Fix the default interface-interval docs and default value

When the interface-interval parser was changed from uint32 parser to duration parser, the default value stayed at plain 60 which now means 60 seconds instead of 60 minutes. Fix the default value and the documentation to match the reality.
chg: ci: Allow re-run of the shotgun jobs to reduce false positives
2025-03-18 14:21:29 +01:00 · 2025-03-18 09:29:10 +00:00 · 2025-03-18 10:19:32 +01:00 · 2025-03-18 10:19:32 +01:00 · 2025-03-18 05:55:17 +00:00 · 2025-03-18 06:19:01 +01:00
49 changed files with 2116 additions and 2245 deletions
@@ -383,6 +383,9 @@ stages:
        SHOTGUN_ROUNDS: 3
    - &shotgun_rule_other
      if: '$CI_PIPELINE_SOURCE =~ /^(api|pipeline|schedule|trigger|web)$/'
+  # when using data from a single run, the overall instability of the results
+  # causes quite high false positive rate, rerun the test to attemp to reduce those
+  retry: 1
  script:
    - if [ -z "$BASELINE" ]; then export BASELINE=$BIND_BASELINE_VERSION; fi  # this dotenv variable can't be set in the rules section, because rules are evaluated before any jobs run
    - PIPELINE_ID=$(curl -s -X POST --fail
@@ -584,7 +587,7 @@ vulture:
  <<: *precheck_job
  needs: []
  script:
-    - vulture --exclude "*/ans*/ans.py,conftest.py,isctest" --ignore-names "pytestmark" bin/tests/system/
+    - vulture --exclude "*ans.py,conftest.py,isctest" --ignore-names "pytestmark" bin/tests/system/

 ci-variables:
  stage: precheck
@@ -1688,9 +1691,6 @@ respdiff-third-party:

 # Performance tests

-# Run shotgun:udp right away, but delay other shotgun jobs sligthly in order to
-# allow re-use of the built container image. Otherwise, the jobs would do the
-# same builds in parallel rather than re-use the already built image.
 shotgun:udp:
  <<: *shotgun_job
  variables:
@@ -1701,7 +1701,7 @@ shotgun:tcp:
  <<: *shotgun_job
  variables:
    SHOTGUN_SCENARIO: tcp
-    SHOTGUN_TRAFFIC_MULTIPLIER: 13
+    SHOTGUN_TRAFFIC_MULTIPLIER: 12

 shotgun:dot:
  <<: *shotgun_job
@@ -1722,7 +1722,7 @@ shotgun:doh-get:
  variables:
    SHOTGUN_SCENARIO: doh-get
    SHOTGUN_TRAFFIC_MULTIPLIER: 3
-    SHOTGUN_EVAL_THRESHOLD_LATENCY_PCTL_MAX: 0.3  # bump from the default due to increased tail-end jitter
+    SHOTGUN_EVAL_THRESHOLD_LATENCY_PCTL_MAX: 0.4  # bump from the default due to increased tail-end jitter
  rules: *shotgun_rules_manual_mr

 .stress-test: &stress_test
@@ -63,7 +63,7 @@ options {\n\
 	geoip-directory \".\";\n"
 #endif /* if defined(HAVE_GEOIP2) */
 			    "\
-	interface-interval 60;\n\
+	interface-interval 60m;\n\
 	listen-on {any;};\n\
 	listen-on-v6 {any;};\n\
 	match-mapped-addresses no;\n\
@@ -129,6 +129,7 @@ static int maxudp = 0;
 /*
 * -T options:
 */
+static bool cookiealwaysvalid = false;
 static bool dropedns = false;
 static bool ednsformerr = false;
 static bool ednsnotimp = false;
@@ -652,7 +653,9 @@ parse_T_opt(char *option) {
 	 * force the server to behave (or misbehave) in
 	 * specified ways for testing purposes.
 	 */
-	if (!strcmp(option, "dropedns")) {
+	if (!strcmp(option, "cookiealwaysvalid")) {
+		cookiealwaysvalid = true;
+	} else if (!strcmp(option, "dropedns")) {
 		dropedns = true;
 	} else if (!strcmp(option, "ednsformerr")) {
 		ednsformerr = true;
@@ -1220,6 +1223,9 @@ setup(void) {
 	/*
 	 * Modify server context according to command line options
 	 */
+	if (cookiealwaysvalid) {
+		ns_server_setoption(sctx, NS_SERVER_COOKIEALWAYSVALID, true);
+	}
 	if (disable4) {
 		ns_server_setoption(sctx, NS_SERVER_DISABLE4, true);
 	}
@@ -1603,7 +1603,7 @@ xfrin_xmlrender(dns_zone_t *zone, void *arg) {
 		isc_sockaddr_format(addrp, addr_buf, sizeof(addr_buf));
 		TRY0(xmlTextWriterWriteString(writer, ISC_XMLCHAR addr_buf));
 	} else if (is_presoa) {
-		addr = dns_zone_getsourceaddr(zone);
+		dns_zone_getsourceaddr(zone, &addr);
 		isc_sockaddr_format(&addr, addr_buf, sizeof(addr_buf));
 		TRY0(xmlTextWriterWriteString(writer, ISC_XMLCHAR addr_buf));
 	} else {
@@ -2660,7 +2660,7 @@ xfrin_jsonrender(dns_zone_t *zone, void *arg) {
 		json_object_object_add(xfrinobj, "localaddr",
 				       json_object_new_string(addr_buf));
 	} else if (is_presoa) {
-		addr = dns_zone_getsourceaddr(zone);
+		dns_zone_getsourceaddr(zone, &addr);
 		isc_sockaddr_format(&addr, addr_buf, sizeof(addr_buf));
 		json_object_object_add(xfrinobj, "localaddr",
 				       json_object_new_string(addr_buf));
@@ -1279,22 +1279,22 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 		obj = NULL;
 		result = named_config_get(maps, "parental-source", &obj);
 		INSIST(result == ISC_R_SUCCESS && obj != NULL);
-		CHECK(dns_zone_setparentalsrc4(zone, cfg_obj_assockaddr(obj)));
+		dns_zone_setparentalsrc4(zone, cfg_obj_assockaddr(obj));

 		obj = NULL;
 		result = named_config_get(maps, "parental-source-v6", &obj);
 		INSIST(result == ISC_R_SUCCESS && obj != NULL);
-		CHECK(dns_zone_setparentalsrc6(zone, cfg_obj_assockaddr(obj)));
+		dns_zone_setparentalsrc6(zone, cfg_obj_assockaddr(obj));

 		obj = NULL;
 		result = named_config_get(maps, "notify-source", &obj);
 		INSIST(result == ISC_R_SUCCESS && obj != NULL);
-		CHECK(dns_zone_setnotifysrc4(zone, cfg_obj_assockaddr(obj)));
+		dns_zone_setnotifysrc4(zone, cfg_obj_assockaddr(obj));

 		obj = NULL;
 		result = named_config_get(maps, "notify-source-v6", &obj);
 		INSIST(result == ISC_R_SUCCESS && obj != NULL);
-		CHECK(dns_zone_setnotifysrc6(zone, cfg_obj_assockaddr(obj)));
+		dns_zone_setnotifysrc6(zone, cfg_obj_assockaddr(obj));

 		obj = NULL;
 		result = named_config_get(maps, "notify-to-soa", &obj);
@@ -1938,14 +1938,12 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 		obj = NULL;
 		result = named_config_get(maps, "transfer-source", &obj);
 		INSIST(result == ISC_R_SUCCESS && obj != NULL);
-		CHECK(dns_zone_setxfrsource4(mayberaw,
-					     cfg_obj_assockaddr(obj)));
+		dns_zone_setxfrsource4(mayberaw, cfg_obj_assockaddr(obj));

 		obj = NULL;
 		result = named_config_get(maps, "transfer-source-v6", &obj);
 		INSIST(result == ISC_R_SUCCESS && obj != NULL);
-		CHECK(dns_zone_setxfrsource6(mayberaw,
-					     cfg_obj_assockaddr(obj)));
+		dns_zone_setxfrsource6(mayberaw, cfg_obj_assockaddr(obj));

 		obj = NULL;
 		(void)named_config_get(maps, "try-tcp-refresh", &obj);
@@ -308,6 +308,7 @@ def logger(request, system_test_name):
@pytest.fixture(scope="module")
 def expected_artifacts(request):
    common_artifacts = [
+        "*/.hypothesis",  # drop after Ubuntu 20.04 Focal Fossa gets removed from CI
        ".libs/*",  # possible build artifacts, see GL #5055
        "ns*/named.conf",
        "ns*/named.memstats",
@@ -361,6 +361,23 @@ grep "status: NOERROR," dig.out.test$n >/dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status + ret))

+n=$((n + 1))
+echo_i "Restart NS4 with -T cookiealwaysvalid ($n)"
+stop_server ns4
+touch ns4/named.cookiealwaysvalid
+start_server --noclean --restart --port ${PORT} ns4 || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status + ret))
+
+n=$((n + 1))
+echo_i "test NS6 cookie on NS4 with -T cookiealwaysvalid (expect success) ($n)"
+ret=0
+$DIG $DIGOPTS +cookie=$ns6cookie -b 10.53.0.4 +nobadcookie soa . @10.53.0.4 >dig.out.test$n || ret=1
+grep "; COOKIE:.*(good)" dig.out.test$n >/dev/null || ret=1
+grep "status: NOERROR," dig.out.test$n >/dev/null || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status + ret))
+
 n=$((n + 1))
 echo_i "check that test server is correctly configured ($n)"
 ret=0
@@ -19,6 +19,7 @@ pytestmark = pytest.mark.extra_artifacts(
        "ans*/ans.run",
        "ans*/query.log",
        "ns1/named_dump.db*",
+        "ns4/named.cookiealwaysvalid",
    ]
 )

@@ -0,0 +1,17 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+@		30	SOA	ns2.good. hostmaster.arpa. 2018050100 1 1 1 1
+@		30	NS	ns2.good.
+
+8.2.6.0		60	NS	ns3.good.
+
+1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.8.f.4.0 1 PTR nee.com.
@@ -1,456 +1,111 @@
-# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-#
-# SPDX-License-Identifier: MPL-2.0
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0.  If a copy of the MPL was not distributed with this
-# file, you can obtain one at https://mozilla.org/MPL/2.0/.
-#
-# See the COPYRIGHT file distributed with this work for additional
-# information regarding copyright ownership.
+"""
+Copyright (C) Internet Systems Consortium, Inc. ("ISC")

-from __future__ import print_function
-import os
-import sys
-import signal
-import socket
-import select
-from datetime import datetime, timedelta
-import time
-import functools
+SPDX-License-Identifier: MPL-2.0

-import dns, dns.message, dns.query, dns.flags
-from dns.rdatatype import *
-from dns.rdataclass import *
-from dns.rcode import *
-from dns.name import *
+This Source Code Form is subject to the terms of the Mozilla Public
+License, v. 2.0.  If a copy of the MPL was not distributed with this
+file, you can obtain one at https://mozilla.org/MPL/2.0/.
+
+See the COPYRIGHT file distributed with this work for additional
+information regarding copyright ownership.
+"""
+
+from typing import AsyncGenerator
+
+import dns.message
+import dns.name
+import dns.rcode
+import dns.rdataclass
+import dns.rdatatype
+
+from isctest.asyncserver import (
+    AsyncDnsServer,
+    DnsResponseSend,
+    DomainHandler,
+    QueryContext,
+    ResponseAction,
+)
+
+from qmin_ans import (
+    DelayedResponseHandler,
+    EntRcodeChanger,
+    QueryLogHandler,
+    log_query,
+)


-# Log query to file
-def logquery(type, qname):
-    with open("qlog", "a") as f:
-        f.write("%s %s\n", type, qname)
+class QueryLogger(QueryLogHandler):
+    domains = ["1.0.0.2.ip6.arpa.", "fwd.", "good."]


