win32/socket should use common isc_socket

Disable qname minimization in RPZ test for now

See merge request isc-projects/bind9!882

.gitlab-ci.yml

@@ -10,6 +10,7 @@ stages:
   - precheck
   - build
   - test
+  - push
 
 .centos-centos6-amd64: &centos_centos6_amd64_image
   image: "$CI_REGISTRY_IMAGE:centos-centos6-amd64"
@@ -118,6 +119,8 @@ stages:
     - ./configure --enable-developer --with-libtool --disable-static --with-atf=/usr --prefix=$HOME/.local --without-make-clean $EXTRA_CONFIGURE || cat config.log
     - make -j${PARALLEL_JOBS_BUILD:-1} -k all V=1
   artifacts:
+    paths:
+    - doc/
     expire_in: '1 hour'
     untracked: true
 
@@ -180,6 +183,29 @@ precheck:debian:sid:amd64:
     expire_in: '1 week'
     when: on_failure
 
+docs:debian:sid:amd64:
+  <<: *debian_sid_amd64_image
+  stage: test
+  dependencies:
+    - build:debian:sid:amd64
+  script:
+    - make -C doc/misc docbook
+    - make -C doc/arm Bv9ARM.html
+  artifacts:
+    paths:
+    - doc/arm/
+    expire_in: '1 month'
+
+push:docs:
+  <<: *debian_sid_amd64_image
+  stage: push
+  dependencies: []
+  script:
+    - curl -X POST -F token=$GITLAB_PAGES_DOCS_TRIGGER_TOKEN -F ref=master $GITLAB_PAGES_DOCS_TRIGGER_URL
+  only:
+    - master@isc-projects/bind9
+    - /^v9_.*$/@isc-projects/bind9
+
 #build:debian:jessie:amd64:
 #  <<: *debian_jessie_amd64_image
 #  <<: *build_job

.gitlab/issue_templates/.gitlab/issue_templates/release

@@ -1,29 +0,0 @@
-##Release Checklist
-
- - [ ] Check for the presence of a milestone for the release
-    - If there is a milestone, are all the issues for the milestone resolved? (other than this checklist)
- - [ ] Prepare the sources for tarball generation
- - [ ] Change software version and library versions in configure.in
- - [ ] Update CHANGES
- - [ ] Ensure the release notes are correct for this release
- - [ ] Ensure the metainformation is correct for this release
- - [ ] Make sure the tests are passing
- - [ ] Create a tag (name vX_Y_Z[-alphatag], content BIND X.Y.Z[-alphatag], signed with a developer's GPG key): git tag -u <DEVELOPER_KEYID> -a -s -m "BIND X.Y.Z" vX.Y.Z
- - [ ] Push the changes and tag
- - [ ] Create the tarball
- - [ ] Create the Windows zips
- - [ ] Ask QA to sanity check the tarball and zips
- - [ ] Request the signature on the tarballs
- - [ ] Make tarballs and signatures available to download
- - [ ] Edit the release https://gitlab.isc.org/isc-projects/bind9/tags and the NEWS snippet + links to the tarballs
- - [ ] Update DEB and RPM packages
-
-##Communication
-
- - [ ] Inform support to upload to the web site (nice to give them a heads-up in advance)
-       Write release e-mail to bind9-announce, bind-users in case of a major release 
- - [ ] Inform marketing to announce the release
-        Post short note to Twitter 
-        Update http://en.wikipedia.org/wiki/BIND (mktg)
-        Blog post if a major release
-

.gitlab/issue_templates/Bug.md

@@ -9,6 +9,10 @@ email to [security-officer@isc.org](security-officer@isc.org).
 
 (Summarize the bug encountered concisely.)
 
+### BIND version used
+
+(Paste the output of `named -V`.)
+
 ### Steps to reproduce
 
 (How one can reproduce the issue - this is very important.)

.gitlab/issue_templates/release.md

@@ -0,0 +1,31 @@
+## Release Checklist
+
+ - [ ] (Manager) Check for the presence of a milestone for the release.
+    - If there is a milestone, are all the issues for the milestone resolved? (other than this checklist).
+ - [ ] (Manager) Inform Support/Marketing of impending release (and give estimated release dates).
+ - (SwEng) Prepare the sources for tarball generation.
+   - [ ] Ensure that there are no outstanding merge requests in the private repository (subscription version only).
+   - [ ] Update API files for libraries with new version information.
+   - [ ] Change software version and library versions in configure.in (new major release only).
+   - [ ] Ensure Kyua and ATF files are correct.
+   - [ ] Rebuild configure using autoconf on docs.isc.org.
+   - [ ] Update CHANGES.
+   - [ ] Update CHANGES.SE (subscription branch only).
+   - [ ] Update "version".
+   - [ ] Update "readme.md".
+   - [ ] Ensure the release notes are correct for this release (content, formatting, etc.).
+   - [ ] Build documentation on docs.isc.org.
+   - [ ] Commit changes and make sure the gitlab-ci tests are passing.
+   - [ ] Push the changes and tag ("alphatag" is an optional string such as "b1", "rc1" etc.). (```git tag -u <DEVELOPER_KEYID> -a -s -m "BIND 9.X.Y[alphatag]" v9_X_Y[alphatag]```)
+   - [ ] If this is the first tag for a release (e.g. beta), create a release branch named `release_v9_X_Y` (this allows development to continue on the release branch whilst release engineering continues).
+ - [ ] (SwEng) Run the "make release" Jenkins job to produce the tarballs and zips.
+ - [ ] (SwEng) Ask QA to sanity check the tarball and zips (passing to them the number of the Jenkins job).
+ - [ ] (QA) Sanity check the tarballs.
+ - [ ] (QA) Request the signature on the tarballs.
+ - [ ] (QA) Check signatures on tarballs.
+ - [ ] (QA) Tell Support to handle notification of release.
+ - [ ] (Support) Make tarballs and signatures available to download.
+ - [ ] (Manager) Update [https://wiki.isc.org/bin/view/Main/BindReleaseDates](BIND release dates page) when public announcement has been made.
+ - [ ] (Manager) Inform marketing of the release
+
+ - [ ] (SwEng) Update DEB and RPM packages

CHANGES

@@ -1,3 +1,96 @@
+5050.	[bug]		The libirs version of getaddrinfo() was unable to parse
+			scoped IPv6 addresses present in /etc/resolv.conf.
+			[GL #187]
+
+5049.	[cleanup]	QNAME minimization has been deeply refactored. [GL #16]
+
+5048.	[func]		Add configure option to enable and enforce FIPS mode
+			in BIND 9. [GL #506]
+
+5047.	[bug]		Messages logged for certain query processing failures
+			now include a more specific error description if it is
+			available. [GL #572]
+
+5046.	[bug]		named could crash during shutdown if an RPZ
+			reload was in progress. [RT #46210]
+
+5045.	[func]		Remove support for DNSSEC algorithms 3 (DSA)
+			and 6 (DSA-NSEC3-SHA1). [GL #22]
+
+5044.	[cleanup]	If "dnssec-enable" is no, then "dnssec-validation"
+			now also defaults to no.  [GL #388]
+
+5043.	[bug]		Fix creating and validating EdDSA signatures. [GL #579]
+
+5042.	[test]		Make the chained delegations in reclimit behave
+			like they would in a regular name server. [GL #578]
+
+5041.	[test]		The chain test contains a incomplete delegation.
+			[GL #568]
+
+5040.	[func]		Extended dnstap so that it can log UPDATE requests
+			and responses as separate message types. Thanks
+			to Greg Rabil. [GL #570]
+
+5039.	[bug]		Named could fail to preserve owner name case of new
+			RRset. [GL #420]
+
+5038.	[bug]		Chaosnet addresses were compared incorrectly.
+			[GL #562]
+
+5037.	[func]		"allow-recursion-on" and "allow-query-cache-on"
+			each now default to the other if only one of them
+			is set, in order to be more consistent with the way
+			"allow-recursion" and "allow-query-cache" work.
+			Also we now ensure that both query-cache ACLs are
+			checked when determining cache access. [GL #319]
+
+5036.	[cleanup]	Fixed a spacing/formatting error in some RPZ-related
+			error messages in the log. [GL !805]
+
+5035.	[test]		Fixed errors that prevented the DNSRPS subtests
+			from running in the rpz and rpzrecurse system
+			tests. [GL #503]
+
+5034.	[bug]		A race between threads could prevent zone maintenance
+			scheduled immediately after zone load from being
+			performed. [GL #542]
+
+5033.	[bug]		When adding NTAs to multiple views using "rndc nta",
+			the text returned via rndc was incorrectly terminated
+			after the first line, making it look as if only one
+			NTA had been added. Also, it was not possible to
+			differentiate between views with the same name but
+			different classes; this has been corrected with the
+			addition of a "-class" option. [GL #105]
+
+5032.	[func]		Add krb5-selfsub and ms-selfsub update policy rules.
+			[GL #511]
+
+5031.	[cleanup]	Various defines in platform.h has been either dropped
+			if always or never triggered on supported platforms
+			or replaced with config.h equivalents if the defines
+			didn't have any impact on public headers.  Workarounds
+			for LinuxThreads have been removed because NPTL is
+			available since Linux kernel 2.6.0.  [GL #525]
+
+5030.	[bug]		Align CMSG buffers to a 64-bit boundary, fixes crash
+			on architectures with strict alignment. [GL #521]
+
+	--- 9.13.3 released ---
+
+5029.	[func]		Workarounds for servers that misbehave when queried
+			with EDNS have been removed, because these broken
+			servers and the workarounds for their noncompliance
+			cause unnecessary delays, increase code complexity,
+			and prevent deployment of new DNS features. See
+			https://dnsflagday.net for further details. [GL #150]
+
+5028.	[bug]		Spread the initial RRSIG expiration times over the
+			entire working sig-validity-interval when signing a
+			zone in named to even out re-signing and transfer
+			loads. [GL #418]
+
 5027.	[func]		Set SO_SNDBUF size on sockets. [GL #74]
 
 5026.	[bug]		rndc reconfig should not touch already loaded zones.

PLATFORMS

@@ -1,9 +1,11 @@
 Supported platforms
 
 In general, this version of BIND will build and run on any POSIX-compliant
-system with a C99-compliant C compiler, BSD-style sockets, and the OpenSSL
+system with a C99-compliant C compiler, BSD-style sockets with
-cryptography library. To build with multiprocessing support, a
+RFC-compliant IPv6 support, POSIX-compliant threads, and the OpenSSL
-C11-compliant C compiler will be needed for standard atomics.
+cryptography library. Atomic operations support from the compiler is
+needed, either in the form of builtin operations, C11 atomics or the
+Interlocked family of functions on Windows.
 
 ISC regularly tests BIND on many operating systems and architectures, but
 lacks the resources to test all of them. Consequently, ISC is only able to
@@ -53,4 +55,7 @@ These are platforms on which BIND is known not to build or run:
 
   * Platforms without at least OpenSSL 1.0.2
   * Windows 10 / x86
-  * Windows Server 2012
+  * Windows Server 2012 and older
+  * Platforms that don't support IPv6 Advanced Socket API (RFC 3542)
+  * Platforms that don't support atomic operations (via compiler or
+    library)

PLATFORMS.md

@@ -11,9 +11,11 @@
 ## Supported platforms
 
 In general, this version of BIND will build and run on any POSIX-compliant
-system with a C99-compliant C compiler, BSD-style sockets, and the OpenSSL
+system with a C99-compliant C compiler, BSD-style sockets with RFC-compliant
-cryptography library. To build with multiprocessing support, a
+IPv6 support, POSIX-compliant threads, and the OpenSSL cryptography library.
-C11-compliant C compiler will be needed for standard atomics.
+Atomic operations support from the compiler is needed, either in the form of
+builtin operations, C11 atomics or the Interlocked family of functions on
+Windows.
 
 ISC regularly tests BIND on many operating systems and architectures, but
 lacks the resources to test all of them. Consequently, ISC is only able to
@@ -61,4 +63,38 @@ These are platforms on which BIND is known *not* to build or run:
 
 * Platforms without at least OpenSSL 1.0.2
 * Windows 10 / x86
-* Windows Server 2012
+* Windows Server 2012 and older
+* Platforms that don't support IPv6 Advanced Socket API (RFC 3542)
+* Platforms that don't support atomic operations (via compiler or library)
+* Linux without NPTL (Native POSIX Thread Library)
+
+## Platform quirks
+
+### ARM
+
+If the compilation ends with following error:
+
+```
+Error: selected processor does not support `yield' in ARM mode
+```
+
+You will need to set `-march` compiler option to `native`, so the compiler
+recognizes `yield` assembler instruction.  The proper way to set `-march=native`
+would be to put it into `CFLAGS`, e.g. run `./configure` like this:
+`CFLAGS="-march=native -Os -g" ./configure` plus your usual options.
+
+If that doesn't work, you can enforce the minimum CPU and FPU (taken from Debian
+armhf documentation):
+
+* The lowest worthwhile CPU implementation is Armv7-A, therefore the recommended
+  build option is `-march=armv7-a`.
+
+* FPU should be set at VFPv3-D16 as they represent the miminum specification of
+  the processors to support here, therefore the recommended build option is
+  `-mfpu=vfpv3-d16`.
+
+The configure command should look like this:
+
+```
+CFLAGS="-march=armv7-a -mfpu=vfpv3-d16 -Os -g" ./configure
+```

README

@@ -104,8 +104,7 @@ BIND 9.13 features
 BIND 9.13 is the newest development branch of BIND 9. It includes a number
 of changes from BIND 9.12 and earlier releases. New features include:
 
-  * The default value of "dnssec-validation" is now "auto".
+  * QNAME minimization, as described in RFC 7816, is now supported.
-  * Support for IDNA2008 when linking with libidn2.
   * "Root key sentinel" support, enabling validating resolvers to indicate
     via a special query which trust anchors are configured for the root
     zone.
@@ -114,15 +113,24 @@ of changes from BIND 9.12 and earlier releases. New features include:
     subject to DNSSEC validation and are not treated as authoritative data
     when answering. This makes it easier to configure a local copy of the
     root zone as described in RFC 7706.
-  * QNAME minimization is now supported
   * The "validate-except" option allows configuration of domains below
     which DNSSEC validation should not be performed.
+  * The default value of "dnssec-validation" is now "auto".
+  * IDNA2008 is now supported when linking with libidn2.
 
-In addition, cryptographic support has been modernized. BIND now uses the
+In addition, workarounds that were formerly in place to enable resolution
-best available pseudo-random number generator for the platform on which
+of domains whose authoritative servers did not respond to EDNS queries
-it's built. Very old versions of OpenSSL are no longer supported.
+have been removed. See https://dnsflagday.net for more details.
-Cryptography is now mandatory; building BIND without DNSSEC is now longer
+
-supported.
+Cryptographic support has been modernized. BIND now uses the best
+available pseudo-random number generator for the platform on which it's
+built. Very old versions of OpenSSL are no longer supported. Cryptography
+is now mandatory: building BIND without DNSSEC is now longer supported.
+
+Special code to support certain legacy operating systems has also been
+removed; see the file PLATFORMS.md for details of supported platforms. In
+addition to OpenSSL, BIND now requires support for IPv6, threads, and
+standard atomic operations provided by the C compiler.
 
 Building BIND
 
@@ -130,7 +138,7 @@ Minimally, BIND requires a UNIX or Linux system with an ANSI C compiler,
 basic POSIX support, and a 64-bit integer type. Successful builds have
 been observed on many versions of Linux and UNIX, including RedHat,
 Fedora, Debian, Ubuntu, SuSE, Slackware, FreeBSD, NetBSD, OpenBSD, Mac OS
-X, Solaris, HP-UX, AIX, SCO OpenServer, and OpenWRT.
+X, Solaris, HP-UX, and OpenWRT.
 
 BIND requires a cryptography provider library such as OpenSSL or a
 hardware service module supporting PKCS#11. On Linux, BIND requires the
@@ -256,10 +264,6 @@ specifying --enable-fixed-rrset or --disable-fixed-rrset on the configure
 command line. By default, fixed rrset-order is disabled to reduce memory
 footprint.
 
-If your operating system has integrated support for IPv6, it will be used
-automatically. If you have installed KAME IPv6 separately, use --with-kame
-[=PATH] to specify its location.
-
 make install will install named and the various BIND 9 libraries. By
 default, installation is into /usr/local, but this can be changed with the
 --prefix option when running configure.

README.md

@@ -122,8 +122,7 @@ BIND 9.13 is the newest development branch of BIND 9. It includes a
 number of changes from BIND 9.12 and earlier releases.  New features
 include:
 
-* The default value of "dnssec-validation" is now "auto".
+* QNAME minimization, as described in RFC 7816, is now supported.
-* Support for IDNA2008 when linking with `libidn2`.
 * "Root key sentinel" support, enabling validating resolvers to indicate
   via a special query which trust anchors are configured for the root zone.
 * Secondary zones can now be configured as "mirror" zones; their contents
@@ -131,16 +130,28 @@ include:
   DNSSEC validation and are not treated as authoritative data when
   answering. This makes it easier to configure a local copy of the root
   zone as described in RFC 7706.
-* QNAME minimization is now supported
 * The "validate-except" option allows configuration of domains below which
   DNSSEC validation should not be performed.
+* The default value of "dnssec-validation" is now "auto".
+* IDNA2008 is now supported when linking with `libidn2`.
 
-In addition, cryptographic support has been modernized. BIND now uses the
+In addition, workarounds that were formerly in place to enable resolution
+of domains whose authoritative servers did not respond to EDNS queries
+have been removed. See [https://dnsflagday.net](https://dnsflagday.net)
+for more details.
+
+Cryptographic support has been modernized. BIND now uses the
 best available pseudo-random number generator for the platform on which
 it's built. Very old versions of OpenSSL are no longer supported.
-Cryptography is now mandatory; building BIND without DNSSEC is now
+Cryptography is now mandatory: building BIND without DNSSEC is now
 longer supported.
 
+Special code to support certain legacy operating systems has also
+been removed; see the file [PLATFORMS.md](PLATFORMS.md) for details
+of supported platforms. In addition to OpenSSL, BIND now requires
+support for IPv6, threads, and standard atomic operations provided
+by the C compiler.
+
 ### <a name="build"/> Building BIND
 
 Minimally, BIND requires a UNIX or Linux system with an ANSI C compiler,

acconfig.h

@@ -1,81 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-/*! \file */
-
-/***
- *** This file is not to be included by any public header files, because
- *** it does not get installed.
- ***/
-@TOP@
-
-/** define if your system needs pthread_init() before using pthreads */
-#undef NEED_PTHREAD_INIT
-
-/** define if your system has sigwait() */
-#undef HAVE_SIGWAIT
-
-/** define if sigwait() is the UnixWare flavor */
-#undef HAVE_UNIXWARE_SIGWAIT
-
-/** define if LinuxThreads is in use */
-#undef HAVE_LINUXTHREADS
-
-/** define if sysconf() is available */
-#undef HAVE_SYSCONF
-
-/** define if sysctlbyname() is available */
-#undef HAVE_SYSCTLBYNAME
-
-/** define if catgets() is available */
-#undef HAVE_CATGETS
-
-/** define if getifaddrs() exists */
-#undef HAVE_GETIFADDRS
-
-/** define if you have the NET_RT_IFLIST sysctl variable and sys/sysctl.h */
-#undef HAVE_IFLIST_SYSCTL
-
-/** define if tzset() is available */
-#undef HAVE_TZSET
-
-/**
- * define if pthread_setconcurrency() should be called to tell the
- * OS how many threads we might want to run.
- */
-#undef CALL_PTHREAD_SETCONCURRENCY
-
-/** define if flockfile() is available */
-#undef HAVE_FLOCKFILE
-
-/** define if getc_unlocked() is available */
-#undef HAVE_GETCUNLOCKED
-
-/** define if the system has a random number generating device */
-#undef PATH_RANDOMDEV
-
-/** define if pthread_attr_getstacksize() is available */
-#undef HAVE_PTHREAD_ATTR_GETSTACKSIZE
-
-/** define if pthread_attr_setstacksize() is available */
-#undef HAVE_PTHREAD_ATTR_SETSTACKSIZE
-
-/** define if you have strerror in the C library. */
-#undef HAVE_STRERROR
-
-/* Define to the length type used by the socket API (socklen_t, size_t, int). */
-#undef ISC_SOCKADDR_LEN_T
-
-/* Define if threads need PTHREAD_SCOPE_SYSTEM */
-#undef NEED_PTHREAD_SCOPE_SYSTEM
-
-/* Define to 1 if you have the uname library function. */
-#undef HAVE_UNAME

bin/check/Makefile.in

@@ -88,12 +88,12 @@ install:: named-checkconf@EXEEXT@ named-checkzone@EXEEXT@ installdirs
 	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} named-checkconf@EXEEXT@ ${DESTDIR}${sbindir}
 	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} named-checkzone@EXEEXT@ ${DESTDIR}${sbindir}
 	(cd ${DESTDIR}${sbindir}; rm -f named-compilezone@EXEEXT@; ${LINK_PROGRAM} named-checkzone@EXEEXT@ named-compilezone@EXEEXT@)
-	for m in ${MANPAGES}; do ${INSTALL_DATA} ${srcdir}/$$m ${DESTDIR}${mandir}/man8; done
+	for m in ${MANPAGES}; do ${INSTALL_DATA} ${srcdir}/$$m ${DESTDIR}${mandir}/man8 || exit 1; done
 	(cd ${DESTDIR}${mandir}/man8; rm -f named-compilezone.8; ${LINK_PROGRAM} named-checkzone.8 named-compilezone.8)
 
 uninstall::
 	rm -f ${DESTDIR}${mandir}/man8/named-compilezone.8
-	for m in ${MANPAGES}; do rm -f ${DESTDIR}${mandir}/man8/$$m ; done
+	for m in ${MANPAGES}; do rm -f ${DESTDIR}${mandir}/man8/$$m || exit 1; done
 	rm -f ${DESTDIR}${sbindir}/named-compilezone@EXEEXT@
 	${LIBTOOL_MODE_UNINSTALL} rm -f ${DESTDIR}${sbindir}/named-checkconf@EXEEXT@
 	${LIBTOOL_MODE_UNINSTALL} rm -f ${DESTDIR}${sbindir}/named-checkzone@EXEEXT@

bin/dig/Makefile.in

@@ -101,12 +101,12 @@ install:: dig@EXEEXT@ host@EXEEXT@ nslookup@EXEEXT@ installdirs
 	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} \
 		nslookup@EXEEXT@ ${DESTDIR}${bindir}
 	for m in ${MANPAGES}; do \
-		${INSTALL_DATA} ${srcdir}/$$m ${DESTDIR}${mandir}/man1; \
+		${INSTALL_DATA} ${srcdir}/$$m ${DESTDIR}${mandir}/man1 || exit 1; \
-		done
+	done
 
 uninstall::
 	for m in ${MANPAGES}; do \
-		rm -f ${DESTDIR}${mandir}/man1/$$m ; \
+		rm -f ${DESTDIR}${mandir}/man1/$$m || exit 1; \
 	done
 	${LIBTOOL_MODE_UNINSTALL} rm -f ${DESTDIR}${bindir}/nslookup@EXEEXT@
 	${LIBTOOL_MODE_UNINSTALL} rm -f ${DESTDIR}${bindir}/host@EXEEXT@

bin/dig/dig.docbook

@@ -1330,7 +1330,9 @@ dig +qr www.isc.org any -x 127.0.0.1 isc.org ns +noqr
       reply from the server.
       If you'd like to turn off the IDN support for some reason, use
       parameters <parameter>+noidnin</parameter> and
-      <parameter>+noidnout</parameter>.
+      <parameter>+noidnout</parameter> or define
+      the <envar>IDN_DISABLE</envar> environment variable.
+
     </para>
   </refsection>
 

bin/dig/dighost.c

@@ -628,8 +628,8 @@ make_empty_lookup(void) {
 	looknew->ttlunits = false;
 	looknew->qr = false;
 #ifdef HAVE_LIBIDN2
-	looknew->idnin = true;
+	looknew->idnin = (getenv("IDN_DISABLE") == NULL);
-	looknew->idnout = true;
+	looknew->idnout = looknew->idnin;
 #else
 	looknew->idnin = false;
 	looknew->idnout = false;

bin/dig/host.docbook

@@ -389,7 +389,7 @@
       <command>host</command> appropriately converts character encoding of
       domain name before sending a request to DNS server or displaying a
       reply from the server.
-      If you'd like to turn off the IDN support for some reason, defines
+      If you'd like to turn off the IDN support for some reason, define
       the <envar>IDN_DISABLE</envar> environment variable.
       The IDN support is disabled if the variable is set when
       <command>host</command> runs.

bin/dig/nslookup.docbook

@@ -478,6 +478,21 @@ nslookup -query=hinfo  -timeout=10
     </para>
   </refsection>
 
+  <refsection><info><title>IDN SUPPORT</title></info>
+
+    <para>
+      If <command>nslookup</command> has been built with IDN (internationalized
+      domain name) support, it can accept and display non-ASCII domain names.
+      <command>nslookup</command> appropriately converts character encoding of
+      domain name before sending a request to DNS server or displaying a
+      reply from the server.
+      If you'd like to turn off the IDN support for some reason, define
+      the <envar>IDN_DISABLE</envar> environment variable.
+      The IDN support is disabled if the variable is set when
+      <command>nslookup</command> runs.
+    </para>
+  </refsection>
+
   <refsection><info><title>FILES</title></info>
 
     <para><filename>/etc/resolv.conf</filename>

bin/dnssec/Makefile.in

@@ -115,12 +115,12 @@ installdirs:
 	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${mandir}/man8
 
 install:: ${TARGETS} installdirs
-	for t in ${TARGETS}; do ${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} $$t ${DESTDIR}${sbindir}; done
+	for t in ${TARGETS}; do ${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} $$t ${DESTDIR}${sbindir} || exit 1; done
-	for m in ${MANPAGES}; do ${INSTALL_DATA} ${srcdir}/$$m ${DESTDIR}${mandir}/man8; done
+	for m in ${MANPAGES}; do ${INSTALL_DATA} ${srcdir}/$$m ${DESTDIR}${mandir}/man8 || exit 1; done
 
 uninstall::
-	for m in ${MANPAGES}; do rm -f ${DESTDIR}${mandir}/man8/$$m ; done
+	for m in ${MANPAGES}; do rm -f ${DESTDIR}${mandir}/man8/$$m || exit 1; done
-	for t in ${TARGETS}; do ${LIBTOOL_MODE_UNINSTALL} rm -f ${DESTDIR}${sbindir}/$$t ; done
+	for t in ${TARGETS}; do ${LIBTOOL_MODE_UNINSTALL} rm -f ${DESTDIR}${sbindir}/$$t || exit 1; done
 
 clean distclean::
 	rm -f ${TARGETS}

bin/dnssec/dnssec-keygen.c

@@ -308,7 +308,7 @@ main(int argc, char **argv) {
 		case 'e':
 			fprintf(stderr,
 				"phased-out option -e "
-				"(was 'use (RSA) large exponent)\n");
+				"(was 'use (RSA) large exponent')\n");
 			break;
 		case 'f':
 			c = (unsigned char)(isc_commandline_argument[0]);

bin/named/main.c

@@ -122,14 +122,17 @@ static int		maxudp = 0;
  */
 static bool clienttest = false;
 static bool dropedns = false;
-static bool noedns = false;
+static bool ednsformerr = false;
-static bool nosoa = false;
+static bool ednsnotimp = false;
-static bool noaa = false;
+static bool ednsrefused = false;
-static unsigned int delay = 0;
-static bool nonearest = false;
-static bool notcp = false;
 static bool fixedlocal = false;
+static bool noaa = false;
+static bool noedns = false;
+static bool nonearest = false;
+static bool nosoa = false;
+static bool notcp = false;
 static bool sigvalinsecs = false;
+static unsigned int delay = 0;
 
