Test larger quantum and more threads

.gitlab-ci.yml

@@ -4,7 +4,6 @@ variables:
   DOCKER_DRIVER: overlay2
   CI_REGISTRY_IMAGE: registry.gitlab.isc.org/isc-projects/images/bind9
   CCACHE_DIR: "/ccache"
-  SOFTHSM2_CONF: "/var/tmp/softhsm2/softhsm2.conf"
 
 stages:
   - precheck
@@ -115,25 +114,20 @@ stages:
     - test -w "${CCACHE_DIR}" && export PATH="/usr/lib/ccache:${PATH}"
 #    - ./autogen.sh
   script:
-    - ./configure --enable-developer --with-libtool --disable-static --with-atf=/usr --prefix=$HOME/.local --without-make-clean $EXTRA_CONFIGURE || cat config.log
+    - ./configure --enable-developer --with-libtool --disable-static --with-atf=/usr $EXTRA_CONFIGURE
     - make -j${PARALLEL_JOBS_BUILD:-1} -k all V=1
   artifacts:
     expire_in: '1 hour'
     untracked: true
 
-.install_test: &install_test_job
-  stage: test
-  before_script:
-    - mkdir $HOME/.local
-  script:
-    - make install
-
 .system_test: &system_test_job
   stage: test
   before_script:
     - rm -rf .ccache
     - bash -x bin/tests/system/ifconfig.sh up
-    - bash -x util/prepare-softhsm2.sh
+    - export SOFTHSM_CONF="/tmp/softhsm.conf"
+    - echo "0:/tmp/softhsm.db" > $SOFTHSM_CONF
+    - if command -v softhsm2-util >/dev/null; then softhsm2-util --init-token --free --pin 0000 --so-pin 0000 --label "softhsm"; fi
   script:
     - ( cd bin/tests && make -j${TEST_PARALLEL_JOBS:-1} -k test V=1 )
     - test -s bin/tests/system/systests.output
@@ -146,7 +140,9 @@ stages:
   stage: test
   before_script:
     - export KYUA_RESULT="$CI_PROJECT_DIR/kyua.results"
-    - bash -x util/prepare-softhsm2.sh
+    - export SOFTHSM_CONF="/tmp/softhsm.conf"
+    - echo "0:/tmp/softhsm.db" > $SOFTHSM_CONF
+    - if command -v softhsm2-util >/dev/null; then softhsm2-util --init-token --free --pin 0000 --so-pin 0000 --label "softhsm"; fi
   script:
     - make unit
   after_script:
@@ -169,8 +165,6 @@ precheck:debian:sid:amd64:
     - perl -w util/merge_copyrights
     - diff -urNap util/copyrights util/newcopyrights
     - rm util/newcopyrights
-    - perl -w util/update_copyrights < util/copyrights
-    - if test "$(git status --porcelain | grep -Ev '\?\?' | wc -l)" -gt "0"; then git status --short; exit 1; fi
     - xmllint --noout --nonet `git ls-files '*.xml' '*.docbook'`
     - xmllint --noout --nonet --html `git ls-files '*.html'`
   artifacts:
@@ -220,11 +214,12 @@ build:centos:centos7:amd64:
   <<: *centos_centos7_amd64_image
   <<: *build_job
 
-build:clang:debian:stretch:amd64:
+build:clang:debian:sid:amd64:
   variables:
-    CC: clang
+    CC: clang-6.0
     CFLAGS: "-Wall -Wextra -Wenum-conversion -O2 -g"
-  <<: *debian_stretch_amd64_image
+    EXTRA_CONFIGURE: "--with-libidn2"
+  <<: *debian_sid_amd64_image
   <<: *build_job
 
 build:debian:jessie:amd64:
@@ -249,11 +244,12 @@ build:debian:sid:amd64:
   <<: *debian_sid_amd64_image
   <<: *build_job
 
-build:clang:debian:stretch:i386:
+build:clang:debian:sid:i386:
   variables:
-    CC: clang
+    CC: clang-6.0
     CFLAGS: "-Wall -Wextra -Wenum-conversion -O2 -g"
-  <<: *debian_stretch_i386_image
+    EXTRA_CONFIGURE: "--with-libidn2"
+  <<: *debian_sid_i386_image
   <<: *build_job
 
 build:debian:sid:i386:
@@ -294,11 +290,11 @@ unittest:debian:sid:amd64:
   dependencies:
     - build:debian:sid:amd64
 
-unittest:clang:debian:stretch:amd64:
-  <<: *debian_stretch_amd64_image
+unittest:clang:debian:sid:amd64:
+  <<: *debian_sid_amd64_image
   <<: *unit_test_job
   dependencies:
-    - build:clang:debian:stretch:amd64
+    - build:clang:debian:sid:amd64
 
 unittest:debian:sid:i386:
   <<: *debian_sid_i386_image
@@ -342,12 +338,6 @@ systemtest:debian:sid:i386:
   dependencies:
     - build:debian:sid:i386
 
-install:debian:sid:amd64:
-  <<: *debian_sid_amd64_image
-  <<: *install_test_job
-  dependencies:
-    - build:debian:sid:amd64
-
 pkcs11:build:debian:sid:amd64:
   variables:
     CC: gcc

.gitlab/issue_templates/.gitlab/issue_templates/release

@@ -1,29 +0,0 @@
-##Release Checklist
-
- - [ ] Check for the presence of a milestone for the release
-    - If there is a milestone, are all the issues for the milestone resolved? (other than this checklist)
- - [ ] Prepare the sources for tarball generation
- - [ ] Change software version and library versions in configure.in
- - [ ] Update CHANGES
- - [ ] Ensure the release notes are correct for this release
- - [ ] Ensure the metainformation is correct for this release
- - [ ] Make sure the tests are passing
- - [ ] Create a tag (name vX_Y_Z[-alphatag], content BIND X.Y.Z[-alphatag], signed with a developer's GPG key): git tag -u <DEVELOPER_KEYID> -a -s -m "BIND X.Y.Z" vX.Y.Z
- - [ ] Push the changes and tag
- - [ ] Create the tarball
- - [ ] Create the Windows zips
- - [ ] Ask QA to sanity check the tarball and zips
- - [ ] Request the signature on the tarballs
- - [ ] Make tarballs and signatures available to download
- - [ ] Edit the release https://gitlab.isc.org/isc-projects/bind9/tags and the NEWS snippet + links to the tarballs
- - [ ] Update DEB and RPM packages
-
-##Communication
-
- - [ ] Inform support to upload to the web site (nice to give them a heads-up in advance)
-       Write release e-mail to bind9-announce, bind-users in case of a major release 
- - [ ] Inform marketing to announce the release
-        Post short note to Twitter 
-        Update http://en.wikipedia.org/wiki/BIND (mktg)
-        Blog post if a major release
-

CHANGES

@@ -1,66 +1,3 @@
-5027.	[func]		Set SO_SNDBUF size on sockets. [GL #74]
-
-5026.	[bug]		rndc reconfig should not touch already loaded zones.
-			[GL #276]
-
-5025.	[cleanup]	Remove isc_keyboard family of functions. [GL #178]
-
-5024.	[func]		Replace custom assembly for atomic operations with
-			atomic support from the compiler. The code will now use
-			C11 stdatomic, or __atomic, or __sync builtins with GCC
-			or Clang compilers, and Interlocked functions with MSVC.
-			[GL #10]
-
-5023.	[cleanup]	Remove wrappers that try to fix broken or incomplete
-			implementations of IPv6, pthreads and other core
-			functionality required and used by BIND. [GL #192]
-
-5022.	[doc]		Update ms-self, ms-subdomain, krb5-self, and
-			krb5-subdomain documentation. [GL !708]
-
-5021.	[bug]		dig returned a non-zero exit code when it received a
-			reply over TCP after a retry. [GL #487]
-
-5020.	[func]		RNG uses thread-local storage instead of locks, if
-			supported by platform. [GL #496]
-
-5019.	[cleanup]	A message is now logged when ixfr-from-differences is
-			set at zone level for an inline-signed zone. [GL #470]
-
-5018.	[bug]		Fix incorrect sizeof arguments in lib/isc/pk11.c.
-			[GL !588]
-
-5017.	[bug]		lib/isc/pk11.c failed to unlink the session before
-			releasing the lock which is unsafe. [GL !589]
-
-5016.	[bug]		Named could assert with overlapping filter-aaaa and
-			dns64 acls. [GL #445]
-
-5015.	[bug]		Reloading all zones caused zone maintenance to cease
-			for inline-signed zones. [GL #435]
-
-5014.	[bug]		Signatures loaded from the journal for the signed
-			version of an inline-signed zone were not scheduled for
-			refresh. [GL #482]
-
-5013.	[bug]		A referral response with a non-empty ANSWER section was
-			inadvertently being treated as an error. [GL #390]
-
-5012.	[bug]		Fix lock order reversal in pk11_initialize. [GL !590]
-
-5011.	[func]		Remove support for unthreaded named. [GL #478]
-
-5010.	[func]		New "validate-except" option specifies a list of
-			domains beneath which DNSSEC validation should not
-			be performed. [GL #237]
-
-5009.	[bug]		Upon an OpenSSL failure, the first error in the OpenSSL
-			error queue was not logged. [GL #476]
-
-5008.	[bug]		"rndc signing -nsec3param ..." requests were silently
-			ignored for zones which were not yet loaded or
-			transferred. [GL #468]
-
 5007.	[cleanup]	Replace custom ISC boolean and integer data types
 			with C99 stdint.h and stdbool.h types. [GL #9]
 

Makefile.in

@@ -14,7 +14,7 @@ top_builddir =  @top_builddir@
 
 VERSION=@BIND9_VERSION@
 
-SUBDIRS =	make unit lib fuzz bin doc
+SUBDIRS =	make unit lib bin doc
 TARGETS =
 PREREQS =	bind.keys.h
 
@@ -90,7 +90,6 @@ force-test: test-force
 
 test-force:
 	status=0; \
-	(cd fuzz && ${MAKE} check) || status=1; \
 	(cd bin/tests && ${MAKE} ${MAKEDEFS} test) || status=1; \
 	(test -f ${top_builddir}/unit/unittest.sh && \
 		$(SHELL) ${top_builddir}/unit/unittest.sh) || status=1; \

README

@@ -114,9 +114,6 @@ of changes from BIND 9.12 and earlier releases. New features include:
     subject to DNSSEC validation and are not treated as authoritative data
     when answering. This makes it easier to configure a local copy of the
     root zone as described in RFC 7706.
-  * QNAME minimization is now supported
-  * The "validate-except" option allows configuration of domains below
-    which DNSSEC validation should not be performed.
 
 In addition, cryptographic support has been modernized. BIND now uses the
 best available pseudo-random number generator for the platform on which

README.md

@@ -131,9 +131,6 @@ include:
   DNSSEC validation and are not treated as authoritative data when
   answering. This makes it easier to configure a local copy of the root
   zone as described in RFC 7706.
-* QNAME minimization is now supported
-* The "validate-except" option allows configuration of domains below which
-  DNSSEC validation should not be performed.
 
 In addition, cryptographic support has been modernized. BIND now uses the
 best available pseudo-random number generator for the platform on which
@@ -147,7 +144,7 @@ Minimally, BIND requires a UNIX or Linux system with an ANSI C compiler,
 basic POSIX support, and a 64-bit integer type. Successful builds have been
 observed on many versions of Linux and UNIX, including RedHat, Fedora,
 Debian, Ubuntu, SuSE, Slackware, FreeBSD, NetBSD, OpenBSD, Mac OS X,
-Solaris, HP-UX, and OpenWRT.
+Solaris, HP-UX, AIX, SCO OpenServer, and OpenWRT.
 
 BIND requires a cryptography provider library such as OpenSSL or a
 hardware service module supporting PKCS#11. On Linux, BIND requires
@@ -271,6 +268,10 @@ specifying `--enable-fixed-rrset` or `--disable-fixed-rrset` on the
 configure command line.  By default, fixed rrset-order is disabled to
 reduce memory footprint.
 
+If your operating system has integrated support for IPv6, it will be used
+automatically.  If you have installed KAME IPv6 separately, use
+`--with-kame[=PATH]` to specify its location.
+
 `make install` will install `named` and the various BIND 9 libraries.  By
 default, installation is into /usr/local, but this can be changed with the
 `--prefix` option when running `configure`.

acconfig.h

@@ -17,6 +17,9 @@
  ***/
 @TOP@
 
+/** define on DEC OSF to enable 4.4BSD style sa_len support */
+#undef _SOCKADDR_LEN
+
 /** define if your system needs pthread_init() before using pthreads */
 #undef NEED_PTHREAD_INIT
 
@@ -26,6 +29,9 @@
 /** define if sigwait() is the UnixWare flavor */
 #undef HAVE_UNIXWARE_SIGWAIT
 
+/** define on Solaris to get sigwait() to work using pthreads semantics */
+#undef _POSIX_PTHREAD_SEMANTICS
+
 /** define if LinuxThreads is in use */
 #undef HAVE_LINUXTHREADS
 
@@ -47,18 +53,62 @@
 /** define if tzset() is available */
 #undef HAVE_TZSET
 
+/** define if struct addrinfo exists */
+#undef HAVE_ADDRINFO
+
+/** define if getaddrinfo() exists */
+#undef HAVE_GETADDRINFO
+
+/** define if gai_strerror() exists */
+#undef HAVE_GAISTRERROR
+
 /**
  * define if pthread_setconcurrency() should be called to tell the
  * OS how many threads we might want to run.
  */
 #undef CALL_PTHREAD_SETCONCURRENCY
 
+/** define if IPv6 is not disabled */
+#undef WANT_IPV6
+
 /** define if flockfile() is available */
 #undef HAVE_FLOCKFILE
 
 /** define if getc_unlocked() is available */
 #undef HAVE_GETCUNLOCKED
 
+/** Shut up warnings about sputaux in stdio.h on BSD/OS pre-4.1 */
+#undef SHUTUP_SPUTAUX
+#ifdef SHUTUP_SPUTAUX
+struct __sFILE;
+extern __inline int __sputaux(int _c, struct __sFILE *_p);
+#endif
+
+/** Shut up warnings about missing sigwait prototype on BSD/OS 4.0* */
+#undef SHUTUP_SIGWAIT
+#ifdef SHUTUP_SIGWAIT
+int sigwait(const unsigned int *set, int *sig);
+#endif
+
+/** Shut up warnings from gcc -Wcast-qual on BSD/OS 4.1. */
+#undef SHUTUP_STDARG_CAST
+#if defined(SHUTUP_STDARG_CAST) && defined(__GNUC__)
+#include <stdarg.h>		/** Grr.  Must be included *every time*. */
+/**
+ * The silly continuation line is to keep configure from
+ * commenting out the #undef.
+ */
+
+#undef \
+	va_start
+#define	va_start(ap, last) \
+	do { \
+		union { const void *konst; long *var; } _u; \
+		_u.konst = &(last); \
+		ap = (va_list)(_u.var + __va_words(__typeof(last))); \
+	} while (0)
+#endif /** SHUTUP_STDARG_CAST && __GNUC__ */
+
 /** define if the system has a random number generating device */
 #undef PATH_RANDOMDEV
 

aclocal.m4

@@ -1,6 +1,6 @@
-# generated automatically by aclocal 1.16.1 -*- Autoconf -*-
+# generated automatically by aclocal 1.15.1 -*- Autoconf -*-
 
-# Copyright (C) 1996-2018 Free Software Foundation, Inc.
+# Copyright (C) 1996-2017 Free Software Foundation, Inc.
 
 # This file is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@@ -12,9 +12,9 @@
 # PARTICULAR PURPOSE.
 
 m4_ifndef([AC_CONFIG_MACRO_DIRS], [m4_defun([_AM_CONFIG_MACRO_DIRS], [])m4_defun([AC_CONFIG_MACRO_DIRS], [_AM_CONFIG_MACRO_DIRS($@)])])
-# pkg.m4 - Macros to locate and utilise pkg-config.   -*- Autoconf -*-
-# serial 12 (pkg-config-0.29.2)
-
+dnl pkg.m4 - Macros to locate and utilise pkg-config.   -*- Autoconf -*-
+dnl serial 11 (pkg-config-0.29.1)
+dnl
 dnl Copyright © 2004 Scott James Remnant <scott@netsplit.com>.
 dnl Copyright © 2012-2015 Dan Nicholson <dbn.lists@gmail.com>
 dnl
@@ -55,7 +55,7 @@ dnl
 dnl See the "Since" comment for each macro you use to see what version
 dnl of the macros you require.
 m4_defun([PKG_PREREQ],
-[m4_define([PKG_MACROS_VERSION], [0.29.2])
+[m4_define([PKG_MACROS_VERSION], [0.29.1])
 m4_if(m4_version_compare(PKG_MACROS_VERSION, [$1]), -1,
     [m4_fatal([pkg.m4 version $1 or higher is required but ]PKG_MACROS_VERSION[ found])])
 ])dnl PKG_PREREQ
@@ -156,7 +156,7 @@ AC_ARG_VAR([$1][_CFLAGS], [C compiler flags for $1, overriding pkg-config])dnl
 AC_ARG_VAR([$1][_LIBS], [linker flags for $1, overriding pkg-config])dnl
 
 pkg_failed=no
-AC_MSG_CHECKING([for $2])
+AC_MSG_CHECKING([for $1])
 
 _PKG_CONFIG([$1][_CFLAGS], [cflags], [$2])
 _PKG_CONFIG([$1][_LIBS], [libs], [$2])
@@ -166,11 +166,11 @@ and $1[]_LIBS to avoid the need to call pkg-config.
 See the pkg-config man page for more details.])
 
