Use isctest.asyncserver in the "upforwd" test

Replace the custom DNS server used in the "upforwd" system test with new code based on the isctest.asyncserver module. The ans4 server currently used in that test is a copy of bin/tests/system/ans.pl modified to receive queries over UDP and TCP without ever responding to any of them.
Add a response handler for ignoring all queries
2025-03-24 06:16:19 +01:00 · 2025-03-24 06:16:19 +01:00 · 2025-03-24 06:16:19 +01:00 · 2025-03-18 15:30:35 +00:00 · 2025-03-18 16:28:18 +01:00 · 2025-03-18 16:28:18 +01:00
177 changed files with 2789 additions and 3561 deletions
@@ -56,6 +56,16 @@ variables:
  # Some jobs may clean up the build artifacts unless this is set to 0.
  CLEAN_BUILD_ARTIFACTS_ON_SUCCESS: 1

+  # DNS Shotgun performance testing defaults
+  SHOTGUN_ROUNDS: 1
+  SHOTGUN_DURATION: 120
+  # allow unlimited improvements against baseline
+  SHOTGUN_EVAL_THRESHOLD_CPU_MIN: '-inf'
+  SHOTGUN_EVAL_THRESHOLD_MEMORY_MIN: '-inf'
+  SHOTGUN_EVAL_THRESHOLD_RCODE_MAX: '+inf'
+  SHOTGUN_EVAL_THRESHOLD_LATENCY_PCTL_MIN: '-inf'
+  SHOTGUN_EVAL_THRESHOLD_LATENCY_PCTL_DRIFT_MIN: '-inf'
+
 default:
  # Allow all running CI jobs to be automatically canceled when a new
  # version of a branch is pushed.
@@ -107,16 +117,55 @@ stages:
    - runner-manager
    - aarch64

-# Autoscaling GitLab Runner on AWS EC2 (FreeBSD)
-
-.freebsd-stress-amd64: &freebsd_stress_amd64
+.freebsd-autoscaler-13-amd64-tags: &freebsd_autoscaler_13_amd64_tags
  tags:
-    - bsd-stress-test
-    - aws
+    - amd64
    - autoscaler
+    - aws
+    - bsd-stress-test-1
    - shell
    - stress-test
+
+.freebsd-autoscaler-14-amd64-tags: &freebsd_autoscaler_14_amd64_tags
+  tags:
    - amd64
+    - autoscaler
+    - aws
+    - bsd-stress-test-2
+    - shell
+    - stress-test
+
+.freebsd-autoscaler-amd64: &freebsd_autoscaler_amd64
+  variables:
+    CC: clang
+    CFLAGS: "${CFLAGS_COMMON} -Og"
+    # Even though there's only one job per runtime environment, the GitLab
+    # "instance" executor insists on cloning the Git repository to a path that
+    # contains a variable number from zero to the "maximum concurrent instances
+    # count" allowed on the GitLab Runner. See the "0" directory in this
+    # example path: /home/ec2-user/builds/t1_4FZzvz/0/isc-projects/bind9/.git/.
+    #
+    # This is not a problem for isolated jobs like "stress" tests that depend
+    # on no other jobs. However, it is a problem for jobs that need other jobs'
+    # artifacts. For example, a system test job that has its Git repo cloned to
+    # the "/1/" sub-path will fail if it downloads build job artifacts that
+    # have ./configure output files with "/0/" in its sub-path recorded.
+    GIT_CLONE_PATH: "/home/ec2-user/builds/${CI_PROJECT_PATH}/"
+    # Use MIT Kerberos5 for BIND 9 GSS-API support because of FreeBSD Heimdal
+    # incompatibility; see https://bugs.freebsd.org/275241.
+    EXTRA_CONFIGURE: "${WITH_READLINE_EDITLINE} --with-gssapi=/usr/local/bin/krb5-config"
+
+# Autoscaling GitLab Runner on AWS EC2 (FreeBSD 13)
+
+.freebsd-autoscaler-13-amd64: &freebsd_autoscaler_13_amd64
+  <<: *freebsd_autoscaler_amd64
+  <<: *freebsd_autoscaler_13_amd64_tags
+
+# Autoscaling GitLab Runner on AWS EC2 (FreeBSD 14)
+
+.freebsd-autoscaler-14-amd64: &freebsd_autoscaler_14_amd64
+  <<: *freebsd_autoscaler_amd64
+  <<: *freebsd_autoscaler_14_amd64_tags

 ### Docker Image Templates

@@ -204,14 +253,6 @@ stages:

 ### QCOW2 Image Templates

-.freebsd-13-amd64: &freebsd_13_amd64_image
-  image: "freebsd-13.4-x86_64"
-  <<: *libvirt_amd64
-
-.freebsd-14-amd64: &freebsd_14_amd64_image
-  image: "freebsd-14.2-x86_64"
-  <<: *libvirt_amd64
-
 .openbsd-amd64: &openbsd_amd64_image
  image: "openbsd-7.6-x86_64"
  <<: *libvirt_amd64
@@ -219,31 +260,18 @@ stages:
 ### Job Templates

 .api-pipelines-schedules-tags-triggers-web-triggering-rules: &api_pipelines_schedules_tags_triggers_web_triggering_rules
-  only:
-    - api
-    - pipelines
-    - schedules
-    - tags
-    - triggers
-    - web
+  rules:
+    - if: '$CI_PIPELINE_SOURCE =~ /^(api|pipeline|schedule|trigger|web)$/'
+    - if: '$CI_COMMIT_TAG != null'

 .api-pipelines-schedules-triggers-web-triggering-rules: &api_pipelines_schedules_triggers_web_triggering_rules
-  only:
-    - api
-    - pipelines
-    - schedules
-    - triggers
-    - web
+  rules:
+    - if: '$CI_PIPELINE_SOURCE =~ /^(api|pipeline|schedule|trigger|web)$/'

 .default-triggering-rules: &default_triggering_rules
-  only:
-    - api
-    - merge_requests
-    - pipelines
-    - schedules
-    - tags
-    - triggers
-    - web
+  rules:
+    - if: '$CI_PIPELINE_SOURCE =~ /^(api|merge_request_event|pipeline|schedule|trigger|web)$/'
+    - if: '$CI_COMMIT_TAG != null'

 .precheck: &precheck_job
  <<: *default_triggering_rules
@@ -343,18 +371,41 @@ stages:

 .shotgun: &shotgun_job
  <<: *base_image
-  <<: *api_pipelines_schedules_tags_triggers_web_triggering_rules
  stage: performance
+  rules:
+    - &shotgun_rule_mr
+      if: '$CI_MERGE_REQUEST_DIFF_BASE_SHA != null'
+      variables:
+        BASELINE: '$CI_MERGE_REQUEST_DIFF_BASE_SHA'
+    - &shotgun_rule_tag
+      if: '$CI_COMMIT_TAG != null'
+      variables:
+        SHOTGUN_ROUNDS: 3
+    - &shotgun_rule_other
+      if: '$CI_PIPELINE_SOURCE =~ /^(api|pipeline|schedule|trigger|web)$/'
+  # when using data from a single run, the overall instability of the results
+  # causes quite high false positive rate, rerun the test to attemp to reduce those
+  retry: 1
  script:
-    - if [ -z "$CI_COMMIT_TAG" ]; then export SHOTGUN_ROUNDS=1; else export SHOTGUN_ROUNDS=3; fi
+    - if [ -z "$BASELINE" ]; then export BASELINE=$BIND_BASELINE_VERSION; fi  # this dotenv variable can't be set in the rules section, because rules are evaluated before any jobs run
    - PIPELINE_ID=$(curl -s -X POST --fail
        -F "token=$CI_JOB_TOKEN"
        -F ref=main
-        -F "variables[SHOTGUN_TEST_VERSION]=['$CI_COMMIT_REF_NAME', '$BIND_BASELINE_VERSION']"
+        -F "variables[SHOTGUN_TEST_VERSION]=['$CI_COMMIT_REF_NAME', '$BASELINE']"
        -F "variables[SHOTGUN_DURATION]=300"
        -F "variables[SHOTGUN_ROUNDS]=$SHOTGUN_ROUNDS"
        -F "variables[SHOTGUN_TRAFFIC_MULTIPLIER]=$SHOTGUN_TRAFFIC_MULTIPLIER"
        -F "variables[SHOTGUN_SCENARIO]=$SHOTGUN_SCENARIO"
+        -F "variables[SHOTGUN_EVAL_THRESHOLD_CPU_MIN]=$SHOTGUN_EVAL_THRESHOLD_CPU_MIN"
+        -F "variables[SHOTGUN_EVAL_THRESHOLD_CPU_MAX]=$SHOTGUN_EVAL_THRESHOLD_CPU_MAX"
+        -F "variables[SHOTGUN_EVAL_THRESHOLD_MEMORY_MIN]=$SHOTGUN_EVAL_THRESHOLD_MEMORY_MIN"
+        -F "variables[SHOTGUN_EVAL_THRESHOLD_MEMORY_MAX]=$SHOTGUN_EVAL_THRESHOLD_MEMORY_MAX"
+        -F "variables[SHOTGUN_EVAL_THRESHOLD_RCODE_MIN]=$SHOTGUN_EVAL_THRESHOLD_RCODE_MIN"
+        -F "variables[SHOTGUN_EVAL_THRESHOLD_RCODE_MAX]=$SHOTGUN_EVAL_THRESHOLD_RCODE_MAX"
+        -F "variables[SHOTGUN_EVAL_THRESHOLD_LATENCY_PCTL_MIN]=$SHOTGUN_EVAL_THRESHOLD_LATENCY_PCTL_MIN"
+        -F "variables[SHOTGUN_EVAL_THRESHOLD_LATENCY_PCTL_MAX]=$SHOTGUN_EVAL_THRESHOLD_LATENCY_PCTL_MAX"
+        -F "variables[SHOTGUN_EVAL_THRESHOLD_LATENCY_PCTL_DRIFT_MIN]=$SHOTGUN_EVAL_THRESHOLD_LATENCY_PCTL_DRIFT_MIN"
+        -F "variables[SHOTGUN_EVAL_THRESHOLD_LATENCY_PCTL_DRIFT_MAX]=$SHOTGUN_EVAL_THRESHOLD_LATENCY_PCTL_DRIFT_MAX"
        https://gitlab.isc.org/api/v4/projects/188/trigger/pipeline | jq .id)
    - util/ci-wait-shotgun.py $PIPELINE_ID
  needs:
@@ -511,6 +562,8 @@ misc:
    - if git grep SYSTEMTESTTOP -- ':!.gitlab-ci.yml'; then echo 'Please use relative paths instead of $SYSTEMTESTTOP.'; exit 1; fi
    - bash util/unused-headers.sh
    - bash util/xmllint-html.sh
+    # Check dangling symlinks in the repository
+    - if find . -xtype l | grep .; then exit 1; fi
  needs: []
  artifacts:
    paths:
@@ -534,7 +587,7 @@ vulture:
  <<: *precheck_job
  needs: []
  script:
-    - vulture --exclude "*/ans*/ans.py,conftest.py,isctest" --ignore-names "pytestmark" bin/tests/system/
+    - vulture --exclude "*ans.py,conftest.py,isctest" --ignore-names "pytestmark" bin/tests/system/

 ci-variables:
  stage: precheck
@@ -619,9 +672,8 @@ danger:
  script:
    - pip install git+https://gitlab.isc.org/isc-projects/hazard.git
    - hazard
-  only:
-    refs:
-      - merge_requests
+  rules:
+    - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'

 checkbashisms:
  <<: *precheck_job
@@ -1289,7 +1341,7 @@ gcc:tsan:
  variables:
    CC: gcc
    CFLAGS: "${CFLAGS_COMMON} -Wno-stringop-overread -ggdb -O2 -fsanitize=thread"
-    LDFLAGS: "-fsanitize=thread"
+    LDFLAGS: "-fsanitize=thread -Wl,--disable-new-dtags"
    EXTRA_CONFIGURE: "--with-libidn2 --enable-pthread-rwlock --without-jemalloc PKG_CONFIG_PATH=/opt/tsan/lib/pkgconfig"
  <<: *tsan_fedora_41_amd64_image
  <<: *build_job
@@ -1318,7 +1370,8 @@ clang:tsan:
  variables:
    CC: "${CLANG}"
    CFLAGS: "${CFLAGS_COMMON} -ggdb -O2 -fsanitize=thread"
-    LDFLAGS: "-fsanitize=thread"
+    # -Wl,--disable-new-dtags ensures that Clang creates valid TSAN reports
+    LDFLAGS: "-fsanitize=thread -Wl,--disable-new-dtags"
    EXTRA_CONFIGURE: "--with-libidn2 --enable-pthread-rwlock --without-jemalloc PKG_CONFIG_PATH=/opt/tsan/lib/pkgconfig"

 system:clang:tsan:
@@ -1397,27 +1450,19 @@ unit:clang:bookworm:amd64:
 # Jobs for Clang builds on FreeBSD 13 (amd64)

 clang:freebsd13:amd64:
-  variables:
-    CFLAGS: "${CFLAGS_COMMON}"
-    # Use MIT Kerberos5 for BIND 9 GSS-API support because of FreeBSD Heimdal
-    # incompatibility; see https://bugs.freebsd.org/275241.
-    EXTRA_CONFIGURE: "${WITH_READLINE_LIBEDIT} --with-gssapi=/usr/local/bin/krb5-config"
-    USER: gitlab-runner
-  <<: *freebsd_13_amd64_image
  <<: *build_job
+  <<: *freebsd_autoscaler_13_amd64

 system:clang:freebsd13:amd64:
-  <<: *freebsd_13_amd64_image
  <<: *system_test_job
-  variables:
-    USER: gitlab-runner
+  <<: *freebsd_autoscaler_13_amd64
  needs:
    - job: clang:freebsd13:amd64
      artifacts: true

 unit:clang:freebsd13:amd64:
-  <<: *freebsd_13_amd64_image
  <<: *unit_test_job
+  <<: *freebsd_autoscaler_13_amd64
  needs:
    - job: clang:freebsd13:amd64
      artifacts: true
@@ -1425,27 +1470,19 @@ unit:clang:freebsd13:amd64:
 # Jobs for Clang builds on FreeBSD 14 (amd64)

 clang:freebsd14:amd64:
-  variables:
-    CFLAGS: "${CFLAGS_COMMON}"
-    # Use MIT Kerberos5 for BIND 9 GSS-API support because of FreeBSD Heimdal
-    # incompatibility; see https://bugs.freebsd.org/275241.
-    EXTRA_CONFIGURE: "${WITH_READLINE_EDITLINE} --with-gssapi=/usr/local/bin/krb5-config"
-    USER: gitlab-runner
-  <<: *freebsd_14_amd64_image
  <<: *build_job
+  <<: *freebsd_autoscaler_14_amd64

 system:clang:freebsd14:amd64:
-  <<: *freebsd_14_amd64_image
  <<: *system_test_job
-  variables:
-    USER: gitlab-runner
+  <<: *freebsd_autoscaler_14_amd64
  needs:
    - job: clang:freebsd14:amd64
      artifacts: true

 unit:clang:freebsd14:amd64:
-  <<: *freebsd_14_amd64_image
  <<: *unit_test_job
+  <<: *freebsd_autoscaler_14_amd64
  needs:
    - job: clang:freebsd14:amd64
      artifacts: true
@@ -1494,8 +1531,8 @@ release:
      artifacts: true
    - job: docs
      artifacts: true
-  only:
-    - tags
+  rules:
+    - if: '$CI_COMMIT_TAG != null'
  artifacts:
    paths:
      - "*-release"
@@ -1538,8 +1575,8 @@ sign:
  needs:
    - job: release
      artifacts: true
-  only:
-    - tags
+  rules:
+    - if: '$CI_COMMIT_TAG != null'
  when: manual
  allow_failure: false

@@ -1591,10 +1628,8 @@ coverity:
      - cov-int.tar.gz
    expire_in: "1 week"
    when: on_failure
-  only:
-    variables:
-      - $COVERITY_SCAN_PROJECT_NAME
-      - $COVERITY_SCAN_TOKEN
+  rules:
+    - if: '$COVERITY_SCAN_PROJECT_NAME != null && $COVERITY_SCAN_TOKEN != null'

 # Respdiff tests

@@ -1629,9 +1664,9 @@ respdiff:tsan:
  <<: *default_triggering_rules
  <<: *tsan_debian_bookworm_amd64_image
  variables:
-    CC: gcc
-    CFLAGS: "${CFLAGS_COMMON} -Og -fsanitize=thread"
-    LDFLAGS: "-fsanitize=thread"
+    CC: "${CLANG}"
+    CFLAGS: "${CFLAGS_COMMON} -ggdb -O2 -fsanitize=thread"
+    LDFLAGS: "-fsanitize=thread -Wl,--disable-new-dtags"
    EXTRA_CONFIGURE: "--enable-pthread-rwlock --without-jemalloc PKG_CONFIG_PATH=/opt/tsan/lib/pkgconfig"
    MAX_DISAGREEMENTS_PERCENTAGE: "0.15"
    TSAN_OPTIONS: "${TSAN_OPTIONS_DEBIAN}"
@@ -1656,9 +1691,6 @@ respdiff-third-party:

 # Performance tests

-# Run shotgun:udp right away, but delay other shotgun jobs sligthly in order to
-# allow re-use of the built container image. Otherwise, the jobs would do the
-# same builds in parallel rather than re-use the already built image.
 shotgun:udp:
  <<: *shotgun_job
  variables:
@@ -1669,25 +1701,29 @@ shotgun:tcp:
  <<: *shotgun_job
  variables:
    SHOTGUN_SCENARIO: tcp
-    SHOTGUN_TRAFFIC_MULTIPLIER: 13
-  when: delayed
-  start_in: 5 minutes
+    SHOTGUN_TRAFFIC_MULTIPLIER: 12

 shotgun:dot:
  <<: *shotgun_job
  variables:
    SHOTGUN_SCENARIO: dot
    SHOTGUN_TRAFFIC_MULTIPLIER: 6
-  when: delayed
-  start_in: 5 minutes
+  rules: &shotgun_rules_manual_mr
+    - if: '$CI_MERGE_REQUEST_DIFF_BASE_SHA != null'
+      variables:
+        BASELINE: '$CI_MERGE_REQUEST_DIFF_BASE_SHA'
+      when: manual  # don't run on each MR unless requested
+      allow_failure: true
+    - *shotgun_rule_tag
+    - *shotgun_rule_other

 shotgun:doh-get:
  <<: *shotgun_job
  variables:
    SHOTGUN_SCENARIO: doh-get
    SHOTGUN_TRAFFIC_MULTIPLIER: 3
-  when: delayed
-  start_in: 5 minutes
+    SHOTGUN_EVAL_THRESHOLD_LATENCY_PCTL_MAX: 0.4  # bump from the default due to increased tail-end jitter
+  rules: *shotgun_rules_manual_mr

 .stress-test: &stress_test
  stage: performance
@@ -1726,8 +1762,8 @@ fsck:
    - git clone https://gitlab.isc.org/isc-projects/bind9.git bind9-full-clone
    - cd bind9-full-clone/
    - git fsck
-  only:
-    - schedules
+  rules:
+    - if: '$CI_PIPELINE_SOURCE == "schedule"'
  needs: []

 gcov:
@@ -1779,9 +1815,8 @@ pairwise:
      - pairwise-model.txt
      - pairwise-output.*.txt
    when: on_failure
-  only:
-    variables:
-      - $PAIRWISE_TESTING
+  rules:
+    - if: '$PAIRWISE_TESTING != null'

 .post_merge_template: &post_merge
  <<: *base_image
@@ -1 +1 @@
-CHANGES
+doc/arm/changelog.rst
@@ -761,7 +761,7 @@ cleanup:
 	}

 	if (mctx != NULL) {
-		isc_mem_destroy(&mctx);
+		isc_mem_detach(&mctx);
 	}

 	return result == ISC_R_SUCCESS ? 0 : 1;
@@ -577,7 +577,7 @@ main(int argc, char **argv) {
 		fprintf(errout, "OK\n");
 	}
 	destroy();
-	isc_mem_destroy(&mctx);
+	isc_mem_detach(&mctx);

 	return (result == ISC_R_SUCCESS) ? 0 : 1;
 }
@@ -290,7 +290,7 @@ options {\n\
 		isc_mem_stats(mctx, stderr);
 	}

-	isc_mem_destroy(&mctx);
+	isc_mem_detach(&mctx);

 	return 0;
 }
@@ -296,7 +296,7 @@ nsupdate -k <keyfile>\n");
 		isc_mem_stats(mctx, stderr);
 	}

-	isc_mem_destroy(&mctx);
+	isc_mem_detach(&mctx);

 	return 0;
 }
@@ -26,16 +26,12 @@
 #include <unistd.h>

 #include <openssl/opensslv.h>
-#if OPENSSL_VERSION_NUMBER >= 0x30000000L
-#include <openssl/err.h>
-#include <openssl/provider.h>
-#endif

 #include <isc/async.h>
 #include <isc/attributes.h>
 #include <isc/base64.h>
 #include <isc/buffer.h>
-#include <isc/fips.h>
+#include <isc/crypto.h>
 #include <isc/hex.h>
 #include <isc/lib.h>
 #include <isc/log.h>
@@ -167,10 +163,6 @@ static dns_fixedname_t qfn;
 /* Default trust anchors */
 static char anchortext[] = TRUST_ANCHORS;

-#if OPENSSL_VERSION_NUMBER >= 0x30000000L
-static OSSL_PROVIDER *fips = NULL, *base = NULL;
-#endif
-
 /*
 * Static function prototypes
 */
@@ -1619,24 +1611,7 @@ preparse_args(int argc, char **argv) {
 		while (strpbrk(option, single_dash_opts) == &option[0]) {
 			switch (option[0]) {
 			case 'F':
-#if OPENSSL_VERSION_NUMBER >= 0x30000000L
-				fips = OSSL_PROVIDER_load(NULL, "fips");
-				if (fips == NULL) {
-					ERR_clear_error();
-					fatal("Failed to load FIPS provider");
-				}
-				base = OSSL_PROVIDER_load(NULL, "base");
-				if (base == NULL) {
-					OSSL_PROVIDER_unload(fips);
-					ERR_clear_error();
-					fatal("Failed to load base provider");
-				}
-#endif
-				/* Already in FIPS mode?  */
-				if (isc_fips_mode()) {
-					break;
-				}
-				if (isc_fips_set_mode(1) != ISC_R_SUCCESS) {
+				if (isc_crypto_fips_enable() != ISC_R_SUCCESS) {
 					fatal("setting FIPS mode failed");
 				}
 				break;
@@ -2309,14 +2284,5 @@ cleanup:

 	isc_managers_destroy(&mctx, &loopmgr, &netmgr);

-#if OPENSSL_VERSION_NUMBER >= 0x30000000L
-	if (base != NULL) {
-		OSSL_PROVIDER_unload(base);
-	}
-	if (fips != NULL) {
-		OSSL_PROVIDER_unload(fips);
-	}
-#endif
-
 	return 0;
 }
@@ -20,8 +20,8 @@
 #include <time.h>

 #include <isc/attributes.h>
+#include <isc/crypto.h>
 #include <isc/dir.h>
-#include <isc/fips.h>
 #include <isc/lib.h>
 #include <isc/loop.h>
 #include <isc/netaddr.h>
@@ -73,14 +73,6 @@ static bool short_form = false, printcmd = true, plusquest = false,
 static uint32_t splitwidth = 0xffffffff;

 #include <openssl/opensslv.h>
-#if OPENSSL_VERSION_NUMBER >= 0x30000000L
-#include <openssl/err.h>
-#include <openssl/provider.h>
-#endif
-
-#if OPENSSL_VERSION_NUMBER >= 0x30000000L
-static OSSL_PROVIDER *fips = NULL, *base = NULL;
-#endif

 /*% opcode text */
 static const char *const opcodetext[] = {
@@ -297,6 +289,7 @@ help(void) {
 	       "                                      form of answers - global "
 	       "option)\n"
 	       "                 +[no]showbadcookie  (Show BADCOOKIE message)\n"
+	       "                 +[no]showbadvers    (Show BADVERS message)\n"
 	       "                 +[no]showsearch     (Search with intermediate "
 	       "results)\n"
 	       "                 +[no]split=##       (Split hex/base64 fields "
@@ -1780,6 +1773,8 @@ plus_option(char *option, bool is_batchfile, bool *need_clone,
 						FULLCHECK("edns");
 						if (!state) {
 							lookup->edns = -1;
+							lookup->original_edns =
+								-1;
 							break;
 						}
 						if (value == NULL) {
@@ -1796,6 +1791,7 @@ plus_option(char *option, bool is_batchfile, bool *need_clone,
 							goto exit_or_usage;
 						}
 						lookup->edns = num;
+						lookup->original_edns = num;
 						break;
 					case 'f':
 						FULLCHECK("ednsflags");
@@ -2314,8 +2310,18 @@ plus_option(char *option, bool is_batchfile, bool *need_clone,
 			case 'w': /* showsearch */
 				switch (cmd[4]) {
 				case 'b':
-					FULLCHECK("showbadcookie");
-					lookup->showbadcookie = state;
+					switch (cmd[7]) {
+					case 'c':
+						FULLCHECK("showbadcookie");
+						lookup->showbadcookie = state;
+						break;
+					case 'v':
+						FULLCHECK("showbadvers");
+						lookup->showbadvers = state;
+						break;
+					default:
+						goto invalid_option;
+					}
 					break;
 				case 's':
 					FULLCHECK("showsearch");
@@ -2931,24 +2937,7 @@ preparse_args(int argc, char **argv) {
 				debugging = true;
 				break;
 			case 'F':
-#if OPENSSL_VERSION_NUMBER >= 0x30000000L
-				fips = OSSL_PROVIDER_load(NULL, "fips");
-				if (fips == NULL) {
-					ERR_clear_error();
-					fatal("Failed to load FIPS provider");
-				}
-				base = OSSL_PROVIDER_load(NULL, "base");
-				if (base == NULL) {
-					OSSL_PROVIDER_unload(fips);
-					ERR_clear_error();
-					fatal("Failed to load base provider");
-				}
-#endif
-				/* Already in FIPS mode?  */
-				if (isc_fips_mode()) {
-					break;
-				}
-				if (isc_fips_set_mode(1) != ISC_R_SUCCESS) {
+				if (isc_crypto_fips_enable() != ISC_R_SUCCESS) {
 					fatal("setting FIPS mode failed");
 				}
 				break;
@@ -3476,14 +3465,5 @@ main(int argc, char **argv) {
 	dig_startup();
 	dig_shutdown();

-#if OPENSSL_VERSION_NUMBER >= 0x30000000L
-	if (base != NULL) {
-		OSSL_PROVIDER_unload(base);
-	}
-	if (fips != NULL) {
-		OSSL_PROVIDER_unload(fips);
-	}
-#endif
-
 	return exitcode;
 }
@@ -614,6 +614,12 @@ abbreviation is unambiguous; for example, :option:`+cd` is equivalent to
   BADCOOKIE rcode before retrying the request or not. The default
   is to not show the messages.