-def endswith(domain, labels):
-    return domain.endswith("." + labels) or domain == labels
+class BadHandler(EntRcodeChanger):
+    domains = ["bad."]
+    rcode = dns.rcode.NXDOMAIN


-############################################################################
-# Respond to a DNS query.
-# For good. it serves:
-# ns2.good. IN A 10.53.0.2
-# zoop.boing.good. NS ns3.good.
-# ns3.good. IN A 10.53.0.3
-# too.many.labels.a.b.c.d.e.f.g.h.i.j.k.l.m.n.o.p.q.r.s.t.u.v.w.x.y.z.good. A 192.0.2.2
-# it responds properly (with NODATA empty response) to non-empty terminals
-#
-# For slow. it works the same as for good., but each response is delayed by 400 milliseconds
-#
-# For bad. it works the same as for good., but returns NXDOMAIN to non-empty terminals
-#
-# For ugly. it works the same as for good., but returns garbage to non-empty terminals
-#
-# For 1.0.0.2.ip6.arpa it serves
-# 1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.8.f.4.0.1.0.0.2.ip6.arpa. IN PTR nee.com.
-# 8.2.6.0.1.0.0.2.ip6.arpa IN NS ns3.good
-# 1.0.0.2.ip6.arpa. IN NS ns2.good
-# ip6.arpa. IN NS ns2.good
-#
-# For stale. it serves:
-# a.b. NS ns.a.b.stale.
-# ns.a.b.stale. IN A 10.53.0.3
-# b. NS ns.b.stale.
-# ns.b.stale. IN A 10.53.0.4
-############################################################################
-def create_response(msg):
-    m = dns.message.from_wire(msg)
-    qname = m.question[0].name.to_text()
-    lqname = qname.lower()
-    labels = lqname.split(".")
-
-    # get qtype
-    rrtype = m.question[0].rdtype
-    typename = dns.rdatatype.to_text(rrtype)
-    if typename == "A" or typename == "AAAA":
-        typename = "ADDR"
-    bad = False
-    ugly = False
-    slow = False
-
-    # log this query
-    with open("query.log", "a") as f:
-        f.write("%s %s\n" % (typename, lqname))
-        print("%s %s" % (typename, lqname), end=" ")
-
-    r = dns.message.make_response(m)
-    r.set_rcode(NOERROR)
-
-    if endswith(lqname, "1.0.0.2.ip6.arpa."):
-        # Direct query - give direct answer
-        if endswith(lqname, "8.2.6.0.1.0.0.2.ip6.arpa."):
-            # Delegate to ns3
-            r.authority.append(
-                dns.rrset.from_text(
-                    "8.2.6.0.1.0.0.2.ip6.arpa.", 60, IN, NS, "ns3.good."
-                )
-            )
-            r.additional.append(
-                dns.rrset.from_text("ns3.good.", 60, IN, A, "10.53.0.3")
-            )
-        elif (
-            lqname
-            == "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.8.f.4.0.1.0.0.2.ip6.arpa."
-            and rrtype == PTR
-        ):
-            # Direct query - give direct answer
-            r.answer.append(
-                dns.rrset.from_text(
-                    "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.8.f.4.0.1.0.0.2.ip6.arpa.",
-                    1,
-                    IN,
-                    PTR,
-                    "nee.com.",
-                )
-            )
-            r.flags |= dns.flags.AA
-        elif lqname == "1.0.0.2.ip6.arpa." and rrtype == NS:
-            # NS query at the apex
-            r.answer.append(
-                dns.rrset.from_text("1.0.0.2.ip6.arpa.", 30, IN, NS, "ns2.good.")
-            )
-            r.flags |= dns.flags.AA
-        elif endswith(
-            "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.8.f.4.0.1.0.0.2.ip6.arpa.",
-            lqname,
-        ):
-            # NODATA answer
-            r.authority.append(
-                dns.rrset.from_text(
-                    "1.0.0.2.ip6.arpa.",
-                    30,
-                    IN,
-                    SOA,
-                    "ns2.good. hostmaster.arpa. 2018050100 1 1 1 1",
-                )
-            )
-        else:
-            # NXDOMAIN
-            r.authority.append(
-                dns.rrset.from_text(
-                    "1.0.0.2.ip6.arpa.",
-                    30,
-                    IN,
-                    SOA,
-                    "ns2.good. hostmaster.arpa. 2018050100 1 1 1 1",
-                )
-            )
-            r.set_rcode(NXDOMAIN)
-        return r
-    elif endswith(lqname, "ip6.arpa."):
-        if lqname == "ip6.arpa." and rrtype == NS:
-            # NS query at the apex
-            r.answer.append(dns.rrset.from_text("ip6.arpa.", 30, IN, NS, "ns2.good."))
-            r.flags |= dns.flags.AA
-        elif endswith("1.0.0.2.ip6.arpa.", lqname):
-            # NODATA answer
-            r.authority.append(
-                dns.rrset.from_text(
-                    "ip6.arpa.",
-                    30,
-                    IN,
-                    SOA,
-                    "ns2.good. hostmaster.arpa. 2018050100 1 1 1 1",
-                )
-            )
-        else:
-            # NXDOMAIN
-            r.authority.append(
-                dns.rrset.from_text(
-                    "ip6.arpa.",
-                    30,
-                    IN,
-                    SOA,
-                    "ns2.good. hostmaster.arpa. 2018050100 1 1 1 1",
-                )
-            )
-            r.set_rcode(NXDOMAIN)
-        return r
-    elif endswith(lqname, "stale."):
-        if endswith(lqname, "a.b.stale."):
-            # Delegate to ns.a.b.stale.
-            r.authority.append(
-                dns.rrset.from_text("a.b.stale.", 2, IN, NS, "ns.a.b.stale.")
-            )
-            r.additional.append(
-                dns.rrset.from_text("ns.a.b.stale.", 2, IN, A, "10.53.0.3")
-            )
-        elif endswith(lqname, "b.stale."):
-            # Delegate to ns.b.stale.
-            r.authority.append(
-                dns.rrset.from_text("b.stale.", 2, IN, NS, "ns.b.stale.")
-            )
-            r.additional.append(
-                dns.rrset.from_text("ns.b.stale.", 2, IN, A, "10.53.0.4")
-            )
-        elif lqname == "stale." and rrtype == NS:
-            # NS query at the apex.
-            r.answer.append(dns.rrset.from_text("stale.", 2, IN, NS, "ns2.stale."))
-            r.flags |= dns.flags.AA
-        elif lqname == "stale." and rrtype == SOA:
-            # SOA query at the apex.
-            r.answer.append(
-                dns.rrset.from_text(
-                    "stale.", 2, IN, SOA, "ns2.stale. hostmaster.stale. 1 2 3 4 5"
-                )
-            )
-            r.flags |= dns.flags.AA
-        elif lqname == "stale.":
-            # NODATA answer
-            r.authority.append(
-                dns.rrset.from_text(
-                    "stale.", 2, IN, SOA, "ns2.stale. hostmaster.arpa. 1 2 3 4 5"
-                )
-            )
-            r.flags |= dns.flags.AA
-        elif lqname == "ns2.stale.":
-            if rrtype == A:
-                r.additional.append(
-                    dns.rrset.from_text("ns.b.stale.", 2, IN, A, "10.53.0.2")
-                )
-            else:
-                r.authority.append(
-                    dns.rrset.from_text(
-                        "stale.", 2, IN, SOA, "ns2.stale. hostmaster.arpa. 1 2 3 4 5"
-                    )
-                )
-            r.flags |= dns.flags.AA
-        else:
-            # NXDOMAIN
-            r.authority.append(
-                dns.rrset.from_text(
-                    "stale.", 2, IN, SOA, "ns2.stale. hostmaster.arpa. 1 2 3 4 5"
-                )
-            )
-            r.set_rcode(NXDOMAIN)
-        return r
-    elif endswith(lqname, "bad."):
-        bad = True
-        suffix = "bad."
-        lqname = lqname[:-4]
-    elif endswith(lqname, "ugly."):
-        ugly = True
-        suffix = "ugly."
-        lqname = lqname[:-5]
-    elif endswith(lqname, "good."):
-        suffix = "good."
-        lqname = lqname[:-5]
-    elif endswith(lqname, "slow."):
-        slow = True
-        suffix = "slow."
-        lqname = lqname[:-5]
-    elif endswith(lqname, "fwd."):
-        suffix = "fwd."
-        lqname = lqname[:-4]
-    else:
-        r.set_rcode(REFUSED)
-        return r
-
-    # Good/bad/ugly differs only in how we treat non-empty terminals
-    if endswith(lqname, "zoop.boing."):
-        r.authority.append(
-            dns.rrset.from_text("zoop.boing." + suffix, 1, IN, NS, "ns3." + suffix)
-        )
-    elif (
-        lqname == "many.labels.a.b.c.d.e.f.g.h.i.j.k.l.m.n.o.p.q.r.s.t.u.v.w.x.y.z."
-        and rrtype == A
-    ):
-        r.answer.append(dns.rrset.from_text(lqname + suffix, 1, IN, A, "192.0.2.2"))
-        r.flags |= dns.flags.AA
-    elif lqname == "" and rrtype == NS:
-        r.answer.append(dns.rrset.from_text(suffix, 30, IN, NS, "ns2." + suffix))
-        r.flags |= dns.flags.AA
-    elif lqname == "ns2.":
-        r.flags |= dns.flags.AA
-        if rrtype == A:
-            r.answer.append(
-                dns.rrset.from_text("ns2." + suffix, 30, IN, A, "10.53.0.2")
-            )
-        elif rrtype == AAAA:
-            r.answer.append(
-                dns.rrset.from_text(
-                    "ns2." + suffix, 30, IN, AAAA, "fd92:7065:b8e:ffff::2"
-                )
-            )
-        else:
-            r.authority.append(
-                dns.rrset.from_text(
-                    suffix,
-                    30,
-                    IN,
-                    SOA,
-                    "ns2." + suffix + " hostmaster.arpa. 2018050100 1 1 1 1",
-                )
-            )
-    elif lqname == "ns3.":
-        r.flags |= dns.flags.AA
-        if rrtype == A:
-            r.answer.append(
-                dns.rrset.from_text("ns3." + suffix, 30, IN, A, "10.53.0.3")
-            )
-        elif lqname == "ns3." and rrtype == AAAA:
-            r.answer.append(
-                dns.rrset.from_text(
-                    "ns3." + suffix, 30, IN, AAAA, "fd92:7065:b8e:ffff::3"
-                )
-            )
-        else:
-            r.authority.append(
-                dns.rrset.from_text(
-                    suffix,
-                    30,
-                    IN,
-                    SOA,
-                    "ns2." + suffix + " hostmaster.arpa. 2018050100 1 1 1 1",
-                )
-            )
-    elif lqname == "ns4.":
-        r.flags |= dns.flags.AA
-        if rrtype == A:
-            r.answer.append(
-                dns.rrset.from_text("ns4." + suffix, 30, IN, A, "10.53.0.4")
-            )
-        elif rrtype == AAAA:
-            r.answer.append(
-                dns.rrset.from_text(
-                    "ns4." + suffix, 30, IN, AAAA, "fd92:7065:b8e:ffff::4"
-                )
-            )
-        else:
-            r.authority.append(
-                dns.rrset.from_text(
-                    suffix,
-                    30,
-                    IN,
-                    SOA,
-                    "ns2." + suffix + " hostmaster.arpa. 2018050100 1 1 1 1",
-                )
-            )
-    elif lqname == "a.bit.longer.ns.name." and rrtype == A:
-        r.answer.append(
-            dns.rrset.from_text("a.bit.longer.ns.name." + suffix, 1, IN, A, "10.53.0.4")
-        )
-        r.flags |= dns.flags.AA
-    elif lqname == "a.bit.longer.ns.name." and rrtype == AAAA:
-        r.answer.append(
-            dns.rrset.from_text(
-                "a.bit.longer.ns.name." + suffix, 1, IN, AAAA, "fd92:7065:b8e:ffff::4"
-            )
-        )
-        r.flags |= dns.flags.AA
-    else:
-        r.authority.append(
-            dns.rrset.from_text(
-                suffix,
-                1,
-                IN,
-                SOA,
-                "ns2." + suffix + " hostmaster.arpa. 2018050100 1 1 1 1",
-            )
-        )
-        if bad or not (
-            endswith("icky.icky.icky.ptang.zoop.boing.", lqname)
-            or endswith(
-                "many.labels.a.b.c.d.e.f.g.h.i.j.k.l.m.n.o.p.q.r.s.t.u.v.w.x.y.z.",
-                lqname,
-            )
-            or endswith("a.bit.longer.ns.name.", lqname)
-        ):
-            r.set_rcode(NXDOMAIN)
-        if ugly:
-            r.set_rcode(FORMERR)
-    if slow:
-        time.sleep(0.2)
-    return r
+class UglyHandler(EntRcodeChanger):
+    domains = ["ugly."]
+    rcode = dns.rcode.FORMERR


-def sigterm(signum, frame):
-    print("Shutting down now...")
-    os.remove("ans.pid")
-    running = False
-    sys.exit(0)
+class SlowHandler(DelayedResponseHandler):
+    domains = ["slow."]
+    delay = 0.2


-############################################################################
-# Main
-#
-# Set up responder and control channel, open the pid file, and start
-# the main loop, listening for queries on the query channel or commands
-# on the control channel and acting on them.
-############################################################################
-ip4 = "10.53.0.2"
-ip6 = "fd92:7065:b8e:ffff::2"
+def send_delegation(
+    qctx: QueryContext, zone_cut: dns.name.Name, target_addr: str
+) -> ResponseAction:
+    """
+    Delegate `zone_cut` to a single in-bailiwick name server, `ns.<zone_cut>`,
+    with a single IPv4 glue record (provided in `target_addr`) included in the
+    ADDITIONAL section.
+    """
+    ns_name = "ns." + zone_cut.to_text()
+    ns_rrset = dns.rrset.from_text(
+        zone_cut, 2, dns.rdataclass.IN, dns.rdatatype.NS, ns_name
+    )
+    a_rrset = dns.rrset.from_text(
+        ns_name, 2, dns.rdataclass.IN, dns.rdatatype.A, target_addr
+    )

-try:
-    port = int(os.environ["PORT"])
-except:
-    port = 5300
+    response = dns.message.make_response(qctx.query)
+    response.set_rcode(dns.rcode.NOERROR)
+    response.authority.append(ns_rrset)
+    response.additional.append(a_rrset)

-query4_socket = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
-query4_socket.bind((ip4, port))
+    return DnsResponseSend(response, authoritative=False)

-havev6 = True
-try:
-    query6_socket = socket.socket(socket.AF_INET6, socket.SOCK_DGRAM)
-    try:
-        query6_socket.bind((ip6, port))
-    except:
-        query6_socket.close()
-        havev6 = False
-except:
-    havev6 = False

-signal.signal(signal.SIGTERM, sigterm)
+class StaleHandler(DomainHandler):
+    """
+    `a.b.stale` is a subdomain of `b.stale` and these two subdomains need to be
+    delegated to different name servers.  Therefore, their delegations cannot
+    be placed in the zone file because the zone cut at `b.stale` would occlude
+    the one at `a.b.stale`.  Generate these delegations dynamically depending
+    on the QNAME.
+    """

-f = open("ans.pid", "w")
-pid = os.getpid()
-print(pid, file=f)
-f.close()
+    domains = ["stale."]

