Limit the outgoing UDP send queue size

If the operating system UDP queue gets full and the outgoing UDP sending starts to be delayed, BIND 9 could exhibit memory spikes as it tries to enqueue all the outgoing UDP messages. As those are not going to be delivered anyway (as we argued when we stopped enlarging the operating system send and receive buffers), try to send the UDP messages directly using `uv_udp_try_send()` and if that fails, drop the outgoing UDP message.
2024-09-16 13:14:35 +02:00
331 changed files with 34326 additions and 32317 deletions
@@ -1542,5 +1542,3 @@ ffbe6b95371c99b7fb05e6de17a8d6b7bf4f629f
 b7de2c7cb959fa35099d72c3f9b13938348c74e6
 # Reformat sources with up-to-date clang-format-19
 ff69d07fed2619a9bedf5ccc18cf106b7dd49bef
-# Reformat sources with up-to-date clang-format-19
-ebb5bd9c0f079de8970b538fe48e5f5c60ea7ee9
@@ -266,6 +266,7 @@ stages:
      --enable-developer
      --enable-option-checking=fatal
      --enable-dnstap
+      --enable-dnsrps
      --with-cmocka
      --with-libxml2
      --with-json-c
@@ -363,7 +364,6 @@ stages:
  needs:
    - job: ci-variables
      artifacts: true
-  timeout: 2h

 .system_test_common: &system_test_common
  <<: *default_triggering_rules
@@ -529,12 +529,6 @@ black:
    expire_in: "1 week"
    when: on_failure

-vulture:
-  <<: *precheck_job
-  needs: []
-  script:
-    - vulture --exclude "*/ans*/ans.py,conftest.py,isctest" --ignore-names "pytestmark" bin/tests/system/
-
 ci-variables:
  stage: precheck
  <<: *precheck_job
@@ -900,7 +894,6 @@ system:gcc:bookworm:amd64:
  <<: *system_test_gcov_job
  variables:
    CI_ENABLE_ALL_TESTS: 1
-    TZ: Australia/Sydney
  needs:
    - job: unit:gcc:bookworm:amd64
      artifacts: true
@@ -1115,7 +1108,15 @@ gcc:tumbleweed:amd64:
  variables:
    CC: gcc
    CFLAGS: "${CFLAGS_COMMON} -DDEBUG"
-    EXTRA_CONFIGURE: "--with-libidn2 ${WITH_READLINE_READLINE}"
+    # NOTE: Testing DNSRPS-enabled builds currently requires an
+    # operating system with glibc 2.34+.  This requirement will go away
+    # once the DNSRPS dynamic loading code gets reworked to use libuv's
+    # dlopen() API.
+    #
+    # NOTE: This does *not* enable testing of the DNSRPS feature itself.
+    # Doing that requires a DNSRPS provider library to be present on the
+    # test host.
+    EXTRA_CONFIGURE: "--enable-dnsrps --enable-dnsrps-dl --with-libidn2 ${WITH_READLINE_READLINE}"
  <<: *tumbleweed_latest_amd64_image
  <<: *build_job

@@ -1422,7 +1423,6 @@ unit:clang:freebsd14:amd64:
  needs:
    - job: clang:freebsd14:amd64
      artifacts: true
-  retry: 1  # GL #4924

 # Jobs for Clang builds on OpenBSD (amd64)

@@ -1455,12 +1455,11 @@ release:
    - pushd "${BIND_DIRECTORY}-release"
    - mv "../${BIND_DIRECTORY}.tar.xz" .
    - tar --extract --file="${BIND_DIRECTORY}.tar.xz"
-    - mv "${BIND_DIRECTORY}"/{COPYRIGHT,LICENSE,README.md,srcid} .
+    - mv "${BIND_DIRECTORY}"/{CHANGES*,COPYRIGHT,LICENSE,README.md,srcid} .
    - rm -rf "${BIND_DIRECTORY}"
    - mv "../doc/arm/_build/html" doc/arm/
    - mv "../doc/arm/_build/epub/Bv9ARM.epub" doc/arm/
    - echo '<!DOCTYPE HTML><html lang="en"><meta http-equiv="refresh" content="0; url=doc/arm/html/notes.html"><title>Redirect</title></html>' > "RELEASE-NOTES-${BIND_DIRECTORY}.html"
-    - echo '<!DOCTYPE HTML><html lang="en"><meta http-equiv="refresh" content="0; url=doc/arm/html/changelog.html"><title>Redirect</title></html>' > "CHANGELOG-${BIND_DIRECTORY}.html"
    - popd
  needs:
    - job: tarball-create
@@ -1590,7 +1589,7 @@ respdiff:asan:
    CC: gcc
    CFLAGS: "${CFLAGS_COMMON} -Og -fsanitize=address,undefined"
    LDFLAGS: "-fsanitize=address,undefined"
-    EXTRA_CONFIGURE: "--without-jemalloc"
+    EXTRA_CONFIGURE: "--disable-dnsrps --without-jemalloc"
    MAX_DISAGREEMENTS_PERCENTAGE: "0.5"
  script:
    - bash respdiff.sh -s named -q "${PWD}/100k_mixed.txt" -c 3 -w "${PWD}/rspworkdir" "${CI_PROJECT_DIR}" "/usr/local/respdiff-reference-bind/sbin/named"
@@ -1603,7 +1602,7 @@ respdiff:tsan:
    CC: gcc
    CFLAGS: "${CFLAGS_COMMON} -Og -fsanitize=thread"
    LDFLAGS: "-fsanitize=thread"
-    EXTRA_CONFIGURE: "--enable-pthread-rwlock --without-jemalloc PKG_CONFIG_PATH=/opt/tsan/lib/pkgconfig"
+    EXTRA_CONFIGURE: "--disable-dnsrps --enable-pthread-rwlock --without-jemalloc PKG_CONFIG_PATH=/opt/tsan/lib/pkgconfig"
    MAX_DISAGREEMENTS_PERCENTAGE: "0.5"
    TSAN_OPTIONS: "${TSAN_OPTIONS_DEBIAN}"
  script:
@@ -1638,7 +1637,7 @@ shotgun:tcp:
  <<: *shotgun_job
  variables:
    SHOTGUN_SCENARIO: tcp
-    SHOTGUN_TRAFFIC_MULTIPLIER: 13
+    SHOTGUN_TRAFFIC_MULTIPLIER: 6
  when: delayed
  start_in: 5 minutes

@@ -1646,7 +1645,7 @@ shotgun:dot:
  <<: *shotgun_job
  variables:
    SHOTGUN_SCENARIO: dot
-    SHOTGUN_TRAFFIC_MULTIPLIER: 6
+    SHOTGUN_TRAFFIC_MULTIPLIER: 3
  when: delayed
  start_in: 5 minutes

@@ -1664,22 +1663,8 @@ shotgun:dot:
    - job: autoreconf
      artifacts: true

-.stress-test-long: &stress_test_long_job
-  <<: *stress_test
-  artifacts:
-    untracked: true
-    exclude:
-      - "output/ns4/*.dtq*"
-      - "output/ns4/large-delta-rpz*.local"
-      - "output/rpz_*"
-    expire_in: "1 week"
-    when: always
-  timeout: 2h
-
 .stress-test-short: &stress_test_short_job
  <<: *stress_test
-  only:
-    - merge_requests
  artifacts:
    untracked: true
    exclude:
@@ -1687,6 +1672,8 @@ shotgun:dot:
      - "output/ns4/large-delta-rpz*.local"
      - "output/rpz_*"
    when: always
+  only:
+    - merge_requests

 stress:short:authoritative:fedora:40:amd64:
  <<: *fedora_40_amd64_image
@@ -1793,6 +1780,14 @@ stress:short:rpz:freebsd13:amd64:
    RATE: 1500
    RUN_TIME: 15

+.stress-test-long: &stress_test_long_job
+  <<: *stress_test
+  artifacts:
+    untracked: true
+    expire_in: "1 week"
+    when: always
+  timeout: 2h
+
 stress:authoritative:fedora:40:amd64:
  <<: *fedora_40_amd64_image
  <<: *linux_amd64
@@ -1,5 +1,4 @@
 Alan Clegg <aclegg@isc.org>
-Alessio Podda <alessio@isc.org>
 Aram Sargsyan <aram@isc.org>
 Artem Boldariev <artem@isc.org> <artem@boldariev.com>
 Curtis Blackburn <ckb@isc.org> <ckb@freebsd11.local>
@@ -12,17 +12,6 @@ disable=
    C0116, # missing-function-docstring
    C0209, # consider-using-f-string
    C0301, # line-too-long, handled better by black
-    C0302, # too-many-lines
    C0415, # import-outside-toplevel
    R0801, # duplicate-code
-    R0901, # too-many-ancestors
-    R0902, # too-many-instance-attributes
    R0903, # too-few-public-methods
-    R0904, # too-many-public-methods
-    R0911, # too-many-return-statements
-    R0912, # too-many-branches
-    R0913, # too-many-arguments
-    R0914, # too-many-locals
-    R0915, # too-many-statements
-    R0916, # too-many-boolean-expressions
-    R0917, # too-many-positional-arguments
@@ -6,9 +6,6 @@ build:
  os: ubuntu-22.04
  tools:
    python: "3.11"
-  jobs:
-    pre_build:
-      - python -m pip install -r https://gitlab.isc.org/isc-projects/bind9/-/raw/main/doc/arm/requirements.txt

 # Build documentation in doc/arm/ with Sphinx
 sphinx:
@@ -16,3 +13,8 @@ sphinx:

 # Build all formats
 formats: all
+
+# Explicitly set the version of Python and its requirements
+python:
+   install:
+   - requirements: doc/arm/requirements.txt
@@ -26,6 +26,7 @@ Files: **/*.after*
       .gitlab/*
       .mailmap
       AUTHORS
+       CHANGES
       COPYRIGHT
       Makefile
       Makefile.*
@@ -73,11 +74,6 @@ Files: **/*.after*
       bin/tests/system/masterfile/knowngood.include
       bin/tests/system/masterfile/knowngood.ttl1
       bin/tests/system/masterfile/knowngood.ttl2
-       bin/tests/system/notify/CA/CA.cfg
-       bin/tests/system/notify/CA/README
-       bin/tests/system/notify/CA/index.txt
-       bin/tests/system/notify/CA/index.txt.attr
-       bin/tests/system/notify/CA/serial
       bin/tests/system/notify/ns4/named.port.in
       bin/tests/system/nsupdate/CA/CA.cfg
       bin/tests/system/nsupdate/CA/README
@@ -0,0 +1 @@
+doc/arm/changelog.rst
@@ -21,6 +21,7 @@ EXTRA_DIST =			\
 	util/bindkeys.pl	\
 	util/dtrace.sh		\
 	contrib			\
+	CHANGES			\
 	COPYRIGHT		\
 	LICENSE			\
 	*.md
@@ -163,7 +163,7 @@ Additional information on various subjects can be found in other

 #### Bug report identifiers

-Most notes in the ARM Changelog appendix include a reference to a bug report or
+Most notes in the CHANGES file include a reference to a bug report or
 issue number. Prior to 2018, these were usually of the form `[RT #NNN]`
 and referred to entries in the "bind9-bugs" RT database, which was not open
 to the public. More recent entries use the form `[GL #NNN]` or, less often,
@@ -159,7 +159,7 @@ main(int argc, char **argv) {

 	while ((c = isc_commandline_parse(argc, argv,
 					  "c:df:hi:jJ:k:L:l:m:n:qr:s:t:o:vw:C:"
-					  "DF:M:R:S:T:W:")) != EOF)
+					  "DF:M:S:T:W:")) != EOF)
 	{
 		switch (c) {
 		case 'c':
@@ -323,18 +323,6 @@ main(int argc, char **argv) {
 			}
 			break;

-		case 'R':
-			if (ARGCMP("fail")) {
-				zone_options |= DNS_ZONEOPT_LOGREPORTS;
-			} else if (ARGCMP("ignore")) {
-				zone_options &= ~DNS_ZONEOPT_LOGREPORTS;
-			} else {
-				fprintf(stderr, "invalid argument to -R: %s\n",
-					isc_commandline_argument);
-				exit(EXIT_FAILURE);
-			}
-			break;
-
 		case 's':
 			if (ARGCMP("full")) {
 				outputstyle = &dns_master_style_full;
@@ -23,7 +23,7 @@ named-checkzone - zone file validation tool
 Synopsis
 ~~~~~~~~

-:program:`named-checkzone` [**-d**] [**-h**] [**-j**] [**-q**] [**-v**] [**-c** class] [**-C** mode] [**-f** format] [**-F** format] [**-J** filename] [**-i** mode] [**-k** mode] [**-m** mode] [**-M** mode] [**-n** mode] [**-l** ttl] [**-L** serial] [**-o** filename] [**-r** mode] [**-R** mode] [**-s** style] [**-S** mode] [**-t** directory] [**-T** mode] [**-w** directory] [**-D**] [**-W** mode] {zonename} {filename}
+:program:`named-checkzone` [**-d**] [**-h**] [**-j**] [**-q**] [**-v**] [**-c** class] [**-C** mode] [**-f** format] [**-F** format] [**-J** filename] [**-i** mode] [**-k** mode] [**-m** mode] [**-M** mode] [**-n** mode] [**-l** ttl] [**-L** serial] [**-o** filename] [**-r** mode] [**-s** style] [**-S** mode] [**-t** directory] [**-T** mode] [**-w** directory] [**-D**] [**-W** mode] {zonename} {filename}

 Description
 ~~~~~~~~~~~
@@ -166,12 +166,6 @@ Options
   semantically equal in plain DNS. Possible modes are ``fail``,
   ``warn`` (the default), and ``ignore``.

-.. option:: -R mode
-
-   This option checks whether a TXT wildcard record exists that
-   matches the name format for RFC 9567 error-reporting queries: ``*._er``.
-   Possible modes are ``fail`` and ``ignore`` (the default).
-
 .. option:: -s style

   This option specifies the style of the dumped zone file. Possible styles are
@@ -23,7 +23,7 @@ named-compilezone - zone file converting tool
 Synopsis
 ~~~~~~~~

-:program:`named-compilezone` [**-d**] [**-h**] [**-j**] [**-q**] [**-v**] [**-c** class] [**-C** mode] [**-f** format] [**-F** format] [**-J** filename] [**-i** mode] [**-k** mode] [**-m** mode] [**-M** mode] [**-n** mode] [**-l** ttl] [**-L** serial] [**-r** mode] [**-R** mode] [**-s** style] [**-S** mode] [**-t** directory] [**-T** mode] [**-w** directory] [**-D**] [**-W** mode] {**-o** filename} {zonename} {filename}
+:program:`named-compilezone` [**-d**] [**-h**] [**-j**] [**-q**] [**-v**] [**-c** class] [**-C** mode] [**-f** format] [**-F** format] [**-J** filename] [**-i** mode] [**-k** mode] [**-m** mode] [**-M** mode] [**-n** mode] [**-l** ttl] [**-L** serial] [**-r** mode] [**-s** style] [**-S** mode] [**-t** directory] [**-T** mode] [**-w** directory] [**-D**] [**-W** mode] {**-o** filename} {zonename} {filename}

 Description
 ~~~~~~~~~~~
@@ -175,12 +175,6 @@ Options
   semantically equal in plain DNS. Possible modes are ``fail``,
   ``warn``, and ``ignore`` (the default).

-.. option:: -R mode
-
-   This option checks whether a TXT wildcard record exists that
-   matches the name format for RFC 9567 error-reporting queries: ``*._er``.
-   Possible modes are ``fail`` and ``ignore`` (the default).
-
 .. option:: -s style

   This option specifies the style of the dumped zone file. Possible styles are
@@ -5,8 +5,7 @@ AM_CPPFLAGS +=				\
 	$(LIBISC_CFLAGS)		\
 	$(LIBDNS_CFLAGS)		\
 	$(LIBNS_CFLAGS)			\
-	$(LIBISCCFG_CFLAGS)		\
-	$(OPENSSL_CFLAGS)
+	$(LIBISCCFG_CFLAGS)

 AM_CPPFLAGS +=				\
 	-DSYSCONFDIR=\"${sysconfdir}\"
@@ -5,8 +5,7 @@ AM_CPPFLAGS +=			\
 	$(LIBDNS_CFLAGS)	\
 	$(LIBISCCFG_CFLAGS)	\
 	$(LIBIDN2_CFLAGS)	\
-	$(LIBUV_CFLAGS)		\
-	$(OPENSSL_CFLAGS)
+	$(LIBUV_CFLAGS)

 LDADD +=			\
 	libdighost.la		\
@@ -1500,9 +1500,9 @@ plus_tls_options(const char *cmd, const char *value, const bool state,
 		goto invalid_option;
 	}

-	return (true);
+	return true;
 invalid_option:
-	return (false);
+	return false;
 }

 /*%
@@ -1824,12 +1824,9 @@ plus_option(char *option, bool is_batchfile, bool *need_clone,
 							     "specified");
 							goto exit_or_usage;
 						}
-						extra = strtok_r(NULL, "",
+						extra = strtok_r(NULL, "\0",
 								 &last);
 						save_opt(lookup, code, extra);
-						if (extra != NULL) {
-							extra[-1] = ':';
-						}
 						break;
 					default:
 						goto invalid_option;
@@ -2558,9 +2555,6 @@ plus_option(char *option, bool is_batchfile, bool *need_clone,
 		fprintf(stderr, "Invalid option: +%s\n", option);
 		usage();
 	}
-	if (value != NULL) {
-		value[-1] = '=';
-	}
 	return (lookup);

 #if !TARGET_OS_IPHONE
@@ -2820,8 +2814,8 @@ dash_option(char *option, char *next, dig_lookup_t **lookup,
 								    * secret */
 			usage();
 		}
-		if ((ptr3 = strtok_r(NULL, "", &last)) != NULL) { /* secret or
-								   * NULL */
+		if ((ptr3 = strtok_r(NULL, ":", &last)) != NULL) { /* secret or
+								    * NULL */
 			parse_hmac(ptr);
 			ptr = ptr2;
 			ptr2 = ptr3;
@@ -2832,10 +2826,6 @@ dash_option(char *option, char *next, dig_lookup_t **lookup,
 		/* XXXONDREJ: FIXME */
 		strlcpy(keynametext, ptr, sizeof(keynametext));
 		strlcpy(keysecret, ptr2, sizeof(keysecret));
-		if (ptr3 != NULL) {
-			ptr[-1] = ':';
-		}
-		ptr2[-1] = ':';
 		return (value_from_next);
 	case 'x':
 		if (*need_clone) {
@@ -36,7 +36,6 @@
 #endif /* HAVE_LIBIDN2 */

 #include <isc/base64.h>
-#include <isc/crypto.h>
 #include <isc/file.h>
 #include <isc/getaddresses.h>
 #include <isc/hex.h>
@@ -1377,27 +1376,24 @@ typedef struct dig_ednsoptname {
 } dig_ednsoptname_t;

 dig_ednsoptname_t optnames[] = {
-	{ 1, "LLQ" },		  /* draft-sekar-dns-llq */
-	{ 2, "UL" },		  /* draft-ietf-dnssd-update-lease */
-	{ 3, "NSID" },		  /* RFC 5001 */
-	{ 5, "DAU" },		  /* RFC 6975 */
-	{ 6, "DHU" },		  /* RFC 6975 */
-	{ 7, "N3U" },		  /* RFC 6975 */
-	{ 8, "ECS" },		  /* RFC 7871 */
-	{ 9, "EXPIRE" },	  /* RFC 7314 */
-	{ 10, "COOKIE" },	  /* RFC 7873 */
-	{ 11, "KEEPALIVE" },	  /* RFC 7828 */
-	{ 12, "PADDING" },	  /* RFC 7830 */
-	{ 12, "PAD" },		  /* shorthand */
-	{ 13, "CHAIN" },	  /* RFC 7901 */
-	{ 14, "KEY-TAG" },	  /* RFC 8145 */
-	{ 15, "EDE" },		  /* ietf-dnsop-extended-error-16 */
-	{ 16, "CLIENT-TAG" },	  /* draft-bellis-dnsop-edns-tags */
-	{ 17, "SERVER-TAG" },	  /* draft-bellis-dnsop-edns-tags */
-	{ 18, "REPORT-CHANNEL" }, /* RFC 9567 */
-	{ 18, "RC" },		  /* shorthand */
-	{ 19, "ZONEVERSION" },	  /* RFC 9660 */
-	{ 26946, "DEVICEID" },	  /* Brian Hartvigsen */
+	{ 1, "LLQ" },	       /* draft-sekar-dns-llq */
+	{ 2, "UL" },	       /* draft-ietf-dnssd-update-lease */
+	{ 3, "NSID" },	       /* RFC 5001 */
+	{ 5, "DAU" },	       /* RFC 6975 */
+	{ 6, "DHU" },	       /* RFC 6975 */
+	{ 7, "N3U" },	       /* RFC 6975 */
+	{ 8, "ECS" },	       /* RFC 7871 */
+	{ 9, "EXPIRE" },       /* RFC 7314 */
+	{ 10, "COOKIE" },      /* RFC 7873 */
+	{ 11, "KEEPALIVE" },   /* RFC 7828 */
+	{ 12, "PADDING" },     /* RFC 7830 */
+	{ 12, "PAD" },	       /* shorthand */
+	{ 13, "CHAIN" },       /* RFC 7901 */
+	{ 14, "KEY-TAG" },     /* RFC 8145 */
+	{ 15, "EDE" },	       /* ietf-dnsop-extended-error-16 */
+	{ 16, "CLIENT-TAG" },  /* draft-bellis-dnsop-edns-tags */
+	{ 17, "SERVER-TAG" },  /* draft-bellis-dnsop-edns-tags */
+	{ 26946, "DEVICEID" }, /* Brian Hartvigsen */
 };

 #define N_EDNS_OPTNAMES (sizeof(optnames) / sizeof(optnames[0]))
@@ -3282,10 +3278,6 @@ start_udp(dig_query_t *query) {
 		return;
 	}

-	if (!port_set) {
-		port = 53;
-	}
-
 	result = get_address(query->servname, port, &query->sockaddr);
 	if (result != ISC_R_SUCCESS) {
 		/* This servname doesn't have an address. */
@@ -4758,7 +4750,7 @@ destroy_libs(void) {
 	isc_managers_destroy(&mctx, &loopmgr, &netmgr);

 #if ENABLE_LEAK_DETECTION
-	isc__crypto_setdestroycheck(true);
+	isc__tls_setdestroycheck(true);
 	isc__uv_setdestroycheck(true);
 	isc__xml_setdestroycheck(true);
 #endif
@@ -25,7 +25,6 @@
 #include <dns/callbacks.h>
 #include <dns/dnssec.h>
 #include <dns/fixedname.h>
-#include <dns/keymgr.h>
 #include <dns/keyvalues.h>
 #include <dns/rdataclass.h>
 #include <dns/rdatalist.h>
@@ -62,19 +61,16 @@ struct ksr_ctx {
 	bool setstart;
 	bool setend;
 	/* keygen */
-	bool ksk;
 	dns_ttl_t ttl;
 	dns_secalg_t alg;
 	int size;
 	time_t lifetime;
-	time_t parentpropagation;
 	time_t propagation;
 	time_t publishsafety;
 	time_t retiresafety;
 	time_t sigrefresh;
 	time_t sigvalidity;
 	time_t signdelay;
-	time_t ttlds;
 	time_t ttlsig;
 };
 typedef struct ksr_ctx ksr_ctx_t;
@@ -143,15 +139,6 @@ usage(int ret) {
 	exit(ret);
 }

-static isc_stdtime_t
-between(isc_stdtime_t t, isc_stdtime_t start, isc_stdtime_t end) {
-	isc_stdtime_t r = end;
-	if (t > 0 && t > start && t < end) {
-		r = t;
-	}
-	return (r);
-}
-
 static void
 checkparams(ksr_ctx_t *ksr, const char *command) {
 	if (ksr->configfile == NULL) {
@@ -195,14 +182,10 @@ getkasp(ksr_ctx_t *ksr, dns_kasp_t **kasp) {
 }

 static int
-keyalgtag_cmp(const void *k1, const void *k2) {
+keytag_cmp(const void *k1, const void *k2) {
 	dns_dnsseckey_t **key1 = (dns_dnsseckey_t **)k1;
 	dns_dnsseckey_t **key2 = (dns_dnsseckey_t **)k2;
-	if (dst_key_alg((*key1)->key) < dst_key_alg((*key2)->key)) {
-		return (-1);
-	} else if (dst_key_alg((*key1)->key) > dst_key_alg((*key2)->key)) {
-		return (1);
-	} else if (dst_key_id((*key1)->key) < dst_key_id((*key2)->key)) {
+	if (dst_key_id((*key1)->key) < dst_key_id((*key2)->key)) {
 		return (-1);
 	} else if (dst_key_id((*key1)->key) > dst_key_id((*key2)->key)) {
 		return (1);
@@ -237,7 +220,7 @@ get_dnskeys(ksr_ctx_t *ksr, dns_dnsseckeylist_t *keys) {
 	{
 		keys_sorted[i] = dk;
 	}
-	qsort(keys_sorted, n, sizeof(dns_dnsseckey_t *), keyalgtag_cmp);
+	qsort(keys_sorted, n, sizeof(dns_dnsseckey_t *), keytag_cmp);
 	while (!ISC_LIST_EMPTY(keys_read)) {
 		dns_dnsseckey_t *key = ISC_LIST_HEAD(keys_read);
 		ISC_LIST_UNLINK(keys_read, key, link);
@@ -252,7 +235,6 @@ get_dnskeys(ksr_ctx_t *ksr, dns_dnsseckeylist_t *keys) {

 static void
 setcontext(ksr_ctx_t *ksr, dns_kasp_t *kasp) {
-	ksr->parentpropagation = dns_kasp_parentpropagationdelay(kasp);
 	ksr->propagation = dns_kasp_zonepropagationdelay(kasp);
 	ksr->publishsafety = dns_kasp_publishsafety(kasp);
 	ksr->retiresafety = dns_kasp_retiresafety(kasp);
@@ -260,7 +242,6 @@ setcontext(ksr_ctx_t *ksr, dns_kasp_t *kasp) {
 	ksr->sigrefresh = dns_kasp_sigrefresh(kasp);
 	ksr->signdelay = dns_kasp_signdelay(kasp);
 	ksr->ttl = dns_kasp_dnskeyttl(kasp);
-	ksr->ttlds = dns_kasp_dsttl(kasp);
 	ksr->ttlsig = dns_kasp_zonemaxttl(kasp, true);
 }

