WIP: Add preliminary DoH client support to dig

Unit-test fixes and manual page updates for DoH configuration
This commit contains fixes to unit tests to make them work well on various platforms (in particular ones shipping old versions of OpenSSL) and fo different configurations. It also updates the generated manpage to include DoH configuration options.
2021-02-02 20:20:10 +02:00 · 2021-02-02 20:20:10 +02:00 · 2021-02-02 20:20:01 +02:00 · 2021-02-02 20:02:13 +02:00 · 2021-02-02 19:53:34 +02:00 · 2021-02-02 19:44:52 +02:00
628 changed files with 26227 additions and 28238 deletions
@@ -1,15 +0,0 @@
 name: 'Lock down mirror repository'
 on:
  issues:
    types: opened
  pull_request:
    types: opened
 jobs:
  lockdown:
    runs-on: ubuntu-latest
    steps:
      - uses: dessant/repo-lockdown@v2
        with:
          github-token: ${{ github.token }}
@@ -56,6 +56,7 @@ Makefile
 Makefile.in
 ans.run
 gen.dSYM/
 kyua.log
 named.memstats
 named.run
 timestamp
@@ -8,6 +8,9 @@ variables:
  CCACHE_DIR: "/ccache"
  SOFTHSM2_CONF: "/var/tmp/softhsm2/softhsm2.conf"
  # VirtualBox driver needs to set build_dir to "/builds" in gitlab-runner.toml
  KYUA_RESULT: "$CI_PROJECT_DIR/kyua.results"
  GIT_DEPTH: 1
  BUILD_PARALLEL_JOBS: 6
  TEST_PARALLEL_JOBS: 6
@@ -22,7 +25,7 @@ variables:
  # Pass run-time flags to AddressSanitizer to get core dumps on error.
  ASAN_OPTIONS_COMMON: abort_on_error=1:disable_coredump=0:unmap_shadow_on_exit=1
-  TSAN_OPTIONS_COMMON: "disable_coredump=0 second_deadlock_stack=1 history_size=7 log_exe_name=true log_path=tsan external_symbolizer_path=/usr/lib/llvm-11/bin/llvm-symbolizer"
+  TSAN_OPTIONS_COMMON: "second_deadlock_stack=1 history_size=7 log_exe_name=true log_path=tsan external_symbolizer_path=/usr/lib/llvm-11/bin/llvm-symbolizer"
  TARBALL_EXTENSION: xz
@@ -34,15 +37,11 @@ variables:
  WITH_READLINE_LIBEDIT: "--with-readline=libedit"
  WITH_READLINE_READLINE: "--with-readline=readline"
-  INSTALL_PATH: "${CI_PROJECT_DIR}/.local"
+  BIND_INSTALL_PATH: "${CI_PROJECT_DIR}/.local"
  # In multithreaded unit tests, abort on the first failure
  CMOCKA_TEST_ABORT: 1
  # Disable pytest's "cacheprovider" plugin to prevent it from creating
  # cross-testrun files as there is no need to use that feature in CI.
  PYTEST_ADDOPTS: "-p no:cacheprovider"
  # Default platforms to run "stress" tests on
  BIND_STRESS_TEST_OS: linux
  BIND_STRESS_TEST_ARCH: amd64
@@ -71,6 +70,11 @@ stages:
    - linux
    - amd64
 .linux-i386: &linux_i386
  tags:
    - linux
    - i386
 .linux-stress-amd64: &linux_stress_amd64
  tags:
    - amd64
@@ -101,8 +105,8 @@ stages:
 # Alpine Linux
-.alpine-3.13-amd64: &alpine_3_13_amd64_image
+.alpine-3.12-amd64: &alpine_3_12_amd64_image
-  image: "$CI_REGISTRY_IMAGE:alpine-3.13-amd64"
+  image: "$CI_REGISTRY_IMAGE:alpine-3.12-amd64"
  <<: *linux_amd64
 # CentOS
@@ -129,6 +133,10 @@ stages:
  image: "$CI_REGISTRY_IMAGE:debian-sid-amd64"
  <<: *linux_amd64
 .debian-sid-i386: &debian_sid_i386_image
  image: "$CI_REGISTRY_IMAGE:debian-sid-i386"
  <<: *linux_i386
 # openSUSE Tumbleweed
 .tumbleweed-latest-amd64: &tumbleweed_latest_amd64_image
@@ -137,18 +145,18 @@ stages:
 # Fedora
-.fedora-34-amd64: &fedora_34_amd64_image
+.fedora-33-amd64: &fedora_33_amd64_image
-  image: "$CI_REGISTRY_IMAGE:fedora-34-amd64"
+  image: "$CI_REGISTRY_IMAGE:fedora-33-amd64"
  <<: *linux_amd64
-.fedora-34-arm64: &fedora_34_arm64_image
+.fedora-33-arm64: &fedora_33_arm64_image
-  image: "$CI_REGISTRY_IMAGE:fedora-34-arm64"
+  image: "$CI_REGISTRY_IMAGE:fedora-33-arm64"
  <<: *linux_stress_arm64
 # Ubuntu
-.ubuntu-bionic-amd64: &ubuntu_bionic_amd64_image
+.ubuntu-xenial-amd64: &ubuntu_xenial_amd64_image
-  image: "$CI_REGISTRY_IMAGE:ubuntu-bionic-amd64"
+  image: "$CI_REGISTRY_IMAGE:ubuntu-xenial-amd64"
  <<: *linux_amd64
 .ubuntu-focal-amd64: &ubuntu_focal_amd64_image
@@ -177,12 +185,8 @@ stages:
  image: "freebsd-12.2-x86_64"
  <<: *libvirt_amd64
 .freebsd-13-amd64: &freebsd_13_amd64_image
  image: "freebsd-13.0-x86_64"
  <<: *libvirt_amd64
 .openbsd-amd64: &openbsd_amd64_image
-  image: "openbsd-6.9-x86_64"
+  image: "openbsd-6.8-x86_64"
  <<: *libvirt_amd64
 ### Job Templates
@@ -203,12 +207,6 @@ stages:
    - main@isc-projects/bind9
    - /^v9_[1-9][0-9]$/@isc-projects/bind9
 .schedules-tags-web-triggering-rules: &schedules_tags_web_triggering_rules
  only:
    - schedules
    - tags
    - web
 .precheck: &precheck_job
  <<: *default_triggering_rules
  <<: *base_image
@@ -228,13 +226,12 @@ stages:
    ${CONFIGURE} \
    --disable-maintainer-mode \
    --enable-developer \
    --enable-option-checking=fatal \
    --enable-dnstap \
    --with-cmocka \
    --with-libxml2 \
    --with-json-c \
    --prefix="${BIND_INSTALL_PATH}" \
    $EXTRA_CONFIGURE \
-    || (test -s config.log && cat config.log; exit 1)
+    || cat config.log
 .check_readline_setup: &check_readline_setup |
    if [[ -n "${WITHOUT_READLINE}" ]]; then \
@@ -251,18 +248,6 @@ stages:
      grep "^#define HAVE_READLINE_READLINE" config.h; \
    fi
 # Move the out-of-tree workspace to CI project dir to save it for use in
 # dependent jobs.
 .save_out_of_tree_workspace: &save_out_of_tree_workspace
  - test -n "${OUT_OF_TREE_WORKSPACE}" && mv "${OUT_OF_TREE_WORKSPACE}" "${CI_PROJECT_DIR}"
 # Move the artifacts from the out-of-tree build job to their original
 # location (the out-of-tree workspace) and then continue work in the
 # out-of-tree workspace.
 .retrieve_out_of_tree_workspace: &retrieve_out_of_tree_workspace
  - test -n "${OUT_OF_TREE_WORKSPACE}" && mv "$(basename "${OUT_OF_TREE_WORKSPACE}")" "${OUT_OF_TREE_WORKSPACE}"
  - test -n "${OUT_OF_TREE_WORKSPACE}" && cd "${OUT_OF_TREE_WORKSPACE}"
 .build: &build_job
  <<: *default_triggering_rules
  stage: build
@@ -273,12 +258,11 @@ stages:
    - *configure
    - *check_readline_setup
    - make -j${BUILD_PARALLEL_JOBS:-1} -k all V=1
-    - test -z "${RUN_MAKE_INSTALL}" || make DESTDIR="${INSTALL_PATH}" install
+    - test -z "${RUN_MAKE_INSTALL}" || make install
-    - test -z "${RUN_MAKE_INSTALL}" || DESTDIR="${INSTALL_PATH}" sh util/check-make-install
+    - test -z "${RUN_MAKE_INSTALL}" || sh util/check-make-install
    - if [[ "${CFLAGS}" == *"-fsanitize=address"* ]]; then ( ! grep -F AddressSanitizer config.log ); fi
    - if test -z "${OUT_OF_TREE_WORKSPACE}" && test "$(git status --porcelain | grep -Ev '\?\?' | wc -l)" -gt "0"; then git status --short; exit 1; fi
  after_script:
-    - *save_out_of_tree_workspace
+    - test -n "${OUT_OF_TREE_WORKSPACE}" && mv "${OUT_OF_TREE_WORKSPACE}" "${CI_PROJECT_DIR}"
  needs:
    - job: autoreconf
      artifacts: true
@@ -329,17 +313,19 @@ stages:
  stage: system
  before_script:
    - *setup_softhsm
-    - *retrieve_out_of_tree_workspace
+    # Move the artifacts from the out-of-tree build job to their original location (the out-of-tree workspace).
    - test -n "${OUT_OF_TREE_WORKSPACE}" && mv "$(basename "${OUT_OF_TREE_WORKSPACE}")" "${OUT_OF_TREE_WORKSPACE}"
    # Continue work in the out-of-tree workspace.
    - test -n "${OUT_OF_TREE_WORKSPACE}" && cd "${OUT_OF_TREE_WORKSPACE}"
    - *setup_interfaces
  script:
    - cd bin/tests/system
    - make -j${TEST_PARALLEL_JOBS:-1} -k check V=1
    - if git rev-parse > /dev/null 2>&1; then ( ! grep "^I:.*:file.*not removed$" *.log ); fi
  after_script:
    - test -n "${OUT_OF_TREE_WORKSPACE}" && cd "${OUT_OF_TREE_WORKSPACE}"
    - test -d bind-* && cd bind-*
    - cat bin/tests/system/test-suite.log
-    - *save_out_of_tree_workspace
+    - test -n "${OUT_OF_TREE_WORKSPACE}" && mv "${OUT_OF_TREE_WORKSPACE}" "${CI_PROJECT_DIR}"
 .system_test: &system_test_job
  <<: *system_test_common
@@ -357,6 +343,7 @@ stages:
 .system_test_tsan: &system_test_tsan_job
  <<: *system_test_common
  allow_failure: true
  after_script:
    - cat bin/tests/system/test-suite.log
    - find bin -name 'tsan.*' -exec python3 util/parse_tsan.py {} \;
@@ -365,8 +352,14 @@ stages:
    untracked: true
    when: on_failure
 .kyua_report: &kyua_report_html |
  kyua --logfile /dev/null report-html \
       --force \
       --results-file "$KYUA_RESULT" \
       --results-filter "" \
       --output kyua_html
 .windows_system_test: &windows_system_test_job
  <<: *schedules_tags_web_triggering_rules
  stage: system
  script:
    - 'Push-Location bin/tests/system'
@@ -382,17 +375,19 @@ stages:
    untracked: true
    expire_in: "1 day"
    when: on_failure
  only:
    - schedules
    - tags
    - web
 .unit_test_common: &unit_test_common
  <<: *default_triggering_rules
  stage: unit
  before_script:
    - if [ -n "$TCP_CONNECTIONTIMEOUT" ]; then sudo sysctl 'net.inet.tcp.keepinittime=1'; fi
    - *setup_softhsm
    - *retrieve_out_of_tree_workspace
  script:
    - make -j${TEST_PARALLEL_JOBS:-1} -k unit V=1
  after_script:
    - *save_out_of_tree_workspace
 .unit_test: &unit_test_job
  <<: *unit_test_common
@@ -520,6 +515,8 @@ flake8:
  script:
    - *configure
    - flake8 --max-line-length=80 $(git ls-files '*.py' | grep -vE '(ans\.py|dangerfile\.py)')
  only:
    - merge_requests
 pylint:
  <<: *default_triggering_rules
@@ -532,6 +529,8 @@ pylint:
    - *configure
    - PYTHONPATH="$PYTHONPATH:$CI_PROJECT_DIR/bin/python"
    - pylint --rcfile $CI_PROJECT_DIR/.pylintrc $(git ls-files '*.py' | grep -vE '(ans\.py|dangerfile\.py)')
  only:
    - merge_requests
 tarball-create:
  stage: precheck
@@ -563,8 +562,6 @@ docs:
  script:
    - *configure
    - make -j${BUILD_PARALLEL_JOBS:-1} -k doc V=1
    - qpdf --check doc/arm/_build/latex/Bv9ARM.pdf
    - find doc/man/ -maxdepth 1 -name "*.[0-9]" -exec mandoc -T lint "{}" \; | ( ! grep -v -e "skipping paragraph macro. sp after" -e "unknown font, skipping request. ft C" )
  needs:
    - job: autoreconf
      artifacts: true
@@ -588,28 +585,28 @@ push:docs:
    - main@isc-projects/bind9
    - /^v9_[1-9][0-9]$/@isc-projects/bind9
-# Jobs for regular GCC builds on Alpine Linux 3.13 (amd64)
+# Jobs for regular GCC builds on Alpine Linux 3.12 (amd64)
-gcc:alpine3.13:amd64:
+gcc:alpine3.12:amd64:
  variables:
    CC: gcc
    CFLAGS: "${CFLAGS_COMMON}"
-    EXTRA_CONFIGURE: "${WITHOUT_READLINE}"
+    EXTRA_CONFIGURE: "--enable-dnstap ${WITHOUT_READLINE}"
-  <<: *alpine_3_13_amd64_image
+  <<: *alpine_3_12_amd64_image
  <<: *build_job
-system:gcc:alpine3.13:amd64:
+system:gcc:alpine3.12:amd64:
-  <<: *alpine_3_13_amd64_image
+  <<: *alpine_3_12_amd64_image
  <<: *system_test_job
  needs:
-    - job: gcc:alpine3.13:amd64
+    - job: gcc:alpine3.12:amd64
      artifacts: true
-unit:gcc:alpine3.13:amd64:
+unit:gcc:alpine3.12:amd64:
-  <<: *alpine_3_13_amd64_image
+  <<: *alpine_3_12_amd64_image
  <<: *unit_test_job
  needs:
-    - job: gcc:alpine3.13:amd64
+    - job: gcc:alpine3.12:amd64
      artifacts: true
 # Jobs for regular GCC builds on CentOS 7 (amd64)
@@ -618,7 +615,7 @@ gcc:centos7:amd64:
  variables:
    CC: gcc
    CFLAGS: "${CFLAGS_COMMON}"
-    EXTRA_CONFIGURE: "--with-libidn2"
+    EXTRA_CONFIGURE: "--enable-dnstap --with-libidn2"
  <<: *centos_centos7_amd64_image
  <<: *build_job
@@ -666,7 +663,6 @@ gcc:stretch:amd64:
  variables:
    CC: gcc
    CFLAGS: "${CFLAGS_COMMON} -O2"
    EXTRA_CONFIGURE: "--without-cmocka --without-gssapi"
  <<: *debian_stretch_amd64_image
  <<: *build_job
@@ -690,7 +686,7 @@ gcc:buster:amd64:
  variables:
    CC: gcc
    CFLAGS: "${CFLAGS_COMMON} --coverage -O0"
-    EXTRA_CONFIGURE: "--with-libidn2 ${WITH_READLINE_LIBEDIT}"
+    EXTRA_CONFIGURE: "--enable-dnstap --with-libidn2 ${WITH_READLINE_LIBEDIT}"
  <<: *debian_buster_amd64_image
  <<: *build_job
@@ -726,7 +722,7 @@ scan-build:
    CC: "${CLANG}"
    CFLAGS: "${CFLAGS_COMMON}"
    CONFIGURE: "${SCAN_BUILD} ./configure"
-    EXTRA_CONFIGURE: "--with-libidn2"
+    EXTRA_CONFIGURE: "--enable-dnstap --with-libidn2"
  script:
    - *configure
    - *scan_build
@@ -746,7 +742,7 @@ gcc:sid:amd64:
  variables:
    CC: gcc
    CFLAGS: "${CFLAGS_COMMON} -O3"
-    EXTRA_CONFIGURE: "--with-libidn2 --without-lmdb"
+    EXTRA_CONFIGURE: "--enable-dnstap --with-libidn2 --without-lmdb"
    RUN_MAKE_INSTALL: 1
  <<: *debian_sid_amd64_image
  <<: *build_job
@@ -777,7 +773,7 @@ gcc:out-of-tree:
    CC: gcc
    CFLAGS: "${CFLAGS_COMMON} -Og"
    CONFIGURE: "${CI_PROJECT_DIR}/configure"
-    EXTRA_CONFIGURE: "--with-libidn2 --with-lmdb"
+    EXTRA_CONFIGURE: "--enable-dnstap --with-libidn2 --with-lmdb"
    RUN_MAKE_INSTALL: 1
    OUT_OF_TREE_WORKSPACE: /tmp/out_of_tree_workspace
  <<: *base_image
@@ -791,24 +787,17 @@ system:gcc:out-of-tree:
      artifacts: true
  <<: *base_image
  <<: *system_test_job
-  <<: *schedules_tags_web_triggering_rules
+  only:
-
+    - schedules
-unit:gcc:out-of-tree:
+    - tags
-  variables:
+    - web
    OUT_OF_TREE_WORKSPACE: /tmp/out_of_tree_workspace
  needs:
    - job: gcc:out-of-tree
      artifacts: true
  <<: *base_image
  <<: *unit_test_job
  <<: *schedules_tags_web_triggering_rules
 # Jobs for tarball GCC builds on Debian 10 "buster" (amd64)
 gcc:tarball:
  variables:
    CC: gcc
-    EXTRA_CONFIGURE: "--with-libidn2"
+    EXTRA_CONFIGURE: "--enable-dnstap --with-libidn2"
    RUN_MAKE_INSTALL: 1
  <<: *base_image
  <<: *build_job
@@ -819,27 +808,58 @@ gcc:tarball:
  needs:
    - job: tarball-create
      artifacts: true
  only:
    - schedules
    - tags
 system:gcc:tarball:
  <<: *base_image
  <<: *system_test_job
  <<: *schedules_tags_web_triggering_rules
  before_script:
    - cd bind-*
    - *setup_interfaces
  needs:
    - job: gcc:tarball
      artifacts: true
  only:
    - schedules
    - tags
 unit:gcc:tarball:
  <<: *base_image
  <<: *unit_test_job
  <<: *schedules_tags_web_triggering_rules
  before_script:
    - cd bind-*
  needs:
    - job: gcc:tarball
      artifacts: true
  only:
    - schedules
    - tags
 # Jobs for regular GCC builds on Debian "sid" (i386)
 gcc:sid:i386:
  variables:
    CC: gcc
    CFLAGS: "${CFLAGS_COMMON}"
    EXTRA_CONFIGURE: "--with-libidn2"
  <<: *debian_sid_i386_image
  <<: *build_job
 system:gcc:sid:i386:
  <<: *debian_sid_i386_image
  <<: *system_test_job
  needs:
    - job: gcc:sid:i386
      artifacts: true
 unit:gcc:sid:i386:
  <<: *debian_sid_i386_image
  <<: *unit_test_job
  needs:
    - job: gcc:sid:i386
      artifacts: true
 # Jobs for debug GCC builds on openSUSE Tumbleweed (amd64)
@@ -865,28 +885,28 @@ unit:gcc:tumbleweed:amd64:
    - job: gcc:tumbleweed:amd64
      artifacts: true
-# Jobs for regular GCC builds on Ubuntu 18.04 Bionic Beaver (amd64)
+# Jobs for regular GCC builds on Ubuntu 16.04 Xenial Xerus (amd64)
-gcc:bionic:amd64:
+gcc:xenial:amd64:
  variables:
    CC: gcc
    CFLAGS: "${CFLAGS_COMMON} -O2"
-    EXTRA_CONFIGURE: "--disable-dnstap --disable-geoip"
+    EXTRA_CONFIGURE: "--disable-geoip"
-  <<: *ubuntu_bionic_amd64_image
+  <<: *ubuntu_xenial_amd64_image
  <<: *build_job
-system:gcc:bionic:amd64:
+system:gcc:xenial:amd64:
-  <<: *ubuntu_bionic_amd64_image
+  <<: *ubuntu_xenial_amd64_image
  <<: *system_test_job
  needs:
-    - job: gcc:bionic:amd64
+    - job: gcc:xenial:amd64
      artifacts: true
-unit:gcc:bionic:amd64:
+unit:gcc:xenial:amd64:
-  <<: *ubuntu_bionic_amd64_image
+  <<: *ubuntu_xenial_amd64_image
  <<: *unit_test_job
  needs:
-    - job: gcc:bionic:amd64
+    - job: gcc:xenial:amd64
      artifacts: true
 # Jobs for regular GCC builds on Ubuntu 20.04 Focal Fossa (amd64)
@@ -918,7 +938,7 @@ unit:gcc:focal:amd64:
 gcc:asan:
  variables:
    CC: gcc
-    CFLAGS: "${CFLAGS_COMMON} -fsanitize=address,undefined"
+    CFLAGS: "${CFLAGS_COMMON} -fsanitize=address,undefined -DISC_MEM_USE_INTERNAL_MALLOC=0"
    LDFLAGS: "-fsanitize=address,undefined"
    EXTRA_CONFIGURE: "--with-libidn2"
  <<: *base_image
@@ -945,7 +965,7 @@ unit:gcc:asan:
 clang:asan:
  variables:
    CC: ${CLANG}
-    CFLAGS: "${CFLAGS_COMMON} -fsanitize=address,undefined"
