experiment

retry fix
slight refactoring in validated()
2025-02-26 16:01:01 -08:00 · 2025-02-26 16:01:01 -08:00 · 2025-02-26 15:28:57 -08:00 · 2025-02-26 15:28:57 -08:00 · 2025-02-26 20:34:27 +00:00 · 2025-02-25 21:29:19 -08:00
186 changed files with 2303 additions and 7086 deletions
@@ -1036,12 +1036,13 @@ unit:gcc:ossl3:amd64:
      artifacts: true

 # Jobs for regular GCC builds on Debian "sid" (amd64)
+# Also tests configration option: --without-lmdb.

 gcc:sid:amd64:
  variables:
    CC: gcc
    CFLAGS: "${CFLAGS_COMMON} -O3"
-    EXTRA_CONFIGURE: "--with-libidn2 ${WITH_READLINE}"
+    EXTRA_CONFIGURE: "--with-libidn2 --without-lmdb ${WITH_READLINE}"
    RUN_MAKE_INSTALL: 1
  <<: *debian_sid_amd64_image
  <<: *build_job
@@ -1062,13 +1063,14 @@ unit:gcc:sid:amd64:
      artifacts: true

 # Job for out-of-tree GCC build on Debian 12 "bookworm" (amd64)
+# Also tests configration option: --with-lmdb.

 gcc:out-of-tree:
  variables:
    CC: gcc
    CFLAGS: "${CFLAGS_COMMON} -Og"
    CONFIGURE: "${CI_PROJECT_DIR}/configure"
-    EXTRA_CONFIGURE: "--with-libidn2"
+    EXTRA_CONFIGURE: "--with-libidn2 --with-lmdb"
    RUN_MAKE_INSTALL: 1
    OUT_OF_TREE_WORKSPACE: workspace
  <<: *base_image
@@ -655,7 +655,7 @@ load_zone(isc_mem_t *mctx, const char *zonename, const char *filename,
 	isc_buffer_constinit(&buffer, zonename, strlen(zonename));
 	isc_buffer_add(&buffer, strlen(zonename));
 	origin = dns_fixedname_initname(&fixorigin);
-	CHECK(dns_name_fromtext(origin, &buffer, dns_rootname, 0, NULL));
+	CHECK(dns_name_fromtext(origin, &buffer, dns_rootname, 0));
 	dns_zone_setorigin(zone, origin);
 	dns_zone_setdbtype(zone, 1, (const char *const *)dbtype);
 	if (strcmp(filename, "-") == 0) {
@@ -597,7 +597,7 @@ convert_name(dns_fixedname_t *fn, dns_name_t **name, const char *text) {
 	isc_buffer_add(&b, len);
 	n = dns_fixedname_initname(fn);

-	result = dns_name_fromtext(n, &b, dns_rootname, 0, NULL);
+	result = dns_name_fromtext(n, &b, dns_rootname, 0);
 	if (result != ISC_R_SUCCESS) {
 		delv_log(ISC_LOG_ERROR, "failed to convert name %s: %s", text,
 			 isc_result_totext(result));
@@ -593,7 +593,7 @@ short_answer(dns_message_t *msg, dns_messagetextflag_t flags, isc_buffer_t *buf,

 	UNUSED(flags);

-	dns_name_init(&empty_name, NULL);
+	dns_name_init(&empty_name);
 	result = dns_message_firstname(msg, DNS_SECTION_ANSWER);
 	if (result == ISC_R_NOMORE) {
 		return ISC_R_SUCCESS;
@@ -635,9 +635,7 @@ static bool
 isdotlocal(dns_message_t *msg) {
 	isc_result_t result;
 	static unsigned char local_ndata[] = { "\005local" };
-	static unsigned char local_offsets[] = { 0, 6 };
-	static dns_name_t local = DNS_NAME_INITABSOLUTE(local_ndata,
-							local_offsets);
+	static dns_name_t local = DNS_NAME_INITABSOLUTE(local_ndata);

 	for (result = dns_message_firstname(msg, DNS_SECTION_QUESTION);
 	     result == ISC_R_SUCCESS;
@@ -858,14 +858,14 @@ requeue_lookup(dig_lookup_t *lookold, bool servers) {
 void
 setup_text_key(void) {
 	isc_result_t result;
-	dns_name_t keyname;
+	dns_fixedname_t fkey;
+	dns_name_t *keyname = dns_fixedname_initname(&fkey);
 	isc_buffer_t secretbuf;
 	unsigned int secretsize;
 	unsigned char *secretstore;

 	debug("setup_text_key()");
 	isc_buffer_allocate(mctx, &namebuf, MXNAME);
-	dns_name_init(&keyname, NULL);
 	isc_buffer_putstr(namebuf, keynametext);
 	secretsize = (unsigned int)strlen(keysecret) * 3 / 4;
 	secretstore = isc_mem_allocate(mctx, secretsize);
@@ -882,12 +882,12 @@ setup_text_key(void) {
 		goto failure;
 	}

-	result = dns_name_fromtext(&keyname, namebuf, dns_rootname, 0, namebuf);
+	result = dns_name_fromtext(keyname, namebuf, dns_rootname, 0);
 	if (result != ISC_R_SUCCESS) {
 		goto failure;
 	}

-	result = dns_tsigkey_create(&keyname, hmac_alg, secretstore,
+	result = dns_tsigkey_create(keyname, hmac_alg, secretstore,
 				    (int)secretsize, mctx, &tsigkey);
 failure:
 	if (result != ISC_R_SUCCESS) {
@@ -898,7 +898,6 @@ failure:
 	}

 	isc_mem_free(mctx, secretstore);
-	dns_name_invalidate(&keyname);
 	isc_buffer_free(&namebuf);
 }

@@ -2082,8 +2081,8 @@ insert_soa(dig_lookup_t *lookup) {
 	soa.common.rdclass = lookup->rdclass;
 	soa.common.rdtype = dns_rdatatype_soa;

-	dns_name_init(&soa.origin, NULL);
-	dns_name_init(&soa.contact, NULL);
+	dns_name_init(&soa.origin);
+	dns_name_init(&soa.contact);

 	dns_name_clone(dns_rootname, &soa.origin);
 	dns_name_clone(dns_rootname, &soa.contact);
@@ -2206,11 +2205,6 @@ setup_lookup(dig_lookup_t *lookup) {
 	}
 	dns_message_gettempname(lookup->sendmsg, &lookup->name);

-	isc_buffer_init(&lookup->namebuf, lookup->name_space,
-			sizeof(lookup->name_space));
-	isc_buffer_init(&lookup->onamebuf, lookup->oname_space,
-			sizeof(lookup->oname_space));
-
 	/*
 	 * We cannot convert `textname' and `origin' separately.
 	 * `textname' doesn't contain TLD, but local mapping needs
@@ -2258,8 +2252,7 @@ setup_lookup(dig_lookup_t *lookup) {
 		len = (unsigned int)strlen(origin);
 		isc_buffer_init(&b, origin, len);
 		isc_buffer_add(&b, len);
-		result = dns_name_fromtext(lookup->oname, &b, dns_rootname, 0,
-					   &lookup->onamebuf);
+		result = dns_name_fromtext(lookup->oname, &b, dns_rootname, 0);
 		if (result != ISC_R_SUCCESS) {
 			dns_message_puttempname(lookup->sendmsg, &lookup->name);
 			dns_message_puttempname(lookup->sendmsg,
@@ -2277,12 +2270,12 @@ setup_lookup(dig_lookup_t *lookup) {
 			len = (unsigned int)strlen(textname);
 			isc_buffer_init(&b, textname, len);
 			isc_buffer_add(&b, len);
-			result = dns_name_fromtext(name, &b, NULL, 0, NULL);
+			result = dns_name_fromtext(name, &b, NULL, 0);
 			if (result == ISC_R_SUCCESS) {
 				if (!dns_name_isabsolute(name)) {
 					result = dns_name_concatenate(
 						name, lookup->oname,
-						lookup->name, &lookup->namebuf);
+						lookup->name);
 				} else {
 					dns_name_copy(name, lookup->name);
 				}
@@ -2310,8 +2303,7 @@ setup_lookup(dig_lookup_t *lookup) {
 			isc_buffer_init(&b, textname, len);
 			isc_buffer_add(&b, len);
 			result = dns_name_fromtext(lookup->name, &b,
-						   dns_rootname, 0,
-						   &lookup->namebuf);
+						   dns_rootname, 0);
 			if (result != ISC_R_SUCCESS) {
 				dns_message_puttempname(lookup->sendmsg,
 							&lookup->name);
@@ -131,8 +131,6 @@ struct dig_lookup {
 	bool rdclassset;
 	char name_space[BUFSIZE];
 	char oname_space[BUFSIZE];
-	isc_buffer_t namebuf;
-	isc_buffer_t onamebuf;
 	isc_buffer_t renderbuf;
 	char *sendspace;
 	dns_name_t *name;
@@ -221,7 +221,7 @@ printsection(dns_message_t *msg, dns_section_t sectionid,
 		printf(";; %s SECTION:\n", section_name);
 	}

-	dns_name_init(&empty_name, NULL);
+	dns_name_init(&empty_name);

 	result = dns_message_firstname(msg, sectionid);
 	if (result == ISC_R_NOMORE) {
@@ -178,7 +178,7 @@ initname(char *setname) {

 	isc_buffer_init(&buf, setname, strlen(setname));
 	isc_buffer_add(&buf, strlen(setname));
-	result = dns_name_fromtext(name, &buf, dns_rootname, 0, NULL);
+	result = dns_name_fromtext(name, &buf, dns_rootname, 0);
 	if (result != ISC_R_SUCCESS) {
 		fatal("could not initialize name %s", setname);
 	}
@@ -67,7 +67,7 @@ initname(char *setname) {

 	isc_buffer_init(&buf, setname, strlen(setname));
 	isc_buffer_add(&buf, strlen(setname));
-	result = dns_name_fromtext(name, &buf, dns_rootname, 0, NULL);
+	result = dns_name_fromtext(name, &buf, dns_rootname, 0);
 	return result;
 }

@@ -69,7 +69,7 @@ initname(char *setname) {

 	isc_buffer_init(&buf, setname, strlen(setname));
 	isc_buffer_add(&buf, strlen(setname));
-	result = dns_name_fromtext(name, &buf, dns_rootname, 0, NULL);
+	result = dns_name_fromtext(name, &buf, dns_rootname, 0);
 	return result;
 }

@@ -367,7 +367,7 @@ main(int argc, char **argv) {
 		isc_buffer_init(&buf, argv[isc_commandline_index],
 				strlen(argv[isc_commandline_index]));
 		isc_buffer_add(&buf, strlen(argv[isc_commandline_index]));
-		ret = dns_name_fromtext(name, &buf, dns_rootname, 0, NULL);
+		ret = dns_name_fromtext(name, &buf, dns_rootname, 0);
 		if (ret != ISC_R_SUCCESS) {
 			fatal("invalid key name %s: %s",
 			      argv[isc_commandline_index],
@@ -277,7 +277,7 @@ keygen(keygen_ctx_t *ctx, isc_mem_t *mctx, int argc, char **argv) {
 		isc_buffer_init(&buf, argv[isc_commandline_index],
 				strlen(argv[isc_commandline_index]));
 		isc_buffer_add(&buf, strlen(argv[isc_commandline_index]));
-		ret = dns_name_fromtext(name, &buf, dns_rootname, 0, NULL);
+		ret = dns_name_fromtext(name, &buf, dns_rootname, 0);
 		if (ret != ISC_R_SUCCESS) {
 			fatal("invalid key name %s: %s",
 			      argv[isc_commandline_index],
@@ -1008,7 +1008,7 @@ parse_dnskey(isc_lex_t *lex, char *owner, isc_buffer_t *buf, dns_ttl_t *ttl) {
 	dname = dns_fixedname_initname(&dfname);
 	isc_buffer_init(&b, owner, strlen(owner));
 	isc_buffer_add(&b, strlen(owner));
-	ret = dns_name_fromtext(dname, &b, dns_rootname, 0, NULL);
+	ret = dns_name_fromtext(dname, &b, dns_rootname, 0);
 	if (ret != ISC_R_SUCCESS) {
 		return ret;
 	}
@@ -1455,7 +1455,7 @@ main(int argc, char *argv[]) {
 	name = dns_fixedname_initname(&fname);
 	isc_buffer_init(&buf, argv[1], strlen(argv[1]));
 	isc_buffer_add(&buf, strlen(argv[1]));
-	ret = dns_name_fromtext(name, &buf, dns_rootname, 0, NULL);
+	ret = dns_name_fromtext(name, &buf, dns_rootname, 0);
 	if (ret != ISC_R_SUCCESS) {
 		fatal("invalid zone name %s: %s", argv[1],
 		      isc_result_totext(ret));
@@ -552,7 +552,7 @@ signset(dns_diff_t *del, dns_diff_t *add, dns_dbnode_t *node, dns_name_t *name,
 		future = isc_serial_lt(now, rrsig.timesigned);

 		key = keythatsigned(&rrsig);
-		offline = key->pubkey;
+		offline = (key != NULL) ? key->pubkey : false;
 		sig_format(&rrsig, sigstr, sizeof(sigstr));
 		expired = isc_serial_gt(now, rrsig.timeexpire);
 		refresh = isc_serial_gt(now + cycle, rrsig.timeexpire);
@@ -959,7 +959,7 @@ addnowildcardhash(hashlist_t *l,

 	wild = dns_fixedname_initname(&fixed);

-	result = dns_name_concatenate(dns_wildcardname, name, wild, NULL);
+	result = dns_name_concatenate(dns_wildcardname, name, wild);
 	if (result == ISC_R_NOSPACE) {
 		return;
 	}
@@ -2034,7 +2034,7 @@ addnsec3(dns_name_t *name, dns_dbnode_t *node, const unsigned char *salt,
 	dns_fixedname_init(&hashname);
 	dns_rdataset_init(&rdataset);

-	dns_name_downcase(name, name, NULL);
+	dns_name_downcase(name, name);
 	result = dns_nsec3_hashname(&hashname, hash, &hash_len, name, gorigin,
 				    dns_hash_sha1, iterations, salt, salt_len);
 	check_result(result, "addnsec3: dns_nsec3_hashname()");
@@ -2402,7 +2402,7 @@ nsec3ify(unsigned int hashalg, dns_iterations_t iterations,
 			fatal("iterating through the database failed: %s",
 			      isc_result_totext(result));
 		}
-		dns_name_downcase(name, name, NULL);
+		dns_name_downcase(name, name);
 		hashlist_add_dns_name(hashlist, name, hashalg, iterations, salt,
 				      salt_len, false);
 		dns_db_detachnode(gdb, &node);
@@ -2412,7 +2412,7 @@ nsec3ify(unsigned int hashalg, dns_iterations_t iterations,
 		 * node for another <name,nextname> span so we don't add
 		 * it here.  Empty labels on nextname are within the span.
 		 */
-		dns_name_downcase(nextname, nextname, NULL);
+		dns_name_downcase(nextname, nextname);
 		dns_name_fullcompare(name, nextname, &order, &nlabels);
 		addnowildcardhash(hashlist, name, hashalg, iterations, salt,
 				  salt_len);
@@ -2579,7 +2579,7 @@ loadzone(char *file, char *origin, dns_rdataclass_t rdclass, dns_db_t **db) {
 	isc_buffer_add(&b, len);

 	name = dns_fixedname_initname(&fname);
-	result = dns_name_fromtext(name, &b, dns_rootname, 0, NULL);
+	result = dns_name_fromtext(name, &b, dns_rootname, 0);
 	if (result != ISC_R_SUCCESS) {
 		fatal("failed converting name '%s' to dns format: %s", origin,
 		      isc_result_totext(result));
@@ -105,7 +105,7 @@ loadzone(char *file, char *origin, dns_rdataclass_t rdclass, dns_db_t **db) {
 	isc_buffer_add(&b, len);

 	name = dns_fixedname_initname(&fname);
-	result = dns_name_fromtext(name, &b, dns_rootname, 0, NULL);
+	result = dns_name_fromtext(name, &b, dns_rootname, 0);
 	if (result != ISC_R_SUCCESS) {
 		fatal("failed converting name '%s' to dns format: %s", origin,
 		      isc_result_totext(result));
@@ -459,7 +459,7 @@ dns64_cname(const dns_name_t *zone, const dns_name_t *name, bdbnode_t *node) {

 static isc_result_t
 builtin_lookup(bdb_t *bdb, const dns_name_t *name, bdbnode_t *node) {
-	if (name->labels == 0 && name->length == 0) {
+	if (name->length == 0) {
 		return bdb->lookup(node);
 	} else if ((node->bdb->implementation->flags & BDB_DNS64) != 0) {
 		return dns64_cname(&bdb->common.origin, name, node);
@@ -839,7 +839,7 @@ getoriginnode(dns_db_t *db, dns_dbnode_t **nodep DNS__DB_FLARG) {
 	REQUIRE(VALID_BDB(bdb));
 	REQUIRE(nodep != NULL && *nodep == NULL);

-	dns_name_init(&relname, NULL);
+	dns_name_init(&relname);
 	name = &relname;

 	result = createnode(bdb, &node);
@@ -881,7 +881,7 @@ findnode(dns_db_t *db, const dns_name_t *name, bool create,
 	isorigin = dns_name_equal(name, &bdb->common.origin);

 	labels = dns_name_countlabels(name) - dns_name_countlabels(&db->origin);
-	dns_name_init(&relname, NULL);
+	dns_name_init(&relname);
 	dns_name_getlabelsequence(name, 0, labels, &relname);
 	name = &relname;

@@ -1197,8 +1197,8 @@ create(isc_mem_t *mctx, const dns_name_t *origin, dns_dbtype_t type,

 	isc_refcount_init(&bdb->common.references, 1);
 	isc_mem_attach(mctx, &bdb->common.mctx);
-	dns_name_init(&bdb->common.origin, NULL);
-	dns_name_dupwithoffsets(origin, mctx, &bdb->common.origin);
+	dns_name_init(&bdb->common.origin);
+	dns_name_dup(origin, mctx, &bdb->common.origin);

 	INSIST(argc >= 1);
 	if (strcmp(argv[0], "authors") == 0) {
@@ -161,9 +161,11 @@ options {\n\
 	fetch-quota-params 100 0.1 0.3 0.7;\n\
 	fetches-per-server 0;\n\
 	fetches-per-zone 0;\n\
-	lame-ttl 0;\n\
-	lmdb-mapsize 32M;\n\
-	max-cache-size 90%;\n\
+	lame-ttl 0;\n"
+#ifdef HAVE_LMDB
+			    "	lmdb-mapsize 32M;\n"
+#endif /* ifdef HAVE_LMDB */
+			    "	max-cache-size 90%;\n\
 	max-cache-ttl 604800; /* 1 week */\n\
 	max-clients-per-query 100;\n\
 	max-ncache-ttl 10800; /* 3 hours */\n\
@@ -549,14 +551,14 @@ named_config_getname(isc_mem_t *mctx, const cfg_obj_t *obj,
 	}

 	*namep = isc_mem_get(mctx, sizeof(**namep));
-	dns_name_init(*namep, NULL);
+	dns_name_init(*namep);

 	objstr = cfg_obj_asstring(obj);
 	isc_buffer_constinit(&b, objstr, strlen(objstr));
 	isc_buffer_add(&b, strlen(objstr));
 	dns_fixedname_init(&fname);
 	result = dns_name_fromtext(dns_fixedname_name(&fname), &b, dns_rootname,
-				   0, NULL);
+				   0);
 	if (result != ISC_R_SUCCESS) {
 		isc_mem_put(mctx, *namep, sizeof(**namep));
 		*namep = NULL;
@@ -26,7 +26,6 @@

 #include <isc/attributes.h>
 #include <isc/backtrace.h>
-#include <isc/cfgmgr.h>
 #include <isc/commandline.h>
 #include <isc/crypto.h>
 #include <isc/dir.h>
@@ -1276,8 +1275,6 @@ setup(void) {
 				      isc_result_totext(result));
 	}

-	REQUIRE(isc_cfgmgr_init(named_g_mctx, "/tmp/cfgmgr") == ISC_R_SUCCESS);
-
 	named_server_create(named_g_mctx, &named_g_server);
 	ENSURE(named_g_server != NULL);
 	sctx = named_g_server->sctx;
@@ -1345,8 +1342,6 @@ cleanup(void) {

 	named_server_destroy(&named_g_server);

-	isc_cfgmgr_deinit();
-
 	named_builtin_deinit();

 	/*
@@ -35,7 +35,6 @@
 #include <isc/async.h>
 #include <isc/attributes.h>
 #include <isc/base64.h>
-#include <isc/cfgmgr.h>
 #include <isc/commandline.h>
 #include <isc/dir.h>
 #include <isc/file.h>
@@ -46,7 +45,6 @@
 #include <isc/httpd.h>
 #include <isc/job.h>
 #include <isc/lex.h>
-#include <isc/lmdb.h>
 #include <isc/loop.h>
 #include <isc/meminfo.h>
 #include <isc/netmgr.h>
@@ -151,7 +149,14 @@
 #define JEMALLOC_API_SUPPORTED 1
 #endif

+#ifdef HAVE_LMDB
 #include <lmdb.h>
+#define configure_newzones configure_newzones_db
+#define dumpzone	   dumpzone_db
+#else /* HAVE_LMDB */
+#define configure_newzones configure_newzones_file
+#define dumpzone	   dumpzone_file
+#endif /* HAVE_LMDB */

 #ifndef SIZE_MAX
 #define SIZE_MAX ((size_t)-1)
@@ -523,6 +528,7 @@ putuint8(isc_buffer_t **b, uint8_t val);
 static isc_result_t
 putnull(isc_buffer_t **b);

+#ifdef HAVE_LMDB
 static isc_result_t
 nzd_writable(dns_view_t *view);

@@ -537,6 +543,10 @@ nzd_env_close(dns_view_t *view);

 static isc_result_t
 nzd_close(MDB_txn **txnp, bool commit);
+#else  /* ifdef HAVE_LMDB */
+static isc_result_t
+nzf_append(dns_view_t *view, const cfg_obj_t *zconfig);
+#endif /* ifdef HAVE_LMDB */

 static isc_result_t
 load_nzf(dns_view_t *view, ns_cfgctx_t *nzcfg);
@@ -654,7 +664,7 @@ configure_view_nametable(const cfg_obj_t *vconfig, const cfg_obj_t *config,
 		str = cfg_obj_asstring(nameobj);
 		isc_buffer_constinit(&b, str, strlen(str));
 		isc_buffer_add(&b, strlen(str));
-		CHECK(dns_name_fromtext(name, &b, dns_rootname, 0, NULL));
+		CHECK(dns_name_fromtext(name, &b, dns_rootname, 0));
 		result = dns_nametree_add(*ntp, name, true);
 		if (result != ISC_R_SUCCESS) {
 			cfg_obj_log(nameobj, ISC_LOG_ERROR,
@@ -714,7 +724,7 @@ ta_fromconfig(const cfg_obj_t *key, bool *initialp, const char **namestrp,
 	name = dns_fixedname_initname(&fname);
 	isc_buffer_constinit(&namebuf, namestr, strlen(namestr));
 	isc_buffer_add(&namebuf, strlen(namestr));
-	CHECK(dns_name_fromtext(name, &namebuf, dns_rootname, 0, NULL));
+	CHECK(dns_name_fromtext(name, &namebuf, dns_rootname, 0));

 	if (*initialp) {
 		atstr = cfg_obj_asstring(cfg_tuple_get(key, "anchortype"));
@@ -903,7 +913,7 @@ process_key(const cfg_obj_t *key, dns_keytable_t *secroots,
 		isc_buffer_constinit(&b, namestr, strlen(namestr));
 		isc_buffer_add(&b, strlen(namestr));
 		keyname = dns_fixedname_initname(&fkeyname);
-		result = dns_name_fromtext(keyname, &b, dns_rootname, 0, NULL);
+		result = dns_name_fromtext(keyname, &b, dns_rootname, 0);
 		if (result != ISC_R_SUCCESS) {
 			return result;
 		}
@@ -1296,7 +1306,7 @@ configure_order(dns_order_t *order, const cfg_obj_t *ent) {
 	isc_buffer_add(&b, strlen(str));
 	dns_fixedname_init(&fixed);
 	result = dns_name_fromtext(dns_fixedname_name(&fixed), &b, dns_rootname,
-				   0, NULL);
+				   0);
 	if (result != ISC_R_SUCCESS) {
 		return result;
 	}
@@ -1581,7 +1591,7 @@ disable_algorithms(const cfg_obj_t *disabled, dns_resolver_t *resolver) {
 	str = cfg_obj_asstring(cfg_tuple_get(disabled, "name"));
 	isc_buffer_constinit(&b, str, strlen(str));
 	isc_buffer_add(&b, strlen(str));
-	CHECK(dns_name_fromtext(name, &b, dns_rootname, 0, NULL));
+	CHECK(dns_name_fromtext(name, &b, dns_rootname, 0));

 	algorithms = cfg_tuple_get(disabled, "algorithms");
 	for (element = cfg_list_first(algorithms); element != NULL;
@@ -1624,7 +1634,7 @@ disable_ds_digests(const cfg_obj_t *disabled, dns_resolver_t *resolver) {
 	str = cfg_obj_asstring(cfg_tuple_get(disabled, "name"));
 	isc_buffer_constinit(&b, str, strlen(str));
 	isc_buffer_add(&b, strlen(str));
-	CHECK(dns_name_fromtext(name, &b, dns_rootname, 0, NULL));
+	CHECK(dns_name_fromtext(name, &b, dns_rootname, 0));

 	digests = cfg_tuple_get(disabled, "digests");
 	for (element = cfg_list_first(digests); element != NULL;
@@ -1668,7 +1678,7 @@ on_disable_list(const cfg_obj_t *disablelist, dns_name_t *zonename) {
 		str = cfg_obj_asstring(value);
 		isc_buffer_constinit(&b, str, strlen(str));
 		isc_buffer_add(&b, strlen(str));
-		result = dns_name_fromtext(name, &b, dns_rootname, 0, NULL);
+		result = dns_name_fromtext(name, &b, dns_rootname, 0);
 		RUNTIME_CHECK(result == ISC_R_SUCCESS);
 		if (dns_name_equal(name, zonename)) {
 			return true;
@@ -1851,7 +1861,7 @@ dns64_reverse(dns_view_t *view, isc_mem_t *mctx, isc_netaddr_t *na,
 	name = dns_fixedname_initname(&fixed);
 	isc_buffer_constinit(&b, reverse, strlen(reverse));
 	isc_buffer_add(&b, strlen(reverse));
-	CHECK(dns_name_fromtext(name, &b, dns_rootname, 0, NULL));
+	CHECK(dns_name_fromtext(name, &b, dns_rootname, 0));
 	dns_zone_create(&zone, mctx, 0);
 	dns_zone_setorigin(zone, name);
 	dns_zone_setview(zone, view);
@@ -1860,9 +1870,9 @@ dns64_reverse(dns_view_t *view, isc_mem_t *mctx, isc_netaddr_t *na,
 	dns_zone_settype(zone, dns_zone_primary);
 	dns_zone_setstats(zone, named_g_server->zonestats);
 	dns_zone_setdbtype(zone, dns64_dbtypec, dns64_dbtype);
-//	if (view->queryacl != NULL) {
-//		dns_zone_setqueryacl(zone, view->queryacl);
-//	}
+	if (view->queryacl != NULL) {
+		dns_zone_setqueryacl(zone, view->queryacl);
+	}
 	if (view->queryonacl != NULL) {
 		dns_zone_setqueryonacl(zone, view->queryonacl);
 	}
@@ -2735,7 +2745,7 @@ configure_catz_zone(dns_view_t *view, dns_view_t *pview,
 	dns_name_t origin;
 	dns_catz_options_t *opts;

-	dns_name_init(&origin, NULL);
+	dns_name_init(&origin);
 	catz_obj = cfg_listelt_value(element);

 	str = cfg_obj_asstring(cfg_tuple_get(catz_obj, "zone name"));
@@ -3078,7 +3088,7 @@ add_ns(dns_db_t *db, dns_dbversion_t *version, const dns_name_t *name,
 	ns.common.rdtype = dns_rdatatype_ns;
 	ns.common.rdclass = dns_db_class(db);
 	ns.mctx = NULL;
-	dns_name_init(&ns.name, NULL);
+	dns_name_init(&ns.name);
 	dns_name_clone(nsname, &ns.name);
 	CHECK(dns_rdata_fromstruct(&rdata, dns_db_class(db), dns_rdatatype_ns,
 				   &ns, &b));
@@ -3240,11 +3250,11 @@ create_empty_zone(dns_zone_t *pzone, dns_name_t *name, dns_view_t *view,
 	dns_zone_setcheckdstype(zone, dns_checkdstype_no);
 	dns_zone_setnotifytype(zone, dns_notifytype_no);
 	dns_zone_setautomatic(zone, true);
-//	if (view->queryacl != NULL) {
-//		dns_zone_setqueryacl(zone, view->queryacl);
-//	} else {
-//		dns_zone_clearqueryacl(zone);
-//	}
+	if (view->queryacl != NULL) {
+		dns_zone_setqueryacl(zone, view->queryacl);
+	} else {
+		dns_zone_clearqueryacl(zone);
+	}
 	if (view->queryonacl != NULL) {
 		dns_zone_setqueryonacl(zone, view->queryonacl);
 	} else {
@@ -3343,11 +3353,11 @@ create_ipv4only_zone(dns_zone_t *pzone, dns_view_t *view,
 	} else {
 		dns_zone_attach(pzone, &zone);
 	}
-	//if (view->queryacl != NULL) {
-	//	dns_zone_setqueryacl(zone, view->queryacl);
-	//} else {
-	//	dns_zone_clearqueryacl(zone);
-	//}
+	if (view->queryacl != NULL) {
+		dns_zone_setqueryacl(zone, view->queryacl);
+	} else {
+		dns_zone_clearqueryacl(zone);
+	}
 	if (view->queryonacl != NULL) {
 		dns_zone_setqueryonacl(zone, view->queryonacl);
 	} else {
@@ -4908,11 +4918,8 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist, cfg_obj_t *config,
 	 */

 	/* named.conf only */
-	// CHECK(configure_view_acl(vconfig, config, NULL, "allow-query", NULL,
-	//			 actx, named_g_mctx, &view->queryacl));
-
-	CHECK(dns_acl_configure(named_g_mctx, "allow-query", &view->queryacl));
-	printf("---- view queryacl %p\n", view->queryacl);
+	CHECK(configure_view_acl(vconfig, config, NULL, "allow-query", NULL,
+				 actx, named_g_mctx, &view->queryacl));

 	/* named.conf only */
 	CHECK(configure_view_acl(vconfig, config, NULL, "allow-query-cache",
@@ -5038,15 +5045,13 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist, cfg_obj_t *config,
 	/*
 	 * Finished setting recursion and query-cache ACLs, so now we
 	 * can get the allow-query default if it wasn't set in named.conf
-	 *
-	 * Commented out as cfgmgr handle default internally.
-	 *
-	 * if (view->queryacl == NULL) {
-	 *	CHECK(configure_view_acl(NULL, NULL, named_g_config,
-	 *				 "allow-query", NULL, actx,
-	 *				 named_g_mctx, &view->queryacl));
-	 * }
 	 */
+	if (view->queryacl == NULL) {
+		/* global default only */
+		CHECK(configure_view_acl(NULL, NULL, named_g_config,
+					 "allow-query", NULL, actx,
+					 named_g_mctx, &view->queryacl));
+	}

 	/*
 	 * Ignore case when compressing responses to the specified
@@ -5871,8 +5876,8 @@ configure_alternates(const cfg_obj_t *config, dns_view_t *view,
 			isc_buffer_constinit(&buffer, str, strlen(str));
 			isc_buffer_add(&buffer, strlen(str));
 			name = dns_fixedname_initname(&fixed);
-			CHECK(dns_name_fromtext(name, &buffer, dns_rootname, 0,
-						NULL));
+			CHECK(dns_name_fromtext(name, &buffer, dns_rootname,
+						0));

 			portobj = cfg_tuple_get(alternate, "port");
 			if (cfg_obj_isuint32(portobj)) {
@@ -5927,7 +5932,7 @@ validate_tls(const cfg_obj_t *config, dns_view_t *view, const cfg_obj_t *obj,

 	if (name != NULL && *name == NULL) {
 		*name = isc_mem_get(view->mctx, sizeof(dns_name_t));
-		dns_name_init(*name, NULL);
+		dns_name_init(*name);
 		dns_name_dup(nm, view->mctx, *name);
 	}

@@ -6227,7 +6232,7 @@ configure_zone(const cfg_obj_t *config, const cfg_obj_t *zconfig,
 	isc_buffer_add(&buffer, strlen(zname));
 	dns_fixedname_init(&fixorigin);
 	CHECK(dns_name_fromtext(dns_fixedname_name(&fixorigin), &buffer,
-				dns_rootname, 0, NULL));
+				dns_rootname, 0));
 	origin = dns_fixedname_name(&fixorigin);

 	CHECK(named_config_getclass(cfg_tuple_get(zconfig, "class"),
@@ -6653,7 +6658,7 @@ add_keydata_zone(dns_view_t *view, const char *directory, isc_mem_t *mctx) {
 	CHECK(dns_zonemgr_managezone(named_g_server->zonemgr, zone));

 	CHECK(dns_acl_none(mctx, &none));
-//	dns_zone_setqueryacl(zone, none);
+	dns_zone_setqueryacl(zone, none);
 	dns_zone_setqueryonacl(zone, none);
 	dns_acl_detach(&none);

@@ -7238,7 +7243,7 @@ configure_session_key(const cfg_obj_t **maps, named_server_t *server,
 	isc_buffer_constinit(&buffer, keynamestr, strlen(keynamestr));
 	isc_buffer_add(&buffer, strlen(keynamestr));
 	keyname = dns_fixedname_initname(&fname);
-	result = dns_name_fromtext(keyname, &buffer, dns_rootname, 0, NULL);
+	result = dns_name_fromtext(keyname, &buffer, dns_rootname, 0);
 	if (result != ISC_R_SUCCESS) {
 		return result;
 	}
@@ -7290,7 +7295,7 @@ configure_session_key(const cfg_obj_t **maps, named_server_t *server,
 		INSIST(server->session_keybits == 0);

 		server->session_keyname = isc_mem_get(mctx, sizeof(dns_name_t));
-		dns_name_init(server->session_keyname, NULL);
+		dns_name_init(server->session_keyname);
 		dns_name_dup(keyname, mctx, server->session_keyname);

 		server->session_keyfile = isc_mem_strdup(mctx, keyfile);
@@ -7367,6 +7372,7 @@ setup_newzones(dns_view_t *view, cfg_obj_t *config, cfg_obj_t *vconfig,
 		dns_view_setnewzonedir(view, dir);
 	}