 /*
  * -4 and -6
@@ -488,6 +491,12 @@ parse_T_opt(char *option) {
 		dropedns = true;
 	} else if (!strncmp(option, "dscp=", 5)) {
 		isc_dscp_check_value = atoi(option + 5);
+	} else if (!strcmp(option, "ednsformerr")) {
+		ednsformerr = true;
+	} else if (!strcmp(option, "ednsnotimp")) {
+		ednsnotimp = true;
+	} else if (!strcmp(option, "ednsrefused")) {
+		ednsrefused = true;
 	} else if (!strcmp(option, "fixedlocal")) {
 		fixedlocal = true;
 	} else if (!strcmp(option, "keepstderr")) {
@@ -547,7 +556,7 @@ parse_T_opt(char *option) {
 	} else if (!strncmp(option, "tat=", 4)) {
 		named_g_tat_interval = atoi(option + 4);
 	} else {
-		fprintf(stderr, "unknown -T flag '%s\n", option);
+		fprintf(stderr, "unknown -T flag '%s'\n", option);
 	}
 }
 
@@ -784,10 +793,7 @@ create_managers(void) {
 	named_g_udpdisp = 1;
 #else
 	if (named_g_udpdisp == 0) {
-		if (named_g_cpus_detected == 1)
+		named_g_udpdisp = named_g_cpus_detected;
-			named_g_udpdisp = 1;
-		else
-			named_g_udpdisp = named_g_cpus_detected - 1;
 	}
 	if (named_g_udpdisp > named_g_cpus)
 		named_g_udpdisp = named_g_cpus;
@@ -815,14 +821,14 @@ create_managers(void) {
 	}
 
 	result = isc_socketmgr_create2(named_g_mctx, &named_g_socketmgr,
-				       maxsocks);
+				       maxsocks, named_g_udpdisp);
 	if (result != ISC_R_SUCCESS) {
 		UNEXPECTED_ERROR(__FILE__, __LINE__,
 				 "isc_socketmgr_create() failed: %s",
 				 isc_result_totext(result));
 		return (ISC_R_UNEXPECTED);
 	}
-	isc__socketmgr_maxudp(named_g_socketmgr, maxudp);
+	isc_socketmgr_maxudp(named_g_socketmgr, maxudp);
 	result = isc_socketmgr_getmaxsockets(named_g_socketmgr, &socks);
 	if (result == ISC_R_SUCCESS) {
 		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
@@ -1035,16 +1041,6 @@ setup(void) {
 		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
 		      "linked to zlib version: %s", zlibVersion());
 #endif
-#ifdef ISC_PLATFORM_USETHREADS
-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
-		      "threads support is enabled");
-#else
-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
-		      "threads support is disabled");
-#endif
-
 	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
 		      "----------------------------------------------------");
@@ -1159,24 +1155,30 @@ setup(void) {
 	 */
 	if (clienttest)
 		ns_server_setoption(sctx, NS_SERVER_CLIENTTEST, true);
-	if (dropedns)
-		ns_server_setoption(sctx, NS_SERVER_DROPEDNS, true);
-	if (noedns)
-		ns_server_setoption(sctx, NS_SERVER_NOEDNS, true);
-	if (nosoa)
-		ns_server_setoption(sctx, NS_SERVER_NOSOA, true);
-	if (noaa)
-		ns_server_setoption(sctx, NS_SERVER_NOAA, true);
-	if (nonearest)
-		ns_server_setoption(sctx, NS_SERVER_NONEAREST, true);
-	if (notcp)
-		ns_server_setoption(sctx, NS_SERVER_NOTCP, true);
-	if (fixedlocal)
-		ns_server_setoption(sctx, NS_SERVER_FIXEDLOCAL, true);
 	if (disable4)
 		ns_server_setoption(sctx, NS_SERVER_DISABLE4, true);
 	if (disable6)
 		ns_server_setoption(sctx, NS_SERVER_DISABLE6, true);
+	if (dropedns)
+		ns_server_setoption(sctx, NS_SERVER_DROPEDNS, true);
+	if (ednsformerr)	/* STD13 server */
+		ns_server_setoption(sctx, NS_SERVER_EDNSFORMERR, true);
+	if (ednsnotimp)
+		ns_server_setoption(sctx, NS_SERVER_EDNSNOTIMP, true);
+	if (ednsrefused)
+		ns_server_setoption(sctx, NS_SERVER_EDNSREFUSED, true);
+	if (fixedlocal)
+		ns_server_setoption(sctx, NS_SERVER_FIXEDLOCAL, true);
+	if (noaa)
+		ns_server_setoption(sctx, NS_SERVER_NOAA, true);
+	if (noedns)
+		ns_server_setoption(sctx, NS_SERVER_NOEDNS, true);
+	if (nonearest)
+		ns_server_setoption(sctx, NS_SERVER_NONEAREST, true);
+	if (nosoa)
+		ns_server_setoption(sctx, NS_SERVER_NOSOA, true);
+	if (notcp)
+		ns_server_setoption(sctx, NS_SERVER_NOTCP, true);
 	if (sigvalinsecs)
 		ns_server_setoption(sctx, NS_SERVER_SIGVALINSECS, true);
 

bin/named/named.conf.5

@@ -10,12 +10,12 @@
 .\"     Title: named.conf
 .\"    Author: 
 .\" Generator: DocBook XSL Stylesheets v1.78.1 <http://docbook.sf.net/>
-.\"      Date: 2018-05-29
+.\"      Date: 2018-06-21
 .\"    Manual: BIND9
 .\"    Source: ISC
 .\"  Language: English
 .\"
-.TH "NAMED\&.CONF" "5" "2018\-05\-29" "ISC" "BIND9"
+.TH "NAMED\&.CONF" "5" "2018\-06\-21" "ISC" "BIND9"
 .\" -----------------------------------------------------------------
 .\" * Define some portability stuff
 .\" -----------------------------------------------------------------
@@ -231,9 +231,9 @@ options {
 	coresize ( default | unlimited | \fIsizeval\fR );
 	datasize ( default | unlimited | \fIsizeval\fR );
 	deny\-answer\-addresses { \fIaddress_match_element\fR; \&.\&.\&. } [
-	    except\-from { \fIquoted_string\fR; \&.\&.\&. } ];
+	    except\-from { \fIstring\fR; \&.\&.\&. } ];
-	deny\-answer\-aliases { \fIquoted_string\fR; \&.\&.\&. } [ except\-from {
+	deny\-answer\-aliases { \fIstring\fR; \&.\&.\&. } [ except\-from { \fIstring\fR; \&.\&.\&.
-	    \fIquoted_string\fR; \&.\&.\&. } ];
+	    } ];
 	dialup ( notify | notify\-passive | passive | refresh | \fIboolean\fR );
 	directory \fIquoted_string\fR;
 	disable\-algorithms \fIstring\fR { \fIstring\fR;
@@ -264,14 +264,12 @@ options {
 	dnssec\-secure\-to\-insecure \fIboolean\fR;
 	dnssec\-update\-mode ( maintain | no\-resign );
 	dnssec\-validation ( yes | no | auto );
-	dnstap { ( all | auth | client | forwarder |
+	dnstap { ( all | auth | client | forwarder | resolver ) [ ( query |
-	    resolver ) [ ( query | response ) ]; \&.\&.\&. };
+	    response ) ]; \&.\&.\&. };
-	dnstap\-identity ( \fIquoted_string\fR | none |
+	dnstap\-identity ( \fIquoted_string\fR | none | hostname );
-	    hostname );
+	dnstap\-output ( file | unix ) \fIquoted_string\fR [ size ( unlimited |
-	dnstap\-output ( file | unix ) \fIquoted_string\fR [
+	    \fIsize\fR ) ] [ versions ( unlimited | \fIinteger\fR ) ] [ suffix (
-	    size ( unlimited | \fIsize\fR ) ] [ versions (
+	    increment | timestamp ) ];
-	    unlimited | \fIinteger\fR ) ] [ suffix ( increment
-	    | timestamp ) ];
 	dnstap\-version ( \fIquoted_string\fR | none );
 	dscp \fIinteger\fR;
 	dual\-stack\-servers [ port \fIinteger\fR ] { ( \fIquoted_string\fR [ port
@@ -369,7 +367,7 @@ options {
 	preferred\-glue \fIstring\fR;
 	prefetch \fIinteger\fR [ \fIinteger\fR ];
 	provide\-ixfr \fIboolean\fR;
-	qname\-minimization ( strict | relaxed | disabled );
+	qname\-minimization ( strict | relaxed | disabled | off );
 	query\-source ( ( [ address ] ( \fIipv4_address\fR | * ) [ port (
 	    \fIinteger\fR | * ) ] ) | ( [ [ address ] ( \fIipv4_address\fR | * ) ]
 	    port ( \fIinteger\fR | * ) ) ) [ dscp \fIinteger\fR ];
@@ -420,7 +418,7 @@ options {
 	    nsip\-enable \fIboolean\fR ] [ nsdname\-enable \fIboolean\fR ] [
 	    dnsrps\-enable \fIboolean\fR ] [ dnsrps\-options { \fIunspecified\-text\fR
 	    } ];
-	root\-delegation\-only [ exclude { \fIquoted_string\fR; \&.\&.\&. } ];
+	root\-delegation\-only [ exclude { \fIstring\fR; \&.\&.\&. } ];
 	root\-key\-sentinel \fIboolean\fR;
 	rrset\-order { [ class \fIstring\fR ] [ type \fIstring\fR ] [ name
 	    \fIquoted_string\fR ] \fIstring\fR \fIstring\fR; \&.\&.\&. };
@@ -470,6 +468,7 @@ options {
 	use\-v4\-udp\-ports { \fIportrange\fR; \&.\&.\&. };
 	use\-v6\-udp\-ports { \fIportrange\fR; \&.\&.\&. };
 	v6\-bias \fIinteger\fR;
+	validate\-except { \fIstring\fR; \&.\&.\&. };
 	version ( \fIquoted_string\fR | none );
 	zero\-no\-soa\-ttl \fIboolean\fR;
 	zero\-no\-soa\-ttl\-cache \fIboolean\fR;
@@ -597,9 +596,9 @@ view \fIstring\fR [ \fIclass\fR ] {
 	cleaning\-interval \fIinteger\fR;
 	clients\-per\-query \fIinteger\fR;
 	deny\-answer\-addresses { \fIaddress_match_element\fR; \&.\&.\&. } [
-	    except\-from { \fIquoted_string\fR; \&.\&.\&. } ];
+	    except\-from { \fIstring\fR; \&.\&.\&. } ];
-	deny\-answer\-aliases { \fIquoted_string\fR; \&.\&.\&. } [ except\-from {
+	deny\-answer\-aliases { \fIstring\fR; \&.\&.\&. } [ except\-from { \fIstring\fR; \&.\&.\&.
-	    \fIquoted_string\fR; \&.\&.\&. } ];
+	    } ];
 	dialup ( notify | notify\-passive | passive | refresh | \fIboolean\fR );
 	disable\-algorithms \fIstring\fR { \fIstring\fR;
 	    \&.\&.\&. };
@@ -633,8 +632,8 @@ view \fIstring\fR [ \fIclass\fR ] {
 	dnssec\-secure\-to\-insecure \fIboolean\fR;
 	dnssec\-update\-mode ( maintain | no\-resign );
 	dnssec\-validation ( yes | no | auto );
-	dnstap { ( all | auth | client | forwarder |
+	dnstap { ( all | auth | client | forwarder | resolver ) [ ( query |
-	    resolver ) [ ( query | response ) ]; \&.\&.\&. };
+	    response ) ]; \&.\&.\&. };
 	dual\-stack\-servers [ port \fIinteger\fR ] { ( \fIquoted_string\fR [ port
 	    \fIinteger\fR ] [ dscp \fIinteger\fR ] | \fIipv4_address\fR [ port
 	    \fIinteger\fR ] [ dscp \fIinteger\fR ] | \fIipv6_address\fR [ port
@@ -712,7 +711,7 @@ view \fIstring\fR [ \fIclass\fR ] {
 	preferred\-glue \fIstring\fR;
 	prefetch \fIinteger\fR [ \fIinteger\fR ];
 	provide\-ixfr \fIboolean\fR;
-	qname\-minimization ( strict | relaxed | disabled );
+	qname\-minimization ( strict | relaxed | disabled | off );
 	query\-source ( ( [ address ] ( \fIipv4_address\fR | * ) [ port (
 	    \fIinteger\fR | * ) ] ) | ( [ [ address ] ( \fIipv4_address\fR | * ) ]
 	    port ( \fIinteger\fR | * ) ) ) [ dscp \fIinteger\fR ];
@@ -758,7 +757,7 @@ view \fIstring\fR [ \fIclass\fR ] {
 	    nsip\-enable \fIboolean\fR ] [ nsdname\-enable \fIboolean\fR ] [
 	    dnsrps\-enable \fIboolean\fR ] [ dnsrps\-options { \fIunspecified\-text\fR
 	    } ];
-	root\-delegation\-only [ exclude { \fIquoted_string\fR; \&.\&.\&. } ];
+	root\-delegation\-only [ exclude { \fIstring\fR; \&.\&.\&. } ];
 	root\-key\-sentinel \fIboolean\fR;
 	rrset\-order { [ class \fIstring\fR ] [ type \fIstring\fR ] [ name
 	    \fIquoted_string\fR ] \fIstring\fR \fIstring\fR; \&.\&.\&. };
@@ -820,6 +819,7 @@ view \fIstring\fR [ \fIclass\fR ] {
 	update\-check\-ksk \fIboolean\fR;
 	use\-alt\-transfer\-source \fIboolean\fR;
 	v6\-bias \fIinteger\fR;
+	validate\-except { \fIstring\fR; \&.\&.\&. };
 	zero\-no\-soa\-ttl \fIboolean\fR;
 	zero\-no\-soa\-ttl\-cache \fIboolean\fR;
 	zone \fIstring\fR [ \fIclass\fR ] {
@@ -901,7 +901,7 @@ view \fIstring\fR [ \fIclass\fR ] {
 		serial\-update\-method ( date | increment | unixtime );
 		server\-addresses { ( \fIipv4_address\fR | \fIipv6_address\fR ) [
 		    port \fIinteger\fR ]; \&.\&.\&. };
-		server\-names { \fIquoted_string\fR; \&.\&.\&. };
+		server\-names { \fIstring\fR; \&.\&.\&. };
 		sig\-signing\-nodes \fIinteger\fR;
 		sig\-signing\-signatures \fIinteger\fR;
 		sig\-signing\-type \fIinteger\fR;
@@ -1009,7 +1009,7 @@ zone \fIstring\fR [ \fIclass\fR ] {
 	serial\-update\-method ( date | increment | unixtime );
 	server\-addresses { ( \fIipv4_address\fR | \fIipv6_address\fR ) [ port
 	    \fIinteger\fR ]; \&.\&.\&. };
-	server\-names { \fIquoted_string\fR; \&.\&.\&. };
+	server\-names { \fIstring\fR; \&.\&.\&. };
 	sig\-signing\-nodes \fIinteger\fR;
 	sig\-signing\-signatures \fIinteger\fR;
 	sig\-signing\-type \fIinteger\fR;

bin/named/named.conf.docbook

@@ -13,7 +13,7 @@
 
 <refentry xmlns:db="http://docbook.org/ns/docbook" version="5.0" xml:id="man.named.conf">
   <info>
-    <date>2018-06-21</date>
+    <date>2018-09-04</date>
   </info>
   <refentryinfo>
     <corpname>ISC</corpname>
@@ -192,6 +192,7 @@ options {
 	    ] [ dscp <replaceable>integer</replaceable> ];
 	alt-transfer-source-v6 ( <replaceable>ipv6_address</replaceable> | * ) [ port ( <replaceable>integer</replaceable> |
 	    * ) ] [ dscp <replaceable>integer</replaceable> ];
+	answer-cookie <replaceable>boolean</replaceable>;
 	attach-cache <replaceable>string</replaceable>;
 	auth-nxdomain <replaceable>boolean</replaceable>; // default changed
 	auto-dnssec ( allow | maintain | off );
@@ -257,8 +258,8 @@ options {
 	dnssec-secure-to-insecure <replaceable>boolean</replaceable>;
 	dnssec-update-mode ( maintain | no-resign );
 	dnssec-validation ( yes | no | auto );
-	dnstap { ( all | auth | client | forwarder | resolver ) [ ( query |
+	dnstap { ( all | auth | client | forwarder | resolver | update ) [
-	    response ) ]; ... };
+	    ( query | response ) ]; ... };
 	dnstap-identity ( <replaceable>quoted_string</replaceable> | none | hostname );
 	dnstap-output ( file | unix ) <replaceable>quoted_string</replaceable> [ size ( unlimited |
 	    <replaceable>size</replaceable> ) ] [ versions ( unlimited | <replaceable>integer</replaceable> ) ] [ suffix (
@@ -340,6 +341,7 @@ options {
 	min-retry-time <replaceable>integer</replaceable>;
 	minimal-any <replaceable>boolean</replaceable>;
 	minimal-responses ( no-auth | no-auth-recursive | <replaceable>boolean</replaceable> );
+	mirror <replaceable>boolean</replaceable>;
 	multi-master <replaceable>boolean</replaceable>;
 	new-zones-directory <replaceable>quoted_string</replaceable>;
 	no-case-compress { <replaceable>address_match_element</replaceable>; ... };
@@ -609,8 +611,8 @@ view <replaceable>string</replaceable> [ <replaceable>class</replaceable> ] {
 	dnssec-secure-to-insecure <replaceable>boolean</replaceable>;
 	dnssec-update-mode ( maintain | no-resign );
 	dnssec-validation ( yes | no | auto );
-	dnstap { ( all | auth | client | forwarder | resolver ) [ ( query |
+	dnstap { ( all | auth | client | forwarder | resolver | update ) [
-	    response ) ]; ... };
+	    ( query | response ) ]; ... };
 	dual-stack-servers [ port <replaceable>integer</replaceable> ] { ( <replaceable>quoted_string</replaceable> [ port
 	    <replaceable>integer</replaceable> ] [ dscp <replaceable>integer</replaceable> ] | <replaceable>ipv4_address</replaceable> [ port
 	    <replaceable>integer</replaceable> ] [ dscp <replaceable>integer</replaceable> ] | <replaceable>ipv6_address</replaceable> [ port
@@ -671,6 +673,7 @@ view <replaceable>string</replaceable> [ <replaceable>class</replaceable> ] {
 	min-retry-time <replaceable>integer</replaceable>;
 	minimal-any <replaceable>boolean</replaceable>;
 	minimal-responses ( no-auth | no-auth-recursive | <replaceable>boolean</replaceable> );
+	mirror <replaceable>boolean</replaceable>;
 	multi-master <replaceable>boolean</replaceable>;
 	new-zones-directory <replaceable>quoted_string</replaceable>;
 	no-case-compress { <replaceable>address_match_element</replaceable>; ... };
@@ -893,10 +896,10 @@ view <replaceable>string</replaceable> [ <replaceable>class</replaceable> ] {
 		    static-stub | stub );
 		update-check-ksk <replaceable>boolean</replaceable>;
 		update-policy ( local | { ( deny | grant ) <replaceable>string</replaceable> (
-		    6to4-self | external | krb5-self | krb5-subdomain |
+		    6to4-self | external | krb5-self | krb5-selfsub |
-		    ms-self | ms-subdomain | name | self | selfsub |
+		    krb5-subdomain | ms-self | ms-selfsub | ms-subdomain |
-		    selfwild | subdomain | tcp-self | wildcard | zonesub )
+		    name | self | selfsub | selfwild | subdomain | tcp-self
-		    [ <replaceable>string</replaceable> ] <replaceable>rrtypelist</replaceable>; ... };
+		    | wildcard | zonesub ) [ <replaceable>string</replaceable> ] <replaceable>rrtypelist</replaceable>; ... };
 		use-alt-transfer-source <replaceable>boolean</replaceable>;
 		zero-no-soa-ttl <replaceable>boolean</replaceable>;
 		zone-statistics ( full | terse | none | <replaceable>boolean</replaceable> );
@@ -996,9 +999,10 @@ zone <replaceable>string</replaceable> [ <replaceable>class</replaceable> ] {
 	    forward | hint | redirect | static-stub | stub );
 	update-check-ksk <replaceable>boolean</replaceable>;
 	update-policy ( local | { ( deny | grant ) <replaceable>string</replaceable> ( 6to4-self |
-	    external | krb5-self | krb5-subdomain | ms-self | ms-subdomain
+	    external | krb5-self | krb5-selfsub | krb5-subdomain | ms-self
-	    | name | self | selfsub | selfwild | subdomain | tcp-self |
+	    | ms-selfsub | ms-subdomain | name | self | selfsub | selfwild
-	    wildcard | zonesub ) [ <replaceable>string</replaceable> ] <replaceable>rrtypelist</replaceable>; ... };
+	    | subdomain | tcp-self | wildcard | zonesub ) [ <replaceable>string</replaceable> ]
+	    <replaceable>rrtypelist</replaceable>; ... };
 	use-alt-transfer-source <replaceable>boolean</replaceable>;
 	zero-no-soa-ttl <replaceable>boolean</replaceable>;
 	zone-statistics ( full | terse | none | <replaceable>boolean</replaceable> );