 if test $pkg_failed = yes; then
-        AC_MSG_RESULT([no])
+   	AC_MSG_RESULT([no])
         _PKG_SHORT_ERRORS_SUPPORTED
         if test $_pkg_short_errors_supported = yes; then
 	        $1[]_PKG_ERRORS=`$PKG_CONFIG --short-errors --print-errors --cflags --libs "$2" 2>&1`
-        else
+        else 
 	        $1[]_PKG_ERRORS=`$PKG_CONFIG --print-errors --cflags --libs "$2" 2>&1`
         fi
 	# Put the nasty error message in config.log where it belongs
@@ -187,7 +187,7 @@ installed software in a non-standard prefix.
 _PKG_TEXT])[]dnl
         ])
 elif test $pkg_failed = untried; then
-        AC_MSG_RESULT([no])
+     	AC_MSG_RESULT([no])
 	m4_default([$4], [AC_MSG_FAILURE(
 [The pkg-config script could not be found or is too old.  Make sure it
 is in your PATH or set the PKG_CONFIG environment variable to the full
@@ -289,7 +289,6 @@ AS_VAR_IF([$1], [""], [$5], [$4])dnl
 ])dnl PKG_CHECK_VAR
 
 m4_include([m4/ax_check_openssl.m4])
-m4_include([m4/ax_pthread.m4])
 m4_include([m4/libtool.m4])
 m4_include([m4/ltoptions.m4])
 m4_include([m4/ltsugar.m4])

bin/check/check-tool.c

@@ -62,6 +62,14 @@
 #define CHECK_LOCAL 1
 #endif
 
+#ifdef HAVE_ADDRINFO
+#ifdef HAVE_GETADDRINFO
+#ifdef HAVE_GAISTRERROR
+#define USE_GETADDRINFO
+#endif
+#endif
+#endif
+
 #define CHECK(r) \
 	do { \
 		result = (r); \
@@ -169,6 +177,7 @@ static bool
 checkns(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner,
 	dns_rdataset_t *a, dns_rdataset_t *aaaa)
 {
+#ifdef USE_GETADDRINFO
 	dns_rdataset_t *rdataset;
 	dns_rdata_t rdata = DNS_RDATA_INIT;
 	struct addrinfo hints, *ai, *cur;
@@ -364,10 +373,14 @@ checkns(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner,
 	}
 	freeaddrinfo(ai);
 	return (answer);
+#else
+	return (true);
+#endif
 }
 
 static bool
 checkmx(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner) {
+#ifdef USE_GETADDRINFO
 	struct addrinfo hints, *ai, *cur;
 	char namebuf[DNS_NAME_FORMATSIZE + 1];
 	char ownerbuf[DNS_NAME_FORMATSIZE];
@@ -446,10 +459,14 @@ checkmx(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner) {
 		}
 		return (true);
 	}
+#else
+	return (true);
+#endif
 }
 
 static bool
 checksrv(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner) {
+#ifdef USE_GETADDRINFO
 	struct addrinfo hints, *ai, *cur;
 	char namebuf[DNS_NAME_FORMATSIZE + 1];
 	char ownerbuf[DNS_NAME_FORMATSIZE];
@@ -527,6 +544,9 @@ checksrv(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner) {
 		}
 		return (true);
 	}
+#else
+	return (true);
+#endif
 }
 
 isc_result_t
@@ -691,7 +711,7 @@ load_zone(isc_mem_t *mctx, const char *zonename, const char *filename,
 	if (dochecksrv)
 		dns_zone_setchecksrv(zone, checksrv);
 
-	CHECK(dns_zone_load(zone, false));
+	CHECK(dns_zone_load(zone));
 
 	/*
 	 * When loading map files we can't catch oversize TTLs during
@@ -771,3 +791,4 @@ DestroySockets(void) {
 	WSACleanup();
 }
 #endif
+

bin/check/win32/checkconf.vcxproj.in

@@ -70,7 +70,7 @@
       <GenerateDebugInformation>true</GenerateDebugInformation>
       <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
       <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);..\..\..\lib\isccfg\win32\$(Configuration);..\..\..\lib\isccc\win32\$(Configuration);..\..\..\lib\bind9\win32\$(Configuration);..\..\..\lib\ns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>@OPENSSL_LIB@checktool.lib;libisc.lib;libdns.lib;libisccfg.lib;libisccc.lib;libbind9.lib;libns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>checktool.lib;libisc.lib;libdns.lib;libisccfg.lib;libisccc.lib;libbind9.lib;libns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
     </Link>
   </ItemDefinitionGroup>
   <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'">
@@ -99,7 +99,7 @@
       <OptimizeReferences>true</OptimizeReferences>
       <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
       <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);..\..\..\lib\isccfg\win32\$(Configuration);..\..\..\lib\isccc\win32\$(Configuration);..\..\..\lib\bind9\win32\$(Configuration);..\..\..\lib\ns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>@OPENSSL_LIB@checktool.lib;libisc.lib;libdns.lib;libisccfg.lib;libisccc.lib;libbind9.lib;libns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>checktool.lib;libisc.lib;libdns.lib;libisccfg.lib;libisccc.lib;libbind9.lib;libns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
       <LinkTimeCodeGeneration>Default</LinkTimeCodeGeneration>
     </Link>
   </ItemDefinitionGroup>

bin/check/win32/checkzone.vcxproj.in

@@ -70,7 +70,7 @@
       <GenerateDebugInformation>true</GenerateDebugInformation>
       <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
       <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);..\..\..\lib\isccfg\win32\$(Configuration);..\..\..\lib\bind9\win32\$(Configuration);..\..\..\lib\ns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>@OPENSSL_LIB@checktool.lib;libisc.lib;libdns.lib;libisccfg.lib;libbind9.lib;libns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>checktool.lib;libisc.lib;libdns.lib;libisccfg.lib;libbind9.lib;libns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
     </Link>
     <PostBuildEvent>
       <Command>cd ..\..\..\Build\$(Configuration)
@@ -105,7 +105,7 @@ copy /Y named-checkzone.ilk named-compilezone.ilk
       <OptimizeReferences>true</OptimizeReferences>
       <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
       <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);..\..\..\lib\isccfg\win32\$(Configuration);..\..\..\lib\bind9\win32\$(Configuration);..\..\..\lib\ns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>@OPENSSL_LIB@checktool.lib;libisc.lib;libdns.lib;libisccfg.lib;libbind9.lib;libns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>checktool.lib;libisc.lib;libdns.lib;libisccfg.lib;libbind9.lib;libns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
       <LinkTimeCodeGeneration>Default</LinkTimeCodeGeneration>
     </Link>
     <PostBuildEvent>

bin/confgen/ddns-confgen.c

@@ -28,6 +28,7 @@
 #include <isc/buffer.h>
 #include <isc/commandline.h>
 #include <isc/file.h>
+#include <isc/keyboard.h>
 #include <isc/mem.h>
 #include <isc/net.h>
 #include <isc/print.h>

bin/confgen/keygen.c

@@ -20,6 +20,7 @@
 #include <isc/base64.h>
 #include <isc/buffer.h>
 #include <isc/file.h>
+#include <isc/keyboard.h>
 #include <isc/mem.h>
 #include <isc/print.h>
 #include <isc/result.h>
@@ -191,3 +192,4 @@ write_key_file(const char *keyfile, const char *user,
 		fatal("fclose(%s) failed\n", keyfile);
 	fprintf(stderr, "wrote key file \"%s\"\n", keyfile);
 }
+

bin/confgen/rndc-confgen.c

@@ -31,6 +31,7 @@
 #include <isc/buffer.h>
 #include <isc/commandline.h>
 #include <isc/file.h>
+#include <isc/keyboard.h>
 #include <isc/mem.h>
 #include <isc/net.h>
 #include <isc/print.h>

bin/confgen/win32/ddnsconfgen.vcxproj.in

@@ -70,7 +70,7 @@
       <GenerateDebugInformation>true</GenerateDebugInformation>
       <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
       <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);..\..\..\lib\isccfg\win32\$(Configuration);..\..\..\lib\isccc\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>@OPENSSL_LIB@confgentool.lib;libisc.lib;libdns.lib;libisccfg.lib;libisccc.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>confgentool.lib;libisc.lib;libdns.lib;libisccfg.lib;libisccc.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
     </Link>
     <PostBuildEvent>
       <Command>cd ..\..\..\Build\$(Configuration)
@@ -106,7 +106,7 @@ copy /Y ddns-confgen.ilk tsig-keygen.ilk
       <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
       <LinkTimeCodeGeneration>Default</LinkTimeCodeGeneration>
       <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);..\..\..\lib\isccfg\win32\$(Configuration);..\..\..\lib\isccc\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>@OPENSSL_LIB@confgentool.lib;libisc.lib;libdns.lib;libisccfg.lib;libisccc.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>confgentool.lib;libisc.lib;libdns.lib;libisccfg.lib;libisccc.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
     </Link>
     <PostBuildEvent>
       <Command>cd ..\..\..\Build\$(Configuration)

bin/confgen/win32/rndcconfgen.vcxproj.in

@@ -70,7 +70,7 @@
       <GenerateDebugInformation>true</GenerateDebugInformation>
       <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
       <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);..\..\..\lib\isccfg\win32\$(Configuration);..\..\..\lib\isccc\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>@OPENSSL_LIB@confgentool.lib;libisc.lib;libdns.lib;libisccfg.lib;libisccc.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>confgentool.lib;libisc.lib;libdns.lib;libisccfg.lib;libisccc.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
     </Link>
   </ItemDefinitionGroup>
   <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'">
@@ -100,7 +100,7 @@
       <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
       <LinkTimeCodeGeneration>Default</LinkTimeCodeGeneration>
       <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);..\..\..\lib\isccfg\win32\$(Configuration);..\..\..\lib\isccc\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>@OPENSSL_LIB@confgentool.lib;libisc.lib;libdns.lib;libisccfg.lib;libisccc.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>confgentool.lib;libisc.lib;libdns.lib;libisccfg.lib;libisccc.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
     </Link>
   </ItemDefinitionGroup>
   <ItemGroup>

bin/delv/win32/delv.vcxproj.in

@@ -68,7 +68,7 @@
       <GenerateDebugInformation>true</GenerateDebugInformation>
       <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
       <AdditionalLibraryDirectories>..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);..\..\..\lib\isccfg\win32\$(Configuration);..\..\..\lib\irs\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>@OPENSSL_LIB@libisc.lib;libdns.lib;libisccfg.lib;libirs.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>libisc.lib;libdns.lib;libisccfg.lib;libirs.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
     </Link>
   </ItemDefinitionGroup>
   <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'">
@@ -98,7 +98,7 @@
       <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
       <LinkTimeCodeGeneration>Default</LinkTimeCodeGeneration>
       <AdditionalLibraryDirectories>..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);..\..\..\lib\isccfg\win32\$(Configuration);..\..\..\lib\irs\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>@OPENSSL_LIB@libisc.lib;libdns.lib;libisccfg.lib;libirs.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>libisc.lib;libdns.lib;libisccfg.lib;libirs.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
     </Link>
   </ItemDefinitionGroup>
   <ItemGroup>

bin/dig/dig.c

@@ -1008,7 +1008,7 @@ plus_option(char *option, bool is_batchfile,
 						code = NULL;
 						if (value != NULL) {
 							code = strtok_r(value,
-									":",
+								        ":",
 									&last);
 						}
 						if (code == NULL) {

bin/dig/dighost.c

@@ -3202,7 +3202,6 @@ connect_done(isc_task_t *task, isc_event_t *event) {
 		UNLOCK_LOOKUP;
 		return;
 	}
-	exitcode = 0;
 	if (keep_open) {
 		if (keep != NULL)
 			isc_socket_detach(&keep);

bin/dig/host.c

@@ -29,6 +29,7 @@
 #include <isc/string.h>
 #include <isc/util.h>
 #include <isc/task.h>
+#include <isc/stdlib.h>
 
 #include <dns/byaddr.h>
 #include <dns/fixedname.h>

bin/dig/win32/dig.vcxproj.in

@@ -68,7 +68,7 @@
       <GenerateDebugInformation>true</GenerateDebugInformation>
       <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
       <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\isccfg\win32\$(Configuration);..\..\..\lib\irs\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);..\..\..\lib\bind9\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>@OPENSSL_LIB@dighost.lib;libisc.lib;libisccfg.lib;libirs.lib;libdns.lib;libbind9.lib;@IDN_LIB@ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>dighost.lib;libisc.lib;libisccfg.lib;libirs.lib;libdns.lib;libbind9.lib;@IDN_LIB@ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
     </Link>
   </ItemDefinitionGroup>
   <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'">
@@ -98,7 +98,7 @@
       <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
       <LinkTimeCodeGeneration>Default</LinkTimeCodeGeneration>
       <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\isccfg\win32\$(Configuration);..\..\..\lib\irs\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);..\..\..\lib\bind9\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>@OPENSSL_LIB@dighost.lib;libisc.lib;libisccfg.lib;libirs.lib;libdns.lib;libbind9.lib;@IDN_LIB@ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>dighost.lib;libisc.lib;libisccfg.lib;libirs.lib;libdns.lib;libbind9.lib;@IDN_LIB@ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
     </Link>
   </ItemDefinitionGroup>
   <ItemGroup>

bin/dig/win32/host.vcxproj.in

@@ -68,7 +68,7 @@
       <GenerateDebugInformation>true</GenerateDebugInformation>
       <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
       <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\isccfg\win32\$(Configuration);..\..\..\lib\irs\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);..\..\..\lib\bind9\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>@OPENSSL_LIB@dighost.lib;@IDN_LIB@libisc.lib;libisccfg.lib;libirs.lib;libdns.lib;libbind9.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>dighost.lib;@IDN_LIB@libisc.lib;libisccfg.lib;libirs.lib;libdns.lib;libbind9.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
     </Link>
   </ItemDefinitionGroup>
   <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'">
@@ -98,7 +98,7 @@
       <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
       <LinkTimeCodeGeneration>Default</LinkTimeCodeGeneration>
       <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\isccfg\win32\$(Configuration);..\..\..\lib\irs\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);..\..\..\lib\bind9\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>@OPENSSL_LIB@dighost.lib;@IDN_LIB@libisc.lib;libisccfg.lib;libirs.lib;libdns.lib;libbind9.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>dighost.lib;@IDN_LIB@libisc.lib;libisccfg.lib;libirs.lib;libdns.lib;libbind9.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
     </Link>
   </ItemDefinitionGroup>
   <ItemGroup>

bin/dig/win32/nslookup.vcxproj.in

@@ -68,7 +68,7 @@
       <GenerateDebugInformation>true</GenerateDebugInformation>
       <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
       <AdditionalLibraryDirectories>..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\isccfg\win32\$(Configuration);..\..\..\lib\irs\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);..\..\..\lib\bind9\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>@OPENSSL_LIB@@READLINE_LIBD@@IDN_LIB@libisc.lib;libisccfg.lib;libirs.lib;libdns.lib;libbind9.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>@READLINE_LIBD@@IDN_LIB@libisc.lib;libisccfg.lib;libirs.lib;libdns.lib;libbind9.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
     </Link>
   </ItemDefinitionGroup>
   <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'">
@@ -98,7 +98,7 @@
       <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
       <LinkTimeCodeGeneration>Default</LinkTimeCodeGeneration>
       <AdditionalLibraryDirectories>..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\isccfg\win32\$(Configuration);..\..\..\lib\irs\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);..\..\..\lib\bind9\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>@OPENSSL_LIB@@READLINE_LIB@@IDN_LIB@libisc.lib;libisccfg.lib;libirs.lib;libdns.lib;libbind9.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>@READLINE_LIB@@IDN_LIB@libisc.lib;libisccfg.lib;libirs.lib;libdns.lib;libbind9.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
     </Link>
   </ItemDefinitionGroup>
   <ItemGroup>

bin/dnssec/dnssec-cds.c

@@ -62,7 +62,7 @@
 #include "dnssectool.h"
 
 #ifndef PATH_MAX
-#define PATH_MAX 1024   /* WIN32, and others don't define this. */
+#define PATH_MAX 1024   /* AIX, WIN32, and others don't define this. */
 #endif
 
 const char *program = "dnssec-cds";

bin/dnssec/dnssec-dsfromkey.c

@@ -50,7 +50,7 @@
 #include "dnssectool.h"
 
 #ifndef PATH_MAX
-#define PATH_MAX 1024   /* WIN32, and others don't define this. */
+#define PATH_MAX 1024   /* AIX, WIN32, and others don't define this. */
 #endif
 
 const char *program = "dnssec-dsfromkey";

bin/dnssec/dnssec-importkey.c

@@ -49,7 +49,7 @@
 #include "dnssectool.h"
 
 #ifndef PATH_MAX
-#define PATH_MAX 1024   /* WIN32, and others don't define this. */
+#define PATH_MAX 1024   /* AIX, WIN32, and others don't define this. */
 #endif
 
 const char *program = "dnssec-importkey";

bin/dnssec/dnssec-signzone.c

@@ -49,6 +49,7 @@
 #include <isc/serial.h>
 #include <isc/safe.h>
 #include <isc/stdio.h>
+#include <isc/stdlib.h>
 #include <isc/string.h>
 #include <isc/task.h>
 #include <isc/time.h>
@@ -88,7 +89,7 @@
 #include "dnssectool.h"
 
 #ifndef PATH_MAX
-#define PATH_MAX 1024   /* WIN32, and others don't define this. */
+#define PATH_MAX 1024   /* AIX, WIN32, and others don't define this. */
 #endif
 
 const char *program = "dnssec-signzone";

bin/dnssec/dnssec-verify.c

@@ -32,6 +32,7 @@
 #include <isc/rwlock.h>
 #include <isc/serial.h>
 #include <isc/stdio.h>
+#include <isc/stdlib.h>
 #include <isc/string.h>
 #include <isc/time.h>
 #include <isc/util.h>

bin/dnssec/dnssectool.c

@@ -410,7 +410,7 @@ key_collision(dst_key_t *dstkey, dns_name_t *name, const char *dir,
 	uint16_t id, oldid;
 	uint32_t rid, roldid;
 	dns_secalg_t alg;
-	char filename[NAME_MAX];
+	char filename[ISC_DIR_NAMEMAX];
 	isc_buffer_t fileb;
 	isc_stdtime_t now;
 

bin/dnssec/win32/dsfromkey.vcxproj.in

@@ -70,7 +70,7 @@
       <GenerateDebugInformation>true</GenerateDebugInformation>
       <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
       <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>@OPENSSL_LIB@dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
     </Link>
 @IF PYTHON
     <PostBuildEvent>
@@ -113,7 +113,7 @@ set PYTHONPATH=.
       <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
       <LinkTimeCodeGeneration>Default</LinkTimeCodeGeneration>
       <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>@OPENSSL_LIB@dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
     </Link>
 @IF PYTHON
     <PostBuildEvent>

bin/dnssec/win32/importkey.vcxproj.in

@@ -70,7 +70,7 @@
       <GenerateDebugInformation>true</GenerateDebugInformation>
       <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
       <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>@OPENSSL_LIB@dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
     </Link>
   </ItemDefinitionGroup>
   <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'">
@@ -100,7 +100,7 @@
       <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
       <LinkTimeCodeGeneration>Default</LinkTimeCodeGeneration>
       <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>@OPENSSL_LIB@dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
     </Link>
   </ItemDefinitionGroup>
   <ItemGroup>

bin/dnssec/win32/keyfromlabel.vcxproj.in

@@ -70,7 +70,7 @@
       <GenerateDebugInformation>true</GenerateDebugInformation>
       <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
       <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>@OPENSSL_LIB@dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
     </Link>
   </ItemDefinitionGroup>
   <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'">
@@ -100,7 +100,7 @@
       <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
       <LinkTimeCodeGeneration>Default</LinkTimeCodeGeneration>
       <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>@OPENSSL_LIB@dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
     </Link>
   </ItemDefinitionGroup>
   <ItemGroup>

bin/dnssec/win32/keygen.vcxproj.in

@@ -69,7 +69,7 @@
       <SubSystem>Console</SubSystem>
       <GenerateDebugInformation>true</GenerateDebugInformation>
       <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalDependencies>@OPENSSL_LIB@dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
       <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
     </Link>
   </ItemDefinitionGroup>
@@ -99,7 +99,7 @@
       <OptimizeReferences>true</OptimizeReferences>
       <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
       <LinkTimeCodeGeneration>Default</LinkTimeCodeGeneration>
-      <AdditionalDependencies>@OPENSSL_LIB@dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
       <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
     </Link>
   </ItemDefinitionGroup>

bin/dnssec/win32/revoke.vcxproj.in

@@ -70,7 +70,7 @@
       <GenerateDebugInformation>true</GenerateDebugInformation>
       <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
       <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>@OPENSSL_LIB@dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
     </Link>
   </ItemDefinitionGroup>
   <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'">
@@ -100,7 +100,7 @@
       <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
       <LinkTimeCodeGeneration>Default</LinkTimeCodeGeneration>
       <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>@OPENSSL_LIB@dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
     </Link>
   </ItemDefinitionGroup>
   <ItemGroup>

bin/dnssec/win32/settime.vcxproj.in

@@ -69,7 +69,7 @@
       <SubSystem>Console</SubSystem>
       <GenerateDebugInformation>true</GenerateDebugInformation>
       <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalDependencies>@OPENSSL_LIB@dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
       <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
     </Link>
   </ItemDefinitionGroup>
@@ -99,7 +99,7 @@
       <OptimizeReferences>true</OptimizeReferences>
       <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
       <LinkTimeCodeGeneration>Default</LinkTimeCodeGeneration>
-      <AdditionalDependencies>@OPENSSL_LIB@dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
       <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
     </Link>
   </ItemDefinitionGroup>

bin/dnssec/win32/signzone.vcxproj.in

@@ -70,7 +70,7 @@
       <GenerateDebugInformation>true</GenerateDebugInformation>
       <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
       <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>@OPENSSL_LIB@dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
     </Link>
   </ItemDefinitionGroup>
   <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'">
@@ -100,7 +100,7 @@
       <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
       <LinkTimeCodeGeneration>Default</LinkTimeCodeGeneration>
       <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>@OPENSSL_LIB@dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
     </Link>
   </ItemDefinitionGroup>
   <ItemGroup>

bin/dnssec/win32/verify.vcxproj.in

@@ -69,7 +69,7 @@
       <SubSystem>Console</SubSystem>
       <GenerateDebugInformation>true</GenerateDebugInformation>
       <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalDependencies>@OPENSSL_LIB@dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
       <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
     </Link>
   </ItemDefinitionGroup>
@@ -99,7 +99,7 @@
       <OptimizeReferences>true</OptimizeReferences>
       <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
       <LinkTimeCodeGeneration>Default</LinkTimeCodeGeneration>
-      <AdditionalDependencies>@OPENSSL_LIB@dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
       <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
     </Link>
   </ItemDefinitionGroup>

bin/named/fuzz.c

@@ -9,7 +9,7 @@
  * information regarding copyright ownership.
  */
 
-#include <config.h>
+#include "config.h"
 
