Apply honggfuzz patch

[v9_12] Do not replace lo0 address on Solaris

See merge request isc-projects/bind9!537

.gitignore

@@ -7,8 +7,6 @@ libtool
 /isc-config.sh
 /configure.lineno
 autom4te.cache/
-*.rej
-*.orig
 *.o
 *.lo
 *.so
@@ -23,10 +21,9 @@ ans.run
 named.run
 named.memstats
 gen.dSYM/
-.ccache/
+.libs/
 .deps/
 .dirstamp
-.libs/
 unit/atf-src/atf-c++/atf-c++.pc
 unit/atf-src/atf-c/atf-c.pc
 unit/atf-src/atf-c/defs.h

.gitlab-ci.yml

@@ -2,7 +2,7 @@ variables:
   DEBIAN_FRONTEND: noninteractive
   LC_ALL: C
   DOCKER_DRIVER: overlay2
-  CI_REGISTRY_IMAGE: registry.gitlab.isc.org/isc-projects/images/bind9
+  CI_REGISTRY_IMAGE: oerdnj/bind9
   CCACHE_DIR: "/ccache"
 
 stages:
@@ -112,9 +112,9 @@ stages:
   stage: build
   before_script:
     - test -w "${CCACHE_DIR}" && export PATH="/usr/lib/ccache:${PATH}"
-#    - ./autogen.sh
+    - autoreconf -fi
   script:
-    - ./configure --enable-developer --with-libtool --disable-static --with-atf=/usr $EXTRA_CONFIGURE
+    - ./configure --enable-developer --with-libtool --disable-static --with-atf=/usr --with-libidn2 "${EXTRA_CONFIGURE}"
     - make -j${PARALLEL_JOBS_BUILD:-1} -k all V=1
   artifacts:
     expire_in: '1 hour'
@@ -125,9 +125,6 @@ stages:
   before_script:
     - rm -rf .ccache
     - bash -x bin/tests/system/ifconfig.sh up
-    - export SOFTHSM_CONF="/tmp/softhsm.conf"
-    - echo "0:/tmp/softhsm.db" > $SOFTHSM_CONF
-    - if command -v softhsm2-util >/dev/null; then softhsm2-util --init-token --free --pin 0000 --so-pin 0000 --label "softhsm"; fi
   script:
     - ( cd bin/tests && make -j${TEST_PARALLEL_JOBS:-1} -k test V=1 )
     - test -s bin/tests/system/systests.output
@@ -140,9 +137,6 @@ stages:
   stage: test
   before_script:
     - export KYUA_RESULT="$CI_PROJECT_DIR/kyua.results"
-    - export SOFTHSM_CONF="/tmp/softhsm.conf"
-    - echo "0:/tmp/softhsm.db" > $SOFTHSM_CONF
-    - if command -v softhsm2-util >/dev/null; then softhsm2-util --init-token --free --pin 0000 --so-pin 0000 --label "softhsm"; fi
   script:
     - make unit
   after_script:
@@ -202,7 +196,7 @@ build:centos:centos6:amd64:
   variables:
     CC: gcc
     CFLAGS: "-Wall -Wextra -O2 -g"
-    EXTRA_CONFIGURE: "--with-libidn2 --disable-warn-error"
+    EXTRA_CONFIGURE: "--disable-warn-error"
   <<: *centos_centos6_amd64_image
   <<: *build_job
 
@@ -210,53 +204,14 @@ build:centos:centos7:amd64:
   variables:
     CC: gcc
     CFLAGS: "-Wall -Wextra -O2 -g"
-    EXTRA_CONFIGURE: "--with-libidn2"
   <<: *centos_centos7_amd64_image
   <<: *build_job
 
-build:clang:debian:sid:amd64:
-  variables:
-    CC: clang-6.0
-    CFLAGS: "-Wall -Wextra -Wenum-conversion -O2 -g"
-    EXTRA_CONFIGURE: "--with-libidn2"
-  <<: *debian_sid_amd64_image
-  <<: *build_job
-
-build:debian:jessie:amd64:
-  variables:
-    CC: gcc
-    CFLAGS: "-Wall -Wextra -O2 -g"
-  <<: *debian_jessie_amd64_image
-  <<: *build_job
-
-build:debian:stretch:amd64:
-  variables:
-    CC: gcc
-    CFLAGS: "-Wall -Wextra -O2 -g"
-  <<: *debian_stretch_amd64_image
-  <<: *build_job
-
 build:debian:sid:amd64:
-  variables:
-    CC: gcc
-    CFLAGS: "-Wall -Wextra -O2 -g"
-    EXTRA_CONFIGURE: "--with-libidn2"
   <<: *debian_sid_amd64_image
   <<: *build_job
-
-build:clang:debian:sid:i386:
-  variables:
-    CC: clang-6.0
-    CFLAGS: "-Wall -Wextra -Wenum-conversion -O2 -g"
-    EXTRA_CONFIGURE: "--with-libidn2"
-  <<: *debian_sid_i386_image
-  <<: *build_job
-
+    
 build:debian:sid:i386:
-  variables:
-    CC: gcc
-    CFLAGS: "-Wall -Wextra -O2 -g"
-    EXTRA_CONFIGURE: "--with-libidn2"
   <<: *debian_sid_i386_image
   <<: *build_job
 
@@ -272,30 +227,12 @@ unittest:centos:centos7:amd64:
   dependencies:
     - build:centos:centos7:amd64
 
-unittest:debian:jessie:amd64:
-  <<: *debian_jessie_amd64_image
-  <<: *unit_test_job
-  dependencies:
-    - build:debian:jessie:amd64
-
-unittest:debian:stretch:amd64:
-  <<: *debian_stretch_amd64_image
-  <<: *unit_test_job
-  dependencies:
-    - build:debian:stretch:amd64
-
 unittest:debian:sid:amd64:
   <<: *debian_sid_amd64_image
   <<: *unit_test_job
   dependencies:
     - build:debian:sid:amd64
-
-unittest:clang:debian:sid:amd64:
-  <<: *debian_sid_amd64_image
-  <<: *unit_test_job
-  dependencies:
-    - build:clang:debian:sid:amd64
-
+    
 unittest:debian:sid:i386:
   <<: *debian_sid_i386_image
   <<: *unit_test_job
@@ -314,46 +251,14 @@ systemtest:centos:centos7:amd64:
   dependencies:
     - build:centos:centos7:amd64
 
-systemtest:debian:jessie:amd64:
-  <<: *debian_jessie_amd64_image
-  <<: *system_test_job
-  dependencies:
-    - build:debian:jessie:amd64
-
-systemtest:debian:stretch:amd64:
-  <<: *debian_stretch_amd64_image
-  <<: *system_test_job
-  dependencies:
-    - build:debian:stretch:amd64
-
 systemtest:debian:sid:amd64:
   <<: *debian_sid_amd64_image
   <<: *system_test_job
   dependencies:
     - build:debian:sid:amd64
-
+    
 systemtest:debian:sid:i386:
   <<: *debian_sid_i386_image
   <<: *system_test_job
   dependencies:
     - build:debian:sid:i386
-
-pkcs11:build:debian:sid:amd64:
-  variables:
-    CC: gcc
-    CFLAGS: "-Wall -Wextra -O2 -g"
-    EXTRA_CONFIGURE: "--enable-native-pkcs11 --with-pkcs11=/usr/lib/softhsm/libsofthsm2.so"
-  <<: *debian_sid_amd64_image
-  <<: *build_job
-
-pkcs11:unittest:debian:sid:amd64:
-  <<: *debian_sid_amd64_image
-  <<: *unit_test_job
-  dependencies:
-    - pkcs11:build:debian:sid:amd64
-
-pkcs11:systemtest:debian:sid:amd64:
-  <<: *debian_sid_amd64_image
-  <<: *system_test_job
-  dependencies:
-    - pkcs11:build:debian:sid:amd64

.gitlab/issue_templates/Bug.md

@@ -1,42 +0,0 @@
-<!--
-If the bug you are reporting is potentially security-related - for example,
-if it involves an assertion failure or other crash in `named` that can be
-triggered repeatedly - then please do *NOT* report it here, but send an
-email to [security-officer@isc.org](security-officer@isc.org).
--->
-
-### Summary
-
-(Summarize the bug encountered concisely.)
-
-### Steps to reproduce
-
-(How one can reproduce the issue - this is very important.)
-
-### What is the current *bug* behavior?
-
-(What actually happens.)
-
-### What is the expected *correct* behavior?
-
-(What you should see instead.)
-
-### Relevant configuration files
-
-(Paste any relevant configuration files - please use code blocks (```)
-to format console output. If submitting the contents of your
-configuration file in a non-confidential Issue, it is advisable to
-obscure key secrets: this can be done automatically by using
-`named-checkconf -px`.)
-
-### Relevant logs and/or screenshots
-
-(Paste any relevant logs - please use code blocks (```) to format console
-output, logs, and code, as it's very hard to read otherwise.)
-
-### Possible fixes
-
-(If you can, link to the line of code that might be responsible for the
-problem.)
-
-/label ~bug

.gitlab/issue_templates/Feature_Request.md

@@ -1,11 +0,0 @@
-### Description
-
-(Describe the problem, use cases, benefits, and/or goals.)
-
-### Request
-
-(Describe the solution you'd like to see.)
-
-### Links / references
-
-/label ~"feature request"

CHANGES

@@ -1,80 +1,28 @@
-5005.	[bug]		dnssec-verify, and dnssec-signzone at the verification
-			step, failed on some validly signed zones. [GL #442]
-
-5004.	[bug]		'rndc reconfig' could cause inline zones to stop
-			re-signing. [GL #439]
-
-5003.	[bug]		dns_acl_isinsecure did not handle geoip elements.
-			[GL #406]
-
-5002.	[bug]		mdig: Handle malformed +ednsopt option, support 100
-			+ednsopt options per query rather than 100 total and
-			address memory leaks if +ednsopt was specified.
-			[GL #410]
-
-5001.	[bug]		Fix refcount errors on error paths. [GL !563]
-
-5000.	[bug]		named_server_servestale() could leave the server in
-			exclusive mode if an error occured. [GL #441]
-
-4999.	[cleanup]	Remove custom printf implementaion in lib/isc/print.c.
-			[GL #261]
-
-4998.	[test]		Make resolver and cacheclean tests more civilized.
-
-4997.	[placeholder]
-
-4996.	[bug]		dig: Handle malformed +ednsopt option. [GL #403]
+4996.	[bug]		dig: Handle malformed ednsopt options. [GL #403]
 
 4995.	[test]		Add tests for "tcp-self" update policy. [GL !282]
 
 4994.	[bug]		Trust anchor telemetry queries were not being sent
 			upstream for locally served zones. [GL #392]
 
-4993.	[cleanup]	Remove support for silently ignoring 'no-change' deltas
-			from BIND 8 when processing an IXFR stream. 'no-change'
-			deltas will now trigger a fallback to AXFR as the
-			recovery mechanism. [GL #369]
-
 4992.	[bug]		The wrong address was being logged for trust anchor
 			telemetry queries. [GL #379]
 
-4991.	[bug]		"rndc reconfig" was incorrectly handling zones whose
-			"mirror" setting was changed. [GL #381]
-
 4990.	[bug]		Prevent a possible NULL reference in pkcs11-keygen.
 			[GL #401]
 
-4989.	[cleanup]	IDN support in dig has been reworked.  IDNA2003
-			fallbacks were removed in the process. [GL #384]
-
 4988.	[bug]		Don't synthesize NXDOMAIN from NSEC for records under
-			a DNAME.
+			a DNAME. [GL #386]
 
-	--- 9.13.2 released ---
+	--- 9.12.2 released ---
 
-4987.	[cleanup]	dns_rdataslab_tordataset() and its related
-			dns_rdatasetmethods_t callbacks were removed as they
-			were not being used by anything in BIND. [GL #371]
-
-4986.	[func]		When built on Linux, BIND now requires the libcap
-			library to set process privileges, unless capability
-			support is explicitly overridden with "configure
-			--disable-linux-caps". [GL #321]
-
-4985.	[func]		Add a new slave zone option, "mirror", to enable
-			serving a non-authoritative copy of a zone that
-			is subject to DNSSEC validation before being
-			used.  For now, this option is only meant to
-			facilitate deployment of an RFC 7706-style local
-			copy of the root zone. [GL #33]
+	--- 9.12.2rc2 released ---
 
 4984.	[bug]		Improve handling of very large incremental
 			zone transfers to prevent journal corruption. [GL #339]
 
-4983.	[func]		Add the ability to not return a DNS COOKIE option
-			when one is present in the request (answer-cookie no;).
-			[GL #173]
+4983.	[cleanup]	Remove the deprecated flag from "answer-cookie";
+                        it will be allowed to persist into 9.13. [GL #275].
 
 4982.	[cleanup]	Return FORMERR if the question section is empty
 			and no COOKIE option is present; this restores
@@ -87,7 +35,9 @@
 4980.	[bug]		Named-checkconf failed to detect bad in-view targets.
 			[GL #288]
 
-4979.	[placeholder]
+4979.	[bug]		Non-libcap builds were not checking whether all
+			requested capabilities are present in the permitted
+			capability set. [GL #321]
 
 4978.	[test]		Fix error handling and resolver configuration in the
 			"rpz" system test. [GL #312]
@@ -103,30 +53,22 @@
 
 4974.	[bug]		Restore default rrset-order to random. [GL #336]
 
-4973.	[func]		verifyzone() and the functions it uses were moved to
-			libdns and refactored to prevent exit() from being
-			called upon failure.  A side effect of that is that
-			dnssec-signzone and dnssec-verify now check for memory
-			leaks upon shutdown. [GL #266]
-
 4972.	[func]		Declare the 'rdata' argument for dns_rdata_tostruct()
 			to be const. [GL #341]
 
 4971.	[bug]		dnssec-signzone and dnssec-verify did not treat records
 			below a DNAME as out-of-zone data. [GL #298]
 
-4970.	[func]		Add QNAME minimization option to resolver. [GL #16]
-
 4969.	[cleanup]	Refactor zone logging functions. [GL #269]
 
-	--- 9.13.1 released ---
+	--- 9.12.2rc1 released ---
 
 4968.	[bug]		If glue records are signed, attempt to validate them.
 			[GL #209]
 
-4967.	[cleanup]	Add "answer-cookie" to the parser, marked obsolete.
-
-4966.	[placeholder]
+4966.	[func]		Add the ability to not return a DNS COOKIE option
+			when one is present in the request (answer-cookie no;).
+			[GL #173]
 
 4965.	[func]		Add support for marking options as deprecated.
 			[GL #322]
@@ -142,9 +84,6 @@
 4962.	[cleanup]	Move 'named -T' processing to its own function.
 			[GL #316]
 
-4961.	[protocol]	Remove support for ECC-GOST (GOST R 34.11-94).
-			[GL #295]
-
 4960.	[security]	When recursion is enabled, but the "allow-recursion"
 			and "allow-query-cache" ACLs are not specified,
 			they should be limited to local networks,
@@ -152,23 +91,8 @@
 			"allow-query", thus allowing remote queries.
 			(CVE-2018-5738) [GL #309]
 
-4959.	[func]		NSID logging (enabled by the "request-nsid" option)
-			now has its own "nsid" category, instead of using the
-			"resolver" category. [GL !332]
-
 4958.	[bug]		Remove redundant space from NSEC3 record. [GL #281]
 
-4957.	[func]		The default setting for "dnssec-validation" is now
-			"auto", which activates DNSSEC validation using the
-			IANA root key. (The default can be changed back to
-			"yes", which activates DNSSEC validation only when keys
-			are explicitly configured in named.conf, by building
-			BIND with "configure --disable-auto-validation".)
-			[GL #30]
-
-4956.	[func]		Change isc_random() to be just PRNG using xoshiro128**,
-			and add isc_nonce_buf() that uses CSPRNG. [GL #289]
-
 4955.	[cleanup]	Silence cppcheck warnings in lib/dns/master.c.
 			[GL #286]
 
@@ -176,49 +100,17 @@
 			directed to the "serve-stale" logging category.
 			Also clarified serve-stale documentation. [GL !323]
 
-4953.	[bug]		Removed the option to build the red black tree
-			database without a hash table; the non-hashing
-			version was buggy and is not needed. [GL #184]
-
-4952.	[func]		Authoritative server support in named for the
-			EDNS CLIENT-SUBNET option (which was experimental
-			and not practical to deploy) has been removed.
-
-			The ECS option is still supported in dig and mdig
-			via the +subnet option, and can be parsed and logged
-			when received by named, but it is no longer used
-			for ACL processing. The "geoip-use-ecs" option
-			is now obsolete; a warning will be logged if it is
-			used in named.conf. "ecs" tags in an ACL definition
-			are also obsolete and will cause the configuration
-			to fail to load.  [GL #32]
-
 4951.	[protocol]	Add "HOME.ARPA" to list of built in empty zones as
 			per RFC 8375. [GL #273]
 
-	--- 9.13.0 released ---
-
 4950.	[bug]		ISC_SOCKEVENTATTR_TRUNC was not be set. [GL #238]
 
-4949.	[placeholder]
-
-4948.	[bug]		When request-nsid is turned on, EDNS NSID options
-			should be logged at level info. Since change 3741
-			they have been logged at debug(3) by mistake.
-			[GL !290]
-
-4947.	[func]		Replace all random functions with isc_random(),
-			isc_random_buf() and isc_random_uniform() API.
-			[GL #221]
+4949.	[bug]		lib/isc/print.c failed to handle floating point
+			output correctly. [GL #261]
 
 4946.	[bug]		Additional glue was not being returned by resolver
 			for unsigned zones since change 4596. [GL #209]
 
-4945.	[func]		BIND can no longer be built without DNSSEC support.
-			A cryptography provder (i.e., OpenSSL or a hardware
-			service module with PKCS#11 support) must be
-			available. [GL #244]
-
 4944.	[cleanup]	Silence cppcheck portability warnings in
 			lib/isc/tests/buffer_test.c. [GL #239]
 
@@ -227,25 +119,8 @@
 			hash table size to 512 entries for 'named -m record'
 			restoring the previous memory footprint. [GL #248]
 
-4942.	[cleanup]	Consolidate multiple instances of splitting of
-			batchline in dig into a single function. [GL #196]
-
-4941.	[cleanup]	Silence clang static analyzer warnings. [GL #196]
-
-4940.	[cleanup]	Extract the loop in dns__zone_updatesigs() into
-			separate functions to improve code readability.
-			[GL #135]
-
 4939.	[test]		Add basic unit tests for update_sigs(). [GL #135]
 
-4938.	[placeholder]
-
-4937.	[func]		Remove support for OpenSSL < 1.0.0 [GL #191]
-
-4936.	[func]		Always use OpenSSL or PKCS#11 random data providers,
-			and remove the --{enable,disable}-crypto-rand configure
-			options. [GL #165]
-
 4935.	[func]		Add support for LibreSSL >= 2.7.0 (some OpenSSL 1.1.0
 			call were added). [GL #191]
 
@@ -264,37 +139,12 @@
 			logged even when an error occurred while updating
 			signatures. [GL #159]
 
-4931.	[func]		Removed the "rbtdb64" database implementation.
-			[GL #217]
-
 4930.	[bug]		Remove a bogus check in nslookup command line
 			argument processing. [GL #206]
 
-4929.	[func]		Add the ability to set RA and TC in queries made by
-			dig (+[no]raflag, +[no]tcflag). [GL #213]
-
-4928.	[func]		The "dnskey-sig-validity" option allows
-			"sig-validity-interval" to be overriden for signatures
-			covering DNSKEY RRsets. [GL #145]
-
-4927.	[placeholder]
-
 4926.	[func]		Add root key sentinel support.  To disable, add
 			'root-key-sentinel no;' to named.conf. [GL #37]
 
-4925.	[func]		Several configuration options that define intervals
-			can now take TTL value suffixes (for example, 2h or 1d)
-			in addition to integer parameters. These include
-			max-cache-ttl, max-ncache-ttl, max-policy-ttl,
-			fstrm-set-reopen-interval, interface-interval, and
-			min-update-interval. [GL #203]
-
-4924.	[cleanup]	Clean up the isc_string_* namespace and leave
-			only strlcpy and strlcat. [GL #178]
-
-4923.	[cleanup]	Refactor socket and socket event options into
-			enum types. [GL !135]
-
 4922.	[bug]		dnstap: Log the destination address of client
 			packets rather than the interface address.
 			[GL #197]
@@ -304,20 +154,8 @@
 			refactoring dns_fixedname_*() macros were turned into
 			functions. [GL #183]
 
-4920.	[cleanup]	Clean up libdns removing most of the backwards
-			compatibility wrappers.
-
-4919.	[cleanup]	Clean up the isc_hash_* namespace and leave only
-			the FNV-1a hash implementation. [GL #178]
-
 4918.	[bug]		Fix double free after keygen error in dnssec-keygen
 			when OpenSSL >= 1.1.0 is used and RSA_generate_key_ex
-			fails. [GL #109]
-
-4917.	[func]		Support 64 RPZ policy zones by default. [GL #123]
-
-4916.	[func]		Remove IDNA2003 support and the bundled idnkit-1.0
-			library.
 
 4915.	[func]		Implement IDNA2008 support in dig by adding support
 			for libidn2.  New dig option +idnin has been added,
@@ -352,15 +190,10 @@
 4907.	[test]		Improved the reliability of the 'notify' system
 			test. [GL #59]
 
-4906.	[func]		Replace getquad() with inet_pton(), completing
-			change #4900. [GL #56]
-
 4905.	[bug]		irs_resconf_load() ignored resolv.conf syntax errors
 			when "domain" or "search" options were present in that
 			file. [GL #110]
 
-4904.	[bug]		Temporarily revert change #4859. [GL #124]
-
 4903.	[bug]		"check-mx fail;" did not prevent MX records containing
 			IP addresses from being added to a zone by a dynamic
 			update. [GL #112]
@@ -368,21 +201,11 @@
 4902.	[test]		Improved the reliability of the 'ixfr' system
 			test. [GL #66]
 
-4901.	[func]		"dig +nssearch" now lists the name servers
-			for a domain that time out, as well as the servers
-			that respond. [GL #64]
-
-4900.	[func]		Remove all uses of inet_aton().  As a result of this
-			change, IPv4 addresses are now only accepted in
-			dotted-quad format. [GL #13]
-
 4899.	[test]		Convert most of the remaining system tests to be able
 			to run in parallel, continuing the work from change
 			#4895. To take advantage of this, use "make -jN check",
 			where N is the number of processors to use. [GL #91]
 
-4898.	[func]		Remove libseccomp based system-call filtering. [GL #93]
-
 4897.	[test]		Update to rpz system test so that it doesn't recurse.
 			[GL #68]
 
@@ -391,6 +214,14 @@
 4895.	[test]		Allow some system tests to run in parallel.
 			[RT #46602]
 
+	--- 9.12.1 released ---
+
+	--- 9.12.1rc2 released ---
+
+4904.	[bug]		Temporarily revert change #4859. [GL #124]
+
+	--- 9.12.1rc1 released ---
+
 4894.	[bug]		named could crash while rolling a dnstap output file.
 			[RT #46942]
 
@@ -400,16 +231,13 @@
 			before all zone loading actions triggered by a previous
 			"rndc reload" command were completed. [RT #47076]
 
-4891.	[placeholder]
-
-4890.	[func]		Remove unused ondestroy callback from libisc.
-			[isc-projects/bind9!3]
-
 4889.	[func]		Warn about the use of old root keys without the new
 			root key being present.  Warn about dlv.isc.org's
 			key being present. Warn about both managed and
 			trusted root keys being present. [RT #43670]
 
+	--- 9.12.1b1 released ---
+
 4888.	[test]		Initialize sockets correctly in sample-update so
 			that the nsupdate system test will run on Windows.
 			[RT #47097]
@@ -480,9 +308,6 @@
 			be passed to memmove which is undefined behavior and
 			can lead to bad optimization. [RT #46888]
 
-4868.	[func]		dnssec-keygen can no longer generate HMAC keys.
-			Use tsig-keygen instead. [RT #46404]
-
 4867.	[cleanup]	Normalize rndc on/off commands (validation,
 			querylog, serve-stale) so they all accept the
 			same synonyms for on/off (yes/no, true/false,
@@ -492,33 +317,15 @@
 			was not disabled) and SHA-1 hash and HMAC support.
 			[RT #46764]
 
-4865.	[cleanup]	Simplify handling isc_socket_sendto2() return values.
-			[RT #46986]
-
 4864.	[bug]		named acting as a slave for a catalog zone crashed if
 			the latter contained a master definition without an IP
 			address. [RT #45999]
 
-4863.	[bug]		Fix various other bugs reported by Valgrind's
-			memcheck tool. [RT #46978]
-
-4862.	[bug]		The rdata flags for RRSIG were not being properly set
-			when constructing a rdataslab. [RT #46978]
-
 4861.	[bug]		The isc_crc64 unit test was not endian independent.
 			[RT #46973]
 
 4860.	[bug]		isc_int8_t should be signed char.  [RT #46973]
 
-4859.	[bug]		A loop was possible when attempting to validate
-			unsigned CNAME responses from secure zones;
-			this caused a delay in returning SERVFAIL and
-			also increased the chances of encountering
-			CVE-2017-3145. [RT #46839]
-
-4858.	[security]	Addresses could be referenced after being freed
-			in resolver.c, causing an assertion failure.
-			(CVE-2017-3145) [RT #46839]
 
 4857.	[bug]		Maintain attach/detach semantics for event->db,
 			event->node, event->rdataset and event->sigrdataset
@@ -544,16 +351,6 @@
 4851.	[port]		Support using kyua as well as atf-run to run the unit
 			tests. [RT #46853]
 
-4850.	[bug]		Named failed to restart with multiple added zones in
-			lmdb database. [RT #46889]
-
-4849.	[bug]		Duplicate zones could appear in the .nzf file if
-			addzone failed. [RT #46435]
-
-4848.	[func]		Zone types "primary" and "secondary" can now be used
-			as synonyms for "master" and "slave" in named.conf.
-			[RT #46713]
-
 4847.	[bug]		dnssec-dnskey-kskonly was not being honored for
 			CDS and CDNSKEY. [RT #46755]
 
@@ -571,6 +368,34 @@
 4842.	[bug]		Conditionally compile opensslecdsa_link.c to avoid
 			warnings about unused function. [RT #46790]
 
+	--- 9.12.0 released ---
+
+	--- 9.12.0rc3 released ---
+
+4863.	[bug]		Fix various other bugs reported by Valgrind's
+			memcheck tool. [RT #46978]
+
+4862.	[bug]		The rdata flags for RRSIG were not being properly set
+			when constructing a rdataslab. [RT #46978]
+
+	--- 9.12.0rc2 released ---
+
+4859.	[bug]		A loop was possible when attempting to validate
+			unsigned CNAME responses from secure zones;
+			this caused a delay in returning SERVFAIL and
+			also increased the chances of encountering
+			CVE-2017-3145. [RT #46839]
+
+4858.	[security]	Addresses could be referenced after being freed
+			in resolver.c, causing an assertion failure.
+			(CVE-2017-3145) [RT #46839]
+
+4850.	[bug]		Named failed to restart with multiple added zones in
+			lmdb database. [RT #46889]
+
+4849.	[bug]		Duplicate zones could appear in the .nzf file if
+			addzone failed. [RT #46435]
+
 	--- 9.12.0rc1 released ---
 
 4841.	[bug]		Address -fsanitize=undefined warnings. [RT #46786]

Makefile.in

@@ -22,8 +22,7 @@ MANPAGES =	isc-config.sh.1
 
 HTMLPAGES =	isc-config.sh.html
 
-MANOBJS =	README HISTORY OPTIONS CONTRIBUTING PLATFORMS \
-		${MANPAGES} ${HTMLPAGES}
+MANOBJS =	README HISTORY OPTIONS ${MANPAGES} ${HTMLPAGES}
 
 @BIND9_MAKE_RULES@
 
@@ -115,11 +114,6 @@ CONTRIBUTING: CONTRIBUTING.md
 		${W3M} -dump -cols 75 -O ascii -T text/html | \
 		sed -e '$${/^$$/d;}' > $@
 
-PLATFORMS: PLATFORMS.md
-	${PANDOC} --email-obfuscation=none -s -t html PLATFORMS.md | \
-		${W3M} -dump -cols 75 -O ascii -T text/html | \
-		sed -e '$${/^$$/d;}' > $@
-
 unit::
 	sh ${top_builddir}/unit/unittest.sh
 

OPTIONS

@@ -19,6 +19,9 @@ Setting                   Description
                           named-checkzone
 -DNS_RUN_PID_DIR=0        Create default PID files in ${localstatedir}/run
                           rather than ${localstatedir}/run/named/
+                          Increase the maximum number of configurable
+-DNS_RPZ_MAX_ZONES=64     response policy zones from 32 to 64; this is the
+                          highest possible setting
                           Disable the use of inline functions to implement
 -DISC_BUFFER_USEINLINE=0  the isc_buffer API: this reduces performance but
                           may be useful when debugging

OPTIONS.md

@@ -23,5 +23,6 @@ Some of these settings are:
 |`-DCHECK_SIBLING=0`|Don't check sibling glue in `named-checkzone`|
 |`-DCHECK_LOCAL=0`|Don't check out-of-zone addresses in `named-checkzone`|
 |`-DNS_RUN_PID_DIR=0`|Create default PID files in `${localstatedir}/run` rather than `${localstatedir}/run/named/`|
+|`-DNS_RPZ_MAX_ZONES=64`|Increase the maximum number of configurable response policy zones from 32 to 64; this is the highest possible setting|
 |`-DISC_BUFFER_USEINLINE=0`|Disable the use of inline functions to implement the `isc_buffer` API: this reduces performance but may be useful when debugging |
 |`-DISC_HEAP_CHECK`|Test heap consistency after every heap operation; used when debugging|

PLATFORMS

@@ -1,56 +0,0 @@
-Supported platforms
-
-In general, this version of BIND will build and run on any POSIX-compliant
-system with a C99-compliant C compiler, BSD-style sockets, and the OpenSSL
-cryptography library. To build with multiprocessing support, a
-C11-compliant C compiler will be needed for standard atomics.
-
-ISC regularly tests BIND on many operating systems and architectures, but
-lacks the resources to test all of them. Consequently, ISC is only able to
-offer support on a "best effort" basis for some.
-
-Regularly tested platforms
-
-As of May 2018, BIND 9.13 is tested on the following systems:
-
-  * Debian 8, 9
-  * Ubuntu 16.04, 18.04
-  * Fedora 27, 28
-  * Red Hat/CentOS 6, 7
-  * FreeBSD 10.x, 11.x
-  * OpenBSD 6.3
-
-The amd64, i386, armhf and arm64 CPU architectures are all fully
-supported.
-
-Best effort
-
-The following are platforms on which BIND is known to build and run, but
-on which it is not routinely tested. ISC makes every effort to fix bugs on
-these platforms, but may be unable to do so quickly due to lack of
-hardware, less familiarity on the part of engineering staff, and other
-constraints.
-
-  * Windows 10 / x64
-  * Windows Server 2012 R2, 2016 / x64
-  * macOS 10.12+
-  * Solaris 10
-  * FreeBSD 12+
-  * OpenBSD 6.2
-  * NetBSD
-  * Older or less popular Linux distributions still supported by their
-    vendors, such as:
-      + Ubuntu 14.04, 18.10+
-      + Gentoo
-      + ArchLinux
-      + Alpine Linux
-  * OpenWRT/LEDE 17.0
-  * Other CPU architectures (mips, mipsel, sparc, ...)
-
-Unsupported platforms
-
-These are platforms on which BIND is known not to build or run:
-
-  * Platforms without at least OpenSSL 1.0.2
-  * Windows 10 / x86
-  * Windows Server 2012

PLATFORMS.md

@@ -1,64 +0,0 @@
-<!--
- - Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- -
- - This Source Code Form is subject to the terms of the Mozilla Public
- - License, v. 2.0. If a copy of the MPL was not distributed with this
- - file, You can obtain one at http://mozilla.org/MPL/2.0/.
- -
- - See the COPYRIGHT file distributed with this work for additional
- - information regarding copyright ownership.
--->
-## Supported platforms
-
-In general, this version of BIND will build and run on any POSIX-compliant
-system with a C99-compliant C compiler, BSD-style sockets, and the OpenSSL
-cryptography library. To build with multiprocessing support, a
-C11-compliant C compiler will be needed for standard atomics.
-
-ISC regularly tests BIND on many operating systems and architectures, but
-lacks the resources to test all of them. Consequently, ISC is only able to
-offer support on a "best effort" basis for some.
-
-### Regularly tested platforms
-
-As of May 2018, BIND 9.13 is tested on the following systems:
-
-* Debian 8, 9
-* Ubuntu 16.04, 18.04
-* Fedora 27, 28
-* Red Hat/CentOS 6, 7
-* FreeBSD 10.x, 11.x
-* OpenBSD 6.3
-
-The amd64, i386, armhf and arm64 CPU architectures are all fully supported.
-
-### Best effort
-
-The following are platforms on which BIND is known to build and run,
-but on which it is not routinely tested. ISC makes every effort to fix bugs
-on these platforms, but may be unable to do so quickly due to lack of
-hardware, less familiarity on the part of engineering staff, and other
-constraints.
-
-* Windows 10 / x64
-* Windows Server 2012 R2, 2016 / x64
-* macOS 10.12+
-* Solaris 10
-* FreeBSD 12+
-* OpenBSD 6.2
-* NetBSD
-* Older or less popular Linux distributions still supported by their vendors, such as:
-    * Ubuntu 14.04, 18.10+
-    * Gentoo
-    * ArchLinux
-    * Alpine Linux
-* OpenWRT/LEDE 17.0
-* Other CPU architectures (mips, mipsel, sparc, ...)
-
-## Unsupported platforms
-
-These are platforms on which BIND is known *not* to build or run:
-
-* Platforms without at least OpenSSL 1.0.2
-* Windows 10 / x86
-* Windows Server 2012

README

@@ -5,7 +5,7 @@ Contents
  1. Introduction
  2. Reporting bugs and getting help
  3. Contributing to BIND
- 4. BIND 9.13 features
+ 4. BIND 9.12 features
  5. Building BIND
  6. macOS
  7. Compile-time options
@@ -31,9 +31,9 @@ administrative tools, including the dig and delv DNS lookup tools,
 nsupdate for dynamic DNS zone updates, rndc for remote name server
 administration, and more.
 
-BIND 9 began as a complete re-write of the BIND architecture that was used
-in versions 4 and 8. Internet Systems Consortium (https://www.isc.org), a
-501(c)(3) public benefit corporation dedicated to providing software and
+BIND 9 is a complete re-write of the BIND architecture that was used in
+versions 4 and 8. Internet Systems Consortium (https://www.isc.org), a 501
+(c)(3) public benefit corporation dedicated to providing software and
 services in support of the Internet infrastructure, developed BIND 9 and
 is responsible for its ongoing maintenance and improvement. BIND is open
 source software licenced under the terms of the Mozilla Public License,
@@ -48,8 +48,6 @@ the file CHANGES. See below for details on the CHANGES file format.
 For up-to-date release notes and errata, see http://www.isc.org/software/
 bind9/releasenotes
 
-For information about supported platforms, see PLATFORMS.
-
 Reporting bugs and getting help
 
 To report non-security-sensitive bugs or request new features, you may
@@ -84,8 +82,8 @@ ISC maintains a public git repository for BIND; details can be found at
 http://www.isc.org/git/.
 
 Information for BIND contributors can be found in the following files: -
-General information: CONTRIBUTING.md - BIND 9 code style: doc/dev/style.md
-- BIND architecture and developer guide: doc/dev/dev.md
+General information: doc/dev/contrib.md - BIND 9 code style: doc/dev/
+style.md - BIND architecture and developer guide: doc/dev/dev.md
 
 Patches for BIND may be submitted as Merge Requests in the ISC GitLab
 server at at https://gitlab.isc.org/isc-projects/bind9/merge_requests.
@@ -99,42 +97,57 @@ If you prefer, you may also submit code by opening a GitLab Issue and
 including your patch as an attachment, preferably generated by git
 format-patch.
 
-BIND 9.13 features
+BIND 9.12 features
 
-BIND 9.13 is the newest development branch of BIND 9. It includes a number
-of changes from BIND 9.12 and earlier releases. New features include:
+BIND 9.12.0 is the newest development branch of BIND 9. It includes a
+number of changes from BIND 9.11 and earlier releases. New features
+include:
 
-  * The default value of "dnssec-validation" is now "auto".
-  * Support for IDNA2008 when linking with libidn2.
-  * "Root key sentinel" support, enabling validating resolvers to indicate
-    via a special query which trust anchors are configured for the root
-    zone.
-  * Secondary zones can now be configured as "mirror" zones; their
-    contents are transferred in as with traditional slave zones, but are
-    subject to DNSSEC validation and are not treated as authoritative data
-    when answering. This makes it easier to configure a local copy of the
-    root zone as described in RFC 7706.
+  * named and related libraries have been substantially refactored for
+    improved query performance -- particularly on delegation heavy zones
+    -- and for improved readability, maintainability, and testability.
+  * Code implementing the name server query processing logic has been
+    moved into a new libns library, for easier testing and use in tools
+    other than named.
+  * Cached, validated NSEC and other records can now be used to synthesize
+    NXDOMAIN responses.
+  * The DNS Response Policy Service API (DNSRPS) is now supported.
+  * Setting 'max-journal-size default' now limits the size of journal
+    files to twice the size of the zone.
+  * dnstap-read -x prints a hex dump of the wire format of each logged DNS
+    message.
+  * dnstap output files can now be configured to roll automatically when
+    reaching a given size.
+  * Log file timestamps can now also be formatted in ISO 8601 (local) or
+    ISO 8601 (UTC) formats.
+  * Logging channels and dnstap output files can now be configured to use
+    a timestamp as the suffix when rolling to a new file.
+  * 'named-checkconf -l' lists zones found in named.conf.
+  * Added support for the EDNS Padding and Keepalive options.
+  * 'new-zones-directory' option sets the location where the configuration
+    data for zones added by rndc addzone is stored.
+  * The default key algorithm in rndc-confgen is now hmac-sha256.
+  * filter-aaaa-on-v4 and filter-aaaa-on-v6 options are now available by
+    default without a configure option.
+  * The obsolete isc-hmac-fixup command has been removed.
 
-In addition, cryptographic support has been modernized. BIND now uses the
-best available pseudo-random number generator for the platform on which
-it's built. Very old versions of OpenSSL are no longer supported.
-Cryptography is now mandatory; building BIND without DNSSEC is now longer
-supported.
+BIND 9.12.1
+
+BIND 9.12.1 is a maintenance release.
+
+BIND 9.12.2
+
+BIND 9.12.2 is a maintenance release, and addresses security
+vulnerabilities disclosed in CVE-2018-5736, CVE-2018-5737 and
+CVE-2018-5738.
 
 Building BIND
 
-Minimally, BIND requires a UNIX or Linux system with an ANSI C compiler,
-basic POSIX support, and a 64-bit integer type. Successful builds have
-been observed on many versions of Linux and UNIX, including RedHat,
-Fedora, Debian, Ubuntu, SuSE, Slackware, FreeBSD, NetBSD, OpenBSD, Mac OS
-X, Solaris, HP-UX, AIX, SCO OpenServer, and OpenWRT.
-
-BIND requires a cryptography provider library such as OpenSSL or a
-hardware service module supporting PKCS#11. On Linux, BIND requires the
-libcap library to set process privileges, though this requirement can be
-overridden by disabling capability support at compile time. See
-Compile-time options below for details on other libraries that may be
-required to support optional features.
+BIND requires a UNIX or Linux system with an ANSI C compiler, basic POSIX
+support, and a 64-bit integer type. Successful builds have been observed
+on many versions of Linux and UNIX, including RedHat, Fedora, Debian,
+Ubuntu, SuSE, Slackware, FreeBSD, NetBSD, OpenBSD, Mac OS X, Solaris,
+HP-UX, AIX, SCO OpenServer, and OpenWRT.
 
 BIND is also available for Windows 2008 and higher. See win32utils/
 readme1st.txt for details on building for Windows systems.
@@ -205,10 +218,11 @@ smaller systems.
 For the server to support DNSSEC, you need to build it with crypto
 support. To use OpenSSL, you should have OpenSSL 1.0.2e or newer
 installed. If the OpenSSL library is installed in a nonstandard location,
-specify the prefix using --with-openssl=<PREFIX> on the configure command
-line. To use a PKCS#11 hardware service module for cryptographic
+specify the prefix using "--with-openssl=<PREFIX>" on the configure
+command line. To use a PKCS#11 hardware service module for cryptographic
 operations, specify the path to the PKCS#11 provider library using
---with-pkcs11=<PREFIX>, and configure BIND with --enable-native-pkcs11.
+"--with-pkcs11=<PREFIX>", and configure BIND with
+"--enable-native-pkcs11".
 
 To support the HTTP statistics channel, the server must be linked with at
 least one of the following: libxml2 http://xmlsoft.org or json-c https://
@@ -221,22 +235,17 @@ specify the prefix using --with-zlib=/prefix.
 
 To support storing configuration data for runtime-added zones in an LMDB
 database, the server must be linked with liblmdb. If this is installed in
-a nonstandard location, specify the prefix using with-lmdb=/prefix.
+a nonstandard location, specify the prefix using "with-lmdb=/prefix".
 
 To support GeoIP location-based ACLs, the server must be linked with
 libGeoIP. This is not turned on by default; BIND must be configured with
---with-geoip. If the library is installed in a nonstandard location,
-specify the prefix using --with-geoip=/prefix.
+"--with-geoip". If the library is installed in a nonstandard location, use
+specify the prefix using "--with-geoip=/prefix".
 
 For DNSTAP packet logging, you must have installed libfstrm https://
 github.com/farsightsec/fstrm and libprotobuf-c https://
 developers.google.com/protocol-buffers, and BIND must be configured with
---enable-dnstap.
-
-On Linux, process capabilities are managed in user space using the libcap
-library, which can be installed on most Linux systems via the libcap-dev
-or libcap-devel module. Process capability support can also be disabled by
-configuring with --disable-linux-caps.
+"--enable-dnstap".
 
 Portions of BIND that are written in Python, including dnssec-keymgr,
 dnssec-coverage, dnssec-checkds, and some of the system tests, require the

README.md

@@ -15,7 +15,7 @@
 1. [Introduction](#intro)
 1. [Reporting bugs and getting help](#help)
 1. [Contributing to BIND](#contrib)
-1. [BIND 9.13 features](#features)
+1. [BIND 9.12 features](#features)
 1. [Building BIND](#build)
 1. [macOS](#macos)
 1. [Compile-time options](#opts)
@@ -41,8 +41,8 @@ administrative tools, including the `dig` and `delv` DNS lookup tools,
 `nsupdate` for dynamic DNS zone updates, `rndc` for remote name server
 administration, and more.
 
-BIND 9 began as a complete re-write of the BIND architecture that was
-used in versions 4 and 8.  Internet Systems Consortium
+BIND 9 is a complete re-write of the BIND architecture that was used in
+versions 4 and 8.  Internet Systems Consortium
 ([https://www.isc.org](https://www.isc.org)), a 501(c)(3) public benefit
 corporation dedicated to providing software and services in support of the
 Internet infrastructure, developed BIND 9 and is responsible for its
@@ -59,8 +59,6 @@ CHANGES file format.
 For up-to-date release notes and errata, see
 [http://www.isc.org/software/bind9/releasenotes](http://www.isc.org/software/bind9/releasenotes)
 
-For information about supported platforms, see [PLATFORMS](PLATFORMS.md).
-
 ### <a name="help"/> Reporting bugs and getting help
 
 To report non-security-sensitive bugs or request new features, you may
@@ -97,7 +95,7 @@ ISC maintains a public git repository for BIND; details can be found
 at [http://www.isc.org/git/](http://www.isc.org/git/).
 
 Information for BIND contributors can be found in the following files:
-- General information: [CONTRIBUTING.md](CONTRIBUTING)
+- General information: [doc/dev/contrib.md](doc/dev/contrib.md)
 - BIND 9 code style: [doc/dev/style.md](doc/dev/style.md)
 - BIND architecture and developer guide: [doc/dev/dev.md](doc/dev/dev.md)
 
@@ -116,42 +114,57 @@ If you prefer, you may also submit code by opening a
 including your patch as an attachment, preferably generated by
 `git format-patch`.
 
-### <a name="features"/> BIND 9.13 features
+### <a name="features"/> BIND 9.12 features
 
-BIND 9.13 is the newest development branch of BIND 9. It includes a
-number of changes from BIND 9.12 and earlier releases.  New features
+BIND 9.12.0 is the newest development branch of BIND 9. It includes a
+number of changes from BIND 9.11 and earlier releases.  New features
 include:
 
-* The default value of "dnssec-validation" is now "auto".
-* Support for IDNA2008 when linking with `libidn2`.
-* "Root key sentinel" support, enabling validating resolvers to indicate
-  via a special query which trust anchors are configured for the root zone.
-* Secondary zones can now be configured as "mirror" zones; their contents
-  are transferred in as with traditional slave zones, but are subject to
-  DNSSEC validation and are not treated as authoritative data when
-  answering. This makes it easier to configure a local copy of the root
-  zone as described in RFC 7706.
+* `named` and related libraries have been substantially refactored for
+  improved query performance -- particularly on delegation heavy zones -- 
+  and for improved readability, maintainability, and testability.
+* Code implementing the name server query processing logic has been moved
+  into a new `libns` library, for easier testing and use in tools other
+  than `named`.
+* Cached, validated NSEC and other records can now be used to synthesize
+  NXDOMAIN responses.
+* The DNS Response Policy Service API (DNSRPS) is now supported.
+* Setting `'max-journal-size default'` now limits the size of journal files
+  to twice the size of the zone.
+* `dnstap-read -x` prints a hex dump of the wire format of each logged
+  DNS message.
+* `dnstap` output files can now be configured to roll automatically when
+  reaching a given size.
+* Log file timestamps can now also be formatted in ISO 8601 (local) or ISO
+  8601 (UTC) formats.
+* Logging channels and `dnstap` output files can now be configured to use a
+  timestamp as the suffix when rolling to a new file.
+* `'named-checkconf -l'` lists zones found in `named.conf`.
+* Added support for the EDNS Padding and Keepalive options.
+* 'new-zones-directory' option sets the location where the configuration
+  data for zones added by rndc addzone is stored.
+* The default key algorithm in `rndc-confgen` is now hmac-sha256.
+* `filter-aaaa-on-v4` and `filter-aaaa-on-v6` options are now available
+  by default without a configure option.
+* The obsolete `isc-hmac-fixup` command has been removed.
 
-In addition, cryptographic support has been modernized. BIND now uses the
-best available pseudo-random number generator for the platform on which
-it's built. Very old versions of OpenSSL are no longer supported.
-Cryptography is now mandatory; building BIND without DNSSEC is now
-longer supported.
+#### BIND 9.12.1
+
+BIND 9.12.1 is a maintenance release.
+
+#### BIND 9.12.2
+
+BIND 9.12.2 is a maintenance release, and addresses security
+vulnerabilities disclosed in CVE-2018-5736, CVE-2018-5737 and
+CVE-2018-5738.
 
 ### <a name="build"/> Building BIND
 
-Minimally, BIND requires a UNIX or Linux system with an ANSI C compiler,
-basic POSIX support, and a 64-bit integer type. Successful builds have been
-observed on many versions of Linux and UNIX, including RedHat, Fedora,
-Debian, Ubuntu, SuSE, Slackware, FreeBSD, NetBSD, OpenBSD, Mac OS X,
-Solaris, HP-UX, AIX, SCO OpenServer, and OpenWRT.
-
-BIND requires a cryptography provider library such as OpenSSL or a
-hardware service module supporting PKCS#11. On Linux, BIND requires
-the `libcap` library to set process privileges, though this requirement
-can be overridden by disabling capability support at compile time.
-See [Compile-time options](#opts) below for details on other libraries
-that may be required to support optional features.
+BIND requires a UNIX or Linux system with an ANSI C compiler, basic POSIX
+support, and a 64-bit integer type. Successful builds have been observed on
+many versions of Linux and UNIX, including RedHat, Fedora, Debian, Ubuntu,
+SuSE, Slackware, FreeBSD, NetBSD, OpenBSD, Mac OS X, Solaris, HP-UX, AIX,
+SCO OpenServer, and OpenWRT. 
 
 BIND is also available for Windows 2008 and higher.  See
 `win32utils/readme1st.txt` for details on building for Windows
@@ -217,10 +230,10 @@ performance on smaller systems.
 For the server to support DNSSEC, you need to build it with crypto support.
 To use OpenSSL, you should have OpenSSL 1.0.2e or newer installed.  If the
 OpenSSL library is installed in a nonstandard location, specify the prefix
-using `--with-openssl=<PREFIX>` on the configure command line. To use a
+using "--with-openssl=&lt;PREFIX&gt;" on the configure command line. To use a
 PKCS#11 hardware service module for cryptographic operations, specify the
-path to the PKCS#11 provider library using `--with-pkcs11=<PREFIX>`, and
-configure BIND with `--enable-native-pkcs11`.
+path to the PKCS#11 provider library using "--with-pkcs11=&lt;PREFIX&gt;", and
+configure BIND with "--enable-native-pkcs11".
 
 To support the HTTP statistics channel, the server must be linked with at
 least one of the following: libxml2
@@ -235,23 +248,18 @@ specify the prefix using `--with-zlib=/prefix`.
 
 To support storing configuration data for runtime-added zones in an LMDB
 database, the server must be linked with liblmdb. If this is installed in a
-nonstandard location, specify the prefix using `with-lmdb=/prefix`.
+nonstandard location, specify the prefix using "with-lmdb=/prefix".
 
 To support GeoIP location-based ACLs, the server must be linked with
 libGeoIP. This is not turned on by default; BIND must be configured with
-`--with-geoip`. If the library is installed in a nonstandard location,
-specify the prefix using `--with-geoip=/prefix`.
+"--with-geoip". If the library is installed in a nonstandard location, use
+specify the prefix using "--with-geoip=/prefix".
 