bin/named/named.conf.html

@@ -212,9 +212,9 @@ options
 	coresize ( default | unlimited | <em class="replaceable"><code>sizeval</code></em> );<br>
 	datasize ( default | unlimited | <em class="replaceable"><code>sizeval</code></em> );<br>
 	deny-answer-addresses { <em class="replaceable"><code>address_match_element</code></em>; ... } [<br>
-	    except-from { <em class="replaceable"><code>quoted_string</code></em>; ... } ];<br>
+	    except-from { <em class="replaceable"><code>string</code></em>; ... } ];<br>
-	deny-answer-aliases { <em class="replaceable"><code>quoted_string</code></em>; ... } [ except-from {<br>
+	deny-answer-aliases { <em class="replaceable"><code>string</code></em>; ... } [ except-from { <em class="replaceable"><code>string</code></em>; ...<br>
-	    <em class="replaceable"><code>quoted_string</code></em>; ... } ];<br>
+	    } ];<br>
 	dialup ( notify | notify-passive | passive | refresh | <em class="replaceable"><code>boolean</code></em> );<br>
 	directory <em class="replaceable"><code>quoted_string</code></em>;<br>
 	disable-algorithms <em class="replaceable"><code>string</code></em> { <em class="replaceable"><code>string</code></em>;<br>
@@ -245,14 +245,12 @@ options
 	dnssec-secure-to-insecure <em class="replaceable"><code>boolean</code></em>;<br>
 	dnssec-update-mode ( maintain | no-resign );<br>
 	dnssec-validation ( yes | no | auto );<br>
-	dnstap { ( all | auth | client | forwarder |<br>
+	dnstap { ( all | auth | client | forwarder | resolver ) [ ( query |<br>
-	    resolver ) [ ( query | response ) ]; ... };<br>
+	    response ) ]; ... };<br>
-	dnstap-identity ( <em class="replaceable"><code>quoted_string</code></em> | none |<br>
+	dnstap-identity ( <em class="replaceable"><code>quoted_string</code></em> | none | hostname );<br>
-	    hostname );<br>
+	dnstap-output ( file | unix ) <em class="replaceable"><code>quoted_string</code></em> [ size ( unlimited |<br>
-	dnstap-output ( file | unix ) <em class="replaceable"><code>quoted_string</code></em> [<br>
+	    <em class="replaceable"><code>size</code></em> ) ] [ versions ( unlimited | <em class="replaceable"><code>integer</code></em> ) ] [ suffix (<br>
-	    size ( unlimited | <em class="replaceable"><code>size</code></em> ) ] [ versions (<br>
+	    increment | timestamp ) ];<br>
-	    unlimited | <em class="replaceable"><code>integer</code></em> ) ] [ suffix ( increment<br>
-	    | timestamp ) ];<br>
 	dnstap-version ( <em class="replaceable"><code>quoted_string</code></em> | none );<br>
 	dscp <em class="replaceable"><code>integer</code></em>;<br>
 	dual-stack-servers [ port <em class="replaceable"><code>integer</code></em> ] { ( <em class="replaceable"><code>quoted_string</code></em> [ port<br>
@@ -350,7 +348,7 @@ options
 	preferred-glue <em class="replaceable"><code>string</code></em>;<br>
 	prefetch <em class="replaceable"><code>integer</code></em> [ <em class="replaceable"><code>integer</code></em> ];<br>
 	provide-ixfr <em class="replaceable"><code>boolean</code></em>;<br>
-	qname-minimization ( strict | relaxed | disabled );<br>
+	qname-minimization ( strict | relaxed | disabled | off );<br>
 	query-source ( ( [ address ] ( <em class="replaceable"><code>ipv4_address</code></em> | * ) [ port (<br>
 	    <em class="replaceable"><code>integer</code></em> | * ) ] ) | ( [ [ address ] ( <em class="replaceable"><code>ipv4_address</code></em> | * ) ]<br>
 	    port ( <em class="replaceable"><code>integer</code></em> | * ) ) ) [ dscp <em class="replaceable"><code>integer</code></em> ];<br>
@@ -401,7 +399,7 @@ options
 	    nsip-enable <em class="replaceable"><code>boolean</code></em> ] [ nsdname-enable <em class="replaceable"><code>boolean</code></em> ] [<br>
 	    dnsrps-enable <em class="replaceable"><code>boolean</code></em> ] [ dnsrps-options { <em class="replaceable"><code>unspecified-text</code></em><br>
 	    } ];<br>
-	root-delegation-only [ exclude { <em class="replaceable"><code>quoted_string</code></em>; ... } ];<br>
+	root-delegation-only [ exclude { <em class="replaceable"><code>string</code></em>; ... } ];<br>
 	root-key-sentinel <em class="replaceable"><code>boolean</code></em>;<br>
 	rrset-order { [ class <em class="replaceable"><code>string</code></em> ] [ type <em class="replaceable"><code>string</code></em> ] [ name<br>
 	    <em class="replaceable"><code>quoted_string</code></em> ] <em class="replaceable"><code>string</code></em> <em class="replaceable"><code>string</code></em>; ... };<br>
@@ -451,6 +449,7 @@ options
 	use-v4-udp-ports { <em class="replaceable"><code>portrange</code></em>; ... };<br>
 	use-v6-udp-ports { <em class="replaceable"><code>portrange</code></em>; ... };<br>
 	v6-bias <em class="replaceable"><code>integer</code></em>;<br>
+	validate-except { <em class="replaceable"><code>string</code></em>; ... };<br>
 	version ( <em class="replaceable"><code>quoted_string</code></em> | none );<br>
 	zero-no-soa-ttl <em class="replaceable"><code>boolean</code></em>;<br>
 	zero-no-soa-ttl-cache <em class="replaceable"><code>boolean</code></em>;<br>
@@ -566,9 +565,9 @@ view
 	cleaning-interval <em class="replaceable"><code>integer</code></em>;<br>
 	clients-per-query <em class="replaceable"><code>integer</code></em>;<br>
 	deny-answer-addresses { <em class="replaceable"><code>address_match_element</code></em>; ... } [<br>
-	    except-from { <em class="replaceable"><code>quoted_string</code></em>; ... } ];<br>
+	    except-from { <em class="replaceable"><code>string</code></em>; ... } ];<br>
-	deny-answer-aliases { <em class="replaceable"><code>quoted_string</code></em>; ... } [ except-from {<br>
+	deny-answer-aliases { <em class="replaceable"><code>string</code></em>; ... } [ except-from { <em class="replaceable"><code>string</code></em>; ...<br>
-	    <em class="replaceable"><code>quoted_string</code></em>; ... } ];<br>
+	    } ];<br>
 	dialup ( notify | notify-passive | passive | refresh | <em class="replaceable"><code>boolean</code></em> );<br>
 	disable-algorithms <em class="replaceable"><code>string</code></em> { <em class="replaceable"><code>string</code></em>;<br>
 	    ... };<br>
@@ -602,8 +601,8 @@ view
 	dnssec-secure-to-insecure <em class="replaceable"><code>boolean</code></em>;<br>
 	dnssec-update-mode ( maintain | no-resign );<br>
 	dnssec-validation ( yes | no | auto );<br>
-	dnstap { ( all | auth | client | forwarder |<br>
+	dnstap { ( all | auth | client | forwarder | resolver ) [ ( query |<br>
-	    resolver ) [ ( query | response ) ]; ... };<br>
+	    response ) ]; ... };<br>
 	dual-stack-servers [ port <em class="replaceable"><code>integer</code></em> ] { ( <em class="replaceable"><code>quoted_string</code></em> [ port<br>
 	    <em class="replaceable"><code>integer</code></em> ] [ dscp <em class="replaceable"><code>integer</code></em> ] | <em class="replaceable"><code>ipv4_address</code></em> [ port<br>
 	    <em class="replaceable"><code>integer</code></em> ] [ dscp <em class="replaceable"><code>integer</code></em> ] | <em class="replaceable"><code>ipv6_address</code></em> [ port<br>
@@ -681,7 +680,7 @@ view
 	preferred-glue <em class="replaceable"><code>string</code></em>;<br>
 	prefetch <em class="replaceable"><code>integer</code></em> [ <em class="replaceable"><code>integer</code></em> ];<br>
 	provide-ixfr <em class="replaceable"><code>boolean</code></em>;<br>
-	qname-minimization ( strict | relaxed | disabled );<br>
+	qname-minimization ( strict | relaxed | disabled | off );<br>
 	query-source ( ( [ address ] ( <em class="replaceable"><code>ipv4_address</code></em> | * ) [ port (<br>
 	    <em class="replaceable"><code>integer</code></em> | * ) ] ) | ( [ [ address ] ( <em class="replaceable"><code>ipv4_address</code></em> | * ) ]<br>
 	    port ( <em class="replaceable"><code>integer</code></em> | * ) ) ) [ dscp <em class="replaceable"><code>integer</code></em> ];<br>
@@ -727,7 +726,7 @@ view
 	    nsip-enable <em class="replaceable"><code>boolean</code></em> ] [ nsdname-enable <em class="replaceable"><code>boolean</code></em> ] [<br>
 	    dnsrps-enable <em class="replaceable"><code>boolean</code></em> ] [ dnsrps-options { <em class="replaceable"><code>unspecified-text</code></em><br>
 	    } ];<br>
-	root-delegation-only [ exclude { <em class="replaceable"><code>quoted_string</code></em>; ... } ];<br>
+	root-delegation-only [ exclude { <em class="replaceable"><code>string</code></em>; ... } ];<br>
 	root-key-sentinel <em class="replaceable"><code>boolean</code></em>;<br>
 	rrset-order { [ class <em class="replaceable"><code>string</code></em> ] [ type <em class="replaceable"><code>string</code></em> ] [ name<br>
 	    <em class="replaceable"><code>quoted_string</code></em> ] <em class="replaceable"><code>string</code></em> <em class="replaceable"><code>string</code></em>; ... };<br>
@@ -789,6 +788,7 @@ view
 	update-check-ksk <em class="replaceable"><code>boolean</code></em>;<br>
 	use-alt-transfer-source <em class="replaceable"><code>boolean</code></em>;<br>
 	v6-bias <em class="replaceable"><code>integer</code></em>;<br>
+	validate-except { <em class="replaceable"><code>string</code></em>; ... };<br>
 	zero-no-soa-ttl <em class="replaceable"><code>boolean</code></em>;<br>
 	zero-no-soa-ttl-cache <em class="replaceable"><code>boolean</code></em>;<br>
 	zone <em class="replaceable"><code>string</code></em> [ <em class="replaceable"><code>class</code></em> ] {<br>
@@ -870,7 +870,7 @@ view
 		serial-update-method ( date | increment | unixtime );<br>
 		server-addresses { ( <em class="replaceable"><code>ipv4_address</code></em> | <em class="replaceable"><code>ipv6_address</code></em> ) [<br>
 		    port <em class="replaceable"><code>integer</code></em> ]; ... };<br>
-		server-names { <em class="replaceable"><code>quoted_string</code></em>; ... };<br>
+		server-names { <em class="replaceable"><code>string</code></em>; ... };<br>
 		sig-signing-nodes <em class="replaceable"><code>integer</code></em>;<br>
 		sig-signing-signatures <em class="replaceable"><code>integer</code></em>;<br>
 		sig-signing-type <em class="replaceable"><code>integer</code></em>;<br>
@@ -975,7 +975,7 @@ zone
 	serial-update-method ( date | increment | unixtime );<br>
 	server-addresses { ( <em class="replaceable"><code>ipv4_address</code></em> | <em class="replaceable"><code>ipv6_address</code></em> ) [ port<br>
 	    <em class="replaceable"><code>integer</code></em> ]; ... };<br>
-	server-names { <em class="replaceable"><code>quoted_string</code></em>; ... };<br>
+	server-names { <em class="replaceable"><code>string</code></em>; ... };<br>
 	sig-signing-nodes <em class="replaceable"><code>integer</code></em>;<br>
 	sig-signing-signatures <em class="replaceable"><code>integer</code></em>;<br>
 	sig-signing-type <em class="replaceable"><code>integer</code></em>;<br>

bin/named/server.c

@@ -938,7 +938,8 @@ configure_view_dnsseckeys(dns_view_t *view, const cfg_obj_t *vconfig,
 
 	/* We don't need trust anchors for the _bind view */
 	if (strcmp(view->name, "_bind") == 0 &&
-	    view->rdclass == dns_rdataclass_chaos) {
+	    view->rdclass == dns_rdataclass_chaos)
+	{
 		return (ISC_R_SUCCESS);
 	}
 
@@ -3411,11 +3412,14 @@ configure_dnstap(const cfg_obj_t **maps, dns_view_t *view) {
 			dt |= DNS_DTTYPE_RQ|DNS_DTTYPE_RR;
 		} else if (strcasecmp(str, "forwarder") == 0) {
 			dt |= DNS_DTTYPE_FQ|DNS_DTTYPE_FR;
+		} else if (strcasecmp(str, "update") == 0) {
+			dt |= DNS_DTTYPE_UQ|DNS_DTTYPE_UR;
 		} else if (strcasecmp(str, "all") == 0) {
 			dt |= DNS_DTTYPE_CQ|DNS_DTTYPE_CR|
 			      DNS_DTTYPE_AQ|DNS_DTTYPE_AR|
 			      DNS_DTTYPE_RQ|DNS_DTTYPE_RR|
-			      DNS_DTTYPE_FQ|DNS_DTTYPE_FR;
+			      DNS_DTTYPE_FQ|DNS_DTTYPE_FR|
+			      DNS_DTTYPE_UQ|DNS_DTTYPE_UR;
 		}
 
 		obj2 = cfg_tuple_get(obj, "mode");
@@ -4063,14 +4067,38 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
 	view->acceptexpired = cfg_obj_asboolean(obj);
 
 	obj = NULL;
-	result = named_config_get(maps, "dnssec-validation", &obj);
+	result = named_config_get(maps, "dnssec-enable", &obj);
 	INSIST(result == ISC_R_SUCCESS);
-	if (cfg_obj_isboolean(obj)) {
+	view->enablednssec = cfg_obj_asboolean(obj);
-		view->enablevalidation = cfg_obj_asboolean(obj);
+
-	} else {
+	obj = NULL;
-		/* If dnssec-validation is not boolean, it must be "auto" */
+	/* 'optionmaps', not 'maps': don't check named_g_defaults yet */
-		view->enablevalidation = true;
+	(void)named_config_get(optionmaps, "dnssec-validation", &obj);
-		auto_root = true;
+	if (obj == NULL) {
+		/*
+		 * If dnssec-enable is yes, then we default to
+		 * VALIDATION_DEFAULT as set in config.c. Otherwise
+		 * we default to "no".
+		 */
+		if (view->enablednssec) {
+			(void)cfg_map_get(named_g_defaults,
+					  "dnssec-validation", &obj);
+			INSIST(obj != NULL);
+		} else {
+			view->enablevalidation = false;
+		}
+	}
+	if (obj != NULL) {
+		if (cfg_obj_isboolean(obj)) {
+			view->enablevalidation = cfg_obj_asboolean(obj);
+		} else {
+			/*
+			 * If dnssec-validation is set but not boolean,
+			 * then it must be "auto"
+			 */
+			view->enablevalidation = true;
+			auto_root = true;
+		}
 	}
 
 	obj = NULL;
@@ -4707,14 +4735,12 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
 	INSIST(result == ISC_R_SUCCESS);
 	view->root_key_sentinel = cfg_obj_asboolean(obj);
 
-	CHECK(configure_view_acl(vconfig, config, named_g_config,
-				 "allow-query-cache-on", NULL, actx,
-				 named_g_mctx, &view->cacheonacl));
 	/*
 	 * Set the "allow-query", "allow-query-cache", "allow-recursion",
-	 * and "allow-recursion-on" ACLs if configured in named.conf, but
+	 * "allow-recursion-on" and "allow-query-cache-on" ACLs if
-	 * NOT from the global defaults. This is done by leaving the third
+	 * configured in named.conf, but NOT from the global defaults.
-	 * argument to configure_view_acl() NULL.
+	 * This is done by leaving the third argument to configure_view_acl()
+	 * NULL.
 	 *
 	 * We ignore the global defaults here because these ACLs
 	 * can inherit from each other.  If any are still unset after
@@ -4731,6 +4757,10 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
 	CHECK(configure_view_acl(vconfig, config, NULL,
 				 "allow-query-cache", NULL, actx,
 				 named_g_mctx, &view->cacheacl));
+	/* named.conf only */
+	CHECK(configure_view_acl(vconfig, config, NULL,
+				 "allow-query-cache-on", NULL, actx,
+				 named_g_mctx, &view->cacheonacl));
 
 	if (strcmp(view->name, "_bind") != 0 &&
 	    view->rdclass != dns_rdataclass_chaos)
@@ -4749,8 +4779,6 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
 		/*
 		 * "allow-query-cache" inherits from "allow-recursion" if set,
 		 * otherwise from "allow-query" if set.
-		 * "allow-recursion" inherits from "allow-query-cache" if set,
-		 * otherwise from "allow-query" if set.
 		 */
 		if (view->cacheacl == NULL) {
 			if (view->recursionacl != NULL) {
@@ -4761,6 +4789,11 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
 					       &view->cacheacl);
 			}
 		}
+
+		/*
+		 * "allow-recursion" inherits from "allow-query-cache" if set,
+		 * otherwise from "allow-query" if set.
+		 */
 		if (view->recursionacl == NULL) {
 			if (view->cacheacl != NULL) {
 				dns_acl_attach(view->cacheacl,
@@ -4772,10 +4805,32 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
 		}
 
 		/*
-		 * If any are still unset, we now get default "allow-recursion",
+		 * "allow-query-cache-on" inherits from "allow-recursion-on"
-		 * "allow-recursion-on" and "allow-query-cache" ACLs from
+		 * if set.
-		 * the global config.
 		 */
+		if (view->cacheonacl == NULL) {
+			if (view->recursiononacl != NULL) {
+				dns_acl_attach(view->recursiononacl,
+					       &view->cacheonacl);
+			}
+		}
+
+		/*
+		 * "allow-recursion-on" inherits from "allow-query-cache-on"
+		 * if set.
+		 */
+		if (view->recursiononacl == NULL) {
+			if (view->cacheonacl != NULL) {
+				dns_acl_attach(view->cacheonacl,
+					       &view->recursiononacl);
+			}
+		}
+
+		/*
+		 * If any are still unset at this point, we now get default
+		 * values for from the global config.
+		 */
+
 		if (view->recursionacl == NULL) {
 			/* global default only */
 			CHECK(configure_view_acl(NULL, NULL, named_g_config,
@@ -4797,14 +4852,30 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
 						 actx, named_g_mctx,
 						 &view->cacheacl));
 		}
-	} else if (view->cacheacl == NULL) {
+		if (view->cacheonacl == NULL) {
+			/* global default only */
+			CHECK(configure_view_acl(NULL, NULL, named_g_config,
+						 "allow-query-cache-on", NULL,
+						 actx, named_g_mctx,
+						 &view->cacheonacl));
+		}
+	} else {
 		/*
-		 * We're not recursive; if "allow-query-cache" hasn't been
+		 * We're not recursive; if the query-cache ACLs haven't
-		 * set at the options/view level, set it to none.
+		 * been set at the options/view level, set them to none.
 		 */
-		CHECK(dns_acl_none(mctx, &view->cacheacl));
+		if (view->cacheacl == NULL) {
+			CHECK(dns_acl_none(mctx, &view->cacheacl));
+		}
+		if (view->cacheonacl == NULL) {
+			CHECK(dns_acl_none(mctx, &view->cacheonacl));
+		}
 	}
 
+	/*
+	 * Finished setting recursion and query-cache ACLs, so now we
+	 * can get the allow-query default if it wasn't set in named.conf
+	 */
 	if (view->queryacl == NULL) {
 		/* global default only */
 		CHECK(configure_view_acl(NULL, NULL, named_g_config,
@@ -5043,11 +5114,6 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
 			view->prefetch_eligible = view->prefetch_trigger + 6;
 	}
 
-	obj = NULL;
-	result = named_config_get(maps, "dnssec-enable", &obj);
-	INSIST(result == ISC_R_SUCCESS);
-	view->enablednssec = cfg_obj_asboolean(obj);
-
 	obj = NULL;
 	result = named_config_get(optionmaps, "dnssec-lookaside", &obj);
 	if (result == ISC_R_SUCCESS) {
@@ -6698,8 +6764,8 @@ dotat(dns_keytable_t *keytable, dns_keynode_t *keynode, void *arg) {
 	 */
 	domain = dns_fixedname_initname(&fdomain);
 	dns_rdataset_init(&nameservers);
-	result = dns_view_findzonecut(view, origin, domain, 0, 0, true,
+	result = dns_view_findzonecut(view, origin, domain, NULL, 0, 0,
-				      true, &nameservers, NULL);
+				      true, true, &nameservers, NULL);
 	if (result == ISC_R_SUCCESS) {
 		result = dns_resolver_createfetch(view->resolver, tatname,
 						  dns_rdatatype_null, domain,
@@ -8054,7 +8120,7 @@ load_configuration(const char *filename, named_server_t *server,
 			      "less than 128 UDP sockets available after "
 			      "applying 'reserved-sockets' and 'maxsockets'");
 	}
-	isc__socketmgr_setreserved(named_g_socketmgr, reserved);
+	isc_socketmgr_setreserved(named_g_socketmgr, reserved);
 
 #ifdef HAVE_GEOIP
 	/*
@@ -9177,8 +9243,17 @@ view_loaded(void *arg) {
 			   "forcing zone maintenance");
 
 		named_os_started();
+
+#ifdef HAVE_FIPS_MODE
 		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-			      NAMED_LOGMODULE_SERVER, ISC_LOG_NOTICE, "running");
+			      NAMED_LOGMODULE_SERVER, ISC_LOG_NOTICE,
+			      "FIPS mode is %s",
+			      FIPS_mode() ? "enabled" : "disabled");
+#endif
+
+		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+			      NAMED_LOGMODULE_SERVER, ISC_LOG_NOTICE,
+			      "running");
 	}
 
 	return (ISC_R_SUCCESS);
@@ -9244,8 +9319,7 @@ load_zones(named_server_t *server, bool init, bool reconfig) {
 		 * the initial server setup; it isn't necessary during
 		 * a reload.)
 		 */
-		isc_taskmgr_setmode(named_g_taskmgr,
+		isc_taskmgr_setprivilegedmode(named_g_taskmgr);
-				    isc_taskmgrmode_privileged);
 	}
 
 	isc_task_endexclusive(server->task);
@@ -14231,6 +14305,7 @@ named_server_nta(named_server_t *server, isc_lex_t *lex,
 	dns_name_t *fname;
 	dns_ttl_t ntattl;
 	bool ttlset = false, excl = false;
+	dns_rdataclass_t rdclass = dns_rdataclass_in;
 
 	UNUSED(force);
 
@@ -14238,18 +14313,20 @@ named_server_nta(named_server_t *server, isc_lex_t *lex,
 
 	/* Skip the command name. */
 	ptr = next_token(lex, text);
-	if (ptr == NULL)
+	if (ptr == NULL) {
 		return (ISC_R_UNEXPECTEDEND);
+	}
 
 	for (;;) {
 		/* Check for options */
 		ptr = next_token(lex, text);
-		if (ptr == NULL)
+		if (ptr == NULL) {
 			return (ISC_R_UNEXPECTEDEND);
+		}
 
-		if (argcheck(ptr, "dump"))
+		if (argcheck(ptr, "dump")) {
 			dump = true;
-		else if (argcheck(ptr, "remove")) {
+		} else if (argcheck(ptr, "remove")) {
 			ntattl = 0;
 			ttlset = true;
 		} else if (argcheck(ptr, "force")) {
@@ -14279,8 +14356,22 @@ named_server_nta(named_server_t *server, isc_lex_t *lex,
 
 			ttlset = true;
 			continue;
-		} else
+		} else if (argcheck(ptr, "class")) {
+			isc_textregion_t tr;
+
+			ptr = next_token(lex, text);
+			if (ptr == NULL) {
+				msg = "No class specified";
+				CHECK(ISC_R_UNEXPECTEDEND);
+			}
+
+			tr.base = ptr;
+			tr.length = strlen(ptr);
+			CHECK(dns_rdataclass_fromtext(&rdclass, &tr));
+			continue;
+		} else {
 			nametext = ptr;
+		}
 
 		break;
 	}
@@ -14293,11 +14384,13 @@ named_server_nta(named_server_t *server, isc_lex_t *lex,
 		     view != NULL;
 		     view = ISC_LIST_NEXT(view, link))
 		{
-			if (ntatable != NULL)
+			if (ntatable != NULL) {
 				dns_ntatable_detach(&ntatable);
+			}
 			result = dns_view_getntatable(view, &ntatable);
-			if (result == ISC_R_NOTFOUND)
+			if (result == ISC_R_NOTFOUND) {
 				continue;
+			}
 			CHECK(dns_ntatable_totext(ntatable, text));
 		}
 		CHECK(putnull(text));
@@ -14314,17 +14407,19 @@ named_server_nta(named_server_t *server, isc_lex_t *lex,
 	}
 
 	/* Get the NTA name. */
-	if (nametext == NULL)
+	if (nametext == NULL) {
 		nametext = next_token(lex, text);
-	if (nametext == NULL)
+	}
+	if (nametext == NULL) {
 		return (ISC_R_UNEXPECTEDEND);
+	}
 
 	/* Copy nametext as it'll be overwritten by next_token() */
 	strlcpy(namebuf, nametext, DNS_NAME_FORMATSIZE);
 
-	if (strcmp(namebuf, ".") == 0)
+	if (strcmp(namebuf, ".") == 0) {
 		ntaname = dns_rootname;
-	else {
+	} else {
 		isc_buffer_t b;
 		isc_buffer_init(&b, namebuf, strlen(namebuf));
 		isc_buffer_add(&b, strlen(namebuf));
@@ -14344,18 +14439,27 @@ named_server_nta(named_server_t *server, isc_lex_t *lex,
 	     view != NULL;
 	     view = ISC_LIST_NEXT(view, link))
 	{
-		if (viewname != NULL &&
+		static bool first = true;
-		    strcmp(view->name, viewname) != 0)
-			continue;
 
-		if (view->nta_lifetime == 0)
+		if (viewname != NULL && strcmp(view->name, viewname) != 0) {
 			continue;
+		}
 
-		if (!ttlset)
+		if (view->rdclass != rdclass && rdclass != dns_rdataclass_any) {
+			continue;
+		}
+
+		if (view->nta_lifetime == 0) {
+			continue;
+		}
+
+		if (!ttlset) {
 			ntattl = view->nta_lifetime;
+		}
 
-		if (ntatable != NULL)
+		if (ntatable != NULL) {
 			dns_ntatable_detach(&ntatable);
+		}
 
 		result = dns_view_getntatable(view, &ntatable);
 		if (result == ISC_R_NOTFOUND) {
@@ -14378,6 +14482,11 @@ named_server_nta(named_server_t *server, isc_lex_t *lex,
 			isc_time_set(&t, when, 0);
 			isc_time_formattimestamp(&t, tbuf, sizeof(tbuf));
 
+			if (!first) {
+				CHECK(putstr(text, "\n"));
+			}
+			first = false;
+
 			CHECK(putstr(text, "Negative trust anchor added: "));
 			CHECK(putstr(text, namebuf));
 			CHECK(putstr(text, "/"));
@@ -14392,6 +14501,11 @@ named_server_nta(named_server_t *server, isc_lex_t *lex,
 		} else {
 			CHECK(dns_ntatable_delete(ntatable, ntaname));
 
+			if (!first) {
+				CHECK(putstr(text, "\n"));
+			}
+			first = false;
+
 			CHECK(putstr(text, "Negative trust anchor removed: "));
 			CHECK(putstr(text, namebuf));
 			CHECK(putstr(text, "/"));
@@ -14411,20 +14525,21 @@ named_server_nta(named_server_t *server, isc_lex_t *lex,
 				      "for view '%s': %s",
 				      view->name, isc_result_totext(result));
 		}
-
-		CHECK(putnull(text));
-
 	}
 
+	CHECK(putnull(text));
+
  cleanup:
 	if (msg != NULL) {
 		(void) putstr(text, msg);
 		(void) putnull(text);
 	}
-	if (excl)
+	if (excl) {
 		isc_task_endexclusive(server->task);
-	if (ntatable != NULL)
+	}
+	if (ntatable != NULL) {
 		dns_ntatable_detach(&ntatable);
+	}
 	return (result);
 }
 

bin/named/unix/os.c

@@ -59,54 +59,6 @@ static int singletonfd = -1;
 #define ISC_FACILITY LOG_DAEMON
 #endif
 
-/*
- * If there's no <sys/capability.h>, we don't care about <sys/prctl.h>
- */
-#ifndef HAVE_SYS_CAPABILITY_H
-#undef HAVE_SYS_PRCTL_H
-#endif
-
-/*
- * Linux defines:
- *	(T) HAVE_LINUXTHREADS
- *	(C) HAVE_SYS_CAPABILITY_H
- *	(P) HAVE_SYS_PRCTL_H
- * The possible cases are:
- *	none:	setuid() normally
- *	T:	no setuid()
- *	C:	setuid() normally, drop caps (keep CAP_SETUID)
- *	T+C:	no setuid(), drop caps (don't keep CAP_SETUID)
- *	T+C+P:	setuid() early, drop caps (keep CAP_SETUID)
- *	C+P:	setuid() normally, drop caps (keep CAP_SETUID)
- *	P:	not possible
- *	T+P:	not possible
- *
- * if (C)
- *	caps = BIND_SERVICE + CHROOT + SETGID
- *	if ((T && C && P) || !T)
- *		caps += SETUID
- *	endif
- *	capset(caps)
- * endif
- * if (T && C && P && -u)
- *	setuid()
- * else if (T && -u)
- *	fail
- * --> start threads
- * if (!T && -u)
- *	setuid()
- * if (C && (P || !-u))
- *	caps = BIND_SERVICE
- *	capset(caps)
- * endif
- *
- * It will be nice when Linux threads work properly with setuid().
- */
-
-#ifdef HAVE_LINUXTHREADS
-static pid_t mainpid = 0;
-#endif
-
 static struct passwd *runas_pw = NULL;
 static bool done_setuid = false;
 static int dfd[2] = { -1, -1 };
@@ -117,10 +69,7 @@ static bool non_root = false;
 static bool non_root_caps = false;
 
 #include <sys/capability.h>
-
+#include <sys/prctl.h>
-#ifdef HAVE_SYS_PRCTL_H
-#include <sys/prctl.h>		/* Required for prctl(). */
-#endif /* HAVE_SYS_PRCTL_H */
 
 static void
 linux_setcaps(cap_t caps) {
@@ -201,15 +150,11 @@ linux_initialprivs(void) {
 	 */
 	SET_CAP(CAP_SYS_CHROOT);
 
-#if defined(HAVE_SYS_PRCTL_H) || !defined(HAVE_LINUXTHREADS)
 	/*
-	 * We can setuid() only if either the kernel supports keeping
+	 * We need setuid() as the kernel supports keeping capabilities after
-	 * capabilities after setuid() (which we don't know until we've
+	 * setuid().
-	 * tried) or we're not using threads.  If either of these is
-	 * true, we want the setuid capability.
 	 */
 	SET_CAP(CAP_SETUID);
-#endif
 
 	/*
 	 * Since we call initgroups, we need this.
@@ -275,7 +220,6 @@ linux_minprivs(void) {
 	FREE_CAP;
 }
 