@@ -328,9 +309,9 @@ freerrset(dns_rdataset_t *rdataset) {
 }

 static void
-create_key(ksr_ctx_t *ksr, dns_kasp_t *kasp, dns_kasp_key_t *kaspkey,
-	   dns_dnsseckeylist_t *keys, isc_stdtime_t inception,
-	   isc_stdtime_t active, isc_stdtime_t *expiration) {
+create_zsk(ksr_ctx_t *ksr, dns_kasp_key_t *kaspkey, dns_dnsseckeylist_t *keys,
+	   isc_stdtime_t inception, isc_stdtime_t active,
+	   isc_stdtime_t *expiration) {
 	bool conflict = false;
 	bool freekey = false;
 	bool show_progress = true;
@@ -342,15 +323,9 @@ create_key(ksr_ctx_t *ksr, dns_kasp_t *kasp, dns_kasp_key_t *kaspkey,
 	isc_buffer_t buf;
 	isc_result_t ret;
 	isc_stdtime_t prepub;
-	uint16_t flags = DNS_KEYOWNER_ZONE;

 	isc_stdtime_tostring(inception, timestr, sizeof(timestr));

-	/* ZSK or KSK? */
-	if (ksr->ksk) {
-		flags |= DNS_KEYFLAG_KSK;
-	}
-
 	/* Check algorithm and size. */
 	dns_secalg_format(ksr->alg, algstr, sizeof(algstr));
 	if (!dst_algorithm_supported(ksr->alg)) {
@@ -441,18 +416,18 @@ create_key(ksr_ctx_t *ksr, dns_kasp_t *kasp, dns_kasp_key_t *kaspkey,
 			ret = dns_keystore_keygen(
 				ksr->keystore, name, ksr->policy,
 				dns_rdataclass_in, mctx, ksr->alg, ksr->size,
-				flags, &key);
+				DNS_KEYOWNER_ZONE, &key);
 		} else if (show_progress) {
-			ret = dst_key_generate(name, ksr->alg, ksr->size, 0,
-					       flags, DNS_KEYPROTO_DNSSEC,
-					       dns_rdataclass_in, NULL, mctx,
-					       &key, &progress);
+			ret = dst_key_generate(
+				name, ksr->alg, ksr->size, 0, DNS_KEYOWNER_ZONE,
+				DNS_KEYPROTO_DNSSEC, dns_rdataclass_in, NULL,
+				mctx, &key, &progress);
 			fflush(stderr);
 		} else {
-			ret = dst_key_generate(name, ksr->alg, ksr->size, 0,
-					       flags, DNS_KEYPROTO_DNSSEC,
-					       dns_rdataclass_in, NULL, mctx,
-					       &key, NULL);
+			ret = dst_key_generate(
+				name, ksr->alg, ksr->size, 0, DNS_KEYOWNER_ZONE,
+				DNS_KEYPROTO_DNSSEC, dns_rdataclass_in, NULL,
+				mctx, &key, NULL);
 		}

 		if (ret != ISC_R_SUCCESS) {
@@ -489,28 +464,15 @@ create_key(ksr_ctx_t *ksr, dns_kasp_t *kasp, dns_kasp_key_t *kaspkey,
 	prepub = ksr->ttl + ksr->publishsafety + ksr->propagation;
 	dst_key_setttl(key, ksr->ttl);
 	dst_key_setnum(key, DST_NUM_LIFETIME, ksr->lifetime);
-	dst_key_setbool(key, DST_BOOL_KSK, ksr->ksk);
-	dst_key_setbool(key, DST_BOOL_ZSK, !ksr->ksk);
+	dst_key_setbool(key, DST_BOOL_KSK, false);
+	dst_key_setbool(key, DST_BOOL_ZSK, true);
 	dst_key_settime(key, DST_TIME_CREATED, ksr->now);
 	dst_key_settime(key, DST_TIME_PUBLISH, (active - prepub));
 	dst_key_settime(key, DST_TIME_ACTIVATE, active);
-	if (ksr->ksk) {
-		dns_keymgr_settime_syncpublish(key, kasp,
-					       (inception == ksr->start));
-	}
-
 	if (ksr->lifetime > 0) {
 		isc_stdtime_t inactive = (active + ksr->lifetime);
-		isc_stdtime_t remove;
-
-		if (ksr->ksk) {
-			remove = ksr->ttlds + ksr->parentpropagation +
-				 ksr->retiresafety;
-			dst_key_settime(key, DST_TIME_SYNCDELETE, inactive);
-		} else {
-			remove = ksr->ttlsig + ksr->propagation +
-				 ksr->retiresafety + ksr->signdelay;
-		}
+		isc_stdtime_t remove = ksr->ttlsig + ksr->propagation +
+				       ksr->retiresafety + ksr->signdelay;
 		dst_key_settime(key, DST_TIME_INACTIVE, inactive);
 		dst_key_settime(key, DST_TIME_DELETE, (inactive + remove));
 		*expiration = inactive;
@@ -644,13 +606,12 @@ fail:
 	return (next_bundle);
 }

-static isc_stdtime_t
+static void
 sign_rrset(ksr_ctx_t *ksr, isc_stdtime_t inception, isc_stdtime_t expiration,
 	   dns_rdataset_t *rrset, dns_dnsseckeylist_t *keys) {
 	dns_rdatalist_t *rrsiglist = NULL;
 	dns_rdataset_t rrsigset = DNS_RDATASET_INIT;
 	isc_result_t ret;
-	isc_stdtime_t next_bundle = expiration;

 	UNUSED(ksr);

@@ -694,25 +655,6 @@ sign_rrset(ksr_ctx_t *ksr, isc_stdtime_t inception, isc_stdtime_t expiration,
 		unsigned char rdatabuf[SIG_FORMATSIZE];
 		isc_stdtime_t clockskew = inception - 3600;

-		isc_stdtime_t pub = 0, act = 0, inact = 0, del = 0;
-
-		/* Determine next bundle. */
-		(void)dst_key_gettime(dk->key, DST_TIME_PUBLISH, &pub);
-		(void)dst_key_gettime(dk->key, DST_TIME_ACTIVATE, &act);
-		(void)dst_key_gettime(dk->key, DST_TIME_INACTIVE, &inact);
-		(void)dst_key_gettime(dk->key, DST_TIME_DELETE, &del);
-		next_bundle = between(pub, inception, next_bundle);
-		next_bundle = between(act, inception, next_bundle);
-		next_bundle = between(inact, inception, next_bundle);
-		next_bundle = between(del, inception, next_bundle);
-
-		if (act > inception) {
-			continue;
-		}
-		if (inact != 0 && inception >= inact) {
-			continue;
-		}
-
 		rrsig = isc_mem_get(mctx, sizeof(*rrsig));
 		dns_rdata_init(rrsig);
 		isc_buffer_init(&buf, rdatabuf, sizeof(rdatabuf));
@@ -734,25 +676,21 @@ sign_rrset(ksr_ctx_t *ksr, isc_stdtime_t inception, isc_stdtime_t expiration,
 	dns_rdatalist_tordataset(rrsiglist, &rrsigset);
 	print_rdata(&rrsigset);
 	freerrset(&rrsigset);
-
-	return (next_bundle);
 }

 /*
 * Create the DNSKEY, CDS, and CDNSKEY records beloing to the KSKs
 * listed in 'keys'.
 */
-static isc_stdtime_t
-get_keymaterial(ksr_ctx_t *ksr, dns_kasp_t *kasp, isc_stdtime_t inception,
-		isc_stdtime_t next_inception, dns_dnsseckeylist_t *keys,
-		dns_rdataset_t *dnskeyset, dns_rdataset_t *cdnskeyset,
-		dns_rdataset_t *cdsset) {
-	dns_kasp_digestlist_t digests = dns_kasp_digests(kasp);
+static void
+create_ksk(ksr_ctx_t *ksr, dns_kasp_t *kasp, dns_dnsseckeylist_t *keys,
+	   dns_rdataset_t *dnskeyset, dns_rdataset_t *cdnskeyset,
+	   dns_rdataset_t *cdsset) {
 	dns_rdatalist_t *dnskeylist = isc_mem_get(mctx, sizeof(*dnskeylist));
 	dns_rdatalist_t *cdnskeylist = isc_mem_get(mctx, sizeof(*cdnskeylist));
 	dns_rdatalist_t *cdslist = isc_mem_get(mctx, sizeof(*cdslist));
 	isc_result_t ret = ISC_R_SUCCESS;
-	isc_stdtime_t next_bundle = next_inception;
+	dns_kasp_digestlist_t digests = dns_kasp_digests(kasp);

 	dns_rdatalist_init(dnskeylist);
 	dnskeylist->rdclass = dns_rdataclass_in;
@@ -772,73 +710,31 @@ get_keymaterial(ksr_ctx_t *ksr, dns_kasp_t *kasp, isc_stdtime_t inception,
 	for (dns_dnsseckey_t *dk = ISC_LIST_HEAD(*keys); dk != NULL;
 	     dk = ISC_LIST_NEXT(dk, link))
 	{
-		bool published = true;
 		isc_buffer_t buf;
 		isc_buffer_t *newbuf;
 		dns_rdata_t *rdata;
 		isc_region_t r;
 		isc_region_t rcds;
-		isc_stdtime_t pub = 0, del = 0;
 		unsigned char kskbuf[DST_KEY_MAXSIZE];
 		unsigned char cdnskeybuf[DST_KEY_MAXSIZE];
 		unsigned char cdsbuf[DNS_DS_BUFFERSIZE];

 		/* KSK */
-		(void)dst_key_gettime(dk->key, DST_TIME_PUBLISH, &pub);
-		(void)dst_key_gettime(dk->key, DST_TIME_DELETE, &del);
-		next_bundle = between(pub, inception, next_bundle);
-		next_bundle = between(del, inception, next_bundle);
+		newbuf = NULL;
+		rdata = isc_mem_get(mctx, sizeof(*rdata));
+		dns_rdata_init(rdata);

-		if (pub > inception) {
-			published = false;
-		}
-		if (del != 0 && inception >= del) {
-			published = false;
-		}
-
-		if (published) {
-			newbuf = NULL;
-			rdata = isc_mem_get(mctx, sizeof(*rdata));
-			dns_rdata_init(rdata);
-
-			isc_buffer_init(&buf, kskbuf, sizeof(kskbuf));
-			CHECK(dst_key_todns(dk->key, &buf));
-			isc_buffer_usedregion(&buf, &r);
-			isc_buffer_allocate(mctx, &newbuf, r.length);
-			isc_buffer_putmem(newbuf, r.base, r.length);
-			isc_buffer_usedregion(newbuf, &r);
-			dns_rdata_fromregion(rdata, dns_rdataclass_in,
-					     dns_rdatatype_dnskey, &r);
-			ISC_LIST_APPEND(dnskeylist->rdata, rdata, link);
-			ISC_LIST_APPEND(cleanup_list, newbuf, link);
-			isc_buffer_clear(newbuf);
-		}
-
-		published = true;
-		if (dns_kasp_cdnskey(kasp) || !ISC_LIST_EMPTY(digests)) {
-			pub = 0;
-			del = 0;
-			(void)dst_key_gettime(dk->key, DST_TIME_SYNCPUBLISH,
-					      &pub);
-			(void)dst_key_gettime(dk->key, DST_TIME_SYNCDELETE,
-					      &del);
-
-			next_bundle = between(pub, inception, next_bundle);
-			next_bundle = between(del, inception, next_bundle);
-
-			if (pub != 0 && pub > inception) {
-				published = false;
-			}
-			if (del != 0 && inception >= del) {
-				published = false;
-			}
-		} else {
-			published = false;
-		}
-
-		if (!published) {
-			continue;
-		}
+		isc_buffer_init(&buf, kskbuf, sizeof(kskbuf));
+		CHECK(dst_key_todns(dk->key, &buf));
+		isc_buffer_usedregion(&buf, &r);
+		isc_buffer_allocate(mctx, &newbuf, r.length);
+		isc_buffer_putmem(newbuf, r.base, r.length);
+		isc_buffer_usedregion(newbuf, &r);
+		dns_rdata_fromregion(rdata, dns_rdataclass_in,
+				     dns_rdatatype_dnskey, &r);
+		ISC_LIST_APPEND(dnskeylist->rdata, rdata, link);
+		ISC_LIST_APPEND(cleanup_list, newbuf, link);
+		isc_buffer_clear(newbuf);

 		/* CDNSKEY */
 		newbuf = NULL;
@@ -892,98 +788,35 @@ get_keymaterial(ksr_ctx_t *ksr, dns_kasp_t *kasp, isc_stdtime_t inception,
 	dns_rdatalist_tordataset(dnskeylist, dnskeyset);
 	dns_rdatalist_tordataset(cdnskeylist, cdnskeyset);
 	dns_rdatalist_tordataset(cdslist, cdsset);
-
-	return (next_bundle);
+	return;

 fail:
 	fatal("failed to create KSK/CDS/CDNSKEY");
-	return (0);
 }

 static void
-sign_bundle(ksr_ctx_t *ksr, dns_kasp_t *kasp, isc_stdtime_t inception,
-	    isc_stdtime_t next_inception, dns_rdatalist_t *zsklist,
+sign_bundle(ksr_ctx_t *ksr, isc_stdtime_t inception,
+	    isc_stdtime_t next_inception, dns_rdatalist_t *rdatalist,
+	    dns_rdataset_t *cds, dns_rdataset_t *cdnskey,
 	    dns_dnsseckeylist_t *keys) {
-	isc_stdtime_t expiration = inception + ksr->sigvalidity;
-	isc_stdtime_t next_bundle = next_inception;
-	dns_rdataset_t zsk;
-
-	dns_rdataset_init(&zsk);
-	dns_rdatalist_tordataset(zsklist, &zsk);
+	dns_rdataset_t rrset = DNS_RDATASET_INIT;
+	isc_stdtime_t expiration;

+	dns_rdataset_init(&rrset);
+	dns_rdatalist_tordataset(rdatalist, &rrset);
+	expiration = inception + ksr->sigvalidity;
 	while (inception <= next_inception) {
-		isc_stdtime_t next_time = next_bundle;
-
-		/* DNSKEY RRset */
-		dns_rdatalist_t *dnskeylist;
-		dnskeylist = isc_mem_get(mctx, sizeof(*dnskeylist));
-		dns_rdatalist_init(dnskeylist);
-		dnskeylist->rdclass = dns_rdataclass_in;
-		dnskeylist->type = dns_rdatatype_dnskey;
-		dnskeylist->ttl = ksr->ttl;
-
-		dns_rdataset_t ksk, cdnskey, cds, rrset;
-		dns_rdataset_init(&ksk);
-		dns_rdataset_init(&cdnskey);
-		dns_rdataset_init(&cds);
-		dns_rdataset_init(&rrset);
-		next_time = get_keymaterial(ksr, kasp, inception, next_time,
-					    keys, &ksk, &cdnskey, &cds);
-		if (next_bundle > next_time) {
-			next_bundle = next_time;
+		sign_rrset(ksr, inception, expiration, &rrset, keys);
+		if (dns_rdataset_count(cdnskey) > 0) {
+			sign_rrset(ksr, inception, expiration, cdnskey, keys);
 		}
-
-		for (isc_result_t r = dns_rdatalist_first(&ksk);
-		     r == ISC_R_SUCCESS; r = dns_rdatalist_next(&ksk))
-		{
-			dns_rdata_t *clone = isc_mem_get(mctx, sizeof(*clone));
-			dns_rdata_init(clone);
-			dns_rdatalist_current(&ksk, clone);
-			ISC_LIST_APPEND(dnskeylist->rdata, clone, link);
+		if (dns_rdataset_count(cds) > 0) {
+			sign_rrset(ksr, inception, expiration, cds, keys);
 		}
-
-		for (isc_result_t r = dns_rdatalist_first(&zsk);
-		     r == ISC_R_SUCCESS; r = dns_rdatalist_next(&zsk))
-		{
-			dns_rdata_t *clone = isc_mem_get(mctx, sizeof(*clone));
-			dns_rdata_init(clone);
-			dns_rdatalist_current(&zsk, clone);
-			ISC_LIST_APPEND(dnskeylist->rdata, clone, link);
-		}
-
-		dns_rdatalist_tordataset(dnskeylist, &rrset);
-		next_time = sign_rrset(ksr, inception, expiration, &rrset,
-				       keys);
-		if (next_bundle > next_time) {
-			next_bundle = next_time;
-		}
-		freerrset(&ksk);
-		freerrset(&rrset);
-
-		/* CDNSKEY */
-		if (dns_rdataset_count(&cdnskey) > 0) {
-			(void)sign_rrset(ksr, inception, expiration, &cdnskey,
-					 keys);
-		}
-		freerrset(&cdnskey);
-
-		/* CDS */
-		if (dns_rdataset_count(&cds) > 0) {
-			(void)sign_rrset(ksr, inception, expiration, &cds,
-					 keys);
-		}
-		freerrset(&cds);
-
-		/* Next response bundle. */
 		inception = expiration - ksr->sigrefresh;
-		if (inception > next_bundle) {
-			inception = next_bundle;
-		}
 		expiration = inception + ksr->sigvalidity;
-		next_bundle = expiration;
 	}
-
-	freerrset(&zsk);
+	freerrset(&rrset);
 }

 static isc_result_t
@@ -1070,12 +903,9 @@ keygen(ksr_ctx_t *ksr) {
 	for (dns_kasp_key_t *kk = ISC_LIST_HEAD(dns_kasp_keys(kasp));
 	     kk != NULL; kk = ISC_LIST_NEXT(kk, link))
 	{
-		if (dns_kasp_key_ksk(kk) && !ksr->ksk) {
+		if (dns_kasp_key_ksk(kk)) {
 			/* only ZSKs allowed */
 			continue;
-		} else if (dns_kasp_key_zsk(kk) && ksr->ksk) {
-			/* only KSKs allowed */
-			continue;
 		}
 		ksr->alg = dns_kasp_key_algorithm(kk);
 		ksr->lifetime = dns_kasp_key_lifetime(kk);
@@ -1086,7 +916,7 @@ keygen(ksr_ctx_t *ksr) {
 		for (isc_stdtime_t inception = ksr->start, act = ksr->start;
 		     inception < ksr->end; inception += ksr->lifetime)
 		{
-			create_key(ksr, kasp, kk, &keys, inception, act, &act);
+			create_zsk(ksr, kk, &keys, inception, act, &act);
 			if (ksr->lifetime == 0) {
 				/* unlimited lifetime, but not infinite loop */
 				break;
@@ -1094,7 +924,7 @@ keygen(ksr_ctx_t *ksr) {
 		}
 	}
 	if (noop) {
-		fatal("no keys created for policy '%s'", ksr->policy);
+		fatal("policy '%s' has no zsks", ksr->policy);
 	}
 	/* Cleanup */
 	cleanup(&keys, kasp);
@@ -1173,6 +1003,9 @@ sign(ksr_ctx_t *ksr) {
 	dns_dnsseckeylist_t keys;
 	dns_kasp_t *kasp = NULL;
 	dns_rdatalist_t *rdatalist = NULL;
+	dns_rdataset_t ksk = DNS_RDATASET_INIT;
+	dns_rdataset_t cdnskey = DNS_RDATASET_INIT;
+	dns_rdataset_t cds = DNS_RDATASET_INIT;
 	isc_result_t ret;
 	isc_stdtime_t inception;
 	isc_lex_t *lex = NULL;
@@ -1205,6 +1038,9 @@ sign(ksr_ctx_t *ksr) {
 		      isc_result_totext(ret));
 	}

+	/* KSK, CDS and CDNSKEY */
+	create_ksk(ksr, kasp, &keys, &ksk, &cdnskey, &cds);
+
 	for (ret = isc_lex_gettoken(lex, opt, &token); ret == ISC_R_SUCCESS;
 	     ret = isc_lex_gettoken(lex, opt, &token))
 	{
@@ -1254,8 +1090,8 @@ sign(ksr_ctx_t *ksr) {

 			if (have_bundle) {
 				/* Sign previous bundle */
-				sign_bundle(ksr, kasp, inception,
-					    next_inception, rdatalist, &keys);
+				sign_bundle(ksr, inception, next_inception,
+					    rdatalist, &cds, &cdnskey, &keys);
 				fprintf(stdout, "\n");
 			}

@@ -1265,7 +1101,15 @@ sign(ksr_ctx_t *ksr) {
 			rdatalist->rdclass = dns_rdataclass_in;
 			rdatalist->type = dns_rdatatype_dnskey;
 			rdatalist->ttl = ksr->ttl;
-
+			for (isc_result_t r = dns_rdatalist_first(&ksk);
+			     r == ISC_R_SUCCESS; r = dns_rdatalist_next(&ksk))
+			{
+				dns_rdata_t *clone =
+					isc_mem_get(mctx, sizeof(*clone));
+				dns_rdata_init(clone);
+				dns_rdatalist_current(&ksk, clone);
+				ISC_LIST_APPEND(rdatalist->rdata, clone, link);
+			}
 			inception = next_inception;
 			have_bundle = true;

@@ -1324,7 +1168,8 @@ sign(ksr_ctx_t *ksr) {

 	/* Final bundle */
 	if (have_bundle && rdatalist != NULL) {
-		sign_bundle(ksr, kasp, inception, ksr->end, rdatalist, &keys);
+		sign_bundle(ksr, inception, ksr->end, rdatalist, &cds, &cdnskey,
+			    &keys);
 	} else {
 		fatal("bad KSR file %s(%lu): no bundles", ksr->file,
 		      isc_lex_getsourceline(lex));
@@ -1336,6 +1181,11 @@ sign(ksr_ctx_t *ksr) {
 		timestr, PACKAGE_VERSION);

 fail:
+	/* Clean up */
+	freerrset(&ksk);
+	freerrset(&cdnskey);
+	freerrset(&cds);
+
 	isc_lex_destroy(&lex);
 	cleanup(&keys, kasp);
 }
@@ -1358,7 +1208,7 @@ main(int argc, char *argv[]) {

 	isc_commandline_errprint = false;

-#define OPTIONS "E:e:Ff:hi:K:k:l:ov:V"
+#define OPTIONS "E:e:Ff:hi:K:k:l:v:V"
 	while ((ch = isc_commandline_parse(argc, argv, OPTIONS)) != -1) {
 		switch (ch) {
 		case 'E':
@@ -1395,9 +1245,6 @@ main(int argc, char *argv[]) {
 		case 'l':
 			ksr.configfile = isc_commandline_argument;
 			break;
-		case 'o':
-			ksr.ksk = true;
-			break;
 		case 'V':
 			version(program);
 			break;
@@ -21,7 +21,7 @@ dnssec-ksr - Create signed key response (SKR) files for offline KSK setups
 Synopsis
 ~~~~~~~~

-:program:`dnssec-ksr` [**-e** date/offset] [**-F**] [**-f** file] [**-h**] [**-i** date/offset] [**-K** directory] [**-k** policy] [**-l** file] [**-o**] [**-V**] [**-v** level] {command} {zone}
+:program:`dnssec-ksr` [**-e** date/offset] [**-F**] [**-h**] [**-i** date/offset] [**-K** directory] [**-k** policy] [**-l** file] [**-V**] [**-v** level] {command} {zone}

 Description
 ~~~~~~~~~~~
@@ -51,10 +51,6 @@ Options
   mode if the underlying crytographic library supports running in FIPS
   mode.

-.. option:: -f
-
-   This option sets the SKR file to be signed when issuing a ``sign`` command.
-
 .. option:: -h

   This option prints a short summary of the options and arguments to
@@ -80,11 +76,6 @@ Options
   This option provides a configuration file that contains a ``dnssec-policy``
   statement (matching the policy set with :option:`-k`).

-.. option:: -o
-
-   Normally when pregenerating keys, ZSKs are created. When this option is
-   set, create KSKs instead.
-
 .. option:: -V

   This option prints version information.
@@ -107,8 +98,9 @@ Commands

 .. option:: keygen

-  Pregenerate a number of keys, given a DNSSEC policy and an interval. The
-  number of generated keys depends on the interval and the key lifetime.
+  Pregenerate a number of zone signing keys (ZSKs), given a DNSSEC policy and
+  an interval. The number of generated keys depends on the interval and the
+  ZSK lifetime.