+.. option:: +showbadvers, +noshowbadvers
+
+   This option toggles whether to show the message containing the
+   BADVERS rcode before retrying the request or not. The default
+   is to not show the messages.
+
 .. option:: +showsearch, +noshowsearch

   This option performs [or does not perform] a search showing intermediate results.
@@ -605,6 +605,7 @@ make_empty_lookup(void) {
 		.idnout = idnout,
 		.udpsize = -1,
 		.edns = -1,
+		.original_edns = -1,
 		.recurse = true,
 		.retries = tries,
 		.comments = true,
@@ -738,6 +739,7 @@ clone_lookup(dig_lookup_t *lookold, bool servers) {
 	}

 	looknew->showbadcookie = lookold->showbadcookie;
+	looknew->showbadvers = lookold->showbadvers;
 	looknew->sendcookie = lookold->sendcookie;
 	looknew->seenbadcookie = lookold->seenbadcookie;
 	looknew->badcookie = lookold->badcookie;
@@ -764,6 +766,7 @@ clone_lookup(dig_lookup_t *lookold, bool servers) {
 	looknew->idnout = lookold->idnout;
 	looknew->udpsize = lookold->udpsize;
 	looknew->edns = lookold->edns;
+	looknew->original_edns = lookold->original_edns;
 	looknew->recurse = lookold->recurse;
 	looknew->aaonly = lookold->aaonly;
 	looknew->adflag = lookold->adflag;
@@ -1938,6 +1941,7 @@ followup_lookup(dns_message_t *msg, dig_query_t *query, dns_section_t section) {
 				}
 				domain = dns_fixedname_name(&lookup->fdomain);
 				dns_name_copy(name, domain);
+				lookup->edns = lookup->original_edns;
 			}
 			debug("adding server %s", namestr);
 			num = getaddresses(lookup, namestr, &lresult);
@@ -2456,7 +2460,8 @@ setup_lookup(dig_lookup_t *lookup) {
 			lookup->udpsize = DEFAULT_EDNS_BUFSIZE;
 		}
 		if (lookup->edns < 0) {
-			lookup->edns = DEFAULT_EDNS_VERSION;
+			lookup->original_edns = lookup->edns =
+				DEFAULT_EDNS_VERSION;
 		}

 		if (lookup->nsid) {
@@ -4300,6 +4305,11 @@ recv_done(isc_nmhandle_t *handle, isc_result_t eresult, isc_region_t *region,
 	if (msg->rcode == dns_rcode_badvers && msg->opt != NULL &&
 	    (newedns = ednsvers(msg->opt)) < l->edns && l->ednsneg)
 	{
+		if (l->showbadvers) {
+			dighost_printmessage(query, &b, msg, true);
+			dighost_received(isc_buffer_usedlength(&b), &peer,
+					 query);
+		}
 		/*
 		 * Add minimum EDNS version required checks here if needed.
 		 */
@@ -117,9 +117,9 @@ struct dig_lookup {
 		section_answer, section_authority, section_question,
 		seenbadcookie, sendcookie, servfail_stops,
 		setqid, /*% use a speciied query ID */
-		showbadcookie, stats, tcflag, tcp_keepalive, tcp_mode,
-		tcp_mode_set, tls_mode, /*% connect using TLS */
-		trace,			/*% dig +trace */
+		showbadcookie, showbadvers, stats, tcflag, tcp_keepalive,
+		tcp_mode, tcp_mode_set, tls_mode, /*% connect using TLS */
+		trace,				  /*% dig +trace */
 		trace_root, /*% initial query for either +trace or +nssearch */
 		ttlunits, use_usec, waiting_connect, zflag;
 	char textname[MXNAME]; /*% Name we're going to be looking up */
@@ -148,6 +148,7 @@ struct dig_lookup {
 	int nsfound;
 	int16_t udpsize;
 	int16_t edns;
+	int16_t original_edns;
 	int16_t padding;
 	uint32_t ixfr_serial;
 	isc_buffer_t rdatabuf;
@@ -246,8 +246,7 @@ printsection(dns_message_t *msg, dns_section_t sectionid,
 			       (list_type == dns_rdatatype_any ||
 				rdataset->type == list_type)) ||
 			      (list_addresses &&
-			       (rdataset->type == dns_rdatatype_a ||
-				rdataset->type == dns_rdatatype_aaaa ||
+			       (dns_rdatatype_isaddr(rdataset->type) ||
 				rdataset->type == dns_rdatatype_ns ||
 				rdataset->type == dns_rdatatype_ptr))))
 			{
@@ -20,7 +20,6 @@
 #include <isc/attributes.h>
 #include <isc/buffer.h>
 #include <isc/commandline.h>
-#include <isc/condition.h>
 #include <isc/lib.h>
 #include <isc/loop.h>
 #include <isc/netaddr.h>
@@ -41,6 +41,14 @@ dnssec_keygen_LDADD =		\
 	$(LDADD)		\
 	$(OPENSSL_LIBS)

+dnssec_ksr_CPPFLAGS=		\
+	$(AM_CPPFLAGS)		\
+	$(OPENSSL_CFLAGS)
+
+dnssec_ksr_LDADD =		\
+	$(LDADD)		\
+	$(OPENSSL_LIBS)
+
 dnssec_signzone_CPPFLAGS =	\
 	$(AM_CPPFLAGS)		\
 	$(OPENSSL_CFLAGS)
@@ -1075,7 +1075,7 @@ cleanup(void) {
 		if (print_mem_stats && verbose > 10) {
 			isc_mem_stats(mctx, stdout);
 		}
-		isc_mem_destroy(&mctx);
+		isc_mem_detach(&mctx);
 	}
 }

@@ -543,7 +543,7 @@ main(int argc, char **argv) {
 	if (verbose > 10) {
 		isc_mem_stats(mctx, stdout);
 	}
-	isc_mem_destroy(&mctx);
+	isc_mem_detach(&mctx);

 	fflush(stdout);
 	if (ferror(stdout)) {
@@ -456,7 +456,7 @@ main(int argc, char **argv) {
 	if (verbose > 10) {
 		isc_mem_stats(mctx, stdout);
 	}
-	isc_mem_destroy(&mctx);
+	isc_mem_detach(&mctx);

 	fflush(stdout);
 	if (ferror(stdout)) {
@@ -746,7 +746,7 @@ main(int argc, char **argv) {
 		isc_mem_stats(mctx, stdout);
 	}
 	isc_mem_free(mctx, label);
-	isc_mem_destroy(&mctx);
+	isc_mem_detach(&mctx);

 	if (freeit != NULL) {
 		free(freeit);
@@ -38,7 +38,7 @@
 #include <isc/attributes.h>
 #include <isc/buffer.h>
 #include <isc/commandline.h>
-#include <isc/fips.h>
+#include <isc/crypto.h>
 #include <isc/lib.h>
 #include <isc/log.h>
 #include <isc/mem.h>
@@ -58,11 +58,6 @@

 #include <dst/dst.h>

-#if OPENSSL_VERSION_NUMBER >= 0x30000000L
-#include <openssl/err.h>
-#include <openssl/provider.h>
-#endif
-
 #include "dnssectool.h"

 const char *program = "dnssec-keygen";
@@ -151,7 +146,7 @@ usage(void) {
 	fprintf(stderr, "    -l <file>: configuration file with dnssec-policy "
 			"statement\n");
 	fprintf(stderr, "    -a <algorithm>:\n");
-	if (!isc_fips_mode()) {
+	if (!isc_crypto_fips_mode()) {
 		fprintf(stderr, "        RSASHA1 | NSEC3RSASHA1 |\n");
 	}
 	fprintf(stderr, "        RSASHA256 | RSASHA512 |\n");
@@ -159,7 +154,7 @@ usage(void) {
 	fprintf(stderr, "        ED25519 | ED448\n");
 	fprintf(stderr, "    -3: use NSEC3-capable algorithm\n");
 	fprintf(stderr, "    -b <key size in bits>:\n");
-	if (!isc_fips_mode()) {
+	if (!isc_crypto_fips_mode()) {
 		fprintf(stderr, "        RSASHA1:\t[%d..%d]\n", min_rsa,
 			MAX_RSA);
 		fprintf(stderr, "        NSEC3RSASHA1:\t[%d..%d]\n", min_rsa,
@@ -288,7 +283,7 @@ keygen(keygen_ctx_t *ctx, isc_mem_t *mctx, int argc, char **argv) {
 			fatal("unsupported algorithm: %s", algstr);
 		}

-		if (isc_fips_mode()) {
+		if (isc_crypto_fips_mode()) {
 			/* verify only in FIPS mode */
 			switch (ctx->alg) {
 			case DST_ALG_RSASHA1:
@@ -341,7 +336,7 @@ keygen(keygen_ctx_t *ctx, isc_mem_t *mctx, int argc, char **argv) {
 			switch (ctx->alg) {
 			case DST_ALG_RSASHA1:
 			case DST_ALG_NSEC3RSASHA1:
-				if (isc_fips_mode()) {
+				if (isc_crypto_fips_mode()) {
 					fatal("key size not specified (-b "
 					      "option)");
 				}
@@ -501,7 +496,7 @@ keygen(keygen_ctx_t *ctx, isc_mem_t *mctx, int argc, char **argv) {
 	switch (ctx->alg) {
 	case DNS_KEYALG_RSASHA1:
 	case DNS_KEYALG_NSEC3RSASHA1:
-		if (isc_fips_mode()) {
+		if (isc_crypto_fips_mode()) {
 			fatal("SHA1 based keys not supported in FIPS mode");
 		}
 		FALLTHROUGH;
@@ -847,10 +842,6 @@ main(int argc, char **argv) {
 	isc_textregion_t r;
 	unsigned char c;
 	int ch;
-	bool set_fips_mode = false;
-#if OPENSSL_VERSION_NUMBER >= 0x30000000L
-	OSSL_PROVIDER *fips = NULL, *base = NULL;
-#endif

 	keygen_ctx_t ctx = {
 		.options = DST_TYPE_PRIVATE | DST_TYPE_PUBLIC,
@@ -1109,7 +1100,9 @@ main(int argc, char **argv) {
 			ctx.prepub = strtottl(isc_commandline_argument);
 			break;
 		case 'F':
-			set_fips_mode = true;
+			if (isc_crypto_fips_enable() != ISC_R_SUCCESS) {
+				fatal("setting FIPS mode failed");
+			}
 			break;
 		case '?':
 			if (isc_commandline_option != '?') {
@@ -1136,32 +1129,11 @@ main(int argc, char **argv) {
 		ctx.quiet = true;
 	}

-	if (set_fips_mode) {
-#if OPENSSL_VERSION_NUMBER >= 0x30000000L
-		fips = OSSL_PROVIDER_load(NULL, "fips");
-		if (fips == NULL) {
-			ERR_clear_error();
-			fatal("Failed to load FIPS provider");
-		}
-		base = OSSL_PROVIDER_load(NULL, "base");
-		if (base == NULL) {
-			OSSL_PROVIDER_unload(fips);
-			ERR_clear_error();
-			fatal("Failed to load base provider");
-		}
-#endif
-		if (!isc_fips_mode()) {
-			if (isc_fips_set_mode(1) != ISC_R_SUCCESS) {
-				fatal("setting FIPS mode failed");
-			}
-		}
-	}
-
 	/*
 	 * The DST subsystem will set FIPS mode if requested at build time.
 	 * The minimum sizes are both raised to 2048.
 	 */
-	if (isc_fips_mode()) {
+	if (isc_crypto_fips_mode()) {
 		min_rsa = min_dh = 2048;
 	}

@@ -1308,16 +1280,8 @@ main(int argc, char **argv) {
 	if (verbose > 10) {
 		isc_mem_stats(mctx, stdout);
 	}
-	isc_mem_destroy(&mctx);
+	isc_mem_detach(&mctx);

-#if OPENSSL_VERSION_NUMBER >= 0x30000000L
-	if (base != NULL) {
-		OSSL_PROVIDER_unload(base);
-	}
-	if (fips != NULL) {
-		OSSL_PROVIDER_unload(fips);
-	}
-#endif
 	if (freeit != NULL) {
 		free(freeit);
 	}
@@ -18,7 +18,7 @@

 #include <isc/buffer.h>
 #include <isc/commandline.h>
-#include <isc/fips.h>
+#include <isc/crypto.h>
 #include <isc/lex.h>
 #include <isc/lib.h>
 #include <isc/mem.h>
@@ -362,7 +362,7 @@ create_key(ksr_ctx_t *ksr, dns_kasp_t *kasp, dns_kasp_key_t *kaspkey,
 	switch (ksr->alg) {
 	case DST_ALG_RSASHA1:
 	case DST_ALG_NSEC3RSASHA1:
-		if (isc_fips_mode()) {
+		if (isc_crypto_fips_mode()) {
 			/* verify-only in FIPS mode */
 			fatal("unsupported algorithm: %s", algstr);
 		}
@@ -1348,10 +1348,6 @@ main(int argc, char *argv[]) {
 	isc_buffer_t buf;
 	int ch;
 	char *endp;
-	bool set_fips_mode = false;
-#if OPENSSL_VERSION_NUMBER >= 0x30000000L
-	OSSL_PROVIDER *fips = NULL, *base = NULL;
-#endif
 	ksr_ctx_t ksr = {
 		.now = isc_stdtime_now(),
 	};
@@ -1371,7 +1367,9 @@ main(int argc, char *argv[]) {
 					    ksr.now, &ksr.setend);
 			break;
 		case 'F':
-			set_fips_mode = true;
+			if (isc_crypto_fips_enable() != ISC_R_SUCCESS) {
+				fatal("setting FIPS mode failed");
+			}
 			break;
 		case 'f':
 			ksr.file = isc_commandline_argument;
@@ -1425,31 +1423,12 @@ main(int argc, char *argv[]) {
 	 * The DST subsystem will set FIPS mode if requested at build time.
 	 * The minimum sizes are both raised to 2048.
 	 */
-	if (isc_fips_mode()) {
+	if (isc_crypto_fips_mode()) {
 		min_rsa = min_dh = 2048;
 	}

 	setup_logging();

-	if (set_fips_mode) {
-#if OPENSSL_VERSION_NUMBER >= 0x30000000L
-		fips = OSSL_PROVIDER_load(NULL, "fips");
-		if (fips == NULL) {
-			fatal("Failed to load FIPS provider");
-		}
-		base = OSSL_PROVIDER_load(NULL, "base");
-		if (base == NULL) {
-			OSSL_PROVIDER_unload(fips);
-			fatal("Failed to load base provider");
-		}
-#endif
-		if (!isc_fips_mode()) {
-			if (isc_fips_set_mode(1) != ISC_R_SUCCESS) {
-				fatal("setting FIPS mode failed");
-			}
-		}
-	}
-
 	/* zone */
 	namestr = argv[1];
 	name = dns_fixedname_initname(&fname);
@@ -248,7 +248,7 @@ cleanup:
 	if (dir != NULL) {
 		isc_mem_free(mctx, dir);
 	}
-	isc_mem_destroy(&mctx);
+	isc_mem_detach(&mctx);

 	return 0;
 }
@@ -949,7 +949,7 @@ main(int argc, char **argv) {
 		isc_mem_stats(mctx, stdout);
 	}
 	isc_mem_free(mctx, directory);
-	isc_mem_destroy(&mctx);
+	isc_mem_detach(&mctx);

 	return 0;
 }
@@ -42,7 +42,6 @@
 #include <isc/commandline.h>
 #include <isc/dir.h>
 #include <isc/file.h>
-#include <isc/fips.h>
 #include <isc/hash.h>
 #include <isc/hex.h>
 #include <isc/lib.h>
@@ -90,10 +89,6 @@
 #include <dns/zoneverify.h>

 #include <dst/dst.h>
-#if OPENSSL_VERSION_NUMBER >= 0x30000000L
-#include <openssl/err.h>
-#include <openssl/provider.h>
-#endif

 #include "dnssectool.h"

@@ -3380,10 +3375,6 @@ main(int argc, char *argv[]) {
 	bool set_optout = false;
 	bool set_iter = false;
 	bool nonsecify = false;
-	bool set_fips_mode = false;
-#if OPENSSL_VERSION_NUMBER >= 0x30000000L
-	OSSL_PROVIDER *fips = NULL, *base = NULL;
-#endif

 	atomic_init(&shuttingdown, false);
 	atomic_init(&finished, false);
@@ -3672,7 +3663,9 @@ main(int argc, char *argv[]) {
 			break;

 		case 'F':
-			set_fips_mode = true;
+			if (isc_crypto_fips_enable() != ISC_R_SUCCESS) {
+				fatal("setting FIPS mode failed");
+			}
 			break;

 		case '?':
@@ -3743,27 +3736,6 @@ main(int argc, char *argv[]) {

 	isc_managers_create(&mctx, nloops, &loopmgr, &netmgr);

-	if (set_fips_mode) {
-#if OPENSSL_VERSION_NUMBER >= 0x30000000L
-		fips = OSSL_PROVIDER_load(NULL, "fips");
-		if (fips == NULL) {
-			ERR_clear_error();
-			fatal("Failed to load FIPS provider");
-		}
-		base = OSSL_PROVIDER_load(NULL, "base");
-		if (base == NULL) {
-			OSSL_PROVIDER_unload(fips);
-			ERR_clear_error();
-			fatal("Failed to load base provider");
-		}
-#endif
-		if (!isc_fips_mode()) {
-			if (isc_fips_set_mode(1) != ISC_R_SUCCESS) {
-				fatal("setting FIPS mode failed");
-			}
-		}
-	}
-
 	setup_logging();

 	argc -= isc_commandline_index;
@@ -4135,15 +4107,6 @@ main(int argc, char *argv[]) {
 		isc_mem_stats(mctx, stdout);
 	}

-#if OPENSSL_VERSION_NUMBER >= 0x30000000L
-	if (base != NULL) {
-		OSSL_PROVIDER_unload(base);
-	}
-	if (fips != NULL) {
-		OSSL_PROVIDER_unload(fips);
-	}
-#endif
-
 	isc_managers_destroy(&mctx, &loopmgr, &netmgr);

 	if (printstats) {
@@ -330,7 +330,7 @@ main(int argc, char *argv[]) {
 	if (verbose > 10) {
 		isc_mem_stats(mctx, stdout);
 	}
-	isc_mem_destroy(&mctx);
+	isc_mem_detach(&mctx);

 	return result == ISC_R_SUCCESS ? 0 : 1;
 }
@@ -736,7 +736,6 @@ controlkeylist_fromcfg(const cfg_obj_t *keylist, isc_mem_t *mctx,
 		key->secret.length = 0;
 		ISC_LINK_INIT(key, link);
 		ISC_LIST_APPEND(*keyids, key, link);
-		newstr = NULL;
 	}
 }

@@ -25,7 +25,6 @@
 #include <string.h>
 #include <unistd.h>

-#include <isc/condition.h>
 #include <isc/log.h>
 #include <isc/loop.h>
 #include <isc/mutex.h>
@@ -86,7 +86,6 @@ EXTERN named_server_t *named_g_server INIT(NULL);
 /*
 * Logging.
 */
-EXTERN bool named_g_logging	       INIT(false);
 EXTERN unsigned int named_g_debuglevel INIT(0);

 /*
@@ -52,8 +52,6 @@ named_log_init(bool safe) {
 	named_log_setdefaultsslkeylogfile(lcfg);
 	rcu_read_unlock();

-	named_g_logging = true;
-
 	return ISC_R_SUCCESS;

 cleanup:
@@ -30,7 +30,6 @@
 #include <isc/crypto.h>
 #include <isc/dir.h>
 #include <isc/file.h>
-#include <isc/fips.h>
 #include <isc/hash.h>
 #include <isc/httpd.h>
 #include <isc/lib.h>
@@ -91,10 +90,6 @@
 #include <openssl/crypto.h>
 #include <openssl/evp.h>
 #include <openssl/opensslv.h>
-#if OPENSSL_VERSION_NUMBER >= 0x30000000L
-#include <openssl/err.h>
-#include <openssl/provider.h>
-#endif
 #ifdef HAVE_LIBXML2
 #include <libxml/parser.h>
 #include <libxml/xmlversion.h>
@@ -134,6 +129,7 @@ static int maxudp = 0;
 /*
 * -T options:
 */
+static bool cookiealwaysvalid = false;
 static bool dropedns = false;
 static bool ednsformerr = false;
 static bool ednsnotimp = false;
@@ -155,24 +151,13 @@ static bool transferstuck = false;
 static bool disable6 = false;
 static bool disable4 = false;