-running = True
+    async def get_responses(
+        self, qctx: QueryContext
+    ) -> AsyncGenerator[ResponseAction, None]:
+        log_query(qctx)
+        a_b_stale = dns.name.from_text("a.b.stale.")
+        b_stale = dns.name.from_text("b.stale.")
+        if qctx.qname.is_subdomain(a_b_stale):
+            yield send_delegation(qctx, a_b_stale, "10.53.0.3")
+        elif qctx.qname.is_subdomain(b_stale):
+            yield send_delegation(qctx, b_stale, "10.53.0.4")

-print("Listening on %s port %d" % (ip4, port))
-if havev6:
-    print("Listening on %s port %d" % (ip6, port))
-print("Ctrl-c to quit")

-if havev6:
-    input = [query4_socket, query6_socket]
-else:
-    input = [query4_socket]
-
-while running:
-    try:
-        inputready, outputready, exceptready = select.select(input, [], [])
-    except select.error as e:
-        break
-    except socket.error as e:
-        break
-    except KeyboardInterrupt:
-        break
-
-    for s in inputready:
-        if s == query4_socket or s == query6_socket:
-            print(
-                "Query received on %s" % (ip4 if s == query4_socket else ip6), end=" "
-            )
-            # Handle incoming queries
-            msg = s.recvfrom(65535)
-            rsp = create_response(msg[0])
-            if rsp:
-                print(dns.rcode.to_text(rsp.rcode()))
-                s.sendto(rsp.to_wire(), msg[1])
-            else:
-                print("NO RESPONSE")
-    if not running:
-        break
+if __name__ == "__main__":
+    server = AsyncDnsServer()
+    server.install_response_handler(QueryLogger())
+    server.install_response_handler(BadHandler())
+    server.install_response_handler(UglyHandler())
+    server.install_response_handler(SlowHandler())
+    server.install_response_handler(StaleHandler())
+    server.run()
@@ -0,0 +1 @@
+good.db
@@ -0,0 +1 @@
+good.db
@@ -0,0 +1,26 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+@			1	SOA	ns2 hostmaster.arpa. 2018050100 1 1 1 1
+
+@			30	NS	ns2
+ns2			30	A	10.53.0.2
+			30	AAAA	fd92:7065:b8e:ffff::2
+
+zoop.boing		30	NS	ns3
+ns3			30	A	10.53.0.3
+			30	AAAA	fd92:7065:b8e:ffff::3
+
+ns4			30	A	10.53.0.4
+			30	AAAA	fd92:7065:b8e:ffff::4
+
+a.bit.longer.ns.name	1	A	10.53.0.4
+			1	AAAA	fd92:7065:b8e:ffff::4
@@ -0,0 +1 @@
+good.db
@@ -0,0 +1,15 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+@	2	SOA	ns2 hostmaster.stale. 1 2 3 4 5
+@	2	NS	ns2
+ns2	2	A	10.53.0.2
+	2	AAAA	fd92:7065:b8e:ffff::2
@@ -0,0 +1 @@
+good.db
@@ -0,0 +1,15 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+@		30	SOA	ns3.good. hostmaster.arpa. 2018050100 1 1 1 1
+@		30	NS	ns3.good.
+
+1.1.1.1		60	NS	ns4.good.
@@ -0,0 +1,15 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+@	1	SOA	ns hostmaster.a.b.stale. 1 2 3 4 5
+@	1	NS	ns
+@	1	TXT	"peekaboo"
+ns	1	A	10.53.0.3
@@ -1,285 +1,46 @@
-# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-#
-# SPDX-License-Identifier: MPL-2.0
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0.  If a copy of the MPL was not distributed with this
-# file, you can obtain one at https://mozilla.org/MPL/2.0/.
-#
-# See the COPYRIGHT file distributed with this work for additional
-# information regarding copyright ownership.
+"""
+Copyright (C) Internet Systems Consortium, Inc. ("ISC")

-from __future__ import print_function
-import os
-import sys
-import signal
-import socket
-import select
-from datetime import datetime, timedelta
-import time
-import functools
+SPDX-License-Identifier: MPL-2.0

-import dns, dns.message, dns.query, dns.flags
-from dns.rdatatype import *
-from dns.rdataclass import *
-from dns.rcode import *
-from dns.name import *
+This Source Code Form is subject to the terms of the Mozilla Public
+License, v. 2.0.  If a copy of the MPL was not distributed with this
+file, you can obtain one at https://mozilla.org/MPL/2.0/.
+
+See the COPYRIGHT file distributed with this work for additional
+information regarding copyright ownership.
+"""
+
+import dns.rcode
+
+from isctest.asyncserver import AsyncDnsServer
+
+from qmin_ans import DelayedResponseHandler, EntRcodeChanger, QueryLogHandler


-# Log query to file
-def logquery(type, qname):
-    with open("qlog", "a") as f:
-        f.write("%s %s\n", type, qname)
+class QueryLogger(QueryLogHandler):
+    domains = ["8.2.6.0.1.0.0.2.ip6.arpa.", "a.b.stale.", "zoop.boing.good."]


-def endswith(domain, labels):
-    return domain.endswith("." + labels) or domain == labels
+class ZoopBoingBadHandler(EntRcodeChanger):
+    domains = ["zoop.boing.bad."]
+    rcode = dns.rcode.NXDOMAIN


-############################################################################
-# Respond to a DNS query.
-# For good. it serves:
-# zoop.boing.good. NS ns3.good.
-# icky.ptang.zoop.boing.good. NS a.bit.longer.ns.name.good.
-# it responds properly (with NODATA empty response) to non-empty terminals
-#
-# For slow. it works the same as for good., but each response is delayed by 400 milliseconds
-#
-# For bad. it works the same as for good., but returns NXDOMAIN to non-empty terminals
-#
-# For ugly. it works the same as for good., but returns garbage to non-empty terminals
-#
-# For stale. it serves:
-# a.b.stale. IN TXT peekaboo (resolver did not do qname minimization)
-############################################################################
-def create_response(msg):
-    m = dns.message.from_wire(msg)
-    qname = m.question[0].name.to_text()
-    lqname = qname.lower()
-    labels = lqname.split(".")
-    suffix = ""
-
-    # get qtype
-    rrtype = m.question[0].rdtype
-    typename = dns.rdatatype.to_text(rrtype)
-    if typename == "A" or typename == "AAAA":
-        typename = "ADDR"
-    bad = False
-    ugly = False
-    slow = False
-
-    # log this query
-    with open("query.log", "a") as f:
-        f.write("%s %s\n" % (typename, lqname))
-        print("%s %s" % (typename, lqname), end=" ")
-
-    r = dns.message.make_response(m)
-    r.set_rcode(NOERROR)
-
-    ip6req = False
-
-    if endswith(lqname, "bad."):
-        bad = True
-        suffix = "bad."
-        lqname = lqname[:-4]
-    elif endswith(lqname, "ugly."):
-        ugly = True
-        suffix = "ugly."
-        lqname = lqname[:-5]
-    elif endswith(lqname, "good."):
-        suffix = "good."
-        lqname = lqname[:-5]
-    elif endswith(lqname, "slow."):
-        slow = True
-        suffix = "slow."
-        lqname = lqname[:-5]
-    elif endswith(lqname, "8.2.6.0.1.0.0.2.ip6.arpa."):
-        ip6req = True
-    elif endswith(lqname, "a.b.stale."):
-        if lqname == "a.b.stale.":
-            r.flags |= dns.flags.AA
-            if rrtype == TXT:
-                # Direct query.
-                r.answer.append(dns.rrset.from_text(lqname, 1, IN, TXT, "peekaboo"))
-            elif rrtype == NS:
-                # NS a.b.
-                r.answer.append(dns.rrset.from_text(lqname, 1, IN, NS, "ns.a.b.stale."))
-                r.additional.append(
-                    dns.rrset.from_text("ns.a.b.stale.", 1, IN, A, "10.53.0.3")
-                )
-            elif rrtype == SOA:
-                # SOA a.b.
-                r.answer.append(
-                    dns.rrset.from_text(
-                        lqname, 1, IN, SOA, "a.b.stale. hostmaster.a.b.stale. 1 2 3 4 5"
-                    )
-                )
-            else:
-                # NODATA.
-                r.authority.append(
-                    dns.rrset.from_text(
-                        lqname, 1, IN, SOA, "a.b.stale. hostmaster.a.b.stale. 1 2 3 4 5"
-                    )
-                )
-        elif lqname == "ns.a.b.stale.":
-            r.flags |= dns.flags.AA
-            if rrtype == A:
-                r.answer.append(
-                    dns.rrset.from_text("ns.a.b.stale.", 1, IN, A, "10.53.0.3")
-                )
-            else:
-                r.authority.append(
-                    dns.rrset.from_text(
-                        lqname, 1, IN, SOA, "a.b.stale. hostmaster.a.b.stale. 1 2 3 4 5"
-                    )
-                )
-        else:
-            r.flags |= dns.flags.AA
-            r.authority.append(
-                dns.rrset.from_text(
-                    lqname, 1, IN, SOA, "a.b.stale. hostmaster.a.b.stale. 1 2 3 4 5"
-                )
-            )
-            r.set_rcode(NXDOMAIN)
-            # NXDOMAIN.
-        return r
-    else:
-        r.set_rcode(REFUSED)
-        return r
-
-    # Good/bad differs only in how we treat non-empty terminals
-    if lqname == "zoop.boing." and rrtype == NS:
-        r.answer.append(
-            dns.rrset.from_text(lqname + suffix, 1, IN, NS, "ns3." + suffix)
-        )
-        r.flags |= dns.flags.AA
-    elif endswith(lqname, "icky.ptang.zoop.boing."):
-        r.authority.append(
-            dns.rrset.from_text(
-                "icky.ptang.zoop.boing." + suffix,
-                1,
-                IN,
-                NS,
-                "a.bit.longer.ns.name." + suffix,
-            )
-        )
-    elif endswith("icky.ptang.zoop.boing.", lqname):
-        r.authority.append(
-            dns.rrset.from_text(
-                "zoop.boing." + suffix,
-                1,
-                IN,
-                SOA,
-                "ns3." + suffix + " hostmaster.arpa. 2018050100 1 1 1 1",
-            )
-        )
-        if bad:
-            r.set_rcode(NXDOMAIN)
-        if ugly:
-            r.set_rcode(FORMERR)
-    elif endswith(lqname, "zoop.boing."):
-        r.authority.append(
-            dns.rrset.from_text(
-                "zoop.boing." + suffix,
-                1,
-                IN,
-                SOA,
-                "ns3." + suffix + " hostmaster.arpa. 2018050100 1 1 1 1",
-            )
-        )
-        r.set_rcode(NXDOMAIN)
-    elif ip6req:
-        r.authority.append(
-            dns.rrset.from_text(
-                "1.1.1.1.8.2.6.0.1.0.0.2.ip6.arpa.", 60, IN, NS, "ns4.good."
-            )
-        )
-        r.additional.append(dns.rrset.from_text("ns4.good.", 60, IN, A, "10.53.0.4"))
-    else:
-        r.set_rcode(REFUSED)
-
-    if slow:
-        time.sleep(0.4)
-    return r
+class ZoopBoingUglyHandler(EntRcodeChanger):
+    domains = ["zoop.boing.ugly."]
+    rcode = dns.rcode.FORMERR


-def sigterm(signum, frame):
-    print("Shutting down now...")
-    os.remove("ans.pid")
-    running = False
-    sys.exit(0)
+class ZoopBoingSlowHandler(DelayedResponseHandler):
+    domains = ["zoop.boing.slow."]
+    delay = 0.4


-############################################################################
-# Main
-#
-# Set up responder and control channel, open the pid file, and start
-# the main loop, listening for queries on the query channel or commands
-# on the control channel and acting on them.
-############################################################################
-ip4 = "10.53.0.3"
-ip6 = "fd92:7065:b8e:ffff::3"
-
-try:
-    port = int(os.environ["PORT"])
-except:
-    port = 5300
-
-query4_socket = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
-query4_socket.bind((ip4, port))
-
-havev6 = True
-try:
-    query6_socket = socket.socket(socket.AF_INET6, socket.SOCK_DGRAM)
-    try:
-        query6_socket.bind((ip6, port))
-    except:
-        query6_socket.close()
-        havev6 = False
-except:
-    havev6 = False
-
-signal.signal(signal.SIGTERM, sigterm)
-
-f = open("ans.pid", "w")
-pid = os.getpid()
-print(pid, file=f)
-f.close()
-
-running = True
-
-print("Listening on %s port %d" % (ip4, port))
-if havev6:
-    print("Listening on %s port %d" % (ip6, port))
-print("Ctrl-c to quit")
-
-if havev6:
-    input = [query4_socket, query6_socket]
-else:
-    input = [query4_socket]
-
-while running:
-    try:
-        inputready, outputready, exceptready = select.select(input, [], [])
-    except select.error as e:
-        break
-    except socket.error as e:
-        break
-    except KeyboardInterrupt:
-        break
-
-    for s in inputready:
-        if s == query4_socket or s == query6_socket:
-            print(
-                "Query received on %s" % (ip4 if s == query4_socket else ip6), end=" "
-            )
-            # Handle incoming queries
-            msg = s.recvfrom(65535)
-            rsp = create_response(msg[0])
-            if rsp:
-                print(dns.rcode.to_text(rsp.rcode()))
-                s.sendto(rsp.to_wire(), msg[1])
-            else:
-                print("NO RESPONSE")
-    if not running:
-        break
+if __name__ == "__main__":
+    server = AsyncDnsServer()
+    server.install_response_handler(QueryLogger())
+    server.install_response_handler(ZoopBoingBadHandler())
+    server.install_response_handler(ZoopBoingUglyHandler())
+    server.install_response_handler(ZoopBoingSlowHandler())
+    server.run()
@@ -0,0 +1,14 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+@			1	SOA	ns3.bad. hostmaster.arpa. 2018050100 1 1 1 1
+@			1	NS	ns3.bad.
+icky.ptang		1	NS	a.bit.longer.ns.name.bad.
@@ -0,0 +1,14 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+@			1	SOA	ns3.good. hostmaster.arpa. 2018050100 1 1 1 1
+@			1	NS	ns3.good.
+icky.ptang		1	NS	a.bit.longer.ns.name.good.
@@ -0,0 +1,14 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+@			1	SOA	ns3.slow. hostmaster.arpa. 2018050100 1 1 1 1
+@			1	NS	ns3.slow.
+icky.ptang		1	NS	a.bit.longer.ns.name.slow.
@@ -0,0 +1,14 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+@			1	SOA	ns3.ugly. hostmaster.arpa. 2018050100 1 1 1 1
+@			1	NS	ns3.ugly.
+icky.ptang		1	NS	a.bit.longer.ns.name.ugly.
@@ -0,0 +1,15 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+@		30	SOA	ns4.good. hostmaster.arpa. 2018050100 1 1 1 1
+@		30	NS	ns4.good.
+
+test1.test2.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.9.0.9.4 1 TXT "long_ip6_name"
@@ -0,0 +1,15 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+@	1	SOA	ns hostmaster.a.b.stale. 1 2 3 4 5
+@	1	NS	ns
+ns	1	A	10.53.0.4
+@	1	TXT	"hooray"
@@ -1,345 +1,93 @@
-# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-#
-# SPDX-License-Identifier: MPL-2.0
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0.  If a copy of the MPL was not distributed with this
-# file, you can obtain one at https://mozilla.org/MPL/2.0/.
-#
-# See the COPYRIGHT file distributed with this work for additional
-# information regarding copyright ownership.
+"""
+Copyright (C) Internet Systems Consortium, Inc. ("ISC")