 .. option:: request

@@ -131,7 +123,7 @@ occurred.
 Examples
 ~~~~~~~~

-When you need to generate ZSKs for the zone "example.com" for the next year,
+When you need to generate keys for the zone "example.com" for the next year,
 given a ``dnssec-policy`` named "mypolicy":

 ::
@@ -144,8 +136,7 @@ Creating a KSR for the same zone and period can be done with:

    dnssec-ksr -i now -e +1y -k mypolicy -l named.conf request example.com > ksr.txt

-Typically you would now transfer the KSR to the system that has access to
-the KSK.
+Typically you would now transfer the KSR to the system that has access to the KSK.

 Signing the KSR created above can be done with:

@@ -153,8 +144,7 @@ Signing the KSR created above can be done with:

    dnssec-ksr -i now -e +1y -k kskpolicy -l named.conf -f ksr.txt sign example.com

-Make sure that the DNSSEC parameters in ``kskpolicy`` match those
-in ``mypolicy``.
+Make sure that the DNSSEC parameters in ``kskpolicy`` match those in ``mypolicy``.

 See Also
 ~~~~~~~~
@@ -859,7 +859,7 @@ getoriginnode(dns_db_t *db, dns_dbnode_t **nodep DNS__DB_FLARG) {
 		return (result);
 	}

-	*nodep = (dns_dbnode_t *)node;
+	*nodep = node;
 	return (ISC_R_SUCCESS);
 }

@@ -905,7 +905,7 @@ findnode(dns_db_t *db, const dns_name_t *name, bool create,
 		}
 	}

-	*nodep = (dns_dbnode_t *)node;
+	*nodep = node;
 	return (ISC_R_SUCCESS);
 }

@@ -925,7 +925,7 @@ find(dns_db_t *db, const dns_name_t *name, dns_dbversion_t *version,

 	REQUIRE(VALID_BDB(bdb));
 	REQUIRE(nodep == NULL || *nodep == NULL);
-	REQUIRE(version == NULL || version == (dns_dbversion_t *)&dummy);
+	REQUIRE(version == NULL || version == (void *)&dummy);

 	if (!dns_name_issubdomain(name, &db->origin)) {
 		return (DNS_R_NXDOMAIN);
@@ -1015,7 +1015,7 @@ find(dns_db_t *db, const dns_name_t *name, dns_dbversion_t *version,
 		 * and try again.
 		 */
 		if (i < nlabels) {
-			destroynode((bdbnode_t *)node);
+			destroynode(node);
 			node = NULL;
 			continue;
 		}
@@ -1142,7 +1142,7 @@ allrdatasets(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
 	     dns_rdatasetiter_t **iteratorp DNS__DB_FLARG) {
 	bdb_rdatasetiter_t *iterator = NULL;

-	REQUIRE(version == NULL || version == (dns_dbversion_t *)&dummy);
+	REQUIRE(version == NULL || version == &dummy);

 	iterator = isc_mem_get(db->mctx, sizeof(bdb_rdatasetiter_t));
 	*iterator = (bdb_rdatasetiter_t){
@@ -95,12 +95,10 @@ options {\n\
 #endif
 			    "\
 	prefetch 2 9;\n\
-#	querylog <boolean>;\n\
 	recursing-file \"named.recursing\";\n\
 	recursive-clients 1000;\n\
 	request-nsid false;\n\
 	resolver-query-timeout 10;\n\
-#	responselog <boolean>;\n\
 	rrset-order { order random; };\n\
 	secroots-file \"named.secroots\";\n\
 	send-cookie true;\n\
@@ -152,6 +150,9 @@ options {\n\
 	clients-per-query 10;\n\
 	dnssec-accept-expired no;\n\
 	dnssec-validation " VALIDATION_DEFAULT "; \n"
+#ifdef USE_DNSRPS
+			    "	dnsrps-library \"" DNSRPS_LIBRPZ_PATH "\";\n"
+#endif /* ifdef USE_DNSRPS */
 #ifdef HAVE_DNSTAP
 			    "	dnstap-identity hostname;\n"
 #endif /* ifdef HAVE_DNSTAP */
@@ -236,7 +237,6 @@ options {\n\
 	notify yes;\n\
 	notify-delay 5;\n\
 	notify-to-soa no;\n\
-	send-report-channel .;\n\
 	serial-update-method increment;\n\
 	sig-signing-nodes 100;\n\
 	sig-signing-signatures 10;\n\
@@ -214,7 +214,8 @@ named_control_docommand(isccc_sexpr_t *message, bool readonly,
 	{
 		result = named_server_dnstap(named_g_server, lex, text);
 	} else if (command_compare(command, NAMED_COMMAND_DUMPDB)) {
-		result = named_server_dumpdb(named_g_server, lex, text);
+		named_server_dumpdb(named_g_server, lex, text);
+		result = ISC_R_SUCCESS;
 	} else if (command_compare(command, NAMED_COMMAND_DUMPSTATS)) {
 		result = named_server_dumpstats(named_g_server);
 	} else if (command_compare(command, NAMED_COMMAND_FETCHLIMIT)) {
@@ -246,9 +247,7 @@ named_control_docommand(isccc_sexpr_t *message, bool readonly,
 	} else if (command_compare(command, NAMED_COMMAND_NULL)) {
 		result = ISC_R_SUCCESS;
 	} else if (command_compare(command, NAMED_COMMAND_QUERYLOG)) {
-		result = named_server_setortoggle(named_g_server,
-						  "query logging",
-						  NS_SERVER_LOGQUERIES, lex);
+		result = named_server_togglequerylog(named_g_server, lex);
 	} else if (command_compare(command, NAMED_COMMAND_RECONFIG)) {
 		result = named_server_reconfigcommand(named_g_server);
 	} else if (command_compare(command, NAMED_COMMAND_RECURSING)) {
@@ -257,10 +256,6 @@ named_control_docommand(isccc_sexpr_t *message, bool readonly,
 		result = named_server_refreshcommand(named_g_server, lex, text);
 	} else if (command_compare(command, NAMED_COMMAND_RELOAD)) {
 		result = named_server_reloadcommand(named_g_server, lex, text);
-	} else if (command_compare(command, NAMED_COMMAND_RESPONSELOG)) {
-		result = named_server_setortoggle(named_g_server,
-						  "response logging",
-						  NS_SERVER_LOGRESPONSES, lex);
 	} else if (command_compare(command, NAMED_COMMAND_RETRANSFER)) {
 		result = named_server_retransfercommand(named_g_server, lex,
 							text);
@@ -54,7 +54,6 @@
 #define NAMED_COMMAND_RECURSING	   "recursing"
 #define NAMED_COMMAND_REFRESH	   "refresh"
 #define NAMED_COMMAND_RELOAD	   "reload"
-#define NAMED_COMMAND_RESPONSELOG  "responselog"
 #define NAMED_COMMAND_RETRANSFER   "retransfer"
 #define NAMED_COMMAND_SCAN	   "scan"
 #define NAMED_COMMAND_SECROOTS	   "secroots"
@@ -98,6 +98,8 @@ EXTERN const char *named_g_conffile	   INIT(NAMED_SYSCONFDIR "/named.conf");
 EXTERN const char *named_g_defaultbindkeys INIT(NULL);
 EXTERN const char *named_g_keyfile	   INIT(NAMED_SYSCONFDIR "/rndc.key");

+EXTERN dns_tsigkey_t *named_g_sessionkey    INIT(NULL);
+EXTERN dns_name_t			    named_g_sessionkeyname;
 EXTERN bool named_g_conffileset		    INIT(false);
 EXTERN cfg_aclconfctx_t *named_g_aclconfctx INIT(NULL);

@@ -109,7 +111,6 @@ EXTERN const char *named_g_chrootdir INIT(NULL);
 EXTERN bool named_g_foreground	     INIT(false);
 EXTERN bool named_g_logstderr	     INIT(false);
 EXTERN bool named_g_nosyslog	     INIT(false);
-EXTERN unsigned int named_g_logflags INIT(0);
 EXTERN const char *named_g_logfile   INIT(NULL);

 EXTERN const char *named_g_defaultsessionkeyfile INIT(NAMED_LOCALSTATEDIR
@@ -56,6 +56,9 @@ struct named_server {
 	char *version;	    /*%< User-specified version */
 	bool  hostname_set; /*%< User has set hostname */
 	char *hostname;	    /*%< User-specified hostname */
+#ifdef USE_DNSRPS
+	char *dnsrpslib;
+#endif /* ifdef USE_DNSRPS */

 	/* Server data structures. */
 	dns_loadmgr_t	  *loadmgr;
@@ -181,20 +184,10 @@ named_server_retransfercommand(named_server_t *server, isc_lex_t *lex,
 */

 isc_result_t
-named_server_setortoggle(named_server_t *server, const char *optname,
-			 unsigned int option, isc_lex_t *lex);
+named_server_togglequerylog(named_server_t *server, isc_lex_t *lex);
 /*%<
- * Enable/disable, or toggle, a server option via the command channel.
- * 'option' is the option value to be changed (for example,
- * NS_SERVER_LOGQUERIES or NS_SERVER_LOGRESPOSNES) and 'optname' is the
- * option's human-readable name for logging purposes ("query logging"
- * or "response logging").
- *
- * If an explicit argument to enable the option was provided
- * (i.e., "on", "enable", "true", or "yes") or an explicit argument
- * to disable it ("off", "disable", "false", or "no"), it will be used.
- *
- * If no argument is provided, the option's current state will be reversed.
+ * Enable/disable logging of queries.  (Takes "yes" or "no" argument,
+ * but can also be used as a toggle for backward comptibility.)
 */

 /*%
@@ -79,16 +79,6 @@ named_log_setdefaultchannels(isc_logconfig_t *lcfg) {
 		isc_log_createchannel(lcfg, "default_debug", ISC_LOG_TOFILE,
 				      ISC_LOG_DYNAMIC, &destination,
 				      ISC_LOG_PRINTTIME | ISC_LOG_DEBUGONLY);
-	} else if (named_g_logstderr && (named_g_logflags != 0)) {
-		/*
-		 * If the option -g is given, but we also requested iso
-		 * timestamps, we'll still need to override the "default_debug"
-		 * logger with a new one.
-		 */
-		isc_log_createchannel(lcfg, "default_debug", ISC_LOG_TOFILEDESC,
-				      ISC_LOG_DYNAMIC,
-				      ISC_LOGDESTINATION_STDERR,
-				      ISC_LOG_PRINTTIME | named_g_logflags);
 	}

 	if (named_g_logfile != NULL) {
@@ -128,16 +118,6 @@ named_log_setsafechannels(isc_logconfig_t *lcfg) {
 		 * discarded a bit faster.
 		 */
 		isc_log_setdebuglevel(0);
-	} else if (named_g_logstderr && (named_g_logflags != 0)) {
-		/*
-		 * If the option -g is given, but we also requested iso
-		 * timestamps, we'll still need to override the "default_debug"
-		 * logger with a new one.
-		 */
-		isc_log_createchannel(lcfg, "default_debug", ISC_LOG_TOFILEDESC,
-				      ISC_LOG_DYNAMIC,
-				      ISC_LOGDESTINATION_STDERR,
-				      ISC_LOG_PRINTTIME | named_g_logflags);
 	} else {
 		isc_log_setdebuglevel(named_g_debuglevel);
 	}
@@ -239,8 +239,6 @@ channel_fromconf(const cfg_obj_t *channel, isc_logconfig_t *logconfig) {
 				flags |= ISC_LOG_ISO8601;
 			} else if (strcasecmp(s, "iso8601-utc") == 0) {
 				flags |= ISC_LOG_ISO8601 | ISC_LOG_UTC;
-			} else if (strcasecmp(s, "iso8601-tzinfo") == 0) {
-				flags |= ISC_LOG_ISO8601 | ISC_LOG_TZINFO;
 			}
 		}
 	}
@@ -27,7 +27,6 @@
 #include <isc/attributes.h>
 #include <isc/backtrace.h>
 #include <isc/commandline.h>
-#include <isc/crypto.h>
 #include <isc/dir.h>
 #include <isc/file.h>
 #include <isc/fips.h>
@@ -890,8 +889,6 @@ parse_command_line(int argc, char *argv[]) {
 		case 'g':
 			named_g_foreground = true;
 			named_g_logstderr = true;
-			named_g_logflags = ISC_LOG_PRINTTIME | ISC_LOG_ISO8601 |
-					   ISC_LOG_TZINFO;
 			break;
 		case 'L':
 			named_g_logfile = isc_commandline_argument;
@@ -1566,7 +1563,7 @@ main(int argc, char *argv[]) {
 	isc_managers_destroy(&named_g_mctx, &named_g_loopmgr, &named_g_netmgr);

 #if ENABLE_LEAK_DETECTION
-	isc__crypto_setdestroycheck(true);
+	isc__tls_setdestroycheck(true);
 	isc__uv_setdestroycheck(true);
 	isc__xml_setdestroycheck(true);
 #endif
@@ -70,6 +70,7 @@
 #include <dns/dispatch.h>
 #include <dns/dlz.h>
 #include <dns/dns64.h>
+#include <dns/dnsrps.h>
 #include <dns/dnssec.h>
 #include <dns/dyndb.h>
 #include <dns/fixedname.h>
@@ -1982,6 +1983,239 @@ cleanup:
 	return (result);
 }

+#ifdef USE_DNSRPS
+typedef struct conf_dnsrps_ctx conf_dnsrps_ctx_t;
+struct conf_dnsrps_ctx {
+	isc_result_t result;
+	char *cstr;
+	size_t cstr_size;
+	isc_mem_t *mctx;
+};
+
+/*
+ * Add to the DNSRPS configuration string.
+ */
+static bool
+conf_dnsrps_sadd(conf_dnsrps_ctx_t *ctx, const char *p, ...) {
+	size_t new_len, cur_len, new_cstr_size;
+	char *new_cstr;
+	va_list args;
+
+	if (ctx->cstr == NULL) {
+		ctx->cstr = isc_mem_get(ctx->mctx, 256);
+		ctx->cstr[0] = '\0';
+		ctx->cstr_size = 256;
+	}
+
+	cur_len = strlen(ctx->cstr);
+	va_start(args, p);
+	new_len = vsnprintf(ctx->cstr + cur_len, ctx->cstr_size - cur_len, p,
+			    args) +
+		  1;
+	va_end(args);
+
+	if (cur_len + new_len <= ctx->cstr_size) {
+		return (true);
+	}
+
+	new_cstr_size = ((cur_len + new_len) / 256 + 1) * 256;
+	new_cstr = isc_mem_get(ctx->mctx, new_cstr_size);
+
+	memmove(new_cstr, ctx->cstr, cur_len);
+	isc_mem_put(ctx->mctx, ctx->cstr, ctx->cstr_size);
+	ctx->cstr_size = new_cstr_size;
+	ctx->cstr = new_cstr;
+
+	/* cannot use args twice after a single va_start()on some systems */
+	va_start(args, p);
+	vsnprintf(ctx->cstr + cur_len, ctx->cstr_size - cur_len, p, args);
+	va_end(args);
+	return (true);
+}
+
+/*
+ * Get a DNSRPS configuration value using the global and view options
+ * for the default.  Return false upon failure.
+ */
+static bool
+conf_dnsrps_get(const cfg_obj_t **sub_obj, const cfg_obj_t **maps,
+		const cfg_obj_t *obj, const char *name,
+		conf_dnsrps_ctx_t *ctx) {
+	if (ctx != NULL && ctx->result != ISC_R_SUCCESS) {
+		*sub_obj = NULL;
+		return (false);
+	}
+
+	*sub_obj = cfg_tuple_get(obj, name);
+	if (cfg_obj_isvoid(*sub_obj)) {
+		*sub_obj = NULL;
+		if (maps != NULL &&
+		    ISC_R_SUCCESS != named_config_get(maps, name, sub_obj))
+		{
+			*sub_obj = NULL;
+		}
+	}
+	return (true);
+}
+
+/*
+ * Handle a DNSRPS boolean configuration value with the global and view
+ * options providing the default.
+ */
+static void
+conf_dnsrps_yes_no(const cfg_obj_t *obj, const char *name,
+		   conf_dnsrps_ctx_t *ctx) {
+	const cfg_obj_t *sub_obj;
+
+	if (!conf_dnsrps_get(&sub_obj, NULL, obj, name, ctx)) {
+		return;
+	}
+	if (sub_obj == NULL) {
+		return;
+	}
+	if (ctx == NULL) {
+		cfg_obj_log(obj, ISC_LOG_ERROR,
+			    "\"%s\" without \"dnsrps-enable yes\"", name);
+		return;
+	}
+
+	conf_dnsrps_sadd(ctx, " %s %s", name,
+			 cfg_obj_asboolean(sub_obj) ? "yes" : "no");
+}
+
+static void
+conf_dnsrps_num(const cfg_obj_t *obj, const char *name,
+		conf_dnsrps_ctx_t *ctx) {
+	const cfg_obj_t *sub_obj;
+
+	if (!conf_dnsrps_get(&sub_obj, NULL, obj, name, ctx)) {
+		return;
+	}
+	if (sub_obj == NULL) {
+		return;
+	}
+	if (ctx == NULL) {
+		cfg_obj_log(obj, ISC_LOG_ERROR,
+			    "\"%s\" without \"dnsrps-enable yes\"", name);
+		return;
+	}
+
+	if (cfg_obj_isduration(sub_obj)) {
+		conf_dnsrps_sadd(ctx, " %s %d", name,
+				 cfg_obj_asduration(sub_obj));
+	} else {
+		conf_dnsrps_sadd(ctx, " %s %d", name,
+				 cfg_obj_asuint32(sub_obj));
+	}
+}
+
+/*
+ * Convert the parsed RPZ configuration statement to a string for
+ * dns_rpz_new_zones().
+ */
+static isc_result_t
+conf_dnsrps(dns_view_t *view, const cfg_obj_t **maps, bool nsip_enabled,
+	    bool nsdname_enabled, dns_rpz_zbits_t *nsip_on,
+	    dns_rpz_zbits_t *nsdname_on, char **rps_cstr, size_t *rps_cstr_size,
+	    const cfg_obj_t *rpz_obj, const cfg_listelt_t *zone_element) {
+	conf_dnsrps_ctx_t ctx;
+	const cfg_obj_t *zone_obj, *obj;
+	dns_rpz_num_t rpz_num;
+	bool on;
+	const char *s;
+
+	memset(&ctx, 0, sizeof(ctx));
+	ctx.result = ISC_R_SUCCESS;
+	ctx.mctx = view->mctx;
+
+	for (rpz_num = 0; zone_element != NULL && ctx.result == ISC_R_SUCCESS;
+	     ++rpz_num)
+	{
+		zone_obj = cfg_listelt_value(zone_element);
+
+		s = cfg_obj_asstring(cfg_tuple_get(zone_obj, "zone name"));
+		conf_dnsrps_sadd(&ctx, "zone \"%s\"", s);
+
+		obj = cfg_tuple_get(zone_obj, "policy");
+		if (!cfg_obj_isvoid(obj)) {
+			s = cfg_obj_asstring(cfg_tuple_get(obj, "policy name"));
+			conf_dnsrps_sadd(&ctx, " policy %s", s);
+			if (strcasecmp(s, "cname") == 0) {
+				s = cfg_obj_asstring(
+					cfg_tuple_get(obj, "cname"));
+				conf_dnsrps_sadd(&ctx, " %s", s);
+			}
+		}
+
+		conf_dnsrps_yes_no(zone_obj, "recursive-only", &ctx);
+		conf_dnsrps_yes_no(zone_obj, "log", &ctx);
+		conf_dnsrps_num(zone_obj, "max-policy-ttl", &ctx);
+		obj = cfg_tuple_get(rpz_obj, "nsip-enable");
+		if (!cfg_obj_isvoid(obj)) {
+			if (cfg_obj_asboolean(obj)) {
+				*nsip_on |= DNS_RPZ_ZBIT(rpz_num);
+			} else {
+				*nsip_on &= ~DNS_RPZ_ZBIT(rpz_num);
+			}
+		}
+		on = ((*nsip_on & DNS_RPZ_ZBIT(rpz_num)) != 0);
+		if (nsip_enabled != on) {
+			conf_dnsrps_sadd(&ctx, on ? " nsip-enable yes "
+						  : " nsip-enable no ");
+		}
+		obj = cfg_tuple_get(rpz_obj, "nsdname-enable");
+		if (!cfg_obj_isvoid(obj)) {
+			if (cfg_obj_asboolean(obj)) {
+				*nsdname_on |= DNS_RPZ_ZBIT(rpz_num);
+			} else {
+				*nsdname_on &= ~DNS_RPZ_ZBIT(rpz_num);
+			}
+		}
+		on = ((*nsdname_on & DNS_RPZ_ZBIT(rpz_num)) != 0);
+		if (nsdname_enabled != on) {
+			conf_dnsrps_sadd(&ctx, on ? " nsdname-enable yes "
+						  : " nsdname-enable no ");
+		}
+		conf_dnsrps_sadd(&ctx, ";\n");
+		zone_element = cfg_list_next(zone_element);
+	}
+
+	conf_dnsrps_yes_no(rpz_obj, "recursive-only", &ctx);
+	conf_dnsrps_num(rpz_obj, "max-policy-ttl", &ctx);
+	conf_dnsrps_num(rpz_obj, "min-ns-dots", &ctx);
+	conf_dnsrps_yes_no(rpz_obj, "qname-wait-recurse", &ctx);
+	conf_dnsrps_yes_no(rpz_obj, "break-dnssec", &ctx);
+	if (!nsip_enabled) {
+		conf_dnsrps_sadd(&ctx, " nsip-enable no ");
+	}
+	if (!nsdname_enabled) {
+		conf_dnsrps_sadd(&ctx, " nsdname-enable no ");
+	}
+
+	/*
+	 * Get the general dnsrpzd parameters from the response-policy
+	 * statement in the view and the general options.
+	 */
+	if (conf_dnsrps_get(&obj, maps, rpz_obj, "dnsrps-options", &ctx) &&
+	    obj != NULL)
+	{
+		conf_dnsrps_sadd(&ctx, " %s\n", cfg_obj_asstring(obj));
+	}
+
+	if (ctx.result == ISC_R_SUCCESS) {
+		*rps_cstr = ctx.cstr;
+		*rps_cstr_size = ctx.cstr_size;
+	} else {
+		if (ctx.cstr != NULL) {
+			isc_mem_put(ctx.mctx, ctx.cstr, ctx.cstr_size);
+		}
+		*rps_cstr = NULL;
+		*rps_cstr_size = 0;
+	}
+	return (ctx.result);
+}
+#endif /* ifdef USE_DNSRPS */
+
 static isc_result_t
 configure_rpz_name(dns_view_t *view, const cfg_obj_t *obj, dns_name_t *name,
 		   const char *str, const char *msg) {
@@ -2087,14 +2321,18 @@ configure_rpz_zone(dns_view_t *view, const cfg_listelt_t *element,
 			    "invalid zone name '%s'", str);
 		return (DNS_R_EMPTYLABEL);
 	}
-	for (rpz_num = 0; rpz_num < view->rpzs->p.num_zones - 1; ++rpz_num) {
-		if (dns_name_equal(&view->rpzs->zones[rpz_num]->origin,
-				   &zone->origin))
+	if (!view->rpzs->p.dnsrps_enabled) {
+		for (rpz_num = 0; rpz_num < view->rpzs->p.num_zones - 1;
+		     ++rpz_num)
 		{
-			cfg_obj_log(rpz_obj, DNS_RPZ_ERROR_LEVEL,
-				    "duplicate '%s'", str);
-			result = DNS_R_DUPLICATE;
-			return (result);
+			if (dns_name_equal(&view->rpzs->zones[rpz_num]->origin,
+					   &zone->origin))
+			{
+				cfg_obj_log(rpz_obj, DNS_RPZ_ERROR_LEVEL,
+					    "duplicate '%s'", str);
+				result = DNS_R_DUPLICATE;
+				return (result);
+			}
 		}
 	}
 	if (*old_rpz_okp && !dns_name_equal(&old->origin, &zone->origin)) {
@@ -2191,9 +2429,12 @@ configure_rpz_zone(dns_view_t *view, const cfg_listelt_t *element,
 }

 static isc_result_t
-configure_rpz(dns_view_t *view, dns_view_t *pview, const cfg_obj_t *rpz_obj,
-	      bool *old_rpz_okp) {
+configure_rpz(dns_view_t *view, dns_view_t *pview, const cfg_obj_t **maps,
+	      const cfg_obj_t *rpz_obj, bool *old_rpz_okp) {
+	bool dnsrps_enabled;
 	const cfg_listelt_t *zone_element;
+	char *rps_cstr;
+	size_t rps_cstr_size;
 	const cfg_obj_t *sub_obj;
 	bool recursive_only_default, add_soa_default;
 	bool nsip_enabled, nsdname_enabled;
@@ -2228,7 +2469,53 @@ configure_rpz(dns_view_t *view, dns_view_t *pview, const cfg_obj_t *rpz_obj,
 	}
 	nsdname_on = nsdname_enabled ? DNS_RPZ_ALL_ZBITS : 0;

-	result = dns_rpz_new_zones(view, named_g_loopmgr, &view->rpzs);
+	/*
+	 * "dnsrps-enable yes|no" can be either a global or response-policy
+	 * clause.
+	 */
+	dnsrps_enabled = false;
+	rps_cstr = NULL;
+	rps_cstr_size = 0;
+	sub_obj = NULL;
+	(void)named_config_get(maps, "dnsrps-enable", &sub_obj);
+	if (sub_obj != NULL) {
+		dnsrps_enabled = cfg_obj_asboolean(sub_obj);
+	}
+	sub_obj = cfg_tuple_get(rpz_obj, "dnsrps-enable");
+	if (!cfg_obj_isvoid(sub_obj)) {
+		dnsrps_enabled = cfg_obj_asboolean(sub_obj);
+	}
+#ifndef USE_DNSRPS
+	if (dnsrps_enabled) {
+		cfg_obj_log(rpz_obj, DNS_RPZ_ERROR_LEVEL,
+			    "\"dnsrps-enable yes\" but"
+			    " without `./configure --enable-dnsrps`");
+		return (ISC_R_FAILURE);
+	}
+#else  /* ifndef USE_DNSRPS */
+	if (dnsrps_enabled) {
+		if (librpz == NULL) {
+			cfg_obj_log(rpz_obj, DNS_RPZ_ERROR_LEVEL,
+				    "\"dnsrps-enable yes\" but %s",
+				    librpz_lib_open_emsg.c);
+			return (ISC_R_FAILURE);
+		}
+
+		/*
+		 * Generate the DNS Response Policy Service
+		 * configuration string.
+		 */
+		result = conf_dnsrps(view, maps, nsip_enabled, nsdname_enabled,
+				     &nsip_on, &nsdname_on, &rps_cstr,
+				     &rps_cstr_size, rpz_obj, zone_element);
+		if (result != ISC_R_SUCCESS) {
+			return (result);
+		}
+	}
+#endif /* ifndef USE_DNSRPS */
+
+	result = dns_rpz_new_zones(view, named_g_loopmgr, rps_cstr,
+				   rps_cstr_size, &view->rpzs);
 	if (result != ISC_R_SUCCESS) {
 		return (result);
 	}
@@ -2347,8 +2634,20 @@ configure_rpz(dns_view_t *view, dns_view_t *pview, const cfg_obj_t *rpz_obj,
 	 * zones are unchanged, then use the same policy data.
 	 * Data for individual zones that must be reloaded will be merged.
 	 */
-	if (old != NULL && memcmp(&old->p, &zones->p, sizeof(zones->p)) != 0) {
-		*old_rpz_okp = false;
+	if (*old_rpz_okp) {
+		if (old != NULL &&
+		    memcmp(&old->p, &zones->p, sizeof(zones->p)) != 0)
+		{
+			*old_rpz_okp = false;
+		} else if ((old == NULL || old->rps_cstr == NULL) !=
+			   (zones->rps_cstr == NULL))
+		{
+			*old_rpz_okp = false;
+		} else if (old != NULL && zones->rps_cstr != NULL &&
+			   strcmp(old->rps_cstr, zones->rps_cstr) != 0)
+		{
+			*old_rpz_okp = false;
+		}
 	}

 	if (*old_rpz_okp) {
@@ -3913,7 +4212,7 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist, cfg_obj_t *config,
 	if (view->rdclass == dns_rdataclass_in && need_hints &&
 	    named_config_get(maps, "response-policy", &obj) == ISC_R_SUCCESS)
 	{
-		CHECK(configure_rpz(view, NULL, obj, &old_rpz_ok));
+		CHECK(configure_rpz(view, NULL, maps, obj, &old_rpz_ok));
 		rpz_configured = true;
 	}

