win32/socket should use common isc_socket

Move socket type to common isc_socket structure; add isc_sockettype_tls
Windows fixes
2018-10-24 10:52:56 +00:00 · 2018-10-24 10:52:56 +00:00 · 2018-10-24 10:52:37 +00:00 · 2018-10-24 07:10:20 +00:00 · 2018-10-24 07:10:20 +00:00 · 2018-10-24 07:10:20 +00:00
155 changed files with 5355 additions and 7184 deletions
@@ -10,6 +10,7 @@ stages:
  - precheck
  - build
  - test
+  - push

 .centos-centos6-amd64: &centos_centos6_amd64_image
  image: "$CI_REGISTRY_IMAGE:centos-centos6-amd64"
@@ -118,6 +119,8 @@ stages:
    - ./configure --enable-developer --with-libtool --disable-static --with-atf=/usr --prefix=$HOME/.local --without-make-clean $EXTRA_CONFIGURE || cat config.log
    - make -j${PARALLEL_JOBS_BUILD:-1} -k all V=1
  artifacts:
+    paths:
+    - doc/
    expire_in: '1 hour'
    untracked: true

@@ -180,6 +183,29 @@ precheck:debian:sid:amd64:
    expire_in: '1 week'
    when: on_failure

+docs:debian:sid:amd64:
+  <<: *debian_sid_amd64_image
+  stage: test
+  dependencies:
+    - build:debian:sid:amd64
+  script:
+    - make -C doc/misc docbook
+    - make -C doc/arm Bv9ARM.html
+  artifacts:
+    paths:
+    - doc/arm/
+    expire_in: '1 month'
+
+push:docs:
+  <<: *debian_sid_amd64_image
+  stage: push
+  dependencies: []
+  script:
+    - curl -X POST -F token=$GITLAB_PAGES_DOCS_TRIGGER_TOKEN -F ref=master $GITLAB_PAGES_DOCS_TRIGGER_URL
+  only:
+    - master@isc-projects/bind9
+    - /^v9_.*$/@isc-projects/bind9
+
 #build:debian:jessie:amd64:
 #  <<: *debian_jessie_amd64_image
 #  <<: *build_job
@@ -9,6 +9,10 @@ email to [security-officer@isc.org](security-officer@isc.org).

 (Summarize the bug encountered concisely.)

+### BIND version used
+
+(Paste the output of `named -V`.)
+
 ### Steps to reproduce

 (How one can reproduce the issue - this is very important.)
@@ -1,29 +1,31 @@
 ## Release Checklist

- - [ ] Check for the presence of a milestone for the release
-    - If there is a milestone, are all the issues for the milestone resolved? (other than this checklist)
- - [ ] Prepare the sources for tarball generation
- - [ ] Change software version and library versions in configure.in
- - [ ] Update CHANGES
- - [ ] Ensure the release notes are correct for this release
- - [ ] Ensure the metainformation is correct for this release
- - [ ] Make sure the tests are passing
- - [ ] Create a tag (name vX_Y_Z[-alphatag], content BIND X.Y.Z[-alphatag], signed with a developer's GPG key): git tag -u <DEVELOPER_KEYID> -a -s -m "BIND X.Y.Z" vX.Y.Z
- - [ ] Push the changes and tag
- - [ ] Create the tarball
- - [ ] Create the Windows zips
- - [ ] Ask QA to sanity check the tarball and zips
- - [ ] Request the signature on the tarballs
- - [ ] Make tarballs and signatures available to download
- - [ ] Edit the release https://gitlab.isc.org/isc-projects/bind9/tags and the NEWS snippet + links to the tarballs
- - [ ] Update DEB and RPM packages
+ - [ ] (Manager) Check for the presence of a milestone for the release.
+    - If there is a milestone, are all the issues for the milestone resolved? (other than this checklist).
+ - [ ] (Manager) Inform Support/Marketing of impending release (and give estimated release dates).
+ - (SwEng) Prepare the sources for tarball generation.
+   - [ ] Ensure that there are no outstanding merge requests in the private repository (subscription version only).
+   - [ ] Update API files for libraries with new version information.
+   - [ ] Change software version and library versions in configure.in (new major release only).
+   - [ ] Ensure Kyua and ATF files are correct.
+   - [ ] Rebuild configure using autoconf on docs.isc.org.
+   - [ ] Update CHANGES.
+   - [ ] Update CHANGES.SE (subscription branch only).
+   - [ ] Update "version".
+   - [ ] Update "readme.md".
+   - [ ] Ensure the release notes are correct for this release (content, formatting, etc.).
+   - [ ] Build documentation on docs.isc.org.
+   - [ ] Commit changes and make sure the gitlab-ci tests are passing.
+   - [ ] Push the changes and tag ("alphatag" is an optional string such as "b1", "rc1" etc.). (```git tag -u <DEVELOPER_KEYID> -a -s -m "BIND 9.X.Y[alphatag]" v9_X_Y[alphatag]```)
+   - [ ] If this is the first tag for a release (e.g. beta), create a release branch named `release_v9_X_Y` (this allows development to continue on the release branch whilst release engineering continues).
+ - [ ] (SwEng) Run the "make release" Jenkins job to produce the tarballs and zips.
+ - [ ] (SwEng) Ask QA to sanity check the tarball and zips (passing to them the number of the Jenkins job).
+ - [ ] (QA) Sanity check the tarballs.
+ - [ ] (QA) Request the signature on the tarballs.
+ - [ ] (QA) Check signatures on tarballs.
+ - [ ] (QA) Tell Support to handle notification of release.
+ - [ ] (Support) Make tarballs and signatures available to download.
+ - [ ] (Manager) Update [https://wiki.isc.org/bin/view/Main/BindReleaseDates](BIND release dates page) when public announcement has been made.
+ - [ ] (Manager) Inform marketing of the release

-## Communication
-
- - [ ] Inform support to upload to the web site (nice to give them a heads-up in advance)
-       - Write release e-mail to bind9-announce, bind-users in case of a major release
-       - Update tickets in case of waiting support customers
- - [ ] Inform marketing to announce the release
-        - Post short note to Twitter 
-        - Update http://en.wikipedia.org/wiki/BIND (mktg)
-        - Blog post if a major release
+ - [ ] (SwEng) Update DEB and RPM packages
@@ -1,3 +1,37 @@
+5050.	[bug]		The libirs version of getaddrinfo() was unable to parse
+			scoped IPv6 addresses present in /etc/resolv.conf.
+			[GL #187]
+
+5049.	[cleanup]	QNAME minimization has been deeply refactored. [GL #16]
+
+5048.	[func]		Add configure option to enable and enforce FIPS mode
+			in BIND 9. [GL #506]
+
+5047.	[bug]		Messages logged for certain query processing failures
+			now include a more specific error description if it is
+			available. [GL #572]
+
+5046.	[bug]		named could crash during shutdown if an RPZ
+			reload was in progress. [RT #46210]
+
+5045.	[func]		Remove support for DNSSEC algorithms 3 (DSA)
+			and 6 (DSA-NSEC3-SHA1). [GL #22]
+
+5044.	[cleanup]	If "dnssec-enable" is no, then "dnssec-validation"
+			now also defaults to no.  [GL #388]
+
+5043.	[bug]		Fix creating and validating EdDSA signatures. [GL #579]
+
+5042.	[test]		Make the chained delegations in reclimit behave
+			like they would in a regular name server. [GL #578]
+
+5041.	[test]		The chain test contains a incomplete delegation.
+			[GL #568]
+
+5040.	[func]		Extended dnstap so that it can log UPDATE requests
+			and responses as separate message types. Thanks
+			to Greg Rabil. [GL #570]
+
 5039.	[bug]		Named could fail to preserve owner name case of new
 			RRset. [GL #420]

@@ -67,3 +67,34 @@ These are platforms on which BIND is known *not* to build or run:
 * Platforms that don't support IPv6 Advanced Socket API (RFC 3542)
 * Platforms that don't support atomic operations (via compiler or library)
 * Linux without NPTL (Native POSIX Thread Library)
+
+## Platform quirks
+
+### ARM
+
+If the compilation ends with following error:
+
+```
+Error: selected processor does not support `yield' in ARM mode
+```
+
+You will need to set `-march` compiler option to `native`, so the compiler
+recognizes `yield` assembler instruction.  The proper way to set `-march=native`
+would be to put it into `CFLAGS`, e.g. run `./configure` like this:
+`CFLAGS="-march=native -Os -g" ./configure` plus your usual options.
+
+If that doesn't work, you can enforce the minimum CPU and FPU (taken from Debian
+armhf documentation):
+
+* The lowest worthwhile CPU implementation is Armv7-A, therefore the recommended
+  build option is `-march=armv7-a`.
+
+* FPU should be set at VFPv3-D16 as they represent the miminum specification of
+  the processors to support here, therefore the recommended build option is
+  `-mfpu=vfpv3-d16`.
+
+The configure command should look like this:
+
+```
+CFLAGS="-march=armv7-a -mfpu=vfpv3-d16 -Os -g" ./configure
+```
@@ -1330,7 +1330,9 @@ dig +qr www.isc.org any -x 127.0.0.1 isc.org ns +noqr
      reply from the server.
      If you'd like to turn off the IDN support for some reason, use
      parameters <parameter>+noidnin</parameter> and
-      <parameter>+noidnout</parameter>.
+      <parameter>+noidnout</parameter> or define
+      the <envar>IDN_DISABLE</envar> environment variable.
+
    </para>
  </refsection>

@@ -628,8 +628,8 @@ make_empty_lookup(void) {
 	looknew->ttlunits = false;
 	looknew->qr = false;
 #ifdef HAVE_LIBIDN2
-	looknew->idnin = true;
-	looknew->idnout = true;
+	looknew->idnin = (getenv("IDN_DISABLE") == NULL);
+	looknew->idnout = looknew->idnin;
 #else
 	looknew->idnin = false;
 	looknew->idnout = false;
@@ -389,7 +389,7 @@
      <command>host</command> appropriately converts character encoding of
      domain name before sending a request to DNS server or displaying a
      reply from the server.
-      If you'd like to turn off the IDN support for some reason, defines
+      If you'd like to turn off the IDN support for some reason, define
      the <envar>IDN_DISABLE</envar> environment variable.
      The IDN support is disabled if the variable is set when
      <command>host</command> runs.
@@ -478,6 +478,21 @@ nslookup -query=hinfo  -timeout=10
    </para>
  </refsection>

+  <refsection><info><title>IDN SUPPORT</title></info>
+
+    <para>
+      If <command>nslookup</command> has been built with IDN (internationalized
+      domain name) support, it can accept and display non-ASCII domain names.
+      <command>nslookup</command> appropriately converts character encoding of
+      domain name before sending a request to DNS server or displaying a
+      reply from the server.
+      If you'd like to turn off the IDN support for some reason, define
+      the <envar>IDN_DISABLE</envar> environment variable.
+      The IDN support is disabled if the variable is set when
+      <command>nslookup</command> runs.
+    </para>
+  </refsection>
+
  <refsection><info><title>FILES</title></info>

    <para><filename>/etc/resolv.conf</filename>
@@ -793,10 +793,7 @@ create_managers(void) {
 	named_g_udpdisp = 1;
 #else
 	if (named_g_udpdisp == 0) {
-		if (named_g_cpus_detected == 1)
-			named_g_udpdisp = 1;
-		else
-			named_g_udpdisp = named_g_cpus_detected - 1;
+		named_g_udpdisp = named_g_cpus_detected;
 	}
 	if (named_g_udpdisp > named_g_cpus)
 		named_g_udpdisp = named_g_cpus;
@@ -824,14 +821,14 @@ create_managers(void) {
 	}

 	result = isc_socketmgr_create2(named_g_mctx, &named_g_socketmgr,
-				       maxsocks);
+				       maxsocks, named_g_udpdisp);
 	if (result != ISC_R_SUCCESS) {
 		UNEXPECTED_ERROR(__FILE__, __LINE__,
 				 "isc_socketmgr_create() failed: %s",
 				 isc_result_totext(result));
 		return (ISC_R_UNEXPECTED);
 	}
-	isc__socketmgr_maxudp(named_g_socketmgr, maxudp);
+	isc_socketmgr_maxudp(named_g_socketmgr, maxudp);
 	result = isc_socketmgr_getmaxsockets(named_g_socketmgr, &socks);
 	if (result == ISC_R_SUCCESS) {
 		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
@@ -13,7 +13,7 @@

 <refentry xmlns:db="http://docbook.org/ns/docbook" version="5.0" xml:id="man.named.conf">
  <info>
-    <date>2018-06-21</date>
+    <date>2018-09-04</date>
  </info>
  <refentryinfo>
    <corpname>ISC</corpname>
@@ -192,6 +192,7 @@ options {
 	    ] [ dscp <replaceable>integer</replaceable> ];
 	alt-transfer-source-v6 ( <replaceable>ipv6_address</replaceable> | * ) [ port ( <replaceable>integer</replaceable> |
 	    * ) ] [ dscp <replaceable>integer</replaceable> ];
+	answer-cookie <replaceable>boolean</replaceable>;
 	attach-cache <replaceable>string</replaceable>;
 	auth-nxdomain <replaceable>boolean</replaceable>; // default changed
 	auto-dnssec ( allow | maintain | off );
@@ -257,8 +258,8 @@ options {
 	dnssec-secure-to-insecure <replaceable>boolean</replaceable>;
 	dnssec-update-mode ( maintain | no-resign );
 	dnssec-validation ( yes | no | auto );
-	dnstap { ( all | auth | client | forwarder | resolver ) [ ( query |
-	    response ) ]; ... };
+	dnstap { ( all | auth | client | forwarder | resolver | update ) [
+	    ( query | response ) ]; ... };
 	dnstap-identity ( <replaceable>quoted_string</replaceable> | none | hostname );
 	dnstap-output ( file | unix ) <replaceable>quoted_string</replaceable> [ size ( unlimited |
 	    <replaceable>size</replaceable> ) ] [ versions ( unlimited | <replaceable>integer</replaceable> ) ] [ suffix (
@@ -340,6 +341,7 @@ options {
 	min-retry-time <replaceable>integer</replaceable>;
 	minimal-any <replaceable>boolean</replaceable>;
 	minimal-responses ( no-auth | no-auth-recursive | <replaceable>boolean</replaceable> );
+	mirror <replaceable>boolean</replaceable>;
 	multi-master <replaceable>boolean</replaceable>;
 	new-zones-directory <replaceable>quoted_string</replaceable>;
 	no-case-compress { <replaceable>address_match_element</replaceable>; ... };
@@ -609,8 +611,8 @@ view <replaceable>string</replaceable> [ <replaceable>class</replaceable> ] {
 	dnssec-secure-to-insecure <replaceable>boolean</replaceable>;
 	dnssec-update-mode ( maintain | no-resign );
 	dnssec-validation ( yes | no | auto );
-	dnstap { ( all | auth | client | forwarder | resolver ) [ ( query |
-	    response ) ]; ... };
+	dnstap { ( all | auth | client | forwarder | resolver | update ) [
+	    ( query | response ) ]; ... };
 	dual-stack-servers [ port <replaceable>integer</replaceable> ] { ( <replaceable>quoted_string</replaceable> [ port
 	    <replaceable>integer</replaceable> ] [ dscp <replaceable>integer</replaceable> ] | <replaceable>ipv4_address</replaceable> [ port
 	    <replaceable>integer</replaceable> ] [ dscp <replaceable>integer</replaceable> ] | <replaceable>ipv6_address</replaceable> [ port
@@ -671,6 +673,7 @@ view <replaceable>string</replaceable> [ <replaceable>class</replaceable> ] {
 	min-retry-time <replaceable>integer</replaceable>;
 	minimal-any <replaceable>boolean</replaceable>;
 	minimal-responses ( no-auth | no-auth-recursive | <replaceable>boolean</replaceable> );
+	mirror <replaceable>boolean</replaceable>;
 	multi-master <replaceable>boolean</replaceable>;
 	new-zones-directory <replaceable>quoted_string</replaceable>;
 	no-case-compress { <replaceable>address_match_element</replaceable>; ... };
@@ -893,10 +896,10 @@ view <replaceable>string</replaceable> [ <replaceable>class</replaceable> ] {
 		    static-stub | stub );
 		update-check-ksk <replaceable>boolean</replaceable>;
 		update-policy ( local | { ( deny | grant ) <replaceable>string</replaceable> (
-		    6to4-self | external | krb5-self | krb5-subdomain |
-		    ms-self | ms-subdomain | name | self | selfsub |
-		    selfwild | subdomain | tcp-self | wildcard | zonesub )
-		    [ <replaceable>string</replaceable> ] <replaceable>rrtypelist</replaceable>; ... };
+		    6to4-self | external | krb5-self | krb5-selfsub |
+		    krb5-subdomain | ms-self | ms-selfsub | ms-subdomain |
+		    name | self | selfsub | selfwild | subdomain | tcp-self
+		    | wildcard | zonesub ) [ <replaceable>string</replaceable> ] <replaceable>rrtypelist</replaceable>; ... };
 		use-alt-transfer-source <replaceable>boolean</replaceable>;
 		zero-no-soa-ttl <replaceable>boolean</replaceable>;
 		zone-statistics ( full | terse | none | <replaceable>boolean</replaceable> );
@@ -996,9 +999,10 @@ zone <replaceable>string</replaceable> [ <replaceable>class</replaceable> ] {
 	    forward | hint | redirect | static-stub | stub );
 	update-check-ksk <replaceable>boolean</replaceable>;
 	update-policy ( local | { ( deny | grant ) <replaceable>string</replaceable> ( 6to4-self |
-	    external | krb5-self | krb5-subdomain | ms-self | ms-subdomain
-	    | name | self | selfsub | selfwild | subdomain | tcp-self |
-	    wildcard | zonesub ) [ <replaceable>string</replaceable> ] <replaceable>rrtypelist</replaceable>; ... };
+	    external | krb5-self | krb5-selfsub | krb5-subdomain | ms-self
+	    | ms-selfsub | ms-subdomain | name | self | selfsub | selfwild
+	    | subdomain | tcp-self | wildcard | zonesub ) [ <replaceable>string</replaceable> ]
+	    <replaceable>rrtypelist</replaceable>; ... };
 	use-alt-transfer-source <replaceable>boolean</replaceable>;
 	zero-no-soa-ttl <replaceable>boolean</replaceable>;
 	zone-statistics ( full | terse | none | <replaceable>boolean</replaceable> );
@@ -3412,11 +3412,14 @@ configure_dnstap(const cfg_obj_t **maps, dns_view_t *view) {
 			dt |= DNS_DTTYPE_RQ|DNS_DTTYPE_RR;
 		} else if (strcasecmp(str, "forwarder") == 0) {
 			dt |= DNS_DTTYPE_FQ|DNS_DTTYPE_FR;
+		} else if (strcasecmp(str, "update") == 0) {
+			dt |= DNS_DTTYPE_UQ|DNS_DTTYPE_UR;
 		} else if (strcasecmp(str, "all") == 0) {
 			dt |= DNS_DTTYPE_CQ|DNS_DTTYPE_CR|
 			      DNS_DTTYPE_AQ|DNS_DTTYPE_AR|
 			      DNS_DTTYPE_RQ|DNS_DTTYPE_RR|
-			      DNS_DTTYPE_FQ|DNS_DTTYPE_FR;
+			      DNS_DTTYPE_FQ|DNS_DTTYPE_FR|
+			      DNS_DTTYPE_UQ|DNS_DTTYPE_UR;
 		}

 		obj2 = cfg_tuple_get(obj, "mode");
@@ -4064,14 +4067,38 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
 	view->acceptexpired = cfg_obj_asboolean(obj);

 	obj = NULL;
-	result = named_config_get(maps, "dnssec-validation", &obj);
+	result = named_config_get(maps, "dnssec-enable", &obj);
 	INSIST(result == ISC_R_SUCCESS);
-	if (cfg_obj_isboolean(obj)) {
-		view->enablevalidation = cfg_obj_asboolean(obj);
-	} else {
-		/* If dnssec-validation is not boolean, it must be "auto" */
-		view->enablevalidation = true;
-		auto_root = true;
+	view->enablednssec = cfg_obj_asboolean(obj);
+
+	obj = NULL;
+	/* 'optionmaps', not 'maps': don't check named_g_defaults yet */
+	(void)named_config_get(optionmaps, "dnssec-validation", &obj);
+	if (obj == NULL) {
+		/*
+		 * If dnssec-enable is yes, then we default to
+		 * VALIDATION_DEFAULT as set in config.c. Otherwise
+		 * we default to "no".
+		 */
+		if (view->enablednssec) {
+			(void)cfg_map_get(named_g_defaults,
+					  "dnssec-validation", &obj);
+			INSIST(obj != NULL);
+		} else {
+			view->enablevalidation = false;
+		}
+	}
+	if (obj != NULL) {
+		if (cfg_obj_isboolean(obj)) {
+			view->enablevalidation = cfg_obj_asboolean(obj);
+		} else {
+			/*
+			 * If dnssec-validation is set but not boolean,
+			 * then it must be "auto"
+			 */
+			view->enablevalidation = true;
+			auto_root = true;
+		}
 	}

 	obj = NULL;
@@ -5087,11 +5114,6 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
 			view->prefetch_eligible = view->prefetch_trigger + 6;
 	}

-	obj = NULL;
-	result = named_config_get(maps, "dnssec-enable", &obj);
-	INSIST(result == ISC_R_SUCCESS);
-	view->enablednssec = cfg_obj_asboolean(obj);
-
 	obj = NULL;
 	result = named_config_get(optionmaps, "dnssec-lookaside", &obj);
 	if (result == ISC_R_SUCCESS) {
@@ -6742,8 +6764,8 @@ dotat(dns_keytable_t *keytable, dns_keynode_t *keynode, void *arg) {
 	 */
 	domain = dns_fixedname_initname(&fdomain);
 	dns_rdataset_init(&nameservers);
-	result = dns_view_findzonecut(view, origin, domain, 0, 0, true,
-				      true, &nameservers, NULL);
+	result = dns_view_findzonecut(view, origin, domain, NULL, 0, 0,
+				      true, true, &nameservers, NULL);
 	if (result == ISC_R_SUCCESS) {
 		result = dns_resolver_createfetch(view->resolver, tatname,
 						  dns_rdatatype_null, domain,
@@ -8098,7 +8120,7 @@ load_configuration(const char *filename, named_server_t *server,
 			      "less than 128 UDP sockets available after "
 			      "applying 'reserved-sockets' and 'maxsockets'");
 	}
-	isc__socketmgr_setreserved(named_g_socketmgr, reserved);
+	isc_socketmgr_setreserved(named_g_socketmgr, reserved);

 #ifdef HAVE_GEOIP
 	/*
@@ -9221,8 +9243,17 @@ view_loaded(void *arg) {
 			   "forcing zone maintenance");

 		named_os_started();
+
+#ifdef HAVE_FIPS_MODE
 		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-			      NAMED_LOGMODULE_SERVER, ISC_LOG_NOTICE, "running");
+			      NAMED_LOGMODULE_SERVER, ISC_LOG_NOTICE,
+			      "FIPS mode is %s",
+			      FIPS_mode() ? "enabled" : "disabled");
+#endif
+
+		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+			      NAMED_LOGMODULE_SERVER, ISC_LOG_NOTICE,
+			      "running");
 	}

 	return (ISC_R_SUCCESS);
@@ -9288,8 +9319,7 @@ load_zones(named_server_t *server, bool init, bool reconfig) {
 		 * the initial server setup; it isn't necessary during
 		 * a reload.)
 		 */
-		isc_taskmgr_setmode(named_g_taskmgr,
-				    isc_taskmgrmode_privileged);
+		isc_taskmgr_setprivilegedmode(named_g_taskmgr);
 	}

 	isc_task_endexclusive(server->task);
@@ -299,8 +299,7 @@
 	    Takes two arguments: keytype (eihter "zsk" or "ksk") and size.
 	    A default value for this option can be set in algorithm policies
 	    as well as in policy classes or zone policies. If no policy is
-	    configured, the default is 1024 bits for DSA keys and 2048 for
-	    RSA.
+	    configured, the default is 2048 bits for RSA keys.
 	  </para>
 	</listitem>
      </varlistentry>
@@ -32,7 +32,7 @@ class dnskey:

    _ALGNAMES = (None, 'RSAMD5', 'DH', 'DSA', 'ECC', 'RSASHA1',
                 'NSEC3DSA', 'NSEC3RSASHA1', 'RSASHA256', None,
-                 'RSASHA512', None, None, 'ECDSAP256SHA256',
+                 'RSASHA512', None, 'ECCGOST', 'ECDSAP256SHA256',
                 'ECDSAP384SHA384', 'ED25519', 'ED448')

    def __init__(self, key, directory=None, keyttl=None):
@@ -71,7 +71,7 @@ class PolicyLex:
        return t

    def t_ALGNAME(self, t):
-        r'(?i)\b(RSAMD5|DH|DSA|NSEC3DSA|ECC|RSASHA1|NSEC3RSASHA1|RSASHA256|RSASHA512|ECDSAP256SHA256|ECDSAP384SHA384|ED25519|ED448)\b'
+        r'(?i)\b(RSAMD5|DH|ECC|RSASHA1|NSEC3RSASHA1|RSASHA256|RSASHA512|ECDSAP256SHA256|ECDSAP384SHA384|ED25519|ED448)\b'
        t.value = t.value.upper()
        return t

@@ -132,9 +132,7 @@ class Policy:
    keyttl = None
    coverage = None
    directory = None
-    valid_key_sz_per_algo = {'DSA': [512, 1024],
-                             'NSEC3DSA': [512, 1024],
-                             'RSAMD5': [1024, 4096],
+    valid_key_sz_per_algo = {'RSAMD5': [1024, 4096],
                             'RSASHA1': [1024, 4096],
                             'NSEC3RSASHA1': [512, 4096],
                             'RSASHA256': [1024, 4096],
@@ -264,19 +262,6 @@ class Policy:
                    return False, 'ZSK key size %d outside valid range %s' \
                            % (self.zsk_keysize, key_sz_range)

-            # Specific check for DSA keys
-            if self.algorithm in ['DSA', 'NSEC3DSA'] and \
-               self.ksk_keysize % 64 != 0:
-                return False, \
-                        ('KSK key size %d not divisible by 64 ' +
-                         'as required for DSA') % self.ksk_keysize
-
-            if self.algorithm in ['DSA', 'NSEC3DSA'] and \
-               self.zsk_keysize % 64 != 0:
-                return False, \
-                        ('ZSK key size %d not divisible by 64 ' +
-                         'as required for DSA') % self.zsk_keysize
-
            if self.algorithm in ['ECDSAP256SHA256', \
                                  'ECDSAP384SHA384', \
                                  'ED25519', \
@@ -335,16 +320,6 @@ class dnssec_policy:
        p.zsk_keysize = 2048;

        # set default algorithm policies
-        # these need a lower default key size:
-        self.alg_policy['DSA'] = copy(p)
-        self.alg_policy['DSA'].algorithm = "DSA"
-        self.alg_policy['DSA'].name = "DSA"
-        self.alg_policy['DSA'].ksk_keysize = 1024;
-
-        self.alg_policy['NSEC3DSA'] = copy(p)
-        self.alg_policy['NSEC3DSA'].algorithm = "NSEC3DSA"
-        self.alg_policy['NSEC3DSA'].name = "NSEC3DSA"
-        self.alg_policy['NSEC3DSA'].ksk_keysize = 1024;

        # these can use default settings
        self.alg_policy['RSAMD5'] = copy(p)
@@ -25,15 +25,6 @@ class PolicyTest(unittest.TestCase):
        self.assertEqual(p.constructed(), False)
        self.assertEqual(p.validate(), (True, ""))

-        p = pol.policy('good_dsa.test', novalidate=True)
-        self.assertEqual(p.get_name(), "good_dsa.test")
-        self.assertEqual(p.constructed(), False)
-        self.assertEqual(p.validate(), (True, ""))
-
-        p = pol.policy('bad_dsa.test', novalidate=True)
-        self.assertEqual(p.validate(),
-                         (False, 'ZSK key size 769 not divisible by 64 as required for DSA'))
-
    def test_prepublish(self):
        pol = policy.dnssec_policy()
        pol.load('test-policies/02-prepublish.pol')
@@ -1070,11 +1070,14 @@
 	<listitem>
 	  <para>
 	    Enable, disable, or check the current status of
-	    DNSSEC validation.
-	    Note <command>dnssec-enable</command> also needs to be
-	    set to <userinput>yes</userinput> or
-	    <userinput>auto</userinput> to be effective.
-	    It defaults to enabled.
+	    DNSSEC validation.  By default, validation is enabled.
+	    (Note that <command>dnssec-enable</command> must also be
+	    <userinput>yes</userinput> (the default value) for signatures
+	    to be returned along with validated data. If validation is
+	    enabled while <command>dnssec-enable</command> is set to
+	    <userinput>no</userinput>, the server will validate internally,
+	    but will not supply clients with the necessary records to allow
+	    validity to be confirmed.)
 	  </para>
 	</listitem>
      </varlistentry>
@@ -771,7 +771,7 @@ main(int argc, char *argv[]) {
 			if (noexact_zonecut)
 				zcoptions |= DNS_DBFIND_NOEXACT;
 			result = dns_db_findzonecut(db, &name, zcoptions,
-						    0, &node, fname,
+						    0, &node, fname, NULL,
 						    &rdataset, &sigrdataset);
 		} else {
 			result = dns_db_find(db, &name, version, type,
@@ -7,9 +7,10 @@
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.