-#if OPENSSL_VERSION_NUMBER >= 0x30000000L
-static OSSL_PROVIDER *fips = NULL, *base = NULL;
-#endif
-
 void
 named_main_earlywarning(const char *format, ...) {
 	va_list args;

 	va_start(args, format);
-	if (named_g_logging) {
-		isc_log_vwrite(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-			       ISC_LOG_WARNING, format, args);
-	} else {
-		fprintf(stderr, "%s: ", program_name);
-		vfprintf(stderr, format, args);
-		fprintf(stderr, "\n");
-		fflush(stderr);
-	}
+	isc_log_vwrite(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
+		       ISC_LOG_WARNING, format, args);
 	va_end(args);
 }

@@ -181,18 +166,10 @@ named_main_earlyfatal(const char *format, ...) {
 	va_list args;

 	va_start(args, format);
-	if (named_g_logging) {
-		isc_log_vwrite(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-			       ISC_LOG_CRITICAL, format, args);
-		isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-			      ISC_LOG_CRITICAL,
-			      "exiting (due to early fatal error)");
-	} else {
-		fprintf(stderr, "%s: ", program_name);
-		vfprintf(stderr, format, args);
-		fprintf(stderr, "\n");
-		fflush(stderr);
-	}
+	isc_log_vwrite(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
+		       ISC_LOG_CRITICAL, format, args);
+	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
+		      ISC_LOG_CRITICAL, "exiting (due to early fatal error)");
 	va_end(args);

 	_exit(EXIT_FAILURE);
@@ -209,26 +186,19 @@ assertion_failed(const char *file, int line, isc_assertiontype_t type,
 	 * Handle assertion failures.
 	 */

-	if (named_g_logging) {
-		/*
-		 * Reset the assertion callback in case it is the log
-		 * routines causing the assertion.
-		 */
-		isc_assertion_setcallback(NULL);
+	/*
+	 * Reset the assertion callback in case it is the log
+	 * routines causing the assertion.
+	 */
+	isc_assertion_setcallback(NULL);

-		isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-			      ISC_LOG_CRITICAL, "%s:%d: %s(%s) failed", file,
-			      line, isc_assertion_typetotext(type), cond);
-		isc_backtrace_log(NAMED_LOGCATEGORY_GENERAL,
-				  NAMED_LOGMODULE_MAIN, ISC_LOG_CRITICAL);
-		isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-			      ISC_LOG_CRITICAL,
-			      "exiting (due to assertion failure)");
-	} else {
-		fprintf(stderr, "%s:%d: %s(%s) failed\n", file, line,
-			isc_assertion_typetotext(type), cond);
-		fflush(stderr);
-	}
+	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
+		      ISC_LOG_CRITICAL, "%s:%d: %s(%s) failed", file, line,
+		      isc_assertion_typetotext(type), cond);
+	isc_backtrace_log(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
+			  ISC_LOG_CRITICAL);
+	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
+		      ISC_LOG_CRITICAL, "exiting (due to assertion failure)");

 	if (named_g_coreok) {
 		abort();
@@ -247,27 +217,20 @@ library_fatal_error(const char *file, int line, const char *func,
 	 * Handle isc_error_fatal() calls from our libraries.
 	 */

-	if (named_g_logging) {
-		/*
-		 * Reset the error callback in case it is the log
-		 * routines causing the assertion.
-		 */
-		isc_error_setfatal(NULL);
+	/*
+	 * Reset the error callback in case it is the log
+	 * routines causing the assertion.
+	 */
+	isc_error_setfatal(NULL);

-		isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-			      ISC_LOG_CRITICAL,
-			      "%s:%d:%s(): fatal error: ", file, line, func);
-		isc_log_vwrite(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-			       ISC_LOG_CRITICAL, format, args);
-		isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-			      ISC_LOG_CRITICAL,
-			      "exiting (due to fatal error in library)");
-	} else {
-		fprintf(stderr, "%s:%d:%s(): fatal error: ", file, line, func);
-		vfprintf(stderr, format, args);
-		fprintf(stderr, "\n");
-		fflush(stderr);
-	}
+	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
+		      ISC_LOG_CRITICAL, "%s:%d:%s(): fatal error: ", file, line,
+		      func);
+	isc_log_vwrite(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
+		       ISC_LOG_CRITICAL, format, args);
+	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
+		      ISC_LOG_CRITICAL,
+		      "exiting (due to fatal error in library)");

 	if (named_g_coreok) {
 		abort();
@@ -287,19 +250,11 @@ library_unexpected_error(const char *file, int line, const char *func,
 	 * Handle isc_error_unexpected() calls from our libraries.
 	 */

-	if (named_g_logging) {
-		isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-			      ISC_LOG_ERROR,
-			      "%s:%d:%s(): unexpected error: ", file, line,
-			      func);
-		isc_log_vwrite(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-			       ISC_LOG_ERROR, format, args);
-	} else {
-		fprintf(stderr, "%s:%d:%s(): fatal error: ", file, line, func);
-		vfprintf(stderr, format, args);
-		fprintf(stderr, "\n");
-		fflush(stderr);
-	}
+	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
+		      ISC_LOG_ERROR, "%s:%d:%s(): unexpected error: ", file,
+		      line, func);
+	isc_log_vwrite(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
+		       ISC_LOG_ERROR, format, args);
 }

 static void
@@ -698,7 +653,9 @@ parse_T_opt(char *option) {
 	 * force the server to behave (or misbehave) in
 	 * specified ways for testing purposes.
 	 */
-	if (!strcmp(option, "dropedns")) {
+	if (!strcmp(option, "cookiealwaysvalid")) {
+		cookiealwaysvalid = true;
+	} else if (!strcmp(option, "dropedns")) {
 		dropedns = true;
 	} else if (!strcmp(option, "ednsformerr")) {
 		ednsformerr = true;
@@ -952,25 +909,7 @@ parse_command_line(int argc, char *argv[]) {
 			named_main_earlyfatal("option '-X' has been removed");
 			break;
 		case 'F':
-#if OPENSSL_VERSION_NUMBER >= 0x30000000L
-			fips = OSSL_PROVIDER_load(NULL, "fips");
-			if (fips == NULL) {
-				ERR_clear_error();
-				named_main_earlyfatal(
-					"Failed to load FIPS provider");
-			}
-			base = OSSL_PROVIDER_load(NULL, "base");
-			if (base == NULL) {
-				OSSL_PROVIDER_unload(fips);
-				ERR_clear_error();
-				named_main_earlyfatal(
-					"Failed to load base provider");
-			}
-#endif
-			if (isc_fips_mode()) { /* Already in FIPS mode. */
-				break;
-			}
-			if (isc_fips_set_mode(1) != ISC_R_SUCCESS) {
+			if (isc_crypto_fips_enable() != ISC_R_SUCCESS) {
 				named_main_earlyfatal(
 					"setting FIPS mode failed");
 			}
@@ -1284,6 +1223,9 @@ setup(void) {
 	/*
 	 * Modify server context according to command line options
 	 */
+	if (cookiealwaysvalid) {
+		ns_server_setoption(sctx, NS_SERVER_COOKIEALWAYSVALID, true);
+	}
 	if (disable4) {
 		ns_server_setoption(sctx, NS_SERVER_DISABLE4, true);
 	}
@@ -1574,15 +1516,6 @@ main(int argc, char *argv[]) {

 	named_os_shutdown();

-#if OPENSSL_VERSION_NUMBER >= 0x30000000L
-	if (base != NULL) {
-		OSSL_PROVIDER_unload(base);
-	}
-	if (fips != NULL) {
-		OSSL_PROVIDER_unload(fips);
-	}
-#endif
-
 #ifdef HAVE_GPERFTOOLS_PROFILER
 	ProfilerStop();
 #endif /* ifdef HAVE_GPERFTOOLS_PROFILER */
@@ -38,7 +38,6 @@
 #include <isc/commandline.h>
 #include <isc/dir.h>
 #include <isc/file.h>
-#include <isc/fips.h>
 #include <isc/hash.h>
 #include <isc/hex.h>
 #include <isc/hmac.h>
@@ -3763,7 +3762,7 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist, cfg_obj_t *config,
 	uint32_t maxbits;
 	unsigned int resopts = 0;
 	dns_zone_t *zone = NULL;
-	uint32_t max_clients_per_query;
+	uint32_t clients_per_query, max_clients_per_query;
 	bool empty_zones_enable;
 	const cfg_obj_t *disablelist = NULL;
 	isc_stats_t *resstats = NULL;
@@ -5169,15 +5168,26 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist, cfg_obj_t *config,
 	INSIST(result == ISC_R_SUCCESS);
 	view->v6bias = cfg_obj_asuint32(obj) * 1000;

+	obj = NULL;
+	result = named_config_get(maps, "clients-per-query", &obj);
+	INSIST(result == ISC_R_SUCCESS);
+	clients_per_query = cfg_obj_asuint32(obj);
+
 	obj = NULL;
 	result = named_config_get(maps, "max-clients-per-query", &obj);
 	INSIST(result == ISC_R_SUCCESS);
 	max_clients_per_query = cfg_obj_asuint32(obj);

-	obj = NULL;
-	result = named_config_get(maps, "clients-per-query", &obj);
-	INSIST(result == ISC_R_SUCCESS);
-	dns_resolver_setclientsperquery(view->resolver, cfg_obj_asuint32(obj),
+	if (max_clients_per_query < clients_per_query) {
+		cfg_obj_log(obj, ISC_LOG_WARNING,
+			    "configured clients-per-query (%u) exceeds "
+			    "max-clients-per-query (%u); automatically "
+			    "adjusting max-clients-per-query to (%u)",
+			    clients_per_query, max_clients_per_query,
+			    clients_per_query);
+		max_clients_per_query = clients_per_query;
+	}
+	dns_resolver_setclientsperquery(view->resolver, clients_per_query,
 					max_clients_per_query);

 	/*
@@ -9377,7 +9387,7 @@ view_loaded(void *arg) {

 		isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_SERVER,
 			      ISC_LOG_NOTICE, "FIPS mode is %s",
-			      isc_fips_mode() ? "enabled" : "disabled");
+			      isc_crypto_fips_mode() ? "enabled" : "disabled");

 #if HAVE_LIBSYSTEMD
 		sd_notifyf(0,
@@ -1603,7 +1603,7 @@ xfrin_xmlrender(dns_zone_t *zone, void *arg) {
 		isc_sockaddr_format(addrp, addr_buf, sizeof(addr_buf));
 		TRY0(xmlTextWriterWriteString(writer, ISC_XMLCHAR addr_buf));
 	} else if (is_presoa) {
-		addr = dns_zone_getsourceaddr(zone);
+		dns_zone_getsourceaddr(zone, &addr);
 		isc_sockaddr_format(&addr, addr_buf, sizeof(addr_buf));
 		TRY0(xmlTextWriterWriteString(writer, ISC_XMLCHAR addr_buf));
 	} else {
@@ -1617,9 +1617,13 @@ xfrin_xmlrender(dns_zone_t *zone, void *arg) {
 		isc_sockaddr_format(addrp, addr_buf, sizeof(addr_buf));
 		TRY0(xmlTextWriterWriteString(writer, ISC_XMLCHAR addr_buf));
 	} else if (is_presoa) {
-		addr = dns_zone_getprimaryaddr(zone);
-		isc_sockaddr_format(&addr, addr_buf, sizeof(addr_buf));
-		TRY0(xmlTextWriterWriteString(writer, ISC_XMLCHAR addr_buf));
+		if (dns_zone_getprimaryaddr(zone, &addr) == ISC_R_SUCCESS) {
+			isc_sockaddr_format(&addr, addr_buf, sizeof(addr_buf));
+			TRY0(xmlTextWriterWriteString(writer,
+						      ISC_XMLCHAR addr_buf));
+		} else {
+			TRY0(xmlTextWriterWriteString(writer, ISC_XMLCHAR "-"));
+		}
 	} else {
 		TRY0(xmlTextWriterWriteString(writer, ISC_XMLCHAR "-"));
 	}
@@ -2656,7 +2660,7 @@ xfrin_jsonrender(dns_zone_t *zone, void *arg) {
 		json_object_object_add(xfrinobj, "localaddr",
 				       json_object_new_string(addr_buf));
 	} else if (is_presoa) {
-		addr = dns_zone_getsourceaddr(zone);
+		dns_zone_getsourceaddr(zone, &addr);
 		isc_sockaddr_format(&addr, addr_buf, sizeof(addr_buf));
 		json_object_object_add(xfrinobj, "localaddr",
 				       json_object_new_string(addr_buf));
@@ -2671,10 +2675,15 @@ xfrin_jsonrender(dns_zone_t *zone, void *arg) {
 		json_object_object_add(xfrinobj, "remoteaddr",
 				       json_object_new_string(addr_buf));
 	} else if (is_presoa) {
-		addr = dns_zone_getprimaryaddr(zone);
-		isc_sockaddr_format(&addr, addr_buf, sizeof(addr_buf));
-		json_object_object_add(xfrinobj, "remoteaddr",
-				       json_object_new_string(addr_buf));
+		if (dns_zone_getprimaryaddr(zone, &addr) == ISC_R_SUCCESS) {
+			isc_sockaddr_format(&addr, addr_buf, sizeof(addr_buf));
+			json_object_object_add(
+				xfrinobj, "remoteaddr",
+				json_object_new_string(addr_buf));
+		} else {
+			json_object_object_add(xfrinobj, "remoteaddr",
+					       json_object_new_string("-"));
+		}
 	} else {
 		json_object_object_add(xfrinobj, "remoteaddr",
 				       json_object_new_string("-"));
@@ -1279,22 +1279,22 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 		obj = NULL;
 		result = named_config_get(maps, "parental-source", &obj);
 		INSIST(result == ISC_R_SUCCESS && obj != NULL);
-		CHECK(dns_zone_setparentalsrc4(zone, cfg_obj_assockaddr(obj)));
+		dns_zone_setparentalsrc4(zone, cfg_obj_assockaddr(obj));

 		obj = NULL;
 		result = named_config_get(maps, "parental-source-v6", &obj);
 		INSIST(result == ISC_R_SUCCESS && obj != NULL);
-		CHECK(dns_zone_setparentalsrc6(zone, cfg_obj_assockaddr(obj)));
+		dns_zone_setparentalsrc6(zone, cfg_obj_assockaddr(obj));

 		obj = NULL;
 		result = named_config_get(maps, "notify-source", &obj);
 		INSIST(result == ISC_R_SUCCESS && obj != NULL);
-		CHECK(dns_zone_setnotifysrc4(zone, cfg_obj_assockaddr(obj)));
+		dns_zone_setnotifysrc4(zone, cfg_obj_assockaddr(obj));

 		obj = NULL;
 		result = named_config_get(maps, "notify-source-v6", &obj);
 		INSIST(result == ISC_R_SUCCESS && obj != NULL);
-		CHECK(dns_zone_setnotifysrc6(zone, cfg_obj_assockaddr(obj)));
+		dns_zone_setnotifysrc6(zone, cfg_obj_assockaddr(obj));

 		obj = NULL;
 		result = named_config_get(maps, "notify-to-soa", &obj);
@@ -1938,14 +1938,12 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 		obj = NULL;
 		result = named_config_get(maps, "transfer-source", &obj);
 		INSIST(result == ISC_R_SUCCESS && obj != NULL);
-		CHECK(dns_zone_setxfrsource4(mayberaw,
-					     cfg_obj_assockaddr(obj)));
+		dns_zone_setxfrsource4(mayberaw, cfg_obj_assockaddr(obj));

 		obj = NULL;
 		result = named_config_get(maps, "transfer-source-v6", &obj);
 		INSIST(result == ISC_R_SUCCESS && obj != NULL);
-		CHECK(dns_zone_setxfrsource6(mayberaw,
-					     cfg_obj_assockaddr(obj)));
+		dns_zone_setxfrsource6(mayberaw, cfg_obj_assockaddr(obj));

 		obj = NULL;
 		(void)named_config_get(maps, "try-tcp-refresh", &obj);
@@ -28,6 +28,7 @@ options {
 	} except-from {
 		"example";
 	};
+	qname-minimization disabled;  // Regression test for GL #4652
 };

 trust-anchors { };
@@ -308,6 +308,7 @@ def logger(request, system_test_name):
@pytest.fixture(scope="module")
 def expected_artifacts(request):
    common_artifacts = [
+        "*/.hypothesis",  # drop after Ubuntu 20.04 Focal Fossa gets removed from CI
        ".libs/*",  # possible build artifacts, see GL #5055
        "ns*/named.conf",
        "ns*/named.memstats",
@@ -361,6 +361,23 @@ grep "status: NOERROR," dig.out.test$n >/dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status + ret))

+n=$((n + 1))
+echo_i "Restart NS4 with -T cookiealwaysvalid ($n)"
+stop_server ns4
+touch ns4/named.cookiealwaysvalid
+start_server --noclean --restart --port ${PORT} ns4 || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status + ret))
+
+n=$((n + 1))
+echo_i "test NS6 cookie on NS4 with -T cookiealwaysvalid (expect success) ($n)"
+ret=0
+$DIG $DIGOPTS +cookie=$ns6cookie -b 10.53.0.4 +nobadcookie soa . @10.53.0.4 >dig.out.test$n || ret=1
+grep "; COOKIE:.*(good)" dig.out.test$n >/dev/null || ret=1
+grep "status: NOERROR," dig.out.test$n >/dev/null || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status + ret))
+
 n=$((n + 1))
 echo_i "check that test server is correctly configured ($n)"
 ret=0
@@ -552,16 +569,21 @@ sys.exit(1)'; then
  $DIG $DIGOPTS @10.53.0.1 tsig. >dig.out.test$n.1 || ret=1
  grep "status: NOERROR" dig.out.test$n.1 >/dev/null || ret=1
  rndc_dumpdb ns1
+  # prime cache with NS response for QNAME minimisation
  grep "$pat" ns1/named_dump.db.test$n >/dev/null || ret=1
+  $DIG $DIGOPTS @10.53.0.1 NS nocookie.tsig >dig.out.test$n.2 || ret=1
+  grep "status: NOERROR" dig.out.test$n.2 >/dev/null || ret=1
  # check the disabled server response
  nextpart ns1/named.run >/dev/null
-  $DIG $DIGOPTS @10.53.0.1 nocookie.tsig >dig.out.test$n.2 || ret=1
-  grep "status: NOERROR" dig.out.test$n.2 >/dev/null || ret=1
-  grep 'A.10\.53\.0\.9' dig.out.test$n.2 >/dev/null || ret=1
-  grep 'A.10\.53\.0\.10' dig.out.test$n.2 >/dev/null || ret=1
+  $DIG $DIGOPTS @10.53.0.1 nocookie.tsig >dig.out.test$n.3 || ret=1
+  grep "status: NOERROR" dig.out.test$n.3 >/dev/null || ret=1
+  grep 'A.10\.53\.0\.9' dig.out.test$n.3 >/dev/null || ret=1
+  grep 'A.10\.53\.0\.10' dig.out.test$n.3 >/dev/null || ret=1
  nextpart ns1/named.run >named.run.test$n
  count=$(grep -c ') [0-9][0-9]* NOERROR 0' named.run.test$n)
  test $count -eq 2 || ret=1
+  count=$(grep -c '^; COOKIE: ................................' named.run.test$n)
+  test $count -eq 1 || ret=1
  if [ $ret != 0 ]; then echo_i "failed"; fi
  status=$((status + ret))
 fi
@@ -19,6 +19,7 @@ pytestmark = pytest.mark.extra_artifacts(
        "ans*/ans.run",
        "ans*/query.log",
        "ns1/named_dump.db*",
+        "ns4/named.cookiealwaysvalid",
    ]
 )

@@ -1135,6 +1135,16 @@ if [ -x "$DIG" ]; then
  grep "; EDNS: version: 0, flags:; udp: 1232" dig.out.test$n >/dev/null || ret=1
  if [ $ret -ne 0 ]; then echo_i "failed"; fi
  status=$((status + ret))
+
+  n=$((n + 1))
+  echo_i "check that dig +showbadvers works ($n)"
+  dig_with_opts @10.53.0.3 +edns=1 +qr +showbadvers a.example >dig.out.test$n 2>&1 || ret=1
+  grep "; EDNS: version: 1, flags:; udp: 1232" dig.out.test$n >/dev/null || ret=1
+  grep "; EDNS: version: 0, flags:; udp: 1232" dig.out.test$n >/dev/null || ret=1
+  grep -F "status: BADVERS" dig.out.test$n >/dev/null || ret=1
+  grep -F "status: NOERROR" dig.out.test$n >/dev/null || ret=1
+  if [ $ret -ne 0 ]; then echo_i "failed"; fi
+  status=$((status + ret))
 else
  echo_i "$DIG is needed, so skipping these dig tests"
 fi
@@ -64,7 +64,7 @@ for subdomain in digest-alg-unsupported ds-unsupported secure badds \
  kskonly update-nsec3 auto-nsec auto-nsec3 secure.below-cname \
  ttlpatch split-dnssec split-smart expired expiring upper lower \
  dnskey-unknown dnskey-unsupported dnskey-unsupported-2 \
-  dnskey-nsec3-unknown managed-future revkey \
+  dnskey-nsec3-unknown managed-future future revkey \
  dname-at-apex-nsec3 occluded rsasha1 rsasha1-1024; do
  cp "../ns3/dsset-$subdomain.example." .
 done
@@ -0,0 +1,6 @@
+; This is a key-signing key, keyid 23640, for .
+; Created: 20250310185208 (Mon Mar 10 18:52:08 2025)
+; Publish: 20250310185208 (Mon Mar 10 18:52:08 2025)
+; Activate: 20250310185208 (Mon Mar 10 18:52:08 2025)
+; Revoke: 20250310185208 (Mon Mar 10 18:52:08 2025)
+. IN DNSKEY 257 3 13 uKwpRtMH+9iuUk/Xj6LciIP5ZckaBtXaUqxUxzJYexXjvxGZGX4470Jv hq2NCI3HBZQNaCCP/h9sluhIzRGPTA==
@@ -0,0 +1,7 @@
+Private-key-format: v1.3
+Algorithm: 13 (ECDSAP256SHA256)
+PrivateKey: m5udfGNSijISQ8Tfp4kx09O1em4PErLUw/mCj3SKmqw=
+Created: 20250310185208
+Publish: 20250310185208
+Activate: 20250310185208
+Revoke: 20250310185208
@@ -0,0 +1,5 @@
+; This is a zone-signing key, keyid 23768, for .
+; Created: 20250310185208 (Mon Mar 10 18:52:08 2025)
+; Publish: 20250310185208 (Mon Mar 10 18:52:08 2025)
+; Activate: 20250310185208 (Mon Mar 10 18:52:08 2025)
+. IN DNSKEY 256 3 13 TFelYtTRBWeA9A307vvuWIcaNwW4txW4RgSELtsi46ZQs24ncRxmxtFf uJuPyVXePNiE4HNI9CIowGUsn5WuBw==
@@ -0,0 +1,37 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+;	This is a zone which has two DNSKEY records, both of which have
+; existing private key files available.  They should be loaded automatically
+; and the zone correctly signed.
+;
+$TTL 30	; 30 seconds
+.			IN SOA	a.root.servers.nil. each.isc.org. (
+				2000042101 ; serial
+				600        ; refresh (10 minutes)
+				600        ; retry (10 minutes)
+				1200       ; expire (20 minutes)
+				600        ; minimum (10 minutes)
+				)
+			NS	a.root-servers.nil.
+			DNSKEY	256 3 13 (
+				TFelYtTRBWeA9A307vvuWIcaNwW4txW4RgSELtsi46ZQ
+				s24ncRxmxtFfuJuPyVXePNiE4HNI9CIowGUsn5WuBw==
+				) ; ZSK; alg = ECDSAP256SHA256 ; key id = 23768
+			DNSKEY	257 3 13 (
+				OSmhpULEDCUzHCBeDU5uJXzkCcGuW2qrkQznKRPGhRZN
+				j7ZUIGInGzM5Um5m02ULWt8tKbi55NJUeifKWegQ0g==
+				) ; KSK; alg = ECDSAP256SHA256 ; key id = 22255
+			DNSKEY	385 3 13 (
+				uKwpRtMH+9iuUk/Xj6LciIP5ZckaBtXaUqxUxzJYexXj
+				vxGZGX4470Jvhq2NCI3HBZQNaCCP/h9sluhIzRGPTA==
+				) ; revoked KSK; alg = ECDSAP256SHA256 ; key id = 23768
+a.root-servers.nil.	A	10.53.0.1
@@ -1564,6 +1564,18 @@ n=$((n + 1))
 test "$ret" -eq 0 || echo_i "failed"
 status=$((status + ret))