 #include <inttypes.h>
 #include <stdbool.h>
@@ -36,6 +36,10 @@
 #include <unistd.h>
 #include <pthread.h>
 
+#ifndef __AFL_LOOP
+#error To use American Fuzzy Lop you have to set CC to afl-clang-fast!!!
+#endif
+
 /*
  * We are using pthreads directly because we might be using it with
  * unthreaded version of BIND, where all thread functions are
@@ -57,6 +61,7 @@ fuzz_thread_client(void *arg) {
 	char *port;
 	struct sockaddr_in servaddr;
 	int sockfd;
+	int loop;
 	void *buf;
 
 	UNUSED(arg);
@@ -98,18 +103,14 @@ fuzz_thread_client(void *arg) {
 	 * Processing fuzzed packets 100,000 times before shutting down
 	 * the app.
 	 */
-#ifdef __AFL_LOOP
-	for (int loop = 0; loop < 100000; loop++) {
-#else
-	{
-#endif
+	for (loop = 0; loop < 100000; loop++) {
 		ssize_t length;
 		ssize_t sent;
 
 		length = read(0, buf, 65536);
 		if (length <= 0) {
 			usleep(1000000);
-			goto next;
+			continue;
 		}
 
 		/*
@@ -129,7 +130,7 @@ fuzz_thread_client(void *arg) {
 				return (NULL);
 			}
 			raise(SIGSTOP);
-			goto next;
+			continue;
 		}
 
 		RUNTIME_CHECK(pthread_mutex_lock(&mutex) == 0);
@@ -150,7 +151,6 @@ fuzz_thread_client(void *arg) {
 			pthread_cond_wait(&cond, &mutex);
 
 		RUNTIME_CHECK(pthread_mutex_unlock(&mutex) == 0);
-	next: ;
 	}
 
 	free(buf);
@@ -586,7 +586,6 @@ fuzz_thread_resolver(void *arg) {
 	named_server_flushonshutdown(named_g_server, false);
 	isc_app_shutdown();
 
-#ifdef __AFL_LOOP
 	/*
 	 * This is here just for the signature, that's how AFL detects
 	 * if it's a 'persistent mode' binary. It has to occur somewhere
@@ -595,7 +594,6 @@ fuzz_thread_resolver(void *arg) {
 	 * in persistent mode if it's present.
 	 */
 	__AFL_LOOP(0);
-#endif
 
 	return (NULL);
 }

bin/named/main.c

@@ -110,8 +110,8 @@ LIBDNS_EXTERNAL_DATA extern unsigned int dns_zone_mkey_day;
 LIBDNS_EXTERNAL_DATA extern unsigned int dns_zone_mkey_month;
 
 static bool	want_stats = false;
-static char		program_name[NAME_MAX] = "named";
-static char		absolute_conffile[PATH_MAX];
+static char		program_name[ISC_DIR_NAMEMAX] = "named";
+static char		absolute_conffile[ISC_DIR_PATHMAX];
 static char		saved_command_line[512];
 static char		version[512];
 static unsigned int	maxsocks = 0;
@@ -773,7 +773,7 @@ create_managers(void) {
 	INSIST(named_g_cpus_detected > 0);
 
 	if (named_g_cpus == 0)
-		named_g_cpus = named_g_cpus_detected;
+		named_g_cpus = named_g_cpus_detected * 1.5;
 	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 		      NAMED_LOGMODULE_SERVER, ISC_LOG_INFO,
 		      "found %u CPU%s, using %u worker thread%s",
@@ -787,7 +787,7 @@ create_managers(void) {
 		if (named_g_cpus_detected == 1)
 			named_g_udpdisp = 1;
 		else
-			named_g_udpdisp = named_g_cpus_detected - 1;
+			named_g_udpdisp = named_g_cpus_detected;
 	}
 	if (named_g_udpdisp > named_g_cpus)
 		named_g_udpdisp = named_g_cpus;
@@ -822,7 +822,7 @@ create_managers(void) {
 				 isc_result_totext(result));
 		return (ISC_R_UNEXPECTED);
 	}
-	isc__socketmgr_maxudp(named_g_socketmgr, maxudp);
+	isc_socketmgr_maxudp(named_g_socketmgr, maxudp);
 	result = isc_socketmgr_getmaxsockets(named_g_socketmgr, &socks);
 	if (result == ISC_R_SUCCESS) {
 		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
@@ -994,6 +994,7 @@ setup(void) {
 		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
 		      "compiled by Solaris Studio %x", __SUNPRO_C);
 #endif
+#ifdef OPENSSL
 	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
 		      "compiled with OpenSSL version: %s",
@@ -1010,6 +1011,7 @@ setup(void) {
 		      "linked to OpenSSL version: %s",
 		      SSLeay_version(SSLEAY_VERSION));
 #endif /* OPENSSL_VERSION_NUMBER >= 0x10100000L */
+#endif
 #ifdef HAVE_LIBXML2
 	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
@@ -1035,15 +1037,9 @@ setup(void) {
 		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
 		      "linked to zlib version: %s", zlibVersion());
 #endif
-#ifdef ISC_PLATFORM_USETHREADS
 	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
 		      "threads support is enabled");
-#else
-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
-		      "threads support is disabled");
-#endif
 
 	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,

bin/named/named.conf.docbook

@@ -13,7 +13,7 @@
 
 <refentry xmlns:db="http://docbook.org/ns/docbook" version="5.0" xml:id="man.named.conf">
   <info>
-    <date>2018-06-21</date>
+    <date>2018-05-29</date>
   </info>
   <refentryinfo>
     <corpname>ISC</corpname>
@@ -224,9 +224,9 @@ options {
 	coresize ( default | unlimited | <replaceable>sizeval</replaceable> );
 	datasize ( default | unlimited | <replaceable>sizeval</replaceable> );
 	deny-answer-addresses { <replaceable>address_match_element</replaceable>; ... } [
-	    except-from { <replaceable>string</replaceable>; ... } ];
-	deny-answer-aliases { <replaceable>string</replaceable>; ... } [ except-from { <replaceable>string</replaceable>; ...
-	    } ];
+	    except-from { <replaceable>quoted_string</replaceable>; ... } ];
+	deny-answer-aliases { <replaceable>quoted_string</replaceable>; ... } [ except-from {
+	    <replaceable>quoted_string</replaceable>; ... } ];
 	dialup ( notify | notify-passive | passive | refresh | <replaceable>boolean</replaceable> );
 	directory <replaceable>quoted_string</replaceable>;
 	disable-algorithms <replaceable>string</replaceable> { <replaceable>string</replaceable>;
@@ -257,12 +257,14 @@ options {
 	dnssec-secure-to-insecure <replaceable>boolean</replaceable>;
 	dnssec-update-mode ( maintain | no-resign );
 	dnssec-validation ( yes | no | auto );
-	dnstap { ( all | auth | client | forwarder | resolver ) [ ( query |
-	    response ) ]; ... };
-	dnstap-identity ( <replaceable>quoted_string</replaceable> | none | hostname );
-	dnstap-output ( file | unix ) <replaceable>quoted_string</replaceable> [ size ( unlimited |
-	    <replaceable>size</replaceable> ) ] [ versions ( unlimited | <replaceable>integer</replaceable> ) ] [ suffix (
-	    increment | timestamp ) ];
+	dnstap { ( all | auth | client | forwarder |
+	    resolver ) [ ( query | response ) ]; ... };
+	dnstap-identity ( <replaceable>quoted_string</replaceable> | none |
+	    hostname );
+	dnstap-output ( file | unix ) <replaceable>quoted_string</replaceable> [
+	    size ( unlimited | <replaceable>size</replaceable> ) ] [ versions (
+	    unlimited | <replaceable>integer</replaceable> ) ] [ suffix ( increment
+	    | timestamp ) ];
 	dnstap-version ( <replaceable>quoted_string</replaceable> | none );
 	dscp <replaceable>integer</replaceable>;
 	dual-stack-servers [ port <replaceable>integer</replaceable> ] { ( <replaceable>quoted_string</replaceable> [ port
@@ -360,7 +362,7 @@ options {
 	preferred-glue <replaceable>string</replaceable>;
 	prefetch <replaceable>integer</replaceable> [ <replaceable>integer</replaceable> ];
 	provide-ixfr <replaceable>boolean</replaceable>;
-	qname-minimization ( strict | relaxed | disabled | off );
+	qname-minimization ( strict | relaxed | disabled );
 	query-source ( ( [ address ] ( <replaceable>ipv4_address</replaceable> | * ) [ port (
 	    <replaceable>integer</replaceable> | * ) ] ) | ( [ [ address ] ( <replaceable>ipv4_address</replaceable> | * ) ]
 	    port ( <replaceable>integer</replaceable> | * ) ) ) [ dscp <replaceable>integer</replaceable> ];
@@ -411,7 +413,7 @@ options {
 	    nsip-enable <replaceable>boolean</replaceable> ] [ nsdname-enable <replaceable>boolean</replaceable> ] [
 	    dnsrps-enable <replaceable>boolean</replaceable> ] [ dnsrps-options { <replaceable>unspecified-text</replaceable>
 	    } ];
-	root-delegation-only [ exclude { <replaceable>string</replaceable>; ... } ];
+	root-delegation-only [ exclude { <replaceable>quoted_string</replaceable>; ... } ];
 	root-key-sentinel <replaceable>boolean</replaceable>;
 	rrset-order { [ class <replaceable>string</replaceable> ] [ type <replaceable>string</replaceable> ] [ name
 	    <replaceable>quoted_string</replaceable> ] <replaceable>string</replaceable> <replaceable>string</replaceable>; ... };
@@ -461,7 +463,6 @@ options {
 	use-v4-udp-ports { <replaceable>portrange</replaceable>; ... };
 	use-v6-udp-ports { <replaceable>portrange</replaceable>; ... };
 	v6-bias <replaceable>integer</replaceable>;
-	validate-except { <replaceable>string</replaceable>; ... };
 	version ( <replaceable>quoted_string</replaceable> | none );
 	zero-no-soa-ttl <replaceable>boolean</replaceable>;
 	zero-no-soa-ttl-cache <replaceable>boolean</replaceable>;
@@ -573,9 +574,9 @@ view <replaceable>string</replaceable> [ <replaceable>class</replaceable> ] {
 	cleaning-interval <replaceable>integer</replaceable>;
 	clients-per-query <replaceable>integer</replaceable>;
 	deny-answer-addresses { <replaceable>address_match_element</replaceable>; ... } [
-	    except-from { <replaceable>string</replaceable>; ... } ];
-	deny-answer-aliases { <replaceable>string</replaceable>; ... } [ except-from { <replaceable>string</replaceable>; ...
-	    } ];
+	    except-from { <replaceable>quoted_string</replaceable>; ... } ];
+	deny-answer-aliases { <replaceable>quoted_string</replaceable>; ... } [ except-from {
+	    <replaceable>quoted_string</replaceable>; ... } ];
 	dialup ( notify | notify-passive | passive | refresh | <replaceable>boolean</replaceable> );
 	disable-algorithms <replaceable>string</replaceable> { <replaceable>string</replaceable>;
 	    ... };
@@ -609,8 +610,8 @@ view <replaceable>string</replaceable> [ <replaceable>class</replaceable> ] {
 	dnssec-secure-to-insecure <replaceable>boolean</replaceable>;
 	dnssec-update-mode ( maintain | no-resign );
 	dnssec-validation ( yes | no | auto );
-	dnstap { ( all | auth | client | forwarder | resolver ) [ ( query |
-	    response ) ]; ... };
+	dnstap { ( all | auth | client | forwarder |
+	    resolver ) [ ( query | response ) ]; ... };
 	dual-stack-servers [ port <replaceable>integer</replaceable> ] { ( <replaceable>quoted_string</replaceable> [ port
 	    <replaceable>integer</replaceable> ] [ dscp <replaceable>integer</replaceable> ] | <replaceable>ipv4_address</replaceable> [ port
 	    <replaceable>integer</replaceable> ] [ dscp <replaceable>integer</replaceable> ] | <replaceable>ipv6_address</replaceable> [ port
@@ -688,7 +689,7 @@ view <replaceable>string</replaceable> [ <replaceable>class</replaceable> ] {
 	preferred-glue <replaceable>string</replaceable>;
 	prefetch <replaceable>integer</replaceable> [ <replaceable>integer</replaceable> ];
 	provide-ixfr <replaceable>boolean</replaceable>;
-	qname-minimization ( strict | relaxed | disabled | off );
+	qname-minimization ( strict | relaxed | disabled );
 	query-source ( ( [ address ] ( <replaceable>ipv4_address</replaceable> | * ) [ port (
 	    <replaceable>integer</replaceable> | * ) ] ) | ( [ [ address ] ( <replaceable>ipv4_address</replaceable> | * ) ]
 	    port ( <replaceable>integer</replaceable> | * ) ) ) [ dscp <replaceable>integer</replaceable> ];
@@ -734,7 +735,7 @@ view <replaceable>string</replaceable> [ <replaceable>class</replaceable> ] {
 	    nsip-enable <replaceable>boolean</replaceable> ] [ nsdname-enable <replaceable>boolean</replaceable> ] [
 	    dnsrps-enable <replaceable>boolean</replaceable> ] [ dnsrps-options { <replaceable>unspecified-text</replaceable>
 	    } ];
-	root-delegation-only [ exclude { <replaceable>string</replaceable>; ... } ];
+	root-delegation-only [ exclude { <replaceable>quoted_string</replaceable>; ... } ];
 	root-key-sentinel <replaceable>boolean</replaceable>;
 	rrset-order { [ class <replaceable>string</replaceable> ] [ type <replaceable>string</replaceable> ] [ name
 	    <replaceable>quoted_string</replaceable> ] <replaceable>string</replaceable> <replaceable>string</replaceable>; ... };
@@ -796,7 +797,6 @@ view <replaceable>string</replaceable> [ <replaceable>class</replaceable> ] {
 	update-check-ksk <replaceable>boolean</replaceable>;
 	use-alt-transfer-source <replaceable>boolean</replaceable>;
 	v6-bias <replaceable>integer</replaceable>;
-	validate-except { <replaceable>string</replaceable>; ... };
 	zero-no-soa-ttl <replaceable>boolean</replaceable>;
 	zero-no-soa-ttl-cache <replaceable>boolean</replaceable>;
 	zone <replaceable>string</replaceable> [ <replaceable>class</replaceable> ] {
@@ -878,7 +878,7 @@ view <replaceable>string</replaceable> [ <replaceable>class</replaceable> ] {
 		serial-update-method ( date | increment | unixtime );
 		server-addresses { ( <replaceable>ipv4_address</replaceable> | <replaceable>ipv6_address</replaceable> ) [
 		    port <replaceable>integer</replaceable> ]; ... };
-		server-names { <replaceable>string</replaceable>; ... };
+		server-names { <replaceable>quoted_string</replaceable>; ... };
 		sig-signing-nodes <replaceable>integer</replaceable>;
 		sig-signing-signatures <replaceable>integer</replaceable>;
 		sig-signing-type <replaceable>integer</replaceable>;
@@ -982,7 +982,7 @@ zone <replaceable>string</replaceable> [ <replaceable>class</replaceable> ] {
 	serial-update-method ( date | increment | unixtime );
 	server-addresses { ( <replaceable>ipv4_address</replaceable> | <replaceable>ipv6_address</replaceable> ) [ port
 	    <replaceable>integer</replaceable> ]; ... };
-	server-names { <replaceable>string</replaceable>; ... };
+	server-names { <replaceable>quoted_string</replaceable>; ... };
 	sig-signing-nodes <replaceable>integer</replaceable>;
 	sig-signing-signatures <replaceable>integer</replaceable>;
 	sig-signing-type <replaceable>integer</replaceable>;

bin/named/server.c

@@ -2608,12 +2608,12 @@ catz_addmodzone_taskaction(isc_task_t *task, isc_event_t *event0) {
 	 * Load the zone from the master file.	If this fails, we'll
 	 * need to undo the configuration we've done already.
 	 */
-	result = dns_zone_load(zone, true);
+	result = dns_zone_loadnew(zone);
 	if (result != ISC_R_SUCCESS) {
 		dns_db_t *dbp = NULL;
 		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 			      NAMED_LOGMODULE_SERVER, ISC_LOG_ERROR,
-			      "catz: dns_zone_load() failed "
+			      "catz: dns_zone_loadnew() failed "
 			      "with %s; reverting.",
 			      isc_result_totext(result));
 