+    CFLAGS: "${CFLAGS_COMMON} -fsanitize=address,undefined -DISC_MEM_USE_INTERNAL_MALLOC=0"
    LDFLAGS: "-fsanitize=address,undefined"
    EXTRA_CONFIGURE: "--with-libidn2"
  <<: *base_image
@@ -976,7 +996,7 @@ gcc:tsan:
  <<: *build_job
  variables:
    CC: gcc
-    CFLAGS: "${CFLAGS_COMMON} -fsanitize=thread"
+    CFLAGS: "${CFLAGS_COMMON} -fsanitize=thread -DISC_MEM_USE_INTERNAL_MALLOC=0"
    LDFLAGS: "-fsanitize=thread"
    EXTRA_CONFIGURE: "--with-libidn2 --enable-pthread-rwlock"
@@ -991,7 +1011,7 @@ system:gcc:tsan:
 unit:gcc:tsan:
  variables:
-    TSAN_OPTIONS: ${TSAN_OPTIONS_COMMON} suppressions=$CI_PROJECT_DIR/tsan-suppressions.txt
+    TSAN_OPTIONS: ${TSAN_OPTIONS_COMMON}
  <<: *base_image
  <<: *unit_test_tsan_job
  needs:
@@ -1003,7 +1023,7 @@ clang:tsan:
  <<: *build_job
  variables:
    CC: "${CLANG}"
-    CFLAGS: "${CFLAGS_COMMON} -fsanitize=thread"
+    CFLAGS: "${CFLAGS_COMMON} -fsanitize=thread -DISC_MEM_USE_INTERNAL_MALLOC=0"
    LDFLAGS: "-fsanitize=thread"
    EXTRA_CONFIGURE: "--with-libidn2 --enable-pthread-rwlock"
@@ -1018,7 +1038,7 @@ system:clang:tsan:
 unit:clang:tsan:
  variables:
-    TSAN_OPTIONS: ${TSAN_OPTIONS_COMMON} suppressions=$CI_PROJECT_DIR/tsan-suppressions.txt
+    TSAN_OPTIONS: ${TSAN_OPTIONS_COMMON}
  <<: *base_image
  <<: *unit_test_tsan_job
  needs:
@@ -1030,7 +1050,7 @@ unit:clang:tsan:
 gcc:mutexatomics:
  variables:
    CC: gcc
-    CFLAGS: "${CFLAGS_COMMON}"
+    CFLAGS: "${CFLAGS_COMMON} -DISC_MEM_USE_INTERNAL_MALLOC=0"
    EXTRA_CONFIGURE: "--with-libidn2 --enable-mutex-atomics"
  <<: *base_image
  <<: *build_job
@@ -1096,25 +1116,25 @@ unit:gcc:softhsm2.4:
    - job: gcc:softhsm2.4
      artifacts: true
-# Jobs for PKCS#11-enabled GCC builds on Fedora 34 (amd64)
+# Jobs for PKCS#11-enabled GCC builds on Fedora 33 (amd64)
 gcc:softhsm2.6:
  variables:
    CC: gcc
    CFLAGS: "${CFLAGS_COMMON} -O1"
    EXTRA_CONFIGURE: "--with-libidn2 --enable-native-pkcs11 --with-pkcs11=/usr/lib64/pkcs11/libsofthsm2.so"
-  <<: *fedora_34_amd64_image
+  <<: *fedora_33_amd64_image
  <<: *build_job
 system:gcc:softhsm2.6:
-  <<: *fedora_34_amd64_image
+  <<: *fedora_33_amd64_image
  <<: *system_test_job
  needs:
    - job: gcc:softhsm2.6
      artifacts: true
 unit:gcc:softhsm2.6:
-  <<: *fedora_34_amd64_image
+  <<: *fedora_33_amd64_image
  <<: *unit_test_job
  needs:
    - job: gcc:softhsm2.6
@@ -1129,12 +1149,10 @@ clang:freebsd11:amd64:
    USER: gitlab-runner
  <<: *freebsd_11_amd64_image
  <<: *build_job
  <<: *schedules_tags_web_triggering_rules
 system:clang:freebsd11:amd64:
  <<: *freebsd_11_amd64_image
  <<: *system_test_job
  <<: *schedules_tags_web_triggering_rules
  variables:
    USER: gitlab-runner
    TEST_PARALLEL_JOBS: 4
@@ -1145,7 +1163,6 @@ system:clang:freebsd11:amd64:
 unit:clang:freebsd11:amd64:
  <<: *freebsd_11_amd64_image
  <<: *unit_test_job
  <<: *schedules_tags_web_triggering_rules
  needs:
    - job: clang:freebsd11:amd64
      artifacts: true
@@ -1155,7 +1172,7 @@ unit:clang:freebsd11:amd64:
 clang:freebsd12:amd64:
  variables:
    CFLAGS: "${CFLAGS_COMMON}"
-    EXTRA_CONFIGURE: "${WITH_READLINE_EDITLINE}"
+    EXTRA_CONFIGURE: "--enable-dnstap ${WITH_READLINE_EDITLINE}"
    USER: gitlab-runner
  <<: *freebsd_12_amd64_image
  <<: *build_job
@@ -1177,40 +1194,12 @@ unit:clang:freebsd12:amd64:
    - job: clang:freebsd12:amd64
      artifacts: true
 # Jobs for Clang builds on FreeBSD 13 (amd64)
 clang:freebsd13:amd64:
  variables:
    CFLAGS: "${CFLAGS_COMMON}"
    EXTRA_CONFIGURE: "${WITH_READLINE_LIBEDIT}"
    USER: gitlab-runner
  <<: *freebsd_13_amd64_image
  <<: *build_job
 system:clang:freebsd13:amd64:
  <<: *freebsd_13_amd64_image
  <<: *system_test_job
  variables:
    USER: gitlab-runner
    TEST_PARALLEL_JOBS: 4
  needs:
    - job: clang:freebsd13:amd64
      artifacts: true
 unit:clang:freebsd13:amd64:
  <<: *freebsd_13_amd64_image
  <<: *unit_test_job
  needs:
    - job: clang:freebsd13:amd64
      artifacts: true
 # Jobs for Clang builds on OpenBSD (amd64)
 clang:openbsd:amd64:
  variables:
    CC: clang
    USER: gitlab-runner
    EXTRA_CONFIGURE: "--disable-dnstap"
  <<: *openbsd_amd64_image
  <<: *build_job
@@ -1231,6 +1220,8 @@ unit:clang:openbsd:amd64:
  <<: *unit_test_job
  variables:
    USER: gitlab-runner
    # There's no socket option on OpenBSD, so we need to set this globally
    TCP_CONNECTIONTIMEOUT: 1
  needs:
    - job: clang:openbsd:amd64
      artifacts: true
@@ -1256,9 +1247,12 @@ system:msvc:windows:amd64:
 msvc-debug:windows:amd64:
  <<: *windows_server_2016_amd64_image
  <<: *windows_build_job
  <<: *schedules_tags_web_triggering_rules
  variables:
    VSCONF: Debug
  only:
    - schedules
    - tags
    - web
 system:msvc-debug:windows:amd64:
  <<: *windows_server_2016_amd64_image
@@ -1350,7 +1344,7 @@ coverity:
  variables:
    CC: gcc
    CFLAGS: "${CFLAGS_COMMON} -Og"
-    EXTRA_CONFIGURE: "--with-libidn2"
+    EXTRA_CONFIGURE: "--enable-dnstap --with-libidn2"
  script:
    - *coverity_cache_prep
    - *configure
@@ -1416,10 +1410,10 @@ respdiff:
    - *setup_interfaces
    - *setup_softhsm
    - make -j${BUILD_PARALLEL_JOBS:-1} -k all V=1
-    - make DESTDIR="${INSTALL_PATH}" install
+    - make install
    - git clone --depth 1 https://gitlab-ci-token:${CI_JOB_TOKEN}@gitlab.isc.org/isc-private/bind-qa.git
    - cd bind-qa/bind9/stress
-    - LD_LIBRARY_PATH="${INSTALL_PATH}/usr/local/lib" BIND_INSTALL_PATH="${INSTALL_PATH}/usr/local" WORKSPACE="${CI_PROJECT_DIR}" bash stress.sh
+    - DIG="${BIND_INSTALL_PATH}/bin/dig" WORKSPACE="${CI_PROJECT_DIR}" bash stress.sh
  needs:
    - job: autoreconf
      artifacts: true
@@ -1429,8 +1423,8 @@ respdiff:
    when: always
  timeout: 2h
-stress:authoritative:fedora:34:amd64:
+stress:authoritative:fedora:33:amd64:
-  <<: *fedora_34_amd64_image
+  <<: *fedora_33_amd64_image
  <<: *linux_stress_amd64
  <<: *stress_job
  variables:
@@ -1443,8 +1437,8 @@ stress:authoritative:fedora:34:amd64:
    variables:
      - $CI_COMMIT_TAG || ($BIND_STRESS_TEST_OS =~ /linux/i && $BIND_STRESS_TEST_MODE =~ /authoritative/i && $BIND_STRESS_TEST_ARCH =~ /amd64/i)
-stress:recursive:fedora:34:amd64:
+stress:recursive:fedora:33:amd64:
-  <<: *fedora_34_amd64_image
+  <<: *fedora_33_amd64_image
  <<: *linux_stress_amd64
  <<: *stress_job
  variables:
@@ -1457,8 +1451,8 @@ stress:recursive:fedora:34:amd64:
    variables:
      - $CI_COMMIT_TAG || ($BIND_STRESS_TEST_OS =~ /linux/i && $BIND_STRESS_TEST_MODE =~ /recursive/i && $BIND_STRESS_TEST_ARCH =~ /amd64/i)
-stress:authoritative:fedora:34:arm64:
+stress:authoritative:fedora:33:arm64:
-  <<: *fedora_34_arm64_image
+  <<: *fedora_33_arm64_image
  <<: *linux_stress_arm64
  <<: *stress_job
  variables:
@@ -1471,8 +1465,8 @@ stress:authoritative:fedora:34:arm64:
    variables:
      - $CI_COMMIT_TAG || ($BIND_STRESS_TEST_OS =~ /linux/i && $BIND_STRESS_TEST_MODE =~ /authoritative/i && $BIND_STRESS_TEST_ARCH =~ /arm64/i)
-stress:recursive:fedora:34:arm64:
+stress:recursive:fedora:33:arm64:
-  <<: *fedora_34_arm64_image
+  <<: *fedora_33_arm64_image
  <<: *linux_stress_arm64
  <<: *stress_job
  variables:
@@ -1,33 +0,0 @@
 <!--
 THIS ISSUE TEMPLATE IS INTENDED ONLY FOR INTERNAL USE.
 If the bug you are reporting is potentially security-related - for example,
 if it involves an assertion failure or other crash in `named` that can be
 triggered repeatedly - then please do *NOT* report it here, but send an
 email to [security-officer@isc.org](security-officer@isc.org).
 -->
 ### CVE-specific actions
  - [ ] Assign a CVE identifier
  - [ ] Determine CVSS score
  - [ ] Determine the range of BIND versions affected (including the Subscription Edition)
  - [ ] Determine whether workarounds for the problem exists
  - [ ] Create a draft of the security advisory and put the information above in there
  - [ ] Prepare a detailed description of the problem which should include the following by default:
      - instructions for reproducing the problem (a system test is good enough)
      - explanation of code flow which triggers the problem (a system test is *not* good enough)
  - [ ] Prepare a private merge request containing the following items in separate commits:
      - a test for the issue (may be moved to a separate merge request for deferred merging)
      - a fix for the issue
      - documentation updates (`CHANGES`, release notes, anything else applicable)
  - [ ] Ensure the merge request from the previous step is reviewed by SWENG staff and has no outstanding discussions
  - [ ] Ensure the documentation changes introduced by the merge request addressing the problem are reviewed by Support and Marketing staff
  - [ ] Prepare backports of the merge request addressing the problem for all affected (and still maintained) BIND branches (backporting might affect the issue's scope and/or description)
  - [ ] Prepare a standalone patch for the last stable release of each affected (and still maintained) BIND branch
 ### Release-specific actions
  - [ ] Create/update the private issue containing links to fixes & reproducers for all CVEs fixed in a given release cycle
  - [ ] Reserve a block of `CHANGES` placeholders once the complete set of vulnerabilities fixed in a given release cycle is determined
  - [ ] Ensure the merge requests containing CVE fixes are merged into `security-*` branches in CVE identifier order
@@ -71,7 +71,7 @@
 - [ ] ***(Support)*** Publish links to downloads on ISC website.
 - [ ] ***(Support)*** Write release email to *bind-announce*.
 - [ ] ***(Support)*** Write email to *bind-users* (if a major release).
- - [ ] ***(Support)*** Send eligible customers updated links to the Subscription Edition (update the -S edition delivery tickets, even if those links were provided earlier via an ASN ticket).
+ - [ ] ***(Support)*** Send eligible customers updated links to the Subscription Edition.
 - [ ] ***(Support)*** Update tickets in case of waiting support customers.
 - [ ] ***(QA)*** Build and test any outstanding private packages.
 - [ ] ***(QA)*** Build public packages (`*.deb`, RPMs).
@@ -85,9 +85,7 @@
 - [ ] ***(QA)*** Merge the automatically prepared `prep 9.x.y` commit which updates `version` and documentation on the release branch into the relevant maintenance branch (`v9_x`).
 - [ ] ***(QA)*** For each maintained branch, update the `BIND_BASELINE_VERSION` variable for the `abi-check` job in `.gitlab-ci.yml` to the latest published BIND version tag for a given branch.
 - [ ] ***(QA)*** Prepare empty release notes for the next set of releases.
- - [ ] ***(QA)*** Sanitize confidential issues which are assigned to the current release milestone and do not describe a security vulnerability, then make them public.
+ - [ ] ***(QA)*** Sanitize all confidential issues assigned to the release milestone and make them public.
 - [ ] ***(QA)*** Sanitize confidential issues which are assigned to older release milestones and describe security vulnerabilities, then make them public if appropriate[^2].
 - [ ] ***(QA)*** Update QA tools used in GitLab CI (e.g. Flake8, PyLint) by modifying the relevant `Dockerfile`.
 [^1]: If not, use the time remaining until the tagging deadline to ensure all outstanding issues are either resolved or moved to a different milestone.
 [^2]: As a rule of thumb, security vulnerabilities which have reproducers merged to the public repository are considered okay for full disclosure.
@@ -13,7 +13,6 @@ extraction:
      - "libidn2-dev"
      - "libmaxminddb-dev"
      - "libuv1-dev"
      - "libnghttp2-dev"
    configure:
      command:
      - "autoreconf -fi"
@@ -5,4 +5,3 @@ disable=
    C0116, # missing-function-docstring
    R0801, # duplicate-code
    C0103, # invalid-name
    C0415,# import-outside-toplevel
@@ -1,408 +1,42 @@
-5652.	[bug]		Copy and paste error caused the socket option to
+5575.	[func]		Initial support for DNS-over-HTTP(S). BIND now
-			be enabled instead of disabled. [GL #2746]
+			includes DNS-over-HTTP(S) layer built on top of nghttp2.
-
+			Both encrypted (via TLS) and unencrypted HTTP/2 connections
-5651.	[func]		Refactor zone dumping to be processed asynchronously
+			are supported.
-			via the uv_work_t thread pool API. [GL #2732]
+
-
+5574.	[func]		Incoming zone transfers can now use TLS.
-5650.	[bug]		Prevent a crash that could occur if serve-stale
+			Addresses in a "primaries" list take an optional
-			was enabled and a prefetch was triggered during a
+			"tls" argument, specifying either a previously
-			query restart. [GL #2733]
+			configured "tls" block or "ephemeral"; SOA queries
-
+			and zone transfer requests will then be sent via
-5649.	[bug]		If a query was answered with stale data on a server
+			TLS. [GL #2392]
-			with DNS64 enabled, an assertion could occur if a
+
-			non-stale answer arrived afterward. [GL #2731]
+5573.	[func]		Also return stale data if an error occurred and we are
-
+			not resuming. Only start the stale-refresh-time window
-5648.	[bug]		The calculation of the estimated IXFR transaction
+			if we timed out. [GL #2434]
-			size by dns_journal_iter_init() was invalid. [GL #2685]
+
-
+5572.	[bug]		Address potential double free in generatexml.
 5647.	[func]		The interfacemgr has been refactored to use fewer
 			clientmgr objects, which in turn use fewer memory
 			contexts and tasks.  This should result in less
 			fragmented memory and better startup performance.
 			[GL #2433]
 5646.	[bug]		The default TCP timeout for rndc has been increased
 			to 60 seconds. This was its original value, but it
 			had been inadvertently lowered to 10. [GL #2643]
 5645.	[cleanup]	Remove the rarely-used dns_name_copy() function
 			and rename dns_name_copynf() to dns_name_copy().
 			[GL !5081]
 5644.	[bug]		Fix a race condition in reading and writing key files
 			for KASP zones in multiple views. [GL #1875]
 5643.	[placeholder]
 5642.	[bug]		Check "key-directory" conflicts in "named.conf" for
 			zones in multiple views with different "dnssec-policy".
 			[GL #2463].
 5641.	[bug]		Address potential memory leak in dst_key_fromnamedfile.
 			[GL #2689]
 5640.	[func]		Add new configuration option to set the operating system
 			receive and send buffers. [GL #2313]
 5639.	[bug]		Check that the first and last SOA record of an AXFR
 			are consistent. [GL #2528]
 	--- 9.17.13 released ---
 5638.	[bug]		Improvements related to network manager/task manager
 			integration:
 			- isc_managers_create() and isc_managers_destroy()
 			  functions were added to handle setup and teardown of
 			  netmgr, taskmgr, timermgr, and socketmgr, since these
 			  require a precise order of operations now.
 			- Event queue processing is now quantized to prevent
 			  infinite looping.
 			- The netmgr can now be paused from within a netmgr
 			  thread.
 			- Deadlocks due to a conflict between netmgr's
 			  pause/resume and listen/stoplistening operations were
 			  fixed.
 			[GL #2654]
 5637.	[placeholder]
 5636.	[bug]		named and named-checkconf did not report an error when
 			multiple zones with the "dnssec-policy" option set were
 			using the same zone file. This has been fixed.
 			[GL #2603]
 5635.	[bug]		Journal compaction could fail when a journal with
 			invalid transaction headers was not detected at startup.
 			This has been fixed. [GL #2670]
 5634.	[bug]		If "dnssec-policy" was active and a private key file was
 			temporarily offline during a rekey event, named could
 			incorrectly introduce replacement keys and break a
 			signed zone. This has been fixed. [GL #2596]
 5633.	[doc]		The "inline-signing" option was incorrectly described as
 			being inherited from the "options"/"view" levels and was
 			incorrectly accepted at those levels without effect.
 			This has been fixed. [GL #2536]
 5632.	[func]		Add a new built-in KASP, "insecure", which is used to
 			transition a zone from a signed to an unsigned state.