-@	86400	SOA	ns2.nil. hostmaster.ns2.nil. 0 1 1 1 1
-@	86400	NS 	ns2.nil.
+@	86400	SOA	ns2.domain0.nil. hostmaster.ns2.nil. 0 1 1 1 1
+@	86400	NS 	ns2.domain0.nil.
 ns2	86400	A 	10.53.0.2
+ns2	86400	AAAA    fd92:7065:b8e:ffff::2

@       86400	A 	1.2.3.4
@       86400	AAAA 	1:2:3::4
@@ -27,6 +27,7 @@ status=`expr $status + $ret`
 n=`expr $n + 1`
 echo_i "checking short DNAME from recursive ($n)"
 ret=0
+$RNDCCMD 10.53.0.7 null --- start test$n --- 2>&1 | sed 's/^/ns7 /' | cat_i
 $DIG $DIGOPTS a.short-dname.example @10.53.0.7 a > dig.out.ns4.short || ret=1
 grep "status: NOERROR" dig.out.ns4.short > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
@@ -43,6 +44,7 @@ status=`expr $status + $ret`
 n=`expr $n + 1`
 echo_i "checking long DNAME from recursive ($n)"
 ret=0
+$RNDCCMD 10.53.0.7 null --- start test$n --- 2>&1 | sed 's/^/ns7 /' | cat_i
 $DIG $DIGOPTS a.long-dname.example @10.53.0.7 a > dig.out.ns4.long || ret=1
 grep "status: NOERROR" dig.out.ns4.long > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
@@ -59,6 +61,7 @@ status=`expr $status + $ret`
 n=`expr $n + 1`
 echo_i "checking (too) long DNAME from recursive with cached DNAME ($n)"
 ret=0
+$RNDCCMD 10.53.0.7 null --- start test$n --- 2>&1 | sed 's/^/ns7 /' | cat_i
 $DIG $DIGOPTS 01234567890123456789012345678901234567890123456789.longlonglonglonglonglonglonglonglonglonglonglonglonglonglong.longlonglonglonglonglonglonglonglonglonglonglonglonglonglong.longlonglonglonglonglonglonglonglonglonglonglonglonglonglong.long-dname.example @10.53.0.7 a > dig.out.ns4.cachedtoolong || ret=1
 grep "status: YXDOMAIN" dig.out.ns4.cachedtoolong > /dev/null || ret=1
 grep '^long-dname\.example\..*DNAME.*long' dig.out.ns4.cachedtoolong > /dev/null || ret=1
@@ -68,6 +71,7 @@ status=`expr $status + $ret`
 n=`expr $n + 1`
 echo_i "checking (too) long DNAME from recursive without cached DNAME ($n)"
 ret=0
+$RNDCCMD 10.53.0.7 null --- start test$n --- 2>&1 | sed 's/^/ns7 /' | cat_i
 $DIG $DIGOPTS 01234567890123456789012345678901234567890123456789.longlonglonglonglonglonglonglonglonglonglonglonglonglonglong.longlonglonglonglonglonglonglonglonglonglonglonglonglonglong.longlonglonglonglonglonglonglonglonglonglonglonglonglong.toolong-dname.example @10.53.0.7 a > dig.out.ns4.uncachedtoolong || ret=1
 grep "status: YXDOMAIN" dig.out.ns4.uncachedtoolong > /dev/null || ret=1
 grep '^toolong-dname\.example\..*DNAME.*long' dig.out.ns4.uncachedtoolong > /dev/null || ret=1
@@ -85,6 +89,7 @@ status=`expr $status + $ret`
 n=`expr $n + 1`
 echo_i "checking CNAME to DNAME from recursive"
 ret=0
+$RNDCCMD 10.53.0.7 null --- start test$n --- 2>&1 | sed 's/^/ns7 /' | cat_i
 $DIG $DIGOPTS cname.example @10.53.0.7 a > dig.out.ns4.cname
 grep "status: NOERROR" dig.out.ns4.cname > /dev/null || ret=1
 grep '^cname.example.' dig.out.ns4.cname > /dev/null || ret=1
@@ -97,6 +102,7 @@ status=`expr $status + $ret`
 n=`expr $n + 1`
 echo_i "checking DNAME is returned with synthesized CNAME before DNAME ($n)"
 ret=0
+$RNDCCMD 10.53.0.7 null --- start test$n --- 2>&1 | sed 's/^/ns7 /' | cat_i
 $DIG $DIGOPTS @10.53.0.7 name.synth-then-dname.example.broken A > dig.out.test$n
 grep "status: NXDOMAIN" dig.out.test$n > /dev/null || ret=1
 grep '^name.synth-then-dname\.example\.broken\..*CNAME.*name.$' dig.out.test$n > /dev/null || ret=1
@@ -107,6 +113,7 @@ status=`expr $status + $ret`
 n=`expr $n + 1`
 echo_i "checking DNAME is returned with CNAME to synthesized CNAME before DNAME ($n)"
 ret=0
+$RNDCCMD 10.53.0.7 null --- start test$n --- 2>&1 | sed 's/^/ns7 /' | cat_i
 $DIG $DIGOPTS @10.53.0.7 cname-to-synth2-then-dname.example.broken A > dig.out.test$n
 grep "status: NXDOMAIN" dig.out.test$n > /dev/null || ret=1
 grep '^cname-to-synth2-then-dname\.example\.broken\..*CNAME.*name\.synth2-then-dname\.example\.broken.$' dig.out.test$n > /dev/null || ret=1
@@ -118,6 +125,7 @@ status=`expr $status + $ret`
 n=`expr $n + 1`
 echo_i "checking CNAME loops are detected ($n)"
 ret=0
+$RNDCCMD 10.53.0.7 null --- start test$n --- 2>&1 | sed 's/^/ns7 /' | cat_i
 $DIG $DIGOPTS @10.53.0.7 loop.example > dig.out.test$n
 grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
 grep "ANSWER: 17" dig.out.test$n > /dev/null || ret=1
@@ -127,6 +135,7 @@ status=`expr $status + $ret`
 n=`expr $n + 1`
 echo_i "checking CNAME to external delegated zones is handled ($n)"
 ret=0
+$RNDCCMD 10.53.0.7 null --- start test$n --- 2>&1 | sed 's/^/ns7 /' | cat_i
 $DIG $DIGOPTS @10.53.0.7 a.example > dig.out.test$n
 grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
 grep "ANSWER: 2" dig.out.test$n > /dev/null || ret=1
@@ -136,6 +145,7 @@ status=`expr $status + $ret`
 n=`expr $n + 1`
 echo_i "checking CNAME to internal delegated zones is handled ($n)"
 ret=0
+$RNDCCMD 10.53.0.7 null --- start test$n --- 2>&1 | sed 's/^/ns7 /' | cat_i
 $DIG $DIGOPTS @10.53.0.7 b.example > dig.out.test$n
 grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
 grep "ANSWER: 2" dig.out.test$n > /dev/null || ret=1
@@ -145,6 +155,7 @@ status=`expr $status + $ret`
 n=`expr $n + 1`
 echo_i "checking CNAME to signed external delgation is handled ($n)"
 ret=0
+$RNDCCMD 10.53.0.7 null --- start test$n --- 2>&1 | sed 's/^/ns7 /' | cat_i
 $DIG $DIGOPTS @10.53.0.7 c.example > dig.out.$n
 grep "status: NOERROR" dig.out.$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i " failed"; fi
@@ -153,6 +164,7 @@ status=`expr $status + $ret`
 n=`expr $n + 1`
 echo_i "checking CNAME to signed internal delgation is handled ($n)"
 ret=0
+$RNDCCMD 10.53.0.7 null --- start test$n --- 2>&1 | sed 's/^/ns7 /' | cat_i
 $DIG $DIGOPTS @10.53.0.7 d.example > dig.out.$n
 grep "status: NOERROR" dig.out.$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i " failed"; fi
@@ -161,30 +173,36 @@ status=`expr $status + $ret`
 n=`expr $n + 1`
 echo_i "checking CNAME chains in various orders ($n)"
 ret=0
+$RNDCCMD 10.53.0.7 null --- start test$n - step 1 --- 2>&1 | sed 's/^/ns7 /' | cat_i
 echo "cname,cname,cname|1,2,3,4,s1,s2,s3,s4" | $SEND
 $DIG $DIGOPTS @10.53.0.7 test.domain.nil > dig.out.1.$n 2>&1
 grep 'status: NOERROR' dig.out.1.$n > /dev/null 2>&1 || ret=1
 grep 'ANSWER: 2' dig.out.1.$n > /dev/null 2>&1 || ret=1
+$RNDCCMD 10.53.0.7 null --- start test$n - step 2 --- 2>&1 | sed 's/^/ns7 /' | cat_i
 $RNDCCMD 10.53.0.7 flush 2>&1 | sed 's/^/ns7 /' | cat_i
 echo "cname,cname,cname|1,1,2,2,3,4,s4,s3,s1" | $SEND
 $DIG $DIGOPTS @10.53.0.7 test.domain.nil > dig.out.2.$n 2>&1
 grep 'status: NOERROR' dig.out.2.$n > /dev/null 2>&1 || ret=1
 grep 'ANSWER: 2' dig.out.2.$n > /dev/null 2>&1 || ret=1
+$RNDCCMD 10.53.0.7 null --- start test$n - step 3 --- 2>&1 | sed 's/^/ns7 /' | cat_i
 $RNDCCMD 10.53.0.7 flush 2>&1 | sed 's/^/ns7 /' | cat_i
 echo "cname,cname,cname|2,1,3,4,s3,s1,s2,s4" | $SEND
 $DIG $DIGOPTS @10.53.0.7 test.domain.nil > dig.out.3.$n 2>&1
 grep 'status: NOERROR' dig.out.3.$n > /dev/null 2>&1 || ret=1
 grep 'ANSWER: 2' dig.out.3.$n > /dev/null 2>&1 || ret=1
+$RNDCCMD 10.53.0.7 null --- start test$n - step 4 --- 2>&1 | sed 's/^/ns7 /' | cat_i
 $RNDCCMD 10.53.0.7 flush 2>&1 | sed 's/^/ns7 /' | cat_i
 echo "cname,cname,cname|4,3,2,1,s4,s3,s2,s1" | $SEND
 $DIG $DIGOPTS @10.53.0.7 test.domain.nil > dig.out.4.$n 2>&1
 grep 'status: NOERROR' dig.out.4.$n > /dev/null 2>&1 || ret=1
 grep 'ANSWER: 2' dig.out.4.$n > /dev/null 2>&1 || ret=1
 echo "cname,cname,cname|4,3,2,1,s4,s3,s2,s1" | $SEND
+$RNDCCMD 10.53.0.7 null --- start test$n - step 5 --- 2>&1 | sed 's/^/ns7 /' | cat_i
 $RNDCCMD 10.53.0.7 flush 2>&1 | sed 's/^/ns7 /' | cat_i
 $DIG $DIGOPTS @10.53.0.7 test.domain.nil > dig.out.5.$n 2>&1
 grep 'status: NOERROR' dig.out.5.$n > /dev/null 2>&1 || ret=1
 grep 'ANSWER: 2' dig.out.5.$n > /dev/null 2>&1 || ret=1
+$RNDCCMD 10.53.0.7 null --- start test$n - step 6 --- 2>&1 | sed 's/^/ns7 /' | cat_i
 $RNDCCMD 10.53.0.7 flush 2>&1 | sed 's/^/ns7 /' | cat_i
 echo "cname,cname,cname|4,3,3,3,s1,s1,1,3,4" | $SEND
 $DIG $DIGOPTS @10.53.0.7 test.domain.nil > dig.out.6.$n 2>&1
@@ -198,6 +216,7 @@ echo_i "checking that only the initial CNAME is cached ($n)"
 ret=0
 $RNDCCMD 10.53.0.7 flush 2>&1 | sed 's/^/ns7 /' | cat_i
 echo "cname,cname,cname|1,2,3,4,s1,s2,s3,s4" | $SEND
+$RNDCCMD 10.53.0.7 null --- start test$n --- 2>&1 | sed 's/^/ns7 /' | cat_i
 $DIG $DIGOPTS @10.53.0.7 test.domain.nil > dig.out.1.$n 2>&1
 sleep 1
 $DIG $DIGOPTS +noall +answer @10.53.0.7 cname1.domain.nil > dig.out.2.$n 2>&1
@@ -209,16 +228,19 @@ status=`expr $status + $ret`
 n=`expr $n + 1`
 echo_i "checking DNAME chains in various orders ($n)"
 ret=0
+$RNDCCMD 10.53.0.7 null --- start test$n - step 1 --- 2>&1 | sed 's/^/ns7 /' | cat_i
 $RNDCCMD 10.53.0.7 flush 2>&1 | sed 's/^/ns7 /' | cat_i
 echo "dname,dname|5,4,3,2,1,s5,s4,s3,s2,s1" | $SEND
 $DIG $DIGOPTS @10.53.0.7 test.domain.nil > dig.out.1.$n 2>&1
 grep 'status: NOERROR' dig.out.1.$n > /dev/null 2>&1 || ret=1
 grep 'ANSWER: 3' dig.out.1.$n > /dev/null 2>&1 || ret=1
+$RNDCCMD 10.53.0.7 null --- start test$n - step 2 --- 2>&1 | sed 's/^/ns7 /' | cat_i
 $RNDCCMD 10.53.0.7 flush 2>&1 | sed 's/^/ns7 /' | cat_i
 echo "dname,dname|5,4,3,2,1,s5,s4,s3,s2,s1" | $SEND
 $DIG $DIGOPTS @10.53.0.7 test.domain.nil > dig.out.2.$n 2>&1
 grep 'status: NOERROR' dig.out.2.$n > /dev/null 2>&1 || ret=1
 grep 'ANSWER: 3' dig.out.2.$n > /dev/null 2>&1 || ret=1
+$RNDCCMD 10.53.0.7 null --- start test$n - step 3 --- 2>&1 | sed 's/^/ns7 /' | cat_i
 $RNDCCMD 10.53.0.7 flush 2>&1 | sed 's/^/ns7 /' | cat_i
 echo "dname,dname|2,3,s1,s2,s3,s4,1" | $SEND
 $DIG $DIGOPTS @10.53.0.7 test.domain.nil > dig.out.3.$n 2>&1
@@ -231,15 +253,18 @@ status=`expr $status + $ret`
 n=`expr $n + 1`
 echo_i "checking external CNAME/DNAME chains in various orders ($n)"
 ret=0
+$RNDCCMD 10.53.0.7 null --- start test$n - step 1 --- 2>&1 | sed 's/^/ns7 /' | cat_i
 echo "xname,dname|1,2,3,4,s1,s2,s3,s4" | $SEND
 $DIG $DIGOPTS @10.53.0.7 test.domain.nil > dig.out.1.$n 2>&1
 grep 'status: NOERROR' dig.out.1.$n > /dev/null 2>&1 || ret=1
 grep 'ANSWER: 2' dig.out.1.$n > /dev/null 2>&1 || ret=1
+$RNDCCMD 10.53.0.7 null --- start test$n - step 2 --- 2>&1 | sed 's/^/ns7 /' | cat_i
 $RNDCCMD 10.53.0.7 flush 2>&1 | sed 's/^/ns7 /' | cat_i
 echo "xname,dname|s2,2,s1,1,4,s4,3" | $SEND
 $DIG $DIGOPTS @10.53.0.7 test.domain.nil > dig.out.2.$n 2>&1
 grep 'status: NOERROR' dig.out.2.$n > /dev/null 2>&1 || ret=1
 grep 'ANSWER: 2' dig.out.2.$n > /dev/null 2>&1 || ret=1
+$RNDCCMD 10.53.0.7 null --- start test$n - step 3 --- 2>&1 | sed 's/^/ns7 /' | cat_i
 $RNDCCMD 10.53.0.7 flush 2>&1 | sed 's/^/ns7 /' | cat_i
 echo "xname,dname|s2,2,2,2" | $SEND
 $DIG $DIGOPTS @10.53.0.7 test.domain.nil > dig.out.3.$n 2>&1
@@ -251,6 +276,7 @@ status=`expr $status + $ret`
 n=`expr $n + 1`
 echo_i "checking explicit DNAME query ($n)"
 ret=0
+$RNDCCMD 10.53.0.7 null --- start test$n --- 2>&1 | sed 's/^/ns7 /' | cat_i
 $DIG $DIGOPTS @10.53.0.7 dname short-dname.example > dig.out.7.$n 2>&1
 grep 'status: NOERROR' dig.out.7.$n > /dev/null 2>&1 || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
@@ -259,6 +285,7 @@ status=`expr $status + $ret`
 n=`expr $n + 1`
 echo_i "checking DNAME via ANY query ($n)"
 ret=0
+$RNDCCMD 10.53.0.7 null --- start test$n --- 2>&1 | sed 's/^/ns7 /' | cat_i
 $RNDCCMD 10.53.0.7 flush 2>&1 | sed 's/^/ns7 /' | cat_i
 $DIG $DIGOPTS @10.53.0.7 any short-dname.example > dig.out.7.$n 2>&1
 grep 'status: NOERROR' dig.out.7.$n > /dev/null 2>&1 || ret=1
@@ -20,6 +20,11 @@ TOP=${SYSTEMTESTTOP:=.}/../../..
 # Make it absolute so that it continues to work after we cd.
 TOP=`cd $TOP && pwd`

+# Default algorithm for testing
+DEFAULT_ALGORITHM=ECDSAP256SHA256
+DEFAULT_ALGORITHM_NUMBER=13
+DEFAULT_BITS=256
+
 ARPANAME=$TOP/bin/tools/arpaname
 CDS=$TOP/bin/dnssec/dnssec-cds
 CHECKCONF=$TOP/bin/check/named-checkconf
@@ -378,7 +383,11 @@ copy_setports() {
        -e "s/@EXTRAPORT6@/${EXTRAPORT6}/g" \
        -e "s/@EXTRAPORT7@/${EXTRAPORT7}/g" \
        -e "s/@EXTRAPORT8@/${EXTRAPORT8}/g" \
-        -e "s/@CONTROLPORT@/${CONTROLPORT}/g" $1 > $2
+        -e "s/@CONTROLPORT@/${CONTROLPORT}/g" \
+	-e "s/@DEFAULT_ALGORITHM@/${DEFAULT_ALGORITHM}/g" \
+	-e "s/@DEFAULT_ALGORITHM_NUMBER@/${DEFAULT_ALGORITHM_NUMBER}/g" \
+	-e "s/@DEFAULT_BITS@/${DEFAULT_BITS}/g" \
+	$1 > $2
 }

 #
@@ -26,6 +26,11 @@ TOP=`cd $TOP && pwd`
 # Visual Studio build configurations are Release and Debug
 VSCONF=Debug

+# Default algorithm for testing
+DEFAULT_ALGORITHM=ECDSAP256SHA256
+DEFAULT_ALGORITHM_NUMBER=13
+DEFAULT_BITS=256
+
 ARPANAME=$TOP/Build/$VSCONF/arpaname@EXEEXT@
 CHECKCONF=$TOP/Build/$VSCONF/named-checkconf@EXEEXT@
 CHECKDS="$PYTHON `cygpath -w $TOP/bin/python/dnssec-checkds.py`"
@@ -361,7 +366,11 @@ copy_setports() {
        -e "s/${atsign}EXTRAPORT6${atsign}/${EXTRAPORT6}/g" \
        -e "s/${atsign}EXTRAPORT7${atsign}/${EXTRAPORT7}/g" \
        -e "s/${atsign}EXTRAPORT8${atsign}/${EXTRAPORT8}/g" \
-        -e "s/${atsign}CONTROLPORT${atsign}/${CONTROLPORT}/g" $1 > $2
+        -e "s/${atsign}CONTROLPORT${atsign}/${CONTROLPORT}/g" \
+	-e "s/${atsign}DEFAULT_ALGORITM${atsign}/${DEFAULT_ALGORITHM}/g" \
+	-e "s/${atsign}DEFAULT_ALGORITHM_NUMBER${atsign}/${DEFAULT_ALGORITHM_NUMBER}/g" \
+	-e "s/${atsign}DEFAULT_BITS${atsign}/${DEFAULT_BITS}/g" \
+	$1 > $2
 }

 #
@@ -23,8 +23,8 @@ infile=root.db.in
 zonefile=root.db
 outfile=root.signed

-keyname1=`$KEYGEN -a DSA -b 768 -n zone $zone 2> /dev/null` 
-keyname2=`$KEYGEN -f KSK -a DSA -b 768 -n zone $zone 2> /dev/null`
+keyname1=`$KEYGEN -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone 2> /dev/null`
+keyname2=`$KEYGEN -f KSK -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone 2> /dev/null`

 cat $infile $keyname1.key $keyname2.key >$zonefile

@@ -24,8 +24,8 @@ zonefile=druz.db
 outfile=druz.pre
 dlvzone=utld.