@@ -3962,7 +4261,7 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist, cfg_obj_t *config,
 	 * zone named in the response policy statement, unless we are
 	 * using RPZ service interface.
 	 */
-	if (view->rpzs != NULL) {
+	if (view->rpzs != NULL && !view->rpzs->p.dnsrps_enabled) {
 		dns_rpz_num_t n;

 		for (n = 0; n < view->rpzs->p.num_zones; ++n) {
@@ -5789,7 +6088,7 @@ cleanup:
 				 * because we are reverting the same operation
 				 * done previously in the "correct" order.
 				 */
-				result2 = configure_rpz(pview, view, obj,
+				result2 = configure_rpz(pview, view, maps, obj,
 							&old_rpz_ok);
 				if (result2 != ISC_R_SUCCESS) {
 					isc_log_write(NAMED_LOGCATEGORY_GENERAL,
@@ -6504,7 +6803,9 @@ configure_zone(const cfg_obj_t *config, const cfg_obj_t *zconfig,
 	 * BIND zone database has nothing to do with rpz and so we don't care.
 	 */
 	for (rpz_num = 0;; ++rpz_num) {
-		if (view->rpzs == NULL || rpz_num >= view->rpzs->p.num_zones) {
+		if (view->rpzs == NULL || rpz_num >= view->rpzs->p.num_zones ||
+		    view->rpzs->p.dnsrps_enabled)
+		{
 			rpz_num = DNS_RPZ_INVALID_NUM;
 			break;
 		}
@@ -8769,6 +9070,35 @@ load_configuration(const char *filename, named_server_t *server,
 	server->kasplist = kasplist;
 	kasplist = tmpkasplist;

+#ifdef USE_DNSRPS
+	/*
+	 * Find the path to the DNSRPS implementation library.
+	 */
+	obj = NULL;
+	if (named_config_get(maps, "dnsrps-library", &obj) == ISC_R_SUCCESS) {
+		if (server->dnsrpslib != NULL) {
+			dns_dnsrps_server_destroy();
+			isc_mem_free(server->mctx, server->dnsrpslib);
+			server->dnsrpslib = NULL;
+		}
+		setstring(server, &server->dnsrpslib, cfg_obj_asstring(obj));
+		result = dns_dnsrps_server_create(server->dnsrpslib);
+		isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_SERVER,
+			      ISC_LOG_DEBUG(1),
+			      "initializing DNSRPS RPZ provider '%s': %s",
+			      server->dnsrpslib, isc_result_totext(result));
+		/*
+		 * It's okay if librpz isn't available. We'll complain
+		 * later if it turns out to be needed for a view with
+		 * "dnsrps-enable yes".
+		 */
+		if (result == ISC_R_FILENOTFOUND) {
+			result = ISC_R_SUCCESS;
+		}
+		CHECKFATAL(result, "initializing RPZ service interface");
+	}
+#endif /* ifdef USE_DNSRPS */
+
 	/*
 	 * Configure the views.
 	 */
@@ -9119,13 +9449,6 @@ load_configuration(const char *filename, named_server_t *server,
 				}
 			}
 		}
-		obj = NULL;
-		result = named_config_get(maps, "responselog", &obj);
-		if (result == ISC_R_SUCCESS) {
-			ns_server_setoption(server->sctx,
-					    NS_SERVER_LOGRESPONSES,
-					    cfg_obj_asboolean(obj));
-		}
 	}

 	obj = NULL;
@@ -9301,6 +9624,22 @@ load_configuration(const char *filename, named_server_t *server,

 	(void)named_server_loadnta(server);

+#ifdef USE_DNSRPS
+	/*
+	 * Start and connect to the DNS Response Policy Service
+	 * daemon, dnsrpzd, for each view that uses DNSRPS.
+	 */
+	for (dns_view_t *view = ISC_LIST_HEAD(server->viewlist); view != NULL;
+	     view = ISC_LIST_NEXT(view, link))
+	{
+		result = dns_dnsrps_connect(view->rpzs);
+		if (result != ISC_R_SUCCESS) {
+			view = NULL;
+			goto cleanup_altsecrets;
+		}
+	}
+#endif /* ifdef USE_DNSRPS */
+
 	/*
 	 * Record the time of most recent configuration
 	 */
@@ -9730,6 +10069,10 @@ shutdown_server(void *arg) {

 	dns_zonemgr_shutdown(server->zonemgr);

+	if (named_g_sessionkey != NULL) {
+		dns_tsigkey_detach(&named_g_sessionkey);
+		dns_name_free(&named_g_sessionkeyname, server->mctx);
+	}
 #if defined(HAVE_GEOIP2)
 	named_geoip_shutdown();
 #endif /* HAVE_GEOIP2 */
@@ -10054,6 +10397,11 @@ named_server_destroy(named_server_t **serverp) {
 	}
 #endif /* HAVE_DNSTAP */

+#ifdef USE_DNSRPS
+	dns_dnsrps_server_destroy();
+	isc_mem_free(server->mctx, server->dnsrpslib);
+#endif /* ifdef USE_DNSRPS */
+
 	named_controls_destroy(&server->controls);

 	isc_stats_detach(&server->zonestats);
@@ -10669,10 +11017,9 @@ named_server_refreshcommand(named_server_t *server, isc_lex_t *lex,
 }

 isc_result_t
-named_server_setortoggle(named_server_t *server, const char *optname,
-			 unsigned int option, isc_lex_t *lex) {
+named_server_togglequerylog(named_server_t *server, isc_lex_t *lex) {
 	bool prev, value;
-	char *ptr = NULL;
+	char *ptr;

 	/* Skip the command name. */
 	ptr = next_token(lex, NULL);
@@ -10680,7 +11027,7 @@ named_server_setortoggle(named_server_t *server, const char *optname,
 		return (ISC_R_UNEXPECTEDEND);
 	}

-	prev = ns_server_getoption(server->sctx, option);
+	prev = ns_server_getoption(server->sctx, NS_SERVER_LOGQUERIES);

 	ptr = next_token(lex, NULL);
 	if (ptr == NULL) {
@@ -10701,10 +11048,10 @@ named_server_setortoggle(named_server_t *server, const char *optname,
 		return (ISC_R_SUCCESS);
 	}

-	ns_server_setoption(server->sctx, option, value);
+	ns_server_setoption(server->sctx, NS_SERVER_LOGQUERIES, value);

 	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_SERVER,
-		      ISC_LOG_INFO, "%s is now %s", optname,
+		      ISC_LOG_INFO, "query logging is now %s",
 		      value ? "on" : "off");
 	return (ISC_R_SUCCESS);
 }
@@ -12091,12 +12438,6 @@ named_server_status(named_server_t *server, isc_buffer_t **text) {
 			 : "OFF");
 	CHECK(putstr(text, line));

-	snprintf(line, sizeof(line), "response logging is %s\n",
-		 ns_server_getoption(server->sctx, NS_SERVER_LOGRESPONSES)
-			 ? "ON"
-			 : "OFF");
-	CHECK(putstr(text, line));
-
 	snprintf(line, sizeof(line), "recursive clients: %u/%u/%u\n",
 		 isc_quota_getused(&server->sctx->recursionquota),
 		 isc_quota_getsoft(&server->sctx->recursionquota),
@@ -203,11 +203,6 @@ configure_zone_ssutable(const cfg_obj_t *zconfig, dns_zone_t *zone,
 	isc_mem_t *mctx = dns_zone_getmctx(zone);
 	bool autoddns = false;
 	isc_result_t result = ISC_R_SUCCESS;
-	char debug[1024];
-	isc_buffer_t dbuf;
-
-	isc_buffer_init(&dbuf, debug, sizeof(debug));
-	isc_buffer_setmctx(&dbuf, mctx);

 	(void)cfg_map_get(zconfig, "update-policy", &updatepolicy);

@@ -242,9 +237,7 @@ configure_zone_ssutable(const cfg_obj_t *zconfig, dns_zone_t *zone,
 		isc_buffer_t b;
 		dns_ssuruletype_t *types;
 		unsigned int i, n;
-		char namebuf[DNS_NAME_FORMATSIZE];

-		isc_buffer_clear(&dbuf);
 		str = cfg_obj_asstring(mode);
 		if (strcasecmp(str, "grant") == 0) {
 			grant = true;
@@ -253,7 +246,14 @@ configure_zone_ssutable(const cfg_obj_t *zconfig, dns_zone_t *zone,
 		} else {
 			UNREACHABLE();
 		}
-		isc_buffer_putstr(&dbuf, str);
+
+		str = cfg_obj_asstring(matchtype);
+		CHECK(dns_ssu_mtypefromstring(str, &mtype));
+		if (mtype == dns_ssumatchtype_subdomain &&
+		    strcasecmp(str, "zonesub") == 0)
+		{
+			usezone = true;
+		}

 		dns_fixedname_init(&fident);
 		str = cfg_obj_asstring(identity);
@@ -266,20 +266,6 @@ configure_zone_ssutable(const cfg_obj_t *zconfig, dns_zone_t *zone,
 				    "'%s' is not a valid name", str);
 			goto cleanup;
 		}
-		dns_name_format(dns_fixedname_name(&fident), namebuf,
-				sizeof(namebuf));
-		isc_buffer_putstr(&dbuf, " ");
-		isc_buffer_putstr(&dbuf, namebuf);
-
-		str = cfg_obj_asstring(matchtype);
-		CHECK(dns_ssu_mtypefromstring(str, &mtype));
-		if (mtype == dns_ssumatchtype_subdomain &&
-		    strcasecmp(str, "zonesub") == 0)
-		{
-			usezone = true;
-		}
-		isc_buffer_putstr(&dbuf, " ");
-		isc_buffer_putstr(&dbuf, str);

 		dns_fixedname_init(&fname);
 		if (usezone) {
@@ -296,10 +282,6 @@ configure_zone_ssutable(const cfg_obj_t *zconfig, dns_zone_t *zone,
 					    "'%s' is not a valid name", str);
 				goto cleanup;
 			}
-			dns_name_format(dns_fixedname_name(&fname), namebuf,
-					sizeof(namebuf));
-			isc_buffer_putstr(&dbuf, " ");
-			isc_buffer_putstr(&dbuf, namebuf);
 		}

 		n = named_config_listcount(typelist);
@@ -323,8 +305,6 @@ configure_zone_ssutable(const cfg_obj_t *zconfig, dns_zone_t *zone,
 			typeobj = cfg_listelt_value(element2);
 			str = cfg_obj_asstring(typeobj);
 			r.base = UNCONST(str);
-			isc_buffer_putstr(&dbuf, " ");
-			isc_buffer_putstr(&dbuf, str);

 			bracket = strchr(str, '(' /*)*/);
 			if (bracket != NULL) {
@@ -357,10 +337,9 @@ configure_zone_ssutable(const cfg_obj_t *zconfig, dns_zone_t *zone,
 		}
 		INSIST(i == n);

-		isc_buffer_putuint8(&dbuf, '\0');
 		dns_ssutable_addrule(table, grant, dns_fixedname_name(&fident),
 				     mtype, dns_fixedname_name(&fname), n,
-				     types, isc_buffer_base(&dbuf));
+				     types);
 		if (types != NULL) {
 			isc_mem_cput(mctx, types, n, sizeof(*types));
 		}
@@ -384,16 +363,15 @@ configure_zone_ssutable(const cfg_obj_t *zconfig, dns_zone_t *zone,
 			goto cleanup;
 		}

-		dns_ssutable_addrule(
-			table, true, named_g_server->session_keyname,
-			dns_ssumatchtype_local, dns_zone_getorigin(zone), 1,
-			&any, "local");
+		dns_ssutable_addrule(table, true,
+				     named_g_server->session_keyname,
+				     dns_ssumatchtype_local,
+				     dns_zone_getorigin(zone), 1, &any);
 	}

 	dns_zone_setssutable(zone, table);

 cleanup:
-	isc_buffer_clearmctx(&dbuf);
 	dns_ssutable_detach(&table);
 	return (result);
 }
@@ -1208,8 +1186,6 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 	if (ztype != dns_zone_stub && ztype != dns_zone_staticstub &&
 	    ztype != dns_zone_redirect)
 	{
-		bool logreports = false;
-
 		/* Make a reference to the default policy. */
 		result = dns_kasplist_find(kasplist, "default", &kasp);
 		INSIST(result == ISC_R_SUCCESS && kasp != NULL);
@@ -1483,51 +1459,6 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 		INSIST(result == ISC_R_SUCCESS && obj != NULL);
 		dns_zone_setoption(zone, DNS_ZONEOPT_NSEC3TESTZONE,
 				   cfg_obj_asboolean(obj));
-
-		obj = NULL;
-		result = cfg_map_get(zoptions, "log-report-channel", &obj);
-		if (result == ISC_R_SUCCESS) {
-			logreports = cfg_obj_asboolean(obj);
-			dns_zone_setoption(zone, DNS_ZONEOPT_LOGREPORTS,
-					   logreports);
-		}
-		obj = NULL;
-		result = named_config_get(maps, "send-report-channel", &obj);
-		if (result == ISC_R_SUCCESS && obj != NULL) {
-			dns_fixedname_t fixed;
-			dns_name_t *rad = dns_fixedname_initname(&fixed);
-			const char *adstr = cfg_obj_asstring(obj);
-			dns_name_t *zn = dns_zone_getorigin(zone);
-
-			CHECK(dns_name_fromstring(rad, adstr, dns_rootname, 0,
-						  mctx));
-			if (logreports || dns_name_equal(rad, dns_rootname)) {
-				/* Disable RC for error-logging zones or root */
-				dns_zone_setrad(zone, NULL);
-			} else if (dns_name_equal(rad, zn)) {
-				/*
-				 * It's illegal to set a matching agent
-				 * domain at the zone level, but it could
-				 * be set in options/view. If so, and the
-				 * matching zone doesn't log reports, warn.
-				 */
-				cfg_obj_log(obj, ISC_LOG_WARNING,
-					    "send-report-channel is set to "
-					    "'%s' but that zone does not have "
-					    "log-report-channel set",
-					    zname);
-				dns_zone_setrad(zone, NULL);
-			} else if (dns_name_issubdomain(rad, zn)) {
-				cfg_obj_log(obj, ISC_LOG_WARNING,
-					    "send-report-channel '%s' ignored "
-					    "for zone '%s' because it is a "
-					    "subdomain of the zone",
-					    adstr, zname);
-				dns_zone_setrad(zone, NULL);
-			} else {
-				dns_zone_setrad(zone, rad);
-			}
-		}
 	} else if (ztype == dns_zone_redirect) {
 		dns_zone_setnotifytype(zone, dns_notifytype_no);

@@ -429,10 +429,8 @@ Currently supported commands are:

   The first list includes all unique clients that are waiting for
   recursion to complete, including the query that is awaiting a
-   response, the timestamp (seconds since the Unix epoch) of
-   when named started processing this client query, the client's
-   address, and the transport over which the the query was received
-   (UDP, TCP, TLS, or HTTP).
+   response and the timestamp (seconds since the Unix epoch) of
+   when named started processing this client query.

   The second list comprises of domains for which there are active
   (or recently active) fetches in progress.  It reports the number
@@ -460,17 +458,6 @@ Currently supported commands are:

 .. program:: rndc

-.. option:: responselog [on | off]
-
-   This command enables or disables response logging. For backward compatibility,
-   this command can also be used without an argument to toggle response logging
-   on and off.
-
-   Unlike query logging, response logging cannot be enabled by explicitly directing
-   the ``responses`` ``category`` to a ``channel`` in the ``logging`` section
-   of :iscman:`named.conf`, but it can still be enabled by specifying
-   ``responselog yes;`` in the ``options`` section of :iscman:`named.conf`.
-
 .. option:: retransfer [-force] zone [class [view]]

   This command retransfers the given secondary zone from the primary server.
@@ -16,7 +16,6 @@ named.run
 /*.trs
 /*.xml
 /resolve
-/legacy.run.sh
 /run.log
 /start.sh
 /stop.sh
@@ -11,6 +11,10 @@ dist-hook:

 SUBDIRS = dyndb/driver dlzexternal/driver hooks/driver

+if DNSRPS
+SUBDIRS += rpz/testlib
+endif
+
 AM_CPPFLAGS +=			\
 	$(LIBISC_CFLAGS) 	\
 	$(LIBDNS_CFLAGS)
@@ -27,7 +31,8 @@ noinst_PROGRAMS =		\
 	feature-test		\
 	makejournal		\
 	pipelined/pipequeries	\
-	rndc/gencheck
+	rndc/gencheck		\
+	rpz/dnsrps

 feature_test_CPPFLAGS =		\
 	$(AM_CPPFLAGS)		\
@@ -55,6 +60,16 @@ pipelined_pipequeries_LDADD =	\
 	$(LDADD)		\
 	$(LIBDNS_LIBS)

+rpz_dnsrps_CPPFLAGS =		\
+	$(AM_CPPFLAGS)		\
+	$(LIBDNS_CFLAGS)	\
+	-DLIBRPZ_LIB_OPEN=\"$(abs_builddir)/rpz/testlib/.libs/libdummyrpz.so\"
+
+rpz_dnsrps_LDADD =		\
+	$(LDADD)		\
+	$(LIBDNS_LIBS)		\
+	$(DLOPEN_LIBS)
+
 # Longer running tests are listed (and executed) first to take the most
 # advantage of parallel execution.
 TESTS =				\
@@ -51,7 +51,6 @@ To run system tests, make sure you have the following dependencies installed:
 - perl
 - dnspython
 - pytest-xdist (for parallel execution)
- python-jinja2 (for tests which use jinja templates)

 Individual system tests might also require additional dependencies. If those
 are missing, the affected tests will be skipped and should produce a message
@@ -155,17 +154,9 @@ system test directories may contain the following standard files:
 - `tests_*.py`: These python files are picked up by pytest as modules. If they
  contain any test functions, they're added to the test suite.

- `*.j2`: These jinja2 templates can be used for configuration files or any
-  other files which require certain variables filled in, e.g. ports from the
-  environment variables. During test setup, the pytest runner will automatically
-  fill those in and strip the filename extension .j2, e.g. `ns1/named.conf.j2`
-  becomes `ns1/named.conf`. When using advanced templating to conditionally
-  include/omit entire sections or when filling in custom variables used for the
-  test, ensure the templates always include the defaults. If you don't need the
-  file to be auto-templated during test setup, use `.j2.manual` instead and then
-  no defaults are needed.
-
- `setup.sh`: This sets up the preconditions for the tests.
+- `setup.sh`: This sets up the preconditions for the tests. Although optional,
+  virtually all tests will require such a file to set up the ports they should
+  use for the test.

 - `tests.sh`: Any shell-based tests are located within this file. Runs the
  actual tests.
@@ -19,9 +19,3 @@ key rndc_key {
 	algorithm       hmac-sha256;
 	secret          "1234abcd8765";
 };
-
-/* Regresssion test for [GL #4991] */
-server example.com {
-	key rndc-key;
-	addresses { localhost; 127.0.0.1; ::1; };
-};
@@ -11,11 +11,10 @@
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.

-rm -f */named.conf
 rm -f */named.memstats
 rm -f */named.run
-rm -f */named.run.prev
+rm -f */named.conf
 rm -f dig.out.test*
-rm -f ns*/managed-keys.bind* ns*/*mkeys*
 rm -f ns2/example.com.bk
 rm -f ns2/example.net.bk
+rm -f ns*/managed-keys.bind* ns*/*mkeys*
@@ -1,23 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; SPDX-License-Identifier: MPL-2.0
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0.  If a copy of the MPL was not distributed with this
-; file, you can obtain one at https://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 300        ; 5 minutes
-@                       IN SOA  ns root (
-				2018010100 ; serial
-				1800       ; refresh (30 minutes)
-				1800       ; retry (30 minutes)
-				1814400    ; expire (3 weeks)
-				3600       ; minimum (1 hour)
-				)
-			NS      ns
-ns                      A       10.53.0.1
-server			A	10.53.0.100
-*._er                   TXT     "Report received"
@@ -22,7 +22,6 @@ options {
 	recursion no;
 	notify yes;
 	dnssec-validation no;
-	send-report-channel "example.rad";
 };

 view main in {
@@ -36,18 +35,6 @@ view main in {
 	zone example.com {
 		type primary;
 		file "example.com.db";
-		send-report-channel "rad.example.net";
-	};
-
-	zone rad {
-		type primary;
-		file "rad.db";
-	};
-
-	zone example.rad {
-		type primary;
-		file "example.rad.db";
-		log-report-channel yes;
 	};
 };

@@ -1,24 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; SPDX-License-Identifier: MPL-2.0
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0.  If a copy of the MPL was not distributed with this
-; file, you can obtain one at https://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 300        ; 5 minutes
-@                       IN SOA  ns root (
-				2018010100 ; serial
-				1800       ; refresh (30 minutes)
-				1800       ; retry (30 minutes)
-				1814400    ; expire (3 weeks)
-				3600       ; minimum (1 hour)
-				)
-			NS      ns
-ns                      A       10.53.0.1
-server			A	10.53.0.100
-
-example			NS	ns
@@ -186,57 +186,5 @@ lines=$(wc -l <dig.out.test$n)
 [ $ret -eq 0 ] || echo_i "failed"
 status=$((status + ret))

-n=$((n + 1))
-echo_i "check that a Report-Channel EDNS option is added to responses ($n)"
-ret=0
-$DIG $DIGOPTS @10.53.0.1 example.net >dig.out.test$n
-grep "; Report-Channel: \"example.rad\"" dig.out.test$n >/dev/null || ret=1
-[ $ret -eq 0 ] || echo_i "failed"
-status=$((status + ret))
-
-n=$((n + 1))
-echo_i "check that Report-Channel option is omitted for names in error-logging zones ($n)"
-ret=0
-$DIG $DIGOPTS @10.53.0.1 example.rad >dig.out.test$n
-grep "; Report-Channel: \"example.rad\"" dig.out.test$n >/dev/null && ret=1
-[ $ret -eq 0 ] || echo_i "failed"
-status=$((status + ret))
-
-n=$((n + 1))
-echo_i "check that Report-Channel option is omitted for zones above the agent-domain ($n)"
-ret=0
-$DIG $DIGOPTS @10.53.0.1 rad >dig.out.test$n
-grep "; Report-Channel: \"example.rad\"" dig.out.test$n >/dev/null && ret=1
-[ $ret -eq 0 ] || echo_i "failed"
-status=$((status + ret))
-
-n=$((n + 1))
-echo_i "check that a zone-level Report-Channel EDNS option is added to responses ($n)"
-ret=0
-$DIG $DIGOPTS @10.53.0.1 example.com >dig.out.test$n
-grep "; Report-Channel: \"rad.example.net\"" dig.out.test$n >/dev/null || ret=1
-[ $ret -eq 0 ] || echo_i "failed"
-status=$((status + ret))
-
-n=$((n + 1))
-echo_i "check that error report queries are logged and no Report-Channel option is present in the response ($n)"
-ret=0
-nextpart ns1/named.run >/dev/null
-$DIG $DIGOPTS @10.53.0.1 _er.0.example.1._er.example.rad TXT >dig.out.test$n
-nextpart ns1/named.run | grep "dns-reporting-agent '_er.0.example.1._er.example.rad/IN'" >/dev/null || ret=1
-grep "; Report-Channel: \"example.rad\"" dig.out.test$n >/dev/null && ret=1
-[ $ret -eq 0 ] || echo_i "failed"
-status=$((status + ret))
-
-n=$((n + 1))
-echo_i "check that error report queries to non-logging zones are not logged ($n)"
-ret=0
-nextpart ns1/named.run >/dev/null
-$DIG $DIGOPTS @10.53.0.1 _er.0.example.1._er.example.com TXT >dig.out.test$n
-nextpart ns1/named.run | grep "dns-reporting-agent '_er.0.example.1._er.example.com/IN'" >/dev/null && ret=1
-grep "; Report-Channel: \"rad.example.net\"" dig.out.test$n >/dev/null || ret=1
-[ $ret -eq 0 ] || echo_i "failed"
-status=$((status + ret))
-
 echo_i "exit status: $status"
 [ $status -eq 0 ] || exit 1
@@ -101,7 +101,7 @@ digcomp --lc dig.out.ns2 knowngood.dig.out || status=1

 n=$((n + 1))
 echo_i "only one tcp socket was used ($n)"
-tcpclients=$(awk '$2 == "client" && $4 ~ /10.53.0.7#[0-9]*:/ {print $4}' ns2/named.run | sort | uniq -c | wc -l)
+tcpclients=$(awk '$3 == "client" && $5 ~ /10.53.0.7#[0-9]*:/ {print $5}' ns2/named.run | sort | uniq -c | wc -l)