 			The existing built-in KASP "none" should no longer be
 			used to unsign a zone. [GL #2645]
 5631.	[protocol]	Update the implementation of the ZONEMD RR type to match
 			RFC 8976. [GL #2658]
 5630.	[func]		Treat DNSSEC responses containing NSEC3 records with
 			iteration counts greater than 150 as insecure.
 			[GL #2445]
 5629.	[func]		Reduce the maximum supported number of NSEC3 iterations
 			that can be configured for a zone to 150. [GL #2642]
 5628.	[bug]		Host and nslookup could crash upon receiving a SERVFAIL
 			response. This has been fixed. [GL #2564]
 5627.	[bug]		RRSIG(SOA) RRsets placed anywhere other than at the zone
 			apex were triggering infinite resigning loops. This has
 			been fixed. [GL #2650]
 5626.	[bug]		When generating zone signing keys, KASP now also checks
 			for key ID conflicts among newly created keys, rather
 			than just between new and existing ones. [GL #2628]
 5625.	[bug]		A deadlock could occur when multiple "rndc addzone",
 			"rndc delzone", and/or "rndc modzone" commands were
 			invoked simultaneously for different zones. This has
 			been fixed. [GL #2626]
 5624.	[func]		Task manager events are now processed inside network
 			manager loops. The task manager no longer needs its own
 			set of worker threads, which improves resolver
 			performance. [GL #2638]
 5623.	[bug]		When named was shut down during an ongoing zone
 			transfer, xfrin_fail() could incorrectly be called
 			twice. This has been fixed. [GL #2630]
 5622.	[cleanup]	The lib/samples/ directory has been removed, as export
 			versions of libraries are no longer maintained.
 			[GL !4835]
 5621.	[placeholder]
 5620.	[bug]		If zone journal files written by BIND 9.16.11 or earlier
 			were present when BIND was upgraded, the zone file for
 			that zone could have been inadvertently rewritten with
 			the current zone contents. This caused the original zone
 			file structure (e.g. comments, $INCLUDE directives) to
 			be lost, although the zone data itself was preserved.
 			This has been fixed. [GL #2623]
 5619.	[protocol]	Implement draft-vandijk-dnsop-nsec-ttl, updating the
 			protocol such that NSEC(3) TTL values are set to the
 			minimum of the SOA MINIMUM value or the SOA TTL.
 			[GL #2347]
 5618.	[bug]		Change 5149 introduced some inconsistencies in the way
 			record TTLs were presented in cache dumps. These
 			inconsistencies have been eliminated. [GL #389]
 			[GL #2289]
 	--- 9.17.12 released ---
 5617.	[placeholder]
 5616.	[security]	named crashed when a DNAME record placed in the ANSWER
 			section during DNAME chasing turned out to be the final
 			answer to a client query. (CVE-2021-25215) [GL #2540]
 5615.	[security]	Insufficient IXFR checks could result in named serving a
 			zone without an SOA record at the apex, leading to a
 			RUNTIME_CHECK assertion failure when the zone was
 			subsequently refreshed. This has been fixed by adding an
 			owner name check for all SOA records which are included
 			in a zone transfer. (CVE-2021-25214) [GL #2467]
 5614.	[bug]		Ensure all resources are properly cleaned up when a call
 			to gss_accept_sec_context() fails. [GL #2620]
 5613.	[bug]		It was possible to write an invalid transaction header
 			in the journal file for a managed-keys database after
 			upgrading. This has been fixed. Invalid headers in
 			existing journal files are detected and named is able
 			to recover from them. [GL #2600]
 5612.	[bug]		Continued refactoring of the network manager:
 			- allow recovery from read and connect timeout events,
 			- ensure that calls to isc_nm_*connect() always
 			  return the connection status via a callback
 			  function.
 			[GL #2401]
 5611.	[func]		Set "stale-answer-client-timeout" to "off" by default.
 			[GL #2608]
 5610.	[bug]		Prevent a crash which could happen when a lookup
 			triggered by "stale-answer-client-timeout" was attempted
 			right after recursion for a client query finished.
 			[GL #2594]
 5609.	[func]		The ISC implementation of SPNEGO was removed from BIND 9
 			source code. It was no longer necessary as all major
 			contemporary Kerberos/GSSAPI libraries include support
 			for SPNEGO. [GL #2607]
 5608.	[bug]		When sending queries over TCP, dig now properly handles
 			"+tries=1 +retry=0" by not retrying the connection when
 			the remote server closes the connection prematurely.
 			[GL #2490]
 5607.	[bug]		As "rndc dnssec -checkds" and "rndc dnssec -rollover"
 			commands may affect the next scheduled key event,
 			reconfiguration of zone keys is now triggered after
 			receiving either of these commands to prevent
 			unnecessary key rollover delays. [GL #2488]
 5606.	[bug]		CDS/CDNSKEY DELETE records are now removed when a zone
 			transitions from a secure to an insecure state.
 			named-checkzone also no longer reports an error when
 			such records are found in an unsigned zone. [GL #2517]
 5605.	[bug]		"dig -u" now uses the CLOCK_REALTIME clock source for
 			more accurate time reporting. [GL #2592]
 5604.	[experimental]	A "filter-a.so" plugin, which is similar to the
 			"filter-aaaa.so" plugin but which omits A records
 			instead of AAAA records, has been added. Thanks to
 			GitLab user @treysis. [GL #2585]
 5603.	[placeholder]
 5602.	[bug]		Fix TCPDNS and TLSDNS timers in Network Manager. This
 			makes the "tcp-initial-timeout" and "tcp-idle-timeout"
 			options work correctly again. [GL #2583]
 5601.	[bug]		Zones using KASP could not be thawed after they were
 			frozen using "rndc freeze". This has been fixed.
 			[GL #2523]
 5600.	[bug]		Send a full certificate chain instead of just the leaf
 			certificate to DNS-over-TLS (DoT) and DNS-over-HTTPS
 			(DoH) clients. This makes BIND 9 DoT/DoH servers
 			compatible with a broader set of clients. [GL #2514]
 5599.	[bug]		Fix a named crash which occurred after skipping a
 			primary server while transferring a zone over TLS.
 			[GL #2562]
 5598.	[port]		Silence -Wchar-subscripts compiler warnings triggered on
 			some platforms due to calling character classification
 			functions declared in the <ctype.h> header with
 			arguments of type char. [GL #2567]
 	--- 9.17.11 released ---
 5597.	[bug]		When serve-stale was enabled and starting the recursive
 			resolution process for a query failed, a named instance
 			could crash if it was configured as both a recursive and
 			authoritative server. This problem was introduced by
 			change 5573 and has now been fixed. [GL #2565]
 5596.	[func]		Client-side support for DNS-over-HTTPS (DoH) has been
 			added to dig. "dig +https" can now query a server via
 			HTTP/2. [GL #1641]
 5595.	[cleanup]	Public header files for BIND 9 libraries no longer
 			directly include third-party library headers. This
 			prevents the need to include paths to third-party header
 			files in CFLAGS whenever BIND 9 public header files are
 			used, which could cause build-time issues on hosts with
 			older versions of BIND 9 installed. [GL #2357]
 5594.	[bug]		Building with --enable-dnsrps --enable-dnsrps-dl failed.
 			[GL #2298]
 5593.	[bug]		Journal files written by older versions of named can now
 			be read when loading zones, so that journal
 			incompatibility does not cause problems on upgrade.
 			Outdated journals are updated to the new format after
 			loading. [GL #2505]
 5592.	[bug]		Prevent hazard pointer table overflows on machines with
 			many cores, by allowing the thread IDs (serving as
 			indices into hazard pointer tables) of finished threads
 			to be reused by those created later. [GL #2396]
 5591.	[bug]		Fix a crash that occurred when
 			"stale-answer-client-timeout" was triggered without any
 			(stale) data available in the cache to answer the query.
 			[GL #2503]
 5590.	[bug]		NSEC3 records were not immediately created for dynamic
 			zones using NSEC3 with "dnssec-policy", resulting in
 			such zones going bogus. Add code to process the
 			NSEC3PARAM queue at zone load time so that NSEC3 records
 			for such zones are created immediately. [GL #2498]
 5589.	[placeholder]
 5588.	[func]		Add a new "purge-keys" option for "dnssec-policy". This
 			option determines the period of time for which key files
 			are retained after they become obsolete. [GL #2408]
 5587.	[bug]		A standalone libtool script no longer needs to be
 			present in PATH to build BIND 9 from a source tarball
 			prepared using "make dist". [GL #2504]
 5586.	[bug]		An invalid direction field in a LOC record resulted in
 			an INSIST failure when a zone file containing such a
 			record was loaded. [GL #2499]
 5585.	[func]		Memory contexts and memory pool implementations were
 			refactored to reduce lock contention for shared memory
 			contexts by replacing mutexes with atomic operations.
 			The internal memory allocator was simplified so that it
 			is only a thin wrapper around the system allocator. This
 			change made the "-M external" named option redundant and
 			it was therefore removed. [GL #2433]
 5584.	[bug]		No longer set the IP_DONTFRAG option on UDP sockets, to
 			prevent dropping outgoing packets exceeding
 			"max-udp-size". [GL #2466]
 5583.	[func]		Changes to DNS-over-HTTPS (DoH) configuration syntax:
 			- When "http" is specified in "listen-on" or
 			  "listen-on-v6" statements, "tls" must also now be
 			  specified. If an unencrypted connection is desired
 			  (for example, when running behind a reverse proxy),
 			  use "tls none".
 			- "http default" can now be specified in "listen-on" and
 			  "listen-on-v6" statements to use the default HTTP
 			  endpoint of "/dns-query". It is no longer necessary to
 			  include an "http" statement in named.conf unless
 			  overriding this value.
 			[GL #2472]
 5582.	[bug]		BIND 9 failed to build when static OpenSSL libraries
 			were used and the pkg-config files for libssl and/or
 			libcrypto were unavailable. This has been fixed by
 			ensuring that the correct linking order for libssl and
 			libcrypto is always used. [GL #2402]
 5581.	[bug]		Fix a memory leak that occurred when inline-signed zones
 			were added to the configuration, followed by a
 			reconfiguration of named. [GL #2041]
 5580.	[test]		The system test framework no longer differentiates
 			between SKIPPED and UNTESTED system test results. Any
 			system test which is not run is now marked as SKIPPED.
 			[GL !4517]
 5579.	[bug]		If an invalid key name (e.g. "a..b") was specified in a
 			primaries list in named.conf, the wrong size was passed
 			to isc_mem_put(), resulting in the returned memory being
 			put on the wrong free list. This prevented named from
 			starting up. [GL #2460]
 	--- 9.17.10 released ---
 5578.	[protocol]	Make "check-names" accept A records below "_spf",
 			"_spf_rate", and "_spf_verify" labels in order to cater
 			for the "exists" SPF mechanism specified in RFC 7208
 			section 5.7 and appendix D.1. [GL #2377]
 5577.	[bug]		Fix the "three is a crowd" key rollover bug in KASP by
 			correctly implementing Equation (2) of the "Flexible and
 			Robust Key Rollover" paper. [GL #2375]
 5576.	[experimental]	Initial server-side implementation of DNS-over-HTTPS
 			(DoH). Support for both TLS-encrypted and unencrypted
 			HTTP/2 connections has been added to the network manager
 			and integrated into named. (Note: there is currently no
 			client-side support for DNS-over-HTTPS; this will be
 			added to dig in a future release.) [GL #1144]
 5575.	[bug]		When migrating to KASP, BIND 9 considered keys with the
 			"Inactive" and/or "Delete" timing metadata to be
 			possible active keys. This has been fixed. [GL #2406]
 5574.	[func]		Incoming zone transfers can now use TLS. Addresses in a
 			"primaries" list take an optional "tls" argument,
 			specifying either a previously configured "tls" block or
 			"ephemeral"; SOA queries and zone transfer requests are
 			then sent via TLS. [GL #2392]
 5573.	[func]		When serve-stale is enabled and stale data is available,
 			named now returns stale answers upon encountering any
 			unexpected error in the query resolution process.
 			However, the "stale-refresh-time" window is still only
 			started upon a timeout. [GL #2434]
 5572.	[bug]		Address potential double free in generatexml().
 			[GL #2420]
-5571.	[bug]		named failed to start when its configuration included a
+5571.	[bug]		If a zone had a non-builtin named allow-update acl
-			zone with a non-builtin "allow-update" ACL attached.
+			named failed to start. [GL #2413]
 			[GL #2413]
-5570.	[bug]		Improve performance of the DNSSEC verification code by
+5570.	[bug]		Improve the performance of dnssec-verify by reducing
-			reducing the number of repeated calls to
+			the number of repeated calls to dns_dnssec_keyfromrdata.
-			dns_dnssec_keyfromrdata(). [GL #2073]
+			[GL #2073]
-5569.	[bug]		Emit useful error message when "rndc retransfer" is
+5569.	[bug]		Emit useful error message when 'rndc retransfer' is
 			applied to a zone of inappropriate type. [GL #2342]
 5568.	[bug]		Fixed a crash in "dnssec-keyfromlabel" when using ECDSA
 			keys. [GL #2178]
 5567.	[bug]		Dig now reports unknown dash options while pre-parsing
-			the options. This prevents "-multi" instead of "+multi"
+			the options.  This prevents '-multi' instead of
-			from reporting memory usage before ending option parsing
+			'+multi' reporting memory usage before ending option
-			with "Invalid option: -lti". [GL #2403]
+			parsing on 'Invalid option: -lti'. [GL #2403]
-5566.	[func]		Add "stale-answer-client-timeout" option, which is the
+5566.	[func]		Add "stale-answer-client-timeout" option, which
-			amount of time a recursive resolver waits before
+			is the amount of time a recursive resolver waits before
 			attempting to answer the query using stale data from
 			cache. [GL #2247]
@@ -410,25 +44,26 @@
 			BIND 9 version number, in an effort to tightly couple
 			internal libraries with a specific release. [GL #2387]
-5564.	[cleanup]	Network manager's TLSDNS module was refactored to use
+5564.	[cleanup]	Refactored the network manager TLSDNS module to use
-			libuv and libssl directly instead of a stack of TCP/TLS
+			libuv and libssl directly, rather than opening a
-			sockets. [GL #2335]
+			TLS/TCP socket stack. [GL #2235]
 5563.	[cleanup]	Changed several obsolete configuration options to
-			ancient, making them fatal errors. Also cleaned up the
+			ancient, making them into fatal errors. Also cleaned
-			number of clause flags in the configuration parser.
+			up the number of clause flags in the configuration
-			[GL #1086]
+			parser. [GL #1086]
 5562.	[placeholder]
-5561.	[bug]		KASP incorrectly set signature validity to the value of
+5561.	[bug]		KASP incorrectly set signature validity to the value
-			the DNSKEY signature validity. This is now fixed.
+			of the DNSKEY signature validity. This is now fixed.
 			[GL #2383]
 5560.	[func]		The default value of "max-stale-ttl" has been changed
 			from 12 hours to 1 day and the default value of
-			"stale-answer-ttl" has been changed from 1 second to 30
+			"stale-answer-ttl" has been changed from 1 second to
-			seconds, following RFC 8767 recommendations. [GL #2248]
+			30 seconds, following RFC 8767 recommendations.
 			[GL #2248]
 	--- 9.17.9 released ---
@@ -10,7 +10,6 @@ AM_V_SPHINX_0 = @echo "  SPHINX   $@";
 SPHINXBUILDDIR = $(builddir)/_build
 common_SPHINXOPTS =			\
 	-W				\
 	-c $(srcdir)			\
 	-a				\
 	$(SPHINX_V)
@@ -3,9 +3,8 @@
 AM_CPPFLAGS +=					\
 	$(CMOCKA_CFLAGS)			\
-	-DNAMED_PLUGINDIR=\"$(libdir)/named\"	\
+	-DTESTS_DIR=\"$(abs_srcdir)\"		\
-	-DSKIPPED_TEST_EXIT_CODE=77		\
+	-DNAMED_PLUGINDIR=\"$(libdir)/named\"
 	-DTESTS_DIR=\"$(abs_srcdir)\"
 LDADD =			\
 	$(CMOCKA_LIBS)
@@ -18,6 +18,11 @@ AM_LDFLAGS +=					\
 	-Wl,-flat_namespace
 endif HOST_MACOS
 if HAVE_GSSAPI
 AM_CPPFLAGS +=					\
 	$(GSSAPI_CFLAGS)
 endif
 LIBISC_CFLAGS =						\
 	-I$(top_srcdir)/include				\
 	-I$(top_srcdir)/lib/isc/unix/include		\
@@ -25,6 +30,21 @@ LIBISC_CFLAGS =						\
 	-I$(top_srcdir)/lib/isc/include			\
 	-I$(top_builddir)/lib/isc/include
 if HAVE_JSON_C
 LIBISC_CFLAGS +=					\
 	$(JSON_C_CFLAGS)
 endif HAVE_JSON_C
 if HAVE_LIBXML2
 LIBISC_CFLAGS +=					\
 	$(LIBXML2_CFLAGS)
 endif HAVE_LIBXML2
 if HAVE_READLINE
 LIBISC_CFLAGS +=					\
 	$(READLINE_CFLAGS)
 endif HAVE_READLINE
 LIBISC_LIBS = $(top_builddir)/lib/isc/libisc.la
 LIBDNS_CFLAGS = \
@@ -34,6 +54,16 @@ LIBDNS_CFLAGS = \
 LIBDNS_LIBS = \
 	$(top_builddir)/lib/dns/libdns.la
 if HAVE_DNSTAP
 LIBDNS_CFLAGS +=					\
 	$(DNSTAP_CFLAGS)
 endif HAVE_DNSTAP
 if HAVE_LMDB
 LIBDNS_CFLAGS +=					\
 	$(LMDB_CFLAGS)
 endif HAVE_LMDB
 LIBNS_CFLAGS = \
 	-I$(top_srcdir)/lib/ns/include
@@ -13,7 +13,7 @@
 In general, this version of BIND will build and run on any POSIX-compliant
 system with a C11-compliant C compiler, BSD-style sockets with RFC-compliant
 IPv6 support, POSIX-compliant threads, the `libuv` asynchronous I/O library,
-the OpenSSL cryptography library, and the `nghttp2` HTTP/2 library.
+and the OpenSSL cryptography library.
 The following C11 features are used in BIND 9:
@@ -46,12 +46,12 @@ As of Nov 2020, BIND 9.17 is fully supported and regularly tested on the
 following systems:
 * Debian 9, 10
-* Ubuntu LTS 18.04, 20.04
+* Ubuntu LTS 16.04, 20.04
-* Fedora 34
+* Fedora 33
 * Red Hat Enterprise Linux / CentOS 7, 8
-* FreeBSD 11.4, 12.2, 13.0
+* FreeBSD 11.4, 12.2
-* OpenBSD 6.9
+* OpenBSD 6.8
-* Alpine Linux 3.13
+* Alpine Linux 3.12
 The amd64, i386, armhf and arm64 CPU architectures are all fully supported.
@@ -69,7 +69,7 @@ Server 2016, none of these are tested regularly by ISC.
 * Solaris 11
 * NetBSD
 * Other Linux distributions still supported by their vendors, such as:
-    * Ubuntu 20.10+
+    * Ubuntu 19.04+
    * Gentoo
    * Arch Linux
 * OpenWRT/LEDE 17.01+
@@ -86,7 +86,7 @@ assessed against the risk of adverse effect on officially supported
 platforms.
 * Platforms past or close to their respective EOL dates, such as:
-    * Ubuntu 14.04, 16.04 (Ubuntu ESM releases are not supported)
+    * Ubuntu 14.04, 18.10
    * CentOS 6
    * Debian Jessie
    * FreeBSD 10.x
@@ -128,13 +128,13 @@ including your patch as an attachment, preferably generated by
 At a minimum, BIND requires a Unix or Linux system with an ANSI C compiler,
 basic POSIX support, and a 64-bit integer type. BIND also requires the
-`libuv` asynchronous I/O library, the `nghttp2` HTTP/2 library, and a
+`libuv` asynchronous I/O library, and a cryptography provider library
-cryptography provider library such as OpenSSL or a hardware service
+such as OpenSSL or a hardware service module supporting PKCS#11. On
-module supporting PKCS#11. On Linux, BIND requires the `libcap` library
+Linux, BIND requires the `libcap` library to set process privileges,
-to set process privileges, though this requirement can be overridden by
+though this requirement can be overridden by disabling capability
-disabling capability support at compile time. See [Compile-time
+support at compile time. See [Compile-time options](#opts) below
-options](#opts) below for details on other libraries that may be
+for details on other libraries that may be required to support
-required to support optional features.