+echo_ic "revoked KSK ID collides with ZSK ($n)"
+ret=0
+# signing should fail, but should not coredump
+(
+  cd signer/general || exit 0
+  rm -f signed.zone
+  $SIGNER -S -f signed.zone -o . test12.zone >signer.out.$n
+) && ret=1
+n=$((n + 1))
+test "$ret" -eq 0 || echo_i "failed"
+status=$((status + ret))
+
 echo_ic "check that dnssec-signzone rejects excessive NSEC3 iterations ($n)"
 ret=0
 (
@@ -2179,7 +2191,7 @@ echo_i "checking RRSIG query from cache ($n)"
 ret=0
 dig_with_opts normalthenrrsig.secure.example. @10.53.0.4 a >/dev/null || ret=1
 ans=$(dig_with_opts +short normalthenrrsig.secure.example. @10.53.0.4 rrsig) || ret=1
-expect=$(dig_with_opts +short normalthenrrsig.secure.example. @10.53.0.3 rrsig | grep '^A') || ret=1
+expect=$(dig_with_opts +short normalthenrrsig.secure.example. @10.53.0.3 rrsig | grep '^\(A\|NSEC\)') || ret=1
 test "$ans" = "$expect" || ret=1
 # also check that RA is set
 dig_with_opts normalthenrrsig.secure.example. @10.53.0.4 rrsig >dig.out.ns4.test$n || ret=1
@@ -2859,6 +2871,19 @@ dig_with_opts +noauth expired.example. +dnssec @10.53.0.4 soa >dig.out.ns4.test$
 grep "SERVFAIL" dig.out.ns4.test$n >/dev/null || ret=1
 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n >/dev/null && ret=1
 grep "expired.example/.*: RRSIG has expired" ns4/named.run >/dev/null || ret=1
+grep "; EDE: 7 (Signature Expired): (expired.example/DNSKEY)" dig.out.ns4.test$n >/dev/null || ret=1
+n=$((n + 1))
+test "$ret" -eq 0 || echo_i "failed"
+status=$((status + ret))
+
+status=$((status + ret))
+echo_i "checking signatures in the future do not validate ($n)"
+ret=0
+dig_with_opts +noauth future.example. +dnssec @10.53.0.4 soa >dig.out.ns4.test$n || ret=1
+grep "SERVFAIL" dig.out.ns4.test$n >/dev/null || ret=1
+grep "flags:.*ad.*QUERY" dig.out.ns4.test$n >/dev/null && ret=1
+grep "future.example/.*: RRSIG validity period has not begun" ns4/named.run >/dev/null || ret=1
+grep "; EDE: 8 (Signature Not Yet Valid): (future.example/DNSKEY)" dig.out.ns4.test$n >/dev/null || ret=1
 n=$((n + 1))
 test "$ret" -eq 0 || echo_i "failed"
 status=$((status + ret))
@@ -3755,7 +3780,7 @@ status=$((status + ret))
 echo_i "checking EDE code 1 for bad alg mnemonic ($n)"
 ret=0
 dig_with_opts @10.53.0.4 badalg.secure.example >dig.out.ns4.test$n || ret=1
-grep "; EDE: 1 (Unsupported DNSKEY Algorithm): (ECDSAP256SHA256 badalg.secure.example/A)" dig.out.ns4.test$n >/dev/null || ret=1
+grep "; EDE: 1 (Unsupported DNSKEY Algorithm): (ECDSAP256SHA256 badalg.secure.example/NSEC)" dig.out.ns4.test$n >/dev/null || ret=1
 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n >/dev/null && ret=1
 n=$((n + 1))
 test "$ret" -eq 0 || echo_i "failed"
@@ -232,9 +232,7 @@ addrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
 	dns_fixedname_init(&name);
 	CHECK(dns__db_addrdataset(sampledb->db, node, version, now, rdataset,
 				  options, addedrdataset DNS__DB_FLARG_PASS));
-	if (rdataset->type == dns_rdatatype_a ||
-	    rdataset->type == dns_rdatatype_aaaa)
-	{
+	if (dns_rdatatype_isaddr(rdataset->type)) {
 		CHECK(dns_db_nodefullname(sampledb->db, node,
 					  dns_fixedname_name(&name)));
 		CHECK(syncptrs(sampledb->inst, dns_fixedname_name(&name),
@@ -263,9 +261,7 @@ subtractrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
 		goto cleanup;
 	}

-	if (rdataset->type == dns_rdatatype_a ||
-	    rdataset->type == dns_rdatatype_aaaa)
-	{
+	if (dns_rdatatype_isaddr(rdataset->type)) {
 		CHECK(dns_db_nodefullname(sampledb->db, node,
 					  dns_fixedname_name(&name)));
 		CHECK(syncptrs(sampledb->inst, dns_fixedname_name(&name),
@@ -23,7 +23,7 @@
 #include <openssl/provider.h>
 #endif

-#include <isc/fips.h>
+#include <isc/crypto.h>
 #include <isc/lib.h>
 #include <isc/md.h>
 #include <isc/mem.h>
@@ -134,7 +134,7 @@ main(int argc, char **argv) {
 		return 1;
 #endif
 #else
-		if (isc_fips_mode()) {
+		if (isc_crypto_fips_mode()) {
 #if OPENSSL_VERSION_NUMBER >= 0x30000000L
 			return 0;
 #else
@@ -149,7 +149,7 @@ main(int argc, char **argv) {
 #if defined(ENABLE_FIPS_MODE)
 		return 0;
 #else
-		return isc_fips_mode() ? 0 : 1;
+		return isc_crypto_fips_mode() ? 0 : 1;
 #endif
 	}

@@ -0,0 +1,52 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+options {
+	query-source address 10.53.0.5;
+	notify-source 10.53.0.5;
+	transfer-source 10.53.0.5;
+	port @PORT@;
+	directory ".";
+	pid-file "named.pid";
+	listen-on { 10.53.0.5; };
+	listen-on-v6 { none; };
+	recursion yes;
+	dnssec-validation yes;
+	notify yes;
+	stale-answer-enable yes;
+	stale-cache-enable yes;
+	stale-answer-client-timeout 0;
+	/* max-clients-per-query < clients-per-query */
+	clients-per-query 10;
+	max-clients-per-query 5;
+};
+
+trust-anchors { };
+
+server 10.53.0.4 {
+	edns no;
+};
+
+key rndc_key {
+	secret "1234abcd8765";
+	algorithm @DEFAULT_HMAC@;
+};
+
+controls {
+	inet 10.53.0.5 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
+};
+
+zone "." {
+	type hint;
+	file "root.hint";
+};
@@ -328,5 +328,14 @@ echo_i "$zspill clients spilled (expected $expected)"
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status + ret))

+n=$((n + 1))
+echo_i "checking a warning is logged if max-clients-per-query < clients-per-query ($n)"
+ret=0
+copy_setports ns5/named3.conf.in ns5/named.conf
+rndc_reconfig ns5 10.53.0.5
+wait_for_message ns5/named.run "configured clients-per-query (10) exceeds max-clients-per-query (5); automatically adjusting max-clients-per-query to (10)" || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status + ret))
+
 echo_i "exit status: $status"
 [ $status -eq 0 ] || exit 1
@@ -224,6 +224,20 @@ class DnsProtocol(enum.Enum):
    TCP = enum.auto()


+@dataclass(frozen=True)
+class Peer:
+    """
+    Pretty-printed connection endpoint.
+    """
+
+    host: str
+    port: int
+
+    def __str__(self) -> str:
+        host = f"[{self.host}]" if ":" in self.host else self.host
+        return f"{host}:{self.port}"
+
+
@dataclass
 class QueryContext:
    """
@@ -232,7 +246,7 @@ class QueryContext:

    query: dns.message.Message
    response: dns.message.Message
-    peer: Tuple[str, int]
+    peer: Peer
    protocol: DnsProtocol
    zone: Optional[dns.zone.Zone] = None
    soa: Optional[dns.rrset.RRset] = None
@@ -346,10 +360,13 @@ class ResponseHandler(abc.ABC):
    method.
    """

-    @abc.abstractmethod
+    # pylint: disable=unused-argument
    def match(self, qctx: QueryContext) -> bool:
        """
-        Matching logic - query is handled when it returns True.
+        Matching logic - the first handler whose `match()` method returns True
+        is used for handling the query.
+
+        The default for each handler is to handle all queries.
        """
        return True

@@ -366,6 +383,17 @@ class ResponseHandler(abc.ABC):
        yield DnsResponseSend(qctx.response)


+class IgnoreAllQueries(ResponseHandler):
+    """
+    Do not respond to any queries sent to the server.
+    """
+
+    async def get_responses(
+        self, qctx: QueryContext
+    ) -> AsyncGenerator[ResponseAction, None]:
+        yield ResponseDrop()
+
+
 class DomainHandler(ResponseHandler):
    """
    Base class used for deriving custom domain handlers.
@@ -513,56 +541,110 @@ class AsyncDnsServer(AsyncServer):
            self._zone_tree.add(zone)

    async def _handle_udp(
-        self, wire: bytes, peer: Tuple[str, int], transport: asyncio.DatagramTransport
+        self, wire: bytes, addr: Tuple[str, int], transport: asyncio.DatagramTransport
    ) -> None:
        logging.debug("Received UDP message: %s", wire.hex())
+        peer = Peer(addr[0], addr[1])
        responses = self._handle_query(wire, peer, DnsProtocol.UDP)
        async for response in responses:
-            transport.sendto(response, peer)
+            transport.sendto(response, addr)

    async def _handle_tcp(
        self, reader: asyncio.StreamReader, writer: asyncio.StreamWriter
    ) -> None:
-        wire_length_bytes = await reader.read(2)
-        (wire_length,) = struct.unpack("!H", wire_length_bytes)
-        logging.debug("Receiving TCP message (%d octets)...", wire_length)
+        peer_info = writer.get_extra_info("peername")
+        peer = Peer(peer_info[0], peer_info[1])
+        logging.debug("Accepted TCP connection from %s", peer)

-        wire = await reader.read(wire_length)
-        full_message = wire_length_bytes + wire
-        logging.debug("Received complete TCP message: %s", full_message.hex())
-
-        peer = writer.get_extra_info("peername")
-        responses = self._handle_query(wire, peer, DnsProtocol.TCP)
-        async for response in responses:
-            writer.write(response)
+        while True:
            try:
-                await writer.drain()
+                wire = await self._read_tcp_query(reader, peer)
+                if not wire:
+                    break
+                await self._send_tcp_response(writer, peer, wire)
            except ConnectionResetError:
-                logging.error(
-                    "TCP connection from %s reset by peer", self._format_peer(peer)
-                )
+                logging.error("TCP connection from %s reset by peer", peer)
                return

+        logging.debug("Closing TCP connection from %s", peer)
        writer.close()
        await writer.wait_closed()

-    def _format_peer(self, peer: Tuple[str, int]) -> str:
-        host = peer[0]
-        port = peer[1]
-        if "::" in host:
-            host = f"[{host}]"
-        return f"{host}:{port}"
+    async def _read_tcp_query(
+        self, reader: asyncio.StreamReader, peer: Peer
+    ) -> Optional[bytes]:
+        wire_length = await self._read_tcp_query_wire_length(reader, peer)
+        if not wire_length:
+            return None

-    def _log_query(
-        self, qctx: QueryContext, peer: Tuple[str, int], protocol: DnsProtocol
+        return await self._read_tcp_query_wire(reader, peer, wire_length)
+
+    async def _read_tcp_query_wire_length(
+        self, reader: asyncio.StreamReader, peer: Peer
+    ) -> Optional[int]:
+        logging.debug("Receiving TCP message length from %s...", peer)
+
+        wire_length_bytes = await self._read_tcp_octets(reader, peer, 2)
+        if not wire_length_bytes:
+            return None
+
+        (wire_length,) = struct.unpack("!H", wire_length_bytes)
+
+        return wire_length
+
+    async def _read_tcp_query_wire(
+        self, reader: asyncio.StreamReader, peer: Peer, wire_length: int
+    ) -> Optional[bytes]:
+        logging.debug("Receiving TCP message (%d octets) from %s...", wire_length, peer)
+
+        wire = await self._read_tcp_octets(reader, peer, wire_length)
+        if not wire:
+            return None
+
+        logging.debug("Received complete TCP message from %s: %s", peer, wire.hex())
+
+        return wire
+
+    async def _read_tcp_octets(
+        self, reader: asyncio.StreamReader, peer: Peer, expected: int
+    ) -> Optional[bytes]:
+        buffer = b""
+
+        while len(buffer) < expected:
+            chunk = await reader.read(expected - len(buffer))
+            if not chunk:
+                if buffer:
+                    logging.debug(
+                        "Received short TCP message (%d octets) from %s: %s",
+                        len(buffer),
+                        peer,
+                        buffer.hex(),
+                    )
+                else:
+                    logging.debug("Received disconnect from %s", peer)
+                return None
+
+            logging.debug("Received %d TCP octets from %s", len(chunk), peer)
+            buffer += chunk
+
+        return buffer
+
+    async def _send_tcp_response(
+        self, writer: asyncio.StreamWriter, peer: Peer, wire: bytes
    ) -> None:
+        responses = self._handle_query(wire, peer, DnsProtocol.TCP)
+        async for response in responses:
+            writer.write(response)
+            await writer.drain()
+
+    def _log_query(self, qctx: QueryContext, peer: Peer, protocol: DnsProtocol) -> None:
        logging.info(
            "Received %s/%s/%s (ID=%d) query from %s (%s)",
            qctx.qname.to_text(omit_final_dot=True),
            dns.rdataclass.to_text(qctx.qclass),
            dns.rdatatype.to_text(qctx.qtype),
            qctx.query.id,
-            self._format_peer(peer),
+            peer,
            protocol.name,
        )
        logging.debug(
@@ -573,14 +655,14 @@ class AsyncDnsServer(AsyncServer):
        self,
        qctx: QueryContext,
        response: Optional[Union[dns.message.Message, bytes]],
-        peer: Tuple[str, int],
+        peer: Peer,
        protocol: DnsProtocol,
    ) -> None:
        if not response:
            logging.info(
                "Not sending a response to query (ID=%d) from %s (%s)",
                qctx.query.id,
-                self._format_peer(peer),
+                peer,
                protocol.name,
            )
            return
@@ -606,7 +688,7 @@ class AsyncDnsServer(AsyncServer):
                len(response.authority),
                len(response.additional),
                qctx.query.id,
-                self._format_peer(peer),
+                peer,
                protocol.name,
            )
            logging.debug(
@@ -618,13 +700,13 @@ class AsyncDnsServer(AsyncServer):
            "Sending response (%d bytes) to a query (ID=%d) from %s (%s)",
            len(response),
            qctx.query.id,
-            self._format_peer(peer),
+            peer,
            protocol.name,
        )
        logging.debug("[OUT] %s", response.hex())

    async def _handle_query(
-        self, wire: bytes, peer: Tuple[str, int], protocol: DnsProtocol
+        self, wire: bytes, peer: Peer, protocol: DnsProtocol
    ) -> AsyncGenerator[bytes, None]:
        """
        Yield wire data to send as a response over the established transport.
@@ -597,6 +597,10 @@ def test_ksr_common(servers):
            selected += 1
        if "Generating" in output:
            generated += 1
+        # Subtract if there was a key collision.
+        if "collide" in output:
+            generated -= 1
+
    assert selected == 2
    assert generated == 2
    for index, key in enumerate(overlapping_zsks):
@@ -111,7 +111,7 @@ cleanup:
 	}

 	if (mctx != NULL) {
-		isc_mem_destroy(&mctx);
+		isc_mem_detach(&mctx);
 	}

 	return result != ISC_R_SUCCESS ? 1 : 0;
@@ -385,7 +385,7 @@ $DIG $DIGOPTS @10.53.0.3 foo.initially-unavailable. A >dig.out.ns3.test$n.1 2>&1
 grep "NOERROR" dig.out.ns3.test$n.1 >/dev/null || ret=1
 grep "flags:.* ad" dig.out.ns3.test$n.1 >/dev/null || ret=1
 # Sanity check: the authoritative server should have been queried.
-nextpart ns2/named.run | grep "query 'foo.initially-unavailable/A/IN'" >/dev/null || ret=1
+nextpart ns2/named.run | grep "query 'foo.initially-unavailable/NS/IN'" >/dev/null || ret=1
 # Reconfigure ns2 so that the zone can be mirrored on ns3.
 sed '/^zone "initially-unavailable" {$/,/^};$/ {
 	s/10.53.0.254/10.53.0.3/
@@ -403,7 +403,7 @@ $DIG $DIGOPTS @10.53.0.3 foo.initially-unavailable. A >dig.out.ns3.test$n.2 2>&1
 grep "NOERROR" dig.out.ns3.test$n.2 >/dev/null || ret=1
 grep "flags:.* ad" dig.out.ns3.test$n.2 >/dev/null || ret=1
 # Ensure the authoritative server was not queried.
-nextpart ns2/named.run | grep "query 'foo.initially-unavailable/A/IN'" >/dev/null && ret=1
+nextpart ns2/named.run | grep "query 'foo.initially-unavailable/NS/IN'" >/dev/null && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status + ret))

@@ -434,7 +434,7 @@ $DIG $DIGOPTS @10.53.0.3 foo.initially-unavailable. A >dig.out.ns3.test$n 2>&1 |
 grep "NOERROR" dig.out.ns3.test$n >/dev/null || ret=1
 grep "flags:.* ad" dig.out.ns3.test$n >/dev/null || ret=1
 # Sanity check: the authoritative server should have been queried.
-nextpart ns2/named.run | grep "query 'foo.initially-unavailable/A/IN'" >/dev/null || ret=1
+nextpart ns2/named.run | grep "query 'foo.initially-unavailable/NS/IN'" >/dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status + ret))

@@ -0,0 +1,17 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+@		30	SOA	ns2.good. hostmaster.arpa. 2018050100 1 1 1 1
+@		30	NS	ns2.good.
+
+8.2.6.0		60	NS	ns3.good.
+
+1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.8.f.4.0 1 PTR nee.com.
@@ -1,456 +1,111 @@
-# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-#
-# SPDX-License-Identifier: MPL-2.0
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0.  If a copy of the MPL was not distributed with this
-# file, you can obtain one at https://mozilla.org/MPL/2.0/.
-#
-# See the COPYRIGHT file distributed with this work for additional
-# information regarding copyright ownership.
+"""
+Copyright (C) Internet Systems Consortium, Inc. ("ISC")

-from __future__ import print_function
-import os
-import sys
-import signal
-import socket
-import select
-from datetime import datetime, timedelta
-import time
-import functools
+SPDX-License-Identifier: MPL-2.0

-import dns, dns.message, dns.query, dns.flags
-from dns.rdatatype import *
-from dns.rdataclass import *
-from dns.rcode import *
-from dns.name import *
+This Source Code Form is subject to the terms of the Mozilla Public
+License, v. 2.0.  If a copy of the MPL was not distributed with this
+file, you can obtain one at https://mozilla.org/MPL/2.0/.
+
+See the COPYRIGHT file distributed with this work for additional
+information regarding copyright ownership.
+"""
+
+from typing import AsyncGenerator
+
+import dns.message
+import dns.name
+import dns.rcode
+import dns.rdataclass
+import dns.rdatatype
+
+from isctest.asyncserver import (
+    AsyncDnsServer,
+    DnsResponseSend,
+    DomainHandler,
+    QueryContext,
+    ResponseAction,
+)
+
+from qmin_ans import (
+    DelayedResponseHandler,
+    EntRcodeChanger,
+    QueryLogHandler,
+    log_query,
+)


-# Log query to file
-def logquery(type, qname):
-    with open("qlog", "a") as f:
-        f.write("%s %s\n", type, qname)
+class QueryLogger(QueryLogHandler):
+    domains = ["1.0.0.2.ip6.arpa.", "fwd.", "good."]