 test $tcpclients -eq 1 || {
  status=1
@@ -1,29 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * SPDX-License-Identifier: MPL-2.0
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0.  If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-tls test-tls {
-	protocols { TLSv1.2; };
-	ciphers "HIGH:!kRSA:!aNULL:!eNULL:!RC4:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS:!SHA1:!SHA256:!SHA384";
-	prefer-server-ciphers yes;
-};
-
-tls another-tls {
-	protocols { TLSv1.2; };
-	session-tickets no;
-};
-
-zone "example" {
-	type forward;
-	forward only;
-	forwarders port 5300 tls test-tls { 10.53.0.1; 10.53.0.2 port 5301 tls another-tls tls third-tls tls "fourth-tls"; };
-};
@@ -1,18 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * SPDX-License-Identifier: MPL-2.0
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0.  If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-zone "." {
-	type primary;
-	file "root.db";
-	log-report-channel yes;
-};
@@ -1,16 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * SPDX-License-Identifier: MPL-2.0
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0.  If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-server 1.2.3.4 {
-	query-source 10.10.10.10 address 10.10.10.11;
-};
@@ -1,16 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * SPDX-License-Identifier: MPL-2.0
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0.  If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-server fd92:7065:b8e:ffff::1 {
-	query-source-v6 fd92:7065:b8e:ffff::2 address fd92:7065:b8e:ffff::3;
-};
@@ -1,17 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * SPDX-License-Identifier: MPL-2.0
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0.  If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-options {
-	/* invalid domain name */
-	send-report-channel example..com;
-};
@@ -1,20 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * SPDX-License-Identifier: MPL-2.0
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0.  If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-zone example.com {
-        type primary;
-        file "example.db";
-
-	/* agent-domain can't be the same as the zone name */
-	send-report-channel example.com;
-};
@@ -1,20 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * SPDX-License-Identifier: MPL-2.0
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0.  If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-zone example.com {
-        type primary;
-        file "example.db";
-
-	/* agent-domain can't be the below the zone name */
-	send-report-channel sub.example.com;
-};
@@ -32,8 +32,4 @@ logging {
 		file "five.out";
 		print-time iso8601-utc;
 	};
-	channel six {
-		file "six.out";
-		print-time iso8601-tzinfo;
-	};
 };
@@ -1,16 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * SPDX-License-Identifier: MPL-2.0
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0.  If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-server 1.2.3.4 {
-	query-source address 10.10.10.10;
-};
@@ -1,16 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * SPDX-License-Identifier: MPL-2.0
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0.  If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-server fd92:7065:b8e:ffff::1 {
-	query-source-v6 address fd92:7065:b8e:ffff::2;
-};
@@ -1,16 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * SPDX-License-Identifier: MPL-2.0
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0.  If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-server fd92:7065:b8e:ffff::1 {
-	query-source-v6 fd92:7065:b8e:ffff::1;
-};
@@ -1,21 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * SPDX-License-Identifier: MPL-2.0
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0.  If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-options {
-	send-report-channel example.com;
-};
-
-zone example.com {
-	type primary;
-	file "example.db";
-};
@@ -105,11 +105,6 @@ view "first" {
 		file "yyy";
 		max-ixfr-ratio unlimited;
 	};
-	zone "reports" {
-		type primary;
-		file "reports";
-		log-report-channel yes;
-	};
 	dnssec-validation auto;
 	max-query-restarts 15;
 	zone-statistics terse;
@@ -1,6 +1,5 @@
 example1 IN first primary
 clone IN first primary
-reports IN first primary
 example1 IN second primary
 example2 IN second static-stub
 example3 IN second static-stub
@@ -24,6 +24,7 @@ pytest.importorskip("dns", minversion="2.0.0")
 import dns.exception
 import dns.message
 import dns.name
+import dns.query
 import dns.rcode
 import dns.rdataclass
 import dns.rdatatype
@@ -60,9 +61,16 @@ def has_signed_apex_nsec(zone, response):


 def do_query(server, qname, qtype, tcp=False):
-    msg = dns.message.make_query(qname, qtype, use_edns=True, want_dnssec=True)
-    query_func = isctest.query.tcp if tcp else isctest.query.udp
-    response = query_func(msg, server.ip, expected_rcode=dns.rcode.NOERROR)
+    query = dns.message.make_query(qname, qtype, use_edns=True, want_dnssec=True)
+    try:
+        if tcp:
+            response = dns.query.tcp(query, server.ip, timeout=3, port=server.ports.dns)
+        else:
+            response = dns.query.udp(query, server.ip, timeout=3, port=server.ports.dns)
+    except dns.exception.Timeout:
+        print(f"error: query timeout for query {qname} {qtype} to {server.ip}")
+        return None
+
    return response


@@ -89,26 +97,38 @@ def verify_zone(zone, transfer):


 def read_statefile(server, zone):
+    addr = server.ip
    count = 0
    keyid = 0
    state = {}

    response = do_query(server, zone, "DS", tcp=True)
-    # fetch key id from response.
-    for rr in response.answer:
-        if rr.match(
-            dns.name.from_text(zone),
-            dns.rdataclass.IN,
-            dns.rdatatype.DS,
-            dns.rdatatype.NONE,
-        ):
-            if count == 0:
-                keyid = list(dict(rr.items).items())[0][0].key_tag
-            count += 1
+    if not isinstance(response, dns.message.Message):
+        print(f"error: no response for {zone} DS from {addr}")
+        return {}

-    assert (
-        count == 1
-    ), f"expected a single DS in response for {zone} from {server.ip}, got {count}"
+    if response.rcode() == dns.rcode.NOERROR:
+        # fetch key id from response.
+        for rr in response.answer:
+            if rr.match(
+                dns.name.from_text(zone),
+                dns.rdataclass.IN,
+                dns.rdatatype.DS,
+                dns.rdatatype.NONE,
+            ):
+                if count == 0:
+                    keyid = list(dict(rr.items).items())[0][0].key_tag
+                count += 1
+
+        if count != 1:
+            print(
+                f"error: expected a single DS in response for {zone} from {addr}, got {count}"
+            )
+            return {}
+    else:
+        rcode = dns.rcode.to_text(response.rcode())
+        print(f"error: {rcode} response for {zone} DNSKEY from {addr}")
+        return {}

    filename = f"ns9/K{zone}+013+{keyid:05d}.state"
    print(f"read state file {filename}")
@@ -120,6 +140,7 @@ def read_statefile(server, zone):
                    continue
                key, val = line.strip().split(":", 1)
                state[key.strip()] = val.strip()
+
    except FileNotFoundError:
        # file may not be written just yet.
        return {}
@@ -128,15 +149,40 @@ def read_statefile(server, zone):


 def zone_check(server, zone):
+    addr = server.ip
    fqdn = f"{zone}."

-    # check zone is fully signed.
-    response = do_query(server, fqdn, "NSEC")
-    assert has_signed_apex_nsec(fqdn, response)
+    # wait until zone is fully signed.
+    signed = False
+    for _ in range(10):
+        response = do_query(server, fqdn, "NSEC")
+        if not isinstance(response, dns.message.Message):
+            print(f"error: no response for {fqdn} NSEC from {addr}")
+        elif response.rcode() == dns.rcode.NOERROR:
+            signed = has_signed_apex_nsec(fqdn, response)
+        else:
+            rcode = dns.rcode.to_text(response.rcode())
+            print(f"error: {rcode} response for {fqdn} NSEC from {addr}")
+
+        if signed:
+            break
+
+        time.sleep(1)
+
+    assert signed

    # check if zone if DNSSEC valid.
+    verified = False
    transfer = do_query(server, fqdn, "AXFR", tcp=True)
-    assert verify_zone(fqdn, transfer)
+    if not isinstance(transfer, dns.message.Message):
+        print(f"error: no response for {fqdn} AXFR from {addr}")
+    elif transfer.rcode() == dns.rcode.NOERROR:
+        verified = verify_zone(fqdn, transfer)
+    else:
+        rcode = dns.rcode.to_text(transfer.rcode())
+        print(f"error: {rcode} response for {fqdn} AXFR from {addr}")
+
+    assert verified


 def keystate_check(server, zone, key):
@@ -124,16 +124,6 @@ n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status + ret))

-echo_i "checking that log-report-channel zones fail if '*._er/TXT' is missing ($n)"
-ret=0
-$CHECKZONE -R fail example zones/er.db >test.out2.$n 2>&1 || ret=1
-grep -F "no '*._er/TXT' wildcard found" test.out4.$n >/dev/null && ret=1
-$CHECKZONE example zones/er-missing.db >test.out3.$n 2>&1 || ret=1
-grep -F "no '*._er/TXT' wildcard found" test.out4.$n >/dev/null && ret=1
-$CHECKZONE -R fail example zones/er-missing.db >test.out4.$n 2>&1 && ret=1
-grep -F "no '*._er/TXT' wildcard found" test.out4.$n >/dev/null || ret=1
-status=$((status + ret))
-
 echo_i "checking that raw zone with bad class is handled ($n)"
 ret=0
 $CHECKZONE -f raw example zones/bad-badclass.raw >test.out.$n 2>&1 && ret=1
@@ -1,22 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; SPDX-License-Identifier: MPL-2.0
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0.  If a copy of the MPL was not distributed with this
-; file, you can obtain one at https://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 300        ; 5 minutes
-@                       IN SOA  ns root (
-				2018010100 ; serial
-				1800       ; refresh (30 minutes)
-				1800       ; retry (30 minutes)
-				1814400    ; expire (3 weeks)
-				3600       ; minimum (1 hour)
-				)
-			NS      ns
-ns                      A       10.53.0.1
-server			A	10.53.0.100
@@ -1,23 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; SPDX-License-Identifier: MPL-2.0
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0.  If a copy of the MPL was not distributed with this
-; file, you can obtain one at https://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 300        ; 5 minutes
-@                       IN SOA  ns root (
-				2018010100 ; serial
-				1800       ; refresh (30 minutes)
-				1800       ; retry (30 minutes)
-				1814400    ; expire (3 weeks)
-				3600       ; minimum (1 hour)
-				)
-			NS      ns
-ns                      A       10.53.0.1
-server			A	10.53.0.100
-*._er                   TXT     "Report received"
@@ -297,7 +297,9 @@ def logger(request, system_test_name):


@pytest.fixture(scope="module")
-def system_test_dir(request, system_test_name):
+def system_test_dir(
+    request, system_test_name
+):  # pylint: disable=too-many-statements,too-many-locals
    """
    Temporary directory for executing the test.

@@ -355,7 +357,7 @@ def system_test_dir(request, system_test_name):
    isctest.vars.dirs.set_system_test_name(testdir.name)

    # Create a convenience symlink with a stable and predictable name
-    module_name = SYMLINK_REPLACEMENT_RE.sub(r"\1", str(_get_node_path(request.node)))
+    module_name = SYMLINK_REPLACEMENT_RE.sub(r"\1", request.node.name)
    symlink_dst = system_test_root / module_name
    unlink(symlink_dst)
    symlink_dst.symlink_to(os.path.relpath(testdir, start=system_test_root))
@@ -406,12 +408,7 @@ def system_test_dir(request, system_test_name):
            unlink(symlink_dst)


-@pytest.fixture(scope="module")
-def templates(system_test_dir: Path):
-    return isctest.template.TemplateEngine(system_test_dir)
-
-
-def _run_script(
+def _run_script(  # pylint: disable=too-many-arguments
    system_test_dir: Path,
    interpreter: str,
    script: str,
@@ -451,15 +448,6 @@ def _run_script(
        isctest.log.debug("  exited with %d", returncode)


-def _get_node_path(node) -> Path:
-    if isinstance(node.parent, pytest.Session):
-        if _pytest_major_ver >= 8:
-            return Path()
-        return Path(node.name)
-    assert node.parent is not None
-    return _get_node_path(node.parent) / node.name
-
-
@pytest.fixture(scope="module")
 def shell(system_test_dir):
    """Function to call a shell script with arguments."""
@@ -483,10 +471,9 @@ def run_tests_sh(system_test_dir, shell):


@pytest.fixture(scope="module", autouse=True)
-def system_test(
+def system_test(  # pylint: disable=too-many-arguments,too-many-statements
    request,
    system_test_dir,
-    templates,
    shell,
    perl,
 ):
@@ -528,7 +515,6 @@ def system_test(
            pytest.skip("Prerequisites missing.")

    def setup_test():
-        templates.render_auto()
        try:
            shell(f"{system_test_dir}/setup.sh")
        except FileNotFoundError:
@@ -559,7 +545,7 @@ def system_test(
            isctest.log.error("Found core dumps or sanitizer reports")
            pytest.fail(f"get_core_dumps.sh exited with {exc.returncode}")

-    isctest.log.info(f"test started: {_get_node_path(request.node)}")
+    isctest.log.info(f"test started: {request.node.name}")
    port = int(os.environ["PORT"])
    isctest.log.info(
        "using port range: <%d, %d>", port, port + isctest.vars.ports.PORTS_PER_TEST - 1
@@ -121,14 +121,10 @@ def create_response(msg, tcp, first, ns10):
                    )
                elif labels[0] != "tcponly" or tcp:
                    cookie = o
-                    try:
-                        if len(o.server) == 0:
-                            cookie.server = o.client
-                    except AttributeError:  # dnspython<2.7.0 compat
-                        if len(o.data) == 8:
-                            cookie.data = o.data + o.data
-                        else:
-                            cookie.data = o.data
+                    if len(o.data) == 8:
+                        cookie.data = o.data + o.data
+                    else:
+                        cookie.data = o.data
                    r.use_edns(options=[cookie])
    r.flags |= dns.flags.AA
    return r
@@ -1140,20 +1140,6 @@ else
 fi

 if [ -x "$MDIG" ]; then
-  n=$((n + 1))
-  echo_i "checking mdig +tcp works with a source address and port ($n)"
-  ret=0
-  # When running more than once in quick succession with a source address#port,
-  # we can get a "response failed with address not available" error because
-  # the address#port is still busy, but we are not interested in that error,
-  # as we are only looking for the unexpected error case, that's why we ignore
-  # the return code from mdig, but we check for the unexpected error message
-  # using grep. See GitLab #4969.
-  mdig_with_opts -b "10.53.0.3#${EXTRAPORT8}" +tcp @10.53.0.3 example >dig.out.test$n 2>&1 || true
-  grep -F "unexpected error" dig.out.test$n >/dev/null && ret=1
-  if [ $ret -ne 0 ]; then echo_i "failed"; fi
-  status=$((status + ret))
-
  n=$((n + 1))
  echo_i "check that mdig handles malformed option '+ednsopt=:' gracefully ($n)"
  ret=0
@@ -12,15 +12,16 @@
 # information regarding copyright ownership.

 import pytest
-import isctest

 pytest.importorskip("dns")
 import dns.message
+import dns.query
+import dns.rcode


-def test_connreset():
+def test_connreset(named_port):
    msg = dns.message.make_query(
        "sub.example.", "A", want_dnssec=True, use_edns=0, payload=1232
    )
-    res = isctest.query.udp(msg, "10.53.0.2")
-    isctest.check.servfail(res)
+    ans = dns.query.udp(msg, "10.53.0.2", timeout=10, port=named_port)
+    assert ans.rcode() == dns.rcode.SERVFAIL
@@ -386,9 +386,9 @@ status=$((status + ret))

 echo_i "checking negative validation NXDOMAIN NSEC3 ($n)"
 ret=0
-dig_with_opts +noauth q.nsec3.example. \
+dig_with_opts +noauth a.b.c.d.e.f.g.h.i.j.nsec3.example. \
  @10.53.0.3 a >dig.out.ns3.test$n || ret=1
-dig_with_opts +noauth q.nsec3.example. \
+dig_with_opts +noauth a.b.c.d.e.f.g.h.i.j.nsec3.example. \
  @10.53.0.4 a >dig.out.ns4.test$n || ret=1
 digcomp dig.out.ns3.test$n dig.out.ns4.test$n || ret=1
 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n >/dev/null || ret=1
@@ -4487,35 +4487,5 @@ n=$((n + 1))
 if [ "$ret" -ne 0 ]; then echo_i "failed"; fi
 status=$((status + ret))

-echo_i "checking NSEC3 nxdomain response closest encloser with 0 ENT ($n)"
-ret=0
-dig_with_opts @10.53.0.3 b.b.b.b.b.a.nsec3.example. >dig.out.ns3.test$n
-grep "status: NXDOMAIN" dig.out.ns3.test$n >/dev/null || ret=1
-pat="^6OVDUHTN094ML2PV8AN90U0DPU823GH2\.nsec3.example\..*NSEC3 1 0 0 - 7AT0S0RIDCJRFF2M5H5AAV22CSFJBUL4 A RRSIG\$"
-grep "$pat" dig.out.ns3.test$n >/dev/null || ret=1
-n=$((n + 1))
-if [ "$ret" -ne 0 ]; then echo_i "failed"; fi
-status=$((status + ret))
-
-echo_i "checking NSEC3 nxdomain response closest encloser with 1 ENTs ($n)"
-ret=0
-dig_with_opts @10.53.0.3 b.b.b.b.b.a.a.nsec3.example. >dig.out.ns3.test$n
-grep "status: NXDOMAIN" dig.out.ns3.test$n >/dev/null || ret=1
-pat="^NGCJFSOLJUUE27PFNQNJIME4TQ0OU2DH\.nsec3.example\..*NSEC3 1 0 0 - R8EVDMNIGNOKME4LH2H90OSP2PRSNJ1Q\$"
-grep "$pat" dig.out.ns3.test$n >/dev/null || ret=1
-n=$((n + 1))
-if [ "$ret" -ne 0 ]; then echo_i "failed"; fi
-status=$((status + ret))
-
-echo_i "checking NSEC3 nxdomain response closest encloser with 2 ENTs ($n)"
-ret=0
-dig_with_opts @10.53.0.3 b.b.b.b.b.a.a.a.nsec3.example. >dig.out.ns3.test$n
-grep "status: NXDOMAIN" dig.out.ns3.test$n >/dev/null || ret=1
-pat="^H7RHPDCHSVVRAND332F878C8AB6IBJQV\.nsec3.example\..*NSEC3 1 0 0 - K8IG76R2UPQ13IKFO49L7IB9JRVB6QJI\$"
-grep "$pat" dig.out.ns3.test$n >/dev/null || ret=1
-n=$((n + 1))
-if [ "$ret" -ne 0 ]; then echo_i "failed"; fi
-status=$((status + ret))
-
 echo_i "exit status: $status"
 [ $status -eq 0 ] || exit 1
@@ -2665,10 +2665,6 @@ unspec01.example.	3600	IN	UNSPEC	\# 1 04
 uri01.example.		3600	IN	URI	10 20 "https://www.isc.org/"
 uri02.example.		3600	IN	URI	30 40 "https://www.isc.org/HolyCowThisSureIsAVeryLongURIRecordIDontEvenKnowWhatSomeoneWouldEverWantWithSuchAThingButTheSpecificationRequiresThatWesupportItSoHereWeGoTestingItLaLaLaLaLaLaLaSeriouslyThoughWhyWouldYouEvenConsiderUsingAURIThisLongItSeemsLikeASillyIdeaButEnhWhatAreYouGonnaDo/"
 uri03.example.		3600	IN	URI	30 40 ""
-wallet.example.		3600	IN	WALLET	"currency-identifer" "wallet-identifier"
-wallet-multiple.example. 3600	IN	WALLET	"currency-identifer1" "wallet-identifier1"
-wallet-multiple.example. 3600	IN	WALLET	"currency-identifer1" "wallet-identifier2"
-wallet-multiple.example. 3600	IN	WALLET	"currency-identifer2" "wallet-identifier3"
 wks01.example.		3600	IN	WKS	10.0.0.1 6 0 1 2 21 23
 wks02.example.		3600	IN	WKS	10.0.0.1 17 0 1 2 53
 wks03.example.		3600	IN	WKS	10.0.0.2 6 65535
@@ -2665,10 +2665,6 @@ unspec01.example8.	3600	IN	UNSPEC	\# 1 04
 uri01.example8.		3600	IN	URI	10 20 "https://www.isc.org/"
 uri02.example8.		3600	IN	URI	30 40 "https://www.isc.org/HolyCowThisSureIsAVeryLongURIRecordIDontEvenKnowWhatSomeoneWouldEverWantWithSuchAThingButTheSpecificationRequiresThatWesupportItSoHereWeGoTestingItLaLaLaLaLaLaLaSeriouslyThoughWhyWouldYouEvenConsiderUsingAURIThisLongItSeemsLikeASillyIdeaButEnhWhatAreYouGonnaDo/"
 uri03.example8.		3600	IN	URI	30 40 ""
-wallet.example8.	3600	IN	WALLET	"currency-identifer" "wallet-identifier"
-wallet-multiple.example8. 3600	IN	WALLET	"currency-identifer1" "wallet-identifier1"
-wallet-multiple.example8. 3600	IN	WALLET	"currency-identifer1" "wallet-identifier2"
-wallet-multiple.example8. 3600	IN	WALLET	"currency-identifer2" "wallet-identifier3"
 wks01.example8.		3600	IN	WKS	10.0.0.1 6 0 1 2 21 23
 wks02.example8.		3600	IN	WKS	10.0.0.1 17 0 1 2 53
 wks03.example8.		3600	IN	WKS	10.0.0.2 6 65535
@@ -38,6 +38,7 @@ usage(void) {
 	fprintf(stderr, "usage: feature-test <arg>\n");
 	fprintf(stderr, "args:\n");
 	fprintf(stderr, "\t--edns-version\n");
+	fprintf(stderr, "\t--enable-dnsrps\n");
 	fprintf(stderr, "\t--enable-dnstap\n");
 	fprintf(stderr, "\t--enable-querytrace\n");
 	fprintf(stderr, "\t--fips-provider\n");
@@ -75,6 +76,14 @@ main(int argc, char **argv) {
 		return (0);
 	}

+	if (strcmp(argv[1], "--enable-dnsrps") == 0) {
+#ifdef USE_DNSRPS
+		return (0);
+#else  /* ifdef USE_DNSRPS */
+		return (1);
+#endif /* ifdef USE_DNSRPS */
+	}
+
 	if (strcmp(argv[1], "--enable-dnstap") == 0) {
 #ifdef HAVE_DNSTAP
 		return (0);
@@ -481,13 +481,7 @@ amtrelay06		AMTRELAY \# 2 0004
 ; type 261
 resinfo			RESINFO	qnamemin exterr=15,16,17 infourl=https://resolver.example.com/guide

-; type 262
-wallet			WALLET	currency-identifer wallet-identifier
-wallet-multiple		WALLET	currency-identifer1 wallet-identifier1
-wallet-multiple		WALLET	currency-identifer1 wallet-identifier2
-wallet-multiple		WALLET	currency-identifer2 wallet-identifier3
-
-; type 265 -- 32767 (unassigned)
+; type 262 -- 32767 (unassigned)

 ; type 32768
 ta			TA	30795 1 1 (
@@ -10,14 +10,18 @@
 # information regarding copyright ownership.

 import pytest
-import isctest

 pytest.importorskip("dns")
 import dns.message
+import dns.query
+import dns.rcode


-def test_async_hook():
-    msg = dns.message.make_query("example.com.", "A")
-    res = isctest.query.udp(msg, "10.53.0.1")
+def test_async_hook(named_port):
+    msg = dns.message.make_query(
+        "example.com.",
+        "A",
+    )
+    ans = dns.query.udp(msg, "10.53.0.1", timeout=10, port=named_port)
    # the test-async plugin changes the status of any positive answer to NOTIMP
-    isctest.check.notimp(res)
+    assert ans.rcode() == dns.rcode.NOTIMP
@@ -12,11 +12,9 @@
 from . import check
 from . import instance
 from . import query
-from . import kasp
 from . import name
 from . import rndc
 from . import run
-from . import template
 from . import log
 from . import vars  # pylint: disable=redefined-builtin
 from . import hypothesis
@@ -97,6 +97,7 @@ class _AsyncUdpHandler(asyncio.DatagramProtocol):
            loop.create_task(handler_coroutine)


+# pylint: disable=too-few-public-methods
 class AsyncServer:
    """
    A generic asynchronous server which may handle UDP and/or TCP traffic.
@@ -224,6 +225,7 @@ class DnsProtocol(enum.Enum):
    TCP = enum.auto()


+# pylint: disable=too-many-instance-attributes
@dataclass
 class QueryContext:
    """
@@ -28,10 +28,6 @@ def noerror(message: dns.message.Message) -> None:
    rcode(message, dns_rcode.NOERROR)


-def notimp(message: dns.message.Message) -> None:
-    rcode(message, dns_rcode.NOTIMP)
-
-
 def servfail(message: dns.message.Message) -> None:
    rcode(message, dns_rcode.SERVFAIL)

@@ -45,6 +45,7 @@ class NamedInstance:
    ```
    """