+optional features.
 Successful builds have been observed on many versions of Linux and
 Unix, including RHEL/CentOS, Fedora, Debian, Ubuntu, SLES, openSUSE,
@@ -21,6 +21,8 @@
 .. highlight: console
 .. _man_named-checkzone:
 named-checkzone, named-compilezone - zone file validity checking or converting tool
 -----------------------------------------------------------------------------------
@@ -21,6 +21,8 @@
 .. highlight: console
 .. _man_tsig-keygen:
 tsig-keygen, ddns-confgen - TSIG key generation tool
 ----------------------------------------------------
@@ -34,10 +34,8 @@
 #include <isc/hex.h>
 #include <isc/lib.h>
 #include <isc/log.h>
 #include <isc/managers.h>
 #include <isc/md.h>
 #include <isc/mem.h>
 #include <isc/netmgr.h>
 #ifdef WIN32
 #include <isc/ntpaths.h>
 #endif /* ifdef WIN32 */
@@ -1738,7 +1736,6 @@ main(int argc, char *argv[]) {
 	dns_namelist_t namelist;
 	unsigned int resopt;
 	isc_appctx_t *actx = NULL;
 	isc_nm_t *netmgr = NULL;
 	isc_taskmgr_t *taskmgr = NULL;
 	isc_socketmgr_t *socketmgr = NULL;
 	isc_timermgr_t *timermgr = NULL;
@@ -1762,8 +1759,9 @@ main(int argc, char *argv[]) {
 	isc_mem_create(&mctx);
 	CHECK(isc_appctx_create(mctx, &actx));
-	isc_managers_create(mctx, 1, 0, 0, &netmgr, &taskmgr, &timermgr,
+	CHECK(isc_taskmgr_createinctx(mctx, 1, 0, &taskmgr));
-			    &socketmgr);
+	CHECK(isc_socketmgr_createinctx(mctx, &socketmgr));
 	CHECK(isc_timermgr_createinctx(mctx, &timermgr));
 	parse_args(argc, argv);
@@ -1783,8 +1781,8 @@ main(int argc, char *argv[]) {
 #endif /* ifndef WIN32 */
 	/* Create client */
-	result = dns_client_create(mctx, actx, taskmgr, socketmgr, timermgr, 0,
+	result = dns_client_createx(mctx, actx, taskmgr, socketmgr, timermgr, 0,
-				   &client, srcaddr4, srcaddr6);
+				    &client, srcaddr4, srcaddr6);
 	if (result != ISC_R_SUCCESS) {
 		delv_log(ISC_LOG_ERROR, "dns_client_create: %s",
 			 isc_result_totext(result));
@@ -1804,7 +1802,7 @@ main(int argc, char *argv[]) {
 	CHECK(convert_name(&qfn, &query_name, qname));
 	/* Set up resolution options */
-	resopt = DNS_CLIENTRESOPT_NOCDFLAG;
+	resopt = DNS_CLIENTRESOPT_ALLOWRUN | DNS_CLIENTRESOPT_NOCDFLAG;
 	if (no_sigs) {
 		resopt |= DNS_CLIENTRESOPT_NODNSSEC;
 	}
@@ -1866,7 +1864,15 @@ cleanup:
 	if (client != NULL) {
 		dns_client_destroy(&client);
 	}
-	isc_managers_destroy(&netmgr, &taskmgr, &timermgr, &socketmgr);
+	if (taskmgr != NULL) {
 		isc_taskmgr_destroy(&taskmgr);
 	}
 	if (timermgr != NULL) {
 		isc_timermgr_destroy(&timermgr);
 	}
 	if (socketmgr != NULL) {
 		isc_socketmgr_destroy(&socketmgr);
 	}
 	if (actx != NULL) {
 		isc_appctx_destroy(&actx);
 	}
@@ -25,15 +25,10 @@ libdighost_la_SOURCES = \
 bin_PROGRAMS = dig host nslookup
 nslookup_CPPFLAGS =		\
 	$(AM_CPPFLAGS)
 nslookup_LDADD =		\
 	$(LDADD)
 if HAVE_READLINE
 nslookup_CPPFLAGS +=		\
 	$(READLINE_CFLAGS)
 nslookup_LDADD +=		\
 	$(READLINE_LIBS)
 endif HAVE_READLINE
@@ -353,17 +353,13 @@ received(unsigned int bytes, isc_sockaddr_t *from, dig_query_t *query) {
 		if (query->lookup->tls_mode) {
 			proto = "TLS";
 		} else if (query->lookup->https_mode) {
-			if (query->lookup->http_plain) {
+			proto = "HTTPS";
 				proto = "HTTP";
 			} else {
 				proto = "HTTPS";
 			}
 		} else if (query->lookup->tcp_mode) {
 			proto = "TCP";
 		} else {
 			proto = "UDP";
 		}
-		printf(";; SERVER: %s(%s) (%s)\n", fromtext, query->userarg,
+		printf(";; SERVER: %s(%s) (%s)\n", fromtext, query->servname,
 		       proto);
 		time(&tnow);
 		(void)localtime_r(&tnow, &tmnow);
@@ -1076,17 +1072,6 @@ plus_option(char *option, bool is_batchfile, bool *need_clone,
 		    (_l >= sizeof(B) || strncasecmp(cmd, B, _l) != 0))   \
 			goto invalid_option;                             \
 	} while (0)
 #define FULLCHECK6(A, B, C, D, E, F)                                     \
 	do {                                                             \
 		size_t _l = strlen(cmd);                                 \
 		if ((_l >= sizeof(A) || strncasecmp(cmd, A, _l) != 0) && \
 		    (_l >= sizeof(B) || strncasecmp(cmd, B, _l) != 0) && \
 		    (_l >= sizeof(C) || strncasecmp(cmd, C, _l) != 0) && \
 		    (_l >= sizeof(D) || strncasecmp(cmd, D, _l) != 0) && \
 		    (_l >= sizeof(E) || strncasecmp(cmd, E, _l) != 0) && \
 		    (_l >= sizeof(F) || strncasecmp(cmd, F, _l) != 0))   \
 			goto invalid_option;                             \
 	} while (0)
 	switch (cmd[0]) {
 	case 'a':
@@ -1439,67 +1424,28 @@ plus_option(char *option, bool is_batchfile, bool *need_clone,
 			lookup->header_only = state;
 			break;
 		case 't':
-			FULLCHECK6("https", "https-get", "https-post",
+			FULLCHECK2("https", "https-get");
-				   "http-plain", "http-plain-get",
+			switch (cmd[5]) {
-				   "http-plain-post");
+			case '\0':
-			if (lookup->https_path != NULL) {
+				FULLCHECK("https");
-				isc_mem_free(mctx, lookup->https_path);
+				lookup->https_mode = state;
-				lookup->https_path = NULL;
+				if (!lookup->tcp_mode_set) {
-			}
+					lookup->tcp_mode = state;
 			if (!state) {
 				lookup->https_mode = false;
 				break;
 			}
 			lookup->https_mode = true;
 			if (cmd[4] == '-') {
 				lookup->http_plain = true;
 				switch (cmd[10]) {
 				case '\0':
 					FULLCHECK("http-plain");
 					break;
 				case '-':
 					switch (cmd[6]) {
 					case 'p':
 						FULLCHECK("https-plain-post");
 						break;
 					case 'g':
 						FULLCHECK("https-plain-get");
 						lookup->https_get = true;
 						break;
 					}
 					break;
 				default:
 					goto invalid_option;
 				}
-			} else {
+				if (value == NULL) {
-				switch (cmd[5]) {
+					lookup->https_path = isc_mem_strdup(
-				case '\0':
+						mctx, DEFAULT_HTTPS_PATH);
 					FULLCHECK("https");
 					break;
 				case '-':
 					switch (cmd[6]) {
 					case 'p':
 						FULLCHECK("https-post");
 						break;
 					case 'g':
 						FULLCHECK("https-get");
 						lookup->https_get = true;
 						break;
 					}
 					break;
 				default:
 					goto invalid_option;
 				}
 			}
 			if (!lookup->tcp_mode_set) {
 				lookup->tcp_mode = state;
 			}
 			if (value == NULL) {
 				lookup->https_path = isc_mem_strdup(
 					mctx, DEFAULT_HTTPS_PATH);
 			} else {
 				lookup->https_path = isc_mem_strdup(mctx,
 								    value);
 				break;
 			case '-':
 				FULLCHECK("https-get");
 				lookup->https_get = true;
 				break;
 			default:
 				goto invalid_option;
 			}
 			break;
 		default:
@@ -349,38 +349,11 @@ abbreviation is unambiguous; for example, ``+cd`` is equivalent to
   default is to add a question section. The query type and query name
   are ignored when this is set.
 ``+[no]https[=value]``
   This option indicates whether to use DNS-over-HTTPS (DoH) when querying
   name servers.  When this option is in use, the port number defaults to 443.
   The HTTP POST request mode is used when sending the query.
   If ``value`` is specified, it will be used as the HTTP endpoint in the
   query URI; the default is ``/dns-query``. So, for example, ``dig
   @example.com +https`` will use the URI ``https://example.com/dns-query``.
 ``+[no]https-get[=value]``
   Similar to ``+https``, except that the HTTP GET request mode is used
   when sending the query.
 ``+[no]https-post[=value]``
   Same as ``+https``.
 ``+[no]http-plain[=value]``
   Similar to ``+https``, except that HTTP queries will be sent over a
   non-encrypted channel. When this option is in use, the port number
   defaults to 80 and the HTTP request mode is POST.
 ``+[no]http-plain-get[=value]``
   Similar to ``+http-plain``, except that the HTTP request mode is GET.
 ``+[no]http-plain-post[=value]``
   Same as ``+http-plain``.
 ``+[no]identify``
-   This option shows [or does not show] the IP address and port number that
+   This option shows [or does not show] the IP address and port number that supplied
-   supplied the answer, when the ``+short`` option is enabled. If short
+   the answer, when the ``+short`` option is enabled. If short form
-   form answers are requested, the default is not to show the source
+   answers are requested, the default is not to show the source address
-   address and port number of the server that provided the answer.
+   and port number of the server that provided the answer.
 ``+[no]idnin``
   This option processes [or does not process] IDN domain names on input. This requires
@@ -480,8 +453,8 @@ abbreviation is unambiguous; for example, ``+cd`` is equivalent to
   ``+nssearch`` or ``+trace`` query option is used.
 ``+retry=T``
-   This option sets the number of times to retry UDP and TCP queries to server to ``T``
+   This option sets the number of times to retry UDP queries to server to ``T``
-   instead of the default, 2.  Unlike ``+tries``, this does not include
+   instead of the default, 2. Unlike ``+tries``, this does not include
   the initial query.
 ``+[no]rrcomments``
@@ -546,9 +519,8 @@ abbreviation is unambiguous; for example, ``+cd`` is equivalent to
   5 seconds. An attempt to set ``T`` to less than 1 is silently set to 1.
 ``+[no]tls``
-   This option indicates whether to use DNS-over-TLS (DoT) when querying
+   This option indicates whether to use DNS over TLS (DoT) when querying
-   name servers. When this option is in use, the port number defaults
+   name servers.
   to 853.
 ``+[no]topdown``
   This feature is related to ``dig +sigchase``, which is obsolete and
@@ -569,7 +541,7 @@ abbreviation is unambiguous; for example, ``+cd`` is equivalent to
   default queries from a name server.
 ``+tries=T``
-   This option sets the number of times to try UDP and TCP queries to server to ``T``
+   This option sets the number of times to try UDP queries to server to ``T``
   instead of the default, 3. If ``T`` is less than or equal to zero,
   the number of tries is silently rounded up to 1.
@@ -41,7 +41,6 @@
 #include <isc/hex.h>
 #include <isc/lang.h>
 #include <isc/log.h>
 #include <isc/managers.h>
 #include <isc/netaddr.h>
 #include <isc/netdb.h>
 #include <isc/nonce.h>
@@ -107,9 +106,9 @@ unsigned int timeout = 0;
 unsigned int extrabytes;
 isc_mem_t *mctx = NULL;
 isc_log_t *lctx = NULL;
 isc_nm_t *netmgr = NULL;
 isc_taskmgr_t *taskmgr = NULL;
 isc_task_t *global_task = NULL;
 isc_nm_t *netmgr = NULL;
 isc_sockaddr_t localaddr;
 isc_refcount_t sendcount = ATOMIC_VAR_INIT(0);
 isc_refcount_t recvcount = ATOMIC_VAR_INIT(0);
@@ -227,9 +226,8 @@ void (*dighost_shutdown)(void);
 /* forward declarations */
 #define cancel_lookup(l) _cancel_lookup(l, __FILE__, __LINE__)
 static void
-_cancel_lookup(dig_lookup_t *lookup, const char *file, unsigned int line);
+cancel_lookup(dig_lookup_t *lookup);
 static void
 recv_done(isc_nmhandle_t *handle, isc_result_t eresult, isc_region_t *region,
@@ -605,9 +603,6 @@ clone_server_list(dig_serverlist_t src, dig_serverlist_t *dest) {
 dig_lookup_t *
 make_empty_lookup(void) {
 	dig_lookup_t *looknew;
 #ifdef HAVE_LIBIDN2
 	bool idn_allowed = isatty(1) ? (getenv("IDN_DISABLE") == NULL) : false;
 #endif /* HAVE_LIBIDN2 */
 	debug("make_empty_lookup()");
@@ -624,8 +619,8 @@ make_empty_lookup(void) {
 		.opcode = dns_opcode_query,
 		.badcookie = true,
 #ifdef HAVE_LIBIDN2
-		.idnin = idn_allowed,
+		.idnin = isatty(1) ? (getenv("IDN_DISABLE") == NULL) : false,
-		.idnout = idn_allowed,
+		.idnout = looknew->idnin,
 #endif /* HAVE_LIBIDN2 */
 		.udpsize = -1,
 		.edns = -1,
@@ -735,7 +730,6 @@ clone_lookup(dig_lookup_t *lookold, bool servers) {
 		looknew->https_path = isc_mem_strdup(mctx, lookold->https_path);
 	}
 	looknew->https_get = lookold->https_get;
 	looknew->http_plain = lookold->http_plain;
 	looknew->sendcookie = lookold->sendcookie;
 	looknew->seenbadcookie = lookold->seenbadcookie;
 	looknew->badcookie = lookold->badcookie;
@@ -797,8 +791,8 @@ clone_lookup(dig_lookup_t *lookold, bool servers) {
 		memmove(looknew->ecs_addr, lookold->ecs_addr, len);
 	}
-	dns_name_copy(dns_fixedname_name(&lookold->fdomain),
+	dns_name_copynf(dns_fixedname_name(&lookold->fdomain),
-		      dns_fixedname_name(&looknew->fdomain));
+			dns_fixedname_name(&looknew->fdomain));
 	if (servers) {
 		clone_server_list(lookold->my_server_list,
@@ -1350,7 +1344,7 @@ setup_libs(void) {
 	}
 	isc_mem_create(&mctx);
-	isc_mem_setname(mctx, "dig");
+	isc_mem_setname(mctx, "dig", NULL);
 	isc_log_create(mctx, &lctx, &logconfig);
 	isc_log_setcontext(lctx);
@@ -1362,7 +1356,10 @@ setup_libs(void) {
 	isc_log_setdebuglevel(lctx, 0);
-	isc_managers_create(mctx, 1, 0, 0, &netmgr, &taskmgr, NULL, NULL);
+	netmgr = isc_nm_start(mctx, 1);
 	result = isc_taskmgr_create(mctx, 1, 0, netmgr, &taskmgr);
 	check_result(result, "isc_taskmgr_create");
 	result = isc_task_create(taskmgr, 0, &global_task);
 	check_result(result, "isc_task_create");
@@ -1540,13 +1537,12 @@ _destroy_lookup(dig_lookup_t *lookup) {
 	dig_server_t *s;
 	void *ptr;
 	REQUIRE(lookup != NULL);
 	REQUIRE(ISC_LIST_EMPTY(lookup->q));
 	debug("destroy_lookup");
 	isc_refcount_destroy(&lookup->references);
 	REQUIRE(ISC_LIST_EMPTY(lookup->q));
 	s = ISC_LIST_HEAD(lookup->my_server_list);
 	while (s != NULL) {
 		debug("freeing server %p belonging to %p", s, lookup);
@@ -1691,16 +1687,14 @@ _query_detach(dig_query_t **queryp, const char *file, unsigned int line) {
 		query_detach(&lookup->current_query);
 	}
 	if (ISC_LINK_LINKED(query, link)) {
 		ISC_LIST_UNLINK(lookup->q, query, link);
 	}
 	debug("%s:%u:query_detach(%p) = %" PRIuFAST32, file, line, query,
 	      isc_refcount_current(&query->references) - 1);
 	if (isc_refcount_decrement(&query->references) == 1) {
 		INSIST(query->readhandle == NULL);
 		INSIST(query->sendhandle == NULL);
 		if (ISC_LINK_LINKED(query, link)) {
 			ISC_LIST_UNLINK(lookup->q, query, link);
 		}
 		destroy_query(query, file, line);
 	}
 }
@@ -1754,18 +1748,13 @@ start_lookup(void) {
 * decremented, current_lookup will not be set to NULL.)
 */
 static void
-clear_current_lookup(void) {
+clear_current_lookup() {
 	dig_lookup_t *lookup = current_lookup;
 	INSIST(!free_now);
 	debug("clear_current_lookup()");
 	if (lookup == NULL) {
 		debug("current_lookup is already detached");
 		return;
 	}
 	if (ISC_LIST_HEAD(lookup->q) != NULL) {
 		debug("still have a worker");
 		return;
@@ -1890,7 +1879,7 @@ followup_lookup(dns_message_t *msg, dig_query_t *query, dns_section_t section) {
 					lookup->recurse = false;
 				}
 				domain = dns_fixedname_name(&lookup->fdomain);
-				dns_name_copy(name, domain);
+				dns_name_copynf(name, domain);
 			}
 			debug("adding server %s", namestr);
 			num = getaddresses(lookup, namestr, &lresult);
@@ -2065,6 +2054,7 @@ insert_soa(dig_lookup_t *lookup) {
 	result = dns_message_gettempname(lookup->sendmsg, &soaname);
 	check_result(result, "dns_message_gettempname");
 	dns_name_init(soaname, NULL);
 	dns_name_clone(lookup->name, soaname);
 	ISC_LIST_INIT(soaname->list);
 	ISC_LIST_APPEND(soaname->list, rdataset, link);
@@ -2162,6 +2152,7 @@ setup_lookup(dig_lookup_t *lookup) {
 	}
 	result = dns_message_gettempname(lookup->sendmsg, &lookup->name);
 	check_result(result, "dns_message_gettempname");
 	dns_name_init(lookup->name, NULL);
 	isc_buffer_init(&lookup->namebuf, lookup->name_space,
 			sizeof(lookup->name_space));
@@ -2205,6 +2196,7 @@ setup_lookup(dig_lookup_t *lookup) {
 		result = dns_message_gettempname(lookup->sendmsg,
 						 &lookup->oname);
 		check_result(result, "dns_message_gettempname");
 		dns_name_init(lookup->oname, NULL);
 		/* XXX Helper funct to conv char* to name? */
 		origin = lookup->origin->origin;
 #ifdef HAVE_LIBIDN2
@@ -2244,7 +2236,9 @@ setup_lookup(dig_lookup_t *lookup) {
 						name, lookup->oname,
 						lookup->name, &lookup->namebuf);
 				} else {
-					dns_name_copy(name, lookup->name);
+					result = dns_name_copy(
 						name, lookup->name,
 						&lookup->namebuf);
 				}
 			}
 			if (result != ISC_R_SUCCESS) {
@@ -2673,12 +2667,11 @@ send_done(isc_nmhandle_t *handle, isc_result_t eresult, void *arg) {
 /*%
 * Cancel a lookup, sending canceling reads on all existing sockets.