 For DNSTAP packet logging, you must have installed libfstrm
 [https://github.com/farsightsec/fstrm](https://github.com/farsightsec/fstrm)
 and libprotobuf-c
 [https://developers.google.com/protocol-buffers](https://developers.google.com/protocol-buffers),
-and BIND must be configured with `--enable-dnstap`.
-
-On Linux, process capabilities are managed in user space using
-the `libcap` library, which can be installed on most Linux systems via
-the `libcap-dev` or `libcap-devel` module. Process capability support can
-also be disabled by configuring with `--disable-linux-caps`.
+and BIND must be configured with "--enable-dnstap".
 
 Portions of BIND that are written in Python, including
 `dnssec-keymgr`, `dnssec-coverage`, `dnssec-checkds`, and some of the

acconfig.h

@@ -121,6 +121,12 @@ int sigwait(const unsigned int *set, int *sig);
 /** define if you have strerror in the C library. */
 #undef HAVE_STRERROR
 
+/* Define if OpenSSL includes DSA support */
+#undef HAVE_OPENSSL_DSA
+
+/* Define if you have getpassphrase in the C library. */
+#undef HAVE_GETPASSPHRASE
+
 /* Define to the length type used by the socket API (socklen_t, size_t, int). */
 #undef ISC_SOCKADDR_LEN_T
 

aclocal.m4

@@ -1,296 +1,17 @@
-# generated automatically by aclocal 1.15.1 -*- Autoconf -*-
+sinclude(libtool.m4/libtool.m4)dnl
+sinclude(libtool.m4/ltoptions.m4)dnl
+sinclude(libtool.m4/ltsugar.m4)dnl
+sinclude(libtool.m4/ltversion.m4)dnl
+sinclude(libtool.m4/lt~obsolete.m4)dnl
 
-# Copyright (C) 1996-2017 Free Software Foundation, Inc.
+m4_divert_text(HELP_CANON, [[
+  NOTE: If PREFIX is not set, then the default values for --sysconfdir
+  and --localstatedir are /etc and /var, respectively.]])
+m4_divert_text(HELP_END, [[
+Professional support for BIND is provided by Internet Systems Consortium,
+Inc.  Information about paid support and training options is available at
+https://www.isc.org/support.
 
-# This file is free software; the Free Software Foundation
-# gives unlimited permission to copy and/or distribute it,
-# with or without modifications, as long as this notice is preserved.
-
-# This program is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY, to the extent permitted by law; without
-# even the implied warranty of MERCHANTABILITY or FITNESS FOR A
-# PARTICULAR PURPOSE.
-
-m4_ifndef([AC_CONFIG_MACRO_DIRS], [m4_defun([_AM_CONFIG_MACRO_DIRS], [])m4_defun([AC_CONFIG_MACRO_DIRS], [_AM_CONFIG_MACRO_DIRS($@)])])
-dnl pkg.m4 - Macros to locate and utilise pkg-config.   -*- Autoconf -*-
-dnl serial 11 (pkg-config-0.29.1)
-dnl
-dnl Copyright © 2004 Scott James Remnant <scott@netsplit.com>.
-dnl Copyright © 2012-2015 Dan Nicholson <dbn.lists@gmail.com>
-dnl
-dnl This program is free software; you can redistribute it and/or modify
-dnl it under the terms of the GNU General Public License as published by
-dnl the Free Software Foundation; either version 2 of the License, or
-dnl (at your option) any later version.
-dnl
-dnl This program is distributed in the hope that it will be useful, but
-dnl WITHOUT ANY WARRANTY; without even the implied warranty of
-dnl MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
-dnl General Public License for more details.
-dnl
-dnl You should have received a copy of the GNU General Public License
-dnl along with this program; if not, write to the Free Software
-dnl Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA
-dnl 02111-1307, USA.
-dnl
-dnl As a special exception to the GNU General Public License, if you
-dnl distribute this file as part of a program that contains a
-dnl configuration script generated by Autoconf, you may include it under
-dnl the same distribution terms that you use for the rest of that
-dnl program.
-
-dnl PKG_PREREQ(MIN-VERSION)
-dnl -----------------------
-dnl Since: 0.29
-dnl
-dnl Verify that the version of the pkg-config macros are at least
-dnl MIN-VERSION. Unlike PKG_PROG_PKG_CONFIG, which checks the user's
-dnl installed version of pkg-config, this checks the developer's version
-dnl of pkg.m4 when generating configure.
-dnl
-dnl To ensure that this macro is defined, also add:
-dnl m4_ifndef([PKG_PREREQ],
-dnl     [m4_fatal([must install pkg-config 0.29 or later before running autoconf/autogen])])
-dnl
-dnl See the "Since" comment for each macro you use to see what version
-dnl of the macros you require.
-m4_defun([PKG_PREREQ],
-[m4_define([PKG_MACROS_VERSION], [0.29.1])
-m4_if(m4_version_compare(PKG_MACROS_VERSION, [$1]), -1,
-    [m4_fatal([pkg.m4 version $1 or higher is required but ]PKG_MACROS_VERSION[ found])])
-])dnl PKG_PREREQ
-
-dnl PKG_PROG_PKG_CONFIG([MIN-VERSION])
-dnl ----------------------------------
-dnl Since: 0.16
-dnl
-dnl Search for the pkg-config tool and set the PKG_CONFIG variable to
-dnl first found in the path. Checks that the version of pkg-config found
-dnl is at least MIN-VERSION. If MIN-VERSION is not specified, 0.9.0 is
-dnl used since that's the first version where most current features of
-dnl pkg-config existed.
-AC_DEFUN([PKG_PROG_PKG_CONFIG],
-[m4_pattern_forbid([^_?PKG_[A-Z_]+$])
-m4_pattern_allow([^PKG_CONFIG(_(PATH|LIBDIR|SYSROOT_DIR|ALLOW_SYSTEM_(CFLAGS|LIBS)))?$])
-m4_pattern_allow([^PKG_CONFIG_(DISABLE_UNINSTALLED|TOP_BUILD_DIR|DEBUG_SPEW)$])
-AC_ARG_VAR([PKG_CONFIG], [path to pkg-config utility])
-AC_ARG_VAR([PKG_CONFIG_PATH], [directories to add to pkg-config's search path])
-AC_ARG_VAR([PKG_CONFIG_LIBDIR], [path overriding pkg-config's built-in search path])
-
-if test "x$ac_cv_env_PKG_CONFIG_set" != "xset"; then
-	AC_PATH_TOOL([PKG_CONFIG], [pkg-config])
-fi
-if test -n "$PKG_CONFIG"; then
-	_pkg_min_version=m4_default([$1], [0.9.0])
-	AC_MSG_CHECKING([pkg-config is at least version $_pkg_min_version])
-	if $PKG_CONFIG --atleast-pkgconfig-version $_pkg_min_version; then
-		AC_MSG_RESULT([yes])
-	else
-		AC_MSG_RESULT([no])
-		PKG_CONFIG=""
-	fi
-fi[]dnl
-])dnl PKG_PROG_PKG_CONFIG
-
-dnl PKG_CHECK_EXISTS(MODULES, [ACTION-IF-FOUND], [ACTION-IF-NOT-FOUND])
-dnl -------------------------------------------------------------------
-dnl Since: 0.18
-dnl
-dnl Check to see whether a particular set of modules exists. Similar to
-dnl PKG_CHECK_MODULES(), but does not set variables or print errors.
-dnl
-dnl Please remember that m4 expands AC_REQUIRE([PKG_PROG_PKG_CONFIG])
-dnl only at the first occurence in configure.ac, so if the first place
-dnl it's called might be skipped (such as if it is within an "if", you
-dnl have to call PKG_CHECK_EXISTS manually
-AC_DEFUN([PKG_CHECK_EXISTS],
-[AC_REQUIRE([PKG_PROG_PKG_CONFIG])dnl
-if test -n "$PKG_CONFIG" && \
-    AC_RUN_LOG([$PKG_CONFIG --exists --print-errors "$1"]); then
-  m4_default([$2], [:])
-m4_ifvaln([$3], [else
-  $3])dnl
-fi])
-
-dnl _PKG_CONFIG([VARIABLE], [COMMAND], [MODULES])
-dnl ---------------------------------------------
-dnl Internal wrapper calling pkg-config via PKG_CONFIG and setting
-dnl pkg_failed based on the result.
-m4_define([_PKG_CONFIG],
-[if test -n "$$1"; then
-    pkg_cv_[]$1="$$1"
- elif test -n "$PKG_CONFIG"; then
-    PKG_CHECK_EXISTS([$3],
-                     [pkg_cv_[]$1=`$PKG_CONFIG --[]$2 "$3" 2>/dev/null`
-		      test "x$?" != "x0" && pkg_failed=yes ],
-		     [pkg_failed=yes])
- else
-    pkg_failed=untried
-fi[]dnl
-])dnl _PKG_CONFIG
-
-dnl _PKG_SHORT_ERRORS_SUPPORTED
-dnl ---------------------------
-dnl Internal check to see if pkg-config supports short errors.
-AC_DEFUN([_PKG_SHORT_ERRORS_SUPPORTED],
-[AC_REQUIRE([PKG_PROG_PKG_CONFIG])
-if $PKG_CONFIG --atleast-pkgconfig-version 0.20; then
-        _pkg_short_errors_supported=yes
-else
-        _pkg_short_errors_supported=no
-fi[]dnl
-])dnl _PKG_SHORT_ERRORS_SUPPORTED
-
-
-dnl PKG_CHECK_MODULES(VARIABLE-PREFIX, MODULES, [ACTION-IF-FOUND],
-dnl   [ACTION-IF-NOT-FOUND])
-dnl --------------------------------------------------------------
-dnl Since: 0.4.0
-dnl
-dnl Note that if there is a possibility the first call to
-dnl PKG_CHECK_MODULES might not happen, you should be sure to include an
-dnl explicit call to PKG_PROG_PKG_CONFIG in your configure.ac
-AC_DEFUN([PKG_CHECK_MODULES],
-[AC_REQUIRE([PKG_PROG_PKG_CONFIG])dnl
-AC_ARG_VAR([$1][_CFLAGS], [C compiler flags for $1, overriding pkg-config])dnl
-AC_ARG_VAR([$1][_LIBS], [linker flags for $1, overriding pkg-config])dnl
-
-pkg_failed=no
-AC_MSG_CHECKING([for $1])
-
-_PKG_CONFIG([$1][_CFLAGS], [cflags], [$2])
-_PKG_CONFIG([$1][_LIBS], [libs], [$2])
-
-m4_define([_PKG_TEXT], [Alternatively, you may set the environment variables $1[]_CFLAGS
-and $1[]_LIBS to avoid the need to call pkg-config.
-See the pkg-config man page for more details.])
-
-if test $pkg_failed = yes; then
-   	AC_MSG_RESULT([no])
-        _PKG_SHORT_ERRORS_SUPPORTED
-        if test $_pkg_short_errors_supported = yes; then
-	        $1[]_PKG_ERRORS=`$PKG_CONFIG --short-errors --print-errors --cflags --libs "$2" 2>&1`
-        else 
-	        $1[]_PKG_ERRORS=`$PKG_CONFIG --print-errors --cflags --libs "$2" 2>&1`
-        fi
-	# Put the nasty error message in config.log where it belongs
-	echo "$$1[]_PKG_ERRORS" >&AS_MESSAGE_LOG_FD
-
-	m4_default([$4], [AC_MSG_ERROR(
-[Package requirements ($2) were not met:
-
-$$1_PKG_ERRORS
-
-Consider adjusting the PKG_CONFIG_PATH environment variable if you
-installed software in a non-standard prefix.
-
-_PKG_TEXT])[]dnl
-        ])
-elif test $pkg_failed = untried; then
-     	AC_MSG_RESULT([no])
-	m4_default([$4], [AC_MSG_FAILURE(
-[The pkg-config script could not be found or is too old.  Make sure it
-is in your PATH or set the PKG_CONFIG environment variable to the full
-path to pkg-config.
-
-_PKG_TEXT
-
-To get pkg-config, see <http://pkg-config.freedesktop.org/>.])[]dnl
-        ])
-else
-	$1[]_CFLAGS=$pkg_cv_[]$1[]_CFLAGS
-	$1[]_LIBS=$pkg_cv_[]$1[]_LIBS
-        AC_MSG_RESULT([yes])
-	$3
-fi[]dnl
-])dnl PKG_CHECK_MODULES
-
-
-dnl PKG_CHECK_MODULES_STATIC(VARIABLE-PREFIX, MODULES, [ACTION-IF-FOUND],
-dnl   [ACTION-IF-NOT-FOUND])
-dnl ---------------------------------------------------------------------
-dnl Since: 0.29
-dnl
-dnl Checks for existence of MODULES and gathers its build flags with
-dnl static libraries enabled. Sets VARIABLE-PREFIX_CFLAGS from --cflags
-dnl and VARIABLE-PREFIX_LIBS from --libs.
-dnl
-dnl Note that if there is a possibility the first call to
-dnl PKG_CHECK_MODULES_STATIC might not happen, you should be sure to
-dnl include an explicit call to PKG_PROG_PKG_CONFIG in your
-dnl configure.ac.
-AC_DEFUN([PKG_CHECK_MODULES_STATIC],
-[AC_REQUIRE([PKG_PROG_PKG_CONFIG])dnl
-_save_PKG_CONFIG=$PKG_CONFIG
-PKG_CONFIG="$PKG_CONFIG --static"
-PKG_CHECK_MODULES($@)
-PKG_CONFIG=$_save_PKG_CONFIG[]dnl
-])dnl PKG_CHECK_MODULES_STATIC
-
-
-dnl PKG_INSTALLDIR([DIRECTORY])
-dnl -------------------------
-dnl Since: 0.27
-dnl
-dnl Substitutes the variable pkgconfigdir as the location where a module
-dnl should install pkg-config .pc files. By default the directory is
-dnl $libdir/pkgconfig, but the default can be changed by passing
-dnl DIRECTORY. The user can override through the --with-pkgconfigdir
-dnl parameter.
-AC_DEFUN([PKG_INSTALLDIR],
-[m4_pushdef([pkg_default], [m4_default([$1], ['${libdir}/pkgconfig'])])
-m4_pushdef([pkg_description],
-    [pkg-config installation directory @<:@]pkg_default[@:>@])
-AC_ARG_WITH([pkgconfigdir],
-    [AS_HELP_STRING([--with-pkgconfigdir], pkg_description)],,
-    [with_pkgconfigdir=]pkg_default)
-AC_SUBST([pkgconfigdir], [$with_pkgconfigdir])
-m4_popdef([pkg_default])
-m4_popdef([pkg_description])
-])dnl PKG_INSTALLDIR
-
-
-dnl PKG_NOARCH_INSTALLDIR([DIRECTORY])
-dnl --------------------------------
-dnl Since: 0.27
-dnl
-dnl Substitutes the variable noarch_pkgconfigdir as the location where a
-dnl module should install arch-independent pkg-config .pc files. By
-dnl default the directory is $datadir/pkgconfig, but the default can be
-dnl changed by passing DIRECTORY. The user can override through the
-dnl --with-noarch-pkgconfigdir parameter.
-AC_DEFUN([PKG_NOARCH_INSTALLDIR],
-[m4_pushdef([pkg_default], [m4_default([$1], ['${datadir}/pkgconfig'])])
-m4_pushdef([pkg_description],
-    [pkg-config arch-independent installation directory @<:@]pkg_default[@:>@])
-AC_ARG_WITH([noarch-pkgconfigdir],
-    [AS_HELP_STRING([--with-noarch-pkgconfigdir], pkg_description)],,
-    [with_noarch_pkgconfigdir=]pkg_default)
-AC_SUBST([noarch_pkgconfigdir], [$with_noarch_pkgconfigdir])
-m4_popdef([pkg_default])
-m4_popdef([pkg_description])
-])dnl PKG_NOARCH_INSTALLDIR
-
-
-dnl PKG_CHECK_VAR(VARIABLE, MODULE, CONFIG-VARIABLE,
-dnl [ACTION-IF-FOUND], [ACTION-IF-NOT-FOUND])
-dnl -------------------------------------------
-dnl Since: 0.28
-dnl
-dnl Retrieves the value of the pkg-config variable for the given module.
-AC_DEFUN([PKG_CHECK_VAR],
-[AC_REQUIRE([PKG_PROG_PKG_CONFIG])dnl
-AC_ARG_VAR([$1], [value of $3 for $2, overriding pkg-config])dnl
-
-_PKG_CONFIG([$1], [variable="][$3]["], [$2])
-AS_VAR_COPY([$1], [pkg_cv_][$1])
-
-AS_VAR_IF([$1], [""], [$5], [$4])dnl
-])dnl PKG_CHECK_VAR
-
-m4_include([m4/ax_check_openssl.m4])
-m4_include([m4/libtool.m4])
-m4_include([m4/ltoptions.m4])
-m4_include([m4/ltsugar.m4])
-m4_include([m4/ltversion.m4])
-m4_include([m4/lt~obsolete.m4])
+Help can also often be found on the BIND Users mailing list
+(https://lists.isc.org/mailman/listinfo/bind-users) or in the #bind
+channel of the Freenode IRC service.]])

bin/check/Makefile.in

@@ -16,15 +16,15 @@ VERSION=@BIND9_VERSION@
 @BIND9_MAKE_INCLUDES@
 
 CINCLUDES =	${NS_INCLUDES} ${BIND9_INCLUDES} ${DNS_INCLUDES} ${ISCCFG_INCLUDES} \
-		${ISC_INCLUDES} @OPENSSL_INCLUDES@
+		${ISC_INCLUDES} @DST_OPENSSL_INC@
 
-CDEFINES = 	-DNAMED_CONFFILE=\"${sysconfdir}/named.conf\"
+CDEFINES = 	@CRYPTO@ -DNAMED_CONFFILE=\"${sysconfdir}/named.conf\"
 CWARNINGS =
 
 DNSLIBS =	../../lib/dns/libdns.@A@ @DNS_CRYPTO_LIBS@
 ISCCFGLIBS =	../../lib/isccfg/libisccfg.@A@
-ISCLIBS =	../../lib/isc/libisc.@A@ @OPENSSL_LIBS@
-ISCNOSYMLIBS =	../../lib/isc/libisc-nosymtbl.@A@ @OPENSSL_LIBS@
+ISCLIBS =	../../lib/isc/libisc.@A@ @ISC_OPENSSL_LIBS@
+ISCNOSYMLIBS =	../../lib/isc/libisc-nosymtbl.@A@ @ISC_OPENSSL_LIBS@
 BIND9LIBS =	../../lib/bind9/libbind9.@A@
 NSLIBS =	../../lib/ns/libns.@A@
 

bin/check/check-tool.c

@@ -98,17 +98,18 @@ isc_boolean_t docheckmx = ISC_FALSE;
 isc_boolean_t dochecksrv = ISC_FALSE;
 isc_boolean_t docheckns = ISC_FALSE;
 #endif
-dns_zoneopt_t zone_options = DNS_ZONEOPT_CHECKNS |
-			     DNS_ZONEOPT_CHECKMX |
-			     DNS_ZONEOPT_MANYERRORS |
-			     DNS_ZONEOPT_CHECKNAMES |
-			     DNS_ZONEOPT_CHECKINTEGRITY |
+unsigned int zone_options = DNS_ZONEOPT_CHECKNS |
+			    DNS_ZONEOPT_CHECKMX |
+			    DNS_ZONEOPT_MANYERRORS |
+			    DNS_ZONEOPT_CHECKNAMES |
+			    DNS_ZONEOPT_CHECKINTEGRITY |
 #if CHECK_SIBLING
-			     DNS_ZONEOPT_CHECKSIBLING |
+			    DNS_ZONEOPT_CHECKSIBLING |
 #endif
-			     DNS_ZONEOPT_CHECKWILDCARD |
-			     DNS_ZONEOPT_WARNMXCNAME |
-			     DNS_ZONEOPT_WARNSRVCNAME;
+			    DNS_ZONEOPT_CHECKWILDCARD |
+			    DNS_ZONEOPT_WARNMXCNAME |
+			    DNS_ZONEOPT_WARNSRVCNAME;
+unsigned int zone_options2 = 0;
 
 /*
  * This needs to match the list in bin/named/log.c.
@@ -687,8 +688,7 @@ load_zone(isc_mem_t *mctx, const char *zonename, const char *filename,
 	CHECK(dns_name_fromtext(origin, &buffer, dns_rootname, 0, NULL));
 	CHECK(dns_zone_setorigin(zone, origin));
 	CHECK(dns_zone_setdbtype(zone, 1, (const char * const *) dbtype));
-	CHECK(dns_zone_setfile(zone, filename, fileformat,
-			       &dns_master_style_default));
+	CHECK(dns_zone_setfile2(zone, filename, fileformat));
 	if (journal != NULL)
 		CHECK(dns_zone_setjournal(zone, journal));
 
@@ -698,6 +698,7 @@ load_zone(isc_mem_t *mctx, const char *zonename, const char *filename,
 
 	dns_zone_setclass(zone, rdclass);
 	dns_zone_setoption(zone, zone_options, ISC_TRUE);
+	dns_zone_setoption2(zone, zone_options2, ISC_TRUE);
 	dns_zone_setoption(zone, DNS_ZONEOPT_NOMERGE, nomerge);
 
 	dns_zone_setmaxttl(zone, maxttl);
@@ -760,8 +761,8 @@ dump_zone(const char *zonename, dns_zone_t *zone, const char *filename,
 		}
 	}
 
-	result = dns_zone_dumptostream(zone, output, fileformat, style,
-				       rawversion);
+	result = dns_zone_dumptostream3(zone, output, fileformat, style,
+					rawversion);
 	if (output != stdout)
 		(void)isc_stdio_close(output);
 

bin/check/check-tool.h

@@ -21,7 +21,6 @@
 
 #include <dns/masterdump.h>
 #include <dns/types.h>
-#include <dns/zone.h>
 
 ISC_LANG_BEGINDECLS
 
@@ -49,7 +48,8 @@ extern isc_boolean_t nomerge;
 extern isc_boolean_t docheckmx;
 extern isc_boolean_t docheckns;
 extern isc_boolean_t dochecksrv;
-extern dns_zoneopt_t zone_options;
+extern unsigned int zone_options;
+extern unsigned int zone_options2;
 
 ISC_LANG_ENDDECLS
 

bin/check/named-checkconf.c

@@ -20,6 +20,7 @@
 
 #include <isc/commandline.h>
 #include <isc/dir.h>
+#include <isc/entropy.h>
 #include <isc/hash.h>
 #include <isc/log.h>
 #include <isc/mem.h>
@@ -127,13 +128,8 @@ get_checknames(const cfg_obj_t **maps, const cfg_obj_t **obj) {
 		     element = cfg_list_next(element)) {
 			value = cfg_listelt_value(element);
 			type = cfg_tuple_get(value, "type");
-			if ((strcasecmp(cfg_obj_asstring(type),
-					"primary") != 0) &&
-			    (strcasecmp(cfg_obj_asstring(type),
-					"master") != 0))
-			{
+			if (strcasecmp(cfg_obj_asstring(type), "master") != 0)
 				continue;
-			}
 			*obj = cfg_tuple_get(value, "mode");
 			return (ISC_TRUE);
 		}
@@ -249,14 +245,11 @@ configure_zone(const char *vclass, const char *view,
 	 * Skip loading checks for any type other than
 	 * master and redirect
 	 */
-	if (strcasecmp(cfg_obj_asstring(typeobj), "hint") == 0) {
+	if (strcasecmp(cfg_obj_asstring(typeobj), "hint") == 0)
 		return (configure_hint(zfile, zclass, mctx));
-	} else if ((strcasecmp(cfg_obj_asstring(typeobj), "primary") != 0) &&
-		   (strcasecmp(cfg_obj_asstring(typeobj), "master") != 0) &&
-		   (strcasecmp(cfg_obj_asstring(typeobj), "redirect") != 0))
-	{
+	else if ((strcasecmp(cfg_obj_asstring(typeobj), "master") != 0) &&
+		  (strcasecmp(cfg_obj_asstring(typeobj), "redirect") != 0))
 		return (ISC_R_SUCCESS);
-	}
 
 	/*
 	 * Is the redirect zone configured as a slave?
@@ -406,7 +399,7 @@ configure_zone(const char *vclass, const char *view,
 	obj = NULL;
 	if (get_maps(maps, "max-zone-ttl", &obj)) {
 		maxttl = cfg_obj_asuint32(obj);
-		zone_options |= DNS_ZONEOPT_CHECKTTL;
+		zone_options2 |= DNS_ZONEOPT2_CHECKTTL;
 	}
 
 	result = load_zone(mctx, zname, zfile, masterformat,
@@ -537,6 +530,7 @@ main(int argc, char **argv) {
 	isc_mem_t *mctx = NULL;
 	isc_result_t result;
 	int exit_status = 0;
+	isc_entropy_t *ectx = NULL;
 	isc_boolean_t load_zones = ISC_FALSE;
 	isc_boolean_t list_zones = ISC_FALSE;
 	isc_boolean_t print = ISC_FALSE;
@@ -652,6 +646,10 @@ main(int argc, char **argv) {
 
 	RUNTIME_CHECK(setup_logging(mctx, stdout, &logc) == ISC_R_SUCCESS);
 
+	RUNTIME_CHECK(isc_entropy_create(mctx, &ectx) == ISC_R_SUCCESS);
+	RUNTIME_CHECK(isc_hash_create(mctx, ectx, DNS_NAME_MAXWIRE)
+		      == ISC_R_SUCCESS);
+
 	dns_result_register();
 
 	RUNTIME_CHECK(cfg_parser_create(mctx, logc, &parser) == ISC_R_SUCCESS);
@@ -682,6 +680,9 @@ main(int argc, char **argv) {
 
 	isc_log_destroy(&logc);
 
+	isc_hash_destroy();
+	isc_entropy_detach(&ectx);
+
 	isc_mem_destroy(&mctx);
 
 #ifdef _WIN32

bin/check/named-checkzone.c

@@ -19,6 +19,7 @@
 #include <isc/app.h>
 #include <isc/commandline.h>
 #include <isc/dir.h>
+#include <isc/entropy.h>
 #include <isc/hash.h>
 #include <isc/log.h>
 #include <isc/mem.h>
@@ -45,6 +46,7 @@
 
 static int quiet = 0;
 static isc_mem_t *mctx = NULL;
+static isc_entropy_t *ectx = NULL;
 dns_zone_t *zone = NULL;
 dns_zonetype_t zonetype = dns_zone_master;
 static int dumpzone = 0;
@@ -257,7 +259,7 @@ main(int argc, char **argv) {
 			break;
 
 		case 'l':
-			zone_options |= DNS_ZONEOPT_CHECKTTL;
+			zone_options2 |= DNS_ZONEOPT2_CHECKTTL;
 			endp = NULL;
 			maxttl = strtol(isc_commandline_argument, &endp, 0);
 			if (*endp != '\0') {
@@ -519,6 +521,9 @@ main(int argc, char **argv) {
 	if (!quiet)
 		RUNTIME_CHECK(setup_logging(mctx, errout, &lctx)
 			      == ISC_R_SUCCESS);
+	RUNTIME_CHECK(isc_entropy_create(mctx, &ectx) == ISC_R_SUCCESS);
+	RUNTIME_CHECK(isc_hash_create(mctx, ectx, DNS_NAME_MAXWIRE)
+		      == ISC_R_SUCCESS);
 
 	dns_result_register();
 
@@ -550,6 +555,8 @@ main(int argc, char **argv) {
 	destroy();
 	if (lctx != NULL)
 		isc_log_destroy(&lctx);
+	isc_hash_destroy();
+	isc_entropy_detach(&ectx);
 	isc_mem_destroy(&mctx);
 #ifdef _WIN32
 	DestroySockets();

bin/check/win32/checkconf.vcxproj.in

@@ -55,7 +55,7 @@
       </PrecompiledHeader>
       <WarningLevel>Level3</WarningLevel>
       <Optimization>Disabled</Optimization>
-      <PreprocessorDefinitions>WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <PreprocessorDefinitions>WIN32;@CRYPTO@_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
       <FunctionLevelLinking>true</FunctionLevelLinking>
       <PrecompiledHeaderOutputFile>.\$(Configuration)\$(ProjectName).pch</PrecompiledHeaderOutputFile>
       <AssemblerListingLocation>.\$(Configuration)\</AssemblerListingLocation>
@@ -81,7 +81,7 @@
       <Optimization>MaxSpeed</Optimization>
       <FunctionLevelLinking>true</FunctionLevelLinking>
       <IntrinsicFunctions>@INTRINSIC@</IntrinsicFunctions>
-      <PreprocessorDefinitions>WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <PreprocessorDefinitions>WIN32;@CRYPTO@NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
       <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
       <WholeProgramOptimization>false</WholeProgramOptimization>
       <StringPooling>true</StringPooling>

bin/check/win32/checktool.vcxproj.in

@@ -58,7 +58,7 @@
       </PrecompiledHeader>
       <WarningLevel>Level3</WarningLevel>
       <Optimization>Disabled</Optimization>
-      <PreprocessorDefinitions>WIN32;_DEBUG;_LIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <PreprocessorDefinitions>WIN32;@CRYPTO@_DEBUG;_LIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
       <FunctionLevelLinking>true</FunctionLevelLinking>
       <PrecompiledHeaderOutputFile>.\$(Configuration)\$(TargetName).pch</PrecompiledHeaderOutputFile>
       <AssemblerListingLocation>.\$(Configuration)\</AssemblerListingLocation>
@@ -80,7 +80,7 @@
       <Optimization>MaxSpeed</Optimization>
       <FunctionLevelLinking>true</FunctionLevelLinking>
       <IntrinsicFunctions>@INTRINSIC@</IntrinsicFunctions>
-      <PreprocessorDefinitions>WIN32;NDEBUG;_LIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <PreprocessorDefinitions>WIN32;@CRYPTO@NDEBUG;_LIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
       <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
       <WholeProgramOptimization>false</WholeProgramOptimization>
       <StringPooling>true</StringPooling>

bin/check/win32/checkzone.vcxproj.in

@@ -55,7 +55,7 @@
       </PrecompiledHeader>
       <WarningLevel>Level3</WarningLevel>
       <Optimization>Disabled</Optimization>
-      <PreprocessorDefinitions>WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <PreprocessorDefinitions>WIN32;@CRYPTO@_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
       <FunctionLevelLinking>true</FunctionLevelLinking>
       <PrecompiledHeaderOutputFile>.\$(Configuration)\$(ProjectName).pch</PrecompiledHeaderOutputFile>
       <AssemblerListingLocation>.\$(Configuration)\</AssemblerListingLocation>
@@ -87,7 +87,7 @@ copy /Y named-checkzone.ilk named-compilezone.ilk
       <Optimization>MaxSpeed</Optimization>
       <FunctionLevelLinking>true</FunctionLevelLinking>
       <IntrinsicFunctions>@INTRINSIC@</IntrinsicFunctions>
-      <PreprocessorDefinitions>WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <PreprocessorDefinitions>WIN32;@CRYPTO@NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
       <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
       <WholeProgramOptimization>false</WholeProgramOptimization>
       <StringPooling>true</StringPooling>

bin/confgen/Makefile.in

@@ -27,8 +27,8 @@ CWARNINGS =
 
 ISCCFGLIBS =	../../lib/isccfg/libisccfg.@A@
 ISCCCLIBS =	../../lib/isccc/libisccc.@A@
-ISCLIBS =	../../lib/isc/libisc.@A@ @OPENSSL_LIBS@
-ISCNOSYMLIBS =	../../lib/isc/libisc-nosymtbl.@A@ @OPENSSL_LIBS@
+ISCLIBS =	../../lib/isc/libisc.@A@ @ISC_OPENSSL_LIBS@
+ISCNOSYMLIBS =	../../lib/isc/libisc-nosymtbl.@A@ @ISC_OPENSSL_LIBS@
 DNSLIBS =	../../lib/dns/libdns.@A@ @DNS_CRYPTO_LIBS@
 BIND9LIBS =	../../lib/bind9/libbind9.@A@
 

bin/confgen/ddns-confgen.8

@@ -39,7 +39,7 @@
 ddns-confgen \- ddns key generation tool
 .SH "SYNOPSIS"
 .HP \w'\fBtsig\-keygen\fR\ 'u
-\fBtsig\-keygen\fR [\fB\-a\ \fR\fB\fIalgorithm\fR\fR] [\fB\-h\fR] [name]
+\fBtsig\-keygen\fR [\fB\-a\ \fR\fB\fIalgorithm\fR\fR] [\fB\-h\fR] [\fB\-r\ \fR\fB\fIrandomfile\fR\fR] [name]
 .HP \w'\fBddns\-confgen\fR\ 'u
 \fBddns\-confgen\fR [\fB\-a\ \fR\fB\fIalgorithm\fR\fR] [\fB\-h\fR] [\fB\-k\ \fR\fB\fIkeyname\fR\fR] [\fB\-q\fR] [\fB\-r\ \fR\fB\fIrandomfile\fR\fR] [\-s\ \fIname\fR | \-z\ \fIzone\fR]
 .SH "DESCRIPTION"
@@ -109,6 +109,17 @@ only\&.) Quiet mode: Print only the key, with no explanatory text or usage examp
 \fBtsig\-keygen\fR\&.
 .RE
 .PP
+\-r \fIrandomfile\fR
+.RS 4
+Specifies a source of random data for generating the authorization\&. If the operating system does not provide a
+/dev/random
+or equivalent device, the default source of randomness is keyboard input\&.
+randomdev
+specifies the name of a character device or file containing random data to be used instead of the default\&. The special value
+keyboard
+indicates that keyboard input should be used\&.
+.RE
+.PP
 \-s \fIname\fR
 .RS 4
 (\fBddns\-confgen\fR

bin/confgen/ddns-confgen.c

@@ -26,6 +26,7 @@
 #include <isc/base64.h>
 #include <isc/buffer.h>
 #include <isc/commandline.h>
+#include <isc/entropy.h>
 #include <isc/file.h>
 #include <isc/keyboard.h>
 #include <isc/mem.h>
@@ -36,7 +37,7 @@
 #include <isc/time.h>
 #include <isc/util.h>
 
-#if USE_PKCS11
+#ifdef PKCS11CRYPTO
 #include <pk11/result.h>
 #endif
 
@@ -66,9 +67,10 @@ usage(int status) {
 	if (progmode == progmode_confgen) {
 		fprintf(stderr, "\
 Usage:\n\
- %s [-a alg] [-k keyname] [-q] [-s name | -z zone]\n\
+ %s [-a alg] [-k keyname] [-r randomfile] [-q] [-s name | -z zone]\n\
   -a alg:        algorithm (default hmac-sha256)\n\
   -k keyname:    name of the key as it will be used in named.conf\n\
+  -r randomfile: source of random data (use \"keyboard\" for key timing)\n\
   -s name:       domain name to be updated using the created key\n\
   -z zone:       name of the zone as it will be used in named.conf\n\
   -q:            quiet mode: print the key, with no explanatory text\n",
@@ -76,8 +78,9 @@ Usage:\n\
 	} else {
 		fprintf(stderr, "\
 Usage:\n\
- %s [-a alg] [keyname]\n\
-  -a alg:        algorithm (default hmac-sha256)\n\n",
+ %s [-a alg] [-r randomfile] [keyname]\n\
+  -a alg:        algorithm (default hmac-sha256)\n\
+  -r randomfile: source of random data (use \"keyboard\" for key timing)\n",
 			 progname);
 	}
 
@@ -92,6 +95,7 @@ main(int argc, char **argv) {
 	isc_buffer_t key_txtbuffer;
 	char key_txtsecret[256];
 	isc_mem_t *mctx = NULL;
+	const char *randomfile = NULL;
 	const char *keyname = NULL;
 	const char *zone = NULL;
 	const char *self_domain = NULL;
@@ -102,7 +106,7 @@ main(int argc, char **argv) {
 	int len = 0;
 	int ch;
 
-#if USE_PKCS11
+#ifdef PKCS11CRYPTO
 	pk11_result_register();
 #endif
 	dns_result_register();
@@ -164,7 +168,7 @@ main(int argc, char **argv) {
 				usage(1);
 			break;
 		case 'r':
-			fatal("The -r option has been deprecated.");
+			randomfile = isc_commandline_argument;
 			break;
 		case 's':
 			if (progmode == progmode_confgen)
@@ -231,7 +235,7 @@ main(int argc, char **argv) {
 
 	isc_buffer_init(&key_txtbuffer, &key_txtsecret, sizeof(key_txtsecret));
 
-	generate_key(mctx, alg, keysize, &key_txtbuffer);
+	generate_key(mctx, randomfile, alg, keysize, &key_txtbuffer);
 
 
 	if (!quiet)

bin/confgen/ddns-confgen.docbook

@@ -46,6 +46,7 @@
       <command>tsig-keygen</command>
       <arg choice="opt" rep="norepeat"><option>-a <replaceable class="parameter">algorithm</replaceable></option></arg>
       <arg choice="opt" rep="norepeat"><option>-h</option></arg>
+      <arg choice="opt" rep="norepeat"><option>-r <replaceable class="parameter">randomfile</replaceable></option></arg>
       <arg choice="opt" rep="norepeat">name</arg>
     </cmdsynopsis>
     <cmdsynopsis sepchar=" ">
@@ -156,6 +157,23 @@
 	</listitem>
       </varlistentry>
 
+      <varlistentry>
+	<term>-r <replaceable class="parameter">randomfile</replaceable></term>
+	<listitem>
+	  <para>
+            Specifies a source of random data for generating the
+            authorization.  If the operating system does not provide a
+            <filename>/dev/random</filename> or equivalent device, the
+            default source of randomness is keyboard input.
+            <filename>randomdev</filename> specifies the name of a
+            character device or file containing random data to be used
+            instead of the default.  The special value
+            <filename>keyboard</filename> indicates that keyboard input
+            should be used.
+	  </para>
+	</listitem>
+      </varlistentry>
+
       <varlistentry>
 	<term>-s <replaceable class="parameter">name</replaceable></term>
 	<listitem>

bin/confgen/ddns-confgen.html

@@ -35,6 +35,7 @@
       <code class="command">tsig-keygen</code> 
        [<code class="option">-a <em class="replaceable"><code>algorithm</code></em></code>]
        [<code class="option">-h</code>]
+       [<code class="option">-r <em class="replaceable"><code>randomfile</code></em></code>]
        [name]
     </p></div>
     <div class="cmdsynopsis"><p>
@@ -135,6 +136,20 @@
             This is essentially identical to <span class="command"><strong>tsig-keygen</strong></span>.
 	  </p>
 	</dd>
+<dt><span class="term">-r <em class="replaceable"><code>randomfile</code></em></span></dt>
+<dd>
+	  <p>
+            Specifies a source of random data for generating the
+            authorization.  If the operating system does not provide a
+            <code class="filename">/dev/random</code> or equivalent device, the
+            default source of randomness is keyboard input.
+            <code class="filename">randomdev</code> specifies the name of a
+            character device or file containing random data to be used
+            instead of the default.  The special value
+            <code class="filename">keyboard</code> indicates that keyboard input
+            should be used.
+	  </p>
+	</dd>
 <dt><span class="term">-s <em class="replaceable"><code>name</code></em></span></dt>
 <dd>
 	  <p>

bin/confgen/keygen.c

@@ -19,6 +19,7 @@
 
 #include <isc/base64.h>
 #include <isc/buffer.h>
+#include <isc/entropy.h>
 #include <isc/file.h>
 #include <isc/keyboard.h>
 #include <isc/mem.h>
@@ -43,8 +44,10 @@
 const char *
 alg_totext(dns_secalg_t alg) {
 	switch (alg) {
+#ifndef PK11_MD5_DISABLE
 	    case DST_ALG_HMACMD5:
 		return "hmac-md5";
+#endif
 	    case DST_ALG_HMACSHA1:
 		return "hmac-sha1";
 	    case DST_ALG_HMACSHA224:
@@ -69,8 +72,10 @@ alg_fromtext(const char *name) {
 	if (strncasecmp(p, "hmac-", 5) == 0)
 		p = &name[5];
 
+#ifndef PK11_MD5_DISABLE
 	if (strcasecmp(p, "md5") == 0)
 		return DST_ALG_HMACMD5;
+#endif
 	if (strcasecmp(p, "sha1") == 0)
 		return DST_ALG_HMACSHA1;
 	if (strcasecmp(p, "sha224") == 0)
@@ -108,19 +113,26 @@ alg_bits(dns_secalg_t alg) {
 }
 
 /*%
- * Generate a key of size 'keysize' and place it in 'key_txtbuffer'
+ * Generate a key of size 'keysize' using entropy source 'randomfile',
+ * and place it in 'key_txtbuffer'
  */
 void
-generate_key(isc_mem_t *mctx, dns_secalg_t alg, int keysize,
-	     isc_buffer_t *key_txtbuffer) {
+generate_key(isc_mem_t *mctx, const char *randomfile, dns_secalg_t alg,
+	     int keysize, isc_buffer_t *key_txtbuffer) {
 	isc_result_t result = ISC_R_SUCCESS;
+	isc_entropysource_t *entropy_source = NULL;
+	int open_keyboard = ISC_ENTROPY_KEYBOARDMAYBE;
+	int entropy_flags = 0;
+	isc_entropy_t *ectx = NULL;
 	isc_buffer_t key_rawbuffer;
 	isc_region_t key_rawregion;
 	char key_rawsecret[64];
 	dst_key_t *key = NULL;
 
 	switch (alg) {
+#ifndef PK11_MD5_DISABLE
 	    case DST_ALG_HMACMD5:
+#endif
 	    case DST_ALG_HMACSHA1:
 	    case DST_ALG_HMACSHA224:
 	    case DST_ALG_HMACSHA256:
@@ -138,12 +150,31 @@ generate_key(isc_mem_t *mctx, dns_secalg_t alg, int keysize,
 		fatal("unsupported algorithm %d\n", alg);
 	}
 
-	DO("initialize dst library", dst_lib_init(mctx, NULL));
+
+	DO("create entropy context", isc_entropy_create(mctx, &ectx));
+
+#ifdef ISC_PLATFORM_CRYPTORANDOM
+	if (randomfile == NULL) {
+		isc_entropy_usehook(ectx, ISC_TRUE);
+	}
+#endif
+	if (randomfile != NULL && strcmp(randomfile, "keyboard") == 0) {
+		randomfile = NULL;
+		open_keyboard = ISC_ENTROPY_KEYBOARDYES;
+	}
+	DO("start entropy source", isc_entropy_usebestsource(ectx,
+							     &entropy_source,
+							     randomfile,
+							     open_keyboard));
+
+	entropy_flags = ISC_ENTROPY_BLOCKING | ISC_ENTROPY_GOODONLY;
+
+	DO("initialize dst library", dst_lib_init(mctx, ectx, entropy_flags));
 
 	DO("generate key", dst_key_generate(dns_rootname, alg,
-					    keysize, 0, 0, DNS_KEYPROTO_ANY,
-					    dns_rdataclass_in, mctx, &key,
-					    NULL));
+					    keysize, 0, 0,
+					    DNS_KEYPROTO_ANY,
+					    dns_rdataclass_in, mctx, &key));
 
 	isc_buffer_init(&key_rawbuffer, &key_rawsecret, sizeof(key_rawsecret));
 
@@ -154,9 +185,17 @@ generate_key(isc_mem_t *mctx, dns_secalg_t alg, int keysize,
 	DO("bsse64 encode secret", isc_base64_totext(&key_rawregion, -1, "",
 						     key_txtbuffer));
 
+	/*
+	 * Shut down the entropy source now so the "stop typing" message
+	 * does not muck with the output.
+	 */
+	if (entropy_source != NULL)
+		isc_entropy_destroysource(&entropy_source);
+
 	if (key != NULL)
 		dst_key_free(&key);
 
+	isc_entropy_detach(&ectx);
 	dst_lib_destroy();
 }
 

bin/confgen/keygen.h

@@ -19,8 +19,8 @@
 
 ISC_LANG_BEGINDECLS
 
-void generate_key(isc_mem_t *mctx, dns_secalg_t alg, int keysize,
-		  isc_buffer_t *key_txtbuffer);
+void generate_key(isc_mem_t *mctx, const char *randomfile, dns_secalg_t alg,
+		  int keysize, isc_buffer_t *key_txtbuffer);
 
 void write_key_file(const char *keyfile, const char *user,
 		    const char *keyname, isc_buffer_t *secret,

bin/confgen/rndc-confgen.8

@@ -39,7 +39,7 @@
 rndc-confgen \- rndc key generation tool
 .SH "SYNOPSIS"
 .HP \w'\fBrndc\-confgen\fR\ 'u
-\fBrndc\-confgen\fR [\fB\-a\fR] [\fB\-A\ \fR\fB\fIalgorithm\fR\fR] [\fB\-b\ \fR\fB\fIkeysize\fR\fR] [\fB\-c\ \fR\fB\fIkeyfile\fR\fR] [\fB\-h\fR] [\fB\-k\ \fR\fB\fIkeyname\fR\fR] [\fB\-p\ \fR\fB\fIport\fR\fR] [\fB\-s\ \fR\fB\fIaddress\fR\fR] [\fB\-t\ \fR\fB\fIchrootdir\fR\fR] [\fB\-u\ \fR\fB\fIuser\fR\fR]
+\fBrndc\-confgen\fR [\fB\-a\fR] [\fB\-A\ \fR\fB\fIalgorithm\fR\fR] [\fB\-b\ \fR\fB\fIkeysize\fR\fR] [\fB\-c\ \fR\fB\fIkeyfile\fR\fR] [\fB\-h\fR] [\fB\-k\ \fR\fB\fIkeyname\fR\fR] [\fB\-p\ \fR\fB\fIport\fR\fR] [\fB\-r\ \fR\fB\fIrandomfile\fR\fR] [\fB\-s\ \fR\fB\fIaddress\fR\fR] [\fB\-t\ \fR\fB\fIchrootdir\fR\fR] [\fB\-u\ \fR\fB\fIuser\fR\fR]
 .SH "DESCRIPTION"
 .PP
 \fBrndc\-confgen\fR
@@ -147,6 +147,17 @@ listens for connections from
 \fBrndc\fR\&. The default is 953\&.
 .RE
 .PP
+\-r \fIrandomfile\fR
+.RS 4
+Specifies a source of random data for generating the authorization\&. If the operating system does not provide a
+/dev/random
+or equivalent device, the default source of randomness is keyboard input\&.
+randomdev
+specifies the name of a character device or file containing random data to be used instead of the default\&. The special value
+keyboard
+indicates that keyboard input should be used\&.
+.RE
+.PP
 \-s \fIaddress\fR
 .RS 4
 Specifies the IP address where

bin/confgen/rndc-confgen.c

@@ -29,6 +29,7 @@
 #include <isc/base64.h>
 #include <isc/buffer.h>
 #include <isc/commandline.h>
+#include <isc/entropy.h>
 #include <isc/file.h>
 #include <isc/keyboard.h>
 #include <isc/mem.h>
@@ -69,7 +70,7 @@ usage(int status) {
 
 	fprintf(stderr, "\
 Usage:\n\
- %s [-a] [-b bits] [-c keyfile] [-k keyname] [-p port] \
+ %s [-a] [-b bits] [-c keyfile] [-k keyname] [-p port] [-r randomfile] \
 [-s addr] [-t chrootdir] [-u user]\n\
   -a:		 generate just the key clause and write it to keyfile (%s)\n\
   -A alg:	 algorithm (default hmac-sha256)\n\
@@ -77,6 +78,7 @@ Usage:\n\
   -c keyfile:	 specify an alternate key file (requires -a)\n\
   -k keyname:	 the name as it will be used  in named.conf and rndc.conf\n\
   -p port:	 the port named will listen on and rndc will connect to\n\
+  -r randomfile: source of random data (use \"keyboard\" for key timing)\n\
   -s addr:	 the address to which rndc should connect\n\
   -t chrootdir:	 write a keyfile in chrootdir as well (requires -a)\n\
   -u user:	 set the keyfile owner to \"user\" (requires -a)\n",
@@ -93,6 +95,7 @@ main(int argc, char **argv) {
 	isc_mem_t *mctx = NULL;
 	isc_result_t result = ISC_R_SUCCESS;
 	const char *keyname = NULL;
+	const char *randomfile = NULL;
 	const char *serveraddr = NULL;
 	dns_secalg_t alg;
 	const char *algname;
@@ -162,7 +165,7 @@ main(int argc, char **argv) {
 				      isc_commandline_argument);
 			break;
 		case 'r':
-			fatal("The -r option has been deprecated.");
+			randomfile = isc_commandline_argument;
 			break;
 		case 's':
 			serveraddr = isc_commandline_argument;
@@ -214,7 +217,7 @@ main(int argc, char **argv) {
 	DO("create memory context", isc_mem_create(0, 0, &mctx));
 	isc_buffer_init(&key_txtbuffer, &key_txtsecret, sizeof(key_txtsecret));
 
-	generate_key(mctx, alg, keysize, &key_txtbuffer);
+	generate_key(mctx, randomfile, alg, keysize, &key_txtbuffer);
 
 	if (keyonly) {
 		write_key_file(keyfile, chrootdir == NULL ? user : NULL,

bin/confgen/rndc-confgen.docbook

@@ -58,6 +58,7 @@
       <arg choice="opt" rep="norepeat"><option>-h</option></arg>
       <arg choice="opt" rep="norepeat"><option>-k <replaceable class="parameter">keyname</replaceable></option></arg>
       <arg choice="opt" rep="norepeat"><option>-p <replaceable class="parameter">port</replaceable></option></arg>
+      <arg choice="opt" rep="norepeat"><option>-r <replaceable class="parameter">randomfile</replaceable></option></arg>
       <arg choice="opt" rep="norepeat"><option>-s <replaceable class="parameter">address</replaceable></option></arg>
       <arg choice="opt" rep="norepeat"><option>-t <replaceable class="parameter">chrootdir</replaceable></option></arg>
       <arg choice="opt" rep="norepeat"><option>-u <replaceable class="parameter">user</replaceable></option></arg>
@@ -190,6 +191,24 @@
         </listitem>
       </varlistentry>
 