+    # pylint: disable=too-many-arguments
    def __init__(
        self,
        identifier: str,
@@ -1,579 +0,0 @@
-# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-#
-# SPDX-License-Identifier: MPL-2.0
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0.  If a copy of the MPL was not distributed with this
-# file, you can obtain one at https://mozilla.org/MPL/2.0/.
-#
-# See the COPYRIGHT file distributed with this work for additional
-# information regarding copyright ownership.
-
-from functools import total_ordering
-import os
-from pathlib import Path
-import re
-import subprocess
-import time
-from typing import Optional, Union
-
-from datetime import datetime, timedelta, timezone
-
-import dns
-import isctest.log
-import isctest.query
-
-DEFAULT_TTL = 300
-
-
-def _query(server, qname, qtype):
-    query = dns.message.make_query(qname, qtype, use_edns=True, want_dnssec=True)
-    try:
-        response = isctest.query.tcp(query, server.ip, server.ports.dns, timeout=3)
-    except dns.exception.Timeout:
-        isctest.log.debug(f"query timeout for query {qname} {qtype} to {server.ip}")
-        return None
-
-    return response
-
-
-@total_ordering
-class KeyTimingMetadata:
-    """
-    Represent a single timing information for a key.
-
-    These objects can be easily compared, support addition and subtraction of
-    timedelta objects or integers(value in seconds). A lack of timing metadata
-    in the key (value 0) should be represented with None rather than an
-    instance of this object.
-    """
-
-    FORMAT = "%Y%m%d%H%M%S"
-
-    def __init__(self, timestamp: str):
-        if int(timestamp) <= 0:
-            raise ValueError(f'invalid timing metadata value: "{timestamp}"')
-        self.value = datetime.strptime(timestamp, self.FORMAT).replace(
-            tzinfo=timezone.utc
-        )
-
-    def __repr__(self):
-        return self.value.strftime(self.FORMAT)
-
-    def __str__(self) -> str:
-        return self.value.strftime(self.FORMAT)
-
-    def __add__(self, other: Union[timedelta, int]):
-        if isinstance(other, int):
-            other = timedelta(seconds=other)
-        result = KeyTimingMetadata.__new__(KeyTimingMetadata)
-        result.value = self.value + other
-        return result
-
-    def __sub__(self, other: Union[timedelta, int]):
-        if isinstance(other, int):
-            other = timedelta(seconds=other)
-        result = KeyTimingMetadata.__new__(KeyTimingMetadata)
-        result.value = self.value - other
-        return result
-
-    def __iadd__(self, other: Union[timedelta, int]):
-        if isinstance(other, int):
-            other = timedelta(seconds=other)
-        self.value += other
-
-    def __isub__(self, other: Union[timedelta, int]):
-        if isinstance(other, int):
-            other = timedelta(seconds=other)
-        self.value -= other
-
-    def __lt__(self, other: "KeyTimingMetadata"):
-        return self.value < other.value
-
-    def __eq__(self, other: object):
-        return isinstance(other, KeyTimingMetadata) and self.value == other.value
-
-    @staticmethod
-    def now() -> "KeyTimingMetadata":
-        result = KeyTimingMetadata.__new__(KeyTimingMetadata)
-        result.value = datetime.now(timezone.utc)
-        return result
-
-
-@total_ordering
-class Key:
-    """
-    Represent a key from a keyfile.
-
-    This object keeps track of its origin (keydir + name), can be used to
-    retrieve metadata from the underlying files and supports convenience
-    operations for KASP tests.
-    """
-
-    def __init__(self, name: str, keydir: Optional[Union[str, Path]] = None):
-        self.name = name
-        if keydir is None:
-            self.keydir = Path()
-        else:
-            self.keydir = Path(keydir)
-        self.path = str(self.keydir / name)
-        self.keyfile = f"{self.path}.key"
-        self.statefile = f"{self.path}.state"
-        self.tag = int(self.name[-5:])
-
-    def get_timing(
-        self, metadata: str, must_exist: bool = True
-    ) -> Optional[KeyTimingMetadata]:
-        regex = rf";\s+{metadata}:\s+(\d+).*"
-        with open(self.keyfile, "r", encoding="utf-8") as file:
-            for line in file:
-                match = re.match(regex, line)
-                if match is not None:
-                    try:
-                        return KeyTimingMetadata(match.group(1))
-                    except ValueError:
-                        break
-        if must_exist:
-            raise ValueError(
-                f'timing metadata "{metadata}" for key "{self.name}" invalid'
-            )
-        return None
-
-    def get_metadata(self, metadata: str, must_exist=True) -> str:
-        value = "undefined"
-        regex = rf"{metadata}:\s+(.*)"
-        with open(self.statefile, "r", encoding="utf-8") as file:
-            for line in file:
-                match = re.match(regex, line)
-                if match is not None:
-                    value = match.group(1)
-                    break
-        if must_exist and value == "undefined":
-            raise ValueError(
-                'state metadata "{metadata}" for key "{self.name}" undefined'
-            )
-        return value
-
-    def is_ksk(self) -> bool:
-        return self.get_metadata("KSK") == "yes"
-
-    def is_zsk(self) -> bool:
-        return self.get_metadata("ZSK") == "yes"
-
-    def dnskey_equals(self, value, cdnskey=False):
-        dnskey = value.split()
-
-        if cdnskey:
-            # fourth element is the rrtype
-            assert dnskey[3] == "CDNSKEY"
-            dnskey[3] = "DNSKEY"
-
-        dnskey_fromfile = []
-        rdata = " ".join(dnskey[:7])
-
-        with open(self.keyfile, "r", encoding="utf-8") as file:
-            for line in file:
-                if f"{rdata}" in line:
-                    dnskey_fromfile = line.split()
-
-        pubkey_fromfile = "".join(dnskey_fromfile[7:])
-        pubkey_fromwire = "".join(dnskey[7:])
-
-        return pubkey_fromfile == pubkey_fromwire
-
-    def cds_equals(self, value, alg):
-        cds = value.split()
-
-        dsfromkey_command = [
-            os.environ.get("DSFROMKEY"),
-            "-T",
-            "3600",
-            "-a",
-            alg,
-            "-C",
-            "-w",
-            str(self.keyfile),
-        ]
-
-        out = isctest.run.cmd(dsfromkey_command, log_stdout=True)
-        dsfromkey = out.stdout.decode("utf-8").split()
-
-        rdata_fromfile = " ".join(dsfromkey[:7])
-        rdata_fromwire = " ".join(cds[:7])
-        if rdata_fromfile != rdata_fromwire:
-            isctest.log.debug(
-                f"CDS RDATA MISMATCH: {rdata_fromfile} - {rdata_fromwire}"
-            )
-            return False
-
-        digest_fromfile = "".join(dsfromkey[7:]).lower()
-        digest_fromwire = "".join(cds[7:]).lower()
-        if digest_fromfile != digest_fromwire:
-            isctest.log.debug(
-                f"CDS DIGEST MISMATCH: {digest_fromfile} - {digest_fromwire}"
-            )
-            return False
-
-        return digest_fromfile == digest_fromwire
-
-    def __lt__(self, other: "Key"):
-        return self.name < other.name
-
-    def __eq__(self, other: object):
-        return isinstance(other, Key) and self.path == other.path
-
-    def __repr__(self):
-        return self.path
-
-
-def check_zone_is_signed(server, zone):
-    addr = server.ip
-    fqdn = f"{zone}."
-
-    # wait until zone is fully signed
-    signed = False
-    for _ in range(10):
-        response = _query(server, fqdn, dns.rdatatype.NSEC)
-        if not isinstance(response, dns.message.Message):
-            isctest.log.debug(f"no response for {fqdn} NSEC from {addr}")
-        elif response.rcode() != dns.rcode.NOERROR:
-            rcode = dns.rcode.to_text(response.rcode())
-            isctest.log.debug(f"{rcode} response for {fqdn} NSEC from {addr}")
-        else:
-            has_nsec = False
-            has_rrsig = False
-            for rr in response.answer:
-                if not has_nsec:
-                    has_nsec = rr.match(
-                        dns.name.from_text(fqdn),
-                        dns.rdataclass.IN,
-                        dns.rdatatype.NSEC,
-                        dns.rdatatype.NONE,
-                    )
-                if not has_rrsig:
-                    has_rrsig = rr.match(
-                        dns.name.from_text(fqdn),
-                        dns.rdataclass.IN,
-                        dns.rdatatype.RRSIG,
-                        dns.rdatatype.NSEC,
-                    )
-
-            if not has_nsec:
-                isctest.log.debug(
-                    f"missing apex {fqdn} NSEC record in response from {addr}"
-                )
-            if not has_rrsig:
-                isctest.log.debug(
-                    f"missing {fqdn} NSEC signature in response from {addr}"
-                )
-
-            signed = has_nsec and has_rrsig
-
-        if signed:
-            break
-
-        time.sleep(1)
-
-    assert signed
-
-
-def check_dnssec_verify(server, zone):
-    # Check if zone if DNSSEC valid with dnssec-verify.
-    fqdn = f"{zone}."
-
-    verified = False
-    for _ in range(10):
-        transfer = _query(server, fqdn, dns.rdatatype.AXFR)
-        if not isinstance(transfer, dns.message.Message):
-            isctest.log.debug(f"no response for {fqdn} AXFR from {server.ip}")
-        elif transfer.rcode() != dns.rcode.NOERROR:
-            rcode = dns.rcode.to_text(transfer.rcode())
-            isctest.log.debug(f"{rcode} response for {fqdn} AXFR from {server.ip}")
-        else:
-            zonefile = f"{zone}.axfr"
-            with open(zonefile, "w", encoding="utf-8") as file:
-                for rr in transfer.answer:
-                    file.write(rr.to_text())
-                    file.write("\n")
-
-            try:
-                verify_command = [os.environ.get("VERIFY"), "-z", "-o", zone, zonefile]
-                verified = isctest.run.cmd(verify_command)
-            except subprocess.CalledProcessError:
-                pass
-
-        if verified:
-            break
-
-        time.sleep(1)
-
-    assert verified
-
-
-def check_dnssecstatus(server, zone, keys, policy=None, view=None):
-    # Call rndc dnssec -status on 'server' for 'zone'. Expect 'policy' in
-    # the output. This is a loose verification, it just tests if the right
-    # policy name is returned, and if all expected keys are listed.
-    response = ""
-    if view is None:
-        response = server.rndc(f"dnssec -status {zone}", log=False)
-    else:
-        response = server.rndc(f"dnssec -status {zone} in {view}", log=False)
-
-    if policy is None:
-        assert "Zone does not have dnssec-policy" in response
-        return
-
-    assert f"dnssec-policy: {policy}" in response
-
-    for key in keys:
-        assert f"key: {key.tag}" in response
-
-
-def _check_signatures(signatures, covers, fqdn, keys):
-    now = KeyTimingMetadata.now()
-    numsigs = 0
-    zrrsig = True
-    if covers in [dns.rdatatype.DNSKEY, dns.rdatatype.CDNSKEY, dns.rdatatype.CDS]:
-        zrrsig = False
-    krrsig = not zrrsig
-
-    for key in keys:
-        activate = key.get_timing("Activate")
-        inactive = key.get_timing("Inactive", must_exist=False)
-
-        active = now >= activate
-        retired = inactive is not None and inactive <= now
-        signing = active and not retired
-        alg = key.get_metadata("Algorithm")
-        rtype = dns.rdatatype.to_text(covers)
-
-        expect = rf"IN RRSIG {rtype} {alg} (\d) (\d+) (\d+) (\d+) {key.tag} {fqdn}"
-
-        if not signing:
-            for rrsig in signatures:
-                assert re.search(expect, rrsig) is None
-            continue
-
-        if zrrsig and key.is_zsk():
-            has_rrsig = False
-            for rrsig in signatures:
-                if re.search(expect, rrsig) is not None:
-                    has_rrsig = True
-                    break
-            assert has_rrsig, f"Expected signature but not found: {expect}"
-            numsigs += 1
-
-        if zrrsig and not key.is_zsk():
-            for rrsig in signatures:
-                assert re.search(expect, rrsig) is None
-
-        if krrsig and key.is_ksk():
-            has_rrsig = False
-            for rrsig in signatures:
-                if re.search(expect, rrsig) is not None:
-                    has_rrsig = True
-                    break
-            assert has_rrsig, f"Expected signature but not found: {expect}"
-            numsigs += 1
-
-        if krrsig and not key.is_ksk():
-            for rrsig in signatures:
-                assert re.search(expect, rrsig) is None
-
-    return numsigs
-
-
-def check_signatures(rrset, covers, fqdn, ksks, zsks):
-    # Check if signatures with covering type are signed with the right keys.
-    # The right keys are the ones that expect a signature and have the
-    # correct role.
-    numsigs = 0
-
-    signatures = []
-    for rr in rrset:
-        for rdata in rr:
-            rdclass = dns.rdataclass.to_text(rr.rdclass)
-            rdtype = dns.rdatatype.to_text(rr.rdtype)
-            rrsig = f"{rr.name} {rr.ttl} {rdclass} {rdtype} {rdata}"
-            signatures.append(rrsig)
-
-    numsigs += _check_signatures(signatures, covers, fqdn, ksks)
-    numsigs += _check_signatures(signatures, covers, fqdn, zsks)
-
-    assert numsigs == len(signatures)
-
-
-def _check_dnskeys(dnskeys, keys, cdnskey=False):
-    now = KeyTimingMetadata.now()
-    numkeys = 0
-
-    publish_md = "Publish"
-    delete_md = "Delete"
-    if cdnskey:
-        publish_md = f"Sync{publish_md}"
-        delete_md = f"Sync{delete_md}"
-
-    for key in keys:
-        publish = key.get_timing(publish_md)
-        delete = key.get_timing(delete_md, must_exist=False)
-        published = now >= publish
-        removed = delete is not None and delete <= now
-
-        if not published or removed:
-            for dnskey in dnskeys:
-                assert not key.dnskey_equals(dnskey, cdnskey=cdnskey)
-            continue
-
-        has_dnskey = False
-        for dnskey in dnskeys:
-            if key.dnskey_equals(dnskey, cdnskey=cdnskey):
-                has_dnskey = True
-                break
-
-        if not cdnskey:
-            assert has_dnskey
-
-        if has_dnskey:
-            numkeys += 1
-
-    return numkeys
-
-
-def check_dnskeys(rrset, ksks, zsks, cdnskey=False):
-    # Check if the correct DNSKEY records are published. If the current time
-    # is between the timing metadata 'publish' and 'delete', the key must have
-    # a DNSKEY record published. If 'cdnskey' is True, check against CDNSKEY
-    # records instead.
-    numkeys = 0
-
-    dnskeys = []
-    for rr in rrset:
-        for rdata in rr:
-            rdclass = dns.rdataclass.to_text(rr.rdclass)
-            rdtype = dns.rdatatype.to_text(rr.rdtype)
-            dnskey = f"{rr.name} {rr.ttl} {rdclass} {rdtype} {rdata}"
-            dnskeys.append(dnskey)
-
-    numkeys += _check_dnskeys(dnskeys, ksks, cdnskey=cdnskey)
-    if not cdnskey:
-        numkeys += _check_dnskeys(dnskeys, zsks)
-
-    assert numkeys == len(dnskeys)
-
-
-def check_cds(rrset, keys):
-    # Check if the correct CDS records are published. If the current time
-    # is between the timing metadata 'publish' and 'delete', the key must have
-    # a DNSKEY record published. If 'cdnskey' is True, check against CDNSKEY
-    # records instead.
-    now = KeyTimingMetadata.now()
-    numcds = 0
-
-    cdss = []
-    for rr in rrset:
-        for rdata in rr:
-            rdclass = dns.rdataclass.to_text(rr.rdclass)
-            rdtype = dns.rdatatype.to_text(rr.rdtype)
-            cds = f"{rr.name} {rr.ttl} {rdclass} {rdtype} {rdata}"
-            cdss.append(cds)
-
-    for key in keys:
-        assert key.is_ksk()
-
-        publish = key.get_timing("SyncPublish")
-        delete = key.get_timing("SyncDelete", must_exist=False)
-        published = now >= publish
-        removed = delete is not None and delete <= now
-        if not published or removed:
-            for cds in cdss:
-                assert not key.cds_equals(cds, "SHA-256")
-            continue
-
-        has_cds = False
-        for cds in cdss:
-            if key.cds_equals(cds, "SHA-256"):
-                has_cds = True
-                break
-
-        assert has_cds
-        numcds += 1
-
-    assert numcds == len(cdss)
-
-
-def _query_rrset(server, fqdn, qtype):
-    response = _query(server, fqdn, qtype)
-    assert response.rcode() == dns.rcode.NOERROR
-
-    rrs = []
-    rrsigs = []
-    for rrset in response.answer:
-        if rrset.match(
-            dns.name.from_text(fqdn), dns.rdataclass.IN, dns.rdatatype.RRSIG, qtype
-        ):
-            rrsigs.append(rrset)
-        elif rrset.match(
-            dns.name.from_text(fqdn), dns.rdataclass.IN, qtype, dns.rdatatype.NONE
-        ):
-            rrs.append(rrset)
-        else:
-            assert False
-
-    return rrs, rrsigs
-
-
-def check_apex(server, zone, ksks, zsks):
-    # Test the apex of a zone. This checks that the SOA and DNSKEY RRsets
-    # are signed correctly and with the appropriate keys.
-    fqdn = f"{zone}."
-
-    # test dnskey query
-    dnskeys, rrsigs = _query_rrset(server, fqdn, dns.rdatatype.DNSKEY)
-    assert len(dnskeys) > 0
-    check_dnskeys(dnskeys, ksks, zsks)
-    assert len(rrsigs) > 0
-    check_signatures(rrsigs, dns.rdatatype.DNSKEY, fqdn, ksks, zsks)
-
-    # test soa query
-    soa, rrsigs = _query_rrset(server, fqdn, dns.rdatatype.SOA)
-    assert len(soa) == 1
-    assert f"{zone}. {DEFAULT_TTL} IN SOA" in soa[0].to_text()
-    assert len(rrsigs) > 0
-    check_signatures(rrsigs, dns.rdatatype.SOA, fqdn, ksks, zsks)
-
-    # test cdnskey query
-    cdnskeys, rrsigs = _query_rrset(server, fqdn, dns.rdatatype.CDNSKEY)
-    check_dnskeys(cdnskeys, ksks, zsks, cdnskey=True)
-    if len(cdnskeys) > 0:
-        assert len(rrsigs) > 0
-        check_signatures(rrsigs, dns.rdatatype.CDNSKEY, fqdn, ksks, zsks)
-
-    # test cds query
-    cds, rrsigs = _query_rrset(server, fqdn, dns.rdatatype.CDS)
-    check_cds(cds, ksks)
-    if len(cds) > 0:
-        assert len(rrsigs) > 0
-        check_signatures(rrsigs, dns.rdatatype.CDS, fqdn, ksks, zsks)
-
-
-def check_subdomain(server, zone, ksks, zsks):
-    # Test an RRset below the apex and verify it is signed correctly.
-    fqdn = f"{zone}."
-    qname = f"a.{zone}."
-    qtype = dns.rdatatype.A
-    response = _query(server, qname, qtype)
-    assert response.rcode() == dns.rcode.NOERROR
-
-    match = f"{qname} {DEFAULT_TTL} IN A 10.0.0.1"
-    rrsigs = []
-    for rrset in response.answer:
-        if rrset.match(
-            dns.name.from_text(qname), dns.rdataclass.IN, dns.rdatatype.RRSIG, qtype
-        ):
-            rrsigs.append(rrset)
-        else:
-            assert match in rrset.to_text()
-
-    assert len(rrsigs) > 0
-    check_signatures(rrsigs, qtype, fqdn, ksks, zsks)
@@ -12,6 +12,7 @@
 # information regarding copyright ownership.

 import os
+from pathlib import Path
 import subprocess

 import pytest
@@ -33,8 +34,17 @@ def feature_test(feature):
    return True


-def with_dnstap(*args):  # pylint: disable=unused-argument
-    return feature_test("--enable-dnstap")
+DNSRPS_BIN = Path(os.environ["TOP_BUILDDIR"]) / "bin/tests/system/rpz/dnsrps"
+
+
+def is_dnsrps_available():
+    if not feature_test("--enable-dnsrps"):
+        return False
+    try:
+        subprocess.run([DNSRPS_BIN, "-a"], check=True)
+    except subprocess.CalledProcessError:
+        return False
+    return True


 def with_tsan(*args):  # pylint: disable=unused-argument
@@ -49,6 +59,10 @@ have_json_c = pytest.mark.skipif(
    not feature_test("--have-json-c"), reason="json-c support disabled in the build"
 )

+dnsrps_enabled = pytest.mark.skipif(
+    not is_dnsrps_available(), reason="dnsrps disabled in the build"
+)
+

 try:
    import flaky as flaky_pkg  # type: ignore
@@ -22,6 +22,7 @@ from isctest.compat import dns_rcode
 QUERY_TIMEOUT = 10


+# pylint: disable=too-many-arguments
 def generic_query(
    query_func: Callable[..., Any],
    message: dns.message.Message,
@@ -38,20 +39,15 @@ def generic_query(
    for attempt in range(attempts):
        try:
            isctest.log.debug(
-                f"{query_func.__name__}(): ip={ip}, port={port}, source={source}, "
+                f"{generic_query.__name__}(): ip={ip}, port={port}, source={source}, "
                f"timeout={timeout}, attempts left={attempts-attempt}"
            )
            res = query_func(message, ip, timeout, port=port, source=source)
            if res.rcode() == expected_rcode or expected_rcode is None:
                return res
        except (dns.exception.Timeout, ConnectionRefusedError) as e:
-            isctest.log.debug(f"{query_func.__name__}(): the '{e}' exceptio raised")
+            isctest.log.debug(f"{generic_query.__name__}(): the '{e}' exceptio raised")
        time.sleep(1)
-    if expected_rcode is not None:
-        last_rcode = dns_rcode.to_text(res.rcode()) if res else None
-        isctest.log.debug(
-            f"{query_func.__name__}(): expected rcode={dns_rcode.to_text(expected_rcode)}, last rcode={last_rcode}"
-        )
    raise dns.exception.Timeout


@@ -14,6 +14,7 @@ import os
 import subprocess


+# pylint: disable=too-few-public-methods
 class RNDCExecutor(abc.ABC):
    """
    An interface which RNDC executors have to implement in order for the
@@ -20,7 +20,7 @@ from isctest.compat import dns_rcode
 import dns.message


-def cmd(
+def cmd(  # pylint: disable=too-many-arguments
    args,
    cwd=None,
    timeout=60,
@@ -1,97 +0,0 @@
-#!/usr/bin/python3
-
-# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-#
-# SPDX-License-Identifier: MPL-2.0
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0.  If a copy of the MPL was not distributed with this
-# file, you can obtain one at https://mozilla.org/MPL/2.0/.
-#
-# See the COPYRIGHT file distributed with this work for additional
-# information regarding copyright ownership.
-
-from pathlib import Path
-from typing import Any, Dict, Optional, Union
-
-import pytest
-
-from .log import debug
-from .vars import ALL
-
-
-class TemplateEngine:
-    """
-    Engine for rendering jinja2 templates in system test directories.
-    """
-
-    def __init__(self, directory: Union[str, Path], env_vars=ALL):
-        """
-        Initialize the template engine for `directory`, optionally overriding
-        the `env_vars` that will be used when rendering the templates (defaults
-        to the environment variables set by the pytest runner).
-        """
-        self.directory = Path(directory)
-        self._j2env = None
-        self.env_vars = dict(env_vars)
-
-    @property
-    def j2env(self):
-        """
-        Jinja2 engine that is initialized when first requested. In case the
-        jinja2 package in unavailable, the current test will be skipped.
-        """
-        if self._j2env is None:
-            try:
-                import jinja2  # pylint: disable=import-outside-toplevel
-            except ImportError:
-                pytest.skip("jinja2 not found")
-
-            loader = jinja2.FileSystemLoader(str(self.directory))
-            return jinja2.Environment(
-                loader=loader,
-                undefined=jinja2.StrictUndefined,
-                variable_start_string="@",
-                variable_end_string="@",
-            )
-        return self._j2env
-
-    def render(
-        self,
-        output: str,
-        data: Optional[Dict[str, Any]] = None,
-        template: Optional[str] = None,
-    ) -> None:
-        """
-        Render `output` file from jinja `template` and fill in the `data`. The
-        `template` defaults to *.j2.manual or *.j2 file. The environment
-        variables which the engine was initialized with are also filled in. In
-        case of a variable name clash, `data` has precedence.
-        """
-        if template is None:
-            template = f"{output}.j2.manual"
-            if not Path(template).is_file():
-                template = f"{output}.j2"
-        if not Path(template).is_file():
-            raise RuntimeError('No jinja2 template found for "{output}"')
-
-        if data is None:
-            data = self.env_vars
-        else:
-            data = {**self.env_vars, **data}
-
-        debug("rendering template `%s` to file `%s`", template, output)
-        stream = self.j2env.get_template(template).stream(data)
-        stream.dump(output, encoding="utf-8")
-
-    def render_auto(self):
-        """
-        Render all *.j2 templates with default values and write the output to
-        files without the .j2 extensions.
-        """
-        templates = [
-            str(filepath.relative_to(self.directory))
-            for filepath in self.directory.rglob("*.j2")
-        ]
-        for template in templates:
-            self.render(template[:-3])
@@ -314,15 +314,6 @@ zone "unfresh-sigs.autosign" {
 	dnssec-policy "autosign";
 };

-/*
- * Zone that has missing key files.
- */
-zone "keyfiles-missing.autosign" {
-	type primary;
-	file "keyfiles-missing.autosign.db";
-	dnssec-policy "autosign";
-};
-
 /*
 * Zone that has missing private KSK.
 */
@@ -129,19 +129,15 @@ $KEYGEN -G -k rsasha256 -l policies/kasp.conf $zone >keygen.out.$zone.2 2>&1

 zone="multisigner-model2.kasp"
 echo_i "setting up zone: $zone"
-KSK=$($KEYGEN -a $DEFAULT_ALGORITHM -f KSK -L 3600 -M 32768:65535 $zone 2>keygen.out.$zone.1)
-ZSK=$($KEYGEN -a $DEFAULT_ALGORITHM -L 3600 $zone -M 32768:65535 2>keygen.out.$zone.2)
-cat "${KSK}.key" | grep -v ";.*" >>"${zone}.db"
-cat "${ZSK}.key" | grep -v ";.*" >>"${zone}.db"
 # Import the ZSK sets of the other providers into their DNSKEY RRset.
-# ZSK1 is from a different provider and is added to the unsigned zonefile.
-# ZSK2 is also from a different provider and is added with a Dynamic Update.
-ZSK1=$($KEYGEN -K ../ -a $DEFAULT_ALGORITHM -L 3600 -M 0:32767 $zone 2>keygen.out.$zone.3)
-ZSK2=$($KEYGEN -K ../ -a $DEFAULT_ALGORITHM -L 3600 -M 0:32767 $zone 2>keygen.out.$zone.4)
+ZSK1=$($KEYGEN -K ../ -a $DEFAULT_ALGORITHM -L 3600 -M 0:32767 $zone 2>keygen.out.$zone.1)
+ZSK2=$($KEYGEN -K ../ -a $DEFAULT_ALGORITHM -L 3600 -M 0:32767 $zone 2>keygen.out.$zone.2)
+# ZSK1 will be added to the unsigned zonefile.
 cat "../${ZSK1}.key" | grep -v ";.*" >>"${zone}.db"
 cat "../${ZSK1}.key" | grep -v ";.*" >"${zone}.zsk1"
-cat "../${ZSK2}.key" | grep -v ";.*" >"${zone}.zsk2"
 rm -f "../${ZSK1}.*"
+# ZSK2 will be used with a Dynamic Update.
+cat "../${ZSK2}.key" | grep -v ";.*" >"${zone}.zsk2"
 rm -f "../${ZSK2}.*"

 zone="rumoured.kasp"
@@ -182,12 +178,11 @@ $SIGNER -PS -x -o $zone -O raw -f "${zonefile}.signed" $infile >signer.out.$zone
 setup dynamic-signed-inline-signing.kasp
 T="now-1d"
 csktimes="-P $T -A $T -P sync $T"
-CSK=$($KEYGEN -K keys -a $DEFAULT_ALGORITHM -L 3600 -f KSK $csktimes $zone 2>keygen.out.$zone.1)
-$SETTIME -s -g $O -d $O $T -k $O $T -z $O $T -r $O $T "keys/$CSK" >settime.out.$zone.1 2>&1
-cat template.db.in "keys/${CSK}.key" >"$infile"
-private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "keys/$CSK" >>"$infile"
+CSK=$($KEYGEN -a $DEFAULT_ALGORITHM -L 3600 -f KSK $csktimes $zone 2>keygen.out.$zone.1)
+$SETTIME -s -g $O -d $O $T -k $O $T -z $O $T -r $O $T "$CSK" >settime.out.$zone.1 2>&1
+cat template.db.in "${CSK}.key" >"$infile"
 cp $infile $zonefile
-$SIGNER -PS -K keys -z -x -s now-2w -e now-1mi -o $zone -f "${zonefile}.signed" $infile >signer.out.$zone.1 2>&1
+$SIGNER -PS -z -x -s now-2w -e now-1mi -o $zone -f "${zonefile}.signed" $infile >signer.out.$zone.1 2>&1