@@ -3692,7 +3692,6 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
 	isc_dscp_t dscp4 = -1, dscp6 = -1;
 	dns_dyndbctx_t *dctx = NULL;
 	unsigned int resolver_param;
-	dns_ntatable_t *ntatable = NULL;
 	const char *qminmode = NULL;
 
 	REQUIRE(DNS_VIEW_VALID(view));
@@ -5349,35 +5348,8 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
 		CHECK(dns_name_fromstring(name, cfg_obj_asstring(obj), 0,
 					  NULL));
 		view->redirectzone = name;
-	} else {
+	} else
 		view->redirectzone = NULL;
-	}
-
-	/*
-	 * Exceptions to DNSSEC validation.
-	 */
-	obj = NULL;
-	result = named_config_get(maps, "validate-except", &obj);
-	if (result == ISC_R_SUCCESS) {
-		result = dns_view_getntatable(view, &ntatable);
-	}
-	if (result == ISC_R_SUCCESS) {
-		for (element = cfg_list_first(obj);
-		     element != NULL;
-		     element = cfg_list_next(element))
-		{
-			dns_fixedname_t fntaname;
-			dns_name_t *ntaname;
-
-			ntaname = dns_fixedname_initname(&fntaname);
-			obj = cfg_listelt_value(element);
-			CHECK(dns_name_fromstring(ntaname,
-						  cfg_obj_asstring(obj),
-						  0, NULL));
-			CHECK(dns_ntatable_add(ntatable, ntaname,
-					       true, 0, 0xffffffffU));
-		}
-	}
 
 #ifdef HAVE_DNSTAP
 	/*
@@ -5390,51 +5362,35 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
 	result = ISC_R_SUCCESS;
 
  cleanup:
-	if (ntatable != NULL) {
-		dns_ntatable_detach(&ntatable);
-	}
-	if (clients != NULL) {
+	if (clients != NULL)
 		dns_acl_detach(&clients);
-	}
-	if (mapped != NULL) {
+	if (mapped != NULL)
 		dns_acl_detach(&mapped);
-	}
-	if (excluded != NULL) {
+	if (excluded != NULL)
 		dns_acl_detach(&excluded);
-	}
-	if (ring != NULL) {
+	if (ring != NULL)
 		dns_tsigkeyring_detach(&ring);
-	}
-	if (zone != NULL) {
+	if (zone != NULL)
 		dns_zone_detach(&zone);
-	}
-	if (dispatch4 != NULL) {
+	if (dispatch4 != NULL)
 		dns_dispatch_detach(&dispatch4);
-	}
-	if (dispatch6 != NULL) {
+	if (dispatch6 != NULL)
 		dns_dispatch_detach(&dispatch6);
-	}
-	if (resstats != NULL) {
+	if (resstats != NULL)
 		isc_stats_detach(&resstats);
-	}
-	if (resquerystats != NULL) {
+	if (resquerystats != NULL)
 		dns_stats_detach(&resquerystats);
-	}
-	if (order != NULL) {
+	if (order != NULL)
 		dns_order_detach(&order);
-	}
-	if (cmctx != NULL) {
+	if (cmctx != NULL)
 		isc_mem_detach(&cmctx);
-	}
-	if (hmctx != NULL) {
+	if (hmctx != NULL)
 		isc_mem_detach(&hmctx);
-	}
-	if (cache != NULL) {
+
+	if (cache != NULL)
 		dns_cache_detach(&cache);
-	}
-	if (dctx != NULL) {
+	if (dctx != NULL)
 		dns_dyndb_destroyctx(&dctx);
-	}
 
 	return (result);
 }
@@ -5778,7 +5734,6 @@ configure_zone(const cfg_obj_t *config, const cfg_obj_t *zconfig,
 	const cfg_obj_t *typeobj = NULL;
 	const cfg_obj_t *forwarders = NULL;
 	const cfg_obj_t *forwardtype = NULL;
-	const cfg_obj_t *ixfrfromdiffs = NULL;
 	const cfg_obj_t *only = NULL;
 	const cfg_obj_t *signing = NULL;
 	const cfg_obj_t *viewobj = NULL;
@@ -6132,15 +6087,6 @@ configure_zone(const cfg_obj_t *config, const cfg_obj_t *zconfig,
 			dns_zone_setstats(raw, named_g_server->zonestats);
 			CHECK(dns_zone_link(zone, raw));
 		}
-		if (cfg_map_get(zoptions, "ixfr-from-differences",
-				&ixfrfromdiffs) == ISC_R_SUCCESS)
-		{
-			isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-				      NAMED_LOGMODULE_SERVER, ISC_LOG_INFO,
-				      "zone '%s': 'ixfr-from-differences' is "
-				      "ignored for inline-signed zones",
-				      zname);
-		}
 	}
 
 	/*
@@ -8054,7 +8000,7 @@ load_configuration(const char *filename, named_server_t *server,
 			      "less than 128 UDP sockets available after "
 			      "applying 'reserved-sockets' and 'maxsockets'");
 	}
-	isc__socketmgr_setreserved(named_g_socketmgr, reserved);
+	isc_socketmgr_setreserved(named_g_socketmgr, reserved);
 
 #ifdef HAVE_GEOIP
 	/*
@@ -9143,6 +9089,7 @@ view_loaded(void *arg) {
 	ns_zoneload_t *zl = (ns_zoneload_t *) arg;
 	named_server_t *server = zl->server;
 	bool reconfig = zl->reconfig;
+	unsigned int refs;
 
 
 	/*
@@ -9153,34 +9100,35 @@ view_loaded(void *arg) {
 	 * We use the zoneload reference counter to let us
 	 * know when all views are finished.
 	 */
-	if (isc_refcount_decrement(&zl->refs) == 1) {
+	isc_refcount_decrement(&zl->refs, &refs);
+	if (refs != 0)
+		return (ISC_R_SUCCESS);
 
-		isc_refcount_destroy(&zl->refs);
-		isc_mem_put(server->mctx, zl, sizeof (*zl));
+	isc_refcount_destroy(&zl->refs);
+	isc_mem_put(server->mctx, zl, sizeof (*zl));
 
-		/*
-		 * To maintain compatibility with log parsing tools that might
-		 * be looking for this string after "rndc reconfig", we keep it
-		 * as it is
-		 */
-		if (reconfig) {
-			isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-				      NAMED_LOGMODULE_SERVER, ISC_LOG_INFO,
-				      "any newly configured zones are now loaded");
-		} else {
-			isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-				      NAMED_LOGMODULE_SERVER, ISC_LOG_NOTICE,
-				      "all zones loaded");
-		}
-
-		CHECKFATAL(dns_zonemgr_forcemaint(server->zonemgr),
-			   "forcing zone maintenance");
-
-		named_os_started();
+	/*
+	 * To maintain compatibility with log parsing tools that might
+	 * be looking for this string after "rndc reconfig", we keep it
+	 * as it is
+	 */
+	if (reconfig) {
 		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-			      NAMED_LOGMODULE_SERVER, ISC_LOG_NOTICE, "running");
+			      NAMED_LOGMODULE_SERVER, ISC_LOG_INFO,
+			      "any newly configured zones are now loaded");
+	} else {
+		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+			      NAMED_LOGMODULE_SERVER, ISC_LOG_NOTICE,
+			      "all zones loaded");
 	}
 
+	CHECKFATAL(dns_zonemgr_forcemaint(server->zonemgr),
+		   "forcing zone maintenance");
+
+	named_os_started();
+	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		      NAMED_LOGMODULE_SERVER, ISC_LOG_NOTICE, "running");
+
 	return (ISC_R_SUCCESS);
 }
 
@@ -9189,6 +9137,7 @@ load_zones(named_server_t *server, bool init, bool reconfig) {
 	isc_result_t result;
 	dns_view_t *view;
 	ns_zoneload_t *zl;
+	unsigned int refs = 0;
 
 	zl = isc_mem_get(server->mctx, sizeof (*zl));
 	if (zl == NULL)
@@ -9209,14 +9158,14 @@ load_zones(named_server_t *server, bool init, bool reconfig) {
 	     view = ISC_LIST_NEXT(view, link))
 	{
 		if (view->managed_keys != NULL) {
-			result = dns_zone_load(view->managed_keys, false);
+			result = dns_zone_load(view->managed_keys);
 			if (result != ISC_R_SUCCESS &&
 			    result != DNS_R_UPTODATE &&
 			    result != DNS_R_CONTINUE)
 				goto cleanup;
 		}
 		if (view->redirect != NULL) {
-			result = dns_zone_load(view->redirect, false);
+			result = dns_zone_load(view->redirect);
 			if (result != ISC_R_SUCCESS &&
 			    result != DNS_R_UPTODATE &&
 			    result != DNS_R_CONTINUE)
@@ -9227,12 +9176,13 @@ load_zones(named_server_t *server, bool init, bool reconfig) {
 		 * 'dns_view_asyncload' calls view_loaded if there are no
 		 * zones.
 		 */
-		isc_refcount_increment(&zl->refs);
-		CHECK(dns_view_asyncload(view, reconfig, view_loaded, zl));
+		isc_refcount_increment(&zl->refs, NULL);
+		CHECK(dns_view_asyncload(view, view_loaded, zl));
 	}
 
  cleanup:
-	if (isc_refcount_decrement(&zl->refs) == 1) {
+	isc_refcount_decrement(&zl->refs, &refs);
+	if (refs == 0) {
 		isc_refcount_destroy(&zl->refs);
 		isc_mem_put(server->mctx, zl, sizeof (*zl));
 	} else if (init) {
@@ -10124,7 +10074,7 @@ named_server_reloadcommand(named_server_t *server, isc_lex_t *lex,
 			dns_zone_detach(&zone);
 			msg = "zone refresh queued";
 		} else {
-			result = dns_zone_load(zone, false);
+			result = dns_zone_load(zone);
 			dns_zone_detach(&zone);
 			switch (result) {
 			case ISC_R_SUCCESS:
@@ -12778,7 +12728,7 @@ do_addzone(named_server_t *server, ns_cfgctx_t *cfg, dns_view_t *view,
 	 * Load the zone from the master file.  If this fails, we'll
 	 * need to undo the configuration we've done already.
 	 */
-	result = dns_zone_load(zone, true);
+	result = dns_zone_loadnew(zone);
 	if (result != ISC_R_SUCCESS) {
 		dns_db_t *dbp = NULL;
 
@@ -12968,7 +12918,7 @@ do_modzone(named_server_t *server, ns_cfgctx_t *cfg, dns_view_t *view,
 	}
 
 	/* Load the zone from the master file if it needs reloading. */
-	result = dns_zone_load(zone, true);
+	result = dns_zone_loadnew(zone);
 
 	/*
 	 * Dynamic zones need no reloading, so we can pass this result.

bin/named/unix/os.c

@@ -23,8 +23,8 @@
 
 #include <ctype.h>
 #include <errno.h>
-#include <grp.h>
 #include <fcntl.h>
+#include <grp.h>		/* Required for initgroups() on IRIX. */
 #include <pwd.h>
 #include <stdio.h>
 #include <stdlib.h>
@@ -40,7 +40,7 @@
 #include <isc/print.h>
 #include <isc/resource.h>
 #include <isc/result.h>
-#include <isc/strerr.h>
+#include <isc/strerror.h>
 #include <isc/string.h>
 
 #include <named/globals.h>
@@ -130,7 +130,7 @@ linux_setcaps(cap_t caps) {
 		return;
 	}
 	if (cap_set_proc(caps) < 0) {
-		strerror_r(errno, strbuf, sizeof(strbuf));
+		isc__strerror(errno, strbuf, sizeof(strbuf));
 		named_main_earlyfatal("cap_set_proc() failed: %s:"
 				      " please ensure that the capset kernel"
 				      " module is loaded.  see insmod(8)",
@@ -146,13 +146,13 @@ linux_setcaps(cap_t caps) {
 		if (err != -1 && curval) { \
 			err = cap_set_flag(caps, CAP_EFFECTIVE, 1, &capval, CAP_SET); \
 			if (err == -1) { \
-				strerror_r(errno, strbuf, sizeof(strbuf)); \
+				isc__strerror(errno, strbuf, sizeof(strbuf)); \
 				named_main_earlyfatal("cap_set_proc failed: %s", strbuf); \
 			} \
 			\
 			err = cap_set_flag(caps, CAP_PERMITTED, 1, &capval, CAP_SET); \
 			if (err == -1) { \
-				strerror_r(errno, strbuf, sizeof(strbuf)); \
+				isc__strerror(errno, strbuf, sizeof(strbuf)); \
 				named_main_earlyfatal("cap_set_proc failed: %s", strbuf); \
 			} \
 		} \
@@ -161,12 +161,12 @@ linux_setcaps(cap_t caps) {
 	do { \
 		caps = cap_init(); \
 		if (caps == NULL) { \
-			strerror_r(errno, strbuf, sizeof(strbuf)); \
+			isc__strerror(errno, strbuf, sizeof(strbuf)); \
 			named_main_earlyfatal("cap_init failed: %s", strbuf); \
 		} \
 		curcaps = cap_get_proc(); \
 		if (curcaps == NULL) { \
-			strerror_r(errno, strbuf, sizeof(strbuf)); \
+			isc__strerror(errno, strbuf, sizeof(strbuf)); \
 			named_main_earlyfatal("cap_get_proc failed: %s", strbuf); \
 		} \
 	} while (0)
@@ -286,7 +286,7 @@ linux_keepcaps(void) {
 
 	if (prctl(PR_SET_KEEPCAPS, 1, 0, 0, 0) < 0) {
 		if (errno != EINVAL) {
-			strerror_r(errno, strbuf, sizeof(strbuf));
+			isc__strerror(errno, strbuf, sizeof(strbuf));
 			named_main_earlyfatal("prctl() failed: %s", strbuf);
 		}
 	} else {
@@ -331,13 +331,13 @@ named_os_daemonize(void) {
 	char strbuf[ISC_STRERRORSIZE];
 
 	if (pipe(dfd) == -1) {
-		strerror_r(errno, strbuf, sizeof(strbuf));
+		isc__strerror(errno, strbuf, sizeof(strbuf));
 		named_main_earlyfatal("pipe(): %s", strbuf);
 	}
 
 	pid = fork();
 	if (pid == -1) {
-		strerror_r(errno, strbuf, sizeof(strbuf));
+		isc__strerror(errno, strbuf, sizeof(strbuf));
 		named_main_earlyfatal("fork(): %s", strbuf);
 	}
 	if (pid != 0) {
@@ -367,7 +367,7 @@ named_os_daemonize(void) {
 #endif
 
 	if (setsid() == -1) {
-		strerror_r(errno, strbuf, sizeof(strbuf));
+		isc__strerror(errno, strbuf, sizeof(strbuf));
 		named_main_earlyfatal("setsid(): %s", strbuf);
 	}
 
@@ -450,14 +450,14 @@ named_os_chroot(const char *root) {
 	if (root != NULL) {
 #ifdef HAVE_CHROOT
 		if (chroot(root) < 0) {
-			strerror_r(errno, strbuf, sizeof(strbuf));
+			isc__strerror(errno, strbuf, sizeof(strbuf));
 			named_main_earlyfatal("chroot(): %s", strbuf);
 		}
 #else
 		named_main_earlyfatal("chroot(): disabled");
 #endif
 		if (chdir("/") < 0) {
-			strerror_r(errno, strbuf, sizeof(strbuf));
+			isc__strerror(errno, strbuf, sizeof(strbuf));
 			named_main_earlyfatal("chdir(/): %s", strbuf);
 		}
 #ifdef HAVE_LIBSCF
@@ -484,7 +484,7 @@ named_os_inituserinfo(const char *username) {
 
 	if (getuid() == 0) {
 		if (initgroups(runas_pw->pw_name, runas_pw->pw_gid) < 0) {
-			strerror_r(errno, strbuf, sizeof(strbuf));
+			isc__strerror(errno, strbuf, sizeof(strbuf));
 			named_main_earlyfatal("initgroups(): %s", strbuf);
 		}
 	}
@@ -514,12 +514,12 @@ named_os_changeuser(void) {
 #endif
 
 	if (setgid(runas_pw->pw_gid) < 0) {
-		strerror_r(errno, strbuf, sizeof(strbuf));
+		isc__strerror(errno, strbuf, sizeof(strbuf));
 		named_main_earlyfatal("setgid(): %s", strbuf);
 	}
 
 	if (setuid(runas_pw->pw_uid) < 0) {
-		strerror_r(errno, strbuf, sizeof(strbuf));
+		isc__strerror(errno, strbuf, sizeof(strbuf));
 		named_main_earlyfatal("setuid(): %s", strbuf);
 	}
 
@@ -529,7 +529,7 @@ named_os_changeuser(void) {
 	 * call has disabled it.
 	 */
 	if (prctl(PR_SET_DUMPABLE,1,0,0,0) < 0) {
-		strerror_r(errno, strbuf, sizeof(strbuf));
+		isc__strerror(errno, strbuf, sizeof(strbuf));
 		named_main_earlywarning("prctl(PR_SET_DUMPABLE) failed: %s",
 					strbuf);
 	}
@@ -648,7 +648,7 @@ mkdirpath(char *filename, void (*report)(const char *, ...)) {
 
 		if (stat(filename, &sb) == -1) {
 			if (errno != ENOENT) {
-				strerror_r(errno, strbuf, sizeof(strbuf));
+				isc__strerror(errno, strbuf, sizeof(strbuf));
 				(*report)("couldn't stat '%s': %s", filename,
 					  strbuf);
 				goto error;
@@ -668,7 +668,7 @@ mkdirpath(char *filename, void (*report)(const char *, ...)) {
 			mode |= S_IRGRP | S_IXGRP;		/* g=rx */
 			mode |= S_IROTH | S_IXOTH;		/* o=rx */
 			if (mkdir(filename, mode) == -1) {
-				strerror_r(errno, strbuf, sizeof(strbuf));
+				isc__strerror(errno, strbuf, sizeof(strbuf));
 				(*report)("couldn't mkdir '%s': %s", filename,
 					  strbuf);
 				goto error;
@@ -676,7 +676,7 @@ mkdirpath(char *filename, void (*report)(const char *, ...)) {
 			if (runas_pw != NULL &&
 			    chown(filename, runas_pw->pw_uid,
 				  runas_pw->pw_gid) == -1) {
-				strerror_r(errno, strbuf, sizeof(strbuf));
+				isc__strerror(errno, strbuf, sizeof(strbuf));
 				(*report)("couldn't chown '%s': %s", filename,
 					  strbuf);
 			}
@@ -703,7 +703,7 @@ setperms(uid_t uid, gid_t gid) {
 #endif
 #if defined(HAVE_SETEGID)
 	if (getegid() != gid && setegid(gid) == -1) {
-		strerror_r(errno, strbuf, sizeof(strbuf));
+		isc__strerror(errno, strbuf, sizeof(strbuf));
 		named_main_earlywarning("unable to set effective "
 					"gid to %ld: %s",
 					(long)gid, strbuf);
@@ -711,7 +711,7 @@ setperms(uid_t uid, gid_t gid) {
 #elif defined(HAVE_SETRESGID)
 	if (getresgid(&tmpg, &oldgid, &tmpg) == -1 || oldgid != gid) {
 		if (setresgid(-1, gid, -1) == -1) {
-			strerror_r(errno, strbuf, sizeof(strbuf));
+			isc__strerror(errno, strbuf, sizeof(strbuf));
 			named_main_earlywarning("unable to set effective "
 						"gid to %d: %s", gid, strbuf);
 		}
@@ -720,7 +720,7 @@ setperms(uid_t uid, gid_t gid) {
 