 */
 static void
-_cancel_lookup(dig_lookup_t *lookup, const char *file, unsigned int line) {
+cancel_lookup(dig_lookup_t *lookup) {
 	dig_query_t *query, *next;
-	debug("%s:%u:%s()", file, line, __func__);
+	debug("cancel_lookup()");
 	query = ISC_LIST_HEAD(lookup->q);
 	while (query != NULL) {
 		REQUIRE(DIG_VALID_QUERY(query));
@@ -2717,17 +2710,14 @@ start_tcp(dig_query_t *query) {
 	if (!port_set) {
 		if (query->lookup->tls_mode) {
 			port = 853;
 		} else if (query->lookup->https_mode &&
 			   !query->lookup->http_plain) {
 			port = 443;
 		} else if (query->lookup->https_mode) {
-			port = 80;
+			port = 443;
 		} else {
 			port = 53;
 		}
 	}
-	debug("query->servname = %s\n", query->servname);
+	fprintf(stderr, "query->servname = %s\n", query->servname);
 	result = get_address(query->servname, port, &query->sockaddr);
 	if (result != ISC_R_SUCCESS) {
@@ -2797,32 +2787,38 @@ start_tcp(dig_query_t *query) {
 		if (query->lookup->tls_mode) {
 			result = isc_tlsctx_createclient(&query->tlsctx);
 			RUNTIME_CHECK(result == ISC_R_SUCCESS);
-			isc_nm_tlsdnsconnect(netmgr, &localaddr,
+			result = isc_nm_tlsdnsconnect(
-					     &query->sockaddr, tcp_connected,
+				netmgr, (isc_nmiface_t *)&localaddr,
-					     query, local_timeout, 0,
+				(isc_nmiface_t *)&query->sockaddr,
-					     query->tlsctx);
+				tcp_connected, query, local_timeout, 0,
 				query->tlsctx);
 			check_result(result, "isc_nm_tlsdnsconnect");
 		} else if (query->lookup->https_mode) {
 			char portbuf[12];
 			char uri[4096] = { 0 };
-			snprintf(uri, sizeof(uri), "https://%s:%u%s",
+			snprintf(portbuf, sizeof(portbuf), "%u",
-				 query->userarg, (uint16_t)port,
+				 (uint16_t)port);
 				 query->lookup->https_path);
-			if (!query->lookup->http_plain) {
+			strlcpy(uri, "https://", sizeof(uri));
-				result =
+			strlcat(uri, query->servname, sizeof(uri));
-					isc_tlsctx_createclient(&query->tlsctx);
+			strlcat(uri, ":", sizeof(uri));
-				RUNTIME_CHECK(result == ISC_R_SUCCESS);
+			strlcat(uri, portbuf, sizeof(uri));
-				isc_tlsctx_enable_http2client_alpn(
+			strlcat(uri, query->lookup->https_path, sizeof(uri));
 					query->tlsctx);
 			}
-			isc_nm_httpconnect(netmgr, &localaddr, &query->sockaddr,
+			result = isc_tlsctx_createclient(&query->tlsctx);
-					   uri, !query->lookup->https_get,
+			RUNTIME_CHECK(result == ISC_R_SUCCESS);
-					   tcp_connected, query, query->tlsctx,
+			result = isc_nm_httpconnect(
-					   local_timeout, 0);
+				netmgr, (isc_nmiface_t *)&localaddr,
 				(isc_nmiface_t *)&query->sockaddr, uri,
 				!query->lookup->https_get, tcp_connected, query,
 				query->tlsctx, local_timeout, 0);
 			check_result(result, "isc_nm_httpconnect");
 		} else {
-			isc_nm_tcpdnsconnect(netmgr, &localaddr,
+			result = isc_nm_tcpdnsconnect(
-					     &query->sockaddr, tcp_connected,
+				netmgr, (isc_nmiface_t *)&localaddr,
-					     query, local_timeout, 0);
+				(isc_nmiface_t *)&query->sockaddr,
 				tcp_connected, query, local_timeout, 0);
 			check_result(result, "isc_nm_tcpdnsconnect");
 		}
 		/* XXX: set DSCP */
@@ -2863,11 +2859,7 @@ send_udp(dig_query_t *query) {
 	isc_buffer_usedregion(&query->sendbuf, &r);
 	debug("sending a request");
-	if (query->lookup->use_usec) {
+	TIME_NOW(&query->time_sent);
 		TIME_NOW_HIRES(&query->time_sent);
 	} else {
 		TIME_NOW(&query->time_sent);
 	}
 	isc_nmhandle_attach(query->handle, &query->sendhandle);
@@ -2897,16 +2889,13 @@ udp_ready(isc_nmhandle_t *handle, isc_result_t eresult, void *arg) {
 		query_detach(&query);
 		return;
 	} else if (eresult != ISC_R_SUCCESS) {
 		dig_lookup_t *l = query->lookup;
 		if (eresult != ISC_R_CANCELED) {
 			debug("udp setup failed: %s",
 			      isc_result_totext(eresult));
 		}
-
+		if (query->tries == 0) {
-		cancel_lookup(l);
+			query_detach(&query);
-		lookup_detach(&l);
+		}
 		query_detach(&query);
 		return;
 	}
@@ -2942,7 +2931,6 @@ static void
 start_udp(dig_query_t *query) {
 	isc_result_t result;
 	dig_query_t *next = NULL;
 	dig_query_t *connectquery = NULL;
 	REQUIRE(DIG_VALID_QUERY(query));
@@ -2994,10 +2982,24 @@ start_udp(dig_query_t *query) {
 		}
 	}
-	query_attach(query, &connectquery);
+	query->tries = 3;
-	isc_nm_udpconnect(netmgr, &localaddr, &query->sockaddr, udp_ready,
+	do {
-			  connectquery,
+		int local_timeout = timeout * 1000;
-			  (timeout ? timeout : UDP_TIMEOUT) * 1000, 0);
+		if (local_timeout == 0) {
 			local_timeout = UDP_TIMEOUT * 1000;
 		}
 		/*
 		 * On FreeBSD the UDP connect() call sometimes results
 		 * in a spurious transient EADDRINUSE. Try a few more times
 		 * before giving up.
 		 */
 		debug("isc_nm_udpconnect(): %d tries left", --query->tries);
 		result = isc_nm_udpconnect(netmgr, (isc_nmiface_t *)&localaddr,
 					   (isc_nmiface_t *)&query->sockaddr,
 					   udp_ready, query, local_timeout, 0);
 	} while (result != ISC_R_SUCCESS && query->tries > 0);
 	check_result(result, "isc_nm_udpconnect");
 }
 /*%
@@ -3104,8 +3106,7 @@ force_next(dig_query_t *query) {
 */
 static void
 requeue_or_update_exitcode(dig_lookup_t *lookup) {
-	if (lookup->eoferr == 0U && lookup->retries > 1) {
+	if (lookup->eoferr == 0U) {
 		--lookup->retries;
 		/*
 		 * Peer closed the connection prematurely for the first time
 		 * for this lookup.  Try again, keeping track of this failure.
@@ -3159,17 +3160,17 @@ launch_next_query(dig_query_t *query) {
 	isc_nmhandle_settimeout(query->handle, local_timeout);
 	query_attach(query, &readquery);
-	isc_nm_read(query->handle, recv_done, readquery);
+	if (query->lookup->https_mode) {
 		isc_nm_httprequest(query->handle, &r, recv_done, readquery);
 		goto cleanup;
 	} else {
 		isc_nm_read(query->handle, recv_done, readquery);
 	}
 	if (!query->first_soa_rcvd) {
 		dig_query_t *sendquery = NULL;
 		debug("sending a request in launch_next_query");
-		if (query->lookup->use_usec) {
+		TIME_NOW(&query->time_sent);
 			TIME_NOW_HIRES(&query->time_sent);
 		} else {
 			TIME_NOW(&query->time_sent);
 		}
 		query_attach(query, &sendquery);
 		isc_buffer_usedregion(&query->sendbuf, &r);
 		if (keep != NULL) {
@@ -3192,7 +3193,7 @@ launch_next_query(dig_query_t *query) {
 			}
 		}
 	}
-
+cleanup:
 	lookup_detach(&l);
 	return;
 }
@@ -3564,31 +3565,25 @@ recv_done(isc_nmhandle_t *handle, isc_result_t eresult, isc_region_t *region,
 	isc_sockaddr_t peer;
 	REQUIRE(DIG_VALID_QUERY(query));
-	REQUIRE(query->readhandle != NULL);
+	INSIST(query->readhandle != NULL);
 	INSIST(handle == query->readhandle);
 	INSIST(!free_now);
 	debug("recv_done(%p, %s, %p, %p)", handle, isc_result_totext(eresult),
 	      region, arg);
 	LOCK_LOOKUP;
 	lookup_attach(query->lookup, &l);
 	isc_refcount_decrement0(&recvcount);
 	debug("recvcount=%" PRIuFAST32, isc_refcount_current(&recvcount));
 	if (eresult == ISC_R_CANCELED) {
 		debug("recv_done: cancel");
-		isc_nmhandle_detach(&query->readhandle);
+		goto detach_query;
 		query_detach(&query);
 		return;
 	}
-	lookup_attach(query->lookup, &l);
+	TIME_NOW(&query->time_recv);
 	if (query->lookup->use_usec) {
 		TIME_NOW_HIRES(&query->time_recv);
 	} else {
 		TIME_NOW(&query->time_recv);
 	}
 	if (eresult == ISC_R_TIMEDOUT && !l->tcp_mode && l->retries > 1) {
 		dig_query_t *newq = NULL;
@@ -4194,23 +4189,19 @@ cancel_all(void) {
 		return;
 	}
 	atomic_store(&cancel_now, true);
-	while (current_lookup != NULL) {
+	if (current_lookup != NULL) {
 		for (q = ISC_LIST_HEAD(current_lookup->q); q != NULL; q = nq) {
 			nq = ISC_LIST_NEXT(q, link);
 			debug("canceling pending query %p, belonging to %p", q,
 			      current_lookup);
 			if (q->readhandle != NULL) {
-				isc_nm_cancelread(q->readhandle);
+				isc_refcount_decrement0(&recvcount);
 				debug("recvcount=%" PRIuFAST32,
 				      isc_refcount_current(&recvcount));
 			}
 			query_detach(&q);
 		}
-
+		lookup_detach(&current_lookup);
 		/*
 		 * current_lookup could have been detached via query_detach().
 		 */
 		if (current_lookup != NULL) {
 			lookup_detach(&current_lookup);
 		}
 	}
 	l = ISC_LIST_HEAD(lookup_list);
 	while (l != NULL) {
@@ -4236,8 +4227,20 @@ destroy_libs(void) {
 		debug("freeing task");
 		isc_task_detach(&global_task);
 	}
 	/*
 	 * The taskmgr_destroy() and isc_nm_destroy() calls block until
 	 * all events are cleared.
 	 */
 	if (taskmgr != NULL) {
 		debug("freeing taskmgr");
 		isc_taskmgr_destroy(&taskmgr);
 	}
-	isc_managers_destroy(&netmgr, &taskmgr, NULL, NULL);
+	debug("closing down netmgr");
 	isc_nm_closedown(netmgr);
 	debug("destroy netmgr");
 	isc_nm_destroy(&netmgr);
 	LOCK_LOOKUP;
 	isc_refcount_destroy(&recvcount);
@@ -172,7 +172,6 @@ struct dig_lookup {
 	unsigned int eoferr;
 	uint16_t qid;
 	struct {
 		bool http_plain;
 		bool https_mode;
 		bool https_get;
 		char *https_path;
@@ -208,6 +207,7 @@ struct dig_query {
 	isc_time_t time_recv;
 	uint64_t byte_count;
 	isc_timer_t *timer;
 	uint8_t tries;
 	isc_tlsctx_t *tlsctx;
 };
@@ -151,11 +151,7 @@ received(unsigned int bytes, isc_sockaddr_t *from, dig_query_t *query) {
 	if (!short_form) {
 		char fromtext[ISC_SOCKADDR_FORMATSIZE];
 		isc_sockaddr_format(from, fromtext, sizeof(fromtext));
-		if (query->lookup->use_usec) {
+		TIME_NOW(&now);
 			TIME_NOW_HIRES(&now);
 		} else {
 			TIME_NOW(&now);
 		}
 		diff = (int)isc_time_microdiff(&now, &query->time_sent);
 		printf("Received %u bytes from %s in %d ms\n", bytes, fromtext,
 		       diff / 1000);
@@ -379,7 +375,7 @@ chase_cnamechain(dns_message_t *msg, dns_name_t *qname) {
 		dns_rdataset_current(rdataset, &rdata);
 		result = dns_rdata_tostruct(&rdata, &cname, NULL);
 		check_result(result, "dns_rdata_tostruct");
-		dns_name_copy(&cname.cname, qname);
+		dns_name_copynf(&cname.cname, qname);
 		dns_rdata_freestruct(&cname);
 	}
 }
@@ -442,7 +438,7 @@ printmessage(dig_query_t *query, const isc_buffer_t *msgbuf, dns_message_t *msg,
 		/* Add AAAA and MX lookups. */
 		name = dns_fixedname_initname(&fixed);
-		dns_name_copy(query->lookup->name, name);
+		dns_name_copynf(query->lookup->name, name);
 		chase_cnamechain(msg, name);
 		dns_name_format(name, namestr, sizeof(namestr));
 		lookup = clone_lookup(query->lookup, false);
@@ -0,0 +1 @@
 ../../../.clang-format.headers
@@ -22,6 +22,7 @@
 #include <isc/netaddr.h>
 #include <isc/parseint.h>
 #include <isc/print.h>
 #include <isc/readline.h>
 #include <isc/string.h>
 #include <isc/task.h>
 #include <isc/util.h>
@@ -37,7 +38,6 @@
 #include <dns/rdatatype.h>
 #include "dighost.h"
 #include "readline.h"
 static bool short_form = true, tcpmode = false, tcpmode_set = false,
 	    identify = false, stats = true, comments = true,
@@ -391,7 +391,7 @@ chase_cnamechain(dns_message_t *msg, dns_name_t *qname) {
 		dns_rdataset_current(rdataset, &rdata);
 		result = dns_rdata_tostruct(&rdata, &cname, NULL);
 		check_result(result, "dns_rdata_tostruct");
-		dns_name_copy(&cname.cname, qname);
+		dns_name_copynf(&cname.cname, qname);
 		dns_rdata_freestruct(&cname);
 	}
 }
@@ -448,7 +448,7 @@ printmessage(dig_query_t *query, const isc_buffer_t *msgbuf, dns_message_t *msg,
 		/* Add AAAA lookup. */
 		name = dns_fixedname_initname(&fixed);
-		dns_name_copy(query->lookup->name, name);
+		dns_name_copynf(query->lookup->name, name);
 		chase_cnamechain(msg, name);
 		dns_name_format(name, namestr, sizeof(namestr));
 		lookup = clone_lookup(query->lookup, false);
@@ -215,7 +215,7 @@ loadkey(char *filename, unsigned char *key_buf, unsigned int key_buf_size,
 	rdclass = dst_key_class(key);
 	name = dns_fixedname_initname(&fixed);
-	dns_name_copy(dst_key_name(key), name);
+	dns_name_copynf(dst_key_name(key), name);
 	dst_key_free(&key);
 }
@@ -185,7 +185,7 @@ loadkey(char *filename, unsigned char *key_buf, unsigned int key_buf_size,
 	rdclass = dst_key_class(key);
 	name = dns_fixedname_initname(&fixed);
-	dns_name_copy(dst_key_name(key), name);
+	dns_name_copynf(dst_key_name(key), name);
 	dst_key_free(&key);
 }
@@ -40,7 +40,6 @@
 #include <isc/file.h>
 #include <isc/hash.h>
 #include <isc/hex.h>
 #include <isc/managers.h>
 #include <isc/md.h>
 #include <isc/mem.h>
 #include <isc/mutex.h>
@@ -145,7 +144,6 @@ static unsigned int nsigned = 0, nretained = 0, ndropped = 0;
 static unsigned int nverified = 0, nverifyfailed = 0;
 static const char *directory = NULL, *dsdir = NULL;
 static isc_mutex_t namelock, statslock;
 static isc_nm_t *netmgr = NULL;
 static isc_taskmgr_t *taskmgr = NULL;
 static dns_db_t *gdb;		  /* The database */
 static dns_dbversion_t *gversion; /* The database version */
@@ -179,9 +177,8 @@ static bool remove_orphansigs = false;
 static bool remove_inactkeysigs = false;
 static bool output_dnssec_only = false;
 static bool output_stdout = false;
-static bool set_maxttl = false;
+bool set_maxttl = false;
 static dns_ttl_t maxttl = 0;
 static bool no_max_check = false;
 #define INCSTAT(counter)            \
 	if (printstats) {           \
@@ -201,7 +198,7 @@ savezonecut(dns_fixedname_t *fzonecut, dns_name_t *name) {
 	dns_name_t *result;
 	result = dns_fixedname_initname(fzonecut);
-	dns_name_copy(name, result);
+	dns_name_copynf(name, result);
 	return (result);
 }
@@ -1337,8 +1334,8 @@ get_soa_ttls(void) {
 	result = dns_rdataset_first(&soaset);
 	check_result(result, "dns_rdataset_first");
 	dns_rdataset_current(&soaset, &rdata);
 	zone_soa_min_ttl = dns_soa_getminimum(&rdata);
 	soa_ttl = soaset.ttl;
 	zone_soa_min_ttl = ISC_MIN(dns_soa_getminimum(&rdata), soa_ttl);
 	if (set_maxttl) {
 		zone_soa_min_ttl = ISC_MIN(zone_soa_min_ttl, maxttl);
 		soa_ttl = ISC_MIN(soa_ttl, maxttl);
@@ -2397,7 +2394,7 @@ nsec3ify(unsigned int hashalg, dns_iterations_t iterations,
 			break;
 		}
 		if (result == ISC_R_NOMORE) {
-			dns_name_copy(gorigin, nextname);
+			dns_name_copynf(gorigin, nextname);
 			done = true;
 		} else if (result != ISC_R_SUCCESS) {
 			fatal("iterating through the database failed: %s",
@@ -2534,7 +2531,7 @@ nsec3ify(unsigned int hashalg, dns_iterations_t iterations,
 			break;
 		}
 		if (result == ISC_R_NOMORE) {
-			dns_name_copy(gorigin, nextname);
+			dns_name_copynf(gorigin, nextname);
 			done = true;
 		} else if (result != ISC_R_SUCCESS) {
 			fatal("iterating through the database failed: %s",
@@ -3441,12 +3438,6 @@ main(int argc, char *argv[]) {
 		case 'H':
 			set_iter = true;
 			/* too-many is NOT DOCUMENTED */
 			if (strcmp(isc_commandline_argument, "too-many") == 0) {
 				nsec3iter = 151;
 				no_max_check = true;
 				break;
 			}
 			nsec3iter = strtoul(isc_commandline_argument, &endp, 0);
 			if (*endp != '\0') {
 				fatal("iterations must be numeric");
@@ -3815,7 +3806,11 @@ main(int argc, char *argv[]) {
 	 * of keys rather early.