-def endswith(domain, labels):
-    return domain.endswith("." + labels) or domain == labels
+class BadHandler(EntRcodeChanger):
+    domains = ["bad."]
+    rcode = dns.rcode.NXDOMAIN


-############################################################################
-# Respond to a DNS query.
-# For good. it serves:
-# ns2.good. IN A 10.53.0.2
-# zoop.boing.good. NS ns3.good.
-# ns3.good. IN A 10.53.0.3
-# too.many.labels.a.b.c.d.e.f.g.h.i.j.k.l.m.n.o.p.q.r.s.t.u.v.w.x.y.z.good. A 192.0.2.2
-# it responds properly (with NODATA empty response) to non-empty terminals
-#
-# For slow. it works the same as for good., but each response is delayed by 400 milliseconds
-#
-# For bad. it works the same as for good., but returns NXDOMAIN to non-empty terminals
-#
-# For ugly. it works the same as for good., but returns garbage to non-empty terminals
-#
-# For 1.0.0.2.ip6.arpa it serves
-# 1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.8.f.4.0.1.0.0.2.ip6.arpa. IN PTR nee.com.
-# 8.2.6.0.1.0.0.2.ip6.arpa IN NS ns3.good
-# 1.0.0.2.ip6.arpa. IN NS ns2.good
-# ip6.arpa. IN NS ns2.good
-#
-# For stale. it serves:
-# a.b. NS ns.a.b.stale.
-# ns.a.b.stale. IN A 10.53.0.3
-# b. NS ns.b.stale.
-# ns.b.stale. IN A 10.53.0.4
-############################################################################
-def create_response(msg):
-    m = dns.message.from_wire(msg)
-    qname = m.question[0].name.to_text()
-    lqname = qname.lower()
-    labels = lqname.split(".")
-
-    # get qtype
-    rrtype = m.question[0].rdtype
-    typename = dns.rdatatype.to_text(rrtype)
-    if typename == "A" or typename == "AAAA":
-        typename = "ADDR"
-    bad = False
-    ugly = False
-    slow = False
-
-    # log this query
-    with open("query.log", "a") as f:
-        f.write("%s %s\n" % (typename, lqname))
-        print("%s %s" % (typename, lqname), end=" ")
-
-    r = dns.message.make_response(m)
-    r.set_rcode(NOERROR)
-
-    if endswith(lqname, "1.0.0.2.ip6.arpa."):
-        # Direct query - give direct answer
-        if endswith(lqname, "8.2.6.0.1.0.0.2.ip6.arpa."):
-            # Delegate to ns3
-            r.authority.append(
-                dns.rrset.from_text(
-                    "8.2.6.0.1.0.0.2.ip6.arpa.", 60, IN, NS, "ns3.good."
-                )
-            )
-            r.additional.append(
-                dns.rrset.from_text("ns3.good.", 60, IN, A, "10.53.0.3")
-            )
-        elif (
-            lqname
-            == "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.8.f.4.0.1.0.0.2.ip6.arpa."
-            and rrtype == PTR
-        ):
-            # Direct query - give direct answer
-            r.answer.append(
-                dns.rrset.from_text(
-                    "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.8.f.4.0.1.0.0.2.ip6.arpa.",
-                    1,
-                    IN,
-                    PTR,
-                    "nee.com.",
-                )
-            )
-            r.flags |= dns.flags.AA
-        elif lqname == "1.0.0.2.ip6.arpa." and rrtype == NS:
-            # NS query at the apex
-            r.answer.append(
-                dns.rrset.from_text("1.0.0.2.ip6.arpa.", 30, IN, NS, "ns2.good.")
-            )
-            r.flags |= dns.flags.AA
-        elif endswith(
-            "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.8.f.4.0.1.0.0.2.ip6.arpa.",
-            lqname,
-        ):
-            # NODATA answer
-            r.authority.append(
-                dns.rrset.from_text(
-                    "1.0.0.2.ip6.arpa.",
-                    30,
-                    IN,
-                    SOA,
-                    "ns2.good. hostmaster.arpa. 2018050100 1 1 1 1",
-                )
-            )
-        else:
-            # NXDOMAIN
-            r.authority.append(
-                dns.rrset.from_text(
-                    "1.0.0.2.ip6.arpa.",
-                    30,
-                    IN,
-                    SOA,
-                    "ns2.good. hostmaster.arpa. 2018050100 1 1 1 1",
-                )
-            )
-            r.set_rcode(NXDOMAIN)
-        return r
-    elif endswith(lqname, "ip6.arpa."):
-        if lqname == "ip6.arpa." and rrtype == NS:
-            # NS query at the apex
-            r.answer.append(dns.rrset.from_text("ip6.arpa.", 30, IN, NS, "ns2.good."))
-            r.flags |= dns.flags.AA
-        elif endswith("1.0.0.2.ip6.arpa.", lqname):
-            # NODATA answer
-            r.authority.append(
-                dns.rrset.from_text(
-                    "ip6.arpa.",
-                    30,
-                    IN,
-                    SOA,
-                    "ns2.good. hostmaster.arpa. 2018050100 1 1 1 1",
-                )
-            )
-        else:
-            # NXDOMAIN
-            r.authority.append(
-                dns.rrset.from_text(
-                    "ip6.arpa.",
-                    30,
-                    IN,
-                    SOA,
-                    "ns2.good. hostmaster.arpa. 2018050100 1 1 1 1",
-                )
-            )
-            r.set_rcode(NXDOMAIN)
-        return r
-    elif endswith(lqname, "stale."):
-        if endswith(lqname, "a.b.stale."):
-            # Delegate to ns.a.b.stale.
-            r.authority.append(
-                dns.rrset.from_text("a.b.stale.", 2, IN, NS, "ns.a.b.stale.")
-            )
-            r.additional.append(
-                dns.rrset.from_text("ns.a.b.stale.", 2, IN, A, "10.53.0.3")
-            )
-        elif endswith(lqname, "b.stale."):
-            # Delegate to ns.b.stale.
-            r.authority.append(
-                dns.rrset.from_text("b.stale.", 2, IN, NS, "ns.b.stale.")
-            )
-            r.additional.append(
-                dns.rrset.from_text("ns.b.stale.", 2, IN, A, "10.53.0.4")
-            )
-        elif lqname == "stale." and rrtype == NS:
-            # NS query at the apex.
-            r.answer.append(dns.rrset.from_text("stale.", 2, IN, NS, "ns2.stale."))
-            r.flags |= dns.flags.AA
-        elif lqname == "stale." and rrtype == SOA:
-            # SOA query at the apex.
-            r.answer.append(
-                dns.rrset.from_text(
-                    "stale.", 2, IN, SOA, "ns2.stale. hostmaster.stale. 1 2 3 4 5"
-                )
-            )
-            r.flags |= dns.flags.AA
-        elif lqname == "stale.":
-            # NODATA answer
-            r.authority.append(
-                dns.rrset.from_text(
-                    "stale.", 2, IN, SOA, "ns2.stale. hostmaster.arpa. 1 2 3 4 5"
-                )
-            )
-            r.flags |= dns.flags.AA
-        elif lqname == "ns2.stale.":
-            if rrtype == A:
-                r.additional.append(
-                    dns.rrset.from_text("ns.b.stale.", 2, IN, A, "10.53.0.2")
-                )
-            else:
-                r.authority.append(
-                    dns.rrset.from_text(
-                        "stale.", 2, IN, SOA, "ns2.stale. hostmaster.arpa. 1 2 3 4 5"
-                    )
-                )
-            r.flags |= dns.flags.AA
-        else:
-            # NXDOMAIN
-            r.authority.append(
-                dns.rrset.from_text(
-                    "stale.", 2, IN, SOA, "ns2.stale. hostmaster.arpa. 1 2 3 4 5"
-                )
-            )
-            r.set_rcode(NXDOMAIN)
-        return r
-    elif endswith(lqname, "bad."):
-        bad = True
-        suffix = "bad."
-        lqname = lqname[:-4]
-    elif endswith(lqname, "ugly."):
-        ugly = True
-        suffix = "ugly."
-        lqname = lqname[:-5]
-    elif endswith(lqname, "good."):
-        suffix = "good."
-        lqname = lqname[:-5]
-    elif endswith(lqname, "slow."):
-        slow = True
-        suffix = "slow."
-        lqname = lqname[:-5]
-    elif endswith(lqname, "fwd."):
-        suffix = "fwd."
-        lqname = lqname[:-4]
-    else:
-        r.set_rcode(REFUSED)
-        return r
-
-    # Good/bad/ugly differs only in how we treat non-empty terminals
-    if endswith(lqname, "zoop.boing."):
-        r.authority.append(
-            dns.rrset.from_text("zoop.boing." + suffix, 1, IN, NS, "ns3." + suffix)
-        )
-    elif (
-        lqname == "many.labels.a.b.c.d.e.f.g.h.i.j.k.l.m.n.o.p.q.r.s.t.u.v.w.x.y.z."
-        and rrtype == A
-    ):
-        r.answer.append(dns.rrset.from_text(lqname + suffix, 1, IN, A, "192.0.2.2"))
-        r.flags |= dns.flags.AA
-    elif lqname == "" and rrtype == NS:
-        r.answer.append(dns.rrset.from_text(suffix, 30, IN, NS, "ns2." + suffix))
-        r.flags |= dns.flags.AA
-    elif lqname == "ns2.":
-        r.flags |= dns.flags.AA
-        if rrtype == A:
-            r.answer.append(
-                dns.rrset.from_text("ns2." + suffix, 30, IN, A, "10.53.0.2")
-            )
-        elif rrtype == AAAA:
-            r.answer.append(
-                dns.rrset.from_text(
-                    "ns2." + suffix, 30, IN, AAAA, "fd92:7065:b8e:ffff::2"
-                )
-            )
-        else:
-            r.authority.append(
-                dns.rrset.from_text(
-                    suffix,
-                    30,
-                    IN,
-                    SOA,
-                    "ns2." + suffix + " hostmaster.arpa. 2018050100 1 1 1 1",
-                )
-            )
-    elif lqname == "ns3.":
-        r.flags |= dns.flags.AA
-        if rrtype == A:
-            r.answer.append(
-                dns.rrset.from_text("ns3." + suffix, 30, IN, A, "10.53.0.3")
-            )
-        elif lqname == "ns3." and rrtype == AAAA:
-            r.answer.append(
-                dns.rrset.from_text(
-                    "ns3." + suffix, 30, IN, AAAA, "fd92:7065:b8e:ffff::3"
-                )
-            )
-        else:
-            r.authority.append(
-                dns.rrset.from_text(
-                    suffix,
-                    30,
-                    IN,
-                    SOA,
-                    "ns2." + suffix + " hostmaster.arpa. 2018050100 1 1 1 1",
-                )
-            )
-    elif lqname == "ns4.":
-        r.flags |= dns.flags.AA
-        if rrtype == A:
-            r.answer.append(
-                dns.rrset.from_text("ns4." + suffix, 30, IN, A, "10.53.0.4")
-            )
-        elif rrtype == AAAA:
-            r.answer.append(
-                dns.rrset.from_text(
-                    "ns4." + suffix, 30, IN, AAAA, "fd92:7065:b8e:ffff::4"
-                )
-            )
-        else:
-            r.authority.append(
-                dns.rrset.from_text(
-                    suffix,
-                    30,
-                    IN,
-                    SOA,
-                    "ns2." + suffix + " hostmaster.arpa. 2018050100 1 1 1 1",
-                )
-            )
-    elif lqname == "a.bit.longer.ns.name." and rrtype == A:
-        r.answer.append(
-            dns.rrset.from_text("a.bit.longer.ns.name." + suffix, 1, IN, A, "10.53.0.4")
-        )
-        r.flags |= dns.flags.AA
-    elif lqname == "a.bit.longer.ns.name." and rrtype == AAAA:
-        r.answer.append(
-            dns.rrset.from_text(
-                "a.bit.longer.ns.name." + suffix, 1, IN, AAAA, "fd92:7065:b8e:ffff::4"
-            )
-        )
-        r.flags |= dns.flags.AA
-    else:
-        r.authority.append(
-            dns.rrset.from_text(
-                suffix,
-                1,
-                IN,
-                SOA,
-                "ns2." + suffix + " hostmaster.arpa. 2018050100 1 1 1 1",
-            )
-        )
-        if bad or not (
-            endswith("icky.icky.icky.ptang.zoop.boing.", lqname)
-            or endswith(
-                "many.labels.a.b.c.d.e.f.g.h.i.j.k.l.m.n.o.p.q.r.s.t.u.v.w.x.y.z.",
-                lqname,
-            )
-            or endswith("a.bit.longer.ns.name.", lqname)
-        ):
-            r.set_rcode(NXDOMAIN)
-        if ugly:
-            r.set_rcode(FORMERR)
-    if slow:
-        time.sleep(0.2)
-    return r
+class UglyHandler(EntRcodeChanger):
+    domains = ["ugly."]
+    rcode = dns.rcode.FORMERR


-def sigterm(signum, frame):
-    print("Shutting down now...")
-    os.remove("ans.pid")
-    running = False
-    sys.exit(0)
+class SlowHandler(DelayedResponseHandler):
+    domains = ["slow."]
+    delay = 0.2


-############################################################################
-# Main
-#
-# Set up responder and control channel, open the pid file, and start
-# the main loop, listening for queries on the query channel or commands
-# on the control channel and acting on them.
-############################################################################
-ip4 = "10.53.0.2"
-ip6 = "fd92:7065:b8e:ffff::2"
+def send_delegation(
+    qctx: QueryContext, zone_cut: dns.name.Name, target_addr: str
+) -> ResponseAction:
+    """
+    Delegate `zone_cut` to a single in-bailiwick name server, `ns.<zone_cut>`,
+    with a single IPv4 glue record (provided in `target_addr`) included in the
+    ADDITIONAL section.
+    """
+    ns_name = "ns." + zone_cut.to_text()
+    ns_rrset = dns.rrset.from_text(
+        zone_cut, 2, dns.rdataclass.IN, dns.rdatatype.NS, ns_name
+    )
+    a_rrset = dns.rrset.from_text(
+        ns_name, 2, dns.rdataclass.IN, dns.rdatatype.A, target_addr
+    )

-try:
-    port = int(os.environ["PORT"])
-except:
-    port = 5300
+    response = dns.message.make_response(qctx.query)
+    response.set_rcode(dns.rcode.NOERROR)
+    response.authority.append(ns_rrset)
+    response.additional.append(a_rrset)

-query4_socket = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
-query4_socket.bind((ip4, port))
+    return DnsResponseSend(response, authoritative=False)

-havev6 = True
-try:
-    query6_socket = socket.socket(socket.AF_INET6, socket.SOCK_DGRAM)
-    try:
-        query6_socket.bind((ip6, port))
-    except:
-        query6_socket.close()
-        havev6 = False
-except:
-    havev6 = False

-signal.signal(signal.SIGTERM, sigterm)
+class StaleHandler(DomainHandler):
+    """
+    `a.b.stale` is a subdomain of `b.stale` and these two subdomains need to be
+    delegated to different name servers.  Therefore, their delegations cannot
+    be placed in the zone file because the zone cut at `b.stale` would occlude
+    the one at `a.b.stale`.  Generate these delegations dynamically depending
+    on the QNAME.
+    """

-f = open("ans.pid", "w")
-pid = os.getpid()
-print(pid, file=f)
-f.close()
+    domains = ["stale."]

-running = True
+    async def get_responses(
+        self, qctx: QueryContext
+    ) -> AsyncGenerator[ResponseAction, None]:
+        log_query(qctx)
+        a_b_stale = dns.name.from_text("a.b.stale.")
+        b_stale = dns.name.from_text("b.stale.")
+        if qctx.qname.is_subdomain(a_b_stale):
+            yield send_delegation(qctx, a_b_stale, "10.53.0.3")
+        elif qctx.qname.is_subdomain(b_stale):
+            yield send_delegation(qctx, b_stale, "10.53.0.4")

-print("Listening on %s port %d" % (ip4, port))
-if havev6:
-    print("Listening on %s port %d" % (ip6, port))
-print("Ctrl-c to quit")

-if havev6:
-    input = [query4_socket, query6_socket]
-else:
-    input = [query4_socket]
-
-while running:
-    try:
-        inputready, outputready, exceptready = select.select(input, [], [])
-    except select.error as e:
-        break
-    except socket.error as e:
-        break
-    except KeyboardInterrupt:
-        break
-
-    for s in inputready:
-        if s == query4_socket or s == query6_socket:
-            print(
-                "Query received on %s" % (ip4 if s == query4_socket else ip6), end=" "
-            )
-            # Handle incoming queries
-            msg = s.recvfrom(65535)
-            rsp = create_response(msg[0])
-            if rsp:
-                print(dns.rcode.to_text(rsp.rcode()))
-                s.sendto(rsp.to_wire(), msg[1])
-            else:
-                print("NO RESPONSE")
-    if not running:
-        break
+if __name__ == "__main__":
+    server = AsyncDnsServer()
+    server.install_response_handler(QueryLogger())
+    server.install_response_handler(BadHandler())
+    server.install_response_handler(UglyHandler())
+    server.install_response_handler(SlowHandler())
+    server.install_response_handler(StaleHandler())
+    server.run()
@@ -0,0 +1 @@
+good.db
@@ -0,0 +1 @@
+good.db
@@ -0,0 +1,26 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+@			1	SOA	ns2 hostmaster.arpa. 2018050100 1 1 1 1
+
+@			30	NS	ns2
+ns2			30	A	10.53.0.2
+			30	AAAA	fd92:7065:b8e:ffff::2
+
+zoop.boing		30	NS	ns3
+ns3			30	A	10.53.0.3
+			30	AAAA	fd92:7065:b8e:ffff::3
+
+ns4			30	A	10.53.0.4
+			30	AAAA	fd92:7065:b8e:ffff::4
+
+a.bit.longer.ns.name	1	A	10.53.0.4
+			1	AAAA	fd92:7065:b8e:ffff::4
@@ -0,0 +1 @@
+good.db
@@ -0,0 +1,15 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+@	2	SOA	ns2 hostmaster.stale. 1 2 3 4 5
+@	2	NS	ns2
+ns2	2	A	10.53.0.2
+	2	AAAA	fd92:7065:b8e:ffff::2
@@ -0,0 +1 @@
+good.db
@@ -0,0 +1,15 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+@		30	SOA	ns3.good. hostmaster.arpa. 2018050100 1 1 1 1
+@		30	NS	ns3.good.
+
+1.1.1.1		60	NS	ns4.good.
@@ -0,0 +1,15 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+@	1	SOA	ns hostmaster.a.b.stale. 1 2 3 4 5
+@	1	NS	ns
+@	1	TXT	"peekaboo"
+ns	1	A	10.53.0.3
@@ -1,285 +1,46 @@
-# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-#
-# SPDX-License-Identifier: MPL-2.0
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0.  If a copy of the MPL was not distributed with this
-# file, you can obtain one at https://mozilla.org/MPL/2.0/.
-#
-# See the COPYRIGHT file distributed with this work for additional
-# information regarding copyright ownership.
+"""
+Copyright (C) Internet Systems Consortium, Inc. ("ISC")

-from __future__ import print_function
-import os
-import sys
-import signal
-import socket
-import select
-from datetime import datetime, timedelta
-import time
-import functools
+SPDX-License-Identifier: MPL-2.0

-import dns, dns.message, dns.query, dns.flags
-from dns.rdatatype import *
-from dns.rdataclass import *
-from dns.rcode import *
-from dns.name import *
+This Source Code Form is subject to the terms of the Mozilla Public
+License, v. 2.0.  If a copy of the MPL was not distributed with this
+file, you can obtain one at https://mozilla.org/MPL/2.0/.
+
+See the COPYRIGHT file distributed with this work for additional
+information regarding copyright ownership.
+"""
+
+import dns.rcode
+
+from isctest.asyncserver import AsyncDnsServer
+
+from qmin_ans import DelayedResponseHandler, EntRcodeChanger, QueryLogHandler


-# Log query to file
-def logquery(type, qname):
-    with open("qlog", "a") as f:
-        f.write("%s %s\n", type, qname)
+class QueryLogger(QueryLogHandler):
+    domains = ["8.2.6.0.1.0.0.2.ip6.arpa.", "a.b.stale.", "zoop.boing.good."]


-def endswith(domain, labels):
-    return domain.endswith("." + labels) or domain == labels
+class ZoopBoingBadHandler(EntRcodeChanger):
+    domains = ["zoop.boing.bad."]
+    rcode = dns.rcode.NXDOMAIN


-############################################################################
-# Respond to a DNS query.
-# For good. it serves:
-# zoop.boing.good. NS ns3.good.
-# icky.ptang.zoop.boing.good. NS a.bit.longer.ns.name.good.
-# it responds properly (with NODATA empty response) to non-empty terminals
-#
-# For slow. it works the same as for good., but each response is delayed by 400 milliseconds
-#
-# For bad. it works the same as for good., but returns NXDOMAIN to non-empty terminals
-#
-# For ugly. it works the same as for good., but returns garbage to non-empty terminals
-#
-# For stale. it serves:
-# a.b.stale. IN TXT peekaboo (resolver did not do qname minimization)
-############################################################################
-def create_response(msg):
-    m = dns.message.from_wire(msg)
-    qname = m.question[0].name.to_text()
-    lqname = qname.lower()
-    labels = lqname.split(".")
-    suffix = ""
-
-    # get qtype
-    rrtype = m.question[0].rdtype
-    typename = dns.rdatatype.to_text(rrtype)
-    if typename == "A" or typename == "AAAA":
-        typename = "ADDR"
-    bad = False
-    ugly = False
-    slow = False
-
-    # log this query
-    with open("query.log", "a") as f:
-        f.write("%s %s\n" % (typename, lqname))
-        print("%s %s" % (typename, lqname), end=" ")
-
-    r = dns.message.make_response(m)
-    r.set_rcode(NOERROR)
-
-    ip6req = False
-
-    if endswith(lqname, "bad."):
-        bad = True
-        suffix = "bad."
-        lqname = lqname[:-4]
-    elif endswith(lqname, "ugly."):
-        ugly = True
-        suffix = "ugly."
-        lqname = lqname[:-5]
-    elif endswith(lqname, "good."):
-        suffix = "good."
-        lqname = lqname[:-5]
-    elif endswith(lqname, "slow."):
-        slow = True
-        suffix = "slow."
-        lqname = lqname[:-5]
-    elif endswith(lqname, "8.2.6.0.1.0.0.2.ip6.arpa."):
-        ip6req = True
-    elif endswith(lqname, "a.b.stale."):
-        if lqname == "a.b.stale.":
-            r.flags |= dns.flags.AA
-            if rrtype == TXT:
-                # Direct query.
-                r.answer.append(dns.rrset.from_text(lqname, 1, IN, TXT, "peekaboo"))
-            elif rrtype == NS:
-                # NS a.b.
-                r.answer.append(dns.rrset.from_text(lqname, 1, IN, NS, "ns.a.b.stale."))
-                r.additional.append(
-                    dns.rrset.from_text("ns.a.b.stale.", 1, IN, A, "10.53.0.3")
-                )
-            elif rrtype == SOA:
-                # SOA a.b.
-                r.answer.append(
-                    dns.rrset.from_text(
-                        lqname, 1, IN, SOA, "a.b.stale. hostmaster.a.b.stale. 1 2 3 4 5"
-                    )
-                )
-            else:
-                # NODATA.
-                r.authority.append(
-                    dns.rrset.from_text(
-                        lqname, 1, IN, SOA, "a.b.stale. hostmaster.a.b.stale. 1 2 3 4 5"
-                    )
-                )
-        elif lqname == "ns.a.b.stale.":
-            r.flags |= dns.flags.AA
-            if rrtype == A:
-                r.answer.append(
-                    dns.rrset.from_text("ns.a.b.stale.", 1, IN, A, "10.53.0.3")
-                )
-            else:
-                r.authority.append(
-                    dns.rrset.from_text(
-                        lqname, 1, IN, SOA, "a.b.stale. hostmaster.a.b.stale. 1 2 3 4 5"
-                    )
-                )
-        else:
-            r.flags |= dns.flags.AA
-            r.authority.append(
-                dns.rrset.from_text(
-                    lqname, 1, IN, SOA, "a.b.stale. hostmaster.a.b.stale. 1 2 3 4 5"
-                )
-            )
-            r.set_rcode(NXDOMAIN)
-            # NXDOMAIN.
-        return r
-    else:
-        r.set_rcode(REFUSED)
-        return r
-
-    # Good/bad differs only in how we treat non-empty terminals
-    if lqname == "zoop.boing." and rrtype == NS:
-        r.answer.append(
-            dns.rrset.from_text(lqname + suffix, 1, IN, NS, "ns3." + suffix)
-        )
-        r.flags |= dns.flags.AA
-    elif endswith(lqname, "icky.ptang.zoop.boing."):
-        r.authority.append(
-            dns.rrset.from_text(
-                "icky.ptang.zoop.boing." + suffix,
-                1,
-                IN,
-                NS,
-                "a.bit.longer.ns.name." + suffix,
-            )
-        )
-    elif endswith("icky.ptang.zoop.boing.", lqname):
-        r.authority.append(
-            dns.rrset.from_text(
-                "zoop.boing." + suffix,
-                1,
-                IN,
-                SOA,
-                "ns3." + suffix + " hostmaster.arpa. 2018050100 1 1 1 1",
-            )
-        )
-        if bad:
-            r.set_rcode(NXDOMAIN)
-        if ugly:
-            r.set_rcode(FORMERR)
-    elif endswith(lqname, "zoop.boing."):
-        r.authority.append(
-            dns.rrset.from_text(
-                "zoop.boing." + suffix,
-                1,
-                IN,
-                SOA,
-                "ns3." + suffix + " hostmaster.arpa. 2018050100 1 1 1 1",
-            )
-        )
-        r.set_rcode(NXDOMAIN)
-    elif ip6req:
-        r.authority.append(
-            dns.rrset.from_text(
-                "1.1.1.1.8.2.6.0.1.0.0.2.ip6.arpa.", 60, IN, NS, "ns4.good."
-            )
-        )
-        r.additional.append(dns.rrset.from_text("ns4.good.", 60, IN, A, "10.53.0.4"))
-    else:
-        r.set_rcode(REFUSED)
-
-    if slow:
-        time.sleep(0.4)
-    return r
+class ZoopBoingUglyHandler(EntRcodeChanger):
+    domains = ["zoop.boing.ugly."]
+    rcode = dns.rcode.FORMERR


-def sigterm(signum, frame):
-    print("Shutting down now...")
-    os.remove("ans.pid")
-    running = False
-    sys.exit(0)
+class ZoopBoingSlowHandler(DelayedResponseHandler):
+    domains = ["zoop.boing.slow."]
+    delay = 0.4