-#ifdef HAVE_SYS_PRCTL_H
 static void
 linux_keepcaps(void) {
 	char strbuf[ISC_STRERRORSIZE];
@@ -295,11 +239,9 @@ linux_keepcaps(void) {
 			non_root = true;
 	}
 }
-#endif
 
 #endif	/* HAVE_SYS_CAPABILITY_H */
 
-
 static void
 setup_syslog(const char *progname) {
 	int options;
@@ -317,9 +259,6 @@ named_os_init(const char *progname) {
 #ifdef HAVE_SYS_CAPABILITY_H
 	linux_initialprivs();
 #endif
-#ifdef HAVE_LINUXTHREADS
-	mainpid = getpid();
-#endif
 #ifdef SIGXFSZ
 	signal(SIGXFSZ, SIG_IGN);
 #endif
@@ -362,10 +301,6 @@ named_os_daemonize(void) {
 	 * We're the child.
 	 */
 
-#ifdef HAVE_LINUXTHREADS
-	mainpid = getpid();
-#endif
-
 	if (setsid() == -1) {
 		strerror_r(errno, strbuf, sizeof(strbuf));
 		named_main_earlyfatal("setsid(): %s", strbuf);
@@ -499,20 +434,6 @@ named_os_changeuser(void) {
 
 	done_setuid = true;
 
-#ifdef HAVE_LINUXTHREADS
-#ifdef HAVE_SYS_CAPABILITY_H
-	if (!non_root_caps) {
-		named_main_earlyfatal("-u with Linux threads not supported: "
-				      "requires kernel support for "
-				      "prctl(PR_SET_KEEPCAPS)");
-	}
-#else
-	named_main_earlyfatal("-u with Linux threads not supported: "
-			      "no capabilities support or capabilities "
-			      "disabled at build time");
-#endif
-#endif
-
 	if (setgid(runas_pw->pw_gid) < 0) {
 		strerror_r(errno, strbuf, sizeof(strbuf));
 		named_main_earlyfatal("setgid(): %s", strbuf);
@@ -523,7 +444,7 @@ named_os_changeuser(void) {
 		named_main_earlyfatal("setuid(): %s", strbuf);
 	}
 
-#if defined(HAVE_SYS_PRCTL_H) && defined(PR_SET_DUMPABLE)
+#if defined(HAVE_SYS_CAPABILITY_H)
 	/*
 	 * Restore the ability of named to drop core after the setuid()
 	 * call has disabled it.
@@ -533,8 +454,7 @@ named_os_changeuser(void) {
 		named_main_earlywarning("prctl(PR_SET_DUMPABLE) failed: %s",
 					strbuf);
 	}
-#endif
+
-#if defined(HAVE_SYS_CAPABILITY_H) && !defined(HAVE_LINUXTHREADS)
 	linux_minprivs();
 #endif
 }
@@ -548,7 +468,7 @@ ns_os_uid(void) {
 
 void
 named_os_adjustnofile(void) {
-#ifdef HAVE_LINUXTHREADS
+#if defined(__linux__)
 	isc_result_t result;
 	isc_resourcevalue_t newvalue;
 
@@ -566,15 +486,9 @@ named_os_adjustnofile(void) {
 
 void
 named_os_minprivs(void) {
-#ifdef HAVE_SYS_PRCTL_H
+#if defined(HAVE_SYS_CAPABILITY_H)
 	linux_keepcaps();
-#endif
+	named_os_changeuser();
-
-#ifdef HAVE_LINUXTHREADS
-	named_os_changeuser(); /* Call setuid() before threads are started */
-#endif
-
-#if defined(HAVE_SYS_CAPABILITY_H) && defined(HAVE_LINUXTHREADS)
 	linux_minprivs();
 #endif
 }
@@ -759,21 +673,16 @@ named_os_openfile(const char *filename, mode_t mode, bool switch_user) {
 	free(f);
 
 	if (switch_user && runas_pw != NULL) {
-#ifndef HAVE_LINUXTHREADS
 		gid_t oldgid = getgid();
-#endif
 		/* Set UID/GID to the one we'll be running with eventually */
 		setperms(runas_pw->pw_uid, runas_pw->pw_gid);
 
 		fd = safe_open(filename, mode, false);
 
-#ifndef HAVE_LINUXTHREADS
 		/* Restore UID/GID to root */
 		setperms(0, oldgid);
-#endif /* HAVE_LINUXTHREADS */
 
 		if (fd == -1) {
-#ifndef HAVE_LINUXTHREADS
 			fd = safe_open(filename, mode, false);
 			if (fd != -1) {
 				named_main_earlywarning("Required root "
@@ -786,13 +695,6 @@ named_os_openfile(const char *filename, mode_t mode, bool switch_user) {
 			named_main_earlywarning("Please check file and "
 						"directory permissions "
 						"or reconfigure the filename.");
-#else /* HAVE_LINUXTHREADS */
-			named_main_earlywarning("Could not open "
-						"'%s'.", filename);
-			named_main_earlywarning("Please check file and "
-						"directory permissions "
-						"or reconfigure the filename.");
-#endif /* HAVE_LINUXTHREADS */
 		}
 	} else {
 		fd = safe_open(filename, mode, false);
@@ -846,11 +748,7 @@ named_os_writepidfile(const char *filename, bool first_time) {
 		cleanup_pidfile();
 		return;
 	}
-#ifdef HAVE_LINUXTHREADS
-	pid = mainpid;
-#else
 	pid = getpid();
-#endif
 	if (fprintf(fh, "%ld\n", (long)pid) < 0) {
 		(*report)("fprintf() to pid file '%s' failed", filename);
 		(void)fclose(fh);
@@ -956,11 +854,7 @@ named_os_shutdownmsg(char *command, isc_buffer_t *text) {
 		return;
 	}
 
-#ifdef HAVE_LINUXTHREADS
-	pid = mainpid;
-#else
 	pid = getpid();
-#endif
 
 	(void)isc_buffer_printf(text, "pid: %ld", (long)pid);
 }

bin/named/zoneconf.c

@@ -224,7 +224,7 @@ configure_zone_ssutable(const cfg_obj_t *zconfig, dns_zone_t *zone,
 		const char *str;
 		bool grant = false;
 		bool usezone = false;
-		unsigned int mtype = dns_ssumatchtype_name;
+		dns_ssumatchtype_t mtype = dns_ssumatchtype_name;
 		dns_fixedname_t fname, fident;
 		isc_buffer_t b;
 		dns_rdatatype_t *types;

bin/python/dnssec-keymgr.docbook

@@ -299,8 +299,7 @@
 	    Takes two arguments: keytype (eihter "zsk" or "ksk") and size.
 	    A default value for this option can be set in algorithm policies
 	    as well as in policy classes or zone policies. If no policy is
-	    configured, the default is 1024 bits for DSA keys and 2048 for
+	    configured, the default is 2048 bits for RSA keys.
-	    RSA.
 	  </para>
 	</listitem>
       </varlistentry>

bin/python/isc/dnskey.py.in

@@ -32,7 +32,7 @@ class dnskey:
 
     _ALGNAMES = (None, 'RSAMD5', 'DH', 'DSA', 'ECC', 'RSASHA1',
                  'NSEC3DSA', 'NSEC3RSASHA1', 'RSASHA256', None,
-                 'RSASHA512', None, None, 'ECDSAP256SHA256',
+                 'RSASHA512', None, 'ECCGOST', 'ECDSAP256SHA256',
                  'ECDSAP384SHA384', 'ED25519', 'ED448')
 
     def __init__(self, key, directory=None, keyttl=None):

bin/python/isc/policy.py.in

@@ -71,7 +71,7 @@ class PolicyLex:
         return t
 
     def t_ALGNAME(self, t):
-        r'(?i)\b(RSAMD5|DH|DSA|NSEC3DSA|ECC|RSASHA1|NSEC3RSASHA1|RSASHA256|RSASHA512|ECDSAP256SHA256|ECDSAP384SHA384|ED25519|ED448)\b'
+        r'(?i)\b(RSAMD5|DH|ECC|RSASHA1|NSEC3RSASHA1|RSASHA256|RSASHA512|ECDSAP256SHA256|ECDSAP384SHA384|ED25519|ED448)\b'
         t.value = t.value.upper()
         return t
 
@@ -132,9 +132,7 @@ class Policy:
     keyttl = None
     coverage = None
     directory = None
-    valid_key_sz_per_algo = {'DSA': [512, 1024],
+    valid_key_sz_per_algo = {'RSAMD5': [1024, 4096],
-                             'NSEC3DSA': [512, 1024],
-                             'RSAMD5': [1024, 4096],
                              'RSASHA1': [1024, 4096],
                              'NSEC3RSASHA1': [512, 4096],
                              'RSASHA256': [1024, 4096],
@@ -264,19 +262,6 @@ class Policy:
                     return False, 'ZSK key size %d outside valid range %s' \
                             % (self.zsk_keysize, key_sz_range)
 
-            # Specific check for DSA keys
-            if self.algorithm in ['DSA', 'NSEC3DSA'] and \
-               self.ksk_keysize % 64 != 0:
-                return False, \
-                        ('KSK key size %d not divisible by 64 ' +
-                         'as required for DSA') % self.ksk_keysize
-
-            if self.algorithm in ['DSA', 'NSEC3DSA'] and \
-               self.zsk_keysize % 64 != 0:
-                return False, \
-                        ('ZSK key size %d not divisible by 64 ' +
-                         'as required for DSA') % self.zsk_keysize
-
             if self.algorithm in ['ECDSAP256SHA256', \
                                   'ECDSAP384SHA384', \
                                   'ED25519', \
@@ -335,16 +320,6 @@ class dnssec_policy:
         p.zsk_keysize = 2048;
 
         # set default algorithm policies
-        # these need a lower default key size:
-        self.alg_policy['DSA'] = copy(p)
-        self.alg_policy['DSA'].algorithm = "DSA"
-        self.alg_policy['DSA'].name = "DSA"
-        self.alg_policy['DSA'].ksk_keysize = 1024;
-
-        self.alg_policy['NSEC3DSA'] = copy(p)
-        self.alg_policy['NSEC3DSA'].algorithm = "NSEC3DSA"
-        self.alg_policy['NSEC3DSA'].name = "NSEC3DSA"
-        self.alg_policy['NSEC3DSA'].ksk_keysize = 1024;
 
         # these can use default settings
         self.alg_policy['RSAMD5'] = copy(p)

bin/python/isc/tests/policy_test.py.in

@@ -25,15 +25,6 @@ class PolicyTest(unittest.TestCase):
         self.assertEqual(p.constructed(), False)
         self.assertEqual(p.validate(), (True, ""))
 
-        p = pol.policy('good_dsa.test', novalidate=True)
-        self.assertEqual(p.get_name(), "good_dsa.test")
-        self.assertEqual(p.constructed(), False)
-        self.assertEqual(p.validate(), (True, ""))
-
-        p = pol.policy('bad_dsa.test', novalidate=True)
-        self.assertEqual(p.validate(),
-                         (False, 'ZSK key size 769 not divisible by 64 as required for DSA'))
-
     def test_prepublish(self):
         pol = policy.dnssec_policy()
         pol.load('test-policies/02-prepublish.pol')

bin/rndc/rndc.docbook

@@ -575,7 +575,7 @@
 
       <varlistentry>
 	<term><userinput>nta
-	<optional>( -d | -f | -r | -l <replaceable>duration</replaceable>)</optional>
+	    <optional>( -class <replaceable>class</replaceable> | -dump | -force | -remove | -lifetime <replaceable>duration</replaceable>)</optional>
 	<replaceable>domain</replaceable>
 	<optional><replaceable>view</replaceable></optional>
 	</userinput></term>
@@ -623,7 +623,7 @@
 	    is equivalent to <option>-remove</option>.
 	  </para>
 	  <para>
-	    If <option>-dump</option> is used, any other arguments
+	    If the <option>-dump</option> is used, any other arguments
 	    are ignored, and a list of existing NTAs is printed
 	    (note that this may include NTAs that are expired but
 	    have not yet been cleaned up).
@@ -640,10 +640,15 @@
 	    lifetime, regardless of whether data could be
 	    validated if the NTA were not present.
 	  </para>
+	  <para>
+	    The view class can be specified with <option>-class</option>.
+	    The default is class <userinput>IN</userinput>, which is
+	    the only class for which DNSSEC is currently supported.
+	  </para>
 	  <para>
 	    All of these options can be shortened, i.e., to
 	    <option>-l</option>, <option>-r</option>, <option>-d</option>,
-	    and <option>-f</option>.
+	    <option>-f</option>, and <option>-c</option>.
 	  </para>
 	</listitem>
       </varlistentry>
@@ -1065,11 +1070,14 @@
 	<listitem>
 	  <para>
 	    Enable, disable, or check the current status of
-	    DNSSEC validation.
+	    DNSSEC validation.  By default, validation is enabled.
-	    Note <command>dnssec-enable</command> also needs to be
+	    (Note that <command>dnssec-enable</command> must also be
-	    set to <userinput>yes</userinput> or
+	    <userinput>yes</userinput> (the default value) for signatures
-	    <userinput>auto</userinput> to be effective.
+	    to be returned along with validated data. If validation is
-	    It defaults to enabled.
+	    enabled while <command>dnssec-enable</command> is set to
+	    <userinput>no</userinput>, the server will validate internally,
+	    but will not supply clients with the necessary records to allow
+	    validity to be confirmed.)
 	  </para>
 	</listitem>
       </varlistentry>

bin/tests/optional/db_test.c

@@ -771,7 +771,7 @@ main(int argc, char *argv[]) {
 			if (noexact_zonecut)
 				zcoptions |= DNS_DBFIND_NOEXACT;
 			result = dns_db_findzonecut(db, &name, zcoptions,
-						    0, &node, fname,
+						    0, &node, fname, NULL,
 						    &rdataset, &sigrdataset);
 		} else {
 			result = dns_db_find(db, &name, version, type,

bin/tests/optional/zone_test.c

@@ -12,6 +12,7 @@
 #include <config.h>
 
 #include <sys/param.h>
+#include <sys/select.h>
 #include <sys/types.h>
 #include <sys/time.h>
 
@@ -35,10 +36,6 @@
 #include <dns/result.h>
 #include <dns/zone.h>
 
-#ifdef ISC_PLATFORM_NEEDSYSSELECTH
-#include <sys/select.h>
-#endif
-
 static int debug = 0;
 static int quiet = 0;
 static int stats = 0;

bin/tests/system/allow-query/ns2/generic.db

@@ -22,3 +22,10 @@ ns2			A	10.53.0.2
 
 a			A	10.0.7.1
 mail			A	10.0.7.2
+b			A	10.0.7.3
+c			A	10.0.7.4
+d			A	10.0.7.5
+e			A	10.0.7.6
+f			A	10.0.7.7
+g			A	10.0.7.8
+h			A	10.0.7.9

bin/tests/system/allow-query/ns3/named1.conf.in

@@ -18,6 +18,15 @@ options {
 	dnssec-validation no;
 };
 
+key rndc_key {
+	secret "1234abcd8765";
+	algorithm hmac-sha256;
+};
+
+controls {
+	inet 10.53.0.3 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
+};
+
 zone "." {
 	type hint;
 	file "../../common/root.hint";

bin/tests/system/allow-query/ns3/named2.conf.in

@@ -0,0 +1,36 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+options {
+	port @PORT@;
+	pid-file "named.pid";
+	listen-on { 10.53.0.3; };
+	listen-on-v6 { none; };
+	recursion yes;
+	allow-recursion { any; };
+	allow-recursion-on { none; };
+	allow-query-cache-on { 10.53.0.3; };
+	dnssec-validation no;
+};
+
+key rndc_key {
+	secret "1234abcd8765";
+	algorithm hmac-sha256;
+};
+
+controls {
+	inet 10.53.0.3 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
+};
+
+zone "." {
+	type hint;
+	file "../../common/root.hint";
+};

bin/tests/system/allow-query/ns3/named3.conf.in

@@ -0,0 +1,36 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+options {
+	port @PORT@;
+	pid-file "named.pid";
+	listen-on { 10.53.0.3; 10.53.1.2; };
+	listen-on-v6 { none; };
+	recursion yes;
+	allow-recursion { any; };
+	allow-query-cache { any; };
+	allow-query-cache-on { 10.53.0.3; }; # allow-recursion-on inherits
+	dnssec-validation no;
+};
+
+key rndc_key {
+	secret "1234abcd8765";
+	algorithm hmac-sha256;
+};
+
+controls {
+	inet 10.53.0.3 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
+};
+
+zone "." {
+	type hint;
+	file "../../common/root.hint";
+};

bin/tests/system/allow-query/ns3/named4.conf.in

@@ -0,0 +1,36 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+options {
+	port @PORT@;
+	pid-file "named.pid";
+	listen-on { 10.53.0.3; 10.53.1.2; };
+	listen-on-v6 { none; };
+	recursion yes;
+	allow-recursion { any; };
+	allow-query-cache { any; };
+	allow-recursion-on { 10.53.0.3; }; # allow-query-cache-on inherits
+	dnssec-validation no;
+};
+
+key rndc_key {
+	secret "1234abcd8765";
+	algorithm hmac-sha256;
+};
+
+controls {
+	inet 10.53.0.3 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
+};
+
+zone "." {
+	type hint;
+	file "../../common/root.hint";
+};

bin/tests/system/allow-query/setup.sh

@@ -12,7 +12,9 @@
 SYSTEMTESTTOP=..
 . $SYSTEMTESTTOP/conf.sh
 
+$SHELL clean.sh
+
 copy_setports ../common/controls.conf.in ns2/controls.conf
 copy_setports  ns1/named.conf.in ns1/named.conf
 copy_setports  ns2/named01.conf.in ns2/named.conf
-copy_setports  ns3/named.conf.in ns3/named.conf
+copy_setports  ns3/named1.conf.in ns3/named.conf

bin/tests/system/allow-query/tests.sh

@@ -56,9 +56,9 @@ SYSTEMTESTTOP=..
 DIGOPTS="+tcp +nosea +nostat +nocmd +norec +noques +noauth +noadd +nostats +dnssec -p ${PORT}"
 
 rndc_reload() {
-    echo_i "`$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p ${CONTROLPORT} reload 2>&1 | sed 's/^/ns2 /'`"
+    echo_i "`$RNDC -c ../common/rndc.conf -s $2 -p ${CONTROLPORT} reload 2>&1 | sed 's/^/'$1' /'`"
     for try in 0 1 2 3 4 5 6 7 8 9; do
-        nextpart ns2/named.run | grep "reloading configuration succeeded" > /dev/null && break
+        nextpart $1/named.run | grep "reloading configuration succeeded" > /dev/null && break
         sleep 1
     done
 }
@@ -81,7 +81,7 @@ status=`expr $status + $ret`
 # Test 2 - explicit any, query allowed
 n=`expr $n + 1`
 copy_setports ns2/named02.conf.in ns2/named.conf
-rndc_reload
+rndc_reload ns2 10.53.0.2
 
 echo_i "test $n: explicit any - query allowed"
 ret=0
@@ -94,7 +94,7 @@ status=`expr $status + $ret`
 # Test 3 - none, query refused
 n=`expr $n + 1`
 copy_setports ns2/named03.conf.in ns2/named.conf
-rndc_reload
+rndc_reload ns2 10.53.0.2
 
 echo_i "test $n: none - query refused"
 ret=0
@@ -107,7 +107,7 @@ status=`expr $status + $ret`
 # Test 4 - address allowed, query allowed
 n=`expr $n + 1`
 copy_setports ns2/named04.conf.in ns2/named.conf
-rndc_reload
+rndc_reload ns2 10.53.0.2
 
 echo_i "test $n: address allowed - query allowed"
 ret=0
@@ -120,7 +120,7 @@ status=`expr $status + $ret`
 # Test 5 - address not allowed, query refused
 n=`expr $n + 1`
 copy_setports ns2/named05.conf.in ns2/named.conf
-rndc_reload
+rndc_reload ns2 10.53.0.2
 
 echo_i "test $n: address not allowed - query refused"
 ret=0
@@ -133,7 +133,7 @@ status=`expr $status + $ret`
 # Test 6 - address disallowed, query refused
 n=`expr $n + 1`
 copy_setports ns2/named06.conf.in ns2/named.conf
-rndc_reload
+rndc_reload ns2 10.53.0.2
 
 echo_i "test $n: address disallowed - query refused"
 ret=0
@@ -146,7 +146,7 @@ status=`expr $status + $ret`
 # Test 7 - acl allowed, query allowed
 n=`expr $n + 1`
 copy_setports ns2/named07.conf.in ns2/named.conf
-rndc_reload
+rndc_reload ns2 10.53.0.2
 
 echo_i "test $n: acl allowed - query allowed"
 ret=0
@@ -159,7 +159,7 @@ status=`expr $status + $ret`
 # Test 8 - acl not allowed, query refused
 n=`expr $n + 1`
 copy_setports ns2/named08.conf.in ns2/named.conf
-rndc_reload
+rndc_reload ns2 10.53.0.2
 
 echo_i "test $n: acl not allowed - query refused"
 ret=0
@@ -173,7 +173,7 @@ status=`expr $status + $ret`
 # Test 9 - acl disallowed, query refused
 n=`expr $n + 1`
 copy_setports ns2/named09.conf.in ns2/named.conf
-rndc_reload
+rndc_reload ns2 10.53.0.2
 
 echo_i "test $n: acl disallowed - query refused"
 ret=0
@@ -186,7 +186,7 @@ status=`expr $status + $ret`
 # Test 10 - key allowed, query allowed
 n=`expr $n + 1`
 copy_setports ns2/named10.conf.in ns2/named.conf
-rndc_reload
+rndc_reload ns2 10.53.0.2
 
 echo_i "test $n: key allowed - query allowed"
 ret=0
@@ -199,7 +199,7 @@ status=`expr $status + $ret`
 # Test 11 - key not allowed, query refused
 n=`expr $n + 1`
 copy_setports ns2/named11.conf.in ns2/named.conf
-rndc_reload
+rndc_reload ns2 10.53.0.2
 
 echo_i "test $n: key not allowed - query refused"
 ret=0
@@ -212,7 +212,7 @@ status=`expr $status + $ret`
 # Test 12 - key disallowed, query refused
 n=`expr $n + 1`
 copy_setports ns2/named12.conf.in ns2/named.conf
-rndc_reload
+rndc_reload ns2 10.53.0.2
 
 echo_i "test $n: key disallowed - query refused"
 ret=0
@@ -228,7 +228,7 @@ n=20
 # Test 21 - views default, query allowed
 n=`expr $n + 1`
 copy_setports ns2/named21.conf.in ns2/named.conf
-rndc_reload
+rndc_reload ns2 10.53.0.2
 
 echo_i "test $n: views default - query allowed"
 ret=0
@@ -241,7 +241,7 @@ status=`expr $status + $ret`
 # Test 22 - views explicit any, query allowed
 n=`expr $n + 1`
 copy_setports ns2/named22.conf.in ns2/named.conf
-rndc_reload
+rndc_reload ns2 10.53.0.2
 
 echo_i "test $n: views explicit any - query allowed"
 ret=0
@@ -254,7 +254,7 @@ status=`expr $status + $ret`
 # Test 23 - views none, query refused
 n=`expr $n + 1`
 copy_setports ns2/named23.conf.in ns2/named.conf
-rndc_reload
+rndc_reload ns2 10.53.0.2
 
 echo_i "test $n: views none - query refused"
 ret=0
@@ -267,7 +267,7 @@ status=`expr $status + $ret`
 # Test 24 - views address allowed, query allowed
 n=`expr $n + 1`
 copy_setports ns2/named24.conf.in ns2/named.conf
-rndc_reload
+rndc_reload ns2 10.53.0.2
 
 echo_i "test $n: views address allowed - query allowed"
 ret=0
@@ -280,7 +280,7 @@ status=`expr $status + $ret`
 # Test 25 - views address not allowed, query refused
 n=`expr $n + 1`
 copy_setports ns2/named25.conf.in ns2/named.conf
-rndc_reload
+rndc_reload ns2 10.53.0.2
 
 echo_i "test $n: views address not allowed - query refused"
 ret=0
@@ -293,7 +293,7 @@ status=`expr $status + $ret`
 # Test 26 - views address disallowed, query refused
 n=`expr $n + 1`
 copy_setports ns2/named26.conf.in ns2/named.conf
-rndc_reload
+rndc_reload ns2 10.53.0.2
 
 echo_i "test $n: views address disallowed - query refused"
 ret=0
@@ -306,7 +306,7 @@ status=`expr $status + $ret`
 # Test 27 - views acl allowed, query allowed
 n=`expr $n + 1`
 copy_setports ns2/named27.conf.in ns2/named.conf
-rndc_reload
+rndc_reload ns2 10.53.0.2
 
 echo_i "test $n: views acl allowed - query allowed"
 ret=0
@@ -319,7 +319,7 @@ status=`expr $status + $ret`
 # Test 28 - views acl not allowed, query refused
 n=`expr $n + 1`
 copy_setports ns2/named28.conf.in ns2/named.conf
-rndc_reload
+rndc_reload ns2 10.53.0.2
 
 echo_i "test $n: views acl not allowed - query refused"
 ret=0
@@ -332,7 +332,7 @@ status=`expr $status + $ret`
 # Test 29 - views acl disallowed, query refused
 n=`expr $n + 1`
 copy_setports ns2/named29.conf.in ns2/named.conf
-rndc_reload
+rndc_reload ns2 10.53.0.2
 
 echo_i "test $n: views acl disallowed - query refused"
 ret=0
@@ -345,7 +345,7 @@ status=`expr $status + $ret`
 # Test 30 - views key allowed, query allowed
 n=`expr $n + 1`
 copy_setports ns2/named30.conf.in ns2/named.conf
-rndc_reload
+rndc_reload ns2 10.53.0.2
 
 echo_i "test $n: views key allowed - query allowed"
 ret=0
@@ -358,7 +358,7 @@ status=`expr $status + $ret`
 # Test 31 - views key not allowed, query refused
 n=`expr $n + 1`
 copy_setports ns2/named31.conf.in ns2/named.conf
-rndc_reload
+rndc_reload ns2 10.53.0.2
 
 echo_i "test $n: views key not allowed - query refused"
 ret=0
@@ -371,7 +371,7 @@ status=`expr $status + $ret`
 # Test 32 - views key disallowed, query refused
 n=`expr $n + 1`
 copy_setports ns2/named32.conf.in ns2/named.conf
-rndc_reload
+rndc_reload ns2 10.53.0.2
 
 echo_i "test $n: views key disallowed - query refused"
 ret=0
@@ -384,7 +384,7 @@ status=`expr $status + $ret`
 # Test 33 - views over options, views allow, query allowed
 n=`expr $n + 1`
 copy_setports ns2/named33.conf.in ns2/named.conf
-rndc_reload
+rndc_reload ns2 10.53.0.2
 
 echo_i "test $n: views over options, views allow - query allowed"
 ret=0
@@ -397,7 +397,7 @@ status=`expr $status + $ret`
 # Test 34 - views over options, views disallow, query refused
 n=`expr $n + 1`
 copy_setports ns2/named34.conf.in ns2/named.conf
-rndc_reload
+rndc_reload ns2 10.53.0.2
 
 echo_i "test $n: views over options, views disallow - query refused"
 ret=0
@@ -414,7 +414,7 @@ n=40
 # Test 41 - zone default, query allowed
 n=`expr $n + 1`
 copy_setports ns2/named40.conf.in ns2/named.conf
-rndc_reload
+rndc_reload ns2 10.53.0.2
 
 echo_i "test $n: zone default - query allowed"
 ret=0
@@ -537,7 +537,7 @@ status=`expr $status + $ret`
 # Test 53 - zones over options, zones allow, query allowed
 n=`expr $n + 1`
 copy_setports ns2/named53.conf.in ns2/named.conf
-rndc_reload
+rndc_reload ns2 10.53.0.2
 
 echo_i "test $n: views over options, views allow - query allowed"
 ret=0
@@ -550,7 +550,7 @@ status=`expr $status + $ret`
 # Test 54 - zones over options, zones disallow, query refused
 n=`expr $n + 1`
 copy_setports ns2/named54.conf.in ns2/named.conf
-rndc_reload
+rndc_reload ns2 10.53.0.2
 
 echo_i "test $n: views over options, views disallow - query refused"
 ret=0
@@ -563,7 +563,7 @@ status=`expr $status + $ret`
 # Test 55 - zones over views, zones allow, query allowed
 n=`expr $n + 1`
 copy_setports ns2/named55.conf.in ns2/named.conf
-rndc_reload
+rndc_reload ns2 10.53.0.2
 
 echo_i "test $n: zones over views, views allow - query allowed"
 ret=0
@@ -576,7 +576,7 @@ status=`expr $status + $ret`
 # Test 56 - zones over views, zones disallow, query refused
 n=`expr $n + 1`
 copy_setports ns2/named56.conf.in ns2/named.conf
-rndc_reload
+rndc_reload ns2 10.53.0.2
 
 echo_i "test $n: zones over views, views disallow - query refused"
 ret=0
@@ -589,7 +589,7 @@ status=`expr $status + $ret`
 # Test 57 - zones over views, zones disallow, query refused (allow-query-on)
 n=`expr $n + 1`
 copy_setports ns2/named57.conf.in ns2/named.conf
-rndc_reload
+rndc_reload ns2 10.53.0.2
 
 echo_i "test $n: zones over views, allow-query-on"
 ret=0
@@ -602,9 +602,9 @@ grep '^a.aclnotallow.example' dig.out.ns2.2.$n > /dev/null && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
 