+      <varlistentry>
+        <term>-r <replaceable class="parameter">randomfile</replaceable></term>
+        <listitem>
+          <para>
+            Specifies a source of random data for generating the
+            authorization.  If the operating
+            system does not provide a <filename>/dev/random</filename>
+            or equivalent device, the default source of randomness
+            is keyboard input.  <filename>randomdev</filename>
+            specifies
+            the name of a character device or file containing random
+            data to be used instead of the default.  The special value
+            <filename>keyboard</filename> indicates that keyboard
+            input should be used.
+          </para>
+        </listitem>
+      </varlistentry>
+
       <varlistentry>
         <term>-s <replaceable class="parameter">address</replaceable></term>
         <listitem>

bin/confgen/rndc-confgen.html

@@ -40,6 +40,7 @@
        [<code class="option">-h</code>]
        [<code class="option">-k <em class="replaceable"><code>keyname</code></em></code>]
        [<code class="option">-p <em class="replaceable"><code>port</code></em></code>]
+       [<code class="option">-r <em class="replaceable"><code>randomfile</code></em></code>]
        [<code class="option">-s <em class="replaceable"><code>address</code></em></code>]
        [<code class="option">-t <em class="replaceable"><code>chrootdir</code></em></code>]
        [<code class="option">-u <em class="replaceable"><code>user</code></em></code>]
@@ -153,6 +154,21 @@
             The default is 953.
           </p>
         </dd>
+<dt><span class="term">-r <em class="replaceable"><code>randomfile</code></em></span></dt>
+<dd>
+          <p>
+            Specifies a source of random data for generating the
+            authorization.  If the operating
+            system does not provide a <code class="filename">/dev/random</code>
+            or equivalent device, the default source of randomness
+            is keyboard input.  <code class="filename">randomdev</code>
+            specifies
+            the name of a character device or file containing random
+            data to be used instead of the default.  The special value
+            <code class="filename">keyboard</code> indicates that keyboard
+            input should be used.
+          </p>
+        </dd>
 <dt><span class="term">-s <em class="replaceable"><code>address</code></em></span></dt>
 <dd>
           <p>

bin/delv/Makefile.in

@@ -16,16 +16,16 @@ VERSION=@BIND9_VERSION@
 @BIND9_MAKE_INCLUDES@
 
 CINCLUDES =	-I${srcdir}/include ${DNS_INCLUDES} ${ISC_INCLUDES} \
-		${IRS_INCLUDES} ${ISCCFG_INCLUDES} @OPENSSL_INCLUDES@
+		${IRS_INCLUDES} ${ISCCFG_INCLUDES} @DST_OPENSSL_INC@
 
-CDEFINES =	-DVERSION=\"${VERSION}\" \
+CDEFINES =	@CRYPTO@ -DVERSION=\"${VERSION}\" \
 		-DSYSCONFDIR=\"${sysconfdir}\"
 CWARNINGS =
 
 ISCCFGLIBS =	../../lib/isccfg/libisccfg.@A@
 DNSLIBS =	../../lib/dns/libdns.@A@ @DNS_CRYPTO_LIBS@
-ISCNOSYMLIBS =	../../lib/isc/libisc-nosymtbl.@A@ @OPENSSL_LIBS@
-ISCLIBS =	../../lib/isc/libisc.@A@ @OPENSSL_LIBS@
+ISCNOSYMLIBS =	../../lib/isc/libisc-nosymtbl.@A@ @ISC_OPENSSL_LIBS@
+ISCLIBS =	../../lib/isc/libisc.@A@ @ISC_OPENSSL_LIBS@
 IRSLIBS =	../../lib/irs/libirs.@A@
 
 ISCCFGDEPLIBS =	../../lib/isccfg/libisccfg.@A@

bin/delv/delv.c

@@ -521,17 +521,17 @@ setup_style(dns_master_style_t **stylep) {
 	}
 
 	if (multiline || (nottl && noclass))
-		result = dns_master_stylecreate(&style, styleflags,
-						24, 24, 24, 32, 80, 8,
-						splitwidth, mctx);
+		result = dns_master_stylecreate2(&style, styleflags,
+						 24, 24, 24, 32, 80, 8,
+						 splitwidth, mctx);
 	else if (nottl || noclass)
-		result = dns_master_stylecreate(&style, styleflags,
-						24, 24, 32, 40, 80, 8,
-						splitwidth, mctx);
+		result = dns_master_stylecreate2(&style, styleflags,
+						 24, 24, 32, 40, 80, 8,
+						 splitwidth, mctx);
 	else
-		result = dns_master_stylecreate(&style, styleflags,
-						24, 32, 40, 48, 80, 8,
-						splitwidth, mctx);
+		result = dns_master_stylecreate2(&style, styleflags,
+						 24, 32, 40, 48, 80, 8,
+						 splitwidth, mctx);
 
 	if (result == ISC_R_SUCCESS)
 		*stylep = style;
@@ -943,6 +943,18 @@ cleanup:
 	return (result);
 }
 
+static char *
+next_token(char **stringp, const char *delim) {
+	char *res;
+
+	do {
+		res = strsep(stringp, delim);
+		if (res == NULL)
+			break;
+	} while (*res == '\0');
+	return (res);
+}
+
 static isc_result_t
 parse_uint(isc_uint32_t *uip, const char *value, isc_uint32_t max,
 	   const char *desc) {
@@ -962,23 +974,23 @@ parse_uint(isc_uint32_t *uip, const char *value, isc_uint32_t max,
 static void
 plus_option(char *option) {
 	isc_result_t result;
-	char *cmd, *value, *last = NULL;
+	char option_store[256];
+	char *cmd, *value, *ptr;
 	isc_boolean_t state = ISC_TRUE;
 
-	INSIST(option != NULL);
-
-	cmd = strtok_r(option, "=", &last);
+	strlcpy(option_store, option, sizeof(option_store));
+	ptr = option_store;
+	cmd = next_token(&ptr,"=");
 	if (cmd == NULL) {
-		printf(";; Invalid option %s\n", option);
+		printf(";; Invalid option %s\n", option_store);
 		return;
 	}
+	value = ptr;
 	if (strncasecmp(cmd, "no", 2)==0) {
 		cmd += 2;
 		state = ISC_FALSE;
 	}
 
-	value = strtok_r(NULL, "\0", &last);
-
 #define FULLCHECK(A) \
 	do { \
 		size_t _l = strlen(cmd); \
@@ -1526,7 +1538,7 @@ get_reverse(char *reverse, size_t len, char *value, isc_boolean_t strict) {
 		unsigned int options = 0;
 
 		name = dns_fixedname_initname(&fname);
-		result = dns_byaddr_createptrname(&addr, options, name);
+		result = dns_byaddr_createptrname2(&addr, options, name);
 		if (result != ISC_R_SUCCESS)
 			return (result);
 		dns_name_format(name, reverse, (unsigned int)len);
@@ -1610,8 +1622,8 @@ main(int argc, char *argv[]) {
 
 	/* Create client */
 	clopt = DNS_CLIENTCREATEOPT_USECACHE;
-	result = dns_client_createx(mctx, actx, taskmgr, socketmgr, timermgr,
-				    clopt, &client, srcaddr4, srcaddr6);
+	result = dns_client_createx2(mctx, actx, taskmgr, socketmgr, timermgr,
+				     clopt, &client, srcaddr4, srcaddr6);
 	if (result != ISC_R_SUCCESS) {
 		delv_log(ISC_LOG_ERROR, "dns_client_create: %s",
 			  isc_result_totext(result));

bin/delv/win32/delv.vcxproj.in

@@ -53,7 +53,7 @@
       </PrecompiledHeader>
       <WarningLevel>Level3</WarningLevel>
       <Optimization>Disabled</Optimization>
-      <PreprocessorDefinitions>WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <PreprocessorDefinitions>WIN32;@CRYPTO@_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
       <FunctionLevelLinking>true</FunctionLevelLinking>
       <PrecompiledHeaderOutputFile>.\$(Configuration)\$(TargetName).pch</PrecompiledHeaderOutputFile>
       <AssemblerListingLocation>.\$(Configuration)\</AssemblerListingLocation>
@@ -79,7 +79,7 @@
       <Optimization>MaxSpeed</Optimization>
       <FunctionLevelLinking>true</FunctionLevelLinking>
       <IntrinsicFunctions>@INTRINSIC@</IntrinsicFunctions>
-      <PreprocessorDefinitions>WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <PreprocessorDefinitions>WIN32;@CRYPTO@NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
       <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
       <WholeProgramOptimization>false</WholeProgramOptimization>
       <StringPooling>true</StringPooling>

bin/dig/Makefile.in

@@ -19,16 +19,16 @@ READLINE_LIB = @READLINE_LIB@
 
 CINCLUDES =	-I${srcdir}/include ${DNS_INCLUDES} \
 		${BIND9_INCLUDES} ${ISC_INCLUDES} \
-		${IRS_INCLUDES} ${ISCCFG_INCLUDES} @LIBIDN2_CFLAGS@ @OPENSSL_INCLUDES@
+		${IRS_INCLUDES} ${ISCCFG_INCLUDES} @LIBIDN2_CFLAGS@ @DST_OPENSSL_INC@
 
-CDEFINES =	-DVERSION=\"${VERSION}\"
+CDEFINES =	-DVERSION=\"${VERSION}\" @CRYPTO@
 CWARNINGS =
 
 ISCCFGLIBS =	../../lib/isccfg/libisccfg.@A@
 DNSLIBS =	../../lib/dns/libdns.@A@ @DNS_CRYPTO_LIBS@
 BIND9LIBS =	../../lib/bind9/libbind9.@A@
-ISCLIBS =	../../lib/isc/libisc.@A@ @OPENSSL_LIBS@
-ISCNOSYMLIBS =	../../lib/isc/libisc-nosymtbl.@A@ @OPENSSL_LIBS@
+ISCLIBS =	../../lib/isc/libisc.@A@ @ISC_OPENSSL_LIBS@
+ISCNOSYMLIBS =	../../lib/isc/libisc-nosymtbl.@A@ @ISC_OPENSSL_LIBS@
 IRSLIBS =	../../lib/irs/libirs.@A@
 
 ISCCFGDEPLIBS =	../../lib/isccfg/libisccfg.@A@
@@ -41,10 +41,10 @@ DEPLIBS =	${DNSDEPLIBS} ${IRSDEPLIBS} ${BIND9DEPLIBS} \
 		${ISCDEPLIBS} ${ISCCFGDEPLIBS}
 
 LIBS =		${DNSLIBS} ${IRSLIBS} ${BIND9LIBS} ${ISCCFGLIBS} \
-		${ISCLIBS} @LIBIDN2_LIBS@ @LIBS@
+		${ISCLIBS} @IDNKIT_LIBS@ @LIBIDN2_LIBS@ @LIBS@
 
 NOSYMLIBS =	${DNSLIBS} ${IRSLIBS} ${BIND9LIBS} ${ISCCFGLIBS} \
-		${ISCNOSYMLIBS} @LIBIDN2_LIBS@ @LIBS@
+		${ISCNOSYMLIBS} @IDNKIT_LIBS@ @LIBIDN2_LIBS@ @LIBS@
 
 SUBDIRS =
 
@@ -64,8 +64,6 @@ MANOBJS =	${MANPAGES} ${HTMLPAGES}
 
 @BIND9_MAKE_RULES@
 
-LDFLAGS =	@LDFLAGS@ @LIBIDN2_LDFLAGS@
-
 dig@EXEEXT@: dig.@O@ dighost.@O@ ${UOBJS} ${DEPLIBS}
 	export BASEOBJS="dig.@O@ dighost.@O@ ${UOBJS}"; \
 	export LIBS0="${DNSLIBS} ${IRSLIBS}"; \

bin/dig/dig.1

@@ -532,7 +532,7 @@ Include an EDNS name server ID request when sending a query\&.
 .RS 4
 When this option is set,
 \fBdig\fR
-attempts to find the authoritative name servers for the zone containing the name being looked up and display the SOA record that each name server has for the zone\&. Addresses of servers that that did not respond are also printed\&.
+attempts to find the authoritative name servers for the zone containing the name being looked up and display the SOA record that each name server has for the zone\&.
 .RE
 .PP
 \fB+[no]onesoa\fR
@@ -564,11 +564,6 @@ Print [do not print] the query as it is sent\&. By default, the query is not pri
 Print [do not print] the question section of a query when an answer is returned\&. The default is to print the question section as a comment\&.
 .RE
 .PP
-\fB+[no]raflag\fR
-.RS 4
-Set [do not set] the RA (Recursion Available) bit in the query\&. The default is +noraflag\&. This bit should be ignored by the server for QUERY\&.
-.RE
-.PP
 \fB+[no]rdflag\fR
 .RS 4
 A synonym for
@@ -658,11 +653,6 @@ for short, sends an EDNS CLIENT\-SUBNET option with an empty address and a sourc
 be used when resolving this query\&.
 .RE
 .PP
-\fB+[no]tcflag\fR
-.RS 4
-Set [do not set] the TC (TrunCation) bit in the query\&. The default is +notcflag\&. This bit should be ignored by the server for QUERY\&.
-.RE
-.PP
 \fB+[no]tcp\fR
 .RS 4
 Use [do not use] TCP when querying name servers\&. The default behavior is to use UDP unless a type

bin/dig/dig.c

@@ -205,7 +205,6 @@ help(void) {
 "                 +padding=###        (Set padding block size [0])\n"
 "                 +[no]qr             (Print question before sending)\n"
 "                 +[no]question       (Control display of question section)\n"
-"                 +[no]raflag         (Set RA flag in query (+[no]raflag))\n"
 "                 +[no]rdflag         (Recursive mode (+[no]recurse))\n"
 "                 +[no]recurse        (Recursive mode (+[no]rdflag))\n"
 "                 +retry=###          (Set number of UDP retries) [2]\n"
@@ -218,7 +217,6 @@ help(void) {
 "                 +[no]split=##       (Split hex/base64 fields into chunks)\n"
 "                 +[no]stats          (Control display of statistics)\n"
 "                 +subnet=addr        (Set edns-client-subnet option)\n"
-"                 +[no]tcflag         (Set TC flag in query (+[no]tcflag))\n"
 "                 +[no]tcp            (TCP mode (+[no]vc))\n"
 "                 +timeout=###        (Set query timeout) [5]\n"
 "                 +[no]trace          (Trace delegation down from root [+dnssec])\n"
@@ -260,7 +258,7 @@ received(unsigned int bytes, isc_sockaddr_t *from, dig_query_t *query) {
 			printf(";; Query time: %ld msec\n", (long) diff / 1000);
 		printf(";; SERVER: %s(%s)\n", fromtext, query->servname);
 		time(&tnow);
-#if !defined(WIN32)
+#if defined(ISC_PLATFORM_USETHREADS) && !defined(WIN32)
 		(void)localtime_r(&tnow, &tmnow);
 #else
 		tmnow  = *localtime(&tnow);
@@ -482,17 +480,17 @@ printmessage(dig_query_t *query, dns_message_t *msg, isc_boolean_t headers) {
 	}
 	if (query->lookup->multiline ||
 	    (query->lookup->nottl && query->lookup->noclass))
-		result = dns_master_stylecreate(&style, styleflags,
-						24, 24, 24, 32, 80, 8,
-						splitwidth, mctx);
+		result = dns_master_stylecreate2(&style, styleflags,
+						 24, 24, 24, 32, 80, 8,
+						 splitwidth, mctx);
 	else if (query->lookup->nottl || query->lookup->noclass)
-		result = dns_master_stylecreate(&style, styleflags,
-						24, 24, 32, 40, 80, 8,
-						splitwidth, mctx);
+		result = dns_master_stylecreate2(&style, styleflags,
+						 24, 24, 32, 40, 80, 8,
+						 splitwidth, mctx);
 	else
-		result = dns_master_stylecreate(&style, styleflags,
-						24, 32, 40, 48, 80, 8,
-						splitwidth, mctx);
+		result = dns_master_stylecreate2(&style, styleflags,
+						 24, 32, 40, 48, 80, 8,
+						 splitwidth, mctx);
 	check_result(result, "dns_master_stylecreate");
 
 	if (query->lookup->cmdline[0] != 0) {
@@ -731,27 +729,28 @@ printgreeting(int argc, char **argv, dig_lookup_t *lookup) {
  */
 
 static void
-plus_option(char *option, isc_boolean_t is_batchfile,
+plus_option(const char *option, isc_boolean_t is_batchfile,
 	    dig_lookup_t *lookup)
 {
 	isc_result_t result;
-	char *cmd, *value, *last = NULL, *code, *extra;
+	char option_store[256];
+	char *cmd, *value, *ptr, *code;
 	isc_uint32_t num;
 	isc_boolean_t state = ISC_TRUE;
 	size_t n;
 
-	INSIST(option != NULL);
-
-	if ((cmd = strtok_r(option, "=", &last)) == NULL) {
-		printf(";; Invalid option %s\n", option);
+	strlcpy(option_store, option, sizeof(option_store));
+	ptr = option_store;
+	cmd = next_token(&ptr, "=");
+	if (cmd == NULL) {
+		printf(";; Invalid option %s\n", option_store);
 		return;
 	}
+	value = ptr;
 	if (strncasecmp(cmd, "no", 2)==0) {
 		cmd += 2;
 		state = ISC_FALSE;
 	}
-	/* parse the rest of the string */
-	value = strtok_r(NULL, "", &last);
 
 #define FULLCHECK(A) \
 	do { \
@@ -1003,9 +1002,8 @@ plus_option(char *option, isc_boolean_t is_batchfile,
 						}
 						code = NULL;
 						if (value != NULL) {
-							code = strtok_r(value,
-								        ":",
-									&last);
+							code = strtok(value,
+								      ":");
 						}
 						if (code == NULL) {
 							warn("ednsopt no "
@@ -1013,9 +1011,8 @@ plus_option(char *option, isc_boolean_t is_batchfile,
 							     "specified");
 							goto exit_or_usage;
 						}
-						extra = strtok_r(NULL, "\0",
-								 &last);
-						save_opt(lookup, code, extra);
+						value = strtok(NULL, "\0");
+						save_opt(lookup, code, value);
 						break;
 					default:
 						goto invalid_option;
@@ -1057,7 +1054,7 @@ plus_option(char *option, isc_boolean_t is_batchfile,
 				switch (cmd[3]) {
 				case 'i':
 					FULLCHECK("idnin");
-#ifndef HAVE_LIBIDN2
+#ifndef WITH_IDN_SUPPORT
 					fprintf(stderr, ";; IDN input support"
 						" not enabled\n");
 #else
@@ -1066,7 +1063,7 @@ plus_option(char *option, isc_boolean_t is_batchfile,
 				break;
 				case 'o':
 					FULLCHECK("idnout");
-#ifndef HAVE_LIBIDN2
+#ifndef WITH_IDN_OUT_SUPPORT
 					fprintf(stderr, ";; IDN output support"
 						" not enabled\n");
 #else
@@ -1250,10 +1247,6 @@ plus_option(char *option, isc_boolean_t is_batchfile,
 		break;
 	case 'r':
 		switch (cmd[1]) {
-		case 'a': /* raflag */
-			FULLCHECK("raflag");
-			lookup->raflag = state;
-			break;
 		case 'd': /* rdflag */
 			FULLCHECK("rdflag");
 			lookup->recurse = state;
@@ -1397,20 +1390,10 @@ plus_option(char *option, isc_boolean_t is_batchfile,
 	case 't':
 		switch (cmd[1]) {
 		case 'c': /* tcp */
-			switch (cmd[2]) {
-			case 'f':
-				FULLCHECK("tcflag");
-				lookup->tcflag = state;
-				break;
-			case 'p':
-				FULLCHECK("tcp");
-				if (!is_batchfile) {
-					lookup->tcp_mode = state;
-					lookup->tcp_mode_set = ISC_TRUE;
-				}
-				break;
-			default:
-				goto invalid_option;
+			FULLCHECK("tcp");
+			if (!is_batchfile) {
+				lookup->tcp_mode = state;
+				lookup->tcp_mode_set = ISC_TRUE;
 			}
 			break;
 		case 'i': /* timeout */
@@ -1546,7 +1529,7 @@ dash_option(char *option, char *next, dig_lookup_t **lookup,
 	    isc_boolean_t config_only, int argc, char **argv,
 	    isc_boolean_t *firstarg)
 {
-	char opt, *value, *ptr, *ptr2, *ptr3, *last;
+	char opt, *value, *ptr, *ptr2, *ptr3;
 	isc_result_t result;
 	isc_boolean_t value_from_next;
 	isc_textregion_t tr;
@@ -1760,21 +1743,26 @@ dash_option(char *option, char *next, dig_lookup_t **lookup,
 				 value);
 		return (value_from_next);
 	case 'y':
-		if ((ptr = strtok_r(value, ":", &last)) == NULL) {
+		ptr = next_token(&value, ":");	/* hmac type or name */
+		if (ptr == NULL) {
 			usage();
 		}
-		if ((ptr2 = strtok_r(NULL, ":", &last)) == NULL) {	/* name or secret */
+		ptr2 = next_token(&value, ":");	/* name or secret */
+		if (ptr2 == NULL)
 			usage();
-		}
-		if ((ptr3 = strtok_r(NULL, ":", &last)) != NULL) { /* secret or NULL */
+		ptr3 = next_token(&value, ":"); /* secret or NULL */
+		if (ptr3 != NULL) {
 			parse_hmac(ptr);
 			ptr = ptr2;
 			ptr2 = ptr3;
 		} else  {
+#ifndef PK11_MD5_DISABLE
 			hmacname = DNS_TSIG_HMACMD5_NAME;
+#else
+			hmacname = DNS_TSIG_HMACSHA256_NAME;
+#endif
 			digestbits = 0;
 		}
-		/* XXXONDREJ: FIXME */
 		strlcpy(keynametext, ptr, sizeof(keynametext));
 		strlcpy(keysecret, ptr2, sizeof(keysecret));
 		return (value_from_next);
@@ -1858,22 +1846,6 @@ preparse_args(int argc, char **argv) {
 	}
 }
 
-static int
-split_batchline(char *batchline, char **bargv, int len, const char *msg) {
-	int bargc;
-	char *last = NULL;
-
-	REQUIRE(batchline != NULL);
-
-	for (bargc = 1, bargv[bargc] = strtok_r(batchline, " \t\r\n", &last);
-	     bargc < len && bargv[bargc];
-	     bargv[++bargc] = strtok_r(NULL,  " \t\r\n", &last))
-	{
-		debug("%s %d: %s", msg, bargc, bargv[bargc]);
-	}
-	return (bargc);
-}
-
 static void
 parse_args(isc_boolean_t is_batchfile, isc_boolean_t config_only,
 	   int argc, char **argv)
@@ -1892,8 +1864,10 @@ parse_args(isc_boolean_t is_batchfile, isc_boolean_t config_only,
 	char **rv;
 #ifndef NOPOSIX
 	char *homedir;
-	char rcfile[PATH_MAX];
+	char rcfile[256];
 #endif
+	char *input;
+	int i;
 	isc_boolean_t need_clone = ISC_TRUE;
 
 	/*
@@ -1925,21 +1899,30 @@ parse_args(isc_boolean_t is_batchfile, isc_boolean_t config_only,
 			unsigned int n;
 			n = snprintf(rcfile, sizeof(rcfile), "%s/.digrc",
 				     homedir);
-			if (n < sizeof(rcfile)) {
+			if (n < sizeof(rcfile))
 				batchfp = fopen(rcfile, "r");
-			}
 		}
 		if (batchfp != NULL) {
 			while (fgets(batchline, sizeof(batchline),
-				     batchfp) != 0)
-			{
+				     batchfp) != 0) {
 				debug("config line %s", batchline);
-				bargc = split_batchline(batchline, bargv, 62,
-							".digrc argv");
+				bargc = 1;
+				input = batchline;
+				bargv[bargc] = next_token(&input, " \t\r\n");
+				while ((bargc < 62) && (bargv[bargc] != NULL)) {
+					bargc++;
+					bargv[bargc] =
+						next_token(&input, " \t\r\n");
+				}
+
 				bargv[0] = argv[0];
 				argv0 = argv[0];
-				parse_args(ISC_TRUE, ISC_TRUE,
-					   bargc, (char **)bargv);
+
+				for(i = 0; i < bargc; i++)
+					debug(".digrc argv %d: %s",
+					      i, bargv[i]);
+				parse_args(ISC_TRUE, ISC_TRUE, bargc,
+					   (char **)bargv);
 			}
 			fclose(batchfp);
 		}
@@ -1950,9 +1933,8 @@ parse_args(isc_boolean_t is_batchfile, isc_boolean_t config_only,
 		/* Processing '-f batchfile'. */
 		lookup = clone_lookup(default_lookup, ISC_TRUE);
 		need_clone = ISC_FALSE;
-	} else {
+	} else
 		lookup = default_lookup;
-	}
 
 	rc = argc;
 	rv = argv;
@@ -2119,14 +2101,23 @@ parse_args(isc_boolean_t is_batchfile, isc_boolean_t config_only,
 		/* XXX Remove code dup from shutdown code */
 	next_line:
 		if (fgets(batchline, sizeof(batchline), batchfp) != 0) {
+			bargc = 1;
 			debug("batch line %s", batchline);
-			if (batchline[0] == '\r' || batchline[0] == '\n' ||
-			    batchline[0] == '#' || batchline[0] == ';')
+			if (batchline[0] == '\r' || batchline[0] == '\n'
+			    || batchline[0] == '#' || batchline[0] == ';')
 				goto next_line;
-			bargc = split_batchline(batchline, bargv, 14,
-						"batch argv");
+			input = batchline;
+			bargv[bargc] = next_token(&input, " \t\r\n");
+			while ((bargc < 14) && (bargv[bargc] != NULL)) {
+				bargc++;
+				bargv[bargc] = next_token(&input, " \t\r\n");
+			}
+
 			bargv[0] = argv[0];
 			argv0 = argv[0];
+
+			for(i = 0; i < bargc; i++)
+				debug("batch argv %d: %s", i, bargv[i]);
 			parse_args(ISC_TRUE, ISC_FALSE, bargc, (char **)bargv);
 			return;
 		}
@@ -2165,6 +2156,8 @@ query_finished(void) {
 	char batchline[MXNAME];
 	int bargc;
 	char *bargv[16];
+	char *input;
+	int i;
 
 	if (batchname == NULL) {
 		isc_app_shutdown();
@@ -2182,8 +2175,18 @@ query_finished(void) {
 
 	if (fgets(batchline, sizeof(batchline), batchfp) != 0) {
 		debug("batch line %s", batchline);
-		bargc = split_batchline(batchline, bargv, 14, "batch argv");
+		bargc = 1;
+		input = batchline;
+		bargv[bargc] = next_token(&input, " \t\r\n");
+		while ((bargc < 14) && (bargv[bargc] != NULL)) {
+			bargc++;
+			bargv[bargc] = next_token(&input, " \t\r\n");
+		}
+
 		bargv[0] = argv0;
+
+		for(i = 0; i < bargc; i++)
+			debug("batch argv %d: %s", i, bargv[i]);
 		parse_args(ISC_TRUE, ISC_FALSE, bargc, (char **)bargv);
 		start_lookup();
 	} else {

bin/dig/dig.docbook

@@ -895,8 +895,7 @@
 	      attempts to find the authoritative name servers for
 	      the zone containing the name being looked up and
 	      display the SOA record that each name server has for
-	      the zone. Addresses of servers that that did not
-	      respond are also printed.
+	      the zone.
 	    </para>
 	  </listitem>
 	</varlistentry>
@@ -960,17 +959,6 @@
 	  </listitem>
 	</varlistentry>
 
-	<varlistentry>
-	  <term><option>+[no]raflag</option></term>
-	  <listitem>
-	    <para>
-	      Set [do not set] the RA (Recursion Available) bit in
-	      the query. The default is +noraflag. This bit should
-	      be ignored by the server for QUERY.
-	    </para>
-	  </listitem>
-	</varlistentry>
-
 	<varlistentry>
 	  <term><option>+[no]rdflag</option></term>
 	  <listitem>
@@ -1114,17 +1102,6 @@
 	  </listitem>
 	</varlistentry>
 
-	<varlistentry>
-	  <term><option>+[no]tcflag</option></term>
-	  <listitem>
-	    <para>
-	      Set [do not set] the TC (TrunCation) bit in the query.
-	      The default is +notcflag.  This bit should be ignored
-	      by the server for QUERY.
-	    </para>
-	  </listitem>
-	</varlistentry>
-
 	<varlistentry>
 	  <term><option>+[no]tcp</option></term>
 	  <listitem>

bin/dig/dig.html

@@ -710,8 +710,7 @@
 	      attempts to find the authoritative name servers for
 	      the zone containing the name being looked up and
 	      display the SOA record that each name server has for
-	      the zone. Addresses of servers that that did not
-	      respond are also printed.
+	      the zone.
 	    </p>
 	  </dd>
 <dt><span class="term"><code class="option">+[no]onesoa</code></span></dt>
@@ -758,14 +757,6 @@
 	      the question section as a comment.
 	    </p>
 	  </dd>
-<dt><span class="term"><code class="option">+[no]raflag</code></span></dt>
-<dd>
-	    <p>
-	      Set [do not set] the RA (Recursion Available) bit in
-	      the query. The default is +noraflag. This bit should
-	      be ignored by the server for QUERY.
-	    </p>
-	  </dd>
 <dt><span class="term"><code class="option">+[no]rdflag</code></span></dt>
 <dd>
 	    <p>
@@ -876,14 +867,6 @@
 	      this query.
 	    </p>
 	  </dd>
-<dt><span class="term"><code class="option">+[no]tcflag</code></span></dt>
-<dd>
-	    <p>
-	      Set [do not set] the TC (TrunCation) bit in the query.
-	      The default is +notcflag.  This bit should be ignored
-	      by the server for QUERY.
-	    </p>
-	  </dd>
 <dt><span class="term"><code class="option">+[no]tcp</code></span></dt>
 <dd>
 	    <p>

bin/dig/dighost.c

@@ -30,9 +30,18 @@
 #include <locale.h>
 #endif
 
-#ifdef HAVE_LIBIDN2
+#ifdef WITH_IDN_SUPPORT
+#ifdef WITH_IDNKIT
+#include <idn/result.h>
+#include <idn/log.h>
+#include <idn/resconf.h>
+#include <idn/api.h>
+#endif
+
+#ifdef WITH_LIBIDN2
 #include <idn2.h>
-#endif /* HAVE_LIBIDN2 */
+#endif
+#endif /* WITH_IDN_SUPPORT */
 
 #include <dns/byaddr.h>
 #include <dns/fixedname.h>
@@ -54,13 +63,13 @@
 
 #include <isc/app.h>
 #include <isc/base64.h>
+#include <isc/entropy.h>
 #include <isc/file.h>
 #include <isc/hex.h>
 #include <isc/lang.h>
 #include <isc/log.h>
 #include <isc/netaddr.h>
 #include <isc/netdb.h>
-#include <isc/nonce.h>
 #include <isc/parseint.h>
 #include <isc/print.h>
 #include <isc/random.h>
@@ -84,7 +93,7 @@
 
 #include <dig/dig.h>
 
-#if USE_PKCS11
+#ifdef PKCS11CRYPTO
 #include <pk11/result.h>
 #endif
 
@@ -132,12 +141,26 @@ int lookup_counter = 0;
 
 static char servercookie[256];
 
-#ifdef HAVE_LIBIDN2
-static void idn_locale_to_ace(const char *src, char *dst, size_t dstlen);
-static void idn_ace_to_locale(const char *src, char **dst);
-static isc_result_t idn_output_filter(isc_buffer_t *buffer,
-				      unsigned int used_org);
-#endif /* HAVE_LIBIDN2 */
+#ifdef WITH_IDN_SUPPORT
+static void idn_initialize(void);
+static isc_result_t idn_locale_to_ace(const char *from,
+		char *to,
+		size_t tolen);
+#endif /* WITH_IDN_SUPPORT */
+
+#ifdef WITH_IDN_OUT_SUPPORT
+static isc_result_t idn_ace_to_locale(const char *from,
+		char *to,
+		size_t tolen);
+static isc_result_t output_filter(isc_buffer_t *buffer,
+		unsigned int used_org,
+		isc_boolean_t absolute);
+#define MAXDLEN 256
+
+#ifdef WITH_IDNKIT
+int idnoptions = 0;
+#endif
+#endif /* WITH_IDN_OUT_SUPPORT */
 
 isc_socket_t *keep = NULL;
 isc_sockaddr_t keepaddr;
@@ -164,6 +187,7 @@ unsigned int digestbits = 0;
 isc_buffer_t *namebuf = NULL;
 dns_tsigkey_t *tsigkey = NULL;
 isc_boolean_t validated = ISC_TRUE;
+isc_entropy_t *entp = NULL;
 isc_mempool_t *commctx = NULL;
 isc_boolean_t debugging = ISC_FALSE;
 isc_boolean_t debugtiming = ISC_FALSE;
@@ -227,6 +251,18 @@ check_next_lookup(dig_lookup_t *lookup);
 static isc_boolean_t
 next_origin(dig_lookup_t *oldlookup);
 
+char *
+next_token(char **stringp, const char *delim) {
+	char *res;
+
+	do {
+		res = strsep(stringp, delim);
+		if (res == NULL)
+			break;
+	} while (*res == '\0');
+	return (res);
+}
+
 static int
 count_dots(char *string) {
 	char *s;
@@ -327,7 +363,7 @@ get_reverse(char *reverse, size_t len, char *value, isc_boolean_t ip6_int,
 		if (ip6_int)
 			options |= DNS_BYADDROPT_IPV6INT;
 		name = dns_fixedname_initname(&fname);
-		result = dns_byaddr_createptrname(&addr, options, name);
+		result = dns_byaddr_createptrname2(&addr, options, name);
 		if (result != ISC_R_SUCCESS)
 			return (result);
 		dns_name_format(name, reverse, (unsigned int)len);
@@ -624,21 +660,22 @@ make_empty_lookup(void) {
 	looknew->ttlunits = ISC_FALSE;
 	looknew->ttlunits = ISC_FALSE;
 	looknew->qr = ISC_FALSE;
-#ifdef HAVE_LIBIDN2
+#ifdef WITH_IDN_SUPPORT
 	looknew->idnin = ISC_TRUE;
-	looknew->idnout = ISC_TRUE;
 #else
 	looknew->idnin = ISC_FALSE;
+#endif
+#ifdef WITH_IDN_OUT_SUPPORT
+	looknew->idnout = ISC_TRUE;
+#else
 	looknew->idnout = ISC_FALSE;
-#endif /* HAVE_LIBIDN2 */
+#endif
 	looknew->udpsize = 0;
 	looknew->edns = -1;
 	looknew->recurse = ISC_TRUE;
 	looknew->aaonly = ISC_FALSE;
 	looknew->adflag = ISC_FALSE;
 	looknew->cdflag = ISC_FALSE;
-	looknew->raflag = ISC_FALSE;
-	looknew->tcflag = ISC_FALSE;
 	looknew->print_unknown_format = ISC_FALSE;
 	looknew->zflag = ISC_FALSE;
 	looknew->ns_search_only = ISC_FALSE;
@@ -781,8 +818,6 @@ clone_lookup(dig_lookup_t *lookold, isc_boolean_t servers) {
 	looknew->aaonly = lookold->aaonly;
 	looknew->adflag = lookold->adflag;
 	looknew->cdflag = lookold->cdflag;
-	looknew->raflag = lookold->raflag;
-	looknew->tcflag = lookold->tcflag;
 	looknew->print_unknown_format = lookold->print_unknown_format;
 	looknew->zflag = lookold->zflag;
 	looknew->ns_search_only = lookold->ns_search_only;
@@ -1032,12 +1067,14 @@ parse_hmac(const char *hmac) {
 
 	digestbits = 0;
 
+#ifndef PK11_MD5_DISABLE
 	if (strcasecmp(buf, "hmac-md5") == 0) {
 		hmacname = DNS_TSIG_HMACMD5_NAME;
 	} else if (strncasecmp(buf, "hmac-md5-", 9) == 0) {
 		hmacname = DNS_TSIG_HMACMD5_NAME;
 		digestbits = parse_bits(&buf[9], "digest-bits [0..128]", 128);
 	} else
+#endif
 	if (strcasecmp(buf, "hmac-sha1") == 0) {
 		hmacname = DNS_TSIG_HMACSHA1_NAME;
 		digestbits = 0;
@@ -1151,9 +1188,11 @@ setup_file_key(void) {
 	}
 
 	switch (dst_key_alg(dstkey)) {
+#ifndef PK11_MD5_DISABLE
 	case DST_ALG_HMACMD5:
 		hmacname = DNS_TSIG_HMACMD5_NAME;
 		break;
+#endif
 	case DST_ALG_HMACSHA1:
 		hmacname = DNS_TSIG_HMACSHA1_NAME;
 		break;
@@ -1280,12 +1319,24 @@ setup_system(isc_boolean_t ipv4only, isc_boolean_t ipv6only) {
 	(void)setlocale(LC_ALL, "");
 #endif
 
+#ifdef WITH_IDN_SUPPORT
+	idn_initialize();
+#endif
+
+#ifdef WITH_IDN_OUT_SUPPORT
+	/* Set domain name -> text post-conversion filter. */
+	result = dns_name_settotextfilter(output_filter);
+	check_result(result, "dns_name_settotextfilter");
+#endif
+
 	if (keyfile[0] != 0)
 		setup_file_key();
 	else if (keysecret[0] != 0)
 		setup_text_key();
-
-	isc_nonce_buf(cookie_secret, sizeof(cookie_secret));
+	result = isc_entropy_getdata(entp, cookie_secret,
+				     sizeof(cookie_secret), NULL, 0);
+	if (result != ISC_R_SUCCESS)
+		fatal("unable to generate cookie secret");
 }
 
 /*%
@@ -1310,7 +1361,7 @@ setup_libs(void) {
 
 	debug("setup_libs()");
 
-#if USE_PKCS11
+#ifdef PKCS11CRYPTO
 	pk11_result_register();
 #endif
 	dns_result_register();
@@ -1354,7 +1405,10 @@ setup_libs(void) {
 	result = isc_socketmgr_create(mctx, &socketmgr);
 	check_result(result, "isc_socketmgr_create");
 
-	result = dst_lib_init(mctx, NULL);
+	result = isc_entropy_create(mctx, &entp);
+	check_result(result, "isc_entropy_create");
+
+	result = dst_lib_init(mctx, entp, 0);
 	check_result(result, "dst_lib_init");
 	is_dst_up = ISC_TRUE;
 
@@ -1840,7 +1894,8 @@ followup_lookup(dns_message_t *msg, dig_query_t *query, dns_section_t section)
 		     srv != NULL;
 		     srv = ISC_LIST_HEAD(lookup->my_server_list)) {
 			INSIST(i > 0);
-			j = isc_random_uniform(i);
+			isc_random_get(&j);
+			j %= i;
 			next = ISC_LIST_NEXT(srv, link);
 			while (j-- > 0 && next != NULL) {
 				srv = next;
@@ -1992,6 +2047,7 @@ compute_cookie(unsigned char *clientcookie, size_t len) {
 isc_boolean_t
 setup_lookup(dig_lookup_t *lookup) {
 	isc_result_t result;
+	isc_uint32_t id;
 	unsigned int len;
 	dig_server_t *serv;
 	dig_query_t *query;
@@ -2002,13 +2058,15 @@ setup_lookup(dig_lookup_t *lookup) {
 	char cookiebuf[256];
 	char *origin = NULL;
 	char *textname = NULL;
-#ifdef HAVE_LIBIDN2
+#ifdef WITH_IDN_SUPPORT
 	char idn_origin[MXNAME], idn_textname[MXNAME];
+#endif
 
+#ifdef WITH_IDN_OUT_SUPPORT
 	result = dns_name_settotextfilter(lookup->idnout ?
-					  idn_output_filter : NULL);
+					  output_filter : NULL);
 	check_result(result, "dns_name_settotextfilter");
-#endif /* HAVE_LIBIDN2 */
+#endif
 
 	REQUIRE(lookup != NULL);
 	INSIST(!free_now);
@@ -2043,13 +2101,14 @@ setup_lookup(dig_lookup_t *lookup) {
 	 * TLD.
 	 */
 	textname = lookup->textname;
-#ifdef HAVE_LIBIDN2
+#ifdef WITH_IDN_SUPPORT
 	if (lookup->idnin) {
-		idn_locale_to_ace(textname, idn_textname, sizeof(idn_textname));
+		result = idn_locale_to_ace(textname, idn_textname, sizeof(idn_textname));
+		check_result(result, "convert textname to IDN encoding");
 		debug("idn_textname: %s", idn_textname);
 		textname = idn_textname;
 	}
-#endif /* HAVE_LIBIDN2 */
+#endif
 
 	/*
 	 * If the name has too many dots, force the origin to be NULL
@@ -2078,14 +2137,14 @@ setup_lookup(dig_lookup_t *lookup) {
 		dns_name_init(lookup->oname, NULL);
 		/* XXX Helper funct to conv char* to name? */
 		origin = lookup->origin->origin;
-#ifdef HAVE_LIBIDN2
+#ifdef WITH_IDN_SUPPORT
 		if (lookup->idnin) {
-			idn_locale_to_ace(origin, idn_origin,
-					  sizeof(idn_origin));
+			result = idn_locale_to_ace(origin, idn_origin, sizeof(idn_origin));
+			check_result(result, "convert origin to IDN encoding");
 			debug("trying idn origin %s", idn_origin);
 			origin = idn_origin;
 		}
-#endif /* HAVE_LIBIDN2 */
+#endif
 		len = (unsigned int) strlen(origin);
 		isc_buffer_init(&b, origin, len);
 		isc_buffer_add(&b, len);
@@ -2163,7 +2222,8 @@ setup_lookup(dig_lookup_t *lookup) {
 	dighost_trying(store, lookup);
 	INSIST(dns_name_isabsolute(lookup->name));
 
-	lookup->sendmsg->id = (dns_messageid_t)isc_random16();
+	isc_random_get(&id);
+	lookup->sendmsg->id = (unsigned short)id & 0xFFFF;
 	lookup->sendmsg->opcode = lookup->opcode;
 	lookup->msgcounter = 0;
 	/*
@@ -2196,16 +2256,6 @@ setup_lookup(dig_lookup_t *lookup) {
 		lookup->sendmsg->flags |= DNS_MESSAGEFLAG_CD;
 	}
 
-	if (lookup->raflag) {
-		debug("RA query");
-		lookup->sendmsg->flags |= DNS_MESSAGEFLAG_RA;
-	}
-
-	if (lookup->tcflag) {
-		debug("TC query");
-		lookup->sendmsg->flags |= DNS_MESSAGEFLAG_TC;
-	}
-
 	if (lookup->zflag) {
 		debug("Z query");
 		lookup->sendmsg->flags |= 0x0040U;
@@ -2940,15 +2990,7 @@ connect_timeout(isc_task_t *task, isc_event_t *event) {
 			check_next_lookup(l);
 		}
 	} else {
-		if (l->ns_search_only) {
-			isc_netaddr_t netaddr;
-			char buf[ISC_NETADDR_FORMATSIZE];
-
-			isc_netaddr_fromsockaddr(&netaddr, &query->sockaddr);
-			isc_netaddr_format(&netaddr, buf, sizeof(buf));
-
-			printf(";; no response from %s\n", buf);
-		} else {
+		if (!l->ns_search_only) {
 			fputs(l->cmdline, stdout);
 			printf(";; connection timed out; no servers could be "
 			       "reached\n");
@@ -4110,9 +4152,9 @@ cancel_all(void) {
  */
 void
 destroy_libs(void) {
-#ifdef HAVE_LIBIDN2
+#ifdef WITH_IDN_SUPPORT
 	isc_result_t result;
-#endif /* HAVE_LIBIDN2 */
+#endif
 
 	if (keep != NULL)
 		isc_socket_detach(&keep);
@@ -4144,10 +4186,10 @@ destroy_libs(void) {
 
 	clear_searchlist();
 
-#ifdef HAVE_LIBIDN2
+#ifdef WITH_IDN_SUPPORT
 	result = dns_name_settotextfilter(NULL);
 	check_result(result, "dns_name_settotextfilter");
-#endif /* HAVE_LIBIDN2 */
+#endif
 	dns_name_destroy();
 
 	if (commctx != NULL) {
@@ -4174,6 +4216,10 @@ destroy_libs(void) {
 		dst_lib_destroy();
 		is_dst_up = ISC_FALSE;
 	}
+	if (entp != NULL) {
+		debug("detach from entropy");
+		isc_entropy_detach(&entp);
+	}
 
 	UNLOCK_LOOKUP;
 	DESTROYLOCK(&lookup_lock);
@@ -4187,108 +4233,173 @@ destroy_libs(void) {
 		isc_mem_destroy(&mctx);
 }
 
-#ifdef HAVE_LIBIDN2
+#ifdef WITH_IDN_OUT_SUPPORT
 static isc_result_t
-idn_output_filter(isc_buffer_t *buffer, unsigned int used_org) {
-	char src[MXNAME], *dst;
-	size_t srclen, dstlen;
+output_filter(isc_buffer_t *buffer, unsigned int used_org,
+	      isc_boolean_t absolute)
+{
+	char tmp1[MAXDLEN], tmp2[MAXDLEN];
+	size_t fromlen, tolen;
+	isc_boolean_t end_with_dot;
+	isc_result_t result;
 
 	/*
-	 * Copy name from 'buffer' to 'src' and terminate it with NULL.
+	 * Copy contents of 'buffer' to 'tmp1', supply trailing dot
+	 * if 'absolute' is true, and terminate with NUL.
 	 */
-	srclen = isc_buffer_usedlength(buffer) - used_org;
-	if (srclen > sizeof(src)) {
-		warn("Input name too long to perform IDN conversion");
+	fromlen = isc_buffer_usedlength(buffer) - used_org;
+	if (fromlen >= MAXDLEN)
+		return (ISC_R_SUCCESS);
+
+	memmove(tmp1, (char *)isc_buffer_base(buffer) + used_org, fromlen);
+	end_with_dot = (tmp1[fromlen - 1] == '.') ? ISC_TRUE : ISC_FALSE;
+	if (absolute && !end_with_dot) {
+		fromlen++;
+		if (fromlen >= MAXDLEN)
+			return (ISC_R_SUCCESS);
+		tmp1[fromlen - 1] = '.';
+	}
+
+	tmp1[fromlen] = '\0';
+
+	/*
+	 * Convert contents of 'tmp1' to local encoding.
+	 */
+	result = idn_ace_to_locale(tmp1, tmp2, sizeof(tmp2));
+	if (result != ISC_R_SUCCESS) {
 		return (ISC_R_SUCCESS);
 	}
-	memmove(src, (char *)isc_buffer_base(buffer) + used_org, srclen);
-	src[srclen] = '\0';
-
 	/*
-	 * Convert 'src' to the current locale's character encoding.
+	 * Copy the converted contents in 'tmp1' back to 'buffer'.
+	 * If we have appended trailing dot, remove it.
 	 */
-	idn_ace_to_locale(src, &dst);
+	tolen = strlen(tmp2);
+	if (absolute && !end_with_dot && tmp2[tolen - 1] == '.')
+		tolen--;
 
-	/*
-	 * Check whether the converted name will fit back into 'buffer'.
-	 */
-	dstlen = strlen(dst);
-	if (isc_buffer_length(buffer) < used_org + dstlen) {
-		idn2_free(dst);
+	if (isc_buffer_length(buffer) < used_org + tolen)
 		return (ISC_R_NOSPACE);
-	}
 
-	/*
-	 * Put the converted name back into 'buffer'.
-	 */
-	isc_buffer_subtract(buffer, srclen);
-	memmove(isc_buffer_used(buffer), dst, dstlen);
-	isc_buffer_add(buffer, dstlen);
-
-	/*
-	 * Clean up.
-	 */
-	idn2_free(dst);
+	isc_buffer_subtract(buffer, isc_buffer_usedlength(buffer) - used_org);
+	memmove(isc_buffer_used(buffer), tmp2, tolen);
+	isc_buffer_add(buffer, (unsigned int)tolen);
 
 	return (ISC_R_SUCCESS);
 }
+#endif
 
-/*%
- * Convert 'src', which is a string using the current locale's character
- * encoding, into an ACE string suitable for use in the DNS, storing the
- * conversion result in 'dst', which is 'dstlen' bytes large.
- *
- * 'dst' MUST be large enough to hold any valid domain name.
- */
+#ifdef WITH_IDN_SUPPORT
+#ifdef WITH_IDNKIT
 static void
-idn_locale_to_ace(const char *src, char *dst, size_t dstlen) {
-	const char *final_src;
-	char *ascii_src;
-	int res;
-
-	/*
-	 * We trust libidn2 to return an error if 'src' is too large to be a
-	 * valid domain name.
-	 */
-	res = idn2_to_ascii_lz(src, &ascii_src, IDN2_NONTRANSITIONAL);
-	if (res != IDN2_OK) {
-		fatal("'%s' is not a legal IDNA2008 name (%s), use +noidnin",
-		      src, idn2_strerror(res));
+idnkit_check_result(idn_result_t result, const char *msg) {
+	if (result != idn_success) {
+		fatal("%s: %s", msg, idn_result_tostring(result));
 	}
-
-	/*
-	 * idn2_to_ascii_lz() normalizes all strings to lower case, but we
-	 * generally don't want to lowercase all input strings; make sure to
-	 * return the original case if the two strings differ only in case.
-	 */
-	final_src = (strcasecmp(src, ascii_src) == 0 ? src : ascii_src);
-
-	(void)strlcpy(dst, final_src, dstlen);
-
-	idn2_free(ascii_src);
 }
 