-############################################################################
-# Main
-#
-# Set up responder and control channel, open the pid file, and start
-# the main loop, listening for queries on the query channel or commands
-# on the control channel and acting on them.
-############################################################################
-ip4 = "10.53.0.3"
-ip6 = "fd92:7065:b8e:ffff::3"
-
-try:
-    port = int(os.environ["PORT"])
-except:
-    port = 5300
-
-query4_socket = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
-query4_socket.bind((ip4, port))
-
-havev6 = True
-try:
-    query6_socket = socket.socket(socket.AF_INET6, socket.SOCK_DGRAM)
-    try:
-        query6_socket.bind((ip6, port))
-    except:
-        query6_socket.close()
-        havev6 = False
-except:
-    havev6 = False
-
-signal.signal(signal.SIGTERM, sigterm)
-
-f = open("ans.pid", "w")
-pid = os.getpid()
-print(pid, file=f)
-f.close()
-
-running = True
-
-print("Listening on %s port %d" % (ip4, port))
-if havev6:
-    print("Listening on %s port %d" % (ip6, port))
-print("Ctrl-c to quit")
-
-if havev6:
-    input = [query4_socket, query6_socket]
-else:
-    input = [query4_socket]
-
-while running:
-    try:
-        inputready, outputready, exceptready = select.select(input, [], [])
-    except select.error as e:
-        break
-    except socket.error as e:
-        break
-    except KeyboardInterrupt:
-        break
-
-    for s in inputready:
-        if s == query4_socket or s == query6_socket:
-            print(
-                "Query received on %s" % (ip4 if s == query4_socket else ip6), end=" "
-            )
-            # Handle incoming queries
-            msg = s.recvfrom(65535)
-            rsp = create_response(msg[0])
-            if rsp:
-                print(dns.rcode.to_text(rsp.rcode()))
-                s.sendto(rsp.to_wire(), msg[1])
-            else:
-                print("NO RESPONSE")
-    if not running:
-        break
+if __name__ == "__main__":
+    server = AsyncDnsServer()
+    server.install_response_handler(QueryLogger())
+    server.install_response_handler(ZoopBoingBadHandler())
+    server.install_response_handler(ZoopBoingUglyHandler())
+    server.install_response_handler(ZoopBoingSlowHandler())
+    server.run()
@@ -0,0 +1,14 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+@			1	SOA	ns3.bad. hostmaster.arpa. 2018050100 1 1 1 1
+@			1	NS	ns3.bad.
+icky.ptang		1	NS	a.bit.longer.ns.name.bad.
@@ -0,0 +1,14 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+@			1	SOA	ns3.good. hostmaster.arpa. 2018050100 1 1 1 1
+@			1	NS	ns3.good.
+icky.ptang		1	NS	a.bit.longer.ns.name.good.
@@ -0,0 +1,14 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+@			1	SOA	ns3.slow. hostmaster.arpa. 2018050100 1 1 1 1
+@			1	NS	ns3.slow.
+icky.ptang		1	NS	a.bit.longer.ns.name.slow.
@@ -0,0 +1,14 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+@			1	SOA	ns3.ugly. hostmaster.arpa. 2018050100 1 1 1 1
+@			1	NS	ns3.ugly.
+icky.ptang		1	NS	a.bit.longer.ns.name.ugly.
@@ -0,0 +1,15 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+@		30	SOA	ns4.good. hostmaster.arpa. 2018050100 1 1 1 1
+@		30	NS	ns4.good.
+
+test1.test2.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.9.0.9.4 1 TXT "long_ip6_name"
@@ -0,0 +1,15 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+@	1	SOA	ns hostmaster.a.b.stale. 1 2 3 4 5
+@	1	NS	ns
+ns	1	A	10.53.0.4
+@	1	TXT	"hooray"
@@ -1,344 +1,93 @@
-# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-#
-# SPDX-License-Identifier: MPL-2.0
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0.  If a copy of the MPL was not distributed with this
-# file, you can obtain one at https://mozilla.org/MPL/2.0/.
-#
-# See the COPYRIGHT file distributed with this work for additional
-# information regarding copyright ownership.
+"""
+Copyright (C) Internet Systems Consortium, Inc. ("ISC")

-from __future__ import print_function
-import os
-import sys
-import signal
-import socket
-import select
-from datetime import datetime, timedelta
-import time
-import functools
+SPDX-License-Identifier: MPL-2.0

-import dns, dns.message, dns.query, dns.flags
-from dns.rdatatype import *
-from dns.rdataclass import *
-from dns.rcode import *
-from dns.name import *
+This Source Code Form is subject to the terms of the Mozilla Public
+License, v. 2.0.  If a copy of the MPL was not distributed with this
+file, you can obtain one at https://mozilla.org/MPL/2.0/.
+
+See the COPYRIGHT file distributed with this work for additional
+information regarding copyright ownership.
+"""
+
+from typing import AsyncGenerator
+
+import dns.rcode
+
+from isctest.asyncserver import (
+    AsyncDnsServer,
+    DnsResponseSend,
+    DomainHandler,
+    QueryContext,
+    ResponseAction,
+)
+
+from qmin_ans import DelayedResponseHandler, EntRcodeChanger, QueryLogHandler, log_query


-# Log query to file
-def logquery(type, qname):
-    with open("qlog", "a") as f:
-        f.write("%s %s\n", type, qname)
+class QueryLogger(QueryLogHandler):
+    domains = [
+        "1.1.1.1.8.2.6.0.1.0.0.2.ip6.arpa.",
+        "icky.ptang.zoop.boing.good.",
+    ]


-def endswith(domain, labels):
-    return domain.endswith("." + labels) or domain == labels
+class StaleHandler(DomainHandler):
+    """
+    The test code relies on this server returning non-minimal (i.e. including
+    address records in the ADDITIONAL section) responses to NS queries for
+    `b.stale` and `a.b.stale`.  While this logic (returning non-minimal
+    responses to NS queries) could be implemented in AsyncDnsServer itself,
+    doing so breaks a lot of other checks in this system test.  Therefore, only
+    these two zones behave in this particular way, thanks to a custom response
+    handler implemented below.
+    """
+
+    domains = ["b.stale", "a.b.stale"]
+
+    async def get_responses(
+        self, qctx: QueryContext
+    ) -> AsyncGenerator[ResponseAction, None]:
+        log_query(qctx)
+
+        if qctx.qtype == dns.rdatatype.NS:
+            assert qctx.zone
+            assert qctx.response.answer[0]
+
+            for nameserver in qctx.response.answer[0]:
+                if not nameserver.target.is_subdomain(qctx.response.answer[0].name):
+                    continue
+                glue_a = qctx.zone.get_rrset(nameserver.target, dns.rdatatype.A)
+                if glue_a:
+                    qctx.response.additional.append(glue_a)
+                glue_aaaa = qctx.zone.get_rrset(nameserver.target, dns.rdatatype.AAAA)
+                if glue_aaaa:
+                    qctx.response.additional.append(glue_aaaa)
+
+        yield DnsResponseSend(qctx.response)


-############################################################################
-# Respond to a DNS query.
-# For good. it serves:
-# icky.ptang.zoop.boing.good. NS a.bit.longer.ns.name.
-# icky.icky.icky.ptang.zoop.boing.good. A 192.0.2.1
-# more.icky.icky.icky.ptang.zoop.boing.good. A 192.0.2.2
-# it responds properly (with NODATA empty response) to non-empty terminals
-#
-# For slow. it works the same as for good., but each response is delayed by 400 milliseconds
-#
-# For bad. it works the same as for good., but returns NXDOMAIN to non-empty terminals
-#
-# For ugly. it works the same as for good., but returns garbage to non-empty terminals
-#
-# For stale. it serves:
-# a.b.stale. IN TXT hooray (resolver did do qname minimization)
-############################################################################
-def create_response(msg):
-    m = dns.message.from_wire(msg)
-    qname = m.question[0].name.to_text()
-    lqname = qname.lower()
-    labels = lqname.split(".")
-    suffix = ""
-
-    # get qtype
-    rrtype = m.question[0].rdtype
-    typename = dns.rdatatype.to_text(rrtype)
-    if typename == "A" or typename == "AAAA":
-        typename = "ADDR"
-    bad = False
-    slow = False
-    ugly = False
-
-    # log this query
-    with open("query.log", "a") as f:
-        f.write("%s %s\n" % (typename, lqname))
-        print("%s %s" % (typename, lqname), end=" ")
-
-    r = dns.message.make_response(m)
-    r.set_rcode(NOERROR)
-
-    ip6req = False
-
-    if endswith(lqname, "bad."):
-        bad = True
-        suffix = "bad."
-        lqname = lqname[:-4]
-    elif endswith(lqname, "ugly."):
-        ugly = True
-        suffix = "ugly."
-        lqname = lqname[:-5]
-    elif endswith(lqname, "good."):
-        suffix = "good."
-        lqname = lqname[:-5]
-    elif endswith(lqname, "slow."):
-        slow = True
-        suffix = "slow."
-        lqname = lqname[:-5]
-    elif endswith(lqname, "1.1.1.1.8.2.6.0.1.0.0.2.ip6.arpa."):
-        ip6req = True
-    elif endswith(lqname, "b.stale."):
-        if lqname == "a.b.stale.":
-            r.flags |= dns.flags.AA
-            if rrtype == TXT:
-                # Direct query.
-                r.answer.append(dns.rrset.from_text(lqname, 1, IN, TXT, "hooray"))
-            elif rrtype == NS:
-                # NS a.b.
-                r.answer.append(dns.rrset.from_text(lqname, 1, IN, NS, "ns.a.b.stale."))
-                r.additional.append(
-                    dns.rrset.from_text("ns.a.b.stale.", 1, IN, A, "10.53.0.3")
-                )
-            elif rrtype == SOA:
-                # SOA a.b.
-                r.answer.append(
-                    dns.rrset.from_text(
-                        lqname, 1, IN, SOA, "a.b.stale. hostmaster.a.b.stale. 1 2 3 4 5"
-                    )
-                )
-            else:
-                # NODATA.
-                r.authority.append(
-                    dns.rrset.from_text(
-                        lqname, 1, IN, SOA, "a.b.stale. hostmaster.a.b.stale. 1 2 3 4 5"
-                    )
-                )
-        elif lqname == "ns.a.b.stale.":
-            r.flags |= dns.flags.AA
-            if rrtype == A:
-                r.answer.append(
-                    dns.rrset.from_text("ns.a.b.stale.", 1, IN, A, "10.53.0.3")
-                )
-            else:
-                # NODATA.
-                r.authority.append(
-                    dns.rrset.from_text(
-                        lqname, 1, IN, SOA, "a.b.stale. hostmaster.a.b.stale. 1 2 3 4 5"
-                    )
-                )
-        elif lqname == "b.stale.":
-            r.flags |= dns.flags.AA
-            if rrtype == NS:
-                # NS b.
-                r.answer.append(dns.rrset.from_text(lqname, 1, IN, NS, "ns.b.stale."))
-                r.additional.append(
-                    dns.rrset.from_text("ns.b.stale.", 1, IN, A, "10.53.0.4")
-                )
-            elif rrtype == SOA:
-                # SOA b.
-                r.answer.append(
-                    dns.rrset.from_text(
-                        lqname, 1, IN, SOA, "b.stale. hostmaster.b.stale. 1 2 3 4 5"
-                    )
-                )
-            else:
-                # NODATA.
-                r.authority.append(
-                    dns.rrset.from_text(
-                        lqname, 1, IN, SOA, "b.stale. hostmaster.b.stale. 1 2 3 4 5"
-                    )
-                )
-        elif lqname == "ns.b.stale.":
-            r.flags |= dns.flags.AA
-            if rrtype == A:
-                # SOA a.b.
-                r.answer.append(
-                    dns.rrset.from_text("ns.a.b.stale.", 1, IN, A, "10.53.0.4")
-                )
-            else:
-                # NODATA.
-                r.authority.append(
-                    dns.rrset.from_text(
-                        lqname, 1, IN, SOA, "b.stale. hostmaster.b.stale. 1 2 3 4 5"
-                    )
-                )
-        else:
-            r.authority.append(
-                dns.rrset.from_text(
-                    lqname, 1, IN, SOA, "b.stale. hostmaster.b.stale. 1 2 3 4 5"
-                )
-            )
-            r.set_rcode(NXDOMAIN)
-            # NXDOMAIN.
-        return r
-    else:
-        r.set_rcode(REFUSED)
-        return r
-
-    # Good/bad differs only in how we treat non-empty terminals
-    if lqname == "icky.icky.icky.ptang.zoop.boing." and rrtype == A:
-        r.answer.append(dns.rrset.from_text(lqname + suffix, 1, IN, A, "192.0.2.1"))
-        r.flags |= dns.flags.AA
-    elif lqname == "more.icky.icky.icky.ptang.zoop.boing." and rrtype == A:
-        r.answer.append(dns.rrset.from_text(lqname + suffix, 1, IN, A, "192.0.2.2"))
-        r.flags |= dns.flags.AA
-    elif lqname == "icky.ptang.zoop.boing." and rrtype == NS:
-        r.answer.append(
-            dns.rrset.from_text(
-                lqname + suffix, 1, IN, NS, "a.bit.longer.ns.name." + suffix
-            )
-        )
-        r.flags |= dns.flags.AA
-    elif endswith(lqname, "icky.ptang.zoop.boing."):
-        r.authority.append(
-            dns.rrset.from_text(
-                "icky.ptang.zoop.boing." + suffix,
-                1,
-                IN,
-                SOA,
-                "ns2." + suffix + " hostmaster.arpa. 2018050100 1 1 1 1",
-            )
-        )
-        if bad or not endswith("more.icky.icky.icky.ptang.zoop.boing.", lqname):
-            r.set_rcode(NXDOMAIN)
-        if ugly:
-            r.set_rcode(FORMERR)
-    elif ip6req:
-        r.flags |= dns.flags.AA
-        if (
-            lqname
-            == "test1.test2.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.9.0.9.4.1.1.1.1.8.2.6.0.1.0.0.2.ip6.arpa."
-            and rrtype == TXT
-        ):
-            r.answer.append(
-                dns.rrset.from_text(
-                    "test1.test2.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.9.0.9.4.1.1.1.1.8.2.6.0.1.0.0.2.ip6.arpa.",
-                    1,
-                    IN,
-                    TXT,
-                    "long_ip6_name",
-                )
-            )
-        elif endswith(
-            "0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.9.0.9.4.1.1.1.1.8.2.6.0.1.0.0.2.ip6.arpa.",
-            lqname,
-        ):
-            # NODATA answer
-            r.authority.append(
-                dns.rrset.from_text(
-                    "1.1.1.1.8.2.6.0.1.0.0.2.ip6.arpa.",
-                    60,
-                    IN,
-                    SOA,
-                    "ns4.good. hostmaster.arpa. 2018050100 120 30 320 16",
-                )
-            )
-        else:
-            # NXDOMAIN
-            r.authority.append(
-                dns.rrset.from_text(
-                    "1.1.1.1.8.2.6.0.1.0.0.2.ip6.arpa.",
-                    60,
-                    IN,
-                    SOA,
-                    "ns4.good. hostmaster.arpa. 2018050100 120 30 320 16",
-                )
-            )
-            r.set_rcode(NXDOMAIN)
-    else:
-        r.set_rcode(REFUSED)
-
-    if slow:
-        time.sleep(0.4)
-    return r
+class IckyPtangZoopBoingBadHandler(EntRcodeChanger):
+    domains = ["icky.ptang.zoop.boing.bad."]
+    rcode = dns.rcode.NXDOMAIN


-def sigterm(signum, frame):
-    print("Shutting down now...")
-    os.remove("ans.pid")
-    running = False
-    sys.exit(0)
+class IckyPtangZoopBoingUglyHandler(EntRcodeChanger):
+    domains = ["icky.ptang.zoop.boing.ugly."]
+    rcode = dns.rcode.FORMERR


-############################################################################
-# Main
-#
-# Set up responder and control channel, open the pid file, and start
-# the main loop, listening for queries on the query channel or commands
-# on the control channel and acting on them.
-############################################################################
-ip4 = "10.53.0.4"
-ip6 = "fd92:7065:b8e:ffff::4"
+class IckyPtangZoopBoingSlowHandler(DelayedResponseHandler):
+    domains = ["icky.ptang.zoop.boing.slow."]
+    delay = 0.4

-try:
-    port = int(os.environ["PORT"])
-except:
-    port = 5300

-query4_socket = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
-query4_socket.bind((ip4, port))
-
-havev6 = True
-try:
-    query6_socket = socket.socket(socket.AF_INET6, socket.SOCK_DGRAM)
-    try:
-        query6_socket.bind((ip6, port))
-    except:
-        query6_socket.close()
-        havev6 = False
-except:
-    havev6 = False
-
-signal.signal(signal.SIGTERM, sigterm)
-
-f = open("ans.pid", "w")
-pid = os.getpid()
-print(pid, file=f)
-f.close()
-
-running = True
-
-print("Listening on %s port %d" % (ip4, port))
-if havev6:
-    print("Listening on %s port %d" % (ip6, port))
-print("Ctrl-c to quit")
-
-if havev6:
-    input = [query4_socket, query6_socket]
-else:
-    input = [query4_socket]
-
-while running:
-    try:
-        inputready, outputready, exceptready = select.select(input, [], [])
-    except select.error as e:
-        break
-    except socket.error as e:
-        break
-    except KeyboardInterrupt:
-        break
-
-    for s in inputready:
-        if s == query4_socket or s == query6_socket:
-            print(
-                "Query received on %s" % (ip4 if s == query4_socket else ip6), end=" "
-            )
-            # Handle incoming queries
-            msg = s.recvfrom(65535)
-            rsp = create_response(msg[0])
-            if rsp:
-                print(dns.rcode.to_text(rsp.rcode()))
-                s.sendto(rsp.to_wire(), msg[1])
-            else:
-                print("NO RESPONSE")
-    if not running:
-        break
+if __name__ == "__main__":
+    server = AsyncDnsServer()
+    server.install_response_handler(QueryLogger())
+    server.install_response_handler(StaleHandler())
+    server.install_response_handler(IckyPtangZoopBoingBadHandler())
+    server.install_response_handler(IckyPtangZoopBoingUglyHandler())
+    server.install_response_handler(IckyPtangZoopBoingSlowHandler())
+    server.run()
@@ -0,0 +1,16 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+@	1	SOA	ns hostmaster.b.stale. 1 2 3 4 5
+@	1	NS	ns
+ns	1	A	10.53.0.4
+a	1	NS	ns.a
+ns.a	1	A	10.53.0.4
@@ -0,0 +1,15 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+@			1	SOA	ns4.bad. hostmaster.arpa. 2018050100 1 1 1 1
+@			1	NS	a.bit.longer.ns.name.bad.
+icky.icky		1	A	192.0.2.1
+more.icky.icky		1	A	192.0.2.2
@@ -0,0 +1,15 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+@			1	SOA	ns4.good. hostmaster.arpa. 2018050100 1 1 1 1
+@			1	NS	a.bit.longer.ns.name.good.
+icky.icky		1	A	192.0.2.1
+more.icky.icky		1	A	192.0.2.2
@@ -0,0 +1,15 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+@			1	SOA	ns4.slow. hostmaster.arpa. 2018050100 1 1 1 1
+@			1	NS	a.bit.longer.ns.name.slow.
+icky.icky		1	A	192.0.2.1
+more.icky.icky		1	A	192.0.2.2
@@ -0,0 +1,15 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+@			1	SOA	ns4.ugly. hostmaster.arpa. 2018050100 1 1 1 1
+@			1	NS	a.bit.longer.ns.name.ugly.
+icky.icky		1	A	192.0.2.1
+more.icky.icky		1	A	192.0.2.2
@@ -0,0 +1,107 @@
+"""
+Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+
+SPDX-License-Identifier: MPL-2.0
+
+This Source Code Form is subject to the terms of the Mozilla Public
+License, v. 2.0.  If a copy of the MPL was not distributed with this
+file, you can obtain one at https://mozilla.org/MPL/2.0/.
+
+See the COPYRIGHT file distributed with this work for additional
+information regarding copyright ownership.
+"""
+
+from typing import AsyncGenerator
+
+import abc
+
+import dns.rcode
+import dns.rdataclass
+import dns.rdatatype
+
+from isctest.asyncserver import (
+    DnsResponseSend,
+    DomainHandler,
+    QueryContext,
+    ResponseAction,
+)
+
+from isctest.compat import dns_rcode
+
+
+def log_query(qctx: QueryContext) -> None:
+    """
+    Log a received DNS query to a text file inspected by `tests.sh`.  AAAA and
+    A queries are logged identically because the relative order in which they
+    are received does not matter.
+    """
+    qname = qctx.qname.to_text()
+    qtype = dns.rdatatype.to_text(qctx.qtype)
+    if qtype in ("A", "AAAA"):
+        qtype = "ADDR"
+
+    with open("query.log", "a", encoding="utf-8") as query_log:
+        print(f"{qtype} {qname}", file=query_log)
+
+
+class QueryLogHandler(DomainHandler):
+    """
+    Log all received DNS queries to a text file.  Use the zone file for
+    preparing responses.
+    """
+
+    async def get_responses(
+        self, qctx: QueryContext
+    ) -> AsyncGenerator[ResponseAction, None]:
+        log_query(qctx)
+        yield DnsResponseSend(qctx.response)
+
+
+class EntRcodeChanger(DomainHandler):
+    """
+    Log all received DNS queries to a text file.  Use the zone file for
+    preparing responses, but override the RCODE returned for empty
+    non-terminals (ENTs) to the value specified by the child class.  This
+    emulates broken authoritative servers.
+    """
+
+    @property
+    @abc.abstractmethod
+    def rcode(self) -> dns_rcode:
+        raise NotImplementedError
+
+    async def get_responses(
+        self, qctx: QueryContext
+    ) -> AsyncGenerator[ResponseAction, None]:
+        assert qctx.zone
+
+        log_query(qctx)
+
+        if (
+            qctx.response.rcode() == dns.rcode.NOERROR
+            and not qctx.response.answer
+            and qctx.response.authority
+            and qctx.response.authority[0].rdtype == dns.rdatatype.SOA
+            and not qctx.zone.get_node(qctx.qname)
+        ):
+            qctx.response.set_rcode(self.rcode)
+            yield DnsResponseSend(qctx.response)
+
+
+class DelayedResponseHandler(DomainHandler):
+    """
+    Log all received DNS queries to a text file.  Use the zone file for
+    preparing responses, but delay sending every answer by the amount of time
+    specified (in seconds) by the child class.  This emulates network delays.
+    """
+
+    @property
+    @abc.abstractmethod
+    def delay(self) -> float:
+        raise NotImplementedError
+
+    async def get_responses(
+        self, qctx: QueryContext
+    ) -> AsyncGenerator[ResponseAction, None]:
+        log_query(qctx)
+        yield DnsResponseSend(qctx.response, delay=self.delay)
@@ -127,12 +127,14 @@ ADDR a.bit.longer.ns.name.good.
 ADDR ns2.good.
 ADDR ns3.good.
 ADDR ns3.good.
+NS a.bit.longer.ns.name.good.
 NS bit.longer.ns.name.good.
 NS boing.good.
 NS good.
 NS longer.ns.name.good.
 NS name.good.
 NS ns.name.good.
+NS ns3.good.
 NS zoop.boing.good.
 __EOF
 cat <<__EOF | diff ans3/query.log - >/dev/null || ret=1
@@ -165,11 +167,13 @@ ADDR a.bit.longer.ns.name.good.
 ADDR ns2.good.
 ADDR ns3.good.
 ADDR ns3.good.
+NS a.bit.longer.ns.name.good.
 NS bit.longer.ns.name.good.
 NS boing.good.
 NS longer.ns.name.good.
 NS name.good.
 NS ns.name.good.
+NS ns3.good.
 NS zoop.boing.good.
 __EOF
 cat <<__EOF | diff ans3/query.log - >/dev/null || ret=1
@@ -221,6 +225,7 @@ ADDR ns3.bad.
 ADDR ns3.bad.
 NS boing.bad.
 NS name.bad.
+NS ns3.bad.
 __EOF
 cat <<__EOF | diff ans3/query.log - >/dev/null || ret=1
 ADDR icky.icky.icky.ptang.zoop.boing.bad.
@@ -271,6 +276,7 @@ ADDR ns3.ugly.
 NS boing.ugly.
 NS name.ugly.
 NS name.ugly.
+NS ns3.ugly.
 __EOF
 echo "ADDR icky.icky.icky.ptang.zoop.boing.ugly." | diff ans3/query.log - >/dev/null || ret=1
 echo "ADDR icky.icky.icky.ptang.zoop.boing.ugly." | diff ans4/query.log - >/dev/null || ret=1
@@ -302,11 +308,13 @@ ADDR a.bit.longer.ns.name.slow.
 ADDR ns2.slow.
 ADDR ns3.slow.
 ADDR ns3.slow.
+NS a.bit.longer.ns.name.slow.
 NS bit.longer.ns.name.slow.
 NS boing.slow.
 NS longer.ns.name.slow.
 NS name.slow.
 NS ns.name.slow.
+NS ns3.slow.
 NS slow.
 NS zoop.boing.slow.
 __EOF
@@ -340,6 +348,7 @@ NS 8.f.4.0.1.0.0.2.ip6.arpa.
 NS 0.0.0.0.8.f.4.0.1.0.0.2.ip6.arpa.
 NS 0.0.0.0.0.0.8.f.4.0.1.0.0.2.ip6.arpa.
 NS 0.0.0.0.0.0.0.0.8.f.4.0.1.0.0.2.ip6.arpa.
+NS 1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.8.f.4.0.1.0.0.2.ip6.arpa.
 PTR 1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.8.f.4.0.1.0.0.2.ip6.arpa.
 __EOF
 for ans in ans2 ans3 ans4; do mv -f $ans/query.log query-$ans-$n.log 2>/dev/null || true; done
@@ -362,12 +371,14 @@ ADDR a.bit.longer.ns.name.good.
 ADDR ns2.good.
 ADDR ns3.good.
 ADDR ns3.good.
+NS a.bit.longer.ns.name.good.
 NS bit.longer.ns.name.good.
 NS boing.good.
 NS good.
 NS longer.ns.name.good.
 NS name.good.
 NS ns.name.good.
+NS ns3.good.
 NS zoop.boing.good.
 __EOF
 cat <<__EOF | diff ans3/query.log - >/dev/null || ret=1
@@ -449,6 +460,7 @@ grep "a\.b\.stale\..*1.*IN.*TXT.*hooray" dig.out.test$n >/dev/null || ret=1
 sleep 1
 sort ans2/query.log >ans2/query.log.sorted
 cat <<__EOF | diff ans2/query.log.sorted - >/dev/null || ret=1
+ADDR ns.a.b.stale.
 ADDR ns.b.stale.
 ADDR ns2.stale.
 NS b.stale.
@@ -457,7 +469,9 @@ __EOF
 test -f ans3/query.log && ret=1
 sort ans4/query.log >ans4/query.log.sorted
 cat <<__EOF | diff ans4/query.log.sorted - >/dev/null || ret=1
+ADDR ns.a.b.stale.
 ADDR ns.b.stale.
+NS a.b.stale.
 NS b.stale.
 TXT a.b.stale.
 __EOF
@@ -476,6 +490,7 @@ grep "a\.b\.stale\..*1.*IN.*TXT.*hooray" dig.out.test$n >/dev/null || ret=1
 sleep 1
 sort ans2/query.log >ans2/query.log.sorted
 cat <<__EOF | diff ans2/query.log.sorted - >/dev/null || ret=1
+ADDR ns.a.b.stale.
 ADDR ns.b.stale.
 ADDR ns2.stale.
 NS b.stale.
@@ -483,7 +498,9 @@ __EOF
 test -f ans3/query.log && ret=1
 sort ans4/query.log >ans4/query.log.sorted
 cat <<__EOF | diff ans4/query.log.sorted - >/dev/null || ret=1
+ADDR ns.a.b.stale.
 ADDR ns.b.stale.
+NS a.b.stale.
 TXT a.b.stale.
 __EOF
 for ans in ans2 ans3 ans4; do mv -f $ans/query.log query-$ans-$n.log 2>/dev/null || true; done
@@ -519,6 +536,7 @@ grep "a\.b\.stale\..*1.*IN.*TXT.*hooray" dig.out.test$n >/dev/null || ret=1
 sleep 1
 sort ans2/query.log >ans2/query.log.sorted
 cat <<__EOF | diff ans2/query.log.sorted - >/dev/null || ret=1
+ADDR ns.a.b.stale.
 ADDR ns.b.stale.
 ADDR ns2.stale.
 NS b.stale.
@@ -527,7 +545,9 @@ __EOF
 test -f ans3/query.log && ret=1
 sort ans4/query.log >ans4/query.log.sorted
 cat <<__EOF | diff ans4/query.log.sorted - >/dev/null || ret=1
+ADDR ns.a.b.stale.
 ADDR ns.b.stale.
+NS a.b.stale.
 NS b.stale.
 TXT a.b.stale.
 __EOF
@@ -546,6 +566,7 @@ grep "a\.b\.stale\..*1.*IN.*TXT.*hooray" dig.out.test$n >/dev/null || ret=1
 sleep 1
 sort ans2/query.log >ans2/query.log.sorted
 cat <<__EOF | diff ans2/query.log.sorted - >/dev/null || ret=1
+ADDR ns.a.b.stale.
 ADDR ns.b.stale.
 ADDR ns2.stale.
 NS b.stale.
@@ -553,7 +574,9 @@ __EOF
 test -f ans3/query.log && ret=1
 sort ans4/query.log >ans4/query.log.sorted
 cat <<__EOF | diff ans4/query.log.sorted - >/dev/null || ret=1
+ADDR ns.a.b.stale.
 ADDR ns.b.stale.
+NS a.b.stale.
 TXT a.b.stale.
 __EOF
 for ans in ans2 ans3 ans4; do mv -f $ans/query.log query-$ans-$n.log 2>/dev/null || true; done
@@ -9,9 +9,9 @@
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.