-# Test 58 - allow-recursion inheritance
+# Test 58 - allow-recursion default
 n=`expr $n + 1`
-echo_i "test $n: default recursion configuration"
+echo_i "test $n: default allow-recursion configuration"
 ret=0
 $DIG -p ${PORT} @10.53.0.3 -b 127.0.0.1 a.normal.example a > dig.out.ns3.1.$n
 grep 'status: NOERROR' dig.out.ns3.1.$n > /dev/null || ret=1
@@ -613,5 +613,82 @@ grep 'status: REFUSED' dig.out.ns3.2.$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
 
+# Test 59 - allow-query-cache default
+n=`expr $n + 1`
+echo_i "test $n: default allow-query-cache configuration"
+ret=0
+$DIG -p ${PORT} @10.53.0.3 -b 127.0.0.1 ns . > dig.out.ns3.1.$n
+grep 'status: NOERROR' dig.out.ns3.1.$n > /dev/null || ret=1
+$DIG -p ${PORT} @10.53.0.3 -b 10.53.0.1 ns . > dig.out.ns3.2.$n
+grep 'status: REFUSED' dig.out.ns3.2.$n > /dev/null || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=`expr $status + $ret`
+
+# Test 60 - block recursion-on, allow query-cache-on
+n=`expr $n + 1`
+copy_setports ns3/named2.conf.in ns3/named.conf
+rndc_reload ns3 10.53.0.3
+
+echo_i "test $n: block recursion-on, allow query-cache-on"
+ret=0
+# this should query the cache, and an answer should already be there
+$DIG -p ${PORT} @10.53.0.3 a.normal.example a > dig.out.ns3.1.$n
+grep 'recursion requested but not available' dig.out.ns3.1.$n > /dev/null || ret=1
+grep 'ANSWER: 1' dig.out.ns3.1.$n > /dev/null || ret=1
+# this should require recursion and therefore can't get an answer
+$DIG -p ${PORT} @10.53.0.3 b.normal.example a > dig.out.ns3.2.$n
+grep 'recursion requested but not available' dig.out.ns3.2.$n > /dev/null || ret=1
+grep 'ANSWER: 0' dig.out.ns3.2.$n > /dev/null || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=`expr $status + $ret`
+
+# Test 61 - inheritance of allow-query-cache-on from allow-recursion-on
+n=`expr $n + 1`
+copy_setports ns3/named3.conf.in ns3/named.conf
+rndc_reload ns3 10.53.0.3
+
+echo_i "test $n: inheritance of allow-query-cache-on"
+ret=0
+# this should query the cache, an answer should already be there
+$DIG -p ${PORT} @10.53.0.3 a.normal.example a > dig.out.ns3.1.$n
+grep 'ANSWER: 1' dig.out.ns3.1.$n > /dev/null || ret=1
+# this should be refused due to allow-recursion-on/allow-query-cache-on
+$DIG -p ${PORT} @10.53.1.2 a.normal.example a > dig.out.ns3.2.$n
+grep 'recursion requested but not available' dig.out.ns3.2.$n > /dev/null || ret=1
+grep 'status: REFUSED' dig.out.ns3.2.$n > /dev/null || ret=1
+# this should require recursion and should be allowed
+$DIG -p ${PORT} @10.53.0.3 c.normal.example a > dig.out.ns3.3.$n
+grep 'ANSWER: 1' dig.out.ns3.3.$n > /dev/null || ret=1
+# this should require recursion and be refused
+$DIG -p ${PORT} @10.53.1.2 d.normal.example a > dig.out.ns3.4.$n
+grep 'recursion requested but not available' dig.out.ns3.4.$n > /dev/null || ret=1
+grep 'status: REFUSED' dig.out.ns3.4.$n > /dev/null || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=`expr $status + $ret`
+
+# Test 62 - inheritance of allow-recursion-on from allow-query-cache-on
+n=`expr $n + 1`
+copy_setports ns3/named4.conf.in ns3/named.conf
+rndc_reload ns3 10.53.0.3
+
+echo_i "test $n: inheritance of allow-recursion-on"
+ret=0
+# this should query the cache, an answer should already be there
+$DIG -p ${PORT} @10.53.0.3 a.normal.example a > dig.out.ns3.1.$n
+grep 'ANSWER: 1' dig.out.ns3.1.$n > /dev/null || ret=1
+# this should be refused due to allow-recursion-on/allow-query-cache-on
+$DIG -p ${PORT} @10.53.1.2 a.normal.example a > dig.out.ns3.2.$n
+grep 'recursion requested but not available' dig.out.ns3.2.$n > /dev/null || ret=1
+grep 'status: REFUSED' dig.out.ns3.2.$n > /dev/null || ret=1
+# this should require recursion and should be allowed
+$DIG -p ${PORT} @10.53.0.3 e.normal.example a > dig.out.ns3.3.$n
+grep 'ANSWER: 1' dig.out.ns3.3.$n > /dev/null || ret=1
+# this should require recursion and be refused
+$DIG -p ${PORT} @10.53.1.2 f.normal.example a > dig.out.ns3.4.$n
+grep 'recursion requested but not available' dig.out.ns3.4.$n > /dev/null || ret=1
+grep 'status: REFUSED' dig.out.ns3.4.$n > /dev/null || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=`expr $status + $ret`
+
 echo_i "exit status: $status"
 [ $status -eq 0 ] || exit 1

bin/tests/system/auth/clean.sh

@@ -13,4 +13,4 @@ rm -f */named.conf
 rm -f dig.out.test*
 rm -f ns2/example.com.bk
 rm -f ns2/example.net.bk
-rm -f ns*/managed-keys.bind*
+rm -f ns*/managed-keys.bind* ns*/*mkeys*

bin/tests/system/auth/ns1/chaos.db

@@ -0,0 +1,21 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0. If a copy of the MPL was not distributed with this
+; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 300	; 5 minutes
+@			CH SOA  ns root (
+				2018010100 ; serial
+				1800       ; refresh (30 minutes)
+				1800       ; retry (30 minutes)
+				1814400    ; expire (3 weeks)
+				3600       ; minimum (1 hour)
+				)
+			NS	ns
+ns			A	ch-addr.example. 1001
+test 			A	ch-addr.example. 1002
+			A	ch-addr.example. 1003

bin/tests/system/auth/ns1/named.conf.in

@@ -21,12 +21,21 @@ options {
 	notify yes;
 };
 
-zone example.net {
+view main in {
-	type master;
+	zone example.net {
-	file "example.net.db";
+		type master;
+		file "example.net.db";
+	};
+
+	zone example.com {
+		type master;
+		file "example.com.db";
+	};
 };
 
-zone example.com {
+view alt chaos {
-	type master;
+	zone example.chaos chaos {
-	file "example.com.db";
+		type master;
+		file "chaos.db";
+	};
 };

bin/tests/system/auth/tests.sh

@@ -128,5 +128,14 @@ grep "a.example.com.*A.*10.53.0.1" dig.out.test$n > /dev/null || ret=1
 [ $ret -eq 0 ] || echo_i "failed"
 status=`expr $status + $ret`
 
+n=`expr $n + 1`
+echo_i "check that CHAOS addresses are compared correctly ($n)"
+ret=0
+$DIG $DIGOPTS @10.53.0.1 +noall +answer ch test.example.chaos > dig.out.test$n
+lines=`wc -l < dig.out.test$n`
+[ ${lines:-0} -eq 2 ] || ret=1
+[ $ret -eq 0 ] || echo_i "failed"
+status=`expr $status + $ret`
+
 echo_i "exit status: $status"
 [ $status -eq 0 ] || exit 1

bin/tests/system/autosign/tests.sh

@@ -78,7 +78,7 @@ do
 	done
 	for z in bar. example. inacksk2.example. inacksk3.example \
 		 inaczsk2.example. inaczsk3.example
-	do 
+	do
 		$DIG $DIGOPTS $z @10.53.0.3 nsec > dig.out.ns3.test$n || ret=1
 		grep "NS SOA" dig.out.ns3.test$n > /dev/null || ret=1
 	done
@@ -91,6 +91,23 @@ n=`expr $n + 1`
 if [ $ret != 0 ]; then echo_i "done"; fi
 status=`expr $status + $ret`
 
+echo_i "Initial counts of RRSIG expiry fields values for auto signed zones"
+for z in .
+do
+	echo_i zone $z
+	$DIG $DIGOPTS $z @10.53.0.1 axfr | awk '$4 == "RRSIG" {print $9}' | sort | uniq -c | cat_i
+done
+for z in bar. example. private.secure.example.
+do
+	echo_i zone $z
+	$DIG $DIGOPTS $z @10.53.0.2 axfr | awk '$4 == "RRSIG" {print $9}' | sort | uniq -c | cat_i
+done
+for z in inacksk2.example. inacksk3.example inaczsk2.example. inaczsk3.example
+do
+	echo_i zone $z
+	$DIG $DIGOPTS $z @10.53.0.3 axfr | awk '$4 == "RRSIG" {print $9}' | sort | uniq -c | cat_i
+done
+
 #
 # Check that DNSKEY is initially signed with a KSK and not a ZSK.
 #
@@ -1147,7 +1164,7 @@ if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
 
 # this confirms that key events are never scheduled more than
-# 'dnssec-loadkeys-interval' minutes in the future, and that the 
+# 'dnssec-loadkeys-interval' minutes in the future, and that the
 # event scheduled is within 10 seconds of expected interval.
 check_interval () {
         awk '/next key event/ {print $2 ":" $9}' $1/named.run |

bin/tests/system/case/dynamic.good

@@ -1,6 +1,6 @@
 DyNaMiC.		300	IN	SOA	mname1. . 2000042407 20 20 1814400 3600
 DyNaMiC.		300	IN	NS	ns1.DYNAMIC.
-DyNaMiC.		300	IN	MX	0 mail.eXaMpLe.
+DynamiC.		300	IN	MX	0 mail.eXaMpLe.
 mAiL.DynamiC.		300	IN	A	10.53.0.1
 ns1.DYNAMIC.		300	IN	A	10.53.0.1
 DyNaMiC.		300	IN	SOA	mname1. . 2000042407 20 20 1814400 3600

bin/tests/system/case/postns1.good

@@ -1,14 +1,6 @@
-
+dYNAMIc.		300	IN	SOA	mname1. . 2000042409 20 20 1814400 3600
-; <<>> DiG 9.11.0pre-alpha <<>> axfr dynamic @10.53.0.1 -p 5300
-;; global options: +cmd
-dYNAMIc.		0	IN	SOA	mname1. . 2000042409 20 20 1814400 3600
 DyNaMiC.		300	IN	NS	ns1.DYNAMIC.
-DyNaMiC.		300	IN	MX	0 mail.eXaMpLe.
+DynamiC.		300	IN	MX	0 mail.eXaMpLe.
 mAiL.DynamiC.		300	IN	A	10.53.0.1
 Ns1.DyNaMIC.		300	IN	A	10.53.0.1
-dYNAMIc.		0	IN	SOA	mname1. . 2000042409 20 20 1814400 3600
+dYNAMIc.		300	IN	SOA	mname1. . 2000042409 20 20 1814400 3600
-;; Query time: 0 msec
-;; SERVER: 10.53.0.1#5300(10.53.0.1)
-;; WHEN: Mon Jan 19 14:50:54 EST 2015
-;; XFR size: 6 records (messages 1, bytes 234)
-

bin/tests/system/case/postupdate.good

@@ -1,6 +1,6 @@
 dYNAMIc.		300	IN	SOA	mname1. . 2000042408 20 20 1814400 3600
 DyNaMiC.		300	IN	NS	ns1.DYNAMIC.
-DyNaMiC.		300	IN	MX	0 mail.eXaMpLe.
+DynamiC.		300	IN	MX	0 mail.eXaMpLe.
 mAiL.DynamiC.		300	IN	A	10.53.0.1
 ns1.DYNAMIC.		300	IN	A	10.53.0.1
 dYNAMIc.		300	IN	SOA	mname1. . 2000042408 20 20 1814400 3600

bin/tests/system/cds/setup.sh

@@ -20,13 +20,13 @@ touch empty
 
 Z=cds.test
 
-keyz=$($KEYGEN -q -a RSASHA256 $Z)
+keyz=`$KEYGEN -q -a RSASHA256 $Z`
-key1=$($KEYGEN -q -a RSASHA256 -f KSK $Z)
+key1=`$KEYGEN -q -a RSASHA256 -f KSK $Z`
-key2=$($KEYGEN -q -a RSASHA256 -f KSK $Z)
+key2=`$KEYGEN -q -a RSASHA256 -f KSK $Z`
 
-idz=$(echo $keyz | sed 's/.*+0*//')
+idz=`echo $keyz | sed 's/.*+0*//'`
-id1=$(echo $key1 | sed 's/.*+0*//')
+id1=`echo $key1 | sed 's/.*+0*//'`
-id2=$(echo $key2 | sed 's/.*+0*//')
+id2=`echo $key2 | sed 's/.*+0*//'`
 
 cat <<EOF >vars.sh
 Z=$Z
@@ -120,10 +120,11 @@ $mangle '\s+IN\s+RRSIG\s+CDS .* '$id1' '$Z'\. ' \
 $mangle " IN CDS $id1 8 1 " <db.cds.1 |
 sign cds-mangled
 
-sed 's/IN CDS '$id1' 8 1 /IN CDS '$((id1 ^ 255))' 8 1 /' <db.cds.1 |
+bad=`$PERL -le "print ($id1 ^ 255);"`
+sed 's/IN CDS '$id1' 8 1 /IN CDS '$bad' 8 1 /' <db.cds.1 |
 sign bad-digests
 
-sed '/IN CDS '$id1' 8 /p;s//IN CDS '$((id1 ^ 255))' 13 /' <db.cds.1 |
+sed '/IN CDS '$id1' 8 /p;s//IN CDS '$bad' 13 /' <db.cds.1 |
 sign bad-algos
 
 rm -f dsset-*

bin/tests/system/chain/ns2/generic.db

@@ -7,9 +7,10 @@
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
 
-@	86400	SOA	ns2.nil. hostmaster.ns2.nil. 0 1 1 1 1
+@	86400	SOA	ns2.domain0.nil. hostmaster.ns2.nil. 0 1 1 1 1
-@	86400	NS 	ns2.nil.
+@	86400	NS 	ns2.domain0.nil.
 ns2	86400	A 	10.53.0.2
+ns2	86400	AAAA    fd92:7065:b8e:ffff::2
 
 @       86400	A 	1.2.3.4
 @       86400	AAAA 	1:2:3::4

bin/tests/system/chain/tests.sh

@@ -27,6 +27,7 @@ status=`expr $status + $ret`
 n=`expr $n + 1`
 echo_i "checking short DNAME from recursive ($n)"
 ret=0
+$RNDCCMD 10.53.0.7 null --- start test$n --- 2>&1 | sed 's/^/ns7 /' | cat_i
 $DIG $DIGOPTS a.short-dname.example @10.53.0.7 a > dig.out.ns4.short || ret=1
 grep "status: NOERROR" dig.out.ns4.short > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
@@ -43,6 +44,7 @@ status=`expr $status + $ret`
 n=`expr $n + 1`
 echo_i "checking long DNAME from recursive ($n)"
 ret=0
+$RNDCCMD 10.53.0.7 null --- start test$n --- 2>&1 | sed 's/^/ns7 /' | cat_i
 $DIG $DIGOPTS a.long-dname.example @10.53.0.7 a > dig.out.ns4.long || ret=1
 grep "status: NOERROR" dig.out.ns4.long > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
@@ -59,6 +61,7 @@ status=`expr $status + $ret`
 n=`expr $n + 1`
 echo_i "checking (too) long DNAME from recursive with cached DNAME ($n)"
 ret=0
+$RNDCCMD 10.53.0.7 null --- start test$n --- 2>&1 | sed 's/^/ns7 /' | cat_i
 $DIG $DIGOPTS 01234567890123456789012345678901234567890123456789.longlonglonglonglonglonglonglonglonglonglonglonglonglonglong.longlonglonglonglonglonglonglonglonglonglonglonglonglonglong.longlonglonglonglonglonglonglonglonglonglonglonglonglonglong.long-dname.example @10.53.0.7 a > dig.out.ns4.cachedtoolong || ret=1
 grep "status: YXDOMAIN" dig.out.ns4.cachedtoolong > /dev/null || ret=1
 grep '^long-dname\.example\..*DNAME.*long' dig.out.ns4.cachedtoolong > /dev/null || ret=1
@@ -68,6 +71,7 @@ status=`expr $status + $ret`
 n=`expr $n + 1`
 echo_i "checking (too) long DNAME from recursive without cached DNAME ($n)"
 ret=0
+$RNDCCMD 10.53.0.7 null --- start test$n --- 2>&1 | sed 's/^/ns7 /' | cat_i
 $DIG $DIGOPTS 01234567890123456789012345678901234567890123456789.longlonglonglonglonglonglonglonglonglonglonglonglonglonglong.longlonglonglonglonglonglonglonglonglonglonglonglonglonglong.longlonglonglonglonglonglonglonglonglonglonglonglonglong.toolong-dname.example @10.53.0.7 a > dig.out.ns4.uncachedtoolong || ret=1
 grep "status: YXDOMAIN" dig.out.ns4.uncachedtoolong > /dev/null || ret=1
 grep '^toolong-dname\.example\..*DNAME.*long' dig.out.ns4.uncachedtoolong > /dev/null || ret=1
@@ -85,6 +89,7 @@ status=`expr $status + $ret`
 n=`expr $n + 1`
 echo_i "checking CNAME to DNAME from recursive"
 ret=0
+$RNDCCMD 10.53.0.7 null --- start test$n --- 2>&1 | sed 's/^/ns7 /' | cat_i
 $DIG $DIGOPTS cname.example @10.53.0.7 a > dig.out.ns4.cname
 grep "status: NOERROR" dig.out.ns4.cname > /dev/null || ret=1
 grep '^cname.example.' dig.out.ns4.cname > /dev/null || ret=1
@@ -97,6 +102,7 @@ status=`expr $status + $ret`
 n=`expr $n + 1`
 echo_i "checking DNAME is returned with synthesized CNAME before DNAME ($n)"
 ret=0
+$RNDCCMD 10.53.0.7 null --- start test$n --- 2>&1 | sed 's/^/ns7 /' | cat_i
 $DIG $DIGOPTS @10.53.0.7 name.synth-then-dname.example.broken A > dig.out.test$n
 grep "status: NXDOMAIN" dig.out.test$n > /dev/null || ret=1
 grep '^name.synth-then-dname\.example\.broken\..*CNAME.*name.$' dig.out.test$n > /dev/null || ret=1
@@ -107,6 +113,7 @@ status=`expr $status + $ret`
 n=`expr $n + 1`
 echo_i "checking DNAME is returned with CNAME to synthesized CNAME before DNAME ($n)"
 ret=0
+$RNDCCMD 10.53.0.7 null --- start test$n --- 2>&1 | sed 's/^/ns7 /' | cat_i
 $DIG $DIGOPTS @10.53.0.7 cname-to-synth2-then-dname.example.broken A > dig.out.test$n
 grep "status: NXDOMAIN" dig.out.test$n > /dev/null || ret=1
 grep '^cname-to-synth2-then-dname\.example\.broken\..*CNAME.*name\.synth2-then-dname\.example\.broken.$' dig.out.test$n > /dev/null || ret=1
@@ -118,6 +125,7 @@ status=`expr $status + $ret`
 n=`expr $n + 1`
 echo_i "checking CNAME loops are detected ($n)"
 ret=0
+$RNDCCMD 10.53.0.7 null --- start test$n --- 2>&1 | sed 's/^/ns7 /' | cat_i
 $DIG $DIGOPTS @10.53.0.7 loop.example > dig.out.test$n
 grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
 grep "ANSWER: 17" dig.out.test$n > /dev/null || ret=1
@@ -127,6 +135,7 @@ status=`expr $status + $ret`
 n=`expr $n + 1`
 echo_i "checking CNAME to external delegated zones is handled ($n)"
 ret=0
+$RNDCCMD 10.53.0.7 null --- start test$n --- 2>&1 | sed 's/^/ns7 /' | cat_i
 $DIG $DIGOPTS @10.53.0.7 a.example > dig.out.test$n
 grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
 grep "ANSWER: 2" dig.out.test$n > /dev/null || ret=1
@@ -136,6 +145,7 @@ status=`expr $status + $ret`
 n=`expr $n + 1`
 echo_i "checking CNAME to internal delegated zones is handled ($n)"
 ret=0
+$RNDCCMD 10.53.0.7 null --- start test$n --- 2>&1 | sed 's/^/ns7 /' | cat_i
 $DIG $DIGOPTS @10.53.0.7 b.example > dig.out.test$n
 grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
 grep "ANSWER: 2" dig.out.test$n > /dev/null || ret=1
@@ -145,6 +155,7 @@ status=`expr $status + $ret`
 n=`expr $n + 1`
 echo_i "checking CNAME to signed external delgation is handled ($n)"
 ret=0
+$RNDCCMD 10.53.0.7 null --- start test$n --- 2>&1 | sed 's/^/ns7 /' | cat_i
 $DIG $DIGOPTS @10.53.0.7 c.example > dig.out.$n
 grep "status: NOERROR" dig.out.$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i " failed"; fi
@@ -153,6 +164,7 @@ status=`expr $status + $ret`
 n=`expr $n + 1`
 echo_i "checking CNAME to signed internal delgation is handled ($n)"
 ret=0
+$RNDCCMD 10.53.0.7 null --- start test$n --- 2>&1 | sed 's/^/ns7 /' | cat_i
 $DIG $DIGOPTS @10.53.0.7 d.example > dig.out.$n
 grep "status: NOERROR" dig.out.$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i " failed"; fi
@@ -161,30 +173,36 @@ status=`expr $status + $ret`
 n=`expr $n + 1`
 echo_i "checking CNAME chains in various orders ($n)"
 ret=0
+$RNDCCMD 10.53.0.7 null --- start test$n - step 1 --- 2>&1 | sed 's/^/ns7 /' | cat_i
 echo "cname,cname,cname|1,2,3,4,s1,s2,s3,s4" | $SEND
 $DIG $DIGOPTS @10.53.0.7 test.domain.nil > dig.out.1.$n 2>&1
 grep 'status: NOERROR' dig.out.1.$n > /dev/null 2>&1 || ret=1
 grep 'ANSWER: 2' dig.out.1.$n > /dev/null 2>&1 || ret=1
+$RNDCCMD 10.53.0.7 null --- start test$n - step 2 --- 2>&1 | sed 's/^/ns7 /' | cat_i
 $RNDCCMD 10.53.0.7 flush 2>&1 | sed 's/^/ns7 /' | cat_i
 echo "cname,cname,cname|1,1,2,2,3,4,s4,s3,s1" | $SEND
 $DIG $DIGOPTS @10.53.0.7 test.domain.nil > dig.out.2.$n 2>&1
 grep 'status: NOERROR' dig.out.2.$n > /dev/null 2>&1 || ret=1
 grep 'ANSWER: 2' dig.out.2.$n > /dev/null 2>&1 || ret=1
+$RNDCCMD 10.53.0.7 null --- start test$n - step 3 --- 2>&1 | sed 's/^/ns7 /' | cat_i
 $RNDCCMD 10.53.0.7 flush 2>&1 | sed 's/^/ns7 /' | cat_i
 echo "cname,cname,cname|2,1,3,4,s3,s1,s2,s4" | $SEND
 $DIG $DIGOPTS @10.53.0.7 test.domain.nil > dig.out.3.$n 2>&1
 grep 'status: NOERROR' dig.out.3.$n > /dev/null 2>&1 || ret=1
 grep 'ANSWER: 2' dig.out.3.$n > /dev/null 2>&1 || ret=1
+$RNDCCMD 10.53.0.7 null --- start test$n - step 4 --- 2>&1 | sed 's/^/ns7 /' | cat_i
 $RNDCCMD 10.53.0.7 flush 2>&1 | sed 's/^/ns7 /' | cat_i
 echo "cname,cname,cname|4,3,2,1,s4,s3,s2,s1" | $SEND
 $DIG $DIGOPTS @10.53.0.7 test.domain.nil > dig.out.4.$n 2>&1
 grep 'status: NOERROR' dig.out.4.$n > /dev/null 2>&1 || ret=1
 grep 'ANSWER: 2' dig.out.4.$n > /dev/null 2>&1 || ret=1
 echo "cname,cname,cname|4,3,2,1,s4,s3,s2,s1" | $SEND
+$RNDCCMD 10.53.0.7 null --- start test$n - step 5 --- 2>&1 | sed 's/^/ns7 /' | cat_i
 $RNDCCMD 10.53.0.7 flush 2>&1 | sed 's/^/ns7 /' | cat_i
 $DIG $DIGOPTS @10.53.0.7 test.domain.nil > dig.out.5.$n 2>&1
 grep 'status: NOERROR' dig.out.5.$n > /dev/null 2>&1 || ret=1
 grep 'ANSWER: 2' dig.out.5.$n > /dev/null 2>&1 || ret=1
+$RNDCCMD 10.53.0.7 null --- start test$n - step 6 --- 2>&1 | sed 's/^/ns7 /' | cat_i
 $RNDCCMD 10.53.0.7 flush 2>&1 | sed 's/^/ns7 /' | cat_i
 echo "cname,cname,cname|4,3,3,3,s1,s1,1,3,4" | $SEND
 $DIG $DIGOPTS @10.53.0.7 test.domain.nil > dig.out.6.$n 2>&1
@@ -198,6 +216,7 @@ echo_i "checking that only the initial CNAME is cached ($n)"
 ret=0
 $RNDCCMD 10.53.0.7 flush 2>&1 | sed 's/^/ns7 /' | cat_i
 echo "cname,cname,cname|1,2,3,4,s1,s2,s3,s4" | $SEND
+$RNDCCMD 10.53.0.7 null --- start test$n --- 2>&1 | sed 's/^/ns7 /' | cat_i
 $DIG $DIGOPTS @10.53.0.7 test.domain.nil > dig.out.1.$n 2>&1
 sleep 1
 $DIG $DIGOPTS +noall +answer @10.53.0.7 cname1.domain.nil > dig.out.2.$n 2>&1
@@ -209,16 +228,19 @@ status=`expr $status + $ret`
 n=`expr $n + 1`
 echo_i "checking DNAME chains in various orders ($n)"
 ret=0
+$RNDCCMD 10.53.0.7 null --- start test$n - step 1 --- 2>&1 | sed 's/^/ns7 /' | cat_i
 $RNDCCMD 10.53.0.7 flush 2>&1 | sed 's/^/ns7 /' | cat_i
 echo "dname,dname|5,4,3,2,1,s5,s4,s3,s2,s1" | $SEND
 $DIG $DIGOPTS @10.53.0.7 test.domain.nil > dig.out.1.$n 2>&1
 grep 'status: NOERROR' dig.out.1.$n > /dev/null 2>&1 || ret=1
 grep 'ANSWER: 3' dig.out.1.$n > /dev/null 2>&1 || ret=1
+$RNDCCMD 10.53.0.7 null --- start test$n - step 2 --- 2>&1 | sed 's/^/ns7 /' | cat_i
 $RNDCCMD 10.53.0.7 flush 2>&1 | sed 's/^/ns7 /' | cat_i
 echo "dname,dname|5,4,3,2,1,s5,s4,s3,s2,s1" | $SEND
 $DIG $DIGOPTS @10.53.0.7 test.domain.nil > dig.out.2.$n 2>&1
 grep 'status: NOERROR' dig.out.2.$n > /dev/null 2>&1 || ret=1
 grep 'ANSWER: 3' dig.out.2.$n > /dev/null 2>&1 || ret=1
+$RNDCCMD 10.53.0.7 null --- start test$n - step 3 --- 2>&1 | sed 's/^/ns7 /' | cat_i
 $RNDCCMD 10.53.0.7 flush 2>&1 | sed 's/^/ns7 /' | cat_i
 echo "dname,dname|2,3,s1,s2,s3,s4,1" | $SEND
 $DIG $DIGOPTS @10.53.0.7 test.domain.nil > dig.out.3.$n 2>&1
@@ -231,15 +253,18 @@ status=`expr $status + $ret`
 n=`expr $n + 1`
 echo_i "checking external CNAME/DNAME chains in various orders ($n)"
 ret=0
+$RNDCCMD 10.53.0.7 null --- start test$n - step 1 --- 2>&1 | sed 's/^/ns7 /' | cat_i
 echo "xname,dname|1,2,3,4,s1,s2,s3,s4" | $SEND
 $DIG $DIGOPTS @10.53.0.7 test.domain.nil > dig.out.1.$n 2>&1
 grep 'status: NOERROR' dig.out.1.$n > /dev/null 2>&1 || ret=1
 grep 'ANSWER: 2' dig.out.1.$n > /dev/null 2>&1 || ret=1
+$RNDCCMD 10.53.0.7 null --- start test$n - step 2 --- 2>&1 | sed 's/^/ns7 /' | cat_i
 $RNDCCMD 10.53.0.7 flush 2>&1 | sed 's/^/ns7 /' | cat_i
 echo "xname,dname|s2,2,s1,1,4,s4,3" | $SEND
 $DIG $DIGOPTS @10.53.0.7 test.domain.nil > dig.out.2.$n 2>&1
 grep 'status: NOERROR' dig.out.2.$n > /dev/null 2>&1 || ret=1
 grep 'ANSWER: 2' dig.out.2.$n > /dev/null 2>&1 || ret=1
+$RNDCCMD 10.53.0.7 null --- start test$n - step 3 --- 2>&1 | sed 's/^/ns7 /' | cat_i
 $RNDCCMD 10.53.0.7 flush 2>&1 | sed 's/^/ns7 /' | cat_i
 echo "xname,dname|s2,2,2,2" | $SEND
 $DIG $DIGOPTS @10.53.0.7 test.domain.nil > dig.out.3.$n 2>&1
@@ -251,6 +276,7 @@ status=`expr $status + $ret`
 n=`expr $n + 1`
 echo_i "checking explicit DNAME query ($n)"
 ret=0
+$RNDCCMD 10.53.0.7 null --- start test$n --- 2>&1 | sed 's/^/ns7 /' | cat_i
 $DIG $DIGOPTS @10.53.0.7 dname short-dname.example > dig.out.7.$n 2>&1
 grep 'status: NOERROR' dig.out.7.$n > /dev/null 2>&1 || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
@@ -259,6 +285,7 @@ status=`expr $status + $ret`
 n=`expr $n + 1`
 echo_i "checking DNAME via ANY query ($n)"
 ret=0
+$RNDCCMD 10.53.0.7 null --- start test$n --- 2>&1 | sed 's/^/ns7 /' | cat_i
 $RNDCCMD 10.53.0.7 flush 2>&1 | sed 's/^/ns7 /' | cat_i
 $DIG $DIGOPTS @10.53.0.7 any short-dname.example > dig.out.7.$n 2>&1
 grep 'status: NOERROR' dig.out.7.$n > /dev/null 2>&1 || ret=1