-from __future__ import print_function
-import os
-import sys
-import signal
-import socket
-import select
-from datetime import datetime, timedelta
-import time
-import functools
+SPDX-License-Identifier: MPL-2.0

-import dns, dns.message, dns.query, dns.flags
-from dns.rdatatype import *
-from dns.rdataclass import *
-from dns.rcode import *
-from dns.name import *
+This Source Code Form is subject to the terms of the Mozilla Public
+License, v. 2.0.  If a copy of the MPL was not distributed with this
+file, you can obtain one at https://mozilla.org/MPL/2.0/.
+
+See the COPYRIGHT file distributed with this work for additional
+information regarding copyright ownership.
+"""
+
+from typing import AsyncGenerator
+
+import dns.rcode
+
+from isctest.asyncserver import (
+    AsyncDnsServer,
+    DnsResponseSend,
+    DomainHandler,
+    QueryContext,
+    ResponseAction,
+)
+
+from qmin_ans import DelayedResponseHandler, EntRcodeChanger, QueryLogHandler, log_query


-# Log query to file
-def logquery(type, qname):
-    with open("qlog", "a") as f:
-        f.write("%s %s\n", type, qname)
+class QueryLogger(QueryLogHandler):
+    domains = [
+        "1.1.1.1.8.2.6.0.1.0.0.2.ip6.arpa.",
+        "icky.ptang.zoop.boing.good.",
+    ]


-def endswith(domain, labels):
-    return domain.endswith("." + labels) or domain == labels
+class StaleHandler(DomainHandler):
+    """
+    The test code relies on this server returning non-minimal (i.e. including
+    address records in the ADDITIONAL section) responses to NS queries for
+    `b.stale` and `a.b.stale`.  While this logic (returning non-minimal
+    responses to NS queries) could be implemented in AsyncDnsServer itself,
+    doing so breaks a lot of other checks in this system test.  Therefore, only
+    these two zones behave in this particular way, thanks to a custom response
+    handler implemented below.
+    """
+
+    domains = ["b.stale", "a.b.stale"]
+
+    async def get_responses(
+        self, qctx: QueryContext
+    ) -> AsyncGenerator[ResponseAction, None]:
+        log_query(qctx)
+
+        if qctx.qtype == dns.rdatatype.NS:
+            assert qctx.zone
+            assert qctx.response.answer[0]
+
+            for nameserver in qctx.response.answer[0]:
+                if not nameserver.target.is_subdomain(qctx.response.answer[0].name):
+                    continue
+                glue_a = qctx.zone.get_rrset(nameserver.target, dns.rdatatype.A)
+                if glue_a:
+                    qctx.response.additional.append(glue_a)
+                glue_aaaa = qctx.zone.get_rrset(nameserver.target, dns.rdatatype.AAAA)
+                if glue_aaaa:
+                    qctx.response.additional.append(glue_aaaa)
+
+        yield DnsResponseSend(qctx.response)


-############################################################################
-# Respond to a DNS query.
-# For good. it serves:
-# icky.ptang.zoop.boing.good. NS a.bit.longer.ns.name.
-# icky.icky.icky.ptang.zoop.boing.good. A 192.0.2.1
-# more.icky.icky.icky.ptang.zoop.boing.good. A 192.0.2.2
-# it responds properly (with NODATA empty response) to non-empty terminals
-#
-# For slow. it works the same as for good., but each response is delayed by 400 milliseconds
-#
-# For bad. it works the same as for good., but returns NXDOMAIN to non-empty terminals
-#
-# For ugly. it works the same as for good., but returns garbage to non-empty terminals
-#
-# For stale. it serves:
-# a.b.stale. IN TXT hooray (resolver did do qname minimization)
-############################################################################
-def create_response(msg):
-    m = dns.message.from_wire(msg)
-    qname = m.question[0].name.to_text()
-    lqname = qname.lower()
-    labels = lqname.split(".")
-    suffix = ""
-
-    # get qtype
-    rrtype = m.question[0].rdtype
-    typename = dns.rdatatype.to_text(rrtype)
-    if typename == "A" or typename == "AAAA":
-        typename = "ADDR"
-    bad = False
-    slow = False
-    ugly = False
-
-    # log this query
-    with open("query.log", "a") as f:
-        f.write("%s %s\n" % (typename, lqname))
-        print("%s %s" % (typename, lqname), end=" ")
-
-    r = dns.message.make_response(m)
-    r.set_rcode(NOERROR)
-
-    ip6req = False
-
-    if endswith(lqname, "bad."):
-        bad = True
-        suffix = "bad."
-        lqname = lqname[:-4]
-    elif endswith(lqname, "ugly."):
-        ugly = True
-        suffix = "ugly."
-        lqname = lqname[:-5]
-    elif endswith(lqname, "good."):
-        suffix = "good."
-        lqname = lqname[:-5]
-    elif endswith(lqname, "slow."):
-        slow = True
-        suffix = "slow."
-        lqname = lqname[:-5]
-    elif endswith(lqname, "1.1.1.1.8.2.6.0.1.0.0.2.ip6.arpa."):
-        ip6req = True
-    elif endswith(lqname, "b.stale."):
-        if lqname == "a.b.stale.":
-            r.flags |= dns.flags.AA
-            if rrtype == TXT:
-                # Direct query.
-                r.answer.append(dns.rrset.from_text(lqname, 1, IN, TXT, "hooray"))
-            elif rrtype == NS:
-                # NS a.b.
-                # This is only returned if a query for b.stale/NS has been made
-                r.answer.append(dns.rrset.from_text(lqname, 1, IN, NS, "ns.a.b.stale."))
-                r.additional.append(
-                    dns.rrset.from_text("ns.a.b.stale.", 1, IN, A, "10.53.0.4")
-                )
-            elif rrtype == SOA:
-                # SOA a.b.
-                r.answer.append(
-                    dns.rrset.from_text(
-                        lqname, 1, IN, SOA, "a.b.stale. hostmaster.a.b.stale. 1 2 3 4 5"
-                    )
-                )
-            else:
-                # NODATA.
-                r.authority.append(
-                    dns.rrset.from_text(
-                        lqname, 1, IN, SOA, "a.b.stale. hostmaster.a.b.stale. 1 2 3 4 5"
-                    )
-                )
-        elif lqname == "ns.a.b.stale.":
-            r.flags |= dns.flags.AA
-            if rrtype == A:
-                r.answer.append(
-                    dns.rrset.from_text("ns.a.b.stale.", 1, IN, A, "10.53.0.4")
-                )
-            else:
-                # NODATA.
-                r.authority.append(
-                    dns.rrset.from_text(
-                        lqname, 1, IN, SOA, "a.b.stale. hostmaster.a.b.stale. 1 2 3 4 5"
-                    )
-                )
-        elif lqname == "b.stale.":
-            r.flags |= dns.flags.AA
-            if rrtype == NS:
-                # NS b.
-                r.answer.append(dns.rrset.from_text(lqname, 1, IN, NS, "ns.b.stale."))
-                r.additional.append(
-                    dns.rrset.from_text("ns.b.stale.", 1, IN, A, "10.53.0.4")
-                )
-            elif rrtype == SOA:
-                # SOA b.
-                r.answer.append(
-                    dns.rrset.from_text(
-                        lqname, 1, IN, SOA, "b.stale. hostmaster.b.stale. 1 2 3 4 5"
-                    )
-                )
-            else:
-                # NODATA.
-                r.authority.append(
-                    dns.rrset.from_text(
-                        lqname, 1, IN, SOA, "b.stale. hostmaster.b.stale. 1 2 3 4 5"
-                    )
-                )
-        elif lqname == "ns.b.stale.":
-            r.flags |= dns.flags.AA
-            if rrtype == A:
-                # SOA a.b.
-                r.answer.append(
-                    dns.rrset.from_text("ns.a.b.stale.", 1, IN, A, "10.53.0.4")
-                )
-            else:
-                # NODATA.
-                r.authority.append(
-                    dns.rrset.from_text(
-                        lqname, 1, IN, SOA, "b.stale. hostmaster.b.stale. 1 2 3 4 5"
-                    )
-                )
-        else:
-            r.authority.append(
-                dns.rrset.from_text(
-                    lqname, 1, IN, SOA, "b.stale. hostmaster.b.stale. 1 2 3 4 5"
-                )
-            )
-            r.set_rcode(NXDOMAIN)
-            # NXDOMAIN.
-        return r
-    else:
-        r.set_rcode(REFUSED)
-        return r
-
-    # Good/bad differs only in how we treat non-empty terminals
-    if lqname == "icky.icky.icky.ptang.zoop.boing." and rrtype == A:
-        r.answer.append(dns.rrset.from_text(lqname + suffix, 1, IN, A, "192.0.2.1"))
-        r.flags |= dns.flags.AA
-    elif lqname == "more.icky.icky.icky.ptang.zoop.boing." and rrtype == A:
-        r.answer.append(dns.rrset.from_text(lqname + suffix, 1, IN, A, "192.0.2.2"))
-        r.flags |= dns.flags.AA
-    elif lqname == "icky.ptang.zoop.boing." and rrtype == NS:
-        r.answer.append(
-            dns.rrset.from_text(
-                lqname + suffix, 1, IN, NS, "a.bit.longer.ns.name." + suffix
-            )
-        )
-        r.flags |= dns.flags.AA
-    elif endswith(lqname, "icky.ptang.zoop.boing."):
-        r.authority.append(
-            dns.rrset.from_text(
-                "icky.ptang.zoop.boing." + suffix,
-                1,
-                IN,
-                SOA,
-                "ns2." + suffix + " hostmaster.arpa. 2018050100 1 1 1 1",
-            )
-        )
-        if bad or not endswith("more.icky.icky.icky.ptang.zoop.boing.", lqname):
-            r.set_rcode(NXDOMAIN)
-        if ugly:
-            r.set_rcode(FORMERR)
-    elif ip6req:
-        r.flags |= dns.flags.AA
-        if (
-            lqname
-            == "test1.test2.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.9.0.9.4.1.1.1.1.8.2.6.0.1.0.0.2.ip6.arpa."
-            and rrtype == TXT
-        ):
-            r.answer.append(
-                dns.rrset.from_text(
-                    "test1.test2.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.9.0.9.4.1.1.1.1.8.2.6.0.1.0.0.2.ip6.arpa.",
-                    1,
-                    IN,
-                    TXT,
-                    "long_ip6_name",
-                )
-            )
-        elif endswith(
-            "0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.9.0.9.4.1.1.1.1.8.2.6.0.1.0.0.2.ip6.arpa.",
-            lqname,
-        ):
-            # NODATA answer
-            r.authority.append(
-                dns.rrset.from_text(
-                    "1.1.1.1.8.2.6.0.1.0.0.2.ip6.arpa.",
-                    60,
-                    IN,
-                    SOA,
-                    "ns4.good. hostmaster.arpa. 2018050100 120 30 320 16",
-                )
-            )
-        else:
-            # NXDOMAIN
-            r.authority.append(
-                dns.rrset.from_text(
-                    "1.1.1.1.8.2.6.0.1.0.0.2.ip6.arpa.",
-                    60,
-                    IN,
-                    SOA,
-                    "ns4.good. hostmaster.arpa. 2018050100 120 30 320 16",
-                )
-            )
-            r.set_rcode(NXDOMAIN)
-    else:
-        r.set_rcode(REFUSED)
-
-    if slow:
-        time.sleep(0.4)
-    return r
+class IckyPtangZoopBoingBadHandler(EntRcodeChanger):
+    domains = ["icky.ptang.zoop.boing.bad."]
+    rcode = dns.rcode.NXDOMAIN


-def sigterm(signum, frame):
-    print("Shutting down now...")
-    os.remove("ans.pid")
-    running = False
-    sys.exit(0)
+class IckyPtangZoopBoingUglyHandler(EntRcodeChanger):
+    domains = ["icky.ptang.zoop.boing.ugly."]
+    rcode = dns.rcode.FORMERR