-keyname1=`$KEYGEN -a DSA -b 768 -n zone $zone 2> /dev/null` 
-keyname2=`$KEYGEN -f KSK -a DSA -b 768 -n zone $zone 2> /dev/null`
+keyname1=`$KEYGEN -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone 2> /dev/null`
+keyname2=`$KEYGEN -f KSK -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone 2> /dev/null`

 cat $infile $keyname1.key $keyname2.key >$zonefile

@@ -26,8 +26,8 @@ zonefile=child1.utld.db
 outfile=child1.signed
 dlvsets="$dlvsets dlvset-`echo $zone |sed -e "s/.$//g"`$TP"

-keyname1=`$KEYGEN -a DSA -b 768 -n zone $zone 2> /dev/null` 
-keyname2=`$KEYGEN -f KSK -a DSA -b 768 -n zone $zone 2> /dev/null`
+keyname1=`$KEYGEN -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone 2> /dev/null`
+keyname2=`$KEYGEN -f KSK -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone 2> /dev/null`

 dsfilename=../ns6/dsset-grand.`echo $zone |sed -e "s/\.$//g"`$TP
 cat $infile $keyname1.key $keyname2.key $dsfilename >$zonefile
@@ -42,8 +42,8 @@ zonefile=child3.utld.db
 outfile=child3.signed
 dlvsets="$dlvsets dlvset-`echo $zone |sed -e "s/.$//g"`$TP"

-keyname1=`$KEYGEN -a DSA -b 768 -n zone $zone 2> /dev/null`
-keyname2=`$KEYGEN -f KSK -a DSA -b 768 -n zone $zone 2> /dev/null`
+keyname1=`$KEYGEN -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone 2> /dev/null`
+keyname2=`$KEYGEN -f KSK -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone 2> /dev/null`

 dsfilename=../ns6/dsset-grand.`echo $zone |sed -e "s/\.$//g"`$TP
 cat $infile $keyname1.key $keyname2.key $dsfilename >$zonefile
@@ -58,8 +58,8 @@ zonefile=child4.utld.db
 outfile=child4.signed
 dlvsets="$dlvsets dlvset-`echo $zone |sed -e "s/.$//g"`$TP"

-keyname1=`$KEYGEN -a DSA -b 768 -n zone $zone 2> /dev/null`
-keyname2=`$KEYGEN -f KSK -a DSA -b 768 -n zone $zone 2> /dev/null`
+keyname1=`$KEYGEN -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone 2> /dev/null`
+keyname2=`$KEYGEN -f KSK -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone 2> /dev/null`

 cat $infile $keyname1.key $keyname2.key >$zonefile

@@ -73,8 +73,8 @@ zonefile=child5.utld.db
 outfile=child5.signed
 dlvsets="$dlvsets dlvset-`echo $zone |sed -e "s/.$//g"`$TP"

-keyname1=`$KEYGEN -a DSA -b 768 -n zone $zone 2> /dev/null`
-keyname2=`$KEYGEN -f KSK -a DSA -b 768 -n zone $zone 2> /dev/null`
+keyname1=`$KEYGEN -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone 2> /dev/null`
+keyname2=`$KEYGEN -f KSK -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone 2> /dev/null`

 dsfilename=../ns6/dsset-grand.`echo $zone |sed -e "s/\.$//g"`$TP
 cat $infile $keyname1.key $keyname2.key $dsfilename >$zonefile
@@ -88,8 +88,8 @@ infile=child.db.in
 zonefile=child7.utld.db
 outfile=child7.signed

-keyname1=`$KEYGEN -a DSA -b 768 -n zone $zone 2> /dev/null`
-keyname2=`$KEYGEN -f KSK -a DSA -b 768 -n zone $zone 2> /dev/null`
+keyname1=`$KEYGEN -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone 2> /dev/null`
+keyname2=`$KEYGEN -f KSK -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone 2> /dev/null`

 dsfilename=../ns6/dsset-grand.`echo $zone |sed -e "s/\.$//g"`$TP
 cat $infile $keyname1.key $keyname2.key $dsfilename >$zonefile
@@ -103,8 +103,8 @@ infile=child.db.in
 zonefile=child8.utld.db
 outfile=child8.signed

-keyname1=`$KEYGEN -a DSA -b 768 -n zone $zone 2> /dev/null`
-keyname2=`$KEYGEN -f KSK -a DSA -b 768 -n zone $zone 2> /dev/null`
+keyname1=`$KEYGEN -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone 2> /dev/null`
+keyname2=`$KEYGEN -f KSK -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone 2> /dev/null`

 cat $infile $keyname1.key $keyname2.key >$zonefile

@@ -118,8 +118,8 @@ zonefile=child9.utld.db
 outfile=child9.signed
 dlvsets="$dlvsets dlvset-`echo $zone |sed -e "s/.$//g"`$TP"

-keyname1=`$KEYGEN -a DSA -b 768 -n zone $zone 2> /dev/null`
-keyname2=`$KEYGEN -f KSK -a DSA -b 768 -n zone $zone 2> /dev/null`
+keyname1=`$KEYGEN -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone 2> /dev/null`
+keyname2=`$KEYGEN -f KSK -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone 2> /dev/null`

 cat $infile $keyname1.key $keyname2.key >$zonefile

@@ -132,8 +132,8 @@ zonefile=child10.utld.db
 outfile=child10.signed
 dlvsets="$dlvsets dlvset-`echo $zone |sed -e "s/.$//g"`$TP"

-keyname1=`$KEYGEN -a DSA -b 768 -n zone $zone 2> /dev/null`
-keyname2=`$KEYGEN -f KSK -a DSA -b 768 -n zone $zone 2> /dev/null`
+keyname1=`$KEYGEN -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone 2> /dev/null`
+keyname2=`$KEYGEN -f KSK -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone 2> /dev/null`

 cat $infile $keyname1.key $keyname2.key >$zonefile

@@ -147,8 +147,8 @@ outfile=child1.druz.signed
 dlvsets="$dlvsets dlvset-`echo $zone |sed -e "s/.$//g"`$TP"
 dssets="$dssets dsset-`echo $zone |sed -e "s/.$//g"`$TP"

-keyname1=`$KEYGEN -a DSA -b 768 -n zone $zone 2> /dev/null` 
-keyname2=`$KEYGEN -f KSK -a DSA -b 768 -n zone $zone 2> /dev/null`
+keyname1=`$KEYGEN -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone 2> /dev/null`
+keyname2=`$KEYGEN -f KSK -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone 2> /dev/null`

 dsfilename=../ns6/dsset-grand.`echo $zone |sed -e "s/\.$//g"`$TP
 cat $infile $keyname1.key $keyname2.key $dsfilename >$zonefile
@@ -164,8 +164,8 @@ outfile=child3.druz.signed
 dlvsets="$dlvsets dlvset-`echo $zone |sed -e "s/.$//g"`$TP"
 dssets="$dssets dsset-`echo $zone |sed -e "s/.$//g"`$TP"

-keyname1=`$KEYGEN -a DSA -b 768 -n zone $zone 2> /dev/null`
-keyname2=`$KEYGEN -f KSK -a DSA -b 768 -n zone $zone 2> /dev/null`
+keyname1=`$KEYGEN -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone 2> /dev/null`
+keyname2=`$KEYGEN -f KSK -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone 2> /dev/null`

 dsfilename=../ns6/dsset-grand.`echo $zone |sed -e "s/\.$//g"`$TP
 cat $infile $keyname1.key $keyname2.key $dsfilename >$zonefile
@@ -181,8 +181,8 @@ outfile=child4.druz.signed
 dlvsets="$dlvsets dlvset-`echo $zone |sed -e "s/.$//g"`$TP"
 dssets="$dssets dsset-`echo $zone |sed -e "s/.$//g"`$TP"

-keyname1=`$KEYGEN -a DSA -b 768 -n zone $zone 2> /dev/null`
-keyname2=`$KEYGEN -f KSK -a DSA -b 768 -n zone $zone 2> /dev/null`
+keyname1=`$KEYGEN -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone 2> /dev/null`
+keyname2=`$KEYGEN -f KSK -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone 2> /dev/null`

 cat $infile $keyname1.key $keyname2.key >$zonefile

@@ -197,8 +197,8 @@ outfile=child5.druz.signed
 dlvsets="$dlvsets dlvset-`echo $zone |sed -e "s/.$//g"`$TP"
 dssets="$dssets dsset-`echo $zone |sed -e "s/.$//g"`$TP"

-keyname1=`$KEYGEN -a DSA -b 768 -n zone $zone 2> /dev/null`
-keyname2=`$KEYGEN -f KSK -a DSA -b 768 -n zone $zone 2> /dev/null`
+keyname1=`$KEYGEN -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone 2> /dev/null`
+keyname2=`$KEYGEN -f KSK -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone 2> /dev/null`

 dsfilename=../ns6/dsset-grand.`echo $zone |sed -e "s/\.$//g"`$TP
 cat $infile $keyname1.key $keyname2.key $dsfilename >$zonefile
@@ -213,8 +213,8 @@ zonefile=child7.druz.db
 outfile=child7.druz.signed
 dssets="$dssets dsset-`echo $zone |sed -e "s/.$//g"`$TP"

-keyname1=`$KEYGEN -a DSA -b 768 -n zone $zone 2> /dev/null`
-keyname2=`$KEYGEN -f KSK -a DSA -b 768 -n zone $zone 2> /dev/null`
+keyname1=`$KEYGEN -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone 2> /dev/null`
+keyname2=`$KEYGEN -f KSK -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone 2> /dev/null`

 dsfilename=../ns6/dsset-grand.`echo $zone |sed -e "s/\.$//g"`$TP
 cat $infile $keyname1.key $keyname2.key $dsfilename >$zonefile
@@ -228,8 +228,8 @@ infile=child.db.in
 zonefile=child8.druz.db
 outfile=child8.druz.signed

-keyname1=`$KEYGEN -a DSA -b 768 -n zone $zone 2> /dev/null`
-keyname2=`$KEYGEN -f KSK -a DSA -b 768 -n zone $zone 2> /dev/null`
+keyname1=`$KEYGEN -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone 2> /dev/null`
+keyname2=`$KEYGEN -f KSK -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone 2> /dev/null`

 cat $infile $keyname1.key $keyname2.key >$zonefile

@@ -243,8 +243,8 @@ zonefile=child9.druz.db
 outfile=child9.druz.signed
 dlvsets="$dlvsets dlvset-`echo $zone |sed -e "s/.$//g"`$TP"

-keyname1=`$KEYGEN -a DSA -b 768 -n zone $zone 2> /dev/null`
-keyname2=`$KEYGEN -f KSK -a DSA -b 768 -n zone $zone 2> /dev/null`
+keyname1=`$KEYGEN -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone 2> /dev/null`
+keyname2=`$KEYGEN -f KSK -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone 2> /dev/null`

 cat $infile $keyname1.key $keyname2.key >$zonefile

@@ -258,8 +258,8 @@ outfile=child10.druz.signed
 dlvsets="$dlvsets dlvset-`echo $zone |sed -e "s/.$//g"`$TP"
 dssets="$dssets dsset-`echo $zone |sed -e "s/.$//g"`$TP"

-keyname1=`$KEYGEN -a DSA -b 768 -n zone $zone 2> /dev/null`
-keyname2=`$KEYGEN -f KSK -a DSA -b 768 -n zone $zone 2> /dev/null`
+keyname1=`$KEYGEN -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone 2> /dev/null`
+keyname2=`$KEYGEN -f KSK -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone 2> /dev/null`

 cat $infile $keyname1.key $keyname2.key >$zonefile

@@ -272,8 +272,8 @@ infile=dlv.db.in
 zonefile=dlv.utld.db
 outfile=dlv.signed

-keyname1=`$KEYGEN -a DSA -b 768 -n zone $zone 2> /dev/null`
-keyname2=`$KEYGEN -f KSK -a DSA -b 768 -n zone $zone 2> /dev/null`
+keyname1=`$KEYGEN -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone 2> /dev/null`
+keyname2=`$KEYGEN -f KSK -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone 2> /dev/null`

 cat $infile $dlvsets $keyname1.key $keyname2.key >$zonefile

@@ -21,8 +21,8 @@ infile=child.db.in
 zonefile=grand.child1.utld.db
 outfile=grand.child1.signed

-keyname1=`$KEYGEN -a DSA -b 768 -n zone $zone 2> /dev/null`
-keyname2=`$KEYGEN -f KSK -a DSA -b 768 -n zone $zone 2> /dev/null`
+keyname1=`$KEYGEN -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone 2> /dev/null`
+keyname2=`$KEYGEN -f KSK -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone 2> /dev/null`

 cat $infile $keyname1.key $keyname2.key >$zonefile

@@ -36,8 +36,8 @@ zonefile=grand.child3.utld.db
 outfile=grand.child3.signed
 dlvzone=dlv.utld.

-keyname1=`$KEYGEN -a DSA -b 768 -n zone $zone 2> /dev/null`
-keyname2=`$KEYGEN -f KSK -a DSA -b 768 -n zone $zone 2> /dev/null`
+keyname1=`$KEYGEN -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone 2> /dev/null`
+keyname2=`$KEYGEN -f KSK -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone 2> /dev/null`

 cat $infile $keyname1.key $keyname2.key >$zonefile

@@ -51,8 +51,8 @@ zonefile=grand.child4.utld.db
 outfile=grand.child4.signed
 dlvzone=dlv.utld.

-keyname1=`$KEYGEN -a DSA -b 768 -n zone $zone 2> /dev/null`
-keyname2=`$KEYGEN -f KSK -a DSA -b 768 -n zone $zone 2> /dev/null`
+keyname1=`$KEYGEN -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone 2> /dev/null`
+keyname2=`$KEYGEN -f KSK -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone 2> /dev/null`

 cat $infile $keyname1.key $keyname2.key >$zonefile

@@ -66,8 +66,8 @@ zonefile=grand.child5.utld.db
 outfile=grand.child5.signed
 dlvzone=dlv.utld.

-keyname1=`$KEYGEN -a DSA -b 768 -n zone $zone 2> /dev/null`
-keyname2=`$KEYGEN -f KSK -a DSA -b 768 -n zone $zone 2> /dev/null`
+keyname1=`$KEYGEN -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone 2> /dev/null`
+keyname2=`$KEYGEN -f KSK -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone 2> /dev/null`

 cat $infile $keyname1.key $keyname2.key >$zonefile

@@ -81,8 +81,8 @@ zonefile=grand.child7.utld.db
 outfile=grand.child7.signed
 dlvzone=dlv.utld.

-keyname1=`$KEYGEN -a DSA -b 768 -n zone $zone 2> /dev/null`
-keyname2=`$KEYGEN -f KSK -a DSA -b 768 -n zone $zone 2> /dev/null`
+keyname1=`$KEYGEN -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone 2> /dev/null`
+keyname2=`$KEYGEN -f KSK -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone 2> /dev/null`

 cat $infile $keyname1.key $keyname2.key >$zonefile

@@ -96,8 +96,8 @@ zonefile=grand.child8.utld.db
 outfile=grand.child8.signed
 dlvzone=dlv.utld.

-keyname1=`$KEYGEN -a DSA -b 768 -n zone $zone 2> /dev/null`
-keyname2=`$KEYGEN -f KSK -a DSA -b 768 -n zone $zone 2> /dev/null`
+keyname1=`$KEYGEN -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone 2> /dev/null`
+keyname2=`$KEYGEN -f KSK -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone 2> /dev/null`

 cat $infile $keyname1.key $keyname2.key >$zonefile

@@ -111,8 +111,8 @@ zonefile=grand.child9.utld.db
 outfile=grand.child9.signed
 dlvzone=dlv.utld.

-keyname1=`$KEYGEN -a DSA -b 768 -n zone $zone 2> /dev/null`
-keyname2=`$KEYGEN -f KSK -a DSA -b 768 -n zone $zone 2> /dev/null`
+keyname1=`$KEYGEN -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone 2> /dev/null`
+keyname2=`$KEYGEN -f KSK -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone 2> /dev/null`

 cat $infile $keyname1.key $keyname2.key >$zonefile

@@ -125,8 +125,8 @@ zonefile=grand.child10.utld.db
 outfile=grand.child10.signed
 dlvzone=dlv.utld.

-keyname1=`$KEYGEN -a DSA -b 768 -n zone $zone 2> /dev/null`
-keyname2=`$KEYGEN -f KSK -a DSA -b 768 -n zone $zone 2> /dev/null`
+keyname1=`$KEYGEN -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone 2> /dev/null`
+keyname2=`$KEYGEN -f KSK -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone 2> /dev/null`

 cat $infile $keyname1.key $keyname2.key >$zonefile

@@ -138,8 +138,8 @@ infile=child.db.in
 zonefile=grand.child1.druz.db
 outfile=grand.child1.druz.signed

-keyname1=`$KEYGEN -a DSA -b 768 -n zone $zone 2> /dev/null`
-keyname2=`$KEYGEN -f KSK -a DSA -b 768 -n zone $zone 2> /dev/null`
+keyname1=`$KEYGEN -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone 2> /dev/null`
+keyname2=`$KEYGEN -f KSK -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone 2> /dev/null`

 cat $infile $keyname1.key $keyname2.key >$zonefile

@@ -153,8 +153,8 @@ zonefile=grand.child3.druz.db
 outfile=grand.child3.druz.signed
 dlvzone=dlv.druz.

-keyname1=`$KEYGEN -a DSA -b 768 -n zone $zone 2> /dev/null`
-keyname2=`$KEYGEN -f KSK -a DSA -b 768 -n zone $zone 2> /dev/null`
+keyname1=`$KEYGEN -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone 2> /dev/null`
+keyname2=`$KEYGEN -f KSK -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone 2> /dev/null`

 cat $infile $keyname1.key $keyname2.key >$zonefile

@@ -168,8 +168,8 @@ zonefile=grand.child4.druz.db
 outfile=grand.child4.druz.signed
 dlvzone=dlv.druz.

-keyname1=`$KEYGEN -a DSA -b 768 -n zone $zone 2> /dev/null`
-keyname2=`$KEYGEN -f KSK -a DSA -b 768 -n zone $zone 2> /dev/null`
+keyname1=`$KEYGEN -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone 2> /dev/null`
+keyname2=`$KEYGEN -f KSK -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone 2> /dev/null`

 cat $infile $keyname1.key $keyname2.key >$zonefile

@@ -183,8 +183,8 @@ zonefile=grand.child5.druz.db
 outfile=grand.child5.druz.signed
 dlvzone=dlv.druz.

-keyname1=`$KEYGEN -a DSA -b 768 -n zone $zone 2> /dev/null`
-keyname2=`$KEYGEN -f KSK -a DSA -b 768 -n zone $zone 2> /dev/null`
+keyname1=`$KEYGEN -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone 2> /dev/null`
+keyname2=`$KEYGEN -f KSK -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone 2> /dev/null`

 cat $infile $keyname1.key $keyname2.key >$zonefile

@@ -198,8 +198,8 @@ zonefile=grand.child7.druz.db
 outfile=grand.child7.druz.signed
 dlvzone=dlv.druz.

-keyname1=`$KEYGEN -a DSA -b 768 -n zone $zone 2> /dev/null`
-keyname2=`$KEYGEN -f KSK -a DSA -b 768 -n zone $zone 2> /dev/null`
+keyname1=`$KEYGEN -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone 2> /dev/null`
+keyname2=`$KEYGEN -f KSK -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone 2> /dev/null`

 cat $infile $keyname1.key $keyname2.key >$zonefile

@@ -213,8 +213,8 @@ zonefile=grand.child8.druz.db
 outfile=grand.child8.druz.signed
 dlvzone=dlv.druz.

-keyname1=`$KEYGEN -a DSA -b 768 -n zone $zone 2> /dev/null`
-keyname2=`$KEYGEN -f KSK -a DSA -b 768 -n zone $zone 2> /dev/null`
+keyname1=`$KEYGEN -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone 2> /dev/null`
+keyname2=`$KEYGEN -f KSK -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone 2> /dev/null`

 cat $infile $keyname1.key $keyname2.key >$zonefile

@@ -228,8 +228,8 @@ zonefile=grand.child9.druz.db
 outfile=grand.child9.druz.signed
 dlvzone=dlv.druz.

-keyname1=`$KEYGEN -a DSA -b 768 -n zone $zone 2> /dev/null`
-keyname2=`$KEYGEN -f KSK -a DSA -b 768 -n zone $zone 2> /dev/null`
+keyname1=`$KEYGEN -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone 2> /dev/null`
+keyname2=`$KEYGEN -f KSK -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone 2> /dev/null`

 cat $infile $keyname1.key $keyname2.key >$zonefile

@@ -242,8 +242,8 @@ zonefile=grand.child10.druz.db
 outfile=grand.child10.druz.signed
 dlvzone=dlv.druz.

-keyname1=`$KEYGEN -a DSA -b 768 -n zone $zone 2> /dev/null`
-keyname2=`$KEYGEN -f KSK -a DSA -b 768 -n zone $zone 2> /dev/null`
+keyname1=`$KEYGEN -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone 2> /dev/null`
+keyname2=`$KEYGEN -f KSK -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone 2> /dev/null`

 cat $infile $keyname1.key $keyname2.key >$zonefile

@@ -29,8 +29,8 @@ do
 	cp ../ns3/dsset-$subdomain.example$TP .
 done

-keyname1=`$KEYGEN -q -a DSA -b 768 -n zone $zone`
-keyname2=`$KEYGEN -q -a DSA -b 768 -n zone $zone`
+keyname1=`$KEYGEN -q -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone`
+keyname2=`$KEYGEN -q -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone`

 cat $infile $keyname1.key $keyname2.key >$zonefile

@@ -89,8 +89,8 @@ zone=in-addr.arpa.
 infile=in-addr.arpa.db.in
 zonefile=in-addr.arpa.db

-keyname1=`$KEYGEN -q -a DSA -b 768 -n zone $zone`
-keyname2=`$KEYGEN -q -a DSA -b 768 -n zone $zone`
+keyname1=`$KEYGEN -q -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone`
+keyname2=`$KEYGEN -q -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone`

 cat $infile $keyname1.key $keyname2.key >$zonefile
 $SIGNER -P -g -o $zone -k $keyname1 $zonefile $keyname2 > /dev/null
@@ -127,8 +127,8 @@ zone=badparam.
 infile=badparam.db.in
 zonefile=badparam.db

-keyname1=`$KEYGEN -q -a RSASHA256 -b 1024 -n zone -f KSK $zone`
-keyname2=`$KEYGEN -q -a RSASHA256 -b 1024 -n zone $zone`
+keyname1=`$KEYGEN -q -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone -f KSK $zone`
+keyname2=`$KEYGEN -q -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone`

 cat $infile $keyname1.key $keyname2.key >$zonefile

@@ -0,0 +1,38 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+// NS4
+
+options {
+	query-source address 10.53.0.4;
+	notify-source 10.53.0.4;
+	transfer-source 10.53.0.4;
+	port @PORT@;
+	pid-file "named.pid";
+	listen-on { 10.53.0.4; };
+	listen-on-v6 { none; };
+	bindkeys-file "managed.conf";
+	dnssec-enable no;
+};
+
+key rndc_key {
+	secret "1234abcd8765";
+	algorithm hmac-sha256;
+};
+
+controls {
+	inet 10.53.0.4 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
+};
+
+key auth {
+	secret "1234abcd8765";
+	algorithm hmac-sha256;
+};
@@ -21,7 +21,7 @@ options {
 	listen-on-v6 { none; };
 	recursion yes;
 	notify yes;
-	disable-algorithms . { DSA; };
+	disable-algorithms . { @DEFAULT_ALGORITHM@; };
 	dnssec-enable yes;
 	dnssec-validation yes;
 	dnssec-lookaside . trust-anchor dlv;
@@ -147,10 +147,10 @@ status=`expr $status + $ret`

 if [ -x ${DELV} ] ; then
   ret=0
-   echo_i "checking postive validation NSEC using dns_client ($n)"
+   echo_i "checking positive validation NSEC using dns_client ($n)"
   $DELV $DELVOPTS @10.53.0.4 a a.example > delv.out$n || ret=1
   grep "a.example..*10.0.0.1" delv.out$n > /dev/null || ret=1
-   grep "a.example..*.RRSIG.A 3 2 300 .*" delv.out$n > /dev/null || ret=1
+   grep "a.example..*.RRSIG.A $DEFAULT_ALGORITHM_NUMBER 2 300 .*" delv.out$n > /dev/null || ret=1
   n=`expr $n + 1`
   if [ $ret != 0 ]; then echo_i "failed"; fi
   status=`expr $status + $ret`
@@ -222,7 +222,7 @@ if [ -x ${DELV} ] ; then
   echo_i "checking positive wildcard validation NSEC using dns_client ($n)"
   $DELV $DELVOPTS @10.53.0.4 a a.wild.example > delv.out$n || ret=1
   grep "a.wild.example..*10.0.0.27" delv.out$n > /dev/null || ret=1
-   grep "a.wild.example..*RRSIG.A 3 2 300.*" delv.out$n > /dev/null || ret=1
+   grep -E "a.wild.example..*RRSIG.A [0-9]+ 2 300.*" delv.out$n > /dev/null || ret=1
   n=`expr $n + 1`
   if [ $ret != 0 ]; then echo_i "failed"; fi
   status=`expr $status + $ret`
@@ -1190,7 +1190,7 @@ n=`expr $n + 1`
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`

-echo_i "checking that lookups succeed after disabling a algorithm works ($n)"
+echo_i "checking that lookups succeed after disabling an algorithm ($n)"
 ret=0
 $DIG $DIGOPTS +noauth example. SOA @10.53.0.2 \
 	> dig.out.ns2.test$n || ret=1
@@ -2997,11 +2997,11 @@ echo_i "check dig's +nocrypto flag ($n)"
 ret=0
 $DIG $DIGOPTS +norec +nocrypto DNSKEY . \
 	@10.53.0.1 > dig.out.dnskey.ns1.test$n || ret=1
-grep '256 3 1 \[key id = [1-9][0-9]*]' dig.out.dnskey.ns1.test$n > /dev/null || ret=1
-grep 'RRSIG.* \[omitted]' dig.out.dnskey.ns1.test$n > /dev/null || ret=1
+grep -E '256 [0-9]+ 1 \[key id = [1-9][0-9]*]' dig.out.dnskey.ns1.test$n > /dev/null || ret=1
+grep -E 'RRSIG.* \[omitted]' dig.out.dnskey.ns1.test$n > /dev/null || ret=1
 $DIG $DIGOPTS +norec +nocrypto DS example \
 	@10.53.0.1 > dig.out.ds.ns1.test$n || ret=1
-grep 'DS.* 3 [12] \[omitted]' dig.out.ds.ns1.test$n > /dev/null || ret=1
+grep -E 'DS.* [0-9]+ [12] \[omitted]' dig.out.ds.ns1.test$n > /dev/null || ret=1
 n=`expr $n + 1`
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
@@ -3137,12 +3137,8 @@ do
 	2) # Diffie Helman
 	   alg=`expr $alg + 1`
 	   continue;;
-	3) # DSA/SHA1
-	   size="-b 512";;
 	5) # RSA/SHA-1
 	   size="-b 1024";;
-	6) # DSA-NSEC3-SHA1
-	   size="-b 512";;
 	7) # RSASHA1-NSEC3-SHA1
 	   size="-b 1024";;
 	8) # RSA/SHA-256
@@ -3573,5 +3569,20 @@ n=`expr $n + 1`
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`

+# Note: after this check, ns4 will not be validating any more; do not add any
+# further validation tests employing ns4 below this check.
+echo_i "check that validation defaults to off when dnssec-enable is off ($n)"
+ret=0
+# Sanity check - validation should be enabled.
+$RNDCCMD 10.53.0.4 validation status | grep "enabled" > /dev/null || ret=1
+# Set "dnssec-enable" to "no" and reconfigure.
+copy_setports ns4/named5.conf.in ns4/named.conf
+$RNDCCMD 10.53.0.4 reconfig 2>&1 | sed 's/^/ns4 /' | cat_i
+# Check validation status again.
+$RNDCCMD 10.53.0.4 validation status | grep "disabled" > /dev/null || ret=1
+n=`expr $n + 1`
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=`expr $status + $ret`
+
 echo_i "exit status: $status"
 [ $status -eq 0 ] || exit 1
@@ -23,3 +23,4 @@ rm -f ns*/dnstap.out.save.?
 rm -f ns*/named.lock
 rm -f ydump.out
 rm -f ns*/managed-keys.bind*
+rm -f ns2/example.db ns2/example.db.jnl
@@ -17,3 +17,5 @@ copy_setports ns1/named.conf.in ns1/named.conf
 copy_setports ns2/named.conf.in ns2/named.conf
 copy_setports ns3/named.conf.in ns3/named.conf
 copy_setports ns4/named.conf.in ns4/named.conf
+
+cp ns2/example.db.in ns2/example.db
@@ -55,6 +55,14 @@ $RNDCCMD -s 10.53.0.4 dnstap -reopen | sed 's/^/ns4 /' | cat_i