 #if defined(HAVE_SETEUID)
 	if (geteuid() != uid && seteuid(uid) == -1) {
-		strerror_r(errno, strbuf, sizeof(strbuf));
+		isc__strerror(errno, strbuf, sizeof(strbuf));
 		named_main_earlywarning("unable to set effective "
 					"uid to %ld: %s",
 					(long)uid, strbuf);
@@ -728,7 +728,7 @@ setperms(uid_t uid, gid_t gid) {
 #elif defined(HAVE_SETRESUID)
 	if (getresuid(&tmpu, &olduid, &tmpu) == -1 || olduid != uid) {
 		if (setresuid(-1, uid, -1) == -1) {
-			strerror_r(errno, strbuf, sizeof(strbuf));
+			isc__strerror(errno, strbuf, sizeof(strbuf));
 			named_main_earlywarning("unable to set effective "
 						"uid to %d: %s", uid, strbuf);
 		}
@@ -747,7 +747,7 @@ named_os_openfile(const char *filename, mode_t mode, bool switch_user) {
 	 */
 	f = strdup(filename);
 	if (f == NULL) {
-		strerror_r(errno, strbuf, sizeof(strbuf));
+		isc__strerror(errno, strbuf, sizeof(strbuf));
 		named_main_earlywarning("couldn't strdup() '%s': %s",
 					filename, strbuf);
 		return (NULL);
@@ -799,7 +799,7 @@ named_os_openfile(const char *filename, mode_t mode, bool switch_user) {
 	}
 
 	if (fd < 0) {
-		strerror_r(errno, strbuf, sizeof(strbuf));
+		isc__strerror(errno, strbuf, sizeof(strbuf));
 		named_main_earlywarning("could not open file '%s': %s",
 					filename, strbuf);
 		return (NULL);
@@ -807,7 +807,7 @@ named_os_openfile(const char *filename, mode_t mode, bool switch_user) {
 
 	fp = fdopen(fd, "w");
 	if (fp == NULL) {
-		strerror_r(errno, strbuf, sizeof(strbuf));
+		isc__strerror(errno, strbuf, sizeof(strbuf));
 		named_main_earlywarning("could not fdopen() file '%s': %s",
 					filename, strbuf);
 	}
@@ -835,7 +835,7 @@ named_os_writepidfile(const char *filename, bool first_time) {
 
 	pidfile = strdup(filename);
 	if (pidfile == NULL) {
-		strerror_r(errno, strbuf, sizeof(strbuf));
+		isc__strerror(errno, strbuf, sizeof(strbuf));
 		(*report)("couldn't strdup() '%s': %s", filename, strbuf);
 		return;
 	}
@@ -882,7 +882,7 @@ named_os_issingleton(const char *filename) {
 	 */
 	lockfile = strdup(filename);
 	if (lockfile == NULL) {
-		strerror_r(errno, strbuf, sizeof(strbuf));
+		isc__strerror(errno, strbuf, sizeof(strbuf));
 		named_main_earlyfatal("couldn't allocate memory for '%s': %s",
 				      filename, strbuf);
 	} else {

bin/named/win32/named.vcxproj.in

@@ -68,7 +68,7 @@
       <GenerateDebugInformation>true</GenerateDebugInformation>
       <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
       <AdditionalLibraryDirectories>..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);..\..\..\lib\isccc\win32\$(Configuration);..\..\..\lib\isccfg\win32\$(Configuration);..\..\..\lib\bind9\win32\$(Configuration);..\..\..\lib\ns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>@OPENSSL_LIB@@LIBXML2_LIB@@GSSAPI_LIB@@GEOIP_LIB@libisc.lib;libdns.lib;libisccc.lib;libisccfg.lib;libbind9.lib;libns.lib;version.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>@LIBXML2_LIB@@OPENSSL_LIB@@GSSAPI_LIB@@GEOIP_LIB@libisc.lib;libdns.lib;libisccc.lib;libisccfg.lib;libbind9.lib;libns.lib;version.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
     </Link>
   </ItemDefinitionGroup>
   <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'">
@@ -98,7 +98,7 @@
       <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
       <LinkTimeCodeGeneration>Default</LinkTimeCodeGeneration>
       <AdditionalLibraryDirectories>..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);..\..\..\lib\isccc\win32\$(Configuration);..\..\..\lib\isccfg\win32\$(Configuration);..\..\..\lib\bind9\win32\$(Configuration);..\..\..\lib\ns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>@OPENSSL_LIB@@LIBXML2_LIB@@GSSAPI_LIB@@GEOIP_LIB@libisc.lib;libdns.lib;libisccc.lib;libisccfg.lib;libbind9.lib;libns.lib;version.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>@LIBXML2_LIB@@OPENSSL_LIB@@GSSAPI_LIB@@GEOIP_LIB@libisc.lib;libdns.lib;libisccc.lib;libisccfg.lib;libbind9.lib;libns.lib;version.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
     </Link>
   </ItemDefinitionGroup>
   <ItemGroup>

bin/named/win32/os.c

@@ -27,6 +27,7 @@
 
 #include <isc/print.h>
 #include <isc/result.h>
+#include <isc/strerror.h>
 #include <isc/string.h>
 #include <isc/ntpaths.h>
 #include <isc/util.h>
@@ -230,7 +231,7 @@ named_os_openfile(const char *filename, int mode, bool switch_user) {
 	UNUSED(switch_user);
 	fd = safe_open(filename, mode, false);
 	if (fd < 0) {
-		strerror_s(strbuf, sizeof(strbuf), errno);
+		isc__strerror(errno, strbuf, sizeof(strbuf));
 		named_main_earlywarning("could not open file '%s': %s",
 					filename, strbuf);
 		return (NULL);
@@ -238,7 +239,7 @@ named_os_openfile(const char *filename, int mode, bool switch_user) {
 
 	fp = fdopen(fd, "w");
 	if (fp == NULL) {
-		strerror_s(strbuf, sizeof(strbuf), errno);
+		isc__strerror(errno, strbuf, sizeof(strbuf));
 		named_main_earlywarning("could not fdopen() file '%s': %s",
 					filename, strbuf);
 		close(fd);
@@ -267,7 +268,7 @@ named_os_writepidfile(const char *filename, bool first_time) {
 
 	pidfile = strdup(filename);
 	if (pidfile == NULL) {
-		strerror_s(strbuf, sizeof(strbuf), errno);
+		isc__strerror(errno, strbuf, sizeof(strbuf));
 		(*report)("couldn't strdup() '%s': %s", filename, strbuf);
 		return;
 	}
@@ -311,7 +312,7 @@ named_os_issingleton(const char *filename) {
 
 	lockfile = strdup(filename);
 	if (lockfile == NULL) {
-		strerror_s(strbuf, sizeof(strbuf), errno);
+		isc__strerror(errno, strbuf, sizeof(strbuf));
 		named_main_earlyfatal("couldn't allocate memory for '%s': %s",
 				      filename, strbuf);
 	}

bin/nsupdate/nsupdate.c

@@ -99,6 +99,20 @@
 #endif
 #endif
 
+#ifdef HAVE_ADDRINFO
+#ifdef HAVE_GETADDRINFO
+#ifdef HAVE_GAISTRERROR
+#define USE_GETADDRINFO
+#endif
+#endif
+#endif
+
+#ifndef USE_GETADDRINFO
+#ifndef ISC_PLATFORM_NONSTDHERRNO
+extern int h_errno;
+#endif
+#endif
+
 #define MAXCMD (128 * 1024)
 #define MAXWIRE (64 * 1024)
 #define PACKETSIZE ((64 * 1024) - 1)

bin/nsupdate/win32/nsupdate.vcxproj.in

@@ -68,7 +68,7 @@
       <GenerateDebugInformation>true</GenerateDebugInformation>
       <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
       <AdditionalLibraryDirectories>..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);..\..\..\lib\bind9\win32\$(Configuration);..\..\..\lib\isccfg\win32\$(Configuration);..\..\..\lib\irs\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>@OPENSSL_LIB@@READLINE_LIBD@@GSSAPI_LIB@@KRB5_LIB@libisc.lib;libdns.lib;libbind9.lib;libisccfg.lib;libirs.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>@READLINE_LIBD@@GSSAPI_LIB@@KRB5_LIB@libisc.lib;libdns.lib;libbind9.lib;libisccfg.lib;libirs.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
     </Link>
   </ItemDefinitionGroup>
   <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'">
@@ -98,7 +98,7 @@
       <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
       <LinkTimeCodeGeneration>Default</LinkTimeCodeGeneration>
       <AdditionalLibraryDirectories>..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);..\..\..\lib\bind9\win32\$(Configuration);..\..\..\lib\isccfg\win32\$(Configuration);..\..\..\lib\irs\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>@OPENSSL_LIB@@READLINE_LIB@@GSSAPI_LIB@@KRB5_LIB@libisc.lib;libdns.lib;libbind9.lib;libisccfg.lib;libirs.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>@READLINE_LIB@@GSSAPI_LIB@@KRB5_LIB@libisc.lib;libdns.lib;libbind9.lib;libisccfg.lib;libirs.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
     </Link>
   </ItemDefinitionGroup>
   <ItemGroup>

bin/pkcs11/win32/pk11destroy.vcxproj.in

@@ -70,7 +70,7 @@
       <GenerateDebugInformation>true</GenerateDebugInformation>
       <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
       <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>@OPENSSL_LIB@libisc.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>libisc.lib;%(AdditionalDependencies)</AdditionalDependencies>
     </Link>
   </ItemDefinitionGroup>
   <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'">
@@ -100,7 +100,7 @@
       <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
       <LinkTimeCodeGeneration>Default</LinkTimeCodeGeneration>
       <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>@OPENSSL_LIB@libisc.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>libisc.lib;%(AdditionalDependencies)</AdditionalDependencies>
     </Link>
   </ItemDefinitionGroup>
   <ItemGroup>

bin/pkcs11/win32/pk11keygen.vcxproj.in

@@ -70,7 +70,7 @@
       <GenerateDebugInformation>true</GenerateDebugInformation>
       <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
       <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>@OPENSSL_LIB@libisc.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>libisc.lib;%(AdditionalDependencies)</AdditionalDependencies>
     </Link>
   </ItemDefinitionGroup>
   <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'">
@@ -100,7 +100,7 @@
       <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
       <LinkTimeCodeGeneration>Default</LinkTimeCodeGeneration>
       <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>@OPENSSL_LIB@libisc.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>libisc.lib;%(AdditionalDependencies)</AdditionalDependencies>
     </Link>
   </ItemDefinitionGroup>
   <ItemGroup>

bin/pkcs11/win32/pk11list.vcxproj.in

@@ -70,7 +70,7 @@
       <GenerateDebugInformation>true</GenerateDebugInformation>
       <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
       <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>@OPENSSL_LIB@libisc.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>libisc.lib;%(AdditionalDependencies)</AdditionalDependencies>
     </Link>
   </ItemDefinitionGroup>
   <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'">
@@ -100,7 +100,7 @@
       <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
       <LinkTimeCodeGeneration>Default</LinkTimeCodeGeneration>
       <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>@OPENSSL_LIB@libisc.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>libisc.lib;%(AdditionalDependencies)</AdditionalDependencies>
     </Link>
   </ItemDefinitionGroup>
   <ItemGroup>

bin/pkcs11/win32/pk11tokens.vcxproj.in

@@ -70,7 +70,7 @@
       <GenerateDebugInformation>true</GenerateDebugInformation>
       <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
       <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>@OPENSSL_LIB@libisc.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>libisc.lib;%(AdditionalDependencies)</AdditionalDependencies>
     </Link>
   </ItemDefinitionGroup>
   <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'">
@@ -100,7 +100,7 @@
       <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
       <LinkTimeCodeGeneration>Default</LinkTimeCodeGeneration>
       <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>@OPENSSL_LIB@libisc.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>libisc.lib;%(AdditionalDependencies)</AdditionalDependencies>
     </Link>
   </ItemDefinitionGroup>
   <ItemGroup>

bin/rndc/win32/rndc.vcxproj.in

@@ -68,7 +68,7 @@
       <GenerateDebugInformation>true</GenerateDebugInformation>
       <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
       <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);..\..\..\lib\isccfg\win32\$(Configuration);..\..\..\lib\isccc\win32\$(Configuration);..\..\..\lib\bind9\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>@OPENSSL_LIB@util.lib;libisc.lib;libdns.lib;libisccfg.lib;libisccc.lib;libbind9.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>util.lib;libisc.lib;libdns.lib;libisccfg.lib;libisccc.lib;libbind9.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
     </Link>
   </ItemDefinitionGroup>
   <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'">
@@ -98,7 +98,7 @@
       <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
       <LinkTimeCodeGeneration>Default</LinkTimeCodeGeneration>
       <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);..\..\..\lib\isccfg\win32\$(Configuration);..\..\..\lib\isccc\win32\$(Configuration);..\..\..\lib\bind9\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>@OPENSSL_LIB@util.lib;libisc.lib;libdns.lib;libisccfg.lib;libisccc.lib;libbind9.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>util.lib;libisc.lib;libdns.lib;libisccfg.lib;libisccc.lib;libbind9.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
     </Link>
   </ItemDefinitionGroup>
   <ItemGroup>

bin/tests/optional/Makefile.in

@@ -20,7 +20,6 @@ CDEFINES =	@USE_GSSAPI@
 
 CWARNINGS =
 BACKTRACECFLAGS = @BACKTRACECFLAGS@
-PTHREAD_CFLAGS = @PTHREAD_CFLAGS@
 
 DNSLIBS =	../../../lib/dns/libdns.@A@ @DNS_CRYPTO_LIBS@
 ISCLIBS =	../../../lib/isc/libisc.@A@ @OPENSSL_LIBS@
@@ -52,6 +51,7 @@ XTARGETS =	adb_test@EXEEXT@ \
 		hash_test@EXEEXT@ \
 		fsaccess_test@EXEEXT@ \
 		inter_test@EXEEXT@ \
+		keyboard_test@EXEEXT@ \
 		lex_test@EXEEXT@ \
 		lfsr_test@EXEEXT@ \
 		log_test@EXEEXT@ \
@@ -82,6 +82,7 @@ XSRCS =		adb_test.c \
 		fsaccess_test.c \
 		gsstest.c \
 		inter_test.c \
+		keyboard_test.c \
 		lex_test.c \
 		lfsr_test.c \
 		log_test.c \
@@ -105,7 +106,7 @@ XSRCS =		adb_test.c \
 
 # disable optimization for backtrace test to get the expected result
 BTTEST_CFLAGS =	${BACKTRACECFLAGS} ${EXT_CFLAGS} ${ALL_CPPFLAGS} -g \
-		${ALWAYS_WARNINGS} ${STD_CWARNINGS} ${CWARNINGS} ${PTHREAD_CFLAGS}
+		${ALWAYS_WARNINGS} ${STD_CWARNINGS} ${CWARNINGS}
 
 all_tests: ${XTARGETS}
 
@@ -239,6 +240,10 @@ inter_test@EXEEXT@: inter_test.@O@ ${ISCDEPLIBS}
 	${LIBTOOL_MODE_LINK} ${PURIFY} ${CC} ${CFLAGS} ${LDFLAGS} -o $@ inter_test.@O@ \
 		${ISCLIBS} ${LIBS}
 
+keyboard_test@EXEEXT@: keyboard_test.@O@ ${ISCDEPLIBS}
+	${LIBTOOL_MODE_LINK} ${PURIFY} ${CC} ${CFLAGS} ${LDFLAGS} -o $@ keyboard_test.@O@ \
+		${ISCLIBS} ${LIBS}
+
 sig0_test@EXEEXT@: sig0_test.@O@ ${ISCDEPLIBS} ${DNSDEPLIBS}
 	${LIBTOOL_MODE_LINK} ${PURIFY} ${CC} ${CFLAGS} ${LDFLAGS} -o $@ sig0_test.@O@ \
 		${DNSLIBS} ${ISCLIBS} ${LIBS}

bin/tests/optional/keyboard_test.c

@@ -0,0 +1,67 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+/*! \file */
+#include <config.h>
+
+#include <stdio.h>
+#include <stdlib.h>
+
+#include <isc/keyboard.h>
+#include <isc/print.h>
+#include <isc/util.h>
+
+static void
+CHECK(const char *msg, isc_result_t result) {
+	if (result != ISC_R_SUCCESS) {
+		printf("FAILURE:  %s:  %s\n", msg, isc_result_totext(result));
+		exit(1);
+	}
+}
+
+int
+main(int argc, char **argv) {
+	isc_keyboard_t kbd;
+	unsigned char c;
+	isc_result_t res;
+	unsigned int count;
+
+	UNUSED(argc);
+	UNUSED(argv);
+
+	printf("Type Q to exit.\n");
+
+	res = isc_keyboard_open(&kbd);
+	CHECK("isc_keyboard_open()", res);
+
+	c = 'x';
+	count = 0;
+	while (res == ISC_R_SUCCESS && c != 'Q') {
+		res = isc_keyboard_getchar(&kbd, &c);
+		printf(".");
+		fflush(stdout);
+		count++;
+		if (count % 64 == 0)
+			printf("\r\n");
+	}
+	printf("\r\n");
+	if (res != ISC_R_SUCCESS) {
+		printf("FAILURE:  keyboard getchar failed:  %s\r\n",
+		       isc_result_totext(res));
+		goto errout;
+	}
+
+ errout:
+	res = isc_keyboard_close(&kbd, 3);
+	CHECK("isc_keyboard_close()", res);
+
+	return (0);
+}

bin/tests/optional/serial_test.c

@@ -12,11 +12,11 @@
 #include <config.h>
 
 #include <stdio.h>
-#include <stdlib.h>
 #include <inttypes.h>
 
 #include <isc/print.h>
 #include <isc/serial.h>
+#include <isc/stdlib.h>
 
 int
 main() {

bin/tests/optional/zone_test.c

@@ -122,7 +122,7 @@ setup(const char *zonename, const char *filename, const char *classname) {
 	if (zonetype == dns_zone_slave)
 		dns_zone_setmasters(zone, &addr, 1);
 