 	 */
 	ISC_LIST_INIT(keylist);
-	isc_rwlock_init(&keylist_lock, 0, 0);
+	result = isc_rwlock_init(&keylist_lock, 0, 0);
 	if (result != ISC_R_SUCCESS) {
 		fatal("could not initialize keylist_lock: %s",
 		      isc_result_totext(result));
 	}
 	/*
 	 * Fill keylist with:
@@ -3865,6 +3860,7 @@ main(int argc, char *argv[]) {
 	warnifallksk(gdb);
 	if (IS_NSEC3) {
 		unsigned int max;
 		bool answer;
 		hash_length = dns_nsec3_hashlength(dns_hash_sha1);
@@ -3883,15 +3879,12 @@ main(int argc, char *argv[]) {
 			      "NSEC-only DNSKEY");
 		}
-		if (nsec3iter > dns_nsec3_maxiterations()) {
+		result = dns_nsec3_maxiterations(gdb, NULL, mctx, &max);
-			if (no_max_check) {
+		check_result(result, "dns_nsec3_maxiterations()");
-				fprintf(stderr,
+		if (nsec3iter > max) {
-					"Ignoring max iterations check.\n");
+			fatal("NSEC3 iterations too big for weakest DNSKEY "
-			} else {
+			      "strength. Maximum iterations allowed %u.",
-				fatal("NSEC3 iterations too big. Maximum "
+			      max);
 				      "iterations allowed %u.",
 				      dns_nsec3_maxiterations());
 			}
 		}
 	} else {
 		hashlist_init(&hashlist, 0, 0); /* silence clang */
@@ -3964,7 +3957,11 @@ main(int argc, char *argv[]) {
 	print_time(outfp);
 	print_version(outfp);
-	isc_managers_create(mctx, ntasks, 0, 0, &netmgr, &taskmgr, NULL, NULL);
+	result = isc_taskmgr_create(mctx, ntasks, 0, NULL, &taskmgr);
 	if (result != ISC_R_SUCCESS) {
 		fatal("failed to create task manager: %s",
 		      isc_result_totext(result));
 	}
 	master = NULL;
 	result = isc_task_create(taskmgr, 0, &master);
@@ -4015,7 +4012,7 @@ main(int argc, char *argv[]) {
 	for (i = 0; i < (int)ntasks; i++) {
 		isc_task_detach(&tasks[i]);
 	}
-	isc_managers_destroy(&netmgr, &taskmgr, NULL, NULL);
+	isc_taskmgr_destroy(&taskmgr);
 	isc_mem_put(mctx, tasks, ntasks * sizeof(isc_task_t *));
 	postsign();
 	TIME_NOW(&sign_finish);
@@ -123,8 +123,6 @@ options {\n\
 	tcp-initial-timeout 300;\n\
 	tcp-keepalive-timeout 300;\n\
 	tcp-listen-queue 10;\n\
 	tcp-receive-buffer 0;\n\
 	tcp-send-buffer 0;\n\
 #	tkey-dhkey <none>\n\
 #	tkey-domain <none>\n\
 #	tkey-gssapi-credential <none>\n\
@@ -135,8 +133,6 @@ options {\n\
 #	treat-cr-as-space <obsolete>;\n\
 	trust-anchor-telemetry yes;\n\
 #	use-id-pool <obsolete>;\n\
 	udp-receive-buffer 0;\n\
 	udp-send-buffer 0;\n\
 \n\
 	/* view */\n\
 	allow-new-zones no;\n\
@@ -199,8 +195,8 @@ options {\n\
 	root-key-sentinel yes;\n\
 	servfail-ttl 1;\n\
 #	sortlist <none>\n\
 	stale-answer-client-timeout off;\n\
 	stale-answer-enable false;\n\
 	stale-answer-client-timeout 1800; /* in milliseconds */\n\
 	stale-answer-ttl 30; /* 30 seconds */\n\
 	stale-cache-enable false;\n\
 	stale-refresh-time 30; /* 30 seconds */\n\
@@ -229,7 +225,7 @@ options {\n\
 	dnssec-update-mode maintain;\n\
 #	forward <none>\n\
 #	forwarders <none>\n\
-#	inline-signing no;\n\
+	inline-signing no;\n\
 	ixfr-from-differences false;\n\
 #	maintain-ixfr-base <obsolete>;\n\
 #	max-ixfr-log-size <obsolete>\n\
@@ -639,7 +635,7 @@ named_config_getname(isc_mem_t *mctx, const cfg_obj_t *obj,
 	result = dns_name_fromtext(dns_fixedname_name(&fname), &b, dns_rootname,
 				   0, NULL);
 	if (result != ISC_R_SUCCESS) {
-		isc_mem_put(mctx, *namep, sizeof(**namep));
+		isc_mem_put(mctx, *namep, sizeof(*namep));
 		*namep = NULL;
 		return (result);
 	}
@@ -1164,9 +1164,10 @@ add_listener(named_controls_t *cp, controllistener_t **listenerp,
 	}
 #endif
-	CHECK(isc_nm_listentcp(
+	CHECK(isc_nm_listentcp(named_g_nm, (isc_nmiface_t *)&listener->address,
-		named_g_netmgr, &listener->address, control_newconn, listener,
+			       control_newconn, listener,
-		sizeof(controlconnection_t), 5, NULL, &listener->sock));
+			       sizeof(controlconnection_t), 5, NULL,
 			       &listener->sock));
 #if 0
 	/* XXX: no unix socket support yet */
 	if (type == isc_socktype_unix) {
@@ -1188,9 +1189,11 @@ add_listener(named_controls_t *cp, controllistener_t **listenerp,
 	return;
 cleanup:
-	isc_refcount_decrement(&listener->refs);
+	if (listener != NULL) {
-	listener->exiting = true;
+		isc_refcount_decrement(&listener->refs);
-	free_listener(listener);
+		listener->exiting = true;
 		free_listener(listener);
 	}
 	if (control != NULL) {
 		cfg_obj_log(control, named_g_lctx, ISC_LOG_WARNING,
@@ -1466,7 +1469,6 @@ named_controls_create(named_server_t *server, named_controls_t **ctrlsp) {
 	ISC_LIST_INIT(controls->listeners);
 	atomic_init(&controls->shuttingdown, false);
 	isc_mutex_init(&controls->symtab_lock);
 	LOCK(&controls->symtab_lock);
 	result = isccc_cc_createsymtab(&controls->symtab);
@@ -62,20 +62,20 @@ EXTERN bool named_g_run_done INIT(false);
 */
 EXTERN isc_timermgr_t *named_g_timermgr INIT(NULL);
 EXTERN isc_socketmgr_t *named_g_socketmgr INIT(NULL);
-EXTERN isc_nm_t *named_g_netmgr INIT(NULL);
+EXTERN isc_nm_t *named_g_nm INIT(NULL);
 EXTERN cfg_parser_t *named_g_parser INIT(NULL);
-EXTERN cfg_parser_t *named_g_addparser INIT(NULL);
+EXTERN cfg_parser_t *named_g_addparser	  INIT(NULL);
-EXTERN const char *named_g_version     INIT(PACKAGE_VERSION);
+EXTERN const char *named_g_version	  INIT(PACKAGE_VERSION);
-EXTERN const char *named_g_product     INIT(PACKAGE_NAME);
+EXTERN const char *named_g_product	  INIT(PACKAGE_NAME);
-EXTERN const char *named_g_description INIT(PACKAGE_DESCRIPTION);
+EXTERN const char *named_g_description	  INIT(PACKAGE_DESCRIPTION);
-EXTERN const char *named_g_srcid       INIT(PACKAGE_SRCID);
+EXTERN const char *named_g_srcid	  INIT(PACKAGE_SRCID);
-EXTERN const char *named_g_configargs  INIT(PACKAGE_CONFIGARGS);
+EXTERN const char *named_g_configargs	  INIT(PACKAGE_CONFIGARGS);
-EXTERN const char *named_g_builder     INIT(PACKAGE_BUILDER);
+EXTERN const char *named_g_builder	  INIT(PACKAGE_BUILDER);
-EXTERN in_port_t named_g_port	       INIT(0);
+EXTERN in_port_t named_g_port		  INIT(0);
-EXTERN in_port_t named_g_tlsport       INIT(0);
+EXTERN in_port_t named_g_tlsport	  INIT(0);
-EXTERN in_port_t named_g_httpsport     INIT(0);
+EXTERN in_port_t named_g_http_secure_port INIT(0);
-EXTERN in_port_t named_g_httpport      INIT(0);
+EXTERN in_port_t named_g_http_port	  INIT(0);
-EXTERN isc_dscp_t named_g_dscp	       INIT(-1);
+EXTERN isc_dscp_t named_g_dscp		  INIT(-1);
 EXTERN named_server_t *named_g_server INIT(NULL);
@@ -18,10 +18,6 @@
 #include <string.h>
 #include <uv.h>
 #ifdef HAVE_DNSTAP
 #include <protobuf-c/protobuf-c.h>
 #endif
 #include <isc/app.h>
 #include <isc/attributes.h>
 #include <isc/backtrace.h>
@@ -31,7 +27,6 @@
 #include <isc/hash.h>
 #include <isc/hp.h>
 #include <isc/httpd.h>
 #include <isc/managers.h>
 #include <isc/netmgr.h>
 #include <isc/os.h>
 #include <isc/platform.h>
@@ -101,7 +96,6 @@
 #ifdef HAVE_ZLIB
 #include <zlib.h>
 #endif /* ifdef HAVE_ZLIB */
 #include <nghttp2/nghttp2.h>
 /*
 * Include header files for database drivers here.
 */
@@ -206,6 +200,8 @@ assertion_failed(const char *file, int line, isc_assertiontype_t type,
 		 const char *cond) {
 	void *tracebuf[BACKTRACE_MAXFRAME];
 	int nframes;
 	isc_result_t result;
 	const char *logsuffix = "";
 	/*
 	 * Handle assertion failures.
@@ -218,23 +214,32 @@ assertion_failed(const char *file, int line, isc_assertiontype_t type,
 		 */
 		isc_assertion_setcallback(NULL);
-		nframes = isc_backtrace(tracebuf, BACKTRACE_MAXFRAME);
+		result = isc_backtrace_gettrace(tracebuf, BACKTRACE_MAXFRAME,
 						&nframes);
 		if (result == ISC_R_SUCCESS && nframes > 0) {
 			logsuffix = ", back trace";
 		}
 		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 			      NAMED_LOGMODULE_MAIN, ISC_LOG_CRITICAL,
 			      "%s:%d: %s(%s) failed%s", file, line,
-			      isc_assertion_typetotext(type), cond,
+			      isc_assertion_typetotext(type), cond, logsuffix);
-			      (nframes > 0) ? ", back trace" : "");
+		if (result == ISC_R_SUCCESS) {
-		if (nframes > 0) {
+#if HAVE_BACKTRACE_SYMBOLS
-			char **strs = isc_backtrace_symbols(tracebuf, nframes);
+			char **strs = backtrace_symbols(tracebuf, nframes);
-			if (strs != NULL) {
+			for (int i = 0; i < nframes; i++) {
-				for (int i = 0; i < nframes; i++) {
+				isc_log_write(named_g_lctx,
-					isc_log_write(named_g_lctx,
+					      NAMED_LOGCATEGORY_GENERAL,
-						      NAMED_LOGCATEGORY_GENERAL,
+					      NAMED_LOGMODULE_MAIN,
-						      NAMED_LOGMODULE_MAIN,
+					      ISC_LOG_CRITICAL, "%s", strs[i]);
 						      ISC_LOG_CRITICAL, "%s",
 						      strs[i]);
 				}
 			}
 #else  /* HAVE_BACKTRACE_SYMBOLS */
 			for (int i = 0; i < nframes; i++) {
 				isc_log_write(
 					named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 					NAMED_LOGMODULE_MAIN, ISC_LOG_CRITICAL,
 					"#%d %p in ??", i, tracebuf[i]);
 			}
 #endif /* HAVE_BACKTRACE_SYMBOLS */
 		}
 		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 			      NAMED_LOGMODULE_MAIN, ISC_LOG_CRITICAL,
@@ -320,14 +325,11 @@ library_unexpected_error(const char *file, int line, const char *format,
 static void
 usage(void) {
 	fprintf(stderr, "usage: named [-4|-6] [-c conffile] [-d debuglevel] "
-			"[-D comment] [-E engine]\n"
+			"[-E engine] [-f|-g]\n"
-			"             [-f|-g] [-L logfile] [-n number_of_cpus] "
+			"             [-n number_of_cpus] [-p port] [-s] "
-			"[-p port] [-s]\n"
+			"[-S sockets] [-t chrootdir]\n"
-			"             [-S sockets] [-t chrootdir] [-u "
+			"             [-u username] [-U listeners] "
-			"username] [-U listeners]\n"
+			"[-m {usage|trace|record|size|mctx}]\n"
 			"             [-X lockfile] [-m "
 			"{usage|trace|record|size|mctx}]\n"
 			"             [-M fill|nofill]\n"
 			"usage: named [-v|-V]\n");
 }
@@ -433,7 +435,8 @@ static struct flag_def {
 			{ "size", ISC_MEM_DEBUGSIZE, false },
 			{ "mctx", ISC_MEM_DEBUGCTX, false },
 			{ NULL, 0, false } },
-  mem_context_flags[] = { { "fill", ISC_MEMFLAG_FILL, false },
+  mem_context_flags[] = { { "external", ISC_MEMFLAG_INTERNAL, true },
 			  { "fill", ISC_MEMFLAG_FILL, false },
 			  { "nofill", ISC_MEMFLAG_FILL, true },
 			  { NULL, 0, false } };
@@ -485,7 +488,6 @@ printversion(bool verbose) {
 	cfg_obj_t *config = NULL;
 	const cfg_obj_t *defaults = NULL, *obj = NULL;
 #endif /* if defined(HAVE_GEOIP2) */
 	nghttp2_info *nginfo = NULL;
 	printf("%s%s <id:%s>\n", PACKAGE_STRING, PACKAGE_DESCRIPTION,
 	       PACKAGE_SRCID);
@@ -527,9 +529,6 @@ printversion(bool verbose) {
 	printf("compiled with libuv version: %d.%d.%d\n", UV_VERSION_MAJOR,
 	       UV_VERSION_MINOR, UV_VERSION_PATCH);
 	printf("linked to libuv version: %s\n", uv_version_string());
 	printf("compiled with libnghttp2 version: %s\n", NGHTTP2_VERSION);
 	nginfo = nghttp2_version(1);
 	printf("linked to libnghttp2 version: %s\n", nginfo->version_str);
 #ifdef HAVE_LIBXML2
 	printf("compiled with libxml2 version: %s\n", LIBXML_DOTTED_VERSION);
 	printf("linked to libxml2 version: %s\n", xmlParserVersion);
@@ -706,7 +705,7 @@ parse_T_opt(char *option) {
 static void
 parse_port(char *arg) {
-	enum { DNSPORT, TLSPORT, HTTPSPORT, HTTPPORT } ptype = DNSPORT;
+	enum { DNSPORT, TLSPORT, HTTP_SECURE_PORT, HTTP_PORT } ptype = DNSPORT;
 	char *value = arg;
 	int port;
@@ -717,10 +716,10 @@ parse_port(char *arg) {
 		ptype = TLSPORT;
 	} else if (strncmp(arg, "https=", 6) == 0) {
 		value = arg + 6;
-		ptype = HTTPSPORT;
+		ptype = HTTP_SECURE_PORT;
 	} else if (strncmp(arg, "http=", 5) == 0) {
 		value = arg + 6;
-		ptype = HTTPPORT;
+		ptype = HTTP_PORT;
 	}
 	port = parse_int(value, "port");
@@ -735,11 +734,11 @@ parse_port(char *arg) {
 	case TLSPORT:
 		named_g_tlsport = port;
 		break;
-	case HTTPSPORT:
+	case HTTP_SECURE_PORT:
-		named_g_httpsport = port;
+		named_g_http_secure_port = port;
 		break;
-	case HTTPPORT:
+	case HTTP_PORT:
-		named_g_httpport = port;
+		named_g_http_port = port;
 		break;
 	default:
 		INSIST(0);
@@ -938,17 +937,45 @@ create_managers(void) {
 		      "using %u UDP listener%s per interface", named_g_udpdisp,
 		      named_g_udpdisp == 1 ? "" : "s");
-	result = isc_managers_create(named_g_mctx, named_g_cpus,
+	/*
-				     0 /* quantum */, maxsocks, &named_g_netmgr,
+	 * We have ncpus network threads, ncpus worker threads, ncpus
-				     &named_g_taskmgr, &named_g_timermgr,
+	 * old network threads - make it 4x just to be safe. The memory
-				     &named_g_socketmgr);
+	 * impact is negligible.
-	if (result != ISC_R_SUCCESS) {
+	 */
-		return (result);
+	isc_hp_init(4 * named_g_cpus);
 	named_g_nm = isc_nm_start(named_g_mctx, named_g_cpus);
 	if (named_g_nm == NULL) {
 		UNEXPECTED_ERROR(__FILE__, __LINE__, "isc_nm_start() failed");
 		return (ISC_R_UNEXPECTED);
 	}
-	isc_socketmgr_maxudp(named_g_socketmgr, maxudp);
+	result = isc_taskmgr_create(named_g_mctx, named_g_cpus, 0, named_g_nm,
-	isc_nm_maxudp(named_g_netmgr, maxudp);
+				    &named_g_taskmgr);
 	if (result != ISC_R_SUCCESS) {
 		UNEXPECTED_ERROR(__FILE__, __LINE__,
 				 "isc_taskmgr_create() failed: %s",
 				 isc_result_totext(result));
 		return (ISC_R_UNEXPECTED);
 	}
 	result = isc_timermgr_create(named_g_mctx, &named_g_timermgr);
 	if (result != ISC_R_SUCCESS) {
 		UNEXPECTED_ERROR(__FILE__, __LINE__,
 				 "isc_timermgr_create() failed: %s",
 				 isc_result_totext(result));
 		return (ISC_R_UNEXPECTED);
 	}
 	result = isc_socketmgr_create2(named_g_mctx, &named_g_socketmgr,
 				       maxsocks, named_g_cpus);
 	if (result != ISC_R_SUCCESS) {
 		UNEXPECTED_ERROR(__FILE__, __LINE__,
 				 "isc_socketmgr_create() failed: %s",
 				 isc_result_totext(result));
 		return (ISC_R_UNEXPECTED);
 	}
 	isc_socketmgr_maxudp(named_g_socketmgr, maxudp);
 	isc_nm_maxudp(named_g_nm, maxudp);
 	result = isc_socketmgr_getmaxsockets(named_g_socketmgr, &socks);
 	if (result == ISC_R_SUCCESS) {
 		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
@@ -961,8 +988,25 @@ create_managers(void) {
 static void
 destroy_managers(void) {
-	isc_managers_destroy(&named_g_netmgr, &named_g_taskmgr,
+	/*
-			     &named_g_timermgr, &named_g_socketmgr);
+	 * isc_nm_closedown() closes all active connections, freeing
 	 * attached clients and other resources and preventing new
 	 * connections from being established, but it not does not
 	 * stop all processing or destroy the netmgr yet.
 	 */
 	isc_nm_closedown(named_g_nm);
 	/*
 	 * isc_taskmgr_destroy() will block until all tasks have exited.
 	 */
 	isc_taskmgr_destroy(&named_g_taskmgr);
 	isc_timermgr_destroy(&named_g_timermgr);
 	isc_socketmgr_destroy(&named_g_socketmgr);
 	/*
 	 * At this point is safe to destroy the netmgr.
 	 */
 	isc_nm_destroy(&named_g_nm);
 }
 static void
@@ -1472,6 +1516,15 @@ main(int argc, char *argv[]) {
 	pk11_result_register();
 #endif /* if USE_PKCS11 */
 #if !ISC_MEM_DEFAULTFILL
 	/*
 	 * Update the default flags to remove ISC_MEMFLAG_FILL
 	 * before we parse the command line. If disabled here,
 	 * it can be turned back on with -M fill.