 $DIG $DIGOPTS @10.53.0.3 a.example > dig.out

+# send an UPDATE to ns2
+$NSUPDATE <<- EOF
+server 10.53.0.2 ${PORT}
+zone example
+update add b.example 3600 in a 10.10.10.10
+send
+EOF
+
 # XXX: file output should be flushed once a second according
 # to the libfstrm source, but it doesn't seem to happen until
 # enough data has accumulated. to get all the output, we stop
@@ -75,6 +83,8 @@ cq1=`$DNSTAPREAD ns1/dnstap.out.save | grep "CQ " | wc -l`
 cr1=`$DNSTAPREAD ns1/dnstap.out.save | grep "CR " | wc -l`
 rq1=`$DNSTAPREAD ns1/dnstap.out.save | grep "RQ " | wc -l`
 rr1=`$DNSTAPREAD ns1/dnstap.out.save | grep "RR " | wc -l`
+uq1=`$DNSTAPREAD ns1/dnstap.out.save | grep "UQ " | wc -l`
+ur1=`$DNSTAPREAD ns1/dnstap.out.save | grep "UR " | wc -l`

 udp2=`$DNSTAPREAD ns2/dnstap.out.save | grep "UDP " | wc -l`
 tcp2=`$DNSTAPREAD ns2/dnstap.out.save | grep "TCP " | wc -l`
@@ -84,6 +94,8 @@ cq2=`$DNSTAPREAD ns2/dnstap.out.save | grep "CQ " | wc -l`
 cr2=`$DNSTAPREAD ns2/dnstap.out.save | grep "CR " | wc -l`
 rq2=`$DNSTAPREAD ns2/dnstap.out.save | grep "RQ " | wc -l`
 rr2=`$DNSTAPREAD ns2/dnstap.out.save | grep "RR " | wc -l`
+uq2=`$DNSTAPREAD ns2/dnstap.out.save | grep "UQ " | wc -l`
+ur2=`$DNSTAPREAD ns2/dnstap.out.save | grep "UR " | wc -l`

 mv ns3/dnstap.out.0 ns3/dnstap.out.save
 udp3=`$DNSTAPREAD ns3/dnstap.out.save | grep "UDP " | wc -l`
@@ -94,6 +106,8 @@ cq3=`$DNSTAPREAD ns3/dnstap.out.save | grep "CQ " | wc -l`
 cr3=`$DNSTAPREAD ns3/dnstap.out.save | grep "CR " | wc -l`
 rq3=`$DNSTAPREAD ns3/dnstap.out.save | grep "RQ " | wc -l`
 rr3=`$DNSTAPREAD ns3/dnstap.out.save | grep "RR " | wc -l`
+uq3=`$DNSTAPREAD ns3/dnstap.out.save | grep "UQ " | wc -l`
+ur3=`$DNSTAPREAD ns3/dnstap.out.save | grep "UR " | wc -l`

 echo_i "checking UDP message counts"
 ret=0
@@ -231,6 +245,40 @@ ret=0
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`

+echo_i "checking UPDATE_QUERY message counts"
+ret=0
+[ $uq1 -eq 0 ] || {
+	echo_i "ns1 $uq1 expected 0"
+	ret=1
+}
+[ $uq2 -eq 0 ] || {
+	echo_i "ns2 $uq2 expected 0"
+	ret=1
+}
+[ $uq3 -eq 0 ] || {
+	echo_i "ns3 $uq3 expected 0"
+	ret=1
+}
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=`expr $status + $ret`
+
+echo_i "checking UPDATE_RESPONSE message counts"
+ret=0
+[ $ur1 -eq 0 ] || {
+	echo_i "ns1 $ur1 expected 0"
+	ret=1
+}
+[ $ur2 -eq 0 ] || {
+	echo_i "ns2 $ur2 expected 0"
+	ret=1
+}
+[ $ur3 -eq 0 ] || {
+	echo_i "ns3 $ur3 expected 0"
+	ret=1
+}
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=`expr $status + $ret`
+
 echo_i "checking reopened message counts"

 udp1=`$DNSTAPREAD ns1/dnstap.out | grep "UDP " | wc -l`
@@ -241,6 +289,8 @@ cq1=`$DNSTAPREAD ns1/dnstap.out | grep "CQ " | wc -l`
 cr1=`$DNSTAPREAD ns1/dnstap.out | grep "CR " | wc -l`
 rq1=`$DNSTAPREAD ns1/dnstap.out | grep "RQ " | wc -l`
 rr1=`$DNSTAPREAD ns1/dnstap.out | grep "RR " | wc -l`
+uq1=`$DNSTAPREAD ns1/dnstap.out | grep "UQ " | wc -l`
+ur1=`$DNSTAPREAD ns1/dnstap.out | grep "UR " | wc -l`

 udp2=`$DNSTAPREAD ns2/dnstap.out | grep "UDP " | wc -l`
 tcp2=`$DNSTAPREAD ns2/dnstap.out | grep "TCP " | wc -l`
@@ -250,6 +300,8 @@ cq2=`$DNSTAPREAD ns2/dnstap.out | grep "CQ " | wc -l`
 cr2=`$DNSTAPREAD ns2/dnstap.out | grep "CR " | wc -l`
 rq2=`$DNSTAPREAD ns2/dnstap.out | grep "RQ " | wc -l`
 rr2=`$DNSTAPREAD ns2/dnstap.out | grep "RR " | wc -l`
+uq2=`$DNSTAPREAD ns2/dnstap.out | grep "UQ " | wc -l`
+ur2=`$DNSTAPREAD ns2/dnstap.out | grep "UR " | wc -l`

 udp3=`$DNSTAPREAD ns3/dnstap.out | grep "UDP " | wc -l`
 tcp3=`$DNSTAPREAD ns3/dnstap.out | grep "TCP " | wc -l`
@@ -259,6 +311,8 @@ cq3=`$DNSTAPREAD ns3/dnstap.out | grep "CQ " | wc -l`
 cr3=`$DNSTAPREAD ns3/dnstap.out | grep "CR " | wc -l`
 rq3=`$DNSTAPREAD ns3/dnstap.out | grep "RQ " | wc -l`
 rr3=`$DNSTAPREAD ns3/dnstap.out | grep "RR " | wc -l`
+uq3=`$DNSTAPREAD ns3/dnstap.out | grep "UQ " | wc -l`
+ur3=`$DNSTAPREAD ns3/dnstap.out | grep "UR " | wc -l`

 echo_i "checking UDP message counts"
 ret=0
@@ -266,8 +320,8 @@ ret=0
 	echo_i "ns1 $udp1 expected 0"
 	ret=1
 }
-[ $udp2 -eq 0 ] || {
-	echo_i "ns2 $udp2 expected 0"
+[ $udp2 -eq 2 ] || {
+	echo_i "ns2 $udp2 expected 2"
 	ret=1
 }
 [ $udp3 -eq 2 ] || {
@@ -396,6 +450,41 @@ ret=0
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`

+echo_i "checking UPDATE_QUERY message counts"
+ret=0
+[ $uq1 -eq 0 ] || {
+	echo_i "ns1 $uq1 expected 0"
+	ret=1
+}
+[ $uq2 -eq 1 ] || {
+	echo_i "ns2 $uq2 expected 1"
+	ret=1
+}
+[ $uq3 -eq 0 ] || {
+	echo_i "ns3 $uq3 expected 0"
+	ret=1
+}
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=`expr $status + $ret`
+
+echo_i "checking UPDATE_RESPONSE message counts"
+ret=0
+[ $ur1 -eq 0 ] || {
+	echo_i "ns1 $ur1 expected 0"
+	ret=1
+}
+[ $ur2 -eq 1 ] || {
+	echo_i "ns2 $ur2 expected 1"
+	ret=1
+}
+[ $ur3 -eq 0 ] || {
+	echo_i "ns3 $ur3 expected 0"
+	ret=1
+}
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=`expr $status + $ret`
+
+
 HAS_PYYAML=0
 if [ -n "$PYTHON" ] ; then
 	$PYTHON -c "import yaml" 2> /dev/null && HAS_PYYAML=1
@@ -423,6 +512,15 @@ status=`expr $status + $ret`
 if [ -n "$FSTRM_CAPTURE" ] ; then
 	$DIG $DIGOPTS @10.53.0.4 a.example > dig.out

+	# send an UPDATE to ns4
+	$NSUPDATE <<- EOF > nsupdate.out 2>&1
+	server 10.53.0.4 ${PORT}
+	zone example
+	update add b.example 3600 in a 10.10.10.10
+	send
+EOF
+	grep "update failed: NOTAUTH" nsupdate.out > /dev/null || ret=1
+
 	echo_i "checking unix socket message counts"
 	sleep 2
 	kill $fstrm_capture_pid
@@ -435,11 +533,13 @@ if [ -n "$FSTRM_CAPTURE" ] ; then
 	cr4=`$DNSTAPREAD dnstap.out | grep "CR " | wc -l`
 	rq4=`$DNSTAPREAD dnstap.out | grep "RQ " | wc -l`
 	rr4=`$DNSTAPREAD dnstap.out | grep "RR " | wc -l`
+	uq4=`$DNSTAPREAD dnstap.out | grep "UQ " | wc -l`
+	ur4=`$DNSTAPREAD dnstap.out | grep "UR " | wc -l`

 	echo_i "checking UDP message counts"
 	ret=0
-	[ $udp4 -eq 2 ] || {
-		echo_i "ns4 $udp4 expected 2"
+	[ $udp4 -eq 4 ] || {
+		echo_i "ns4 $udp4 expected 4"
 		ret=1
 	}
 	if [ $ret != 0 ]; then echo_i "failed"; fi
@@ -505,7 +605,27 @@ if [ -n "$FSTRM_CAPTURE" ] ; then
 		echo_i "ns4 $rr4 expected 0"
 		ret=1
 	}
+
+	echo_i "checking UPDATE_QUERY message counts"
+	ret=0
+	[ $uq4 -eq 1 ] || {
+		echo_i "ns4 $uq4 expected 1"
+		ret=1
+	}
+	if [ $ret != 0 ]; then echo_i "failed"; fi
+	status=`expr $status + $ret`
+
+	echo_i "checking UPDATE_RESPONSE message counts"
+	ret=0
+	[ $ur4 -eq 1 ] || {
+		echo_i "ns4 $ur4 expected 1"
+		ret=1
+	}
+	if [ $ret != 0 ]; then echo_i "failed"; fi
+	status=`expr $status + $ret`
+
 	mv dnstap.out dnstap.out.save
+
 	$FSTRM_CAPTURE -t protobuf:dnstap.Dnstap -u ns4/dnstap.out \
 		-w dnstap.out > fstrm_capture.out 2>&1 &
 	fstrm_capture_pid=$!
@@ -524,6 +644,8 @@ if [ -n "$FSTRM_CAPTURE" ] ; then
 	cr4=`$DNSTAPREAD dnstap.out | grep "CR " | wc -l`
 	rq4=`$DNSTAPREAD dnstap.out | grep "RQ " | wc -l`
 	rr4=`$DNSTAPREAD dnstap.out | grep "RR " | wc -l`
+	uq4=`$DNSTAPREAD dnstap.out | grep "UQ " | wc -l`
+	ur4=`$DNSTAPREAD dnstap.out | grep "UR " | wc -l`

 	echo_i "checking UDP message counts"
 	ret=0
@@ -594,6 +716,24 @@ if [ -n "$FSTRM_CAPTURE" ] ; then
 		echo_i "ns4 $rr4 expected 0"
 		ret=1
 	}
+
+	echo_i "checking UPDATE_QUERY message counts"
+	ret=0
+	[ $uq4 -eq 0 ] || {
+		echo_i "ns4 $uq4 expected 0"
+		ret=1
+	}
+	if [ $ret != 0 ]; then echo_i "failed"; fi
+	status=`expr $status + $ret`
+
+	echo_i "checking UPDATE_RESPONSE message counts"
+	ret=0
+	[ $ur4 -eq 0 ] || {
+		echo_i "ns4 $ur4 expected 0"
+		ret=1
+	}
+	if [ $ret != 0 ]; then echo_i "failed"; fi
+	status=`expr $status + $ret`
 fi

 echo_i "exit status: $status"
@@ -220,14 +220,15 @@ find(dns_db_t *db, const dns_name_t *name, dns_dbversion_t *version,
 static isc_result_t
 findzonecut(dns_db_t *db, const dns_name_t *name, unsigned int options,
 	    isc_stdtime_t now, dns_dbnode_t **nodep, dns_name_t *foundname,
-	    dns_rdataset_t *rdataset, dns_rdataset_t *sigrdataset)
+	    dns_name_t *dcname, dns_rdataset_t *rdataset,
+	    dns_rdataset_t *sigrdataset)
 {
 	sampledb_t *sampledb = (sampledb_t *) db;

 	REQUIRE(VALID_SAMPLEDB(sampledb));

 	return (dns_db_findzonecut(sampledb->rbtdb, name, options,
-				   now, nodep, foundname, rdataset,
+				   now, nodep, foundname, dcname, rdataset,
 				   sigrdataset));
 }

@@ -157,7 +157,7 @@ status=`expr $status + $ret`
 copy_setports ns3/named3.conf.in ns3/named.conf
 $RNDCCMD reconfig 2>&1 | sed 's/^/ns3 /' | cat_i

-echo_i "checking lame server clients are dropped at the soft limit"
+echo_i "checking lame server clients are dropped near the soft limit"
 ret=0
 fail=0
 exceeded=0
@@ -166,7 +166,7 @@ touch ans4/norespond
 for try in 1 2 3 4 5; do
    burst b $try 400
    $DIG @10.53.0.3 -p ${PORT}  a ${try}.example > dig.out.ns3.$try
-    stat 360 || exceeded=`expr $exceeded + 1`
+    stat 370 || exceeded=`expr $exceeded + 1`
    grep "status: NOERROR" dig.out.ns3.$try > /dev/null 2>&1 && \
            success=`expr $success + 1`
    grep "status: SERVFAIL" dig.out.ns3.$try > /dev/null 2>&1 && \
@@ -177,7 +177,7 @@ echo_i "$success successful valid queries (expected 5)"
 [ "$success" -eq 5 ] || { echo_i "failed"; ret=1; }
 echo_i "$fail SERVFAIL responses (expected 0)"
 [ "$fail" -eq 0 ] || { echo_i "failed"; ret=1; }
-echo_i "clients count exceeded 360 on $exceeded trials (expected 0)"
+echo_i "clients count exceeded 370 on $exceeded trials (expected 0)"
 [ "$exceeded" -eq 0 ] || { echo_i "failed"; ret=1; }
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
@@ -21,8 +21,8 @@ infile=signed.db.in
 zonefile=signed.db.signed
 outfile=signed.db.signed

-keyname1=`$KEYGEN -a DSA -b 768 -n zone $zone 2> /dev/null`
-keyname2=`$KEYGEN -f KSK -a DSA -b 768 -n zone $zone 2> /dev/null`
+keyname1=`$KEYGEN -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone 2> /dev/null`
+keyname2=`$KEYGEN -f KSK -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone 2> /dev/null`

 cat $infile $keyname1.key $keyname2.key >$zonefile

@@ -21,8 +21,8 @@ infile=signed.db.in
 zonefile=signed.db.signed
 outfile=signed.db.signed

-keyname1=`$KEYGEN -a DSA -b 768 -n zone $zone 2> /dev/null`
-keyname2=`$KEYGEN -f KSK -a DSA -b 768 -n zone $zone 2> /dev/null`
+keyname1=`$KEYGEN -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone 2> /dev/null`
+keyname2=`$KEYGEN -f KSK -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone 2> /dev/null`

 cat $infile $keyname1.key $keyname2.key >$zonefile

@@ -118,7 +118,7 @@ rm -f ns3/test-?.bk
 rm -f ns3/test-?.bk.signed
 rm -f ns3/test-?.bk.signed.jnl
 rm -f import.key Kimport*
-rm -f checkdsa checkecdsa
+rm -f checkecdsa
 rm -f ns3/a-file
 rm -f ns*/named.lock
 rm -f dig.out.*
@@ -133,7 +133,7 @@ zone=externalkey
 rm -f K${zone}.+*+*.key
 rm -f K${zone}.+*+*.private

-for alg in ECDSAP256SHA256 NSEC3RSASHA1 DSA
+for alg in ECDSAP256SHA256 NSEC3RSASHA1
 do
    k1=`$KEYGEN -q -a $alg -b 1024 -n zone -f KSK $zone`
    k2=`$KEYGEN -q -a $alg -b 1024 -n zone $zone`
@@ -945,13 +945,11 @@ n=`expr $n + 1`
 echo_i "testing adding external keys to a inline zone ($n)"
 ret=0
 $DIG $DIGOPTS @10.53.0.3 dnskey externalkey > dig.out.ns3.test$n
-for alg in 3 7 13
+for alg in 7 13
 do
-   [ $alg = 3 -a ! -f checkdsa ] && continue;
   [ $alg = 13 -a ! -f checkecdsa ] && continue;

   case $alg in
-   3) echo_i "checking DSA";;
   7) echo_i "checking NSEC3RSASHA1";;
   13) echo_i "checking ECDSAP256SHA256";;
   *) echo_i "checking $alg";;
@@ -134,12 +134,12 @@ algorithm policy RSASHA1:
 	zsk_standby None
 	keyttl None

-algorithm policy DSA:
+algorithm policy RSASHA256:
 	inherits None
 	directory None
-	algorithm DSA
+	algorithm RSASHA256
 	coverage None
-	ksk_keysize 1024
+	ksk_keysize 2048
 	zsk_keysize 2048
 	ksk_rollperiod None
 	zsk_rollperiod None
@@ -151,6 +151,23 @@ algorithm policy DSA:
 	zsk_standby None
 	keyttl None

+algorithm policy ECDSAP256SHA256:
+	inherits None
+	directory None
+	algorithm ECDSAP256SHA256
+	coverage None
+	ksk_keysize None
+	zsk_keysize None
+	ksk_rollperiod None
+	zsk_rollperiod None
+	ksk_prepublish None
+	ksk_postpublish None
+	zsk_prepublish None
+	zsk_postpublish None
+	ksk_standby None
+	zsk_standby None
+	keyttl None
+
 policy extra:
 	inherits default
 	directory None
@@ -31,7 +31,8 @@ if len(sys.argv) > 0:

        # print algorithm policies
        print(pp.alg_policy['RSASHA1'])
-        print(pp.alg_policy['DSA'])
+        print(pp.alg_policy['RSASHA256'])
+        print(pp.alg_policy['ECDSAP256SHA256'])

        # print another named policy
        print(pp.named_policy['extra'])
@@ -19,7 +19,7 @@ from datetime import datetime, timedelta
 import time
 import functools

-import dns, dns.message, dns.query
+import dns, dns.message, dns.query, dns.flags
 from dns.rdatatype import *
 from dns.rdataclass import *
 from dns.rcode import *
@@ -44,6 +44,8 @@ def logquery(type, qname):
 #
 # For bad. it works the same as for good., but returns NXDOMAIN to non-empty terminals
 #
+# For ugly. it works the same as for good., but returns garbage to non-empty terminals
+#
 # For 1.0.0.2.ip6.arpa it serves
 # 1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.8.f.4.0.1.0.0.2.ip6.arpa. IN PTR nee.com.
 # 1.0.0.2.ip6.arpa. IN NS ns2.good
@@ -61,6 +63,7 @@ def create_response(msg):
    if typename == "A" or typename == "AAAA":
        typename = "ADDR"
    bad = False
+    ugly = False
    slow = False

    # log this query
@@ -76,9 +79,11 @@ def create_response(msg):
        if lqname == "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.8.f.4.0.1.0.0.2.ip6.arpa." and rrtype == PTR:
            # Direct query - give direct answer
            r.answer.append(dns.rrset.from_text("1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.8.f.4.0.1.0.0.2.ip6.arpa.", 1, IN, PTR, "nee.com."))
+            r.flags |= dns.flags.AA
        elif lqname == "1.0.0.2.ip6.arpa." and rrtype == NS:
            # NS query at the apex
            r.answer.append(dns.rrset.from_text("1.0.0.2.ip6.arpa.", 1, IN, NS, "ns2.good."))
+            r.flags |= dns.flags.AA
        elif "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.8.f.4.0.1.0.0.2.ip6.arpa.".endswith(lqname):
            # NODATA answer
            r.authority.append(dns.rrset.from_text("1.0.0.2.ip6.arpa.", 1, IN, SOA, "ns2.good. hostmaster.arpa. 2018050100 1 1 1 1"))
@@ -91,6 +96,7 @@ def create_response(msg):
        if lqname == "ip6.arpa." and rrtype == NS:
            # NS query at the apex
            r.answer.append(dns.rrset.from_text("ip6.arpa.", 1, IN, NS, "ns2.good."))
+            r.flags |= dns.flags.AA
        elif "1.0.0.2.ip6.arpa.".endswith(lqname):
            # NODATA answer
            r.authority.append(dns.rrset.from_text("ip6.arpa.", 1, IN, SOA, "ns2.good. hostmaster.arpa. 2018050100 1 1 1 1"))
@@ -103,6 +109,10 @@ def create_response(msg):
        bad = True
        suffix = "bad."
        lqname = lqname[:-4]
+    elif lqname.endswith("ugly."):
+        ugly = True
+        suffix = "ugly."
+        lqname = lqname[:-5]
    elif lqname.endswith("good."):
        suffix = "good."
        lqname = lqname[:-5]
@@ -114,25 +124,33 @@ def create_response(msg):
        r.set_rcode(REFUSED)
        return r

-    # Good/bad differs only in how we treat non-empty terminals
+    # Good/bad/ugly differs only in how we treat non-empty terminals
    if lqname.endswith("zoop.boing."):
        r.authority.append(dns.rrset.from_text("zoop.boing." + suffix, 1, IN, NS, "ns3." + suffix))
    elif lqname == "many.labels.a.b.c.d.e.f.g.h.i.j.k.l.m.n.o.p.q.r.s.t.u.v.w.x.y.z." and rrtype == A:
        r.answer.append(dns.rrset.from_text(lqname + suffix, 1, IN, A, "192.0.2.2"))
+        r.flags |= dns.flags.AA
    elif lqname == "" and rrtype == NS:
        r.answer.append(dns.rrset.from_text(suffix, 1, IN, NS, "ns2." + suffix))
+        r.flags |= dns.flags.AA
    elif lqname == "ns2." and rrtype == A:
        r.answer.append(dns.rrset.from_text("ns2."+suffix, 1, IN, A, "10.53.0.2"))
+        r.flags |= dns.flags.AA
    elif lqname == "ns2." and rrtype == AAAA:
        r.answer.append(dns.rrset.from_text("ns2."+suffix, 1, IN, AAAA, "fd92:7065:b8e:ffff::2"))
+        r.flags |= dns.flags.AA
    elif lqname == "ns3." and rrtype == A:
        r.answer.append(dns.rrset.from_text("ns3."+suffix, 1, IN, A, "10.53.0.3"))
+        r.flags |= dns.flags.AA
    elif lqname == "ns3." and rrtype == AAAA:
        r.answer.append(dns.rrset.from_text("ns3."+suffix, 1, IN, AAAA, "fd92:7065:b8e:ffff::3"))
+        r.flags |= dns.flags.AA
    elif lqname == "a.bit.longer.ns.name." and rrtype == A:
        r.answer.append(dns.rrset.from_text("a.bit.longer.ns.name."+suffix, 1, IN, A, "10.53.0.4"))
+        r.flags |= dns.flags.AA
    elif lqname == "a.bit.longer.ns.name." and rrtype == AAAA:
        r.answer.append(dns.rrset.from_text("a.bit.longer.ns.name."+suffix, 1, IN, AAAA, "fd92:7065:b8e:ffff::4"))
+        r.flags |= dns.flags.AA
    else:
        r.authority.append(dns.rrset.from_text(suffix, 1, IN, SOA, "ns2." + suffix + " hostmaster.arpa. 2018050100 1 1 1 1"))
        if bad or not \
@@ -140,6 +158,8 @@ def create_response(msg):
             "many.labels.a.b.c.d.e.f.g.h.i.j.k.l.m.n.o.p.q.r.s.t.u.v.w.x.y.z.".endswith(lqname) or \
             "a.bit.longer.ns.name.".endswith(lqname)):
            r.set_rcode(NXDOMAIN)
+        if ugly:
+            r.set_rcode(FORMERR)
    if slow:
        time.sleep(0.2)
    return r
@@ -19,7 +19,7 @@ from datetime import datetime, timedelta
 import time
 import functools

-import dns, dns.message, dns.query
+import dns, dns.message, dns.query, dns.flags
 from dns.rdatatype import *
 from dns.rdataclass import *
 from dns.rcode import *
@@ -41,6 +41,8 @@ def logquery(type, qname):
 # For slow. it works the same as for good., but each response is delayed by 400 miliseconds
 #
 # For bad. it works the same as for good., but returns NXDOMAIN to non-empty terminals
+#
+# For ugly. it works the same as for good., but returns garbage to non-empty terminals
 ############################################################################
 def create_response(msg):
    m = dns.message.from_wire(msg)
@@ -54,6 +56,7 @@ def create_response(msg):
    if typename == "A" or typename == "AAAA":
        typename = "ADDR"
    bad = False
+    ugly = False
    slow = False

    # log this query
@@ -68,6 +71,10 @@ def create_response(msg):
        bad = True
        suffix = "bad."
        lqname = lqname[:-4]
+    elif lqname.endswith("ugly."):
+        ugly = True
+        suffix = "ugly."
+        lqname = lqname[:-5]
    elif lqname.endswith("good."):
        suffix = "good."
        lqname = lqname[:-5]
@@ -82,12 +89,15 @@ def create_response(msg):
    # Good/bad differs only in how we treat non-empty terminals
    if lqname == "zoop.boing." and rrtype == NS:
        r.answer.append(dns.rrset.from_text(lqname + suffix, 1, IN, NS, "ns3."+suffix))
+        r.flags |= dns.flags.AA
    elif lqname.endswith("icky.ptang.zoop.boing."):
        r.authority.append(dns.rrset.from_text("icky.ptang.zoop.boing." + suffix, 1, IN, NS, "a.bit.longer.ns.name." + suffix))
    elif "icky.ptang.zoop.boing.".endswith(lqname):
        r.authority.append(dns.rrset.from_text("zoop.boing." + suffix, 1, IN, SOA, "ns3." + suffix + " hostmaster.arpa. 2018050100 1 1 1 1"))
        if bad:
            r.set_rcode(NXDOMAIN)
+        if ugly:
+            r.set_rcode(FORMERR)
    elif "zoop.boing.".endswith(lqname):
        r.authority.append(dns.rrset.from_text("zoop.boing." + suffix, 1, IN, SOA, "ns3." + suffix + " hostmaster.arpa. 2018050100 1 1 1 1"))
        r.set_rcode(NXDOMAIN)
@@ -19,7 +19,7 @@ from datetime import datetime, timedelta
 import time
 import functools