 # We are changing an existing single-signed zone to multi-signed
 # zone where the key tags do not match the dnssec-policy key tag range
@@ -291,22 +286,6 @@ echo "ZSK: yes" >>"${ZSK}".state
 echo "Lifetime: 31536000" >>"${ZSK}".state # PT1Y
 rm -f "${ZSK}".private

-# These signatures are still good, but the key files will be removed
-# before a second run of reconfiguring keys.
-setup keyfiles-missing.autosign
-T="now-6mo"
-ksktimes="-P $T -A $T -P sync $T"
-zsktimes="-P $T -A $T"
-KSK=$($KEYGEN -a $DEFAULT_ALGORITHM -L 300 -f KSK $ksktimes $zone 2>keygen.out.$zone.1)
-ZSK=$($KEYGEN -a $DEFAULT_ALGORITHM -L 300 $zsktimes $zone 2>keygen.out.$zone.2)
-$SETTIME -s -g $O -d $O $T -k $O $T -r $O $T "$KSK" >settime.out.$zone.1 2>&1
-$SETTIME -s -g $O -k $O $T -z $O $T "$ZSK" >settime.out.$zone.2 2>&1
-cat template.db.in "${KSK}.key" "${ZSK}.key" >"$infile"
-private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$KSK" >>"$infile"
-private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$ZSK" >>"$infile"
-cp $infile $zonefile
-$SIGNER -S -x -s now-1w -e now+1w -o $zone -O raw -f "${zonefile}.signed" $infile >signer.out.$zone.1 2>&1
-
 # These signatures are already expired, and the private ZSK is retired.
 setup zsk-retired.autosign
 T="now-6mo"
@@ -322,12 +301,6 @@ private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$ZSK" >>"$infile"
 cp $infile $zonefile
 $SIGNER -PS -x -s now-2w -e now-1mi -o $zone -O raw -f "${zonefile}.signed" $infile >signer.out.$zone.1 2>&1
 $SETTIME -s -g HIDDEN "$ZSK" >settime.out.$zone.3 2>&1
-# An old key that is being purged should not prevent keymgr to be run.
-T1="now-1y"
-T2="now-2y"
-oldtimes="-P $T2 -A $T2 -I $T1 -D $T1"
-OLD=$($KEYGEN -a $DEFAULT_ALGORITHM -L 300 $oldtimes $zone 2>keygen.out.$zone.3)
-$SETTIME -s -g $H -k $H $T1 -z $H $T1 "$OLD" >settime.out.$zone.3 2>&1

 #
 # The zones at enable-dnssec.autosign represent the various steps of the
@@ -318,7 +318,7 @@ state_stat=$(key_get KEY1 STATE_STAT)

 nextpart $DIR/named.run >/dev/null
 rndccmd 10.53.0.3 loadkeys "$ZONE" >/dev/null || log_error "rndc loadkeys zone ${ZONE} failed"
-wait_for_log 3 "keymgr: $ZONE done" $DIR/named.run || ret=1
+wait_for_log 3 "keymgr: $ZONE done" $DIR/named.run
 privkey_stat2=$(key_stat "${basefile}.private")
 pubkey_stat2=$(key_stat "${basefile}.key")
 state_stat2=$(key_stat "${basefile}.state")
@@ -334,7 +334,7 @@ ret=0

 nextpart $DIR/named.run >/dev/null
 rndccmd 10.53.0.3 loadkeys "$ZONE" >/dev/null || log_error "rndc loadkeys zone ${ZONE} failed"
-wait_for_log 3 "keymgr: $ZONE done" $DIR/named.run || ret=1
+wait_for_log 3 "keymgr: $ZONE done" $DIR/named.run
 privkey_stat2=$(key_stat "${basefile}.private")
 pubkey_stat2=$(key_stat "${basefile}.key")
 state_stat2=$(key_stat "${basefile}.state")
@@ -385,7 +385,7 @@ echo_i "test that if private key files are inaccessible this doesn't trigger a r
 basefile=$(key_get KEY1 BASEFILE)
 mv "${basefile}.private" "${basefile}.offline"
 rndccmd 10.53.0.3 loadkeys "$ZONE" >/dev/null || log_error "rndc loadkeys zone ${ZONE} failed"
-wait_for_log 3 "zone $ZONE/IN (signed): zone_rekey:zone_verifykeys failed: some key files are missing" $DIR/named.run || ret=1
+wait_for_log 3 "offline, policy default" $DIR/named.run || ret=1
 mv "${basefile}.offline" "${basefile}.private"
 test "$ret" -eq 0 || echo_i "failed"
 status=$((status + ret))
@@ -1647,15 +1647,6 @@ check_subdomain
 dnssec_verify
 check_rrsig_refresh

-# Load again, make sure the purged key is not an issue when verifying keys.
-echo_i "load keys for $ZONE, making sure a recently purged key is not an issue when verifying keys ($n)"
-ret=0
-rndccmd 10.53.0.3 loadkeys "$ZONE" >/dev/null || log_error "rndc loadkeys zone ${ZONE} failed"
-wait_for_log 3 "keymgr: $ZONE done" $DIR/named.run || ret=1
-grep "zone $ZONE/IN (signed): zone_rekey:zone_verifykeys failed: some key files are missing" $DIR/named.run && ret=1
-test "$ret" -eq 0 || echo_i "failed"
-status=$((status + ret))
-
 #
 # Zone: legacy-keys.kasp.
 #
@@ -1752,68 +1743,6 @@ check_apex
 check_subdomain
 dnssec_verify

-#
-# Zone: keyfiles-missing.autosign.
-#
-set_zone "keyfiles-missing.autosign"
-set_policy "autosign" "2" "300"
-set_server "ns3" "10.53.0.3"
-# Key properties.
-key_clear "KEY1"
-set_keyrole "KEY1" "ksk"
-set_keylifetime "KEY1" "63072000"
-set_keyalgorithm "KEY1" "$DEFAULT_ALGORITHM_NUMBER" "$DEFAULT_ALGORITHM" "$DEFAULT_BITS"
-set_keysigning "KEY1" "yes"
-set_zonesigning "KEY1" "no"
-
-key_clear "KEY2"
-set_keyrole "KEY2" "zsk"
-set_keylifetime "KEY2" "31536000"
-set_keyalgorithm "KEY2" "$DEFAULT_ALGORITHM_NUMBER" "$DEFAULT_ALGORITHM" "$DEFAULT_BITS"
-set_keysigning "KEY2" "no"
-set_zonesigning "KEY2" "yes"
-
-# Both KSK and ZSK stay OMNIPRESENT.
-set_keystate "KEY1" "GOAL" "omnipresent"
-set_keystate "KEY1" "STATE_DNSKEY" "omnipresent"
-set_keystate "KEY1" "STATE_KRRSIG" "omnipresent"
-set_keystate "KEY1" "STATE_DS" "omnipresent"
-
-set_keystate "KEY2" "GOAL" "omnipresent"
-set_keystate "KEY2" "STATE_DNSKEY" "omnipresent"
-set_keystate "KEY2" "STATE_ZRRSIG" "omnipresent"
-
-check_keys
-check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
-set_keytimes_autosign_policy
-check_keytimes
-check_apex
-check_subdomain
-dnssec_verify
-# All good, now remove key files and reload keys.
-rm_keyfiles() {
-  _basefile=$(key_get "$1" BASEFILE)
-  echo_i "remove key files $_basefile"
-  _keyfile="${_basefile}.key"
-  _privatefile="${_basefile}.private"
-  _statefile="${_basefile}.state"
-  rm -f $_keyfile
-  rm -f $_privatefile
-  rm -f $_statefile
-}
-rm_keyfiles "KEY1"
-rm_keyfiles "KEY2"
-
-rndccmd 10.53.0.3 loadkeys "$ZONE" >/dev/null || log_error "rndc loadkeys zone ${ZONE} failed"
-wait_for_log 3 "zone $ZONE/IN (signed): zone_rekey:zone_verifykeys failed: some key files are missing" $DIR/named.run || ret=1
-# Check keys again, make sure no new keys are created.
-set_policy "autosign" "0" "300"
-key_clear "KEY1"
-key_clear "KEY2"
-check_keys
-# Zone is still signed correctly.
-dnssec_verify
-
 #
 # Test dnssec-policy inheritance.
 #
@@ -2201,23 +2130,16 @@ check_apex
 check_subdomain
 dnssec_verify

-# Check that the ZSKs from the other providers are published.
+# Check that the ZSKs from the other provider are published.
 zsks_are_published() {
-  num=$1
  dig_with_opts +short "$ZONE" "@${SERVER}" DNSKEY >"dig.out.$DIR.test$n" || return 1
  # We should have three ZSKs.
  lines=$(grep "256 3 13" dig.out.$DIR.test$n | wc -l)
-  test "$lines" -eq $num || return 1
+  test "$lines" -eq 3 || return 1
  # And one KSK.
  lines=$(grep "257 3 13" dig.out.$DIR.test$n | wc -l)
  test "$lines" -eq 1 || return 1
 }
-n=$((n + 1))
-echo_i "check initial number of ZSKs (one from us and one from another provider) for zone ${ZONE} ($n)"
-ret=0
-retry_quiet 10 zsks_are_published 2 || ret=1
-test "$ret" -eq 0 || echo_i "failed"
-status=$((status + ret))

 n=$((n + 1))
 echo_i "update zone with ZSK from another provider for zone ${ZONE} ($n)"
@@ -2228,21 +2150,7 @@ ret=0
  echo update add $(cat "${DIR}/${ZONE}.zsk2")
  echo send
 ) | $NSUPDATE
-retry_quiet 10 zsks_are_published 3 || ret=1
-test "$ret" -eq 0 || echo_i "failed"
-status=$((status + ret))
-
-n=$((n + 1))
-echo_i "remove ZSKs from the other providers for zone ${ZONE} ($n)"
-ret=0
-(
-  echo zone ${ZONE}
-  echo server 10.53.0.3 "$PORT"
-  echo update del $(cat "${DIR}/${ZONE}.zsk1")
-  echo update del $(cat "${DIR}/${ZONE}.zsk2")
-  echo send
-) | $NSUPDATE
-retry_quiet 10 zsks_are_published 1 || ret=1
+retry_quiet 10 zsks_are_published || ret=1
 test "$ret" -eq 0 || echo_i "failed"
 status=$((status + ret))

@@ -2504,10 +2412,10 @@ _check_next_key_event() {

  # Get the latest next key event.
  if [ "${DYNAMIC}" = "yes" ]; then
-    _time=$(awk '{print $8}' <"keyevent.out.$ZONE.test$n" | tail -1)
+    _time=$(awk '{print $9}' <"keyevent.out.$ZONE.test$n" | tail -1)
  else
    # inline-signing zone adds "(signed)"
-    _time=$(awk '{print $9}' <"keyevent.out.$ZONE.test$n" | tail -1)
+    _time=$(awk '{print $10}' <"keyevent.out.$ZONE.test$n" | tail -1)
  fi

  # The next key event time must within threshold of the
@@ -5291,7 +5199,7 @@ dig_with_opts @10.53.0.6 example SOA >dig.out.ns6.test$n.soa1 || ret=1
 cp ns6/example2.db.in ns6/example.db || ret=1
 nextpart ns6/named.run >/dev/null
 rndccmd 10.53.0.6 reload || ret=1
-wait_for_log 3 "all zones loaded" ns6/named.run || ret=1
+wait_for_log 3 "all zones loaded" ns6/named.run
 # Check that the SOA SERIAL increases and check the TTLs (should be 300 as
 # defined in ns6/example2.db.in).
 retry_quiet 10 _check_soa_ttl 300 300 || ret=1
@@ -5309,7 +5217,7 @@ cp ns6/example3.db.in ns6/example.db || ret=1
 rm ns6/example.db.jnl
 nextpart ns6/named.run >/dev/null
 start_server --noclean --restart --port ${PORT} ns6
-wait_for_log 3 "all zones loaded" ns6/named.run || ret=1
+wait_for_log 3 "all zones loaded" ns6/named.run
 # Check that the SOA SERIAL increases and check the TTLs (should be changed
 # from 300 to 400 as defined in ns6/example3.db.in).
 retry_quiet 10 _check_soa_ttl 300 400 || ret=1
@@ -25,7 +25,7 @@ echo_i "checking that dig handles TCP keepalive ($n)"
 ret=0
 n=$((n + 1))
 $DIG $DIGOPTS +qr +keepalive foo.example @10.53.0.2 >dig.out.test$n || ret=1
-grep "; TCP-KEEPALIVE" dig.out.test$n >/dev/null || ret=1
+grep "; TCP KEEPALIVE" dig.out.test$n >/dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status + ret))

@@ -41,7 +41,7 @@ echo_i "checking that TCP keepalive is added for TCP responses ($n)"
 ret=0
 n=$((n + 1))
 $DIG $DIGOPTS +vc +keepalive foo.example @10.53.0.2 >dig.out.test$n || ret=1
-grep "; TCP-KEEPALIVE" dig.out.test$n >/dev/null || ret=1
+grep "; TCP KEEPALIVE" dig.out.test$n >/dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status + ret))

@@ -49,7 +49,7 @@ echo_i "checking that TCP keepalive requires TCP ($n)"
 ret=0
 n=$((n + 1))
 $DIG $DIGOPTS +keepalive foo.example @10.53.0.2 >dig.out.test$n || ret=1
-grep "; TCP-KEEPALIVE" dig.out.test$n >/dev/null && ret=1
+grep "; TCP KEEPALIVE" dig.out.test$n >/dev/null && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status + ret))

@@ -57,7 +57,7 @@ echo_i "checking default value ($n)"
 ret=0
 n=$((n + 1))
 $DIG $DIGOPTS +vc +keepalive foo.example @10.53.0.3 >dig.out.test$n || ret=1
-grep "; TCP-KEEPALIVE: 30.0 secs" dig.out.test$n >/dev/null || ret=1
+grep "; TCP KEEPALIVE: 30.0 secs" dig.out.test$n >/dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status + ret))

@@ -65,7 +65,7 @@ echo_i "checking configured value ($n)"
 ret=0
 n=$((n + 1))
 $DIG $DIGOPTS +vc +keepalive foo.example @10.53.0.2 >dig.out.test$n || ret=1
-grep "; TCP-KEEPALIVE: 15.0 secs" dig.out.test$n >/dev/null || ret=1
+grep "; TCP KEEPALIVE: 15.0 secs" dig.out.test$n >/dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status + ret))

@@ -75,7 +75,7 @@ n=$((n + 1))
 $RNDCCMD tcp-timeouts 300 300 300 200 >output
 diff -b output expected || ret=1
 $DIG $DIGOPTS +vc +keepalive foo.example @10.53.0.2 >dig.out.test$n || ret=1
-grep "; TCP-KEEPALIVE: 20.0 secs" dig.out.test$n >/dev/null || ret=1
+grep "; TCP KEEPALIVE: 20.0 secs" dig.out.test$n >/dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status + ret))

@@ -0,0 +1,38 @@
+#!/bin/sh
+
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+set -e
+
+rm -f ./*.ksk*
+rm -f ./*.zsk*
+rm -f ./created.out
+rm -f ./footer.*
+rm -f ./now.out
+rm -f ./ns1/*.db
+rm -f ./ns1/*.db.jbk
+rm -f ./ns1/*.db.signed
+rm -f ./ns1/*.db.signed.jnl
+rm -f ./ns1/K*
+rm -f ./ns1/keygen.out.*
+rm -f ./ns1/named.conf
+rm -f ./ns1/named.memstats
+rm -f ./ns1/named.run
+rm -f ./python.out
+rm -f ./settime.out.*
+rm -f ./ksr.*.err.*
+rm -f ./ksr.*.expect
+rm -f ./ksr.*.expect.*
+rm -f ./ksr.*.out.*
+
+rm -rf ./ns1/keydir
+rm -rf ./ns1/offline
@@ -79,17 +79,9 @@ dnssec-policy "no-cds" {
 dnssec-policy "two-tone" {
 	offline-ksk yes;
 	keys {
-		ksk lifetime unlimited algorithm @ALTERNATIVE_ALGORITHM@;
-		zsk lifetime P5M algorithm @ALTERNATIVE_ALGORITHM@;
 		ksk lifetime unlimited algorithm @DEFAULT_ALGORITHM@;
+		ksk lifetime unlimited algorithm @ALTERNATIVE_ALGORITHM@;
 		zsk lifetime P3M algorithm @DEFAULT_ALGORITHM@;
-	};
-};
-
-dnssec-policy "ksk-roll" {
-	offline-ksk yes;
-	keys {
-		ksk lifetime P6M algorithm @DEFAULT_ALGORITHM@;
-		zsk lifetime unlimited algorithm @DEFAULT_ALGORITHM@;
+		zsk lifetime P5M algorithm @ALTERNATIVE_ALGORITHM@;
 	};
 };
@@ -24,6 +24,24 @@ cp template.db.in past.test.db
 cp template.db.in future.test.db
 cp template.db.in last-bundle.test.db
 cp template.db.in in-the-middle.test.db
-cp template.db.in unlimited.test.db
-cp template.db.in two-tone.test.db
-cp template.db.in ksk-roll.test.db
+
+# Create KSK for the various policies.
+create_ksk() {
+  KSK=$($KEYGEN -l named.conf -fK -k $2 $1 2>keygen.out.$1)
+  num=0
+  for ksk in $KSK; do
+    num=$(($num + 1))
+    echo $ksk >"../${1}.ksk${num}.id"
+    cat "${ksk}.key" | grep -v ";.*" >"../$1.ksk$num"
+    mv "${ksk}.key" offline/
+    mv "${ksk}.private" offline/
+    mv "${ksk}.state" offline/
+  done
+}
+create_ksk common.test common
+create_ksk past.test common
+create_ksk future.test common
+create_ksk last-bundle.test common
+create_ksk in-the-middle.test common
+create_ksk unlimited.test unlimited
+create_ksk two-tone.test two-tone
@@ -16,6 +16,8 @@