+#ifdef HAVE_LMDB
 	result = named_config_get(maps, "lmdb-mapsize", &obj);
 	if (result == ISC_R_SUCCESS && obj != NULL) {
 		mapsize = cfg_obj_asuint64(obj);
@@ -7386,6 +7392,9 @@ setup_newzones(dns_view_t *view, cfg_obj_t *config, cfg_obj_t *vconfig,
 			return ISC_R_FAILURE;
 		}
 	}
+#else  /* ifdef HAVE_LMDB */
+	UNUSED(obj);
+#endif /* HAVE_LMDB */

 	/*
 	 * A non-empty catalog-zones statement implies allow-new-zones
@@ -7480,6 +7489,54 @@ configure_zone_setviewcommit(isc_result_t result, const cfg_obj_t *zconfig,
 	dns_view_detach(&pview);
 }

+#ifndef HAVE_LMDB
+
+static isc_result_t
+configure_newzones(dns_view_t *view, cfg_obj_t *config, cfg_obj_t *vconfig,
+		   cfg_aclconfctx_t *actx) {
+	isc_result_t result;
+	ns_cfgctx_t *nzctx;
+	const cfg_obj_t *zonelist;
+	const cfg_listelt_t *element;
+
+	nzctx = view->new_zone_config;
+	if (nzctx == NULL || nzctx->nzf_config == NULL) {
+		return ISC_R_SUCCESS;
+	}
+
+	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_SERVER,
+		      ISC_LOG_INFO, "loading additional zones for view '%s'",
+		      view->name);
+
+	zonelist = NULL;
+	cfg_map_get(nzctx->nzf_config, "zone", &zonelist);
+
+	for (element = cfg_list_first(zonelist); element != NULL;
+	     element = cfg_list_next(element))
+	{
+		const cfg_obj_t *zconfig = cfg_listelt_value(element);
+		CHECK(configure_zone(config, zconfig, vconfig, view,
+				     &named_g_server->viewlist,
+				     &named_g_server->kasplist,
+				     &named_g_server->keystorelist, actx, true,
+				     false, false, false));
+	}
+
+	result = ISC_R_SUCCESS;
+
+cleanup:
+	for (element = cfg_list_first(zonelist); element != NULL;
+	     element = cfg_list_next(element))
+	{
+		const cfg_obj_t *zconfig = cfg_listelt_value(element);
+		configure_zone_setviewcommit(result, zconfig, view);
+	}
+
+	return result;
+}
+
+#else /* HAVE_LMDB */
+
 static isc_result_t
 data_to_cfg(dns_view_t *view, MDB_val *key, MDB_val *data, isc_buffer_t **text,
 	    cfg_obj_t **zoneconfig) {
@@ -7744,8 +7801,7 @@ get_newzone_config(dns_view_t *view, const char *zonename,
 	isc_buffer_constinit(&b, zonename, strlen(zonename));
 	isc_buffer_add(&b, strlen(zonename));
 	name = dns_fixedname_initname(&fname);
-	CHECK(dns_name_fromtext(name, &b, dns_rootname, DNS_NAME_DOWNCASE,
-				NULL));
+	CHECK(dns_name_fromtext(name, &b, dns_rootname, DNS_NAME_DOWNCASE));
 	dns_name_format(name, zname, sizeof(zname));

 	key.mv_data = zname;
@@ -7777,6 +7833,8 @@ cleanup:
 	return result;
 }

+#endif /* HAVE_LMDB */
+
 static isc_result_t
 load_configuration(const char *filename, named_server_t *server,
 		   bool first_time) {
@@ -7838,8 +7896,6 @@ load_configuration(const char *filename, named_server_t *server,
 	ISC_LIST_INIT(cachelist);
 	ISC_LIST_INIT(altsecrets);

-	REQUIRE(isc_cfgmgr_rwtransaction() == ISC_R_SUCCESS);
-
 	/* Ensure exclusive access to configuration data. */
 	isc_loopmgr_pause(named_g_loopmgr);

@@ -7861,7 +7917,6 @@ load_configuration(const char *filename, named_server_t *server,
 	 * Parse the global default pseudo-config file.
 	 */
 	if (first_time) {
-		isc_cfgmgr_setmode(ISC_CFGMGR_MODEBUILTIN);
 		result = named_config_parsedefaults(named_g_parser,
 						    &named_g_config);
 		if (result != ISC_R_SUCCESS) {
@@ -7873,8 +7928,6 @@ load_configuration(const char *filename, named_server_t *server,
 					  &named_g_defaults) == ISC_R_SUCCESS);
 	}

-	isc_cfgmgr_setmode(ISC_CFGMGR_MODEUSER);
-
 	/*
 	 * Log the current working directory.
 	 */
@@ -8649,17 +8702,6 @@ load_configuration(const char *filename, named_server_t *server,
 	 * Configure and freeze all explicit views.  Explicit
 	 * views that have zones were already created at parsing
 	 * time, but views with no zones must be created here.
-	 *
-	 * Using cfgmgr, this loop would be re-written this way:
-	 *
-	 * isc_result_t viewresult = isc_cfgmgr_open("views");
-	 * while (viewresult == ISC_R_SUCCESS) {
-	 *     ... the body of the loop ...
-	 *     viewresult = isc_cfgmgr_nextclause();
-	 * }
-	 *
-	 * This will ensures that configure_view is always called in a context
-	 * where the correct view clause is opened.
 	 */
 	for (element = cfg_list_first(views); element != NULL;
 	     element = cfg_list_next(element))
@@ -8696,19 +8738,11 @@ load_configuration(const char *filename, named_server_t *server,
 		if (result != ISC_R_SUCCESS) {
 			goto cleanup_cachelist;
 		}
-
-		/*
-		 * The fallback default view is built using "options"
-		 * properties
-		 */
-		isc_cfgmgr_open("options");
 		result = configure_view(view, &viewlist, config, NULL,
 					&cachelist, &server->cachelist,
 					&server->kasplist,
 					&server->keystorelist, bindkeys,
 					named_g_mctx, named_g_aclconfctx, true);
-		isc_cfgmgr_close();
-
 		if (result != ISC_R_SUCCESS) {
 			dns_view_detach(&view);
 			goto cleanup_cachelist;
@@ -8734,16 +8768,11 @@ load_configuration(const char *filename, named_server_t *server,
 			goto cleanup_cachelist;
 		}

-		isc_cfgmgr_setmode(ISC_CFGMGR_MODEBUILTIN);
-		isc_cfgmgr_open("options");
 		result = configure_view(
 			view, &viewlist, config, vconfig, &cachelist,
 			&server->cachelist, &server->kasplist,
 			&server->keystorelist, bindkeys, named_g_mctx,
 			named_g_aclconfctx, false);
-		isc_cfgmgr_close();
-		isc_cfgmgr_setmode(ISC_CFGMGR_MODEUSER);
-
 		if (result != ISC_R_SUCCESS) {
 			dns_view_detach(&view);
 			goto cleanup_cachelist;
@@ -8801,11 +8830,12 @@ load_configuration(const char *filename, named_server_t *server,
 		server->sctx->tkeyctx = tkeyctx;
 	}

+#ifdef HAVE_LMDB
 	/*
-	 * We may have created newzones LMDB databases as root, making
-	 * it impossible to reopen them later after switching to a new
-	 * userid. We close them now, and reopen after relinquishing
-	 * privileges them.
+	 * If we're using LMDB, we may have created newzones databases
+	 * as root, making it impossible to reopen them later after
+	 * switching to a new userid. We close them now, and reopen
+	 * after relinquishing privileges them.
 	 */
 	if (first_time) {
 		for (dns_view_t *view = ISC_LIST_HEAD(server->viewlist);
@@ -8814,6 +8844,7 @@ load_configuration(const char *filename, named_server_t *server,
 			nzd_env_close(view);
 		}
 	}
+#endif /* HAVE_LMDB */

 	/*
 	 * Switch to the effective UID for setting up files.
@@ -8835,6 +8866,7 @@ load_configuration(const char *filename, named_server_t *server,
 		goto cleanup_cachelist;
 	}

+#ifdef HAVE_LMDB
 	/*
 	 * Reopen NZD databases.
 	 */
@@ -8845,6 +8877,7 @@ load_configuration(const char *filename, named_server_t *server,
 			nzd_env_reopen(view);
 		}
 	}
+#endif /* HAVE_LMDB */

 	/*
 	 * Configure the logging system.
@@ -9272,8 +9305,6 @@ cleanup_exclusive:
 		isc_loopmgr_resume(named_g_loopmgr);
 	}

-	REQUIRE(isc_cfgmgr_commit() == ISC_R_SUCCESS);
-
 	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_SERVER,
 		      ISC_LOG_DEBUG(1), "load_configuration: %s",
 		      isc_result_totext(result));
@@ -11801,7 +11832,7 @@ named_server_flushnode(named_server_t *server, isc_lex_t *lex, bool tree) {
 	isc_buffer_constinit(&b, target, strlen(target));
 	isc_buffer_add(&b, strlen(target));
 	name = dns_fixedname_initname(&fixed);
-	result = dns_name_fromtext(name, &b, dns_rootname, 0, NULL);
+	result = dns_name_fromtext(name, &b, dns_rootname, 0);
 	if (result != ISC_R_SUCCESS) {
 		return result;
 	}
@@ -12347,12 +12378,169 @@ named_smf_add_message(isc_buffer_t **text) {
 }
 #endif /* HAVE_LIBSCF */

+#ifndef HAVE_LMDB
+
+/*
+ * Emit a comment at the top of the nzf file containing the viewname
+ * Expects the fp to already be open for writing
+ */
+#define HEADER1 "# New zone file for view: "
+#define HEADER2                                                     \
+	"\n# This file contains configuration for zones added by\n" \
+	"# the 'rndc addzone' command. DO NOT EDIT BY HAND.\n"
+static isc_result_t
+add_comment(FILE *fp, const char *viewname) {
+	isc_result_t result;
+	CHECK(isc_stdio_write(HEADER1, sizeof(HEADER1) - 1, 1, fp, NULL));
+	CHECK(isc_stdio_write(viewname, strlen(viewname), 1, fp, NULL));
+	CHECK(isc_stdio_write(HEADER2, sizeof(HEADER2) - 1, 1, fp, NULL));
+cleanup:
+	return result;
+}
+
+static void
+dumpzone(void *arg, const char *buf, int len) {
+	FILE *fp = arg;
+
+	(void)isc_stdio_write(buf, len, 1, fp, NULL);
+}
+
+static isc_result_t
+nzf_append(dns_view_t *view, const cfg_obj_t *zconfig) {
+	isc_result_t result;
+	off_t offset;
+	FILE *fp = NULL;
+	bool offsetok = false;
+
+	LOCK(&view->new_zone_lock);
+
+	CHECK(isc_stdio_open(view->new_zone_file, "a", &fp));
+	CHECK(isc_stdio_seek(fp, 0, SEEK_END));
+
+	CHECK(isc_stdio_tell(fp, &offset));
+	offsetok = true;
+	if (offset == 0) {
+		CHECK(add_comment(fp, view->name));
+	}
+
+	CHECK(isc_stdio_write("zone ", 5, 1, fp, NULL));
+	cfg_printx(zconfig, CFG_PRINTER_ONELINE, dumpzone, fp);
+	CHECK(isc_stdio_write(";\n", 2, 1, fp, NULL));
+	CHECK(isc_stdio_flush(fp));
+	result = isc_stdio_close(fp);
+	fp = NULL;
+
+cleanup:
+	if (fp != NULL) {
+		(void)isc_stdio_close(fp);
+		if (offsetok) {
+			isc_result_t result2;
+
+			result2 = isc_file_truncate(view->new_zone_file,
+						    offset);
+			if (result2 != ISC_R_SUCCESS) {
+				isc_log_write(NAMED_LOGCATEGORY_GENERAL,
+					      NAMED_LOGMODULE_SERVER,
+					      ISC_LOG_ERROR,
+					      "Error truncating NZF file '%s' "
+					      "during rollback from append: "
+					      "%s",
+					      view->new_zone_file,
+					      isc_result_totext(result2));
+			}
+		}
+	}
+	UNLOCK(&view->new_zone_lock);
+	return result;
+}
+
+static isc_result_t
+nzf_writeconf(const cfg_obj_t *config, dns_view_t *view) {
+	const cfg_obj_t *zl = NULL;
+	cfg_list_t *list;
+	const cfg_listelt_t *elt;
+
+	FILE *fp = NULL;
+	char tmp[1024];
+	isc_result_t result;
+
+	result = isc_file_template(view->new_zone_file, "nzf-XXXXXXXX", tmp,
+				   sizeof(tmp));
+	if (result == ISC_R_SUCCESS) {
+		result = isc_file_openunique(tmp, &fp);
+	}
+	if (result != ISC_R_SUCCESS) {
+		return result;
+	}
+
+	cfg_map_get(config, "zone", &zl);
+	if (!cfg_obj_islist(zl)) {
+		CHECK(ISC_R_FAILURE);
+	}
+
+	list = UNCONST(&zl->value.list);
+
+	CHECK(add_comment(fp, view->name)); /* force a comment */
+
+	for (elt = ISC_LIST_HEAD(*list); elt != NULL;
+	     elt = ISC_LIST_NEXT(elt, link))
+	{
+		const cfg_obj_t *zconfig = cfg_listelt_value(elt);
+
+		CHECK(isc_stdio_write("zone ", 5, 1, fp, NULL));
+		cfg_printx(zconfig, CFG_PRINTER_ONELINE, dumpzone, fp);
+		CHECK(isc_stdio_write(";\n", 2, 1, fp, NULL));
+	}
+
+	CHECK(isc_stdio_flush(fp));
+	result = isc_stdio_close(fp);
+	fp = NULL;
+	if (result != ISC_R_SUCCESS) {
+		goto cleanup;
+	}
+	CHECK(isc_file_rename(tmp, view->new_zone_file));
+	return result;
+
+cleanup:
+	if (fp != NULL) {
+		(void)isc_stdio_close(fp);
+	}
+	(void)isc_file_remove(tmp);
+	return result;
+}
+
+static isc_result_t
+load_nzf(dns_view_t *view, ns_cfgctx_t *nzcfg) {
+	isc_result_t result;
+
+	/* The new zone file may not exist. That is OK. */
+	if (!isc_file_exists(view->new_zone_file)) {
+		return ISC_R_SUCCESS;
+	}
+
+	/*
+	 * Parse the configuration in the NZF file.  This may be called in
+	 * multiple views, so we reset the parser each time.
+	 */
+	cfg_parser_reset(named_g_addparser);
+	result = cfg_parse_file(named_g_addparser, view->new_zone_file,
+				&cfg_type_addzoneconf, &nzcfg->nzf_config);
+	if (result != ISC_R_SUCCESS) {
+		isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_SERVER,
+			      ISC_LOG_ERROR, "Error parsing NZF file '%s': %s",
+			      view->new_zone_file, isc_result_totext(result));
+	}
+
+	return result;
+}
+#else  /* HAVE_LMDB */
+
 static void
 nzd_setkey(MDB_val *key, dns_name_t *name, char *namebuf, size_t buflen) {
 	dns_fixedname_t fixed;

 	dns_fixedname_init(&fixed);
-	dns_name_downcase(name, dns_fixedname_name(&fixed), NULL);
+	dns_name_downcase(name, dns_fixedname_name(&fixed));
 	dns_name_format(dns_fixedname_name(&fixed), namebuf, buflen);

 	key->mv_data = namebuf;
@@ -12754,7 +12942,7 @@ load_nzf(dns_view_t *view, ns_cfgctx_t *nzcfg) {
 		isc_buffer_add(&b, strlen(origin));
 		name = dns_fixedname_initname(&fname);
 		CHECK(dns_name_fromtext(name, &b, dns_rootname,
-					DNS_NAME_DOWNCASE, NULL));
+					DNS_NAME_DOWNCASE));
 		dns_name_format(name, zname, sizeof(zname));

 		key.mv_data = zname;
@@ -12828,6 +13016,7 @@ cleanup:

 	return result;
 }
+#endif /* HAVE_LMDB */

 static isc_result_t
 newzone_parse(named_server_t *server, char *command, dns_view_t **viewp,
@@ -13012,14 +13201,21 @@ cleanup:

 static isc_result_t
 do_addzone(named_server_t *server, ns_cfgctx_t *cfg, dns_view_t *view,
-	   dns_name_t *name, const cfg_obj_t *zoneobj, bool redirect,
-	   isc_buffer_t **text) {
+	   dns_name_t *name, cfg_obj_t *zoneconf, const cfg_obj_t *zoneobj,
+	   bool redirect, isc_buffer_t **text) {
 	isc_result_t result, tresult;
 	dns_zone_t *zone = NULL;
+#ifndef HAVE_LMDB
+	FILE *fp = NULL;
+	bool cleanup_config = false;
+#else /* HAVE_LMDB */
 	MDB_txn *txn = NULL;
 	MDB_dbi dbi;
 	bool locked = false;

+	UNUSED(zoneconf);
+#endif
+
 	/* Zone shouldn't already exist */
 	if (redirect) {
 		result = (view->redirect == NULL) ? ISC_R_NOTFOUND
@@ -13035,6 +13231,24 @@ do_addzone(named_server_t *server, ns_cfgctx_t *cfg, dns_view_t *view,
 	}

 	isc_loopmgr_pause(named_g_loopmgr);
+
+#ifndef HAVE_LMDB
+	/*
+	 * Make sure we can open the configuration save file
+	 */
+	result = isc_stdio_open(view->new_zone_file, "a", &fp);
+	if (result != ISC_R_SUCCESS) {
+		isc_loopmgr_resume(named_g_loopmgr);
+		TCHECK(putstr(text, "unable to create '"));
+		TCHECK(putstr(text, view->new_zone_file));
+		TCHECK(putstr(text, "': "));
+		TCHECK(putstr(text, isc_result_totext(result)));
+		goto cleanup;
+	}
+
+	(void)isc_stdio_close(fp);
+	fp = NULL;
+#else  /* HAVE_LMDB */
 	LOCK(&view->new_zone_lock);
 	locked = true;
 	/* Make sure we can open the NZD database */
@@ -13047,6 +13261,7 @@ do_addzone(named_server_t *server, ns_cfgctx_t *cfg, dns_view_t *view,
 		result = ISC_R_FAILURE;
 		goto cleanup;
 	}
+#endif /* HAVE_LMDB */

 	/* Mark view unfrozen and configure zone */
 	dns_view_thaw(view);
@@ -13081,6 +13296,22 @@ do_addzone(named_server_t *server, ns_cfgctx_t *cfg, dns_view_t *view,
 		}
 	}

+#ifndef HAVE_LMDB
+	/*
+	 * If there wasn't a previous newzone config, just save the one
+	 * we've created. If there was a previous one, merge the new
+	 * zone into it.
+	 */
+	if (cfg->nzf_config == NULL) {
+		cfg_obj_attach(zoneconf, &cfg->nzf_config);
+	} else {
+		cfg_obj_t *z = UNCONST(zoneobj);
+		CHECK(cfg_parser_mapadd(cfg->add_parser, cfg->nzf_config, z,
+					"zone"));
+	}
+	cleanup_config = true;
+#endif /* HAVE_LMDB */
+
 	/*
 	 * Load the zone from the master file.  If this fails, we'll
 	 * need to undo the configuration we've done already.
@@ -13109,17 +13340,34 @@ do_addzone(named_server_t *server, ns_cfgctx_t *cfg, dns_view_t *view,
 	/* Flag the zone as having been added at runtime */
 	dns_zone_setadded(zone, true);

+#ifdef HAVE_LMDB
 	/* Save the new zone configuration into the NZD */
 	CHECK(nzd_open(view, 0, &txn, &dbi));
 	CHECK(nzd_save(&txn, dbi, zone, zoneobj));
+#else  /* ifdef HAVE_LMDB */
+	/* Append the zone configuration to the NZF */
+	result = nzf_append(view, zoneobj);
+#endif /* HAVE_LMDB */

 cleanup:
+
+#ifndef HAVE_LMDB
+	if (fp != NULL) {
+		(void)isc_stdio_close(fp);
+	}
+	if (result != ISC_R_SUCCESS && cleanup_config) {
+		tresult = delete_zoneconf(view, cfg->add_parser,
+					  cfg->nzf_config, name, NULL);
+		RUNTIME_CHECK(tresult == ISC_R_SUCCESS);
+	}
+#else  /* HAVE_LMDB */
 	if (txn != NULL) {
 		(void)nzd_close(&txn, false);
 	}
 	if (locked) {
 		UNLOCK(&view->new_zone_lock);
 	}
+#endif /* HAVE_LMDB */

 	if (zone != NULL) {
 		dns_zone_detach(&zone);
@@ -13135,9 +13383,14 @@ do_modzone(named_server_t *server, ns_cfgctx_t *cfg, dns_view_t *view,
 	isc_result_t result, tresult;
 	dns_zone_t *zone = NULL;
 	bool added;
+#ifndef HAVE_LMDB
+	FILE *fp = NULL;
+	cfg_obj_t *z;
+#else  /* HAVE_LMDB */
 	MDB_txn *txn = NULL;
 	MDB_dbi dbi;
 	bool locked = false;
+#endif /* HAVE_LMDB */

 	/* Zone must already exist */
 	if (redirect) {
@@ -13157,8 +13410,30 @@ do_modzone(named_server_t *server, ns_cfgctx_t *cfg, dns_view_t *view,
 	added = dns_zone_getadded(zone);
 	dns_zone_detach(&zone);

+#ifndef HAVE_LMDB
+	cfg = (ns_cfgctx_t *)view->new_zone_config;
+	if (cfg == NULL) {
+		TCHECK(putstr(text, "new zone config is not set"));
+		CHECK(ISC_R_FAILURE);
+	}
+#endif /* ifndef HAVE_LMDB */
+
 	isc_loopmgr_pause(named_g_loopmgr);

+#ifndef HAVE_LMDB
+	/* Make sure we can open the configuration save file */
+	result = isc_stdio_open(view->new_zone_file, "a", &fp);
+	if (result != ISC_R_SUCCESS) {
+		TCHECK(putstr(text, "unable to open '"));
+		TCHECK(putstr(text, view->new_zone_file));
+		TCHECK(putstr(text, "': "));
+		TCHECK(putstr(text, isc_result_totext(result)));
+		isc_loopmgr_resume(named_g_loopmgr);
+		goto cleanup;
+	}
+	(void)isc_stdio_close(fp);
+	fp = NULL;
+#else  /* HAVE_LMDB */
 	LOCK(&view->new_zone_lock);
 	locked = true;
 	/* Make sure we can open the NZD database */
@@ -13171,6 +13446,7 @@ do_modzone(named_server_t *server, ns_cfgctx_t *cfg, dns_view_t *view,
 		isc_loopmgr_resume(named_g_loopmgr);
 		goto cleanup;
 	}
+#endif /* HAVE_LMDB */

 	/* Reconfigure the zone */
 	dns_view_thaw(view);
@@ -13198,6 +13474,21 @@ do_modzone(named_server_t *server, ns_cfgctx_t *cfg, dns_view_t *view,
 		CHECK(dns_view_findzone(view, name, DNS_ZTFIND_EXACT, &zone));
 	}

+#ifndef HAVE_LMDB
+	/* Remove old zone from configuration (and NZF file if applicable) */
+	if (added) {
+		result = delete_zoneconf(view, cfg->add_parser, cfg->nzf_config,
+					 dns_zone_getorigin(zone),
+					 nzf_writeconf);
+		if (result != ISC_R_SUCCESS) {
+			TCHECK(putstr(text, "former zone configuration "
+					    "not deleted: "));
+			TCHECK(putstr(text, isc_result_totext(result)));
+			goto cleanup;
+		}
+	}
+#endif /* HAVE_LMDB */
+
 	if (!added) {
 		if (cfg->vconfig == NULL) {
 			result = delete_zoneconf(
@@ -13254,9 +13545,24 @@ do_modzone(named_server_t *server, ns_cfgctx_t *cfg, dns_view_t *view,
 		goto cleanup;
 	}

+#ifndef HAVE_LMDB
+	/* Store the new zone configuration; also in NZF if applicable */
+	z = UNCONST(zoneobj);
+	CHECK(cfg_parser_mapadd(cfg->add_parser, cfg->nzf_config, z, "zone"));
+#endif /* HAVE_LMDB */
+
 	if (added) {
+#ifdef HAVE_LMDB
 		CHECK(nzd_open(view, 0, &txn, &dbi));
 		CHECK(nzd_save(&txn, dbi, zone, zoneobj));
+#else  /* ifdef HAVE_LMDB */
+		result = nzf_append(view, zoneobj);
+		if (result != ISC_R_SUCCESS) {
+			TCHECK(putstr(text, "\nNew zone config not saved: "));
+			TCHECK(putstr(text, isc_result_totext(result)));
+			goto cleanup;
+		}
+#endif /* HAVE_LMDB */

 		TCHECK(putstr(text, "zone '"));
 		TCHECK(putstr(text, zname));
@@ -13270,12 +13576,18 @@ do_modzone(named_server_t *server, ns_cfgctx_t *cfg, dns_view_t *view,

 cleanup:

+#ifndef HAVE_LMDB
+	if (fp != NULL) {
+		(void)isc_stdio_close(fp);
+	}
+#else  /* HAVE_LMDB */
 	if (txn != NULL) {
 		(void)nzd_close(&txn, false);
 	}
 	if (locked) {
 		UNLOCK(&view->new_zone_lock);
 	}
+#endif /* HAVE_LMDB */

 	if (zone != NULL) {
 		dns_zone_detach(&zone);
@@ -13315,7 +13627,12 @@ named_server_changezone(named_server_t *server, char *command,
 			    &redirect, text));

 	/* Are we accepting new zones in this view? */
-	if (view->new_zone_db == NULL) {
+#ifdef HAVE_LMDB
+	if (view->new_zone_db == NULL)
+#else  /* ifdef HAVE_LMDB */
+	if (view->new_zone_file == NULL)
+#endif /* HAVE_LMDB */
+	{
 		(void)putstr(text, "Not allowing new zones in view '");
 		(void)putstr(text, view->name);
 		(void)putstr(text, "'");
@@ -13334,7 +13651,7 @@ named_server_changezone(named_server_t *server, char *command,
 	isc_buffer_add(&buf, strlen(zonename));

 	dnsname = dns_fixedname_initname(&fname);
-	CHECK(dns_name_fromtext(dnsname, &buf, dns_rootname, 0, NULL));
+	CHECK(dns_name_fromtext(dnsname, &buf, dns_rootname, 0));

 	if (redirect) {
 		if (!dns_name_equal(dnsname, dns_rootname)) {
@@ -13345,8 +13662,8 @@ named_server_changezone(named_server_t *server, char *command,
 	}

 	if (addzone) {
-		CHECK(do_addzone(server, cfg, view, dnsname, zoneobj, redirect,
-				 text));
+		CHECK(do_addzone(server, cfg, view, dnsname, zoneconf, zoneobj,
+				 redirect, text));
 	} else {
 		CHECK(do_modzone(server, cfg, view, dnsname, zonename, zoneobj,
 				 redirect, text));
@@ -13409,8 +13726,10 @@ rmzone(void *arg) {
 	dns_db_t *dbp = NULL;
 	bool added;
 	isc_result_t result;
+#ifdef HAVE_LMDB
 	MDB_txn *txn = NULL;
 	MDB_dbi dbi;
+#endif /* ifdef HAVE_LMDB */

 	REQUIRE(dz != NULL);

@@ -13432,6 +13751,7 @@ rmzone(void *arg) {
 	catz = dns_zone_get_parentcatz(zone);

 	if (added && catz == NULL && cfg != NULL) {
+#ifdef HAVE_LMDB
 		/* Make sure we can open the NZD database */
 		LOCK(&view->new_zone_lock);
 		result = nzd_open(view, 0, &txn, &dbi);
@@ -13455,6 +13775,17 @@ rmzone(void *arg) {
 			(void)nzd_close(&txn, false);
 		}
 		UNLOCK(&view->new_zone_lock);
+#else  /* ifdef HAVE_LMDB */
+		result = delete_zoneconf(view, cfg->add_parser, cfg->nzf_config,
+					 dns_zone_getorigin(zone),
+					 nzf_writeconf);
+		if (result != ISC_R_SUCCESS) {
+			isc_log_write(NAMED_LOGCATEGORY_GENERAL,
+				      NAMED_LOGMODULE_SERVER, ISC_LOG_ERROR,
+				      "unable to delete zone configuration: %s",
+				      isc_result_totext(result));
+		}
+#endif /* HAVE_LMDB */
 	}

 	if (!added && cfg != NULL) {
@@ -13763,7 +14094,9 @@ named_server_showzone(named_server_t *server, isc_lex_t *lex,
 	dns_view_t *view = NULL;
 	dns_zone_t *zone = NULL;
 	ns_cfgctx_t *cfg = NULL;
+#ifdef HAVE_LMDB
 	cfg_obj_t *nzconfig = NULL;
+#endif /* HAVE_LMDB */
 	bool added, redirect;
 	ns_dzarg_t dzarg;

@@ -13803,6 +14136,12 @@ named_server_showzone(named_server_t *server, isc_lex_t *lex,
 						     redirect);
 	}

+#ifndef HAVE_LMDB
+	if (zconfig == NULL && cfg->nzf_config != NULL) {
+		zconfig = find_name_in_list_from_map(cfg->nzf_config, "zone",
+						     zonename, redirect);
+	}
+#else  /* HAVE_LMDB */
 	if (zconfig == NULL) {
 		const cfg_obj_t *zlist = NULL;
 		CHECK(get_newzone_config(view, zonename, &nzconfig));
@@ -13813,6 +14152,7 @@ named_server_showzone(named_server_t *server, isc_lex_t *lex,

 		zconfig = cfg_listelt_value(cfg_list_first(zlist));
 	}
+#endif /* HAVE_LMDB */

 	if (zconfig == NULL) {
 		CHECK(ISC_R_NOTFOUND);
@@ -13830,10 +14170,11 @@ named_server_showzone(named_server_t *server, isc_lex_t *lex,
 	result = ISC_R_SUCCESS;

 cleanup:
+#ifdef HAVE_LMDB
 	if (nzconfig != NULL) {
 		cfg_obj_destroy(named_g_addparser, &nzconfig);
 	}
-
+#endif /* HAVE_LMDB */
 	if (isc_buffer_usedlength(*text) > 0) {
 		(void)putnull(text);
 	}
@@ -14876,7 +15217,7 @@ named_server_nta(named_server_t *server, isc_lex_t *lex, bool readonly,
 		isc_buffer_t b;
 		isc_buffer_init(&b, namebuf, strlen(namebuf));
 		isc_buffer_add(&b, strlen(namebuf));
-		CHECK(dns_name_fromtext(fname, &b, dns_rootname, 0, NULL));
+		CHECK(dns_name_fromtext(fname, &b, dns_rootname, 0));
 		ntaname = fname;
 	}

@@ -17,7 +17,6 @@
 #include <stdbool.h>

 #include <isc/buffer.h>
-#include <isc/cfgmgr.h>
 #include <isc/httpd.h>
 #include <isc/mem.h>
 #include <isc/once.h>
@@ -3488,251 +3487,6 @@ render_json_traffic(const isc_httpd_t *httpd, const isc_httpdurl_t *urlinfo,
 			   b, freecb, freecb_args);
 }