-import dns, dns.message, dns.query
+import dns, dns.message, dns.query, dns.flags
 from dns.rdatatype import *
 from dns.rdataclass import *
 from dns.rcode import *
@@ -42,6 +42,8 @@ def logquery(type, qname):
 # For slow. it works the same as for good., but each response is delayed by 400 miliseconds
 #
 # For bad. it works the same as for good., but returns NXDOMAIN to non-empty terminals
+#
+# For ugly. it works the same as for good., but returns garbage to non-empty terminals
 ############################################################################
 def create_response(msg):
    m = dns.message.from_wire(msg)
@@ -56,6 +58,7 @@ def create_response(msg):
        typename = "ADDR"
    bad = False
    slow = False
+    ugly = False

    # log this query
    with open("query.log", "a") as f:
@@ -69,6 +72,10 @@ def create_response(msg):
        bad = True
        suffix = "bad."
        lqname = lqname[:-4]
+    elif lqname.endswith("ugly."):
+        ugly = True
+        suffix = "ugly."
+        lqname = lqname[:-5]
    elif lqname.endswith("good."):
        suffix = "good."
        lqname = lqname[:-5]
@@ -83,14 +90,19 @@ def create_response(msg):
    # Good/bad differs only in how we treat non-empty terminals
    if lqname == "icky.icky.icky.ptang.zoop.boing." and rrtype == A:
        r.answer.append(dns.rrset.from_text(lqname + suffix, 1, IN, A, "192.0.2.1"))
+        r.flags |= dns.flags.AA
    elif lqname == "more.icky.icky.icky.ptang.zoop.boing." and rrtype == A:
        r.answer.append(dns.rrset.from_text(lqname + suffix, 1, IN, A, "192.0.2.2"))
+        r.flags |= dns.flags.AA
    elif lqname == "icky.ptang.zoop.boing." and rrtype == NS:
        r.answer.append(dns.rrset.from_text(lqname + suffix, 1, IN, NS, "a.bit.longer.ns.name."+suffix))
+        r.flags |= dns.flags.AA
    elif lqname.endswith("icky.ptang.zoop.boing."):
        r.authority.append(dns.rrset.from_text("icky.ptang.zoop.boing." + suffix, 1, IN, SOA, "ns2." + suffix + " hostmaster.arpa. 2018050100 1 1 1 1"))
        if bad or not "more.icky.icky.icky.ptang.zoop.boing.".endswith(lqname):
            r.set_rcode(NXDOMAIN)
+        if ugly:
+            r.set_rcode(FORMERR)
    else:
        r.set_rcode(REFUSED)

@@ -28,5 +28,5 @@ ns2.bad.		A	10.53.0.2
 slow			NS	ns2.slow.
 ns2.slow.		A	10.53.0.2

-horrible.		NS	ns2.horrible.
-ns2.horrible.		A	10.53.0.2
+ugly.			NS	ns2.ugly.
+ns2.ugly.		A	10.53.0.2
@@ -85,6 +85,29 @@ for ans in ans2 ans3 ans4; do mv -f $ans/query.log query-$ans-$n.log 2>/dev/null
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`

+n=`expr $n + 1`
+echo_i "query for .ugly is not minimized when qname-minimization is off ($n)"
+ret=0
+$CLEANQL
+$RNDCCMD 10.53.0.5 flush
+$DIG $DIGOPTS icky.icky.icky.ptang.zoop.boing.ugly. @10.53.0.5 > dig.out.test$n
+sleep 5
+grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
+grep "icky.icky.icky.ptang.zoop.boing.ugly. 1	IN A	192.0.2.1" dig.out.test$n > /dev/null || ret=1
+sleep 1
+cat << __EOF | diff ans2/query.log - > /dev/null || ret=1
+ADDR icky.icky.icky.ptang.zoop.boing.ugly.
+ADDR ns3.ugly.
+ADDR ns3.ugly.
+ADDR a.bit.longer.ns.name.ugly.
+ADDR a.bit.longer.ns.name.ugly.
+__EOF
+echo "ADDR icky.icky.icky.ptang.zoop.boing.ugly." | diff ans3/query.log - > /dev/null || ret=1
+echo "ADDR icky.icky.icky.ptang.zoop.boing.ugly." | diff ans4/query.log - > /dev/null || ret=1
+for ans in ans2 ans3 ans4; do mv -f $ans/query.log query-$ans-$n.log 2>/dev/null || true; done
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=`expr $status + $ret`
+
 n=`expr $n + 1`
 echo_i "query for .good is properly minimized when qname-minimization is on ($n)"
 ret=0
@@ -94,31 +117,22 @@ $DIG $DIGOPTS icky.icky.icky.ptang.zoop.boing.good. @10.53.0.6 > dig.out.test$n
 grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
 grep "icky.icky.icky.ptang.zoop.boing.good. 1	IN A	192.0.2.1" dig.out.test$n > /dev/null || ret=1
 sleep 1
-# Duplicated NS queries are there because we're not creating
-# a separate fetch when doing qname minimization - so two
-# queries running for the same name but different RRTYPE
-# (A and AAAA in this case) will create separate queries
-# for NSes on the way. Those will be cached though, so it
-# should not be a problem
 cat << __EOF | diff ans2/query.log - > /dev/null || ret=1
+NS good.
 NS boing.good.
 NS zoop.boing.good.
 ADDR ns3.good.
 ADDR ns3.good.
-NS name.good.
-NS name.good.
-NS ns.name.good.
-NS ns.name.good.
-NS longer.ns.name.good.
-NS longer.ns.name.good.
 ADDR a.bit.longer.ns.name.good.
 ADDR a.bit.longer.ns.name.good.
 __EOF
 cat << __EOF | diff ans3/query.log - > /dev/null || ret=1
+NS zoop.boing.good.
 NS ptang.zoop.boing.good.
 NS icky.ptang.zoop.boing.good.
 __EOF
 cat << __EOF | diff ans4/query.log - > /dev/null || ret=1
+NS icky.ptang.zoop.boing.good.
 NS icky.icky.ptang.zoop.boing.good.
 ADDR icky.icky.icky.ptang.zoop.boing.good.
 __EOF
@@ -134,7 +148,10 @@ $RNDCCMD 10.53.0.6 flush
 $DIG $DIGOPTS icky.icky.icky.ptang.zoop.boing.bad. @10.53.0.6 > dig.out.test$n
 grep "status: NXDOMAIN" dig.out.test$n > /dev/null || ret=1
 sleep 1
-echo "NS boing.bad." | diff ans2/query.log - > /dev/null || ret=1
+cat << __EOF | diff ans2/query.log - > /dev/null || ret=1
+NS bad.
+NS boing.bad.
+__EOF
 for ans in ans2 ans3 ans4; do mv -f $ans/query.log query-$ans-$n.log 2>/dev/null || true; done
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
@@ -149,12 +166,11 @@ grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
 grep "icky.icky.icky.ptang.zoop.boing.bad. 1 IN A	192.0.2.1" dig.out.test$n > /dev/null || ret=1
 sleep 1
 cat << __EOF | diff ans2/query.log - > /dev/null || ret=1
+NS bad.
 NS boing.bad.
 ADDR icky.icky.icky.ptang.zoop.boing.bad.
 ADDR ns3.bad.
 ADDR ns3.bad.
-NS name.bad.
-NS name.bad.
 ADDR a.bit.longer.ns.name.bad.
 ADDR a.bit.longer.ns.name.bad.
 __EOF
@@ -164,6 +180,50 @@ for ans in ans2 ans3 ans4; do mv -f $ans/query.log query-$ans-$n.log 2>/dev/null
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`

+n=`expr $n + 1`
+echo_i "query for .ugly fails when qname-minimization is in strict mode ($n)"
+ret=0
+$CLEANQL
+$RNDCCMD 10.53.0.6 flush
+$DIG $DIGOPTS icky.icky.icky.ptang.zoop.boing.ugly. @10.53.0.6 > dig.out.test$n
+grep "status: SERVFAIL" dig.out.test$n > /dev/null || ret=1
+sleep 1
+cat << __EOF | diff ans2/query.log - > /dev/null || ret=1
+NS ugly.
+NS boing.ugly.
+NS boing.ugly.
+__EOF
+for ans in ans2 ans3 ans4; do mv -f $ans/query.log query-$ans-$n.log 2>/dev/null || true; done
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=`expr $status + $ret`
+$RNDCCMD 10.53.0.6 flush
+
+n=`expr $n + 1`
+echo_i "query for .ugly succeds when qname-minimization is in relaxed mode ($n)"
+ret=0
+$CLEANQL
+$RNDCCMD 10.53.0.7 flush
+$DIG $DIGOPTS icky.icky.icky.ptang.zoop.boing.ugly. @10.53.0.7 > dig.out.test$n
+grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
+grep "icky.icky.icky.ptang.zoop.boing.ugly. 1	IN A	192.0.2.1" dig.out.test$n > /dev/null || ret=1
+sleep 1
+cat << __EOF | diff ans2/query.log - > /dev/null || ret=1
+NS ugly.
+NS boing.ugly.
+NS boing.ugly.
+ADDR icky.icky.icky.ptang.zoop.boing.ugly.
+ADDR ns3.ugly.
+ADDR ns3.ugly.
+ADDR a.bit.longer.ns.name.ugly.
+ADDR a.bit.longer.ns.name.ugly.
+__EOF
+echo "ADDR icky.icky.icky.ptang.zoop.boing.ugly." | diff ans3/query.log - > /dev/null || ret=1
+echo "ADDR icky.icky.icky.ptang.zoop.boing.ugly." | diff ans4/query.log - > /dev/null || ret=1
+for ans in ans2 ans3 ans4; do mv -f $ans/query.log query-$ans-$n.log 2>/dev/null || true; done
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=`expr $status + $ret`
+$RNDCCMD 10.53.0.7 flush
+
 n=`expr $n + 1`
 echo_i "query for .slow is properly minimized when qname-minimization is on ($n)"
 ret=0
@@ -174,24 +234,21 @@ sleep 5
 grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
 grep "icky.icky.icky.ptang.zoop.boing.slow. 1	IN A	192.0.2.1" dig.out.test$n > /dev/null || ret=1
 cat << __EOF | diff ans2/query.log - > /dev/null || ret=1
+NS slow.
 NS boing.slow.
 NS zoop.boing.slow.
 ADDR ns3.slow.
 ADDR ns3.slow.
-NS name.slow.
-NS name.slow.
-NS ns.name.slow.
-NS ns.name.slow.
-NS longer.ns.name.slow.
-NS longer.ns.name.slow.
 ADDR a.bit.longer.ns.name.slow.
 ADDR a.bit.longer.ns.name.slow.
 __EOF
 cat << __EOF | diff ans3/query.log - > /dev/null || ret=1
+NS zoop.boing.slow.
 NS ptang.zoop.boing.slow.
 NS icky.ptang.zoop.boing.slow.
 __EOF
 cat << __EOF | diff ans4/query.log - > /dev/null || ret=1
+NS icky.ptang.zoop.boing.slow.
 NS icky.icky.ptang.zoop.boing.slow.
 ADDR icky.icky.icky.ptang.zoop.boing.slow.
 __EOF
@@ -220,25 +277,6 @@ for ans in ans2 ans3 ans4; do mv -f $ans/query.log query-$ans-$n.log 2>/dev/null
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`

-n=`expr $n + 1`
-echo_i "query for multiple label name skips after 3rd no-delegation response ($n)"
-ret=0
-$CLEANQL
-$RNDCCMD 10.53.0.6 flush
-$DIG $DIGOPTS many.labels.a.b.c.d.e.f.g.h.i.j.k.l.m.n.o.p.q.r.s.t.u.v.w.x.y.z.good. @10.53.0.6 > dig.out.test$n
-grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
-grep "many.labels.a.b.c.d.e.f.g.h.i.j.k.l.m.n.o.p.q.r.s.t.u.v.w.x.y.z.good. 1	IN A 192.0.2.2" dig.out.test$n > /dev/null || ret=1
-sleep 1
-# We skipped after third no-delegation.
-cat << __EOF | diff ans2/query.log - > /dev/null || ret=1
-NS z.good.
-NS y.z.good.
-NS x.y.z.good.
-ADDR many.labels.a.b.c.d.e.f.g.h.i.j.k.l.m.n.o.p.q.r.s.t.u.v.w.x.y.z.good.
-__EOF
-if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
-
 n=`expr $n + 1`
 echo_i "query for multiple label name skips after 7th label ($n)"
 ret=0
@@ -249,25 +287,22 @@ grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
 grep "more.icky.icky.icky.ptang.zoop.boing.good. 1 IN	A 192.0.2.2" dig.out.test$n > /dev/null || ret=1
 sleep 1
 cat << __EOF | diff ans2/query.log - > /dev/null || ret=1
+NS good.
 NS boing.good.
 NS zoop.boing.good.
 ADDR ns3.good.
 ADDR ns3.good.
-NS name.good.
-NS name.good.
-NS ns.name.good.
-NS ns.name.good.
-NS longer.ns.name.good.
-NS longer.ns.name.good.
 ADDR a.bit.longer.ns.name.good.
 ADDR a.bit.longer.ns.name.good.
 __EOF
 cat << __EOF | diff ans3/query.log - > /dev/null || ret=1
+NS zoop.boing.good.
 NS ptang.zoop.boing.good.
 NS icky.ptang.zoop.boing.good.
 __EOF
-# There's no NS icky.icky.ptang.zoop.boing.good. query - we skipped it.
+# There's no NS icky.icky.icky.ptang.zoop.boing.good. query - we skipped it.
 cat << __EOF | diff ans4/query.log - > /dev/null || ret=1
+NS icky.ptang.zoop.boing.good.
 NS icky.icky.ptang.zoop.boing.good.
 ADDR more.icky.icky.icky.ptang.zoop.boing.good.
 __EOF
@@ -7,7 +7,6 @@ system test for recursion limits
 ns1  -- root server
 ans2 -- for example.org: delegate to ns1.(n+1).example.org for all n, up to the
                         value specified in ans.limit (or forever if limit is 0)
-        for example.net: delegate every query to 15 more name servers, with
-                         "victim" address
 ns3  -- resolver under test
+ans4 -- for ns*.example.com: return address records.
 ans7 -- "victim" server
@@ -102,7 +102,7 @@ sub reply_handler {
 	    my ($ttl, $rdata) = (3600, $localaddr);
 	    my $rr = new Net::DNS::RR("$qname $ttl $qclass $qtype $rdata");
 	    push @ans, $rr;
-	} 
+	}
 	$rcode = "NOERROR";
    } elsif ($qname =~ /^ns1\.(\d+)\.example\.org$/) {
 	my $next = $1 + 1;
@@ -113,7 +113,7 @@ sub reply_handler {
 	} else {
 	    $send_response = 1;
 	    if ($qtype eq "A") {
-		my ($ttl, $rdata) = (3600, $localaddr);
+		my ($ttl, $rdata) = (3600, "10.53.0.4");
 		my $rr = new Net::DNS::RR("$qname $ttl $qclass $qtype $rdata");
 		print("\tresponse: $qname $ttl $qclass $qtype $rdata\n");
 		push @ans, $rr;
@@ -121,22 +121,22 @@ sub reply_handler {
 	}
 	$rcode = "NOERROR";
    } elsif ($qname eq "direct.example.net" ) {
-        if ($qtype eq "A") {
-            my ($ttl, $rdata) = (3600, $localaddr);
-            my $rr = new Net::DNS::RR("$qname $ttl $qclass $qtype $rdata");
-            push @ans, $rr;
-        }
-        $rcode = "NOERROR";
+	if ($qtype eq "A") {
+	    my ($ttl, $rdata) = (3600, $localaddr);
+	    my $rr = new Net::DNS::RR("$qname $ttl $qclass $qtype $rdata");
+	    push @ans, $rr;
+	}
+	$rcode = "NOERROR";
    } elsif( $qname =~ /^ns1\.(\d+)\.example\.net$/ ) {
-        my $next = ($1 + 1) * 16;
-        for (my $i = 1; $i < 16; $i++) {
-            my $s = $next + $i;
-            my $rr = new Net::DNS::RR("$1.example.net 86400 $qclass NS ns1.$s.example.net");
-            push @auth, $rr;
-            $rr = new Net::DNS::RR("ns1.$s.example.net 86400 $qclass A 10.53.0.7");
-            push @add, $rr;
-        }
-        $rcode = "NOERROR";
+	my $next = ($1 + 1) * 16;
+	for (my $i = 1; $i < 16; $i++) {
+	    my $s = $next + $i;
+	    my $rr = new Net::DNS::RR("$1.example.net 86400 $qclass NS ns1.$s.example.net");
+	    push @auth, $rr;
+	    $rr = new Net::DNS::RR("ns1.$s.example.net 86400 $qclass A 10.53.0.7");
+	    push @add, $rr;
+	}
+	$rcode = "NOERROR";
    } else {
 	$rcode = "NXDOMAIN";
    }
@@ -0,0 +1,238 @@
+#!/usr/bin/env perl
+#
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+use strict;
+use warnings;
+
+use IO::File;
+use IO::Socket;
+use Net::DNS;
+
+my $localaddr = "10.53.0.4";
+my $limit = getlimit();
+my $no_more_waiting = 0;
+my @delayed_response;
+my $timeout;
+
+my $localport = int($ENV{'PORT'});
+if (!$localport) { $localport = 5300; }
+
+my $udpsock = IO::Socket::INET->new(LocalAddr => "$localaddr",
+   LocalPort => $localport, Proto => "udp", Reuse => 1) or die "$!";
+
+my $pidf = new IO::File "ans.pid", "w" or die "cannot open pid file: $!";
+print $pidf "$$\n" or die "cannot write pid file: $!";
+$pidf->close or die "cannot close pid file: $!";
+sub rmpid { unlink "ans.pid"; exit 1; };
+
+$SIG{INT} = \&rmpid;
+$SIG{TERM} = \&rmpid;
+
+my $count = 0;
+my $send_response = 1;
+
+sub getlimit {
+    if ( -e "ans.limit") {
+	open(FH, "<", "ans.limit");
+	my $line = <FH>;
+	chomp $line;
+	close FH;
+	if ($line =~ /^\d+$/) {
+	    return $line;
+	}
+    }
+
+    return 0;
+}
+
+# If $wait == 0 is returned, returned reply will be sent immediately.
+# If $wait == 1 is returned, sending the returned reply might be delayed; see
+# comments inside handle_UDP() for details.
+sub reply_handler {
+    my ($qname, $qclass, $qtype) = @_;
+    my ($rcode, @ans, @auth, @add, $wait);
+
+    print ("request: $qname/$qtype\n");
+    STDOUT->flush();
+
+    $wait = 0;
+    $count += 1;
+
+    if ($qname eq "count" ) {
+	if ($qtype eq "TXT") {
+	    my ($ttl, $rdata) = (0, "$count");
+	    my $rr = new Net::DNS::RR("$qname $ttl $qclass $qtype $rdata");
+	    push @ans, $rr;
+	    print ("\tcount: $count\n");
+	}
+	$rcode = "NOERROR";
+    } elsif ($qname eq "reset" ) {
+	$count = 0;
+	$send_response = 1;
+	$limit = getlimit();
+	$rcode = "NOERROR";
+	print ("\tlimit: $limit\n");
+    } elsif ($qname eq "direct.example.org" ) {
+	if ($qtype eq "A") {
+	    my ($ttl, $rdata) = (3600, $localaddr);
+	    my $rr = new Net::DNS::RR("$qname $ttl $qclass $qtype $rdata");
+	    push @ans, $rr;
+	    print ("\twait=$wait ans: $qname $ttl $qclass $qtype $rdata\n");
+	}
+	$rcode = "NOERROR";
+    } elsif ($qname eq "indirect1.example.org" ||
+	     $qname eq "indirect2.example.org" ||
+	     $qname eq "indirect3.example.org" ||
+	     $qname eq "indirect4.example.org" ||
+	     $qname eq "indirect5.example.org" ||
+	     $qname eq "indirect6.example.org" ||
+	     $qname eq "indirect7.example.org" ||
+	     $qname eq "indirect8.example.org") {
+	if ($qtype eq "A") {
+	    my ($ttl, $rdata) = (3600, $localaddr);
+	    my $rr = new Net::DNS::RR("$qname $ttl $qclass $qtype $rdata");
+	    push @ans, $rr;
+	    print ("\twait=$wait ans: $qname $ttl $qclass $qtype $rdata\n");
+	}
+	$rcode = "NOERROR";
+    } elsif ($qname =~ /^ns1\.(\d+)\.example\.org$/) {
+	my $next = $1 + 1;
+	$wait = 1;
+	if ($limit == 0) {
+	    my $rr = new Net::DNS::RR("$1.example.org 86400 $qclass NS ns1.$next.example.org");
+	    push @auth, $rr;
+	    print ("\twait=$wait auth: $1.example.org 86400 $qclass NS ns1.$next.example.org\n");
+	} else {
+	    $send_response = 1;
+	    if ($qtype eq "A") {
+		my ($ttl, $rdata) = (3600, $localaddr);
+		my $rr = new Net::DNS::RR("$qname $ttl $qclass $qtype $rdata");
+		print("\tresponse: $qname $ttl $qclass $qtype $rdata\n");
+		push @ans, $rr;
+	    }
+	}
+	$rcode = "NOERROR";
+    } elsif ($qname eq "direct.example.net" ) {
+        if ($qtype eq "A") {
+            my ($ttl, $rdata) = (3600, $localaddr);
+            my $rr = new Net::DNS::RR("$qname $ttl $qclass $qtype $rdata");
+            push @ans, $rr;
+	    print ("\twait=$wait ans: $qname $ttl $qclass $qtype $rdata\n");
+        }
+        $rcode = "NOERROR";
+    } elsif( $qname =~ /^ns1\.(\d+)\.example\.net$/ ) {
+        my $next = ($1 + 1) * 16;
+        for (my $i = 1; $i < 16; $i++) {
+            my $s = $next + $i;
+            my $rr = new Net::DNS::RR("$1.example.net 86400 $qclass NS ns1.$s.example.net");
+            push @auth, $rr;
+	    print ("\twait=$wait auth: $1.example.net 86400 $qclass NS ns1.$s.example.net\n");
+            $rr = new Net::DNS::RR("ns1.$s.example.net 86400 $qclass A 10.53.0.7");
+	    print ("\twait=$wait add: ns1.$s.example.net 86400 $qclass A 10.53.0.7\n");
+            push @add, $rr;
+        }
+        $rcode = "NOERROR";
+    } else {
+	$rcode = "NXDOMAIN";
+	    print ("\twait=$wait NXDOMAIN\n");
+    }
+
+    return ($rcode, \@ans, \@auth, \@add, $wait);
+}
+
+sub handleUDP {
+	my ($buf, $peer) = @_;
+	my ($request, $rcode, $ans, $auth, $add, $wait);
+
+	$request = new Net::DNS::Packet(\$buf, 0);
+	$@ and die $@;
+
+	my ($question) = $request->question;
+	my $qname = $question->qname;
+	my $qclass = $question->qclass;
+	my $qtype = $question->qtype;
+
+	($rcode, $ans, $auth, $add, $wait) = reply_handler($qname, $qclass, $qtype);
+
+	my $reply = $request->reply();
+
+	$reply->header->rcode($rcode);
+	$reply->header->aa(@$ans ? 1 : 0);
+	$reply->header->id($request->header->id);
+	$reply->{answer} = $ans if $ans;
+	$reply->{authority} = $auth if $auth;
+	$reply->{additional} = $add if $add;
+
+	if ($wait) {
+		# reply_handler() asked us to delay sending this reply until
+		# another reply with $wait == 1 is generated or a timeout
+		# occurs.
+		if (@delayed_response) {
+			# A delayed reply is already queued, so we can now send
+			# both the delayed reply and the current reply.
+			send_delayed_response();
+			return $reply;
+		} elsif ($no_more_waiting) {
+			# It was determined before that there is no point in
+			# waiting for "accompanying" queries.  Thus, send the
+			# current reply immediately.
+			return $reply;
+		} else {
+			# No delayed reply is queued and the client is expected
+			# to send an "accompanying" query shortly.  Do not send
+			# the current reply right now, just save it for later
+			# and wait for an "accompanying" query to be received.
+			@delayed_response = ($reply, $peer);
+			$timeout = 0.5;
+			return;
+		}
+	} else {
+		# Send reply immediately.
+		return $reply;
+	}
+}
+
+sub send_delayed_response {
+	my ($reply, $peer) = @delayed_response;
+	# Truncation to 512 bytes is required for triggering "NS explosion" on
+	# builds without IPv6 support
+	$udpsock->send($reply->data(512), 0, $peer);
+	undef @delayed_response;
+	undef $timeout;
+	print ("send_delayed_response\n");
+}
+
+# Main
+my $rin;
+my $rout;
+for (;;) {
+	$rin = '';
+	vec($rin, fileno($udpsock), 1) = 1;
+
+	select($rout = $rin, undef, undef, $timeout);
+
+	if (vec($rout, fileno($udpsock), 1)) {
+		my ($buf, $peer, $reply);
+		$udpsock->recv($buf, 512);
+		$peer = $udpsock->peername();
+		$reply = handleUDP($buf, $peer);
+		# Truncation to 512 bytes is required for triggering "NS
+		# explosion" on builds without IPv6 support
+		$udpsock->send($reply->data(512), 0, $peer) if $reply;
+	} else {
+		# An "accompanying" query was expected to come in, but did not.
+		# Assume the client never sends "accompanying" queries to
+		# prevent pointlessly waiting for them ever again.
+		$no_more_waiting = 1;
+		# Send the delayed reply to the query which caused us to wait.
+		send_delayed_response();
+	}
+}
@@ -12,6 +12,7 @@
 rm -f dig.out*
 rm -f ans?/ans.run
 rm -f ans2/ans.limit
+rm -f ans4/ans.limit
 rm -f ns?/named.memstats
 rm -f ns?/named.run
 rm -f ns*/named.conf
@@ -15,3 +15,5 @@ example.org. 60 IN NS direct.example.org.
 direct.example.org. 60 IN A 10.53.0.2
 example.net. 60 IN NS direct.example.net.
 direct.example.net. 60 IN A 10.53.0.2
+example.com. 60 IN NS direct.example.com.
+direct.example.com. 60 IN A 10.53.0.4
@@ -37,9 +37,12 @@ ns3_sends_aaaa_queries() {
 #   - if ns3 sends AAAA queries, the query count should equal $2,
 #   - if ns3 does not send AAAA queries, the query count should equal $3.
 check_query_count() {
-	count=`sed 's/[^0-9]//g;' $1`
-	expected_count_with_aaaa=$2
-	expected_count_without_aaaa=$3
+	count1=`sed 's/[^0-9]//g;' $1`
+	count2=`sed 's/[^0-9]//g;' $2`
+	count=`expr $count1 + $count2`
+	#echo_i "count1=$count1 count2=$count2 count=$count"
+	expected_count_with_aaaa=$3
+	expected_count_without_aaaa=$4

 	if ns3_sends_aaaa_queries; then
 		expected_count=$expected_count_with_aaaa
@@ -48,7 +51,7 @@ check_query_count() {
 	fi

 	if [ $count -ne $expected_count ]; then
-		echo_i "count ($count) != $expected_count"
+		echo_i "count $count (actual) != $expected_count (expected)"
 		ret=1
 	fi
 }
@@ -59,11 +62,14 @@ n=`expr $n + 1`
 echo_i "attempt excessive-depth lookup ($n)"
 ret=0
 echo "1000" > ans2/ans.limit
+echo "1000" > ans4/ans.limit
 $DIG $DIGOPTS @10.53.0.2 reset > /dev/null || ret=1
+$DIG $DIGOPTS @10.53.0.4 reset > /dev/null || ret=1
 $DIG $DIGOPTS @10.53.0.3 indirect1.example.org > dig.out.1.test$n || ret=1
 grep "status: SERVFAIL" dig.out.1.test$n > /dev/null || ret=1
 $DIG $DIGOPTS +short @10.53.0.2 count txt > dig.out.2.test$n || ret=1
-check_query_count dig.out.2.test$n 26 14
+$DIG $DIGOPTS +short @10.53.0.4 count txt > dig.out.4.test$n || ret=1
+check_query_count dig.out.2.test$n dig.out.4.test$n 27 14
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`