-	result = dns_zone_load(zone, false);
+	result = dns_zone_load(zone);
 	ERRRET(result, "dns_zone_load");
 
 	result = dns_zonemgr_managezone(zonemgr, zone);

bin/tests/system/checkconf/good.conf

@@ -65,9 +65,6 @@ options {
 	max-cache-size 20000000000000;
 	nta-lifetime 604800;
 	nta-recheck 604800;
-	validate-except {
-		"corp";
-	};
 	transfer-source 0.0.0.0 dscp 63;
 	zone-statistics none;
 };

bin/tests/system/conf.sh.in

@@ -138,7 +138,11 @@ else
 	TESTSOCK6=false
 fi
 
-TESTSOCK6="$TESTSOCK6"
+if grep "^#define WANT_IPV6 1" $TOP/config.h > /dev/null 2>&1 ; then
+        TESTSOCK6="$TESTSOCK6"
+else
+        TESTSOCK6=false
+fi
 
 # Windows process management leave empty
 PSSUSPEND=

bin/tests/system/conf.sh.win32

@@ -107,7 +107,7 @@ PARALLELDIRS="allow_query catz rpzrecurse serve-stale"
 SUBDIRS="$SEQUENTIALDIRS $PARALLELDIRS"
 
 # missing: chain integrity
-# extra: dname ednscompliance forward
+# extra: dname ednscompliance forward 
 
 #Things that are different on Windows
 KILL="/bin/kill -f"
@@ -117,7 +117,7 @@ DOS2UNIX=dos2unix
 TP=
 
 # Configure is launched from native environment, but tests are run in Cygwin -
-# so any detection is unreliable.
+# so any detection is unreliable. 
 SHELL="/bin/bash -o igncr"
 CURL=/usr/bin/curl
 XMLLINT=/usr/bin/xmllint
@@ -135,7 +135,11 @@ else
 	TESTSOCK6=false
 fi
 
-TESTSOCK6="$TESTSOCK6"
+if grep "^#define WANT_IPV6 1" $TOP/config.h > /dev/null 2>&1 ; then
+        TESTSOCK6="$TESTSOCK6"
+else
+        TESTSOCK6=false
+fi
 
 #
 # PsSuspend is part of PSTools and can be downloaded from

bin/tests/system/dnssec/ns2/corp.db

@@ -1,21 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 30	; 5 minutes
-@			IN SOA	mname1. . (
-				2000042407 ; serial
-				20         ; refresh (20 seconds)
-				20         ; retry (20 seconds)
-				1814400    ; expire (3 weeks)
-				30       ; minimum (1 hour)
-				)
-			NS	ns2
-ns2			A	10.53.0.2
-
-www			A	10.0.0.1

bin/tests/system/dnssec/ns2/named.conf.in

@@ -158,9 +158,4 @@ zone "cdnskey-auto.secure" {
 	allow-update { any; };
 };
 
-zone "corp" {
-	type master;
-	file "corp.db";
-};
-
 include "trusted.conf";

bin/tests/system/dnssec/ns4/named1.conf.in

@@ -28,8 +28,6 @@ options {
 	nta-lifetime 12s;
 	nta-recheck 9s;
 
-	validate-except { corp; };
-
 	# Note: We only reference the bind.keys file here to confirm that it
 	# is *not* being used.  It contains the real root key, and we're
 	# using a local toy root zone for the tests, so it wouldn't work.
@@ -52,9 +50,4 @@ zone "." {
 	file "../../common/root.hint";
 };
 
-zone "corp" {
-	type static-stub;
-	server-addresses { 10.53.0.2; };
-};
-
 include "trusted.conf";

bin/tests/system/dnssec/tests.sh

@@ -1764,15 +1764,6 @@ n=`expr $n + 1`
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
 
-echo_i "checking validate-except in an insecure local domain ($n)"
-ret=0
-$DIG $DIGOPTS ns www.corp @10.53.0.4 > dig.out.ns4.test$n || ret=1
-grep "NOERROR" dig.out.ns4.test$n > /dev/null || ret=1
-grep "flags:[^;]* ad[^;]*;" dig.out.ns4.test$n > /dev/null && ret=1
-n=`expr $n + 1`
-if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
-
 echo_i "checking positive and negative validation with negative trust anchors ($n)"
 ret=0
 
@@ -2174,14 +2165,10 @@ fi
 echo_i "sleeping for an additional 4 seconds for ns4 to fully startup"
 sleep 4
 
-# dump the NTA to a file (omit validate-except entries)
-echo_i "testing 'rndc nta'"
+# dump the NTA to a file
 $RNDCCMD 10.53.0.4 nta -d > rndc.out.ns4.test$n.1 2>/dev/null
-# "corp" is configured as a validate-except domain and thus should be
-# omitted. only "secure.example" should be in the dump at this point.
 lines=`wc -l < rndc.out.ns4.test$n.1`
 [ "$lines" -eq 1 ] || ret=1
-grep 'secure.example' rndc.out.ns4.test$n.1 > /dev/null || ret=1
 ts=`awk '{print $3" "$4}' < rndc.out.ns4.test$n.1`
 # rndc nta outputs localtime, so append the timezone
 ts_with_zone="$ts `date +%z`"

bin/tests/system/dnstap/ns1/named.conf.in

@@ -26,7 +26,6 @@ options {
 	dnstap { all; };
 	send-cookie no;
 	require-server-cookie no;
-	dnssec-validation yes;
 };
 
 key rndc_key {

bin/tests/system/dnstap/ns2/named.conf.in

@@ -26,7 +26,6 @@ options {
 	dnstap { all; };
 	send-cookie no;
 	require-server-cookie no;
-	dnssec-validation yes;
 };
 
 key rndc_key {

bin/tests/system/dnstap/ns3/named.conf.in

@@ -27,7 +27,6 @@ options {
 	send-cookie no;
 	require-server-cookie no;
 	minimal-responses no;
-	dnssec-validation yes;
 };
 
 server 10.53.0.1 { tcp-only yes; };

bin/tests/system/dnstap/ns4/named.conf.in

@@ -26,7 +26,6 @@ options {
 	dnstap { all; };
 	send-cookie no;
 	require-server-cookie no;
-	dnssec-validation yes;
 };
 
 server 10.53.0.1 { tcp-only yes; };

bin/tests/system/dyndb/driver/db.c

@@ -72,7 +72,7 @@ attach(dns_db_t *source, dns_db_t **targetp) {
 
 	REQUIRE(VALID_SAMPLEDB(sampledb));
 
-	isc_refcount_increment(&sampledb->refs);
+	isc_refcount_increment(&sampledb->refs, NULL);
 	*targetp = source;
 }
 
@@ -87,13 +87,15 @@ free_sampledb(sampledb_t *sampledb) {
 
 static void
 detach(dns_db_t **dbp) {
-	REQUIRE(dbp != NULL && VALID_SAMPLEDB((sampledb_t *)(*dbp)));
 	sampledb_t *sampledb = (sampledb_t *)(*dbp);
-	*dbp = NULL;
+	unsigned int refs;
 
-	if (isc_refcount_decrement(&sampledb->refs) == 1) {
+	REQUIRE(VALID_SAMPLEDB(sampledb));
+
+	isc_refcount_decrement(&sampledb->refs, &refs);
+	if (refs == 0)
 		free_sampledb(sampledb);
-	}
+	*dbp = NULL;
 }
 
 /*
@@ -771,7 +773,7 @@ create_db(isc_mem_t *mctx, const dns_name_t *origin, dns_dbtype_t type,
 
 	CHECK(dns_name_dupwithoffsets(origin, mctx, &sampledb->common.origin));
 
-	isc_refcount_init(&sampledb->refs, 1);
+	CHECK(isc_refcount_init(&sampledb->refs, 1));
 
 	/* Translate instance name to instance pointer. */
 	sampledb->inst = driverarg;

bin/tests/system/dyndb/driver/zone.c

@@ -151,7 +151,7 @@ load_zone(dns_zone_t *zone) {
 	bool zone_dynamic;
 	uint32_t serial;
 
-	result = dns_zone_load(zone, false);
+	result = dns_zone_load(zone);
 	if (result != ISC_R_SUCCESS && result != DNS_R_UPTODATE
 	    && result != DNS_R_DYNAMIC && result != DNS_R_CONTINUE)
 		goto cleanup;

bin/tests/system/filter-aaaa/ns5/hints

@@ -1,11 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-. 0 NS ns.rootservers.utld.
-ns.rootservers.utld. 0 A 10.53.0.1

bin/tests/system/filter-aaaa/ns5/named.conf.in

@@ -1,42 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-options {
-	query-source address 10.53.0.5;
-	notify-source 10.53.0.5;
-	transfer-source 10.53.0.5;
-	port @PORT@;
-	pid-file "named.pid";
-	listen-on { 10.53.0.5; };
-	listen-on-v6 { fd92:7065:b8e:ffff::5; };
-	recursion yes;
-	dnssec-validation no;
-	notify yes;
-	dns64 64:ff9b::/96 {
-			    clients { any; };
-			    exclude { any; };
-			    mapped { any; };
-	};
-	filter-aaaa-on-v4 break-dnssec;
-	filter-aaaa { any; };
-	minimal-responses no;
-};
-
-key rndc_key {
-	secret "1234abcd8765";
-	algorithm hmac-sha256;
-};
-
-controls {
-	inet 10.53.0.5 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
-};
-
-zone "." { type hint; file "hints"; };

bin/tests/system/filter-aaaa/setup.sh

@@ -18,7 +18,6 @@ copy_setports ns1/named1.conf.in ns1/named.conf
 copy_setports ns2/named1.conf.in ns2/named.conf
 copy_setports ns3/named1.conf.in ns3/named.conf
 copy_setports ns4/named1.conf.in ns4/named.conf
-copy_setports ns5/named.conf.in ns5/named.conf
 
 (cd ns1 && $SHELL -e sign.sh)
 (cd ns4 && $SHELL -e sign.sh)

bin/tests/system/filter-aaaa/tests.sh

@@ -1374,17 +1374,5 @@ grep "^mx.unsigned.*AAAA" dig.out.ns3.test$n > /dev/null 2>&1 || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
 
-# We don't check for the AAAA record here as configuration in ns5 does
-# not make sense.  The AAAA record is wanted by filter-aaaa but discarded
-# by the dns64 configuration. We just want to ensure the server stays
-# running.
-n=`expr $n + 1`
-echo_i "checking filter-aaaa with dns64 ($n)"
-ret=0
-$DIG $DIGOPTS aaaa aaaa-only.unsigned @10.53.0.5 > dig.out.ns5.test$n || ret=1
-grep "status: NOERROR" dig.out.ns5.test$n > /dev/null || ret=1
-if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
-
 echo_i "exit status: $status"
 [ $status -eq 0 ] || exit 1

bin/tests/system/ifconfig.sh

@@ -38,7 +38,15 @@ EOF
 	exit 1
 fi
 
-sys=`sh $config_guess`
+# If running on hp-ux, don't even try to run config.guess.
+# It will try to create a temporary file in the current directory,
+# which fails when running as root with the current directory
+# on a NFS mounted disk.
+
+case `uname -a` in
+	*HP-UX*) sys=hpux ;;
+	*) sys=`sh $config_guess` ;;
+esac
 
 use_ip=
 case "$sys" in

bin/tests/system/inline/clean.sh

@@ -73,10 +73,6 @@ rm -f ns3/nsec3.db
 rm -f ns3/nsec3.db.jnl
 rm -f ns3/nsec3.db.signed
 rm -f ns3/nsec3.db.signed.jnl
-rm -f ns3/delayedkeys.db
-rm -f ns3/delayedkeys.db.jnl
-rm -f ns3/delayedkeys.db.signed
-rm -f ns3/delayedkeys.db.signed.jnl
 rm -f ns3/removedkeys-primary.db
 rm -f ns3/removedkeys-primary.db.jnl
 rm -f ns3/removedkeys-primary.db.signed

bin/tests/system/inline/ns2/bits.db.in

@@ -18,3 +18,110 @@ $TTL 300	; 5 minutes
 			NS	ns3
 ns2			A	10.53.0.2
 ns3			A	10.53.0.3
+
+a			A	10.0.0.1
+b			A	10.0.0.2
+d			A	10.0.0.4
+
+; Used for testing ANY queries
+foo			TXT	"testing"
+foo			A	10.0.1.0
+
+bad-cname		CNAME   a
+bad-dname		DNAME   @
+
+; Used for testing CNAME queries
+cname1			CNAME	cname1-target
+cname1-target		TXT	"testing cname"
+
+cname2			CNAME	cname2-target
+cname2-target		TXT	"testing cname"
+
+; Used for testing DNAME queries
+dname1			DNAME	dname1-target
+foo.dname1-target	TXT	"testing dname"
+
+dname2			DNAME	dname2-target
+foo.dname2-target	TXT	"testing dname"
+
+; A secure subdomain
+secure			NS	ns.secure
+ns.secure		A	10.53.0.3
+
+; An insecure subdomain
+insecure		NS	ns.insecure
+ns.insecure		A	10.53.0.3
+
+; A secure subdomain we're going to inject bogus data into
+bogus			NS	ns.bogus
+ns.bogus		A	10.53.0.3
+
+; A dynamic secure subdomain
+dynamic			NS	dynamic
+dynamic			A	10.53.0.3
+
+; A insecure subdomain
+mustbesecure		NS	ns.mustbesecure
+ns.mustbesecure		A	10.53.0.3
+
+; A rfc2535 signed zone w/ CNAME
+rfc2535			NS	ns.rfc2535
+ns.rfc2535		A	10.53.0.3
+
+z			A	10.0.0.26
+
+keyless			NS	ns.keyless
+ns.keyless		A	10.53.0.3
+
+nsec3			NS	ns.nsec3
+ns.nsec3		A	10.53.0.3
+
+optout			NS	ns.optout
+ns.optout		A	10.53.0.3
+
+nsec3-unknown		NS	ns.nsec3-unknown
+ns.nsec3-unknown	A	10.53.0.3
+
+optout-unknown		NS	ns.optout-unknown
+ns.optout-unknown	A	10.53.0.3
+
+multiple		NS	ns.multiple
+ns.multiple		A	10.53.0.3
+
+*.wild			A	10.0.0.27
+
+rsasha256		NS	ns.rsasha256
+ns.rsasha256		A	10.53.0.3
+
+rsasha512		NS	ns.rsasha512
+ns.rsasha512		A	10.53.0.3
+
+kskonly 		NS	ns.kskonly
+ns.kskonly		A	10.53.0.3
+
+update-nsec3		NS	ns.update-nsec3
+ns.update-nsec3		A	10.53.0.3
+
+auto-nsec		NS	ns.auto-nsec
+ns.auto-nsec		A	10.53.0.3
+
+auto-nsec3		NS	ns.auto-nsec3
+ns.auto-nsec3		A	10.53.0.3
+
+
+below-cname		CNAME	some.where.else.
+
+insecure.below-cname	NS	ns.insecure.below-cname
+ns.insecure.below-cname	A	10.53.0.3
+
+secure.below-cname	NS	ns.secure.below-cname
+ns.secure.below-cname	A	10.53.0.3
+
+ttlpatch		NS	ns.ttlpatch
+ns.ttlpatch		A	10.53.0.3
+
+split-dnssec		NS	ns.split-dnssec
+ns.split-dnssec		A	10.53.0.3
+
+split-smart		NS	ns.split-smart
+ns.split-smart		A	10.53.0.3

bin/tests/system/inline/ns2/named.conf.in

@@ -48,7 +48,6 @@ zone "retransfer3" {
 	type master;
 	file "retransfer3.db";
 	allow-update { any; };
-	allow-transfer { none; };	// changed dynamically by tests.sh
 	notify no;
 };
 

bin/tests/system/inline/ns3/master.db.in

@@ -16,4 +16,112 @@ $TTL 300	; 5 minutes
 				3600       ; minimum (1 hour)
 				)
 			NS	ns3
+ns2			A	10.53.0.2
 ns3			A	10.53.0.3
+
+a			A	10.0.0.1
+b			A	10.0.0.2
+d			A	10.0.0.4
+
+; Used for testing ANY queries
+foo			TXT	"testing"
+foo			A	10.0.1.0
+
+bad-cname		CNAME   a
+bad-dname		DNAME   @
+
+; Used for testing CNAME queries
+cname1			CNAME	cname1-target
+cname1-target		TXT	"testing cname"
+
+cname2			CNAME	cname2-target
+cname2-target		TXT	"testing cname"
+
+; Used for testing DNAME queries
+dname1			DNAME	dname1-target
+foo.dname1-target	TXT	"testing dname"
+
+dname2			DNAME	dname2-target
+foo.dname2-target	TXT	"testing dname"
+
+; A secure subdomain
+secure			NS	ns.secure
+ns.secure		A	10.53.0.3
+
+; An insecure subdomain
+insecure		NS	ns.insecure
+ns.insecure		A	10.53.0.3
+
+; A secure subdomain we're going to inject bogus data into
+bogus			NS	ns.bogus
+ns.bogus		A	10.53.0.3
+
+; A dynamic secure subdomain
+dynamic			NS	dynamic
+dynamic			A	10.53.0.3
+
+; A insecure subdomain
+mustbesecure		NS	ns.mustbesecure
+ns.mustbesecure		A	10.53.0.3
+
+; A rfc2535 signed zone w/ CNAME
+rfc2535			NS	ns.rfc2535
+ns.rfc2535		A	10.53.0.3
+
+z			A	10.0.0.26
+
+keyless			NS	ns.keyless
+ns.keyless		A	10.53.0.3
+
+nsec3			NS	ns.nsec3
+ns.nsec3		A	10.53.0.3
+
+optout			NS	ns.optout
+ns.optout		A	10.53.0.3
+
+nsec3-unknown		NS	ns.nsec3-unknown
+ns.nsec3-unknown	A	10.53.0.3
+
+optout-unknown		NS	ns.optout-unknown
+ns.optout-unknown	A	10.53.0.3
+
+multiple		NS	ns.multiple
+ns.multiple		A	10.53.0.3
+
+*.wild			A	10.0.0.27
+
+rsasha256		NS	ns.rsasha256
+ns.rsasha256		A	10.53.0.3
+
+rsasha512		NS	ns.rsasha512
+ns.rsasha512		A	10.53.0.3
+
+kskonly 		NS	ns.kskonly
+ns.kskonly		A	10.53.0.3
+
+update-nsec3		NS	ns.update-nsec3
+ns.update-nsec3		A	10.53.0.3
+
+auto-nsec		NS	ns.auto-nsec
+ns.auto-nsec		A	10.53.0.3
+
+auto-nsec3		NS	ns.auto-nsec3
+ns.auto-nsec3		A	10.53.0.3
+
+
+below-cname		CNAME	some.where.else.
+
+insecure.below-cname	NS	ns.insecure.below-cname
+ns.insecure.below-cname	A	10.53.0.3
+
+secure.below-cname	NS	ns.secure.below-cname
+ns.secure.below-cname	A	10.53.0.3
+
+ttlpatch		NS	ns.ttlpatch
+ns.ttlpatch		A	10.53.0.3
+
+split-dnssec		NS	ns.split-dnssec
+ns.split-dnssec		A	10.53.0.3
+
+split-smart		NS	ns.split-smart
+ns.split-smart		A	10.53.0.3

bin/tests/system/inline/ns3/master2.db.in

@@ -16,6 +16,113 @@ $TTL 300	; 5 minutes
 				3600       ; minimum (1 hour)
 				)
 			NS	ns3
+ns2			A	10.53.0.2
 ns3			A	10.53.0.3
 