 	 */
 	isc_mem_defaultflags &= ~ISC_MEMFLAG_FILL;
 #endif /* if !ISC_MEM_DEFAULTFILL */
 	parse_command_line(argc, argv);
 #ifdef ENABLE_AFL
@@ -1502,7 +1555,7 @@ main(int argc, char *argv[]) {
 	}
 	isc_mem_create(&named_g_mctx);
-	isc_mem_setname(named_g_mctx, "main");
+	isc_mem_setname(named_g_mctx, "main", NULL);
 	setup();
@@ -71,7 +71,6 @@ DNSSEC-POLICY
  	parent-ds-ttl duration;
  	parent-propagation-delay duration;
  	publish-safety duration;
  	purge-keys duration;
  	retire-safety duration;
  	signatures-refresh duration;
  	signatures-validity duration;
@@ -93,7 +92,7 @@ HTTP
 ::
  http string {
-  	endpoints { quoted_string; ... };
+  	endpoints { quoted_string; ... }; // experimental
  };
 KEY
@@ -276,6 +275,7 @@ OPTIONS
  	hostname ( quoted_string | none );
  	http-port integer;
  	https-port integer;
  	inline-signing boolean;
  	interface-interval duration;
  	ipv4only-contact string;
  	ipv4only-enable boolean;
@@ -432,8 +432,6 @@ OPTIONS
  	tcp-initial-timeout integer;
  	tcp-keepalive-timeout integer;
  	tcp-listen-queue integer;
  	tcp-receive-buffer integer;
  	tcp-send-buffer integer;
  	tkey-dhkey quoted_string integer;
  	tkey-domain quoted_string;
  	tkey-gssapi-credential quoted_string;
@@ -450,8 +448,6 @@ OPTIONS
  	transfers-per-ns integer;
  	trust-anchor-telemetry boolean; // experimental
  	try-tcp-refresh boolean;
  	udp-receive-buffer integer;
  	udp-send-buffer integer;
  	update-check-ksk boolean;
  	use-alt-transfer-source boolean;
  	use-v4-udp-ports { portrange; ... };
@@ -669,6 +665,7 @@ VIEW
  	forwarders [ port integer ] [ dscp integer ] { ( ipv4_address
  	    | ipv6_address ) [ port integer ] [ dscp integer ]; ... };
  	glue-cache boolean;// deprecated
  	inline-signing boolean;
  	ipv4only-contact string;
  	ipv4only-enable boolean;
  	ipv4only-server string;
@@ -3612,7 +3612,7 @@ add_listener(named_server_t *server, named_statschannel_t **listenerp,
 		CHECK(ISC_R_FAMILYNOSUPPORT);
 	}
-	CHECK(isc_httpdmgr_create(named_g_netmgr, server->mctx, addr, client_ok,
+	CHECK(isc_httpdmgr_create(named_g_nm, server->mctx, addr, client_ok,
 				  destroy_listener, listener,
 				  &listener->httpdmgr));
@@ -64,7 +64,7 @@ add_doh_transports(const cfg_obj_t *transportlist, dns_transport_list_t *list) {
 		create_name(dohid, &dohname);
-		transport = dns_transport_new(&dohname, DNS_TRANSPORT_HTTP,
+		transport = dns_transport_new(&dohname, DNS_TRANSPORT_DOH,
 					      list);
 		parse_transport_option(doh, transport, "key-file",
@@ -379,7 +379,7 @@ all_digits(const char *s) {
 		return (false);
 	}
 	while (*s != '\0') {
-		if (!isdigit((unsigned char)(*s))) {
+		if (!isdigit((*s) & 0xff)) {
 			return (false);
 		}
 		s++;
@@ -67,7 +67,7 @@
      <ProgramDataBaseFileName>$(OutDir)$(TargetName).pdb</ProgramDataBaseFileName>
      <BrowseInformation>true</BrowseInformation>
      <ForcedIncludeFiles>..\..\..\config.h</ForcedIncludeFiles>
-      <AdditionalIncludeDirectories>@LIBUV_INC@@NGHTTP2_INC@@OPENSSL_INC@@GSSAPI_INC@@GEOIP_INC@.\;..\..\..\;@LIBXML2_INC@..\win32\include;..\include;..\..\..\lib\isc\win32;..\..\..\lib\isc\win32\include;..\..\..\lib\isc\include;..\..\..\lib\dns\include;..\..\..\lib\isccc\include;..\..\..\lib\isccfg\include;..\..\..\lib\bind9\include;..\..\..\lib\ns\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+      <AdditionalIncludeDirectories>@LIBUV_INC@@OPENSSL_INC@@GSSAPI_INC@@GEOIP_INC@.\;..\..\..\;@LIBXML2_INC@..\win32\include;..\include;..\..\..\lib\isc\win32;..\..\..\lib\isc\win32\include;..\..\..\lib\isc\include;..\..\..\lib\dns\include;..\..\..\lib\isccc\include;..\..\..\lib\isccfg\include;..\..\..\lib\bind9\include;..\..\..\lib\ns\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
      <CompileAs>CompileAsC</CompileAs>
    </ClCompile>
    <Link>
@@ -75,7 +75,7 @@
      <GenerateDebugInformation>true</GenerateDebugInformation>
      <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
      <AdditionalLibraryDirectories>..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);..\..\..\lib\isccc\win32\$(Configuration);..\..\..\lib\isccfg\win32\$(Configuration);..\..\..\lib\bind9\win32\$(Configuration);..\..\..\lib\ns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>@LIBUV_LIB@@NGHTTP2_LIB@@OPENSSL_LIBCRYPTO@@OPENSSL_LIBSSL@@LIBXML2_LIB@@GSSAPI_LIB@@GEOIP_LIB@libisc.lib;libdns.lib;libisccc.lib;libisccfg.lib;libbind9.lib;libns.lib;version.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>@LIBUV_LIB@@OPENSSL_LIBCRYPTO@@OPENSSL_LIBSSL@@LIBXML2_LIB@@GSSAPI_LIB@@GEOIP_LIB@libisc.lib;libdns.lib;libisccc.lib;libisccfg.lib;libbind9.lib;libns.lib;version.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
    </Link>
    <PreBuildEvent>
      <Command>cd ..
@@ -103,7 +103,7 @@ perl -e "print \";\";" &gt;&gt; xsl.c
      <ObjectFileName>.\$(Configuration)\</ObjectFileName>
      <ProgramDataBaseFileName>$(OutDir)$(TargetName).pdb</ProgramDataBaseFileName>
      <ForcedIncludeFiles>..\..\..\config.h</ForcedIncludeFiles>
-      <AdditionalIncludeDirectories>@LIBUV_INC@@NGHTTP2_INC@@OPENSSL_INC@@GSSAPI_INC@@GEOIP_INC@.\;..\..\..\;@LIBXML2_INC@..\win32\include;..\include;..\..\..\lib\isc\win32;..\..\..\lib\isc\win32\include;..\..\..\lib\isc\include;..\..\..\lib\dns\include;..\..\..\lib\isccc\include;..\..\..\lib\isccfg\include;..\..\..\lib\bind9\include;..\..\..\lib\ns\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+      <AdditionalIncludeDirectories>@LIBUV_INC@@OPENSSL_INC@@GSSAPI_INC@@GEOIP_INC@.\;..\..\..\;@LIBXML2_INC@..\win32\include;..\include;..\..\..\lib\isc\win32;..\..\..\lib\isc\win32\include;..\..\..\lib\isc\include;..\..\..\lib\dns\include;..\..\..\lib\isccc\include;..\..\..\lib\isccfg\include;..\..\..\lib\bind9\include;..\..\..\lib\ns\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
      <CompileAs>CompileAsC</CompileAs>
    </ClCompile>
    <Link>
@@ -114,7 +114,7 @@ perl -e "print \";\";" &gt;&gt; xsl.c
      <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
      <LinkTimeCodeGeneration>Default</LinkTimeCodeGeneration>
      <AdditionalLibraryDirectories>..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);..\..\..\lib\isccc\win32\$(Configuration);..\..\..\lib\isccfg\win32\$(Configuration);..\..\..\lib\bind9\win32\$(Configuration);..\..\..\lib\ns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>@LIBUV_LIB@@NGHTTP2_LIB@@OPENSSL_LIBCRYPTO@@OPENSSL_LIBSSL@@LIBXML2_LIB@@GSSAPI_LIB@@GEOIP_LIB@libisc.lib;libdns.lib;libisccc.lib;libisccfg.lib;libbind9.lib;libns.lib;version.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>@LIBUV_LIB@@OPENSSL_LIBCRYPTO@@OPENSSL_LIBSSL@@LIBXML2_LIB@@GSSAPI_LIB@@GEOIP_LIB@libisc.lib;libdns.lib;libisccc.lib;libisccfg.lib;libbind9.lib;libns.lib;version.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
    </Link>
    <PreBuildEvent>
      <Command>cd ..
@@ -272,8 +272,8 @@ configure_zone_ssutable(const cfg_obj_t *zconfig, dns_zone_t *zone,
 		dns_fixedname_init(&fname);
 		if (usezone) {
-			dns_name_copy(dns_zone_getorigin(zone),
+			dns_name_copynf(dns_zone_getorigin(zone),
-				      dns_fixedname_name(&fname));
+					dns_fixedname_name(&fname));
 		} else {
 			str = cfg_obj_asstring(dname);
 			isc_buffer_constinit(&b, str, strlen(str));
@@ -1249,23 +1249,15 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 		result = named_config_get(maps, "dnssec-policy", &obj);
 		if (result == ISC_R_SUCCESS) {
 			kaspname = cfg_obj_asstring(obj);
-			if (strcmp(kaspname, "none") != 0) {
+			result = dns_kasplist_find(kasplist, kaspname, &kasp);
-				result = dns_kasplist_find(kasplist, kaspname,
+			if (result != ISC_R_SUCCESS) {
-							   &kasp);
+				cfg_obj_log(obj, named_g_lctx, ISC_LOG_ERROR,
-				if (result != ISC_R_SUCCESS) {
+					    "'dnssec-policy '%s' not found ",
-					cfg_obj_log(
+					    kaspname);
-						obj, named_g_lctx,
+				RETERR(result);
 						ISC_LOG_ERROR,
 						"dnssec-policy '%s' not found ",
 						kaspname);
 					RETERR(result);
 				}
 				dns_zone_setkasp(zone, kasp);
 				use_kasp = true;
 			}
-		}
+			dns_zone_setkasp(zone, kasp);
-		if (!use_kasp) {
+			use_kasp = dns_zone_use_kasp(zone);
 			dns_zone_setkasp(zone, NULL);
 		}
 		obj = NULL;
@@ -1679,11 +1671,10 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 		obj = NULL;
 		result = cfg_map_get(zoptions, "auto-dnssec", &obj);
-		if (kasp != NULL) {
+		if (kasp != NULL && strcmp(dns_kasp_getname(kasp), "none") != 0)
-			bool s2i = (strcmp(dns_kasp_getname(kasp),
+		{
 					   "insecure") != 0);
 			dns_zone_setkeyopt(zone, DNS_ZONEKEY_ALLOW, true);
-			dns_zone_setkeyopt(zone, DNS_ZONEKEY_CREATE, !s2i);
+			dns_zone_setkeyopt(zone, DNS_ZONEKEY_CREATE, true);
 			dns_zone_setkeyopt(zone, DNS_ZONEKEY_MAINTAIN, true);
 		} else if (result == ISC_R_SUCCESS) {
 			const char *arg = cfg_obj_asstring(obj);
@@ -1700,6 +1691,11 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 			dns_zone_setkeyopt(zone, DNS_ZONEKEY_ALLOW, allow);
 			dns_zone_setkeyopt(zone, DNS_ZONEKEY_CREATE, false);
 			dns_zone_setkeyopt(zone, DNS_ZONEKEY_MAINTAIN, maint);
 		} else {
 			bool s2i = dns_zone_secure_to_insecure(zone, false);
 			dns_zone_setkeyopt(zone, DNS_ZONEKEY_ALLOW, s2i);
 			dns_zone_setkeyopt(zone, DNS_ZONEKEY_CREATE, false);
 			dns_zone_setkeyopt(zone, DNS_ZONEKEY_MAINTAIN, s2i);
 		}
 	}
@@ -2220,6 +2216,13 @@ named_zone_inlinesigning(dns_zone_t *zone, const cfg_obj_t *zconfig,
 			dns_zone_log(zone, ISC_LOG_DEBUG(1),
 				     "inline-signing: "
 				     "implicitly through dnssec-policy");
 		} else {
 			inline_signing = dns_zone_secure_to_insecure(zone,
 								     true);
 			dns_zone_log(
 				zone, ISC_LOG_DEBUG(1), "inline-signing: %s",
 				inline_signing ? "transitioning to insecure"
 					       : "no");
 		}
 	}
@@ -7,8 +7,7 @@ AM_CPPFLAGS +=			\
 	$(LIBIRS_CFLAGS)	\
 	$(LIBBIND9_CFLAGS)	\
 	$(GSSAPI_CFLAGS)	\
-	$(KRB5_CFLAGS)		\
+	$(KRB5_CFLAGS)
 	$(READLINE_CFLAGS)
 AM_CPPFLAGS += \
 	-DSESSION_KEYFILE=\"${localstatedir}/run/named/session.key\"
@@ -28,7 +27,3 @@ LDADD +=			\
 endif
 bin_PROGRAMS = nsupdate
 nsupdate_SOURCES =		\
 	nsupdate.c		\
 	../dig/readline.h
@@ -29,7 +29,6 @@
 #include <isc/hash.h>
 #include <isc/lex.h>
 #include <isc/log.h>
 #include <isc/managers.h>
 #include <isc/mem.h>
 #include <isc/nonce.h>
 #include <isc/parseint.h>
@@ -37,6 +36,7 @@
 #include <isc/portset.h>
 #include <isc/print.h>
 #include <isc/random.h>
 #include <isc/readline.h>
 #include <isc/region.h>
 #include <isc/sockaddr.h>
 #include <isc/socket.h>
@@ -58,7 +58,6 @@
 #include <dns/masterdump.h>
 #include <dns/message.h>
 #include <dns/name.h>
 #include <dns/nsec3.h>
 #include <dns/rcode.h>
 #include <dns/rdata.h>
 #include <dns/rdataclass.h>
@@ -96,8 +95,6 @@
 #include <bind9/getaddresses.h>
 #include "../dig/readline.h"
 #define MAXCMD	     (128 * 1024)
 #define MAXWIRE	     (64 * 1024)
 #define PACKETSIZE   ((64 * 1024) - 1)
@@ -127,7 +124,6 @@ static bool usegsstsig = false;
 static bool use_win2k_gsstsig = false;
 static bool tried_other_gsstsig = false;
 static bool local_only = false;
 static isc_nm_t *netmgr = NULL;
 static isc_taskmgr_t *taskmgr = NULL;
 static isc_task_t *global_task = NULL;
 static isc_event_t *global_event = NULL;
@@ -924,8 +920,14 @@ setup_system(void) {
 	result = dns_dispatchmgr_create(gmctx, &dispatchmgr);
 	check_result(result, "dns_dispatchmgr_create");
-	isc_managers_create(gmctx, 1, 0, 0, &netmgr, &taskmgr, &timermgr,
+	result = isc_socketmgr_create(gmctx, &socketmgr);
-			    &socketmgr);
+	check_result(result, "dns_socketmgr_create");
 	result = isc_timermgr_create(gmctx, &timermgr);
 	check_result(result, "dns_timermgr_create");
 	result = isc_taskmgr_create(gmctx, 1, 0, NULL, &taskmgr);
 	check_result(result, "isc_taskmgr_create");
 	result = isc_task_create(taskmgr, 0, &global_task);
 	check_result(result, "isc_task_create");
@@ -1264,6 +1266,7 @@ static uint16_t
 parse_name(char **cmdlinep, dns_message_t *msg, dns_name_t **namep) {
 	isc_result_t result;
 	char *word;
 	isc_buffer_t *namebuf = NULL;
 	isc_buffer_t source;
 	word = nsu_strsep(cmdlinep, " \t\r\n");
@@ -1274,6 +1277,10 @@ parse_name(char **cmdlinep, dns_message_t *msg, dns_name_t **namep) {
 	result = dns_message_gettempname(msg, namep);
 	check_result(result, "dns_message_gettempname");
 	isc_buffer_allocate(gmctx, &namebuf, DNS_NAME_MAXWIRE);
 	dns_name_init(*namep, NULL);
 	dns_name_setbuffer(*namep, namebuf);
 	dns_message_takebuffer(msg, &namebuf);
 	isc_buffer_init(&source, word, strlen(word));
 	isc_buffer_add(&source, strlen(word));
 	result = dns_name_fromtext(*namep, &source, dns_rootname, 0, NULL);
@@ -1957,19 +1964,6 @@ parseclass:
 		}
 	}
 	if (!isdelete && rdata->type == dns_rdatatype_nsec3param) {
 		dns_rdata_nsec3param_t nsec3param;
 		result = dns_rdata_tostruct(rdata, &nsec3param, NULL);
 		check_result(result, "dns_rdata_tostruct");
 		if (nsec3param.iterations > dns_nsec3_maxiterations()) {
 			fprintf(stderr,
 				"NSEC3PARAM has excessive iterations (> %u)\n",
 				dns_nsec3_maxiterations());
 			goto failure;
 		}
 	}
 doneparsing:
 	result = dns_message_gettemprdatalist(updatemsg, &rdatalist);
@@ -2068,6 +2062,7 @@ setzone(dns_name_t *zonename) {
 	if (zonename != NULL) {
 		result = dns_message_gettempname(updatemsg, &name);
 		check_result(result, "dns_message_gettempname");
 		dns_name_init(name, NULL);
 		dns_name_clone(zonename, name);
 		result = dns_message_gettemprdataset(updatemsg, &rdataset);
 		check_result(result, "dns_message_gettemprdataset");
@@ -2730,7 +2725,7 @@ lookforsoa:
 		 * address.
 		 */
 		zname = dns_fixedname_initname(&fzname);
-		dns_name_copy(name, zname);
+		dns_name_copynf(name, zname);
 	}
 	if (debugging) {
@@ -2905,7 +2900,7 @@ failed_gssrequest(void) {
 static void
 start_gssrequest(dns_name_t *master) {
-	dns_gss_ctx_id_t context;
+	gss_ctx_id_t context;
 	isc_buffer_t buf;
 	isc_result_t result;
 	uint32_t val = 0;
@@ -3050,7 +3045,7 @@ recvgss(isc_task_t *task, isc_event_t *event) {
 	nsu_gssinfo_t *reqinfo;
 	dns_message_t *tsigquery = NULL;
 	isc_sockaddr_t *addr;
-	dns_gss_ctx_id_t context;
+	gss_ctx_id_t context;
 	isc_buffer_t buf;
 	dns_name_t *servname;
 	dns_fixedname_t fname;
@@ -3242,6 +3237,7 @@ start_update(void) {
 	dns_rdataset_makequestion(rdataset, getzoneclass(), dns_rdatatype_soa);
 	if (userzone != NULL) {
 		dns_name_init(name, NULL);
 		dns_name_clone(userzone, name);
 	} else {
 		dns_rdataset_t *tmprdataset;
@@ -3260,6 +3256,7 @@ start_update(void) {
 		}
 		firstname = NULL;
 		dns_message_currentname(updatemsg, section, &firstname);
 		dns_name_init(name, NULL);
 		dns_name_clone(firstname, name);
 		/*
 		 * Looks to see if the first name references a DS record
@@ -3310,12 +3307,18 @@ cleanup(void) {
 		dst_key_free(&sig0key);
 	}
-	ddebug("Shutting down managers");
+	ddebug("Shutting down task manager");
-	isc_managers_destroy(&netmgr, &taskmgr, &timermgr, &socketmgr);
+	isc_taskmgr_destroy(&taskmgr);
 	ddebug("Destroying event");
 	isc_event_free(&global_event);
 	ddebug("Shutting down socket manager");
 	isc_socketmgr_destroy(&socketmgr);
 	ddebug("Shutting down timer manager");
 	isc_timermgr_destroy(&timermgr);
 #ifdef HAVE_GSSAPI
 	/*
 	 * Cleanup GSSAPI resources after taskmgr has been destroyed.
@@ -7,9 +7,6 @@ AM_CPPFLAGS +=			\
 	$(LIBISCCFG_CFLAGS)
 pkglib_LTLIBRARIES = filter-aaaa.la
 pkglib_LTLIBRARIES += filter-a.la
 filter_aaaa_la_SOURCES = filter-aaaa.c
 filter_a_la_SOURCES = filter-a.c
 filter_aaaa_la_LDFLAGS = -avoid-version -module -shared -export-dynamic
 filter_a_la_LDFLAGS = -avoid-version -module -shared -export-dynamic
@@ -1,906 +0,0 @@
 /*
 * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 *
 * This Source Code Form is subject to the terms of the Mozilla Public
 * License, v. 2.0. If a copy of the MPL was not distributed with this
 * file, you can obtain one at https://mozilla.org/MPL/2.0/.
 *
 * See the COPYRIGHT file distributed with this work for additional
 * information regarding copyright ownership.
 */
 /*! \file */
 /* aliases for the exported symbols */
 #include <inttypes.h>
 #include <stdbool.h>
 #include <string.h>
 #include <isc/buffer.h>
 #include <isc/hash.h>
 #include <isc/ht.h>
 #include <isc/lib.h>
 #include <isc/log.h>
 #include <isc/mem.h>
 #include <isc/netaddr.h>
 #include <isc/result.h>
 #include <isc/types.h>
 #include <isc/util.h>
 #include <dns/acl.h>
 #include <dns/db.h>
 #include <dns/enumtype.h>
 #include <dns/log.h>
 #include <dns/message.h>
 #include <dns/rdataset.h>
 #include <dns/result.h>
 #include <dns/types.h>
 #include <dns/view.h>
 #include <isccfg/aclconf.h>
 #include <isccfg/cfg.h>
 #include <isccfg/grammar.h>
 #include <ns/client.h>
 #include <ns/hooks.h>
 #include <ns/log.h>
 #include <ns/query.h>
 #include <ns/types.h>
 #define CHECK(op)                              \
 	do {                                   \
 		result = (op);                 \
 		if (result != ISC_R_SUCCESS) { \
 			goto cleanup;          \
 		}                              \
 	} while (0)
 /*
 * Possible values for the settings of filter-a-on-v6 and
 * filter-a-on-v4: "no" is NONE, "yes" is FILTER, "break-dnssec"
 * is BREAK_DNSSEC.