@@ -71,12 +77,15 @@ n=`expr $n + 1`
 echo_i "attempt permissible lookup ($n)"
 ret=0
 echo "12" > ans2/ans.limit
+echo "12" > ans4/ans.limit
 ns3_reset ns3/named1.conf.in
 $DIG $DIGOPTS @10.53.0.2 reset > /dev/null || ret=1
+$DIG $DIGOPTS @10.53.0.4 reset > /dev/null || ret=1
 $DIG $DIGOPTS @10.53.0.3 indirect2.example.org > dig.out.1.test$n || ret=1
 grep "status: NOERROR" dig.out.1.test$n > /dev/null || ret=1
 $DIG $DIGOPTS +short @10.53.0.2 count txt > dig.out.2.test$n || ret=1
-check_query_count dig.out.2.test$n 49 26
+$DIG $DIGOPTS +short @10.53.0.4 count txt > dig.out.4.test$n || ret=1
+check_query_count dig.out.2.test$n dig.out.4.test$n 50 26
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`

@@ -88,10 +97,12 @@ ret=0
 echo "12" > ans2/ans.limit
 ns3_reset ns3/named2.conf.in
 $DIG $DIGOPTS @10.53.0.2 reset > /dev/null || ret=1
+$DIG $DIGOPTS @10.53.0.4 reset > /dev/null || ret=1
 $DIG $DIGOPTS @10.53.0.3 indirect3.example.org > dig.out.1.test$n || ret=1
 grep "status: SERVFAIL" dig.out.1.test$n > /dev/null || ret=1
 $DIG $DIGOPTS +short @10.53.0.2 count txt > dig.out.2.test$n || ret=1
-check_query_count dig.out.2.test$n 12 7
+$DIG $DIGOPTS +short @10.53.0.4 count txt > dig.out.4.test$n || ret=1
+check_query_count dig.out.2.test$n dig.out.4.test$n 13 7
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`

@@ -99,12 +110,15 @@ n=`expr $n + 1`
 echo_i "attempt permissible lookup ($n)"
 ret=0
 echo "5" > ans2/ans.limit
+echo "5" > ans4/ans.limit
 ns3_reset ns3/named2.conf.in
 $DIG $DIGOPTS @10.53.0.2 reset > /dev/null || ret=1
+$DIG $DIGOPTS @10.53.0.4 reset > /dev/null || ret=1
 $DIG $DIGOPTS @10.53.0.3 indirect4.example.org > dig.out.1.test$n || ret=1
 grep "status: NOERROR" dig.out.1.test$n > /dev/null || ret=1
 $DIG $DIGOPTS +short @10.53.0.2 count txt > dig.out.2.test$n || ret=1
-check_query_count dig.out.2.test$n 21 12
+$DIG $DIGOPTS +short @10.53.0.4 count txt > dig.out.4.test$n || ret=1
+check_query_count dig.out.2.test$n dig.out.4.test$n 22 12
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`

@@ -114,13 +128,16 @@ n=`expr $n + 1`
 echo_i "attempt excessive-queries lookup ($n)"
 ret=0
 echo "13" > ans2/ans.limit
+echo "13" > ans4/ans.limit
 ns3_reset ns3/named3.conf.in
 $DIG $DIGOPTS @10.53.0.2 reset > /dev/null || ret=1
+$DIG $DIGOPTS @10.53.0.4 reset > /dev/null || ret=1
 $DIG $DIGOPTS @10.53.0.3 indirect5.example.org > dig.out.1.test$n || ret=1
 if ns3_sends_aaaa_queries; then
  grep "status: SERVFAIL" dig.out.1.test$n > /dev/null || ret=1
 fi
 $DIG $DIGOPTS +short @10.53.0.2 count txt > dig.out.2.test$n || ret=1
+$DIG $DIGOPTS +short @10.53.0.4 count txt > dig.out.4.test$n || ret=1
 eval count=`cat dig.out.2.test$n`
 [ $count -le 50 ] || { ret=1; echo_i "count ($count) !<= 50"; }
 if [ $ret != 0 ]; then echo_i "failed"; fi
@@ -145,7 +162,7 @@ echo_i "set max-recursion-depth=100, max-recursion-queries=40"
 n=`expr $n + 1`
 echo_i "attempt excessive-queries lookup ($n)"
 ret=0
-echo "10" > ans2/ans.limit
+echo "11" > ans2/ans.limit
 ns3_reset ns3/named4.conf.in
 $DIG $DIGOPTS @10.53.0.2 reset > /dev/null || ret=1
 $DIG $DIGOPTS @10.53.0.3 indirect7.example.org > dig.out.1.test$n || ret=1
@@ -187,5 +204,6 @@ eval count=`cat dig.out.3.test$n`
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`

+#grep "duplicate query" ns3/named.run
 echo_i "exit status: $status"
 [ $status -eq 0 ] || exit 1
@@ -93,6 +93,11 @@ for (;;) {
 		$packet->push("answer",
 			      new Net::DNS::RR($qname .
 				       " 300 CNAME goodcname.example.org"));
+	} elsif ($qname =~ /^nodata\.example\.net$/i) {
+		$packet->header->aa(1);
+	} elsif ($qname =~ /^nxdomain\.example\.net$/i) {
+		$packet->header->aa(1);
+		$packet->header->rcode(NXDOMAIN);
 	} elsif ($qname eq "cname.sub.example.org") {
 		$packet->push("answer",
 			      new Net::DNS::RR($qname .
@@ -109,6 +114,10 @@ for (;;) {
 			      new Net::DNS::RR($qname . " 300 A 192.0.2.1"));
 	} elsif ($qname eq "foo.glue-in-answer.example.org") {
 		$packet->push("answer", new Net::DNS::RR($qname . " 300 A 192.0.2.1"));
+	} elsif ($qname eq "ns.example.net") {
+		$packet->push("answer",
+			      new Net::DNS::RR($qname .
+				       " 300 A 10.53.0.3"));
 	} else {
 		$packet->push("answer", new Net::DNS::RR("www.example.com 300 A 1.2.3.4"));
 	}
@@ -74,6 +74,9 @@ sub handleUDP {
 	} elsif ($qname eq "ns.no-questions") {
 		$packet->push("answer", new Net::DNS::RR($qname . " 300 A 10.53.0.8"));
 		return $packet->data;
+	} elsif ($qname =~ /\.formerr-to-all$/) {
+		$packet->header->rcode("FORMERR");
+		return $packet->data;
 	}

 	# don't use Net::DNS to construct the header only reply as early
@@ -24,3 +24,5 @@ example.net.		NS	ns.example.net.
 ns.example.net.		A	10.53.0.6
 no-questions.		NS	ns.no-questions.
 ns.no-questions.	A	10.53.0.8
+formerr-to-all.		NS	ns.formerr-to-all.
+ns.formerr-to-all.	A	10.53.0.8
@@ -788,5 +788,13 @@ grep "1.2.3.4" dig.ns5.out.${n} > /dev/null && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`

+n=`expr $n + 1`
+echo_i "checking SERVFAIL is returned when all authoritative servers return FORMERR ($n)"
+ret=0
+$DIG $DIGOPTS @10.53.0.5 ns.formerr-to-all. a > dig.ns5.out.${n} || ret=1
+grep "status: SERVFAIL" dig.ns5.out.${n} > /dev/null || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=`expr $status + $ret`
+
 echo_i "exit status: $status"
 [ $status -eq 0 ] || exit 1
@@ -22,8 +22,8 @@ zone=example.
 infile=example.db.in
 zonefile=example.db

-keyname1=`$KEYGEN -q -a DSA -b 768 -n zone $zone`
-keyname2=`$KEYGEN -q -a DSA -b 768 -n zone $zone`
+keyname1=`$KEYGEN -q -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone`
+keyname2=`$KEYGEN -q -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone`

 cat $infile $keyname1.key $keyname2.key >$zonefile
 echo root-key-sentinel-is-ta-$oldid A 10.53.0.1 >> $zonefile
@@ -21,7 +21,6 @@ options {
 	notify no;
 	minimal-responses no;
 	recursion yes;
-	qname-minimization disabled;
 	dnssec-validation yes;
 };

@@ -27,7 +27,6 @@ options {
 	notify yes;
 	minimal-responses no;
 	recursion yes;
-	qname-minimization disabled;
 	dnssec-validation yes;

 	response-policy {
@@ -21,7 +21,6 @@ options {
 	notify no;
 	minimal-responses no;
 	recursion yes;
-	qname-minimization disabled;
 	dnssec-validation yes;
 };

@@ -29,7 +29,6 @@ options {
 	notify yes;
 	minimal-responses no;
 	recursion yes;
-	qname-minimization disabled;
 	dnssec-validation yes;

 	# turn rpz on or off
@@ -23,8 +23,8 @@ options {
 	forwarders { 10.53.0.3; };
 	minimal-responses no;
 	recursion yes;
-	qname-minimization disabled;
 	dnssec-validation yes;
+	qname-minimization disabled;

 	response-policy {
 	    zone "policy1" min-update-interval 0;
@@ -21,7 +21,6 @@ options {
 	listen-on-v6 { none; };
 	minimal-responses no;
 	recursion yes;
-	qname-minimization disabled;
 	dnssec-validation yes;

 	response-policy {
@@ -1,4 +1,4 @@
-#!/bin/sh
+#!/bin/sh -x
 #
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
@@ -1,4 +1,4 @@
-#!/bin/sh
+#!/bin/sh -x
 #
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
@@ -24,28 +24,6 @@ grep "another named process" ns2/named.run > /dev/null && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`

-if [ ! "$CYGWIN" ]; then
-    n=`expr $n + 1`
-    echo_i "verifying that named checks for conflicting listeners ($n)"
-    ret=0
-    (cd ns2; $NAMED -c named-alt1.conf -D ns2-extra-1 -X other.lock -m record,size,mctx -d 99 -g -U 4 >> named2.run 2>&1 & )
-    for i in 1 2 3 4 5 6 7 8 9
-    do
-        grep "unable to listen on any configured interface" ns2/named2.run > /dev/null && break
-        sleep 1
-    done
-    grep "unable to listen on any configured interface" ns2/named2.run > /dev/null || ret=1
-    for i in 1 2 3 4 5 6 7 8 9
-    do
-	grep "exiting (due to fatal error)" ns2/named2.run > /dev/null && break
-	sleep 1
-    done
-    pid=`cat ns2/named2.pid 2>/dev/null`
-    test "${pid:+set}" = set && $KILL -15 ${pid} >/dev/null 2>&1
-    if [ $ret != 0 ]; then echo_i "failed"; fi
-    status=`expr $status + $ret`
-fi
-
 n=`expr $n + 1`
 echo_i "verifying that named checks for conflicting named processes ($n)"
 ret=0
@@ -16,8 +16,8 @@ zone=example.
 infile=example.db.in
 zonefile=example.db

-keyname1=`$KEYGEN -q -a DSA -b 768 -n zone $zone`
-keyname2=`$KEYGEN -q -a DSA -b 768 -n zone $zone`
+keyname1=`$KEYGEN -q -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone`
+keyname2=`$KEYGEN -q -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone`

 cat $infile $keyname1.key $keyname2.key >$zonefile

@@ -159,13 +159,13 @@ sub stop_signal {
 		$result = system("/bin/kill -f -$sig $pid");
 		unlink $pid_file;
 		if ($result != 0) {
-			print "I:$server died before a SIG$sig was sent\n";
+			print "I:$test:$server died before a SIG$sig was sent\n";
 			$errors++;
 		}
 	} else {
 		$result = kill $sig, $pid;
 		if (!$result) {
-			print "I:$server died before a SIG$sig was sent\n";
+			print "I:$test:$server died before a SIG$sig was sent\n";
 			unlink $pid_file;
 			$errors++;
 		}
@@ -15,7 +15,7 @@ SYSTEMTESTTOP=${SYSTEMTESTTOP:=..}
 prog=$0

 args=""
-alg="-a RSAMD5 -b 1024"
+alg="-a $DEFAULT_ALGORITHM -b $DEFAULT_BITS"
 quiet=0

 msg1="cryptography"
@@ -16,5 +16,5 @@ $SHELL clean.sh

 copy_setports ns1/named.conf.in ns1/named.conf

-key=`$KEYGEN -Cq -K ns1 -a DSA -b 512 -n HOST -T KEY key.example.nil.`
+key=`$KEYGEN -Cq -K ns1 -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n HOST -T KEY key.example.nil.`
 cat ns1/example.nil.db.in ns1/${key}.key > ns1/example.nil.db
@@ -31,12 +31,12 @@ do
 	$DIG $DIGOPTS @10.53.0.3 -f query.list > dig.out$i.5.test$n &
 	$DIG $DIGOPTS @10.53.0.3 -f query.list > dig.out$i.6.test$n &
 	wait
-	grep "status: SERVFAIL" dig.out$i.1.test$n && ret=1
-	grep "status: SERVFAIL" dig.out$i.2.test$n && ret=1
-	grep "status: SERVFAIL" dig.out$i.3.test$n && ret=1
-	grep "status: SERVFAIL" dig.out$i.4.test$n && ret=1
-	grep "status: SERVFAIL" dig.out$i.5.test$n && ret=1
-	grep "status: SERVFAIL" dig.out$i.6.test$n && ret=1
+	grep "status: SERVFAIL" dig.out$i.1.test$n > /dev/null && ret=1
+	grep "status: SERVFAIL" dig.out$i.2.test$n > /dev/null && ret=1
+	grep "status: SERVFAIL" dig.out$i.3.test$n > /dev/null && ret=1
+	grep "status: SERVFAIL" dig.out$i.4.test$n > /dev/null && ret=1
+	grep "status: SERVFAIL" dig.out$i.5.test$n > /dev/null && ret=1
+	grep "status: SERVFAIL" dig.out$i.6.test$n > /dev/null && ret=1
 	[ $ret = 1 ] && break
 	i=`expr $i + 1`
 	echo_i "successfully completed pass $i of $passes"
@@ -46,6 +46,7 @@ status=`expr $status + $ret`

 n=`expr $n + 1`
 echo_i "check repeated recursive lookups of non recurring TTL=0 responses get new values ($n)"
+ret=0
 count=`(
 $DIG $DIGOPTS +short @10.53.0.3 foo.increment
 $DIG $DIGOPTS +short @10.53.0.3 foo.increment
@@ -71,12 +72,12 @@ do
 	$DIG $DIGOPTS @10.53.0.3 www.one.tld > dig.out$i.4.test$n
 	$DIG $DIGOPTS @10.53.0.3 www.one.tld > dig.out$i.5.test$n
 	$DIG $DIGOPTS @10.53.0.3 www.one.tld > dig.out$i.6.test$n
-	grep "status: SERVFAIL" dig.out$i.1.test$n && ret=1
-	grep "status: SERVFAIL" dig.out$i.2.test$n && ret=1
-	grep "status: SERVFAIL" dig.out$i.3.test$n && ret=1
-	grep "status: SERVFAIL" dig.out$i.4.test$n && ret=1
-	grep "status: SERVFAIL" dig.out$i.5.test$n && ret=1
-	grep "status: SERVFAIL" dig.out$i.6.test$n && ret=1
+	grep "status: SERVFAIL" dig.out$i.1.test$n > /dev/null && ret=1
+	grep "status: SERVFAIL" dig.out$i.2.test$n > /dev/null && ret=1
+	grep "status: SERVFAIL" dig.out$i.3.test$n > /dev/null && ret=1
+	grep "status: SERVFAIL" dig.out$i.4.test$n > /dev/null && ret=1
+	grep "status: SERVFAIL" dig.out$i.5.test$n > /dev/null && ret=1
+	grep "status: SERVFAIL" dig.out$i.6.test$n > /dev/null && ret=1
 	[ $ret = 1 ] && break
 	i=`expr $i + 1`
 	echo_i "successfully completed pass $i of $passes"
@@ -1,4 +1,4 @@
-/* config.h.in.  Generated from configure.in by autoheader.  */
+/* config.h.in.  Generated from configure.ac by autoheader.  */

 /* Define if building universal (internal helper macro) */
 #undef AC_APPLE_UNIVERSAL_BUILD
@@ -72,6 +72,9 @@
 /* Define to 1 if you have the <cmocka.h> header file. */
 #undef HAVE_CMOCKA_H

+/* Define to 1 if you have the `cpuset_setaffinty' function. */
+#undef HAVE_CPUSET_SETAFFINITY
+
 /* Define to 1 if you have the <devpoll.h> header file. */
 #undef HAVE_DEVPOLL_H

@@ -147,6 +150,9 @@
 /* Define to 1 if you have the <fcntl.h> header file. */
 #undef HAVE_FCNTL_H

+/* Define to 1 if you have the `FIPS_mode' function. */
+#undef HAVE_FIPS_MODE
+
 /* Build with GeoIP support */
 #undef HAVE_GEOIP

@@ -252,6 +258,9 @@
 /* define if OpenSSL supports Ed25519 */
 #undef HAVE_OPENSSL_ED25519

+/* Define to 1 if you have the `processor_bind' function. */
+#undef HAVE_PROCESSOR_BIND
+
 /* Define if you have POSIX threads libraries and header files. */
 #undef HAVE_PTHREAD

@@ -270,6 +279,9 @@
 /* Have PTHREAD_PRIO_INHERIT. */
 #undef HAVE_PTHREAD_PRIO_INHERIT

+/* Define to 1 if you have the `pthread_setaffinity_np' function. */
+#undef HAVE_PTHREAD_SETAFFINITY_NP
+
 /* Define to 1 if you have the `pthread_setname_np' function. */
 #undef HAVE_PTHREAD_SETNAME_NP

@@ -300,6 +312,9 @@
 /* Define to 1 if you have the <sched.h> header file. */
 #undef HAVE_SCHED_H

+/* Define to 1 if you have the `sched_setaffinity' function. */
+#undef HAVE_SCHED_SETAFFINITY
+
 /* Define to 1 if you have the `sched_yield' function. */
 #undef HAVE_SCHED_YIELD

@@ -354,6 +369,9 @@
 /* Define to 1 if you have the <sys/capability.h> header file. */
 #undef HAVE_SYS_CAPABILITY_H

+/* Define to 1 if you have the <sys/cpuset.h> header file. */
+#undef HAVE_SYS_CPUSET_H
+
 /* Define to 1 if you have the <sys/devpoll.h> header file. */
 #undef HAVE_SYS_DEVPOLL_H

@@ -363,6 +381,12 @@
 /* Define to 1 if you have the <sys/param.h> header file. */
 #undef HAVE_SYS_PARAM_H

+/* Define to 1 if you have the <sys/prctl.h> header file. */
+#undef HAVE_SYS_PRCTL_H
+
+/* Define to 1 if you have the <sys/procset.h> header file. */
+#undef HAVE_SYS_PROCSET_H
+
 /* Define to 1 if you have the <sys/select.h> header file. */
 #undef HAVE_SYS_SELECT_H

@@ -899,6 +899,7 @@ with_geoip
 with_locktype
 with_libtool
 with_openssl
+enable_fips_mode
 with_cc_alg
 enable_native_pkcs11
 with_pkcs11
@@ -1595,6 +1596,7 @@ Optional Features:
  --enable-kqueue         use BSD kqueue when available [default=yes]
  --enable-epoll          use Linux epoll when available [default=auto]
  --enable-devpoll        use /dev/poll when available [default=yes]
+  --enable-fips-mode      enable FIPS mode in OpenSSL library [default=no]
  --enable-native-pkcs11  use native PKCS11 for public-key crypto [default=no]
  --enable-largefile      64-bit file support
  --enable-backtrace      log stack backtrace on abort [default=yes]
@@ -13616,6 +13618,37 @@ $as_echo "#define FLEXIBLE_ARRAY_MEMBER /**/" >>confdefs.h
  fi


+#
+# Check for yield support on ARM processors
+#
+case $host in #(
+  arm*) :
+
+	  { $as_echo "$as_me:${as_lineno-$LINENO}: checking for yield instruction support" >&5
+$as_echo_n "checking for yield instruction support... " >&6; }
+	  cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+/* end confdefs.h.  */
+
+int
+main ()
+{
+__asm__ __volatile__ ("yield")
+
+  ;
+  return 0;
+}
+_ACEOF
+if ac_fn_c_try_compile "$LINENO"; then :
+  { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
+$as_echo "yes" >&6; }
+else
+  as_fn_error $? "no, try adding -march=native or -march=armv7-a to CFLAGS (see PLATFORM.md for more information)" "$LINENO" 5
+fi
+rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext ;; #(
+  *) :
+     ;;
+esac
+
 for ac_func in sysctlbyname
 do :
  ac_fn_c_check_func "$LINENO" "sysctlbyname" "ac_cv_func_sysctlbyname"
@@ -15216,6 +15249,114 @@ fi
 done


+for ac_header in sys/cpuset.h
+do :
+  ac_fn_c_check_header_mongrel "$LINENO" "sys/cpuset.h" "ac_cv_header_sys_cpuset_h" "$ac_includes_default"
+if test "x$ac_cv_header_sys_cpuset_h" = xyes; then :
+  cat >>confdefs.h <<_ACEOF
+#define HAVE_SYS_CPUSET_H 1
+_ACEOF
+
+fi
+
+done
+
+for ac_header in sys/procset.h
+do :
+  ac_fn_c_check_header_mongrel "$LINENO" "sys/procset.h" "ac_cv_header_sys_procset_h" "$ac_includes_default"
+if test "x$ac_cv_header_sys_procset_h" = xyes; then :
+  cat >>confdefs.h <<_ACEOF
+#define HAVE_SYS_PROCSET_H 1
+_ACEOF
+
+fi
+
+done
+
+for ac_func in pthread_setaffinity_np cpuset_setaffinity processor_bind sched_setaffinity
+do :
+  as_ac_var=`$as_echo "ac_cv_func_$ac_func" | $as_tr_sh`
+ac_fn_c_check_func "$LINENO" "$ac_func" "$as_ac_var"
+if eval test \"x\$"$as_ac_var"\" = x"yes"; then :
+  cat >>confdefs.h <<_ACEOF
+#define `$as_echo "HAVE_$ac_func" | $as_tr_cpp` 1
+_ACEOF
+
+fi
+done
+
+
+#
+# Additional OS-specific issues related to pthreads and sigwait.
+#
+case "$host" in
+	#
+	# One more place to look for sigwait.
+	#
+	*-freebsd*)
+		{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for sigwait in -lc_r" >&5
+$as_echo_n "checking for sigwait in -lc_r... " >&6; }
+if ${ac_cv_lib_c_r_sigwait+:} false; then :
+  $as_echo_n "(cached) " >&6
+else
+  ac_check_lib_save_LIBS=$LIBS
+LIBS="-lc_r  $LIBS"
+cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+/* end confdefs.h.  */
+
+/* Override any GCC internal prototype to avoid an error.
+   Use char because int might match the return type of a GCC
+   builtin and then its argument prototype would still apply.  */
+#ifdef __cplusplus
+extern "C"
+#endif
+char sigwait ();
+int
+main ()
+{
+return sigwait ();
+  ;
+  return 0;
+}
+_ACEOF
+if ac_fn_c_try_link "$LINENO"; then :
+  ac_cv_lib_c_r_sigwait=yes
+else
+  ac_cv_lib_c_r_sigwait=no
+fi
+rm -f core conftest.err conftest.$ac_objext \
+    conftest$ac_exeext conftest.$ac_ext
+LIBS=$ac_check_lib_save_LIBS
+fi
+{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_c_r_sigwait" >&5
+$as_echo "$ac_cv_lib_c_r_sigwait" >&6; }
+if test "x$ac_cv_lib_c_r_sigwait" = xyes; then :
+  $as_echo "#define HAVE_SIGWAIT 1" >>confdefs.h
+
+fi
+
+		case $host in
+		*-freebsd5.[012]|*-freebsd5.[012].*);;
+		*-freebsd5.[3456789]|*-freebsd5.[3456789].*)
+			$as_echo "#define NEED_PTHREAD_SCOPE_SYSTEM 1" >>confdefs.h
+
+			;;
+		*-freebsd6.*)
+			$as_echo "#define NEED_PTHREAD_SCOPE_SYSTEM 1" >>confdefs.h
+
+			;;
+		esac
+		;;
+	#
+	# LinuxThreads requires some changes to the way we
+	# deal with signals.
+	#
+	*-linux*)
+		$as_echo "#define HAVE_LINUXTHREADS 1" >>confdefs.h
+
+		;;
+esac
+
 # Look for functions relating to thread naming
 for ac_func in pthread_setname_np pthread_set_name_np
 do :
@@ -15715,6 +15856,46 @@ fi
 done