-/*%
- * Convert 'src', which is an ACE string suitable for use in the DNS, into a
- * string using the current locale's character encoding, storing the conversion
- * result in 'dst'.
- *
- * The caller MUST subsequently release 'dst' using idn2_free().
- */
 static void
-idn_ace_to_locale(const char *src, char **dst) {
-	char *local_src, *utf8_src;
+idn_initialize(void) {
+	idn_result_t result;
+
+	/* Create configuration context. */
+	result = idn_nameinit(1);
+	idnkit_check_result(result, "idnkit api initialization failed");
+	return (ISC_R_SUCCESS);
+}
+
+static isc_result_t
+idn_locale_to_ace(const char *from, char *to, size_t tolen) {
+	char utf8_textname[MXNAME];
+	idn_result_t result;
+
+	result = idn_encodename(IDN_LOCALCONV | IDN_DELIMMAP, from,
+				utf8_textname, sizeof(utf8_textname));
+	idnkit_check_result(result, "idnkit idn_encodename to utf8 failed");
+
+	result = idn_encodename(idnoptions | IDN_LOCALMAP | IDN_NAMEPREP |
+				IDN_IDNCONV | IDN_LENCHECK,
+				utf8_textname, to, tolen);
+	idnkit_check_result(result, "idnkit idn_encodename to idn failed");
+	return (ISC_R_SUCCESS);
+}
+
+static isc_result_t
+idn_ace_to_locale(const char *from, char *to, size_t tolen) {
+	idn_result_t result;
+
+	result = idn_decodename(IDN_DECODE_APP, from, to, tolen);
+	if (result != idn_success) {
+		debug("idnkit idn_decodename failed: %s",
+		      idn_result_tostring(result));
+		return (ISC_R_FAILURE);
+	}
+	return (ISC_R_SUCCESS);
+}
+#endif /* WITH_IDNKIT */
+
+#ifdef WITH_LIBIDN2
+static void
+idn_initialize(void) {
+}
+
+static isc_result_t
+idn_locale_to_ace(const char *from, char *to, size_t tolen) {
 	int res;
+	char *tmp_str = NULL;
+
+	res = idn2_to_ascii_lz(from, &tmp_str, IDN2_NONTRANSITIONAL|IDN2_NFC_INPUT);
+	if (res == IDN2_DISALLOWED) {
+		res = idn2_to_ascii_lz(from, &tmp_str, IDN2_TRANSITIONAL|IDN2_NFC_INPUT);
+	}
+
+	if (res == IDN2_OK) {
+		/*
+		 * idn2_to_ascii_lz() normalizes all strings to lowerl case,
+		 * but we generally don't want to lowercase all input strings;
+		 * make sure to return the original case if the two strings
+		 * differ only in case
+		 */
+		if (!strcasecmp(from, tmp_str)) {
+			if (strlen(from) >= tolen) {
+				debug("from string is too long");
+				idn2_free(tmp_str);
+				return ISC_R_NOSPACE;
+			}
+			idn2_free(tmp_str);
+			(void) strlcpy(to, from, tolen);
+			return ISC_R_SUCCESS;
+		}
+		/* check the length */
+		if (strlen(tmp_str) >= tolen) {
+			debug("ACE string is too long");
+			idn2_free(tmp_str);
+			return ISC_R_NOSPACE;
+		}
+
+		(void) strlcpy(to, tmp_str, tolen);
+		idn2_free(tmp_str);
+		return ISC_R_SUCCESS;
+	}
+
+	fatal("'%s' is not a legal IDN name (%s), use +noidnin", from, idn2_strerror(res));
+	return ISC_R_FAILURE;
+}
+
+#ifdef WITH_IDN_OUT_SUPPORT
+static isc_result_t
+idn_ace_to_locale(const char *from, char *to, size_t tolen) {
+	int res;
+	char *utf8_src, *tmp_str = NULL;
 
 	/*
 	 * We need to:
 	 *
-	 *  1) check whether 'src' is a valid IDNA2008 name,
+	 *  1) check whether 'from' is a valid IDNA2008 name,
 	 *  2) if it is, output it in the current locale's character encoding.
 	 *
 	 * Unlike idn2_to_ascii_*(), idn2_to_unicode_*() functions are unable
 	 * to perform IDNA2008 validity checks.  Thus, we need to decode any
-	 * Punycode in 'src', check if the resulting name is a valid IDNA2008
+	 * Punycode in 'from', check if the resulting name is a valid IDNA2008
 	 * name, and only once we ensure it is, output that name in the current
 	 * locale's character encoding.
 	 *
@@ -4299,32 +4410,32 @@ idn_ace_to_locale(const char *src, char **dst) {
 	 * valid IDNA2008 name, as long as it contained any non-ASCII
 	 * character).  Thus, we need to take a longer route.
 	 *
-	 * First, convert 'src' to UTF-8, ignoring the current locale.
+	 * First, convert 'from' to UTF-8, ignoring the current locale.
 	 */
-	res = idn2_to_unicode_8z8z(src, &utf8_src, 0);
+	res = idn2_to_unicode_8z8z(from, &utf8_src, 0);
 	if (res != IDN2_OK) {
 		fatal("Bad ACE string '%s' (%s), use +noidnout",
-		      src, idn2_strerror(res));
+		      from, idn2_strerror(res));
 	}
 
 	/*
-	 * Then, check whether decoded 'src' is a valid IDNA2008 name.
+	 * Then, check whether decoded 'from' is a valid IDNA2008 name.
 	 */
 	res = idn2_to_ascii_8z(utf8_src, NULL, IDN2_NONTRANSITIONAL);
 	if (res != IDN2_OK) {
 		fatal("'%s' is not a legal IDNA2008 name (%s), use +noidnout",
-		      src, idn2_strerror(res));
+		      from, idn2_strerror(res));
 	}
 
 	/*
-	 * Finally, try converting the decoded 'src' into the current locale's
+	 * Finally, try converting the decoded 'from' into the current locale's
 	 * character encoding.
 	 */
-	res = idn2_to_unicode_8zlz(utf8_src, &local_src, 0);
+	res = idn2_to_unicode_8zlz(utf8_src, &tmp_str, 0);
 	if (res != IDN2_OK) {
 		fatal("Cannot represent '%s' in the current locale (%s), "
 		      "use +noidnout or a different locale",
-		      src, idn2_strerror(res));
+		      from, idn2_strerror(res));
 	}
 
 	/*
@@ -4332,6 +4443,17 @@ idn_ace_to_locale(const char *src, char **dst) {
 	 */
 	idn2_free(utf8_src);
 
-	*dst = local_src;
+	/* check the length */
+	if (strlen(tmp_str) >= tolen) {
+		debug("encoded ASC string is too long");
+		idn2_free(tmp_str);
+		return (ISC_R_FAILURE);
+	}
+
+	(void) strlcpy(to, tmp_str, tolen);
+	idn2_free(tmp_str);
+	return (ISC_R_SUCCESS);
 }
-#endif /* HAVE_LIBIDN2 */
+#endif /* WITH_IDN_OUT_SUPPORT */
+#endif /* WITH_LIBIDN2 */
+#endif /* WITH_IDN_SUPPORT */

bin/dig/host.c

@@ -19,6 +19,13 @@
 #include <locale.h>
 #endif
 
+#ifdef WITH_IDNKIT
+#include <idn/result.h>
+#include <idn/log.h>
+#include <idn/resconf.h>
+#include <idn/api.h>
+#endif
+
 #include <isc/app.h>
 #include <isc/commandline.h>
 #include <isc/netaddr.h>
@@ -713,6 +720,9 @@ parse_args(isc_boolean_t is_batchfile, int argc, char **argv) {
 			    lookup->rdtype != dns_rdatatype_axfr)
 				lookup->rdtype = rdtype;
 			lookup->rdtypeset = ISC_TRUE;
+#ifdef WITH_IDNKIT
+			idnoptions = 0;
+#endif
 			if (rdtype == dns_rdatatype_axfr) {
 				/* -l -t any -v */
 				list_type = dns_rdatatype_any;
@@ -725,6 +735,13 @@ parse_args(isc_boolean_t is_batchfile, int argc, char **argv) {
 			} else if (rdtype == dns_rdatatype_any) {
 				if (!lookup->tcp_mode_set)
 					lookup->tcp_mode = ISC_TRUE;
+#ifdef WITH_IDNKIT
+			} else if (rdtype == dns_rdatatype_a ||
+				   rdtype == dns_rdatatype_aaaa ||
+				   rdtype == dns_rdatatype_mx) {
+				idnoptions = IDN_ASCCHECK;
+				list_type = rdtype;
+#endif
 			} else
 				list_type = rdtype;
 			list_addresses = ISC_FALSE;
@@ -753,6 +770,9 @@ parse_args(isc_boolean_t is_batchfile, int argc, char **argv) {
 			if (!lookup->rdtypeset ||
 			    lookup->rdtype != dns_rdatatype_axfr)
 				lookup->rdtype = dns_rdatatype_any;
+#ifdef WITH_IDNKIT
+			idnoptions = 0;
+#endif
 			list_type = dns_rdatatype_any;
 			list_addresses = ISC_FALSE;
 			lookup->rdtypeset = ISC_TRUE;
@@ -864,6 +884,9 @@ main(int argc, char **argv) {
 	ISC_LIST_INIT(search_list);
 
 	fatalexit = 1;
+#ifdef WITH_IDNKIT
+	idnoptions = IDN_ASCCHECK;
+#endif
 
 	/* setup dighost callbacks */
 	dighost_printmessage = printmessage;

bin/dig/include/dig/dig.h

@@ -94,8 +94,6 @@ struct dig_lookup {
 		aaonly,
 		adflag,
 		cdflag,
-		raflag,
-		tcflag,
 		zflag,
 		trace, /*% dig +trace */
 		trace_root, /*% initial query for either +trace or +nssearch */
@@ -271,6 +269,9 @@ extern char *progname;
 extern int tries;
 extern int fatalexit;
 extern isc_boolean_t verbose;
+#ifdef WITH_IDNKIT
+extern int idnoptions;
+#endif
 
 /*
  * Routines in dighost.c.
@@ -371,6 +372,9 @@ destroy_libs(void);
 void
 set_search_domain(char *domain);
 
+char *
+next_token(char **stringp, const char *delim);
+
 /*
  * Routines to be defined in dig.c, host.c, and nslookup.c. and
  * then assigned to the appropriate function pointer

bin/dig/nslookup.c

@@ -813,12 +813,12 @@ addlookup(char *opt) {
 
 static void
 do_next_command(char *input) {
-	char *ptr, *arg, *last;
+	char *ptr, *arg;
 
-	if ((ptr = strtok_r(input, " \t\r\n", &last)) == NULL) {
+	ptr = next_token(&input, " \t\r\n");
+	if (ptr == NULL)
 		return;
-	}
-	arg = strtok_r(NULL, " \t\r\n", &last);
+	arg = next_token(&input, " \t\r\n");
 	if ((strcasecmp(ptr, "set") == 0) &&
 	    (arg != NULL))
 		setoption(arg);

bin/dig/win32/dig.vcxproj.in

@@ -53,7 +53,7 @@
       </PrecompiledHeader>
       <WarningLevel>Level3</WarningLevel>
       <Optimization>Disabled</Optimization>
-      <PreprocessorDefinitions>WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <PreprocessorDefinitions>WIN32;@CRYPTO@_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
       <FunctionLevelLinking>true</FunctionLevelLinking>
       <PrecompiledHeaderOutputFile>.\$(Configuration)\$(TargetName).pch</PrecompiledHeaderOutputFile>
       <AssemblerListingLocation>.\$(Configuration)\</AssemblerListingLocation>
@@ -79,7 +79,7 @@
       <Optimization>MaxSpeed</Optimization>
       <FunctionLevelLinking>true</FunctionLevelLinking>
       <IntrinsicFunctions>@INTRINSIC@</IntrinsicFunctions>
-      <PreprocessorDefinitions>WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <PreprocessorDefinitions>WIN32;@CRYPTO@NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
       <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
       <WholeProgramOptimization>false</WholeProgramOptimization>
       <StringPooling>true</StringPooling>

bin/dig/win32/dighost.vcxproj.in

@@ -53,7 +53,7 @@
       </PrecompiledHeader>
       <WarningLevel>Level3</WarningLevel>
       <Optimization>Disabled</Optimization>
-      <PreprocessorDefinitions>WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <PreprocessorDefinitions>WIN32;@CRYPTO@_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
       <FunctionLevelLinking>true</FunctionLevelLinking>
       <PrecompiledHeaderOutputFile>.\$(Configuration)\$(TargetName).pch</PrecompiledHeaderOutputFile>
       <AssemblerListingLocation>.\$(Configuration)\</AssemblerListingLocation>
@@ -77,7 +77,7 @@
       <Optimization>MaxSpeed</Optimization>
       <FunctionLevelLinking>true</FunctionLevelLinking>
       <IntrinsicFunctions>@INTRINSIC@</IntrinsicFunctions>
-      <PreprocessorDefinitions>WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <PreprocessorDefinitions>WIN32;@CRYPTO@NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
       <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
       <WholeProgramOptimization>false</WholeProgramOptimization>
       <StringPooling>true</StringPooling>

bin/dig/win32/host.vcxproj.in

@@ -53,7 +53,7 @@
       </PrecompiledHeader>
       <WarningLevel>Level3</WarningLevel>
       <Optimization>Disabled</Optimization>
-      <PreprocessorDefinitions>WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <PreprocessorDefinitions>WIN32;@CRYPTO@_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
       <FunctionLevelLinking>true</FunctionLevelLinking>
       <PrecompiledHeaderOutputFile>.\$(Configuration)\$(TargetName).pch</PrecompiledHeaderOutputFile>
       <AssemblerListingLocation>.\$(Configuration)\</AssemblerListingLocation>
@@ -79,7 +79,7 @@
       <Optimization>MaxSpeed</Optimization>
       <FunctionLevelLinking>true</FunctionLevelLinking>
       <IntrinsicFunctions>@INTRINSIC@</IntrinsicFunctions>
-      <PreprocessorDefinitions>WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <PreprocessorDefinitions>WIN32;@CRYPTO@NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
       <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
       <WholeProgramOptimization>false</WholeProgramOptimization>
       <StringPooling>true</StringPooling>

bin/dig/win32/nslookup.vcxproj.in

@@ -53,7 +53,7 @@
       </PrecompiledHeader>
       <WarningLevel>Level3</WarningLevel>
       <Optimization>Disabled</Optimization>
-      <PreprocessorDefinitions>WIN32;USE_READLINE_STATIC;_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <PreprocessorDefinitions>WIN32;@CRYPTO@USE_READLINE_STATIC;_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
       <FunctionLevelLinking>true</FunctionLevelLinking>
       <PrecompiledHeaderOutputFile>.\$(Configuration)\$(TargetName).pch</PrecompiledHeaderOutputFile>
       <AssemblerListingLocation>.\$(Configuration)\</AssemblerListingLocation>
@@ -79,7 +79,7 @@
       <Optimization>MaxSpeed</Optimization>
       <FunctionLevelLinking>true</FunctionLevelLinking>
       <IntrinsicFunctions>@INTRINSIC@</IntrinsicFunctions>
-      <PreprocessorDefinitions>WIN32;USE_READLINE_STATIC;NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <PreprocessorDefinitions>WIN32;@CRYPTO@USE_READLINE_STATIC;NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
       <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
       <WholeProgramOptimization>false</WholeProgramOptimization>
       <StringPooling>true</StringPooling>

bin/dnssec/Makefile.in

@@ -15,14 +15,15 @@ VERSION=@BIND9_VERSION@
 
 @BIND9_MAKE_INCLUDES@
 
-CINCLUDES =	${DNS_INCLUDES} ${ISC_INCLUDES} @OPENSSL_INCLUDES@
+CINCLUDES =	${DNS_INCLUDES} ${ISC_INCLUDES} @DST_OPENSSL_INC@
 
-CDEFINES =	-DVERSION=\"${VERSION}\"
+CDEFINES =	-DVERSION=\"${VERSION}\" @USE_PKCS11@ @PKCS11_ENGINE@ \
+		@CRYPTO@ -DPK11_LIB_LOCATION=\"@PKCS11_PROVIDER@\"
 CWARNINGS =
 
 DNSLIBS =	../../lib/dns/libdns.@A@ @DNS_CRYPTO_LIBS@
-ISCLIBS =	../../lib/isc/libisc.@A@ @OPENSSL_LIBS@
-ISCNOSYMLIBS =	../../lib/isc/libisc-nosymtbl.@A@ @OPENSSL_LIBS@
+ISCLIBS =	../../lib/isc/libisc.@A@ @ISC_OPENSSL_LIBS@
+ISCNOSYMLIBS =	../../lib/isc/libisc-nosymtbl.@A@ @ISC_OPENSSL_LIBS@
 
 DNSDEPLIBS =	../../lib/dns/libdns.@A@
 ISCDEPLIBS =	../../lib/isc/libisc.@A@

bin/dnssec/dnssec-cds.8

@@ -102,7 +102,7 @@ Specify a digest algorithm to use when converting CDNSKEY records to DS records\
 .sp
 The
 \fIalgorithm\fR
-must be one of SHA\-1 (SHA1), SHA\-256 (SHA256), or SHA\-384 (SHA384)\&. These values are case insensitive\&. If no algorithm is specified, the default is SHA\-256\&.
+must be one of SHA\-1 (SHA1), SHA\-256 (SHA256), GOST, or SHA\-384 (SHA384)\&. These values are case insensitive\&. If no algorithm is specified, the default is SHA\-256\&.
 .RE
 .PP
 \-c \fIclass\fR

bin/dnssec/dnssec-cds.c

@@ -23,6 +23,7 @@
 
 #include <isc/buffer.h>
 #include <isc/commandline.h>
+#include <isc/entropy.h>
 #include <isc/file.h>
 #include <isc/hash.h>
 #include <isc/mem.h>
@@ -53,7 +54,7 @@
 
 #include <dst/dst.h>
 
-#if USE_PKCS11
+#ifdef PKCS11CRYPTO
 #include <pk11/result.h>
 #endif
 
@@ -71,6 +72,7 @@ int verbose;
  */
 static isc_log_t *lctx = NULL;
 static isc_mem_t *mctx = NULL;
+static isc_entropy_t *ectx = NULL;
 
 /*
  * The domain we are working on
@@ -251,8 +253,8 @@ load_db(const char *filename, dns_db_t **dbp, dns_dbnode_t **nodep) {
 			       rdclass, 0, NULL, dbp);
 	check_result(result, "dns_db_create()");
 
-	result = dns_db_load(*dbp, filename,
-			     dns_masterformat_text, DNS_MASTER_HINT);
+	result = dns_db_load3(*dbp, filename,
+			      dns_masterformat_text, DNS_MASTER_HINT);
 	if (result != ISC_R_SUCCESS && result != DNS_R_SEENINCLUDE) {
 		fatal("can't load %s: %s", filename,
 		      isc_result_totext(result));
@@ -376,9 +378,9 @@ formatset(dns_rdataset_t *rdataset) {
 	 * which just separates fields with spaces. The huge tab stop width
 	 * eliminates any tab characters.
 	 */
-	result = dns_master_stylecreate(&style, styleflags,
-					0, 0, 0, 0, 0, 1000000, 0,
-					mctx);
+	result = dns_master_stylecreate2(&style, styleflags,
+					 0, 0, 0, 0, 0, 1000000, 0,
+					 mctx);
 	check_result(result, "dns_master_stylecreate2 failed");
 
 	result = isc_buffer_allocate(mctx, &buf, MAX_CDS_RDATA_TEXT_SIZE);
@@ -668,11 +670,8 @@ matching_sigs(keyinfo_t *keytbl, dns_rdataset_t *rdataset,
 			}
 
 			result = dns_dnssec_verify(name, rdataset, ki->dst,
-						   ISC_FALSE, 0, mctx,
-						   &sigrdata, NULL);
-
-			if (result != ISC_R_SUCCESS &&
-			    result != DNS_R_FROMWILDCARD) {
+						   ISC_FALSE, mctx, &sigrdata);
+			if (result != ISC_R_SUCCESS) {
 				vbprintf(1, "skip RRSIG by key %d:"
 					 " verification failed: %s\n",
 					 sig.keyid, isc_result_totext(result));
@@ -1115,7 +1114,7 @@ usage(void) {
 		program);
 	fprintf(stderr, "Version: %s\n", VERSION);
 	fprintf(stderr, "Options:\n"
-"    -a <algorithm>     digest algorithm (SHA-1 / SHA-256 / SHA-384)\n"
+"    -a <algorithm>     digest algorithm (SHA-1 / SHA-256 / GOST / SHA-384)\n"
 "    -c <class>         of domain (default IN)\n"
 "    -D                 prefer CDNSKEY records instead of CDS\n"
 "    -d <file|dir>      where to find parent dsset- file\n"
@@ -1147,7 +1146,7 @@ main(int argc, char *argv[]) {
 		fatal("out of memory");
 	}
 
-#if USE_PKCS11
+#ifdef PKCS11CRYPTO
 	pk11_result_register();
 #endif
 	dns_result_register();
@@ -1231,11 +1230,20 @@ main(int argc, char *argv[]) {
 
 	setup_logging(mctx, &lctx);
 
-	result = dst_lib_init(mctx, NULL);
+	if (ectx == NULL) {
+		setup_entropy(mctx, NULL, &ectx);
+	}
+	result = isc_hash_create(mctx, ectx, DNS_NAME_MAXWIRE);
+	if (result != ISC_R_SUCCESS) {
+		fatal("could not initialize hash");
+	}
+	result = dst_lib_init(mctx, ectx,
+			      ISC_ENTROPY_BLOCKING | ISC_ENTROPY_GOODONLY);
 	if (result != ISC_R_SUCCESS) {
 		fatal("could not initialize dst: %s",
 		      isc_result_totext(result));
 	}
+	isc_entropy_stopcallbacksources(ectx);
 
 	if (ds_path == NULL) {
 		fatal("missing -d DS pathname");
@@ -1385,6 +1393,8 @@ main(int argc, char *argv[]) {
 	free_all_sets();
 	cleanup_logging(&lctx);
 	dst_lib_destroy();
+	isc_hash_destroy();
+	cleanup_entropy(&ectx);
 	if (verbose > 10) {
 		isc_mem_stats(mctx, stdout);
 	}

bin/dnssec/dnssec-cds.docbook

@@ -144,7 +144,7 @@
           </para>
           <para>
 	    The <replaceable>algorithm</replaceable> must be one of SHA-1
-	    (SHA1), SHA-256 (SHA256), or SHA-384 (SHA384). These
+	    (SHA1), SHA-256 (SHA256), GOST, or SHA-384 (SHA384). These
 	    values are case insensitive. If no algorithm is specified,
 	    the default is SHA-256.
           </para>

bin/dnssec/dnssec-cds.html

@@ -130,7 +130,7 @@
           </p>
           <p>
 	    The <em class="replaceable"><code>algorithm</code></em> must be one of SHA-1
-	    (SHA1), SHA-256 (SHA256), or SHA-384 (SHA384). These
+	    (SHA1), SHA-256 (SHA256), GOST, or SHA-384 (SHA384). These
 	    values are case insensitive. If no algorithm is specified,
 	    the default is SHA-256.
           </p>

bin/dnssec/dnssec-dsfromkey.8

@@ -64,7 +64,7 @@ Use SHA\-256 as the digest algorithm\&.
 .RS 4
 Select the digest algorithm\&. The value of
 \fBalgorithm\fR
-must be one of SHA\-1 (SHA1), SHA\-256 (SHA256) or SHA\-384 (SHA384)\&. These values are case insensitive\&.
+must be one of SHA\-1 (SHA1), SHA\-256 (SHA256), GOST or SHA\-384 (SHA384)\&. These values are case insensitive\&.
 .RE
 .PP
 \-C

bin/dnssec/dnssec-dsfromkey.c

@@ -17,6 +17,7 @@
 
 #include <isc/buffer.h>
 #include <isc/commandline.h>
+#include <isc/entropy.h>
 #include <isc/hash.h>
 #include <isc/mem.h>
 #include <isc/print.h>
@@ -41,7 +42,7 @@
 
 #include <dst/dst.h>
 
-#if USE_PKCS11
+#ifdef PKCS11CRYPTO
 #include <pk11/result.h>
 #endif
 
@@ -112,7 +113,7 @@ loadset(const char *filename, dns_rdataset_t *rdataset) {
 		db_load_from_stream(db, stdin);
 		filename = "input";
 	} else {
-		result = dns_db_load(db, filename, dns_masterformat_text, 0);
+		result = dns_db_load(db, filename);
 		if (result != ISC_R_SUCCESS && result != DNS_R_SEENINCLUDE)
 			fatal("can't load %s: %s", filename,
 			      isc_result_totext(result));
@@ -358,6 +359,7 @@ main(int argc, char **argv) {
 	isc_boolean_t	showall = ISC_FALSE;
 	isc_result_t	result;
 	isc_log_t	*log = NULL;
+	isc_entropy_t	*ectx = NULL;
 	dns_rdataset_t	rdataset;
 	dns_rdata_t	rdata;
 
@@ -370,7 +372,7 @@ main(int argc, char **argv) {
 	if (result != ISC_R_SUCCESS)
 		fatal("out of memory");
 
-#if USE_PKCS11
+#ifdef PKCS11CRYPTO
 	pk11_result_register();
 #endif
 	dns_result_register();
@@ -473,10 +475,17 @@ main(int argc, char **argv) {
 	if (argc > isc_commandline_index + 1)
 		fatal("extraneous arguments");
 
-	result = dst_lib_init(mctx, NULL);
+	if (ectx == NULL)
+		setup_entropy(mctx, NULL, &ectx);
+	result = dst_lib_init(mctx, ectx,
+			      ISC_ENTROPY_BLOCKING | ISC_ENTROPY_GOODONLY);
 	if (result != ISC_R_SUCCESS)
 		fatal("could not initialize dst: %s",
 		      isc_result_totext(result));
+	result = isc_hash_create(mctx, ectx, DNS_NAME_MAXWIRE);
+	if (result != ISC_R_SUCCESS)
+		fatal("could not initialize hash");
+	isc_entropy_stopcallbacksources(ectx);
 
 	setup_logging(mctx, &log);
 
@@ -537,7 +546,9 @@ main(int argc, char **argv) {
 	if (dns_rdataset_isassociated(&rdataset))
 		dns_rdataset_disassociate(&rdataset);
 	cleanup_logging(&log);
+	isc_hash_destroy();
 	dst_lib_destroy();
+	cleanup_entropy(&ectx);
 	dns_name_destroy();
 	if (verbose > 10)
 		isc_mem_stats(mctx, stdout);

bin/dnssec/dnssec-dsfromkey.docbook

@@ -117,7 +117,7 @@
 	  <para>
 	    Select the digest algorithm. The value of
 	    <option>algorithm</option> must be one of SHA-1 (SHA1),
-	    SHA-256 (SHA256) or SHA-384 (SHA384).
+	    SHA-256 (SHA256), GOST or SHA-384 (SHA384).
 	    These values are case insensitive.
 	  </para>
 	</listitem>

bin/dnssec/dnssec-dsfromkey.html

@@ -97,7 +97,7 @@
 	  <p>
 	    Select the digest algorithm. The value of
 	    <code class="option">algorithm</code> must be one of SHA-1 (SHA1),
-	    SHA-256 (SHA256) or SHA-384 (SHA384).
+	    SHA-256 (SHA256), GOST or SHA-384 (SHA384).
 	    These values are case insensitive.
 	  </p>
 	</dd>

bin/dnssec/dnssec-importkey.c

@@ -17,6 +17,7 @@
 
 #include <isc/buffer.h>
 #include <isc/commandline.h>
+#include <isc/entropy.h>
 #include <isc/hash.h>
 #include <isc/mem.h>
 #include <isc/print.h>
@@ -41,7 +42,7 @@
 
 #include <dst/dst.h>
 
-#if USE_PKCS11
+#ifdef PKCS11CRYPTO
 #include <pk11/result.h>
 #endif
 
@@ -117,8 +118,8 @@ loadset(const char *filename, dns_rdataset_t *rdataset) {
 		db_load_from_stream(db, stdin);
 		filename = "input";
 	} else {
-		result = dns_db_load(db, filename, dns_masterformat_text,
-				     DNS_MASTER_NOTTL);
+		result = dns_db_load3(db, filename, dns_masterformat_text,
+				      DNS_MASTER_NOTTL);
 		if (result != ISC_R_SUCCESS && result != DNS_R_SEENINCLUDE)
 			fatal("can't load %s: %s", filename,
 			      isc_result_totext(result));
@@ -296,6 +297,7 @@ main(int argc, char **argv) {
 	int		ch;
 	isc_result_t	result;
 	isc_log_t	*log = NULL;
+	isc_entropy_t	*ectx = NULL;
 	dns_rdataset_t	rdataset;
 	dns_rdata_t	rdata;
 	isc_stdtime_t   now;
@@ -310,7 +312,7 @@ main(int argc, char **argv) {
 	if (result != ISC_R_SUCCESS)
 		fatal("out of memory");
 
-#if USE_PKCS11
+#ifdef PKCS11CRYPTO
 	pk11_result_register();
 #endif
 	dns_result_register();
@@ -402,10 +404,17 @@ main(int argc, char **argv) {
 	if (argc > isc_commandline_index + 1)
 		fatal("extraneous arguments");
 
-	result = dst_lib_init(mctx, NULL);
+	if (ectx == NULL)
+		setup_entropy(mctx, NULL, &ectx);
+	result = dst_lib_init(mctx, ectx,
+			      ISC_ENTROPY_BLOCKING | ISC_ENTROPY_GOODONLY);
 	if (result != ISC_R_SUCCESS)
 		fatal("could not initialize dst: %s",
 		      isc_result_totext(result));
+	result = isc_hash_create(mctx, ectx, DNS_NAME_MAXWIRE);
+	if (result != ISC_R_SUCCESS)
+		fatal("could not initialize hash");
+	isc_entropy_stopcallbacksources(ectx);
 
 	setup_logging(mctx, &log);
 
@@ -448,7 +457,9 @@ main(int argc, char **argv) {
 	if (dns_rdataset_isassociated(&rdataset))
 		dns_rdataset_disassociate(&rdataset);
 	cleanup_logging(&log);
+	isc_hash_destroy();
 	dst_lib_destroy();
+	cleanup_entropy(&ectx);
 	dns_name_destroy();
 	if (verbose > 10)
 		isc_mem_stats(mctx, stdout);

bin/dnssec/dnssec-keyfromlabel.8

@@ -55,7 +55,7 @@ of the key is specified on the command line\&. This must match the name of the z
 .RS 4
 Selects the cryptographic algorithm\&. The value of
 \fBalgorithm\fR
-must be one of RSAMD5, RSASHA1, DSA, NSEC3RSASHA1, NSEC3DSA, RSASHA256, RSASHA512, ECDSAP256SHA256, ECDSAP384SHA384, ED25519 or ED448\&.
+must be one of RSAMD5, RSASHA1, DSA, NSEC3RSASHA1, NSEC3DSA, RSASHA256, RSASHA512, ECCGOST, ECDSAP256SHA256, ECDSAP384SHA384, ED25519 or ED448\&.
 .sp
 If no algorithm is specified, then RSASHA1 will be used by default, unless the
 \fB\-3\fR

bin/dnssec/dnssec-keyfromlabel.c

@@ -18,6 +18,7 @@
 
 #include <isc/buffer.h>
 #include <isc/commandline.h>
+#include <isc/entropy.h>
 #include <isc/mem.h>
 #include <isc/region.h>
 #include <isc/print.h>
@@ -37,7 +38,7 @@
 
 #include <dst/dst.h>
 
-#if USE_PKCS11
+#ifdef PKCS11CRYPTO
 #include <pk11/result.h>
 #endif
 
@@ -64,14 +65,17 @@ usage(void) {
 	fprintf(stderr, "    -a algorithm: \n"
 			"        RSA | RSAMD5 | DH | DSA | RSASHA1 |\n"
 			"        NSEC3DSA | NSEC3RSASHA1 |\n"
-			"        RSASHA256 | RSASHA512 |\n"
+			"        RSASHA256 | RSASHA512 | ECCGOST |\n"
 			"        ECDSAP256SHA256 | ECDSAP384SHA384\n");
 	fprintf(stderr, "    -3: use NSEC3-capable algorithm\n");
 	fprintf(stderr, "    -c class (default: IN)\n");
 	fprintf(stderr, "    -E <engine>:\n");
-#if USE_PKCS11
+#if defined(PKCS11CRYPTO)
 	fprintf(stderr, "        path to PKCS#11 provider library "
 				"(default is %s)\n", PK11_LIB_LOCATION);
+#elif defined(USE_PKCS11)
+	fprintf(stderr, "        name of an OpenSSL engine to use "
+				"(default is \"pkcs11\")\n");
 #else
 	fprintf(stderr, "        name of an OpenSSL engine to use\n");
 #endif
@@ -121,7 +125,11 @@ main(int argc, char **argv) {
 	const char	*directory = NULL;
 	const char	*predecessor = NULL;
 	dst_key_t	*prevkey = NULL;
+#ifdef USE_PKCS11
+	const char	*engine = PKCS11_ENGINE;
+#else
 	const char	*engine = NULL;
+#endif
 	char		*classname = NULL;
 	char		*endp;
 	dst_key_t	*key = NULL;
@@ -138,6 +146,7 @@ main(int argc, char **argv) {
 	char		filename[255];
 	isc_buffer_t	buf;
 	isc_log_t	*log = NULL;
+	isc_entropy_t	*ectx = NULL;
 	dns_rdataclass_t rdclass;
 	int		options = DST_TYPE_PRIVATE | DST_TYPE_PUBLIC;
 	char		*label = NULL;
@@ -166,7 +175,7 @@ main(int argc, char **argv) {
 
 	RUNTIME_CHECK(isc_mem_create(0, 0, &mctx) == ISC_R_SUCCESS);
 
-#if USE_PKCS11
+#ifdef PKCS11CRYPTO
 	pk11_result_register();
 #endif
 	dns_result_register();
@@ -338,7 +347,10 @@ main(int argc, char **argv) {
 		}
 	}
 
-	ret = dst_lib_init(mctx, engine);
+	if (ectx == NULL)
+		setup_entropy(mctx, NULL, &ectx);
+	ret = dst_lib_init2(mctx, ectx, engine,
+			    ISC_ENTROPY_BLOCKING | ISC_ENTROPY_GOODONLY);
 	if (ret != ISC_R_SUCCESS)
 		fatal("could not initialize dst: %s",
 		      isc_result_totext(ret));
@@ -381,10 +393,20 @@ main(int argc, char **argv) {
 		}
 
 		if (strcasecmp(algname, "RSA") == 0) {
+#ifndef PK11_MD5_DISABLE
 			fprintf(stderr, "The use of RSA (RSAMD5) is not "
 					"recommended.\nIf you still wish to "
 					"use RSA (RSAMD5) please specify "
 					"\"-a RSAMD5\"\n");
+#else
+			fprintf(stderr,
+				"The use of RSA (RSAMD5) was disabled\n");
+			if (freeit != NULL)
+				free(freeit);
+			return (1);
+		} else if (strcasecmp(algname, "RSAMD5") == 0) {
+			fprintf(stderr, "The use of RSAMD5 was disabled\n");
+#endif
 			if (freeit != NULL)
 				free(freeit);
 			return (1);
@@ -410,6 +432,7 @@ main(int argc, char **argv) {
 			case DST_ALG_NSEC3RSASHA1:
 			case DST_ALG_RSASHA256:
 			case DST_ALG_RSASHA512:
+			case DST_ALG_ECCGOST:
 			case DST_ALG_ECDSA256:
 			case DST_ALG_ECDSA384:
 			case DST_ALG_ED25519:
@@ -495,6 +518,11 @@ main(int argc, char **argv) {
 		alg = dst_key_alg(prevkey);
 		flags = dst_key_flags(prevkey);
 
+#ifdef PK11_MD5_DISABLE
+		if (alg == DST_ALG_RSAMD5)
+			fatal("Key %s uses disabled RSAMD5", predecessor);
+#endif
+
 		dst_key_format(prevkey, keystr, sizeof(keystr));
 		dst_key_getprivateformat(prevkey, &major, &minor);
 		if (major != DST_MAJOR_VERSION || minor < DST_MINOR_VERSION)
@@ -584,12 +612,13 @@ main(int argc, char **argv) {
 
 	/* associate the key */
 	ret = dst_key_fromlabel(name, alg, flags, protocol, rdclass,
-#if USE_PKCS11
+#ifdef PKCS11CRYPTO
 				"pkcs11",
 #else
 				engine,
 #endif
 				label, NULL, mctx, &key);
+	isc_entropy_stopcallbacksources(ectx);
 
 	if (ret != ISC_R_SUCCESS) {
 		char namestr[DNS_NAME_FORMATSIZE];
@@ -708,6 +737,7 @@ main(int argc, char **argv) {
 		dst_key_free(&prevkey);
 
 	cleanup_logging(&log);
+	cleanup_entropy(&ectx);
 	dst_lib_destroy();
 	dns_name_destroy();
 	if (verbose > 10)

bin/dnssec/dnssec-keyfromlabel.docbook

@@ -106,7 +106,7 @@
 	  <para>
 	    Selects the cryptographic algorithm.  The value of
 	    <option>algorithm</option> must be one of RSAMD5, RSASHA1,
-	    DSA, NSEC3RSASHA1, NSEC3DSA, RSASHA256, RSASHA512,
+	    DSA, NSEC3RSASHA1, NSEC3DSA, RSASHA256, RSASHA512, ECCGOST,
 	    ECDSAP256SHA256, ECDSAP384SHA384, ED25519 or ED448.
 	  </para>
 	  <para>

bin/dnssec/dnssec-keyfromlabel.html

@@ -90,7 +90,7 @@
 	  <p>
 	    Selects the cryptographic algorithm.  The value of
 	    <code class="option">algorithm</code> must be one of RSAMD5, RSASHA1,
-	    DSA, NSEC3RSASHA1, NSEC3DSA, RSASHA256, RSASHA512,
+	    DSA, NSEC3RSASHA1, NSEC3DSA, RSASHA256, RSASHA512, ECCGOST,
 	    ECDSAP256SHA256, ECDSAP384SHA384, ED25519 or ED448.
 	  </p>
 	  <p>

bin/dnssec/dnssec-keygen.8

@@ -39,7 +39,7 @@
 dnssec-keygen \- DNSSEC key generation tool
 .SH "SYNOPSIS"
 .HP \w'\fBdnssec\-keygen\fR\ 'u
-\fBdnssec\-keygen\fR [\fB\-a\ \fR\fB\fIalgorithm\fR\fR] [\fB\-b\ \fR\fB\fIkeysize\fR\fR] [\fB\-n\ \fR\fB\fInametype\fR\fR] [\fB\-3\fR] [\fB\-A\ \fR\fB\fIdate/offset\fR\fR] [\fB\-C\fR] [\fB\-c\ \fR\fB\fIclass\fR\fR] [\fB\-D\ \fR\fB\fIdate/offset\fR\fR] [\fB\-D\ sync\ \fR\fB\fIdate/offset\fR\fR] [\fB\-E\ \fR\fB\fIengine\fR\fR] [\fB\-f\ \fR\fB\fIflag\fR\fR] [\fB\-G\fR] [\fB\-g\ \fR\fB\fIgenerator\fR\fR] [\fB\-h\fR] [\fB\-I\ \fR\fB\fIdate/offset\fR\fR] [\fB\-i\ \fR\fB\fIinterval\fR\fR] [\fB\-K\ \fR\fB\fIdirectory\fR\fR] [\fB\-k\fR] [\fB\-L\ \fR\fB\fIttl\fR\fR] [\fB\-P\ \fR\fB\fIdate/offset\fR\fR] [\fB\-P\ sync\ \fR\fB\fIdate/offset\fR\fR] [\fB\-p\ \fR\fB\fIprotocol\fR\fR] [\fB\-q\fR] [\fB\-R\ \fR\fB\fIdate/offset\fR\fR] [\fB\-S\ \fR\fB\fIkey\fR\fR] [\fB\-s\ \fR\fB\fIstrength\fR\fR] [\fB\-t\ \fR\fB\fItype\fR\fR] [\fB\-V\fR] [\fB\-v\ \fR\fB\fIlevel\fR\fR] [\fB\-z\fR] {name}
+\fBdnssec\-keygen\fR [\fB\-a\ \fR\fB\fIalgorithm\fR\fR] [\fB\-b\ \fR\fB\fIkeysize\fR\fR] [\fB\-n\ \fR\fB\fInametype\fR\fR] [\fB\-3\fR] [\fB\-A\ \fR\fB\fIdate/offset\fR\fR] [\fB\-C\fR] [\fB\-c\ \fR\fB\fIclass\fR\fR] [\fB\-D\ \fR\fB\fIdate/offset\fR\fR] [\fB\-D\ sync\ \fR\fB\fIdate/offset\fR\fR] [\fB\-E\ \fR\fB\fIengine\fR\fR] [\fB\-f\ \fR\fB\fIflag\fR\fR] [\fB\-G\fR] [\fB\-g\ \fR\fB\fIgenerator\fR\fR] [\fB\-h\fR] [\fB\-I\ \fR\fB\fIdate/offset\fR\fR] [\fB\-i\ \fR\fB\fIinterval\fR\fR] [\fB\-K\ \fR\fB\fIdirectory\fR\fR] [\fB\-k\fR] [\fB\-L\ \fR\fB\fIttl\fR\fR] [\fB\-P\ \fR\fB\fIdate/offset\fR\fR] [\fB\-P\ sync\ \fR\fB\fIdate/offset\fR\fR] [\fB\-p\ \fR\fB\fIprotocol\fR\fR] [\fB\-q\fR] [\fB\-R\ \fR\fB\fIdate/offset\fR\fR] [\fB\-r\ \fR\fB\fIrandomdev\fR\fR] [\fB\-S\ \fR\fB\fIkey\fR\fR] [\fB\-s\ \fR\fB\fIstrength\fR\fR] [\fB\-t\ \fR\fB\fItype\fR\fR] [\fB\-V\fR] [\fB\-v\ \fR\fB\fIlevel\fR\fR] [\fB\-z\fR] {name}
 .SH "DESCRIPTION"
 .PP
 \fBdnssec\-keygen\fR
@@ -62,23 +62,23 @@ may be preferable to direct use of
 .RS 4
 Selects the cryptographic algorithm\&. For DNSSEC keys, the value of
 \fBalgorithm\fR
-must be one of RSAMD5, RSASHA1, DSA, NSEC3RSASHA1, NSEC3DSA, RSASHA256, RSASHA512, ECDSAP256SHA256, ECDSAP384SHA384, ED25519 or ED448\&. For TKEY, the value must be DH (Diffie Hellman); specifying his value will automatically set the
+must be one of RSAMD5, RSASHA1, DSA, NSEC3RSASHA1, NSEC3DSA, RSASHA256, RSASHA512, ECCGOST, ECDSAP256SHA256, ECDSAP384SHA384, ED25519 or ED448\&. For TKEY, the value must be DH (Diffie Hellman); specifying his value will automatically set the
 \fB\-T KEY\fR
 option as well\&.
 .sp
+TSIG keys can also be generated by setting the value to one of HMAC\-MD5, HMAC\-SHA1, HMAC\-SHA224, HMAC\-SHA256, HMAC\-SHA384, or HMAC\-SHA512\&. As with DH, specifying these values will automatically set
+\fB\-T KEY\fR\&. Note, however, that
+\fBtsig\-keygen\fR
+produces TSIG keys in a more useful format\&. These algorithms have been deprecated in
+\fBdnssec\-keygen\fR, and will be removed in a future release\&.
+.sp
 These values are case insensitive\&. In some cases, abbreviations are supported, such as ECDSA256 for ECDSAP256SHA256 and ECDSA384 for ECDSAP384SHA384\&. If RSASHA1 or DSA is specified along with the
 \fB\-3\fR
 option, then NSEC3RSASHA1 or NSEC3DSA will be used instead\&.
 .sp
-This parameter
-\fImust\fR
-be specified except when using the
+As of BIND 9\&.12\&.0, this option is mandatory except when using the
 \fB\-S\fR
-option, which copies the algorithm from the predecessor key\&.
-.sp
-In prior releases, HMAC algorithms could be generated for use as TSIG keys, but that feature has been removed as of BIND 9\&.13\&.0\&. Use
-\fBtsig\-keygen\fR
-to generate TSIG keys\&.
+option, which copies the algorithm from the predecessor key\&. Previously, the default for newly generated keys was RSASHA1\&.
 .RE
 .PP
 \-b \fIkeysize\fR
@@ -178,6 +178,21 @@ stderr
 indicating the progress of the key generation\&. A \*(Aq\&.\*(Aq indicates that a random number has been found which passed an initial sieve test; \*(Aq+\*(Aq means a number has passed a single round of the Miller\-Rabin primality test; a space means that the number has passed all the tests and is a satisfactory key\&.
 .RE
 .PP
+\-r \fIrandomdev\fR
+.RS 4
+Specifies a source of randomness\&. Normally, when generating DNSSEC keys, this option has no effect; the random number generation function provided by the cryptographic library will be used\&.
+.sp
+If that behavior is disabled at compile time, however, the specified file will be used as entropy source for key generation\&.
+randomdev
+is the name of a character device or file containing random data to be used\&. The special value
+keyboard
+indicates that keyboard input should be used\&.
+.sp
+The default is
+/dev/random
+if the operating system provides it or an equivalent device; if not, the default source of randomness is keyboard input\&.
+.RE
+.PP
 \-S \fIkey\fR
 .RS 4
 Create a new key which is an explicit successor to an existing key\&. The name, algorithm, size, and type of the key will be set to match the existing key\&. The activation date of the new key will be set to the inactivation date of the existing one\&. The publication date will be set to the activation date minus the prepublication interval, which defaults to 30 days\&.

bin/dnssec/dnssec-keygen.c

@@ -33,6 +33,7 @@
 
 #include <isc/buffer.h>
 #include <isc/commandline.h>
+#include <isc/entropy.h>
 #include <isc/mem.h>
 #include <isc/print.h>
 #include <isc/region.h>
@@ -52,7 +53,7 @@
 
 #include <dst/dst.h>
 
-#if USE_PKCS11
+#ifdef PKCS11CRYPTO
 #include <pk11/result.h>
 #endif
 
@@ -79,9 +80,12 @@ usage(void) {
 	fprintf(stderr, "    -a <algorithm>:\n");
 	fprintf(stderr, "        RSA | RSAMD5 | DSA | RSASHA1 | NSEC3RSASHA1"
 				" | NSEC3DSA |\n");
-	fprintf(stderr, "        RSASHA256 | RSASHA512 |\n");
+	fprintf(stderr, "        RSASHA256 | RSASHA512 | ECCGOST |\n");
 	fprintf(stderr, "        ECDSAP256SHA256 | ECDSAP384SHA384 |\n");
-	fprintf(stderr, "        ED25519 | ED448 | DH\n");
+	fprintf(stderr, "        ED25519 | ED448 | DH |\n");
+	fprintf(stderr, "        HMAC-MD5 | HMAC-SHA1 | HMAC-SHA224 | "
+				"HMAC-SHA256 | \n");
+	fprintf(stderr, "        HMAC-SHA384 | HMAC-SHA512\n");
 	fprintf(stderr, "    -3: use NSEC3-capable algorithm\n");
 	fprintf(stderr, "    -b <key size in bits>:\n");
 	fprintf(stderr, "        RSAMD5:\t[1024..%d]\n", MAX_RSA);
@@ -98,6 +102,12 @@ usage(void) {
 	fprintf(stderr, "        ECDSAP384SHA384:\tignored\n");
 	fprintf(stderr, "        ED25519:\tignored\n");
 	fprintf(stderr, "        ED448:\tignored\n");
+	fprintf(stderr, "        HMAC-MD5:\t[1..512]\n");
+	fprintf(stderr, "        HMAC-SHA1:\t[1..160]\n");
+	fprintf(stderr, "        HMAC-SHA224:\t[1..224]\n");
+	fprintf(stderr, "        HMAC-SHA256:\t[1..256]\n");
+	fprintf(stderr, "        HMAC-SHA384:\t[1..384]\n");
+	fprintf(stderr, "        HMAC-SHA512:\t[1..512]\n");
 	fprintf(stderr, "        (key size defaults are set according to\n"
 			"        algorithm and usage (ZSK or KSK)\n");
 	fprintf(stderr, "    -n <nametype>: ZONE | HOST | ENTITY | "
@@ -106,9 +116,12 @@ usage(void) {
 	fprintf(stderr, "    -c <class>: (default: IN)\n");
 	fprintf(stderr, "    -d <digest bits> (0 => max, default)\n");
 	fprintf(stderr, "    -E <engine>:\n");
-#if USE_PKCS11
+#if defined(PKCS11CRYPTO)
 	fprintf(stderr, "        path to PKCS#11 provider library "
 				"(default is %s)\n", PK11_LIB_LOCATION);
+#elif defined(USE_PKCS11)
+	fprintf(stderr, "        name of an OpenSSL engine to use "
+				"(default is \"pkcs11\")\n");
 #else
 	fprintf(stderr, "        name of an OpenSSL engine to use\n");
 #endif
@@ -117,6 +130,7 @@ usage(void) {
 			"(DH only)\n");
 	fprintf(stderr, "    -L <ttl>: default key TTL\n");
 	fprintf(stderr, "    -p <protocol>: (default: 3 [dnssec])\n");
+	fprintf(stderr, "    -r <randomdev>: a file containing random data\n");
 	fprintf(stderr, "    -s <strength>: strength value this key signs DNS "
 			"records with (default: 0)\n");
 	fprintf(stderr, "    -T <rrtype>: DNSKEY | KEY (default: DNSKEY; "
@@ -213,7 +227,12 @@ main(int argc, char **argv) {
 	dst_key_t	*prevkey = NULL;
 	isc_buffer_t	buf;
 	isc_log_t	*log = NULL;
+	isc_entropy_t	*ectx = NULL;
+#ifdef USE_PKCS11
+	const char	*engine = PKCS11_ENGINE;
+#else
 	const char	*engine = NULL;
+#endif
 	dns_rdataclass_t rdclass;
 	int		options = DST_TYPE_PRIVATE | DST_TYPE_PUBLIC;
 	int		dbits = 0;
@@ -240,7 +259,7 @@ main(int argc, char **argv) {
 	if (argc == 1)
 		usage();
 
-#if USE_PKCS11
+#ifdef PKCS11CRYPTO
 	pk11_result_register();
 #endif
 	dns_result_register();
@@ -355,8 +374,7 @@ main(int argc, char **argv) {
 			quiet = ISC_TRUE;
 			break;
 		case 'r':
-			fatal("The -r option has been deprecated.\n"
-			      "System random data is always used.\n");
+			setup_entropy(mctx, isc_commandline_argument, &ectx);
 			break;
 		case 's':
 			signatory = strtol(isc_commandline_argument,
@@ -485,7 +503,10 @@ main(int argc, char **argv) {
 	if (!isatty(0))
 		quiet = ISC_TRUE;
 