-############################################################################
-# Main
-#
-# Set up responder and control channel, open the pid file, and start
-# the main loop, listening for queries on the query channel or commands
-# on the control channel and acting on them.
-############################################################################
-ip4 = "10.53.0.4"
-ip6 = "fd92:7065:b8e:ffff::4"
+class IckyPtangZoopBoingSlowHandler(DelayedResponseHandler):
+    domains = ["icky.ptang.zoop.boing.slow."]
+    delay = 0.4

-try:
-    port = int(os.environ["PORT"])
-except:
-    port = 5300

-query4_socket = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
-query4_socket.bind((ip4, port))
-
-havev6 = True
-try:
-    query6_socket = socket.socket(socket.AF_INET6, socket.SOCK_DGRAM)
-    try:
-        query6_socket.bind((ip6, port))
-    except:
-        query6_socket.close()
-        havev6 = False
-except:
-    havev6 = False
-
-signal.signal(signal.SIGTERM, sigterm)
-
-f = open("ans.pid", "w")
-pid = os.getpid()
-print(pid, file=f)
-f.close()
-
-running = True
-
-print("Listening on %s port %d" % (ip4, port))
-if havev6:
-    print("Listening on %s port %d" % (ip6, port))
-print("Ctrl-c to quit")
-
-if havev6:
-    input = [query4_socket, query6_socket]
-else:
-    input = [query4_socket]
-
-while running:
-    try:
-        inputready, outputready, exceptready = select.select(input, [], [])
-    except select.error as e:
-        break
-    except socket.error as e:
-        break
-    except KeyboardInterrupt:
-        break
-
-    for s in inputready:
-        if s == query4_socket or s == query6_socket:
-            print(
-                "Query received on %s" % (ip4 if s == query4_socket else ip6), end=" "
-            )
-            # Handle incoming queries
-            msg = s.recvfrom(65535)
-            rsp = create_response(msg[0])
-            if rsp:
-                print(dns.rcode.to_text(rsp.rcode()))
-                s.sendto(rsp.to_wire(), msg[1])
-            else:
-                print("NO RESPONSE")
-    if not running:
-        break
+if __name__ == "__main__":
+    server = AsyncDnsServer()
+    server.install_response_handler(QueryLogger())
+    server.install_response_handler(StaleHandler())
+    server.install_response_handler(IckyPtangZoopBoingBadHandler())
+    server.install_response_handler(IckyPtangZoopBoingUglyHandler())
+    server.install_response_handler(IckyPtangZoopBoingSlowHandler())
+    server.run()
@@ -0,0 +1,16 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+@	1	SOA	ns hostmaster.b.stale. 1 2 3 4 5
+@	1	NS	ns
+ns	1	A	10.53.0.4
+a	1	NS	ns.a
+ns.a	1	A	10.53.0.4
@@ -0,0 +1,15 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+@			1	SOA	ns4.bad. hostmaster.arpa. 2018050100 1 1 1 1
+@			1	NS	a.bit.longer.ns.name.bad.
+icky.icky		1	A	192.0.2.1
+more.icky.icky		1	A	192.0.2.2
@@ -0,0 +1,15 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+@			1	SOA	ns4.good. hostmaster.arpa. 2018050100 1 1 1 1
+@			1	NS	a.bit.longer.ns.name.good.
+icky.icky		1	A	192.0.2.1
+more.icky.icky		1	A	192.0.2.2
@@ -0,0 +1,15 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+@			1	SOA	ns4.slow. hostmaster.arpa. 2018050100 1 1 1 1
+@			1	NS	a.bit.longer.ns.name.slow.
+icky.icky		1	A	192.0.2.1
+more.icky.icky		1	A	192.0.2.2
@@ -0,0 +1,15 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+@			1	SOA	ns4.ugly. hostmaster.arpa. 2018050100 1 1 1 1
+@			1	NS	a.bit.longer.ns.name.ugly.
+icky.icky		1	A	192.0.2.1
+more.icky.icky		1	A	192.0.2.2
@@ -0,0 +1,107 @@
+"""
+Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+
+SPDX-License-Identifier: MPL-2.0
+
+This Source Code Form is subject to the terms of the Mozilla Public
+License, v. 2.0.  If a copy of the MPL was not distributed with this
+file, you can obtain one at https://mozilla.org/MPL/2.0/.
+
+See the COPYRIGHT file distributed with this work for additional
+information regarding copyright ownership.
+"""
+
+from typing import AsyncGenerator
+
+import abc
+
+import dns.rcode
+import dns.rdataclass
+import dns.rdatatype
+
+from isctest.asyncserver import (
+    DnsResponseSend,
+    DomainHandler,
+    QueryContext,
+    ResponseAction,
+)
+
+from isctest.compat import dns_rcode
+
+
+def log_query(qctx: QueryContext) -> None:
+    """
+    Log a received DNS query to a text file inspected by `tests.sh`.  AAAA and
+    A queries are logged identically because the relative order in which they
+    are received does not matter.
+    """
+    qname = qctx.qname.to_text()
+    qtype = dns.rdatatype.to_text(qctx.qtype)
+    if qtype in ("A", "AAAA"):
+        qtype = "ADDR"
+
+    with open("query.log", "a", encoding="utf-8") as query_log:
+        print(f"{qtype} {qname}", file=query_log)
+
+
+class QueryLogHandler(DomainHandler):
+    """
+    Log all received DNS queries to a text file.  Use the zone file for
+    preparing responses.
+    """
+
+    async def get_responses(
+        self, qctx: QueryContext
+    ) -> AsyncGenerator[ResponseAction, None]:
+        log_query(qctx)
+        yield DnsResponseSend(qctx.response)
+
+
+class EntRcodeChanger(DomainHandler):
+    """
+    Log all received DNS queries to a text file.  Use the zone file for
+    preparing responses, but override the RCODE returned for empty
+    non-terminals (ENTs) to the value specified by the child class.  This
+    emulates broken authoritative servers.
+    """
+
+    @property
+    @abc.abstractmethod
+    def rcode(self) -> dns_rcode:
+        raise NotImplementedError
+
+    async def get_responses(
+        self, qctx: QueryContext
+    ) -> AsyncGenerator[ResponseAction, None]:
+        assert qctx.zone
+
+        log_query(qctx)
+
+        if (
+            qctx.response.rcode() == dns.rcode.NOERROR
+            and not qctx.response.answer
+            and qctx.response.authority
+            and qctx.response.authority[0].rdtype == dns.rdatatype.SOA
+            and not qctx.zone.get_node(qctx.qname)
+        ):
+            qctx.response.set_rcode(self.rcode)
+            yield DnsResponseSend(qctx.response)
+
+
+class DelayedResponseHandler(DomainHandler):
+    """
+    Log all received DNS queries to a text file.  Use the zone file for
+    preparing responses, but delay sending every answer by the amount of time
+    specified (in seconds) by the child class.  This emulates network delays.
+    """
+
+    @property
+    @abc.abstractmethod
+    def delay(self) -> float:
+        raise NotImplementedError
+
+    async def get_responses(
+        self, qctx: QueryContext
+    ) -> AsyncGenerator[ResponseAction, None]:
+        log_query(qctx)
+        yield DnsResponseSend(qctx.response, delay=self.delay)
@@ -264,7 +264,8 @@ sub construct_ns_command {

 		foreach my $t_option(
 			"dropedns", "ednsformerr", "ednsnotimp", "ednsrefused",
-			"noaa", "noedns", "nosoa", "maxudp512", "maxudp1460",
+			"cookiealwaysvalid", "noaa", "noedns", "nosoa",
+			"maxudp512", "maxudp1460",
 		    ) {
 			if (-e "$testdir/$server/named.$t_option") {
 				$command .= "-T $t_option "
@@ -323,7 +324,7 @@ sub construct_ans_command {
 	}

 	if (-e "$testdir/$server/ans.py") {
-		$ENV{'PYTHONPATH'} = $testdir . ":" . $ENV{'srcdir'};
+		$ENV{'PYTHONPATH'} = $testdir . ":" . $builddir;
 		$command = "$PYTHON -u ans.py 10.53.0.$n $queryport";
 	} elsif (-e "$testdir/$server/ans.pl") {
 		$command = "$PERL ans.pl";
@@ -218,6 +218,7 @@ latex_logo = "isc-logo.pdf"
 linkcheck_timeout = 10
 linkcheck_ignore = [
    "http://127.0.0.1",
+    "https://dl.acm.org",
    "https://gitlab.isc.org",
    "https://kb.isc.org",
    "https://simpleicon.com/",
@@ -3969,9 +3969,10 @@ Periodic Task Intervals
   :tags: server
   :short: Sets the interval at which the server scans the network interface list.

-   The server scans the network interface list every :any:`interface-interval`
-   minutes. The default is 60 minutes; the maximum value is 28 days (40320
-   minutes). If set to 0, interface scanning only occurs when the configuration
+   The server scans the network interface list on every interval as specified by
+   :any:`interface-interval`.
+
+   If set to 0, interface scanning only occurs when the configuration
   file is loaded, or when :any:`automatic-interface-scan` is enabled and supported
   by the operating system. After the scan, the server begins listening for
   queries on any newly discovered interfaces (provided they are allowed by the
@@ -3979,6 +3980,8 @@ Periodic Task Intervals
   gone away. For convenience, TTL-style time-unit suffixes may be used to
   specify the value. It also accepts ISO 8601 duration formats.

+   The default is 60 minutes (1 hour); the maximum value is 28 days.
+
 .. _rrset_ordering:

 RRset Ordering
@@ -1076,11 +1076,11 @@ new_adbfetch(dns_adb_t *adb) {
 	dns_adbfetch_t *fetch = NULL;

 	fetch = isc_mem_get(adb->hmctx, sizeof(*fetch));
-	*fetch = (dns_adbfetch_t){ 0 };
+	*fetch = (dns_adbfetch_t){
+		.magic = DNS_ADBFETCH_MAGIC,
+	};
 	dns_rdataset_init(&fetch->rdataset);

-	fetch->magic = DNS_ADBFETCH_MAGIC;
-
 	return fetch;
 }

@@ -205,9 +205,9 @@ dns_keytable_finddeepestmatch(dns_keytable_t *keytable, const dns_name_t *name,
 *\li	Any other result indicates an error.
 */

-bool
+isc_result_t
 dns_keytable_issecuredomain(dns_keytable_t *keytable, const dns_name_t *name,
-			    dns_name_t *foundname);
+			    dns_name_t *foundname, bool *wantdnssecp);
 /*%<
 * Is 'name' at or beneath a trusted key?
 *
@@ -219,11 +219,20 @@ dns_keytable_issecuredomain(dns_keytable_t *keytable, const dns_name_t *name,
 *
 *\li	'foundanme' is NULL or is a pointer to an initialized dns_name_t
 *
+ *\li	'*wantsdnssecp' is a valid bool.
+ *
 * Ensures:
 *
- *\li	Returns true if and only if 'name' is at or beneath a trusted key.
- *	If 'foundname' is not NULL, then it will be updated to contain
- *	the name of the closest enclosing trust anchor.
+ *\li	On success, *wantsdnssecp will be true if and only if 'name'
+ *	is at or beneath a trusted key.  If 'foundname' is not NULL, then
+ *	it will be updated to contain the name of the closest enclosing
+ *	trust anchor.
+ *
+ * Returns:
+ *
+ *\li	ISC_R_SUCCESS
+ *
+ *\li	Any other result is an error.
 */

 isc_result_t
@@ -54,24 +54,26 @@
 isc_result_t
 dns_ncache_add(dns_message_t *message, dns_db_t *cache, dns_dbnode_t *node,
 	       dns_rdatatype_t covers, isc_stdtime_t now, dns_ttl_t minttl,
-	       dns_ttl_t maxttl, bool optout, bool secure,
-	       dns_rdataset_t *addedrdataset);
+	       dns_ttl_t maxttl, dns_rdataset_t *addedrdataset);
+isc_result_t
+dns_ncache_addoptout(dns_message_t *message, dns_db_t *cache,
+		     dns_dbnode_t *node, dns_rdatatype_t covers,
+		     isc_stdtime_t now, dns_ttl_t minttl, dns_ttl_t maxttl,
+		     bool optout, dns_rdataset_t *addedrdataset);
 /*%<
 * Convert the authority data from 'message' into a negative cache
 * rdataset, and store it in 'cache' at 'node' with a TTL limited to
 * 'maxttl'.
 *
- * \li If 'secure' is true and all the records that make up the entry
- *     are secure, then dns_ncache_add produces a negative cache entry
- *     with trust level secure.
- * \li If 'secure' is false, the negative cache entry's trust level
- *     will be capped at answer.
+ * \li dns_ncache_add produces a negative cache entry with a trust of no
+ *     more than answer
+ * \li dns_ncache_addoptout produces a negative cache entry which will have
+ *     a trust of secure if all the records that make up the entry are secure.
 *
 * The 'covers' argument is the RR type whose nonexistence we are caching,
 * or dns_rdatatype_any when caching a NXDOMAIN response.
 *
- * 'optout' indicates DNS_RDATASETATTR_OPTOUT should be set. This only
- * applies in secure zones; if 'secure' is false, 'optout' is ignored.
+ * 'optout' indicates a DNS_RDATASETATTR_OPTOUT should be set.
 *
 * Note:
 *\li	If 'addedrdataset' is not NULL, then it will be attached to the added
@@ -689,30 +689,3 @@ dns_rdataset_equals(const dns_rdataset_t *rdataset1,
 * \li	'rdataset1' is a valid rdataset.
 * \li	'rdataset2' is a valid rdataset.
 */
-
-/*%
- * Returns true if the rdataset is of type 'type', or type RRSIG
- * and covers 'type'.
- */
-static inline bool
-dns_rdataset_matchestype(const dns_rdataset_t *rdataset,
-			 const dns_rdatatype_t type) {
-	REQUIRE(DNS_RDATASET_VALID(rdataset));
-
-	return rdataset->type == type ||
-	       (rdataset->type == dns_rdatatype_rrsig &&
-		rdataset->covers == type);
-}
-
-/*%
- * Returns true if the rdataset is of type 'type', or type RRSIG
- * and covers 'type'.
- */
-static inline bool
-dns_rdataset_issigtype(const dns_rdataset_t *rdataset,
-		       const dns_rdatatype_t type) {
-	REQUIRE(DNS_RDATASET_VALID(rdataset));
-
-	return rdataset->type == dns_rdatatype_rrsig &&
-	       rdataset->covers == type;
-}
@@ -986,12 +986,13 @@ dns_view_getsecroots(dns_view_t *view, dns_keytable_t **ktp);
 *\li	ISC_R_NOTFOUND
 */