-typedef struct cfgmgr_visitctx cfgmgr_visitctx_t;
-struct cfgmgr_visitctx {
-	size_t indent;
-	size_t lvl;
-	isc_buffer_t *buffer;
-};
-
-static void
-cfgmgr_visitprop(void *state, const char *name) {
-	cfgmgr_visitctx_t *ctx = state;
-	isc_cfgmgr_val_t val;
-
-	REQUIRE(isc_cfgmgr_read(name, &val) == ISC_R_SUCCESS);
-
-	for (size_t i = 0; i < ctx->lvl * ctx->indent; i++) {
-		isc_buffer_putstr(ctx->buffer, " ");
-	}
-
-	isc_buffer_printf(ctx->buffer, "%s ", name);
-	switch (val.type) {
-	case ISC_CFGMGR_UINT32:
-		isc_buffer_printf(ctx->buffer, "%u", val.uint32);
-		break;
-	case ISC_CFGMGR_STRING:
-		isc_buffer_printf(ctx->buffer, "%s", val.string);
-		break;
-	default:
-		UNREACHABLE();
-	}
-	isc_buffer_putstr(ctx->buffer, ";\n");
-}
-
-static void
-cfgmgr_nodeindent(cfgmgr_visitctx_t *ctx, const char *type, const char *name) {
-	for (size_t i = 0; i < ctx->lvl * ctx->indent; i++) {
-		isc_buffer_putstr(ctx->buffer, " ");
-	}
-
-	if (type != NULL) {
-		isc_buffer_printf(ctx->buffer, "%s ", type);
-	}
-	isc_buffer_printf(ctx->buffer, "%s {\n", name);
-	ctx->lvl++;
-}
-
-static void
-cfgmgr_nodedeindent(cfgmgr_visitctx_t *ctx) {
-	ctx->lvl--;
-	for (size_t i = 0; i < ctx->lvl * ctx->indent; i++) {
-		isc_buffer_putstr(ctx->buffer, " ");
-	}
-	isc_buffer_printf(ctx->buffer, "};\n");
-}
-
-static void
-cfgmgr_visitgenericnode(void *state, const char *name) {
-	cfgmgr_visitctx_t *ctx = state;
-
-	cfgmgr_nodeindent(ctx, NULL, name);
-	isc_cfgmgr_open(name);
-	isc_cfgmgr_foreachproperties(cfgmgr_visitprop, ctx);
-	isc_cfgmgr_foreachnodes(cfgmgr_visitgenericnode, ctx);
-	isc_cfgmgr_close();
-	cfgmgr_nodedeindent(ctx);
-}
-
-static void
-cfgmgr_visitaclnode(void *state, const char *aclname) {
-	cfgmgr_visitctx_t *ctx = state;
-
-	cfgmgr_nodeindent(ctx, "acl", aclname);
-	isc_cfgmgr_open(aclname);
-	isc_cfgmgr_foreachproperties(cfgmgr_visitprop, ctx);
-	/*
-	 * geoip-based ACL are implemented as a subnode
-	 */
-	isc_cfgmgr_foreachnodes(cfgmgr_visitgenericnode, ctx);
-	isc_cfgmgr_close();
-	cfgmgr_nodedeindent(ctx);
-}
-
-static void
-cfgmgr_visitaclsnode(cfgmgr_visitctx_t *ctx) {
-	isc_cfgmgr_open("acls");
-	isc_cfgmgr_foreachnodes(cfgmgr_visitaclnode, ctx);
-	isc_cfgmgr_close();
-}
-
-static void
-cfgmgr_visittoplevelnodes(void *state, const char *name) {
-	cfgmgr_visitctx_t *ctx = state;
-
-	REQUIRE(ctx->lvl == 0);
-
-	if (strcmp(name, "acls") == 0) {
-		cfgmgr_visitaclsnode(ctx);
-	} else { 
-		cfgmgr_visitgenericnode(ctx, name);
-	} 
-}
-
-static void
-cfgmgr_dump(isc_cfgmgr_mode_t mode, isc_buffer_t *buffer) {
-	cfgmgr_visitctx_t ctx = { .lvl = 0, .indent = 8, .buffer = buffer };
-
-	isc_cfgmgr_transaction();
-	isc_cfgmgr_setmode(mode);
-	isc_cfgmgr_foreachnodes(cfgmgr_visittoplevelnodes, &ctx);
-	isc_cfgmgr_commit();
-}
-
-static void
-cfgmgr_dumpfree(isc_buffer_t *buffer, void *arg) {
-	isc_mem_t *mctx = arg;
-	void *data = isc_buffer_base(buffer);
-
-	isc_buffer_initnull(buffer);
-	isc_mem_free(mctx, data);
-}
-
-static isc_result_t
-render_cfgmgr_dump(const isc_httpd_t *httpd, const isc_httpdurl_t *urlinfo,
-		    void *arg, unsigned int *retcode, const char **retmsg,
-		    const char **mimetype, isc_buffer_t *b,
-		    isc_httpdfree_t **freecb, void **freecb_args) {
-	const size_t bufsz = 4092;
-	named_server_t *server = arg;
-	char *bufdata = isc_mem_allocate(server->mctx, bufsz);
-
-	UNUSED(httpd);
-	UNUSED(urlinfo);
-	UNUSED(retmsg);
-
-	*retcode = 200;
-	*retmsg = "OK";
-	*mimetype = "text/html";
-	*freecb = cfgmgr_dumpfree;
-	*freecb_args = server->mctx;
-	isc_buffer_reinit(b, bufdata, bufsz);
-
-	isc_buffer_putstr(b, "<pre>");
-
-	isc_buffer_putstr(b, "# Builtin config dump\n\n");
-	cfgmgr_dump(ISC_CFGMGR_MODEBUILTIN, b);
-
-	isc_buffer_putstr(b, "\n\n\n\n# User/named.conf config dump\n\n");
-	cfgmgr_dump(ISC_CFGMGR_MODEUSER, b);
-
-	isc_buffer_putstr(b, "\n\n\n\n# Running config dump\n\n");
-	cfgmgr_dump(ISC_CFGMGR_MODERUNNING, b);
-
-	isc_buffer_putstr(b, "</pre>");
-
-	return ISC_R_SUCCESS;
-}
-
-static void
-cfgmgr_deleteallowquery(void *state, const char *propname) {
-	UNUSED(state);
-	REQUIRE(isc_cfgmgr_write(propname, NULL) == ISC_R_SUCCESS);
-}
-
-static isc_result_t
-set_cfgmgr_optionprop(const isc_httpd_t *httpd, const isc_httpdurl_t *urlinfo,
-		      void *arg, unsigned int *retcode, const char **retmsg,
-		      const char **mimetype, isc_buffer_t *b,
-		      isc_httpdfree_t **freecb, void **freecb_args) {
-	isc_cfgmgr_val_t val;
-	const char *base;
-	uint16_t len;
-
-	UNUSED(httpd);
-	UNUSED(urlinfo);
-	UNUSED(retmsg);
-	UNUSED(retcode);
-	UNUSED(b);
-	UNUSED(freecb);
-	UNUSED(freecb_args);
-	UNUSED(mimetype);
-	UNUSED(arg);
-
-	*retcode = 200;
-	*retmsg = "OK";
-
-	base = NULL;
-	if (isc_httpd_geturlfield(httpd, ISC_UF_QUERY, &base, &len) ==
-	    ISC_R_SUCCESS)
-	{
-		char query[512];
-		char *name;
-		char *value;
-
-		REQUIRE(len < 511);
-		strncpy(query, base, len);
-
-		/*
-		 * if there is several queries options, let's pick only the
-		 * first one and ignore the other
-		 */
-		name = strtok(query, "=");
-		value = strtok(NULL, "&"); 
-
-		REQUIRE(name != NULL && strcmp(name, "allow-query") == 0);
-		REQUIRE(value != NULL);
-
-		isc_cfgmgr_rwtransaction();
-
-		isc_cfgmgr_open("options");
-		isc_cfgmgr_open("allow-query");
-		isc_cfgmgr_foreachproperties(cfgmgr_deleteallowquery, NULL);
-		val.type = ISC_CFGMGR_STRING;
-		val.string = "";
-		isc_cfgmgr_write(value, &val);
-		isc_cfgmgr_commit();
-
-		if (strcmp(name, "allow-query") == 0) {
-			dns_view_t *view = NULL;
-			dns_acl_t *newacl = NULL;
-//			dns_acl_t *oldacl;
-
-			REQUIRE(dns_viewlist_find(&named_g_server->viewlist,
-						  "_default", dns_rdataclass_in,
-						  &view) == ISC_R_SUCCESS);
-
-			isc_cfgmgr_transaction();
-			isc_cfgmgr_open("options");
-			REQUIRE(dns_acl_configure(view->mctx, "allow-query",
-						  &newacl) == ISC_R_SUCCESS);
-			isc_cfgmgr_commit();
-
-			REQUIRE(newacl != NULL);
-			isc_refcount_increment(&newacl->references);
-
-			(void)rcu_xchg_pointer(&view->queryacl, newacl);
-			synchronize_rcu();
-
-
-//			dns_acl_detach(&oldacl);
-
-		}
-	}
-
-	return ISC_R_SUCCESS;
-}
-
 #endif /* HAVE_JSON_C */

 #if HAVE_LIBXML2
@@ -3969,10 +3723,6 @@ add_listener(named_server_t *server, named_statschannel_t **listenerp,
 			    false, render_json_traffic, server);
 #endif /* ifdef HAVE_JSON_C */

-	isc_httpdmgr_addurl(listener->httpdmgr, "/cfgmgrdump", false,
-			    render_cfgmgr_dump, server);
-	isc_httpdmgr_addurl(listener->httpdmgr, "/setcfgmgroptionprop", false,
-			    set_cfgmgr_optionprop, server);
 	*listenerp = listener;
 	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_SERVER,
 		      ISC_LOG_NOTICE, "statistics channel listening on %s",
@@ -62,9 +62,9 @@ named_tkeyctx_fromconfig(const cfg_obj_t *options, isc_mem_t *mctx,
 		isc_buffer_constinit(&b, s, strlen(s));
 		isc_buffer_add(&b, strlen(s));
 		name = dns_fixedname_initname(&fname);
-		RETERR(dns_name_fromtext(name, &b, dns_rootname, 0, NULL));
+		RETERR(dns_name_fromtext(name, &b, dns_rootname, 0));
 		tctx->domain = isc_mem_get(mctx, sizeof(dns_name_t));
-		dns_name_init(tctx->domain, NULL);
+		dns_name_init(tctx->domain);
 		dns_name_dup(name, mctx, tctx->domain);
 	}

@@ -76,7 +76,7 @@ named_tkeyctx_fromconfig(const cfg_obj_t *options, isc_mem_t *mctx,
 		isc_buffer_constinit(&b, s, strlen(s));
 		isc_buffer_add(&b, strlen(s));
 		name = dns_fixedname_initname(&fname);
-		RETERR(dns_name_fromtext(name, &b, dns_rootname, 0, NULL));
+		RETERR(dns_name_fromtext(name, &b, dns_rootname, 0));
 		RETERR(dst_gssapi_acquirecred(name, false, &tctx->gsscred));
 	}

@@ -27,17 +27,16 @@
 #include <named/log.h>
 #include <named/transportconf.h>

-#define create_name(id, name)                                      \
-	isc_buffer_t namesrc, namebuf;                             \
-	char namedata[DNS_NAME_FORMATSIZE + 1];                    \
-	dns_name_init(name, NULL);                                 \
-	isc_buffer_constinit(&namesrc, id, strlen(id));            \
-	isc_buffer_add(&namesrc, strlen(id));                      \
-	isc_buffer_init(&namebuf, namedata, sizeof(namedata));     \
-	result = (dns_name_fromtext(name, &namesrc, dns_rootname,  \
-				    DNS_NAME_DOWNCASE, &namebuf)); \
-	if (result != ISC_R_SUCCESS) {                             \
-		goto failure;                                      \
+#define create_name(id, name)                                     \
+	isc_buffer_t namesrc;                                     \
+	dns_fixedname_t _fn;                                      \
+	name = dns_fixedname_initname(&_fn);                      \
+	isc_buffer_constinit(&namesrc, id, strlen(id));           \
+	isc_buffer_add(&namesrc, strlen(id));                     \
+	result = (dns_name_fromtext(name, &namesrc, dns_rootname, \
+				    DNS_NAME_DOWNCASE));          \
+	if (result != ISC_R_SUCCESS) {                            \
+		goto failure;                                     \
 	}

 #define parse_transport_option(map, transport, name, setter)      \
@@ -100,15 +99,15 @@ add_doh_transports(const cfg_obj_t *transportlist, dns_transport_list_t *list) {
 	for (const cfg_listelt_t *element = cfg_list_first(transportlist);
 	     element != NULL; element = cfg_list_next(element))
 	{
-		dns_name_t dohname;
-		dns_transport_t *transport;
+		dns_name_t *dohname = NULL;
+		dns_transport_t *transport = NULL;

 		doh = cfg_listelt_value(element);
 		dohid = cfg_obj_asstring(cfg_map_getname(doh));

-		create_name(dohid, &dohname);
+		create_name(dohid, dohname);

-		transport = dns_transport_new(&dohname, DNS_TRANSPORT_HTTP,
+		transport = dns_transport_new(dohname, DNS_TRANSPORT_HTTP,
 					      list);

 		dns_transport_set_tlsname(transport, dohid);
@@ -148,8 +147,8 @@ add_tls_transports(const cfg_obj_t *transportlist, dns_transport_list_t *list) {
 	for (const cfg_listelt_t *element = cfg_list_first(transportlist);
 	     element != NULL; element = cfg_list_next(element))
 	{
-		dns_name_t tlsname;
-		dns_transport_t *transport;
+		dns_name_t *tlsname = NULL;
+		dns_transport_t *transport = NULL;

 		tls = cfg_listelt_value(element);
 		tlsid = cfg_obj_asstring(cfg_map_getname(tls));
@@ -159,10 +158,9 @@ add_tls_transports(const cfg_obj_t *transportlist, dns_transport_list_t *list) {
 			goto failure;
 		}

-		create_name(tlsid, &tlsname);
+		create_name(tlsid, tlsname);

-		transport = dns_transport_new(&tlsname, DNS_TRANSPORT_TLS,
-					      list);
+		transport = dns_transport_new(tlsname, DNS_TRANSPORT_TLS, list);

 		dns_transport_set_tlsname(transport, tlsid);
 		parse_transport_option(tls, transport, "key-file",
@@ -222,12 +220,12 @@ transport_list_fromconfig(const cfg_obj_t *config, dns_transport_list_t *list) {
 static void
 transport_list_add_ephemeral(dns_transport_list_t *list) {
 	isc_result_t result;
-	dns_name_t tlsname;
+	dns_name_t *tlsname = NULL;
 	dns_transport_t *transport;

-	create_name("ephemeral", &tlsname);
+	create_name("ephemeral", tlsname);

-	transport = dns_transport_new(&tlsname, DNS_TRANSPORT_TLS, list);
+	transport = dns_transport_new(tlsname, DNS_TRANSPORT_TLS, list);
 	dns_transport_set_tlsname(transport, "ephemeral");

 	return;
@@ -46,11 +46,11 @@ add_initial_keys(const cfg_obj_t *list, dns_tsigkeyring_t *ring,
 	{
 		const cfg_obj_t *algobj = NULL;
 		const cfg_obj_t *secretobj = NULL;
-		dns_name_t keyname;
+		dns_fixedname_t fkey;
+		dns_name_t *keyname = dns_fixedname_initname(&fkey);
 		dst_algorithm_t alg = DST_ALG_UNKNOWN;
 		const char *algstr = NULL;
-		char keynamedata[1024];
-		isc_buffer_t keynamesrc, keynamebuf;
+		isc_buffer_t keynamesrc;
 		const char *secretstr = NULL;
 		isc_buffer_t secretbuf;
 		int secretlen = 0;
@@ -68,12 +68,10 @@ add_initial_keys(const cfg_obj_t *list, dns_tsigkeyring_t *ring,
 		/*
 		 * Create the key name.
 		 */
-		dns_name_init(&keyname, NULL);
 		isc_buffer_constinit(&keynamesrc, keyid, strlen(keyid));
 		isc_buffer_add(&keynamesrc, strlen(keyid));
-		isc_buffer_init(&keynamebuf, keynamedata, sizeof(keynamedata));
-		ret = dns_name_fromtext(&keyname, &keynamesrc, dns_rootname,
-					DNS_NAME_DOWNCASE, &keynamebuf);
+		ret = dns_name_fromtext(keyname, &keynamesrc, dns_rootname,
+					DNS_NAME_DOWNCASE);
 		if (ret != ISC_R_SUCCESS) {
 			goto failure;
 		}
@@ -103,7 +101,7 @@ add_initial_keys(const cfg_obj_t *list, dns_tsigkeyring_t *ring,
 		}
 		secretlen = isc_buffer_usedlength(&secretbuf);

-		ret = dns_tsigkey_create(&keyname, alg, secret, secretlen, mctx,
+		ret = dns_tsigkey_create(keyname, alg, secret, secretlen, mctx,
 					 &tsigkey);
 		isc_mem_put(mctx, secret, secretalloc);
 		secret = NULL;
@@ -138,13 +138,6 @@ configure_zone_acl(const cfg_obj_t *zconfig, const cfg_obj_t *vconfig,
 		}
 	}

-	/*
-	 * Failing that: bailing out: query code will automatically lookup into
-	 * the view if the zone doesn't have ACLs
-	 * (leaving the code below and before the label just in case for now)
-	 */
-	return ISC_R_SUCCESS;
-
 	/* Failing that, see if there's a default ACL already in the view */
 	if (aclp != NULL && *aclp != NULL) {
 		(*setzacl)(zone, *aclp);
@@ -260,7 +253,7 @@ configure_zone_ssutable(const cfg_obj_t *zconfig, dns_zone_t *zone,
 		isc_buffer_constinit(&b, str, strlen(str));
 		isc_buffer_add(&b, strlen(str));
 		result = dns_name_fromtext(dns_fixedname_name(&fident), &b,
-					   dns_rootname, 0, NULL);
+					   dns_rootname, 0);
 		if (result != ISC_R_SUCCESS) {
 			cfg_obj_log(identity, ISC_LOG_ERROR,
 				    "'%s' is not a valid name", str);
@@ -290,7 +283,7 @@ configure_zone_ssutable(const cfg_obj_t *zconfig, dns_zone_t *zone,
 			isc_buffer_constinit(&b, str, strlen(str));
 			isc_buffer_add(&b, strlen(str));
 			result = dns_name_fromtext(dns_fixedname_name(&fname),
-						   &b, dns_rootname, 0, NULL);
+						   &b, dns_rootname, 0);
 			if (result != ISC_R_SUCCESS) {
 				cfg_obj_log(identity, ISC_LOG_ERROR,
 					    "'%s' is not a valid name", str);
@@ -525,7 +518,7 @@ configure_staticstub_servernames(const cfg_obj_t *zconfig, dns_zone_t *zone,

 		isc_buffer_constinit(&b, str, strlen(str));
 		isc_buffer_add(&b, strlen(str));
-		result = dns_name_fromtext(nsname, &b, dns_rootname, 0, NULL);
+		result = dns_name_fromtext(nsname, &b, dns_rootname, 0);
 		if (result != ISC_R_SUCCESS) {
 			cfg_obj_log(zconfig, ISC_LOG_ERROR,
 				    "server-name '%s' is not a valid "
@@ -640,7 +633,7 @@ configure_staticstub(const cfg_obj_t *zconfig, dns_zone_t *zone,
 	 */
 	CHECK(dns_db_newversion(db, &dbversion));

-	dns_name_init(&apexname, NULL);
+	dns_name_init(&apexname);
 	dns_name_clone(dns_zone_getorigin(zone), &apexname);
 	CHECK(dns_db_findnode(db, &apexname, false, &apexnode));

@@ -523,8 +523,7 @@ setup_keystr(void) {
 	isc_buffer_add(&keynamesrc, (unsigned int)(n - name));

 	debug("namefromtext");
-	result = dns_name_fromtext(mykeyname, &keynamesrc, dns_rootname, 0,
-				   NULL);
+	result = dns_name_fromtext(mykeyname, &keynamesrc, dns_rootname, 0);
 	check_result(result, "dns_name_fromtext");

 	secretlen = strlen(secretstr) * 3 / 4;
@@ -786,16 +785,14 @@ set_source_ports(dns_dispatchmgr_t *manager) {
 }

 static isc_result_t
-create_name(const char *str, char *namedata, size_t len, dns_name_t *name) {
-	isc_buffer_t namesrc, namebuf;
+create_name(const char *str, dns_name_t *name) {
+	isc_buffer_t namesrc;

-	dns_name_init(name, NULL);
 	isc_buffer_constinit(&namesrc, str, strlen(str));
 	isc_buffer_add(&namesrc, strlen(str));
-	isc_buffer_init(&namebuf, namedata, len);

 	return dns_name_fromtext(name, &namesrc, dns_rootname,
-				 DNS_NAME_DOWNCASE, &namebuf);
+				 DNS_NAME_DOWNCASE);
 }

 static void
@@ -805,8 +802,8 @@ setup_system(void *arg ISC_ATTR_UNUSED) {
 	isc_sockaddrlist_t *nslist;
 	isc_logconfig_t *logconfig = NULL;
 	irs_resconf_t *resconf = NULL;
-	dns_name_t tlsname;
-	char namedata[DNS_NAME_FORMATSIZE + 1];
+	dns_fixedname_t ftls;
+	dns_name_t *tlsname = dns_fixedname_initname(&ftls);

 	ddebug("setup_system()");

@@ -940,17 +937,15 @@ setup_system(void *arg ISC_ATTR_UNUSED) {
 	isc_tlsctx_cache_create(gmctx, &tls_ctx_cache);

 	if (tls_client_key_file == NULL) {
-		result = create_name("tls-non-auth-client", namedata,
-				     sizeof(namedata), &tlsname);
+		result = create_name("tls-non-auth-client", tlsname);
 		check_result(result, "create_name (tls-non-auth-client)");
-		transport = dns_transport_new(&tlsname, DNS_TRANSPORT_TLS,
+		transport = dns_transport_new(tlsname, DNS_TRANSPORT_TLS,
 					      transport_list);
 		dns_transport_set_tlsname(transport, "tls-non-auth-client");
 	} else {
-		result = create_name("tls-auth-client", namedata,
-				     sizeof(namedata), &tlsname);
+		result = create_name("tls-auth-client", tlsname);
 		check_result(result, "create_name (tls-auth-client)");
-		transport = dns_transport_new(&tlsname, DNS_TRANSPORT_TLS,
+		transport = dns_transport_new(tlsname, DNS_TRANSPORT_TLS,
 					      transport_list);
 		dns_transport_set_tlsname(transport, "tls-auth-client");
 		dns_transport_set_keyfile(transport, tls_client_key_file);
@@ -1309,7 +1304,7 @@ parse_name(char **cmdlinep, dns_message_t *msg, dns_name_t **namep) {
 	dns_message_gettempname(msg, namep);
 	isc_buffer_init(&source, word, strlen(word));
 	isc_buffer_add(&source, strlen(word));
-	result = dns_name_fromtext(*namep, &source, dns_rootname, 0, NULL);
+	result = dns_name_fromtext(*namep, &source, dns_rootname, 0);
 	if (result != ISC_R_SUCCESS) {
 		error("invalid owner name: %s", isc_result_totext(result));
 		isc_buffer_invalidate(&source);
@@ -1735,7 +1730,7 @@ evaluate_key(char *cmdline) {

 	isc_buffer_init(&b, namestr, strlen(namestr));
 	isc_buffer_add(&b, strlen(namestr));
-	result = dns_name_fromtext(mykeyname, &b, dns_rootname, 0, NULL);
+	result = dns_name_fromtext(mykeyname, &b, dns_rootname, 0);
 	if (result != ISC_R_SUCCESS) {
 		fprintf(stderr, "could not parse key name\n");
 		return STATUS_SYNTAX;
@@ -1789,7 +1784,7 @@ evaluate_zone(char *cmdline) {
 	userzone = dns_fixedname_initname(&fuserzone);
 	isc_buffer_init(&b, word, strlen(word));
 	isc_buffer_add(&b, strlen(word));
-	result = dns_name_fromtext(userzone, &b, dns_rootname, 0, NULL);
+	result = dns_name_fromtext(userzone, &b, dns_rootname, 0);
 	if (result != ISC_R_SUCCESS) {
 		userzone = NULL; /* Lest it point to an invalid name */
 		fprintf(stderr, "could not parse zone name\n");
@@ -2614,8 +2609,8 @@ done:
 	if (usegsstsig) {
 		dns_name_free(&tmpzonename, gmctx);
 		dns_name_free(&restart_primary, gmctx);
-		dns_name_init(&tmpzonename, 0);
-		dns_name_init(&restart_primary, 0);
+		dns_name_init(&tmpzonename);
+		dns_name_init(&restart_primary);
 	}
 	done_update();
 }
@@ -2881,7 +2876,7 @@ lookforsoa:
 	result = dns_rdata_tostruct(&soarr, &soa, NULL);
 	check_result(result, "dns_rdata_tostruct");

-	dns_name_init(&primary, NULL);
+	dns_name_init(&primary);
 	dns_name_clone(&soa.origin, &primary);

 	if (userzone != NULL) {
@@ -2937,9 +2932,9 @@ lookforsoa:

 #if HAVE_GSSAPI
 	if (usegsstsig) {
-		dns_name_init(&tmpzonename, NULL);
+		dns_name_init(&tmpzonename);
 		dns_name_dup(zname, gmctx, &tmpzonename);
-		dns_name_init(&restart_primary, NULL);
+		dns_name_init(&restart_primary);
 		dns_name_dup(&primary, gmctx, &restart_primary);
 		start_gssrequest(&primary);
 	} else {
@@ -2968,7 +2963,7 @@ droplabel:
 	if (nlabels == 1) {
 		fatal("could not find enclosing zone");
 	}
-	dns_name_init(&tname, NULL);
+	dns_name_init(&tname);
 	dns_name_getlabelsequence(name, 1, nlabels - 1, &tname);
 	dns_name_clone(&tname, name);
 	dns_request_destroy(&request);
@@ -3075,8 +3070,8 @@ failed_gssrequest(void) {

 	dns_name_free(&tmpzonename, gmctx);
 	dns_name_free(&restart_primary, gmctx);
-	dns_name_init(&tmpzonename, NULL);
-	dns_name_init(&restart_primary, NULL);
+	dns_name_init(&tmpzonename);
+	dns_name_init(&restart_primary);

 	done_update();
 }
@@ -3123,7 +3118,7 @@ start_gssrequest(dns_name_t *primary) {
 	RUNTIME_CHECK(result < sizeof(servicename));
 	isc_buffer_init(&buf, servicename, strlen(servicename));
 	isc_buffer_add(&buf, strlen(servicename));
-	result = dns_name_fromtext(servname, &buf, dns_rootname, 0, NULL);
+	result = dns_name_fromtext(servname, &buf, dns_rootname, 0);
 	if (result != ISC_R_SUCCESS) {
 		fatal("dns_name_fromtext(servname) failed: %s",
 		      isc_result_totext(result));
@@ -3140,7 +3135,7 @@ start_gssrequest(dns_name_t *primary) {
 	isc_buffer_init(&buf, mykeystr, strlen(mykeystr));
 	isc_buffer_add(&buf, strlen(mykeystr));

-	result = dns_name_fromtext(keyname, &buf, dns_rootname, 0, NULL);
+	result = dns_name_fromtext(keyname, &buf, dns_rootname, 0);
 	if (result != ISC_R_SUCCESS) {
 		fatal("dns_name_fromtext(keyname) failed: %s",
 		      isc_result_totext(result));
@@ -3299,7 +3294,7 @@ recvgss(void *arg) {
 	servname = dns_fixedname_initname(&fname);
 	isc_buffer_init(&buf, servicename, strlen(servicename));
 	isc_buffer_add(&buf, strlen(servicename));
-	result = dns_name_fromtext(servname, &buf, dns_rootname, 0, NULL);
+	result = dns_name_fromtext(servname, &buf, dns_rootname, 0);
 	check_result(result, "dns_name_fromtext");

 	result = dns_tkey_gssnegotiate(tsigquery, rcvmsg, servname, &context,
@@ -133,13 +133,14 @@ Currently supported commands are:
   string specified on the command line is the zone configuration text
   that would ordinarily be placed in :iscman:`named.conf`.

-   The configuration is saved in an LMDB database called
-   ``viewname.nzd``. ``viewname`` is the name of the view, unless the
-   view name contains characters that are incompatible with use as a
-   file name, in which case a cryptographic hash of the view name is
-   used instead. When :iscman:`named` is restarted, the file is loaded
-   into the view configuration so that zones that were added can
-   persist after a restart.
+   The configuration is saved in a file called ``viewname.nzf`` (or, if
+   :iscman:`named` is compiled with liblmdb, an LMDB database file called
+   ``viewname.nzd``). ``viewname`` is the name of the view, unless the view
+   name contains characters that are incompatible with use as a file
+   name, in which case a cryptographic hash of the view name is used
+   instead. When :iscman:`named` is restarted, the file is loaded into
+   the view configuration so that zones that were added can persist
+   after a restart.

   This sample ``addzone`` command adds the zone ``example.com`` to
   the default view:
@@ -36,8 +36,8 @@ n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status + ret))

-# This tests that migration from NZF to NZD occurs during named
-# startup
+# When LMDB support is compiled in, this tests that migration from
+# NZF to NZD occurs during named startup
 echo_i "checking previously added zone ($n)"
 ret=0
 $DIG $DIGOPTS @10.53.0.2 a.previous.example a >dig.out.ns2.$n || ret=1
@@ -47,11 +47,13 @@ n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status + ret))

-echo_i "checking that existing NZF file was renamed after migration ($n)"
-[ -e ns2/3bf305731dd26307.nzf~ ] || ret=1
-n=$((n + 1))
-if [ $ret != 0 ]; then echo_i "failed"; fi
-status=$((status + ret))
+if $FEATURETEST --with-lmdb; then
+  echo_i "checking that existing NZF file was renamed after migration ($n)"
+  [ -e ns2/3bf305731dd26307.nzf~ ] || ret=1
+  n=$((n + 1))
+  if [ $ret != 0 ]; then echo_i "failed"; fi
+  status=$((status + ret))
+fi

 echo_i "adding new zone ($n)"
 ret=0
@@ -124,6 +126,16 @@ n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status + ret))

+if ! $FEATURETEST --with-lmdb; then
+  echo_i "verifying no comments in NZF file ($n)"
+  ret=0
+  hcount=$(grep "^# New zone file for view: _default" ns2/3bf305731dd26307.nzf | wc -l)
+  [ $hcount -eq 0 ] || ret=1
+  n=$((n + 1))
+  if [ $ret != 0 ]; then echo_i "failed"; fi
+  status=$((status + ret))
+fi
+
 echo_i "checking rndc showzone with previously added zone ($n)"
 ret=0
 $RNDCCMD 10.53.0.2 showzone previous.example >rndc.out.ns2.$n
@@ -133,11 +145,13 @@ n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status + ret))

-echo_i "checking zone is present in NZD ($n)"
-ret=0
-$NZD2NZF ns2/_default.nzd | grep previous.example >/dev/null || ret=1
-if [ $ret != 0 ]; then echo_i "failed"; fi
-status=$((status + ret))
+if $FEATURETEST --with-lmdb; then
+  echo_i "checking zone is present in NZD ($n)"
+  ret=0
+  $NZD2NZF ns2/_default.nzd | grep previous.example >/dev/null || ret=1
+  if [ $ret != 0 ]; then echo_i "failed"; fi
+  status=$((status + ret))
+fi

 echo_i "deleting previously added zone ($n)"
 ret=0
@@ -157,10 +171,22 @@ check_nzd2nzf() (
    && ! grep previous.example nzd2nzf.out.$n >/dev/null
 )

-echo_i "checking zone was deleted from NZD ($n)"
-retry_quiet 10 check_nzd2nzf || ret=1
-if [ $ret != 0 ]; then echo_i "failed"; fi
-status=$((status + ret))
+if $FEATURETEST --with-lmdb; then
+  echo_i "checking zone was deleted from NZD ($n)"
+  retry_quiet 10 check_nzd2nzf || ret=1
+  if [ $ret != 0 ]; then echo_i "failed"; fi
+  status=$((status + ret))
+fi
+
+if ! $FEATURETEST --with-lmdb; then
+  echo_i "checking NZF file now has comment ($n)"
+  ret=0
+  hcount=$(grep "^# New zone file for view: _default" ns2/3bf305731dd26307.nzf | wc -l)
+  [ $hcount -eq 1 ] || ret=1
+  n=$((n + 1))
+  if [ $ret != 0 ]; then echo_i "failed"; fi
+  status=$((status + ret))
+fi

 echo_i "deleting newly added zone added.example ($n)"
 ret=0
@@ -482,12 +508,24 @@ n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status + ret))

-echo_i "verifying added.example in external view created an external.nzd DB ($n)"
-ret=0
-[ -e ns2/external.nzd ] || ret=1
-n=$((n + 1))
-if [ $ret != 0 ]; then echo_i "failed"; fi
-status=$((status + ret))
+if ! $FEATURETEST --with-lmdb; then
+  echo_i "checking new NZF file has comment ($n)"
+  ret=0
+  hcount=$(grep "^# New zone file for view: external" ns2/external.nzf | wc -l)
+  [ $hcount -eq 1 ] || ret=1
+  n=$((n + 1))
+  if [ $ret != 0 ]; then echo_i "failed"; fi
+  status=$((status + ret))
+fi
+
+if $FEATURETEST --with-lmdb; then
+  echo_i "verifying added.example in external view created an external.nzd DB ($n)"
+  ret=0
+  [ -e ns2/external.nzd ] || ret=1
+  n=$((n + 1))
+  if [ $ret != 0 ]; then echo_i "failed"; fi
+  status=$((status + ret))
+fi

 echo_i "checking rndc reload causes named to reload the external view's new zone config ($n)"
 ret=0
@@ -506,7 +544,11 @@ status=$((status + ret))

 echo_i "checking rndc showzone with newly added zone ($n)"
 _check_rndc_showzone_newly_added() (
-  expected='zone "added.example" { type primary; file "added.db"; };'
+  if ! $FEATURETEST --with-lmdb; then
+    expected='zone "added.example" in external { type primary; file "added.db"; };'
+  else
+    expected='zone "added.example" { type primary; file "added.db"; };'
+  fi
  $RNDCCMD 10.53.0.2 showzone added.example in external >rndc.out.ns2.$n 2>/dev/null \
    && [ "$(cat rndc.out.ns2.$n)" = "$expected" ]
 )
@@ -609,8 +651,13 @@ n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status + ret))

-echo_i "checking NZD file was created in new-zones-directory ($n)"
-expect=ns2/new-zones/directory.nzd
+if $FEATURETEST --with-lmdb; then
+  echo_i "checking NZD file was created in new-zones-directory ($n)"
+  expect=ns2/new-zones/directory.nzd
+else
+  echo_i "checking NZF file was created in new-zones-directory ($n)"
+  expect=ns2/new-zones/directory.nzf
+fi
 $RNDCCMD 10.53.0.2 sync 'added.example IN directory' 2>&1 | sed 's/^/I:ns2 /'
 sleep 2
 [ -e "$expect" ] || ret=1
@@ -646,6 +693,19 @@ n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status + ret))

+if ! $FEATURETEST --with-lmdb; then
+  echo_i "check that addzone is fully reversed on failure (--with-lmdb=no) ($n)"
+  ret=0
+  $RNDCCMD 10.53.0.3 addzone "test1.baz" '{ type primary; file "e.db"; };' >/dev/null 2>&1 || ret=1
+  $RNDCCMD 10.53.0.3 addzone "test2.baz" '{ type primary; file "dne.db"; };' >/dev/null 2>&1 && ret=1
+  $RNDCCMD 10.53.0.3 addzone "test3.baz" '{ type primary; file "e.db"; };' >/dev/null 2>&1 || ret=1
+  $RNDCCMD 10.53.0.3 delzone "test3.baz" >/dev/null 2>&1 || ret=1
+  grep test2.baz ns3/_default.nzf >/dev/null && ret=1
+  n=$((n + 1))
+  if [ $ret != 0 ]; then echo_i "failed"; fi
+  status=$((status + ret))
+fi
+
 _check_version_bind() (
  $DIG $DIGOPTS @10.53.0.3 version.bind txt ch >dig.out.test$n \
    && grep "status: NOERROR" dig.out.test$n >/dev/null
@@ -109,14 +109,26 @@ for lmdb in lmdb-*.conf; do
  n=$((n + 1))
  ret=0

-  echo_i "checking that named-checkconf detects no error in $lmdb ($n)"
-  {
-    $CHECKCONF $lmdb >checkconf.out$n 2>&1
-    rc=$?
-  } || true
-  if [ $rc -ne 0 ]; then
-    echo_i "failed"
-    ret=1
+  if $FEATURETEST --with-lmdb; then
+    echo_i "checking that named-checkconf detects no error in $lmdb ($n)"
+    {
+      $CHECKCONF $lmdb >checkconf.out$n 2>&1
+      rc=$?
+    } || true
+    if [ $rc -ne 0 ]; then
+      echo_i "failed"
+      ret=1
+    fi
+  else
+    echo_i "checking that named-checkconf detects error in $lmdb ($n)"
+    {
+      $CHECKCONF $lmdb >checkconf.out$n 2>&1
+      rc=$?
+    } || true
+    if [ $rc -eq 0 ]; then
+      echo_i "failed"
+      ret=1
+    fi
  fi
  status=$((status + ret))
 done
@@ -518,7 +518,7 @@ add_ns(dns_db_t *db, dns_dbversion_t *version, const dns_name_t *name,
 	ns.common.rdtype = dns_rdatatype_ns;
 	ns.common.rdclass = dns_db_class(db);
 	ns.mctx = NULL;
-	dns_name_init(&ns.name, NULL);
+	dns_name_init(&ns.name);
 	dns_name_clone(nsname, &ns.name);
 	CHECK(dns_rdata_fromstruct(&rdata, dns_db_class(db), dns_rdatatype_ns,
 				   &ns, &b));
@@ -608,9 +608,9 @@ create_db(isc_mem_t *mctx, const dns_name_t *origin, dns_dbtype_t type,
 	};

 	isc_mem_attach(mctx, &sampledb->common.mctx);
-	dns_name_init(&sampledb->common.origin, NULL);
+	dns_name_init(&sampledb->common.origin);

-	dns_name_dupwithoffsets(origin, mctx, &sampledb->common.origin);
+	dns_name_dup(origin, mctx, &sampledb->common.origin);

 	isc_refcount_init(&sampledb->common.references, 1);