-	ret = dst_lib_init(mctx, engine);
+	if (ectx == NULL)
+		setup_entropy(mctx, NULL, &ectx);
+	ret = dst_lib_init2(mctx, ectx, engine,
+			    ISC_ENTROPY_BLOCKING | ISC_ENTROPY_GOODONLY);
 	if (ret != ISC_R_SUCCESS)
 		fatal("could not initialize dst: %s",
 		      isc_result_totext(ret));
@@ -516,28 +537,66 @@ main(int argc, char **argv) {
 		}
 
 		if (strcasecmp(algname, "RSA") == 0) {
+#ifndef PK11_MD5_DISABLE
 			fprintf(stderr, "The use of RSA (RSAMD5) is not "
 					"recommended.\nIf you still wish to "
 					"use RSA (RSAMD5) please specify "
 					"\"-a RSAMD5\"\n");
 			INSIST(freeit == NULL);
 			return (1);
-		} else {
+		} else if (strcasecmp(algname, "HMAC-MD5") == 0) {
+			alg = DST_ALG_HMACMD5;
+#else
+			fprintf(stderr,
+				"The use of RSA (RSAMD5) was disabled\n");
+			INSIST(freeit == NULL);
+			return (1);
+		} else if (strcasecmp(algname, "RSAMD5") == 0) {
+			fprintf(stderr, "The use of RSAMD5 was disabled\n");
+			INSIST(freeit == NULL);
+			return (1);
+		} else if (strcasecmp(algname, "HMAC-MD5") == 0) {
+			fprintf(stderr,
+				"The use of HMAC-MD5 was disabled\n");
+			return (1);
+#endif
+		} else if (strcasecmp(algname, "HMAC-SHA1") == 0)
+			alg = DST_ALG_HMACSHA1;
+		else if (strcasecmp(algname, "HMAC-SHA224") == 0)
+			alg = DST_ALG_HMACSHA224;
+		else if (strcasecmp(algname, "HMAC-SHA256") == 0)
+			alg = DST_ALG_HMACSHA256;
+		else if (strcasecmp(algname, "HMAC-SHA384") == 0)
+			alg = DST_ALG_HMACSHA384;
+		else if (strcasecmp(algname, "HMAC-SHA512") == 0)
+			alg = DST_ALG_HMACSHA512;
+		else {
 			r.base = algname;
 			r.length = strlen(algname);
 			ret = dns_secalg_fromtext(&alg, &r);
-			if (ret != ISC_R_SUCCESS) {
+			if (ret != ISC_R_SUCCESS)
 				fatal("unknown algorithm %s", algname);
-			}
-			if (alg == DST_ALG_DH) {
+			if (alg == DST_ALG_DH)
 				options |= DST_TYPE_KEY;
-			}
 		}
 
-		if (!dst_algorithm_supported(alg)) {
-			fatal("unsupported algorithm: %d", alg);
+#ifdef PK11_MD5_DISABLE
+		INSIST((alg != DNS_KEYALG_RSAMD5) && (alg != DST_ALG_HMACMD5));
+#endif
+
+
+		if (alg == DST_ALG_HMACMD5 || alg == DST_ALG_HMACSHA1 ||
+		    alg == DST_ALG_HMACSHA224 || alg == DST_ALG_HMACSHA256 ||
+		    alg == DST_ALG_HMACSHA384 || alg == DST_ALG_HMACSHA512)
+		{
+			fprintf(stderr,
+				"Use of dnssec-keygen for HMAC keys is "
+				"deprecated: use tsig-keygen\n");
 		}
 
+		if (!dst_algorithm_supported(alg))
+			fatal("unsupported algorithm: %d", alg);
+
 		if (use_nsec3) {
 			switch (alg) {
 			case DST_ALG_DSA:
@@ -563,20 +622,20 @@ main(int argc, char **argv) {
 		}
 
 		if (type != NULL && (options & DST_TYPE_KEY) != 0) {
-			if (strcasecmp(type, "NOAUTH") == 0) {
+			if (strcasecmp(type, "NOAUTH") == 0)
 				flags |= DNS_KEYTYPE_NOAUTH;
-			} else if (strcasecmp(type, "NOCONF") == 0) {
+			else if (strcasecmp(type, "NOCONF") == 0)
 				flags |= DNS_KEYTYPE_NOCONF;
-			} else if (strcasecmp(type, "NOAUTHCONF") == 0) {
+			else if (strcasecmp(type, "NOAUTHCONF") == 0) {
 				flags |= (DNS_KEYTYPE_NOAUTH |
 					  DNS_KEYTYPE_NOCONF);
 				if (size < 0)
 					size = 0;
-			} else if (strcasecmp(type, "AUTHCONF") == 0) {
-				/* nothing */;
-			} else {
-				fatal("invalid type %s", type);
 			}
+			else if (strcasecmp(type, "AUTHCONF") == 0)
+				/* nothing */;
+			else
+				fatal("invalid type %s", type);
 		}
 
 		if (size < 0) {
@@ -746,18 +805,78 @@ main(int argc, char **argv) {
 	case DST_ALG_ED448:
 		size = 456;
 		break;
+	case DST_ALG_HMACMD5:
+		options |= DST_TYPE_KEY;
+		if (size < 1 || size > 512)
+			fatal("HMAC-MD5 key size %d out of range", size);
+		if (dbits != 0 && (dbits < 80 || dbits > 128))
+			fatal("HMAC-MD5 digest bits %d out of range", dbits);
+		if ((dbits % 8) != 0)
+			fatal("HMAC-MD5 digest bits %d not divisible by 8",
+			      dbits);
+		break;
+	case DST_ALG_HMACSHA1:
+		options |= DST_TYPE_KEY;
+		if (size < 1 || size > 160)
+			fatal("HMAC-SHA1 key size %d out of range", size);
+		if (dbits != 0 && (dbits < 80 || dbits > 160))
+			fatal("HMAC-SHA1 digest bits %d out of range", dbits);
+		if ((dbits % 8) != 0)
+			fatal("HMAC-SHA1 digest bits %d not divisible by 8",
+			      dbits);
+		break;
+	case DST_ALG_HMACSHA224:
+		options |= DST_TYPE_KEY;
+		if (size < 1 || size > 224)
+			fatal("HMAC-SHA224 key size %d out of range", size);
+		if (dbits != 0 && (dbits < 112 || dbits > 224))
+			fatal("HMAC-SHA224 digest bits %d out of range", dbits);
+		if ((dbits % 8) != 0)
+			fatal("HMAC-SHA224 digest bits %d not divisible by 8",
+			      dbits);
+		break;
+	case DST_ALG_HMACSHA256:
+		options |= DST_TYPE_KEY;
+		if (size < 1 || size > 256)
+			fatal("HMAC-SHA256 key size %d out of range", size);
+		if (dbits != 0 && (dbits < 128 || dbits > 256))
+			fatal("HMAC-SHA256 digest bits %d out of range", dbits);
+		if ((dbits % 8) != 0)
+			fatal("HMAC-SHA256 digest bits %d not divisible by 8",
+			      dbits);
+		break;
+	case DST_ALG_HMACSHA384:
+		options |= DST_TYPE_KEY;
+		if (size < 1 || size > 384)
+			fatal("HMAC-384 key size %d out of range", size);
+		if (dbits != 0 && (dbits < 192 || dbits > 384))
+			fatal("HMAC-SHA384 digest bits %d out of range", dbits);
+		if ((dbits % 8) != 0)
+			fatal("HMAC-SHA384 digest bits %d not divisible by 8",
+			      dbits);
+		break;
+	case DST_ALG_HMACSHA512:
+		options |= DST_TYPE_KEY;
+		if (size < 1 || size > 512)
+			fatal("HMAC-SHA512 key size %d out of range", size);
+		if (dbits != 0 && (dbits < 256 || dbits > 512))
+			fatal("HMAC-SHA512 digest bits %d out of range", dbits);
+		if ((dbits % 8) != 0)
+			fatal("HMAC-SHA512 digest bits %d not divisible by 8",
+			      dbits);
+		break;
 	}
 
 	if (alg != DNS_KEYALG_DH && generator != 0)
 		fatal("specified DH generator for a non-DH key");
 
 	if (nametype == NULL) {
-		if ((options & DST_TYPE_KEY) != 0) /* KEY */
+		if ((options & DST_TYPE_KEY) != 0) /* KEY / HMAC */
 			fatal("no nametype specified");
 		flags |= DNS_KEYOWNER_ZONE;	/* DNSKEY */
 	} else if (strcasecmp(nametype, "zone") == 0)
 		flags |= DNS_KEYOWNER_ZONE;
-	else if ((options & DST_TYPE_KEY) != 0)	{ /* KEY */
+	else if ((options & DST_TYPE_KEY) != 0)	{ /* KEY / HMAC */
 		if (strcasecmp(nametype, "host") == 0 ||
 			 strcasecmp(nametype, "entity") == 0)
 			flags |= DNS_KEYOWNER_ENTITY;
@@ -773,7 +892,7 @@ main(int argc, char **argv) {
 	if (directory == NULL)
 		directory = ".";
 
-	if ((options & DST_TYPE_KEY) != 0)  /* KEY */
+	if ((options & DST_TYPE_KEY) != 0)  /* KEY / HMAC */
 		flags |= signatory;
 	else if ((flags & DNS_KEYOWNER_ZONE) != 0) { /* DNSKEY */
 		flags |= kskflag;
@@ -794,11 +913,12 @@ main(int argc, char **argv) {
 	}
 
 	if ((flags & DNS_KEYFLAG_OWNERMASK) == DNS_KEYOWNER_ZONE &&
-	    alg == DNS_KEYALG_DH)
-	{
+	    (alg == DNS_KEYALG_DH || alg == DST_ALG_HMACMD5 ||
+	     alg == DST_ALG_HMACSHA1 || alg == DST_ALG_HMACSHA224 ||
+	     alg == DST_ALG_HMACSHA256 || alg == DST_ALG_HMACSHA384 ||
+	     alg == DST_ALG_HMACSHA512))
 		fatal("a key with algorithm '%s' cannot be a zone key",
 		      algname);
-	}
 
 	switch(alg) {
 	case DNS_KEYALG_RSAMD5:
@@ -821,6 +941,15 @@ main(int argc, char **argv) {
 	case DST_ALG_ED25519:
 	case DST_ALG_ED448:
 		show_progress = ISC_TRUE;
+		/* fall through */
+
+	case DST_ALG_HMACMD5:
+	case DST_ALG_HMACSHA1:
+	case DST_ALG_HMACSHA224:
+	case DST_ALG_HMACSHA256:
+	case DST_ALG_HMACSHA384:
+	case DST_ALG_HMACSHA512:
+		param = 0;
 		break;
 	}
 
@@ -834,17 +963,19 @@ main(int argc, char **argv) {
 
 		if (!quiet && show_progress) {
 			fprintf(stderr, "Generating key pair.");
-			ret = dst_key_generate(name, alg, size, param, flags,
-					       protocol, rdclass, mctx, &key,
-					       &progress);
+			ret = dst_key_generate2(name, alg, size, param, flags,
+						protocol, rdclass, mctx, &key,
+						&progress);
 			putc('\n', stderr);
 			fflush(stderr);
 		} else {
-			ret = dst_key_generate(name, alg, size, param, flags,
-					       protocol, rdclass, mctx, &key,
-					       NULL);
+			ret = dst_key_generate2(name, alg, size, param, flags,
+						protocol, rdclass, mctx, &key,
+						NULL);
 		}
 
+		isc_entropy_stopcallbacksources(ectx);
+
 		if (ret != ISC_R_SUCCESS) {
 			char namestr[DNS_NAME_FORMATSIZE];
 			char algstr[DNS_SECALG_FORMATSIZE];
@@ -997,6 +1128,7 @@ main(int argc, char **argv) {
 		dst_key_free(&prevkey);
 
 	cleanup_logging(&log);
+	cleanup_entropy(&ectx);
 	dst_lib_destroy();
 	dns_name_destroy();
 	if (verbose > 10)

bin/dnssec/dnssec-keygen.docbook

@@ -81,6 +81,7 @@
       <arg choice="opt" rep="norepeat"><option>-p <replaceable class="parameter">protocol</replaceable></option></arg>
       <arg choice="opt" rep="norepeat"><option>-q</option></arg>
       <arg choice="opt" rep="norepeat"><option>-R <replaceable class="parameter">date/offset</replaceable></option></arg>
+      <arg choice="opt" rep="norepeat"><option>-r <replaceable class="parameter">randomdev</replaceable></option></arg>
       <arg choice="opt" rep="norepeat"><option>-S <replaceable class="parameter">key</replaceable></option></arg>
       <arg choice="opt" rep="norepeat"><option>-s <replaceable class="parameter">strength</replaceable></option></arg>
       <arg choice="opt" rep="norepeat"><option>-t <replaceable class="parameter">type</replaceable></option></arg>
@@ -123,12 +124,22 @@
 	  <para>
 	    Selects the cryptographic algorithm.  For DNSSEC keys, the value
 	    of <option>algorithm</option> must be one of RSAMD5, RSASHA1,
-	    DSA, NSEC3RSASHA1, NSEC3DSA, RSASHA256, RSASHA512,
+	    DSA, NSEC3RSASHA1, NSEC3DSA, RSASHA256, RSASHA512, ECCGOST,
 	    ECDSAP256SHA256, ECDSAP384SHA384, ED25519 or ED448.  For
 	    TKEY, the value must be DH (Diffie Hellman); specifying
 	    his value will automatically set the <option>-T KEY</option>
 	    option as well.
 	  </para>
+	  <para>
+	    TSIG keys can also be generated by setting the value to
+	    one of HMAC-MD5, HMAC-SHA1, HMAC-SHA224, HMAC-SHA256,
+	    HMAC-SHA384, or HMAC-SHA512.  As with DH, specifying these
+	    values will automatically set <option>-T KEY</option>. Note,
+	    however, that <command>tsig-keygen</command> produces TSIG keys
+	    in a more useful format. These algorithms have been deprecated
+	    in <command>dnssec-keygen</command>, and will be removed in a
+	    future release.
+	  </para>
 	  <para>
 	    These values are case insensitive. In some cases, abbreviations
 	    are supported, such as ECDSA256 for ECDSAP256SHA256 and
@@ -137,15 +148,10 @@
 	    or NSEC3DSA will be used instead.
 	  </para>
 	  <para>
-	    This parameter <emphasis>must</emphasis> be specified except
-	    when using the <option>-S</option> option, which copies the
-	    algorithm from the predecessor key.
-	  </para>
-	  <para>
-	    In prior releases, HMAC algorithms could be generated for
-	    use as TSIG keys, but that feature has been removed as of
-	    BIND 9.13.0. Use <command>tsig-keygen</command> to generate
-	    TSIG keys.
+	    As of BIND 9.12.0, this option is mandatory except when using
+	    the <option>-S</option> option, which copies the algorithm from
+	    the predecessor key.  Previously, the default for newly
+	    generated keys was RSASHA1.
 	  </para>
 	</listitem>
       </varlistentry>
@@ -348,6 +354,31 @@
 	</listitem>
       </varlistentry>
 
+      <varlistentry>
+	<term>-r <replaceable class="parameter">randomdev</replaceable></term>
+	<listitem>
+	  <para>
+	    Specifies a source of randomness.  Normally, when generating
+	    DNSSEC keys, this option has no effect; the random number
+	    generation function provided by the cryptographic library will
+	    be used.
+	  </para>
+	  <para>
+	    If that behavior is disabled at compile time, however,
+	    the specified file will be used as entropy source
+	    for key generation.  <filename>randomdev</filename> is
+	    the name of a character device or file containing random
+	    data to be used.  The special value <filename>keyboard</filename>
+	    indicates that keyboard input should be used.
+	  </para>
+	  <para>
+	    The default is <filename>/dev/random</filename> if the
+	    operating system provides it or an equivalent device;
+	    if not, the default source of randomness is keyboard input.
+	  </para>
+	</listitem>
+      </varlistentry>
+
       <varlistentry>
 	<term>-S <replaceable class="parameter">key</replaceable></term>
 	<listitem>

bin/dnssec/dnssec-keygen.html

@@ -57,6 +57,7 @@
        [<code class="option">-p <em class="replaceable"><code>protocol</code></em></code>]
        [<code class="option">-q</code>]
        [<code class="option">-R <em class="replaceable"><code>date/offset</code></em></code>]
+       [<code class="option">-r <em class="replaceable"><code>randomdev</code></em></code>]
        [<code class="option">-S <em class="replaceable"><code>key</code></em></code>]
        [<code class="option">-s <em class="replaceable"><code>strength</code></em></code>]
        [<code class="option">-t <em class="replaceable"><code>type</code></em></code>]
@@ -100,12 +101,22 @@
 	  <p>
 	    Selects the cryptographic algorithm.  For DNSSEC keys, the value
 	    of <code class="option">algorithm</code> must be one of RSAMD5, RSASHA1,
-	    DSA, NSEC3RSASHA1, NSEC3DSA, RSASHA256, RSASHA512,
+	    DSA, NSEC3RSASHA1, NSEC3DSA, RSASHA256, RSASHA512, ECCGOST,
 	    ECDSAP256SHA256, ECDSAP384SHA384, ED25519 or ED448.  For
 	    TKEY, the value must be DH (Diffie Hellman); specifying
 	    his value will automatically set the <code class="option">-T KEY</code>
 	    option as well.
 	  </p>
+	  <p>
+	    TSIG keys can also be generated by setting the value to
+	    one of HMAC-MD5, HMAC-SHA1, HMAC-SHA224, HMAC-SHA256,
+	    HMAC-SHA384, or HMAC-SHA512.  As with DH, specifying these
+	    values will automatically set <code class="option">-T KEY</code>. Note,
+	    however, that <span class="command"><strong>tsig-keygen</strong></span> produces TSIG keys
+	    in a more useful format. These algorithms have been deprecated
+	    in <span class="command"><strong>dnssec-keygen</strong></span>, and will be removed in a
+	    future release.
+	  </p>
 	  <p>
 	    These values are case insensitive. In some cases, abbreviations
 	    are supported, such as ECDSA256 for ECDSAP256SHA256 and
@@ -114,15 +125,10 @@
 	    or NSEC3DSA will be used instead.
 	  </p>
 	  <p>
-	    This parameter <span class="emphasis"><em>must</em></span> be specified except
-	    when using the <code class="option">-S</code> option, which copies the
-	    algorithm from the predecessor key.
-	  </p>
-	  <p>
-	    In prior releases, HMAC algorithms could be generated for
-	    use as TSIG keys, but that feature has been removed as of
-	    BIND 9.13.0. Use <span class="command"><strong>tsig-keygen</strong></span> to generate
-	    TSIG keys.
+	    As of BIND 9.12.0, this option is mandatory except when using
+	    the <code class="option">-S</code> option, which copies the algorithm from
+	    the predecessor key.  Previously, the default for newly
+	    generated keys was RSASHA1.
 	  </p>
 	</dd>
 <dt><span class="term">-b <em class="replaceable"><code>keysize</code></em></span></dt>
@@ -278,6 +284,28 @@
 	    a satisfactory key.
 	  </p>
 	</dd>
+<dt><span class="term">-r <em class="replaceable"><code>randomdev</code></em></span></dt>
+<dd>
+	  <p>
+	    Specifies a source of randomness.  Normally, when generating
+	    DNSSEC keys, this option has no effect; the random number
+	    generation function provided by the cryptographic library will
+	    be used.
+	  </p>
+	  <p>
+	    If that behavior is disabled at compile time, however,
+	    the specified file will be used as entropy source
+	    for key generation.  <code class="filename">randomdev</code> is
+	    the name of a character device or file containing random
+	    data to be used.  The special value <code class="filename">keyboard</code>
+	    indicates that keyboard input should be used.
+	  </p>
+	  <p>
+	    The default is <code class="filename">/dev/random</code> if the
+	    operating system provides it or an equivalent device;
+	    if not, the default source of randomness is keyboard input.
+	  </p>
+	</dd>
 <dt><span class="term">-S <em class="replaceable"><code>key</code></em></span></dt>
 <dd>
 	  <p>

bin/dnssec/dnssec-revoke.c

@@ -18,6 +18,7 @@
 
 #include <isc/buffer.h>
 #include <isc/commandline.h>
+#include <isc/entropy.h>
 #include <isc/file.h>
 #include <isc/hash.h>
 #include <isc/mem.h>
@@ -30,7 +31,7 @@
 
 #include <dst/dst.h>
 
-#if USE_PKCS11
+#ifdef PKCS11CRYPTO
 #include <pk11/result.h>
 #endif
 
@@ -49,9 +50,12 @@ usage(void) {
 	fprintf(stderr, "Usage:\n");
 	fprintf(stderr,	"    %s [options] keyfile\n\n", program);
 	fprintf(stderr, "Version: %s\n", VERSION);
-#if USE_PKCS11
+#if defined(PKCS11CRYPTO)
 	fprintf(stderr, "    -E engine:    specify PKCS#11 provider "
 					"(default: %s)\n", PK11_LIB_LOCATION);
+#elif defined(USE_PKCS11)
+	fprintf(stderr, "    -E engine:    specify OpenSSL engine "
+					   "(default \"pkcs11\")\n");
 #else
 	fprintf(stderr, "    -E engine:    specify OpenSSL engine\n");
 #endif
@@ -72,13 +76,18 @@ usage(void) {
 int
 main(int argc, char **argv) {
 	isc_result_t result;
+#ifdef USE_PKCS11
+	const char *engine = PKCS11_ENGINE;
+#else
 	const char *engine = NULL;
+#endif
 	char const *filename = NULL;
 	char *dir = NULL;
 	char newname[1024], oldname[1024];
 	char keystr[DST_KEY_FORMATSIZE];
 	char *endp;
 	int ch;
+	isc_entropy_t *ectx = NULL;
 	dst_key_t *key = NULL;
 	isc_uint32_t flags;
 	isc_buffer_t buf;
@@ -93,7 +102,7 @@ main(int argc, char **argv) {
 	if (result != ISC_R_SUCCESS)
 		fatal("Out of memory");
 
-#if HAVE_PKCS11
+#ifdef PKCS11CRYPTO
 	pk11_result_register();
 #endif
 	dns_result_register();
@@ -171,10 +180,17 @@ main(int argc, char **argv) {
 		}
 	}
 
-	result = dst_lib_init(mctx, engine);
+	if (ectx == NULL)
+		setup_entropy(mctx, NULL, &ectx);
+	result = dst_lib_init2(mctx, ectx, engine,
+			       ISC_ENTROPY_BLOCKING | ISC_ENTROPY_GOODONLY);
 	if (result != ISC_R_SUCCESS)
 		fatal("Could not initialize dst: %s",
 		      isc_result_totext(result));
+	result = isc_hash_create(mctx, ectx, DNS_NAME_MAXWIRE);
+	if (result != ISC_R_SUCCESS)
+		fatal("Could not initialize hash");
+	isc_entropy_stopcallbacksources(ectx);
 
 	result = dst_key_fromnamedfile(filename, dir,
 				       DST_TYPE_PUBLIC|DST_TYPE_PRIVATE,
@@ -255,7 +271,9 @@ main(int argc, char **argv) {
 
 cleanup:
 	dst_key_free(&key);
+	isc_hash_destroy();
 	dst_lib_destroy();
+	cleanup_entropy(&ectx);
 	if (verbose > 10)
 		isc_mem_stats(mctx, stdout);
 	if (dir != NULL)

bin/dnssec/dnssec-settime.c

@@ -20,6 +20,7 @@
 
 #include <isc/buffer.h>
 #include <isc/commandline.h>
+#include <isc/entropy.h>
 #include <isc/file.h>
 #include <isc/hash.h>
 #include <isc/mem.h>
@@ -33,7 +34,7 @@
 
 #include <dst/dst.h>
 
-#if USE_PKCS11
+#ifdef PKCS11CRYPTO
 #include <pk11/result.h>
 #endif
 
@@ -53,7 +54,7 @@ usage(void) {
 	fprintf(stderr,	"    %s [options] keyfile\n\n", program);
 	fprintf(stderr, "Version: %s\n", VERSION);
 	fprintf(stderr, "General options:\n");
-#if USE_PKCS11
+#if defined(PKCS11CRYPTO)
 	fprintf(stderr, "    -E engine:          specify PKCS#11 provider "
 					"(default: %s)\n", PK11_LIB_LOCATION);
 #elif defined(USE_PKCS11)
@@ -127,13 +128,18 @@ printtime(dst_key_t *key, int type, const char *tag, isc_boolean_t epoch,
 int
 main(int argc, char **argv) {
 	isc_result_t	result;
+#ifdef USE_PKCS11
+	const char	*engine = PKCS11_ENGINE;
+#else
 	const char	*engine = NULL;
+#endif
 	const char 	*filename = NULL;
 	char		*directory = NULL;
 	char		newname[1024];
 	char		keystr[DST_KEY_FORMATSIZE];
 	char		*endp, *p;
 	int		ch;
+	isc_entropy_t	*ectx = NULL;
 	const char	*predecessor = NULL;
 	dst_key_t	*prevkey = NULL;
 	dst_key_t	*key = NULL;
@@ -174,7 +180,7 @@ main(int argc, char **argv) {
 
 	setup_logging(mctx, &log);
 
-#if USE_PKCS11
+#ifdef PKCS11CRYPTO
 	pk11_result_register();
 #endif
 	dns_result_register();
@@ -372,10 +378,17 @@ main(int argc, char **argv) {
 	if (argc > isc_commandline_index + 1)
 		fatal("Extraneous arguments");
 
-	result = dst_lib_init(mctx, engine);
+	if (ectx == NULL)
+		setup_entropy(mctx, NULL, &ectx);
+	result = dst_lib_init2(mctx, ectx, engine,
+			       ISC_ENTROPY_BLOCKING | ISC_ENTROPY_GOODONLY);
 	if (result != ISC_R_SUCCESS)
 		fatal("Could not initialize dst: %s",
 		      isc_result_totext(result));
+	result = isc_hash_create(mctx, ectx, DNS_NAME_MAXWIRE);
+	if (result != ISC_R_SUCCESS)
+		fatal("Could not initialize hash");
+	isc_entropy_stopcallbacksources(ectx);
 
 	if (predecessor != NULL) {
 		int major, minor;
@@ -659,7 +672,9 @@ main(int argc, char **argv) {
 	if (prevkey != NULL)
 		dst_key_free(&prevkey);
 	dst_key_free(&key);
+	isc_hash_destroy();
 	dst_lib_destroy();
+	cleanup_entropy(&ectx);
 	if (verbose > 10)
 		isc_mem_stats(mctx, stdout);
 	cleanup_logging(&log);

bin/dnssec/dnssec-signzone.8

@@ -39,7 +39,7 @@
 dnssec-signzone \- DNSSEC zone signing tool
 .SH "SYNOPSIS"
 .HP \w'\fBdnssec\-signzone\fR\ 'u
-\fBdnssec\-signzone\fR [\fB\-a\fR] [\fB\-c\ \fR\fB\fIclass\fR\fR] [\fB\-d\ \fR\fB\fIdirectory\fR\fR] [\fB\-D\fR] [\fB\-E\ \fR\fB\fIengine\fR\fR] [\fB\-e\ \fR\fB\fIend\-time\fR\fR] [\fB\-f\ \fR\fB\fIoutput\-file\fR\fR] [\fB\-g\fR] [\fB\-h\fR] [\fB\-i\ \fR\fB\fIinterval\fR\fR] [\fB\-I\ \fR\fB\fIinput\-format\fR\fR] [\fB\-j\ \fR\fB\fIjitter\fR\fR] [\fB\-K\ \fR\fB\fIdirectory\fR\fR] [\fB\-k\ \fR\fB\fIkey\fR\fR] [\fB\-L\ \fR\fB\fIserial\fR\fR] [\fB\-l\ \fR\fB\fIdomain\fR\fR] [\fB\-M\ \fR\fB\fImaxttl\fR\fR] [\fB\-N\ \fR\fB\fIsoa\-serial\-format\fR\fR] [\fB\-o\ \fR\fB\fIorigin\fR\fR] [\fB\-O\ \fR\fB\fIoutput\-format\fR\fR] [\fB\-P\fR] [\fB\-Q\fR] [\fB\-R\fR] [\fB\-S\fR] [\fB\-s\ \fR\fB\fIstart\-time\fR\fR] [\fB\-T\ \fR\fB\fIttl\fR\fR] [\fB\-t\fR] [\fB\-u\fR] [\fB\-v\ \fR\fB\fIlevel\fR\fR] [\fB\-V\fR] [\fB\-X\ \fR\fB\fIextended\ end\-time\fR\fR] [\fB\-x\fR] [\fB\-z\fR] [\fB\-3\ \fR\fB\fIsalt\fR\fR] [\fB\-H\ \fR\fB\fIiterations\fR\fR] [\fB\-A\fR] {zonefile} [key...]
+\fBdnssec\-signzone\fR [\fB\-a\fR] [\fB\-c\ \fR\fB\fIclass\fR\fR] [\fB\-d\ \fR\fB\fIdirectory\fR\fR] [\fB\-D\fR] [\fB\-E\ \fR\fB\fIengine\fR\fR] [\fB\-e\ \fR\fB\fIend\-time\fR\fR] [\fB\-f\ \fR\fB\fIoutput\-file\fR\fR] [\fB\-g\fR] [\fB\-h\fR] [\fB\-i\ \fR\fB\fIinterval\fR\fR] [\fB\-I\ \fR\fB\fIinput\-format\fR\fR] [\fB\-j\ \fR\fB\fIjitter\fR\fR] [\fB\-K\ \fR\fB\fIdirectory\fR\fR] [\fB\-k\ \fR\fB\fIkey\fR\fR] [\fB\-L\ \fR\fB\fIserial\fR\fR] [\fB\-l\ \fR\fB\fIdomain\fR\fR] [\fB\-M\ \fR\fB\fImaxttl\fR\fR] [\fB\-N\ \fR\fB\fIsoa\-serial\-format\fR\fR] [\fB\-o\ \fR\fB\fIorigin\fR\fR] [\fB\-O\ \fR\fB\fIoutput\-format\fR\fR] [\fB\-P\fR] [\fB\-p\fR] [\fB\-Q\fR] [\fB\-R\fR] [\fB\-r\ \fR\fB\fIrandomdev\fR\fR] [\fB\-S\fR] [\fB\-s\ \fR\fB\fIstart\-time\fR\fR] [\fB\-T\ \fR\fB\fIttl\fR\fR] [\fB\-t\fR] [\fB\-u\fR] [\fB\-v\ \fR\fB\fIlevel\fR\fR] [\fB\-V\fR] [\fB\-X\ \fR\fB\fIextended\ end\-time\fR\fR] [\fB\-x\fR] [\fB\-z\fR] [\fB\-3\ \fR\fB\fIsalt\fR\fR] [\fB\-H\ \fR\fB\fIiterations\fR\fR] [\fB\-A\fR] {zonefile} [key...]
 .SH "DESCRIPTION"
 .PP
 \fBdnssec\-signzone\fR
@@ -278,6 +278,11 @@ specifies the format version of the raw zone file: if N is 0, the raw file can b
 \fBnamed\fR; if N is 1, the file can be read by release 9\&.9\&.0 or higher; the default is 1\&.
 .RE
 .PP
+\-p
+.RS 4
+Use pseudo\-random data when signing the zone\&. This is faster, but less secure, than using real random data\&. This option may be useful when signing large zones or when the entropy source is limited\&.
+.RE
+.PP
 \-P
 .RS 4
 Disable post sign verification tests\&.
@@ -306,6 +311,17 @@ This option is similar to
 to signatures from keys that are no longer published\&. This enables ZSK rollover using the procedure described in RFC 4641, section 4\&.2\&.1\&.2 ("Double Signature Zone Signing Key Rollover")\&.
 .RE
 .PP
+\-r \fIrandomdev\fR
+.RS 4
+Specifies the source of randomness\&. If the operating system does not provide a
+/dev/random
+or equivalent device, the default source of randomness is keyboard input\&.
+randomdev
+specifies the name of a character device or file containing random data to be used instead of the default\&. The special value
+keyboard
+indicates that keyboard input should be used\&.
+.RE
+.PP
 \-S
 .RS 4
 Smart signing: Instructs

bin/dnssec/dnssec-signzone.c

@@ -34,6 +34,7 @@
 #include <isc/app.h>
 #include <isc/base32.h>
 #include <isc/commandline.h>
+#include <isc/entropy.h>
 #include <isc/event.h>
 #include <isc/file.h>
 #include <isc/hash.h>
@@ -76,11 +77,10 @@
 #include <dns/soa.h>
 #include <dns/time.h>
 #include <dns/update.h>
-#include <dns/zoneverify.h>
 
 #include <dst/dst.h>
 
-#if USE_PKCS11
+#ifdef PKCS11CRYPTO
 #include <pk11/result.h>
 #endif
 
@@ -97,10 +97,6 @@ typedef struct hashlist hashlist_t;
 
 static int nsec_datatype = dns_rdatatype_nsec;
 
-#define check_dns_dbiterator_current(result) \
-	check_result((result == DNS_R_NEWORIGIN) ? ISC_R_SUCCESS : result, \
-		     "dns_dbiterator_current()")
-
 #define IS_NSEC3	(nsec_datatype == dns_rdatatype_nsec3)
 #define OPTOUT(x)	(((x) & DNS_NSEC3FLAG_OPTOUT) != 0)
 
@@ -134,6 +130,7 @@ static int jitter = 0;
 static isc_boolean_t tryverify = ISC_FALSE;
 static isc_boolean_t printstats = ISC_FALSE;
 static isc_mem_t *mctx = NULL;
+static isc_entropy_t *ectx = NULL;
 static dns_ttl_t zone_soa_min_ttl;
 static dns_ttl_t soa_ttl;
 static FILE *outfp = NULL;
@@ -298,10 +295,11 @@ signwithkey(dns_name_t *name, dns_rdataset_t *rdataset, dst_key_t *key,
 	else
 		expiry = endtime;
 
-	jendtime = (jitter != 0) ? expiry - isc_random_uniform(jitter) : expiry;
+	jendtime = (jitter != 0) ? isc_random_jitter(expiry, jitter) : expiry;
 	isc_buffer_init(&b, array, sizeof(array));
 	result = dns_dnssec_sign(name, rdataset, key, &starttime, &jendtime,
 				 mctx, &b, &trdata);
+	isc_entropy_stopcallbacksources(ectx);
 	if (result != ISC_R_SUCCESS) {
 		fatal("dnskey '%s' failed to sign data: %s",
 		      keystr, isc_result_totext(result));
@@ -310,8 +308,8 @@ signwithkey(dns_name_t *name, dns_rdataset_t *rdataset, dst_key_t *key,
 
 	if (tryverify) {
 		result = dns_dnssec_verify(name, rdataset, key,
-					   ISC_TRUE, 0, mctx, &trdata, NULL);
-		if (result == ISC_R_SUCCESS || result == DNS_R_FROMWILDCARD) {
+					   ISC_TRUE, mctx, &trdata);
+		if (result == ISC_R_SUCCESS) {
 			vbprintf(3, "\tsignature verified\n");
 			INCSTAT(nverified);
 		} else {
@@ -471,9 +469,8 @@ setverifies(dns_name_t *name, dns_rdataset_t *set, dst_key_t *key,
 	    dns_rdata_t *rrsig)
 {
 	isc_result_t result;
-	result = dns_dnssec_verify(name, set, key, ISC_FALSE, 0, mctx, rrsig,
-				   NULL);
-	if (result == ISC_R_SUCCESS || result == DNS_R_FROMWILDCARD) {
+	result = dns_dnssec_verify(name, set, key, ISC_FALSE, mctx, rrsig);
+	if (result == ISC_R_SUCCESS) {
 		INCSTAT(nverified);
 		return (ISC_TRUE);
 	} else {
@@ -503,11 +500,11 @@ signset(dns_diff_t *del, dns_diff_t *add, dns_dbnode_t *node, dns_name_t *name,
 	dns_ttl_t ttl;
 	int i;
 	char namestr[DNS_NAME_FORMATSIZE];
-	char typestr[DNS_RDATATYPE_FORMATSIZE];
+	char typestr[TYPE_FORMATSIZE];
 	char sigstr[SIG_FORMATSIZE];
 
 	dns_name_format(name, namestr, sizeof(namestr));
-	dns_rdatatype_format(set->type, typestr, sizeof(typestr));
+	type_format(set->type, typestr, sizeof(typestr));
 
 	ttl = ISC_MIN(set->ttl, endtime - starttime);
 
@@ -789,7 +786,7 @@ hashlist_add_dns_name(hashlist_t *l, /*const*/ dns_name_t *name,
 
 static int
 hashlist_comp(const void *a, const void *b) {
-	return (memcmp(a, b, hash_length + 1));
+	return (isc_safe_memcompare(a, b, hash_length + 1));
 }
 
 static void
@@ -920,7 +917,7 @@ opendb(const char *prefix, dns_name_t *name, dns_rdataclass_t rdclass,
 			       rdclass, 0, NULL, dbp);
 	check_result(result, "dns_db_create()");
 
-	result = dns_db_load(*dbp, filename, inputformat, DNS_MASTER_HINT);
+	result = dns_db_load3(*dbp, filename, inputformat, DNS_MASTER_HINT);
 	if (result != ISC_R_SUCCESS && result != DNS_R_SEENINCLUDE)
 		dns_db_detach(dbp);
 }
@@ -1047,47 +1044,6 @@ secure(dns_name_t *name, dns_dbnode_t *node) {
 	return (ISC_TF(result == ISC_R_SUCCESS));
 }
 
-static isc_boolean_t
-is_delegation(dns_db_t *db, dns_dbversion_t *ver, dns_name_t *origin,
-	      dns_name_t *name, dns_dbnode_t *node, isc_uint32_t *ttlp)
-{
-	dns_rdataset_t nsset;
-	isc_result_t result;
-
-	if (dns_name_equal(name, origin))
-		return (ISC_FALSE);
-
-	dns_rdataset_init(&nsset);
-	result = dns_db_findrdataset(db, node, ver, dns_rdatatype_ns,
-				     0, 0, &nsset, NULL);
-	if (dns_rdataset_isassociated(&nsset)) {
-		if (ttlp != NULL)
-			*ttlp = nsset.ttl;
-		dns_rdataset_disassociate(&nsset);
-	}
-
-	return (ISC_TF(result == ISC_R_SUCCESS));
-}
-
-/*%
- * Return ISC_TRUE if version 'ver' of database 'db' contains a DNAME RRset at
- * 'node'; return ISC_FALSE otherwise.
- */
-static isc_boolean_t
-has_dname(dns_db_t *db, dns_dbversion_t *ver, dns_dbnode_t *node) {
-	dns_rdataset_t dnameset;
-	isc_result_t result;
-
-	dns_rdataset_init(&dnameset);
-	result = dns_db_findrdataset(db, node, ver, dns_rdatatype_dname, 0, 0,
-				     &dnameset, NULL);
-	if (dns_rdataset_isassociated(&dnameset)) {
-		dns_rdataset_disassociate(&dnameset);
-	}
-
-	return (ISC_TF(result == ISC_R_SUCCESS));
-}
-
 /*%
  * Signs all records at a name.
  */
@@ -2136,10 +2092,10 @@ rrset_cleanup(dns_name_t *name, dns_rdataset_t *rdataset,
 	unsigned int count1 = 0;
 	dns_rdataset_t tmprdataset;
 	char namestr[DNS_NAME_FORMATSIZE];
-	char typestr[DNS_RDATATYPE_FORMATSIZE];
+	char typestr[TYPE_FORMATSIZE];
 
 	dns_name_format(name, namestr, sizeof(namestr));
-	dns_rdatatype_format(rdataset->type, typestr, sizeof(typestr));
+	type_format(rdataset->type, typestr, sizeof(typestr));
 
 	dns_rdataset_init(&tmprdataset);
 	for (result = dns_rdataset_first(rdataset);
@@ -2531,7 +2487,7 @@ loadzone(char *file, char *origin, dns_rdataclass_t rdclass, dns_db_t **db) {
 			       rdclass, 0, NULL, db);
 	check_result(result, "dns_db_create()");
 
-	result = dns_db_load(*db, file, inputformat, 0);
+	result = dns_db_load2(*db, file, inputformat);
 	if (result != ISC_R_SUCCESS && result != DNS_R_SEENINCLUDE)
 		fatal("failed loading zone from '%s': %s",
 		      file, isc_result_totext(result));
@@ -2697,7 +2653,7 @@ build_final_keylist(void) {
 	 * Find keys that match this zone in the key repository.
 	 */
 	result = dns_dnssec_findmatchingkeys(gorigin, directory,
-					     now, mctx, &matchkeys);
+					     mctx, &matchkeys);
 	if (result == ISC_R_NOTFOUND) {
 		result = ISC_R_SUCCESS;
 	}
@@ -3044,8 +3000,7 @@ writeset(const char *prefix, dns_rdatatype_t type) {
 	check_result(result, "dns_diff_apply");
 	dns_diff_clear(&diff);
 
-	result = dns_master_dump(mctx, db, dbversion, style, filename,
-				 dns_masterformat_text, NULL);
+	result = dns_master_dump(mctx, db, dbversion, style, filename);
 	check_result(result, "dns_master_dump");
 
 	isc_mem_put(mctx, filename, filenamelen);
@@ -3127,16 +3082,23 @@ usage(void) {
 	fprintf(stderr, "\t\tsoa serial format of signed zone file (keep)\n");
 	fprintf(stderr, "\t-D:\n");
 	fprintf(stderr, "\t\toutput only DNSSEC-related records\n");
+	fprintf(stderr, "\t-r randomdev:\n");
+	fprintf(stderr,	"\t\ta file containing random data\n");
 	fprintf(stderr, "\t-a:\t");
 	fprintf(stderr, "verify generated signatures\n");
 	fprintf(stderr, "\t-c class (IN)\n");
 	fprintf(stderr, "\t-E engine:\n");
-#if USE_PKCS11
+#if defined(PKCS11CRYPTO)
 	fprintf(stderr, "\t\tpath to PKCS#11 provider library "
 		"(default is %s)\n", PK11_LIB_LOCATION);
+#elif defined(USE_PKCS11)
+	fprintf(stderr, "\t\tname of an OpenSSL engine to use "
+				"(default is \"pkcs11\")\n");
 #else
 	fprintf(stderr, "\t\tname of an OpenSSL engine to use\n");
 #endif
+	fprintf(stderr, "\t-p:\t");
+	fprintf(stderr, "use pseudorandom data (faster but less secure)\n");
 	fprintf(stderr, "\t-P:\t");
 	fprintf(stderr, "disable post-sign verification\n");
 	fprintf(stderr, "\t-Q:\t");
@@ -3224,9 +3186,15 @@ main(int argc, char *argv[]) {
 	isc_time_t timer_start, timer_finish;
 	isc_time_t sign_start, sign_finish;
 	dns_dnsseckey_t *key;
-	isc_result_t result, vresult;
+	isc_result_t result;
 	isc_log_t *log = NULL;
+	isc_boolean_t pseudorandom = ISC_FALSE;
+#ifdef USE_PKCS11
+	const char *engine = PKCS11_ENGINE;
+#else
 	const char *engine = NULL;
+#endif
+	unsigned int eflags;
 	isc_boolean_t free_output = ISC_FALSE;
 	int tempfilelen = 0;
 	dns_rdataclass_t rdclass;
@@ -3279,7 +3247,7 @@ main(int argc, char *argv[]) {
 	if (result != ISC_R_SUCCESS)
 		fatal("out of memory");
 
-#if USE_PKCS11
+#ifdef PKCS11CRYPTO
 	pk11_result_register();
 #endif
 	dns_result_register();
@@ -3455,7 +3423,7 @@ main(int argc, char *argv[]) {
 			break;
 
 		case 'p':
-			fatal("The -p option has been deprecated.\n");
+			pseudorandom = ISC_TRUE;
 			break;
 
 		case 'Q':
@@ -3467,7 +3435,7 @@ main(int argc, char *argv[]) {
 			break;
 
 		case 'r':
-			fatal("The -r options has been deprecated.\n");
+			setup_entropy(mctx, isc_commandline_argument, &ectx);
 			break;
 
 		case 'S':
@@ -3543,11 +3511,21 @@ main(int argc, char *argv[]) {
 		}
 	}
 
-	result = dst_lib_init(mctx, engine);
+	if (ectx == NULL)
+		setup_entropy(mctx, NULL, &ectx);
+	eflags = ISC_ENTROPY_BLOCKING;
+	if (!pseudorandom)
+		eflags |= ISC_ENTROPY_GOODONLY;
+
+	result = dst_lib_init2(mctx, ectx, engine, eflags);
 	if (result != ISC_R_SUCCESS)
 		fatal("could not initialize dst: %s",
 		      isc_result_totext(result));
 
+	result = isc_hash_create(mctx, ectx, DNS_NAME_MAXWIRE);
+	if (result != ISC_R_SUCCESS)
+		fatal("could not create hash context");
+
 	isc_stdtime_get(&now);
 
 	if (startstr != NULL) {
@@ -3673,8 +3651,8 @@ main(int argc, char *argv[]) {
 	if (output_dnssec_only && set_maxttl)
 		fatal("option -D cannot be used with -M");
 
-	result = dns_master_stylecreate(&dsstyle, DNS_STYLEFLAG_NO_TTL,
-					0, 24, 0, 0, 0, 8, 0xffffffff, mctx);
+	result = dns_master_stylecreate(&dsstyle,  DNS_STYLEFLAG_NO_TTL,
+					0, 24, 0, 0, 0, 8, mctx);
 	check_result(result, "dns_master_stylecreate");
 
 	gdb = NULL;
@@ -3905,18 +3883,9 @@ main(int argc, char *argv[]) {
 	postsign();
 	TIME_NOW(&sign_finish);
 
-	if (disable_zone_check) {
-		vresult = ISC_R_SUCCESS;
-	} else {
-		vresult = dns_zoneverify_dnssec(NULL, gdb, gversion, gorigin,
-						NULL, mctx, ignore_kskflag,
-						keyset_kskonly);
-		if (vresult != ISC_R_SUCCESS) {
-			fprintf(output_stdout ? stderr : stdout,
-				"Zone verification failed (%s)\n",
-				isc_result_totext(vresult));
-		}
-	}
+	if (!disable_zone_check)
+		verifyzone(gdb, gversion, gorigin, mctx,
+			   ignore_kskflag, keyset_kskonly);
 
 	if (outputformat != dns_masterformat_text) {
 		dns_masterrawheader_t header;
@@ -3927,9 +3896,9 @@ main(int argc, char *argv[]) {
 			header.flags = DNS_MASTERRAW_SOURCESERIALSET;
 			header.sourceserial = serialnum;
 		}
-		result = dns_master_dumptostream(mctx, gdb, gversion,
-						 masterstyle, outputformat,
-						 &header, outfp);
+		result = dns_master_dumptostream3(mctx, gdb, gversion,
+						  masterstyle, outputformat,
+						  &header, outfp);
 		check_result(result, "dns_master_dumptostream3");
 	}
 
@@ -3942,16 +3911,12 @@ main(int argc, char *argv[]) {
 		check_result(result, "isc_stdio_close");
 		removefile = ISC_FALSE;
 
-		if (vresult == ISC_R_SUCCESS) {
-			result = isc_file_rename(tempfile, output);
-			if (result != ISC_R_SUCCESS) {
-				fatal("failed to rename temp file to %s: %s",
-				      output, isc_result_totext(result));
-			}
-			printf("%s\n", output);
-		} else {
-			isc_file_remove(tempfile);
-		}
+		result = isc_file_rename(tempfile, output);
+		if (result != ISC_R_SUCCESS)
+			fatal("failed to rename temp file to %s: %s",
+			      output, isc_result_totext(result));
+
+		printf("%s\n", output);
 	}
 
 	dns_db_closeversion(gdb, &gversion, ISC_FALSE);
@@ -3974,7 +3939,9 @@ main(int argc, char *argv[]) {
 	dns_master_styledestroy(&dsstyle, mctx);
 
 	cleanup_logging(&log);
+	isc_hash_destroy();
 	dst_lib_destroy();
+	cleanup_entropy(&ectx);
 	dns_name_destroy();
 	if (verbose > 10)
 		isc_mem_stats(mctx, stdout);
@@ -3991,5 +3958,5 @@ main(int argc, char *argv[]) {
 #ifdef _WIN32
 	DestroySockets();
 #endif
-	return (vresult == ISC_R_SUCCESS ? 0 : 1);
+	return (0);
 }

bin/dnssec/dnssec-signzone.docbook

@@ -78,8 +78,10 @@
       <arg choice="opt" rep="norepeat"><option>-o <replaceable class="parameter">origin</replaceable></option></arg>
       <arg choice="opt" rep="norepeat"><option>-O <replaceable class="parameter">output-format</replaceable></option></arg>
       <arg choice="opt" rep="norepeat"><option>-P</option></arg>
+      <arg choice="opt" rep="norepeat"><option>-p</option></arg>
       <arg choice="opt" rep="norepeat"><option>-Q</option></arg>
       <arg choice="opt" rep="norepeat"><option>-R</option></arg>
+      <arg choice="opt" rep="norepeat"><option>-r <replaceable class="parameter">randomdev</replaceable></option></arg>
       <arg choice="opt" rep="norepeat"><option>-S</option></arg>
       <arg choice="opt" rep="norepeat"><option>-s <replaceable class="parameter">start-time</replaceable></option></arg>
       <arg choice="opt" rep="norepeat"><option>-T <replaceable class="parameter">ttl</replaceable></option></arg>
@@ -506,6 +508,18 @@
         </listitem>
       </varlistentry>
 