-bool
+isc_result_t
 dns_view_issecuredomain(dns_view_t *view, const dns_name_t *name,
-			isc_stdtime_t now, bool checknta, bool *ntap);
+			isc_stdtime_t now, bool checknta, bool *ntap,
+			bool *secure_domain);
 /*%<
 * Is 'name' at or beneath a trusted key, and not covered by a valid
- * negative trust anchor, and DNSSEC validation is enabled?
+ * negative trust anchor?  Put answer in '*secure_domain'.
 *
 * If 'checknta' is false, ignore the NTA table in determining
 * whether this is a secure domain. If 'checknta' is not false, and if
@@ -1000,6 +1001,10 @@ dns_view_issecuredomain(dns_view_t *view, const dns_name_t *name,
 *
 * Requires:
 * \li	'view' is valid.
+ *
+ * Returns:
+ *\li	ISC_R_SUCCESS
+ *\li	Any other value indicates failure
 */

 bool
@@ -818,7 +818,7 @@ dns_zone_setmaxretrytime(dns_zone_t *zone, uint32_t val);
 *	val > 0.
 */

-isc_result_t
+void
 dns_zone_setxfrsource4(dns_zone_t *zone, const isc_sockaddr_t *xfrsource);
 /*%<
 * 	Set the source address to be used in IPv4 zone transfers.
@@ -826,22 +826,20 @@ dns_zone_setxfrsource4(dns_zone_t *zone, const isc_sockaddr_t *xfrsource);
 * Require:
 *\li	'zone' to be a valid zone.
 *\li	'xfrsource' to contain the address.
- *
- * Returns:
- *\li	#ISC_R_SUCCESS
 */

-isc_sockaddr_t *
-dns_zone_getxfrsource4(dns_zone_t *zone);
+void
+dns_zone_getxfrsource4(dns_zone_t *zone, isc_sockaddr_t *xfrsource);
 /*%<
 *	Returns the source address set by a previous dns_zone_setxfrsource4
 *	call, or the default of inaddr_any, port 0.
 *
 * Require:
 *\li	'zone' to be a valid zone.
+ *\li	'xfrsource' to not be NULL
 */

-isc_result_t
+void
 dns_zone_setxfrsource6(dns_zone_t *zone, const isc_sockaddr_t *xfrsource);
 /*%<
 * 	Set the source address to be used in IPv6 zone transfers.
@@ -849,22 +847,20 @@ dns_zone_setxfrsource6(dns_zone_t *zone, const isc_sockaddr_t *xfrsource);
 * Require:
 *\li	'zone' to be a valid zone.
 *\li	'xfrsource' to contain the address.
- *
- * Returns:
- *\li	#ISC_R_SUCCESS
 */

-isc_sockaddr_t *
-dns_zone_getxfrsource6(dns_zone_t *zone);
+void
+dns_zone_getxfrsource6(dns_zone_t *zone, isc_sockaddr_t *xfrsource);
 /*%<
 *	Returns the source address set by a previous dns_zone_setxfrsource6
 *	call, or the default of in6addr_any, port 0.
 *
 * Require:
 *\li	'zone' to be a valid zone.
+ *\li	'xfrsource' to not be NULL
 */

-isc_result_t
+void
 dns_zone_setparentalsrc4(dns_zone_t *zone, const isc_sockaddr_t *parentalsrc);
 /*%<
 * 	Set the source address to be used with IPv4 parental DS queries.
@@ -872,22 +868,20 @@ dns_zone_setparentalsrc4(dns_zone_t *zone, const isc_sockaddr_t *parentalsrc);
 * Require:
 *\li	'zone' to be a valid zone.
 *\li	'parentalsrc' to contain the address.
- *
- * Returns:
- *\li	#ISC_R_SUCCESS
 */

-isc_sockaddr_t *
-dns_zone_getparentalsrc4(dns_zone_t *zone);
+void
+dns_zone_getparentalsrc4(dns_zone_t *zone, isc_sockaddr_t *parentalsrc);
 /*%<
 *	Returns the source address set by a previous dns_zone_setparentalsrc4
 *	call, or the default of inaddr_any, port 0.
 *
 * Require:
 *\li	'zone' to be a valid zone.
+ *\li	'parentalsrc' to be non NULL.
 */

-isc_result_t
+void
 dns_zone_setparentalsrc6(dns_zone_t *zone, const isc_sockaddr_t *parentalsrc);
 /*%<
 * 	Set the source address to be used with IPv6 parental DS queries.
@@ -895,22 +889,20 @@ dns_zone_setparentalsrc6(dns_zone_t *zone, const isc_sockaddr_t *parentalsrc);
 * Require:
 *\li	'zone' to be a valid zone.
 *\li	'parentalsrc' to contain the address.
- *
- * Returns:
- *\li	#ISC_R_SUCCESS
 */

-isc_sockaddr_t *
-dns_zone_getparentalsrc6(dns_zone_t *zone);
+void
+dns_zone_getparentalsrc6(dns_zone_t *zone, isc_sockaddr_t *parentalsrc);
 /*%<
 *	Returns the source address set by a previous dns_zone_setparentalsrc6
 *	call, or the default of in6addr_any, port 0.
 *
 * Require:
 *\li	'zone' to be a valid zone.
+ *\li	'parentalsrc' to be non NULL.
 */

-isc_result_t
+void
 dns_zone_setnotifysrc4(dns_zone_t *zone, const isc_sockaddr_t *notifysrc);
 /*%<
 * 	Set the source address to be used with IPv4 NOTIFY messages.
@@ -918,22 +910,20 @@ dns_zone_setnotifysrc4(dns_zone_t *zone, const isc_sockaddr_t *notifysrc);
 * Require:
 *\li	'zone' to be a valid zone.
 *\li	'notifysrc' to contain the address.
- *
- * Returns:
- *\li	#ISC_R_SUCCESS
 */

-isc_sockaddr_t *
-dns_zone_getnotifysrc4(dns_zone_t *zone);
+void
+dns_zone_getnotifysrc4(dns_zone_t *zone, isc_sockaddr_t *notifysrc);
 /*%<
 *	Returns the source address set by a previous dns_zone_setnotifysrc4
 *	call, or the default of inaddr_any, port 0.
 *
 * Require:
 *\li	'zone' to be a valid zone.
+ *\li	'notifysrc' to be non NULL.
 */

-isc_result_t
+void
 dns_zone_setnotifysrc6(dns_zone_t *zone, const isc_sockaddr_t *notifysrc);
 /*%<
 * 	Set the source address to be used with IPv6 NOTIFY messages.
@@ -941,19 +931,17 @@ dns_zone_setnotifysrc6(dns_zone_t *zone, const isc_sockaddr_t *notifysrc);
 * Require:
 *\li	'zone' to be a valid zone.
 *\li	'notifysrc' to contain the address.
- *
- * Returns:
- *\li	#ISC_R_SUCCESS
 */

-isc_sockaddr_t *
-dns_zone_getnotifysrc6(dns_zone_t *zone);
+void
+dns_zone_getnotifysrc6(dns_zone_t *zone, isc_sockaddr_t *notifysrc);
 /*%<
 *	Returns the source address set by a previous dns_zone_setnotifysrc6
 *	call, or the default of in6addr_any, port 0.
 *
 * Require:
 *\li	'zone' to be a valid zone.
+ *\li	'notifysrc' to be non NULL.
 */

 void
@@ -1528,8 +1516,8 @@ dns_zone_getsigresigninginterval(dns_zone_t *zone);
 * \li	'zone' to be a valid zone.
 */

-isc_sockaddr_t
-dns_zone_getsourceaddr(dns_zone_t *zone);
+void
+dns_zone_getsourceaddr(dns_zone_t *zone, isc_sockaddr_t *sourceaddr);
 /*%<
 * Get the zone's source address from which it has last contacted the current
 * primary server.
@@ -1537,17 +1525,18 @@ dns_zone_getsourceaddr(dns_zone_t *zone);
 * Requires:
 * \li	'zone' to be a valid zone.
 * \li	'zone' has a non-empty primaries list.
+ * \li	'sourceaddr' to be non-NULL.
 */

 isc_result_t
-dns_zone_getprimaryaddr(dns_zone_t *zone, isc_sockaddr_t *dest);
+dns_zone_getprimaryaddr(dns_zone_t *zone, isc_sockaddr_t *primaryaddr);
 /*%<
- * Get the zone's current primary server into '*dest'.
+ * Get the zone's current primary server into '*primaryaddr'.
 *
 * Requires:
 * \li	'zone' to be a valid zone.
 * \li	'zone' has a non-empty primaries list.
- * \li	'dest' != NULL.
+ * \li	'primaryaddr' to be non-NULL.
 *
 * Returns:
 *\li	#ISC_R_SUCCESS if the current primary server was found
@@ -530,14 +530,13 @@ dns_keytable_finddeepestmatch(dns_keytable_t *keytable, const dns_name_t *name,
 	return result;
 }

-bool
+isc_result_t
 dns_keytable_issecuredomain(dns_keytable_t *keytable, const dns_name_t *name,
-			    dns_name_t *foundname) {
+			    dns_name_t *foundname, bool *wantdnssecp) {
 	isc_result_t result;
 	dns_qpread_t qpr;
 	dns_keynode_t *keynode = NULL;
 	void *pval = NULL;
-	bool secure = false;

 	/*
 	 * Is 'name' at or beneath a trusted key?
@@ -545,6 +544,7 @@ dns_keytable_issecuredomain(dns_keytable_t *keytable, const dns_name_t *name,

 	REQUIRE(VALID_KEYTABLE(keytable));
 	REQUIRE(dns_name_isabsolute(name));
+	REQUIRE(wantdnssecp != NULL);

 	dns_qpmulti_query(keytable->table, &qpr);
 	result = dns_qp_lookup(&qpr, name, NULL, NULL, NULL, &pval, NULL);
@@ -553,12 +553,16 @@ dns_keytable_issecuredomain(dns_keytable_t *keytable, const dns_name_t *name,
 		if (foundname != NULL) {
 			dns_name_copy(&keynode->name, foundname);
 		}
-		secure = true;
+		*wantdnssecp = true;
+		result = ISC_R_SUCCESS;
+	} else if (result == ISC_R_NOTFOUND) {
+		*wantdnssecp = false;
+		result = ISC_R_SUCCESS;
 	}

 	dns_qpread_destroy(keytable->table, &qpr);

-	return secure;
+	return result;
 }

 static isc_result_t
@@ -50,6 +50,12 @@ atomic_getuint8(isc_buffer_t *b) {
 	return ret;
 }

+static isc_result_t
+addoptout(dns_message_t *message, dns_db_t *cache, dns_dbnode_t *node,
+	  dns_rdatatype_t covers, isc_stdtime_t now, dns_ttl_t minttl,
+	  dns_ttl_t maxttl, bool optout, bool secure,
+	  dns_rdataset_t *addedrdataset);
+
 static isc_result_t
 copy_rdataset(dns_rdataset_t *rdataset, isc_buffer_t *buffer) {
 	isc_result_t result;
@@ -101,8 +107,25 @@ copy_rdataset(dns_rdataset_t *rdataset, isc_buffer_t *buffer) {
 isc_result_t
 dns_ncache_add(dns_message_t *message, dns_db_t *cache, dns_dbnode_t *node,
 	       dns_rdatatype_t covers, isc_stdtime_t now, dns_ttl_t minttl,
-	       dns_ttl_t maxttl, bool optout, bool secure,
-	       dns_rdataset_t *addedrdataset) {
+	       dns_ttl_t maxttl, dns_rdataset_t *addedrdataset) {
+	return addoptout(message, cache, node, covers, now, minttl, maxttl,
+			 false, false, addedrdataset);
+}
+
+isc_result_t
+dns_ncache_addoptout(dns_message_t *message, dns_db_t *cache,
+		     dns_dbnode_t *node, dns_rdatatype_t covers,
+		     isc_stdtime_t now, dns_ttl_t minttl, dns_ttl_t maxttl,
+		     bool optout, dns_rdataset_t *addedrdataset) {
+	return addoptout(message, cache, node, covers, now, minttl, maxttl,
+			 optout, true, addedrdataset);
+}
+
+static isc_result_t
+addoptout(dns_message_t *message, dns_db_t *cache, dns_dbnode_t *node,
+	  dns_rdatatype_t covers, isc_stdtime_t now, dns_ttl_t minttl,
+	  dns_ttl_t maxttl, bool optout, bool secure,
+	  dns_rdataset_t *addedrdataset) {
 	isc_result_t result;
 	isc_buffer_t buffer;
 	isc_region_t r;
@@ -120,17 +143,14 @@ dns_ncache_add(dns_message_t *message, dns_db_t *cache, dns_dbnode_t *node,
 	/*
 	 * Convert the authority data from 'message' into a negative cache
 	 * rdataset, and store it in 'cache' at 'node'.
-	 *
-	 * We assume that all data in the authority section has been
-	 * validated by the caller.
 	 */

 	REQUIRE(message != NULL);

 	/*
-	 * If 'secure' is false, ignore 'optout'.
+	 * We assume that all data in the authority section has been
+	 * validated by the caller.
 	 */
-	optout = optout && secure;