+a			A	10.0.0.1
+b			A	10.0.0.2
+d			A	10.0.0.4
 e			A	10.0.0.5
+
+; Used for testing ANY queries
+foo			TXT	"testing"
+foo			A	10.0.1.0
+
+bad-cname		CNAME   a
+bad-dname		DNAME   @
+
+; Used for testing CNAME queries
+cname1			CNAME	cname1-target
+cname1-target		TXT	"testing cname"
+
+cname2			CNAME	cname2-target
+cname2-target		TXT	"testing cname"
+
+; Used for testing DNAME queries
+dname1			DNAME	dname1-target
+foo.dname1-target	TXT	"testing dname"
+
+dname2			DNAME	dname2-target
+foo.dname2-target	TXT	"testing dname"
+
+; A secure subdomain
+secure			NS	ns.secure
+ns.secure		A	10.53.0.3
+
+; An insecure subdomain
+insecure		NS	ns.insecure
+ns.insecure		A	10.53.0.3
+
+; A secure subdomain we're going to inject bogus data into
+bogus			NS	ns.bogus
+ns.bogus		A	10.53.0.3
+
+; A dynamic secure subdomain
+dynamic			NS	dynamic
+dynamic			A	10.53.0.3
+
+; A insecure subdomain
+mustbesecure		NS	ns.mustbesecure
+ns.mustbesecure		A	10.53.0.3
+
+; A rfc2535 signed zone w/ CNAME
+rfc2535			NS	ns.rfc2535
+ns.rfc2535		A	10.53.0.3
+
+z			A	10.0.0.26
+
+keyless			NS	ns.keyless
+ns.keyless		A	10.53.0.3
+
+nsec3			NS	ns.nsec3
+ns.nsec3		A	10.53.0.3
+
+optout			NS	ns.optout
+ns.optout		A	10.53.0.3
+
+nsec3-unknown		NS	ns.nsec3-unknown
+ns.nsec3-unknown	A	10.53.0.3
+
+optout-unknown		NS	ns.optout-unknown
+ns.optout-unknown	A	10.53.0.3
+
+multiple		NS	ns.multiple
+ns.multiple		A	10.53.0.3
+
+*.wild			A	10.0.0.27
+
+rsasha256		NS	ns.rsasha256
+ns.rsasha256		A	10.53.0.3
+
+rsasha512		NS	ns.rsasha512
+ns.rsasha512		A	10.53.0.3
+
+kskonly 		NS	ns.kskonly
+ns.kskonly		A	10.53.0.3
+
+update-nsec3		NS	ns.update-nsec3
+ns.update-nsec3		A	10.53.0.3
+
+auto-nsec		NS	ns.auto-nsec
+ns.auto-nsec		A	10.53.0.3
+
+auto-nsec3		NS	ns.auto-nsec3
+ns.auto-nsec3		A	10.53.0.3
+
+
+below-cname		CNAME	some.where.else.
+
+insecure.below-cname	NS	ns.insecure.below-cname
+ns.insecure.below-cname	A	10.53.0.3
+
+secure.below-cname	NS	ns.secure.below-cname
+ns.secure.below-cname	A	10.53.0.3
+
+ttlpatch		NS	ns.ttlpatch
+ns.ttlpatch		A	10.53.0.3
+
+split-dnssec		NS	ns.split-dnssec
+ns.split-dnssec		A	10.53.0.3
+
+split-smart		NS	ns.split-smart
+ns.split-smart		A	10.53.0.3

bin/tests/system/inline/ns3/master3.db.in

@@ -16,7 +16,114 @@ $TTL 300	; 5 minutes
 				3600       ; minimum (1 hour)
 				)
 			NS	ns3
+ns2			A	10.53.0.2
 ns3			A	10.53.0.3
 
+a			A	10.0.0.1
+b			A	10.0.0.2
 c			A	10.0.0.3
+d			A	10.0.0.4
 e			A	10.0.0.5
+
+; Used for testing ANY queries
+foo			TXT	"testing"
+foo			A	10.0.1.0
+
+bad-cname		CNAME   a
+bad-dname		DNAME   @
+
+; Used for testing CNAME queries
+cname1			CNAME	cname1-target
+cname1-target		TXT	"testing cname"
+
+cname2			CNAME	cname2-target
+cname2-target		TXT	"testing cname"
+
+; Used for testing DNAME queries
+dname1			DNAME	dname1-target
+foo.dname1-target	TXT	"testing dname"
+
+dname2			DNAME	dname2-target
+foo.dname2-target	TXT	"testing dname"
+
+; A secure subdomain
+secure			NS	ns.secure
+ns.secure		A	10.53.0.3
+
+; An insecure subdomain
+insecure		NS	ns.insecure
+ns.insecure		A	10.53.0.3
+
+; A secure subdomain we're going to inject bogus data into
+bogus			NS	ns.bogus
+ns.bogus		A	10.53.0.3
+
+; A dynamic secure subdomain
+dynamic			NS	dynamic
+dynamic			A	10.53.0.3
+
+; A insecure subdomain
+mustbesecure		NS	ns.mustbesecure
+ns.mustbesecure		A	10.53.0.3
+
+; A rfc2535 signed zone w/ CNAME
+rfc2535			NS	ns.rfc2535
+ns.rfc2535		A	10.53.0.3
+
+z			A	10.0.0.26
+
+keyless			NS	ns.keyless
+ns.keyless		A	10.53.0.3
+
+nsec3			NS	ns.nsec3
+ns.nsec3		A	10.53.0.3
+
+optout			NS	ns.optout
+ns.optout		A	10.53.0.3
+
+nsec3-unknown		NS	ns.nsec3-unknown
+ns.nsec3-unknown	A	10.53.0.3
+
+optout-unknown		NS	ns.optout-unknown
+ns.optout-unknown	A	10.53.0.3
+
+multiple		NS	ns.multiple
+ns.multiple		A	10.53.0.3
+
+*.wild			A	10.0.0.27
+
+rsasha256		NS	ns.rsasha256
+ns.rsasha256		A	10.53.0.3
+
+rsasha512		NS	ns.rsasha512
+ns.rsasha512		A	10.53.0.3
+
+kskonly 		NS	ns.kskonly
+ns.kskonly		A	10.53.0.3
+
+update-nsec3		NS	ns.update-nsec3
+ns.update-nsec3		A	10.53.0.3
+
+auto-nsec		NS	ns.auto-nsec
+ns.auto-nsec		A	10.53.0.3
+
+auto-nsec3		NS	ns.auto-nsec3
+ns.auto-nsec3		A	10.53.0.3
+
+
+below-cname		CNAME	some.where.else.
+
+insecure.below-cname	NS	ns.insecure.below-cname
+ns.insecure.below-cname	A	10.53.0.3
+
+secure.below-cname	NS	ns.secure.below-cname
+ns.secure.below-cname	A	10.53.0.3
+
+ttlpatch		NS	ns.ttlpatch
+ns.ttlpatch		A	10.53.0.3
+
+split-dnssec		NS	ns.split-dnssec
+ns.split-dnssec		A	10.53.0.3
+
+split-smart		NS	ns.split-smart
+ns.split-smart		A	10.53.0.3

bin/tests/system/inline/ns3/master4.db.in

@@ -16,7 +16,114 @@ $TTL 300	; 5 minutes
 				3600       ; minimum (1 hour)
 				)
 			NS	ns3
+ns2			A	10.53.0.2
 ns3			A	10.53.0.3
 
+a			A	10.0.0.1
+b			A	10.0.0.2
 c			A	10.0.0.3
+d			A	10.0.0.4
 e			A	10.0.0.5
+
+; Used for testing ANY queries
+foo			TXT	"testing"
+foo			A	10.0.1.0
+
+bad-cname		CNAME   a
+bad-dname		DNAME   @
+
+; Used for testing CNAME queries
+cname1			CNAME	cname1-target
+cname1-target		TXT	"testing cname"
+
+cname2			CNAME	cname2-target
+cname2-target		TXT	"testing cname"
+
+; Used for testing DNAME queries
+dname1			DNAME	dname1-target
+foo.dname1-target	TXT	"testing dname"
+
+dname2			DNAME	dname2-target
+foo.dname2-target	TXT	"testing dname"
+
+; A secure subdomain
+secure			NS	ns.secure
+ns.secure		A	10.53.0.3
+
+; An insecure subdomain
+insecure		NS	ns.insecure
+ns.insecure		A	10.53.0.3
+
+; A secure subdomain we're going to inject bogus data into
+bogus			NS	ns.bogus
+ns.bogus		A	10.53.0.3
+
+; A dynamic secure subdomain
+dynamic			NS	dynamic
+dynamic			A	10.53.0.3
+
+; A insecure subdomain
+mustbesecure		NS	ns.mustbesecure
+ns.mustbesecure		A	10.53.0.3
+
+; A rfc2535 signed zone w/ CNAME
+rfc2535			NS	ns.rfc2535
+ns.rfc2535		A	10.53.0.3
+
+z			A	10.0.0.26
+
+keyless			NS	ns.keyless
+ns.keyless		A	10.53.0.3
+
+nsec3			NS	ns.nsec3
+ns.nsec3		A	10.53.0.3
+
+optout			NS	ns.optout
+ns.optout		A	10.53.0.3
+
+nsec3-unknown		NS	ns.nsec3-unknown
+ns.nsec3-unknown	A	10.53.0.3
+
+optout-unknown		NS	ns.optout-unknown
+ns.optout-unknown	A	10.53.0.3
+
+multiple		NS	ns.multiple
+ns.multiple		A	10.53.0.3
+
+*.wild			A	10.0.0.27
+
+rsasha256		NS	ns.rsasha256
+ns.rsasha256		A	10.53.0.3
+
+rsasha512		NS	ns.rsasha512
+ns.rsasha512		A	10.53.0.3
+
+kskonly 		NS	ns.kskonly
+ns.kskonly		A	10.53.0.3
+
+update-nsec3		NS	ns.update-nsec3
+ns.update-nsec3		A	10.53.0.3
+
+auto-nsec		NS	ns.auto-nsec
+ns.auto-nsec		A	10.53.0.3
+
+auto-nsec3		NS	ns.auto-nsec3
+ns.auto-nsec3		A	10.53.0.3
+
+
+below-cname		CNAME	some.where.else.
+
+insecure.below-cname	NS	ns.insecure.below-cname
+ns.insecure.below-cname	A	10.53.0.3
+
+secure.below-cname	NS	ns.secure.below-cname
+ns.secure.below-cname	A	10.53.0.3
+
+ttlpatch		NS	ns.ttlpatch
+ns.ttlpatch		A	10.53.0.3
+
+split-dnssec		NS	ns.split-dnssec
+ns.split-dnssec		A	10.53.0.3
+
+split-smart		NS	ns.split-smart
+ns.split-smart		A	10.53.0.3

bin/tests/system/inline/ns3/master5.db.in

@@ -1,22 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 300	; 5 minutes
-@			IN SOA	ns3 . (
-				2000042411 ; serial
-				20         ; refresh (20 seconds)
-				20         ; retry (20 seconds)
-				1814400    ; expire (3 weeks)
-				3600       ; minimum (1 hour)
-				)
-			NS	ns3
-ns3			A	10.53.0.3
-
-c			A	10.0.0.3
-e			A	10.0.0.5

bin/tests/system/inline/ns3/named.conf.in

@@ -58,10 +58,6 @@ zone "master" {
 	inline-signing yes;
 	auto-dnssec maintain;
 	file "master.db";
-	notify explicit;
-	also-notify {
-		10.53.0.3;
-	};
 };
 
 zone "dynamic" {
@@ -145,13 +141,6 @@ zone "nokeys" {
 	file "nokeys.bk";
 };
 
-zone "delayedkeys" {
-	type master;
-	inline-signing yes;
-	auto-dnssec maintain;
-	file "delayedkeys.db";
-};
-
 zone "removedkeys-primary" {
 	type master;
 	inline-signing yes;

bin/tests/system/inline/ns3/sign.sh

@@ -96,14 +96,6 @@ keyname=`$KEYGEN -q -a RSASHA256 -b 1024 -n zone $zone`
 keyname=`$KEYGEN -q -a RSASHA256 -b 1024 -n zone -f KSK $zone`
 $DSFROMKEY -T 1200 $keyname >> ../ns1/root.db
 
-zone=delayedkeys
-rm -f K${zone}.+*+*.key
-rm -f K${zone}.+*+*.private
-keyname=`$KEYGEN -q -a RSASHA1 -b 1024 -n zone $zone`
-keyname=`$KEYGEN -q -a RSASHA1 -b 1024 -n zone -f KSK $zone`
-# Keys for the "delayedkeys" zone should not be initially accessible.
-mv K${zone}.+*+*.* ../
-
 zone=removedkeys-primary
 rm -f K${zone}.+*+*.key
 rm -f K${zone}.+*+*.private

bin/tests/system/inline/ns4/noixfr.db.in

@@ -18,3 +18,110 @@ $TTL 300	; 5 minutes
 			NS	ns3
 ns4			A	10.53.0.4
 ns3			A	10.53.0.3
+
+a			A	10.0.0.1
+b			A	10.0.0.2
+d			A	10.0.0.4
+
+; Used for testing ANY queries
+foo			TXT	"testing"
+foo			A	10.0.1.0
+
+bad-cname		CNAME   a
+bad-dname		DNAME   @
+
+; Used for testing CNAME queries
+cname1			CNAME	cname1-target
+cname1-target		TXT	"testing cname"
+
+cname2			CNAME	cname2-target
+cname2-target		TXT	"testing cname"
+
+; Used for testing DNAME queries
+dname1			DNAME	dname1-target
+foo.dname1-target	TXT	"testing dname"
+
+dname2			DNAME	dname2-target
+foo.dname2-target	TXT	"testing dname"
+
+; A secure subdomain
+secure			NS	ns.secure
+ns.secure		A	10.53.0.3
+
+; An insecure subdomain
+insecure		NS	ns.insecure
+ns.insecure		A	10.53.0.3
+
+; A secure subdomain we're going to inject bogus data into
+bogus			NS	ns.bogus
+ns.bogus		A	10.53.0.3
+
+; A dynamic secure subdomain
+dynamic			NS	dynamic
+dynamic			A	10.53.0.3
+
+; A insecure subdomain
+mustbesecure		NS	ns.mustbesecure
+ns.mustbesecure		A	10.53.0.3
+
+; A rfc2535 signed zone w/ CNAME
+rfc2535			NS	ns.rfc2535
+ns.rfc2535		A	10.53.0.3
+
+z			A	10.0.0.26
+
+keyless			NS	ns.keyless
+ns.keyless		A	10.53.0.3
+
+nsec3			NS	ns.nsec3
+ns.nsec3		A	10.53.0.3
+
+optout			NS	ns.optout
+ns.optout		A	10.53.0.3
+
+nsec3-unknown		NS	ns.nsec3-unknown
+ns.nsec3-unknown	A	10.53.0.3
+
+optout-unknown		NS	ns.optout-unknown
+ns.optout-unknown	A	10.53.0.3
+
+multiple		NS	ns.multiple
+ns.multiple		A	10.53.0.3
+
+*.wild			A	10.0.0.27
+
+rsasha256		NS	ns.rsasha256
+ns.rsasha256		A	10.53.0.3
+
+rsasha512		NS	ns.rsasha512
+ns.rsasha512		A	10.53.0.3
+
+kskonly 		NS	ns.kskonly
+ns.kskonly		A	10.53.0.3
+
+update-nsec3		NS	ns.update-nsec3
+ns.update-nsec3		A	10.53.0.3
+
+auto-nsec		NS	ns.auto-nsec
+ns.auto-nsec		A	10.53.0.3
+
+auto-nsec3		NS	ns.auto-nsec3
+ns.auto-nsec3		A	10.53.0.3
+
+
+below-cname		CNAME	some.where.else.
+
+insecure.below-cname	NS	ns.insecure.below-cname
+ns.insecure.below-cname	A	10.53.0.3
+
+secure.below-cname	NS	ns.secure.below-cname
+ns.secure.below-cname	A	10.53.0.3
+
+ttlpatch		NS	ns.ttlpatch
+ns.ttlpatch		A	10.53.0.3
+
+split-dnssec		NS	ns.split-dnssec
+ns.split-dnssec		A	10.53.0.3
+
+split-smart		NS	ns.split-smart
+ns.split-smart		A	10.53.0.3

bin/tests/system/inline/setup.sh

@@ -31,7 +31,6 @@ cp ns3/master.db.in ns3/updated.db
 cp ns3/master.db.in ns3/expired.db
 cp ns3/master.db.in ns3/nsec3.db
 cp ns3/master.db.in ns3/externalkey.db
-cp ns3/master.db.in ns3/delayedkeys.db
 cp ns3/master.db.in ns3/removedkeys-primary.db
 
 mkdir ns3/removedkeys

bin/tests/system/inline/tests.sh

@@ -27,6 +27,22 @@ do
 	sleep 1
 done
 
+# Loop until retransfer3 has been transferred.
+for i in 1 2 3 4 5 6 7 8 9 0
+do
+        ans=0
+        $RNDCCMD 10.53.0.3 signing -nsec3param 1 0 0 - retransfer3 > /dev/null 2>&1 || ans=1
+	[ $ans = 0 ] && break
+        sleep 1
+done
+
+for i in 1 2 3 4 5 6 7 8 9 0
+do
+	nsec3param=`$DIG $DIGOPTS +nodnssec +short @10.53.0.3 nsec3param retransfer3.`
+	test "$nsec3param" = "1 0 0 -" && break
+	sleep 1
+done
+
 n=`expr $n + 1`
 echo_i "checking that rrsigs are replaced with ksk only ($n)"
 ret=0
@@ -754,48 +770,9 @@ done
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
 