+      <varlistentry>
+        <term>-p</term>
+        <listitem>
+          <para>
+            Use pseudo-random data when signing the zone.  This is faster,
+            but less secure, than using real random data.  This option
+            may be useful when signing large zones or when the entropy
+            source is limited.
+          </para>
+        </listitem>
+      </varlistentry>
+
       <varlistentry>
         <term>-P</term>
         <listitem>
@@ -557,6 +571,23 @@
           </para>
         </listitem>
       </varlistentry>
+      <varlistentry>
+        <term>-r <replaceable class="parameter">randomdev</replaceable></term>
+        <listitem>
+          <para>
+            Specifies the source of randomness.  If the operating
+            system does not provide a <filename>/dev/random</filename>
+            or equivalent device, the default source of randomness
+            is keyboard input.  <filename>randomdev</filename>
+            specifies
+            the name of a character device or file containing random
+            data to be used instead of the default.  The special value
+            <filename>keyboard</filename> indicates that keyboard
+            input should be used.
+          </para>
+        </listitem>
+      </varlistentry>
+
       <varlistentry>
         <term>-S</term>
         <listitem>

bin/dnssec/dnssec-signzone.html

@@ -54,8 +54,10 @@
        [<code class="option">-o <em class="replaceable"><code>origin</code></em></code>]
        [<code class="option">-O <em class="replaceable"><code>output-format</code></em></code>]
        [<code class="option">-P</code>]
+       [<code class="option">-p</code>]
        [<code class="option">-Q</code>]
        [<code class="option">-R</code>]
+       [<code class="option">-r <em class="replaceable"><code>randomdev</code></em></code>]
        [<code class="option">-S</code>]
        [<code class="option">-s <em class="replaceable"><code>start-time</code></em></code>]
        [<code class="option">-T <em class="replaceable"><code>ttl</code></em></code>]
@@ -398,6 +400,15 @@
             can be read by release 9.9.0 or higher; the default is 1.
           </p>
         </dd>
+<dt><span class="term">-p</span></dt>
+<dd>
+          <p>
+            Use pseudo-random data when signing the zone.  This is faster,
+            but less secure, than using real random data.  This option
+            may be useful when signing large zones or when the entropy
+            source is limited.
+          </p>
+        </dd>
 <dt><span class="term">-P</span></dt>
 <dd>
           <p>
@@ -442,6 +453,20 @@
             ("Double Signature Zone Signing Key Rollover").
           </p>
         </dd>
+<dt><span class="term">-r <em class="replaceable"><code>randomdev</code></em></span></dt>
+<dd>
+          <p>
+            Specifies the source of randomness.  If the operating
+            system does not provide a <code class="filename">/dev/random</code>
+            or equivalent device, the default source of randomness
+            is keyboard input.  <code class="filename">randomdev</code>
+            specifies
+            the name of a character device or file containing random
+            data to be used instead of the default.  The special value
+            <code class="filename">keyboard</code> indicates that keyboard
+            input should be used.
+          </p>
+        </dd>
 <dt><span class="term">-S</span></dt>
 <dd>
           <p>

bin/dnssec/dnssec-verify.c

@@ -19,6 +19,7 @@
 #include <isc/app.h>
 #include <isc/base32.h>
 #include <isc/commandline.h>
+#include <isc/entropy.h>
 #include <isc/event.h>
 #include <isc/file.h>
 #include <isc/hash.h>
@@ -58,11 +59,10 @@
 #include <dns/result.h>
 #include <dns/soa.h>
 #include <dns/time.h>
-#include <dns/zoneverify.h>
 
 #include <dst/dst.h>
 
-#if USE_PKCS11
+#ifdef PKCS11CRYPTO
 #include <pk11/result.h>
 #endif
 
@@ -73,6 +73,7 @@ int verbose;
 
 static isc_stdtime_t now;
 static isc_mem_t *mctx = NULL;
+static isc_entropy_t *ectx = NULL;
 static dns_masterformat_t inputformat = dns_masterformat_text;
 static dns_db_t *gdb;			/* The database */
 static dns_dbversion_t *gversion;	/* The database version */
@@ -106,7 +107,7 @@ loadzone(char *file, char *origin, dns_rdataclass_t rdclass, dns_db_t **db) {
 			       rdclass, 0, NULL, db);
 	check_result(result, "dns_db_create()");
 
-	result = dns_db_load(*db, file, inputformat, 0);
+	result = dns_db_load2(*db, file, inputformat);
 	switch (result) {
 	case DNS_R_SEENINCLUDE:
 	case ISC_R_SUCCESS:
@@ -150,9 +151,12 @@ usage(void) {
 	fprintf(stderr, "\t\tfile format of input zonefile (text)\n");
 	fprintf(stderr, "\t-c class (IN)\n");
 	fprintf(stderr, "\t-E engine:\n");
-#if USE_PKCS11
+#if defined(PKCS11CRYPTO)
 	fprintf(stderr, "\t\tpath to PKCS#11 provider library "
 		"(default is %s)\n", PK11_LIB_LOCATION);
+#elif defined(USE_PKCS11)
+	fprintf(stderr, "\t\tname of an OpenSSL engine to use "
+				"(default is \"pkcs11\")\n");
 #else
 	fprintf(stderr, "\t\tname of an OpenSSL engine to use\n");
 #endif
@@ -168,7 +172,11 @@ main(int argc, char *argv[]) {
 	char *inputformatstr = NULL;
 	isc_result_t result;
 	isc_log_t *log = NULL;
+#ifdef USE_PKCS11
+	const char *engine = PKCS11_ENGINE;
+#else
 	const char *engine = NULL;
+#endif
 	char *classname = NULL;
 	dns_rdataclass_t rdclass;
 	char *endp;
@@ -205,7 +213,7 @@ main(int argc, char *argv[]) {
 	if (result != ISC_R_SUCCESS)
 		fatal("out of memory");
 
-#if USE_PKCS11
+#ifdef PKCS11CRYPTO
 	pk11_result_register();
 #endif
 	dns_result_register();
@@ -269,11 +277,18 @@ main(int argc, char *argv[]) {
 		}
 	}
 
-	result = dst_lib_init(mctx, engine);
+	if (ectx == NULL)
+		setup_entropy(mctx, NULL, &ectx);
+
+	result = dst_lib_init2(mctx, ectx, engine, ISC_ENTROPY_BLOCKING);
 	if (result != ISC_R_SUCCESS)
 		fatal("could not initialize dst: %s",
 		      isc_result_totext(result));
 
+	result = isc_hash_create(mctx, ectx, DNS_NAME_MAXWIRE);
+	if (result != ISC_R_SUCCESS)
+		fatal("could not create hash context");
+
 	isc_stdtime_get(&now);
 
 	rdclass = strtoclass(classname);
@@ -316,14 +331,16 @@ main(int argc, char *argv[]) {
 	result = dns_db_newversion(gdb, &gversion);
 	check_result(result, "dns_db_newversion()");
 
-	result = dns_zoneverify_dnssec(NULL, gdb, gversion, gorigin, NULL,
-				       mctx, ignore_kskflag, keyset_kskonly);
+	verifyzone(gdb, gversion, gorigin, mctx,
+		   ignore_kskflag, keyset_kskonly);
 
 	dns_db_closeversion(gdb, &gversion, ISC_FALSE);
 	dns_db_detach(&gdb);
 
 	cleanup_logging(&log);
 	dst_lib_destroy();
+	isc_hash_destroy();
+	cleanup_entropy(&ectx);
 	dns_name_destroy();
 	if (verbose > 10)
 		isc_mem_stats(mctx, stdout);
@@ -331,5 +348,5 @@ main(int argc, char *argv[]) {
 
 	(void) isc_app_finish();
 
-	return (result == ISC_R_SUCCESS ? 0 : 1);
+	return (0);
 }

bin/dnssec/dnssectool.h

@@ -18,6 +18,11 @@
 #include <dns/rdatastruct.h>
 #include <dst/dst.h>
 
+#define check_dns_dbiterator_current(result) \
+	check_result((result == DNS_R_NEWORIGIN) ? ISC_R_SUCCESS : result, \
+		     "dns_dbiterator_current()")
+
+
 typedef void (fatalcallback_t)(void);
 
 ISC_PLATFORM_NORETURN_PRE void
@@ -36,6 +41,10 @@ vbprintf(int level, const char *fmt, ...) ISC_FORMAT_PRINTF(2, 3);
 ISC_PLATFORM_NORETURN_PRE void
 version(const char *program) ISC_PLATFORM_NORETURN_POST;
 
+void
+type_format(const dns_rdatatype_t type, char *cp, unsigned int size);
+#define TYPE_FORMATSIZE 20
+
 void
 sig_format(dns_rdata_rrsig_t *sig, char *cp, unsigned int size);
 #define SIG_FORMATSIZE (DNS_NAME_FORMATSIZE + DNS_SECALG_FORMATSIZE + sizeof("65535"))
@@ -46,6 +55,12 @@ setup_logging(isc_mem_t *mctx, isc_log_t **logp);
 void
 cleanup_logging(isc_log_t **logp);
 
+void
+setup_entropy(isc_mem_t *mctx, const char *randomfile, isc_entropy_t **ectx);
+
+void
+cleanup_entropy(isc_entropy_t **ectx);
+
 dns_ttl_t strtottl(const char *str);
 
 isc_stdtime_t
@@ -71,6 +86,22 @@ isc_boolean_t
 key_collision(dst_key_t *key, dns_name_t *name, const char *dir,
 	      isc_mem_t *mctx, isc_boolean_t *exact);
 
+isc_boolean_t
+is_delegation(dns_db_t *db, dns_dbversion_t *ver, dns_name_t *origin,
+		      dns_name_t *name, dns_dbnode_t *node, isc_uint32_t *ttlp);
+
+/*%
+ * Return ISC_TRUE if version 'ver' of database 'db' contains a DNAME RRset at
+ * 'node'; return ISC_FALSE otherwise.
+ */
+isc_boolean_t
+has_dname(dns_db_t *db, dns_dbversion_t *ver, dns_dbnode_t *node);
+
+void
+verifyzone(dns_db_t *db, dns_dbversion_t *ver,
+		   dns_name_t *origin, isc_mem_t *mctx,
+		   isc_boolean_t ignore_kskflag, isc_boolean_t keyset_kskonly);
+
 isc_boolean_t
 isoptarg(const char *arg, char **argv, void (*usage)(void));
 

bin/dnssec/win32/dnssectool.vcxproj.in

@@ -61,7 +61,7 @@
       </PrecompiledHeader>
       <WarningLevel>Level3</WarningLevel>
       <Optimization>Disabled</Optimization>
-      <PreprocessorDefinitions>WIN32;_DEBUG;_LIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <PreprocessorDefinitions>WIN32;@CRYPTO@_DEBUG;_LIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
       <FunctionLevelLinking>true</FunctionLevelLinking>
       <PrecompiledHeaderOutputFile>.\$(Configuration)\$(TargetName).pch</PrecompiledHeaderOutputFile>
       <AssemblerListingLocation>.\$(Configuration)\</AssemblerListingLocation>
@@ -84,7 +84,7 @@
       <Optimization>MaxSpeed</Optimization>
       <FunctionLevelLinking>true</FunctionLevelLinking>
       <IntrinsicFunctions>@INTRINSIC@</IntrinsicFunctions>
-      <PreprocessorDefinitions>WIN32;NDEBUG;_LIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <PreprocessorDefinitions>WIN32;@CRYPTO@NDEBUG;_LIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
       <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
       <WholeProgramOptimization>false</WholeProgramOptimization>
       <StringPooling>true</StringPooling>

bin/dnssec/win32/dsfromkey.vcxproj.in

@@ -55,7 +55,7 @@
       </PrecompiledHeader>
       <WarningLevel>Level3</WarningLevel>
       <Optimization>Disabled</Optimization>
-      <PreprocessorDefinitions>WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <PreprocessorDefinitions>WIN32;@CRYPTO@_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
       <FunctionLevelLinking>true</FunctionLevelLinking>
       <PrecompiledHeaderOutputFile>.\$(Configuration)\$(ProjectName).pch</PrecompiledHeaderOutputFile>
       <AssemblerListingLocation>.\$(Configuration)\</AssemblerListingLocation>
@@ -94,7 +94,7 @@ set PYTHONPATH=.
       <Optimization>MaxSpeed</Optimization>
       <FunctionLevelLinking>true</FunctionLevelLinking>
       <IntrinsicFunctions>@INTRINSIC@</IntrinsicFunctions>
-      <PreprocessorDefinitions>WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <PreprocessorDefinitions>WIN32;@CRYPTO@NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
       <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
       <WholeProgramOptimization>false</WholeProgramOptimization>
       <StringPooling>true</StringPooling>

bin/dnssec/win32/importkey.vcxproj.in

@@ -55,7 +55,7 @@
       </PrecompiledHeader>
       <WarningLevel>Level3</WarningLevel>
       <Optimization>Disabled</Optimization>
-      <PreprocessorDefinitions>WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <PreprocessorDefinitions>WIN32;@CRYPTO@_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
       <FunctionLevelLinking>true</FunctionLevelLinking>
       <PrecompiledHeaderOutputFile>.\$(Configuration)\$(ProjectName).pch</PrecompiledHeaderOutputFile>
       <AssemblerListingLocation>.\$(Configuration)\</AssemblerListingLocation>
@@ -81,7 +81,7 @@
       <Optimization>MaxSpeed</Optimization>
       <FunctionLevelLinking>true</FunctionLevelLinking>
       <IntrinsicFunctions>@INTRINSIC@</IntrinsicFunctions>
-      <PreprocessorDefinitions>WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <PreprocessorDefinitions>WIN32;@CRYPTO@NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
       <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
       <WholeProgramOptimization>false</WholeProgramOptimization>
       <StringPooling>true</StringPooling>

bin/dnssec/win32/keyfromlabel.vcxproj.in

@@ -55,7 +55,7 @@
       </PrecompiledHeader>
       <WarningLevel>Level3</WarningLevel>
       <Optimization>Disabled</Optimization>
-      <PreprocessorDefinitions>WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <PreprocessorDefinitions>WIN32;@CRYPTO@_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
       <FunctionLevelLinking>true</FunctionLevelLinking>
       <PrecompiledHeaderOutputFile>.\$(Configuration)\$(ProjectName).pch</PrecompiledHeaderOutputFile>
       <AssemblerListingLocation>.\$(Configuration)\</AssemblerListingLocation>
@@ -81,7 +81,7 @@
       <Optimization>MaxSpeed</Optimization>
       <FunctionLevelLinking>true</FunctionLevelLinking>
       <IntrinsicFunctions>@INTRINSIC@</IntrinsicFunctions>
-      <PreprocessorDefinitions>WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <PreprocessorDefinitions>WIN32;@CRYPTO@NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
       <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
       <WholeProgramOptimization>false</WholeProgramOptimization>
       <StringPooling>true</StringPooling>

bin/dnssec/win32/keygen.vcxproj.in

@@ -55,7 +55,7 @@
       </PrecompiledHeader>
       <WarningLevel>Level3</WarningLevel>
       <Optimization>Disabled</Optimization>
-      <PreprocessorDefinitions>WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <PreprocessorDefinitions>WIN32;@CRYPTO@_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
       <FunctionLevelLinking>true</FunctionLevelLinking>
       <PrecompiledHeaderOutputFile>.\$(Configuration)\$(ProjectName).pch</PrecompiledHeaderOutputFile>
       <AssemblerListingLocation>.\$(Configuration)\</AssemblerListingLocation>
@@ -81,7 +81,7 @@
       <Optimization>MaxSpeed</Optimization>
       <FunctionLevelLinking>true</FunctionLevelLinking>
       <IntrinsicFunctions>@INTRINSIC@</IntrinsicFunctions>
-      <PreprocessorDefinitions>WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <PreprocessorDefinitions>WIN32;@CRYPTO@NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
       <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
       <WholeProgramOptimization>false</WholeProgramOptimization>
       <StringPooling>true</StringPooling>

bin/dnssec/win32/revoke.vcxproj.in

@@ -55,7 +55,7 @@
       </PrecompiledHeader>
       <WarningLevel>Level3</WarningLevel>
       <Optimization>Disabled</Optimization>
-      <PreprocessorDefinitions>WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <PreprocessorDefinitions>WIN32;@CRYPTO@_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
       <FunctionLevelLinking>true</FunctionLevelLinking>
       <PrecompiledHeaderOutputFile>.\$(Configuration)\$(ProjectName).pch</PrecompiledHeaderOutputFile>
       <AssemblerListingLocation>.\$(Configuration)\</AssemblerListingLocation>
@@ -81,7 +81,7 @@
       <Optimization>MaxSpeed</Optimization>
       <FunctionLevelLinking>true</FunctionLevelLinking>
       <IntrinsicFunctions>@INTRINSIC@</IntrinsicFunctions>
-      <PreprocessorDefinitions>WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <PreprocessorDefinitions>WIN32;@CRYPTO@NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
       <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
       <WholeProgramOptimization>false</WholeProgramOptimization>
       <StringPooling>true</StringPooling>

bin/dnssec/win32/settime.vcxproj.in

@@ -55,7 +55,7 @@
       </PrecompiledHeader>
       <WarningLevel>Level3</WarningLevel>
       <Optimization>Disabled</Optimization>
-      <PreprocessorDefinitions>WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <PreprocessorDefinitions>WIN32;@CRYPTO@_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
       <FunctionLevelLinking>true</FunctionLevelLinking>
       <PrecompiledHeaderOutputFile>.\$(Configuration)\$(ProjectName).pch</PrecompiledHeaderOutputFile>
       <AssemblerListingLocation>.\$(Configuration)\</AssemblerListingLocation>
@@ -81,7 +81,7 @@
       <Optimization>MaxSpeed</Optimization>
       <FunctionLevelLinking>true</FunctionLevelLinking>
       <IntrinsicFunctions>@INTRINSIC@</IntrinsicFunctions>
-      <PreprocessorDefinitions>WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <PreprocessorDefinitions>WIN32;@CRYPTO@NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
       <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
       <WholeProgramOptimization>false</WholeProgramOptimization>
       <StringPooling>true</StringPooling>

bin/dnssec/win32/signzone.vcxproj.in

@@ -55,7 +55,7 @@
       </PrecompiledHeader>
       <WarningLevel>Level3</WarningLevel>
       <Optimization>Disabled</Optimization>
-      <PreprocessorDefinitions>WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <PreprocessorDefinitions>WIN32;@CRYPTO@_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
       <FunctionLevelLinking>true</FunctionLevelLinking>
       <PrecompiledHeaderOutputFile>.\$(Configuration)\$(ProjectName).pch</PrecompiledHeaderOutputFile>
       <AssemblerListingLocation>.\$(Configuration)\</AssemblerListingLocation>
@@ -81,7 +81,7 @@
       <Optimization>MaxSpeed</Optimization>
       <FunctionLevelLinking>true</FunctionLevelLinking>
       <IntrinsicFunctions>@INTRINSIC@</IntrinsicFunctions>
-      <PreprocessorDefinitions>WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <PreprocessorDefinitions>WIN32;@CRYPTO@NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
       <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
       <WholeProgramOptimization>false</WholeProgramOptimization>
       <StringPooling>true</StringPooling>

bin/dnssec/win32/verify.vcxproj.in

@@ -55,7 +55,7 @@
       </PrecompiledHeader>
       <WarningLevel>Level3</WarningLevel>
       <Optimization>Disabled</Optimization>
-      <PreprocessorDefinitions>WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <PreprocessorDefinitions>WIN32;@CRYPTO@_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
       <FunctionLevelLinking>true</FunctionLevelLinking>
       <PrecompiledHeaderOutputFile>.\$(Configuration)\$(ProjectName).pch</PrecompiledHeaderOutputFile>
       <AssemblerListingLocation>.\$(Configuration)\</AssemblerListingLocation>
@@ -81,7 +81,7 @@
       <Optimization>MaxSpeed</Optimization>
       <FunctionLevelLinking>true</FunctionLevelLinking>
       <IntrinsicFunctions>@INTRINSIC@</IntrinsicFunctions>
-      <PreprocessorDefinitions>WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <PreprocessorDefinitions>WIN32;@CRYPTO@NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
       <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
       <WholeProgramOptimization>false</WholeProgramOptimization>
       <StringPooling>true</StringPooling>

bin/named/Makefile.in

@@ -46,17 +46,17 @@ CINCLUDES =	-I${srcdir}/include -I${srcdir}/unix/include -I. \
 		${NS_INCLUDES} ${DNS_INCLUDES} \
 		${BIND9_INCLUDES} ${ISCCFG_INCLUDES} ${ISCCC_INCLUDES} \
 		${ISC_INCLUDES} ${DLZDRIVER_INCLUDES} \
-		${DBDRIVER_INCLUDES} @OPENSSL_INCLUDES@
+		${DBDRIVER_INCLUDES} @DST_OPENSSL_INC@
 
-CDEFINES =      @CONTRIB_DLZ@
+CDEFINES =      @CONTRIB_DLZ@ @USE_PKCS11@ @PKCS11_ENGINE@ @CRYPTO@
 
 CWARNINGS =
 
 DNSLIBS =	../../lib/dns/libdns.@A@ @DNS_CRYPTO_LIBS@
 ISCCFGLIBS =	../../lib/isccfg/libisccfg.@A@
 ISCCCLIBS =	../../lib/isccc/libisccc.@A@
-ISCLIBS =	../../lib/isc/libisc.@A@ @OPENSSL_LIBS@
-ISCNOSYMLIBS =	../../lib/isc/libisc-nosymtbl.@A@ @OPENSSL_LIBS@
+ISCLIBS =	../../lib/isc/libisc.@A@ @ISC_OPENSSL_LIBS@
+ISCNOSYMLIBS =	../../lib/isc/libisc-nosymtbl.@A@ @ISC_OPENSSL_LIBS@
 BIND9LIBS =	../../lib/bind9/libbind9.@A@
 NSLIBS =	../../lib/ns/libns.@A@
 
@@ -72,13 +72,11 @@ DEPLIBS =	${NSDEPLIBS} ${DNSDEPLIBS} ${BIND9DEPLIBS} \
 
 LIBS =		${NSLIBS} ${DNSLIBS} ${BIND9LIBS} \
 		${ISCCFGLIBS} ${ISCCCLIBS} ${ISCLIBS} \
-		${DLZDRIVER_LIBS} ${DBDRIVER_LIBS} @LIBCAP_LIBS@ \
-		@LIBS@
+		${DLZDRIVER_LIBS} ${DBDRIVER_LIBS} @LIBS@
 
 NOSYMLIBS =	${NSLIBS} ${DNSLIBS} ${BIND9LIBS} \
 		${ISCCFGLIBS} ${ISCCCLIBS} ${ISCNOSYMLIBS} \
-		${DLZDRIVER_LIBS} ${DBDRIVER_LIBS} @LIBCAP_LIBS@ \
-		@LIBS@
+		${DLZDRIVER_LIBS} ${DBDRIVER_LIBS} @LIBS@
 
 SUBDIRS =	unix
 

bin/named/config.c

@@ -51,7 +51,11 @@ options {\n\
 	automatic-interface-scan yes;\n\
 	bindkeys-file \"" NAMED_SYSCONFDIR "/bind.keys\";\n\
 #	blackhole {none;};\n"
+#if defined(HAVE_OPENSSL_AES) || defined(HAVE_OPENSSL_EVP_AES)
 "	cookie-algorithm aes;\n"
+#else
+"	cookie-algorithm sha256;\n"
+#endif
 #ifndef WIN32
 "	coresize default;\n\
 	datasize default;\n"
@@ -86,8 +90,13 @@ options {\n\
 	nta-recheck 300;\n\
 #	pid-file \"" NAMED_LOCALSTATEDIR "/run/named/named.pid\"; \n\
 	port 53;\n\
-	prefetch 2 9;\n\
-	recursing-file \"named.recursing\";\n\
+	prefetch 2 9;\n"
+#if defined(ISC_PLATFORM_CRYPTORANDOM)
+"	random-device none;\n"
+#elif defined(PATH_RANDOMDEV)
+"	random-device \"" PATH_RANDOMDEV "\";\n"
+#endif
+"	recursing-file \"named.recursing\";\n\
 	recursive-clients 1000;\n\
 	request-nsid false;\n\
 	reserved-sockets 512;\n\
@@ -145,7 +154,7 @@ options {\n\
 	clients-per-query 10;\n\
 	dnssec-accept-expired no;\n\
 	dnssec-enable yes;\n\
-	dnssec-validation " VALIDATION_DEFAULT "; \n"
+	dnssec-validation yes; \n"
 #ifdef HAVE_DNSTAP
 "	dnstap-identity hostname;\n"
 #endif
@@ -180,7 +189,6 @@ options {\n\
 	notify-source-v6 *;\n\
 	nsec3-test-zone no;\n\
 	provide-ixfr true;\n\
-	qname-minimization relaxed;\n\
 	query-source address *;\n\
 	query-source-v6 address *;\n\
 	recursion true;\n\
@@ -243,7 +251,6 @@ options {\n\
 	sig-signing-signatures 10;\n\
 	sig-signing-type 65534;\n\
 	sig-validity-interval 30; /* days */\n\
-	dnskey-sig-validity 0; /* default: sig-validity-interval */\n\
 	transfer-source *;\n\
 	transfer-source-v6 *;\n\
 	try-tcp-refresh yes; /* BIND 8 compat */\n\
@@ -423,23 +430,18 @@ named_config_getzonetype(const cfg_obj_t *zonetypeobj) {
 	const char *str;
 
 	str = cfg_obj_asstring(zonetypeobj);
-	if (strcasecmp(str, "primary") == 0 ||
-	    strcasecmp(str, "master") == 0)
-	{
+	if (strcasecmp(str, "master") == 0)
 		ztype = dns_zone_master;
-	} else if (strcasecmp(str, "secondary") == 0 ||
-		   strcasecmp(str, "slave") == 0)
-	{
+	else if (strcasecmp(str, "slave") == 0)
 		ztype = dns_zone_slave;
-	} else if (strcasecmp(str, "stub") == 0) {
+	else if (strcasecmp(str, "stub") == 0)
 		ztype = dns_zone_stub;
-	} else if (strcasecmp(str, "static-stub") == 0) {
+	else if (strcasecmp(str, "static-stub") == 0)
 		ztype = dns_zone_staticstub;
-	} else if (strcasecmp(str, "redirect") == 0) {
+	else if (strcasecmp(str, "redirect") == 0)
 		ztype = dns_zone_redirect;
-	} else {
+	else
 		INSIST(0);
-	}
 	return (ztype);
 }
 
@@ -953,9 +955,11 @@ struct keyalgorithms {
 	unsigned int type;
 	isc_uint16_t size;
 } algorithms[] = {
+#ifndef PK11_MD5_DISABLE
 	{ "hmac-md5", hmacmd5, DST_ALG_HMACMD5, 128 },
 	{ "hmac-md5.sig-alg.reg.int", hmacmd5, DST_ALG_HMACMD5, 0 },
 	{ "hmac-md5.sig-alg.reg.int.", hmacmd5, DST_ALG_HMACMD5, 0 },
+#endif
 	{ "hmac-sha1", hmacsha1, DST_ALG_HMACSHA1, 160 },
 	{ "hmac-sha224", hmacsha224, DST_ALG_HMACSHA224, 224 },
 	{ "hmac-sha256", hmacsha256, DST_ALG_HMACSHA256, 256 },
@@ -1002,7 +1006,9 @@ named_config_getkeyalgorithm2(const char *str, const dns_name_t **name,
 
 	if (name != NULL) {
 		switch (algorithms[i].hmac) {
+#ifndef PK11_MD5_DISABLE
 		case hmacmd5: *name = dns_tsig_hmacmd5_name; break;
+#endif
 		case hmacsha1: *name = dns_tsig_hmacsha1_name; break;
 		case hmacsha224: *name = dns_tsig_hmacsha224_name; break;
 		case hmacsha256: *name = dns_tsig_hmacsha256_name; break;

bin/named/controlconf.c

@@ -20,7 +20,6 @@
 #include <isc/mem.h>
 #include <isc/net.h>
 #include <isc/netaddr.h>
-#include <isc/nonce.h>
 #include <isc/random.h>
 #include <isc/result.h>
 #include <isc/stdtime.h>
@@ -232,11 +231,11 @@ address_ok(isc_sockaddr_t *sockaddr, dns_acl_t *acl) {
 	isc_netaddr_fromsockaddr(&netaddr, sockaddr);
 
 	result = dns_acl_match(&netaddr, NULL, acl, env, &match, NULL);
-	if (result != ISC_R_SUCCESS || match <= 0) {
+
+	if (result != ISC_R_SUCCESS || match <= 0)
 		return (ISC_FALSE);
-	} else {
+	else
 		return (ISC_TRUE);
-	}
 }
 
 static isc_result_t
@@ -326,6 +325,7 @@ static void
 control_recvmessage(isc_task_t *task, isc_event_t *event) {
 	controlconnection_t *conn = NULL;
 	controllistener_t *listener = NULL;
+	named_server_t *server = NULL;
 	controlkey_t *key = NULL;
 	isccc_sexpr_t *request = NULL;
 	isccc_sexpr_t *response = NULL;
@@ -347,6 +347,7 @@ control_recvmessage(isc_task_t *task, isc_event_t *event) {
 
 	conn = event->ev_arg;
 	listener = conn->listener;
+	server = listener->controls->server;
 	algorithm = DST_ALG_UNKNOWN;
 	secret.rstart = NULL;
 	text = NULL;
@@ -458,7 +459,8 @@ control_recvmessage(isc_task_t *task, isc_event_t *event) {
 	 */
 	if (conn->nonce == 0) {
 		while (conn->nonce == 0) {
-			isc_nonce_buf(&conn->nonce, sizeof(conn->nonce));
+			isc_rng_randombytes(server->sctx->rngctx, &conn->nonce,
+					    sizeof(conn->nonce));
 		}
 		eresult = ISC_R_SUCCESS;
 	} else

bin/named/fuzz.c

@@ -33,10 +33,6 @@
 #include <unistd.h>
 #include <pthread.h>
 
-#ifndef __AFL_LOOP
-#error To use American Fuzzy Lop you have to set CC to afl-clang-fast!!!
-#endif
-
 /*
  * We are using pthreads directly because we might be using it with
  * unthreaded version of BIND, where all thread functions are
@@ -590,7 +586,6 @@ fuzz_thread_resolver(void *arg) {
 	 * this signature ("##SIG_AFL_PERSISTENT##") and runs the binary
 	 * in persistent mode if it's present.
 	 */
-	__AFL_LOOP(0);
 
 	return (NULL);
 }
@@ -740,7 +735,9 @@ named_fuzz_notify(void) {
 		return;
 	}
 
+#if 0
 	raise(SIGSTOP);
+#endif
 
 	RUNTIME_CHECK(pthread_mutex_lock(&mutex) == 0);
 
@@ -753,8 +750,7 @@ named_fuzz_notify(void) {
 
 void
 named_fuzz_setup(void) {
-#ifdef ENABLE_AFL
-	if (getenv("__AFL_PERSISTENT") || getenv("AFL_CMIN")) {
+#if 0
 		pthread_t thread;
 		void *(fn) = NULL;
 
@@ -780,6 +776,5 @@ named_fuzz_setup(void) {
 		RUNTIME_CHECK(pthread_mutex_init(&mutex, NULL) == 0);
 		RUNTIME_CHECK(pthread_cond_init(&cond, NULL) == 0);
 		RUNTIME_CHECK(pthread_create(&thread, NULL, fn, NULL) == 0);
-	}
 #endif /* ENABLE_AFL */
 }

bin/named/include/named/globals.h

@@ -48,6 +48,8 @@ EXTERN unsigned int		named_g_cpus		INIT(0);
 EXTERN unsigned int		named_g_udpdisp		INIT(0);
 EXTERN isc_taskmgr_t *		named_g_taskmgr		INIT(NULL);
 EXTERN dns_dispatchmgr_t *	named_g_dispatchmgr	INIT(NULL);
+EXTERN isc_entropy_t *		named_g_entropy		INIT(NULL);
+EXTERN isc_entropy_t *		named_g_fallbackentropy	INIT(NULL);
 EXTERN unsigned int		named_g_cpus_detected	INIT(1);
 
 #ifdef ENABLE_AFL
@@ -142,7 +144,11 @@ EXTERN const char *		named_g_defaultdnstap	INIT(NULL);
 
 EXTERN const char *		named_g_username	INIT(NULL);
 
+#if defined(USE_PKCS11)
+EXTERN const char *		named_g_engine		INIT(PKCS11_ENGINE);
+#else
 EXTERN const char *		named_g_engine		INIT(NULL);
+#endif
 
 EXTERN isc_time_t		named_g_boottime;
 EXTERN isc_time_t		named_g_configtime;

bin/named/include/named/seccomp.h

@@ -0,0 +1,248 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+#ifndef NAMED_SECCOMP_H
+#define NAMED_SECCOMP_H 1
+
+/*! \file */
+
+#ifdef HAVE_LIBSECCOMP
+#include <sys/types.h>
+#include <sys/resource.h>
+#include <unistd.h>
+#include <seccomp.h>
+#include <isc/platform.h>
+
+/*%
+ * For each architecture, the scmp_syscalls and
+ * scmp_syscall_names arrays MUST be kept in sync.
+ */
+#ifdef __x86_64__
+int scmp_syscalls[] = {
+	SCMP_SYS(access),
+	SCMP_SYS(open),
+	SCMP_SYS(openat),
+	SCMP_SYS(lseek),
+	SCMP_SYS(clock_gettime),
+	SCMP_SYS(time),
+	SCMP_SYS(read),
+	SCMP_SYS(write),
+	SCMP_SYS(close),
+	SCMP_SYS(brk),
+	SCMP_SYS(poll),
+	SCMP_SYS(select),
+	SCMP_SYS(madvise),
+	SCMP_SYS(mmap),
+	SCMP_SYS(munmap),
+	SCMP_SYS(exit_group),
+	SCMP_SYS(rt_sigprocmask),
+	SCMP_SYS(rt_sigaction),
+	SCMP_SYS(fsync),
+	SCMP_SYS(rt_sigreturn),
+	SCMP_SYS(setsid),
+	SCMP_SYS(chdir),
+	SCMP_SYS(futex),
+	SCMP_SYS(stat),
+	SCMP_SYS(rt_sigsuspend),
+	SCMP_SYS(fstat),
+	SCMP_SYS(epoll_ctl),
+	SCMP_SYS(gettimeofday),
+	SCMP_SYS(getpid),
+#ifdef HAVE_GETRANDOM
+	SCMP_SYS(getrandom),
+#endif
+	SCMP_SYS(rename),
+	SCMP_SYS(unlink),
+	SCMP_SYS(socket),
+	SCMP_SYS(sendto),
+#ifndef ISC_PLATFORM_USETHREADS
+	SCMP_SYS(bind),
+	SCMP_SYS(accept),
+	SCMP_SYS(connect),
+	SCMP_SYS(listen),
+	SCMP_SYS(fcntl),
+	SCMP_SYS(sendmsg),
+	SCMP_SYS(recvmsg),
+	SCMP_SYS(uname),
+	SCMP_SYS(setrlimit),
+	SCMP_SYS(getrlimit),
+	SCMP_SYS(setsockopt),
+	SCMP_SYS(getsockopt),
+	SCMP_SYS(getsockname),
+	SCMP_SYS(lstat),
+	SCMP_SYS(getgid),
+	SCMP_SYS(getegid),
+	SCMP_SYS(getuid),
+	SCMP_SYS(geteuid),
+	SCMP_SYS(setresgid),
+	SCMP_SYS(setresuid),
+	SCMP_SYS(setgid),
+	SCMP_SYS(setuid),
+	SCMP_SYS(prctl),
+	SCMP_SYS(epoll_wait),
+	SCMP_SYS(getdents),
+	SCMP_SYS(utimes),
+	SCMP_SYS(dup),
+#endif
+};
+const char *scmp_syscall_names[] = {
+	"access",
+	"open",
+	"openat",
+	"lseek",
+	"clock_gettime",
+	"time",
+	"read",
+	"write",
+	"close",
+	"brk",
+	"poll",
+	"select",
+	"madvise",
+	"mmap",
+	"munmap",
+	"exit_group",
+	"rt_sigprocmask",
+	"rt_sigaction",
+	"fsync",
+	"rt_sigreturn",
+	"setsid",
+	"chdir",
+	"futex",
+	"stat",
+	"rt_sigsuspend",
+	"fstat",
+	"epoll_ctl",
+	"gettimeofday",
+	"getpid",
+#ifdef HAVE_GETRANDOM
+	"getrandom",
+#endif
+	"rename",
+	"unlink",
+	"socket",
+	"sendto",
+#ifndef ISC_PLATFORM_USETHREADS
+	"bind",
+	"accept",
+	"connect",
+	"listen",
+	"fcntl",
+	"sendmsg",
+	"recvmsg",
+	"uname",
+	"setrlimit",
+	"getrlimit",
+	"setsockopt",
+	"getsockopt",
+	"getsockname",
+	"lstat",
+	"getgid",
+	"getegid",
+	"getuid",
+	"geteuid",
+	"setresgid",
+	"setresuid",
+	"setgid",
+	"setuid",
+	"prctl",
+	"epoll_wait",
+	"getdents",
+	"utimes",
+	"dup",
+#endif
+};
+#endif /* __x86_64__ */
+#ifdef __i386__
+int scmp_syscalls[] = {
+	SCMP_SYS(access),
+	SCMP_SYS(open),
+	SCMP_SYS(clock_gettime),
+	SCMP_SYS(time),
+	SCMP_SYS(read),
+	SCMP_SYS(write),
+	SCMP_SYS(close),
+	SCMP_SYS(brk),
+	SCMP_SYS(poll),
+	SCMP_SYS(_newselect),
+	SCMP_SYS(select),
+	SCMP_SYS(madvise),
+	SCMP_SYS(mmap2),
+	SCMP_SYS(mmap),
+	SCMP_SYS(munmap),
+	SCMP_SYS(exit_group),
+	SCMP_SYS(rt_sigprocmask),
+	SCMP_SYS(sigprocmask),
+	SCMP_SYS(rt_sigaction),
+	SCMP_SYS(socketcall),
+	SCMP_SYS(fsync),
+	SCMP_SYS(sigreturn),
+	SCMP_SYS(setsid),
+	SCMP_SYS(chdir),
+	SCMP_SYS(futex),
+	SCMP_SYS(stat64),
+	SCMP_SYS(rt_sigsuspend),
+	SCMP_SYS(fstat64),
+	SCMP_SYS(epoll_ctl),
+	SCMP_SYS(gettimeofday),
+	SCMP_SYS(getpid),
+#ifdef HAVE_GETRANDOM
+	SCMP_SYS(getrandom),
+#endif
+	SCMP_SYS(unlink),
+#ifndef ISC_PLATFORM_USETHREADS
+	SCMP_SYS(fcntl64),
+#endif
+};
+const char *scmp_syscall_names[] = {
+	"access",
+	"open",
+	"clock_gettime",
+	"time",
+	"read",
+	"write",
+	"close",
+	"brk",
+	"poll",
+	"_newselect",
+	"select",
+	"madvise",
+	"mmap2",
+	"mmap",
+	"munmap",
+	"exit_group",
+	"rt_sigprocmask",
+	"sigprocmask",
+	"rt_sigaction",
+	"socketcall",
+	"fsync",
+	"sigreturn",
+	"setsid",
+	"chdir",
+	"futex",
+	"stat64",
+	"rt_sigsuspend",
+	"fstat64",
+	"epoll_ctl",
+	"gettimeofday",
+	"getpid",
+#ifdef HAVE_GETRANDOM
+	"getrandom",
+#endif
+	"unlink",
+#ifndef ISC_PLATFORM_USETHREADS
+	"fcntl64",
+#endif
+};
+#endif /* __i386__ */
+#endif /* HAVE_LIBSECCOMP */
+
+#endif /* NAMED_SECCOMP_H */

bin/named/include/named/tkeyconf.h

@@ -23,7 +23,7 @@ ISC_LANG_BEGINDECLS
 
 isc_result_t
 named_tkeyctx_fromconfig(const cfg_obj_t *options, isc_mem_t *mctx,
-			 dns_tkeyctx_t **tctxp);
+			 isc_entropy_t *ectx, dns_tkeyctx_t **tctxp);
 /*%<
  * 	Create a TKEY context and configure it, including the default DH key
  *	and default domain, according to 'options'.
@@ -31,6 +31,7 @@ named_tkeyctx_fromconfig(const cfg_obj_t *options, isc_mem_t *mctx,
  *	Requires:
  *\li		'cfg' is a valid configuration options object.
  *\li		'mctx' is not NULL
+ *\li		'ectx' is not NULL
  *\li		'tctx' is not NULL
  *\li		'*tctx' is NULL
  *

bin/named/main.c

@@ -21,6 +21,7 @@
 #include <isc/backtrace.h>
 #include <isc/commandline.h>
 #include <isc/dir.h>
+#include <isc/entropy.h>
 #include <isc/file.h>
 #include <isc/hash.h>
 #include <isc/httpd.h>
@@ -44,7 +45,7 @@
 #include <dns/view.h>
 
 #include <dst/result.h>
-#if USE_PKCS11
+#ifdef PKCS11CRYPTO
 #include <pk11/result.h>
 #endif
 
@@ -71,12 +72,15 @@
 #include <named/os.h>
 #include <named/server.h>
 #include <named/main.h>
+#include <named/seccomp.h>
 #ifdef HAVE_LIBSCF
 #include <named/smf_globals.h>
 #endif
 
+#ifdef OPENSSL
 #include <openssl/opensslv.h>
 #include <openssl/crypto.h>
+#endif
 #ifdef HAVE_LIBXML2
 #include <libxml/xmlversion.h>
 #endif
@@ -466,7 +470,6 @@ parse_fuzz_arg(void) {
 static void
 parse_T_opt(char *option) {
 	const char *p;
-	char *last = NULL;
 	/*
 	 * force the server to behave (or misbehave) in
 	 * specified ways for testing purposes.
@@ -509,7 +512,7 @@ parse_T_opt(char *option) {
 	} else if (!strncmp(option, "maxudp=", 7)) {
 		maxudp = atoi(option + 7);
 	} else if (!strncmp(option, "mkeytimers=", 11)) {
-		p = strtok_r(option + 11, "/", &last);
+		p = strtok(option + 11, "/");
 		if (p == NULL) {
 			named_main_earlyfatal("bad mkeytimer");
 		}
@@ -519,7 +522,7 @@ parse_T_opt(char *option) {
 			named_main_earlyfatal("bad mkeytimer");
 		}
 
-		p = strtok_r(NULL, "/", &last);
+		p = strtok(NULL, "/");
 		if (p == NULL) {
 			dns_zone_mkey_day = (24 * dns_zone_mkey_hour);
 			dns_zone_mkey_month = (30 * dns_zone_mkey_day);
@@ -530,7 +533,7 @@ parse_T_opt(char *option) {
 		if (dns_zone_mkey_day < dns_zone_mkey_hour)
 			named_main_earlyfatal("bad mkeytimer");
 
-		p = strtok_r(NULL, "/", &last);
+		p = strtok(NULL, "/");
 		if (p == NULL) {
 			dns_zone_mkey_month = (30 * dns_zone_mkey_day);
 			return;
@@ -689,6 +692,7 @@ parse_command_line(int argc, char *argv[]) {
 #ifdef __SUNPRO_C
 			printf("compiled by Solaris Studio %x\n", __SUNPRO_C);
 #endif
+#ifdef OPENSSL
 			printf("compiled with OpenSSL version: %s\n",
 			       OPENSSL_VERSION_TEXT);
 #if !defined(LIBRESSL_VERSION_NUMBER) && \
@@ -700,6 +704,7 @@ parse_command_line(int argc, char *argv[]) {
 			printf("linked to OpenSSL version: %s\n",
 			       SSLeay_version(SSLEAY_VERSION));
 #endif /* OPENSSL_VERSION_NUMBER >= 0x10100000L */
+#endif
 #ifdef HAVE_LIBXML2
 			printf("compiled with libxml2 version: %s\n",
 			       LIBXML_DOTTED_VERSION);
@@ -718,7 +723,11 @@ parse_command_line(int argc, char *argv[]) {
 			printf("linked to zlib version: %s\n",
 			       zlibVersion());
 #endif
+#ifdef ISC_PLATFORM_USETHREADS
 			printf("threads support is enabled\n");
+#else
+			printf("threads support is disabled\n");
+#endif
 			exit(0);
 		case 'x':
 			/* Obsolete. No longer in use. Ignore. */
@@ -770,6 +779,7 @@ create_managers(void) {
 
 	INSIST(named_g_cpus_detected > 0);
 
+#ifdef ISC_PLATFORM_USETHREADS
 	if (named_g_cpus == 0)
 		named_g_cpus = named_g_cpus_detected;
 	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
@@ -778,6 +788,9 @@ create_managers(void) {
 		      named_g_cpus_detected,
 		      named_g_cpus_detected == 1 ? "" : "s",
 		      named_g_cpus, named_g_cpus == 1 ? "" : "s");
+#else
+	named_g_cpus = 1;
+#endif
 #ifdef WIN32
 	named_g_udpdisp = 1;
 #else
@@ -790,10 +803,12 @@ create_managers(void) {
 	if (named_g_udpdisp > named_g_cpus)
 		named_g_udpdisp = named_g_cpus;
 #endif
+#ifdef ISC_PLATFORM_USETHREADS
 	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 		      NAMED_LOGMODULE_SERVER, ISC_LOG_INFO,
 		      "using %u UDP listener%s per interface",
 		      named_g_udpdisp, named_g_udpdisp == 1 ? "" : "s");
+#endif
 
 	result = isc_taskmgr_create(named_g_mctx, named_g_cpus, 0,
 				    &named_g_taskmgr);
@@ -820,7 +835,7 @@ create_managers(void) {
 				 isc_result_totext(result));
 		return (ISC_R_UNEXPECTED);
 	}
-	isc_socketmgr_maxudp(named_g_socketmgr, maxudp);
+	isc__socketmgr_maxudp(named_g_socketmgr, maxudp);
 	result = isc_socketmgr_getmaxsockets(named_g_socketmgr, &socks);
 	if (result == ISC_R_SUCCESS) {
 		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
@@ -828,6 +843,23 @@ create_managers(void) {
 			      ISC_LOG_INFO, "using up to %u sockets", socks);
 	}
 
+	result = isc_entropy_create(named_g_mctx, &named_g_entropy);
+	if (result != ISC_R_SUCCESS) {
+		UNEXPECTED_ERROR(__FILE__, __LINE__,
+				 "isc_entropy_create() failed: %s",
+				 isc_result_totext(result));
+		return (ISC_R_UNEXPECTED);
+	}
+
+	result = isc_hash_create(named_g_mctx, named_g_entropy,
+				 DNS_NAME_MAXWIRE);
+	if (result != ISC_R_SUCCESS) {
+		UNEXPECTED_ERROR(__FILE__, __LINE__,
+				 "isc_hash_create() failed: %s",
+				 isc_result_totext(result));
+		return (ISC_R_UNEXPECTED);
+	}
+
 	return (ISC_R_SUCCESS);
 }
 
@@ -839,6 +871,13 @@ destroy_managers(void) {
 	isc_taskmgr_destroy(&named_g_taskmgr);
 	isc_timermgr_destroy(&named_g_timermgr);
 	isc_socketmgr_destroy(&named_g_socketmgr);
+
+	/*
+	 * isc_hash_destroy() cannot be called as long as a resolver may be
+	 * running.  Calling this after isc_taskmgr_destroy() ensures the
+	 * call is safe.
+	 */
+	isc_hash_destroy();
 }
 
 static void
@@ -870,6 +909,60 @@ dump_symboltable(void) {
 	}
 }
 
+#ifdef HAVE_LIBSECCOMP
+static void
+setup_seccomp() {
+	scmp_filter_ctx ctx;
+	unsigned int i;
+	int ret;
+
+	/* Make sure the lists are in sync */
+	INSIST((sizeof(scmp_syscalls) / sizeof(int)) ==
+	       (sizeof(scmp_syscall_names) / sizeof(const char *)));
+
+	ctx = seccomp_init(SCMP_ACT_KILL);
+	if (ctx == NULL) {
+		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+			      NAMED_LOGMODULE_MAIN, ISC_LOG_WARNING,
+			      "libseccomp activation failed");
+		return;
+	}
+
+	for (i = 0 ; i < sizeof(scmp_syscalls)/sizeof(*(scmp_syscalls)); i++) {
+		ret = seccomp_rule_add(ctx, SCMP_ACT_ALLOW,
+				       scmp_syscalls[i], 0);
+		if (ret < 0)
+			isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+				      NAMED_LOGMODULE_MAIN, ISC_LOG_WARNING,
+				      "libseccomp rule failed: %s",
+				      scmp_syscall_names[i]);
+
+		else
+			isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+				      NAMED_LOGMODULE_MAIN, ISC_LOG_DEBUG(9),
+				      "added libseccomp rule: %s",
+				      scmp_syscall_names[i]);
+	}
+
+	ret = seccomp_load(ctx);
+	if (ret < 0) {
+		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+			      NAMED_LOGMODULE_MAIN, ISC_LOG_WARNING,
+			      "libseccomp unable to load filter");
+	} else {
+		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+			      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
+			      "libseccomp sandboxing active");
+	}
+
+	/*
+	 * Release filter in ctx. Filters already loaded are not
+	 * affected.
+	 */
+	seccomp_release(ctx);
+}
+#endif /* HAVE_LIBSECCOMP */
+
 static void
 setup(void) {
 	isc_result_t result;
@@ -905,10 +998,36 @@ setup(void) {
 		isc_mem_free(named_g_mctx, instance);
 #endif /* HAVE_LIBSCF */
 
+#ifdef PATH_RANDOMDEV
+	/*
+	 * Initialize system's random device as fallback entropy source
+	 * if running chroot'ed.
+	 */
+	if (named_g_chrootdir != NULL) {
+		result = isc_entropy_create(named_g_mctx,
+					    &named_g_fallbackentropy);
+		if (result != ISC_R_SUCCESS)
+			named_main_earlyfatal("isc_entropy_create() failed: %s",
+					   isc_result_totext(result));
+
+		result = isc_entropy_createfilesource(named_g_fallbackentropy,
+						      PATH_RANDOMDEV);
+		if (result != ISC_R_SUCCESS) {
+			named_main_earlywarning("could not open pre-chroot "
+					     "entropy source %s: %s",
+					     PATH_RANDOMDEV,
+					     isc_result_totext(result));
+			isc_entropy_detach(&named_g_fallbackentropy);
+		}
+	}
+#endif
+
+#ifdef ISC_PLATFORM_USETHREADS
 	/*
 	 * Check for the number of cpu's before named_os_chroot().
 	 */
 	named_g_cpus_detected = isc_os_ncpus();
+#endif
 
 	named_os_chroot(named_g_chrootdir);
 
@@ -1035,9 +1154,15 @@ setup(void) {
 		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
 		      "linked to zlib version: %s", zlibVersion());
 #endif
+#ifdef ISC_PLATFORM_USETHREADS
 	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
 		      "threads support is enabled");
+#else
+	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
+		      "threads support is disabled");
+#endif
 
 	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
@@ -1175,6 +1300,10 @@ setup(void) {
 		ns_server_setoption(sctx, NS_SERVER_SIGVALINSECS, ISC_TRUE);
 
 	named_g_server->sctx->delay = delay;
+
+#ifdef HAVE_LIBSECCOMP
+	setup_seccomp();
+#endif /* HAVE_LIBSECCOMP */
 }
 
 static void
@@ -1184,6 +1313,10 @@ cleanup(void) {
 	if (named_g_mapped != NULL)
 		dns_acl_detach(&named_g_mapped);
 