@@ -224,7 +224,7 @@ syncptr(sample_instance_t *inst, dns_name_t *name, dns_rdata_t *addr_rdata,

 	dns_fixedname_init(&ptr_name);
 	DNS_RDATACOMMON_INIT(&ptr_struct, dns_rdatatype_ptr, dns_rdataclass_in);
-	dns_name_init(&ptr_struct.ptr, NULL);
+	dns_name_init(&ptr_struct.ptr);

 	syncptr = isc_mem_get(mctx, sizeof(*syncptr));
 	*syncptr = (syncptr_t){ 0 };
@@ -56,6 +56,7 @@ usage(void) {
 	fprintf(stderr, "\t--tsan\n");
 	fprintf(stderr, "\t--with-dlz-filesystem\n");
 	fprintf(stderr, "\t--with-libidn2\n");
+	fprintf(stderr, "\t--with-lmdb\n");
 	fprintf(stderr, "\t--with-libnghttp2\n");
 	fprintf(stderr, "\t--with-zlib\n");
 }
@@ -239,6 +240,14 @@ main(int argc, char **argv) {
 #endif /* ifdef HAVE_LIBIDN2 */
 	}

+	if (strcmp(argv[1], "--with-lmdb") == 0) {
+#ifdef HAVE_LMDB
+		return 0;
+#else  /* ifdef HAVE_LMDB */
+		return 1;
+#endif /* ifdef HAVE_LMDB */
+	}
+
 	if (strcmp(argv[1], "--with-libnghttp2") == 0) {
 #ifdef HAVE_LIBNGHTTP2
 		return 0;
@@ -36,7 +36,7 @@ fi
 echo_i "two question types"
 $PERL formerr.pl -a 10.53.0.1 -p ${PORT} twoquestiontypes >twoquestiontypes.out
 ans=$(grep got: twoquestiontypes.out)
-if [ "${ans}" != "got: 0000800100020000000000000e41414141414141414141414141410000010001c00c00020001" ]; then
+if [ "${ans}" != "got: 000080010000000000000000" ]; then
  echo_i "failed"
  status=$((status + 1))
 fi
@@ -141,7 +141,7 @@ sendquery(void) {
 	isc_buffer_init(&buf, host, strlen(host));
 	isc_buffer_add(&buf, strlen(host));
 	result = dns_name_fromtext(dns_fixedname_name(&queryname), &buf,
-				   dns_rootname, 0, NULL);
+				   dns_rootname, 0);
 	CHECK("dns_name_fromtext", result);

 	dns_message_create(mctx, NULL, NULL, DNS_MESSAGE_INTENTRENDER,
@@ -857,11 +857,6 @@ status=$((status + ret))
 n=$((n + 1))
 echo_i "check that correct namespace is chosen for dual-stack-servers ($n)"
 ret=0
-#
-# The two priming queries are needed until we fix dual-stack-servers fully
-#
-dig_with_opts @fd92:7065:b8e:ffff::9 v4.nameserver A >dig.out.prime1.${n} || ret=1
-dig_with_opts @fd92:7065:b8e:ffff::9 v4.nameserver AAAA >dig.out.prime2.${n} || ret=1
 dig_with_opts @fd92:7065:b8e:ffff::9 foo.v4only.net A >dig.out.ns9.${n} || ret=1
 grep "status: NOERROR" dig.out.ns9.${n} >/dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
@@ -14,6 +14,7 @@
 . ../conf.sh

 cp -f ns1/example1.db ns1/example.db
+cp -f ns1/example3.db.in ns1/example3.db
 cp -f ns3/noprimary.db ns3/noprimary1.db

 copy_setports ns1/named.conf.in ns1/named.conf
@@ -26,6 +26,7 @@ pytestmark = pytest.mark.extra_artifacts(
        "ns1/example.db",
        "ns1/example2-toomanykeys.db",
        "ns1/example2.db",
+        "ns1/example3.db",
        "ns3/dnstap.conf",
        "ns3/dnstap.out",
        "ns3/noprimary1.db",
@@ -2,21 +2,18 @@ include $(top_srcdir)/Makefile.top

 AM_CPPFLAGS +=			\
 	$(LIBISC_CFLAGS)	\
-	$(LIBDNS_CFLAGS)	\
-	$(LMDB_CFLAGS)
+	$(LIBDNS_CFLAGS)

 LDADD +=			\
 	$(LIBDNS_LIBS)		\
-	$(LIBISC_LIBS)		\
-	$(LMDB_LIBS)
+	$(LIBISC_LIBS)

 bin_PROGRAMS =			\
 	arpaname		\
 	mdig			\
 	named-journalprint	\
 	named-rrchecker		\
-	nsec3hash		\
-	named-nzd2nzf
+	nsec3hash

 arpaname_LDADD =		\
 	$(LIBISC_LIBS)
@@ -35,3 +32,17 @@ dnstap_read_LDADD =		\
 	$(LIBISC_LIBS)		\
 	$(DNSTAP_LIBS)
 endif
+
+if HAVE_LMDB
+bin_PROGRAMS +=			\
+	named-nzd2nzf
+
+named_nzd2nzf_CPPFLAGS =		\
+	$(AM_CPPFLAGS)		\
+	$(LMDB_CFLAGS)
+
+named_nzd2nzf_LDADD =		\
+	$(LIBISC_LIBS)		\
+	$(LMDB_LIBS)
+
+endif
@@ -441,7 +441,7 @@ repopulate_buffer:
 			answerstyleflags |= DNS_STYLEFLAG_UNKNOWNFORMAT;
 		}

-		dns_name_init(&empty_name, NULL);
+		dns_name_init(&empty_name);
 		result = dns_message_firstname(response, DNS_SECTION_ANSWER);
 		if (result != ISC_R_NOMORE) {
 			CHECK("dns_message_firstname", result);
@@ -592,7 +592,7 @@ sendquery(struct query *query) {
 	isc_buffer_init(&buf, query->textname, strlen(query->textname));
 	isc_buffer_add(&buf, strlen(query->textname));
 	result = dns_name_fromtext(dns_fixedname_name(&queryname), &buf,
-				   dns_rootname, 0, NULL);
+				   dns_rootname, 0);
 	CHECK("dns_name_fromtext", result);

 	dns_message_create(mctx, NULL, NULL, DNS_MESSAGE_INTENTRENDER,
@@ -11,12 +11,17 @@
 * information regarding copyright ownership.
 */

+#ifndef HAVE_LMDB
+#error This program requires the LMDB library.
+#endif /* ifndef HAVE_LMDB */
+
+#include <lmdb.h>
 #include <stdio.h>
 #include <stdlib.h>

 #include <isc/lib.h>
-#include <isc/lmdb.h>

+/* Included just to get DNS_LMDB_FLAGS definition */
 #include <dns/view.h>

 int
@@ -122,10 +122,10 @@ nsec3hash(nsec3printer *nsec3print, const char *algostr, const char *flagstr,
 	name = dns_fixedname_initname(&fixed);
 	isc_buffer_constinit(&buffer, domain, strlen(domain));
 	isc_buffer_add(&buffer, strlen(domain));
-	result = dns_name_fromtext(name, &buffer, dns_rootname, 0, NULL);
+	result = dns_name_fromtext(name, &buffer, dns_rootname, 0);
 	check_result(result, "dns_name_fromtext() failed");

-	dns_name_downcase(name, name, NULL);
+	dns_name_downcase(name, name);
 	length = isc_iterated_hash(hash, hash_alg, iterations, salt,
 				   salt_length, name->ndata, name->length);
 	if (length == 0) {
@@ -756,13 +756,43 @@ AC_SUBST([KRB5_CFLAGS])
 AC_SUBST([KRB5_LIBS])

 #
-# LMDB is mandatory
+# was --with-lmdb specified?
 #
-PKG_CHECK_MODULES([LMDB], [lmdb])
-AX_SAVE_FLAGS([lmdb])

-CFLAGS="$CFLAGS $LMDB_CFLAGS"
-LIBS="$LIBS $LMDB_LIBS"
+# [pairwise: --with-lmdb=auto, --with-lmdb=yes, --without-lmdb]
+AC_ARG_WITH([lmdb],
+	    [AS_HELP_STRING([--with-lmdb=@<:@PATH@:>@],
+			    [use LMDB library @<:@default=auto@:>@, optionally specify the prefix for lmdb library])],
+	    [:],
+	    [with_lmdb="auto"])
+
+ac_lib_lmdb_found=no
+AS_CASE([$with_lmdb],
+	[no],[],
+	[auto|yes], [PKG_CHECK_MODULES([LMDB], [lmdb],
+				       [ac_lib_lmdb_found=yes],
+				       [for ac_lib_lmdb_path in /usr /usr/local /opt /opt/local; do
+						AX_LIB_LMDB([$ac_lib_lmdb_path],
+							    [ac_lib_lmdb_found=yes
+							     break])
+					done
+				       ])],
+	[AX_LIB_LMDB([$with_lmdb],[ac_lib_lmdb_found=yes])])
+
+# don't fail when in automatic mode
+AS_IF([test "$with_lmdb" = "auto" && test "$ac_lib_lmdb_found" = "no"],
+      [with_lmdb=no])
+
+# hard fail when LMDB requested, but not found
+AS_IF([test "$with_lmdb" != "no" && test "$ac_lib_lmdb_found" != "yes"],
+      [AC_MSG_ERROR([LMDB requested, but not found])])
+
+AS_IF([test "$ac_lib_lmdb_found" = "yes"],
+      [AC_DEFINE([HAVE_LMDB], [1], [Use lmdb library])])
+
+AC_SUBST([LMDB_CFLAGS])
+AC_SUBST([LMDB_LIBS])
+AM_CONDITIONAL([HAVE_LMDB], [test -n "$LMDB_LIBS"])

 #
 # was --with-libxml2 specified?
@@ -1489,6 +1519,7 @@ report() {
 	test -z "$LIBXML2_LIBS" || echo "    XML statistics (--with-libxml2)"
 	test -z "$JSON_C_LIBS" || echo "    JSON statistics (--with-json-c): $JSON_C_CFLAGS $JSON_C_LIBS"
 	test -z "$ZLIB_LIBS" || echo "    HTTP zlib compression (--with-zlib)"
+	test -z "$LMDB_LIBS" || echo "    LMDB database to store configuration for 'addzone' zones (--with-lmdb)"
 	test -z "$LIBIDN2_LIBS" || echo "    IDN support (--with-libidn2)"
    fi

@@ -1550,6 +1581,7 @@ report() {
    test -z "$LIBXML2_LIBS" && echo "    XML statistics (--with-libxml2)"
    test -z "$JSON_C_LIBS" && echo "    JSON statistics (--with-json-c)"
    test -z "$ZLIB_LIBS" && echo "    HTTP zlib compression (--with-zlib)"
+    test -z "$LMDB_LIBS" && echo "    LMDB database to store configuration for 'addzone' zones (--with-lmdb)"
    test -z "$LIBIDN2_LIBS" && echo "    IDN support (--with-libidn2)"

    echo "-------------------------------------------------------------------------------"
@@ -117,6 +117,11 @@ be linked against ``zlib`` (https://zlib.net/). If this is installed in
 a nonstandard location, specify the prefix using
 ``--with-zlib=/prefix``.

+To support storing configuration data for runtime-added zones in an LMDB
+database, the server must be linked with ``liblmdb``
+(https://github.com/LMDB/lmdb). If this is installed in a nonstandard
+location, specify the prefix using ``--with-lmdb=/prefix``.
+
 To support MaxMind GeoIP2 location-based ACLs, the server must be linked
 with ``libmaxminddb`` (https://maxmind.github.io/libmaxminddb/). This is
 turned on by default if the library is found; if the library is
@@ -1364,11 +1364,12 @@ default is used.
   :tags: server
   :short: Sets a maximum size for the memory map of the new-zone database in LMDB database format.

-   This option sets a maximum size for the memory map of the new-zone
-   database (NZD) in LMDB database format. This database is used to
-   store configuration information for zones added using :option:`rndc
-   addzone`. Note that this is not the NZD database file size, but the
-   largest size that the database may grow to.
+   When :iscman:`named` is built with liblmdb, this option sets a maximum size
+   for the memory map of the new-zone database (NZD) in LMDB database
+   format. This database is used to store configuration information for
+   zones added using :option:`rndc addzone`. Note that this is not the NZD
+   database file size, but the largest size that the database may grow
+   to.

   Because the database file is memory-mapped, its size is limited by
   the address space of the :iscman:`named` process. The default of 32 megabytes
@@ -1997,15 +1998,17 @@ Boolean Options

   Newly added zones' configuration parameters are stored so that they
   can persist after the server is restarted. The configuration
-   information is saved in an LMDB database file called
-   ``viewname.nzf``. "viewname" is the name of the view, unless the
-   view name contains characters that are incompatible with use as a
-   file name, in which case a cryptographic hash of the view name is
-   used instead.
+   information is saved in a file called ``viewname.nzf`` (or, if
+   :iscman:`named` is compiled with liblmdb, in an LMDB database file called
+   ``viewname.nzd``). "viewname" is the name of the view, unless the view
+   name contains characters that are incompatible with use as a file
+   name, in which case a cryptographic hash of the view name is used
+   instead.

-   Configurations for zones added at runtime are stored either in a
-   new-zone database (NZD). See :ref:`man_rndc` for further details
-   about :option:`rndc addzone`.
+   Configurations for zones added at runtime are stored either in
+   a new-zone file (NZF) or a new-zone database (NZD), depending on
+   whether :iscman:`named` was linked with liblmdb at compile time. See
+   :ref:`man_rndc` for further details about :option:`rndc addzone`.

 .. namedconf:statement:: auth-nxdomain
   :tags: query
@@ -1,173 +0,0 @@
-<!--
-Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-
-SPDX-License-Identifier: MPL-2.0
-
-This Source Code Form is subject to the terms of the Mozilla Public
-License, v. 2.0.  If a copy of the MPL was not distributed with this
-file, you can obtain one at https://mozilla.org/MPL/2.0/.
-
-See the COPYRIGHT file distributed with this work for additional
-information regarding copyright ownership.
-->
-
-## cfgmgr
-
-### Concepts
-
-cfgmgr is a library to (in-memory) store and to interact with
-configuration data in a hierarchical way. A configuration clause can
-be seen as a "box" holding properties accessible by name. A property
-can be of various types (boolean, unsigned integer, string, sockaddr,
-etc.) as well as a clause, making possible to have nested
-clauses. Furthermore, a clause can be repeated: it is possible to have
-several clauses of the same name (or "several instances") at the same
-level (i.e. in the same parent clause).
-
-### API
-
-Public API usage and concepts are documented in
-lib/isc/include/isc/cfgmgr.h. The API is thread-safe and transaction
-based. In order to access to a clause, it must be opened (which starts
-a read or read-write transaction) and eventually closed (which commit
-the transaction, if read-write). Changes made during a transaction are
-visible by the current thread only. Opening nested clauses doesn't
-create sub-transactions: there is only one transaction at the time for
-a given thread opening a top-level clause.
-
-### Implementation
-
-cfgmgr is essentially a wrapper abstracting LMDB, which is providing
-the storage, thread-safe and transactional access. Because LMDB also
-write data on disk and cfgmgr intents to be in-memory only, the LMDB
-files are immediately deleted during the initialization of cfgmgr.
-
-#### Nested and repeatable clauses
-
-LDBM itself is "flat": it stores key-values associations. In order to
-model nested clauses, cfgmgr dynamically build the key for each value
-using a namespace dot based notation. For example:
-
-```
-foo {
-    bar {
-    	gee: 55;
-    };
-    baz: "abc";
-};
-```
-
-is implemented with the following key-values:
-
-```
-foo.XXX.bar.YYY.gee: 55
-foo.XXX.baz: "abc"
-```
-
-The "XXX" and "YYY" are random numbers identifying a specific clause
-instance. Let's make the configuration a bit more complex:
-
-```
-foo {
-    bar {
-    	gee: 55;
-    };
-    bar {
-    	gee: 234;
-    };
-    baz: "abc";
-};
-```
-
-This is implemented with the following key-values:
-
-```
-foo.XXX.bar.YYY.gee: 55
-foo.XXX.bar.ZZZ.gee: 234
-foo.XXX.baz: "abc"
-```
-
-This makes it easy to differentiate between the two instances of the
-"bar" clause: one is "bar.YYY" while the other is "bar.ZZZ".
-
-The reason a number is used (instead of a name or something else) is
-because LMDB sort the key in a lexicographical way. Also, given a key,
-LMDB is able to give the first key which is equal or bigger. This is
-the crux of how cfgmgr can jump to the next instance of a same clause
-(function `isc_cfgmgr_nextclause`) in one lookup. It takes the key of
-the current clause, increments it by one (which is way simpler than
-incrementing a "string by one"), and asks LMDB to give it back the
-next key equal or bigger than the new one. Example:
-
- current clause is `foo.1234`
- cfgmgr then creates the key prefix `foo.1235.`
- LMDB gives the first key bigger or equals to `foo.1235.`
-
-No matter what's inside `foo.1234` (so no matter the keys starting by
-`foo.1234.`, LMDB returns the first key starting by _at least_
-`foo.1235`, which would be the first key of the next instance of the
-same clause. (If there is no other "foo" clause, nothing is found).
-
-### List properties
-
-named configuration format supports properties holding a list of
-values. cfgmgr approach to implement lists uses the fact that LMDB
-allows duplicate keys and it stores a newly duplicated key after the
-previous ones. A clause "foo" with a property "bar" holding a list of
-integers is implemented by cfgmgr in the following way in LMDB:
-
-```
-foo.XXX.bar: 23
-foo.XXX.bar: 43
-```
-
-(Note there would be another way as LMDB enables to store several
-values for a given key, but it's not flexible enough for cfgmgr: it
-requires providing ahead the size used by all the values. It means
-that adding a new list element would require to allocate a buffer of
-the existing size plus the size of the new element, delete the
-existing key-value from LMDB, and add it again. Dup keys seems to be a
-better fit here.)
-
-### Inheritance (proposal/speculative)
-
-Some named configuration clauses have a concept of inheritance. For
-instance, if a looked-up property is not found in a "view" clause, the
-property will be looked-up in the "options" clause. cfgmgr currently
-doesn't support inheritance, so the following is an API/implementation
-proposal to support-ish it:
-
- a new API `isc_cfgmgr_fallback("A")` could be called while a clause
-  "B" is opened. Then, cfgmgr would know that if a looked-up property
-  of a clause "B" is not found, then it would internally and
-  synchronously try to lookup the same property from within the clause
-  "A". So this can be seen as "B inherits A properties" from the
-  caller perspective. This API could be used once-per clause (no
-  "multiple inheritance"), and it would be possible to break this
-  relation if needed by calling `isc_cfgmgr_fallback(NULL)`.
-
- internally, `isc_cfgmgr_fallback` would create a new LMDB key-value
-  `B.0.fallback: "A"`. So when cfgmgr opens a clause it can figure out
-  if it needs to lookup for another clause in case a looked-up
-  property is not found.
-
- From performance perspective in would make one extra LMDB lookup
-  only if a property name is not found for a clause "B" (so this is
-  likely acceptable). (And of course one extra lookup when opening a
-  clause to find the "clausename.0.fallback" key, but again, that's
-  acceptable.)
-
- limitation 1: if "B" has multiple instances, only the first instance
-  values would be used. (Which I think is fine for named use case:
-  "options" is not a repeatable clause).
-
- limitation 2: There won't be any check to make sure "A" actually
-  exists when `isc_cfgmgr_fallback` is called, so can be done at any
-  tine even if "A" doesn't exists yet. It makes initialization time
-  order-independent (so actually not really a limitation), and more
-  importantly it avoids falling into a rabbit hole, for instance, to
-  make sure that if we delete "A" it would remove all the
-  `"other-clause-names.0.fallback: "A"` keys. This is actually the
-  reason I want to call it "fallback" in the API and not
-  "inheritance". It's basically just a "second-chance" if a value is
-  not found, but nothing more.
@@ -610,19 +610,6 @@ both dynamically and statically allocated, relative and absolute,
 compressed and not, with straightforward conversions from text to
 wire format and vice versa.

-##### Initializing
-
-When a name object is initialized, a pointer to an "offset table"
-(`dns_offsets_t`) may optionally be supplied; this will improve
-performance of most name operations if the name is used more than
-once.
-
-        dns_name_t name1, name2;
-        dns_offsets_t offsets1;
-
-        dns_name_init(&name1, &offsets1);
-        dns_name_init(&name2, NULL);
-
 ##### Copying

 There are three methods for copying name objects:
@@ -641,7 +628,7 @@ There are three methods for copying name objects:
        isc_buffer_t buffer;

        isc_buffer_init(&buffer, namedata, sizeof(namedata));
-        dns_name_init(&target, NULL);
+        dns_name_init(&target);
        dns_name_setbuffer(target, &buffer);
        dns_name_copy(source, &target);

@@ -650,10 +637,8 @@ There are three methods for copying name objects:
  a buffer.

 - `dns_name_dup()` copies a name into a new name object, dynamically
-  allocating buffer space as needed. `dns_name_dupwithoffsets()` does
-  the same, but also dynamically allocates space for the copied offset
-  table.  Targets created by these functions must be freed by calling
-  `dns_name_free()`.
+  allocating buffer space as needed.  Target created by this function
+  must be freed by calling `dns_name_free()`.

 ##### Wire format

@@ -689,7 +674,7 @@ name.
        isc_buffer_t buf;
        dns_name_t name;

-        dns_name_init(&name, NULL);
+        dns_name_init(&name);
        isc_buffer_init(&buf, namedata, sizeof(namedata));
        isc_buffer_add(&buf, strlen(text));
        result = dns_name_fromtext(&name, &buf, dns_rootname, 0, NULL);
@@ -366,8 +366,8 @@ Typical use:
                dns_name_t name, prefix;
                bool sub;

-                dns_name_init(&name, NULL);
-                dns_name_init(&prefix, NULL);
+                dns_name_init(&name);
+                dns_name_init(&prefix);
                dns_rdata_toregion(rdata, &region);
                dns_name_fromregion(&name, &region);
                sub = name_prefix(&name, origin, &prefix);
@@ -1391,7 +1391,7 @@ same DNSSEC policy and interval.

 .. code-block:: none

-    # dnssec-ksr -i now -e +2y -k offline-ksk -l named.conf keygen example.net
+    # dnssec-ksr -i now -e +2y -k offline-ksk -l named.conf request example.net
    ;; KeySigningRequest 1.0 20240813133035 (Tue Aug 13 15:30:35 2024)
    example.net. 3600 IN DNSKEY	256 3 13 Z8WRuXJr9v7cSUZpJuQKN/1pZuLPEgoWx4eQOhVI8Edz49F7xpbxnGar aLelIIIlWuRyjdvUtsnitAfWvyGjqQ==
    ;; KeySigningRequest 1.0 20250215111826 (Sat Feb 15 12:18:26 2025)
@@ -100,7 +100,6 @@ man_MANS =				\
 	named-checkzone.1		\
 	named-compilezone.1		\
 	named-journalprint.1		\
-	named-nzd2nzf.1			\
 	named.8				\
 	nsec3hash.1			\
 	rndc-confgen.8			\
@@ -112,6 +111,11 @@ man_MANS +=				\
 	dnstap-read.1
 endif HAVE_DNSTAP

+if HAVE_LMDB
+man_MANS +=				\
+	named-nzd2nzf.1
+endif HAVE_LMDB
+
 MANPAGES_IN =				\
 	$(man_MANS:=in)			\
 	dnstap-read.1in			\
@@ -165,7 +165,7 @@ options {
 	lame-ttl <duration>;
 	listen-on [ port <integer> ] [ proxy <string> ] [ tls <string> ] [ http <string> ] { <address_match_element>; ... }; // may occur multiple times
 	listen-on-v6 [ port <integer> ] [ proxy <string> ] [ tls <string> ] [ http <string> ] { <address_match_element>; ... }; // may occur multiple times
-	lmdb-mapsize <sizeval>;
+	lmdb-mapsize <sizeval>; // optional (only available if configured)
 	managed-keys-directory <quoted_string>;
 	masterfile-format ( raw | text );
 	masterfile-style ( full | relative );
@@ -452,7 +452,7 @@ view <string> [ <class> ] {
 	}; // may occur multiple times
 	key-directory <quoted_string>;
 	lame-ttl <duration>;
-	lmdb-mapsize <sizeval>;
+	lmdb-mapsize <sizeval>; // optional (only available if configured)
 	masterfile-format ( raw | text );
 	masterfile-style ( full | relative );
 	match-clients { <address_match_element>; ... };
@@ -42,7 +42,7 @@ LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
 	isc_buffer_setactive(&buf, size);

 	result = dns_name_fromtext(dns_fixedname_name(&origin), &buf,
-				   dns_rootname, 0, NULL);
+				   dns_rootname, 0);
 	if (debug) {
 		fprintf(stderr, "dns_name_fromtext: %s\n",
 			isc_result_totext(result));
@@ -41,8 +41,6 @@ LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
 	dns_fixedname_t old_fixed;
 	dns_name_t *new_name = dns_fixedname_initname(&new_fixed);
 	dns_name_t *old_name = dns_fixedname_initname(&old_fixed);
-	uint8_t *new_offsets;
-	uint8_t *old_offsets;
 	dns_decompress_t dctx = DNS_DECOMPRESS_PERMITTED;
 	isc_buffer_t new_buf;
 	isc_buffer_t old_buf;
@@ -81,12 +79,6 @@ LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {

 	REQUIRE(new_result == old_result);
 	REQUIRE(dns_name_equal(new_name, old_name));
-	REQUIRE(new_name->labels == old_name->labels);
-
-	new_offsets = new_name->offsets;
-	old_offsets = old_name->offsets;
-	REQUIRE(new_offsets != NULL && old_offsets != NULL);
-	REQUIRE(memcmp(new_offsets, old_offsets, old_name->labels) == 0);

 	REQUIRE(new_fixed.buffer.current == old_fixed.buffer.current);
 	REQUIRE(new_fixed.buffer.active == old_fixed.buffer.active);
@@ -34,17 +34,12 @@ typedef enum { fw_start = 0, fw_ordinary, fw_newcurrent } fw_state;

 #define VALID_NAME(n) ISC_MAGIC_VALID(n, DNS_NAME_MAGIC)

-#define INIT_OFFSETS(name, var, default_offsets) \
-	if ((name)->offsets != NULL)             \
-		var = (name)->offsets;           \
-	else                                     \
-		var = (default_offsets);
+#define INIT_OFFSETS(name, var, default_offsets) (var) = (default_offsets)

 #define MAKE_EMPTY(name)                           \
 	do {                                       \
 		name->ndata = NULL;                \
 		name->length = 0;                  \
-		name->labels = 0;                  \
 		name->attributes.absolute = false; \
 	} while (0)

@@ -197,7 +192,6 @@ old_name_fromwire(dns_name_t *name, isc_buffer_t *source, dns_decompress_t dctx,
 	}

 	name->ndata = (unsigned char *)target->base + target->used;
-	name->labels = labels;
 	name->length = nused;
 	name->attributes.absolute = true;

@@ -274,7 +274,6 @@ libdns_la_CPPFLAGS =		\
 	$(LIBISC_CFLAGS)	\
 	$(LIBURCU_CFLAGS)	\
 	$(LIBUV_CFLAGS)		\
-	$(LMDB_CFLAGS)		\
 	$(OPENSSL_CFLAGS)

 libdns_la_LDFLAGS =		\
@@ -285,7 +284,6 @@ libdns_la_LIBADD =		\
 	$(LIBISC_LIBS)		\
 	$(LIBURCU_LIBS)		\
 	$(LIBUV_LIBS)		\
-	$(LMDB_LIBS)		\
 	$(OPENSSL_LIBS)

 if HAVE_JSON_C
@@ -335,6 +333,11 @@ libdns_la_CPPFLAGS += $(DNSTAP_CFLAGS)
 libdns_la_LIBADD += $(DNSTAP_LIBS)
 endif

+if HAVE_LMDB
+libdns_la_CPPFLAGS += $(LMDB_CFLAGS)
+libdns_la_LIBADD += $(LMDB_LIBS)
+endif
+
 if !HAVE_SYSTEMTAP
 DTRACE_DEPS = libdns_la-xfrin.lo
 DTRACE_OBJS = .libs/libdns_la-xfrin.$(OBJEXT)
@@ -16,7 +16,6 @@
 #include <inttypes.h>
 #include <stdbool.h>

-#include <isc/cfgmgr.h>
 #include <isc/mem.h>
 #include <isc/once.h>
 #include <isc/string.h>
@@ -325,7 +324,7 @@ dns_acl_merge(dns_acl_t *dest, dns_acl_t *source, bool pos) {

 		/* Duplicate key name. */
 		if (source->elements[i].type == dns_aclelementtype_keyname) {
-			dns_name_init(&dest->elements[nelem + i].keyname, NULL);
+			dns_name_init(&dest->elements[nelem + i].keyname);
 			dns_name_dup(&source->elements[i].keyname, dest->mctx,
 				     &dest->elements[nelem + i].keyname);
 		}
@@ -802,136 +801,3 @@ dns_acl_merge_ports_transports(dns_acl_t *dest, dns_acl_t *source, bool pos) {
 					    next->encrypted, add_negative);
 	}
 }
-
-static isc_result_t
-dns_acl_preallocate(isc_mem_t *mctx, const char *aclname, dns_acl_t **aclp) {
-	isc_result_t result;
-	uint32_t count = 0;
-	isc_cfgmgr_val_t val;
-
-	/*
-	 * Need to allocate a new ACL structure.  Count the items
-	 * in the ACL definition that will require space in the
-	 * elements table, by iterating over the cfgmgr list.
-	 */
-	result = isc_cfgmgr_read(aclname, &val);
-
-	if (result != ISC_R_SUCCESS) {
-		goto out;
-	}
-
-	if (val.type != ISC_CFGMGR_STRING) {
-		UNREACHABLE();
-	}
-
-	/*
-	 * See count_acl_elements(): Need to increment
-	 * count for localhost, localnets, none, but
-	 * _not_ for any
-	 */
-	if (strcasecmp(val.string, "none") == 0) {
-		count++;
-	}
-
-	dns_acl_create(mctx, count, aclp);
-
-out:
-	return result;
-}
-
-isc_result_t
-dns_acl_configure(isc_mem_t *mctx, const char *aclname, dns_acl_t **aclp) {
-	isc_result_t result = ISC_R_SUCCESS;
-	isc_cfgmgr_val_t val;
-	dns_acl_t *dacl = NULL;
-	dns_iptable_t *iptab;
-	bool neg = false;
-
-	REQUIRE(mctx != NULL);
-	REQUIRE(aclname != NULL);
-	REQUIRE(aclp != NULL);
-
-	/*
-	 * Initial code from cfg_acl_fromconfig function. Handle ACL
-	 * inheritance. This is not used for now.
-	 */
-	if (*aclp != NULL) {
-		/*
-		 * If target already points to an ACL, then we're being
-		 * called recursively to configure a nested ACL.  The
-		 * nested ACL's contents should just be absorbed into its
-		 * parent ACL.
-		 */
-		dns_acl_attach(*aclp, &dacl);
-		dns_acl_detach(aclp);
-	} else if (dns_acl_preallocate(mctx, aclname, &dacl) != ISC_R_SUCCESS) {
-		goto out;
-	}
-
-	iptab = dacl->iptable;
-
-//	if (result != ISC_R_SUCCESS) {
-//		goto cleanup;
-//	}
-
-	INSIST(dacl->length <= dacl->alloc);
-
-	isc_cfgmgr_open(aclname);
-	if (isc_cfgmgr_read("any", &val) == ISC_R_SUCCESS) {
-		result = dns_iptable_addprefix(iptab, NULL, 0, !neg);
-		if (result != ISC_R_SUCCESS) {
-			isc_cfgmgr_close();
-			goto cleanup;
-		}
-	} else if (isc_cfgmgr_read("none", &val) == ISC_R_SUCCESS) {
-		result = dns_iptable_addprefix(iptab, NULL, 0, neg);
-		if (result != ISC_R_SUCCESS) {
-			isc_cfgmgr_close();
-			goto cleanup;
-		}
-
-		if (!neg) {
-			dacl->has_negatives = !neg;
-		}
-	} else {
-		UNREACHABLE();
-	}
-	isc_cfgmgr_close();
-
-//	if (val.type != ISC_CFGMGR_STRING) {
-//		UNREACHABLE();
-//	}
-
-//	if (strcasecmp(val.string, "any") == 0) {
-//		result = dns_iptable_addprefix(iptab, NULL, 0, !neg);
-//		if (result != ISC_R_SUCCESS) {
-//			goto cleanup;
-//		}
-//	} else if (strcasecmp(val.string, "none") == 0) {
-//		result = dns_iptable_addprefix(iptab, NULL, 0, neg);
-//		if (result != ISC_R_SUCCESS) {
-//			goto cleanup;
-//		}
-//
-//		if (!neg) {
-//			dacl->has_negatives = !neg;
-//		}
-//	} else {
-//		/*
-//		 * localhost, localnets will be added
-//		 * here.
-//		 *
-//		 * It's possible that named ACL would be
-//		 * attached here as well (currently it's done in
-//		 * count_acl_elements())
-//		 */
-//		UNREACHABLE();
-//	}
-
-	dns_acl_attach(dacl, aclp);
-
-cleanup:
-	dns_acl_detach(&dacl);
-out:
-	return result;
-}
@@ -137,8 +137,6 @@ struct dns_adbname {
 	dns_name_t *name;
 	unsigned int partial_result;
 	unsigned int flags;
-	dns_name_t target;
-	isc_stdtime_t expire_target;
 	isc_stdtime_t expire_v4;
 	isc_stdtime_t expire_v6;
 	dns_adbnamehooklist_t v4;
@@ -314,8 +312,6 @@ print_fetch_list(FILE *, dns_adbname_t *);
 static void
 clean_namehooks(dns_adb_t *, dns_adbnamehooklist_t *);
 static void
-clean_target(dns_adb_t *, dns_name_t *);
-static void
 clean_finds_at_name(dns_adbname_t *, dns_adbstatus_t, unsigned int);
 static void
 maybe_expire_namehooks(dns_adbname_t *, isc_stdtime_t);
@@ -369,8 +365,10 @@ enum {
 */
 enum {
 	NAME_IS_DEAD = 1 << 31,
+	NAME_IS_ALIAS = 1 << 30,
 };
-#define NAME_DEAD(n) (((n)->flags & NAME_IS_DEAD) != 0)
+#define NAME_DEAD(n)  (((n)->flags & NAME_IS_DEAD) != 0)
+#define NAME_ALIAS(n) (((n)->flags & NAME_IS_ALIAS) != 0)

 /*
 * Private flag(s) for adbentry objects.  Note that these will also
@@ -569,6 +567,14 @@ import_rdataset(dns_adbname_t *adbname, dns_rdataset_t *rdataset,
 		rdataset->ttl = ttlclamp(rdataset->ttl);
 	}