bin/tests/system/checkconf/bad-update-policy10.conf

@@ -0,0 +1,18 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+zone "example.com" {
+	type master;
+	file "example.com.db";
+	update-policy {
+		grant * krb5-selfsub TXT;
+	};
+};

bin/tests/system/checkconf/bad-update-policy11.conf

@@ -0,0 +1,18 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+zone "example.com" {
+	type master;
+	file "example.com.db";
+	update-policy {
+		grant * ms-selfsub TXT;
+	};
+};

bin/tests/system/checkconf/bad-update-policy12.conf

@@ -0,0 +1,18 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+zone "example.com" {
+	type master;
+	file "example.com.db";
+	update-policy {
+		grant * external TXT;
+	};
+};

bin/tests/system/checkconf/bad-update-policy13.conf

@@ -0,0 +1,18 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+zone "example.com" {
+	type master;
+	file "example.com.db";
+	update-policy {
+		grant a-key-name name TXT;
+	};
+};

bin/tests/system/checkconf/bad-update-policy14.conf

@@ -0,0 +1,18 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+zone "example.com" {
+	type master;
+	file "example.com.db";
+	update-policy {
+		grant a-key-name subdomain TXT;
+	};
+};

bin/tests/system/checkconf/bad-update-policy15.conf

@@ -0,0 +1,18 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+zone "example.com" {
+	type master;
+	file "example.com.db";
+	update-policy {
+		grant a-key-name wildcard TXT;
+	};
+};

bin/tests/system/checkconf/tests.sh

@@ -54,10 +54,14 @@ do
 	pat="identity and name fields are not the same"
 	grep "$pat" checkconf.out > /dev/null || ret=1
 	;;
-    bad-update-policy*.conf)
+    bad-update-policy[4589].conf|bad-update-policy1[01].conf)
 	pat="name field not set to placeholder value"
 	grep "$pat" checkconf.out > /dev/null || ret=1
 	;;
+    bad-update-policy[67].conf|bad-update-policy1[2345].conf)
+	pat="missing name field type '.*' found"
+	grep "$pat" checkconf.out > /dev/null || ret=1
+	;;
     esac
     if [ $ret != 0 ]; then echo_i "failed"; fi
     status=`expr $status + $ret`

bin/tests/system/conf.sh.in

@@ -20,6 +20,11 @@ TOP=${SYSTEMTESTTOP:=.}/../../..
 # Make it absolute so that it continues to work after we cd.
 TOP=`cd $TOP && pwd`
 
+# Default algorithm for testing
+DEFAULT_ALGORITHM=ECDSAP256SHA256
+DEFAULT_ALGORITHM_NUMBER=13
+DEFAULT_BITS=256
+
 ARPANAME=$TOP/bin/tools/arpaname
 CDS=$TOP/bin/dnssec/dnssec-cds
 CHECKCONF=$TOP/bin/check/named-checkconf
@@ -148,7 +153,6 @@ PYTHON=@PYTHON@
 #
 # Determine if we support various optional features.
 #
-CHECK_DSA=@CHECK_DSA@
 HAVEXMLSTATS=@XMLSTATS@
 HAVEJSONSTATS=@JSONSTATS@
 ZLIB=@ZLIB@
@@ -379,7 +383,11 @@ copy_setports() {
         -e "s/@EXTRAPORT6@/${EXTRAPORT6}/g" \
         -e "s/@EXTRAPORT7@/${EXTRAPORT7}/g" \
         -e "s/@EXTRAPORT8@/${EXTRAPORT8}/g" \
-        -e "s/@CONTROLPORT@/${CONTROLPORT}/g" $1 > $2
+        -e "s/@CONTROLPORT@/${CONTROLPORT}/g" \
+	-e "s/@DEFAULT_ALGORITHM@/${DEFAULT_ALGORITHM}/g" \
+	-e "s/@DEFAULT_ALGORITHM_NUMBER@/${DEFAULT_ALGORITHM_NUMBER}/g" \
+	-e "s/@DEFAULT_BITS@/${DEFAULT_BITS}/g" \
+	$1 > $2
 }
 
 #

bin/tests/system/conf.sh.win32

@@ -26,6 +26,11 @@ TOP=`cd $TOP && pwd`
 # Visual Studio build configurations are Release and Debug
 VSCONF=Debug
 
+# Default algorithm for testing
+DEFAULT_ALGORITHM=ECDSAP256SHA256
+DEFAULT_ALGORITHM_NUMBER=13
+DEFAULT_BITS=256
+
 ARPANAME=$TOP/Build/$VSCONF/arpaname@EXEEXT@
 CHECKCONF=$TOP/Build/$VSCONF/named-checkconf@EXEEXT@
 CHECKDS="$PYTHON `cygpath -w $TOP/bin/python/dnssec-checkds.py`"
@@ -102,7 +107,7 @@ SEQUENTIALDIRS="acl additional addzone autosign builtin \
 # tests can be run in parallel.
 #
 # This symbol must be kept in step with the PARALLEL macro in Makefile.in
-PARALLELDIRS="allow_query catz rpzrecurse serve-stale"
+PARALLELDIRS="allow-query catz rpzrecurse serve-stale"
 
 SUBDIRS="$SEQUENTIALDIRS $PARALLELDIRS"
 
@@ -147,7 +152,6 @@ PYTHON=@PYTHON@
 #
 # Determine if we support various optional features.
 #
-CHECK_DSA=@CHECK_DSA@
 HAVEXMLSTATS=@XMLSTATS@
 HAVEJSONSTATS=@JSONSTATS@
 ZLIB=@ZLIB@
@@ -362,7 +366,11 @@ copy_setports() {
         -e "s/${atsign}EXTRAPORT6${atsign}/${EXTRAPORT6}/g" \
         -e "s/${atsign}EXTRAPORT7${atsign}/${EXTRAPORT7}/g" \
         -e "s/${atsign}EXTRAPORT8${atsign}/${EXTRAPORT8}/g" \
-        -e "s/${atsign}CONTROLPORT${atsign}/${CONTROLPORT}/g" $1 > $2
+        -e "s/${atsign}CONTROLPORT${atsign}/${CONTROLPORT}/g" \
+	-e "s/${atsign}DEFAULT_ALGORITM${atsign}/${DEFAULT_ALGORITHM}/g" \
+	-e "s/${atsign}DEFAULT_ALGORITHM_NUMBER${atsign}/${DEFAULT_ALGORITHM_NUMBER}/g" \
+	-e "s/${atsign}DEFAULT_BITS${atsign}/${DEFAULT_BITS}/g" \
+	$1 > $2
 }
 
 #

bin/tests/system/dlv/ns1/sign.sh

@@ -23,8 +23,8 @@ infile=root.db.in
 zonefile=root.db
 outfile=root.signed
 
-keyname1=`$KEYGEN -a DSA -b 768 -n zone $zone 2> /dev/null` 
+keyname1=`$KEYGEN -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone 2> /dev/null`
-keyname2=`$KEYGEN -f KSK -a DSA -b 768 -n zone $zone 2> /dev/null`
+keyname2=`$KEYGEN -f KSK -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone 2> /dev/null`
 
 cat $infile $keyname1.key $keyname2.key >$zonefile
 

bin/tests/system/dlv/ns2/sign.sh

@@ -24,8 +24,8 @@ zonefile=druz.db
 outfile=druz.pre
 dlvzone=utld.
 
-keyname1=`$KEYGEN -a DSA -b 768 -n zone $zone 2> /dev/null` 
+keyname1=`$KEYGEN -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone 2> /dev/null`
-keyname2=`$KEYGEN -f KSK -a DSA -b 768 -n zone $zone 2> /dev/null`
+keyname2=`$KEYGEN -f KSK -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone 2> /dev/null`
 
 cat $infile $keyname1.key $keyname2.key >$zonefile
 

bin/tests/system/dlv/ns3/sign.sh

@@ -26,8 +26,8 @@ zonefile=child1.utld.db
 outfile=child1.signed
 dlvsets="$dlvsets dlvset-`echo $zone |sed -e "s/.$//g"`$TP"
 
-keyname1=`$KEYGEN -a DSA -b 768 -n zone $zone 2> /dev/null` 
+keyname1=`$KEYGEN -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone 2> /dev/null`
-keyname2=`$KEYGEN -f KSK -a DSA -b 768 -n zone $zone 2> /dev/null`
+keyname2=`$KEYGEN -f KSK -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone 2> /dev/null`
 
 dsfilename=../ns6/dsset-grand.`echo $zone |sed -e "s/\.$//g"`$TP
 cat $infile $keyname1.key $keyname2.key $dsfilename >$zonefile
@@ -42,8 +42,8 @@ zonefile=child3.utld.db
 outfile=child3.signed
 dlvsets="$dlvsets dlvset-`echo $zone |sed -e "s/.$//g"`$TP"
 
-keyname1=`$KEYGEN -a DSA -b 768 -n zone $zone 2> /dev/null`
+keyname1=`$KEYGEN -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone 2> /dev/null`
-keyname2=`$KEYGEN -f KSK -a DSA -b 768 -n zone $zone 2> /dev/null`
+keyname2=`$KEYGEN -f KSK -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone 2> /dev/null`
 
 dsfilename=../ns6/dsset-grand.`echo $zone |sed -e "s/\.$//g"`$TP
 cat $infile $keyname1.key $keyname2.key $dsfilename >$zonefile
@@ -58,8 +58,8 @@ zonefile=child4.utld.db
 outfile=child4.signed
 dlvsets="$dlvsets dlvset-`echo $zone |sed -e "s/.$//g"`$TP"
 
-keyname1=`$KEYGEN -a DSA -b 768 -n zone $zone 2> /dev/null`
+keyname1=`$KEYGEN -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone 2> /dev/null`
-keyname2=`$KEYGEN -f KSK -a DSA -b 768 -n zone $zone 2> /dev/null`
+keyname2=`$KEYGEN -f KSK -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone 2> /dev/null`
 
 cat $infile $keyname1.key $keyname2.key >$zonefile
 
@@ -73,8 +73,8 @@ zonefile=child5.utld.db
 outfile=child5.signed
 dlvsets="$dlvsets dlvset-`echo $zone |sed -e "s/.$//g"`$TP"
 
-keyname1=`$KEYGEN -a DSA -b 768 -n zone $zone 2> /dev/null`
+keyname1=`$KEYGEN -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone 2> /dev/null`
-keyname2=`$KEYGEN -f KSK -a DSA -b 768 -n zone $zone 2> /dev/null`
+keyname2=`$KEYGEN -f KSK -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone 2> /dev/null`
 
 dsfilename=../ns6/dsset-grand.`echo $zone |sed -e "s/\.$//g"`$TP
 cat $infile $keyname1.key $keyname2.key $dsfilename >$zonefile
@@ -88,8 +88,8 @@ infile=child.db.in
 zonefile=child7.utld.db
 outfile=child7.signed
 
-keyname1=`$KEYGEN -a DSA -b 768 -n zone $zone 2> /dev/null`
+keyname1=`$KEYGEN -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone 2> /dev/null`
-keyname2=`$KEYGEN -f KSK -a DSA -b 768 -n zone $zone 2> /dev/null`
+keyname2=`$KEYGEN -f KSK -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone 2> /dev/null`
 
 dsfilename=../ns6/dsset-grand.`echo $zone |sed -e "s/\.$//g"`$TP
 cat $infile $keyname1.key $keyname2.key $dsfilename >$zonefile
@@ -103,8 +103,8 @@ infile=child.db.in
 zonefile=child8.utld.db
 outfile=child8.signed
 
-keyname1=`$KEYGEN -a DSA -b 768 -n zone $zone 2> /dev/null`
+keyname1=`$KEYGEN -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone 2> /dev/null`
-keyname2=`$KEYGEN -f KSK -a DSA -b 768 -n zone $zone 2> /dev/null`
+keyname2=`$KEYGEN -f KSK -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone 2> /dev/null`
 
 cat $infile $keyname1.key $keyname2.key >$zonefile
 
@@ -118,8 +118,8 @@ zonefile=child9.utld.db
 outfile=child9.signed
 dlvsets="$dlvsets dlvset-`echo $zone |sed -e "s/.$//g"`$TP"
 
-keyname1=`$KEYGEN -a DSA -b 768 -n zone $zone 2> /dev/null`
+keyname1=`$KEYGEN -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone 2> /dev/null`
-keyname2=`$KEYGEN -f KSK -a DSA -b 768 -n zone $zone 2> /dev/null`
+keyname2=`$KEYGEN -f KSK -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone 2> /dev/null`
 
 cat $infile $keyname1.key $keyname2.key >$zonefile
 
@@ -132,8 +132,8 @@ zonefile=child10.utld.db
 outfile=child10.signed
 dlvsets="$dlvsets dlvset-`echo $zone |sed -e "s/.$//g"`$TP"
 
-keyname1=`$KEYGEN -a DSA -b 768 -n zone $zone 2> /dev/null`
+keyname1=`$KEYGEN -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone 2> /dev/null`
-keyname2=`$KEYGEN -f KSK -a DSA -b 768 -n zone $zone 2> /dev/null`
+keyname2=`$KEYGEN -f KSK -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone 2> /dev/null`
 
 cat $infile $keyname1.key $keyname2.key >$zonefile
 
@@ -147,8 +147,8 @@ outfile=child1.druz.signed
 dlvsets="$dlvsets dlvset-`echo $zone |sed -e "s/.$//g"`$TP"
 dssets="$dssets dsset-`echo $zone |sed -e "s/.$//g"`$TP"
 
-keyname1=`$KEYGEN -a DSA -b 768 -n zone $zone 2> /dev/null` 
+keyname1=`$KEYGEN -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone 2> /dev/null`
-keyname2=`$KEYGEN -f KSK -a DSA -b 768 -n zone $zone 2> /dev/null`
+keyname2=`$KEYGEN -f KSK -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone 2> /dev/null`
 
 dsfilename=../ns6/dsset-grand.`echo $zone |sed -e "s/\.$//g"`$TP
 cat $infile $keyname1.key $keyname2.key $dsfilename >$zonefile
@@ -164,8 +164,8 @@ outfile=child3.druz.signed
 dlvsets="$dlvsets dlvset-`echo $zone |sed -e "s/.$//g"`$TP"
 dssets="$dssets dsset-`echo $zone |sed -e "s/.$//g"`$TP"
 
-keyname1=`$KEYGEN -a DSA -b 768 -n zone $zone 2> /dev/null`
+keyname1=`$KEYGEN -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone 2> /dev/null`
-keyname2=`$KEYGEN -f KSK -a DSA -b 768 -n zone $zone 2> /dev/null`
+keyname2=`$KEYGEN -f KSK -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone 2> /dev/null`
 
 dsfilename=../ns6/dsset-grand.`echo $zone |sed -e "s/\.$//g"`$TP
 cat $infile $keyname1.key $keyname2.key $dsfilename >$zonefile
@@ -181,8 +181,8 @@ outfile=child4.druz.signed
 dlvsets="$dlvsets dlvset-`echo $zone |sed -e "s/.$//g"`$TP"
 dssets="$dssets dsset-`echo $zone |sed -e "s/.$//g"`$TP"
 
-keyname1=`$KEYGEN -a DSA -b 768 -n zone $zone 2> /dev/null`
+keyname1=`$KEYGEN -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone 2> /dev/null`
-keyname2=`$KEYGEN -f KSK -a DSA -b 768 -n zone $zone 2> /dev/null`
+keyname2=`$KEYGEN -f KSK -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone 2> /dev/null`
 
 cat $infile $keyname1.key $keyname2.key >$zonefile
 
@@ -197,8 +197,8 @@ outfile=child5.druz.signed
 dlvsets="$dlvsets dlvset-`echo $zone |sed -e "s/.$//g"`$TP"
 dssets="$dssets dsset-`echo $zone |sed -e "s/.$//g"`$TP"
 
-keyname1=`$KEYGEN -a DSA -b 768 -n zone $zone 2> /dev/null`
+keyname1=`$KEYGEN -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone 2> /dev/null`
-keyname2=`$KEYGEN -f KSK -a DSA -b 768 -n zone $zone 2> /dev/null`
+keyname2=`$KEYGEN -f KSK -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone 2> /dev/null`
 
 dsfilename=../ns6/dsset-grand.`echo $zone |sed -e "s/\.$//g"`$TP
 cat $infile $keyname1.key $keyname2.key $dsfilename >$zonefile
@@ -213,8 +213,8 @@ zonefile=child7.druz.db
 outfile=child7.druz.signed
 dssets="$dssets dsset-`echo $zone |sed -e "s/.$//g"`$TP"
 
-keyname1=`$KEYGEN -a DSA -b 768 -n zone $zone 2> /dev/null`
+keyname1=`$KEYGEN -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone 2> /dev/null`
-keyname2=`$KEYGEN -f KSK -a DSA -b 768 -n zone $zone 2> /dev/null`
+keyname2=`$KEYGEN -f KSK -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone 2> /dev/null`
 
 dsfilename=../ns6/dsset-grand.`echo $zone |sed -e "s/\.$//g"`$TP
 cat $infile $keyname1.key $keyname2.key $dsfilename >$zonefile
@@ -228,8 +228,8 @@ infile=child.db.in
 zonefile=child8.druz.db
 outfile=child8.druz.signed
 
-keyname1=`$KEYGEN -a DSA -b 768 -n zone $zone 2> /dev/null`
+keyname1=`$KEYGEN -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone 2> /dev/null`
-keyname2=`$KEYGEN -f KSK -a DSA -b 768 -n zone $zone 2> /dev/null`
+keyname2=`$KEYGEN -f KSK -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone 2> /dev/null`
 
 cat $infile $keyname1.key $keyname2.key >$zonefile
 
@@ -243,8 +243,8 @@ zonefile=child9.druz.db
 outfile=child9.druz.signed
 dlvsets="$dlvsets dlvset-`echo $zone |sed -e "s/.$//g"`$TP"
 
-keyname1=`$KEYGEN -a DSA -b 768 -n zone $zone 2> /dev/null`
+keyname1=`$KEYGEN -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone 2> /dev/null`
-keyname2=`$KEYGEN -f KSK -a DSA -b 768 -n zone $zone 2> /dev/null`
+keyname2=`$KEYGEN -f KSK -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone 2> /dev/null`
 
 cat $infile $keyname1.key $keyname2.key >$zonefile
 
@@ -258,8 +258,8 @@ outfile=child10.druz.signed
 dlvsets="$dlvsets dlvset-`echo $zone |sed -e "s/.$//g"`$TP"
 dssets="$dssets dsset-`echo $zone |sed -e "s/.$//g"`$TP"
 
-keyname1=`$KEYGEN -a DSA -b 768 -n zone $zone 2> /dev/null`
+keyname1=`$KEYGEN -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone 2> /dev/null`
-keyname2=`$KEYGEN -f KSK -a DSA -b 768 -n zone $zone 2> /dev/null`
+keyname2=`$KEYGEN -f KSK -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone 2> /dev/null`
 
 cat $infile $keyname1.key $keyname2.key >$zonefile
 
@@ -272,8 +272,8 @@ infile=dlv.db.in
 zonefile=dlv.utld.db
 outfile=dlv.signed
 
-keyname1=`$KEYGEN -a DSA -b 768 -n zone $zone 2> /dev/null`
+keyname1=`$KEYGEN -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone 2> /dev/null`
-keyname2=`$KEYGEN -f KSK -a DSA -b 768 -n zone $zone 2> /dev/null`
+keyname2=`$KEYGEN -f KSK -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone 2> /dev/null`
 
 cat $infile $dlvsets $keyname1.key $keyname2.key >$zonefile
 

bin/tests/system/dlv/ns6/sign.sh

@@ -21,8 +21,8 @@ infile=child.db.in
 zonefile=grand.child1.utld.db
 outfile=grand.child1.signed
 
-keyname1=`$KEYGEN -a DSA -b 768 -n zone $zone 2> /dev/null`
+keyname1=`$KEYGEN -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone 2> /dev/null`
-keyname2=`$KEYGEN -f KSK -a DSA -b 768 -n zone $zone 2> /dev/null`
+keyname2=`$KEYGEN -f KSK -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone 2> /dev/null`
 
 cat $infile $keyname1.key $keyname2.key >$zonefile
 
@@ -36,8 +36,8 @@ zonefile=grand.child3.utld.db
 outfile=grand.child3.signed
 dlvzone=dlv.utld.
 