+	isc_entropy_detach(&named_g_entropy);
+	if (named_g_fallbackentropy != NULL)
+		isc_entropy_detach(&named_g_fallbackentropy);
+
 	named_server_destroy(&named_g_server);
 
 	named_builtin_deinit();
@@ -1296,13 +1429,255 @@ named_smf_get_instance(char **ins_name, int debug, isc_mem_t *mctx) {
 }
 #endif /* HAVE_LIBSCF */
 
+#include <named/globals.h>
+
+#include <arpa/inet.h>
+#include <errno.h>
+#include <fcntl.h>
+#include <net/if.h>
+#include <net/route.h>
+#include <netinet/ip6.h>
+#include <netinet/tcp.h>
+#include <pthread.h>
+#include <sched.h>
+#include <sys/ioctl.h>
+#include <sys/resource.h>
+#include <sys/socket.h>
+#include <sys/stat.h>
+#include <sys/time.h>
+#include <sys/types.h>
+#include <sys/uio.h>
+#include <sys/wait.h>
+#include <unistd.h>
+
+#include <libhfcommon/util.h>
+#include <libhfuzz/libhfuzz.h>
+
+static void enter_namespaces(void) {
+    if (linuxEnterNs(CLONE_NEWUSER | CLONE_NEWNET | CLONE_NEWNS | CLONE_NEWIPC) == false) {
+        exit(1);
+    }
+    if (linuxIfaceUp("lo") == false) {
+        exit(1);
+    }
+    if (linuxMountTmpfs("/tmp") == false) {
+        exit(1);
+    }
+}
+
+static size_t rlen = 0;
+static const uint8_t *rbuf = NULL;
+
+__attribute__((no_sanitize("memory"))) __attribute__((no_sanitize("address"))) static void *
+bind_thr(void *unused __attribute__((unused))) {
+    while (!named_g_run_done) {
+        usleep(10000);
+    }
+
+    int myfd = socket(AF_INET, SOCK_STREAM, IPPROTO_IP);
+    if (myfd == -1) {
+        perror("socket");
+        exit(1);
+    }
+    int val = 1;
+    if (setsockopt(myfd, SOL_SOCKET, SO_REUSEADDR, &val, sizeof(val)) == -1) {
+        perror("setsockopt(SO_REUSEADDR)");
+    }
+
+    const struct sockaddr_in saddr = {
+        .sin_family = AF_INET,
+        .sin_port = htons(53),
+        .sin_addr.s_addr = inet_addr("127.0.0.2"),
+    };
+    if (bind(myfd, &saddr, sizeof(saddr)) == -1) {
+        perror("bind");
+        exit(1);
+    }
+
+    if (listen(myfd, SOMAXCONN) == -1) {
+        perror("listen");
+        exit(1);
+    }
+
+    for (;;) {
+        struct sockaddr_in cli;
+        socklen_t cli_len = sizeof(cli);
+
+        int nfd = accept(myfd, &cli, &cli_len);
+        if (nfd == -1) {
+            perror("accept");
+            exit(1);
+        }
+
+        static char b[1024 * 1024];
+        ssize_t sz = recv(nfd, b, sizeof(b), 0);
+        if (sz <= 0) {
+            perror("recv");
+            _exit(1);
+        }
+        if (sz < 4) {
+            close(nfd);
+            continue;
+        }
+
+        uint16_t t_l = htons(rlen + 2);
+        const struct iovec iov[] = {
+            {
+                .iov_base = &t_l,
+                .iov_len = sizeof(t_l),
+            },
+            {
+                .iov_base = &b[2],
+                .iov_len = 2,
+            },
+            {
+                .iov_base = (void *)rbuf,
+                .iov_len = rlen,
+            },
+        };
+
+        if (writev(nfd, iov, 3) == -1) {
+            perror("writev() failed");
+        }
+
+        close(nfd);
+    }
+
+    return NULL;
+}
+
+static void rndloop(int sock) {
+    const struct sockaddr_in bsaddr = {
+        .sin_family = AF_INET,
+        .sin_port = htons(0),
+        .sin_addr.s_addr = htonl((((uint32_t)util_rnd64()) & 0x00FFFFFF) | 0x7F000000),
+    };
+    if (bind(sock, (const struct sockaddr *)&bsaddr, sizeof(bsaddr)) == -1) {
+        perror("bind");
+    }
+}
+
+__attribute__((no_sanitize("memory"))) __attribute__((no_sanitize("address"))) static void *
+connect_thr(void *unused __attribute__((unused))) {
+    while (!named_g_run_done) {
+        usleep(10000);
+    }
+    usleep(100000);
+
+    for (;;) {
+        int myfd = socket(AF_INET, SOCK_STREAM, IPPROTO_IP);
+        if (myfd == -1) {
+            perror("socket");
+            exit(1);
+        }
+        int val = 1;
+        if (setsockopt(myfd, SOL_SOCKET, SO_REUSEADDR, &val, sizeof(val)) == -1) {
+            perror("setsockopt(SO_REUSEADDR)");
+        }
+
+        rndloop(myfd);
+
+        const struct sockaddr_in saddr = {
+            .sin_family = AF_INET,
+            .sin_port = htons(53),
+            .sin_addr.s_addr = htonl(INADDR_LOOPBACK),
+        };
+        if (connect(myfd, &saddr, sizeof(saddr)) == -1) {
+            close(myfd);
+            continue;
+        }
+
+        const uint8_t *buf;
+        size_t len;
+        HF_ITER(&buf, &len);
+
+        rlen = 0;
+        rbuf = NULL;
+
+        if (len < 32) {
+            close(myfd);
+            continue;
+        }
+
+        uint32_t tmplen = *((const uint32_t *)buf);
+
+        buf = &buf[sizeof(uint32_t)];
+        len -= sizeof(uint32_t);
+
+        tmplen %= len;
+
+        rbuf = &buf[tmplen];
+        rlen = len - tmplen;
+        len = tmplen;
+
+        uint16_t t_l = htons(len);
+        const struct iovec iov[] = {
+            {
+                .iov_base = &t_l,
+                .iov_len = sizeof(t_l),
+            },
+            {
+                .iov_base = (void *)buf,
+                .iov_len = len,
+            },
+        };
+
+        if (writev(myfd, iov, 2) == -1) {
+            perror("write");
+            close(myfd);
+            continue;
+        }
+
+        if (shutdown(myfd, SHUT_WR) == -1) {
+            if (errno == ENOTCONN) {
+                close(myfd);
+                continue;
+            }
+            perror("shutdown");
+            _exit(1);
+        }
+
+        uint8_t b[1024 * 512];
+        while (recv(myfd, b, sizeof(b), 0) > 0)
+            ;
+        close(myfd);
+    }
+}
+
+static void launch_thr(void) {
+    pthread_attr_t attr;
+    pthread_attr_init(&attr);
+    pthread_attr_setstacksize(&attr, 1024 * 1024 * 4);
+    pthread_attr_setdetachstate(&attr, PTHREAD_CREATE_DETACHED);
+
+    pthread_t t;
+    if (pthread_create(&t, &attr, bind_thr, NULL) < 0) {
+        perror("pthread_create(bind_thr)");
+        exit(1);
+    }
+
+    pthread_attr_init(&attr);
+    pthread_attr_setstacksize(&attr, 1024 * 1024 * 4);
+    pthread_attr_setdetachstate(&attr, PTHREAD_CREATE_DETACHED);
+    if (pthread_create(&t, &attr, connect_thr, NULL) < 0) {
+        perror("pthread_create(connect_thr)");
+        exit(1);
+    }
+}
+
 /* main entry point, possibly hooked */
 
-int
-main(int argc, char *argv[]) {
-	isc_result_t result;
+int main(int argc, char *argv[]) {
+    if (!getenv("NO_FUZZ")) {
+        named_g_fuzz_addr = "127.0.0.1:53";
+        named_g_fuzz_type = isc_fuzz_client;
+        enter_namespaces();
+        launch_thr();
+    }
+
+    isc_result_t result;
 #ifdef HAVE_LIBSCF
-	char *instance = NULL;
+    char *instance = NULL;
 #endif
 
 #ifdef HAVE_GPERFTOOLS_PROFILER
@@ -1336,7 +1711,7 @@ main(int argc, char *argv[]) {
 	dns_result_register();
 	dst_result_register();
 	isccc_result_register();
-#if USE_PKCS11
+#ifdef PKCS11CRYPTO
 	pk11_result_register();
 #endif
 
@@ -1351,17 +1726,17 @@ main(int argc, char *argv[]) {
 
 	parse_command_line(argc, argv);
 
-#ifdef ENABLE_AFL
+#if 0
 	if (named_g_fuzz_type != isc_fuzz_none) {
 		named_fuzz_setup();
 	}
+#endif
 
 	if (named_g_fuzz_type == isc_fuzz_resolver) {
 		dns_resolver_setfuzzing();
 	} else if (named_g_fuzz_type == isc_fuzz_http) {
 		isc_httpd_setfinishhook(named_fuzz_notify);
 	}
-#endif
 	/*
 	 * Warn about common configuration error.
 	 */

bin/named/named.conf.5

@@ -10,12 +10,12 @@
 .\"     Title: named.conf
 .\"    Author: 
 .\" Generator: DocBook XSL Stylesheets v1.78.1 <http://docbook.sf.net/>
-.\"      Date: 2018-05-29
+.\"      Date: 2018-06-21
 .\"    Manual: BIND9
 .\"    Source: ISC
 .\"  Language: English
 .\"
-.TH "NAMED\&.CONF" "5" "2018\-05\-29" "ISC" "BIND9"
+.TH "NAMED\&.CONF" "5" "2018\-06\-21" "ISC" "BIND9"
 .\" -----------------------------------------------------------------
 .\" * Define some portability stuff
 .\" -----------------------------------------------------------------
@@ -199,6 +199,7 @@ options {
 	    ] [ dscp \fIinteger\fR ];
 	alt\-transfer\-source\-v6 ( \fIipv6_address\fR | * ) [ port ( \fIinteger\fR |
 	    * ) ] [ dscp \fIinteger\fR ];
+	answer\-cookie \fIboolean\fR;
 	attach\-cache \fIstring\fR;
 	auth\-nxdomain \fIboolean\fR; // default changed
 	auto\-dnssec ( allow | maintain | off );
@@ -212,14 +213,13 @@ options {
 	    \fIinteger\fR ] [ dscp \fIinteger\fR ] { ( \fImasters\fR | \fIipv4_address\fR [
 	    port \fIinteger\fR ] | \fIipv6_address\fR [ port \fIinteger\fR ] ) [ key
 	    \fIstring\fR ]; \&.\&.\&. } ] [ zone\-directory \fIquoted_string\fR ] [
-	    in\-memory \fIboolean\fR ] [ min\-update\-interval \fIttlval\fR ]; \&.\&.\&. };
+	    in\-memory \fIboolean\fR ] [ min\-update\-interval \fIinteger\fR ]; \&.\&.\&. };
 	check\-dup\-records ( fail | warn | ignore );
 	check\-integrity \fIboolean\fR;
 	check\-mx ( fail | warn | ignore );
 	check\-mx\-cname ( fail | warn | ignore );
-	check\-names ( primary | master |
-	    secondary | slave | response ) (
-	    fail | warn | ignore );
+	check\-names ( master | slave | response
+	    ) ( fail | warn | ignore );
 	check\-sibling \fIboolean\fR;
 	check\-spf ( warn | ignore );
 	check\-srv\-cname ( fail | warn | ignore );
@@ -251,7 +251,6 @@ options {
 	};
 	dns64\-contact \fIstring\fR;
 	dns64\-server \fIstring\fR;
-	dnskey\-sig\-validity \fIinteger\fR;
 	dnsrps\-enable \fIboolean\fR;
 	dnsrps\-options { \fIunspecified\-text\fR };
 	dnssec\-accept\-expired \fIboolean\fR;
@@ -300,15 +299,15 @@ options {
 	fstrm\-set\-output\-notify\-threshold \fIinteger\fR;
 	fstrm\-set\-output\-queue\-model ( mpsc | spsc );
 	fstrm\-set\-output\-queue\-size \fIinteger\fR;
-	fstrm\-set\-reopen\-interval \fIttlval\fR;
+	fstrm\-set\-reopen\-interval \fIinteger\fR;
 	geoip\-directory ( \fIquoted_string\fR | none );
+	geoip\-use\-ecs \fIboolean\fR;
 	glue\-cache \fIboolean\fR;
 	heartbeat\-interval \fIinteger\fR;
 	hostname ( \fIquoted_string\fR | none );
 	inline\-signing \fIboolean\fR;
-	interface\-interval \fIttlval\fR;
-	ixfr\-from\-differences ( primary | master | secondary | slave |
-	    \fIboolean\fR );
+	interface\-interval \fIinteger\fR;
+	ixfr\-from\-differences ( master | slave | \fIboolean\fR );
 	keep\-response\-order { \fIaddress_match_element\fR; \&.\&.\&. };
 	key\-directory \fIquoted_string\fR;
 	lame\-ttl \fIttlval\fR;
@@ -325,10 +324,10 @@ options {
 	masterfile\-style ( full | relative );
 	match\-mapped\-addresses \fIboolean\fR;
 	max\-cache\-size ( default | unlimited | \fIsizeval\fR | \fIpercentage\fR );
-	max\-cache\-ttl \fIttlval\fR;
+	max\-cache\-ttl \fIinteger\fR;
 	max\-clients\-per\-query \fIinteger\fR;
 	max\-journal\-size ( default | unlimited | \fIsizeval\fR );
-	max\-ncache\-ttl \fIttlval\fR;
+	max\-ncache\-ttl \fIinteger\fR;
 	max\-records \fIinteger\fR;
 	max\-recursion\-depth \fIinteger\fR;
 	max\-recursion\-queries \fIinteger\fR;
@@ -369,7 +368,6 @@ options {
 	preferred\-glue \fIstring\fR;
 	prefetch \fIinteger\fR [ \fIinteger\fR ];
 	provide\-ixfr \fIboolean\fR;
-	qname\-minimization ( strict | relaxed | disabled );
 	query\-source ( ( [ address ] ( \fIipv4_address\fR | * ) [ port (
 	    \fIinteger\fR | * ) ] ) | ( [ [ address ] ( \fIipv4_address\fR | * ) ]
 	    port ( \fIinteger\fR | * ) ) ) [ dscp \fIinteger\fR ];
@@ -409,12 +407,12 @@ options {
 	response\-padding { \fIaddress_match_element\fR; \&.\&.\&. } block\-size
 	    \fIinteger\fR;
 	response\-policy { zone \fIquoted_string\fR [ log \fIboolean\fR ] [
-	    max\-policy\-ttl \fIttlval\fR ] [ min\-update\-interval \fIttlval\fR ] [
+	    max\-policy\-ttl \fIinteger\fR ] [ min\-update\-interval \fIinteger\fR ] [
 	    policy ( cname | disabled | drop | given | no\-op | nodata |
 	    nxdomain | passthru | tcp\-only \fIquoted_string\fR ) ] [
 	    recursive\-only \fIboolean\fR ] [ nsip\-enable \fIboolean\fR ] [
 	    nsdname\-enable \fIboolean\fR ]; \&.\&.\&. } [ break\-dnssec \fIboolean\fR ] [
-	    max\-policy\-ttl \fIttlval\fR ] [ min\-update\-interval \fIttlval\fR ] [
+	    max\-policy\-ttl \fIinteger\fR ] [ min\-update\-interval \fIinteger\fR ] [
 	    min\-ns\-dots \fIinteger\fR ] [ nsip\-wait\-recurse \fIboolean\fR ] [
 	    qname\-wait\-recurse \fIboolean\fR ] [ recursive\-only \fIboolean\fR ] [
 	    nsip\-enable \fIboolean\fR ] [ nsdname\-enable \fIboolean\fR ] [
@@ -582,14 +580,13 @@ view \fIstring\fR [ \fIclass\fR ] {
 	    \fIinteger\fR ] [ dscp \fIinteger\fR ] { ( \fImasters\fR | \fIipv4_address\fR [
 	    port \fIinteger\fR ] | \fIipv6_address\fR [ port \fIinteger\fR ] ) [ key
 	    \fIstring\fR ]; \&.\&.\&. } ] [ zone\-directory \fIquoted_string\fR ] [
-	    in\-memory \fIboolean\fR ] [ min\-update\-interval \fIttlval\fR ]; \&.\&.\&. };
+	    in\-memory \fIboolean\fR ] [ min\-update\-interval \fIinteger\fR ]; \&.\&.\&. };
 	check\-dup\-records ( fail | warn | ignore );
 	check\-integrity \fIboolean\fR;
 	check\-mx ( fail | warn | ignore );
 	check\-mx\-cname ( fail | warn | ignore );
-	check\-names ( primary | master |
-	    secondary | slave | response ) (
-	    fail | warn | ignore );
+	check\-names ( master | slave | response
+	    ) ( fail | warn | ignore );
 	check\-sibling \fIboolean\fR;
 	check\-spf ( warn | ignore );
 	check\-srv\-cname ( fail | warn | ignore );
@@ -620,7 +617,6 @@ view \fIstring\fR [ \fIclass\fR ] {
 	};
 	dns64\-contact \fIstring\fR;
 	dns64\-server \fIstring\fR;
-	dnskey\-sig\-validity \fIinteger\fR;
 	dnsrps\-enable \fIboolean\fR;
 	dnsrps\-options { \fIunspecified\-text\fR };
 	dnssec\-accept\-expired \fIboolean\fR;
@@ -656,8 +652,7 @@ view \fIstring\fR [ \fIclass\fR ] {
 	    | \fIipv6_address\fR ) [ port \fIinteger\fR ] [ dscp \fIinteger\fR ]; \&.\&.\&. };
 	glue\-cache \fIboolean\fR;
 	inline\-signing \fIboolean\fR;
-	ixfr\-from\-differences ( primary | master | secondary | slave |
-	    \fIboolean\fR );
+	ixfr\-from\-differences ( master | slave | \fIboolean\fR );
 	key \fIstring\fR {
 		algorithm \fIstring\fR;
 		secret \fIstring\fR;
@@ -674,10 +669,10 @@ view \fIstring\fR [ \fIclass\fR ] {
 	match\-destinations { \fIaddress_match_element\fR; \&.\&.\&. };
 	match\-recursive\-only \fIboolean\fR;
 	max\-cache\-size ( default | unlimited | \fIsizeval\fR | \fIpercentage\fR );
-	max\-cache\-ttl \fIttlval\fR;
+	max\-cache\-ttl \fIinteger\fR;
 	max\-clients\-per\-query \fIinteger\fR;
 	max\-journal\-size ( default | unlimited | \fIsizeval\fR );
-	max\-ncache\-ttl \fIttlval\fR;
+	max\-ncache\-ttl \fIinteger\fR;
 	max\-records \fIinteger\fR;
 	max\-recursion\-depth \fIinteger\fR;
 	max\-recursion\-queries \fIinteger\fR;
@@ -712,7 +707,6 @@ view \fIstring\fR [ \fIclass\fR ] {
 	preferred\-glue \fIstring\fR;
 	prefetch \fIinteger\fR [ \fIinteger\fR ];
 	provide\-ixfr \fIboolean\fR;
-	qname\-minimization ( strict | relaxed | disabled );
 	query\-source ( ( [ address ] ( \fIipv4_address\fR | * ) [ port (
 	    \fIinteger\fR | * ) ] ) | ( [ [ address ] ( \fIipv4_address\fR | * ) ]
 	    port ( \fIinteger\fR | * ) ) ) [ dscp \fIinteger\fR ];
@@ -747,12 +741,12 @@ view \fIstring\fR [ \fIclass\fR ] {
 	response\-padding { \fIaddress_match_element\fR; \&.\&.\&. } block\-size
 	    \fIinteger\fR;
 	response\-policy { zone \fIquoted_string\fR [ log \fIboolean\fR ] [
-	    max\-policy\-ttl \fIttlval\fR ] [ min\-update\-interval \fIttlval\fR ] [
+	    max\-policy\-ttl \fIinteger\fR ] [ min\-update\-interval \fIinteger\fR ] [
 	    policy ( cname | disabled | drop | given | no\-op | nodata |
 	    nxdomain | passthru | tcp\-only \fIquoted_string\fR ) ] [
 	    recursive\-only \fIboolean\fR ] [ nsip\-enable \fIboolean\fR ] [
 	    nsdname\-enable \fIboolean\fR ]; \&.\&.\&. } [ break\-dnssec \fIboolean\fR ] [
-	    max\-policy\-ttl \fIttlval\fR ] [ min\-update\-interval \fIttlval\fR ] [
+	    max\-policy\-ttl \fIinteger\fR ] [ min\-update\-interval \fIinteger\fR ] [
 	    min\-ns\-dots \fIinteger\fR ] [ nsip\-wait\-recurse \fIboolean\fR ] [
 	    qname\-wait\-recurse \fIboolean\fR ] [ recursive\-only \fIboolean\fR ] [
 	    nsip\-enable \fIboolean\fR ] [ nsdname\-enable \fIboolean\fR ] [
@@ -852,7 +846,6 @@ view \fIstring\fR [ \fIclass\fR ] {
 		dialup ( notify | notify\-passive | passive | refresh |
 		    \fIboolean\fR );
 		dlz \fIstring\fR;
-		dnskey\-sig\-validity \fIinteger\fR;
 		dnssec\-dnskey\-kskonly \fIboolean\fR;
 		dnssec\-loadkeys\-interval \fIinteger\fR;
 		dnssec\-secure\-to\-insecure \fIboolean\fR;
@@ -884,7 +877,6 @@ view \fIstring\fR [ \fIclass\fR ] {
 		max\-zone\-ttl ( unlimited | \fIttlval\fR );
 		min\-refresh\-time \fIinteger\fR;
 		min\-retry\-time \fIinteger\fR;
-		mirror \fIboolean\fR;
 		multi\-master \fIboolean\fR;
 		notify ( explicit | master\-only | \fIboolean\fR );
 		notify\-delay \fIinteger\fR;
@@ -911,9 +903,8 @@ view \fIstring\fR [ \fIclass\fR ] {
 		transfer\-source\-v6 ( \fIipv6_address\fR | * ) [ port (
 		    \fIinteger\fR | * ) ] [ dscp \fIinteger\fR ];
 		try\-tcp\-refresh \fIboolean\fR;
-		type ( primary | master | secondary | slave |
-		    delegation\-only | forward | hint | redirect |
-		    static\-stub | stub );
+		type ( delegation\-only | forward | hint | master | redirect
+		    | slave | static\-stub | stub );
 		update\-check\-ksk \fIboolean\fR;
 		update\-policy ( local | { ( deny | grant ) \fIstring\fR (
 		    6to4\-self | external | krb5\-self | krb5\-subdomain |
@@ -964,7 +955,6 @@ zone \fIstring\fR [ \fIclass\fR ] {
 	delegation\-only \fIboolean\fR;
 	dialup ( notify | notify\-passive | passive | refresh | \fIboolean\fR );
 	dlz \fIstring\fR;
-	dnskey\-sig\-validity \fIinteger\fR;
 	dnssec\-dnskey\-kskonly \fIboolean\fR;
 	dnssec\-loadkeys\-interval \fIinteger\fR;
 	dnssec\-secure\-to\-insecure \fIboolean\fR;
@@ -994,7 +984,6 @@ zone \fIstring\fR [ \fIclass\fR ] {
 	max\-zone\-ttl ( unlimited | \fIttlval\fR );
 	min\-refresh\-time \fIinteger\fR;
 	min\-retry\-time \fIinteger\fR;
-	mirror \fIboolean\fR;
 	multi\-master \fIboolean\fR;
 	notify ( explicit | master\-only | \fIboolean\fR );
 	notify\-delay \fIinteger\fR;
@@ -1019,8 +1008,8 @@ zone \fIstring\fR [ \fIclass\fR ] {
 	transfer\-source\-v6 ( \fIipv6_address\fR | * ) [ port ( \fIinteger\fR | * )
 	    ] [ dscp \fIinteger\fR ];
 	try\-tcp\-refresh \fIboolean\fR;
-	type ( primary | master | secondary | slave | delegation\-only |
-	    forward | hint | redirect | static\-stub | stub );
+	type ( delegation\-only | forward | hint | master | redirect | slave
+	    | static\-stub | stub );
 	update\-check\-ksk \fIboolean\fR;
 	update\-policy ( local | { ( deny | grant ) \fIstring\fR ( 6to4\-self |
 	    external | krb5\-self | krb5\-subdomain | ms\-self | ms\-subdomain

bin/named/named.conf.docbook

@@ -13,7 +13,7 @@
 
 <refentry xmlns:db="http://docbook.org/ns/docbook" version="5.0" xml:id="man.named.conf">
   <info>
-    <date>2018-05-29</date>
+    <date>2018-06-21</date>
   </info>
   <refentryinfo>
     <corpname>ISC</corpname>
@@ -192,6 +192,7 @@ options {
 	    ] [ dscp <replaceable>integer</replaceable> ];
 	alt-transfer-source-v6 ( <replaceable>ipv6_address</replaceable> | * ) [ port ( <replaceable>integer</replaceable> |
 	    * ) ] [ dscp <replaceable>integer</replaceable> ];
+	answer-cookie <replaceable>boolean</replaceable>;
 	attach-cache <replaceable>string</replaceable>;
 	auth-nxdomain <replaceable>boolean</replaceable>; // default changed
 	auto-dnssec ( allow | maintain | off );
@@ -205,14 +206,13 @@ options {
 	    <replaceable>integer</replaceable> ] [ dscp <replaceable>integer</replaceable> ] { ( <replaceable>masters</replaceable> | <replaceable>ipv4_address</replaceable> [
 	    port <replaceable>integer</replaceable> ] | <replaceable>ipv6_address</replaceable> [ port <replaceable>integer</replaceable> ] ) [ key
 	    <replaceable>string</replaceable> ]; ... } ] [ zone-directory <replaceable>quoted_string</replaceable> ] [
-	    in-memory <replaceable>boolean</replaceable> ] [ min-update-interval <replaceable>ttlval</replaceable> ]; ... };
+	    in-memory <replaceable>boolean</replaceable> ] [ min-update-interval <replaceable>integer</replaceable> ]; ... };
 	check-dup-records ( fail | warn | ignore );
 	check-integrity <replaceable>boolean</replaceable>;
 	check-mx ( fail | warn | ignore );
 	check-mx-cname ( fail | warn | ignore );
-	check-names ( primary | master |
-	    secondary | slave | response ) (
-	    fail | warn | ignore );
+	check-names ( master | slave | response
+	    ) ( fail | warn | ignore );
 	check-sibling <replaceable>boolean</replaceable>;
 	check-spf ( warn | ignore );
 	check-srv-cname ( fail | warn | ignore );
@@ -244,7 +244,6 @@ options {
 	};
 	dns64-contact <replaceable>string</replaceable>;
 	dns64-server <replaceable>string</replaceable>;
-	dnskey-sig-validity <replaceable>integer</replaceable>;
 	dnsrps-enable <replaceable>boolean</replaceable>;
 	dnsrps-options { <replaceable>unspecified-text</replaceable> };
 	dnssec-accept-expired <replaceable>boolean</replaceable>;
@@ -293,15 +292,15 @@ options {
 	fstrm-set-output-notify-threshold <replaceable>integer</replaceable>;
 	fstrm-set-output-queue-model ( mpsc | spsc );
 	fstrm-set-output-queue-size <replaceable>integer</replaceable>;
-	fstrm-set-reopen-interval <replaceable>ttlval</replaceable>;
+	fstrm-set-reopen-interval <replaceable>integer</replaceable>;
 	geoip-directory ( <replaceable>quoted_string</replaceable> | none );
+	geoip-use-ecs <replaceable>boolean</replaceable>;
 	glue-cache <replaceable>boolean</replaceable>;
 	heartbeat-interval <replaceable>integer</replaceable>;
 	hostname ( <replaceable>quoted_string</replaceable> | none );
 	inline-signing <replaceable>boolean</replaceable>;
-	interface-interval <replaceable>ttlval</replaceable>;
-	ixfr-from-differences ( primary | master | secondary | slave |
-	    <replaceable>boolean</replaceable> );
+	interface-interval <replaceable>integer</replaceable>;
+	ixfr-from-differences ( master | slave | <replaceable>boolean</replaceable> );
 	keep-response-order { <replaceable>address_match_element</replaceable>; ... };
 	key-directory <replaceable>quoted_string</replaceable>;
 	lame-ttl <replaceable>ttlval</replaceable>;
@@ -318,10 +317,10 @@ options {
 	masterfile-style ( full | relative );
 	match-mapped-addresses <replaceable>boolean</replaceable>;
 	max-cache-size ( default | unlimited | <replaceable>sizeval</replaceable> | <replaceable>percentage</replaceable> );
-	max-cache-ttl <replaceable>ttlval</replaceable>;
+	max-cache-ttl <replaceable>integer</replaceable>;
 	max-clients-per-query <replaceable>integer</replaceable>;
 	max-journal-size ( default | unlimited | <replaceable>sizeval</replaceable> );
-	max-ncache-ttl <replaceable>ttlval</replaceable>;
+	max-ncache-ttl <replaceable>integer</replaceable>;
 	max-records <replaceable>integer</replaceable>;
 	max-recursion-depth <replaceable>integer</replaceable>;
 	max-recursion-queries <replaceable>integer</replaceable>;
@@ -362,7 +361,6 @@ options {
 	preferred-glue <replaceable>string</replaceable>;
 	prefetch <replaceable>integer</replaceable> [ <replaceable>integer</replaceable> ];
 	provide-ixfr <replaceable>boolean</replaceable>;
-	qname-minimization ( strict | relaxed | disabled );
 	query-source ( ( [ address ] ( <replaceable>ipv4_address</replaceable> | * ) [ port (
 	    <replaceable>integer</replaceable> | * ) ] ) | ( [ [ address ] ( <replaceable>ipv4_address</replaceable> | * ) ]
 	    port ( <replaceable>integer</replaceable> | * ) ) ) [ dscp <replaceable>integer</replaceable> ];
@@ -402,12 +400,12 @@ options {
 	response-padding { <replaceable>address_match_element</replaceable>; ... } block-size
 	    <replaceable>integer</replaceable>;
 	response-policy { zone <replaceable>quoted_string</replaceable> [ log <replaceable>boolean</replaceable> ] [
-	    max-policy-ttl <replaceable>ttlval</replaceable> ] [ min-update-interval <replaceable>ttlval</replaceable> ] [
+	    max-policy-ttl <replaceable>integer</replaceable> ] [ min-update-interval <replaceable>integer</replaceable> ] [
 	    policy ( cname | disabled | drop | given | no-op | nodata |
 	    nxdomain | passthru | tcp-only <replaceable>quoted_string</replaceable> ) ] [
 	    recursive-only <replaceable>boolean</replaceable> ] [ nsip-enable <replaceable>boolean</replaceable> ] [
 	    nsdname-enable <replaceable>boolean</replaceable> ]; ... } [ break-dnssec <replaceable>boolean</replaceable> ] [
-	    max-policy-ttl <replaceable>ttlval</replaceable> ] [ min-update-interval <replaceable>ttlval</replaceable> ] [
+	    max-policy-ttl <replaceable>integer</replaceable> ] [ min-update-interval <replaceable>integer</replaceable> ] [
 	    min-ns-dots <replaceable>integer</replaceable> ] [ nsip-wait-recurse <replaceable>boolean</replaceable> ] [
 	    qname-wait-recurse <replaceable>boolean</replaceable> ] [ recursive-only <replaceable>boolean</replaceable> ] [
 	    nsip-enable <replaceable>boolean</replaceable> ] [ nsdname-enable <replaceable>boolean</replaceable> ] [
@@ -559,14 +557,13 @@ view <replaceable>string</replaceable> [ <replaceable>class</replaceable> ] {
 	    <replaceable>integer</replaceable> ] [ dscp <replaceable>integer</replaceable> ] { ( <replaceable>masters</replaceable> | <replaceable>ipv4_address</replaceable> [
 	    port <replaceable>integer</replaceable> ] | <replaceable>ipv6_address</replaceable> [ port <replaceable>integer</replaceable> ] ) [ key
 	    <replaceable>string</replaceable> ]; ... } ] [ zone-directory <replaceable>quoted_string</replaceable> ] [
-	    in-memory <replaceable>boolean</replaceable> ] [ min-update-interval <replaceable>ttlval</replaceable> ]; ... };
+	    in-memory <replaceable>boolean</replaceable> ] [ min-update-interval <replaceable>integer</replaceable> ]; ... };
 	check-dup-records ( fail | warn | ignore );
 	check-integrity <replaceable>boolean</replaceable>;
 	check-mx ( fail | warn | ignore );
 	check-mx-cname ( fail | warn | ignore );
-	check-names ( primary | master |
-	    secondary | slave | response ) (
-	    fail | warn | ignore );
+	check-names ( master | slave | response
+	    ) ( fail | warn | ignore );
 	check-sibling <replaceable>boolean</replaceable>;
 	check-spf ( warn | ignore );
 	check-srv-cname ( fail | warn | ignore );
@@ -597,7 +594,6 @@ view <replaceable>string</replaceable> [ <replaceable>class</replaceable> ] {
 	};
 	dns64-contact <replaceable>string</replaceable>;
 	dns64-server <replaceable>string</replaceable>;
-	dnskey-sig-validity <replaceable>integer</replaceable>;
 	dnsrps-enable <replaceable>boolean</replaceable>;
 	dnsrps-options { <replaceable>unspecified-text</replaceable> };
 	dnssec-accept-expired <replaceable>boolean</replaceable>;
@@ -633,8 +629,7 @@ view <replaceable>string</replaceable> [ <replaceable>class</replaceable> ] {
 	    | <replaceable>ipv6_address</replaceable> ) [ port <replaceable>integer</replaceable> ] [ dscp <replaceable>integer</replaceable> ]; ... };
 	glue-cache <replaceable>boolean</replaceable>;
 	inline-signing <replaceable>boolean</replaceable>;
-	ixfr-from-differences ( primary | master | secondary | slave |
-	    <replaceable>boolean</replaceable> );
+	ixfr-from-differences ( master | slave | <replaceable>boolean</replaceable> );
 	key <replaceable>string</replaceable> {
 		algorithm <replaceable>string</replaceable>;
 		secret <replaceable>string</replaceable>;
@@ -651,10 +646,10 @@ view <replaceable>string</replaceable> [ <replaceable>class</replaceable> ] {
 	match-destinations { <replaceable>address_match_element</replaceable>; ... };
 	match-recursive-only <replaceable>boolean</replaceable>;
 	max-cache-size ( default | unlimited | <replaceable>sizeval</replaceable> | <replaceable>percentage</replaceable> );
-	max-cache-ttl <replaceable>ttlval</replaceable>;
+	max-cache-ttl <replaceable>integer</replaceable>;
 	max-clients-per-query <replaceable>integer</replaceable>;
 	max-journal-size ( default | unlimited | <replaceable>sizeval</replaceable> );
-	max-ncache-ttl <replaceable>ttlval</replaceable>;
+	max-ncache-ttl <replaceable>integer</replaceable>;
 	max-records <replaceable>integer</replaceable>;
 	max-recursion-depth <replaceable>integer</replaceable>;
 	max-recursion-queries <replaceable>integer</replaceable>;
@@ -689,7 +684,6 @@ view <replaceable>string</replaceable> [ <replaceable>class</replaceable> ] {
 	preferred-glue <replaceable>string</replaceable>;
 	prefetch <replaceable>integer</replaceable> [ <replaceable>integer</replaceable> ];
 	provide-ixfr <replaceable>boolean</replaceable>;
-	qname-minimization ( strict | relaxed | disabled );
 	query-source ( ( [ address ] ( <replaceable>ipv4_address</replaceable> | * ) [ port (
 	    <replaceable>integer</replaceable> | * ) ] ) | ( [ [ address ] ( <replaceable>ipv4_address</replaceable> | * ) ]
 	    port ( <replaceable>integer</replaceable> | * ) ) ) [ dscp <replaceable>integer</replaceable> ];
@@ -724,12 +718,12 @@ view <replaceable>string</replaceable> [ <replaceable>class</replaceable> ] {
 	response-padding { <replaceable>address_match_element</replaceable>; ... } block-size
 	    <replaceable>integer</replaceable>;
 	response-policy { zone <replaceable>quoted_string</replaceable> [ log <replaceable>boolean</replaceable> ] [
-	    max-policy-ttl <replaceable>ttlval</replaceable> ] [ min-update-interval <replaceable>ttlval</replaceable> ] [
+	    max-policy-ttl <replaceable>integer</replaceable> ] [ min-update-interval <replaceable>integer</replaceable> ] [
 	    policy ( cname | disabled | drop | given | no-op | nodata |
 	    nxdomain | passthru | tcp-only <replaceable>quoted_string</replaceable> ) ] [
 	    recursive-only <replaceable>boolean</replaceable> ] [ nsip-enable <replaceable>boolean</replaceable> ] [
 	    nsdname-enable <replaceable>boolean</replaceable> ]; ... } [ break-dnssec <replaceable>boolean</replaceable> ] [
-	    max-policy-ttl <replaceable>ttlval</replaceable> ] [ min-update-interval <replaceable>ttlval</replaceable> ] [
+	    max-policy-ttl <replaceable>integer</replaceable> ] [ min-update-interval <replaceable>integer</replaceable> ] [
 	    min-ns-dots <replaceable>integer</replaceable> ] [ nsip-wait-recurse <replaceable>boolean</replaceable> ] [
 	    qname-wait-recurse <replaceable>boolean</replaceable> ] [ recursive-only <replaceable>boolean</replaceable> ] [
 	    nsip-enable <replaceable>boolean</replaceable> ] [ nsdname-enable <replaceable>boolean</replaceable> ] [
@@ -829,7 +823,6 @@ view <replaceable>string</replaceable> [ <replaceable>class</replaceable> ] {
 		dialup ( notify | notify-passive | passive | refresh |
 		    <replaceable>boolean</replaceable> );
 		dlz <replaceable>string</replaceable>;
-		dnskey-sig-validity <replaceable>integer</replaceable>;
 		dnssec-dnskey-kskonly <replaceable>boolean</replaceable>;
 		dnssec-loadkeys-interval <replaceable>integer</replaceable>;
 		dnssec-secure-to-insecure <replaceable>boolean</replaceable>;
@@ -861,7 +854,6 @@ view <replaceable>string</replaceable> [ <replaceable>class</replaceable> ] {
 		max-zone-ttl ( unlimited | <replaceable>ttlval</replaceable> );
 		min-refresh-time <replaceable>integer</replaceable>;
 		min-retry-time <replaceable>integer</replaceable>;
-		mirror <replaceable>boolean</replaceable>;
 		multi-master <replaceable>boolean</replaceable>;
 		notify ( explicit | master-only | <replaceable>boolean</replaceable> );
 		notify-delay <replaceable>integer</replaceable>;
@@ -888,9 +880,8 @@ view <replaceable>string</replaceable> [ <replaceable>class</replaceable> ] {
 		transfer-source-v6 ( <replaceable>ipv6_address</replaceable> | * ) [ port (
 		    <replaceable>integer</replaceable> | * ) ] [ dscp <replaceable>integer</replaceable> ];
 		try-tcp-refresh <replaceable>boolean</replaceable>;
-		type ( primary | master | secondary | slave |
-		    delegation-only | forward | hint | redirect |
-		    static-stub | stub );
+		type ( delegation-only | forward | hint | master | redirect
+		    | slave | static-stub | stub );
 		update-check-ksk <replaceable>boolean</replaceable>;
 		update-policy ( local | { ( deny | grant ) <replaceable>string</replaceable> (
 		    6to4-self | external | krb5-self | krb5-subdomain |
@@ -937,7 +928,6 @@ zone <replaceable>string</replaceable> [ <replaceable>class</replaceable> ] {
 	delegation-only <replaceable>boolean</replaceable>;
 	dialup ( notify | notify-passive | passive | refresh | <replaceable>boolean</replaceable> );
 	dlz <replaceable>string</replaceable>;
-	dnskey-sig-validity <replaceable>integer</replaceable>;
 	dnssec-dnskey-kskonly <replaceable>boolean</replaceable>;
 	dnssec-loadkeys-interval <replaceable>integer</replaceable>;
 	dnssec-secure-to-insecure <replaceable>boolean</replaceable>;
@@ -967,7 +957,6 @@ zone <replaceable>string</replaceable> [ <replaceable>class</replaceable> ] {
 	max-zone-ttl ( unlimited | <replaceable>ttlval</replaceable> );
 	min-refresh-time <replaceable>integer</replaceable>;
 	min-retry-time <replaceable>integer</replaceable>;
-	mirror <replaceable>boolean</replaceable>;
 	multi-master <replaceable>boolean</replaceable>;
 	notify ( explicit | master-only | <replaceable>boolean</replaceable> );
 	notify-delay <replaceable>integer</replaceable>;
@@ -992,8 +981,8 @@ zone <replaceable>string</replaceable> [ <replaceable>class</replaceable> ] {
 	transfer-source-v6 ( <replaceable>ipv6_address</replaceable> | * ) [ port ( <replaceable>integer</replaceable> | * )
 	    ] [ dscp <replaceable>integer</replaceable> ];
 	try-tcp-refresh <replaceable>boolean</replaceable>;
-	type ( primary | master | secondary | slave | delegation-only |
-	    forward | hint | redirect | static-stub | stub );
+	type ( delegation-only | forward | hint | master | redirect | slave
+	    | static-stub | stub );
 	update-check-ksk <replaceable>boolean</replaceable>;
 	update-policy ( local | { ( deny | grant ) <replaceable>string</replaceable> ( 6to4-self |
 	    external | krb5-self | krb5-subdomain | ms-self | ms-subdomain