+if (rdtype != dns_rdatatype_a && rdtype != dns_rdatatype_aaaa) {
+char rb[DNS_RDATATYPE_FORMATSIZE];
+char nb[DNS_NAME_FORMATSIZE];
+dns_rdatatype_format(rdtype, rb, sizeof(rb));
+dns_name_format(adbname->name, nb, sizeof(nb));
+isc_log_write(DNS_LOGCATEGORY_RESOLVER, DNS_LOGMODULE_RESOLVER, ISC_LOG_NOTICE,
+	      "%s has %s", nb, rb);
+}
 	REQUIRE(rdtype == dns_rdatatype_a || rdtype == dns_rdatatype_aaaa);

 	for (result = dns_rdataset_first(rdataset); result == ISC_R_SUCCESS;
@@ -674,7 +680,6 @@ expire_name(dns_adbname_t *adbname, dns_adbstatus_t astat) {
 	clean_finds_at_name(adbname, astat, DNS_ADBFIND_ADDRESSMASK);
 	clean_namehooks(adb, &adbname->v4);
 	clean_namehooks(adb, &adbname->v6);
-	clean_target(adb, &adbname->target);

 	if (NAME_FETCH_A(adbname)) {
 		dns_resolver_cancelfetch(adbname->fetch_a->fetch);
@@ -733,14 +738,6 @@ maybe_expire_namehooks(dns_adbname_t *adbname, isc_stdtime_t now) {
 		adbname->expire_v6 = INT_MAX;
 		adbname->fetch6_err = FIND_ERR_UNEXPECTED;
 	}
-
-	/*
-	 * Check to see if we need to remove the alias target.
-	 */
-	if (EXPIRE_OK(adbname->expire_target, now)) {
-		clean_target(adb, &adbname->target);
-		adbname->expire_target = INT_MAX;
-	}
 }

 static void
@@ -811,82 +808,6 @@ clean_namehooks(dns_adb_t *adb, dns_adbnamehooklist_t *namehooks) {
 	}
 }

-static void
-clean_target(dns_adb_t *adb, dns_name_t *target) {
-	if (dns_name_countlabels(target) > 0) {
-		dns_name_free(target, adb->mctx);
-		dns_name_init(target, NULL);
-	}
-}
-
-static isc_result_t
-set_target(dns_adb_t *adb, const dns_name_t *name, const dns_name_t *fname,
-	   dns_rdataset_t *rdataset, dns_name_t *target) {
-	isc_result_t result;
-	dns_rdata_t rdata = DNS_RDATA_INIT;
-
-	REQUIRE(dns_name_countlabels(target) == 0);
-
-	if (rdataset->type == dns_rdatatype_cname) {
-		dns_rdata_cname_t cname;
-
-		/*
-		 * Copy the CNAME's target into the target name.
-		 */
-		result = dns_rdataset_first(rdataset);
-		if (result != ISC_R_SUCCESS) {
-			return result;
-		}
-		dns_rdataset_current(rdataset, &rdata);
-		result = dns_rdata_tostruct(&rdata, &cname, NULL);
-		if (result != ISC_R_SUCCESS) {
-			return result;
-		}
-		dns_name_dup(&cname.cname, adb->mctx, target);
-		dns_rdata_freestruct(&cname);
-	} else {
-		dns_fixedname_t fixed1, fixed2;
-		dns_name_t *prefix = NULL, *new_target = NULL;
-		dns_rdata_dname_t dname;
-		dns_namereln_t namereln;
-		unsigned int nlabels;
-		int order;
-
-		INSIST(rdataset->type == dns_rdatatype_dname);
-		namereln = dns_name_fullcompare(name, fname, &order, &nlabels);
-		INSIST(namereln == dns_namereln_subdomain);
-
-		/*
-		 * Get the target name of the DNAME.
-		 */
-		result = dns_rdataset_first(rdataset);
-		if (result != ISC_R_SUCCESS) {
-			return result;
-		}
-		dns_rdataset_current(rdataset, &rdata);
-		result = dns_rdata_tostruct(&rdata, &dname, NULL);
-		if (result != ISC_R_SUCCESS) {
-			return result;
-		}
-
-		/*
-		 * Construct the new target name.
-		 */
-		prefix = dns_fixedname_initname(&fixed1);
-		new_target = dns_fixedname_initname(&fixed2);
-		dns_name_split(name, nlabels, prefix, NULL);
-		result = dns_name_concatenate(prefix, &dname.dname, new_target,
-					      NULL);
-		dns_rdata_freestruct(&dname);
-		if (result != ISC_R_SUCCESS) {
-			return result;
-		}
-		dns_name_dup(new_target, adb->mctx, target);
-	}
-
-	return ISC_R_SUCCESS;
-}
-
 /*
 * The name must be locked.
 */
@@ -967,7 +888,6 @@ new_adbname(dns_adb_t *adb, const dns_name_t *dnsname, unsigned int flags) {
 		.adb = dns_adb_ref(adb),
 		.expire_v4 = INT_MAX,
 		.expire_v6 = INT_MAX,
-		.expire_target = INT_MAX,
 		.fetch_err = FIND_ERR_UNEXPECTED,
 		.fetch6_err = FIND_ERR_UNEXPECTED,
 		.v4 = ISC_LIST_INITIALIZER,
@@ -988,7 +908,6 @@ new_adbname(dns_adb_t *adb, const dns_name_t *dnsname, unsigned int flags) {

 	name->name = dns_fixedname_initname(&name->fname);
 	dns_name_copy(dnsname, name->name);
-	dns_name_init(&name->target, NULL);

 	inc_adbstats(adb, dns_adbstats_namescnt);
 	return name;
@@ -1545,8 +1464,7 @@ maybe_expire_name(dns_adbname_t *adbname, isc_stdtime_t now) {

 	/* ... or is not yet expired. */
 	if (!EXPIRE_OK(adbname->expire_v4, now) ||
-	    !EXPIRE_OK(adbname->expire_v6, now) ||
-	    !EXPIRE_OK(adbname->expire_target, now))
+	    !EXPIRE_OK(adbname->expire_v6, now))
 	{
 		return false;
 	}
@@ -1927,8 +1845,8 @@ isc_result_t
 dns_adb_createfind(dns_adb_t *adb, isc_loop_t *loop, isc_job_cb cb, void *cbarg,
 		   const dns_name_t *name, const dns_name_t *qname,
 		   dns_rdatatype_t qtype ISC_ATTR_UNUSED, unsigned int options,
-		   isc_stdtime_t now, dns_name_t *target, in_port_t port,
-		   unsigned int depth, isc_counter_t *qc, isc_counter_t *gqc,
+		   isc_stdtime_t now, in_port_t port, unsigned int depth,
+		   isc_counter_t *qc, isc_counter_t *gqc,
 		   dns_adbfind_t **findp) {
 	isc_result_t result = ISC_R_UNEXPECTED;
 	dns_adbfind_t *find = NULL;
@@ -1949,7 +1867,6 @@ dns_adb_createfind(dns_adb_t *adb, isc_loop_t *loop, isc_job_cb cb, void *cbarg,
 	REQUIRE(name != NULL);
 	REQUIRE(qname != NULL);
 	REQUIRE(findp != NULL && *findp == NULL);
-	REQUIRE(target == NULL || dns_name_hasbuffer(target));

 	REQUIRE((options & DNS_ADBFIND_ADDRESSMASK) != 0);

@@ -2005,7 +1922,7 @@ again:
 	/*
 	 * Do we know that the name is an alias?
 	 */
-	if (!EXPIRE_OK(adbname->expire_target, now)) {
+	if (NAME_ALIAS(adbname) && !EXPIRE_OK(adbname->expire_v4, now)) {
 		/* Yes, it is. */
 		DP(DEF_LEVEL,
 		   "dns_adb_createfind: name %s (%p) is an alias (cached)",
@@ -2219,9 +2136,6 @@ post_copy:

 	find->partial_result |= (adbname->partial_result & wanted_addresses);
 	if (alias) {
-		if (target != NULL) {
-			dns_name_copy(&adbname->target, target);
-		}
 		result = DNS_R_ALIAS;
 	} else {
 		result = ISC_R_SUCCESS;
@@ -2409,14 +2323,9 @@ dump_adb(dns_adb_t *adb, FILE *f, bool debug, isc_stdtime_t now) {
 		}
 		fprintf(f, "; ");
 		dns_name_print(name->name, f);
-		if (dns_name_countlabels(&name->target) > 0) {
-			fprintf(f, " alias ");
-			dns_name_print(&name->target, f);
-		}

 		dump_ttl(f, "v4", name->expire_v4, now);
 		dump_ttl(f, "v6", name->expire_v6, now);
-		dump_ttl(f, "target", name->expire_target, now);

 		fprintf(f, " [v4 %s] [v6 %s]", errnames[name->fetch_err],
 			errnames[name->fetch6_err]);
@@ -2763,18 +2672,17 @@ dbfind_name(dns_adbname_t *adbname, isc_stdtime_t now, dns_rdatatype_t rdtype) {
 		break;
 	case DNS_R_CNAME:
 	case DNS_R_DNAME:
+		/*
+		 * We found a CNAME or DNAME. Mark this as an
+		 * alias (not to be used) and mark the expiry
+		 * for both address families so we won't ask again
+		 * for a while.
+		 */
 		rdataset.ttl = ttlclamp(rdataset.ttl);
-		clean_target(adb, &adbname->target);
-		adbname->expire_target = INT_MAX;
-		result = set_target(adb, adbname->name, fname, &rdataset,
-				    &adbname->target);
-		if (result == ISC_R_SUCCESS) {
-			result = DNS_R_ALIAS;
-			DP(NCACHE_LEVEL, "adb name %p: caching alias target",
-			   adbname);
-			adbname->expire_target = ADJUSTED_EXPIRE(
-				adbname->expire_target, now, rdataset.ttl);
-		}
+		result = DNS_R_ALIAS;
+		adbname->flags |= NAME_IS_ALIAS;
+		adbname->expire_v4 = adbname->expire_v6 =
+			ADJUSTED_EXPIRE(INT_MAX, now, rdataset.ttl);
 		if (rdtype == dns_rdatatype_a) {
 			adbname->fetch_err = FIND_ERR_SUCCESS;
 		} else {
@@ -2889,16 +2797,10 @@ fetch_callback(void *arg) {
 	 */
 	if (resp->result == DNS_R_CNAME || resp->result == DNS_R_DNAME) {
 		resp->rdataset->ttl = ttlclamp(resp->rdataset->ttl);
-		clean_target(adb, &name->target);
-		name->expire_target = INT_MAX;
-		result = set_target(adb, name->name, resp->foundname,
-				    resp->rdataset, &name->target);
-		if (result == ISC_R_SUCCESS) {
-			DP(NCACHE_LEVEL,
-			   "adb fetch name %p: caching alias target", name);
-			name->expire_target = ADJUSTED_EXPIRE(
-				name->expire_target, now, resp->rdataset->ttl);
-		}
+		result = ISC_R_SUCCESS;
+		name->flags |= NAME_IS_ALIAS;
+		name->expire_v4 = name->expire_v6 =
+			ADJUSTED_EXPIRE(INT_MAX, now, resp->rdataset->ttl);
 		goto check_result;
 	}

@@ -170,7 +170,7 @@ bcentry_new(isc_loop_t *loop, const dns_name_t *name,
 		.lru_head = CDS_LIST_HEAD_INIT(bad->lru_head),
 	};

-	dns_name_init(&bad->name, NULL);
+	dns_name_init(&bad->name);
 	dns_name_dup(name, mctx, &bad->name);

 	return bad;
@@ -80,5 +80,5 @@ dns_byaddr_createptrname(const isc_netaddr_t *address, dns_name_t *name) {
 	len = (unsigned int)strlen(textname);
 	isc_buffer_init(&buffer, textname, len);
 	isc_buffer_add(&buffer, len);
-	return dns_name_fromtext(name, &buffer, dns_rootname, 0, NULL);
+	return dns_name_fromtext(name, &buffer, dns_rootname, 0);
 }
@@ -17,6 +17,7 @@
 #include <stdbool.h>
 #include <stdint.h>
 #include <stdlib.h>
+#include <unistd.h>

 #include <isc/async.h>
 #include <isc/hex.h>
@@ -34,6 +35,8 @@
 #include <dns/view.h>
 #include <dns/zone.h>

+#include "dns/name.h"
+
 #define DNS_CATZ_ZONE_MAGIC  ISC_MAGIC('c', 'a', 't', 'z')
 #define DNS_CATZ_ZONES_MAGIC ISC_MAGIC('c', 'a', 't', 's')
 #define DNS_CATZ_ENTRY_MAGIC ISC_MAGIC('c', 'a', 't', 'e')
@@ -249,7 +252,7 @@ catz_coo_new(isc_mem_t *mctx, const dns_name_t *domain) {
 	*ncoo = (dns_catz_coo_t){
 		.magic = DNS_CATZ_COO_MAGIC,
 	};
-	dns_name_init(&ncoo->name, NULL);
+	dns_name_init(&ncoo->name);
 	dns_name_dup(domain, mctx, &ncoo->name);
 	isc_refcount_init(&ncoo->references, 1);

@@ -304,7 +307,7 @@ dns_catz_entry_new(isc_mem_t *mctx, const dns_name_t *domain) {
 		.magic = DNS_CATZ_ENTRY_MAGIC,
 	};

-	dns_name_init(&nentry->name, NULL);
+	dns_name_init(&nentry->name);
 	if (domain != NULL) {
 		dns_name_dup(domain, mctx, &nentry->name);
 	}
@@ -557,7 +560,7 @@ dns__catz_zones_merge(dns_catz_zone_t *catz, dns_catz_zone_t *newcatz) {
 		 * record, removed.
 		 * xxxwpk: make it a separate verification phase?
 		 */
-		if (dns_name_countlabels(&nentry->name) == 0) {
+		if (nentry->name.length == 0) {
 			dns_catz_entry_detach(newcatz, &nentry);
 			delcur = true;
 			continue;
@@ -839,7 +842,7 @@ dns_catz_zone_new(dns_catz_zones_t *catzs, const dns_name_t *name) {
 	isc_time_settoepoch(&catz->lastupdated);
 	dns_catz_options_init(&catz->defoptions);
 	dns_catz_options_init(&catz->zoneoptions);
-	dns_name_init(&catz->name, NULL);
+	dns_name_init(&catz->name);
 	dns_name_dup(name, catzs->mctx, &catz->name);

 	return catz;
@@ -1154,16 +1157,18 @@ catz_process_zones(dns_catz_zone_t *catz, dns_rdataset_t *value,
 	REQUIRE(DNS_RDATASET_VALID(value));
 	REQUIRE(ISC_MAGIC_VALID(name, DNS_NAME_MAGIC));

-	if (name->labels == 0) {
+	uint8_t labels = dns_name_countlabels(name);
+
+	if (labels == 0) {
 		return ISC_R_FAILURE;
 	}

-	dns_name_getlabel(name, name->labels - 1, &mhash);
+	dns_name_getlabel(name, labels - 1, &mhash);

-	if (name->labels == 1) {
+	if (labels == 1) {
 		return catz_process_zones_entry(catz, value, &mhash);
 	} else {
-		dns_name_init(&opt, NULL);
+		dns_name_init(&opt);
 		dns_name_split(name, 1, &opt, NULL);
 		return catz_process_zones_suboption(catz, value, &mhash, &opt);
 	}
@@ -1405,7 +1410,7 @@ catz_process_primaries(dns_catz_zone_t *catz, dns_ipkeylist_t *ipkl,
 	 * - label and IN A/IN AAAA
 	 * - label and IN TXT - TSIG key name
 	 */
-	if (name->labels > 0) {
+	if (name->length != 0) {
 		isc_sockaddr_t sockaddr;
 		size_t i;

@@ -1455,7 +1460,7 @@ catz_process_primaries(dns_catz_zone_t *catz, dns_ipkeylist_t *ipkl,

 			/* rdatastr.length < DNS_NAME_MAXTEXT */
 			keyname = isc_mem_get(mctx, sizeof(*keyname));
-			dns_name_init(keyname, 0);
+			dns_name_init(keyname);
 			memmove(keycbuf, rdatastr.data, rdatastr.length);
 			keycbuf[rdatastr.length] = 0;
 			dns_rdata_freestruct(&rdata_txt);
@@ -1496,7 +1501,7 @@ catz_process_primaries(dns_catz_zone_t *catz, dns_ipkeylist_t *ipkl,

 			ipkl->labels[i] = isc_mem_get(mctx,
 						      sizeof(*ipkl->labels[0]));
-			dns_name_init(ipkl->labels[i], NULL);
+			dns_name_init(ipkl->labels[i]);
 			dns_name_dup(name, mctx, ipkl->labels[i]);

 			if (value->type == dns_rdatatype_txt) {
@@ -1644,10 +1649,12 @@ catz_process_zones_suboption(dns_catz_zone_t *catz, dns_rdataset_t *value,
 	REQUIRE(DNS_RDATASET_VALID(value));
 	REQUIRE(ISC_MAGIC_VALID(name, DNS_NAME_MAGIC));

-	if (name->labels < 1) {
+	uint8_t labels = dns_name_countlabels(name);
+
+	if (labels < 1) {
 		return ISC_R_FAILURE;
 	}
-	dns_name_getlabel(name, name->labels - 1, &option);
+	dns_name_getlabel(name, labels - 1, &option);
 	opt = catz_get_option(&option);

 	/*
@@ -1655,11 +1662,11 @@ catz_process_zones_suboption(dns_catz_zone_t *catz, dns_rdataset_t *value,
 	 * "ext" label.
 	 */
 	if (catz->version >= 2 && opt >= CATZ_OPT_CUSTOM_START) {
-		if (opt != CATZ_OPT_EXT || name->labels < 2) {
+		if (opt != CATZ_OPT_EXT || labels < 2) {
 			return ISC_R_FAILURE;
 		}
 		suffix_labels++;
-		dns_name_getlabel(name, name->labels - 2, &option);
+		dns_name_getlabel(name, labels - 2, &option);
 		opt = catz_get_option(&option);
 	}

@@ -1676,7 +1683,7 @@ catz_process_zones_suboption(dns_catz_zone_t *catz, dns_rdataset_t *value,
 	}
 	INSIST(result == ISC_R_SUCCESS);

-	dns_name_init(&prefix, NULL);
+	dns_name_init(&prefix);
 	dns_name_split(name, suffix_labels, &prefix, NULL);
 	switch (opt) {
 	case CATZ_OPT_COO:
@@ -1684,13 +1691,13 @@ catz_process_zones_suboption(dns_catz_zone_t *catz, dns_rdataset_t *value,
 	case CATZ_OPT_PRIMARIES:
 		return catz_process_primaries(catz, &entry->opts.masters, value,
 					      &prefix);
-	case CATZ_OPT_ALLOW_QUERY:
-		if (prefix.labels != 0) {
+	case CATZ_OPT_ALLOW_QUERY:;
+		if (prefix.length != 0) {
 			return ISC_R_FAILURE;
 		}
 		return catz_process_apl(catz, &entry->opts.allow_query, value);
 	case CATZ_OPT_ALLOW_TRANSFER:
-		if (prefix.labels != 0) {
+		if (prefix.length != 0) {
 			return ISC_R_FAILURE;
 		}
 		return catz_process_apl(catz, &entry->opts.allow_transfer,
@@ -1734,10 +1741,12 @@ catz_process_value(dns_catz_zone_t *catz, dns_name_t *name,
 	REQUIRE(ISC_MAGIC_VALID(name, DNS_NAME_MAGIC));
 	REQUIRE(DNS_RDATASET_VALID(rdataset));

-	if (name->labels < 1) {
+	uint8_t labels = dns_name_countlabels(name);
+
+	if (labels < 1) {
 		return ISC_R_FAILURE;
 	}
-	dns_name_getlabel(name, name->labels - 1, &option);
+	dns_name_getlabel(name, labels - 1, &option);
 	opt = catz_get_option(&option);

 	/*
@@ -1745,15 +1754,15 @@ catz_process_value(dns_catz_zone_t *catz, dns_name_t *name,
 	 * "ext" label.
 	 */
 	if (catz->version >= 2 && opt >= CATZ_OPT_CUSTOM_START) {
-		if (opt != CATZ_OPT_EXT || name->labels < 2) {
+		if (opt != CATZ_OPT_EXT || labels < 2) {
 			return ISC_R_FAILURE;
 		}
 		suffix_labels++;
-		dns_name_getlabel(name, name->labels - 2, &option);
+		dns_name_getlabel(name, labels - 2, &option);
 		opt = catz_get_option(&option);
 	}

-	dns_name_init(&prefix, NULL);
+	dns_name_init(&prefix);
 	dns_name_split(name, suffix_labels, &prefix, NULL);

 	switch (opt) {
@@ -1763,19 +1772,19 @@ catz_process_value(dns_catz_zone_t *catz, dns_name_t *name,
 		return catz_process_primaries(catz, &catz->zoneoptions.masters,
 					      rdataset, &prefix);
 	case CATZ_OPT_ALLOW_QUERY:
-		if (prefix.labels != 0) {
+		if (prefix.length != 0) {
 			return ISC_R_FAILURE;
 		}
 		return catz_process_apl(catz, &catz->zoneoptions.allow_query,
 					rdataset);
 	case CATZ_OPT_ALLOW_TRANSFER:
-		if (prefix.labels != 0) {
+		if (prefix.length != 0) {
 			return ISC_R_FAILURE;
 		}
 		return catz_process_apl(catz, &catz->zoneoptions.allow_transfer,
 					rdataset);
 	case CATZ_OPT_VERSION:
-		if (prefix.labels != 0) {
+		if (prefix.length != 0) {
 			return ISC_R_FAILURE;
 		}
 		return catz_process_version(catz, rdataset);
@@ -1841,8 +1850,9 @@ dns__catz_update_process(dns_catz_zone_t *catz, const dns_name_t *src_name,
 		return ISC_R_UNEXPECTED;
 	}

-	dns_name_init(&prefix, NULL);
-	dns_name_split(src_name, catz->name.labels, &prefix, NULL);
+	uint8_t labels = dns_name_countlabels(&catz->name);
+	dns_name_init(&prefix);
+	dns_name_split(src_name, labels, &prefix, NULL);
 	result = catz_process_value(catz, &prefix, rdataset);

 	return result;
@@ -569,7 +569,7 @@ client_resfind(resctx_t *rctx, dns_fetchresponse_t *resp) {
 		dns_name_t *aname = dns_fixedname_name(&rctx->name);

 		ansname = isc_mem_get(mctx, sizeof(*ansname));
-		dns_name_init(ansname, NULL);
+		dns_name_init(ansname);

 		dns_name_dup(aname, mctx, ansname);

@@ -652,7 +652,7 @@ client_resfind(resctx_t *rctx, dns_fetchresponse_t *resp) {
 			prefix = dns_fixedname_initname(&fixed);
 			dns_name_split(name, nlabels, prefix, NULL);
 			tresult = dns_name_concatenate(prefix, &dname.dname,
-						       name, NULL);
+						       name);
 			dns_rdata_freestruct(&dname);
 			if (tresult == ISC_R_SUCCESS) {
 				want_restart = true;
@@ -57,6 +57,7 @@ dns_compress_init(dns_compress_t *cctx, isc_mem_t *mctx,
 		.mctx = mctx,
 		.mask = mask,
 		.set = set,
+		.coff = 0xffff,
 	};
 }

@@ -69,6 +70,23 @@ dns_compress_invalidate(dns_compress_t *cctx) {
 	*cctx = (dns_compress_t){ 0 };
 }

+void
+dns_compress_setmultiuse(dns_compress_t *cctx, bool multi) {
+	REQUIRE(CCTX_VALID(cctx));
+	if (multi) {
+		cctx->flags |= DNS_COMPRESS_MULTIUSE;
+	} else {
+		cctx->flags &= ~DNS_COMPRESS_MULTIUSE;
+	}
+	cctx->coff = 0xffff;
+}
+
+bool
+dns_compress_getmultiuse(dns_compress_t *cctx) {
+	REQUIRE(CCTX_VALID(cctx));
+	return (cctx->flags & DNS_COMPRESS_MULTIUSE) != 0;
+}
+
 void
 dns_compress_setpermitted(dns_compress_t *cctx, bool permitted) {
 	REQUIRE(CCTX_VALID(cctx));
@@ -77,6 +95,7 @@ dns_compress_setpermitted(dns_compress_t *cctx, bool permitted) {
 	} else {
 		cctx->flags &= ~DNS_COMPRESS_PERMITTED;
 	}
+	dns_compress_setmultiuse(cctx, false);
 }

 bool
@@ -218,13 +237,14 @@ slot_index(dns_compress_t *cctx, unsigned int hash, unsigned int probe) {
 }

 static bool
-insert_label(dns_compress_t *cctx, isc_buffer_t *buffer, const dns_name_t *name,
-	     unsigned int label, uint16_t hash, unsigned int probe) {
+insert_label(dns_compress_t *cctx, isc_buffer_t *buffer,
+	     const dns_offsets_t offsets, unsigned int label, uint16_t hash,
+	     unsigned int probe) {
 	/*
 	 * hash set entries must have valid compression offsets
 	 * and the hash set must not get too full (75% load)
 	 */
-	unsigned int prefix_len = name->offsets[label];
+	unsigned int prefix_len = offsets[label];
 	unsigned int coff = isc_buffer_usedlength(buffer) + prefix_len;
 	if (coff >= 0x4000 || cctx->count > cctx->mask * 3 / 4) {
 		return false;
@@ -253,17 +273,18 @@ insert_label(dns_compress_t *cctx, isc_buffer_t *buffer, const dns_name_t *name,
 */
 static void
 insert(dns_compress_t *cctx, isc_buffer_t *buffer, const dns_name_t *name,
-       unsigned int label, uint16_t hash, unsigned int probe) {
+       const dns_offsets_t offsets, unsigned int label, uint16_t hash,
+       unsigned int probe) {
 	bool sensitive = (cctx->flags & DNS_COMPRESS_CASE) != 0;
 	/*
 	 * this insertion loop continues from the search loop inside
 	 * dns_compress_name() below, iterating over the remaining labels
 	 * of the name and accumulating the hash in the same manner
 	 */
-	while (insert_label(cctx, buffer, name, label, hash, probe) &&
+	while (insert_label(cctx, buffer, offsets, label, hash, probe) &&
 	       label-- > 0)
 	{
-		unsigned int prefix_len = name->offsets[label];
+		unsigned int prefix_len = offsets[label];
 		uint8_t *suffix_ptr = name->ndata + prefix_len;
 		hash = hash_label(hash, suffix_ptr, sensitive);
 		probe = 0;
@@ -277,8 +298,6 @@ dns_compress_name(dns_compress_t *cctx, isc_buffer_t *buffer,
 	REQUIRE(CCTX_VALID(cctx));
 	REQUIRE(ISC_BUFFER_VALID(buffer));
 	REQUIRE(dns_name_isabsolute(name));
-	REQUIRE(name->labels > 0);
-	REQUIRE(name->offsets != NULL);
 	REQUIRE(return_prefix != NULL);
 	REQUIRE(return_coff != NULL);
 	REQUIRE(*return_coff == 0);
@@ -287,17 +306,21 @@ dns_compress_name(dns_compress_t *cctx, isc_buffer_t *buffer,
 		return;
 	}

+	dns_offsets_t offsets;
+	size_t labels = dns_name_offsets(name, offsets);
+	INSIST(labels > 0);
+
 	bool sensitive = (cctx->flags & DNS_COMPRESS_CASE) != 0;

 	uint16_t hash = HASH_INIT_DJB2;
-	unsigned int label = name->labels - 1; /* skip the root label */
+	size_t label = labels - 1; /* skip the root label */

 	/*
 	 * find out how much of the name's suffix is in the hash set,
 	 * stepping backwards from the end one label at a time
 	 */
 	while (label-- > 0) {
-		unsigned int prefix_len = name->offsets[label];
+		unsigned int prefix_len = offsets[label];
 		unsigned int suffix_len = name->length - prefix_len;
 		uint8_t *suffix_ptr = name->ndata + prefix_len;
 		hash = hash_label(hash, suffix_ptr, sensitive);
@@ -313,7 +336,8 @@ dns_compress_name(dns_compress_t *cctx, isc_buffer_t *buffer,
 			 * the rest of the name (its prefix) into the set
 			 */
 			if (coff == 0 || probe > probe_distance(cctx, slot)) {
-				insert(cctx, buffer, name, label, hash, probe);
+				insert(cctx, buffer, name, offsets, label, hash,
+				       probe);
 				return;
 			}

@@ -71,7 +71,7 @@ dns_difftuple_create(isc_mem_t *mctx, dns_diffop_t op, const dns_name_t *name,
 	datap = (unsigned char *)(t + 1);

 	memmove(datap, name->ndata, name->length);
-	dns_name_init(&t->name, NULL);
+	dns_name_init(&t->name);
 	dns_name_clone(name, &t->name);
 	t->name.ndata = datap;
 	datap += name->length;
@@ -410,7 +410,7 @@ dns_dlz_writeablezone(dns_view_t *view, dns_dlzdb_t *dlzdb,
 	isc_buffer_add(&buffer, strlen(zone_name));
 	dns_fixedname_init(&fixorigin);
 	result = dns_name_fromtext(dns_fixedname_name(&fixorigin), &buffer,
-				   dns_rootname, 0, NULL);
+				   dns_rootname, 0);
 	if (result != ISC_R_SUCCESS) {
 		goto cleanup;
 	}
@@ -167,8 +167,8 @@ digest_sig(dst_context_t *ctx, bool downcase, dns_rdata_t *sigrdata,
 		dns_fixedname_init(&fname);

 		RUNTIME_CHECK(dns_name_downcase(&rrsig->signer,
-						dns_fixedname_name(&fname),
-						NULL) == ISC_R_SUCCESS);
+						dns_fixedname_name(&fname)) ==
+			      ISC_R_SUCCESS);
 		dns_name_toregion(dns_fixedname_name(&fname), &r);
 	} else {
 		dns_name_toregion(&rrsig->signer, &r);
@@ -228,11 +228,11 @@ dns_dnssec_sign(const dns_name_t *name, dns_rdataset_t *set, dst_key_t *key,
 	/*
 	 * Downcase signer.
 	 */
-	dns_name_init(&sig.signer, NULL);
+	dns_name_init(&sig.signer);
 	dns_fixedname_init(&fsigner);
 	RUNTIME_CHECK(dns_name_downcase(dst_key_name(key),
-					dns_fixedname_name(&fsigner),
-					NULL) == ISC_R_SUCCESS);
+					dns_fixedname_name(&fsigner)) ==
+		      ISC_R_SUCCESS);
 	dns_name_clone(dns_fixedname_name(&fsigner), &sig.signer);

 	sig.covered = set->type;
@@ -280,8 +280,8 @@ dns_dnssec_sign(const dns_name_t *name, dns_rdataset_t *set, dst_key_t *key,
 	}

 	dns_fixedname_init(&fnewname);
-	RUNTIME_CHECK(dns_name_downcase(name, dns_fixedname_name(&fnewname),
-					NULL) == ISC_R_SUCCESS);
+	RUNTIME_CHECK(dns_name_downcase(name, dns_fixedname_name(&fnewname)) ==
+		      ISC_R_SUCCESS);
 	dns_name_toregion(dns_fixedname_name(&fnewname), &r);

 	/*
@@ -479,8 +479,8 @@ again:
 	 */
 	dns_fixedname_init(&fnewname);
 	labels = dns_name_countlabels(name) - 1;
-	RUNTIME_CHECK(dns_name_downcase(name, dns_fixedname_name(&fnewname),
-					NULL) == ISC_R_SUCCESS);
+	RUNTIME_CHECK(dns_name_downcase(name, dns_fixedname_name(&fnewname)) ==
+		      ISC_R_SUCCESS);
 	if (labels - sig.labels > 0) {
 		dns_name_split(dns_fixedname_name(&fnewname), sig.labels + 1,
 			       NULL, dns_fixedname_name(&fnewname));
@@ -592,7 +592,7 @@ cleanup_struct:
 			RUNTIME_CHECK(dns_name_concatenate(
 					      dns_wildcardname,
 					      dns_fixedname_name(&fnewname),
-					      wild, NULL) == ISC_R_SUCCESS);
+					      wild) == ISC_R_SUCCESS);
 		}
 		inc_stat(dns_dnssecstats_wildcard);
 		ret = DNS_R_FROMWILDCARD;
@@ -803,7 +803,7 @@ dns_dnssec_signmessage(dns_message_t *msg, dst_key_t *key) {

 	sig.keyid = dst_key_id(key);

-	dns_name_init(&sig.signer, NULL);
+	dns_name_init(&sig.signer);
 	dns_name_clone(dst_key_name(key), &sig.signer);

 	sig.siglen = 0;
@@ -67,7 +67,7 @@ dns_ds_fromkeyrdata(const dns_name_t *owner, dns_rdata_t *key,
 	}

 	name = dns_fixedname_initname(&fname);
-	(void)dns_name_downcase(owner, name, NULL);
+	(void)dns_name_downcase(owner, name);

 	md = isc_md_new();

@@ -1534,7 +1534,7 @@ get_key_struct(const dns_name_t *name, unsigned int alg, unsigned int flags,
 		.func = dst_t_func[alg],
 	};

-	dns_name_init(key->key_name, NULL);
+	dns_name_init(key->key_name);
 	dns_name_dup(name, mctx, key->key_name);

 	isc_refcount_init(&key->refs, 1);
@@ -1618,8 +1618,7 @@ dst_key_read_public(const char *filename, int type, isc_mem_t *mctx,
 	dns_fixedname_init(&name);
 	isc_buffer_init(&b, DST_AS_STR(token), strlen(DST_AS_STR(token)));
 	isc_buffer_add(&b, strlen(DST_AS_STR(token)));
-	ret = dns_name_fromtext(dns_fixedname_name(&name), &b, dns_rootname, 0,
-				NULL);
+	ret = dns_name_fromtext(dns_fixedname_name(&name), &b, dns_rootname, 0);
 	if (ret != ISC_R_SUCCESS) {
 		goto cleanup;
 	}
@@ -17,7 +17,7 @@

 void
 dns_fixedname_init(dns_fixedname_t *fixed) {
-	dns_name_init(&fixed->name, fixed->offsets);
+	dns_name_init(&fixed->name);
 	isc_buffer_init(&fixed->buffer, fixed->data, DNS_NAME_MAXWIRE);
 	dns_name_setbuffer(&fixed->name, &fixed->buffer);
 }
@@ -81,7 +81,7 @@ new_forwarders(isc_mem_t *mctx, const dns_name_t *name,
 	isc_mem_attach(mctx, &forwarders->mctx);
 	isc_refcount_init(&forwarders->references, 1);