 	/*
 	 * Initialize the list.
@@ -1533,31 +1533,41 @@ dns_view_ntacovers(dns_view_t *view, isc_stdtime_t now, const dns_name_t *name,
 	return dns_ntatable_covered(view->ntatable_priv, now, name, anchor);
 }

-bool
+isc_result_t
 dns_view_issecuredomain(dns_view_t *view, const dns_name_t *name,
-			isc_stdtime_t now, bool checknta, bool *ntap) {
+			isc_stdtime_t now, bool checknta, bool *ntap,
+			bool *secure_domain) {
+	isc_result_t result;
 	bool secure = false;
 	dns_fixedname_t fn;
 	dns_name_t *anchor;

 	REQUIRE(DNS_VIEW_VALID(view));

-	if (!view->enablevalidation || view->secroots_priv == NULL) {
-		return false;
+	if (view->secroots_priv == NULL) {
+		return ISC_R_NOTFOUND;
 	}

 	anchor = dns_fixedname_initname(&fn);
-	secure = dns_keytable_issecuredomain(view->secroots_priv, name, anchor);
+
+	result = dns_keytable_issecuredomain(view->secroots_priv, name, anchor,
+					     &secure);
+	if (result != ISC_R_SUCCESS) {
+		return result;
+	}

 	SET_IF_NOT_NULL(ntap, false);
 	if (checknta && secure && view->ntatable_priv != NULL &&
 	    dns_ntatable_covered(view->ntatable_priv, now, name, anchor))
 	{
-		SET_IF_NOT_NULL(ntap, true);
+		if (ntap != NULL) {
+			*ntap = true;
+		}
 		secure = false;
 	}

-	return secure;
+	*secure_domain = secure;
+	return ISC_R_SUCCESS;
 }

 void
@@ -5998,106 +5998,123 @@ dns_zone_getkeyopts(dns_zone_t *zone) {
 	return atomic_load_relaxed(&zone->keyopts);
 }

-isc_result_t
+void
 dns_zone_setxfrsource4(dns_zone_t *zone, const isc_sockaddr_t *xfrsource) {
 	REQUIRE(DNS_ZONE_VALID(zone));
+	REQUIRE(xfrsource != NULL);

 	LOCK_ZONE(zone);
 	zone->xfrsource4 = *xfrsource;
 	UNLOCK_ZONE(zone);
-
-	return ISC_R_SUCCESS;
 }

-isc_sockaddr_t *
-dns_zone_getxfrsource4(dns_zone_t *zone) {
+void
+dns_zone_getxfrsource4(dns_zone_t *zone, isc_sockaddr_t *xfrsource) {
 	REQUIRE(DNS_ZONE_VALID(zone));
-	return &zone->xfrsource4;
+	REQUIRE(xfrsource != NULL);
+
+	LOCK_ZONE(zone);
+	*xfrsource = zone->xfrsource4;
+	UNLOCK_ZONE(zone);
 }

-isc_result_t
+void
 dns_zone_setxfrsource6(dns_zone_t *zone, const isc_sockaddr_t *xfrsource) {
 	REQUIRE(DNS_ZONE_VALID(zone));
+	REQUIRE(xfrsource != NULL);

 	LOCK_ZONE(zone);
 	zone->xfrsource6 = *xfrsource;
 	UNLOCK_ZONE(zone);
-
-	return ISC_R_SUCCESS;
 }

-isc_sockaddr_t *
-dns_zone_getxfrsource6(dns_zone_t *zone) {
+void
+dns_zone_getxfrsource6(dns_zone_t *zone, isc_sockaddr_t *xfrsource) {
 	REQUIRE(DNS_ZONE_VALID(zone));
-	return &zone->xfrsource6;
+	REQUIRE(xfrsource != NULL);
+
+	LOCK_ZONE(zone);
+	*xfrsource = zone->xfrsource6;
+	UNLOCK_ZONE(zone);
 }

-isc_result_t
+void
 dns_zone_setparentalsrc4(dns_zone_t *zone, const isc_sockaddr_t *parentalsrc) {
 	REQUIRE(DNS_ZONE_VALID(zone));
+	REQUIRE(parentalsrc != NULL);

 	LOCK_ZONE(zone);
 	zone->parentalsrc4 = *parentalsrc;
 	UNLOCK_ZONE(zone);
-
-	return ISC_R_SUCCESS;
 }

-isc_sockaddr_t *
-dns_zone_getparentalsrc4(dns_zone_t *zone) {
+void
+dns_zone_getparentalsrc4(dns_zone_t *zone, isc_sockaddr_t *parentalsrc) {
 	REQUIRE(DNS_ZONE_VALID(zone));
-	return &zone->parentalsrc4;
+	REQUIRE(parentalsrc != NULL);
+
+	LOCK_ZONE(zone);
+	*parentalsrc = zone->parentalsrc4;
+	UNLOCK_ZONE(zone);
 }

-isc_result_t
+void
 dns_zone_setparentalsrc6(dns_zone_t *zone, const isc_sockaddr_t *parentalsrc) {
 	REQUIRE(DNS_ZONE_VALID(zone));

 	LOCK_ZONE(zone);
 	zone->parentalsrc6 = *parentalsrc;
 	UNLOCK_ZONE(zone);
-
-	return ISC_R_SUCCESS;
 }

-isc_sockaddr_t *
-dns_zone_getparentalsrc6(dns_zone_t *zone) {
+void
+dns_zone_getparentalsrc6(dns_zone_t *zone, isc_sockaddr_t *parentalsrc) {
 	REQUIRE(DNS_ZONE_VALID(zone));
-	return &zone->parentalsrc6;
+	REQUIRE(parentalsrc != NULL);
+
+	LOCK_ZONE(zone);
+	*parentalsrc = zone->parentalsrc6;
+	UNLOCK_ZONE(zone);
 }

-isc_result_t
+void
 dns_zone_setnotifysrc4(dns_zone_t *zone, const isc_sockaddr_t *notifysrc) {
 	REQUIRE(DNS_ZONE_VALID(zone));
+	REQUIRE(notifysrc != NULL);

 	LOCK_ZONE(zone);
 	zone->notifysrc4 = *notifysrc;
 	UNLOCK_ZONE(zone);
-
-	return ISC_R_SUCCESS;
 }

-isc_sockaddr_t *
-dns_zone_getnotifysrc4(dns_zone_t *zone) {
+void
+dns_zone_getnotifysrc4(dns_zone_t *zone, isc_sockaddr_t *notifysrc) {
 	REQUIRE(DNS_ZONE_VALID(zone));
-	return &zone->notifysrc4;
+	REQUIRE(notifysrc != NULL);
+
+	LOCK_ZONE(zone);
+	*notifysrc = zone->notifysrc4;
+	UNLOCK_ZONE(zone);
 }

-isc_result_t
+void
 dns_zone_setnotifysrc6(dns_zone_t *zone, const isc_sockaddr_t *notifysrc) {
 	REQUIRE(DNS_ZONE_VALID(zone));
+	REQUIRE(notifysrc != NULL);

 	LOCK_ZONE(zone);
 	zone->notifysrc6 = *notifysrc;
 	UNLOCK_ZONE(zone);
-
-	return ISC_R_SUCCESS;
 }

-isc_sockaddr_t *
-dns_zone_getnotifysrc6(dns_zone_t *zone) {
+void
+dns_zone_getnotifysrc6(dns_zone_t *zone, isc_sockaddr_t *notifysrc) {
 	REQUIRE(DNS_ZONE_VALID(zone));
-	return &zone->notifysrc6;
+	REQUIRE(notifysrc != NULL);
+
+	LOCK_ZONE(zone);
+	*notifysrc = zone->notifysrc6;
+	UNLOCK_ZONE(zone);
 }

 void
@@ -18371,31 +18388,28 @@ dns_zone_getsigresigninginterval(dns_zone_t *zone) {
 	return zone->sigresigninginterval;
 }

-isc_sockaddr_t
-dns_zone_getsourceaddr(dns_zone_t *zone) {
-	isc_sockaddr_t sourceaddr;
-
+void
+dns_zone_getsourceaddr(dns_zone_t *zone, isc_sockaddr_t *sourceaddr) {
 	REQUIRE(DNS_ZONE_VALID(zone));
+	REQUIRE(sourceaddr != NULL);

 	LOCK_ZONE(zone);
 	INSIST(dns_remote_count(&zone->primaries) > 0);
-	sourceaddr = zone->sourceaddr;
+	*sourceaddr = zone->sourceaddr;
 	UNLOCK_ZONE(zone);
-
-	return sourceaddr;
 }

 isc_result_t
-dns_zone_getprimaryaddr(dns_zone_t *zone, isc_sockaddr_t *dest) {
+dns_zone_getprimaryaddr(dns_zone_t *zone, isc_sockaddr_t *primaryaddr) {
 	isc_result_t result = ISC_R_NOMORE;

 	REQUIRE(DNS_ZONE_VALID(zone));
-	REQUIRE(dest != NULL);
+	REQUIRE(primaryaddr != NULL);

 	LOCK_ZONE(zone);
 	INSIST(dns_remote_count(&zone->primaries) > 0);
 	if (!dns_remote_done(&zone->primaries)) {
-		*dest = dns_remote_curraddr(&zone->primaries);
+		*primaryaddr = dns_remote_curraddr(&zone->primaries);
 		result = ISC_R_SUCCESS;
 	}
 	UNLOCK_ZONE(zone);
@@ -1290,6 +1290,7 @@ process_cookie(ns_client_t *client, isc_buffer_t *buf, size_t optlen) {
 	isc_stdtime_t now;
 	uint32_t when;
 	isc_buffer_t db;
+	bool alwaysvalid;

 	/*
 	 * If we have already seen a cookie option skip this cookie option.
@@ -1335,11 +1336,22 @@ process_cookie(ns_client_t *client, isc_buffer_t *buf, size_t optlen) {
 	when = isc_buffer_getuint32(buf);
 	isc_buffer_forward(buf, 8);

+	/*
+	 * For '-T cookiealwaysvalid' still process everything to not skew any
+	 * performance tests involving cookies, but make sure that the cookie
+	 * check passes in the end, given the cookie was structurally correct.
+	 */
+	alwaysvalid = ns_server_getoption(client->manager->sctx,
+					  NS_SERVER_COOKIEALWAYSVALID);
+
 	/*
 	 * Allow for a 5 minute clock skew between servers sharing a secret.
 	 * Only accept COOKIE if we have talked to the client in the last hour.
 	 */
 	now = isc_stdtime_now();
+	if (alwaysvalid) {
+		now = when;
+	}
 	if (isc_serial_gt(when, (now + 300)) /* In the future. */ ||
 	    isc_serial_lt(when, (now - 3600)) /* In the past. */)
 	{
@@ -1352,7 +1364,7 @@ process_cookie(ns_client_t *client, isc_buffer_t *buf, size_t optlen) {
 	isc_buffer_init(&db, dbuf, sizeof(dbuf));
 	compute_cookie(client, when, client->manager->sctx->secret, &db);

-	if (isc_safe_memequal(old, dbuf, COOKIE_SIZE)) {
+	if (isc_safe_memequal(old, dbuf, COOKIE_SIZE) || alwaysvalid) {
 		ns_stats_increment(client->manager->sctx->nsstats,
 				   ns_statscounter_cookiematch);
 		client->attributes |= NS_CLIENTATTR_HAVECOOKIE;
@@ -32,24 +32,25 @@

 #include <ns/types.h>

-#define NS_SERVER_LOGQUERIES	 0x00000001U /*%< log queries */
-#define NS_SERVER_NOAA		 0x00000002U /*%< -T noaa */
-#define NS_SERVER_NOSOA		 0x00000004U /*%< -T nosoa */
-#define NS_SERVER_NONEAREST	 0x00000008U /*%< -T nonearest */
-#define NS_SERVER_NOEDNS	 0x00000020U /*%< -T noedns */
-#define NS_SERVER_DROPEDNS	 0x00000040U /*%< -T dropedns */
-#define NS_SERVER_NOTCP		 0x00000080U /*%< -T notcp */
-#define NS_SERVER_DISABLE4	 0x00000100U /*%< -6 */
-#define NS_SERVER_DISABLE6	 0x00000200U /*%< -4 */
-#define NS_SERVER_FIXEDLOCAL	 0x00000400U /*%< -T fixedlocal */
-#define NS_SERVER_SIGVALINSECS	 0x00000800U /*%< -T sigvalinsecs */
-#define NS_SERVER_EDNSFORMERR	 0x00001000U /*%< -T ednsformerr (STD13) */
-#define NS_SERVER_EDNSNOTIMP	 0x00002000U /*%< -T ednsnotimp */
-#define NS_SERVER_EDNSREFUSED	 0x00004000U /*%< -T ednsrefused */
-#define NS_SERVER_TRANSFERINSECS 0x00008000U /*%< -T transferinsecs */
-#define NS_SERVER_TRANSFERSLOWLY 0x00010000U /*%< -T transferslowly */
-#define NS_SERVER_TRANSFERSTUCK	 0x00020000U /*%< -T transferstuck */
-#define NS_SERVER_LOGRESPONSES	 0x00040000U /*%< log responses */
+#define NS_SERVER_LOGQUERIES	    0x00000001U /*%< log queries */
+#define NS_SERVER_NOAA		    0x00000002U /*%< -T noaa */
+#define NS_SERVER_NOSOA		    0x00000004U /*%< -T nosoa */
+#define NS_SERVER_NONEAREST	    0x00000008U /*%< -T nonearest */
+#define NS_SERVER_NOEDNS	    0x00000020U /*%< -T noedns */
+#define NS_SERVER_DROPEDNS	    0x00000040U /*%< -T dropedns */
+#define NS_SERVER_NOTCP		    0x00000080U /*%< -T notcp */
+#define NS_SERVER_DISABLE4	    0x00000100U /*%< -6 */
+#define NS_SERVER_DISABLE6	    0x00000200U /*%< -4 */
+#define NS_SERVER_FIXEDLOCAL	    0x00000400U /*%< -T fixedlocal */
+#define NS_SERVER_SIGVALINSECS	    0x00000800U /*%< -T sigvalinsecs */
+#define NS_SERVER_EDNSFORMERR	    0x00001000U /*%< -T ednsformerr (STD13) */
+#define NS_SERVER_EDNSNOTIMP	    0x00002000U /*%< -T ednsnotimp */
+#define NS_SERVER_EDNSREFUSED	    0x00004000U /*%< -T ednsrefused */
+#define NS_SERVER_TRANSFERINSECS    0x00008000U /*%< -T transferinsecs */
+#define NS_SERVER_TRANSFERSLOWLY    0x00010000U /*%< -T transferslowly */
+#define NS_SERVER_TRANSFERSTUCK	    0x00020000U /*%< -T transferstuck */
+#define NS_SERVER_LOGRESPONSES	    0x00040000U /*%< log responses */
+#define NS_SERVER_COOKIEALWAYSVALID 0x00080000U /*%< -T cookiealwaysvalid */