 set -e

+$SHELL clean.sh
+
 copy_setports ns1/named.conf.in ns1/named.conf

 (
@@ -0,0 +1,14 @@
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+
+def test_ksr(run_tests_sh):
+    run_tests_sh()
@@ -733,7 +733,7 @@ echo_i "check that trust-anchor-telemetry queries contain the correct key ($n)"
 ret=0
 # convert the hexadecimal key from the TAT query into decimal and
 # compare against the known key.
-tathex=$(grep "query '_ta-[0-9a-f][0-9a-f]*/NULL/IN' approved" ns1/named.run | awk '{print $5; exit 0}' | sed -e 's/(_ta-\([0-9a-f][0-9a-f]*\)):/\1/') || true
+tathex=$(grep "query '_ta-[0-9a-f][0-9a-f]*/NULL/IN' approved" ns1/named.run | awk '{print $6; exit 0}' | sed -e 's/(_ta-\([0-9a-f][0-9a-f]*\)):/\1/') || true
 tatkey=$($PERL -e 'printf("%d\n", hex(@ARGV[0]));' "$tathex")
 realkey=$(rndccmd 10.53.0.2 secroots - | sed -n "s#.*${DEFAULT_ALGORITHM}/\([0-9][0-9]*\) ; .*managed.*#\1#p")
 [ "$tatkey" -eq "$realkey" ] || ret=1
@@ -1,5 +0,0 @@
-# temporary files generated by "openssl ca"
-/CA/*.old
-# there is little point in keeping the certificate requests
-# for the issued certificates
-/CA/certs/*.csr
@@ -1,77 +0,0 @@
-# See ../../doth/CA/ca.cfg for more information
-
-# certificate authority configuration
-[ca]
-default_ca      = CA_default               # The default ca section
-
-[CA_default]
-dir            = .
-new_certs_dir  = $dir/newcerts         # new certs dir (must be created)
-certificate    = $dir/CA.pem           # The CA cert
-private_key    = $dir/private/CA.key   # CA private key
-
-serial         = $dir/serial           # serial number file for the next certificate
-                                       # Update before issuing it:
-                                       # xxd -l 8 -u -ps /dev/urandom > ./serial
-database = $dir/index.txt                 # (must be created manually: touch ./index.txt)
-
-default_days   = 1                 # how long to certify for
-
-#default_crl_days = 30                 # the number of days before the
-default_crl_days = 10950               # next CRL is due. That is the
-                                       # days from now to place in the
-                                       # CRL nextUpdate field.  If CRL
-                                       # is expired, certificate
-                                       # verifications will fail even
-                                       # for otherwise valid
-                                       # certificates. Clients might
-                                       # cache the CRL, so the expiry
-                                       # period should normally be
-                                       # relatively short (default:
-                                       # 30) for production CAs.
-
-default_md     = sha256                # digest to use
-
-policy         = policy_default        # default policy
-email_in_dn    = no                    # Don't add the email into cert DN
-
-name_opt       = ca_default            # Subject name display option
-cert_opt       = ca_default            # Certificate display option
-
-# We need the following in order to copy Subject Alt Name(s) from a
-# request to the certificate.
-copy_extensions = copy                 # copy extensions from request
-
-[policy_default]
-countryName            = optional
-stateOrProvinceName    = optional
-organizationalUnitName = optional
-commonName             = supplied
-emailAddress           = optional
-
-# default certificate requests settings
-[req]
-# Options for the `req` tool (`man req`).
-default_bits        = 3072 # for RSA only
-distinguished_name  = req_default
-string_mask         = utf8only
-# SHA-1 is deprecated, so use SHA-256 instead.
-default_md          = sha256
-# do not encrypt the private key file
-encrypt_key         = no
-
-[req_default]
-# See <https://en.wikipedia.org/wiki/Certificate_signing_request>.
-countryName                     = Country Name (2 letter code)
-stateOrProvinceName             = State or Province Name (full name)
-localityName                    = Locality Name (e.g., city)
-0.organizationName              = Organization Name (e.g., company)
-organizationalUnitName          = Organizational Unit Name (e.g. department)
-commonName                      = Common Name (e.g. server FQDN or YOUR name)
-emailAddress                    = Email Address
-# defaults
-countryName_default                     = UA
-stateOrProvinceName_default             = Kharkiv Oblast
-localityName_default                    = Kharkiv
-0.organizationName_default              = ISC
-organizationalUnitName_default          = Software Engeneering (BIND 9)
@@ -1,29 +0,0 @@
-----BEGIN CERTIFICATE-----
-MIIE3TCCA0WgAwIBAgIUeZPKrvbGEBZaRc2jNczlIsJXyPYwDQYJKoZIhvcNAQEL
-BQAwfTELMAkGA1UEBhMCVUExGDAWBgNVBAgMD0toYXJraXYgT2JsYXN0JzEQMA4G
-A1UEBwwHS2hhcmtpdjEkMCIGA1UECgwbSW50ZXJuZXQgU3lzdGVtcyBDb25zb3J0
-aXVtMRwwGgYDVQQDDBNjYS50ZXN0LmV4YW1wbGUuY29tMCAXDTIyMDEyNDEyNDA1
-NFoYDzIwNTIwMTE3MTI0MDU0WjB9MQswCQYDVQQGEwJVQTEYMBYGA1UECAwPS2hh
-cmtpdiBPYmxhc3QnMRAwDgYDVQQHDAdLaGFya2l2MSQwIgYDVQQKDBtJbnRlcm5l
-dCBTeXN0ZW1zIENvbnNvcnRpdW0xHDAaBgNVBAMME2NhLnRlc3QuZXhhbXBsZS5j
-b20wggGiMA0GCSqGSIb3DQEBAQUAA4IBjwAwggGKAoIBgQCi6hEegBzpUKbE1NTo
-Z7uz7EMUY7TBckkiw/7ydTLKNa8YI4JpBguFvWQsDY0dGFJIoVwyHyNx3seW/LoI
-B5zWPZ2xbOvLLceA+t2NZpbc98E7jUOVS123yED+nqlfZjCq9Zt0r/ezwnQtjnFF
-ko1mcU4H9Jvg8aIgnU2AxE78zciU9CY8799pFFNThIjbooI8oVbfjbzbpmLzxjA5
-3rDmZBTh+ySTlMa2U2oT4WPjRltZWnJVegRRLpG95GnTbQ1fkJAbj1Iu10XTkCee
-wBOqaA1UJem0a6pby5odE414Y7c0ETKcmaJtYENQyO0IJwZWDKtVe5OTIAklakia
-eyFTCAw1h5tHCYLaJW/Yu2wlLl5RNQcRZ9+cWXnldTY+TI1iBjfmADjLdKJYUlhX
-z7kWJtTi63Sdv6WYcEXxaWpxT+R3e2kaR/R7GOo4gdkWpX1siGlRteHHH2/36CSQ
-ZD2etcTUpGW+KDHFR4grnEfL1rt9UgvCjpa4KcssmZtWSSUCAwEAAaNTMFEwHQYD
-VR0OBBYEFHyJ6Fzr5R9ySATFj/uSCJz1YCY5MB8GA1UdIwQYMBaAFHyJ6Fzr5R9y
-SATFj/uSCJz1YCY5MA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggGB
-AF3y0hvzyZWtmuG1JwIcOcc1aPl1KdRy8bao/5iHYGYYrsdDgcO5/e+y9S/izalc
-TdW7SKB5iBOCiE8fBNtToCvGP+fxNxHijpAmTr37G5sWuSo1T1VYFizHWL+df/Ig
-TcSvDrEjSnAwaEdNJUWtjoIC4VzNKTLtZf16QIATTzTZa3bfgSetpWS7LhLQbHod
-CSGI2QB1LRbqGC+a1Y85QxHv81jWzPWPzXYvnOLrDdQyBMOBcxDzrN4b6zg+5Itz
-qGYt+IS71jAH0IhxAyD/U5n1jGJv02BnSq0ynLEOD6gsnZjqAwPbt/PM9pGbtbXO
-70Q9rxr+vQc1IISKAEiH3txaEPi10wU98d6LbInJvQrmgHo/ntet8skWNYuxlEzS
-wvynuE9KvvQtOTodWt5AePtKrhHdxu527a4CHVp59nYUjKSdMKjvmhMRXM1cNjFE
-rA/pyyhozR47w3RzHMJVHw2GJ2B/HeqmxpXr1CmJjoRP38QCR7N+mqiZy85Fq2j2
-8Q==
-----END CERTIFICATE-----
@@ -1,2 +0,0 @@
-Please take a look at the contents of the CA.cfg file for further
-instructions and configurations options.
@@ -1,6 +0,0 @@
-----BEGIN PRIVATE KEY-----
-MIG2AgEAMBAGByqGSM49AgEGBSuBBAAiBIGeMIGbAgEBBDBbu3hxycrhJ+msVeQ0
-mNB/WkW7rxNr8Zi8iXLETgBJ40cJu0d/IA4jrJ4gvfwT82uhZANiAAT+AGZM20R/
-AnlbmJOoZ4qHWgcPhEDIZ3+5rzIYpyL67adW2henRZ2s/ULMi/v/OpLYfuT8f1Ro
-RHxhJUK0kpu1yx1R0mEI94kimw2Ocpnf2VHIksml+D8tEek0h0lczC0=
-----END PRIVATE KEY-----
@@ -1,76 +0,0 @@
-Certificate:
-    Data:
-        Version: 3 (0x2)
-        Serial Number:
-            c5:86:68:39:7b:1c:c4:a2
-        Signature Algorithm: sha256WithRSAEncryption
-        Issuer: C=UA, ST=Kharkiv Oblast', L=Kharkiv, O=Internet Systems Consortium, CN=ca.test.example.com
-        Validity
-            Not Before: Sep 17 16:18:18 2024 GMT
-            Not After : Sep 18 16:18:18 2024 GMT
-        Subject: CN=srv02.crt01-expired.example.com
-        Subject Public Key Info:
-            Public Key Algorithm: id-ecPublicKey
-                Public-Key: (384 bit)
-                pub:
-                    04:fe:00:66:4c:db:44:7f:02:79:5b:98:93:a8:67:
-                    8a:87:5a:07:0f:84:40:c8:67:7f:b9:af:32:18:a7:
-                    22:fa:ed:a7:56:da:17:a7:45:9d:ac:fd:42:cc:8b:
-                    fb:ff:3a:92:d8:7e:e4:fc:7f:54:68:44:7c:61:25:
-                    42:b4:92:9b:b5:cb:1d:51:d2:61:08:f7:89:22:9b:
-                    0d:8e:72:99:df:d9:51:c8:92:c9:a5:f8:3f:2d:11:
-                    e9:34:87:49:5c:cc:2d
-                ASN1 OID: secp384r1
-                NIST CURVE: P-384
-        X509v3 extensions:
-            X509v3 Subject Alternative Name:
-                DNS:srv02.crt01-expired.example.com, IP Address:10.53.0.2
-            X509v3 Subject Key Identifier:
-                03:4C:AC:DE:C0:A3:EB:04:56:1C:10:47:EB:C9:4D:1A:5F:FD:8E:A1
-            X509v3 Authority Key Identifier:
-                7C:89:E8:5C:EB:E5:1F:72:48:04:C5:8F:FB:92:08:9C:F5:60:26:39
-    Signature Algorithm: sha256WithRSAEncryption
-    Signature Value:
-        25:33:d0:30:6e:60:5e:f3:29:e7:1d:36:83:4d:cd:06:d2:35:
-        df:80:76:25:e5:56:c6:e7:5f:cb:70:c8:30:da:a1:15:50:1b:
-        5d:e0:7b:01:60:47:32:ee:ea:98:cd:27:c2:2e:b8:d5:4a:2f:
-        76:7b:f1:0d:ff:c3:b3:74:f9:98:37:c1:07:85:04:55:8f:42:
-        25:b7:21:03:50:83:50:01:6a:88:84:bc:83:2c:48:3f:e5:96:
-        04:d7:b5:56:68:7c:fe:d9:06:e2:bc:f0:fd:47:fd:4b:4c:9b:
-        15:ca:ab:10:e4:8d:8f:b5:f7:dd:69:8c:9d:06:00:8f:80:5b:
-        30:a6:6c:31:d2:b8:4b:cf:10:2a:bf:64:fb:be:da:3f:e2:ee:
-        f1:6c:74:02:a7:c5:0c:e2:13:f1:54:63:a9:45:43:7b:b7:85:
-        a3:48:00:62:34:db:ac:a1:b6:b8:76:b9:d9:aa:17:a2:f9:0b:
-        96:87:ad:da:5e:95:50:2b:73:17:d7:2c:d0:43:40:e3:e9:80:
-        e2:87:be:1d:65:68:17:0d:90:98:0a:9b:6d:4f:2d:91:3e:f0:
-        16:4e:c0:c3:e7:a9:a6:e8:bf:8e:b6:d0:3b:72:e6:d9:9a:b3:
-        70:82:23:c1:02:c2:cc:91:d7:75:19:3c:79:33:ea:86:8d:80:
-        9a:6b:f2:93:b4:dc:22:19:11:82:3d:62:1d:e5:58:58:7f:50:
-        84:b0:d4:5a:67:be:d0:28:b0:be:a1:7f:9d:1b:a2:98:9b:70:
-        5a:c0:a8:c5:03:ec:de:8a:e2:ea:03:2d:4e:9f:6c:7d:d8:0e:
-        41:3c:58:df:3f:1e:4f:69:04:68:54:59:58:ef:dd:e3:32:b3:
-        2c:b4:cc:40:28:eb:3e:3b:37:fd:42:f7:d9:60:bf:fa:6d:87:
-        ca:ed:43:24:93:47:a8:bc:54:cc:c9:4d:ac:d0:b8:09:cb:85:
-        c3:02:55:73:bf:f0:ff:a3:fc:d2:d1:ae:ea:5a:96:6a:76:51:
-        fb:da:d9:ad:e4:cd
-----BEGIN CERTIFICATE-----
-MIIDcDCCAdigAwIBAgIJAMWGaDl7HMSiMA0GCSqGSIb3DQEBCwUAMH0xCzAJBgNV
-BAYTAlVBMRgwFgYDVQQIDA9LaGFya2l2IE9ibGFzdCcxEDAOBgNVBAcMB0toYXJr
-aXYxJDAiBgNVBAoMG0ludGVybmV0IFN5c3RlbXMgQ29uc29ydGl1bTEcMBoGA1UE
-AwwTY2EudGVzdC5leGFtcGxlLmNvbTAeFw0yNDA5MTcxNjE4MThaFw0yNDA5MTgx
-NjE4MThaMCoxKDAmBgNVBAMMH3NydjAyLmNydDAxLWV4cGlyZWQuZXhhbXBsZS5j
-b20wdjAQBgcqhkjOPQIBBgUrgQQAIgNiAAT+AGZM20R/AnlbmJOoZ4qHWgcPhEDI
-Z3+5rzIYpyL67adW2henRZ2s/ULMi/v/OpLYfuT8f1RoRHxhJUK0kpu1yx1R0mEI
-94kimw2Ocpnf2VHIksml+D8tEek0h0lczC2jdDByMDAGA1UdEQQpMCeCH3NydjAy
-LmNydDAxLWV4cGlyZWQuZXhhbXBsZS5jb22HBAo1AAIwHQYDVR0OBBYEFANMrN7A
-o+sEVhwQR+vJTRpf/Y6hMB8GA1UdIwQYMBaAFHyJ6Fzr5R9ySATFj/uSCJz1YCY5
-MA0GCSqGSIb3DQEBCwUAA4IBgQAlM9AwbmBe8ynnHTaDTc0G0jXfgHYl5VbG51/L
-cMgw2qEVUBtd4HsBYEcy7uqYzSfCLrjVSi92e/EN/8OzdPmYN8EHhQRVj0IltyED
-UINQAWqIhLyDLEg/5ZYE17VWaHz+2QbivPD9R/1LTJsVyqsQ5I2PtffdaYydBgCP
-gFswpmwx0rhLzxAqv2T7vto/4u7xbHQCp8UM4hPxVGOpRUN7t4WjSABiNNusoba4
-drnZqhei+QuWh63aXpVQK3MX1yzQQ0Dj6YDih74dZWgXDZCYCpttTy2RPvAWTsDD
-56mm6L+OttA7cubZmrNwgiPBAsLMkdd1GTx5M+qGjYCaa/KTtNwiGRGCPWId5VhY
-f1CEsNRaZ77QKLC+oX+dG6KYm3BawKjFA+zeiuLqAy1On2x92A5BPFjfPx5PaQRo
-VFlY793jMrMstMxAKOs+Ozf9QvfZYL/6bYfK7UMkk0eovFTMyU2s0LgJy4XDAlVz
-v/D/o/zS0a7qWpZqdlH72tmt5M0=
-----END CERTIFICATE-----
@@ -1,6 +0,0 @@
-----BEGIN PRIVATE KEY-----
-MIG2AgEAMBAGByqGSM49AgEGBSuBBAAiBIGeMIGbAgEBBDAxARyCz9Aq5XQpE4SV
-IKYvvz2K9IjosWKkcbxjh0rW62RGyi4c3pSo6so8tpvHXzmhZANiAAQ2bCdh34Lt
-hA8MzF7BeZhYfvUODFH3fSSAJuRDMSaO02f294+E2Icy91W9AhFetSceZa0Dhldc
-aVVaPVm3bhhjvLUGFImFmccFtNtQj/llRCbY9VFtbfXaY/Vq5243EAg=
-----END PRIVATE KEY-----
@@ -1,76 +0,0 @@
-Certificate:
-    Data:
-        Version: 3 (0x2)
-        Serial Number:
-            c5:86:68:39:7b:1c:c4:9f
-        Signature Algorithm: sha256WithRSAEncryption
-        Issuer: C=UA, ST=Kharkiv Oblast', L=Kharkiv, O=Internet Systems Consortium, CN=ca.test.example.com
-        Validity
-            Not Before: Sep  3 15:33:14 2024 GMT
-            Not After : Aug 27 15:33:14 2054 GMT
-        Subject: CN=srv02.crt01.example.com
-        Subject Public Key Info:
-            Public Key Algorithm: id-ecPublicKey
-                Public-Key: (384 bit)
-                pub:
-                    04:36:6c:27:61:df:82:ed:84:0f:0c:cc:5e:c1:79:
-                    98:58:7e:f5:0e:0c:51:f7:7d:24:80:26:e4:43:31:
-                    26:8e:d3:67:f6:f7:8f:84:d8:87:32:f7:55:bd:02:
-                    11:5e:b5:27:1e:65:ad:03:86:57:5c:69:55:5a:3d:
-                    59:b7:6e:18:63:bc:b5:06:14:89:85:99:c7:05:b4:
-                    db:50:8f:f9:65:44:26:d8:f5:51:6d:6d:f5:da:63:
-                    f5:6a:e7:6e:37:10:08
-                ASN1 OID: secp384r1
-                NIST CURVE: P-384
-        X509v3 extensions:
-            X509v3 Subject Alternative Name:
-                DNS:srv02.crt01.example.com, IP Address:10.53.0.2
-            X509v3 Subject Key Identifier:
-                4C:A6:2B:5F:55:DF:2E:1E:FA:E8:C6:3F:05:25:20:69:BA:60:3B:E2
-            X509v3 Authority Key Identifier:
-                7C:89:E8:5C:EB:E5:1F:72:48:04:C5:8F:FB:92:08:9C:F5:60:26:39
-    Signature Algorithm: sha256WithRSAEncryption
-    Signature Value:
-        1d:22:c4:60:42:9a:d8:ac:54:cf:77:be:17:d0:eb:b4:7d:44:
-        b1:ad:bf:53:0e:be:61:37:bf:7b:a6:78:7e:a0:3f:aa:21:cd:
-        09:3a:d4:41:b5:9f:31:a2:c9:db:df:94:a4:05:02:dd:98:04:
-        38:55:af:20:3a:4d:82:cd:37:0f:a5:b8:9c:dc:0d:f8:07:c9:
-        9d:8e:0a:4f:df:f1:8d:0c:53:9b:56:a2:35:7e:0a:3d:47:89:
-        ad:76:8f:6c:f5:15:0e:3f:05:af:fb:f8:97:97:a3:91:a6:cf:
-        22:04:c0:35:24:84:b4:e5:4d:c0:bf:e0:8d:8b:59:bf:71:2e:
-        c3:d8:8e:c9:9d:ba:0a:32:cb:0f:b8:b8:e3:91:f9:77:78:55:
-        17:9f:6e:09:d6:29:86:25:b6:0d:9b:52:b7:0a:75:f7:cd:09:
-        5d:04:83:9f:08:8f:eb:8c:23:73:e0:14:2b:be:ba:22:96:8f:
-        68:f8:c7:39:a7:44:9b:1d:ce:cb:eb:04:33:c0:da:b8:03:c0:
-        5b:7a:3c:a1:f5:28:92:93:06:f2:32:c3:38:fe:68:5d:64:21:
-        6e:3f:8b:80:f8:01:8f:19:5c:fa:13:6c:5e:27:55:19:70:87:
-        70:02:80:79:d2:37:d3:d9:05:b1:8e:50:37:24:f0:32:33:bb:
-        e9:f2:26:f8:19:92:d5:ad:2a:09:c1:b0:48:52:f4:e3:62:cd:
-        e1:b4:51:d9:0a:88:e3:fb:1e:c9:5c:a5:83:fe:30:9d:cf:83:
-        22:ba:1a:cd:c9:a9:e0:3d:cc:8d:f7:68:9e:17:a2:36:78:ab:
-        6f:01:de:20:a1:0d:a2:30:12:ee:45:14:b6:f7:c4:e4:d3:4e:
-        c7:0b:d7:14:b2:49:5c:f8:3a:fc:29:43:fa:97:d1:70:46:54:
-        c0:a9:c6:eb:f0:91:59:0e:24:8f:e5:38:79:38:fb:86:ab:3c:
-        b1:ea:d2:a3:4c:2c:e4:29:1a:03:da:54:a0:a6:73:ac:b4:c8:
-        02:5a:4c:38:e0:23
-----BEGIN CERTIFICATE-----
-MIIDYjCCAcqgAwIBAgIJAMWGaDl7HMSfMA0GCSqGSIb3DQEBCwUAMH0xCzAJBgNV
-BAYTAlVBMRgwFgYDVQQIDA9LaGFya2l2IE9ibGFzdCcxEDAOBgNVBAcMB0toYXJr
-aXYxJDAiBgNVBAoMG0ludGVybmV0IFN5c3RlbXMgQ29uc29ydGl1bTEcMBoGA1UE
-AwwTY2EudGVzdC5leGFtcGxlLmNvbTAgFw0yNDA5MDMxNTMzMTRaGA8yMDU0MDgy
-NzE1MzMxNFowIjEgMB4GA1UEAwwXc3J2MDIuY3J0MDEuZXhhbXBsZS5jb20wdjAQ
-BgcqhkjOPQIBBgUrgQQAIgNiAAQ2bCdh34LthA8MzF7BeZhYfvUODFH3fSSAJuRD
-MSaO02f294+E2Icy91W9AhFetSceZa0DhldcaVVaPVm3bhhjvLUGFImFmccFtNtQ
-j/llRCbY9VFtbfXaY/Vq5243EAijbDBqMCgGA1UdEQQhMB+CF3NydjAyLmNydDAx
-LmV4YW1wbGUuY29thwQKNQACMB0GA1UdDgQWBBRMpitfVd8uHvroxj8FJSBpumA7
-4jAfBgNVHSMEGDAWgBR8iehc6+UfckgExY/7kgic9WAmOTANBgkqhkiG9w0BAQsF
-AAOCAYEAHSLEYEKa2KxUz3e+F9DrtH1Esa2/Uw6+YTe/e6Z4fqA/qiHNCTrUQbWf
-MaLJ29+UpAUC3ZgEOFWvIDpNgs03D6W4nNwN+AfJnY4KT9/xjQxTm1aiNX4KPUeJ
-rXaPbPUVDj8Fr/v4l5ejkabPIgTANSSEtOVNwL/gjYtZv3Euw9iOyZ26CjLLD7i4
-45H5d3hVF59uCdYphiW2DZtStwp1980JXQSDnwiP64wjc+AUK766IpaPaPjHOadE
-mx3Oy+sEM8DauAPAW3o8ofUokpMG8jLDOP5oXWQhbj+LgPgBjxlc+hNsXidVGXCH
-cAKAedI309kFsY5QNyTwMjO76fIm+BmS1a0qCcGwSFL042LN4bRR2QqI4/seyVyl
-g/4wnc+DIroazcmp4D3MjfdonheiNnirbwHeIKENojAS7kUUtvfE5NNOxwvXFLJJ
-XPg6/ClD+pfRcEZUwKnG6/CRWQ4kj+U4eTj7hqs8serSo0ws5CkaA9pUoKZzrLTI
-AlpMOOAj
-----END CERTIFICATE-----
@@ -1,6 +0,0 @@
-----BEGIN PRIVATE KEY-----
-MIG2AgEAMBAGByqGSM49AgEGBSuBBAAiBIGeMIGbAgEBBDAEmVA9V00diOvZfEJV
-N7piEbfN7fULRHWg2k4g7V2Ivpn9LfBsaYh5+Acf271G0mKhZANiAAQSbFty27Ro
-RO7BPZFI9yM5V64xIUGMe4o4LYBA6cKhFFCVO0fX6h6bO0wgh2fCgYbWOq2X6Q1X
-/x36gVJCzgXSBXPNktdMIxki9cttREvXo1cmELKl/n+PXDgxcbg/RbM=
-----END PRIVATE KEY-----
@@ -1,76 +0,0 @@
-Certificate:
-    Data:
-        Version: 3 (0x2)
-        Serial Number:
-            c5:86:68:39:7b:1c:c4:a0
-        Signature Algorithm: sha256WithRSAEncryption
-        Issuer: C=UA, ST=Kharkiv Oblast', L=Kharkiv, O=Internet Systems Consortium, CN=ca.test.example.com
-        Validity
-            Not Before: Sep  3 15:33:18 2024 GMT
-            Not After : Aug 27 15:33:18 2054 GMT
-        Subject: CN=srv03.crt01.example.com
-        Subject Public Key Info:
-            Public Key Algorithm: id-ecPublicKey
-                Public-Key: (384 bit)
-                pub:
-                    04:12:6c:5b:72:db:b4:68:44:ee:c1:3d:91:48:f7:
-                    23:39:57:ae:31:21:41:8c:7b:8a:38:2d:80:40:e9:
-                    c2:a1:14:50:95:3b:47:d7:ea:1e:9b:3b:4c:20:87:
-                    67:c2:81:86:d6:3a:ad:97:e9:0d:57:ff:1d:fa:81:
-                    52:42:ce:05:d2:05:73:cd:92:d7:4c:23:19:22:f5:
-                    cb:6d:44:4b:d7:a3:57:26:10:b2:a5:fe:7f:8f:5c:
-                    38:31:71:b8:3f:45:b3
-                ASN1 OID: secp384r1
-                NIST CURVE: P-384
-        X509v3 extensions:
-            X509v3 Subject Alternative Name:
-                DNS:srv03.crt01.example.com, IP Address:10.53.0.3
-            X509v3 Subject Key Identifier:
-                6A:4F:85:19:52:0E:08:29:28:1B:96:53:84:97:0E:AA:35:C3:96:27
-            X509v3 Authority Key Identifier:
-                7C:89:E8:5C:EB:E5:1F:72:48:04:C5:8F:FB:92:08:9C:F5:60:26:39
-    Signature Algorithm: sha256WithRSAEncryption
-    Signature Value:
-        62:05:bb:62:4e:2a:6a:46:00:49:3e:83:b3:a7:ff:40:68:02:
-        36:06:1f:e7:c9:47:db:72:09:be:78:bc:e6:c5:b4:8c:51:7c:
-        d5:93:06:ec:24:ad:11:a7:32:16:3a:55:79:a3:ab:4c:68:10:
-        78:f2:e8:24:b3:c0:9c:3a:cd:11:45:7a:22:37:3e:a3:9d:5d:
-        3e:ed:91:bd:58:04:2d:f6:6d:2e:0f:61:1d:4f:ab:d7:47:11:
-        1b:c7:06:9d:1d:2d:df:85:93:fa:08:dc:27:32:3a:70:37:61:
-        7a:58:95:0a:ca:62:ea:28:64:a1:2d:37:0e:7d:f9:0a:6c:71:
-        23:20:6a:5d:2d:6b:f2:fe:23:f8:7b:89:51:21:e3:dd:2d:52:
-        e7:a3:bc:b9:62:86:65:21:de:90:6a:66:f8:ef:25:aa:da:e5:
-        b7:5f:f1:8e:ab:2d:5a:50:5f:b8:98:8a:00:d0:7b:e3:51:ec:
-        d8:a5:67:ee:2a:93:b5:62:84:9b:f5:c7:cd:72:de:53:99:a8:
-        45:b3:f6:4c:31:58:f2:5c:cd:a3:ec:f1:1c:3a:29:cf:8e:b8:
-        60:ba:c3:cd:d9:7d:bd:9a:b0:41:b3:dd:fb:37:0f:56:54:5b:
-        5e:99:d1:a7:58:57:ac:9e:52:c5:74:3e:c2:df:72:82:07:bf:
-        b2:48:87:9e:16:d8:03:3b:3b:a2:0a:03:55:83:69:44:f2:14:
-        c8:6b:50:20:89:85:16:b4:be:c6:6c:42:91:00:09:d7:55:9f:
-        c3:0c:9b:5f:58:bf:43:9d:42:ca:f3:25:1f:d8:f4:b2:87:86:
-        a8:59:60:e9:53:23:2e:27:e8:97:02:d6:a6:91:9a:81:fb:28:
-        e4:47:86:c3:3a:55:ca:f0:24:1f:be:dd:00:d3:db:6a:20:5c:
-        a3:b0:7a:5f:d9:a7:9b:35:f7:23:c7:2b:9d:98:f9:5c:89:5a:
-        6d:d4:ed:1c:d7:ec:40:0c:b0:c2:92:24:4b:78:a1:ab:7e:27:
-        cf:19:2c:ec:3a:77
-----BEGIN CERTIFICATE-----
-MIIDYjCCAcqgAwIBAgIJAMWGaDl7HMSgMA0GCSqGSIb3DQEBCwUAMH0xCzAJBgNV
-BAYTAlVBMRgwFgYDVQQIDA9LaGFya2l2IE9ibGFzdCcxEDAOBgNVBAcMB0toYXJr
-aXYxJDAiBgNVBAoMG0ludGVybmV0IFN5c3RlbXMgQ29uc29ydGl1bTEcMBoGA1UE
-AwwTY2EudGVzdC5leGFtcGxlLmNvbTAgFw0yNDA5MDMxNTMzMThaGA8yMDU0MDgy
-NzE1MzMxOFowIjEgMB4GA1UEAwwXc3J2MDMuY3J0MDEuZXhhbXBsZS5jb20wdjAQ
-BgcqhkjOPQIBBgUrgQQAIgNiAAQSbFty27RoRO7BPZFI9yM5V64xIUGMe4o4LYBA
-6cKhFFCVO0fX6h6bO0wgh2fCgYbWOq2X6Q1X/x36gVJCzgXSBXPNktdMIxki9ctt
-REvXo1cmELKl/n+PXDgxcbg/RbOjbDBqMCgGA1UdEQQhMB+CF3NydjAzLmNydDAx
-LmV4YW1wbGUuY29thwQKNQADMB0GA1UdDgQWBBRqT4UZUg4IKSgbllOElw6qNcOW
-JzAfBgNVHSMEGDAWgBR8iehc6+UfckgExY/7kgic9WAmOTANBgkqhkiG9w0BAQsF
-AAOCAYEAYgW7Yk4qakYAST6Ds6f/QGgCNgYf58lH23IJvni85sW0jFF81ZMG7CSt
-EacyFjpVeaOrTGgQePLoJLPAnDrNEUV6Ijc+o51dPu2RvVgELfZtLg9hHU+r10cR
-G8cGnR0t34WT+gjcJzI6cDdheliVCspi6ihkoS03Dn35CmxxIyBqXS1r8v4j+HuJ
-USHj3S1S56O8uWKGZSHekGpm+O8lqtrlt1/xjqstWlBfuJiKANB741Hs2KVn7iqT
-tWKEm/XHzXLeU5moRbP2TDFY8lzNo+zxHDopz464YLrDzdl9vZqwQbPd+zcPVlRb
-XpnRp1hXrJ5SxXQ+wt9ygge/skiHnhbYAzs7ogoDVYNpRPIUyGtQIImFFrS+xmxC
-kQAJ11WfwwybX1i/Q51CyvMlH9j0soeGqFlg6VMjLifolwLWppGagfso5EeGwzpV
-yvAkH77dANPbaiBco7B6X9mnmzX3I8crnZj5XIlabdTtHNfsQAywwpIkS3ihq34n
-zxks7Dp3
-----END CERTIFICATE-----
--- a/Show More
+++ b/Show More