+#
+# Check whether FIPS mode is available and whether we should enable it
+#
+# Check whether --enable-fips-mode was given.
+if test "${enable_fips_mode+set}" = set; then :
+  enableval=$enable_fips_mode;
+else
+  enable_fips_mode="no"
+fi
+
+
+{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether to enable FIPS mode in OpenSSL library" >&5
+$as_echo_n "checking whether to enable FIPS mode in OpenSSL library... " >&6; }
+case $enable_fips_mode in #(
+  yes) :
+    { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
+$as_echo "yes" >&6; }
+		for ac_func in FIPS_mode
+do :
+  ac_fn_c_check_func "$LINENO" "FIPS_mode" "ac_cv_func_FIPS_mode"
+if test "x$ac_cv_func_FIPS_mode" = xyes; then :
+  cat >>confdefs.h <<_ACEOF
+#define HAVE_FIPS_MODE 1
+_ACEOF
+
+else
+  { { $as_echo "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5
+$as_echo "$as_me: error: in \`$ac_pwd':" >&2;}
+as_fn_error $? "OpenSSL FIPS mode requested but not available.
+See \`config.log' for more details" "$LINENO" 5; }
+fi
+done
+ ;; #(
+  no) :
+    { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
+$as_echo "no" >&6; } ;; #(
+  *) :
+     ;;
+esac
+
 CFLAGS="$save_CFLAGS"
 LIBS="$save_LIBS"
 LDFLAGS="$save_LDFLAGS"
@@ -460,6 +460,20 @@ AC_C_INLINE
 AC_C_VOLATILE
 AC_C_FLEXIBLE_ARRAY_MEMBER

+#
+# Check for yield support on ARM processors
+#
+AS_CASE([$host],
+	[arm*],[
+	  AC_MSG_CHECKING([for yield instruction support])
+	  AC_COMPILE_IFELSE(
+	    [AC_LANG_PROGRAM(
+	       [[]],
+	       [[__asm__ __volatile__ ("yield")]]
+	     )],
+	    [AC_MSG_RESULT([yes])],
+	    [AC_MSG_ERROR([no, try adding -march=native or -march=armv7-a to CFLAGS (see PLATFORM.md for more information)])])])
+
 AC_CHECK_FUNCS([sysctlbyname])

 #
@@ -701,6 +715,38 @@ AC_CHECK_HEADERS([sched.h])
 AC_SEARCH_LIBS([sched_yield],[rt])
 AC_CHECK_FUNCS([sched_yield pthread_yield pthread_yield_np])

+AC_CHECK_HEADERS([sys/cpuset.h])
+AC_CHECK_HEADERS([sys/procset.h])
+AC_CHECK_FUNCS([pthread_setaffinity_np cpuset_setaffinity processor_bind sched_setaffinity])
+
+#
+# Additional OS-specific issues related to pthreads and sigwait.
+#
+case "$host" in
+	#
+	# One more place to look for sigwait.
+	#
+	*-freebsd*)
+		AC_CHECK_LIB(c_r, sigwait, AC_DEFINE(HAVE_SIGWAIT),)
+		case $host in
+		*-freebsd5.[[012]]|*-freebsd5.[[012]].*);;
+		*-freebsd5.[[3456789]]|*-freebsd5.[[3456789]].*)
+			AC_DEFINE(NEED_PTHREAD_SCOPE_SYSTEM)
+			;;
+		*-freebsd6.*)
+			AC_DEFINE(NEED_PTHREAD_SCOPE_SYSTEM)
+			;;
+		esac
+		;;
+	#
+	# LinuxThreads requires some changes to the way we
+	# deal with signals.
+	#
+	*-linux*)
+		AC_DEFINE(HAVE_LINUXTHREADS)
+		;;
+esac
+
 # Look for functions relating to thread naming
 AC_CHECK_FUNCS([pthread_setname_np pthread_set_name_np])
 AC_CHECK_HEADERS([pthread_np.h], [], [], [#include <pthread.h>])
@@ -836,6 +882,21 @@ AC_CHECK_FUNCS([EVP_aes_128_ecb EVP_aes_192_ecb EVP_aes_256_ecb], [:],
 #
 AC_CHECK_FUNCS([DH_get0_key ECDSA_SIG_get0 RSA_set0_key DSA_get0_pqg])

+#
+# Check whether FIPS mode is available and whether we should enable it
+#
+AC_ARG_ENABLE([fips-mode],
+	      [AS_HELP_STRING([--enable-fips-mode],
+			      [enable FIPS mode in OpenSSL library [default=no]])],
+	      [], [enable_fips_mode="no"])
+
+AC_MSG_CHECKING([whether to enable FIPS mode in OpenSSL library])
+AS_CASE([$enable_fips_mode],
+	[yes], [AC_MSG_RESULT([yes])
+		AC_CHECK_FUNCS([FIPS_mode],
+			       [], [AC_MSG_FAILURE([OpenSSL FIPS mode requested but not available.])])],
+	[no], [AC_MSG_RESULT([no])])
+
 CFLAGS="$save_CFLAGS"
 LIBS="$save_LIBS"
 LDFLAGS="$save_LDFLAGS"
@@ -2201,43 +2201,54 @@ allow-update { !{ !localnets; any; }; key host1-host2. ;};

      </section>

-      <section xml:id="dnssec_config"><info><title>Configuring Servers</title></info>
-
+      <section xml:id="dnssec_config"><info><title>Configuring Servers for DNSSEC</title></info>
 	<para>
 	  To enable <command>named</command> to respond appropriately
-	  to DNS requests from DNSSEC aware clients,
-	  <command>dnssec-enable</command> must be set to yes.
-	  This is the default setting.
+	  to DNS requests from DNSSEC-aware clients,
+	  <command>dnssec-enable</command> must be set to
+	  <userinput>yes</userinput>. This is the default setting.
 	</para>
-
 	<para>
-	  To enable <command>named</command> to validate answers from
-	  other servers, the <command>dnssec-enable</command> option
-	  must be set to <userinput>yes</userinput>, and the
+	  To enable <command>named</command> to validate answers
+	  received from other servers, the
 	  <command>dnssec-validation</command> option must be set to
 	  either <userinput>yes</userinput> or <userinput>auto</userinput>.
 	</para>
-
 	<para>
 	  When <command>dnssec-validation</command> is set to
 	  <userinput>auto</userinput>, a trust anchor for the DNS
 	  root zone will automatically be used. This trust anchor is
 	  provided as part of BIND and is kept up to date using RFC 5011
 	  key management.
-	  If <command>dnssec-validation</command> is set to
-	  <userinput>yes</userinput>, then
-	  DNSSEC validation only occurs if
-	  at least one trust anchor has been explicitly configured
-	  in <filename>named.conf</filename>,
+	</para>
+	<para>
+	  When <command>dnssec-validation</command> is set to
+	  <userinput>yes</userinput>, DNSSEC validation will only occur
+	  if at least one trust anchor has been explicitly configured
+	  in <filename>named.conf</filename>
 	  using a <command>trusted-keys</command> or
 	  <command>managed-keys</command> statement.
-	  If <command>dnssec-validation</command> is set to
-	  <userinput>no</userinput>, then DNSSEC validation will
-	  not occur.
+	</para>
+	<para>
+	  When <command>dnssec-validation</command> is set to
+	  <userinput>no</userinput>, DNSSEC validation will not occur.
+	</para>
+	<para>
 	  The default is <userinput>auto</userinput> unless BIND is
 	  built with <command>configure --disable-auto-validation</command>,
 	  in which case the default is <userinput>yes</userinput>.
 	</para>
+	<para>
+	  If <command>dnssec-enable</command> is set to
+	  <userinput>no</userinput>, then the default for
+	  <command>dnssec-validation</command> is also changed to
+	  <userinput>no</userinput>. If
+	  <command>dnssec-validation</command> is set to
+	  <userinput>yes</userinput>, the server will
+	  perform DNSSEC validation internally, but will not return
+	  signatures when queried - but it will not be turned on
+	  automatically.
+	</para>

 	<para>
 	  <command>trusted-keys</command> are copies of DNSKEY RRs
@@ -4366,10 +4377,11 @@ badresp:1,adberr:0,findfail:0,valfail:0]
 		The <command>dnstap</command> option is a bracketed list
 		of message types to be logged. These may be set differently
 		for each view. Supported types are <literal>client</literal>,
-		<literal>auth</literal>, <literal>resolver</literal>, and
-		<literal>forwarder</literal>.  Specifying type
-		<literal>all</literal> will cause all <command>dnstap</command>
-		messages to be logged, regardless of type.
+		<literal>auth</literal>, <literal>resolver</literal>,
+		<literal>forwarder</literal>, and <literal>update</literal>.
+		Specifying type <literal>all</literal> will cause all
+		<command>dnstap</command> messages to be logged, regardless of
+		type.
 	      </para>
 	      <para>
 		Each type may take an additional argument to indicate whether
@@ -6599,34 +6611,54 @@ options {
 	      <term><command>dnssec-validation</command></term>
 	      <listitem>
 		<para>
-		  Enable DNSSEC validation in <command>named</command>.
-		  Note <command>dnssec-enable</command> also needs to be
-		  set to <userinput>yes</userinput> to be effective.
+		  This enables DNSSEC validation in <command>named</command>.
+		  Note that <command>dnssec-enable</command> also needs to
+		  be set to <userinput>yes</userinput> for signatures to be
+		  returned to the client along with validated answers.
+		</para>
+	        <para>
+		  If set to <userinput>auto</userinput>,
+		  DNSSEC validation is enabled, and a default trust anchor
+		  for the DNS root zone is used.
+		</para>
+		<para>
+		  If set to <userinput>yes</userinput>, DNSSEC validation is
+		  enabled, but a trust anchor must be manually configured
+		  using a <command>trusted-keys</command>
+		  or <command>managed-keys</command> statement; if there
+		  is no configured trust anchor, validation will not take
+		  place.
+		</para>
+		<para>
 		  If set to <userinput>no</userinput>, DNSSEC validation
 		  is disabled.
 		</para>
-	        <para>
-		  If set to <userinput>auto</userinput>, DNSSEC validation
-		  is enabled, and a default trust anchor for the DNS root
-		  zone is used.  If set to <userinput>yes</userinput>,
-		  DNSSEC validation is enabled, but a trust anchor must be
-		  manually configured using a <command>trusted-keys</command>
-		  or <command>managed-keys</command> statement.  The default
-		  is <userinput>yes</userinput>.
+		<para>
+		  The default is <userinput>auto</userinput>, unless
+		  BIND is built with
+		  <command>configure --disable-auto-validation</command>,
+		  in which case the default is <userinput>yes</userinput>.
+		  If <command>dnssec-enable</command> is set to
+		  <userinput>no</userinput>, then the default for
+		  <command>dnssec-validation</command> is also
+		  <userinput>no</userinput>. Validation can still be turned on
+		  if desired - this results in a server that performs DNSSEC
+		  validation but does not return signatures when queried -
+		  but it will not be turned on automatically.
 		</para>
 		<para>
 		  The default root trust anchor is stored in the file
 		  <filename>bind.keys</filename>.
 		  <command>named</command> will load that key at
 		  startup if <command>dnssec-validation</command> is
-		  set to <constant>auto</constant>.  A copy of the file is
+		  set to <userinput>auto</userinput>.  A copy of the file is
 		  installed along with BIND 9, and is current as of the
 		  release date.  If the root key expires, a new copy of
 		  <filename>bind.keys</filename> can be downloaded
 		  from <link xmlns:xlink="http://www.w3.org/1999/xlink" xlink:href="https://www.isc.org/bind-keys">https://www.isc.org/bind-keys</link>.
 		</para>
 		<para>
-		  To prevent problems if <filename>bind.keys</filename> is
+		  (To prevent problems if <filename>bind.keys</filename> is
 		  not found, the current trust anchor is also compiled in
 		  to <command>named</command>.  Relying on this is not
 		  recommended, however, as it requires <command>named</command>
@@ -6634,8 +6666,8 @@ options {
 		</para>
 		<note>
 		  <para>
-		    <command>named</command> <emphasis>only</emphasis>
-		    loads the root key from <filename>bind.keys</filename>.
+		    <command>named</command> loads <emphasis>only</emphasis>
+		    the root key from <filename>bind.keys</filename>.
 		    The file cannot be used to store keys for other zones.
 		    The root key in <filename>bind.keys</filename> is ignored
 		    if <command>dnssec-validation auto</command> is not in
@@ -63,7 +63,7 @@
 	<command>sig-signing-type</command> <replaceable>integer</replaceable>;
 	<command>sig-validity-interval</command> <replaceable>integer</replaceable> [ <replaceable>integer</replaceable> ];
 	<command>update-check-ksk</command> <replaceable>boolean</replaceable>;
-	<command>update-policy</command> ( local | { ( deny | grant ) <replaceable>string</replaceable> ( 6to4-self | external | krb5-self | krb5-subdomain | ms-self | ms-subdomain | name | self | selfsub | selfwild | subdomain | tcp-self | wildcard | zonesub ) [ <replaceable>string</replaceable> ] <replaceable>rrtypelist</replaceable>; ... };
+	<command>update-policy</command> ( local | { ( deny | grant ) <replaceable>string</replaceable> ( 6to4-self | external | krb5-self | krb5-selfsub | krb5-subdomain | ms-self | ms-selfsub | ms-subdomain | name | self | selfsub | selfwild | subdomain | tcp-self | wildcard | zonesub ) [ <replaceable>string</replaceable> ] <replaceable>rrtypelist</replaceable>; ... };
 	<command>zero-no-soa-ttl</command> <replaceable>boolean</replaceable>;
 	<command>zone-statistics</command> ( full | terse | none | <replaceable>boolean</replaceable> );
 };
@@ -207,6 +207,15 @@
 	  in the respective principals.
 	</para>
      </listitem>
+      <listitem>
+	<para>
+	  The new configure option <command>--enable-fips-mode</command>
+	  can be used to make BIND enable and enforce FIPS mode in the
+	  OpenSSL library.  When compiled with such option the BIND will
+	  refuse to run if FIPS mode can't be enabled, thus this option
+	  must be only enabled for the systems where FIPS mode is available.
+	</para>
+      </listitem>
    </itemizedlist>
  </section>

@@ -373,6 +382,11 @@
 	  usually long after their end-of-life date and they are
 	  neither developed nor supported by their respective vendors.
 	</para>
+	<para>
+	  Support for DSA and DSA-NSEC3-SHA1 algorithms has been
+	  removed from BIND as the DSA key length is limited to 1024
+	  bits and this is not considered secure enough.
+	</para>
      </listitem>
    </itemizedlist>
  </section>
@@ -31,6 +31,7 @@
 	    ] [ dscp <replaceable>integer</replaceable> ];
 	<command>alt-transfer-source-v6</command> ( <replaceable>ipv6_address</replaceable> | * ) [ port ( <replaceable>integer</replaceable> |
 	    * ) ] [ dscp <replaceable>integer</replaceable> ];
+	<command>answer-cookie</command> <replaceable>boolean</replaceable>;
 	<command>attach-cache</command> <replaceable>string</replaceable>;
 	<command>auth-nxdomain</command> <replaceable>boolean</replaceable>; // default changed
 	<command>auto-dnssec</command> ( allow | maintain | off );
@@ -96,8 +97,8 @@
 	<command>dnssec-secure-to-insecure</command> <replaceable>boolean</replaceable>;
 	<command>dnssec-update-mode</command> ( maintain | no-resign );
 	<command>dnssec-validation</command> ( yes | no | auto );
-	<command>dnstap</command> { ( all | auth | client | forwarder | resolver ) [ ( query |
-	    <command>response</command> ) ]; ... };
+	<command>dnstap</command> { ( all | auth | client | forwarder | resolver | update ) [
+	    ( query | response ) ]; ... };
 	<command>dnstap-identity</command> ( <replaceable>quoted_string</replaceable> | none | hostname );
 	<command>dnstap-output</command> ( file | unix ) <replaceable>quoted_string</replaceable> [ size ( unlimited |
 	    <replaceable>size</replaceable> ) ] [ versions ( unlimited | <replaceable>integer</replaceable> ) ] [ suffix (
@@ -51,7 +51,7 @@ zone <string> [ <class> ] {
 	sig-signing-type <integer>;
 	sig-validity-interval <integer> [ <integer> ];
 	update-check-ksk <boolean>;
-	update-policy ( local | { ( deny | grant ) <string> ( 6to4-self | external | krb5-self | krb5-subdomain | ms-self | ms-subdomain | name | self | selfsub | selfwild | subdomain | tcp-self | wildcard | zonesub ) [ <string> ] <rrtypelist>; ... };
+	update-policy ( local | { ( deny | grant ) <string> ( 6to4-self | external | krb5-self | krb5-selfsub | krb5-subdomain | ms-self | ms-selfsub | ms-subdomain | name | self | selfsub | selfwild | subdomain | tcp-self | wildcard | zonesub ) [ <string> ] <rrtypelist>; ... };
 	zero-no-soa-ttl <boolean>;
 	zone-statistics ( full | terse | none | <boolean> );
 };
@@ -146,15 +146,13 @@ options {
        dnssec-secure-to-insecure <boolean>;
        dnssec-update-mode ( maintain | no-resign );
        dnssec-validation ( yes | no | auto );
-        dnstap { ( all | auth | client | forwarder |
-            resolver ) [ ( query | response ) ]; ... }; // not configured
-        dnstap-identity ( <quoted_string> | none |
-            hostname ); // not configured
-        dnstap-output ( file | unix ) <quoted_string> [
-            size ( unlimited | <size> ) ] [ versions (
-            unlimited | <integer> ) ] [ suffix ( increment
-            | timestamp ) ]; // not configured
-        dnstap-version ( <quoted_string> | none ); // not configured
+        dnstap { ( all | auth | client | forwarder | resolver | update ) [
+            ( query | response ) ]; ... };
+        dnstap-identity ( <quoted_string> | none | hostname );
+        dnstap-output ( file | unix ) <quoted_string> [ size ( unlimited |
+            <size> ) ] [ versions ( unlimited | <integer> ) ] [ suffix (
+            increment | timestamp ) ];
+        dnstap-version ( <quoted_string> | none );
        dscp <integer>;
        dual-stack-servers [ port <integer> ] { ( <quoted_string> [ port
            <integer> ] [ dscp <integer> ] | <ipv4_address> [ port
@@ -178,14 +176,14 @@ options {
        forward ( first | only );
        forwarders [ port <integer> ] [ dscp <integer> ] { ( <ipv4_address>
            | <ipv6_address> ) [ port <integer> ] [ dscp <integer> ]; ... };
-        fstrm-set-buffer-hint <integer>; // not configured
-        fstrm-set-flush-timeout <integer>; // not configured
-        fstrm-set-input-queue-size <integer>; // not configured
-        fstrm-set-output-notify-threshold <integer>; // not configured
-        fstrm-set-output-queue-model ( mpsc | spsc ); // not configured
-        fstrm-set-output-queue-size <integer>; // not configured
-        fstrm-set-reopen-interval <ttlval>; // not configured
-        geoip-directory ( <quoted_string> | none ); // not configured
+        fstrm-set-buffer-hint <integer>;
+        fstrm-set-flush-timeout <integer>;
+        fstrm-set-input-queue-size <integer>;
+        fstrm-set-output-notify-threshold <integer>;
+        fstrm-set-output-queue-model ( mpsc | spsc );
+        fstrm-set-output-queue-size <integer>;
+        fstrm-set-reopen-interval <ttlval>;
+        geoip-directory ( <quoted_string> | none );
        geoip-use-ecs <boolean>; // obsolete
        glue-cache <boolean>;
        has-old-clients <boolean>; // obsolete
@@ -206,7 +204,7 @@ options {
        listen-on-v6 [ port <integer> ] [ dscp
            <integer> ] {
            <address_match_element>; ... }; // may occur multiple times
-        lmdb-mapsize <sizeval>; // non-operational
+        lmdb-mapsize <sizeval>;
        lock-file ( <quoted_string> | none );
        maintain-ixfr-base <boolean>; // obsolete
        managed-keys-directory <quoted_string>;
@@ -515,8 +513,8 @@ view <string> [ <class> ] {
        dnssec-secure-to-insecure <boolean>;
        dnssec-update-mode ( maintain | no-resign );
        dnssec-validation ( yes | no | auto );
-        dnstap { ( all | auth | client | forwarder |
-            resolver ) [ ( query | response ) ]; ... }; // not configured
+        dnstap { ( all | auth | client | forwarder | resolver | update ) [
+            ( query | response ) ]; ... };
        dual-stack-servers [ port <integer> ] { ( <quoted_string> [ port
            <integer> ] [ dscp <integer> ] | <ipv4_address> [ port
            <integer> ] [ dscp <integer> ] | <ipv6_address> [ port
@@ -547,7 +545,7 @@ view <string> [ <class> ] {
        }; // may occur multiple times
        key-directory <quoted_string>;
        lame-ttl <ttlval>;
-        lmdb-mapsize <sizeval>; // non-operational
+        lmdb-mapsize <sizeval>;
        maintain-ixfr-base <boolean>; // obsolete
        managed-keys { <string> <string>
            <integer> <integer> <integer>
@@ -822,10 +820,10 @@ view <string> [ <class> ] {
                    static-stub | stub );
                update-check-ksk <boolean>;
                update-policy ( local | { ( deny | grant ) <string> (
-                    6to4-self | external | krb5-self | krb5-subdomain |
-                    ms-self | ms-subdomain | name | self | selfsub |
-                    selfwild | subdomain | tcp-self | wildcard | zonesub )
-                    [ <string> ] <rrtypelist>; ... };
+                    6to4-self | external | krb5-self | krb5-selfsub |
+                    krb5-subdomain | ms-self | ms-selfsub | ms-subdomain |
+                    name | self | selfsub | selfwild | subdomain | tcp-self
+                    | wildcard | zonesub ) [ <string> ] <rrtypelist>; ... };
                use-alt-transfer-source <boolean>;
                zero-no-soa-ttl <boolean>;
                zone-statistics ( full | terse | none | <boolean> );
@@ -926,9 +924,10 @@ zone <string> [ <class> ] {
            forward | hint | redirect | static-stub | stub );
        update-check-ksk <boolean>;
        update-policy ( local | { ( deny | grant ) <string> ( 6to4-self |
-            external | krb5-self | krb5-subdomain | ms-self | ms-subdomain
-            | name | self | selfsub | selfwild | subdomain | tcp-self |
-            wildcard | zonesub ) [ <string> ] <rrtypelist>; ... };
+            external | krb5-self | krb5-selfsub | krb5-subdomain | ms-self
+            | ms-selfsub | ms-subdomain | name | self | selfsub | selfwild
+            | subdomain | tcp-self | wildcard | zonesub ) [ <string> ]
+            <rrtypelist>; ... };
        use-alt-transfer-source <boolean>;
        zero-no-soa-ttl <boolean>;
        zone-statistics ( full | terse | none | <boolean> );
@@ -44,9 +44,9 @@ LIBS =		@LIBS@
 DSTOBJS =	@DST_EXTRA_OBJS@ \
 		dst_api.@O@ dst_lib.@O@ dst_parse.@O@ dst_result.@O@ \
 		gssapi_link.@O@ gssapictx.@O@ hmac_link.@O@ \
-		openssl_link.@O@ openssldh_link.@O@ openssldsa_link.@O@ \
+		openssl_link.@O@ openssldh_link.@O@ \
 		opensslecdsa_link.@O@ openssleddsa_link.@O@ opensslrsa_link.@O@ \
-		pkcs11dsa_link.@O@ pkcs11rsa_link.@O@ \
+		pkcs11rsa_link.@O@ \
 		pkcs11ecdsa_link.@O@ pkcs11eddsa_link.@O@ pkcs11.@O@ \
 		key.@O@

@@ -82,9 +82,9 @@ OBJS=		@DNSTAPOBJS@ ${DNSOBJS} ${OTHEROBJS} ${DSTOBJS} \
 DSTSRCS =	@DST_EXTRA_SRCS@ @PKCS11LINKSRCS@ \
 		dst_api.c dst_lib.c dst_parse.c \
 		dst_result.c gssapi_link.c gssapictx.c hmac_link.c \
-		openssl_link.c openssldh_link.c openssldsa_link.c \
+		openssl_link.c openssldh_link.c \
 		opensslecdsa_link.c openssleddsa_link.c opensslrsa_link.c \
-		pkcs11dsa_link.c pkcs11rsa_link.c \
+		pkcs11rsa_link.c \
 		pkcs11ecdsa_link.c pkcs11eddsa_link.c pkcs11.c \
 		key.c

@@ -1546,7 +1546,6 @@ clean_finds_at_name(dns_adbname_t *name, isc_eventtype_t evtype,
 		UNLOCK(&find->lock);
 		find = next_find;
 	}
-
 	DP(ENTER_LEVEL, "EXIT clean_finds_at_name, name %p", name);
 }

@@ -3221,12 +3220,14 @@ dns_adb_createfind(dns_adb_t *adb, isc_task_t *task, isc_taskaction_t action,
 	if (want_event) {
 		find->adbname = adbname;
 		find->name_bucket = bucket;
+		bool empty = ISC_LIST_EMPTY(adbname->finds);
 		ISC_LIST_APPEND(adbname->finds, find, plink);
 		find->query_pending = (query_pending & wanted_addresses);
 		find->flags &= ~DNS_ADBFIND_ADDRESSMASK;
 		find->flags |= (find->query_pending & DNS_ADBFIND_ADDRESSMASK);
-		DP(DEF_LEVEL, "createfind: attaching find %p to adbname %p",
-		   find, adbname);
+		DP(DEF_LEVEL, "createfind: attaching find %p to adbname "
+			      "%p %d",
+		   find, adbname, empty);
 	} else {
 		/*
 		 * Remove the flag so the caller knows there will never
@@ -4024,7 +4025,7 @@ fetch_name(dns_adbname_t *adbname, bool start_at_zone,
 		   adbname);
 		name = dns_fixedname_initname(&fixed);
 		result = dns_view_findzonecut(adb->view, &adbname->name, name,
-					      0, 0, true, false,
+					      NULL, 0, 0, true, false,
 					      &rdataset, NULL);
 		if (result != ISC_R_SUCCESS && result != DNS_R_HINT)
 			goto cleanup;
@@ -4032,14 +4033,6 @@ fetch_name(dns_adbname_t *adbname, bool start_at_zone,
 		options |= DNS_FETCHOPT_UNSHARED;
 	}