-	dns_name_dupwithoffsets(name, mctx, &forwarders->name);
+	dns_name_dup(name, mctx, &forwarders->name);

 	return forwarders;
 }
@@ -107,7 +107,7 @@ dns_fwdtable_addfwd(dns_fwdtable_t *fwdtable, const dns_name_t *name,
 		if (fwd->tlsname != NULL) {
 			nfwd->tlsname = isc_mem_get(fwdtable->mctx,
 						    sizeof(*nfwd->tlsname));
-			dns_name_init(nfwd->tlsname, NULL);
+			dns_name_init(nfwd->tlsname);
 			dns_name_dup(fwd->tlsname, fwdtable->mctx,
 				     nfwd->tlsname);
 		}
@@ -110,7 +110,7 @@ name_to_gbuffer(const dns_name_t *name, isc_buffer_t *buffer,
 		namep = name;
 	} else {
 		unsigned int labels;
-		dns_name_init(&tname, NULL);
+		dns_name_init(&tname);
 		labels = dns_name_countlabels(name);
 		dns_name_getlabelsequence(name, 0, labels - 1, &tname);
 		namep = &tname;
@@ -783,8 +783,7 @@ dst_gssapi_acceptctx(dns_gss_cred_id_t cred, const char *gssapi_keytab,
 		isc_buffer_init(&namebuf, r.base, r.length);
 		isc_buffer_add(&namebuf, r.length);

-		RETERR(dns_name_fromtext(principal, &namebuf, dns_rootname, 0,
-					 NULL));
+		RETERR(dns_name_fromtext(principal, &namebuf, dns_rootname, 0));

 		if (gnamebuf.length != 0U) {
 			gret = gss_release_buffer(&minor, &gnamebuf);
@@ -309,22 +309,3 @@ dns_acl_merge_ports_transports(dns_acl_t *dest, dns_acl_t *source, bool pos);
 *\li		'dest' is a valid ACL object;
 *\li		'source' is a valid ACL object.
 */
-
-isc_result_t
-dns_acl_configure(isc_mem_t *mctx, const char *aclname, dns_acl_t **aclp);
-/*%<
- * Creates and initialize an ACL matching "aclname" in configuration files. This
- * must be called under a isc_cfgmgr transaction and the clause where "aclname"
- * is defined must be opened.
- *
- * Aims to be a cfgmgr replacement or "configure_view_acl -> cfg_acl_fromconfig"
- * flow.
- *
- * For now, it assumes all ACL are defined as a list, but this can be changed
- * later.
- *
- * Requires:
- * \li		"mctx" to be valid
- * \li		"aclname" the name of the ACL
- * \li 		"aclp" a valid pointer to be written to
- */
@@ -278,9 +278,8 @@ isc_result_t
 dns_adb_createfind(dns_adb_t *adb, isc_loop_t *loop, isc_job_cb cb, void *cbarg,
 		   const dns_name_t *name, const dns_name_t *qname,
 		   dns_rdatatype_t qtype, unsigned int options,
-		   isc_stdtime_t now, dns_name_t *target, in_port_t port,
-		   unsigned int depth, isc_counter_t *qc, isc_counter_t *gqc,
-		   dns_adbfind_t **find);
+		   isc_stdtime_t now, in_port_t port, unsigned int depth,
+		   isc_counter_t *qc, isc_counter_t *gqc, dns_adbfind_t **find);
 /*%<
 * Main interface for clients. The adb will look up the name given in
 * "name" and will build up a list of found addresses, and perhaps start
@@ -313,10 +312,6 @@ dns_adb_createfind(dns_adb_t *adb, isc_loop_t *loop, isc_job_cb cb, void *cbarg,
 * the running database.  If specified as zero, the current time will
 * be retrieved and used.
 *
- * If 'target' is not NULL and 'name' is an alias (i.e. the name is
- * CNAME'd or DNAME'd to another name), then 'target' will be updated with
- * the domain name that 'name' is aliased to.
- *
 * All addresses returned will have the sockaddr's port set to 'port.'
 * The caller may change them directly in the dns_adbaddrinfo_t since
 * they are copies of the internal address only.
@@ -332,8 +327,6 @@ dns_adb_createfind(dns_adb_t *adb, isc_loop_t *loop, isc_job_cb cb, void *cbarg,
 *
 *\li	qname != NULL and *qname be a valid dns_name_t.
 *
- *\li	target == NULL or target is a valid name with a buffer.
- *
 *\li	find != NULL && *find == NULL.
 *
 * Returns:
@@ -75,6 +75,7 @@ enum dns_compress_flags {
 	DNS_COMPRESS_LARGE = 0x00000004U,
 	/* can toggle while rendering a message */
 	DNS_COMPRESS_PERMITTED = 0x00000008U,
+	DNS_COMPRESS_MULTIUSE = 0x00000010U,
 };

 /*
@@ -91,6 +92,7 @@ struct dns_compress {
 	dns_compress_flags_t flags;
 	uint16_t	     mask;
 	uint16_t	     count;
+	uint16_t	     coff;
 	isc_mem_t	    *mctx;
 	dns_compress_slot_t *set;
 	dns_compress_slot_t  smallset[1 << DNS_COMPRESS_SMALLBITS];
@@ -140,11 +142,36 @@ dns_compress_invalidate(dns_compress_t *cctx);
 */

 void
+dns_compress_setmultiuse(dns_compress_t *cctx, bool multi);
+/*%<
+ * 	Indicates this compression context is to be used for
+ * 	multiple calls to dns_name_towire(), for example when
+ * 	rendering the rdata in an rdataset. This causes the
+ * 	compression offset to be reusable across calls.
+ *
+ *	Requires:
+ *\li		'cctx' is not NULL.
+ */
+
+bool
+dns_compress_getmultiuse(dns_compress_t *cctx);
+
+/*%<
+ *	Find out whether multiuse is enabled.
+ *
+ *	Requires:
+ *\li		'cctx' to be initialized.
+ *
+ *	Returns:
+ *\li		allowed compression bitmap.
+ */
+void
 dns_compress_setpermitted(dns_compress_t *cctx, bool permitted);

 /*%<
 *	Sets whether compression is allowed, according to RFC 3597.
- *	This can vary depending on the rdata type.
+ *	This can vary depending on the rdata type. This will also
+ *	reset multiuse to false.
 *
 *	Requires:
 *\li		'cctx' to be initialized.
@@ -59,7 +59,6 @@

 struct dns_fixedname {
 	dns_name_t    name;
-	dns_offsets_t offsets;
 	isc_buffer_t  buffer;
 	unsigned char data[DNS_NAME_MAXWIRE];
 };
@@ -61,7 +61,7 @@
 *
 * The same applies to rdatasets.
 *
- * On the other hand, offsets, rdatalists and rdatas allocated using
+ * On the other hand, rdatalists and rdatas allocated using
 * dns_message_gettemp*() will always be freed automatically
 * when the message is reset or destroyed; calling dns_message_puttemp*()
 * on rdatalists and rdatas is optional and serves only to enable the item
@@ -275,7 +275,6 @@ struct dns_message {

 	ISC_LIST(dns_msgblock_t) rdatas;
 	ISC_LIST(dns_msgblock_t) rdatalists;
-	ISC_LIST(dns_msgblock_t) offsets;

 	ISC_LIST(dns_rdata_t) freerdata;
 	ISC_LIST(dns_rdatalist_t) freerdatalist;
@@ -67,6 +67,7 @@
 #include <stdbool.h>
 #include <stdio.h>

+#include <isc/attributes.h>
 #include <isc/buffer.h>
 #include <isc/hashmap.h>
 #include <isc/magic.h>
@@ -95,12 +96,10 @@
 struct dns_name {
 	unsigned int magic;
 	uint8_t	     length;
-	uint8_t	     labels;
 	struct dns_name_attrs {
 		bool absolute	  : 1; /*%< Used by name.c */
 		bool readonly	  : 1; /*%< Used by name.c */
 		bool dynamic	  : 1; /*%< Used by name.c */
-		bool dynoffsets	  : 1; /*%< Used by name.c */
 		bool nocompress	  : 1; /*%< Used by name.c */
 		bool cache	  : 1; /*%< Used by resolver. */
 		bool answer	  : 1; /*%< Used by resolver. */
@@ -113,7 +112,6 @@ struct dns_name {
 		bool hasupdaterec : 1; /*%< Used by client. */
 	} attributes;
 	unsigned char *ndata;
-	unsigned char *offsets;
 	isc_buffer_t  *buffer;
 	ISC_LINK(dns_name_t) link;
 	ISC_LIST(dns_rdataset_t) list;
@@ -151,38 +149,29 @@ extern const dns_name_t *dns_wildcardname;
 * and sizeof(A) in DNS_NAME_INITABSOLUTE to allow C strings to be used
 * to initialize 'ndata'.
 *
- * Note[2]: The final value of offsets for DNS_NAME_INITABSOLUTE should
- * match (sizeof(A) - 1) which is the offset of the root label.
- *
 * Typical usage:
 *	unsigned char data[] = "\005value";
- *	unsigned char offsets[] = { 0 };
- *	dns_name_t value = DNS_NAME_INITNONABSOLUTE(data, offsets);
+ *	dns_name_t value = DNS_NAME_INITNONABSOLUTE(data);
 *
 *	unsigned char data[] = "\005value";
- *	unsigned char offsets[] = { 0, 6 };
- *	dns_name_t value = DNS_NAME_INITABSOLUTE(data, offsets);
+ *	dns_name_t value = DNS_NAME_INITABSOLUTE(data);
 */
-#define DNS_NAME_INITNONABSOLUTE(A, B)              \
+#define DNS_NAME_INITNONABSOLUTE(__ndata)           \
 	{                                           \
 		.magic = DNS_NAME_MAGIC,            \
-		.ndata = A,                         \
-		.length = (sizeof(A) - 1),          \
-		.labels = sizeof(B),                \
+		.ndata = (__ndata),                 \
+		.length = (sizeof(__ndata) - 1),    \
 		.attributes = { .readonly = true }, \
-		.offsets = B,                       \
 		.link = ISC_LINK_INITIALIZER,       \
 		.list = ISC_LIST_INITIALIZER,       \
 	}

-#define DNS_NAME_INITABSOLUTE(A, B)                                   \
+#define DNS_NAME_INITABSOLUTE(__ndata)                                \
 	{                                                             \
 		.magic = DNS_NAME_MAGIC,                              \
-		.ndata = A,                                           \
-		.length = sizeof(A),                                  \
-		.labels = sizeof(B),                                  \
+		.ndata = (__ndata),                                   \
+		.length = sizeof(__ndata),                            \
 		.attributes = { .readonly = true, .absolute = true }, \
-		.offsets = B,                                         \
 		.link = ISC_LINK_INITIALIZER,                         \
 		.list = ISC_LIST_INITIALIZER,                         \
 	}
@@ -199,7 +188,7 @@ extern const dns_name_t *dns_wildcardname;
 #define DNS_NAME_MAXLABELS 128
 #define DNS_NAME_LABELLEN  63

-typedef unsigned char dns_offsets_t[DNS_NAME_MAXLABELS];
+typedef uint8_t dns_offsets_t[DNS_NAME_MAXLABELS];

 /*
 * Text output filter procedure.
@@ -214,10 +203,9 @@ typedef isc_result_t(dns_name_totextfilter_t)(isc_buffer_t *target,
 ***/

 static inline void
-dns_name_init(dns_name_t *name, unsigned char *offsets) {
+dns_name_init(dns_name_t *name) {
 	*name = (dns_name_t){
 		.magic = DNS_NAME_MAGIC,
-		.offsets = (offsets),
 		.link = ISC_LINK_INITIALIZER,
 		.list = ISC_LIST_INITIALIZER,
 	};
@@ -225,16 +213,9 @@ dns_name_init(dns_name_t *name, unsigned char *offsets) {
 /*%<
 * Initialize 'name'.
 *
- * Notes:
- * \li	'offsets' is never required to be non-NULL, but specifying a
- *	dns_offsets_t for 'offsets' will improve the performance of most
- *	name operations if the name is used more than once.
- *
 * Requires:
 * \li	'name' is not NULL and points to a struct dns_name.
 *
- * \li	offsets == NULL or offsets is a dns_offsets_t.
- *
 * Ensures:
 * \li	'name' is a valid name.
 * \li	dns_name_countlabels(name) == 0
@@ -248,7 +229,6 @@ dns_name_reset(dns_name_t *name) {

 	name->ndata = NULL;
 	name->length = 0;
-	name->labels = 0;
 	name->attributes.absolute = false;
 	if (name->buffer != NULL) {
 		isc_buffer_clear(name->buffer);
@@ -284,9 +264,7 @@ dns_name_invalidate(dns_name_t *name) {
 	name->magic = 0;
 	name->ndata = NULL;
 	name->length = 0;
-	name->labels = 0;
 	name->attributes = (struct dns_name_attrs){};
-	name->offsets = NULL;
 	name->buffer = NULL;
 	ISC_LINK_INIT(name, link);
 }
@@ -324,9 +302,10 @@ dns_name_setbuffer(dns_name_t *name, isc_buffer_t *buffer) {
 * Dedicate a buffer for use with 'name'.
 *
 * Notes:
- * \li	Specification of a target buffer in dns_name_fromwire(),
- *	dns_name_fromtext(), and dns_name_concatenate() is optional if
- *	'name' has a dedicated buffer.
+ * \li	Specification of a target buffer in dns_name_fromwire() and
+ *	dns_name_fromtext() is optional if 'name' has a dedicated buffer.
+ *	The target name in dns_name_concatenate() must have a dedicated
+ *	buffer.
 *
 * \li	The caller must not write to buffer until the name has been
 *	invalidated or is otherwise known not to be in use.
@@ -485,8 +464,6 @@ dns_name_equal(const dns_name_t *name1, const dns_name_t *name2);
 * \li	Because it only needs to test for equality, dns_name_equal() can be
 *	significantly faster than dns_name_fullcompare() or dns_name_compare().
 *
- * \li	Offsets tables are not used in the comparison.
- *
 * \li	It makes no sense for one of the names to be relative and the
 *	other absolute.  If both names are relative, then to be meaningfully
 * 	compared the caller must ensure that they are both relative to the
@@ -594,12 +571,28 @@ dns_name_matcheswildcard(const dns_name_t *name, const dns_name_t *wname);
 *** Labels
 ***/

-static inline unsigned int
+uint8_t
+dns_name_offsets(const dns_name_t *name, dns_offsets_t offsets);
+/*%<
+ * Returns the number of the labels in the DNS name and optionally fills their
+ * offsets into the table.
+ *
+ * Requires:
+ *\li	'name' is a valid DNS name
+ *
+ * Returns:
+ *\li	number of labels in the DNS name
+ *
+ * Note:
+ *\li	if the 'offsets' is non-NULL, it will fill the offsets of
+ *	individual labels in the name
+ */
+
+static inline uint8_t
 dns_name_countlabels(const dns_name_t *name) {
 	REQUIRE(DNS_NAME_VALID(name));
-	REQUIRE(name->labels <= DNS_NAME_MAXLABELS);

-	return name->labels;
+	return dns_name_offsets(name, NULL);
 }
 /*%<
 * How many labels does 'name' have?
@@ -776,10 +769,11 @@ dns_name_fromwire(dns_name_t *name, isc_buffer_t *source, dns_decompress_t dctx,

 isc_result_t
 dns_name_towire(const dns_name_t *name, dns_compress_t *cctx,
-		isc_buffer_t *target, uint16_t *comp_offsetp);
+		isc_buffer_t *target);
 /*%<
 * Convert 'name' into wire format, compressing it as specified by the
- * compression context 'cctx', and storing the result in 'target'.
+ * compression context 'cctx' (or leaving it uncompressed if 'cctx' is
+ * NULL), and storing the result in 'target'.
 *
 * Notes:
 * \li	If compression is permitted, then the cctx table may be updated.
@@ -793,8 +787,6 @@ dns_name_towire(const dns_name_t *name, dns_compress_t *cctx,
 *
 * \li	target is a valid buffer.
 *
- * \li	Any offsets in the compression table are valid for buffer.
- *
 * Ensures:
 *
 *	If the result is success:
@@ -808,10 +800,48 @@ dns_name_towire(const dns_name_t *name, dns_compress_t *cctx,

 isc_result_t
 dns_name_fromtext(dns_name_t *name, isc_buffer_t *source,
-		  const dns_name_t *origin, unsigned int options,
-		  isc_buffer_t *target);
+		  const dns_name_t *origin, unsigned int options);
 /*%<
- * Convert the textual representation of a DNS name at source
+ * Convert the textual representation of a DNS name in 'source'
+ * and store it in 'name'.
+ *
+ * Notes:
+ * \li	Relative domain names will have 'origin' appended to them
+ *	unless 'origin' is NULL, in which case relative domain names
+ *	will remain relative.
+ *
+ * \li	If DNS_NAME_DOWNCASE is set in 'options', any uppercase letters
+ *	in 'source' will be downcased when they are copied into 'target'.
+ *
+ * Requires:
+ *
+ * \li	'name' is a valid name with a dedicated buffer.
+ *
+ * \li	'source' is a valid buffer.
+ *
+ * Ensures:
+ *
+ *	If result is success:
+ * \li		Uppercase letters are downcased in the copy iff
+ *		DNS_NAME_DOWNCASE is set in 'options'.
+ *
+ * \li		The current location in source is advanced.
+ *
+ * Result:
+ *\li	#ISC_R_SUCCESS
+ *\li	#DNS_R_EMPTYLABEL
+ *\li	#DNS_R_LABELTOOLONG
+ *\li	#DNS_R_BADESCAPE
+ *\li	#DNS_R_BADDOTTEDQUAD
+ *\li	#ISC_R_NOSPACE
+ *\li	#ISC_R_UNEXPECTEDEND
+ */
+
+isc_result_t
+dns_name_wirefromtext(isc_buffer_t *source, const dns_name_t *origin,
+		      unsigned int options, isc_buffer_t *target);
+/*%<
+ * Convert the textual representation of a DNS name in 'source'
 * into uncompressed wire form stored in target.
 *
 * Notes:
@@ -824,18 +854,13 @@ dns_name_fromtext(dns_name_t *name, isc_buffer_t *source,
 *
 * Requires:
 *
- * \li	'name' is a valid name.
- *
 * \li	'source' is a valid buffer.
 *
- * \li	'target' is a valid buffer or 'target' is NULL and 'name' has
- *	a dedicated buffer.
+ * \li	'target' is a valid buffer.
 *
 * Ensures:
 *
 *	If result is success:
- * \li	 	If 'target' is not NULL, 'name' is attached to it.
- *
 * \li		Uppercase letters are downcased in the copy iff
 *		DNS_NAME_DOWNCASE is set in 'options'.
 *
@@ -947,8 +972,7 @@ dns_name_tofilenametext(const dns_name_t *name, bool omit_final_dot,
 */

 isc_result_t
-dns_name_downcase(const dns_name_t *source, dns_name_t *name,
-		  isc_buffer_t *target);
+dns_name_downcase(const dns_name_t *source, dns_name_t *name);
 /*%<
 * Downcase 'source'.
 *
@@ -959,9 +983,7 @@ dns_name_downcase(const dns_name_t *source, dns_name_t *name,
 *\li	If source == name, then
 *		'source' must not be read-only
 *
- *\li	Otherwise,
- *		'target' is a valid buffer or 'target' is NULL and
- *		'name' has a dedicated buffer.
+ *\li	'name' has a dedicated buffer.
 *
 * Returns:
 *\li	#ISC_R_SUCCESS
@@ -972,9 +994,11 @@ dns_name_downcase(const dns_name_t *source, dns_name_t *name,

 isc_result_t
 dns_name_concatenate(const dns_name_t *prefix, const dns_name_t *suffix,
-		     dns_name_t *name, isc_buffer_t *target);
+		     dns_name_t *name);
 /*%<
- *	Concatenate 'prefix' and 'suffix'.
+ *	Concatenate 'prefix' and 'suffix' and place the result in 'name'.
+ *	(Note that 'name' may be the same as 'prefix', in which case
+ *	'suffix' will be appended to it.)
 *
 * Requires:
 *
@@ -982,20 +1006,10 @@ dns_name_concatenate(const dns_name_t *prefix, const dns_name_t *suffix,
 *
 *\li	'suffix' is a valid name or NULL.
 *
- *\li	'name' is a valid name or NULL.
- *
- *\li	'target' is a valid buffer or 'target' is NULL and 'name' has
- *	a dedicated buffer.
+ *\li	'name' is a valid name with a dedicated buffer.
 *
 *\li	If 'prefix' is absolute, 'suffix' must be NULL or the empty name.
 *
- * Ensures:
- *
- *\li	On success,
- *	 	If 'target' is not NULL and 'name' is not NULL, then 'name'
- *		is attached to it.
- *		The used space in target is updated.
- *
 * Returns:
 *\li	#ISC_R_SUCCESS
 *\li	#ISC_R_NOSPACE
@@ -1007,19 +1021,21 @@ dns_name_split(const dns_name_t *name, unsigned int suffixlabels,
 	       dns_name_t *prefix, dns_name_t *suffix) {
 	REQUIRE(DNS_NAME_VALID(name));
 	REQUIRE(suffixlabels > 0);
-	REQUIRE(suffixlabels <= name->labels);
 	REQUIRE(prefix != NULL || suffix != NULL);
 	REQUIRE(prefix == NULL ||
 		(DNS_NAME_VALID(prefix) && DNS_NAME_BINDABLE(prefix)));
 	REQUIRE(suffix == NULL ||
 		(DNS_NAME_VALID(suffix) && DNS_NAME_BINDABLE(suffix)));

+	uint8_t labels = dns_name_countlabels(name);
+	INSIST(suffixlabels <= labels);
+
 	if (prefix != NULL) {
-		dns_name_getlabelsequence(name, 0, name->labels - suffixlabels,
+		dns_name_getlabelsequence(name, 0, labels - suffixlabels,
 					  prefix);
 	}
 	if (suffix != NULL) {
-		dns_name_getlabelsequence(name, name->labels - suffixlabels,
+		dns_name_getlabelsequence(name, labels - suffixlabels,
 					  suffixlabels, suffix);
 	}
 }
@@ -1081,24 +1097,6 @@ dns_name_dup(const dns_name_t *source, isc_mem_t *mctx, dns_name_t *target);
 *\li	'mctx' is a valid memory context.
 */

-void
-dns_name_dupwithoffsets(const dns_name_t *source, isc_mem_t *mctx,
-			dns_name_t *target);
-/*%<
- * Make 'target' a read-only dynamically allocated copy of 'source'.
- * 'target' will also have a dynamically allocated offsets table.
- *
- * Requires:
- *
- *\li	'source' is a valid non-empty name.
- *
- *\li	'target' is a valid name that is not read-only.
- *
- *\li	'target' has no offsets table.
- *
- *\li	'mctx' is a valid memory context.
- */
-
 void
 dns_name_free(dns_name_t *name, isc_mem_t *mctx);
 /*%<
@@ -54,21 +54,16 @@
 isc_result_t
 dns_ncache_add(dns_message_t *message, dns_db_t *cache, dns_dbnode_t *node,
 	       dns_rdatatype_t covers, isc_stdtime_t now, dns_ttl_t minttl,
-	       dns_ttl_t maxttl, dns_rdataset_t *addedrdataset);
-isc_result_t
-dns_ncache_addoptout(dns_message_t *message, dns_db_t *cache,
-		     dns_dbnode_t *node, dns_rdatatype_t covers,
-		     isc_stdtime_t now, dns_ttl_t minttl, dns_ttl_t maxttl,
-		     bool optout, dns_rdataset_t *addedrdataset);
+	       dns_ttl_t maxttl, bool optout, bool secure,
+	       dns_rdataset_t *addedrdataset);
 /*%<
 * Convert the authority data from 'message' into a negative cache
 * rdataset, and store it in 'cache' at 'node' with a TTL limited to
 * 'maxttl'.
 *
- * \li dns_ncache_add produces a negative cache entry with a trust of no
- *     more than answer
- * \li dns_ncache_addoptout produces a negative cache entry which will have
- *     a trust of secure if all the records that make up the entry are secure.
+ * \li if 'secure' is true and all the records that make up the entry
+ *     are secure, then dns_ncache_add produces a negative cache entry
+ *     with trust level secure.
 *
 * The 'covers' argument is the RR type whose nonexistence we are caching,
 * or dns_rdatatype_any when caching a NXDOMAIN response.
@@ -317,8 +317,10 @@ enum {
 #define dns_opcode_status ((dns_opcode_t)dns_opcode_status)
 	dns_opcode_notify = 4,
 #define dns_opcode_notify ((dns_opcode_t)dns_opcode_notify)
-	dns_opcode_update = 5 /* dynamic update */
+	dns_opcode_update = 5, /* dynamic update */
 #define dns_opcode_update ((dns_opcode_t)dns_opcode_update)
+	dns_opcode_max = 6,
+#define dns_opcode_max ((dns_opcode_t)dns_opcode_max)
 };

 /*%
@@ -248,6 +248,19 @@ struct dns_view {
 #define DNS_VIEWATTR_ADBSHUTDOWN 0x02
 #define DNS_VIEWATTR_REQSHUTDOWN 0x04

+#ifdef HAVE_LMDB
+#define DNS_LMDB_COMMON_FLAGS (MDB_CREATE | MDB_NOSUBDIR | MDB_NOLOCK)
+#ifndef __OpenBSD__
+#define DNS_LMDB_FLAGS (DNS_LMDB_COMMON_FLAGS)
+#else /* __OpenBSD__ */
+/*
+ * OpenBSD does not have a unified buffer cache, which requires both reads and
+ * writes to be performed using mmap().
+ */
+#define DNS_LMDB_FLAGS (DNS_LMDB_COMMON_FLAGS | MDB_WRITEMAP)
+#endif /* __OpenBSD__ */
+#endif /* HAVE_LMDB */
+
 void
 dns_view_create(isc_mem_t *mctx, isc_loopmgr_t *loopmgr,
 		dns_dispatchmgr_t *dispmgr, dns_rdataclass_t rdclass,
@@ -122,7 +122,7 @@ dns_ipkeylist_copy(isc_mem_t *mctx, const dns_ipkeylist_t *src,
 			if (src->keys[i] != NULL) {
 				dst->keys[i] = isc_mem_get(mctx,
 							   sizeof(dns_name_t));
-				dns_name_init(dst->keys[i], NULL);
+				dns_name_init(dst->keys[i]);
 				dns_name_dup(src->keys[i], mctx, dst->keys[i]);
 			} else {
 				dst->keys[i] = NULL;
@@ -135,7 +135,7 @@ dns_ipkeylist_copy(isc_mem_t *mctx, const dns_ipkeylist_t *src,
 			if (src->tlss[i] != NULL) {
 				dst->tlss[i] = isc_mem_get(mctx,
 							   sizeof(dns_name_t));
-				dns_name_init(dst->tlss[i], NULL);
+				dns_name_init(dst->tlss[i]);
 				dns_name_dup(src->tlss[i], mctx, dst->tlss[i]);
 			} else {
 				dst->tlss[i] = NULL;
@@ -148,7 +148,7 @@ dns_ipkeylist_copy(isc_mem_t *mctx, const dns_ipkeylist_t *src,
 			if (src->labels[i] != NULL) {
 				dst->labels[i] =
 					isc_mem_get(mctx, sizeof(dns_name_t));
-				dns_name_init(dst->labels[i], NULL);
+				dns_name_init(dst->labels[i]);
 				dns_name_dup(src->labels[i], mctx,
 					     dst->labels[i]);
 			} else {
@@ -723,7 +723,7 @@ journal_open(isc_mem_t *mctx, const char *filename, bool writable, bool create,
 	/*
 	 * Initialize the iterator.
 	 */
-	dns_name_init(&j->it.name, NULL);
+	dns_name_init(&j->it.name);
 	dns_rdata_init(&j->it.rdata);

 	/*
@@ -319,7 +319,7 @@ new_keynode(const dns_name_t *name, dns_rdata_ds_t *ds,
 	isc_refcount_init(&knode->references, 1);
 	isc_rwlock_init(&knode->rwlock);

-	dns_name_dupwithoffsets(name, keytable->mctx, &knode->name);
+	dns_name_dup(name, keytable->mctx, &knode->name);

 	/*
 	 * If a DS was supplied, initialize an rdatalist.
@@ -324,19 +324,13 @@ loadctx_destroy(dns_loadctx_t *lctx);
 			    source, line, isc_result_totext(result))

 static unsigned char in_addr_arpa_data[] = "\007IN-ADDR\004ARPA";
-static unsigned char in_addr_arpa_offsets[] = { 0, 8, 13 };
-static dns_name_t const in_addr_arpa =
-	DNS_NAME_INITABSOLUTE(in_addr_arpa_data, in_addr_arpa_offsets);
+static dns_name_t const in_addr_arpa = DNS_NAME_INITABSOLUTE(in_addr_arpa_data);

 static unsigned char ip6_int_data[] = "\003IP6\003INT";
-static unsigned char ip6_int_offsets[] = { 0, 4, 8 };
-static dns_name_t const ip6_int = DNS_NAME_INITABSOLUTE(ip6_int_data,
-							ip6_int_offsets);
+static dns_name_t const ip6_int = DNS_NAME_INITABSOLUTE(ip6_int_data);

 static unsigned char ip6_arpa_data[] = "\003IP6\004ARPA";
-static unsigned char ip6_arpa_offsets[] = { 0, 4, 9 };
-static dns_name_t const ip6_arpa = DNS_NAME_INITABSOLUTE(ip6_arpa_data,
-							 ip6_arpa_offsets);
+static dns_name_t const ip6_arpa = DNS_NAME_INITABSOLUTE(ip6_arpa_data);

 static bool
 dns_master_isprimary(dns_loadctx_t *lctx) {
@@ -841,8 +835,7 @@ generate(dns_loadctx_t *lctx, char *range, char *lhs, char *gtype, char *rhs,
 		isc_buffer_init(&buffer, lhsbuf, strlen(lhsbuf));
 		isc_buffer_add(&buffer, strlen(lhsbuf));
 		isc_buffer_setactive(&buffer, strlen(lhsbuf));
-		result = dns_name_fromtext(owner, &buffer, ictx->origin, 0,
-					   NULL);
+		result = dns_name_fromtext(owner, &buffer, ictx->origin, 0);
 		if (result != ISC_R_SUCCESS) {
 			goto error_cleanup;
 		}
@@ -1394,7 +1387,7 @@ load_text(dns_loadctx_t *lctx) {
 			isc_buffer_setactive(&buffer,
 					     token.value.as_region.length);
 			result = dns_name_fromtext(new_name, &buffer,
-						   ictx->origin, 0, NULL);
+						   ictx->origin, 0);
 			if (MANYERRS(lctx, result)) {
 				SETRESULT(lctx, result);
 				LOGIT(result);
@@ -2969,7 +2962,7 @@ is_glue(rdatalist_head_t *head, dns_name_t *owner) {

 	rdata = ISC_LIST_HEAD(this->rdata);
 	while (rdata != NULL) {
-		dns_name_init(&name, NULL);
+		dns_name_init(&name);
 		dns_rdata_toregion(rdata, &region);
 		dns_name_fromregion(&name, &region);
 		if (dns_name_equal(&name, owner)) {
@@ -511,7 +511,7 @@ ncache_summary(dns_rdataset_t *rdataset, bool omit_final_dot,
 	char *start = NULL;

 	dns_rdataset_init(&rds);
-	dns_name_init(&name, NULL);
+	dns_name_init(&name);

 	do {
 		dns_ncache_current(rdataset, &name, &rds);
@@ -366,24 +366,6 @@ out:
 	return rdatalist;
 }

-static dns_offsets_t *
-newoffsets(dns_message_t *msg) {
-	dns_msgblock_t *msgblock;
-	dns_offsets_t *offsets;
-
-	msgblock = ISC_LIST_TAIL(msg->offsets);
-	offsets = msgblock_get(msgblock, dns_offsets_t);
-	if (offsets == NULL) {
-		msgblock = msgblock_allocate(msg->mctx, sizeof(dns_offsets_t),
-					     OFFSET_COUNT);
-		ISC_LIST_APPEND(msg->offsets, msgblock, link);
-
-		offsets = msgblock_get(msgblock, dns_offsets_t);
-	}
-
-	return offsets;
-}
-
 static void
 msginitheader(dns_message_t *m) {
 	m->id = 0;
@@ -608,18 +590,6 @@ msgreset(dns_message_t *msg, bool everything) {
 		msgblock = next_msgblock;
 	}

-	msgblock = ISC_LIST_HEAD(msg->offsets);
-	if (!everything && msgblock != NULL) {
-		msgblock_reset(msgblock);
-		msgblock = ISC_LIST_NEXT(msgblock, link);
-	}
-	while (msgblock != NULL) {
-		next_msgblock = ISC_LIST_NEXT(msgblock, link);
-		ISC_LIST_UNLINK(msg->offsets, msgblock, link);
-		msgblock_free(msg->mctx, msgblock, sizeof(dns_offsets_t));
-		msgblock = next_msgblock;
-	}
-
 	if (msg->tsigkey != NULL) {
 		dns_tsigkey_detach(&msg->tsigkey);
 		msg->tsigkey = NULL;
@@ -726,7 +696,6 @@ dns_message_create(isc_mem_t *mctx, isc_mempool_t *namepool,
 		.cleanup = ISC_LIST_INITIALIZER,
 		.rdatas = ISC_LIST_INITIALIZER,
 		.rdatalists = ISC_LIST_INITIALIZER,
-		.offsets = ISC_LIST_INITIALIZER,
 		.freerdata = ISC_LIST_INITIALIZER,
 		.freerdatalist = ISC_LIST_INITIALIZER,
 		.magic = DNS_MESSAGE_MAGIC,
@@ -966,7 +935,6 @@ getquestions(isc_buffer_t *source, dns_message_t *msg, dns_decompress_t dctx,
 	isc_region_t r;
 	unsigned int count;
 	dns_name_t *name = NULL;
-	dns_name_t *found_name = NULL;
 	dns_rdataset_t *rdataset = NULL;
 	dns_rdatalist_t *rdatalist = NULL;
 	isc_result_t result = ISC_R_SUCCESS;
@@ -976,17 +944,12 @@ getquestions(isc_buffer_t *source, dns_message_t *msg, dns_decompress_t dctx,
 	bool best_effort = ((options & DNS_MESSAGEPARSE_BESTEFFORT) != 0);
 	bool seen_problem = false;
 	bool free_name = false;
-	bool free_hashmaps = false;
-	isc_hashmap_t *name_map = NULL;

-	if (msg->counts[DNS_SECTION_QUESTION] > 1) {
-		isc_hashmap_create(msg->mctx, 1, &name_map);
-	}
+	REQUIRE(msg->counts[DNS_SECTION_QUESTION] <= 1 || best_effort);

 	for (count = 0; count < msg->counts[DNS_SECTION_QUESTION]; count++) {
 		name = NULL;
 		dns_message_gettempname(msg, &name);
-		name->offsets = (unsigned char *)newoffsets(msg);
 		free_name = true;

 		/*
@@ -999,48 +962,7 @@ getquestions(isc_buffer_t *source, dns_message_t *msg, dns_decompress_t dctx,
 			goto cleanup;
 		}