-$TTL 60
+$TTL 120

-big.		IN	SOA	ns.big. hostmaster.ns.big. 1 0 0 0 60
+big.		IN	SOA	ns.big. hostmaster.ns.big. 1 0 0 0 120
 big.		IN	NS	ns.big.
 ns.big.		IN	A	10.53.0.1

@@ -280,11 +280,11 @@ echo_i "checking that priority names under the max-types-per-name limit get cach

 # Query for NXDOMAIN for items on our priority list - these should get cached
 for rrtype in AAAA MX NS; do
-  check_manytypes 1 manytypes.big "${rrtype}" NOERROR big SOA 60 || ret=1
+  check_manytypes 1 manytypes.big "${rrtype}" NOERROR big SOA 120 || ret=1
 done
 # Wait at least 1 second
 for rrtype in AAAA MX NS; do
-  check_manytypes 2 manytypes.big "${rrtype}" NOERROR big SOA "" 60 || ret=1
+  check_manytypes 2 manytypes.big "${rrtype}" NOERROR big SOA "" 120 || ret=1
 done

 if [ $ret -ne 0 ]; then echo_i "failed"; fi
@@ -299,13 +299,13 @@ echo_i "checking that NXDOMAIN names under the max-types-per-name limit get cach

 # Query for 10 NXDOMAIN types
 for ntype in $(seq 65270 65279); do
-  check_manytypes 1 manytypes.big "TYPE${ntype}" NOERROR big SOA 60 || ret=1
+  check_manytypes 1 manytypes.big "TYPE${ntype}" NOERROR big SOA 120 || ret=1
 done
 # Wait at least 1 second
 sleep 1
 # Query for 10 NXDOMAIN types again - these should be cached
 for ntype in $(seq 65270 65279); do
-  check_manytypes 2 manytypes.big "TYPE${ntype}" NOERROR big SOA "" 60 || ret=1
+  check_manytypes 2 manytypes.big "TYPE${ntype}" NOERROR big SOA "" 120 || ret=1
 done

 if [ $ret -ne 0 ]; then echo_i "failed"; fi
@@ -318,13 +318,13 @@ echo_i "checking that existing names under the max-types-per-name limit get cach

 # Limited to 10 types - these should be cached and the previous record should be evicted
 for ntype in $(seq 65280 65289); do
-  check_manytypes 1 manytypes.big "TYPE${ntype}" NOERROR manytypes.big "TYPE${ntype}" 60 || ret=1
+  check_manytypes 1 manytypes.big "TYPE${ntype}" NOERROR manytypes.big "TYPE${ntype}" 120 || ret=1
 done
 # Wait at least one second
 sleep 1
 # Limited to 10 types - these should be cached
 for ntype in $(seq 65280 65289); do
-  check_manytypes 2 manytypes.big "TYPE${ntype}" NOERROR manytypes.big "TYPE${ntype}" "" 60 || ret=1
+  check_manytypes 2 manytypes.big "TYPE${ntype}" NOERROR manytypes.big "TYPE${ntype}" "" 120 || ret=1
 done

 if [ $ret -ne 0 ]; then echo_i "failed"; fi
@@ -356,11 +356,11 @@ echo_i "checking that priority NXDOMAIN names over the max-types-per-name limit

 # Query for NXDOMAIN for items on our priority list - these should get cached
 for rrtype in AAAA MX NS; do
-  check_manytypes 1 manytypes.big "${rrtype}" NOERROR big SOA 60 || ret=1
+  check_manytypes 1 manytypes.big "${rrtype}" NOERROR big SOA 120 || ret=1
 done
 # Wait at least 1 second
 for rrtype in AAAA MX NS; do
-  check_manytypes 2 manytypes.big "${rrtype}" NOERROR big SOA "" 60 || ret=1
+  check_manytypes 2 manytypes.big "${rrtype}" NOERROR big SOA "" 120 || ret=1
 done

 if [ $ret -ne 0 ]; then echo_i "failed"; fi
@@ -372,11 +372,11 @@ ret=0
 echo_i "checking that priority name over the max-types-per-name get cached ($n)"

 # Query for an item on our priority list - it should get cached
-check_manytypes 1 manytypes.big "A" NOERROR manytypes.big A 60 || ret=1
+check_manytypes 1 manytypes.big "A" NOERROR manytypes.big A 120 || ret=1
 # Wait at least 1 second
 sleep 1
 # Query the same name again - it should be in the cache
-check_manytypes 2 manytypes.big "A" NOERROR big manytypes.A "" 60 || ret=1
+check_manytypes 2 manytypes.big "A" NOERROR big manytypes.A "" 120 || ret=1

 if [ $ret -ne 0 ]; then echo_i "failed"; fi
 status=$((status + ret))
@@ -389,7 +389,7 @@ ret=0
 echo_i "checking that priority name over the max-types-per-name don't get evicted ($n)"

 # Query for an item on our priority list - it should get cached
-check_manytypes 1 manytypes.big "A" NOERROR manytypes.big A 60 || ret=1
+check_manytypes 1 manytypes.big "A" NOERROR manytypes.big A 120 || ret=1
 # Query for 10 more types - this should not evict A record
 for ntype in $(seq 65280 65289); do
  check_manytypes 1 manytypes.big "TYPE${ntype}" NOERROR manytypes.big || ret=1
@@ -397,9 +397,9 @@ done
 # Wait at least 1 second
 sleep 1
 # Query the same name again - it should be in the cache
-check_manytypes 2 manytypes.big "A" NOERROR manytypes.big A "" 60 || ret=1
+check_manytypes 2 manytypes.big "A" NOERROR manytypes.big A "" 120 || ret=1
 # This one was first in the list and should have been evicted
-check_manytypes 2 manytypes.big "TYPE65280" NOERROR manytypes.big TYPE65280 60 || ret=1
+check_manytypes 2 manytypes.big "TYPE65280" NOERROR manytypes.big TYPE65280 120 || ret=1

 if [ $ret -ne 0 ]; then echo_i "failed"; fi
 status=$((status + ret))
@@ -413,21 +413,21 @@ echo_i "checking that non-priority types cause eviction ($n)"

 # Everything on top of that will cause the cache eviction
 for ntype in $(seq 65280 65299); do
-  check_manytypes 1 manytypes.big "TYPE${ntype}" NOERROR manytypes.big "TYPE${ntype}" 60 || ret=1
+  check_manytypes 1 manytypes.big "TYPE${ntype}" NOERROR manytypes.big "TYPE${ntype}" 120 || ret=1
 done
 # Wait at least one second
 sleep 1
-# These should have TTL != 60 now
+# These should have TTL != 120 now
 for ntype in $(seq 65290 65299); do
-  check_manytypes 2 manytypes.big "TYPE${ntype}" NOERROR manytypes.big "TYPE${ntype}" "" 60 || ret=1
+  check_manytypes 2 manytypes.big "TYPE${ntype}" NOERROR manytypes.big "TYPE${ntype}" "" 120 || ret=1
 done
 # These should have been evicted
 for ntype in $(seq 65280 65289); do
-  check_manytypes 3 manytypes.big "TYPE${ntype}" NOERROR manytypes.big "TYPE${ntype}" 60 || ret=1
+  check_manytypes 3 manytypes.big "TYPE${ntype}" NOERROR manytypes.big "TYPE${ntype}" 120 || ret=1
 done
 # These should have been evicted by the previous block
 for ntype in $(seq 65290 65299); do
-  check_manytypes 4 manytypes.big "TYPE${ntype}" NOERROR manytypes.big "TYPE${ntype}" 60 || ret=1
+  check_manytypes 4 manytypes.big "TYPE${ntype}" NOERROR manytypes.big "TYPE${ntype}" 120 || ret=1
 done

 if [ $ret -ne 0 ]; then echo_i "failed"; fi
@@ -442,25 +442,25 @@ echo_i "checking that signed names under the max-types-per-name limit get cached

 # Go through the 10 items, this should result in 20 items (type + rrsig(type))
 for ntype in $(seq 65280 65289); do
-  check_manytypes 1 manytypes.signed "TYPE${ntype}" NOERROR manytypes.signed "TYPE${ntype}" 60 || ret=1
+  check_manytypes 1 manytypes.signed "TYPE${ntype}" NOERROR manytypes.signed "TYPE${ntype}" 120 || ret=1
 done

 # Wait at least one second
 sleep 1

-# These should have TTL != 60 now
+# These should have TTL != 120 now
 for ntype in $(seq 65285 65289); do
-  check_manytypes 2 manytypes.signed "TYPE${ntype}" NOERROR manytypes.signed "TYPE${ntype}" "" 60 || ret=1
+  check_manytypes 2 manytypes.signed "TYPE${ntype}" NOERROR manytypes.signed "TYPE${ntype}" "" 120 || ret=1
 done

 # These should have been evicted
 for ntype in $(seq 65280 65284); do
-  check_manytypes 3 manytypes.signed "TYPE${ntype}" NOERROR manytypes.signed "TYPE${ntype}" 60 || ret=1
+  check_manytypes 3 manytypes.signed "TYPE${ntype}" NOERROR manytypes.signed "TYPE${ntype}" 120 || ret=1
 done

 # These should have been evicted by the previous block
 for ntype in $(seq 65285 65289); do
-  check_manytypes 4 manytypes.signed "TYPE${ntype}" NOERROR manytypes.signed "TYPE${ntype}" 60 || ret=1
+  check_manytypes 4 manytypes.signed "TYPE${ntype}" NOERROR manytypes.signed "TYPE${ntype}" 120 || ret=1
 done

 if [ $ret -ne 0 ]; then echo_i "failed"; fi
@@ -475,12 +475,12 @@ echo_i "checking that lifting the limit will allow everything to get cached ($n)
 ns3_reset ns3/named6.conf.in

 for ntype in $(seq 65280 65534); do
-  check_manytypes 1 manytypes.big "TYPE${ntype}" NOERROR manytypes.big "TYPE${ntype}" 60 || ret=1
+  check_manytypes 1 manytypes.big "TYPE${ntype}" NOERROR manytypes.big "TYPE${ntype}" 120 || ret=1
 done
 # Wait at least one second
 sleep 1
 for ntype in $(seq 65280 65534); do
-  check_manytypes 2 manytypes.big "TYPE${ntype}" NOERROR manytypes.big "TYPE${ntype}" "" 60 || ret=1
+  check_manytypes 2 manytypes.big "TYPE${ntype}" NOERROR manytypes.big "TYPE${ntype}" "" 120 || ret=1
 done

 if [ $ret -ne 0 ]; then echo_i "failed"; fi
@@ -4,37 +4,21 @@
 * SPDX-License-Identifier: MPL-2.0
 *
 * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
 * file, you can obtain one at https://mozilla.org/MPL/2.0/.
 *
 * See the COPYRIGHT file distributed with this work for additional
 * information regarding copyright ownership.
 */

-#pragma once
-
-/*****
-***** Module Info
-*****/
-
-/***
- *** Imports
- ***/
-
-#include <isc/types.h>
-
-/***
- *** Functions
- ***/
-
-bool
-isc_fips_mode(void);
-/*
- * Return if FIPS mode is currently enabled or not
- */
-
-isc_result_t
-isc_fips_set_mode(int mode);
-/*
- * Enable FIPS mode.
- */
+options {
+	query-source address 10.53.0.11;
+	notify-source 10.53.0.11;
+	transfer-source 10.53.0.11;
+	port @PORT@;
+	pid-file "named.pid";
+	listen-on { 10.53.0.11; };
+	listen-on-v6 { none; };
+	recursion no;
+	dnssec-validation no;
+};
@@ -24,5 +24,6 @@ copy_setports ns5/named.conf.in ns5/named.conf
 copy_setports ns6/named.conf.in ns6/named.conf
 copy_setports ns7/named1.conf.in ns7/named.conf
 copy_setports ns9/named.conf.in ns9/named.conf
+copy_setports ns11/named.conf.in ns11/named.conf

 (cd ns6 && $SHELL keygen.sh)
@@ -729,10 +729,10 @@ if ${FEATURETEST} --enable-querytrace; then
  grep "status: SERVFAIL" dig.ns5.out.${n} >/dev/null || ret=1
  check_namedrun() {
    nextpartpeek ns5/named.run >nextpart.out.${n}
-    grep 'resolving tcpalso.no-questions/A for [^:]*: empty question section, accepting it anyway as TC=1' nextpart.out.${n} >/dev/null || return 1
-    grep '(tcpalso.no-questions/A): connecting via TCP' nextpart.out.${n} >/dev/null || return 1
-    grep 'resolving tcpalso.no-questions/A for [^:]*: empty question section$' nextpart.out.${n} >/dev/null || return 1
-    grep '(tcpalso.no-questions/A): nextitem' nextpart.out.${n} >/dev/null || return 1
+    grep 'resolving tcpalso.no-questions/NS for [^:]*: empty question section, accepting it anyway as TC=1' nextpart.out.${n} >/dev/null || return 1
+    grep '(tcpalso.no-questions/NS): connecting via TCP' nextpart.out.${n} >/dev/null || return 1
+    grep 'resolving tcpalso.no-questions/NS for [^:]*: empty question section$' nextpart.out.${n} >/dev/null || return 1
+    grep '(tcpalso.no-questions/NS): nextitem' nextpart.out.${n} >/dev/null || return 1
    return 0
  }
  retry_quiet 12 check_namedrun || ret=1
@@ -1015,5 +1015,14 @@ ttl=$(awk '{print $2}' dig.ns1.out.${n})
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status + ret))

+n=$((n + 1))
+echo_i "client requests recursion but it is disabled - expect EDE 20 code with REFUSED($n)"
+ret=0
+dig_with_opts +recurse www.isc.org @10.53.0.11 a >dig.out.ns11.test${n} || ret=1
+grep "status: REFUSED" dig.out.ns11.test${n} >/dev/null || ret=1
+grep -F "EDE: 20 (Not Authoritative)" dig.out.ns11.test${n} >/dev/null || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status + ret))
+
 echo_i "exit status: $status"
 [ $status -eq 0 ] || exit 1
@@ -102,6 +102,23 @@ def test_rpz_passthru_logging():
        dns.rrset.from_text("allowed.", 300, "IN", "A", "10.53.0.2")
    ]

+    # Should also generate a log entry into rpz_passthru.txt
+    msg_allowed_any = dns.message.make_query("allowed.", "ANY")
+    res_allowed_any = isctest.query.udp(
+        msg_allowed_any,
+        resolver_ip,
+        source="10.53.0.1",
+        expected_rcode=dns.rcode.NOERROR,
+    )
+    assert res_allowed_any.answer == [
+        dns.rrset.from_text("allowed.", 300, "IN", "A", "10.53.0.2"),
+        dns.rrset.from_text("allowed.", 300, "IN", "NS", "ns1.allowed."),
+    ]
+    # The comparison above doesn't compare the TTL values, and we want to
+    # make sure that the "passthru" rpz doesn't cap the TTL with max-policy-ttl.
+    assert res_allowed_any.answer[0].ttl > 200
+    assert res_allowed_any.answer[1].ttl > 200
+
    # baddomain.com isn't allowed (CNAME .), should return NXDOMAIN
    # Should generate a log entry into rpz.txt
    msg_not_allowed = dns.message.make_query("baddomain.", "A")
@@ -140,7 +140,7 @@ main(int argc, char **argv) {
 	printf("%s\n", filename);
 	dst_key_free(&key);