-keyname1=`$KEYGEN -a DSA -b 768 -n zone $zone 2> /dev/null`
+keyname1=`$KEYGEN -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone 2> /dev/null`
-keyname2=`$KEYGEN -f KSK -a DSA -b 768 -n zone $zone 2> /dev/null`
+keyname2=`$KEYGEN -f KSK -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone 2> /dev/null`
 
 cat $infile $keyname1.key $keyname2.key >$zonefile
 
@@ -51,8 +51,8 @@ zonefile=grand.child4.utld.db
 outfile=grand.child4.signed
 dlvzone=dlv.utld.
 
-keyname1=`$KEYGEN -a DSA -b 768 -n zone $zone 2> /dev/null`
+keyname1=`$KEYGEN -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone 2> /dev/null`
-keyname2=`$KEYGEN -f KSK -a DSA -b 768 -n zone $zone 2> /dev/null`
+keyname2=`$KEYGEN -f KSK -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone 2> /dev/null`
 
 cat $infile $keyname1.key $keyname2.key >$zonefile
 
@@ -66,8 +66,8 @@ zonefile=grand.child5.utld.db
 outfile=grand.child5.signed
 dlvzone=dlv.utld.
 
-keyname1=`$KEYGEN -a DSA -b 768 -n zone $zone 2> /dev/null`
+keyname1=`$KEYGEN -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone 2> /dev/null`
-keyname2=`$KEYGEN -f KSK -a DSA -b 768 -n zone $zone 2> /dev/null`
+keyname2=`$KEYGEN -f KSK -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone 2> /dev/null`
 
 cat $infile $keyname1.key $keyname2.key >$zonefile
 
@@ -81,8 +81,8 @@ zonefile=grand.child7.utld.db
 outfile=grand.child7.signed
 dlvzone=dlv.utld.
 
-keyname1=`$KEYGEN -a DSA -b 768 -n zone $zone 2> /dev/null`
+keyname1=`$KEYGEN -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone 2> /dev/null`
-keyname2=`$KEYGEN -f KSK -a DSA -b 768 -n zone $zone 2> /dev/null`
+keyname2=`$KEYGEN -f KSK -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone 2> /dev/null`
 
 cat $infile $keyname1.key $keyname2.key >$zonefile
 
@@ -96,8 +96,8 @@ zonefile=grand.child8.utld.db
 outfile=grand.child8.signed
 dlvzone=dlv.utld.
 
-keyname1=`$KEYGEN -a DSA -b 768 -n zone $zone 2> /dev/null`
+keyname1=`$KEYGEN -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone 2> /dev/null`
-keyname2=`$KEYGEN -f KSK -a DSA -b 768 -n zone $zone 2> /dev/null`
+keyname2=`$KEYGEN -f KSK -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone 2> /dev/null`
 
 cat $infile $keyname1.key $keyname2.key >$zonefile
 
@@ -111,8 +111,8 @@ zonefile=grand.child9.utld.db
 outfile=grand.child9.signed
 dlvzone=dlv.utld.
 
-keyname1=`$KEYGEN -a DSA -b 768 -n zone $zone 2> /dev/null`
+keyname1=`$KEYGEN -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone 2> /dev/null`
-keyname2=`$KEYGEN -f KSK -a DSA -b 768 -n zone $zone 2> /dev/null`
+keyname2=`$KEYGEN -f KSK -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone 2> /dev/null`
 
 cat $infile $keyname1.key $keyname2.key >$zonefile
 
@@ -125,8 +125,8 @@ zonefile=grand.child10.utld.db
 outfile=grand.child10.signed
 dlvzone=dlv.utld.
 
-keyname1=`$KEYGEN -a DSA -b 768 -n zone $zone 2> /dev/null`
+keyname1=`$KEYGEN -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone 2> /dev/null`
-keyname2=`$KEYGEN -f KSK -a DSA -b 768 -n zone $zone 2> /dev/null`
+keyname2=`$KEYGEN -f KSK -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone 2> /dev/null`
 
 cat $infile $keyname1.key $keyname2.key >$zonefile
 
@@ -138,8 +138,8 @@ infile=child.db.in
 zonefile=grand.child1.druz.db
 outfile=grand.child1.druz.signed
 
-keyname1=`$KEYGEN -a DSA -b 768 -n zone $zone 2> /dev/null`
+keyname1=`$KEYGEN -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone 2> /dev/null`
-keyname2=`$KEYGEN -f KSK -a DSA -b 768 -n zone $zone 2> /dev/null`
+keyname2=`$KEYGEN -f KSK -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone 2> /dev/null`
 
 cat $infile $keyname1.key $keyname2.key >$zonefile
 
@@ -153,8 +153,8 @@ zonefile=grand.child3.druz.db
 outfile=grand.child3.druz.signed
 dlvzone=dlv.druz.
 
-keyname1=`$KEYGEN -a DSA -b 768 -n zone $zone 2> /dev/null`
+keyname1=`$KEYGEN -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone 2> /dev/null`
-keyname2=`$KEYGEN -f KSK -a DSA -b 768 -n zone $zone 2> /dev/null`
+keyname2=`$KEYGEN -f KSK -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone 2> /dev/null`
 
 cat $infile $keyname1.key $keyname2.key >$zonefile
 
@@ -168,8 +168,8 @@ zonefile=grand.child4.druz.db
 outfile=grand.child4.druz.signed
 dlvzone=dlv.druz.
 
-keyname1=`$KEYGEN -a DSA -b 768 -n zone $zone 2> /dev/null`
+keyname1=`$KEYGEN -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone 2> /dev/null`
-keyname2=`$KEYGEN -f KSK -a DSA -b 768 -n zone $zone 2> /dev/null`
+keyname2=`$KEYGEN -f KSK -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone 2> /dev/null`
 
 cat $infile $keyname1.key $keyname2.key >$zonefile
 
@@ -183,8 +183,8 @@ zonefile=grand.child5.druz.db
 outfile=grand.child5.druz.signed
 dlvzone=dlv.druz.
 
-keyname1=`$KEYGEN -a DSA -b 768 -n zone $zone 2> /dev/null`
+keyname1=`$KEYGEN -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone 2> /dev/null`
-keyname2=`$KEYGEN -f KSK -a DSA -b 768 -n zone $zone 2> /dev/null`
+keyname2=`$KEYGEN -f KSK -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone 2> /dev/null`
 
 cat $infile $keyname1.key $keyname2.key >$zonefile
 
@@ -198,8 +198,8 @@ zonefile=grand.child7.druz.db
 outfile=grand.child7.druz.signed
 dlvzone=dlv.druz.
 
-keyname1=`$KEYGEN -a DSA -b 768 -n zone $zone 2> /dev/null`
+keyname1=`$KEYGEN -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone 2> /dev/null`
-keyname2=`$KEYGEN -f KSK -a DSA -b 768 -n zone $zone 2> /dev/null`
+keyname2=`$KEYGEN -f KSK -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone 2> /dev/null`
 
 cat $infile $keyname1.key $keyname2.key >$zonefile
 
@@ -213,8 +213,8 @@ zonefile=grand.child8.druz.db
 outfile=grand.child8.druz.signed
 dlvzone=dlv.druz.
 
-keyname1=`$KEYGEN -a DSA -b 768 -n zone $zone 2> /dev/null`
+keyname1=`$KEYGEN -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone 2> /dev/null`
-keyname2=`$KEYGEN -f KSK -a DSA -b 768 -n zone $zone 2> /dev/null`
+keyname2=`$KEYGEN -f KSK -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone 2> /dev/null`
 
 cat $infile $keyname1.key $keyname2.key >$zonefile
 
@@ -228,8 +228,8 @@ zonefile=grand.child9.druz.db
 outfile=grand.child9.druz.signed
 dlvzone=dlv.druz.
 
-keyname1=`$KEYGEN -a DSA -b 768 -n zone $zone 2> /dev/null`
+keyname1=`$KEYGEN -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone 2> /dev/null`
-keyname2=`$KEYGEN -f KSK -a DSA -b 768 -n zone $zone 2> /dev/null`
+keyname2=`$KEYGEN -f KSK -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone 2> /dev/null`
 
 cat $infile $keyname1.key $keyname2.key >$zonefile
 
@@ -242,8 +242,8 @@ zonefile=grand.child10.druz.db
 outfile=grand.child10.druz.signed
 dlvzone=dlv.druz.
 
-keyname1=`$KEYGEN -a DSA -b 768 -n zone $zone 2> /dev/null`
+keyname1=`$KEYGEN -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone 2> /dev/null`
-keyname2=`$KEYGEN -f KSK -a DSA -b 768 -n zone $zone 2> /dev/null`
+keyname2=`$KEYGEN -f KSK -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone 2> /dev/null`
 
 cat $infile $keyname1.key $keyname2.key >$zonefile
 

bin/tests/system/dnssec/ns2/sign.sh

@@ -29,8 +29,8 @@ do
 	cp ../ns3/dsset-$subdomain.example$TP .
 done
 
-keyname1=`$KEYGEN -q -a DSA -b 768 -n zone $zone`
+keyname1=`$KEYGEN -q -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone`
-keyname2=`$KEYGEN -q -a DSA -b 768 -n zone $zone`
+keyname2=`$KEYGEN -q -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone`
 
 cat $infile $keyname1.key $keyname2.key >$zonefile
 
@@ -89,8 +89,8 @@ zone=in-addr.arpa.
 infile=in-addr.arpa.db.in
 zonefile=in-addr.arpa.db
 
-keyname1=`$KEYGEN -q -a DSA -b 768 -n zone $zone`
+keyname1=`$KEYGEN -q -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone`
-keyname2=`$KEYGEN -q -a DSA -b 768 -n zone $zone`
+keyname2=`$KEYGEN -q -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone`
 
 cat $infile $keyname1.key $keyname2.key >$zonefile
 $SIGNER -P -g -o $zone -k $keyname1 $zonefile $keyname2 > /dev/null
@@ -127,8 +127,8 @@ zone=badparam.
 infile=badparam.db.in
 zonefile=badparam.db
 
-keyname1=`$KEYGEN -q -a RSASHA256 -b 1024 -n zone -f KSK $zone`
+keyname1=`$KEYGEN -q -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone -f KSK $zone`
-keyname2=`$KEYGEN -q -a RSASHA256 -b 1024 -n zone $zone`
+keyname2=`$KEYGEN -q -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone`
 
 cat $infile $keyname1.key $keyname2.key >$zonefile
 

bin/tests/system/dnssec/ns4/named5.conf.in

@@ -0,0 +1,38 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+// NS4
+
+options {
+	query-source address 10.53.0.4;
+	notify-source 10.53.0.4;
+	transfer-source 10.53.0.4;
+	port @PORT@;
+	pid-file "named.pid";
+	listen-on { 10.53.0.4; };
+	listen-on-v6 { none; };
+	bindkeys-file "managed.conf";
+	dnssec-enable no;
+};
+
+key rndc_key {
+	secret "1234abcd8765";
+	algorithm hmac-sha256;
+};
+
+controls {
+	inet 10.53.0.4 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
+};
+
+key auth {
+	secret "1234abcd8765";
+	algorithm hmac-sha256;
+};

bin/tests/system/dnssec/ns6/named.conf.in

@@ -21,7 +21,7 @@ options {
 	listen-on-v6 { none; };
 	recursion yes;
 	notify yes;
-	disable-algorithms . { DSA; };
+	disable-algorithms . { @DEFAULT_ALGORITHM@; };
 	dnssec-enable yes;
 	dnssec-validation yes;
 	dnssec-lookaside . trust-anchor dlv;

bin/tests/system/dnssec/tests.sh

@@ -147,10 +147,10 @@ status=`expr $status + $ret`
 
 if [ -x ${DELV} ] ; then
    ret=0
-   echo_i "checking postive validation NSEC using dns_client ($n)"
+   echo_i "checking positive validation NSEC using dns_client ($n)"
    $DELV $DELVOPTS @10.53.0.4 a a.example > delv.out$n || ret=1
    grep "a.example..*10.0.0.1" delv.out$n > /dev/null || ret=1
-   grep "a.example..*.RRSIG.A 3 2 300 .*" delv.out$n > /dev/null || ret=1
+   grep "a.example..*.RRSIG.A $DEFAULT_ALGORITHM_NUMBER 2 300 .*" delv.out$n > /dev/null || ret=1
    n=`expr $n + 1`
    if [ $ret != 0 ]; then echo_i "failed"; fi
    status=`expr $status + $ret`
@@ -222,7 +222,7 @@ if [ -x ${DELV} ] ; then
    echo_i "checking positive wildcard validation NSEC using dns_client ($n)"
    $DELV $DELVOPTS @10.53.0.4 a a.wild.example > delv.out$n || ret=1
    grep "a.wild.example..*10.0.0.27" delv.out$n > /dev/null || ret=1
-   grep "a.wild.example..*RRSIG.A 3 2 300.*" delv.out$n > /dev/null || ret=1
+   grep -E "a.wild.example..*RRSIG.A [0-9]+ 2 300.*" delv.out$n > /dev/null || ret=1
    n=`expr $n + 1`
    if [ $ret != 0 ]; then echo_i "failed"; fi
    status=`expr $status + $ret`
@@ -1190,7 +1190,7 @@ n=`expr $n + 1`
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
 
-echo_i "checking that lookups succeed after disabling a algorithm works ($n)"
+echo_i "checking that lookups succeed after disabling an algorithm ($n)"
 ret=0
 $DIG $DIGOPTS +noauth example. SOA @10.53.0.2 \
 	> dig.out.ns2.test$n || ret=1
@@ -2997,11 +2997,11 @@ echo_i "check dig's +nocrypto flag ($n)"
 ret=0
 $DIG $DIGOPTS +norec +nocrypto DNSKEY . \
 	@10.53.0.1 > dig.out.dnskey.ns1.test$n || ret=1
-grep '256 3 1 \[key id = [1-9][0-9]*]' dig.out.dnskey.ns1.test$n > /dev/null || ret=1
+grep -E '256 [0-9]+ 1 \[key id = [1-9][0-9]*]' dig.out.dnskey.ns1.test$n > /dev/null || ret=1
-grep 'RRSIG.* \[omitted]' dig.out.dnskey.ns1.test$n > /dev/null || ret=1
+grep -E 'RRSIG.* \[omitted]' dig.out.dnskey.ns1.test$n > /dev/null || ret=1
 $DIG $DIGOPTS +norec +nocrypto DS example \
 	@10.53.0.1 > dig.out.ds.ns1.test$n || ret=1
-grep 'DS.* 3 [12] \[omitted]' dig.out.ds.ns1.test$n > /dev/null || ret=1
+grep -E 'DS.* [0-9]+ [12] \[omitted]' dig.out.ds.ns1.test$n > /dev/null || ret=1
 n=`expr $n + 1`
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
@@ -3137,12 +3137,8 @@ do
 	2) # Diffie Helman
 	   alg=`expr $alg + 1`
 	   continue;;
-	3) # DSA/SHA1
-	   size="-b 512";;
 	5) # RSA/SHA-1
 	   size="-b 1024";;
-	6) # DSA-NSEC3-SHA1
-	   size="-b 512";;
 	7) # RSASHA1-NSEC3-SHA1
 	   size="-b 1024";;
 	8) # RSA/SHA-256
@@ -3573,5 +3569,20 @@ n=`expr $n + 1`
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
 
+# Note: after this check, ns4 will not be validating any more; do not add any
+# further validation tests employing ns4 below this check.
+echo_i "check that validation defaults to off when dnssec-enable is off ($n)"
+ret=0
+# Sanity check - validation should be enabled.
+$RNDCCMD 10.53.0.4 validation status | grep "enabled" > /dev/null || ret=1
+# Set "dnssec-enable" to "no" and reconfigure.
+copy_setports ns4/named5.conf.in ns4/named.conf
+$RNDCCMD 10.53.0.4 reconfig 2>&1 | sed 's/^/ns4 /' | cat_i
+# Check validation status again.
+$RNDCCMD 10.53.0.4 validation status | grep "disabled" > /dev/null || ret=1
+n=`expr $n + 1`
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=`expr $status + $ret`
+
 echo_i "exit status: $status"
 [ $status -eq 0 ] || exit 1

bin/tests/system/dnstap/clean.sh

@@ -23,3 +23,4 @@ rm -f ns*/dnstap.out.save.?
 rm -f ns*/named.lock
 rm -f ydump.out
 rm -f ns*/managed-keys.bind*
+rm -f ns2/example.db ns2/example.db.jnl

bin/tests/system/dnstap/setup.sh

@@ -17,3 +17,5 @@ copy_setports ns1/named.conf.in ns1/named.conf
 copy_setports ns2/named.conf.in ns2/named.conf
 copy_setports ns3/named.conf.in ns3/named.conf
 copy_setports ns4/named.conf.in ns4/named.conf
+
+cp ns2/example.db.in ns2/example.db

bin/tests/system/dnstap/tests.sh

@@ -55,6 +55,14 @@ $RNDCCMD -s 10.53.0.4 dnstap -reopen | sed 's/^/ns4 /' | cat_i
 
 $DIG $DIGOPTS @10.53.0.3 a.example > dig.out
 
+# send an UPDATE to ns2
+$NSUPDATE <<- EOF
+server 10.53.0.2 ${PORT}
+zone example
+update add b.example 3600 in a 10.10.10.10
+send
+EOF
+
 # XXX: file output should be flushed once a second according
 # to the libfstrm source, but it doesn't seem to happen until
 # enough data has accumulated. to get all the output, we stop
@@ -75,6 +83,8 @@ cq1=`$DNSTAPREAD ns1/dnstap.out.save | grep "CQ " | wc -l`
 cr1=`$DNSTAPREAD ns1/dnstap.out.save | grep "CR " | wc -l`
 rq1=`$DNSTAPREAD ns1/dnstap.out.save | grep "RQ " | wc -l`
 rr1=`$DNSTAPREAD ns1/dnstap.out.save | grep "RR " | wc -l`
+uq1=`$DNSTAPREAD ns1/dnstap.out.save | grep "UQ " | wc -l`
+ur1=`$DNSTAPREAD ns1/dnstap.out.save | grep "UR " | wc -l`
 
 udp2=`$DNSTAPREAD ns2/dnstap.out.save | grep "UDP " | wc -l`
 tcp2=`$DNSTAPREAD ns2/dnstap.out.save | grep "TCP " | wc -l`
@@ -84,6 +94,8 @@ cq2=`$DNSTAPREAD ns2/dnstap.out.save | grep "CQ " | wc -l`
 cr2=`$DNSTAPREAD ns2/dnstap.out.save | grep "CR " | wc -l`
 rq2=`$DNSTAPREAD ns2/dnstap.out.save | grep "RQ " | wc -l`
 rr2=`$DNSTAPREAD ns2/dnstap.out.save | grep "RR " | wc -l`
+uq2=`$DNSTAPREAD ns2/dnstap.out.save | grep "UQ " | wc -l`
+ur2=`$DNSTAPREAD ns2/dnstap.out.save | grep "UR " | wc -l`
 
 mv ns3/dnstap.out.0 ns3/dnstap.out.save
 udp3=`$DNSTAPREAD ns3/dnstap.out.save | grep "UDP " | wc -l`
@@ -94,6 +106,8 @@ cq3=`$DNSTAPREAD ns3/dnstap.out.save | grep "CQ " | wc -l`
 cr3=`$DNSTAPREAD ns3/dnstap.out.save | grep "CR " | wc -l`
 rq3=`$DNSTAPREAD ns3/dnstap.out.save | grep "RQ " | wc -l`
 rr3=`$DNSTAPREAD ns3/dnstap.out.save | grep "RR " | wc -l`
+uq3=`$DNSTAPREAD ns3/dnstap.out.save | grep "UQ " | wc -l`
+ur3=`$DNSTAPREAD ns3/dnstap.out.save | grep "UR " | wc -l`
 
 echo_i "checking UDP message counts"
 ret=0
@@ -231,6 +245,40 @@ ret=0
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
 
+echo_i "checking UPDATE_QUERY message counts"
+ret=0
+[ $uq1 -eq 0 ] || {
+	echo_i "ns1 $uq1 expected 0"
+	ret=1
+}
+[ $uq2 -eq 0 ] || {
+	echo_i "ns2 $uq2 expected 0"
+	ret=1
+}
+[ $uq3 -eq 0 ] || {
+	echo_i "ns3 $uq3 expected 0"
+	ret=1
+}
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=`expr $status + $ret`
+
+echo_i "checking UPDATE_RESPONSE message counts"
+ret=0
+[ $ur1 -eq 0 ] || {
+	echo_i "ns1 $ur1 expected 0"
+	ret=1
+}
+[ $ur2 -eq 0 ] || {
+	echo_i "ns2 $ur2 expected 0"
+	ret=1
+}
+[ $ur3 -eq 0 ] || {
+	echo_i "ns3 $ur3 expected 0"
+	ret=1
+}
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=`expr $status + $ret`
+
 echo_i "checking reopened message counts"
 
 udp1=`$DNSTAPREAD ns1/dnstap.out | grep "UDP " | wc -l`
@@ -241,6 +289,8 @@ cq1=`$DNSTAPREAD ns1/dnstap.out | grep "CQ " | wc -l`
 cr1=`$DNSTAPREAD ns1/dnstap.out | grep "CR " | wc -l`
 rq1=`$DNSTAPREAD ns1/dnstap.out | grep "RQ " | wc -l`
 rr1=`$DNSTAPREAD ns1/dnstap.out | grep "RR " | wc -l`
+uq1=`$DNSTAPREAD ns1/dnstap.out | grep "UQ " | wc -l`
+ur1=`$DNSTAPREAD ns1/dnstap.out | grep "UR " | wc -l`
 
 udp2=`$DNSTAPREAD ns2/dnstap.out | grep "UDP " | wc -l`
 tcp2=`$DNSTAPREAD ns2/dnstap.out | grep "TCP " | wc -l`
@@ -250,6 +300,8 @@ cq2=`$DNSTAPREAD ns2/dnstap.out | grep "CQ " | wc -l`
 cr2=`$DNSTAPREAD ns2/dnstap.out | grep "CR " | wc -l`
 rq2=`$DNSTAPREAD ns2/dnstap.out | grep "RQ " | wc -l`
 rr2=`$DNSTAPREAD ns2/dnstap.out | grep "RR " | wc -l`
+uq2=`$DNSTAPREAD ns2/dnstap.out | grep "UQ " | wc -l`
+ur2=`$DNSTAPREAD ns2/dnstap.out | grep "UR " | wc -l`
 
 udp3=`$DNSTAPREAD ns3/dnstap.out | grep "UDP " | wc -l`
 tcp3=`$DNSTAPREAD ns3/dnstap.out | grep "TCP " | wc -l`
@@ -259,6 +311,8 @@ cq3=`$DNSTAPREAD ns3/dnstap.out | grep "CQ " | wc -l`
 cr3=`$DNSTAPREAD ns3/dnstap.out | grep "CR " | wc -l`
 rq3=`$DNSTAPREAD ns3/dnstap.out | grep "RQ " | wc -l`
 rr3=`$DNSTAPREAD ns3/dnstap.out | grep "RR " | wc -l`
+uq3=`$DNSTAPREAD ns3/dnstap.out | grep "UQ " | wc -l`
+ur3=`$DNSTAPREAD ns3/dnstap.out | grep "UR " | wc -l`
 
 echo_i "checking UDP message counts"
 ret=0
@@ -266,8 +320,8 @@ ret=0
 	echo_i "ns1 $udp1 expected 0"
 	ret=1
 }
-[ $udp2 -eq 0 ] || {
+[ $udp2 -eq 2 ] || {
-	echo_i "ns2 $udp2 expected 0"
+	echo_i "ns2 $udp2 expected 2"
 	ret=1
 }
 [ $udp3 -eq 2 ] || {
@@ -396,6 +450,41 @@ ret=0
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
 
+echo_i "checking UPDATE_QUERY message counts"
+ret=0
+[ $uq1 -eq 0 ] || {
+	echo_i "ns1 $uq1 expected 0"
+	ret=1
+}
+[ $uq2 -eq 1 ] || {
+	echo_i "ns2 $uq2 expected 1"
+	ret=1
+}
+[ $uq3 -eq 0 ] || {
+	echo_i "ns3 $uq3 expected 0"
+	ret=1
+}
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=`expr $status + $ret`
+
+echo_i "checking UPDATE_RESPONSE message counts"
+ret=0
+[ $ur1 -eq 0 ] || {
+	echo_i "ns1 $ur1 expected 0"
+	ret=1
+}
+[ $ur2 -eq 1 ] || {
+	echo_i "ns2 $ur2 expected 1"
+	ret=1
+}
+[ $ur3 -eq 0 ] || {
+	echo_i "ns3 $ur3 expected 0"
+	ret=1
+}
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=`expr $status + $ret`
+
+
 HAS_PYYAML=0
 if [ -n "$PYTHON" ] ; then
 	$PYTHON -c "import yaml" 2> /dev/null && HAS_PYYAML=1
@@ -423,6 +512,15 @@ status=`expr $status + $ret`
 if [ -n "$FSTRM_CAPTURE" ] ; then
 	$DIG $DIGOPTS @10.53.0.4 a.example > dig.out
 