-n=`expr $n + 1`
-echo_i "check 'rndc signing -nsec3param' requests are queued for zones which are not loaded ($n)"
-ret=0
-# The "retransfer3" zone is configured with "allow-transfer { none; };" on ns2,
-# which means it should not yet be available on ns3.
-$DIG $DIGOPTS @10.53.0.3 retransfer3 SOA > dig.out.ns3.pre.test$n
-grep "status: SERVFAIL" dig.out.ns3.pre.test$n > /dev/null || ret=1
-# Switch the zone to NSEC3.  An "NSEC3 -> NSEC -> NSEC3" sequence is used purely
-# to test that multiple queued "rndc signing -nsec3param" requests are handled
-# properly.
-$RNDCCMD 10.53.0.3 signing -nsec3param 1 0 0 - retransfer3 > /dev/null 2>&1 || ret=1
-$RNDCCMD 10.53.0.3 signing -nsec3param none retransfer3 > /dev/null 2>&1 || ret=1
-$RNDCCMD 10.53.0.3 signing -nsec3param 1 0 0 - retransfer3 > /dev/null 2>&1 || ret=1
-# Reconfigure ns2 to allow outgoing transfers for the "retransfer3" zone.
-sed "s|\(allow-transfer { none; };.*\)|// \1|;" ns2/named.conf > ns2/named.conf.new
-mv ns2/named.conf.new ns2/named.conf
-$RNDCCMD 10.53.0.2 reconfig || ret=1
-# Request ns3 to retransfer the "retransfer3" zone.
-$RNDCCMD 10.53.0.3 retransfer retransfer3 || ret=1
-# Wait until ns3 finishes building the NSEC3 chain for "retransfer3".  There is
-# no need to immediately set ret=1 if building the NSEC3 chain is not finished
-# within the time limit because the query we will send shortly will detect any
-# problems anyway.
-for i in 0 1 2 3 4 5 6 7 8 9
-do
-	$RNDCCMD 10.53.0.3 signing -list retransfer3 > signing.out.test$n.$i 2>&1
-	keys_done=`grep "Done signing" signing.out.test$n.$i | wc -l`
-	nsec3_pending=`grep "NSEC3 chain" signing.out.test$n.$i | wc -l`
-	test $keys_done -eq 2 -a $nsec3_pending -eq 0 && break
-	sleep 1
-done
-# Check whether "retransfer3" uses NSEC3 as requested.
-$DIG $DIGOPTS @10.53.0.3 nonexist.retransfer3 A > dig.out.ns3.post.test$n
-grep "status: NXDOMAIN" dig.out.ns3.post.test$n > /dev/null || ret=1
-grep "NSEC3" dig.out.ns3.post.test$n > /dev/null || ret=1
-if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
-
 n=`expr $n + 1`
 echo_i "check rndc retransfer of a inline nsec3 slave retains nsec3 ($n)"
 ret=0
-$RNDCCMD 10.53.0.3 signing -nsec3param 1 0 0 - retransfer3 > /dev/null 2>&1 || ret=1
 for i in 0 1 2 3 4 5 6 7 8 9
 do
 	ans=0
@@ -900,31 +877,6 @@ done
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
 
-n=`expr $n + 1`
-echo_i "check that reloading all zones does not cause zone maintenance to cease for inline-signed zones ($n)"
-ret=1
-# Ensure "rndc reload" attempts to load ns3/master.db by waiting 1 second so
-# that the master file modification time has no possibility of being equal to
-# the one stored during server startup.
-sleep 1
-nextpart ns3/named.run > /dev/null
-cp ns3/master5.db.in ns3/master.db
-$RNDCCMD 10.53.0.3 reload 2>&1 | sed 's/^/ns3 /' | cat_i
-for i in 1 2 3 4 5 6 7 8 9 10
-do
-	if nextpart ns3/named.run | grep "zone master.*sending notifies" > /dev/null; then
-		ret=0
-		break
-	fi
-	sleep 1
-done
-# Sanity check: master file updates should be reflected in the signed zone,
-# i.e. SOA RNAME should no longer be set to "hostmaster".
-$DIG $DIGOPTS @10.53.0.3 master SOA > dig.out.ns3.test$n || ret=1
-grep "hostmaster" dig.out.ns3.test$n > /dev/null && ret=1
-if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
-
 n=`expr $n + 1`
 echo_i "test add/del zone combinations ($n)"
 ret=0
@@ -1292,61 +1244,7 @@ grep "RRSIG" dig.out.ns3.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
 
-# Check that the master file $2 for zone $1 does not contain RRSIG records
-# while the journal file for that zone does contain them.
-ensure_sigs_only_in_journal() {
-	origin="$1"
-	masterfile="$2"
-	$CHECKZONE -i none -f raw -D -o - "$origin" "$masterfile" 2>&1 | grep -w RRSIG > /dev/null && ret=1
-	$CHECKZONE -j -i none -f raw -D -o - "$origin" "$masterfile" 2>&1 | grep -w RRSIG > /dev/null || ret=1
-}
-
 n=`expr $n + 1`
-echo_i "checking that records added from a journal are scheduled to be resigned ($n)"
-ret=0
-# Signing keys for the "delayedkeys" zone are not yet accessible.  Thus, the
-# zone file for the signed version of the zone will contain no DNSSEC records.
-# Move keys into place now and load them, which will cause DNSSEC records to
-# only be present in the journal for the signed version of the zone.
-mv Kdelayedkeys* ns3/
-$RNDCCMD 10.53.0.3 loadkeys delayedkeys > rndc.out.ns3.pre.test$n 2>&1 || ret=1
-# Wait until the zone is signed.
-ans=1
-for i in 1 2 3 4 5 6 7 8 9 10
-do
-	$RNDCCMD 10.53.0.3 signing -list delayedkeys > signing.out.test$n 2>&1
-	num=`grep "Done signing with" signing.out.test$n | wc -l`
-	if [ $num -eq 2 ]; then
-		ans=0
-		break
-	fi
-	sleep 1
-done
-if [ $ans != 0 ]; then ret=1; fi
-# Halt rather than stopping the server to prevent the master file from being
-# flushed upon shutdown since we specifically want to avoid it.
-$PERL $SYSTEMTESTTOP/stop.pl --use-rndc --halt --port ${CONTROLPORT} . ns3
-ensure_sigs_only_in_journal delayedkeys ns3/delayedkeys.db.signed
-$PERL $SYSTEMTESTTOP/start.pl --noclean --restart --port ${PORT} . ns3
-# At this point, the raw zone journal will not have a source serial set.  Upon
-# server startup, receive_secure_serial() will rectify that, update SOA, resign
-# it, and schedule its future resign.  This will cause "rndc zonestatus" to
-# return delayedkeys/SOA as the next node to resign, so we restart the server
-# once again; with the raw zone journal now having a source serial set,
-# receive_secure_serial() should refrain from introducing any zone changes.
-$PERL $SYSTEMTESTTOP/stop.pl --use-rndc --halt --port ${CONTROLPORT} . ns3
-ensure_sigs_only_in_journal delayedkeys ns3/delayedkeys.db.signed
-$PERL $SYSTEMTESTTOP/start.pl --noclean --restart --port ${PORT} . ns3
-# We can now test whether the secure zone journal was correctly processed:
-# unless the records contained in it were scheduled for resigning, no resigning
-# event will be scheduled at all since the secure zone master file contains no
-# DNSSEC records.
-$RNDCCMD 10.53.0.3 zonestatus delayedkeys > rndc.out.ns3.post.test$n 2>&1 || ret=1
-grep "next resign node:" rndc.out.ns3.post.test$n > /dev/null || ret=1
-if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
-n=`expr $n + 1`
-
 echo_i "check that zonestatus reports 'type: master' for a inline master zone ($n)"
 ret=0
 $RNDCCMD 10.53.0.3 zonestatus master > rndc.out.ns3.test$n

bin/tests/system/mirror/ns3/named.conf.in

@@ -48,7 +48,6 @@ zone "initially-unavailable" {
 	masters { 10.53.0.2; };
 	mirror yes;
 	file "initially-unavailable.db.mirror";
-	use-alt-transfer-source no;
 };
 
 zone "verify-axfr" {

bin/tests/system/resolver/ans2/ans.pl

@@ -107,10 +107,6 @@ for (;;) {
 		# expected to be accepted regardless of the filter setting.
 		$packet->push("authority", new Net::DNS::RR("sub.example.org 300 NS ns.sub.example.org"));
 		$packet->push("additional", new Net::DNS::RR("ns.sub.example.org 300 A 10.53.0.3"));
-	} elsif ($qname =~ /glue-in-answer\.example\.org/) {
-		$packet->push("answer", new Net::DNS::RR("ns.glue-in-answer.example.org 300 A 10.53.0.3"));
-		$packet->push("authority", new Net::DNS::RR("glue-in-answer.example.org 300 NS ns.glue-in-answer.example.org"));
-		$packet->push("additional", new Net::DNS::RR("ns.glue-in-answer.example.org 300 A 10.53.0.3"));
 	} elsif ($qname =~ /\.broken/ || $qname =~ /^broken/) {
 		# Delegation to broken TLD.
 		$packet->push("authority", new Net::DNS::RR("broken 300 NS ns.broken"));

bin/tests/system/resolver/ans3/ans.pl

@@ -107,8 +107,6 @@ for (;;) {
 	} elsif ($qname eq "www.ok.sub.example.org") {
 		$packet->push("answer",
 			      new Net::DNS::RR($qname . " 300 A 192.0.2.1"));
-	} elsif ($qname eq "foo.glue-in-answer.example.org") {
-		$packet->push("answer", new Net::DNS::RR($qname . " 300 A 192.0.2.1"));
 	} else {
 		$packet->push("answer", new Net::DNS::RR("www.example.com 300 A 1.2.3.4"));
 	}

bin/tests/system/resolver/tests.sh

@@ -247,15 +247,6 @@ if [ -x ${RESOLVE} ] ; then
     status=`expr $status + $ret`
 fi
 
-n=`expr $n + 1`
-echo_i "check that the resolver accepts a referral response with a non-empty ANSWER section ($n)"
-ret=0
-$DIG $DIGOPTS @10.53.0.1 foo.glue-in-answer.example.org. A > dig.ns1.out.${n} || ret=1
-grep "status: NOERROR" dig.ns1.out.${n} > /dev/null || ret=1
-grep "foo.glue-in-answer.example.org.*192.0.2.1" dig.ns1.out.${n} > /dev/null || ret=1
-if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
-
 n=`expr $n + 1`
 echo_i "RT21594 regression test check setup ($n)"
 ret=0

bin/tests/system/rsabigexponent/bigkey.c

@@ -75,8 +75,6 @@ main(int argc, char **argv) {
 	UNUSED(argc);
 	UNUSED(argv);
 
-#if !USE_PKCS11
-
 	rsa = RSA_new();
 	e = BN_new();
 	pkey = EVP_PKEY_new();
@@ -151,9 +149,6 @@ main(int argc, char **argv) {
 	dns_name_destroy();
 	isc_mem_destroy(&mctx);
 	return (0);
-#else /* !USE_PKCS11 */
-	return (1);
-#endif /* !USE_PKC11 */
 }
 
 /*! \file */

bin/tests/system/rsabigexponent/prereq.sh

@@ -16,7 +16,7 @@ if $BIGKEY > /dev/null 2>&1
 then
     rm -f Kexample.*
 else
-    echo_i "This test requires OpenSSL cryptography provider" >&2
-    echo_i "configure with --with-openssl, and make sure you disable --with-pkcs11 and --enable-native-pkcs11" >&2
+    echo_i "This test requires cryptography" >&2
+    echo_i "configure with --with-openssl, or --with-pkcs11 and --enable-native-pkcs11" >&2
     exit 255
 fi

bin/tests/system/stop.pl

@@ -31,12 +31,11 @@ use Getopt::Long;
 #
 #   server          Name of the server directory.
 
-my $usage = "usage: $0 [--use-rndc [--halt] [--port port]] test-directory [server-directory]";
+my $usage = "usage: $0 [--use-rndc [--port port]] test-directory [server-directory]";
 
 my $use_rndc = 0;
-my $halt = 0;
 my $port = 9953;
-GetOptions('use-rndc' => \$use_rndc, 'halt' => \$halt, 'port=i' => \$port) or die "$usage\n";
+GetOptions('use-rndc' => \$use_rndc, 'port=i' => \$port) or die "$usage\n";
 
 my $errors = 0;
 
@@ -132,10 +131,9 @@ sub stop_rndc {
 
 	return unless ($server =~ /^ns(\d+)$/);
 	my $ip = "10.53.0.$1";
-	my $how = $halt ? "halt" : "stop";
 
 	# Ugly, but should work.
-	system("$ENV{RNDC} -c ../common/rndc.conf -s $ip -p $port $how | sed 's/^/I:$server /'");
+	system("$ENV{RNDC} -c ../common/rndc.conf -s $ip -p $port stop | sed 's/^/I:$server /'");
 	return;
 }
 

bin/tests/system/win32/bigkey.vcxproj.in

@@ -68,7 +68,7 @@
       <GenerateDebugInformation>true</GenerateDebugInformation>
       <OutputFile>..\..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
       <AdditionalLibraryDirectories>..\..\..\..\lib\isc\win32\$(Configuration);..\..\..\..\lib\dns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>@OPENSSL_LIB@@LIBXML2_LIB@libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>@LIBXML2_LIB@@OPENSSL_LIB@libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
     </Link>
   </ItemDefinitionGroup>
   <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'">
@@ -98,7 +98,7 @@
       <OutputFile>..\..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
       <LinkTimeCodeGeneration>Default</LinkTimeCodeGeneration>
       <AdditionalLibraryDirectories>..\..\..\..\lib\isc\win32\$(Configuration);..\..\..\..\lib\dns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>@OPENSSL_LIB@@LIBXML2_LIB@libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>@LIBXML2_LIB@@OPENSSL_LIB@libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
     </Link>
   </ItemDefinitionGroup>
   <ItemGroup>

bin/tests/system/win32/feature-test.vcxproj.in

@@ -68,7 +68,7 @@
       <GenerateDebugInformation>true</GenerateDebugInformation>
       <OutputFile>..\..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
       <AdditionalLibraryDirectories>..\..\..\..\lib\isc\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>@OPENSSL_LIB@@LIBXML2_LIB@libisc.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>@LIBXML2_LIB@libisc.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
     </Link>
   </ItemDefinitionGroup>
   <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'">
@@ -98,7 +98,7 @@
       <OutputFile>..\..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
       <LinkTimeCodeGeneration>Default</LinkTimeCodeGeneration>
       <AdditionalLibraryDirectories>..\..\..\..\lib\isc\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>@OPENSSL_LIB@@LIBXML2_LIB@libisc.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>@LIBXML2_LIB@libisc.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
     </Link>
   </ItemDefinitionGroup>
   <ItemGroup>

bin/tests/system/win32/gencheck.vcxproj.in

@@ -68,7 +68,7 @@
       <GenerateDebugInformation>true</GenerateDebugInformation>
       <OutputFile>..\..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
       <AdditionalLibraryDirectories>..\..\..\..\lib\isc\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>@OPENSSL_LIB@@LIBXML2_LIB@libisc.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>@LIBXML2_LIB@libisc.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
     </Link>
   </ItemDefinitionGroup>
   <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'">
@@ -98,7 +98,7 @@
       <OutputFile>..\..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
       <LinkTimeCodeGeneration>Default</LinkTimeCodeGeneration>
       <AdditionalLibraryDirectories>..\..\..\..\lib\isc\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>@OPENSSL_LIB@@LIBXML2_LIB@libisc.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>@LIBXML2_LIB@libisc.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
     </Link>
   </ItemDefinitionGroup>
   <ItemGroup>

bin/tests/system/win32/keycreate.vcxproj.in

@@ -68,7 +68,7 @@
       <GenerateDebugInformation>true</GenerateDebugInformation>
       <OutputFile>..\..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
       <AdditionalLibraryDirectories>..\..\..\..\lib\isc\win32\$(Configuration);..\..\..\..\lib\dns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>@OPENSSL_LIB@@LIBXML2_LIB@libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>@LIBXML2_LIB@@OPENSSL_LIB@libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
     </Link>
   </ItemDefinitionGroup>
   <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'">
@@ -98,7 +98,7 @@
       <OutputFile>..\..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
       <LinkTimeCodeGeneration>Default</LinkTimeCodeGeneration>
       <AdditionalLibraryDirectories>..\..\..\..\lib\isc\win32\$(Configuration);..\..\..\..\lib\dns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>@OPENSSL_LIB@@LIBXML2_LIB@libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>@LIBXML2_LIB@@OPENSSL_LIB@libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
     </Link>
   </ItemDefinitionGroup>
   <ItemGroup>

bin/tests/system/win32/keydelete.vcxproj.in

@@ -68,7 +68,7 @@
       <GenerateDebugInformation>true</GenerateDebugInformation>
       <OutputFile>..\..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
       <AdditionalLibraryDirectories>..\..\..\..\lib\isc\win32\$(Configuration);..\..\..\..\lib\dns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>@OPENSSL_LIB@@LIBXML2_LIB@libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>@LIBXML2_LIB@@OPENSSL_LIB@libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
     </Link>
   </ItemDefinitionGroup>
   <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'">
@@ -98,7 +98,7 @@
       <OutputFile>..\..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
       <LinkTimeCodeGeneration>Default</LinkTimeCodeGeneration>
       <AdditionalLibraryDirectories>..\..\..\..\lib\isc\win32\$(Configuration);..\..\..\..\lib\dns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>@OPENSSL_LIB@@LIBXML2_LIB@libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>@LIBXML2_LIB@@OPENSSL_LIB@libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
     </Link>
   </ItemDefinitionGroup>
   <ItemGroup>

bin/tests/system/win32/pipequeries.vcxproj.in

@@ -68,7 +68,7 @@
       <GenerateDebugInformation>true</GenerateDebugInformation>
       <OutputFile>..\..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
       <AdditionalLibraryDirectories>..\..\..\..\lib\isc\win32\$(Configuration);..\..\..\..\lib\dns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>@OPENSSL_LIB@@LIBXML2_LIB@libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>@LIBXML2_LIB@@OPENSSL_LIB@libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
     </Link>
   </ItemDefinitionGroup>
   <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'">
@@ -98,7 +98,7 @@
       <OutputFile>..\..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
       <LinkTimeCodeGeneration>Default</LinkTimeCodeGeneration>
       <AdditionalLibraryDirectories>..\..\..\..\lib\isc\win32\$(Configuration);..\..\..\..\lib\dns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>@OPENSSL_LIB@@LIBXML2_LIB@libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>@LIBXML2_LIB@@OPENSSL_LIB@libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
     </Link>
   </ItemDefinitionGroup>
   <ItemGroup>

bin/tests/win32/backtrace_test.vcxproj.in

@@ -68,7 +68,7 @@
       <GenerateDebugInformation>true</GenerateDebugInformation>
       <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
       <AdditionalLibraryDirectories>..\..\..\lib\isc\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>@OPENSSL_LIB@libisc.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>libisc.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
     </Link>
   </ItemDefinitionGroup>
   <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'">
@@ -98,7 +98,7 @@
       <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
       <LinkTimeCodeGeneration>Default</LinkTimeCodeGeneration>
       <AdditionalLibraryDirectories>..\..\..\lib\isc\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>@OPENSSL_LIB@libisc.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>libisc.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
     </Link>
   </ItemDefinitionGroup>
   <ItemGroup>