-	isc_mem_destroy(&mctx);
+	isc_mem_detach(&mctx);
 	return 0;
 }

@@ -115,10 +115,12 @@ sleep 2
 # stale for somewhere between 3500-3599 seconds.
 echo_i "check rndc dump stale data.example ($n)"
 rndc_dumpdb ns1 || ret=1
-awk '/; stale since [0-9]*/ { x=$0; getline; print x, $0}' ns1/named_dump.db.test$n \
+# add in inherited owner names
+awk '$1 ~ /^[0-9][0-9]*$/ { $0 = last " " $0 } $1 != ";" { last = $1 } { print }' ns1/named_dump.db.test$n >named_dump.db.test$n
+awk '/; stale since [0-9]*/ { x=$0; getline; print x, $0}' named_dump.db.test$n \
  | grep "; stale since [0-9]* data\.example.*3[56]...*TXT.*A text record with a 2 second ttl" >/dev/null 2>&1 || ret=1
 # Also make sure the not expired data does not have a stale comment.
-awk '/; authanswer/ { x=$0; getline; print x, $0}' ns1/named_dump.db.test$n \
+awk '/; authanswer/ { x=$0; getline; print x, $0}' named_dump.db.test$n \
  | grep "; authanswer longttl\.example.*[56]...*TXT.*A text record with a 600 second ttl" >/dev/null 2>&1 || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status + ret))
@@ -1664,16 +1666,15 @@ status=$((status + ret))
 # Check that expired records are dumped.
 echo_i "check rndc dump expired data.example ($n)"
 ret=0
-awk '/; expired/ { x=$0; getline; print x, $0}' ns5/named_dump.db.test$n \
-  | grep "; expired (awaiting cleanup) data\.example\..*A text record with a 2 second ttl" >/dev/null 2>&1 || ret=1
-awk '/; expired/ { x=$0; getline; print x, $0}' ns5/named_dump.db.test$n \
-  | grep "; expired (awaiting cleanup) nodata\.example\." >/dev/null 2>&1 || ret=1
-awk '/; expired/ { x=$0; getline; print x, $0}' ns5/named_dump.db.test$n \
-  | grep "; expired (awaiting cleanup) nxdomain\.example\." >/dev/null 2>&1 || ret=1
-awk '/; expired/ { x=$0; getline; print x, $0}' ns5/named_dump.db.test$n \
-  | grep "; expired (awaiting cleanup) othertype\.example\." >/dev/null 2>&1 || ret=1
+# add in inherited owner names
+awk '$1 ~ /^[0-9][0-9]*$/ { $0 = last " " $0 } $1 != ";" { last = $1 } { print }' ns5/named_dump.db.test$n >named_dump.db.test$n
+# extract expired records
+awk '/; expired/ { x=$0; getline; print x, $0}' named_dump.db.test$n >expired.test$n
+grep "; expired (awaiting cleanup) data\.example\..*A text record with a 2 second ttl" expired.test$n >/dev/null 2>&1 || ret=1
+grep "; expired (awaiting cleanup) nodata\.example\." expired.test$n >/dev/null 2>&1 || ret=1
+grep "; expired (awaiting cleanup) nxdomain\.example\." expired.test$n >/dev/null 2>&1 || ret=1
 # Also make sure the not expired data does not have an expired comment.
-awk '/; authanswer/ { x=$0; getline; print x, $0}' ns5/named_dump.db.test$n \
+awk '/; authanswer/ { x=$0; getline; print x, $0}' named_dump.db.test$n \
  | grep "; authanswer longttl\.example.*A text record with a 600 second ttl" >/dev/null 2>&1 || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status + ret))
@@ -14,6 +14,8 @@ import pytest
 pytestmark = pytest.mark.extra_artifacts(
    [
        "dig.out.*",
+        "expired.test*",
+        "named_dump.db.test*",
        "rndc.out.*",
        "ans*/ans.run",
        "ns*/named.stats*",
@@ -234,7 +234,7 @@ sub construct_ns_command {
 		$command = "taskset $taskset $NAMED ";
 	} elsif ($ENV{'USE_RR'}) {
 		$ENV{'_RR_TRACE_DIR'} = ".";
-		$command = "rr record --chaos $NAMED ";
+		$command = "$ENV{'TOP_BUILDDIR'}/libtool --mode=execute rr record --chaos $NAMED ";
 	} else {
 		$command = "$NAMED ";
 	}
@@ -264,7 +264,8 @@ sub construct_ns_command {

 		foreach my $t_option(
 			"dropedns", "ednsformerr", "ednsnotimp", "ednsrefused",
-			"noaa", "noedns", "nosoa", "maxudp512", "maxudp1460",
+			"cookiealwaysvalid", "noaa", "noedns", "nosoa",
+			"maxudp512", "maxudp1460",
 		    ) {
 			if (-e "$testdir/$server/named.$t_option") {
 				$command .= "-T $t_option "
@@ -323,7 +324,7 @@ sub construct_ans_command {
 	}

 	if (-e "$testdir/$server/ans.py") {
-		$ENV{'PYTHONPATH'} = $testdir . ":" . $ENV{'srcdir'};
+		$ENV{'PYTHONPATH'} = $testdir . ":" . $builddir;
 		$command = "$PYTHON -u ans.py 10.53.0.$n $queryport";
 	} elsif (-e "$testdir/$server/ans.pl") {
 		$command = "$PERL ans.pl";
@@ -414,10 +414,10 @@ for ns in 2 4 5 6; do
  check_status NOERROR dig.out.ns${ns}.test$n || ret=1
  if [ ${synth} = yes ]; then
    check_synth_cname b.wild-cname.example. dig.out.ns${ns}.test$n || ret=1
-    nextpart ns1/named.run | grep b.wild-cname.example/A >/dev/null && ret=1
+    nextpart ns1/named.run | grep b.wild-cname.example/NS >/dev/null && ret=1
  else
    check_nosynth_cname b.wild-cname.example. dig.out.ns${ns}.test$n || ret=1
-    nextpart ns1/named.run | grep b.wild-cname.example/A >/dev/null || ret=1
+    nextpart ns1/named.run | grep b.wild-cname.example/NS >/dev/null || ret=1
  fi
  grep "ns1.example.*.IN.A" dig.out.ns${ns}.test$n >/dev/null || ret=1
  digcomp wildcname.out dig.out.ns${ns}.test$n || ret=1
@@ -470,6 +470,7 @@ for ns in 2 4 5 6; do
  check_nosynth_aaaa b.wild-2-nsec-afterdata.example. dig.out.a.ns${ns}.test$n || ret=1
  #
  nextpart ns1/named.run >/dev/null
+  sleep 1
  dig_with_opts b.wild-2-nsec-afterdata.example. @10.53.0.${ns} TLSA >dig.out.ns${ns}.test$n || ret=1
  check_ad_flag $ad dig.out.ns${ns}.test$n || ret=1
  check_status NOERROR dig.out.ns${ns}.test$n || ret=1
@@ -531,7 +532,7 @@ for ns in 2 4 5 6; do
  check_ad_flag no dig.out.ns${ns}.test$n || ret=1
  check_status NOERROR dig.out.ns${ns}.test$n || ret=1
  check_nosynth_cname b.wild-cname.insecure.example dig.out.ns${ns}.test$n || ret=1
-  nextpart ns1/named.run | grep b.wild-cname.insecure.example/A >/dev/null || ret=1
+  nextpart ns1/named.run | grep b.wild-cname.insecure.example/NS >/dev/null || ret=1
  grep "ns1.insecure.example.*.IN.A" dig.out.ns${ns}.test$n >/dev/null || ret=1
  digcomp insecure.wildcname.out dig.out.ns${ns}.test$n || ret=1
  n=$((n + 1))
@@ -1,365 +0,0 @@
-#!/usr/bin/perl
-
-# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-#
-# SPDX-License-Identifier: MPL-2.0
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0.  If a copy of the MPL was not distributed with this
-# file, you can obtain one at https://mozilla.org/MPL/2.0/.
-#
-# See the COPYRIGHT file distributed with this work for additional
-# information regarding copyright ownership.
-
-#
-# This is the name server from hell.  It provides canned
-# responses based on pattern matching the queries, and
-# can be reprogrammed on-the-fly over a TCP connection.
-#
-# The server listens for control connections on port 5301.
-# A control connection is a TCP stream of lines like
-#
-#  /pattern/
-#  name ttl type rdata
-#  name ttl type rdata
-#  ...
-#  /pattern/
-#  name ttl type rdata
-#  name ttl type rdata
-#  ...
-#
-# There can be any number of patterns, each associated
-# with any number of response RRs.  Each pattern is a
-# Perl regular expression.
-#
-# Each incoming query is converted into a string of the form
-# "qname qtype" (the printable query domain name, space,
-# printable query type) and matched against each pattern.
-#
-# The first pattern matching the query is selected, and
-# the RR following the pattern line are sent in the
-# answer section of the response.
-#
-# Each new control connection causes the current set of
-# patterns and responses to be cleared before adding new
-# ones.
-#
-# The server handles UDP and TCP queries.  Zone transfer
-# responses work, but must fit in a single 64 k message.
-#
-# Now you can add TSIG, just specify key/key data with:
-#
-#  /pattern <key> <key_data>/
-#  name ttl type rdata
-#  name ttl type rdata
-#
-#  Note that this data will still be sent with any request for
-#  pattern, only this data will be signed. Currently, this is only
-#  done for TCP.
-
-
-use IO::File;
-use IO::Socket;
-use Data::Dumper;
-use Net::DNS;
-use Net::DNS::Packet;
-use strict;
-
-# Ignore SIGPIPE so we won't fail if peer closes a TCP socket early
-local $SIG{PIPE} = 'IGNORE';
-
-# Flush logged output after every line
-local $| = 1;
-
-my $server_addr = "10.53.0.4";
-
-my $localport = int($ENV{'PORT'});
-if (!$localport) { $localport = 5300; }
-
-my $udpsock = IO::Socket::INET->new(LocalAddr => "$server_addr",
-   LocalPort => $localport, Proto => "udp", Reuse => 1) or die "$!";
-
-my $tcpsock = IO::Socket::INET->new(LocalAddr => "$server_addr",
-   LocalPort => $localport, Proto => "tcp", Listen => 5, Reuse => 1) or die "$!";
-
-print "listening on $server_addr:$localport.\n";
-
-my $pidf = new IO::File "ans.pid", "w" or die "cannot open pid file: $!";
-print $pidf "$$\n" or die "cannot write pid file: $!";
-$pidf->close or die "cannot close pid file: $!";;
-sub rmpid { unlink "ans.pid"; exit 1; };
-
-$SIG{INT} = \&rmpid;
-$SIG{TERM} = \&rmpid;
-
-#my @answers = ();
-my @rules;
-sub handleUDP {
-        my ($buf) = @_;
-	my $packet;
-
-	if ($Net::DNS::VERSION > 0.68) {
-		$packet = new Net::DNS::Packet(\$buf, 0);
-		$@ and die $@;
-	} else {
-		my $err;
-		($packet, $err) = new Net::DNS::Packet(\$buf, 0);
-		$err and die $err;
-	}
-
-        $packet->header->qr(1);
-        $packet->header->aa(1);
-
-        my @questions = $packet->question;
-        my $qname = $questions[0]->qname;
-        my $qtype = $questions[0]->qtype;
-
-        # get the existing signature if any, and clear the additional section
-        my $prev_tsig;
-        while (my $rr = $packet->pop("additional")) {
-                if ($rr->type eq "TSIG") {
-                        $prev_tsig = $rr;
-                }
-        }
-
-        my $r;
-        foreach $r (@rules) {
-                my $pattern = $r->{pattern};
-		my($dbtype, $key_name, $key_data) = split(/ /,$pattern);
-		print "[handleUDP] $dbtype, $key_name, $key_data \n";
-                if ("$qname $qtype" =~ /$dbtype/) {
-                        my $a;
-                        foreach $a (@{$r->{answer}}) {
-                                $packet->push("answer", $a);
-                        }
-			if(defined($key_name) && defined($key_data)) {
-				# Sign the packet
-				print "  Signing the response with " .
-                                      "$key_name/$key_data\n";
-                                my $tsig = Net::DNS::RR->
-                                        new("$key_name TSIG $key_data");
-
-                                # These kluges are necessary because Net::DNS
-                                # doesn't know how to sign responses.  We
-                                # clear compnames so that the TSIG key and
-                                # algorithm name won't be compressed, and
-                                # add one to arcount because the signing
-                                # function will attempt to decrement it,
-                                # which is incorrect in a response. Finally
-                                # we set request_mac to the previous digest.
-                                $packet->{"compnames"} = {};
-                                $packet->{"header"}{"arcount"} += 1;
-                                if (defined($prev_tsig)) {
-                                        my $rmac = pack('n H*',
-                                                $prev_tsig->mac_size,
-                                                $prev_tsig->mac);
-                                        $tsig->{"request_mac"} =
-                                                unpack("H*", $rmac);
-                                }
-
-				$packet->sign_tsig($tsig);
-			}
-                        last;
-                }
-        }
-        #$packet->print;
-
-        return $packet->data;
-}
-
-# namelen:
-# given a stream of data, reads a DNS-formatted name and returns its
-# total length, thus making it possible to skip past it.
-sub namelen {
-        my ($data) = @_;
-        my $len = 0;
-        my $label_len = 0;
-        do {
-                $label_len = unpack("c", $data);
-                $data = substr($data, $label_len + 1);
-                $len += $label_len + 1;
-        } while ($label_len != 0);
-        return ($len);
-}
-
-# packetlen:
-# given a stream of data, reads a DNS wire-format packet and returns
-# its total length, making it possible to skip past it.
-sub packetlen {
-        my ($data) = @_;
-        my $q;
-        my $rr;
-
-        my ($header, $offset) = Net::DNS::Header->parse(\$data);
-        for (1 .. $header->qdcount) {
-                ($q, $offset) = Net::DNS::Question->parse(\$data, $offset);
-        }
-        for (1 .. $header->ancount) {
-                ($rr, $offset) = Net::DNS::RR->parse(\$data, $offset);
-        }
-        for (1 .. $header->nscount) {
-                ($rr, $offset) = Net::DNS::RR->parse(\$data, $offset);
-        }
-        for (1 .. $header->arcount) {
-                ($rr, $offset) = Net::DNS::RR->parse(\$data, $offset);
-        }
-        return $offset;
-}
-
-# sign_tcp_continuation:
-# This is a hack to correct the problem that Net::DNS has no idea how
-# to sign multiple-message TCP responses.  Several data that are included
-# in the digest when signing a query or the first message of a response are
-# omitted when signing subsequent messages in a TCP stream.
-#
-# Net::DNS::Packet->sign_tsig() has the ability to use a custom signing
-# function (specified by calling Packet->sign_func()).  We use this
-# function as the signing function for TCP continuations, and it removes
-# the unwanted data from the digest before calling the default sign_hmac
-# function.
-sub sign_tcp_continuation {
-        my ($key, $data) = @_;
-
-        # copy out first two bytes: size of the previous MAC
-        my $rmacsize = unpack("n", $data);
-        $data = substr($data, 2);
-
-        # copy out previous MAC
-        my $rmac = substr($data, 0, $rmacsize);
-        $data = substr($data, $rmacsize);
-
-        # try parsing out the packet information
-        my $plen = packetlen($data);
-        my $pdata = substr($data, 0, $plen);
-        $data = substr($data, $plen);
-
-        # remove the keyname, ttl, class, and algorithm name
-        $data = substr($data, namelen($data));
-        $data = substr($data, 6);
-        $data = substr($data, namelen($data));
-
-        # preserve the TSIG data
-        my $tdata = substr($data, 0, 8);
-
-        # prepare a new digest and sign with it
-        $data = pack("n", $rmacsize) . $rmac . $pdata . $tdata;
-        return Net::DNS::RR::TSIG::sign_hmac($key, $data);
-}
-
-sub handleTCP {
-	my ($buf) = @_;
-	my $packet;
-
-	if ($Net::DNS::VERSION > 0.68) {
-		$packet = new Net::DNS::Packet(\$buf, 0);
-		$@ and die $@;
-	} else {
-		my $err;
-		($packet, $err) = new Net::DNS::Packet(\$buf, 0);
-		$err and die $err;
-	}
-
-	$packet->header->qr(1);
-	$packet->header->aa(1);
-
-	my @questions = $packet->question;
-	my $qname = $questions[0]->qname;
-	my $qtype = $questions[0]->qtype;
-
-        # get the existing signature if any, and clear the additional section
-        my $prev_tsig;
-        my $signer;
-        while (my $rr = $packet->pop("additional")) {
-                if ($rr->type eq "TSIG") {
-                        $prev_tsig = $rr;
-                }
-        }
-
-	my @results = ();
-	my $count_these = 0;
-
-	my $r;
-	foreach $r (@rules) {
-		my $pattern = $r->{pattern};
-		my($dbtype, $key_name, $key_data) = split(/ /,$pattern);
-		print "[handleTCP] $dbtype, $key_name, $key_data \n";
-		if ("$qname $qtype" =~ /$dbtype/) {
-			$count_these++;
-			my $a;
-			foreach $a (@{$r->{answer}}) {
-				$packet->push("answer", $a);
-			}
-			if(defined($key_name) && defined($key_data)) {
-				# sign the packet
-				print "  Signing the data with " .
-                                      "$key_name/$key_data\n";
-
-                                my $tsig = Net::DNS::RR->
-                                        new("$key_name TSIG $key_data");
-
-                                # These kluges are necessary because Net::DNS
-                                # doesn't know how to sign responses.  We
-                                # clear compnames so that the TSIG key and
-                                # algorithm name won't be compressed, and
-                                # add one to arcount because the signing
-                                # function will attempt to decrement it,
-                                # which is incorrect in a response. Finally
-                                # we set request_mac to the previous digest.
-                                $packet->{"compnames"} = {};
-                                $packet->{"header"}{"arcount"} += 1;
-                                if (defined($prev_tsig)) {
-                                        my $rmac = pack('n H*',
-                                                $prev_tsig->mac_size,
-                                                $prev_tsig->mac);
-                                        $tsig->{"request_mac"} =
-                                                unpack("H*", $rmac);
-                                }
-
-                                $tsig->sign_func($signer) if defined($signer);
-				$packet->sign_tsig($tsig);
-                                $signer = \&sign_tcp_continuation;
-
-                                my $copy =
-                                        Net::DNS::Packet->new(\($packet->data));
-                                $prev_tsig = $copy->pop("additional");
-			}
-			#$packet->print;
-			push(@results,$packet->data);
-			$packet = new Net::DNS::Packet(\$buf, 0);
-			$packet->header->qr(1);
-			$packet->header->aa(1);
-		}
-	}
-	print " A total of $count_these patterns matched\n";
-	return \@results;
-}
-
-# Main
-my $rin;
-my $rout;
-for (;;) {
-	$rin = '';
-	vec($rin, fileno($tcpsock), 1) = 1;
-	vec($rin, fileno($udpsock), 1) = 1;
-
-	select($rout = $rin, undef, undef, undef);
-
-	if (vec($rout, fileno($udpsock), 1)) {
-		printf "UDP request\n";
-		my $buf;
-		$udpsock->recv($buf, 512);
-	} elsif (vec($rout, fileno($tcpsock), 1)) {
-		my $conn = $tcpsock->accept;
-		my $buf;
-		for (;;) {
-			my $lenbuf;
-			my $n = $conn->sysread($lenbuf, 2);
-			last unless $n == 2;
-			my $len = unpack("n", $lenbuf);
-			$n = $conn->sysread($buf, $len);
-			last unless $n == $len;
-		}
-		sleep(1);
-		$conn->close;
-	}
-}
@@ -0,0 +1,20 @@
+"""
+Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+
+SPDX-License-Identifier: MPL-2.0
+
+This Source Code Form is subject to the terms of the Mozilla Public
+License, v. 2.0.  If a copy of the MPL was not distributed with this
+file, you can obtain one at https://mozilla.org/MPL/2.0/.
+
+See the COPYRIGHT file distributed with this work for additional
+information regarding copyright ownership.
+"""
+
+from isctest.asyncserver import AsyncDnsServer, IgnoreAllQueries
+
+
+if __name__ == "__main__":
+    server = AsyncDnsServer()
+    server.install_response_handler(IgnoreAllQueries())
+    server.run()
@@ -260,7 +260,7 @@ main(int argc, char *argv[]) {
 	if (printmemstats) {
 		isc_mem_stats(mctx, stdout);
 	}
-	isc_mem_destroy(&mctx);
+	isc_mem_detach(&mctx);

 	return 0;
 }
@@ -425,7 +425,7 @@ cleanup:
 	if (message != NULL) {
 		dns_message_detach(&message);
 	}
-	isc_mem_destroy(&mctx);
+	isc_mem_detach(&mctx);

 	exit(rv);
 }
@@ -61,7 +61,7 @@ cleanup(void) {
 		isc_lex_destroy(&lex);
 	}
 	if (mctx != NULL) {
-		isc_mem_destroy(&mctx);
+		isc_mem_detach(&mctx);
 	}
 }

@@ -16,7 +16,7 @@
 #
 m4_define([bind_VERSION_MAJOR], 9)dnl
 m4_define([bind_VERSION_MINOR], 21)dnl
-m4_define([bind_VERSION_PATCH], 6)dnl
+m4_define([bind_VERSION_PATCH], 7)dnl
 m4_define([bind_VERSION_EXTRA], -dev)dnl
 m4_define([bind_DESCRIPTION], [(Development Release)])dnl
 m4_define([bind_SRCID], [m4_esyscmd_s([git rev-parse --short HEAD | cut -b1-7])])dnl
@@ -886,31 +886,6 @@ AC_CHECK_HEADERS([execinfo.h],
 		 [AC_SEARCH_LIBS([backtrace_symbols], [execinfo],
 				 [AC_CHECK_FUNCS([backtrace_symbols])])])

-#
-# We do the IPv6 compilation checking after libtool so that we can put
-# the right suffix on the files.
-#
-AC_MSG_CHECKING([for IPv6 structures])
-AC_COMPILE_IFELSE(
-  [AC_LANG_PROGRAM(
-     [[
-       #include <sys/types.h>
-       #include <sys/socket.h>
-       #include <netinet/in.h>
-     ]],
-     [[
-       struct sockaddr_in6 sin6;
-       struct in6_addr in6;
-       struct in6_pktinfo in6_pi;
-       struct sockaddr_storage storage;
-       in6 = in6addr_any;
-       in6 = in6addr_loopback;
-       sin6.sin6_scope_id = 0;
-       return (0);
-     ]])],
-  [AC_MSG_RESULT([yes])],
-  [AC_MSG_FAILURE([IPv6 support is mandatory])])
-
 #
 # Allow forcibly disabling TCP Fast Open support as autodetection might yield
 # confusing results on some systems (e.g. FreeBSD; see set_tcp_fastopen()
@@ -218,6 +218,7 @@ latex_logo = "isc-logo.pdf"
 linkcheck_timeout = 10
 linkcheck_ignore = [
    "http://127.0.0.1",
+    "https://dl.acm.org",
    "https://gitlab.isc.org",
    "https://kb.isc.org",
    "https://simpleicon.com/",
@@ -3660,9 +3660,13 @@ system.
   after 20 minutes if it has remained unchanged.

   If :any:`max-clients-per-query` is set to zero, there is no upper bound, other
-   than that imposed by :any:`recursive-clients`. If :any:`clients-per-query` is
-   set to zero, :any:`max-clients-per-query` no longer applies and there is no
-   upper bound, other than that imposed by :any:`recursive-clients`.
+   than that imposed by :any:`recursive-clients`. If the option is set to a
+   lower value than :any:`clients-per-query`, the value is adjusted to
+   :any:`clients-per-query`.
+
+   If :any:`clients-per-query` is set to zero, :any:`max-clients-per-query` no
+   longer applies and there is no upper bound, other than that imposed by
+   :any:`recursive-clients`.

 .. namedconf:statement:: max-validations-per-fetch
   :tags: server
@@ -154,7 +154,7 @@ main(int argc, char **argv) {
 	if (memstats) {
 		isc_mem_stats(mctx, stderr);
 	}
-	isc_mem_destroy(&mctx);
+	isc_mem_detach(&mctx);

 	fflush(stdout);
 	if (ferror(stdout)) {
@@ -74,6 +74,6 @@ LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {

 end:
 	dns_db_detach(&db);
-	isc_mem_destroy(&mctx);
+	isc_mem_detach(&mctx);
 	return 0;
 }
@@ -211,7 +211,7 @@ LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
 	}

 	dns_qp_destroy(&qp);
-	isc_mem_destroy(&mctx);
+	isc_mem_detach(&mctx);
 	isc_mem_checkdestroyed(stderr);

 	for (size_t i = 0; i < ARRAY_SIZE(item); i++) {
@@ -145,6 +145,6 @@ LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
 cleanup:
 	isc_lex_close(lex);
 	isc_lex_destroy(&lex);
-	isc_mem_destroy(&mctx);
+	isc_mem_detach(&mctx);
 	return 0;
 }
@@ -567,7 +567,7 @@ import_rdataset(dns_adbname_t *adbname, dns_rdataset_t *rdataset,
 		rdataset->ttl = ttlclamp(rdataset->ttl);
 	}

-	REQUIRE(rdtype == dns_rdatatype_a || rdtype == dns_rdatatype_aaaa);
+	REQUIRE(dns_rdatatype_isaddr(rdtype));

 	for (result = dns_rdataset_first(rdataset); result == ISC_R_SUCCESS;
 	     result = dns_rdataset_next(rdataset))
@@ -1076,11 +1076,11 @@ new_adbfetch(dns_adb_t *adb) {
 	dns_adbfetch_t *fetch = NULL;

 	fetch = isc_mem_get(adb->hmctx, sizeof(*fetch));
-	*fetch = (dns_adbfetch_t){ 0 };
+	*fetch = (dns_adbfetch_t){
+		.magic = DNS_ADBFETCH_MAGIC,
+	};
 	dns_rdataset_init(&fetch->rdataset);

-	fetch->magic = DNS_ADBFETCH_MAGIC;
-
 	return fetch;
 }

@@ -2557,7 +2557,7 @@ dbfind_name(dns_adbname_t *adbname, isc_stdtime_t now, dns_rdatatype_t rdtype) {
 	adb = adbname->adb;

 	REQUIRE(DNS_ADB_VALID(adb));
-	REQUIRE(rdtype == dns_rdatatype_a || rdtype == dns_rdatatype_aaaa);
+	REQUIRE(dns_rdatatype_isaddr(rdtype));

 	fname = dns_fixedname_initname(&foundname);
 	dns_rdataset_init(&rdataset);
--- a/Show More
+++ b/Show More