-		/* If there is only one QNAME, skip the duplicity checks */
-		if (name_map == NULL) {
-			result = ISC_R_SUCCESS;
-			goto skip_name_check;
-		}
-
-		/*
-		 * Run through the section, looking to see if this name
-		 * is already there.  If it is found, put back the allocated
-		 * name since we no longer need it, and set our name pointer
-		 * to point to the name we found.
-		 */
-		result = isc_hashmap_add(name_map, dns_name_hash(name),
-					 name_match, name, name,
-					 (void **)&found_name);
-
-		/*
-		 * If it is the first name in the section, accept it.
-		 *
-		 * If it is not, but is not the same as the name already
-		 * in the question section, append to the section.  Note that
-		 * here in the question section this is illegal, so return
-		 * FORMERR.  In the future, check the opcode to see if
-		 * this should be legal or not.  In either case we no longer
-		 * need this name pointer.
-		 */
-	skip_name_check:
-		switch (result) {
-		case ISC_R_SUCCESS:
-			if (!ISC_LIST_EMPTY(*section)) {
-				DO_ERROR(DNS_R_FORMERR);
-			}
-			ISC_LIST_APPEND(*section, name, link);
-			break;
-		case ISC_R_EXISTS:
-			dns_message_puttempname(msg, &name);
-			name = found_name;
-			found_name = NULL;
-			break;
-		default:
-			UNREACHABLE();
-		}
+		ISC_LIST_APPEND(*section, name, link);

 		free_name = false;

@@ -1090,40 +1012,6 @@ getquestions(isc_buffer_t *source, dns_message_t *msg, dns_decompress_t dctx,

 		rdataset->attributes |= DNS_RDATASETATTR_QUESTION;

-		/*
-		 * Skip the duplicity check for first rdataset
-		 */
-		if (ISC_LIST_EMPTY(name->list)) {
-			result = ISC_R_SUCCESS;
-			goto skip_rds_check;
-		}
-
-		/*
-		 * Can't ask the same question twice.
-		 */
-		if (name->hashmap == NULL) {
-			isc_hashmap_create(msg->mctx, 1, &name->hashmap);
-			free_hashmaps = true;
-
-			INSIST(ISC_LIST_HEAD(name->list) ==
-			       ISC_LIST_TAIL(name->list));
-
-			dns_rdataset_t *old_rdataset =
-				ISC_LIST_HEAD(name->list);
-
-			result = isc_hashmap_add(
-				name->hashmap, rds_hash(old_rdataset),
-				rds_match, old_rdataset, old_rdataset, NULL);
-
-			INSIST(result == ISC_R_SUCCESS);
-		}
-		result = isc_hashmap_add(name->hashmap, rds_hash(rdataset),
-					 rds_match, rdataset, rdataset, NULL);
-		if (result == ISC_R_EXISTS) {
-			DO_ERROR(DNS_R_FORMERR);
-		}
-
-	skip_rds_check:
 		ISC_LIST_APPEND(name->list, rdataset, link);

 		rdataset = NULL;
@@ -1146,14 +1034,6 @@ cleanup:
 		dns_message_puttempname(msg, &name);
 	}

-	if (free_hashmaps) {
-		cleanup_name_hashmaps(section);
-	}
-
-	if (name_map != NULL) {
-		isc_hashmap_destroy(&name_map);
-	}
-
 	return result;
 }

@@ -1209,7 +1089,6 @@ getsection(isc_buffer_t *source, dns_message_t *msg, dns_decompress_t dctx,

 		name = NULL;
 		dns_message_gettempname(msg, &name);
-		name->offsets = (unsigned char *)newoffsets(msg);
 		free_name = true;

 		/*
@@ -1663,6 +1542,38 @@ cleanup:
 	return result;
 }

+static isc_result_t
+early_sanity_check(dns_message_t *msg) {
+	bool is_unknown_opcode = msg->opcode >= dns_opcode_max;
+	bool is_query_response = (msg->flags & DNS_MESSAGEFLAG_QR) != 0;
+	bool no_questions = msg->counts[DNS_SECTION_QUESTION] == 0;
+	bool many_questions = msg->counts[DNS_SECTION_QUESTION] > 1;
+	bool has_answer = msg->counts[DNS_SECTION_ANSWER] > 0;
+	bool has_auth = msg->counts[DNS_SECTION_AUTHORITY] > 0;
+
+	if (is_unknown_opcode) {
+		return DNS_R_NOTIMP;
+	} else if (many_questions) {
+		return DNS_R_FORMERR;
+	} else if (no_questions && (msg->opcode != dns_opcode_query) &&
+		   (msg->opcode != dns_opcode_status))
+	{
+		/*
+		 * Per RFC9619, the two cases where qdcount == 0 is acceptable
+		 * are AXFR transfers and cookies, and both have opcode 0.
+		 *
+		 * RFC9619 also specifies that msg->opcode == dns_opcode_status
+		 * is unspecified, so we ignore it.
+		 */
+		return DNS_R_FORMERR;
+	} else if (msg->opcode == dns_opcode_notify &&
+		   ((is_query_response && has_answer) || has_auth))
+	{
+		return DNS_R_FORMERR;
+	}
+	return ISC_R_SUCCESS;
+}
+
 isc_result_t
 dns_message_parse(dns_message_t *msg, isc_buffer_t *source,
 		  unsigned int options) {
@@ -1717,6 +1628,12 @@ dns_message_parse(dns_message_t *msg, isc_buffer_t *source,

 	dctx = DNS_DECOMPRESS_ALWAYS;

+	bool strict_parse = ((options & DNS_MESSAGEPARSE_BESTEFFORT) == 0);
+	isc_result_t early_check_ret = early_sanity_check(msg);
+	if (strict_parse && (early_check_ret != ISC_R_SUCCESS)) {
+		return early_check_ret;
+	}
+
 	ret = getquestions(source, msg, dctx, options);

 	if (ret == ISC_R_UNEXPECTEDEND && ignore_tc) {
@@ -3380,7 +3297,7 @@ dns_message_sectiontotext(dns_message_t *msg, dns_section_t section,
 		ADD_STRING(target, " SECTION:\n");
 	}

-	dns_name_init(&empty_name, NULL);
+	dns_name_init(&empty_name);
 	result = dns_message_firstname(msg, section);
 	if (result != ISC_R_SUCCESS) {
 		goto cleanup;
@@ -4917,7 +4834,7 @@ rdataset_soa_min(dns_rdataset_t *rds, dns_ttl_t *ttlp) {
 			 * whether it's an SOA.
 			 */
 			dns_rdata_toregion(&rdata, &r);
-			dns_name_init(&tmp, NULL);
+			dns_name_init(&tmp);
 			dns_name_fromregion(&tmp, &r);
 			isc_region_consume(&r, tmp.length);
 			if (r.length < 2) {
@@ -126,7 +126,7 @@ newnode(isc_mem_t *mctx, const dns_name_t *name) {
 	isc_mem_attach(mctx, &node->mctx);
 	isc_refcount_init(&node->references, 1);

-	dns_name_dupwithoffsets(name, mctx, &node->name);
+	dns_name_dup(name, mctx, &node->name);

 	return node;
 }
@@ -50,12 +50,6 @@ atomic_getuint8(isc_buffer_t *b) {
 	return ret;
 }

-static isc_result_t
-addoptout(dns_message_t *message, dns_db_t *cache, dns_dbnode_t *node,
-	  dns_rdatatype_t covers, isc_stdtime_t now, dns_ttl_t minttl,
-	  dns_ttl_t maxttl, bool optout, bool secure,
-	  dns_rdataset_t *addedrdataset);
-
 static isc_result_t
 copy_rdataset(dns_rdataset_t *rdataset, isc_buffer_t *buffer) {
 	isc_result_t result;
@@ -107,25 +101,8 @@ copy_rdataset(dns_rdataset_t *rdataset, isc_buffer_t *buffer) {
 isc_result_t
 dns_ncache_add(dns_message_t *message, dns_db_t *cache, dns_dbnode_t *node,
 	       dns_rdatatype_t covers, isc_stdtime_t now, dns_ttl_t minttl,
-	       dns_ttl_t maxttl, dns_rdataset_t *addedrdataset) {
-	return addoptout(message, cache, node, covers, now, minttl, maxttl,
-			 false, false, addedrdataset);
-}
-
-isc_result_t
-dns_ncache_addoptout(dns_message_t *message, dns_db_t *cache,
-		     dns_dbnode_t *node, dns_rdatatype_t covers,
-		     isc_stdtime_t now, dns_ttl_t minttl, dns_ttl_t maxttl,
-		     bool optout, dns_rdataset_t *addedrdataset) {
-	return addoptout(message, cache, node, covers, now, minttl, maxttl,
-			 optout, true, addedrdataset);
-}
-
-static isc_result_t
-addoptout(dns_message_t *message, dns_db_t *cache, dns_dbnode_t *node,
-	  dns_rdatatype_t covers, isc_stdtime_t now, dns_ttl_t minttl,
-	  dns_ttl_t maxttl, bool optout, bool secure,
-	  dns_rdataset_t *addedrdataset) {
+	       dns_ttl_t maxttl, bool optout, bool secure,
+	       dns_rdataset_t *addedrdataset) {
 	isc_result_t result;
 	isc_buffer_t buffer;
 	isc_region_t r;
@@ -322,7 +299,7 @@ dns_ncache_towire(dns_rdataset_t *rdataset, dns_compress_t *cctx,
 		dns_rdataset_current(rdataset, &rdata);
 		isc_buffer_init(&source, rdata.data, rdata.length);
 		isc_buffer_add(&source, rdata.length);
-		dns_name_init(&name, NULL);
+		dns_name_init(&name);
 		isc_buffer_remainingregion(&source, &remaining);
 		dns_name_fromregion(&name, &remaining);
 		INSIST(remaining.length >= name.length);
@@ -360,7 +337,7 @@ dns_ncache_towire(dns_rdataset_t *rdataset, dns_compress_t *cctx,
 			 * Write the name.
 			 */
 			dns_compress_setpermitted(cctx, true);
-			result = dns_name_towire(&name, cctx, target, NULL);
+			result = dns_name_towire(&name, cctx, target);
 			if (result != ISC_R_SUCCESS) {
 				goto rollback;
 			}
@@ -545,7 +522,7 @@ dns_ncache_getrdataset(dns_rdataset_t *ncacherdataset, dns_name_t *name,
 		dns_rdataset_current(&rclone, &rdata);
 		isc_buffer_init(&source, rdata.data, rdata.length);
 		isc_buffer_add(&source, rdata.length);
-		dns_name_init(&tname, NULL);
+		dns_name_init(&tname);
 		isc_buffer_remainingregion(&source, &remaining);
 		dns_name_fromregion(&tname, &remaining);
 		INSIST(remaining.length >= tname.length);
@@ -615,7 +592,7 @@ dns_ncache_getsigrdataset(dns_rdataset_t *ncacherdataset, dns_name_t *name,
 		dns_rdataset_current(&rclone, &rdata);
 		isc_buffer_init(&source, rdata.data, rdata.length);
 		isc_buffer_add(&source, rdata.length);
-		dns_name_init(&tname, NULL);
+		dns_name_init(&tname);
 		isc_buffer_remainingregion(&source, &remaining);
 		dns_name_fromregion(&tname, &remaining);
 		INSIST(remaining.length >= tname.length);
@@ -704,7 +681,7 @@ dns_ncache_current(dns_rdataset_t *ncacherdataset, dns_name_t *found,
 	isc_buffer_init(&source, rdata.data, rdata.length);
 	isc_buffer_add(&source, rdata.length);

-	dns_name_init(&tname, NULL);
+	dns_name_init(&tname);
 	isc_buffer_remainingregion(&source, &remaining);
 	dns_name_fromregion(found, &remaining);
 	INSIST(remaining.length >= found->length);
@@ -473,7 +473,7 @@ dns_nsec_noexistnodata(dns_rdatatype_t type, const dns_name_t *name,
 	}
 	if (wild != NULL) {
 		dns_name_t common;
-		dns_name_init(&common, NULL);
+		dns_name_init(&common);
 		if (olabels > nlabels) {
 			labels = dns_name_countlabels(nsecname);
 			dns_name_getlabelsequence(nsecname, labels - olabels,
@@ -483,8 +483,7 @@ dns_nsec_noexistnodata(dns_rdatatype_t type, const dns_name_t *name,
 			dns_name_getlabelsequence(&nsec.next, labels - nlabels,
 						  nlabels, &common);
 		}
-		result = dns_name_concatenate(dns_wildcardname, &common, wild,
-					      NULL);
+		result = dns_name_concatenate(dns_wildcardname, &common, wild);
 		if (result != ISC_R_SUCCESS) {
 			dns_rdata_freestruct(&nsec);
 			(*logit)(arg, ISC_LOG_DEBUG(3),
@@ -261,7 +261,7 @@ dns_nsec3_hashname(dns_fixedname_t *result,
 	memset(rethash, 0, NSEC3_MAX_HASH_LENGTH);

 	downcased = dns_fixedname_initname(&fixed);
-	dns_name_downcase(name, downcased, NULL);
+	dns_name_downcase(name, downcased);

 	/* hash the node name */
 	len = isc_iterated_hash(rethash, hashalg, iterations, salt,
@@ -282,7 +282,7 @@ dns_nsec3_hashname(dns_fixedname_t *result,
 	/* convert the hex to a domain name */
 	dns_fixedname_init(result);
 	return dns_name_fromtext(dns_fixedname_name(result), &namebuffer,
-				 origin, 0, NULL);
+				 origin, 0);
 }

 unsigned int
@@ -757,7 +757,7 @@ addnsec3:
 	/*
 	 * Add missing NSEC3 records for empty nodes
 	 */
-	dns_name_init(&empty, NULL);
+	dns_name_init(&empty);
 	dns_name_clone(name, &empty);
 	do {
 		labels = dns_name_countlabels(&empty) - 1;
@@ -1114,7 +1114,7 @@ dns_nsec3param_deletechains(dns_db_t *db, dns_dbversion_t *ver,
 	dns_name_t *origin = dns_zone_getorigin(zone);
 	dns_rdatatype_t privatetype = dns_zone_getprivatetype(zone);

-	dns_name_init(&next, NULL);
+	dns_name_init(&next);
 	dns_rdataset_init(&rdataset);

 	result = dns_db_getoriginnode(db, &node);
@@ -1536,7 +1536,7 @@ dns_nsec3_delnsec3(dns_db_t *db, dns_dbversion_t *version,
 	 *  Delete NSEC3 records for now non active nodes.
 	 */
 cleanup_orphaned_ents:
-	dns_name_init(&empty, NULL);
+	dns_name_init(&empty);
 	dns_name_clone(name, &empty);
 	do {
 		labels = dns_name_countlabels(&empty) - 1;
@@ -2022,7 +2022,7 @@ dns_nsec3_noexistnodata(dns_rdatatype_t type, const dns_name_t *name,
 	 * Prepare to compute all the hashes.
 	 */
 	qname = dns_fixedname_initname(&qfixed);
-	dns_name_downcase(name, qname, NULL);
+	dns_name_downcase(name, qname);
 	qlabels = dns_name_countlabels(qname);
 	first = true;

@@ -289,7 +289,7 @@ nta_create(dns_ntatable_t *ntatable, const dns_name_t *name,

 	isc_refcount_init(&nta->references, 1);

-	dns_name_dupwithoffsets(name, nta->mctx, &nta->name);
+	dns_name_dup(name, nta->mctx, &nta->name);

 	*target = nta;
 }
@@ -506,14 +506,14 @@ dns_peer_setkeybycharp(dns_peer_t *peer, const char *keyval) {
 	isc_buffer_constinit(&b, keyval, strlen(keyval));
 	isc_buffer_add(&b, strlen(keyval));
 	result = dns_name_fromtext(dns_fixedname_name(&fname), &b, dns_rootname,
-				   0, NULL);
+				   0);
 	if (result != ISC_R_SUCCESS) {
 		return result;
 	}

 	name = isc_mem_get(peer->mem, sizeof(dns_name_t));

-	dns_name_init(name, NULL);
+	dns_name_init(name);
 	dns_name_dup(dns_fixedname_name(&fname), peer->mem, name);

 	result = dns_peer_setkey(peer, &name);
@@ -215,26 +215,20 @@ dns__qp_shutdown(void) {
 */
 size_t
 dns_qpkey_fromname(dns_qpkey_t key, const dns_name_t *name) {
-	size_t len, label;
-	dns_fixedname_t fixed;
-
 	REQUIRE(ISC_MAGIC_VALID(name, DNS_NAME_MAGIC));

-	if (name->labels == 0) {
+	dns_offsets_t offsets;
+	size_t labels = dns_name_offsets(name, offsets);
+
+	if (labels == 0) {
 		key[0] = SHIFT_NOBYTE;
 		return 0;
 	}

-	if (name->offsets == NULL) {
-		dns_name_t *clone = dns_fixedname_initname(&fixed);
-		dns_name_clone(name, clone);
-		name = clone;
-	}
-
-	len = 0;
-	label = name->labels;
+	size_t len = 0;
+	size_t label = labels;
 	while (label-- > 0) {
-		const uint8_t *ldata = name->ndata + name->offsets[label];
+		const uint8_t *ldata = name->ndata + offsets[label];
 		size_t label_len = *ldata++;
 		while (label_len-- > 0) {
 			uint16_t bits = dns_qp_bits_for_byte[*ldata++];
@@ -255,12 +249,11 @@ dns_qpkey_fromname(dns_qpkey_t key, const dns_name_t *name) {
 void
 dns_qpkey_toname(const dns_qpkey_t key, size_t keylen, dns_name_t *name) {
 	size_t locs[DNS_NAME_MAXLABELS];
-	size_t loc = 0, opos = 0;
+	size_t loc = 0;
 	size_t offset;

 	REQUIRE(ISC_MAGIC_VALID(name, DNS_NAME_MAGIC));
 	REQUIRE(name->buffer != NULL);
-	REQUIRE(name->offsets != NULL);

 	dns_name_reset(name);

@@ -293,14 +286,15 @@ scanned:
 	 * we step backward through the label boundaries, then forward
 	 * through the labels, to create the DNS wire format data.
 	 */
-	name->labels = loc;
 	while (loc-- > 0) {
 		uint8_t len = 0, *lenp = NULL;

-		/* Add a length byte to the name data and set an offset */
+		/* Store the location of the length byte */
 		lenp = isc_buffer_used(name->buffer);
+
+		/* Add a length byte to the name data */
 		isc_buffer_putuint8(name->buffer, 0);
-		name->offsets[opos++] = name->length++;
+		name->length++;

 		/* Convert from escaped byte ranges to ASCII */
 		for (offset = locs[loc]; offset < locs[loc + 1] - 1; offset++) {
@@ -316,6 +310,8 @@ scanned:
 		}

 		name->length += len;
+
+		/* Write the final label length to the length byte */
 		*lenp = len;
 	}

@@ -323,8 +319,7 @@ scanned:
 	if (key[0] == SHIFT_NOBYTE) {
 		name->attributes.absolute = true;
 		isc_buffer_putuint8(name->buffer, 0);
-		name->offsets[opos++] = name->length++;
-		name->labels++;
+		name->length++;
 	}

 	name->ndata = isc_buffer_base(name->buffer);
@@ -307,7 +307,7 @@ struct qpcache {

 #ifdef DNS_DB_NODETRACE
 #define qpcache_ref(ptr)   qpcache__ref(ptr, __func__, __FILE__, __LINE__)
-#define qpcache_unref(ptr) qpcache_unref(ptr, __func__, __FILE__, __LINE__)
+#define qpcache_unref(ptr) qpcache__unref(ptr, __func__, __FILE__, __LINE__)
 #define qpcache_attach(ptr, ptrp) \
 	qpcache__attach(ptr, ptrp, __func__, __FILE__, __LINE__)
 #define qpcache_detach(ptrp) qpcache__detach(ptrp, __func__, __FILE__, __LINE__)
@@ -797,6 +797,10 @@ qpcnode_release(qpcache_t *qpdb, qpcnode_t *node, isc_rwlocktype_t *nlocktypep,
 		 * acquired a reference in the meantime, so we increment
 		 * erefs (but NOT references!), upgrade the node lock,
 		 * decrement erefs again, and see if it's still zero.
+		 *
+		 * We can't really assume anything about the result code of
+		 * erefs_increment.  If another thread acquires reference it
+		 * will be larger than 0, if it doesn't it is going to be 0.
 		 */
 		isc_rwlock_t *nlock = &qpdb->buckets[node->locknum].lock;
 		qpcnode_erefs_increment(qpdb, node, *nlocktypep,
@@ -2511,7 +2515,8 @@ cleanup_deadnodes(void *arg) {
 	RUNTIME_CHECK(isc_queue_splice(&deadnodes,
 				       &qpdb->buckets[locknum].deadnodes));
 	isc_queue_for_each_entry_safe(&deadnodes, qpnode, qpnext, deadlink) {
-		qpcnode_release(qpdb, qpnode, &nlocktype, &tlocktype, false);
+		qpcnode_release(qpdb, qpnode, &nlocktype, &tlocktype,
+				false DNS__DB_FILELINE);
 	}

 	NODE_UNLOCK(nlock, &nlocktype);
@@ -2548,7 +2553,7 @@ new_qpcnode(qpcache_t *qpdb, const dns_name_t *name) {
 	};

 	isc_mem_attach(qpdb->common.mctx, &newdata->mctx);
-	dns_name_dupwithoffsets(name, newdata->mctx, &newdata->name);
+	dns_name_dup(name, newdata->mctx, &newdata->name);

 #ifdef DNS_DB_NODETRACE
 	fprintf(stderr, "new_qpcnode:%s:%s:%d:%p->references = 1\n", __func__,
@@ -2624,16 +2629,19 @@ qpcache_detachnode(dns_db_t *db, dns_dbnode_t **nodep DNS__DB_FLARG) {
 	nlock = &qpdb->buckets[node->locknum].lock;

 	/*
-	 * We can't destroy qpcache while holding a nodelock, so
-	 * we need to reference it before acquiring the lock
-	 * and release it afterward.
+	 * We can't destroy qpcache while holding a nodelock, so we need to
+	 * reference it before acquiring the lock and release it afterward.
+	 * Additionally, we must ensure that we don't destroy the database while
+	 * the NODE_LOCK is locked.
 	 */
 	qpcache_ref(qpdb);

+	rcu_read_lock();
 	NODE_RDLOCK(nlock, &nlocktype);
 	qpcnode_release(qpdb, node, &nlocktype, &tlocktype,
 			true DNS__DB_FLARG_PASS);
 	NODE_UNLOCK(nlock, &nlocktype);
+	rcu_read_unlock();

 	qpcache_detach(&qpdb);
 }
@@ -3485,7 +3493,7 @@ dns__qpcache_create(isc_mem_t *mctx, const dns_name_t *origin,
 	/*
 	 * Make a copy of the origin name.
 	 */
-	dns_name_dupwithoffsets(origin, mctx, &qpdb->common.origin);
+	dns_name_dup(origin, mctx, &qpdb->common.origin);

 	/*
 	 * Make the qp tries.
@@ -185,7 +185,7 @@ struct qpznode {
 	void *data;
 };

-typedef struct qpcache_bucket {
+typedef struct qpzone_bucket {
 	/* Per-bucket lock. */
 	isc_rwlock_t lock;

@@ -245,7 +245,7 @@ struct qpzonedb {

 #ifdef DNS_DB_NODETRACE
 #define qpzonedb_ref(ptr)   qpzonedb__ref(ptr, __func__, __FILE__, __LINE__)
-#define qpzonedb_unref(ptr) qpzonedb_unref(ptr, __func__, __FILE__, __LINE__)
+#define qpzonedb_unref(ptr) qpzonedb__unref(ptr, __func__, __FILE__, __LINE__)
 #define qpzonedb_attach(ptr, ptrp) \
 	qpzonedb__attach(ptr, ptrp, __func__, __FILE__, __LINE__)
 #define qpzonedb_detach(ptrp) \
@@ -599,7 +599,7 @@ new_qpznode(qpzonedb_t *qpdb, const dns_name_t *name) {
 	};

 	isc_mem_attach(qpdb->common.mctx, &newdata->mctx);
-	dns_name_dupwithoffsets(name, qpdb->common.mctx, &newdata->name);
+	dns_name_dup(name, qpdb->common.mctx, &newdata->name);

 #if DNS_DB_NODETRACE
 	fprintf(stderr, "new_qpznode:%s:%s:%d:%p->references = 1\n", __func__,
@@ -676,7 +676,7 @@ dns__qpzone_create(isc_mem_t *mctx, const dns_name_t *origin, dns_dbtype_t type,
 	/*
 	 * Make a copy of the origin name.
 	 */
-	dns_name_dupwithoffsets(origin, mctx, &qpdb->common.origin);
+	dns_name_dup(origin, mctx, &qpdb->common.origin);

 	dns_qpmulti_create(mctx, &qpmethods, qpdb, &qpdb->tree);
 	dns_qpmulti_create(mctx, &qpmethods, qpdb, &qpdb->nsec);
@@ -940,6 +940,10 @@ qpznode_release(qpzonedb_t *qpdb, qpznode_t *node, uint32_t least_serial,
 		 * acquired a reference in the meantime, so we increment
 		 * erefs (but NOT references!), upgrade the node lock,
 		 * decrement erefs again, and see if it's still zero.
+		 *
+		 * We can't really assume anything about the result code of
+		 * erefs_increment.  If another thread acquires reference it
+		 * will be larger than 0, if it doesn't it is going to be 0.
 		 */
 		isc_rwlock_t *nlock = &qpdb->buckets[node->locknum].lock;
 		qpznode_erefs_increment(qpdb, node DNS__DB_FLARG_PASS);
@@ -2149,11 +2153,10 @@ static void
 wildcardmagic(qpzonedb_t *qpdb, dns_qp_t *qp, const dns_name_t *name) {
 	isc_result_t result;
 	dns_name_t foundname;
-	dns_offsets_t offsets;
 	unsigned int n;
 	qpznode_t *node = NULL;

-	dns_name_init(&foundname, offsets);
+	dns_name_init(&foundname);
 	n = dns_name_countlabels(name);
 	INSIST(n >= 2);
 	n--;
@@ -2175,10 +2178,9 @@ wildcardmagic(qpzonedb_t *qpdb, dns_qp_t *qp, const dns_name_t *name) {
 static void
 addwildcards(qpzonedb_t *qpdb, dns_qp_t *qp, const dns_name_t *name) {
 	dns_name_t foundname;
-	dns_offsets_t offsets;
 	unsigned int n, l, i;

-	dns_name_init(&foundname, offsets);
+	dns_name_init(&foundname);
 	n = dns_name_countlabels(name);
 	l = dns_name_countlabels(&qpdb->common.origin);
 	i = l + 1;
@@ -2846,9 +2848,9 @@ wildcard_blocked(qpz_search_t *search, const dns_name_t *qname,
 	bool check_prev = false;
 	unsigned int n;

-	dns_name_init(&name, NULL);
-	dns_name_init(&tname, NULL);
-	dns_name_init(&rname, NULL);
+	dns_name_init(&name);
+	dns_name_init(&tname);
+	dns_name_init(&rname);
 	next = dns_fixedname_initname(&fnext);
 	prev = dns_fixedname_initname(&fprev);

@@ -2958,7 +2960,7 @@ find_wildcard(qpz_search_t *search, qpznode_t **nodep,
 			 * Construct the wildcard name for this level.
 			 */
 			result = dns_name_concatenate(dns_wildcardname,
-						      &node->name, wname, NULL);
+						      &node->name, wname);
 			if (result != ISC_R_SUCCESS) {
 				break;
 			}
@@ -3977,8 +3979,8 @@ qpzone_allrdatasets(dns_db_t *db, dns_dbnode_t *dbnode,
 }

 static void
-attachnode(dns_db_t *db, dns_dbnode_t *source,
-	   dns_dbnode_t **targetp DNS__DB_FLARG) {
+qpzone_attachnode(dns_db_t *db, dns_dbnode_t *source,
+		  dns_dbnode_t **targetp DNS__DB_FLARG) {
 	qpzonedb_t *qpdb = (qpzonedb_t *)db;
 	qpznode_t *node = (qpznode_t *)source;

@@ -3991,7 +3993,7 @@ attachnode(dns_db_t *db, dns_dbnode_t *source,
 }

 static void
-detachnode(dns_db_t *db, dns_dbnode_t **nodep DNS__DB_FLARG) {
+qpzone_detachnode(dns_db_t *db, dns_dbnode_t **nodep DNS__DB_FLARG) {
 	qpzonedb_t *qpdb = (qpzonedb_t *)db;
 	qpznode_t *node = NULL;
 	isc_rwlocktype_t nlocktype = isc_rwlocktype_none;
@@ -4005,15 +4007,21 @@ detachnode(dns_db_t *db, dns_dbnode_t **nodep DNS__DB_FLARG) {
 	nlock = &qpdb->buckets[node->locknum].lock;

 	/*
-	 * qpzone_destroy() uses call_rcu() API to destroy the node locks,
-	 * so it is safe to call it in the middle of NODE_LOCK.
+	 * qpzone_destroy() uses call_rcu() API to destroy the node locks, so it
+	 * is safe to call it in the middle of NODE_LOCK, but we need to acquire
+	 * the database reference to prevent destroying the database while the
+	 * NODE_LOCK is locked.
 	 */

+	qpzonedb_ref(qpdb);
+
 	rcu_read_lock();
 	NODE_RDLOCK(nlock, &nlocktype);
 	qpznode_release(qpdb, node, 0, &nlocktype DNS__DB_FLARG_PASS);
 	NODE_UNLOCK(nlock, &nlocktype);
 	rcu_read_unlock();
+
+	qpzonedb_unref(qpdb);
 }

 static unsigned int
@@ -5405,8 +5413,8 @@ static dns_dbmethods_t qpdb_zonemethods = {
 	.closeversion = closeversion,
 	.findnode = qpzone_findnode,
 	.find = qpzone_find,
-	.attachnode = attachnode,
-	.detachnode = detachnode,
+	.attachnode = qpzone_attachnode,
+	.detachnode = qpzone_detachnode,
 	.createiterator = qpzone_createiterator,
 	.findrdataset = qpzone_findrdataset,
 	.allrdatasets = qpzone_allrdatasets,
@@ -343,10 +343,8 @@ generic_rdata_in_svcb_current(dns_rdata_in_svcb_t *, isc_region_t *);
 * Active Directory gc._msdcs.<forest> prefix.
 */
 static unsigned char gc_msdcs_data[] = "\002gc\006_msdcs";
-static unsigned char gc_msdcs_offset[] = { 0, 3 };

-static dns_name_t const gc_msdcs = DNS_NAME_INITNONABSOLUTE(gc_msdcs_data,
-							    gc_msdcs_offset);
+static dns_name_t const gc_msdcs = DNS_NAME_INITNONABSOLUTE(gc_msdcs_data);

 /*%
 *	convert presentation level address to network order binary form.
@@ -606,13 +604,6 @@ check_private(isc_buffer_t *source, dns_secalg_t alg) {

 		RETERR(dns_name_fromwire(dns_fixedname_initname(&fixed), source,
 					 DNS_DECOMPRESS_DEFAULT, NULL));
-		/*
-		 * There should be a public key or signature after the key name.
-		 */
-		isc_buffer_activeregion(source, &sr);
-		if (sr.length == 0) {
-			return ISC_R_UNEXPECTEDEND;
-		}
 	} else if (alg == DNS_KEYALG_PRIVATEOID) {
 		/*
 		 * Check that we can extract the OID from the start of the
@@ -629,10 +620,6 @@ check_private(isc_buffer_t *source, dns_secalg_t alg) {
 			RETERR(DNS_R_FORMERR);
 		}
 		ASN1_OBJECT_free(obj);
-		/* There should be a public key or signature after the OID. */
-		if (in >= sr.base + sr.length) {
-			return ISC_R_UNEXPECTEDEND;
-		}
 	}
 	return ISC_R_SUCCESS;
 }
@@ -20,7 +20,6 @@
 static isc_result_t
 fromtext_any_tsig(ARGS_FROMTEXT) {
 	isc_token_t token;
-	dns_name_t name;
 	uint64_t sigtime;
 	isc_buffer_t buffer;
 	dns_rcode_t rcode;
@@ -39,12 +38,11 @@ fromtext_any_tsig(ARGS_FROMTEXT) {
 	 */
 	RETERR(isc_lex_getmastertoken(lexer, &token, isc_tokentype_string,
 				      false));
-	dns_name_init(&name, NULL);
 	buffer_fromregion(&buffer, &token.value.as_region);
 	if (origin == NULL) {
 		origin = dns_rootname;
 	}
-	RETTOK(dns_name_fromtext(&name, &buffer, origin, options, target));
+	RETTOK(dns_name_wirefromtext(&buffer, origin, options, target));

 	/*
 	 * Time Signed: 48 bits.
@@ -151,8 +149,8 @@ totext_any_tsig(ARGS_TOTEXT) {
 	/*
 	 * Algorithm Name.
 	 */
-	dns_name_init(&name, NULL);
-	dns_name_init(&prefix, NULL);
+	dns_name_init(&name);
+	dns_name_init(&prefix);
 	dns_name_fromregion(&name, &sr);
 	opts = name_prefix(&name, tctx->origin, &prefix) ? DNS_NAME_OMITFINALDOT
 							 : 0;
@@ -270,7 +268,7 @@ fromwire_any_tsig(ARGS_FROMWIRE) {
 	/*
 	 * Algorithm Name.
 	 */
-	dns_name_init(&name, NULL);
+	dns_name_init(&name);
 	RETERR(dns_name_fromwire(&name, source, dctx, target));

 	isc_buffer_activeregion(source, &sr);
@@ -326,7 +324,6 @@ static isc_result_t
 towire_any_tsig(ARGS_TOWIRE) {
 	isc_region_t sr;
 	dns_name_t name;
-	dns_offsets_t offsets;

 	REQUIRE(rdata->type == dns_rdatatype_tsig);
 	REQUIRE(rdata->rdclass == dns_rdataclass_any);
@@ -334,9 +331,9 @@ towire_any_tsig(ARGS_TOWIRE) {

 	dns_compress_setpermitted(cctx, false);
 	dns_rdata_toregion(rdata, &sr);
-	dns_name_init(&name, offsets);
+	dns_name_init(&name);
 	dns_name_fromregion(&name, &sr);
-	RETERR(dns_name_towire(&name, cctx, target, NULL));
+	RETERR(dns_name_towire(&name, cctx, target));
 	isc_region_consume(&sr, name_length(&name));
 	return mem_tobuffer(target, sr.base, sr.length);
 }
@@ -358,8 +355,8 @@ compare_any_tsig(ARGS_COMPARE) {

 	dns_rdata_toregion(rdata1, &r1);
 	dns_rdata_toregion(rdata2, &r2);
-	dns_name_init(&name1, NULL);
-	dns_name_init(&name2, NULL);
+	dns_name_init(&name1);
+	dns_name_init(&name2);
 	dns_name_fromregion(&name1, &r1);
 	dns_name_fromregion(&name2, &r2);
 	order = dns_name_rdatacompare(&name1, &name2);
@@ -463,9 +460,9 @@ tostruct_any_tsig(ARGS_TOSTRUCT) {
 	/*
 	 * Algorithm Name.
 	 */
-	dns_name_init(&alg, NULL);
+	dns_name_init(&alg);
 	dns_name_fromregion(&alg, &sr);
-	dns_name_init(&tsig->algorithm, NULL);
+	dns_name_init(&tsig->algorithm);
 	name_duporclone(&alg, mctx, &tsig->algorithm);

 	isc_region_consume(&sr, name_length(&tsig->algorithm));
@@ -24,7 +24,8 @@
 static isc_result_t
 fromtext_ch_a(ARGS_FROMTEXT) {
 	isc_token_t token;
-	dns_name_t name;
+	dns_fixedname_t fn;
+	dns_name_t *name = dns_fixedname_initname(&fn);
 	isc_buffer_t buffer;