-	if (adb->view->qminimization) {
-		options |= DNS_FETCHOPT_QMINIMIZE;
-		options |= DNS_FETCHOPT_QMIN_SKIP_IP6A;
-		if (adb->view->qmin_strict) {
-			options |= DNS_FETCHOPT_QMIN_STRICT;
-		}
-	}
-
 	fetch = new_adbfetch(adb);
 	if (fetch == NULL) {
 		result = ISC_R_NOMEMORY;
@@ -4047,14 +4040,25 @@ fetch_name(dns_adbname_t *adbname, bool start_at_zone,
 	}
 	fetch->depth = depth;

+	/*
+	 * We're not minimizing this query, as nothing user-related should
+	 * be leaked here.
+	 * However, if we'd ever want to change it we'd have to modify
+	 * createfetch to find deepest cached name when we're providing
+	 * domain and nameservers.
+	 */
 	result = dns_resolver_createfetch(adb->view->resolver, &adbname->name,
 					  type, name, nameservers, NULL,
 					  NULL, 0, options, depth, qc,
 					  adb->task, fetch_callback, adbname,
 					  &fetch->rdataset, NULL,
 					  &fetch->fetch);
-	if (result != ISC_R_SUCCESS)
+	if (result != ISC_R_SUCCESS) {
+		DP(ENTER_LEVEL,
+		   "fetch_name: createfetch failed with %s",
+		   isc_result_totext(result));
 		goto cleanup;
+	}

 	if (type == dns_rdatatype_a) {
 		adbname->fetch_a = fetch;
@@ -559,10 +559,13 @@ isc_result_t
 dns_db_findzonecut(dns_db_t *db, const dns_name_t *name,
 		   unsigned int options, isc_stdtime_t now,
 		   dns_dbnode_t **nodep, dns_name_t *foundname,
-		   dns_rdataset_t *rdataset, dns_rdataset_t *sigrdataset)
+		   dns_name_t *dcname, dns_rdataset_t *rdataset,
+		   dns_rdataset_t *sigrdataset)
 {
 	/*
 	 * Find the deepest known zonecut which encloses 'name' in 'db'.
+	 * foundname is the zonecut, dcname is the deepest name we have
+	 * in database that is part of queried name.
 	 */

 	REQUIRE(DNS_DB_VALID(db));
@@ -574,7 +577,8 @@ dns_db_findzonecut(dns_db_t *db, const dns_name_t *name,
 		 ! dns_rdataset_isassociated(sigrdataset)));

 	return ((db->methods->findzonecut)(db, name, options, now, nodep,
-					   foundname, rdataset, sigrdataset));
+					   foundname, dcname,
+					   rdataset, sigrdataset));
 }

 void
@@ -299,7 +299,8 @@ static isc_result_t get_udpsocket(dns_dispatchmgr_t *mgr,
 				  isc_socketmgr_t *sockmgr,
 				  const isc_sockaddr_t *localaddr,
 				  isc_socket_t **sockp,
-				  isc_socket_t *dup_socket);
+				  isc_socket_t *dup_socket,
+				  bool duponly);
 static isc_result_t dispatch_createudp(dns_dispatchmgr_t *mgr,
 				       isc_socketmgr_t *sockmgr,
 				       isc_taskmgr_t *taskmgr,
@@ -317,7 +318,7 @@ static void qid_destroy(isc_mem_t *mctx, dns_qid_t **qidp);
 static isc_result_t open_socket(isc_socketmgr_t *mgr,
 				const isc_sockaddr_t *local,
 				unsigned int options, isc_socket_t **sockp,
-				isc_socket_t *dup_socket);
+				isc_socket_t *dup_socket, bool duponly);
 static bool portavailable(dns_dispatchmgr_t *mgr, isc_socket_t *sock,
 				   isc_sockaddr_t *sockaddrp);

@@ -728,7 +729,7 @@ get_dispsocket(dns_dispatch_t *disp, const isc_sockaddr_t *dest,
 		if (portentry != NULL)
 			bindoptions |= ISC_SOCKET_REUSEADDRESS;
 		result = open_socket(sockmgr, &localaddr, bindoptions, &sock,
-				     NULL);
+				     NULL, false);
 		if (result == ISC_R_SUCCESS) {
 			if (portentry == NULL) {
 				portentry = new_portentry(disp, port);
@@ -1668,7 +1669,7 @@ destroy_mgr(dns_dispatchmgr_t **mgrp) {
 static isc_result_t
 open_socket(isc_socketmgr_t *mgr, const isc_sockaddr_t *local,
 	    unsigned int options, isc_socket_t **sockp,
-	    isc_socket_t *dup_socket)
+	    isc_socket_t *dup_socket, bool duponly)
 {
 	isc_socket_t *sock;
 	isc_result_t result;
@@ -1678,7 +1679,7 @@ open_socket(isc_socketmgr_t *mgr, const isc_sockaddr_t *local,
 		result = isc_socket_open(sock);
 		if (result != ISC_R_SUCCESS)
 			return (result);
-	} else if (dup_socket != NULL) {
+	} else if (dup_socket != NULL && (!isc_socket_hasreuseport() || duponly)) {
 		result = isc_socket_dup(dup_socket, &sock);
 		if (result != ISC_R_SUCCESS)
 			return (result);
@@ -2758,7 +2759,7 @@ dns_dispatch_getudp(dns_dispatchmgr_t *mgr, isc_socketmgr_t *sockmgr,
 static isc_result_t
 get_udpsocket(dns_dispatchmgr_t *mgr, dns_dispatch_t *disp,
 	      isc_socketmgr_t *sockmgr, const isc_sockaddr_t *localaddr,
-	      isc_socket_t **sockp, isc_socket_t *dup_socket)
+	      isc_socket_t **sockp, isc_socket_t *dup_socket, bool duponly)
 {
 	unsigned int i, j;
 	isc_socket_t *held[DNS_DISPATCH_HELD];
@@ -2796,7 +2797,7 @@ get_udpsocket(dns_dispatchmgr_t *mgr, dns_dispatch_t *disp,
 			prt = ports[isc_random_uniform(nports)];
 			isc_sockaddr_setport(&localaddr_bound, prt);
 			result = open_socket(sockmgr, &localaddr_bound,
-					     0, &sock, NULL);
+					     0, &sock, NULL, false);
 			/*
 			 * Continue if the port choosen is already in use
 			 * or the OS has reserved it.
@@ -2817,7 +2818,7 @@ get_udpsocket(dns_dispatchmgr_t *mgr, dns_dispatch_t *disp,
 		/* Allow to reuse address for non-random ports. */
 		result = open_socket(sockmgr, localaddr,
 				     ISC_SOCKET_REUSEADDRESS, &sock,
-				     dup_socket);
+				     dup_socket, duponly);

 		if (result == ISC_R_SUCCESS)
 			*sockp = sock;
@@ -2829,7 +2830,7 @@ get_udpsocket(dns_dispatchmgr_t *mgr, dns_dispatch_t *disp,
 	i = 0;

 	for (j = 0; j < 0xffffU; j++) {
-		result = open_socket(sockmgr, localaddr, 0, &sock, NULL);
+		result = open_socket(sockmgr, localaddr, 0, &sock, NULL, false);
 		if (result != ISC_R_SUCCESS)
 			goto end;
 		else if (portavailable(mgr, sock, NULL))
@@ -2874,6 +2875,9 @@ dispatch_createudp(dns_dispatchmgr_t *mgr, isc_socketmgr_t *sockmgr,
 	isc_socket_t *sock = NULL;
 	int i = 0;

+	bool duponly = ((attributes & DNS_DISPATCHATTR_CANREUSE) == 0);
+	/* This is an attribute needed only at creation time */
+	attributes &= ~DNS_DISPATCHATTR_CANREUSE;
 	/*
 	 * dispatch_allocate() checks mgr for us.
 	 */
@@ -2886,7 +2890,7 @@ dispatch_createudp(dns_dispatchmgr_t *mgr, isc_socketmgr_t *sockmgr,

 	if ((attributes & DNS_DISPATCHATTR_EXCLUSIVE) == 0) {
 		result = get_udpsocket(mgr, disp, sockmgr, localaddr, &sock,
-				       dup_socket);
+				       dup_socket, duponly);
 		if (result != ISC_R_SUCCESS)
 			goto deallocate_dispatch;

@@ -2911,7 +2915,7 @@ dispatch_createudp(dns_dispatchmgr_t *mgr, isc_socketmgr_t *sockmgr,
 		 */
 		isc_sockaddr_anyofpf(&sa_any, isc_sockaddr_pf(localaddr));
 		if (!isc_sockaddr_eqaddr(&sa_any, localaddr)) {
-			result = open_socket(sockmgr, localaddr, 0, &sock, NULL);
+			result = open_socket(sockmgr, localaddr, 0, &sock, NULL, false);
 			if (sock != NULL)
 				isc_socket_detach(&sock);
 			if (result != ISC_R_SUCCESS)
@@ -167,7 +167,7 @@ dt_init(void) {
 		int ret;

 		if (dt_mctx == NULL)
-			result = isc_mem_create2(0, 0, &dt_mctx, 0);
+			result = isc_mem_create(0, 0, &dt_mctx);
 		if (result != ISC_R_SUCCESS)
 			goto unlock;
 		isc_mem_setname(dt_mctx, "dt", NULL);
@@ -694,6 +694,10 @@ dnstap_type(dns_dtmsgtype_t msgtype) {
 		return (DNSTAP__MESSAGE__TYPE__TOOL_QUERY);
 	case DNS_DTTYPE_TR:
 		return (DNSTAP__MESSAGE__TYPE__TOOL_RESPONSE);
+	case DNS_DTTYPE_UQ:
+		return (DNSTAP__MESSAGE__TYPE__UPDATE_QUERY);
+	case DNS_DTTYPE_UR:
+		return (DNSTAP__MESSAGE__TYPE__UPDATE_RESPONSE);
 	default:
 		INSIST(0);
 	}
@@ -860,6 +864,7 @@ dns_dt_send(dns_view_t *view, dns_dtmsgtype_t msgtype,
 	case DNS_DTTYPE_FR:
 	case DNS_DTTYPE_SR:
 	case DNS_DTTYPE_TR:
+	case DNS_DTTYPE_UR:
 		if (rtime != NULL)
 			t = rtime;

@@ -881,6 +886,7 @@ dns_dt_send(dns_view_t *view, dns_dtmsgtype_t msgtype,
 	case DNS_DTTYPE_RQ:
 	case DNS_DTTYPE_SQ:
 	case DNS_DTTYPE_TQ:
+	case DNS_DTTYPE_UQ:
 		if (qtime != NULL)
 			t = qtime;

@@ -1160,6 +1166,12 @@ dns_dt_parse(isc_mem_t *mctx, isc_region_t *src, dns_dtdata_t **destp) {
 	case DNSTAP__MESSAGE__TYPE__TOOL_RESPONSE:
 		d->type = DNS_DTTYPE_TR;
 		break;
+	case DNSTAP__MESSAGE__TYPE__UPDATE_QUERY:
+		d->type = DNS_DTTYPE_UQ;
+		break;
+	case DNSTAP__MESSAGE__TYPE__UPDATE_RESPONSE:
+		d->type = DNS_DTTYPE_UR;
+		break;
 	default:
 		CHECK(DNS_R_BADDNSTAP);
 	}
@@ -1316,6 +1328,12 @@ dns_dt_datatotext(dns_dtdata_t *d, isc_buffer_t **dest) {
 	case DNS_DTTYPE_TR:
 		CHECK(putstr(dest, "TR "));
 		break;
+	case DNS_DTTYPE_UQ:
+		CHECK(putstr(dest, "UQ "));
+		break;
+	case DNS_DTTYPE_UR:
+		CHECK(putstr(dest, "UR "));
+		break;
 	default:
 		return (DNS_R_BADDNSTAP);
 	}
@@ -165,6 +165,16 @@ message Message {
        // TOOL_RESPONSE is a DNS response message received by a DNS software
        // tool from a DNS server, from the perspective of the tool.
        TOOL_RESPONSE = 12;
+
+        // UPDATE_QUERY is a DNS update query message received from a resolver
+        // by an authoritative name server, from the perspective of the
+        // authoritative name server.
+	UPDATE_QUERY = 13;
+
+        // UPDATE_RESPONSE is a DNS update response message sent from an
+        // authoritative name server to a resolver, from the perspective of the
+        // authoritative name server.
+	UPDATE_RESPONSE = 14;
    }

    // One of the Type values described above.
@@ -159,8 +159,8 @@ dst_lib_init(isc_mem_t *mctx, const char *engine) {
 	 * ISC_MEMFLAG_INTERNAL as it will free up memory still being used
 	 * by libcrypto.
 	 */
-	result = isc_mem_createx2(0, 0, default_memalloc, default_memfree,
-				  NULL, &dst__memory_pool, 0);
+	result = isc_mem_createx(0, 0, default_memalloc, default_memfree,
+				 NULL, &dst__memory_pool, 0);
 	if (result != ISC_R_SUCCESS)
 		return (result);
 	isc_mem_setname(dst__memory_pool, "dst", NULL);
@@ -190,8 +190,6 @@ dst_lib_init(isc_mem_t *mctx, const char *engine) {
 				    DST_ALG_RSASHA256));
 	RETERR(dst__opensslrsa_init(&dst_t_func[DST_ALG_RSASHA512],
 				    DST_ALG_RSASHA512));
-	RETERR(dst__openssldsa_init(&dst_t_func[DST_ALG_DSA]));
-	RETERR(dst__openssldsa_init(&dst_t_func[DST_ALG_NSEC3DSA]));
 	RETERR(dst__opensslecdsa_init(&dst_t_func[DST_ALG_ECDSA256]));
 	RETERR(dst__opensslecdsa_init(&dst_t_func[DST_ALG_ECDSA384]));
 #ifdef HAVE_OPENSSL_ED25519
@@ -209,8 +207,6 @@ dst_lib_init(isc_mem_t *mctx, const char *engine) {
 	RETERR(dst__pkcs11rsa_init(&dst_t_func[DST_ALG_NSEC3RSASHA1]));
 	RETERR(dst__pkcs11rsa_init(&dst_t_func[DST_ALG_RSASHA256]));
 	RETERR(dst__pkcs11rsa_init(&dst_t_func[DST_ALG_RSASHA512]));
-	RETERR(dst__pkcs11dsa_init(&dst_t_func[DST_ALG_DSA]));
-	RETERR(dst__pkcs11dsa_init(&dst_t_func[DST_ALG_NSEC3DSA]));
 	RETERR(dst__pkcs11ecdsa_init(&dst_t_func[DST_ALG_ECDSA256]));
 	RETERR(dst__pkcs11ecdsa_init(&dst_t_func[DST_ALG_ECDSA384]));
 #ifdef HAVE_PKCS11_ED25519
@@ -806,6 +802,9 @@ dst_key_fromgssapi(const dns_name_t *name, gss_ctx_id_t gssctx,
 	*keyp = key;
 	result = ISC_R_SUCCESS;
 out:
+	if (result != ISC_R_SUCCESS) {
+		dst_key_free(&key);
+	}
 	return result;
 }

@@ -1190,10 +1189,6 @@ dst_key_sigsize(const dst_key_t *key, unsigned int *n) {
 	case DST_ALG_RSASHA512:
 		*n = (key->key_size + 7) / 8;
 		break;
-	case DST_ALG_DSA:
-	case DST_ALG_NSEC3DSA:
-		*n = DNS_SIG_DSASIGSIZE;
-		break;
 	case DST_ALG_ECDSA256:
 		*n = DNS_SIG_ECDSA256SIZE;
 		break;
@@ -1522,8 +1517,6 @@ issymmetric(const dst_key_t *key) {
 	case DST_ALG_NSEC3RSASHA1:
 	case DST_ALG_RSASHA256:
 	case DST_ALG_RSASHA512:
-	case DST_ALG_DSA:
-	case DST_ALG_NSEC3DSA:
 	case DST_ALG_DH:
 	case DST_ALG_ECDSA256:
 	case DST_ALG_ECDSA384:
@@ -53,7 +53,6 @@
 #include <dst/dst.h>

 #include <openssl/dh.h>
-#include <openssl/dsa.h>
 #include <openssl/err.h>
 #include <openssl/evp.h>
 #include <openssl/objects.h>
@@ -109,7 +108,6 @@ struct dst_key {
 	union {
 		void *generic;
 		gss_ctx_id_t gssctx;
-		DSA *dsa;
 		DH *dh;
 #if USE_OPENSSL
 		EVP_PKEY *pkey;
@@ -229,7 +227,6 @@ isc_result_t dst__openssldh_init(struct dst_func **funcp);
 #if USE_OPENSSL
 isc_result_t dst__opensslrsa_init(struct dst_func **funcp,
 				  unsigned char algorithm);
-isc_result_t dst__openssldsa_init(struct dst_func **funcp);
 isc_result_t dst__opensslecdsa_init(struct dst_func **funcp);
 #if HAVE_OPENSSL_ED25519 || HAVE_OPENSSL_ED448
 isc_result_t dst__openssleddsa_init(struct dst_func **funcp);
@@ -96,12 +96,6 @@ static struct parse_map map[] = {
 	{TAG_DH_PRIVATE, "Private_value(x):"},
 	{TAG_DH_PUBLIC, "Public_value(y):"},

-	{TAG_DSA_PRIME, "Prime(p):"},
-	{TAG_DSA_SUBPRIME, "Subprime(q):"},
-	{TAG_DSA_BASE, "Base(g):"},
-	{TAG_DSA_PRIVATE, "Private_value(x):"},
-	{TAG_DSA_PUBLIC, "Public_value(y):"},
-
 	{TAG_ECDSA_PRIVATEKEY, "PrivateKey:"},
 	{TAG_ECDSA_ENGINE, "Engine:" },
 	{TAG_ECDSA_LABEL, "Label:" },
@@ -232,26 +226,6 @@ check_dh(const dst_private_t *priv) {
 	return (0);
 }

-static int
-check_dsa(const dst_private_t *priv, bool external) {
-	int i, j;
-
-	if (external)
-		return ((priv->nelements == 0)? 0 : -1);
-
-	if (priv->nelements != DSA_NTAGS)
-		return (-1);
-
-	for (i = 0; i < DSA_NTAGS; i++) {
-		for (j = 0; j < priv->nelements; j++)
-			if (priv->elements[j].tag == TAG(DST_ALG_DSA, i))
-				break;
-		if (j == priv->nelements)
-			return (-1);
-	}
-	return (0);
-}
-
 static int
 check_ecdsa(const dst_private_t *priv, bool external) {
 	int i, j;
@@ -370,9 +344,6 @@ check_data(const dst_private_t *priv, const unsigned int alg,
 		return (check_rsa(priv, external));
 	case DST_ALG_DH:
 		return (check_dh(priv));
-	case DST_ALG_DSA:
-	case DST_ALG_NSEC3DSA:
-		return (check_dsa(priv, external));
 	case DST_ALG_ECDSA256:
 	case DST_ALG_ECDSA384:
 		return (check_ecdsa(priv, external));
@@ -696,18 +667,12 @@ dst__privstruct_writefile(const dst_key_t *key, const dst_private_t *priv,
 	case DST_ALG_DH:
 		fprintf(fp, "(DH)\n");
 		break;
-	case DST_ALG_DSA:
-		fprintf(fp, "(DSA)\n");
-		break;
 	case DST_ALG_RSASHA1:
 		fprintf(fp, "(RSASHA1)\n");
 		break;
 	case DST_ALG_NSEC3RSASHA1:
 		fprintf(fp, "(NSEC3RSASHA1)\n");
 		break;
-	case DST_ALG_NSEC3DSA:
-		fprintf(fp, "(NSEC3DSA)\n");
-		break;
 	case DST_ALG_RSASHA256:
 		fprintf(fp, "(RSASHA256)\n");
 		break;
@@ -311,7 +311,8 @@ static isc_result_t
 findzonecut(dns_db_t *db, const dns_name_t *name,
 	    unsigned int options, isc_stdtime_t now,
 	    dns_dbnode_t **nodep, dns_name_t *foundname,
-	    dns_rdataset_t *rdataset, dns_rdataset_t *sigrdataset)
+	    dns_name_t *dcname, dns_rdataset_t *rdataset,
+	    dns_rdataset_t *sigrdataset)
 {
 	dns_ecdb_t *ecdb = (dns_ecdb_t *)db;

@@ -322,6 +323,7 @@ findzonecut(dns_db_t *db, const dns_name_t *name,
 	UNUSED(now);
 	UNUSED(nodep);
 	UNUSED(foundname);
+	UNUSED(dcname);
 	UNUSED(rdataset);
 	UNUSED(sigrdataset);

@@ -147,7 +147,7 @@ static struct tt {
 	int type;
 	char classname[TYPECLASSBUF];
 	char typename[TYPECLASSBUF];
-	char dirname[DIRNAMESIZE];	/* XXX Should be max path length */
+	char dirname[DIRNAMESIZE-30];	/* XXX Should be max path length */
 } *types;

 static struct ttnam {
@@ -114,7 +114,7 @@ state_key_init(void) {
 			int ret;

 			if (state_mctx == NULL)
-				result = isc_mem_create2(0, 0, &state_mctx, 0);
+				result = isc_mem_create(0, 0, &state_mctx);
 			if (result != ISC_R_SUCCESS)
 				goto unlock;
 			isc_mem_setname(state_mctx, "geoip_state", NULL);
@@ -103,6 +103,7 @@ typedef struct dns_dbmethods {
 				       unsigned int options, isc_stdtime_t now,
 				       dns_dbnode_t **nodep,
 				       dns_name_t *foundname,
+				       dns_name_t *dcname,
 				       dns_rdataset_t *rdataset,
 				       dns_rdataset_t *sigrdataset);
 	void		(*attachnode)(dns_db_t *db,
@@ -936,7 +937,8 @@ isc_result_t
 dns_db_findzonecut(dns_db_t *db, const dns_name_t *name,
 		   unsigned int options, isc_stdtime_t now,
 		   dns_dbnode_t **nodep, dns_name_t *foundname,
-		   dns_rdataset_t *rdataset, dns_rdataset_t *sigrdataset);
+		   dns_name_t *dcname, dns_rdataset_t *rdataset,
+		   dns_rdataset_t *sigrdataset);
 /*%<
 * Find the deepest known zonecut which encloses 'name' in 'db'.
 *
@@ -955,6 +957,8 @@ dns_db_findzonecut(dns_db_t *db, const dns_name_t *name,
 *
 * \li	'foundname' is a valid name with a dedicated buffer.
 *
+ * \li	'dcname' is a valid name with a dedicated buffer.
+ *
 * \li	'rdataset' is NULL, or is a valid unassociated rdataset.
 *
 * Ensures, on a non-error completion:
@@ -964,6 +968,9 @@ dns_db_findzonecut(dns_db_t *db, const dns_name_t *name,
 * \li	If foundname != NULL, then it contains the full name of the
 *	found node.
 *
+ * \li	If dcname != NULL, then it contains the deepest cached name
+ *      that exists in the database.
+ *
 * \li	If rdataset != NULL and type != dns_rdatatype_any, then
 *	rdataset is bound to the found rdataset.
 *
@@ -140,6 +140,7 @@ struct dns_dispatchset {
 #define DNS_DISPATCHATTR_CONNECTED	0x00000080U
 #define DNS_DISPATCHATTR_FIXEDID	0x00000100U
 #define DNS_DISPATCHATTR_EXCLUSIVE	0x00000200U
+#define DNS_DISPATCHATTR_CANREUSE	0x00000400U
 /*@}*/

 /*
@@ -73,13 +73,17 @@ struct fstrm_iothr_options;
 #define DNS_DTTYPE_FR 0x0200
 #define DNS_DTTYPE_TQ 0x0400
 #define DNS_DTTYPE_TR 0x0800
+#define DNS_DTTYPE_UQ 0x1000
+#define DNS_DTTYPE_UR 0x2000

 #define DNS_DTTYPE_QUERY \
 	(DNS_DTTYPE_SQ|DNS_DTTYPE_CQ|DNS_DTTYPE_AQ|\
-	 DNS_DTTYPE_RQ|DNS_DTTYPE_FQ|DNS_DTTYPE_TQ)
+	 DNS_DTTYPE_RQ|DNS_DTTYPE_FQ|DNS_DTTYPE_TQ|\
+	 DNS_DTTYPE_UQ)
 #define DNS_DTTYPE_RESPONSE \
 	(DNS_DTTYPE_SR|DNS_DTTYPE_CR|DNS_DTTYPE_AR|\
-	 DNS_DTTYPE_RR|DNS_DTTYPE_FR|DNS_DTTYPE_TR)
+	 DNS_DTTYPE_RR|DNS_DTTYPE_FR|DNS_DTTYPE_TR|\
+	 DNS_DTTYPE_UR)
 #define DNS_DTTYPE_ALL \
 	(DNS_DTTYPE_QUERY|DNS_DTTYPE_RESPONSE)

@@ -704,7 +704,7 @@ dns_view_simplefind(dns_view_t *view, const dns_name_t *name,

 isc_result_t
 dns_view_findzonecut(dns_view_t *view, const dns_name_t *name,
-		     dns_name_t *fname, isc_stdtime_t now,
+		     dns_name_t *fname, dns_name_t *dcname, isc_stdtime_t now,
 		     unsigned int options,
 		     bool use_hints, bool use_cache,
 		     dns_rdataset_t *rdataset, dns_rdataset_t *sigrdataset);
@@ -730,6 +730,8 @@ dns_view_findzonecut(dns_view_t *view, const dns_name_t *name,
 *\li	If the DNS_DBFIND_NOEXACT option is set, then the zonecut returned
 *	(if any) will be the deepest known ancestor of 'name'.
 *
+ *\li	If dcname is not NULL the deepest cached name is copied to it.
+ *
 * Requires:
 *
 *\li	'view' is a valid, frozen view.
@@ -1301,7 +1301,7 @@ totext_filter_proc_key_init(void) {
 	if (!thread_key_initialized) {
 		LOCK(&thread_key_mutex);
 		if (thread_key_mctx == NULL)
-			result = isc_mem_create2(0, 0, &thread_key_mctx, 0);
+			result = isc_mem_create(0, 0, &thread_key_mctx);
 		if (result != ISC_R_SUCCESS)
 			goto unlock;
 		isc_mem_setname(thread_key_mctx, "threadkey", NULL);
--- a/Show More
+++ b/Show More