 /*%
 * Type for callback function to get hostname.
@@ -535,6 +535,7 @@ ISC_LOOP_TEST_IMPL(find) {

 /* check issecuredomain() */
 ISC_LOOP_TEST_IMPL(issecuredomain) {
+	bool issecure;
 	const char **n;
 	const char *names[] = { "example.com", "sub.example.com",
 				"null.example", "sub.null.example", NULL };
@@ -549,16 +550,22 @@ ISC_LOOP_TEST_IMPL(issecuredomain) {
 	 * of installing a null key).
 	 */
 	for (n = names; *n != NULL; n++) {
-		assert_true(dns_keytable_issecuredomain(keytable, str2name(*n),
-							NULL));
+		assert_int_equal(dns_keytable_issecuredomain(keytable,
+							     str2name(*n), NULL,
+							     &issecure),
+				 ISC_R_SUCCESS);
+		assert_true(issecure);
 	}

 	/*
 	 * If the key table has no entry (not even a null one) for a domain or
 	 * any of its ancestors, that domain is considered insecure.
 	 */
-	assert_false(dns_keytable_issecuredomain(
-		keytable, str2name("example.org"), NULL));
+	assert_int_equal(dns_keytable_issecuredomain(keytable,
+						     str2name("example.org"),
+						     NULL, &issecure),
+			 ISC_R_SUCCESS);
+	assert_false(issecure);

 	destroy_tables();

@@ -588,7 +595,7 @@ ISC_LOOP_TEST_IMPL(dump) {
 /* check negative trust anchors */
 ISC_LOOP_TEST_IMPL(nta) {
 	isc_result_t result;
-	bool covered;
+	bool issecure, covered;
 	dns_fixedname_t fn;
 	dns_name_t *keyname = dns_fixedname_name(&fn);
 	unsigned char digest[ISC_MAX_MD_SIZE];
@@ -619,15 +626,20 @@ ISC_LOOP_TEST_IMPL(nta) {
 	assert_int_equal(result, ISC_R_SUCCESS);

 	/* Should be secure */
-	assert_true(dns_view_issecuredomain(
-		myview, str2name("test.secure.example"), now, true, &covered));
+	result = dns_view_issecuredomain(myview,
+					 str2name("test.secure.example"), now,
+					 true, &covered, &issecure);
+	assert_int_equal(result, ISC_R_SUCCESS);
 	assert_false(covered);
+	assert_true(issecure);

 	/* Should not be secure */
-	assert_false(dns_view_issecuredomain(myview,
-					     str2name("test.insecure.example"),
-					     now, true, &covered));
+	result = dns_view_issecuredomain(myview,
+					 str2name("test.insecure.example"), now,
+					 true, &covered, &issecure);
+	assert_int_equal(result, ISC_R_SUCCESS);
 	assert_true(covered);
+	assert_false(issecure);

 	/* NTA covered */
 	covered = dns_view_ntacovers(myview, now, str2name("insecure.example"),
@@ -640,30 +652,38 @@ ISC_LOOP_TEST_IMPL(nta) {
 	assert_false(covered);

 	/* As of now + 2, the NTA should be clear */
-	assert_true(dns_view_issecuredomain(myview,
-					    str2name("test.insecure.example"),
-					    now + 2, true, &covered));
+	result = dns_view_issecuredomain(myview,
+					 str2name("test.insecure.example"),
+					 now + 2, true, &covered, &issecure);
+	assert_int_equal(result, ISC_R_SUCCESS);
 	assert_false(covered);
+	assert_true(issecure);

 	/* Now check deletion */
-	assert_true(dns_view_issecuredomain(
-		myview, str2name("test.new.example"), now, true, &covered));
+	result = dns_view_issecuredomain(myview, str2name("test.new.example"),
+					 now, true, &covered, &issecure);
+	assert_int_equal(result, ISC_R_SUCCESS);
 	assert_false(covered);
+	assert_true(issecure);

 	result = dns_ntatable_add(ntatable, str2name("new.example"), false, now,
 				  3600);
 	assert_int_equal(result, ISC_R_SUCCESS);

-	assert_false(dns_view_issecuredomain(
-		myview, str2name("test.new.example"), now, true, &covered));
+	result = dns_view_issecuredomain(myview, str2name("test.new.example"),
+					 now, true, &covered, &issecure);
+	assert_int_equal(result, ISC_R_SUCCESS);
 	assert_true(covered);
+	assert_false(issecure);

 	result = dns_ntatable_delete(ntatable, str2name("new.example"));
 	assert_int_equal(result, ISC_R_SUCCESS);

-	assert_true(dns_view_issecuredomain(
-		myview, str2name("test.new.example"), now, true, &covered));
+	result = dns_view_issecuredomain(myview, str2name("test.new.example"),
+					 now, true, &covered, &issecure);
+	assert_int_equal(result, ISC_R_SUCCESS);
 	assert_false(covered);
+	assert_true(issecure);

 	isc_loopmgr_shutdown(loopmgr);
Author	SHA1	Message	Date
Ondřej Surý	0ff0495a6b	Fix the default interface-interval docs and default value When the interface-interval parser was changed from uint32 parser to duration parser, the default value stayed at plain 60 which now means 60 seconds instead of 60 minutes. Fix the default value and the documentation to match the reality.	2025-03-18 14:21:29 +01:00
Nicki Křížek	a2042e603e	chg: ci: Allow re-run of the shotgun jobs to reduce false positives The false positive rate is about 10-20 % when evaluating shotgun results from a single run. Attempt to reduce the false positive rate by allowing a re-run of failed jobs. Merge branch 'nicki/ci-shotgun-reduce-false-positives' into 'main' See merge request isc-projects/bind9!10271	2025-03-18 09:29:10 +00:00
Nicki Křížek	5eab352478	Allow re-run of the shotgun jobs to reduce false positive The false positive rate is about 10-20 % when evaluating shotgun results from a single run. Attempt to reduce the false positive rate by allowing a re-run of failed jobs. While there is a slight risk that barely noticable decreases in performance might slip by more easily in MRs, they'd still likely pop up during nightly or pre-release testing. Also increase the tolerance threshold for DoH latency comparisons, as those tests often experience increased jitter in the tail end latencies.	2025-03-18 10:19:32 +01:00
Nicki Křížek	7f8226a039	Adjust the load factor for shotgun:tcp test With the slightly decreased load for the TCP test, the results appear to be a little bit more stable.	2025-03-18 10:19:32 +01:00
Michał Kępień	192627db10	chg: test: Use isctest.asyncserver in the "qmin" test Replace custom DNS servers used in the "qmin" system test with new code based on the isctest.asyncserver module. The revised code employs zone files and a limited amount of custom logic, which massively improves test readability and maintainability, extends logging, and fixes non-compliant replies sent by some of the custom servers in response to certain queries (e.g. AA=0 in authoritative empty non-terminal responses, non-glue address records in ADDITIONAL section). Merge branch 'michal/qmin-asyncserver' into 'main' See merge request isc-projects/bind9!10195	2025-03-18 05:55:17 +00:00
Michał Kępień	dfd37918d6	Broaden vulture exclude glob for ans.py servers The vulture tool seems to be unable to follow how the parent classes defined in bin/tests/system/qmin/qmin_ans.py use mandatory properties specified by child classes in bin/tests/system/qmin/ans/ans.py. Make the tool ignore not just ans.py servers, but also _ans.py utility modules above the ansX/ subdirectories to prevent false positives about unused code from causing CI pipeline failures.	2025-03-18 06:19:01 +01:00
Michał Kępień	f413ddbe5f	Ignore .hypothesis files created by system tests Some versions of the Hypothesis Python library - notably the one included in stock OS repositories for Ubuntu 20.04 Focal Fossa - cause a .hypothesis file to be created in a Python script's working directory when the hypothesis module is present in its import chain. Ignore such files by adding them to the list of expected test artifacts to prevent pytest teardown checks from failing due to these files appearing in the file system after running system tests.	2025-03-18 06:19:01 +01:00
Michał Kępień	a799dd04ad	Fix PYTHONPATH set for ans.py servers by start.pl Commit `6c010a5644` caused the PYTHONPATH environment variable to be set for ans.py servers started using start.pl. However, no system test has actually used the new isctest.asyncserver module since that change was applied, so it has not been noticed until now that including the source directory in PYTHONPATH is only sufficient for in-tree builds. Include the build directory instead of the source directory in the PYTHONPATH environment variable set for ans.py servers started by start.pl so that they work correctly for both in-tree and out-of-tree builds.	2025-03-18 06:19:01 +01:00
Michał Kępień	7faa34c6ee	Use isctest.asyncserver in the "qmin" test Replace custom DNS servers used in the "qmin" system test with new code based on the isctest.asyncserver module. The revised code employs zone files and a limited amount of custom logic, which massively improves test readability and maintainability, extends logging, and fixes non-compliant replies sent by some of the custom servers in response to certain queries (e.g. AA=0 in authoritative empty non-terminal responses, non-glue address records in ADDITIONAL section).	2025-03-18 06:19:01 +01:00
Ondřej Surý	575a2e5f11	rem: dev: Cleanup BIND 8 compatibility code There was some code in dns_resolver unit meant to keep compatibility with BIND 8 breaking the DNS protocol. These should not be needed anymore. Merge branch 'ondrej/resolver-bind-8-cleanup' into 'main' See merge request isc-projects/bind9!10270	2025-03-18 00:12:31 +00:00
Ondřej SurýandEvan Hunt	0d9f58b745	Remove a kludge to process non-authoritative CNAME response A BIND 8 server could return a non-authoritative answer when a CNAME is followed. This is no longer handled as a valid answer.	2025-03-17 23:23:24 +00:00
Ondřej SurýandEvan Hunt	05d6542e6d	Remove the kludges for records in the bad sections There were kludges to help process responses from authoritative servers giving RRs in wrong sections (mentioning BIND 8). These should just go away and such responses should not be processed.	2025-03-17 23:23:24 +00:00
Ondřej SurýandEvan Hunt	ff73d37f69	Small cleanup in dns_adb unit	2025-03-17 23:23:24 +00:00
Michal Nowak	9d9e9d9cb1	chg: ci: Disable linkcheck on dl.acm.org The check fails with the following error for some time: 403 Client Error: Forbidden for url: https://dl.acm.org/doi/10.1145/1315245.1315298 Merge branch 'mnowak/linkcheck-disable-dl-acm-org' into 'main' See merge request isc-projects/bind9!10272	2025-03-17 17:07:40 +00:00
Michal Nowak	1ab889ee21	Disable linkcheck on dl.acm.org The check fails with the following error for some time: 403 Client Error: Forbidden for url: https://dl.acm.org/doi/10.1145/1315245.1315298	2025-03-17 17:39:36 +01:00
Arаm Sаrgsyаn	ae2fd7ef15	new: dev: Implement -T cookiealwaysvalid When `-T cookiealwaysvalid` is passed to `named`, DNS cookie checks for the incoming queries always pass, given they are structurally correct. Merge branch 'aram/new-named-minus-T-option-of-cookiealwaysvalid' into 'main' See merge request isc-projects/bind9!10232	2025-03-17 11:36:57 +00:00
Aram Sargsyan	4e75a20b6a	Test -T cookiealwaysvalid Add a check in the "cookie" system test to make sure that the new '-T cookiealwaysvalid' option works.	2025-03-17 10:42:47 +00:00
Aram Sargsyan	807ef8545d	Implement -T cookiealwaysvalid When -T cookiealwaysvalid is passed to named, DNS cookie checks for the incoming queries always pass, given they are structurally correct.	2025-03-17 10:42:47 +00:00
Mark Andrews	06427720f7	fix: dev: Add missing locks when returning addresses Add missing locks in dns_zone_getxfrsource4 et al. Addresses CID 468706, 468708, 468741, 468742, 468785, and 468778. Cleanup dns_zone_setxfrsource4 et al to now return void. Remove double copies with dns_zone_getprimaryaddr and dns_zone_getsourceaddr. Closes #4933 Merge branch '4933-add-missing-locks-when-returning-addresses' into 'main' See merge request isc-projects/bind9!9485	2025-03-15 06:04:34 +00:00
Mark Andrews	d0a59277fb	Add missing locks when returning addresses Add missing locks in dns_zone_getxfrsource4 et al. Addresses CID 468706, 468708, 468741, 468742, 468785 and 468778. Cleanup dns_zone_setxfrsource4 et al to now return void. Remove double copies with dns_zone_getprimaryaddr and dns_zone_getsourceaddr.	2025-03-15 04:51:59 +00:00