 	REQUIRE(type == dns_rdatatype_a);
@@ -37,22 +38,22 @@ fromtext_ch_a(ARGS_FROMTEXT) {
 				      false));

 	/* get domain name */
-	dns_name_init(&name, NULL);
 	buffer_fromregion(&buffer, &token.value.as_region);
 	if (origin == NULL) {
 		origin = dns_rootname;
 	}
-	RETTOK(dns_name_fromtext(&name, &buffer, origin, options, target));
+	RETTOK(dns_name_fromtext(name, &buffer, origin, options));
+	RETTOK(dns_name_towire(name, NULL, target));
 	if ((options & DNS_RDATA_CHECKNAMES) != 0 &&
 	    (options & DNS_RDATA_CHECKREVERSE) != 0)
 	{
 		bool ok;
-		ok = dns_name_ishostname(&name, false);
+		ok = dns_name_ishostname(name, false);
 		if (!ok && (options & DNS_RDATA_CHECKNAMESFAIL) != 0) {
 			RETTOK(DNS_R_BADNAME);
 		}
 		if (!ok && callbacks != NULL) {
-			warn_badname(&name, lexer, callbacks);
+			warn_badname(name, lexer, callbacks);
 		}
 	}

@@ -77,8 +78,8 @@ totext_ch_a(ARGS_TOTEXT) {
 	REQUIRE(rdata->rdclass == dns_rdataclass_ch); /* 3 */
 	REQUIRE(rdata->length != 0);

-	dns_name_init(&name, NULL);
-	dns_name_init(&prefix, NULL);
+	dns_name_init(&name);
+	dns_name_init(&prefix);

 	dns_rdata_toregion(rdata, &region);
 	dns_name_fromregion(&name, &region);
@@ -108,7 +109,7 @@ fromwire_ch_a(ARGS_FROMWIRE) {

 	dctx = dns_decompress_setpermitted(dctx, true);

-	dns_name_init(&name, NULL);
+	dns_name_init(&name);

 	RETERR(dns_name_fromwire(&name, source, dctx, target));

@@ -131,7 +132,6 @@ fromwire_ch_a(ARGS_FROMWIRE) {
 static isc_result_t
 towire_ch_a(ARGS_TOWIRE) {
 	dns_name_t name;
-	dns_offsets_t offsets;
 	isc_region_t sregion;
 	isc_region_t tregion;

@@ -141,13 +141,13 @@ towire_ch_a(ARGS_TOWIRE) {

 	dns_compress_setpermitted(cctx, true);

-	dns_name_init(&name, offsets);
+	dns_name_init(&name);

 	dns_rdata_toregion(rdata, &sregion);

 	dns_name_fromregion(&name, &sregion);
 	isc_region_consume(&sregion, name_length(&name));
-	RETERR(dns_name_towire(&name, cctx, target, NULL));
+	RETERR(dns_name_towire(&name, cctx, target));

 	isc_buffer_availableregion(target, &tregion);
 	if (tregion.length < 2) {
@@ -174,8 +174,8 @@ compare_ch_a(ARGS_COMPARE) {
 	REQUIRE(rdata1->length != 0);
 	REQUIRE(rdata2->length != 0);

-	dns_name_init(&name1, NULL);
-	dns_name_init(&name2, NULL);
+	dns_name_init(&name1);
+	dns_name_init(&name2);

 	dns_rdata_toregion(rdata1, &region1);
 	dns_rdata_toregion(rdata2, &region2);
@@ -232,11 +232,11 @@ tostruct_ch_a(ARGS_TOSTRUCT) {

 	dns_rdata_toregion(rdata, &region);

-	dns_name_init(&name, NULL);
+	dns_name_init(&name);
 	dns_name_fromregion(&name, &region);
 	isc_region_consume(&region, name_length(&name));

-	dns_name_init(&a->ch_addr_dom, NULL);
+	dns_name_init(&a->ch_addr_dom);
 	name_duporclone(&name, mctx, &a->ch_addr_dom);
 	a->ch_addr = htons(uint16_fromregion(&region));
 	a->mctx = mctx;
@@ -280,7 +280,7 @@ digest_ch_a(ARGS_DIGEST) {
 	REQUIRE(rdata->rdclass == dns_rdataclass_ch);

 	dns_rdata_toregion(rdata, &r);
-	dns_name_init(&name, NULL);
+	dns_name_init(&name);
 	dns_name_fromregion(&name, &r);
 	isc_region_consume(&r, name_length(&name));
 	RETERR(dns_name_digest(&name, digest, arg));
@@ -308,7 +308,7 @@ checknames_ch_a(ARGS_CHECKNAMES) {
 	UNUSED(owner);

 	dns_rdata_toregion(rdata, &region);
-	dns_name_init(&name, NULL);
+	dns_name_init(&name);
 	dns_name_fromregion(&name, &region);
 	if (!dns_name_ishostname(&name, false)) {
 		if (bad != NULL) {
@@ -22,7 +22,8 @@ static isc_result_t
 fromtext_afsdb(ARGS_FROMTEXT) {
 	isc_token_t token;
 	isc_buffer_t buffer;
-	dns_name_t name;
+	dns_fixedname_t fn;
+	dns_name_t *name = dns_fixedname_initname(&fn);
 	bool ok;

 	REQUIRE(type == dns_rdatatype_afsdb);
@@ -46,21 +47,21 @@ fromtext_afsdb(ARGS_FROMTEXT) {
 	 */
 	RETERR(isc_lex_getmastertoken(lexer, &token, isc_tokentype_string,
 				      false));
-	dns_name_init(&name, NULL);
 	buffer_fromregion(&buffer, &token.value.as_region);
 	if (origin == NULL) {
 		origin = dns_rootname;
 	}
-	RETTOK(dns_name_fromtext(&name, &buffer, origin, options, target));
+	RETTOK(dns_name_fromtext(name, &buffer, origin, options));
+	RETTOK(dns_name_towire(name, NULL, target));
 	ok = true;
 	if ((options & DNS_RDATA_CHECKNAMES) != 0) {
-		ok = dns_name_ishostname(&name, false);
+		ok = dns_name_ishostname(name, false);
 	}
 	if (!ok && (options & DNS_RDATA_CHECKNAMESFAIL) != 0) {
 		RETTOK(DNS_R_BADNAME);
 	}
 	if (!ok && callbacks != NULL) {
-		warn_badname(&name, lexer, callbacks);
+		warn_badname(name, lexer, callbacks);
 	}
 	return ISC_R_SUCCESS;
 }
@@ -76,8 +77,8 @@ totext_afsdb(ARGS_TOTEXT) {
 	REQUIRE(rdata->type == dns_rdatatype_afsdb);
 	REQUIRE(rdata->length != 0);

-	dns_name_init(&name, NULL);
-	dns_name_init(&prefix, NULL);
+	dns_name_init(&name);
+	dns_name_init(&prefix);

 	dns_rdata_toregion(rdata, &region);
 	num = uint16_fromregion(&region);
@@ -103,7 +104,7 @@ fromwire_afsdb(ARGS_FROMWIRE) {

 	dctx = dns_decompress_setpermitted(dctx, false);

-	dns_name_init(&name, NULL);
+	dns_name_init(&name);

 	isc_buffer_activeregion(source, &sr);
 	isc_buffer_availableregion(target, &tr);
@@ -124,7 +125,6 @@ towire_afsdb(ARGS_TOWIRE) {
 	isc_region_t tr;
 	isc_region_t sr;
 	dns_name_t name;
-	dns_offsets_t offsets;

 	REQUIRE(rdata->type == dns_rdatatype_afsdb);
 	REQUIRE(rdata->length != 0);
@@ -139,10 +139,10 @@ towire_afsdb(ARGS_TOWIRE) {
 	isc_region_consume(&sr, 2);
 	isc_buffer_add(target, 2);

-	dns_name_init(&name, offsets);
+	dns_name_init(&name);
 	dns_name_fromregion(&name, &sr);

-	return dns_name_towire(&name, cctx, target, NULL);
+	return dns_name_towire(&name, cctx, target);
 }

 static int
@@ -164,8 +164,8 @@ compare_afsdb(ARGS_COMPARE) {
 		return result < 0 ? -1 : 1;
 	}

-	dns_name_init(&name1, NULL);
-	dns_name_init(&name2, NULL);
+	dns_name_init(&name1);
+	dns_name_init(&name2);

 	dns_rdata_toregion(rdata1, &region1);
 	dns_rdata_toregion(rdata2, &region2);
@@ -211,14 +211,14 @@ tostruct_afsdb(ARGS_TOSTRUCT) {
 	afsdb->common.rdtype = rdata->type;
 	ISC_LINK_INIT(&afsdb->common, link);

-	dns_name_init(&afsdb->server, NULL);
+	dns_name_init(&afsdb->server);

 	dns_rdata_toregion(rdata, &region);

 	afsdb->subtype = uint16_fromregion(&region);
 	isc_region_consume(&region, 2);

-	dns_name_init(&name, NULL);
+	dns_name_init(&name);
 	dns_name_fromregion(&name, &region);

 	name_duporclone(&name, mctx, &afsdb->server);
@@ -244,14 +244,13 @@ freestruct_afsdb(ARGS_FREESTRUCT) {
 static isc_result_t
 additionaldata_afsdb(ARGS_ADDLDATA) {
 	dns_name_t name;
-	dns_offsets_t offsets;
 	isc_region_t region;

 	REQUIRE(rdata->type == dns_rdatatype_afsdb);

 	UNUSED(owner);

-	dns_name_init(&name, offsets);
+	dns_name_init(&name);
 	dns_rdata_toregion(rdata, &region);
 	isc_region_consume(&region, 2);
 	dns_name_fromregion(&name, &region);
@@ -271,7 +270,7 @@ digest_afsdb(ARGS_DIGEST) {
 	isc_region_consume(&r2, 2);
 	r1.length = 2;
 	RETERR((digest)(arg, &r1));
-	dns_name_init(&name, NULL);
+	dns_name_init(&name);
 	dns_name_fromregion(&name, &r2);

 	return dns_name_digest(&name, digest, arg);
@@ -300,7 +299,7 @@ checknames_afsdb(ARGS_CHECKNAMES) {

 	dns_rdata_toregion(rdata, &region);
 	isc_region_consume(&region, 2);
-	dns_name_init(&name, NULL);
+	dns_name_init(&name);
 	dns_name_fromregion(&name, &region);
 	if (!dns_name_ishostname(&name, false)) {
 		if (bad != NULL) {
@@ -23,7 +23,6 @@
 static isc_result_t
 fromtext_amtrelay(ARGS_FROMTEXT) {
 	isc_token_t token;
-	dns_name_t name;
 	isc_buffer_t buffer;
 	unsigned int discovery;
 	unsigned int gateway;
@@ -108,13 +107,11 @@ fromtext_amtrelay(ARGS_FROMTEXT) {
 		return ISC_R_SUCCESS;

 	case 3:
-		dns_name_init(&name, NULL);
 		buffer_fromregion(&buffer, &token.value.as_region);
 		if (origin == NULL) {
 			origin = dns_rootname;
 		}
-		return dns_name_fromtext(&name, &buffer, origin, options,
-					 target);
+		return dns_name_wirefromtext(&buffer, origin, options, target);
 	default:
 		UNREACHABLE();
 	}
@@ -172,7 +169,7 @@ totext_amtrelay(ARGS_TOTEXT) {
 		return inet_totext(AF_INET6, tctx->flags, &region, target);

 	case 3:
-		dns_name_init(&name, NULL);
+		dns_name_init(&name);
 		dns_name_fromregion(&name, &region);
 		return dns_name_totext(&name, 0, target);

@@ -224,7 +221,7 @@ fromwire_amtrelay(ARGS_FROMWIRE) {
 	case 3:
 		RETERR(mem_tobuffer(target, region.base, 2));
 		isc_buffer_forward(source, 2);
-		dns_name_init(&name, NULL);
+		dns_name_init(&name);
 		return dns_name_fromwire(&name, source, dctx, target);

 	default:
@@ -318,10 +315,10 @@ tostruct_amtrelay(ARGS_TOSTRUCT) {
 	amtrelay->common.rdtype = rdata->type;
 	ISC_LINK_INIT(&amtrelay->common, link);

-	dns_name_init(&amtrelay->gateway, NULL);
+	dns_name_init(&amtrelay->gateway);
 	amtrelay->data = NULL;

-	dns_name_init(&name, NULL);
+	dns_name_init(&name);
 	dns_rdata_toregion(rdata, &region);

 	amtrelay->precedence = uint8_fromregion(&region);
@@ -453,8 +450,8 @@ casecompare_amtrelay(ARGS_COMPARE) {
 		return isc_region_compare(&region1, &region2);
 	}

-	dns_name_init(&name1, NULL);
-	dns_name_init(&name2, NULL);
+	dns_name_init(&name1);
+	dns_name_init(&name2);

 	isc_region_consume(&region1, 2);
 	isc_region_consume(&region2, 2);
@@ -20,7 +20,6 @@
 static isc_result_t
 fromtext_cname(ARGS_FROMTEXT) {
 	isc_token_t token;
-	dns_name_t name;
 	isc_buffer_t buffer;

 	REQUIRE(type == dns_rdatatype_cname);
@@ -32,12 +31,11 @@ fromtext_cname(ARGS_FROMTEXT) {
 	RETERR(isc_lex_getmastertoken(lexer, &token, isc_tokentype_string,
 				      false));

-	dns_name_init(&name, NULL);
 	buffer_fromregion(&buffer, &token.value.as_region);
 	if (origin == NULL) {
 		origin = dns_rootname;
 	}
-	RETTOK(dns_name_fromtext(&name, &buffer, origin, options, target));
+	RETTOK(dns_name_wirefromtext(&buffer, origin, options, target));
 	return ISC_R_SUCCESS;
 }

@@ -51,8 +49,8 @@ totext_cname(ARGS_TOTEXT) {
 	REQUIRE(rdata->type == dns_rdatatype_cname);
 	REQUIRE(rdata->length != 0);

-	dns_name_init(&name, NULL);
-	dns_name_init(&prefix, NULL);
+	dns_name_init(&name);
+	dns_name_init(&prefix);

 	dns_rdata_toregion(rdata, &region);
 	dns_name_fromregion(&name, &region);
@@ -73,14 +71,13 @@ fromwire_cname(ARGS_FROMWIRE) {

 	dctx = dns_decompress_setpermitted(dctx, true);

-	dns_name_init(&name, NULL);
+	dns_name_init(&name);
 	return dns_name_fromwire(&name, source, dctx, target);
 }

 static isc_result_t
 towire_cname(ARGS_TOWIRE) {
 	dns_name_t name;
-	dns_offsets_t offsets;
 	isc_region_t region;

 	REQUIRE(rdata->type == dns_rdatatype_cname);
@@ -88,11 +85,11 @@ towire_cname(ARGS_TOWIRE) {

 	dns_compress_setpermitted(cctx, true);

-	dns_name_init(&name, offsets);
+	dns_name_init(&name);
 	dns_rdata_toregion(rdata, &region);
 	dns_name_fromregion(&name, &region);

-	return dns_name_towire(&name, cctx, target, NULL);
+	return dns_name_towire(&name, cctx, target);
 }

 static int
@@ -108,8 +105,8 @@ compare_cname(ARGS_COMPARE) {
 	REQUIRE(rdata1->length != 0);
 	REQUIRE(rdata2->length != 0);

-	dns_name_init(&name1, NULL);
-	dns_name_init(&name2, NULL);
+	dns_name_init(&name1);
+	dns_name_init(&name2);

 	dns_rdata_toregion(rdata1, &region1);
 	dns_rdata_toregion(rdata2, &region2);
@@ -151,10 +148,10 @@ tostruct_cname(ARGS_TOSTRUCT) {
 	cname->common.rdtype = rdata->type;
 	ISC_LINK_INIT(&cname->common, link);

-	dns_name_init(&name, NULL);
+	dns_name_init(&name);
 	dns_rdata_toregion(rdata, &region);
 	dns_name_fromregion(&name, &region);
-	dns_name_init(&cname->cname, NULL);
+	dns_name_init(&cname->cname);
 	name_duporclone(&name, mctx, &cname->cname);
 	cname->mctx = mctx;
 	return ISC_R_SUCCESS;
@@ -194,7 +191,7 @@ digest_cname(ARGS_DIGEST) {
 	REQUIRE(rdata->type == dns_rdatatype_cname);

 	dns_rdata_toregion(rdata, &r);
-	dns_name_init(&name, NULL);
+	dns_name_init(&name);
 	dns_name_fromregion(&name, &r);

 	return dns_name_digest(&name, digest, arg);
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Evan Hunt	3878c145c9	experiment	2025-02-26 16:01:01 -08:00
Evan Hunt	4acbfbc2d1	retry fix	2025-02-26 16:01:01 -08:00
Evan Hunt	1ef9a32de7	slight refactoring in validated() fix some minor code redundancies.	2025-02-26 15:28:57 -08:00
Evan Hunt	6c738fe323	simplify dns_ncache_add() there's no longer any reason to have both dns_ncache_add() and dns_ncache_addoptout().	2025-02-26 15:28:57 -08:00
Evan Hunt	49ccbe857a	fix: dev: Validating ADB fetches could cause a crash in import_rdataset() Previously, in some cases, the resolver could return rdatasets of type CNAME or DNAME without the result code being set to `DNS_R_CNAME` or `DNS_R_DNAME`. This could trigger an assertion failure in the ADB. The resolver error has been fixed. Closes #5201 Merge branch '5201-adb-cname-error' into 'main' See merge request isc-projects/bind9!10172	2025-02-26 20:34:27 +00:00
Evan Hunt	1edbbc32b4	set eresult based on the type in ncache_adderesult() when the caching of a negative record failed because of the presence of a positive one, ncache_adderesult() could override this to ISC_R_SUCCESS. this could cause CNAME and DNAME responses to be handled incorrectly. ncache_adderesult() now sets the result code correctly in such cases.	2025-02-25 21:29:19 -08:00
Mark Andrews	a102e504c3	fix: doc: Fix command to generate KSR in DNSSEC guide Merge branch 'doc-fix-dnssec-ksr-request-command' into 'main' See merge request isc-projects/bind9!10087	2025-02-26 01:51:33 +00:00
Doug FreedandMark Andrews	0dd046d007	Fix command to generate KSR in DNSSEC guide	2025-02-26 01:08:52 +00:00
Evan Hunt	764eb65cf6	fix: dev: Remove 'target' from dns_adb When a server name turns out to be a CNAME or DNAME, the ADB does not use it, but the `dns_adbname` structure still stored a copy of the target name. This is unnecessary and the code has been removed. Merge branch 'each-remove-adb-target' into 'main' See merge request isc-projects/bind9!10149	2025-02-26 00:43:46 +00:00
Evan Hunt	6c2af2ae3b	remove 'target' from dns_adb the target name parameter to dns_adb_createfind() was always passed as NULL, so we can safely remove it. relatedly, the 'target' field in the dns_adbname structure was never referenced after being set. the 'expire_target' field was used, but only as a way to check whether an ADB name represents a CNAME or DNAME, and that information can be stored as a single flag.	2025-02-26 00:43:21 +00:00
Mark Andrews	6af708f3b0	fix: usr: Fix dual-stack-servers configuration option The dual-stack-servers configuration option was not working as expected; the specified servers were not being used when they should have been, leading to resolution failures. This has been fixed. Closes #5019 Merge branch '5019-dual-stack-servers-wasn-t-working-in-all-cases' into 'main' See merge request isc-projects/bind9!9708	2025-02-26 00:22:30 +00:00
Mark Andrews	14ab1629b7	Removing now unneeded priming queries Now that fctx_try is being called when adb returns DNS_ADB_NOMOREADDRESSES we don't need these priming queries for the dual-stack-servers test to succeed.	2025-02-25 23:47:46 +00:00
Mark Andrews	f98a8331aa	Fix dual-stack-servers Named was stopping nameserver address resolution attempts too soon when dual stack servers are configured. Dual stack servers are used when there are not addresses for the server in a particular address family so find->status == DNS_ADB_NOMOREADDRESSES is not a sufficient stopping condition when dual stack servers are available. Call fctx_try to see if the alternate servers can be used.	2025-02-25 23:47:46 +00:00
Mark Andrews	1bc7016d7a	fix: usr: Relax private DNSKEY and RRSIG constraints DNSKEY, KEY, RRSIG and SIG constraints have been relaxed to allow empty key and signature material after the algorithm identifier for PRIVATEOID and PRIVATEDNS. It is arguable whether this falls within the expected use of these types as no key material is shared and the signatures are ineffective but these are private algorithms and they can be totally insecure. Closes #5167 Merge branch '5167-relax-private-dnskey-constraints' into 'main' See merge request isc-projects/bind9!10083	2025-02-25 23:39:40 +00:00
Mark Andrews	b048190e23	Relax private DNSKEY and RRSIG constraints DNSKEY, KEY, RRSIG and SIG constraints have been relaxed to allow empty key and signature material after the algorithm identifier for PRIVATEOID and PRIVATEDNS. It is arguable whether this falls within the expected use of these types as no key material is shared and the signatures are ineffective but these are private algorithms and they can be totally insecure.	2025-02-25 22:59:46 +00:00
Evan Hunt	5604d3a44e	fix: dev: Prevent a reference leak when using plugins The `NS_QUERY_DONE_BEGIN` and `NS_QUERY_DONE_SEND` plugin hooks could cause a reference leak if they returned `NS_HOOK_RETURN` without cleaning up the query context properly. Closes #2094 Merge branch '2094-plugin-reference-leak' into 'main' See merge request isc-projects/bind9!9971	2025-02-25 22:40:55 +00:00
Evan Hunt	ae37ef45ff	wrap ns_client_error() for unit testing When testing, the client object doesn't have a proper netmgr handle, so ns_client_error() needs to be a no-op.	2025-02-25 22:40:48 +00:00
Evan Hunt	c2e4358267	prevent a reference leak from the ns_query_done hooks if the NS_QUERY_DONE_BEGIN or NS_QUERY_DONE_SEND hook is used in a plugin and returns NS_HOOK_RETURN, some of the cleanup in ns_query_done() can be skipped over, leading to reference leaks that can cause named to hang on shut down. this has been addressed by adding more housekeeping code after the cleanup: tag in ns_query_done().	2025-02-25 22:40:48 +00:00
Mark Andrews	26f8ee7229	fix: usr: dnssec-signzone needs to check for a NULL key when setting offline dnssec-signzone could dereference a NULL key pointer when resigning a zone. This has been fixed. Closes #5192 Merge branch '5192-dnssec-signzone-needs-to-check-for-a-null-key-when-setting-offline' into 'main' See merge request isc-projects/bind9!10161	2025-02-25 22:22:30 +00:00
Mark Andrews	1784e4a9ae	Check if key is NULL before dereferencing it	2025-02-25 21:45:37 +00:00
Evan Hunt	e16560a650	fix: dev: Simplify some dns_name API calls Several functions in the `dns_name` module have had parameters removed, that were rarely or never used: - `dns_name_fromtext()` and `dns_name_concatenate()` no longer take a target buffer. - `dns_name_towire()` no longer takes a compression offset pointer; this is now part of the compression context. - `dns_name_towire()` with a `NULL` compression context will copy name data directly into a buffer with no processing. Merge branch 'each-simplify-names' into 'main' See merge request isc-projects/bind9!10152	2025-02-25 21:34:31 +00:00
Evan Hunt	2f7e6eb019	allow NULL compression context in dns_name_towire() passing NULL as the compression context to dns_name_towire() copies the uncompressed name data directly into the target buffer.	2025-02-25 12:53:25 -08:00
Evan Hunt	afb424c9b6	simplify dns_name_fromtext() interface previously, dns_name_fromtext() took both a target name and an optional target buffer parameter, which could override the name's dedicated buffer. this interface is unnecessarily complex. we now have two functions, dns_name_fromtext() to convert text into a dns_name that has a dedicated buffer, and dns_name_wirefromtext() to convert text into uncompressed DNS wire format and append it to a target buffer. in cases where it really is necessary to have both, we can use dns_name_fromtext() to load the dns_name, then dns_name_towire() to append the wire format to the target buffer.	2025-02-25 12:53:25 -08:00
Evan Hunt	cf098cf10d	avoid the 'target' buffer in dns_name_fromtext() dns_name_fromtext() stores the converted name in the 'name' passed to it, and optionally also copies it in wire format to a buffer 'target'. this makes the interface unnecessarily complex, and could be simplified by having a different function for each purpose. as a first step, remove uses of the target buffer in calls to dns_name_fromtext() where it wasn't actually needed.	2025-02-25 12:53:25 -08:00
Evan Hunt	a6986f6837	remove 'target' parameter from dns_name_concatenate() the target buffer passed to dns_name_concatenate() was never used (except for one place in dig, where it wasn't actually needed, and has already been removed in a prior commit). we can safely remove the parameter.	2025-02-25 12:53:25 -08:00
Evan Hunt	2edefbad4a	remove the 'name_coff' parameter in dns_name_towire() this parameter was added as a (minor) optimization for cases where dns_name_towire() is run repeatedly with the same compression context, as when rendering all of the rdatas in an rdataset. it is currently only used in one place. we now simplify the interface by removing the extra parameter. the compression offset value is now part of the compression context, and can be activated when needed by calling dns_compress_setmultiuse(). multiuse mode is automatically deactivated by any subsequent call to dns_compress_permitted().	2025-02-25 12:53:25 -08:00
Evan Hunt	1d7a9ebeda	remove the namebuf and onamebuf buffers in dig lookup->namebuf and lookup->onamebuf were not necessary and have been removed.	2025-02-25 12:53:25 -08:00
Evan Hunt	cf981ab13b	fix: dev: Save time when creating a slab from another slab The `dns_rdataslab_fromrdataset()` function creates a slab from an rdataset. If the source rdataset already uses a slab, then no processing is necessary; we can just copy the existing slab to a new location. Closes #5188 Merge branch '5188-optimize-makeslab' into 'main' See merge request isc-projects/bind9!10162	2025-02-25 18:37:49 +00:00
Evan Hunt	94a96a7a0e	save time when creating a slab from another slab the dns_rdataslab_fromrdataset() function creates a slab from an rdataset. if the source rdataset already uses a slab, then no processing is necessary; we can just copy the existing slab to a new location.	2025-02-25 18:37:35 +00:00
Ondřej Surý	796b662b92	fix: usr: Fix assertion failure when dumping recursing clients Previously, if a new counter was added to the hashtable while dumping recursing clients via the `rndc recursing` command, and `fetches-per-zone` was enabled, an assertion failure could occur. This has been fixed. Closes #5200 Merge branch '5200-destroy-iterator-inside-the-rwlock' into 'main' See merge request isc-projects/bind9!10164	2025-02-25 15:38:08 +00:00
Ondřej Surý	1e4fb53c61	Destroy the hashmap iterator inside the rwlock Previously, the hashmap iterator for fetches-per-zone was destroy outside the rwlock. This could lead to an assertion failure due to a timing race with the internal rehashing of the hashmap table as the rehashing process requires no iterators to be running when rehashing the hashmap table. This has been fixed by moving the destruction of the iterator inside the read locked section.	2025-02-25 13:36:37 +01:00
Ondřej Surý	24db1b1a8a	chg:usr: Reduce memory used to store DNS names The memory used to internally store the DNS names has been reduced. Merge branch 'ondrej/experiment-no-offsets-in-dns_name' into 'main' See merge request isc-projects/bind9!10140	2025-02-25 11:17:55 +00:00
Ondřej Surý	67e1df1a07	Squash set_offsets() and dns_name_offsets() into single function The third argument to set_offsets() was only used in dns_name_fromregion() and not really needed. We can remove the third argument and then manually check whether the last label is root label.	2025-02-25 12:17:34 +01:00
Ondřej Surý	79c3871a7b	Remove target buffer from dns_name_downcase() There was just a single use of passing an extra buffer to dns_name_downcase() which have been replaced by simple call to isc_ascii_lowercase() and the 'target' argument from dns_name_downcase() function has been removed.	2025-02-25 12:17:34 +01:00
Ondřej Surý	3bb47bc6cd	Remove MAKE_EMPTY() macro from dns_name unit The MAKE_EMPTY() macro was clearing up the output variable in case of the failure. However, this was breaking the usual design pattern that the output variables are left in indeterminate state or we don't touch them at all when a failure occurs. Remove the macro and change the dns_name_downcase() to not touch the name contents until success.	2025-02-25 12:17:34 +01:00
Ondřej Surý	259600c837	Cleanup the usage of dns_offsets_t vs unsigned char * pointers There was a back-and-forth between static arrays and the pointers to the offsets. Since we are now only using the static arrays, we can cleanup the usage of the pointers that would previously point either to the static array or name->offsets if available.	2025-02-25 12:17:34 +01:00
Ondřej Surý	1c22ab2ef7	Simplify name initializers We no longer need to pass labels to DNS_NAME_INITABSOLUTE and DNS_NAME_INITNONABSOLUTE.	2025-02-25 12:17:34 +01:00
Ondřej Surý	04c2c2cbc8	Simplify dns_name_init() Remove the now-unused offsets parameter from dns_name_init().	2025-02-25 12:17:34 +01:00
Ondřej Surý	08e966df82	Remove offsets from the dns_name and dns_fixedname structures The offsets were meant to speed-up the repeated dns_name operations, but it was experimentally proven that there's actually no real-world benefit. Remove the offsets and labels fields from the dns_name and the static offsets fields to save 128 bytes from the fixedname in favor of calculating labels and offsets only when needed.	2025-02-25 12:17:34 +01:00
Alessio Podda	869168545a	chg: nil: Remove unused symtab implementation The old symtab implementation should have been removed in !9921, but it wasn't. This MR addresses that. Merge branch 'alessio/cleanup-symtab-orphan-files' into 'main' See merge request isc-projects/bind9!10122	2025-02-25 11:13:22 +00:00
alessio	45132df850	Remove unused symtab implementation The old symtab implementation should have been removed in !9921 , but it wasn't. This commit addresses that.	2025-02-25 11:29:58 +01:00
Alessio Podda	7fce7707db	chg: usr: Drop malformed notify messages early instead of decompressing them The DNS header shows if a message has multiple questions or invalid NOTIFY sections. We can drop these messages early, right after parsing the question. This matches RFC 9619 for multi-question messages and Unbound's handling of NOTIFY. We still parse the question to include it in our FORMERR response. Add drop_msg_early() function to check for these conditions: - Messages with more than one question, as required by RFC 9619 - NOTIFY query messages containing answer sections (like Unbound) - NOTIFY messages containing authority sections (like Unbound) Closes #5158, #3656 Merge branch '5158-early-formerr-on-bad-notify-or-bad-qdcount' into 'main' See merge request isc-projects/bind9!10056	2025-02-25 10:29:00 +00:00
alessio	887502e37d	Drop malformed notify messages early instead of decompressing them The DNS header shows if a message has multiple questions or invalid NOTIFY sections. We can drop these messages early, right after parsing the question. This matches RFC 9619 for multi-question messages and Unbound's handling of NOTIFY. To further add further robustness, we include an additional check for unknown opcodes, and also drop those messages early. Add early_sanity_check() function to check for these conditions: - Messages with more than one question, as required by RFC 9619 - NOTIFY query messages containing answer sections (like Unbound) - NOTIFY messages containing authority sections (like Unbound) - Unknown opcodes.	2025-02-25 10:40:38 +01:00
Mark Andrews	4e0b62bf10	fix: test: Handle example3.db being modified in upforwd system test The zone file for example3 (ns1/example3.db) can be modified in the upforwd test as example3 is updated as part of the test. Whether the zone is written out or not by the end of the test is timing dependent. Rename ns1/example3.db to ns1/example3.db.in and copy it to ns1/example3.db in setup so we don't trigger post test changes checks. Closes #5180 Merge branch '5180-create-example3-in-setup' into 'main' See merge request isc-projects/bind9!10160	2025-02-25 06:16:45 +00:00
Mark Andrews	afc4413862	Handle example3.db being modified in upforwd system test The zone file for example3 (ns1/example3.db) can be modified in the upforwd test as example3 is updated as part of the test. Whether the zone is written out or not by the end of the test is timing dependent. Rename ns1/example3.db to ns1/example3.db.in and copy it to ns1/example3.db in setup so we don't trigger post test changes checks.	2025-02-25 12:28:58 +11:00
Evan Hunt	02ef8ff01c	fix: dev: Fix a logic error in cache_name() A change in `6aba56ae8` (checking whether a rejected RRset was identical to the data it would have replaced, so that we could still cache a signature) inadvertently introduced cases where processing of a response would continue when previously it would have been skipped. Closes #5197 Merge branch '5197-cache_name-logic-error' into 'main' See merge request isc-projects/bind9!10157	2025-02-24 23:39:23 +00:00
Evan Hunt	d0fd9cbe3b	Fix a logic error in cache_name() A change in `6aba56ae8` (checking whether a rejected RRset was identical to the data it would have replaced, so that we could still cache a signature) inadvertently introduced cases where processing of a response would continue when previously it would have been skipped.	2025-02-24 15:04:14 -08:00
Ondřej Surý	c4868b5bd9	fix: dev: Acquire the database reference before possibly last node release Acquire the database reference in the detachnode() to prevent the last reference to be release while the NODE_LOCK being locked. The NODE_LOCK is locked/unlocked inside the RCU critical section, thus it is most probably this should not pose a problem as the database uses call_rcu memory reclamation, but this it is still safer to acquire the reference before releasing the node. Closes #5194 Merge branch '5194-fix-assertion-failure-while-reference-counting-qpdb' into 'main' See merge request isc-projects/bind9!10155	2025-02-24 22:24:51 +00:00
Ondřej Surý	d1ef6a93c1	Acquire the database reference before possibly last node release Acquire the database refernce in the detachnode() to prevent the last reference to be release while the NODE_LOCK being locked. The NODE_LOCK is locked/unlocked inside the RCU critical section, thus it is most probably this should not pose a problem as the database uses call_rcu memory reclamation, but this it is still safer to acquire the reference before releasing the node.	2025-02-24 20:05:56 +01:00