bin/named/named.conf.html

@@ -180,6 +180,7 @@ options
 	    ] [ dscp <em class="replaceable"><code>integer</code></em> ];<br>
 	alt-transfer-source-v6 ( <em class="replaceable"><code>ipv6_address</code></em> | * ) [ port ( <em class="replaceable"><code>integer</code></em> |<br>
 	    * ) ] [ dscp <em class="replaceable"><code>integer</code></em> ];<br>
+	answer-cookie <em class="replaceable"><code>boolean</code></em>;<br>
 	attach-cache <em class="replaceable"><code>string</code></em>;<br>
 	auth-nxdomain <em class="replaceable"><code>boolean</code></em>; // default changed<br>
 	auto-dnssec ( allow | maintain | off );<br>
@@ -193,14 +194,13 @@ options
 	    <em class="replaceable"><code>integer</code></em> ] [ dscp <em class="replaceable"><code>integer</code></em> ] { ( <em class="replaceable"><code>masters</code></em> | <em class="replaceable"><code>ipv4_address</code></em> [<br>
 	    port <em class="replaceable"><code>integer</code></em> ] | <em class="replaceable"><code>ipv6_address</code></em> [ port <em class="replaceable"><code>integer</code></em> ] ) [ key<br>
 	    <em class="replaceable"><code>string</code></em> ]; ... } ] [ zone-directory <em class="replaceable"><code>quoted_string</code></em> ] [<br>
-	    in-memory <em class="replaceable"><code>boolean</code></em> ] [ min-update-interval <em class="replaceable"><code>ttlval</code></em> ]; ... };<br>
+	    in-memory <em class="replaceable"><code>boolean</code></em> ] [ min-update-interval <em class="replaceable"><code>integer</code></em> ]; ... };<br>
 	check-dup-records ( fail | warn | ignore );<br>
 	check-integrity <em class="replaceable"><code>boolean</code></em>;<br>
 	check-mx ( fail | warn | ignore );<br>
 	check-mx-cname ( fail | warn | ignore );<br>
-	check-names ( primary | master |<br>
-	    secondary | slave | response ) (<br>
-	    fail | warn | ignore );<br>
+	check-names ( master | slave | response<br>
+	    ) ( fail | warn | ignore );<br>
 	check-sibling <em class="replaceable"><code>boolean</code></em>;<br>
 	check-spf ( warn | ignore );<br>
 	check-srv-cname ( fail | warn | ignore );<br>
@@ -232,7 +232,6 @@ options
 	};<br>
 	dns64-contact <em class="replaceable"><code>string</code></em>;<br>
 	dns64-server <em class="replaceable"><code>string</code></em>;<br>
-	dnskey-sig-validity <em class="replaceable"><code>integer</code></em>;<br>
 	dnsrps-enable <em class="replaceable"><code>boolean</code></em>;<br>
 	dnsrps-options { <em class="replaceable"><code>unspecified-text</code></em> };<br>
 	dnssec-accept-expired <em class="replaceable"><code>boolean</code></em>;<br>
@@ -281,15 +280,15 @@ options
 	fstrm-set-output-notify-threshold <em class="replaceable"><code>integer</code></em>;<br>
 	fstrm-set-output-queue-model ( mpsc | spsc );<br>
 	fstrm-set-output-queue-size <em class="replaceable"><code>integer</code></em>;<br>
-	fstrm-set-reopen-interval <em class="replaceable"><code>ttlval</code></em>;<br>
+	fstrm-set-reopen-interval <em class="replaceable"><code>integer</code></em>;<br>
 	geoip-directory ( <em class="replaceable"><code>quoted_string</code></em> | none );<br>
+	geoip-use-ecs <em class="replaceable"><code>boolean</code></em>;<br>
 	glue-cache <em class="replaceable"><code>boolean</code></em>;<br>
 	heartbeat-interval <em class="replaceable"><code>integer</code></em>;<br>
 	hostname ( <em class="replaceable"><code>quoted_string</code></em> | none );<br>
 	inline-signing <em class="replaceable"><code>boolean</code></em>;<br>
-	interface-interval <em class="replaceable"><code>ttlval</code></em>;<br>
-	ixfr-from-differences ( primary | master | secondary | slave |<br>
-	    <em class="replaceable"><code>boolean</code></em> );<br>
+	interface-interval <em class="replaceable"><code>integer</code></em>;<br>
+	ixfr-from-differences ( master | slave | <em class="replaceable"><code>boolean</code></em> );<br>
 	keep-response-order { <em class="replaceable"><code>address_match_element</code></em>; ... };<br>
 	key-directory <em class="replaceable"><code>quoted_string</code></em>;<br>
 	lame-ttl <em class="replaceable"><code>ttlval</code></em>;<br>
@@ -306,10 +305,10 @@ options
 	masterfile-style ( full | relative );<br>
 	match-mapped-addresses <em class="replaceable"><code>boolean</code></em>;<br>
 	max-cache-size ( default | unlimited | <em class="replaceable"><code>sizeval</code></em> | <em class="replaceable"><code>percentage</code></em> );<br>
-	max-cache-ttl <em class="replaceable"><code>ttlval</code></em>;<br>
+	max-cache-ttl <em class="replaceable"><code>integer</code></em>;<br>
 	max-clients-per-query <em class="replaceable"><code>integer</code></em>;<br>
 	max-journal-size ( default | unlimited | <em class="replaceable"><code>sizeval</code></em> );<br>
-	max-ncache-ttl <em class="replaceable"><code>ttlval</code></em>;<br>
+	max-ncache-ttl <em class="replaceable"><code>integer</code></em>;<br>
 	max-records <em class="replaceable"><code>integer</code></em>;<br>
 	max-recursion-depth <em class="replaceable"><code>integer</code></em>;<br>
 	max-recursion-queries <em class="replaceable"><code>integer</code></em>;<br>
@@ -350,7 +349,6 @@ options
 	preferred-glue <em class="replaceable"><code>string</code></em>;<br>
 	prefetch <em class="replaceable"><code>integer</code></em> [ <em class="replaceable"><code>integer</code></em> ];<br>
 	provide-ixfr <em class="replaceable"><code>boolean</code></em>;<br>
-	qname-minimization ( strict | relaxed | disabled );<br>
 	query-source ( ( [ address ] ( <em class="replaceable"><code>ipv4_address</code></em> | * ) [ port (<br>
 	    <em class="replaceable"><code>integer</code></em> | * ) ] ) | ( [ [ address ] ( <em class="replaceable"><code>ipv4_address</code></em> | * ) ]<br>
 	    port ( <em class="replaceable"><code>integer</code></em> | * ) ) ) [ dscp <em class="replaceable"><code>integer</code></em> ];<br>
@@ -390,12 +388,12 @@ options
 	response-padding { <em class="replaceable"><code>address_match_element</code></em>; ... } block-size<br>
 	    <em class="replaceable"><code>integer</code></em>;<br>
 	response-policy { zone <em class="replaceable"><code>quoted_string</code></em> [ log <em class="replaceable"><code>boolean</code></em> ] [<br>
-	    max-policy-ttl <em class="replaceable"><code>ttlval</code></em> ] [ min-update-interval <em class="replaceable"><code>ttlval</code></em> ] [<br>
+	    max-policy-ttl <em class="replaceable"><code>integer</code></em> ] [ min-update-interval <em class="replaceable"><code>integer</code></em> ] [<br>
 	    policy ( cname | disabled | drop | given | no-op | nodata |<br>
 	    nxdomain | passthru | tcp-only <em class="replaceable"><code>quoted_string</code></em> ) ] [<br>
 	    recursive-only <em class="replaceable"><code>boolean</code></em> ] [ nsip-enable <em class="replaceable"><code>boolean</code></em> ] [<br>
 	    nsdname-enable <em class="replaceable"><code>boolean</code></em> ]; ... } [ break-dnssec <em class="replaceable"><code>boolean</code></em> ] [<br>
-	    max-policy-ttl <em class="replaceable"><code>ttlval</code></em> ] [ min-update-interval <em class="replaceable"><code>ttlval</code></em> ] [<br>
+	    max-policy-ttl <em class="replaceable"><code>integer</code></em> ] [ min-update-interval <em class="replaceable"><code>integer</code></em> ] [<br>
 	    min-ns-dots <em class="replaceable"><code>integer</code></em> ] [ nsip-wait-recurse <em class="replaceable"><code>boolean</code></em> ] [<br>
 	    qname-wait-recurse <em class="replaceable"><code>boolean</code></em> ] [ recursive-only <em class="replaceable"><code>boolean</code></em> ] [<br>
 	    nsip-enable <em class="replaceable"><code>boolean</code></em> ] [ nsdname-enable <em class="replaceable"><code>boolean</code></em> ] [<br>
@@ -551,14 +549,13 @@ view
 	    <em class="replaceable"><code>integer</code></em> ] [ dscp <em class="replaceable"><code>integer</code></em> ] { ( <em class="replaceable"><code>masters</code></em> | <em class="replaceable"><code>ipv4_address</code></em> [<br>
 	    port <em class="replaceable"><code>integer</code></em> ] | <em class="replaceable"><code>ipv6_address</code></em> [ port <em class="replaceable"><code>integer</code></em> ] ) [ key<br>
 	    <em class="replaceable"><code>string</code></em> ]; ... } ] [ zone-directory <em class="replaceable"><code>quoted_string</code></em> ] [<br>
-	    in-memory <em class="replaceable"><code>boolean</code></em> ] [ min-update-interval <em class="replaceable"><code>ttlval</code></em> ]; ... };<br>
+	    in-memory <em class="replaceable"><code>boolean</code></em> ] [ min-update-interval <em class="replaceable"><code>integer</code></em> ]; ... };<br>
 	check-dup-records ( fail | warn | ignore );<br>
 	check-integrity <em class="replaceable"><code>boolean</code></em>;<br>
 	check-mx ( fail | warn | ignore );<br>
 	check-mx-cname ( fail | warn | ignore );<br>
-	check-names ( primary | master |<br>
-	    secondary | slave | response ) (<br>
-	    fail | warn | ignore );<br>
+	check-names ( master | slave | response<br>
+	    ) ( fail | warn | ignore );<br>
 	check-sibling <em class="replaceable"><code>boolean</code></em>;<br>
 	check-spf ( warn | ignore );<br>
 	check-srv-cname ( fail | warn | ignore );<br>
@@ -589,7 +586,6 @@ view
 	};<br>
 	dns64-contact <em class="replaceable"><code>string</code></em>;<br>
 	dns64-server <em class="replaceable"><code>string</code></em>;<br>
-	dnskey-sig-validity <em class="replaceable"><code>integer</code></em>;<br>
 	dnsrps-enable <em class="replaceable"><code>boolean</code></em>;<br>
 	dnsrps-options { <em class="replaceable"><code>unspecified-text</code></em> };<br>
 	dnssec-accept-expired <em class="replaceable"><code>boolean</code></em>;<br>
@@ -625,8 +621,7 @@ view
 	    | <em class="replaceable"><code>ipv6_address</code></em> ) [ port <em class="replaceable"><code>integer</code></em> ] [ dscp <em class="replaceable"><code>integer</code></em> ]; ... };<br>
 	glue-cache <em class="replaceable"><code>boolean</code></em>;<br>
 	inline-signing <em class="replaceable"><code>boolean</code></em>;<br>
-	ixfr-from-differences ( primary | master | secondary | slave |<br>
-	    <em class="replaceable"><code>boolean</code></em> );<br>
+	ixfr-from-differences ( master | slave | <em class="replaceable"><code>boolean</code></em> );<br>
 	key <em class="replaceable"><code>string</code></em> {<br>
 		algorithm <em class="replaceable"><code>string</code></em>;<br>
 		secret <em class="replaceable"><code>string</code></em>;<br>
@@ -643,10 +638,10 @@ view
 	match-destinations { <em class="replaceable"><code>address_match_element</code></em>; ... };<br>
 	match-recursive-only <em class="replaceable"><code>boolean</code></em>;<br>
 	max-cache-size ( default | unlimited | <em class="replaceable"><code>sizeval</code></em> | <em class="replaceable"><code>percentage</code></em> );<br>
-	max-cache-ttl <em class="replaceable"><code>ttlval</code></em>;<br>
+	max-cache-ttl <em class="replaceable"><code>integer</code></em>;<br>
 	max-clients-per-query <em class="replaceable"><code>integer</code></em>;<br>
 	max-journal-size ( default | unlimited | <em class="replaceable"><code>sizeval</code></em> );<br>
-	max-ncache-ttl <em class="replaceable"><code>ttlval</code></em>;<br>
+	max-ncache-ttl <em class="replaceable"><code>integer</code></em>;<br>
 	max-records <em class="replaceable"><code>integer</code></em>;<br>
 	max-recursion-depth <em class="replaceable"><code>integer</code></em>;<br>
 	max-recursion-queries <em class="replaceable"><code>integer</code></em>;<br>
@@ -681,7 +676,6 @@ view
 	preferred-glue <em class="replaceable"><code>string</code></em>;<br>
 	prefetch <em class="replaceable"><code>integer</code></em> [ <em class="replaceable"><code>integer</code></em> ];<br>
 	provide-ixfr <em class="replaceable"><code>boolean</code></em>;<br>
-	qname-minimization ( strict | relaxed | disabled );<br>
 	query-source ( ( [ address ] ( <em class="replaceable"><code>ipv4_address</code></em> | * ) [ port (<br>
 	    <em class="replaceable"><code>integer</code></em> | * ) ] ) | ( [ [ address ] ( <em class="replaceable"><code>ipv4_address</code></em> | * ) ]<br>
 	    port ( <em class="replaceable"><code>integer</code></em> | * ) ) ) [ dscp <em class="replaceable"><code>integer</code></em> ];<br>
@@ -716,12 +710,12 @@ view
 	response-padding { <em class="replaceable"><code>address_match_element</code></em>; ... } block-size<br>
 	    <em class="replaceable"><code>integer</code></em>;<br>
 	response-policy { zone <em class="replaceable"><code>quoted_string</code></em> [ log <em class="replaceable"><code>boolean</code></em> ] [<br>
-	    max-policy-ttl <em class="replaceable"><code>ttlval</code></em> ] [ min-update-interval <em class="replaceable"><code>ttlval</code></em> ] [<br>
+	    max-policy-ttl <em class="replaceable"><code>integer</code></em> ] [ min-update-interval <em class="replaceable"><code>integer</code></em> ] [<br>
 	    policy ( cname | disabled | drop | given | no-op | nodata |<br>
 	    nxdomain | passthru | tcp-only <em class="replaceable"><code>quoted_string</code></em> ) ] [<br>
 	    recursive-only <em class="replaceable"><code>boolean</code></em> ] [ nsip-enable <em class="replaceable"><code>boolean</code></em> ] [<br>
 	    nsdname-enable <em class="replaceable"><code>boolean</code></em> ]; ... } [ break-dnssec <em class="replaceable"><code>boolean</code></em> ] [<br>
-	    max-policy-ttl <em class="replaceable"><code>ttlval</code></em> ] [ min-update-interval <em class="replaceable"><code>ttlval</code></em> ] [<br>
+	    max-policy-ttl <em class="replaceable"><code>integer</code></em> ] [ min-update-interval <em class="replaceable"><code>integer</code></em> ] [<br>
 	    min-ns-dots <em class="replaceable"><code>integer</code></em> ] [ nsip-wait-recurse <em class="replaceable"><code>boolean</code></em> ] [<br>
 	    qname-wait-recurse <em class="replaceable"><code>boolean</code></em> ] [ recursive-only <em class="replaceable"><code>boolean</code></em> ] [<br>
 	    nsip-enable <em class="replaceable"><code>boolean</code></em> ] [ nsdname-enable <em class="replaceable"><code>boolean</code></em> ] [<br>
@@ -821,7 +815,6 @@ view
 		dialup ( notify | notify-passive | passive | refresh |<br>
 		    <em class="replaceable"><code>boolean</code></em> );<br>
 		dlz <em class="replaceable"><code>string</code></em>;<br>
-		dnskey-sig-validity <em class="replaceable"><code>integer</code></em>;<br>
 		dnssec-dnskey-kskonly <em class="replaceable"><code>boolean</code></em>;<br>
 		dnssec-loadkeys-interval <em class="replaceable"><code>integer</code></em>;<br>
 		dnssec-secure-to-insecure <em class="replaceable"><code>boolean</code></em>;<br>
@@ -853,7 +846,6 @@ view
 		max-zone-ttl ( unlimited | <em class="replaceable"><code>ttlval</code></em> );<br>
 		min-refresh-time <em class="replaceable"><code>integer</code></em>;<br>
 		min-retry-time <em class="replaceable"><code>integer</code></em>;<br>
-		mirror <em class="replaceable"><code>boolean</code></em>;<br>
 		multi-master <em class="replaceable"><code>boolean</code></em>;<br>
 		notify ( explicit | master-only | <em class="replaceable"><code>boolean</code></em> );<br>
 		notify-delay <em class="replaceable"><code>integer</code></em>;<br>
@@ -880,9 +872,8 @@ view
 		transfer-source-v6 ( <em class="replaceable"><code>ipv6_address</code></em> | * ) [ port (<br>
 		    <em class="replaceable"><code>integer</code></em> | * ) ] [ dscp <em class="replaceable"><code>integer</code></em> ];<br>
 		try-tcp-refresh <em class="replaceable"><code>boolean</code></em>;<br>
-		type ( primary | master | secondary | slave |<br>
-		    delegation-only | forward | hint | redirect |<br>
-		    static-stub | stub );<br>
+		type ( delegation-only | forward | hint | master | redirect<br>
+		    | slave | static-stub | stub );<br>
 		update-check-ksk <em class="replaceable"><code>boolean</code></em>;<br>
 		update-policy ( local | { ( deny | grant ) <em class="replaceable"><code>string</code></em> (<br>
 		    6to4-self | external | krb5-self | krb5-subdomain |<br>
@@ -930,7 +921,6 @@ zone
 	delegation-only <em class="replaceable"><code>boolean</code></em>;<br>
 	dialup ( notify | notify-passive | passive | refresh | <em class="replaceable"><code>boolean</code></em> );<br>
 	dlz <em class="replaceable"><code>string</code></em>;<br>
-	dnskey-sig-validity <em class="replaceable"><code>integer</code></em>;<br>
 	dnssec-dnskey-kskonly <em class="replaceable"><code>boolean</code></em>;<br>
 	dnssec-loadkeys-interval <em class="replaceable"><code>integer</code></em>;<br>
 	dnssec-secure-to-insecure <em class="replaceable"><code>boolean</code></em>;<br>
@@ -960,7 +950,6 @@ zone
 	max-zone-ttl ( unlimited | <em class="replaceable"><code>ttlval</code></em> );<br>
 	min-refresh-time <em class="replaceable"><code>integer</code></em>;<br>
 	min-retry-time <em class="replaceable"><code>integer</code></em>;<br>
-	mirror <em class="replaceable"><code>boolean</code></em>;<br>
 	multi-master <em class="replaceable"><code>boolean</code></em>;<br>
 	notify ( explicit | master-only | <em class="replaceable"><code>boolean</code></em> );<br>
 	notify-delay <em class="replaceable"><code>integer</code></em>;<br>
@@ -985,8 +974,8 @@ zone
 	transfer-source-v6 ( <em class="replaceable"><code>ipv6_address</code></em> | * ) [ port ( <em class="replaceable"><code>integer</code></em> | * )<br>
 	    ] [ dscp <em class="replaceable"><code>integer</code></em> ];<br>
 	try-tcp-refresh <em class="replaceable"><code>boolean</code></em>;<br>
-	type ( primary | master | secondary | slave | delegation-only |<br>
-	    forward | hint | redirect | static-stub | stub );<br>
+	type ( delegation-only | forward | hint | master | redirect | slave<br>
+	    | static-stub | stub );<br>
 	update-check-ksk <em class="replaceable"><code>boolean</code></em>;<br>
 	update-policy ( local | { ( deny | grant ) <em class="replaceable"><code>string</code></em> ( 6to4-self |<br>
 	    external | krb5-self | krb5-subdomain | ms-self | ms-subdomain<br>

bin/named/server.c

@@ -25,6 +25,7 @@
 #include <isc/base64.h>
 #include <isc/commandline.h>
 #include <isc/dir.h>
+#include <isc/entropy.h>
 #include <isc/file.h>
 #include <isc/hash.h>
 #include <isc/hex.h>
@@ -32,11 +33,11 @@
 #include <isc/httpd.h>
 #include <isc/lex.h>
 #include <isc/meminfo.h>
-#include <isc/nonce.h>
 #include <isc/parseint.h>
 #include <isc/platform.h>
 #include <isc/portset.h>
 #include <isc/print.h>
+#include <isc/random.h>
 #include <isc/refcount.h>
 #include <isc/resource.h>
 #include <isc/sha2.h>
@@ -870,8 +871,8 @@ load_view_keys(const cfg_obj_t *keys, const cfg_obj_t *vconfig,
 			 * initializing key; that's why 'managed'
 			 * is duplicated below.
 			 */
-			CHECK(dns_keytable_add(secroots, managed,
-					       managed, &dstkey));
+			CHECK(dns_keytable_add2(secroots, managed,
+						managed, &dstkey));
 		}
 	}
 
@@ -3348,7 +3349,7 @@ create_empty_zone(dns_zone_t *zone, dns_name_t *name, dns_view_t *view,
 		dns_db_closeversion(db, &version, ISC_TRUE);
 		CHECK(dns_zone_replacedb(zone, db, ISC_FALSE));
 	}
-	dns_zone_setoption(zone, DNS_ZONEOPT_AUTOEMPTY, ISC_TRUE);
+	dns_zone_setoption2(zone, DNS_ZONEOPT2_AUTOEMPTY, ISC_TRUE);
 	dns_zone_setview(zone, view);
 	CHECK(dns_view_addzone(view, zone));
 
@@ -3550,7 +3551,7 @@ configure_dnstap(const cfg_obj_t **maps, dns_view_t *view) {
 			fstrm_iothr_options_set_reopen_interval(fopt, i);
 		}
 
-		CHECKM(dns_dt_create(named_g_mctx, dmode, dpath,
+		CHECKM(dns_dt_create2(named_g_mctx, dmode, dpath,
 				      &fopt, named_g_server->task,
 				      &named_g_server->dtenv),
 		       "unable to create dnstap environment");
@@ -3613,7 +3614,8 @@ create_mapped_acl(void) {
 	if (result != ISC_R_SUCCESS)
 		return (result);
 
-	result = dns_iptable_addprefix(acl->iptable, &addr, 96, ISC_TRUE);
+	result = dns_iptable_addprefix2(acl->iptable, &addr, 96,
+					ISC_TRUE, ISC_FALSE);
 	if (result == ISC_R_SUCCESS)
 		dns_acl_attach(acl, &named_g_mapped);
 	dns_acl_detach(&acl);
@@ -3690,7 +3692,6 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
 	isc_dscp_t dscp4 = -1, dscp6 = -1;
 	dns_dyndbctx_t *dctx = NULL;
 	unsigned int resolver_param;
-	const char *qminmode = NULL;
 
 	REQUIRE(DNS_VIEW_VALID(view));
 
@@ -4202,10 +4203,10 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
 			isc_mem_setname(cmctx, "cache", NULL);
 			CHECK(isc_mem_create(0, 0, &hmctx));
 			isc_mem_setname(hmctx, "cache_heap", NULL);
-			CHECK(dns_cache_create(cmctx, hmctx, named_g_taskmgr,
-					       named_g_timermgr, view->rdclass,
-					       cachename, "rbt", 0, NULL,
-					       &cache));
+			CHECK(dns_cache_create3(cmctx, hmctx, named_g_taskmgr,
+						named_g_timermgr, view->rdclass,
+						cachename, "rbt", 0, NULL,
+						&cache));
 			isc_mem_detach(&cmctx);
 			isc_mem_detach(&hmctx);
 		}
@@ -4223,7 +4224,7 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
 		ISC_LINK_INIT(nsc, link);
 		ISC_LIST_APPEND(*cachelist, nsc, link);
 	}
-	dns_view_setcache(view, cache, shared_cache);
+	dns_view_setcache2(view, cache, shared_cache);
 
 	/*
 	 * cache-file cannot be inherited if views are present, but this
@@ -4636,22 +4637,6 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
 	INSIST(result == ISC_R_SUCCESS);
 	view->recursion = cfg_obj_asboolean(obj);
 
-	obj = NULL;
-	result = named_config_get(maps, "qname-minimization", &obj);
-	INSIST(result == ISC_R_SUCCESS);
-	qminmode = cfg_obj_asstring(obj);
-	INSIST(qminmode != NULL);
-	if (!strcmp(qminmode, "strict")) {
-		view->qminimization = ISC_TRUE;
-		view->qmin_strict = ISC_TRUE;
-	} else if (!strcmp(qminmode, "relaxed")) {
-		view->qminimization = ISC_TRUE;
-		view->qmin_strict = ISC_FALSE;
-	} else { /* "disabled" or "off" */
-		view->qminimization = ISC_FALSE;
-		view->qmin_strict = ISC_FALSE;
-	}
-
 	obj = NULL;
 	result = named_config_get(maps, "auth-nxdomain", &obj);
 	INSIST(result == ISC_R_SUCCESS);
@@ -5291,7 +5276,7 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
 			 * empty zone for it.
 			 */
 			result = dns_fwdtable_find(view->fwdtable, name,
-						   NULL, &dnsforwarders);
+						   &dnsforwarders);
 			if (result == ISC_R_SUCCESS &&
 			    dnsforwarders->fwdpolicy == dns_fwdpolicy_only)
 				continue;
@@ -5708,7 +5693,12 @@ create_view(const cfg_obj_t *vconfig, dns_viewlist_t *viewlist,
 	if (result != ISC_R_SUCCESS)
 		return (result);
 
-	isc_nonce_buf(view->secret, sizeof(view->secret));
+	result = isc_entropy_getdata(named_g_entropy, view->secret,
+				     sizeof(view->secret), NULL, 0);
+	if (result != ISC_R_SUCCESS) {
+		dns_view_detach(&view);
+		return (result);
+	}
 
 	ISC_LIST_APPEND(*viewlist, view, link);
 	dns_view_attach(view, viewp);
@@ -6072,9 +6062,7 @@ configure_zone(const cfg_obj_t *config, const cfg_obj_t *zconfig,
 	dns_zone_setadded(zone, added);
 
 	signing = NULL;
-	if ((strcasecmp(ztypestr, "primary") == 0 ||
-	     strcasecmp(ztypestr, "master") == 0 ||
-	     strcasecmp(ztypestr, "secondary") == 0 ||
+	if ((strcasecmp(ztypestr, "master") == 0 ||
 	     strcasecmp(ztypestr, "slave") == 0) &&
 	    cfg_map_get(zoptions, "inline-signing", &signing) == ISC_R_SUCCESS &&
 	    cfg_obj_asboolean(signing))
@@ -6176,8 +6164,7 @@ add_keydata_zone(dns_view_t *view, const char *directory, isc_mem_t *mctx) {
 				defaultview ? "managed-keys" : view->name,
 				defaultview ? "bind" : "mkeys",
 				filename, sizeof(filename)));
-	CHECK(dns_zone_setfile(zone, filename, dns_masterformat_text,
-			       &dns_master_style_default));
+	CHECK(dns_zone_setfile(zone, filename));
 
 	dns_zone_setview(zone, view);
 	dns_zone_settype(zone, dns_zone_key);
@@ -6298,8 +6285,8 @@ add_listenelt(isc_mem_t *mctx, ns_listenlist_t *list, isc_sockaddr_t *addr,
 		if (result != ISC_R_SUCCESS)
 			return (result);
 
-		result = dns_iptable_addprefix(src_acl->iptable, &netaddr,
-					       128, ISC_TRUE);
+		result = dns_iptable_addprefix(src_acl->iptable,
+					       &netaddr, 128, ISC_TRUE);
 		if (result != ISC_R_SUCCESS)
 			goto clean;
 
@@ -6645,33 +6632,25 @@ dotat(dns_keytable_t *keytable, dns_keynode_t *keynode, void *arg) {
 	domain = dns_fixedname_initname(&fdomain);
 	dns_rdataset_init(&nameservers);
 	result = dns_view_findzonecut(view, origin, domain, 0, 0, ISC_TRUE,
-				      ISC_TRUE, &nameservers, NULL);
-	if (result == ISC_R_SUCCESS) {
-		result = dns_resolver_createfetch(view->resolver, tatname,
-						  dns_rdatatype_null, domain,
-						  &nameservers, NULL, NULL, 0,
-						  0, 0, NULL, tat->task,
-						  tat_done, tat,
-						  &tat->rdataset,
-						  &tat->sigrdataset,
-						  &tat->fetch);
+				      &nameservers, NULL);
+	if (result != ISC_R_SUCCESS) {
+		goto done;
 	}
 
+	result = dns_resolver_createfetch(view->resolver, tatname,
+					  dns_rdatatype_null, domain,
+					  &nameservers, NULL, 0, tat->task,
+					  tat_done, tat, &tat->rdataset,
+					  &tat->sigrdataset, &tat->fetch);
+
 	/*
-	 * 'domain' holds the dns_name_t pointer inside a dst_key_t structure.
-	 * dns_resolver_createfetch() creates its own copy of 'domain' if it
-	 * succeeds.  Thus, 'domain' is not freed here.
-	 *
-	 * Even if dns_view_findzonecut() returned something else than
-	 * ISC_R_SUCCESS, it still could have associated 'nameservers'.
-	 * dns_resolver_createfetch() creates its own copy of 'nameservers' if
-	 * it succeeds.  Thus, we need to check whether 'nameservers' is
-	 * associated and release it if it is.
+	 * dns_resolver_createfetch() creates its own copies of 'domain' and
+	 * 'nameservers'; clean up the latter (the former points into a
+	 * dst_key_t structure and thus must not be freed).
 	 */
-	if (dns_rdataset_isassociated(&nameservers)) {
-		dns_rdataset_disassociate(&nameservers);
-	}
+	dns_rdataset_disassociate(&nameservers);
 
+ done:
 	if (result != ISC_R_SUCCESS) {
 		isc_task_detach(&tat->task);
 		isc_mem_putanddetach(&tat->mctx, tat, sizeof(*tat));
@@ -6922,7 +6901,7 @@ generate_session_key(const char *filename, const char *keynamestr,
 	/* generate key */
 	result = dst_key_generate(keyname, algtype, bits, 1, 0,
 				  DNS_KEYPROTO_ANY, dns_rdataclass_in,
-				  mctx, &key, NULL);
+				  mctx, &key);
 	if (result != ISC_R_SUCCESS)
 		return (result);
 
@@ -8000,7 +7979,7 @@ load_configuration(const char *filename, named_server_t *server,
 			      "less than 128 UDP sockets available after "
 			      "applying 'reserved-sockets' and 'maxsockets'");
 	}
-	isc_socketmgr_setreserved(named_g_socketmgr, reserved);
+	isc__socketmgr_setreserved(named_g_socketmgr, reserved);
 
 #ifdef HAVE_GEOIP
 	/*
@@ -8019,6 +7998,11 @@ load_configuration(const char *filename, named_server_t *server,
 		named_geoip_load(NULL);
 	}
 	named_g_aclconfctx->geoip = named_g_geoip;
+
+	obj = NULL;
+	result = named_config_get(maps, "geoip-use-ecs", &obj);
+	INSIST(result == ISC_R_SUCCESS);
+	env->geoip_use_ecs = cfg_obj_asboolean(obj);
 #endif /* HAVE_GEOIP */
 
 	/*
@@ -8611,7 +8595,8 @@ load_configuration(const char *filename, named_server_t *server,
 	/* Load the TKEY information from the configuration. */
 	if (options != NULL) {
 		dns_tkeyctx_t *t = NULL;
-		CHECKM(named_tkeyctx_fromconfig(options, named_g_mctx, &t),
+		CHECKM(named_tkeyctx_fromconfig(options, named_g_mctx,
+						named_g_entropy, &t),
 		       "configuring TKEY");
 		if (server->sctx->tkeyctx != NULL) {
 			dns_tkeyctx_destroy(&server->sctx->tkeyctx);
@@ -8626,6 +8611,72 @@ load_configuration(const char *filename, named_server_t *server,
 					named_g_aclconfctx),
 	       "binding control channel(s)");
 
+	/*
+	 * Open the source of entropy.
+	 */
+	if (first_time) {
+		const char *randomdev = NULL;
+		int level = ISC_LOG_ERROR;
+		obj = NULL;
+		result = named_config_get(maps, "random-device", &obj);
+		if (result == ISC_R_SUCCESS) {
+			if (!cfg_obj_isvoid(obj)) {
+				level = ISC_LOG_INFO;
+				randomdev = cfg_obj_asstring(obj);
+			}
+		}
+		if (randomdev == NULL) {
+#ifdef ISC_PLATFORM_CRYPTORANDOM
+			isc_entropy_usehook(named_g_entropy, ISC_TRUE);
+#else
+			if ((obj != NULL) && !cfg_obj_isvoid(obj))
+				level = ISC_LOG_INFO;
+			isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+				      NAMED_LOGMODULE_SERVER, level,
+				      "no source of entropy found");
+			if ((obj == NULL) || cfg_obj_isvoid(obj)) {
+				CHECK(ISC_R_FAILURE);
+			}
+#endif
+		} else {
+			result = isc_entropy_createfilesource(named_g_entropy,
+							      randomdev);
+#ifdef PATH_RANDOMDEV
+			if (named_g_fallbackentropy != NULL) {
+				level = ISC_LOG_INFO;
+			}
+#endif
+			if (result != ISC_R_SUCCESS) {
+				isc_log_write(named_g_lctx,
+					      NAMED_LOGCATEGORY_GENERAL,
+					      NAMED_LOGMODULE_SERVER,
+					      level,
+					      "could not open "
+					      "entropy source %s: %s",
+					      randomdev,
+					      isc_result_totext(result));
+			}
+#ifdef PATH_RANDOMDEV
+			if (named_g_fallbackentropy != NULL) {
+				if (result != ISC_R_SUCCESS) {
+					isc_log_write(named_g_lctx,
+						      NAMED_LOGCATEGORY_GENERAL,
+						      NAMED_LOGMODULE_SERVER,
+						      ISC_LOG_INFO,
+						      "using pre-chroot "
+						      "entropy source %s",
+						      PATH_RANDOMDEV);
+					isc_entropy_detach(&named_g_entropy);
+					isc_entropy_attach(
+						   named_g_fallbackentropy,
+						   &named_g_entropy);
+				}
+				isc_entropy_detach(&named_g_fallbackentropy);
+			}
+#endif
+		}
+	}
+
 #ifdef HAVE_LMDB
 	/*
 	 * If we're using LMDB, we may have created newzones databases
@@ -8872,7 +8923,11 @@ load_configuration(const char *filename, named_server_t *server,
 	result = named_config_get(maps, "cookie-algorithm", &obj);
 	INSIST(result == ISC_R_SUCCESS);
 	if (strcasecmp(cfg_obj_asstring(obj), "aes") == 0) {
+#if defined(HAVE_OPENSSL_AES) || defined(HAVE_OPENSSL_EVP_AES)
 		server->sctx->cookiealg = ns_cookiealg_aes;
+#else
+		INSIST(0);
+#endif
 	} else if (strcasecmp(cfg_obj_asstring(obj), "sha1") == 0) {
 		server->sctx->cookiealg = ns_cookiealg_sha1;
 	} else if (strcasecmp(cfg_obj_asstring(obj), "sha256") == 0) {
@@ -8956,8 +9011,14 @@ load_configuration(const char *filename, named_server_t *server,
 			}
 		}
 	} else {
-		isc_nonce_buf(server->sctx->secret,
-			      sizeof(server->sctx->secret));
+		result = isc_entropy_getdata(named_g_entropy,
+					     server->sctx->secret,
+					     sizeof(server->sctx->secret),
+					     NULL,
+					     0);
+		if (result != ISC_R_SUCCESS) {
+			goto cleanup;
+		}
 	}
 
 	/*
@@ -9035,7 +9096,7 @@ load_configuration(const char *filename, named_server_t *server,
 		{
 			dns_view_setviewrevert(view);
 			(void)dns_zt_apply(view->zonetable, ISC_FALSE,
-					   NULL, removed, view);
+					   removed, view);
 		}
 		dns_view_detach(&view);
 	}
@@ -9211,7 +9272,8 @@ run_server(isc_task_t *task, isc_event_t *event) {
 
 	isc_event_free(&event);
 
-	CHECKFATAL(dns_dispatchmgr_create(named_g_mctx, &named_g_dispatchmgr),
+	CHECKFATAL(dns_dispatchmgr_create(named_g_mctx, named_g_entropy,
+					  &named_g_dispatchmgr),
 		   "creating dispatch manager");
 
 	dns_dispatchmgr_setstats(named_g_dispatchmgr, server->resolverstats);
@@ -9269,8 +9331,10 @@ run_server(isc_task_t *task, isc_event_t *event) {
 	CHECKFATAL(load_configuration(named_g_conffile, server, ISC_TRUE),
 		   "loading configuration");
 
+	isc_hash_init();
+
 	CHECKFATAL(load_zones(server, ISC_TRUE, ISC_FALSE), "loading zones");
-#ifdef ENABLE_AFL
+#if 1
 	named_g_run_done = ISC_TRUE;
 #endif
 }
@@ -9371,7 +9435,7 @@ shutdown_server(isc_task_t *task, isc_event_t *event) {
  */
 static isc_result_t
 get_matching_view(isc_netaddr_t *srcaddr, isc_netaddr_t *destaddr,
-		  dns_message_t *message, dns_aclenv_t *env,
+		  dns_message_t *message, dns_aclenv_t *env, dns_ecs_t *ecs,
 		  isc_result_t *sigresult, dns_view_t **viewp)
 {
 	dns_view_t *view;
@@ -9388,6 +9452,9 @@ get_matching_view(isc_netaddr_t *srcaddr, isc_netaddr_t *destaddr,
 		    message->rdclass == dns_rdataclass_any)
 		{
 			dns_name_t *tsig = NULL;
+			isc_netaddr_t *addr = NULL;
+			isc_uint8_t *scope = NULL;
+			isc_uint8_t source = 0;
 
 			*sigresult = dns_message_rechecksig(message, view);
 			if (*sigresult == ISC_R_SUCCESS) {
@@ -9397,9 +9464,15 @@ get_matching_view(isc_netaddr_t *srcaddr, isc_netaddr_t *destaddr,
 				tsig = dns_tsigkey_identity(tsigkey);
 			}
 
-			if (dns_acl_allowed(srcaddr, tsig,
-					    view->matchclients, env) &&
-			    dns_acl_allowed(destaddr, tsig,
+			if (ecs != NULL) {
+				addr = &ecs->addr;
+				source = ecs->source;
+				scope = &ecs->scope;
+			}
+
+			if (dns_acl_allowed(srcaddr, tsig, addr, source,
+					    scope, view->matchclients, env) &&
+			    dns_acl_allowed(destaddr, tsig, NULL, 0, NULL,
 					    view->matchdestinations, env) &&
 			    !(view->matchrecursiveonly &&
 			      (message->flags & DNS_MESSAGEFLAG_RD) == 0))
@@ -9436,7 +9509,8 @@ named_server_create(isc_mem_t *mctx, named_server_t **serverp) {
 	server->in_roothints = NULL;
 
 	/* Must be first. */
-	CHECKFATAL(dst_lib_init(named_g_mctx, named_g_engine),
+	CHECKFATAL(dst_lib_init2(named_g_mctx, named_g_entropy,
+				 named_g_engine, ISC_ENTROPY_GOODONLY),
 		   "initializing DST");
 
 	CHECKFATAL(dns_rootns_create(mctx, dns_rdataclass_in, NULL,
@@ -9466,7 +9540,8 @@ named_server_create(isc_mem_t *mctx, named_server_t **serverp) {
 	isc_taskmgr_setexcltask(named_g_taskmgr, server->task);
 
 	server->sctx = NULL;
-	CHECKFATAL(ns_server_create(mctx, get_matching_view,
+	CHECKFATAL(ns_server_create(mctx, named_g_entropy,
+				    get_matching_view,
 				    &server->sctx),
 		   "creating server context");
 
@@ -10389,7 +10464,7 @@ add_view_tolist(struct dumpcontext *dctx, dns_view_t *view) {
 	ISC_LIST_INIT(vle->zonelist);
 	ISC_LIST_APPEND(dctx->viewlist, vle, link);
 	if (dctx->dumpzones)
-		result = dns_zt_apply(view->zonetable, ISC_TRUE, NULL,
+		result = dns_zt_apply(view->zonetable, ISC_TRUE,
 				      add_zone_tolist, dctx);
 	return (result);
 }
@@ -10886,7 +10961,7 @@ named_server_validation(named_server_t *server, isc_lex_t *lex,
 	{
 		if (ptr != NULL && strcasecmp(ptr, view->name) != 0)
 			continue;
-		CHECK(dns_view_flushcache(view, ISC_FALSE));
+		CHECK(dns_view_flushcache(view));
 
 		if (set) {
 			view->enablevalidation = enable;
@@ -10977,7 +11052,7 @@ named_server_flushcache(named_server_t *server, isc_lex_t *lex) {
 		if (ptr != NULL && !nsc->needflush)
 			continue;
 		nsc->needflush = ISC_TRUE;
-		result = dns_view_flushcache(nsc->primaryview, ISC_FALSE);
+		result = dns_view_flushcache2(nsc->primaryview, ISC_FALSE);
 		if (result != ISC_R_SUCCESS) {
 			flushed = ISC_FALSE;
 			isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
@@ -11008,7 +11083,7 @@ named_server_flushcache(named_server_t *server, isc_lex_t *lex) {
 		     nsc = ISC_LIST_NEXT(nsc, link)) {
 			if (!nsc->needflush || nsc->cache != view->cache)
 				continue;
-			result = dns_view_flushcache(view, ISC_TRUE);
+			result = dns_view_flushcache2(view, ISC_TRUE);
 			if (result != ISC_R_SUCCESS) {
 				flushed = ISC_FALSE;
 				isc_log_write(named_g_lctx,
@@ -11208,6 +11283,7 @@ named_server_status(named_server_t *server, isc_buffer_t **text) {
 	}
 	CHECK(putstr(text, line));
 
+#ifdef ISC_PLATFORM_USETHREADS
 	snprintf(line, sizeof(line), "CPUs found: %u\n", named_g_cpus_detected);
 	CHECK(putstr(text, line));
 
@@ -11217,6 +11293,10 @@ named_server_status(named_server_t *server, isc_buffer_t **text) {
 	snprintf(line, sizeof(line), "UDP listeners per interface: %u\n",
 		 named_g_udpdisp);
 	CHECK(putstr(text, line));
+#else
+	snprintf(line, sizeof(line), "CPUs found: N/A (threads disabled)\n");
+	CHECK(putstr(text, line));
+#endif
 
 	snprintf(line, sizeof(line), "number of zones: %u (%u automatic)\n",
 		     zonecount, automatic);
@@ -11623,7 +11703,7 @@ named_server_sync(named_server_t *server, isc_lex_t *lex, isc_buffer_t **text) {
 		     view != NULL;
 		     view = ISC_LIST_NEXT(view, link)) {
 			result = dns_zt_apply(view->zonetable, ISC_FALSE,
-					      NULL, synczone, &cleanup);
+					      synczone, &cleanup);
 			if (result != ISC_R_SUCCESS &&
 			    tresult == ISC_R_SUCCESS)
 				tresult = result;
@@ -11674,7 +11754,7 @@ named_server_freeze(named_server_t *server, isc_boolean_t freeze,
 		    isc_lex_t *lex, isc_buffer_t **text)
 {
 	isc_result_t result, tresult;
-	dns_zone_t *mayberaw = NULL, *raw = NULL;
+	dns_zone_t *zone = NULL, *raw = NULL;
 	dns_zonetype_t type;
 	char classstr[DNS_RDATACLASS_FORMATSIZE];
 	char zonename[DNS_NAME_FORMATSIZE];
@@ -11683,11 +11763,11 @@ named_server_freeze(named_server_t *server, isc_boolean_t freeze,
 	isc_boolean_t frozen;
 	const char *msg = NULL;
 
-	result = zone_from_args(server, lex, NULL, &mayberaw, NULL,
+	result = zone_from_args(server, lex, NULL, &zone, NULL,
 				text, ISC_TRUE);
 	if (result != ISC_R_SUCCESS)
 		return (result);
-	if (mayberaw == NULL) {
+	if (zone == NULL) {
 		result = isc_task_beginexclusive(server->task);
 		RUNTIME_CHECK(result == ISC_R_SUCCESS);
 		tresult = ISC_R_SUCCESS;
@@ -11707,26 +11787,26 @@ named_server_freeze(named_server_t *server, isc_boolean_t freeze,
 			      isc_result_totext(tresult));
 		return (tresult);
 	}
-	dns_zone_getraw(mayberaw, &raw);
+	dns_zone_getraw(zone, &raw);
 	if (raw != NULL) {
-		dns_zone_detach(&mayberaw);
-		dns_zone_attach(raw, &mayberaw);
+		dns_zone_detach(&zone);
+		dns_zone_attach(raw, &zone);
 		dns_zone_detach(&raw);
 	}
-	type = dns_zone_gettype(mayberaw);
+	type = dns_zone_gettype(zone);
 	if (type != dns_zone_master) {
-		dns_zone_detach(&mayberaw);
+		dns_zone_detach(&zone);
 		return (DNS_R_NOTMASTER);
 	}
 
-	if (freeze && !dns_zone_isdynamic(mayberaw, ISC_TRUE)) {
-		dns_zone_detach(&mayberaw);
+	if (freeze && !dns_zone_isdynamic(zone, ISC_TRUE)) {
+		dns_zone_detach(&zone);
 		return (DNS_R_NOTDYNAMIC);
 	}
 
 	result = isc_task_beginexclusive(server->task);
 	RUNTIME_CHECK(result == ISC_R_SUCCESS);
-	frozen = dns_zone_getupdatedisabled(mayberaw);
+	frozen = dns_zone_getupdatedisabled(zone);
 	if (freeze) {
 		if (frozen) {
 			msg = "WARNING: The zone was already frozen.\n"
@@ -11735,16 +11815,16 @@ named_server_freeze(named_server_t *server, isc_boolean_t freeze,
 			result = DNS_R_FROZEN;
 		}
 		if (result == ISC_R_SUCCESS) {
-			result = dns_zone_flush(mayberaw);
+			result = dns_zone_flush(zone);
 			if (result != ISC_R_SUCCESS)
 				msg = "Flushing the zone updates to "
 				      "disk failed.";
 		}
 		if (result == ISC_R_SUCCESS)
-			dns_zone_setupdatedisabled(mayberaw, freeze);
+			dns_zone_setupdatedisabled(zone, freeze);
 	} else {
 		if (frozen) {
-			result = dns_zone_loadandthaw(mayberaw);
+			result = dns_zone_loadandthaw(zone);
 			switch (result) {
 			case ISC_R_SUCCESS:
 			case DNS_R_UPTODATE:
@@ -11767,7 +11847,7 @@ named_server_freeze(named_server_t *server, isc_boolean_t freeze,
 		(void) putnull(text);
 	}
 
-	view = dns_zone_getview(mayberaw);
+	view = dns_zone_getview(zone);
 	if (strcmp(view->name, "_default") == 0 ||
 	    strcmp(view->name, "_bind") == 0)
 	{
@@ -11777,9 +11857,9 @@ named_server_freeze(named_server_t *server, isc_boolean_t freeze,
 		vname = view->name;
 		sep = " ";
 	}
-	dns_rdataclass_format(dns_zone_getclass(mayberaw), classstr,
+	dns_rdataclass_format(dns_zone_getclass(zone), classstr,
 			      sizeof(classstr));
-	dns_name_format(dns_zone_getorigin(mayberaw),
+	dns_name_format(dns_zone_getorigin(zone),
 			zonename, sizeof(zonename));
 	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 		      NAMED_LOGMODULE_SERVER, ISC_LOG_INFO,
@@ -11787,7 +11867,7 @@ named_server_freeze(named_server_t *server, isc_boolean_t freeze,
 		      freeze ? "freezing" : "thawing",
 		      zonename, classstr, sep, vname,
 		      isc_result_totext(result));
-	dns_zone_detach(&mayberaw);
+	dns_zone_detach(&zone);
 	return (result);
 }
 
@@ -13619,7 +13699,7 @@ generate_salt(unsigned char *salt, size_t saltlen) {
 	if (saltlen > 256U)
 		return (ISC_R_RANGE);
 
-	isc_nonce_buf(salt, saltlen);
+	isc_rng_randombytes(named_g_server->sctx->rngctx, salt, saltlen);
 
 	r.base = salt;
 	r.length = (unsigned int) saltlen;
@@ -13912,7 +13992,7 @@ named_server_zonestatus(named_server_t *server, isc_lex_t *lex,
 		type = "master";
 		break;
 	case dns_zone_slave:
-		type = dns_zone_ismirror(zone) ? "mirror" : "slave";
+		type = "slave";
 		break;
 	case dns_zone_stub:
 		type = "stub";
@@ -13934,18 +14014,10 @@ named_server_zonestatus(named_server_t *server, isc_lex_t *lex,
 	}
 
 	/* Serial number */
-	result = dns_zone_getserial(mayberaw, &serial);
-	/* XXXWPK TODO this is to mirror old behavior with dns_zone_getserial */
-	if (result != ISC_R_SUCCESS) {
-		serial = 0;
-	}
+	serial = dns_zone_getserial(mayberaw);
 	snprintf(serbuf, sizeof(serbuf), "%u", serial);
 	if (hasraw) {
-		result = dns_zone_getserial(zone, &signed_serial);
-		/* XXXWPK TODO ut supra */
-		if (result != ISC_R_SUCCESS) {
-			serial = 0;
-		}
+		signed_serial = dns_zone_getserial(zone);
 		snprintf(sserbuf, sizeof(sserbuf), "%u", signed_serial);
 	}
 
@@ -14511,6 +14583,7 @@ mkey_destroy(named_server_t *server, dns_view_t *view, isc_buffer_t **text) {
 	return (result);
 }
 
+
 static isc_result_t
 mkey_dumpzone(dns_view_t *view, isc_buffer_t **text) {
 	isc_result_t result;
@@ -14926,7 +14999,6 @@ named_server_servestale(named_server_t *server, isc_lex_t *lex,
 	dns_stale_answer_t staleanswersok = dns_stale_answer_conf;
 	isc_boolean_t wantstatus = ISC_FALSE;
 	isc_result_t result = ISC_R_SUCCESS;
-	isc_boolean_t exclusive = ISC_FALSE;
 
 	/* Skip the command name. */
 	ptr = next_token(lex, text);
@@ -14978,7 +15050,6 @@ named_server_servestale(named_server_t *server, isc_lex_t *lex,
 
 	result = isc_task_beginexclusive(server->task);
 	RUNTIME_CHECK(result == ISC_R_SUCCESS);
-	exclusive = ISC_TRUE;
 
 	for (view = ISC_LIST_HEAD(server->viewlist);
 	     view != NULL;
@@ -15034,14 +15105,12 @@ named_server_servestale(named_server_t *server, isc_lex_t *lex,
 		}
 		found = ISC_TRUE;
 	}
+	isc_task_endexclusive(named_g_server->task);
 
 	if (!found)
 		result = ISC_R_NOTFOUND;
 
 cleanup:
-	if (exclusive)
-		isc_task_endexclusive(named_g_server->task);
-
 	if (isc_buffer_usedlength(*text) > 0)
 		(void) putnull(text);
 

bin/named/statschannel.c

@@ -100,7 +100,7 @@ user_zonetype( dns_zone_t *zone ) {
 	};
 	const struct zt *tp;
 
-	if ((dns_zone_getoptions(zone) & DNS_ZONEOPT_AUTOEMPTY) != 0)
+	if ((dns_zone_getoptions2(zone) & DNS_ZONEOPT2_AUTOEMPTY) != 0)
 		return ("builtin");
 
 	view = dns_zone_getview(zone);
@@ -1494,7 +1494,7 @@ zone_xmlrender(dns_zone_t *zone, void *arg) {
 	TRY0(xmlTextWriterEndElement(writer)); /* type */
 
 	TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "serial"));
-	if (dns_zone_getserial(zone, &serial) == ISC_R_SUCCESS)
+	if (dns_zone_getserial2(zone, &serial) == ISC_R_SUCCESS)
 		TRY0(xmlTextWriterWriteFormatString(writer, "%u", serial));
 	else
 		TRY0(xmlTextWriterWriteString(writer, ISC_XMLCHAR "-"));
@@ -1916,7 +1916,7 @@ generatexml(named_server_t *server, isc_uint32_t flags,
 			TRY0(xmlTextWriterStartElement(writer,
 						       ISC_XMLCHAR "zones"));
 			result = dns_zt_apply(view->zonetable, ISC_TRUE,
-					      NULL, zone_xmlrender, writer);
+					      zone_xmlrender, writer);
 			if (result != ISC_R_SUCCESS)
 				goto error;
 			TRY0(xmlTextWriterEndElement(writer)); /* /zones */
@@ -2271,7 +2271,7 @@ zone_jsonrender(dns_zone_t *zone, void *arg) {
 	dns_rdataclass_format(rdclass, classbuf, sizeof(classbuf));
 	class_only = classbuf;
 
-	if (dns_zone_getserial(zone, &serial) != ISC_R_SUCCESS)
+	if (dns_zone_getserial2(zone, &serial) != ISC_R_SUCCESS)
 		zoneobj = addzone(zone_name_only, class_only,
 				  user_zonetype(zone), 0, ISC_FALSE);
 	else
@@ -2609,10 +2609,8 @@ generatejson(named_server_t *server, size_t *msglen,
 			CHECKMEM(za);
 
 			if ((flags & STATS_JSON_ZONES) != 0) {
-				result = dns_zt_apply(view->zonetable,
-						      ISC_TRUE,
-						      NULL, zone_jsonrender,
-						      za);
+				result = dns_zt_apply(view->zonetable, ISC_TRUE,
+						      zone_jsonrender, za);
 				if (result != ISC_R_SUCCESS) {
 					goto error;
 				}
@@ -3106,7 +3104,6 @@ render_xsl(const char *url, isc_httpdurl_t *urlinfo,
 	   isc_httpdfree_t **freecb, void **freecb_args)
 {
 	isc_result_t result;
-	char *_headers = NULL;
 
 	UNUSED(url);
 	UNUSED(querystring);
@@ -3118,45 +3115,30 @@ render_xsl(const char *url, isc_httpdurl_t *urlinfo,
 
 	if (urlinfo->isstatic) {
 		isc_time_t when;
-		char *line, *saveptr;
-		const char *if_modified_since = "If-Modified-Since: ";
-		_headers = strdup(headers);
+		char *p = strcasestr(headers, "If-Modified-Since: ");
 
-		if (_headers == NULL) {
-			goto send;
-		}
+		if (p != NULL) {
+			time_t t1, t2;
+			p += strlen("If-Modified-Since: ");
+			result = isc_time_parsehttptimestamp(p, &when);
+			if (result != ISC_R_SUCCESS)
+				goto send;
 
-		saveptr = NULL;
-		for (line = strtok_r(_headers, "\n", &saveptr);
-		     line;
-		     line = strtok_r(NULL, "\n", &saveptr)) {
-			if (strncasecmp(line, if_modified_since,
-					strlen(if_modified_since)) == 0) {
-				time_t t1, t2;
-				line += strlen(if_modified_since);
-				result = isc_time_parsehttptimestamp(line, &when);
-				if (result != ISC_R_SUCCESS) {
-					goto send;
-				}
+			result = isc_time_secondsastimet(&when, &t1);
+			if (result != ISC_R_SUCCESS)
+				goto send;
 
-				result = isc_time_secondsastimet(&when, &t1);
-				if (result != ISC_R_SUCCESS) {
-					goto send;
-				}
+			result = isc_time_secondsastimet(&urlinfo->loadtime,
+							 &t2);
+			if (result != ISC_R_SUCCESS)
+				goto send;
 
-				result = isc_time_secondsastimet(&urlinfo->loadtime, &t2);
-				if (result != ISC_R_SUCCESS) {
-					goto send;
-				}
+			if (t1 < t2)
+				goto send;
 
-				if (t1 < t2) {
-					goto send;
-				}
-
-				*retcode = 304;
-				*retmsg = "Not modified";
-				goto end;
-			}
+			*retcode = 304;
+			*retmsg = "Not modified";
+			return (ISC_R_SUCCESS);
 		}
 	}
 
@@ -3165,8 +3147,7 @@ render_xsl(const char *url, isc_httpdurl_t *urlinfo,
 	*retmsg = "OK";
 	isc_buffer_reinit(b, xslmsg, strlen(xslmsg));
 	isc_buffer_add(b, strlen(xslmsg));
-end:
-	free(_headers);
+
 	return (ISC_R_SUCCESS);
 }
 
@@ -3196,8 +3177,8 @@ client_ok(const isc_sockaddr_t *fromaddr, void *arg) {
 	isc_netaddr_fromsockaddr(&netaddr, fromaddr);
 
 	LOCK(&listener->lock);
-	if ((dns_acl_match(&netaddr, NULL, listener->acl, env,
-			   &match, NULL) == ISC_R_SUCCESS) && match > 0)
+	if (dns_acl_match(&netaddr, NULL, listener->acl, env,
+			  &match, NULL) == ISC_R_SUCCESS && match > 0)
 	{
 		UNLOCK(&listener->lock);
 		return (ISC_TRUE);

bin/named/tkeyconf.c

@@ -45,7 +45,7 @@
 
 isc_result_t
 named_tkeyctx_fromconfig(const cfg_obj_t *options, isc_mem_t *mctx,
-			 dns_tkeyctx_t **tctxp)
+			 isc_entropy_t *ectx, dns_tkeyctx_t **tctxp)
 {
 	isc_result_t result;
 	dns_tkeyctx_t *tctx = NULL;
@@ -57,7 +57,7 @@ named_tkeyctx_fromconfig(const cfg_obj_t *options, isc_mem_t *mctx,
 	const cfg_obj_t *obj;
 	int type;
 
-	result = dns_tkeyctx_create(mctx, &tctx);
+	result = dns_tkeyctx_create(mctx, ectx, &tctx);
 	if (result != ISC_R_SUCCESS)
 		return (result);
 

bin/named/unix/Makefile.in

@@ -15,9 +15,9 @@ top_srcdir =	@top_srcdir@
 
 CINCLUDES =	-I${srcdir}/include -I${srcdir}/../include \
 		${ISCCFG_INCLUDES} ${ISCCC_INCLUDES} \
-		${DNS_INCLUDES} ${ISC_INCLUDES} @OPENSSL_INCLUDES@
+		${DNS_INCLUDES} ${ISC_INCLUDES} @DST_OPENSSL_INC@
 
-CDEFINES =
+CDEFINES =	@CRYPTO@
 CWARNINGS =
 
 OBJS =		os.@O@ dlz_dlopen_driver.@O@