+	# send an UPDATE to ns4
+	$NSUPDATE <<- EOF > nsupdate.out 2>&1
+	server 10.53.0.4 ${PORT}
+	zone example
+	update add b.example 3600 in a 10.10.10.10
+	send
+EOF
+	grep "update failed: NOTAUTH" nsupdate.out > /dev/null || ret=1
+
 	echo_i "checking unix socket message counts"
 	sleep 2
 	kill $fstrm_capture_pid
@@ -435,11 +533,13 @@ if [ -n "$FSTRM_CAPTURE" ] ; then
 	cr4=`$DNSTAPREAD dnstap.out | grep "CR " | wc -l`
 	rq4=`$DNSTAPREAD dnstap.out | grep "RQ " | wc -l`
 	rr4=`$DNSTAPREAD dnstap.out | grep "RR " | wc -l`
+	uq4=`$DNSTAPREAD dnstap.out | grep "UQ " | wc -l`
+	ur4=`$DNSTAPREAD dnstap.out | grep "UR " | wc -l`
 
 	echo_i "checking UDP message counts"
 	ret=0
-	[ $udp4 -eq 2 ] || {
+	[ $udp4 -eq 4 ] || {
-		echo_i "ns4 $udp4 expected 2"
+		echo_i "ns4 $udp4 expected 4"
 		ret=1
 	}
 	if [ $ret != 0 ]; then echo_i "failed"; fi
@@ -505,7 +605,27 @@ if [ -n "$FSTRM_CAPTURE" ] ; then
 		echo_i "ns4 $rr4 expected 0"
 		ret=1
 	}
+
+	echo_i "checking UPDATE_QUERY message counts"
+	ret=0
+	[ $uq4 -eq 1 ] || {
+		echo_i "ns4 $uq4 expected 1"
+		ret=1
+	}
+	if [ $ret != 0 ]; then echo_i "failed"; fi
+	status=`expr $status + $ret`
+
+	echo_i "checking UPDATE_RESPONSE message counts"
+	ret=0
+	[ $ur4 -eq 1 ] || {
+		echo_i "ns4 $ur4 expected 1"
+		ret=1
+	}
+	if [ $ret != 0 ]; then echo_i "failed"; fi
+	status=`expr $status + $ret`
+
 	mv dnstap.out dnstap.out.save
+
 	$FSTRM_CAPTURE -t protobuf:dnstap.Dnstap -u ns4/dnstap.out \
 		-w dnstap.out > fstrm_capture.out 2>&1 &
 	fstrm_capture_pid=$!
@@ -524,6 +644,8 @@ if [ -n "$FSTRM_CAPTURE" ] ; then
 	cr4=`$DNSTAPREAD dnstap.out | grep "CR " | wc -l`
 	rq4=`$DNSTAPREAD dnstap.out | grep "RQ " | wc -l`
 	rr4=`$DNSTAPREAD dnstap.out | grep "RR " | wc -l`
+	uq4=`$DNSTAPREAD dnstap.out | grep "UQ " | wc -l`
+	ur4=`$DNSTAPREAD dnstap.out | grep "UR " | wc -l`
 
 	echo_i "checking UDP message counts"
 	ret=0
@@ -594,6 +716,24 @@ if [ -n "$FSTRM_CAPTURE" ] ; then
 		echo_i "ns4 $rr4 expected 0"
 		ret=1
 	}
+
+	echo_i "checking UPDATE_QUERY message counts"
+	ret=0
+	[ $uq4 -eq 0 ] || {
+		echo_i "ns4 $uq4 expected 0"
+		ret=1
+	}
+	if [ $ret != 0 ]; then echo_i "failed"; fi
+	status=`expr $status + $ret`
+
+	echo_i "checking UPDATE_RESPONSE message counts"
+	ret=0
+	[ $ur4 -eq 0 ] || {
+		echo_i "ns4 $ur4 expected 0"
+		ret=1
+	}
+	if [ $ret != 0 ]; then echo_i "failed"; fi
+	status=`expr $status + $ret`
 fi
 
 echo_i "exit status: $status"

bin/tests/system/dyndb/driver/db.c

@@ -220,14 +220,15 @@ find(dns_db_t *db, const dns_name_t *name, dns_dbversion_t *version,
 static isc_result_t
 findzonecut(dns_db_t *db, const dns_name_t *name, unsigned int options,
 	    isc_stdtime_t now, dns_dbnode_t **nodep, dns_name_t *foundname,
-	    dns_rdataset_t *rdataset, dns_rdataset_t *sigrdataset)
+	    dns_name_t *dcname, dns_rdataset_t *rdataset,
+	    dns_rdataset_t *sigrdataset)
 {
 	sampledb_t *sampledb = (sampledb_t *) db;
 
 	REQUIRE(VALID_SAMPLEDB(sampledb));
 
 	return (dns_db_findzonecut(sampledb->rbtdb, name, options,
-				   now, nodep, foundname, rdataset,
+				   now, nodep, foundname, dcname, rdataset,
 				   sigrdataset));
 }
 

bin/tests/system/feature-test.c

@@ -175,7 +175,7 @@ main(int argc, char **argv) {
 		int s;
 		int n = -1;
 		int v6only = -1;
-		ISC_SOCKADDR_LEN_T len = sizeof(v6only);
+		socklen_t len = sizeof(v6only);
 
 		s = socket(AF_INET6, SOCK_DGRAM, IPPROTO_UDP);
 		if (s >= 0) {

bin/tests/system/fetchlimit/tests.sh

@@ -157,7 +157,7 @@ status=`expr $status + $ret`
 copy_setports ns3/named3.conf.in ns3/named.conf
 $RNDCCMD reconfig 2>&1 | sed 's/^/ns3 /' | cat_i
 
-echo_i "checking lame server clients are dropped at the soft limit"
+echo_i "checking lame server clients are dropped near the soft limit"
 ret=0
 fail=0
 exceeded=0
@@ -166,7 +166,7 @@ touch ans4/norespond
 for try in 1 2 3 4 5; do
     burst b $try 400
     $DIG @10.53.0.3 -p ${PORT}  a ${try}.example > dig.out.ns3.$try
-    stat 360 || exceeded=`expr $exceeded + 1`
+    stat 370 || exceeded=`expr $exceeded + 1`
     grep "status: NOERROR" dig.out.ns3.$try > /dev/null 2>&1 && \
             success=`expr $success + 1`
     grep "status: SERVFAIL" dig.out.ns3.$try > /dev/null 2>&1 && \
@@ -177,7 +177,7 @@ echo_i "$success successful valid queries (expected 5)"
 [ "$success" -eq 5 ] || { echo_i "failed"; ret=1; }
 echo_i "$fail SERVFAIL responses (expected 0)"
 [ "$fail" -eq 0 ] || { echo_i "failed"; ret=1; }
-echo_i "clients count exceeded 360 on $exceeded trials (expected 0)"
+echo_i "clients count exceeded 370 on $exceeded trials (expected 0)"
 [ "$exceeded" -eq 0 ] || { echo_i "failed"; ret=1; }
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`

bin/tests/system/filter-aaaa/ns1/sign.sh

@@ -21,8 +21,8 @@ infile=signed.db.in
 zonefile=signed.db.signed
 outfile=signed.db.signed
 
-keyname1=`$KEYGEN -a DSA -b 768 -n zone $zone 2> /dev/null`
+keyname1=`$KEYGEN -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone 2> /dev/null`
-keyname2=`$KEYGEN -f KSK -a DSA -b 768 -n zone $zone 2> /dev/null`
+keyname2=`$KEYGEN -f KSK -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone 2> /dev/null`
 
 cat $infile $keyname1.key $keyname2.key >$zonefile
 

bin/tests/system/filter-aaaa/ns4/sign.sh

@@ -21,8 +21,8 @@ infile=signed.db.in
 zonefile=signed.db.signed
 outfile=signed.db.signed
 
-keyname1=`$KEYGEN -a DSA -b 768 -n zone $zone 2> /dev/null`
+keyname1=`$KEYGEN -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone 2> /dev/null`
-keyname2=`$KEYGEN -f KSK -a DSA -b 768 -n zone $zone 2> /dev/null`
+keyname2=`$KEYGEN -f KSK -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone 2> /dev/null`
 
 cat $infile $keyname1.key $keyname2.key >$zonefile
 

bin/tests/system/ifconfig.sh

@@ -12,10 +12,10 @@
 #
 # Set up interface aliases for bind9 system tests.
 #
-# IPv4: 10.53.0.{1..8}				RFC 1918
+# IPv4: 10.53.0.{1..10}				RFC 1918
 #       10.53.1.{0..2}
 #       10.53.2.{0..2}
-# IPv6: fd92:7065:b8e:ffff::{1..8}		ULA
+# IPv6: fd92:7065:b8e:ffff::{1..10}		ULA
 #       fd92:7065:b8e:99ff::{1..2}
 #       fd92:7065:b8e:ff::{1..2}
 #
@@ -65,7 +65,7 @@ case "$1" in
 		  2) ipv6="00" ;;
 		  *) ipv6="" ;;
 		esac
-		for ns in 1 2 3 4 5 6 7 8
+		for ns in 1 2 3 4 5 6 7 8 9 10
 		do
 			[ $i -gt 0 -a $ns -gt 2 ] && break
 			int=`expr $i \* 10 + $ns`
@@ -171,7 +171,7 @@ case "$1" in
 		  2) ipv6="00" ;;
 		  *) ipv6="" ;;
 		esac
-		for ns in 8 7 6 5 4 3 2 1
+		for ns in 10 9 8 7 6 5 4 3 2 1
 		do
 			[ $i -gt 0 -a $ns -gt 2 ] && continue
 			int=`expr $i \* 10 + $ns - 1`

bin/tests/system/inline/.gitignore

@@ -1 +0,0 @@
-checkdsa.sh

bin/tests/system/inline/clean.sh

@@ -118,7 +118,7 @@ rm -f ns3/test-?.bk
 rm -f ns3/test-?.bk.signed
 rm -f ns3/test-?.bk.signed.jnl
 rm -f import.key Kimport*
-rm -f checkdsa checkecdsa
+rm -f checkecdsa
 rm -f ns3/a-file
 rm -f ns*/named.lock
 rm -f dig.out.*

bin/tests/system/inline/ns3/sign.sh

@@ -133,24 +133,8 @@ zone=externalkey
 rm -f K${zone}.+*+*.key
 rm -f K${zone}.+*+*.private
 
-for alg in ECDSAP256SHA256 NSEC3RSASHA1 DSA
+for alg in ECDSAP256SHA256 NSEC3RSASHA1
 do
-    case $alg in
-        DSA)
-            $SHELL ../checkdsa.sh 2> /dev/null || continue
-            checkfile=../checkdsa
-            touch $checkfile ;;
-        ECDSAP256SHA256)
-            fail=0
-            $KEYGEN -q -a ecdsap256sha256 test > /dev/null 2>&1 || fail=1
-            rm -f Ktest*
-            [ $fail != 0 ] && continue
-            $SHELL ../checkdsa.sh 2> /dev/null || continue
-            checkfile=../checkecdsa
-            touch $checkfile ;;
-        *) ;;
-    esac
-
     k1=`$KEYGEN -q -a $alg -b 1024 -n zone -f KSK $zone`
     k2=`$KEYGEN -q -a $alg -b 1024 -n zone $zone`
     k3=`$KEYGEN -q -a $alg -b 1024 -n zone $zone`
@@ -161,9 +145,9 @@ do
     rm -f $k1.private 
     mv $k1.key a-file
     $IMPORTKEY -P now -D now+3600 -f a-file $zone > /dev/null 2>&1 ||
-        ( echo "importkey failed: $alg"; rm -f $checkfile )
+        ( echo "importkey failed: $alg" )
     rm -f $k2.private 
     mv $k2.key a-file
     $IMPORTKEY -f a-file $zone > /dev/null 2>&1 ||
-        ( echo "importkey failed: $alg"; rm -f $checkfile )
+        ( echo "importkey failed: $alg" )
 done

bin/tests/system/inline/tests.sh

@@ -945,13 +945,11 @@ n=`expr $n + 1`
 echo_i "testing adding external keys to a inline zone ($n)"
 ret=0
 $DIG $DIGOPTS @10.53.0.3 dnskey externalkey > dig.out.ns3.test$n
-for alg in 3 7 13
+for alg in 7 13
 do
-   [ $alg = 3 -a ! -f checkdsa ] && continue;
    [ $alg = 13 -a ! -f checkecdsa ] && continue;
 
    case $alg in
-   3) echo_i "checking DSA";;
    7) echo_i "checking NSEC3RSASHA1";;
    13) echo_i "checking ECDSAP256SHA256";;
    *) echo_i "checking $alg";;

bin/tests/system/keymgr/policy.good

@@ -134,12 +134,12 @@ algorithm policy RSASHA1:
 	zsk_standby None
 	keyttl None
 
-algorithm policy DSA:
+algorithm policy RSASHA256:
 	inherits None
 	directory None
-	algorithm DSA
+	algorithm RSASHA256
 	coverage None
-	ksk_keysize 1024
+	ksk_keysize 2048
 	zsk_keysize 2048
 	ksk_rollperiod None
 	zsk_rollperiod None
@@ -151,6 +151,23 @@ algorithm policy DSA:
 	zsk_standby None
 	keyttl None
 
+algorithm policy ECDSAP256SHA256:
+	inherits None
+	directory None
+	algorithm ECDSAP256SHA256
+	coverage None
+	ksk_keysize None
+	zsk_keysize None
+	ksk_rollperiod None
+	zsk_rollperiod None
+	ksk_prepublish None
+	ksk_postpublish None
+	zsk_prepublish None
+	zsk_postpublish None
+	ksk_standby None
+	zsk_standby None
+	keyttl None
+
 policy extra:
 	inherits default
 	directory None

bin/tests/system/keymgr/testpolicy.py

@@ -31,7 +31,8 @@ if len(sys.argv) > 0:
 
         # print algorithm policies
         print(pp.alg_policy['RSASHA1'])
-        print(pp.alg_policy['DSA'])
+        print(pp.alg_policy['RSASHA256'])
+        print(pp.alg_policy['ECDSAP256SHA256'])
 
         # print another named policy
         print(pp.named_policy['extra'])

bin/tests/system/legacy/clean.sh

@@ -8,9 +8,9 @@
 # information regarding copyright ownership.
 
 rm -f dig.out.*
-rm -f ns?/named.conf
+rm -f ns*/named.conf
-rm -f ns?/named.memstats
+rm -f ns*/named.memstats
-rm -f ns?/named.run
+rm -f ns*/named.run
 rm -f ns*/named.lock
 
 # build.sh

bin/tests/system/legacy/ns1/root.db

@@ -23,3 +23,9 @@ edns512.		NS	ns.edns512.
 ns.edns512.		A	10.53.0.6
 edns512-notcp.		NS	ns.edns512-notcp.
 ns.edns512-notcp.	A	10.53.0.7
+ednsformerr.		NS	ns.ednsformerr.
+ns.ednsformerr.		A	10.53.0.8
+ednsnotimp.		NS	ns.ednsnotimp.
+ns.ednsnotimp.		A	10.53.0.9
+ednsrefused.		NS	ns.ednsrefused.
+ns.ednsrefused.		A	10.53.0.10

bin/tests/system/legacy/ns10/ednsrefused.db

@@ -0,0 +1,12 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0. If a copy of the MPL was not distributed with this
+; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+@	60	SOA	ns marka.isc.org. 1 0 0 0 0
+@	60	NS	ns
+ns	60	A	10.53.0.8

bin/tests/system/legacy/ns10/named.conf.in

@@ -0,0 +1,27 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+options {
+	query-source address 10.53.0.10;
+	notify-source 10.53.0.10;
+	transfer-source 10.53.0.10;
+	port @PORT@;
+	pid-file "named.pid";
+	listen-on { 10.53.0.10; };
+	listen-on-v6 { none; };
+	recursion no;
+	dnssec-validation no;
+};
+
+zone "ednsrefused" {
+	type master;
+	file "ednsrefused.db";
+};

bin/tests/system/legacy/ns10/named.ednsrefused

@@ -0,0 +1 @@
+ednsrefused

bin/tests/system/legacy/ns8/ednsformerr.db

@@ -0,0 +1,12 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0. If a copy of the MPL was not distributed with this
+; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+@	60	SOA	ns marka.isc.org. 1 0 0 0 0
+@	60	NS	ns
+ns	60	A	10.53.0.8

bin/tests/system/legacy/ns8/named.conf.in

@@ -0,0 +1,27 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+options {
+	query-source address 10.53.0.8;
+	notify-source 10.53.0.8;
+	transfer-source 10.53.0.8;
+	port @PORT@;
+	pid-file "named.pid";
+	listen-on { 10.53.0.8; };
+	listen-on-v6 { none; };
+	recursion no;
+	dnssec-validation no;
+};
+
+zone "ednsformerr" {
+	type master;
+	file "ednsformerr.db";
+};

bin/tests/system/legacy/ns8/named.ednsformerr

@@ -0,0 +1 @@
+ednsformerr

bin/tests/system/legacy/ns9/ednsnotimp.db

@@ -0,0 +1,12 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0. If a copy of the MPL was not distributed with this
+; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+@	60	SOA	ns marka.isc.org. 1 0 0 0 0
+@	60	NS	ns
+ns	60	A	10.53.0.8

bin/tests/system/legacy/ns9/named.conf.in

@@ -0,0 +1,27 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+options {
+	query-source address 10.53.0.9;
+	notify-source 10.53.0.9;
+	transfer-source 10.53.0.9;
+	port @PORT@;
+	pid-file "named.pid";
+	listen-on { 10.53.0.9; };
+	listen-on-v6 { none; };
+	recursion no;
+	dnssec-validation no;
+};
+
+zone "ednsnotimp" {
+	type master;
+	file "ednsnotimp.db";
+};

bin/tests/system/legacy/ns9/named.ednsnotimp

@@ -0,0 +1 @@
+ednsnotimp

bin/tests/system/legacy/setup.sh

@@ -15,10 +15,12 @@ SYSTEMTESTTOP=..
 $SHELL clean.sh
 
 copy_setports ns1/named1.conf.in ns1/named.conf
-
 copy_setports ns2/named.conf.in ns2/named.conf
 copy_setports ns3/named.conf.in ns3/named.conf
 copy_setports ns4/named.conf.in ns4/named.conf
 copy_setports ns5/named.conf.in ns5/named.conf
 copy_setports ns6/named.conf.in ns6/named.conf
 copy_setports ns7/named.conf.in ns7/named.conf
+copy_setports ns8/named.conf.in ns8/named.conf
+copy_setports ns9/named.conf.in ns9/named.conf
+copy_setports ns10/named.conf.in ns10/named.conf

bin/tests/system/legacy/tests.sh

@@ -17,6 +17,60 @@ DIGOPTS="-p ${PORT}"
 status=0
 n=0
 
+n=`expr $n + 1`
+echo_i "checking formerr edns server setup ($n)"
+ret=0
+$DIG $DIGOPTS +edns @10.53.0.8 ednsformerr soa > dig.out.1.test$n || ret=1
+grep "status: FORMERR" dig.out.1.test$n > /dev/null || ret=1
+$DIG $DIGOPTS +noedns @10.53.0.8 ednsformerr soa > dig.out.2.test$n || ret=1
+grep "status: NOERROR" dig.out.2.test$n > /dev/null || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=`expr $status + $ret`
+
+n=`expr $n + 1`
+echo_i "checking recursive lookup to formerr edns server succeeds ($n)"
+ret=0
+$DIG $DIGOPTS +tcp @10.53.0.1 ednsformerr soa > dig.out.test$n || ret=1
+grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=`expr $status + $ret`
+
+n=`expr $n + 1`
+echo_i "checking notimp edns server setup ($n)"
+ret=0
+$DIG $DIGOPTS +edns @10.53.0.9 ednsnotimp soa > dig.out.1.test$n || ret=1
+grep "status: NOTIMP" dig.out.1.test$n > /dev/null || ret=1
+$DIG $DIGOPTS +noedns @10.53.0.9 ednsnotimp soa > dig.out.2.test$n || ret=1
+grep "status: NOERROR" dig.out.2.test$n > /dev/null || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=`expr $status + $ret`
+
+n=`expr $n + 1`
+echo_i "checking recursive lookup to notimp edns server fails ($n)"
+ret=0
+$DIG $DIGOPTS +tcp @10.53.0.1 ednsnotimp soa > dig.out.test$n
+grep "status: NOERROR" dig.out.test$n > /dev/null && ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=`expr $status + $ret`
+
+n=`expr $n + 1`
+echo_i "checking refused edns server setup ($n)"
+ret=0
+$DIG $DIGOPTS +edns @10.53.0.10 ednsrefused soa > dig.out.1.test$n || ret=1
+grep "status: REFUSED" dig.out.1.test$n > /dev/null || ret=1
+$DIG $DIGOPTS +noedns @10.53.0.10 ednsrefused soa > dig.out.2.test$n || ret=1
+grep "status: NOERROR" dig.out.2.test$n > /dev/null || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=`expr $status + $ret`
+
+n=`expr $n + 1`
+echo_i "checking recursive lookup to refused edns server fails ($n)"
+ret=0
+$DIG $DIGOPTS +tcp @10.53.0.1 ednsrefused soa > dig.out.test$n
+grep "status: NOERROR" dig.out.test$n > /dev/null && ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=`expr $status + $ret`
+
 n=`expr $n + 1`
 echo_i "checking drop edns server setup ($n)"
 ret=0
@@ -34,10 +88,10 @@ if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
 
 n=`expr $n + 1`
-echo_i "checking recursive lookup to drop edns server succeeds ($n)"
+echo_i "checking recursive lookup to drop edns server fails ($n)"
 ret=0
-$DIG $DIGOPTS +tcp @10.53.0.1 dropedns soa > dig.out.test$n || ret=1
+$DIG $DIGOPTS +tcp @10.53.0.1 dropedns soa > dig.out.test$n
-grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
+grep "status: NOERROR" dig.out.test$n > /dev/null && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
 
@@ -55,10 +109,10 @@ if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
 
 n=`expr $n + 1`
-echo_i "checking recursive lookup to drop edns + no tcp server succeeds ($n)"
+echo_i "checking recursive lookup to drop edns + no tcp server fails ($n)"
 ret=0
-$DIG $DIGOPTS +tcp @10.53.0.1 dropedns-notcp soa > dig.out.test$n || ret=1
+$DIG $DIGOPTS +tcp @10.53.0.1 dropedns-notcp soa > dig.out.test$n
-grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
+grep "status: NOERROR" dig.out.test$n > /dev/null && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
 
@@ -135,10 +189,10 @@ if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
 
 n=`expr $n + 1`
-echo_i "checking recursive lookup to edns 512 + no tcp server succeeds ($n)"
+echo_i "checking recursive lookup to edns 512 + no tcp server fails ($n)"
 ret=0
 $DIG $DIGOPTS +tcp @10.53.0.1 edns512-notcp soa > dig.out.test$n || ret=1
-grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
+grep "status: NOERROR" dig.out.test$n > /dev/null && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
 

bin/tests/system/nsupdate/clean.sh

@@ -40,6 +40,18 @@ rm -f ns3/nsec3param.test.db
 rm -f ns3/too-big.test.db
 rm -f ns5/local.db
 rm -f ns6/in-addr.db
+rm -f ns7/in-addr.db
+rm -f ns7/example.com.db
+rm -f ns7/_default.tsigkeys
+rm -f ns8/in-addr.db
+rm -f ns8/example.com.db
+rm -f ns8/_default.tsigkeys
+rm -f ns9/in-addr.db
+rm -f ns9/example.com.db
+rm -f ns9/_default.tsigkeys
+rm -f ns10/example.com.db
+rm -f ns10/in-addr.db
+rm -f ns10/_default.tsigkeys
 rm -f nsupdate.out*
 rm -f typelist.out.*
 rm -f ns1/sample.db

bin/tests/system/nsupdate/krb/setup.sh

@@ -0,0 +1,113 @@
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+set -x
+
+PWD=`pwd`
+
+KRB5_CONFIG="${PWD}/krb5.conf"
+export KRB5_CONFIG
+
+KRB5_KDC_PROFILE=${PWD}/krb5kdc
+export KRB5_KDC_PROFILE
+
+now=`date +%s`
+lifetime=`expr 2147483647 - $now`
+lifetime=`expr $lifetime / 3600 / 24 - 30`
+
+cat << EOF > "${KRB5_CONFIG}"
+[libdefaults]
+   default_realm = EXAMPLE.COM
+   dns_lookup_kdc = false
+   # Depending on what you are testing, you may want something like:
+   # default_keytab_name = FILE:/usr/local/var/keytab
+[realms]
+   EXAMPLE.COM = {
+     admin_server = 127.0.0.1:50001
+     kdc = 127.0.0.1:50000
+     database_module = DB2
+     kdc_ports = 50000
+     kadmind_port = 50001
+   }
+[dbmodules]
+   DB2 = {
+     db_library = db2
+   }
+[logging]
+   # Use any pathnames you want here.
+   kdc = FILE:${PWD}/kdc.log
+   admin_server = FILE:${PWD}/kadmin.log
+# Depending on what you are testing, you may want:
+# [domain_realm]
+#   your.domain = EXAMPLE.COM
+EOF
+
+rm -rf ${KRB5_KDC_PROFILE}
+mkdir -p ${KRB5_KDC_PROFILE}
+chmod 700 ${KRB5_KDC_PROFILE}
+
+cat << EOF > "${KRB5_KDC_PROFILE}"/kdc.conf
+[kdcdefaults]
+  kdc_ports = 50000
+  kdc_tcp_ports = 50000
+
+[realms]
+  EXAMPLE.COM = {
+    key_stash_file = ${KRB5_KDC_PROFILE}/.k5.EXAMPLE.COM
+    database_module = EXAMPLE.COM
+    max_life = ${lifetime}d
+}
+
+[dbmodules]
+  EXAMPLE.COM = {
+    db_library = db2
+    database_name = ${KRB5_KDC_PROFILE}/principal
+  }
+EOF
+
+kdb5_util create -s <<EOF
+master
+master
+EOF
+
+krb5kdc -n &
+krb5kdcpid=$!
+#trap "kill $krb5kdcpid; wait; trap 0; exit" 0 15
+
+
+kadmin.local addprinc -maxlife ${lifetime}d -randkey DNS/ns7.example.com@EXAMPLE.COM
+kadmin.local addprinc -maxlife ${lifetime}d -randkey DNS/ns8.example.com@EXAMPLE.COM
+kadmin.local addprinc -maxlife ${lifetime}d -randkey host/machine.example.com@EXAMPLE.COM
+
+kadmin.local ktadd -k ns7-server.keytab DNS/ns7.example.com@EXAMPLE.COM
+kadmin.local ktadd -k ns8-server.keytab DNS/ns8.example.com@EXAMPLE.COM
+kadmin.local ktadd -k krb5-machine.keytab host/machine.example.com@EXAMPLE.COM
+
+kadmin.local addprinc -maxlife ${lifetime}d -randkey 'DNS/ns9.example.com@EXAMPLE.COM'
+kadmin.local addprinc -maxlife ${lifetime}d -randkey 'DNS/ns10.example.com@EXAMPLE.COM'
+kadmin.local addprinc -maxlife ${lifetime}d -randkey 'machine$@EXAMPLE.COM'
+
+kadmin.local ktadd -k ns9-server.keytab 'DNS/ns9.example.com@EXAMPLE.COM'
+kadmin.local ktadd -k ns10-server.keytab 'DNS/ns10.example.com@EXAMPLE.COM'
+kadmin.local ktadd -k ms-machine.keytab 'machine$@EXAMPLE.COM'
+
+kinit -V -k -t krb5-machine.keytab -l ${lifetime}d -c krb5-machine.ccache host/machine.example.com@EXAMPLE.COM
+kinit -V -k -t ms-machine.keytab -l ${lifetime}d -c ms-machine.ccache 'machine$@EXAMPLE.COM'
+
+cp ns7-server.keytab ../ns7/dns.keytab
+cp ns8-server.keytab ../ns8/dns.keytab
+cp ns9-server.keytab ../ns9/dns.keytab
+cp ns10-server.keytab ../ns10/dns.keytab
+
+cp krb5-machine.ccache ../ns7/machine.ccache
+cp krb5-machine.ccache ../ns8/machine.ccache
+cp ms-machine.ccache ../ns9/machine.ccache
+cp ms-machine.ccache ../ns10/machine.ccache
+
+echo krb5kdc pid:$krb5kdcpid