 */
 typedef enum { NONE = 0, FILTER = 1, BREAK_DNSSEC = 2 } filter_a_t;
 /*
 * Persistent data for use by this module. This will be associated
 * with client object address in the hash table, and will remain
 * accessible until the client object is detached.
 */
 typedef struct filter_data {
 	filter_a_t mode;
 	uint32_t flags;
 } filter_data_t;
 typedef struct filter_instance {
 	ns_plugin_t *module;
 	isc_mem_t *mctx;
 	/*
 	 * Memory pool for use with persistent data.
 	 */
 	isc_mempool_t *datapool;
 	isc_mutex_t plock;
 	/*
 	 * Hash table associating a client object with its persistent data.
 	 */
 	isc_ht_t *ht;
 	isc_mutex_t hlock;
 	/*
 	 * Values configured when the module is loaded.
 	 */
 	filter_a_t v4_a;
 	filter_a_t v6_a;
 	dns_acl_t *a_acl;
 } filter_instance_t;
 /*
 * Per-client flags set by this module
 */
 #define FILTER_A_RECURSING 0x0001 /* Recursing for AAAA */
 #define FILTER_A_FILTERED  0x0002 /* A was removed from answer */
 /*
 * Client attribute tests.
 */
 #define WANTDNSSEC(c)  (((c)->attributes & NS_CLIENTATTR_WANTDNSSEC) != 0)
 #define RECURSIONOK(c) (((c)->query.attributes & NS_QUERYATTR_RECURSIONOK) != 0)
 /*
 * Forward declarations of functions referenced in install_hooks().
 */
 static ns_hookresult_t
 filter_qctx_initialize(void *arg, void *cbdata, isc_result_t *resp);
 static ns_hookresult_t
 filter_respond_begin(void *arg, void *cbdata, isc_result_t *resp);
 static ns_hookresult_t
 filter_respond_any_found(void *arg, void *cbdata, isc_result_t *resp);
 static ns_hookresult_t
 filter_prep_response_begin(void *arg, void *cbdata, isc_result_t *resp);
 static ns_hookresult_t
 filter_query_done_send(void *arg, void *cbdata, isc_result_t *resp);
 static ns_hookresult_t
 filter_qctx_destroy(void *arg, void *cbdata, isc_result_t *resp);
 /*%
 * Register the functions to be called at each hook point in 'hooktable', using
 * memory context 'mctx' for allocating copies of stack-allocated structures
 * passed to ns_hook_add().  Make sure 'inst' will be passed as the 'cbdata'
 * argument to every callback.
 */
 static void
 install_hooks(ns_hooktable_t *hooktable, isc_mem_t *mctx,
 	      filter_instance_t *inst) {
 	const ns_hook_t filter_init = {
 		.action = filter_qctx_initialize,
 		.action_data = inst,
 	};
 	const ns_hook_t filter_respbegin = {
 		.action = filter_respond_begin,
 		.action_data = inst,
 	};
 	const ns_hook_t filter_respanyfound = {
 		.action = filter_respond_any_found,
 		.action_data = inst,
 	};
 	const ns_hook_t filter_prepresp = {
 		.action = filter_prep_response_begin,
 		.action_data = inst,
 	};
 	const ns_hook_t filter_donesend = {
 		.action = filter_query_done_send,
 		.action_data = inst,
 	};
 	const ns_hook_t filter_destroy = {
 		.action = filter_qctx_destroy,
 		.action_data = inst,
 	};
 	ns_hook_add(hooktable, mctx, NS_QUERY_QCTX_INITIALIZED, &filter_init);
 	ns_hook_add(hooktable, mctx, NS_QUERY_RESPOND_BEGIN, &filter_respbegin);
 	ns_hook_add(hooktable, mctx, NS_QUERY_RESPOND_ANY_FOUND,
 		    &filter_respanyfound);
 	ns_hook_add(hooktable, mctx, NS_QUERY_PREP_RESPONSE_BEGIN,
 		    &filter_prepresp);
 	ns_hook_add(hooktable, mctx, NS_QUERY_DONE_SEND, &filter_donesend);
 	ns_hook_add(hooktable, mctx, NS_QUERY_QCTX_DESTROYED, &filter_destroy);
 }
 /**
 ** Support for parsing of parameters and configuration of the module.
 **/
 /*
 * Support for parsing of parameters.
 */
 static const char *filter_a_enums[] = { "break-dnssec", NULL };
 static isc_result_t
 parse_filter_a(cfg_parser_t *pctx, const cfg_type_t *type, cfg_obj_t **ret) {
 	return (cfg_parse_enum_or_other(pctx, type, &cfg_type_boolean, ret));
 }
 static void
 doc_filter_a(cfg_printer_t *pctx, const cfg_type_t *type) {
 	cfg_doc_enum_or_other(pctx, type, &cfg_type_boolean);
 }
 static cfg_type_t cfg_type_filter_a = {
 	"filter_a",   parse_filter_a,  cfg_print_ustring,
 	doc_filter_a, &cfg_rep_string, filter_a_enums,
 };
 static cfg_clausedef_t param_clauses[] = {
 	{ "filter-a", &cfg_type_bracketed_aml, 0 },
 	{ "filter-a-on-v6", &cfg_type_filter_a, 0 },
 	{ "filter-a-on-v4", &cfg_type_filter_a, 0 },
 };
 static cfg_clausedef_t *param_clausesets[] = { param_clauses, NULL };
 static cfg_type_t cfg_type_parameters = { "filter-a-params", cfg_parse_mapbody,
 					  cfg_print_mapbody, cfg_doc_mapbody,
 					  &cfg_rep_map,	     param_clausesets };
 static isc_result_t
 parse_filter_a_on(const cfg_obj_t *param_obj, const char *param_name,
 		  filter_a_t *dstp) {
 	const cfg_obj_t *obj = NULL;
 	isc_result_t result;
 	result = cfg_map_get(param_obj, param_name, &obj);
 	if (result != ISC_R_SUCCESS) {
 		return (ISC_R_SUCCESS);
 	}
 	if (cfg_obj_isboolean(obj)) {
 		if (cfg_obj_asboolean(obj)) {
 			*dstp = FILTER;
 		} else {
 			*dstp = NONE;
 		}
 	} else if (strcasecmp(cfg_obj_asstring(obj), "break-dnssec") == 0) {
 		*dstp = BREAK_DNSSEC;
 	} else {
 		result = ISC_R_UNEXPECTED;
 	}
 	return (result);
 }
 static isc_result_t
 check_syntax(cfg_obj_t *fmap, const void *cfg, isc_mem_t *mctx, isc_log_t *lctx,
 	     void *actx) {
 	isc_result_t result = ISC_R_SUCCESS;
 	const cfg_obj_t *aclobj = NULL;
 	dns_acl_t *acl = NULL;
 	filter_a_t f4 = NONE, f6 = NONE;
 	cfg_map_get(fmap, "filter-a", &aclobj);
 	if (aclobj == NULL) {
 		return (result);
 	}
 	CHECK(cfg_acl_fromconfig(aclobj, (const cfg_obj_t *)cfg, lctx,
 				 (cfg_aclconfctx_t *)actx, mctx, 0, &acl));
 	CHECK(parse_filter_a_on(fmap, "filter-a-on-v6", &f6));
 	CHECK(parse_filter_a_on(fmap, "filter-a-on-v4", &f4));
 	if ((f4 != NONE || f6 != NONE) && dns_acl_isnone(acl)) {
 		cfg_obj_log(aclobj, lctx, ISC_LOG_WARNING,
 			    "\"filter-a\" is 'none;' but "
 			    "either filter-a-on-v6 or filter-a-on-v4 "
 			    "is enabled");
 		result = ISC_R_FAILURE;
 	} else if (f4 == NONE && f6 == NONE && !dns_acl_isnone(acl)) {
 		cfg_obj_log(aclobj, lctx, ISC_LOG_WARNING,
 			    "\"filter-a\" is set but "
 			    "neither filter-a-on-v6 or filter-a-on-v4 "
 			    "is enabled");
 		result = ISC_R_FAILURE;
 	}
 cleanup:
 	if (acl != NULL) {
 		dns_acl_detach(&acl);
 	}
 	return (result);
 }
 static isc_result_t
 parse_parameters(filter_instance_t *inst, const char *parameters,
 		 const void *cfg, const char *cfg_file, unsigned long cfg_line,
 		 isc_mem_t *mctx, isc_log_t *lctx, void *actx) {
 	isc_result_t result = ISC_R_SUCCESS;
 	cfg_parser_t *parser = NULL;
 	cfg_obj_t *param_obj = NULL;
 	const cfg_obj_t *obj = NULL;
 	isc_buffer_t b;
 	CHECK(cfg_parser_create(mctx, lctx, &parser));
 	isc_buffer_constinit(&b, parameters, strlen(parameters));
 	isc_buffer_add(&b, strlen(parameters));
 	CHECK(cfg_parse_buffer(parser, &b, cfg_file, cfg_line,
 			       &cfg_type_parameters, 0, &param_obj));
 	CHECK(check_syntax(param_obj, cfg, mctx, lctx, actx));
 	CHECK(parse_filter_a_on(param_obj, "filter-a-on-v6", &inst->v6_a));
 	CHECK(parse_filter_a_on(param_obj, "filter-a-on-v4", &inst->v4_a));
 	result = cfg_map_get(param_obj, "filter-a", &obj);
 	if (result == ISC_R_SUCCESS) {
 		CHECK(cfg_acl_fromconfig(obj, (const cfg_obj_t *)cfg, lctx,
 					 (cfg_aclconfctx_t *)actx, mctx, 0,
 					 &inst->a_acl));
 	} else {
 		CHECK(dns_acl_any(mctx, &inst->a_acl));
 	}
 cleanup:
 	if (param_obj != NULL) {
 		cfg_obj_destroy(parser, &param_obj);
 	}
 	if (parser != NULL) {
 		cfg_parser_destroy(&parser);
 	}
 	return (result);
 }
 /**
 ** Mandatory plugin API functions:
 **
 ** - plugin_destroy
 ** - plugin_register
 ** - plugin_version
 ** - plugin_check
 **/
 /*
 * Called by ns_plugin_register() to initialize the plugin and
 * register hook functions into the view hook table.
 */
 isc_result_t
 plugin_register(const char *parameters, const void *cfg, const char *cfg_file,
 		unsigned long cfg_line, isc_mem_t *mctx, isc_log_t *lctx,
 		void *actx, ns_hooktable_t *hooktable, void **instp) {
 	filter_instance_t *inst = NULL;
 	isc_result_t result;
 	isc_log_write(lctx, NS_LOGCATEGORY_GENERAL, NS_LOGMODULE_HOOKS,
 		      ISC_LOG_INFO,
 		      "registering 'filter-a' "
 		      "module from %s:%lu, %s parameters",
 		      cfg_file, cfg_line, parameters != NULL ? "with" : "no");
 	inst = isc_mem_get(mctx, sizeof(*inst));
 	memset(inst, 0, sizeof(*inst));
 	isc_mem_attach(mctx, &inst->mctx);
 	if (parameters != NULL) {
 		CHECK(parse_parameters(inst, parameters, cfg, cfg_file,
 				       cfg_line, mctx, lctx, actx));
 	}
 	isc_mempool_create(mctx, sizeof(filter_data_t), &inst->datapool);
 	CHECK(isc_ht_init(&inst->ht, mctx, 16));
 	isc_mutex_init(&inst->hlock);
 	/*
 	 * Fill the mempool with 1K filter_a state objects at
 	 * a time; ideally after a single allocation, the mempool will
 	 * have enough to handle all the simultaneous queries the system
 	 * requires and it won't be necessary to allocate more.
 	 *
 	 * We don't set any limit on the number of free state objects
 	 * so that they'll always be returned to the pool and not
 	 * freed until the pool is destroyed on shutdown.
 	 */
 	isc_mempool_setfillcount(inst->datapool, 1024);
 	isc_mempool_setfreemax(inst->datapool, UINT_MAX);
 	isc_mutex_init(&inst->plock);
 	isc_mempool_associatelock(inst->datapool, &inst->plock);
 	/*
 	 * Set hook points in the view's hooktable.
 	 */
 	install_hooks(hooktable, mctx, inst);
 	*instp = inst;
 cleanup:
 	if (result != ISC_R_SUCCESS && inst != NULL) {
 		plugin_destroy((void **)&inst);
 	}
 	return (result);
 }
 isc_result_t
 plugin_check(const char *parameters, const void *cfg, const char *cfg_file,
 	     unsigned long cfg_line, isc_mem_t *mctx, isc_log_t *lctx,
 	     void *actx) {
 	isc_result_t result = ISC_R_SUCCESS;
 	cfg_parser_t *parser = NULL;
 	cfg_obj_t *param_obj = NULL;
 	isc_buffer_t b;
 	CHECK(cfg_parser_create(mctx, lctx, &parser));
 	isc_buffer_constinit(&b, parameters, strlen(parameters));
 	isc_buffer_add(&b, strlen(parameters));
 	CHECK(cfg_parse_buffer(parser, &b, cfg_file, cfg_line,
 			       &cfg_type_parameters, 0, &param_obj));
 	CHECK(check_syntax(param_obj, cfg, mctx, lctx, actx));
 cleanup:
 	if (param_obj != NULL) {
 		cfg_obj_destroy(parser, &param_obj);
 	}
 	if (parser != NULL) {
 		cfg_parser_destroy(&parser);
 	}
 	return (result);
 }
 /*
 * Called by ns_plugins_free(); frees memory allocated by
 * the module when it was registered.
 */
 void
 plugin_destroy(void **instp) {
 	filter_instance_t *inst = (filter_instance_t *)*instp;
 	if (inst->ht != NULL) {
 		isc_ht_destroy(&inst->ht);
 		isc_mutex_destroy(&inst->hlock);
 	}
 	if (inst->datapool != NULL) {
 		isc_mempool_destroy(&inst->datapool);
 		isc_mutex_destroy(&inst->plock);
 	}
 	if (inst->a_acl != NULL) {
 		dns_acl_detach(&inst->a_acl);
 	}
 	isc_mem_putanddetach(&inst->mctx, inst, sizeof(*inst));
 	*instp = NULL;
 	return;
 }
 /*
 * Returns plugin API version for compatibility checks.
 */
 int
 plugin_version(void) {
 	return (NS_PLUGIN_VERSION);
 }
 /**
 ** "filter-a" feature implementation begins here.
 **/
 /*%
 * Structure describing the filtering to be applied by process_section().
 */
 typedef struct section_filter {
 	query_ctx_t *qctx;
 	filter_a_t mode;
 	dns_section_t section;
 	const dns_name_t *name;
 	dns_rdatatype_t type;
 	bool only_if_aaaa_exists;
 } section_filter_t;
 /*
 * Check whether this is an IPv4 client.
 */
 static bool
 is_v4_client(ns_client_t *client) {
 	if (isc_sockaddr_pf(&client->peeraddr) == AF_INET) {
 		return (true);
 	}
 	if (isc_sockaddr_pf(&client->peeraddr) == AF_INET6 &&
 	    IN6_IS_ADDR_V4MAPPED(&client->peeraddr.type.sin6.sin6_addr))
 	{
 		return (true);
 	}
 	return (false);
 }
 /*
 * Check whether this is an IPv6 client.
 */
 static bool
 is_v6_client(ns_client_t *client) {
 	if (isc_sockaddr_pf(&client->peeraddr) == AF_INET6 &&
 	    !IN6_IS_ADDR_V4MAPPED(&client->peeraddr.type.sin6.sin6_addr))
 	{
 		return (true);
 	}
 	return (false);
 }
 static filter_data_t *
 client_state_get(const query_ctx_t *qctx, filter_instance_t *inst) {
 	filter_data_t *client_state = NULL;
 	isc_result_t result;
 	LOCK(&inst->hlock);
 	result = isc_ht_find(inst->ht, (const unsigned char *)&qctx->client,
 			     sizeof(qctx->client), (void **)&client_state);
 	UNLOCK(&inst->hlock);
 	return (result == ISC_R_SUCCESS ? client_state : NULL);
 }
 static void
 client_state_create(const query_ctx_t *qctx, filter_instance_t *inst) {
 	filter_data_t *client_state;
 	isc_result_t result;
 	client_state = isc_mempool_get(inst->datapool);
 	if (client_state == NULL) {
 		return;
 	}
 	client_state->mode = NONE;
 	client_state->flags = 0;
 	LOCK(&inst->hlock);
 	result = isc_ht_add(inst->ht, (const unsigned char *)&qctx->client,
 			    sizeof(qctx->client), client_state);
 	UNLOCK(&inst->hlock);
 	RUNTIME_CHECK(result == ISC_R_SUCCESS);
 }
 static void
 client_state_destroy(const query_ctx_t *qctx, filter_instance_t *inst) {
 	filter_data_t *client_state = client_state_get(qctx, inst);
 	isc_result_t result;
 	if (client_state == NULL) {
 		return;
 	}
 	LOCK(&inst->hlock);
 	result = isc_ht_delete(inst->ht, (const unsigned char *)&qctx->client,
 			       sizeof(qctx->client));
 	UNLOCK(&inst->hlock);
 	RUNTIME_CHECK(result == ISC_R_SUCCESS);
 	isc_mempool_put(inst->datapool, client_state);
 }
 /*%
 * Mark 'rdataset' and 'sigrdataset' as rendered, gracefully handling NULL
 * pointers and non-associated rdatasets.
 */
 static void
 mark_as_rendered(dns_rdataset_t *rdataset, dns_rdataset_t *sigrdataset) {
 	if (rdataset != NULL && dns_rdataset_isassociated(rdataset)) {
 		rdataset->attributes |= DNS_RDATASETATTR_RENDERED;
 	}
 	if (sigrdataset != NULL && dns_rdataset_isassociated(sigrdataset)) {
 		sigrdataset->attributes |= DNS_RDATASETATTR_RENDERED;
 	}
 }
 /*%
 * Check whether an RRset of given 'type' is present at given 'name'.  If
 * it is found and either it is not signed or the combination of query
 * flags and configured processing 'mode' allows it, mark the RRset and its
 * associated signatures as already rendered to prevent them from appearing
 * in the response message stored in 'qctx'.  If 'only_if_aaaa_exists' is
 * true, an RRset of type AAAA must also exist at 'name' in order for the
 * above processing to happen.
 */
 static bool
 process_name(query_ctx_t *qctx, filter_a_t mode, const dns_name_t *name,
 	     dns_rdatatype_t type, bool only_if_aaaa_exists) {
 	dns_rdataset_t *rdataset = NULL, *sigrdataset = NULL;
 	isc_result_t result;
 	bool modified = false;
 	if (only_if_aaaa_exists) {
 		CHECK(dns_message_findtype(name, dns_rdatatype_aaaa, 0, NULL));
 	}
 	(void)dns_message_findtype(name, type, 0, &rdataset);
 	(void)dns_message_findtype(name, dns_rdatatype_rrsig, type,
 				   &sigrdataset);
 	if (rdataset != NULL &&
 	    (sigrdataset == NULL || !WANTDNSSEC(qctx->client) ||
 	     mode == BREAK_DNSSEC))
 	{
 		/*
 		 * An RRset of given 'type' was found at 'name' and at least
 		 * one of the following is true:
 		 *
 		 *   - the RRset is not signed,
 		 *   - the client did not set the DO bit in its request,
 		 *   - configuration allows us to tamper with signed responses.
 		 *
 		 * This means it is okay to filter out this RRset and its
 		 * signatures, if any, from the response.
 		 */
 		mark_as_rendered(rdataset, sigrdataset);
 		modified = true;
 	}
 cleanup:
 	return (modified);
 }
 /*%
 * Apply the requested section filter, i.e. prevent (when possible, as
 * determined by process_name()) RRsets of given 'type' from being rendered
 * in the given 'section' of the response message stored in 'qctx'.  Clear
 * the AD bit if the answer and/or authority section was modified.  If
 * 'name' is NULL, all names in the given 'section' are processed;
 * otherwise, only 'name' is.  'only_if_aaaa_exists' is passed through to
 * process_name().
 */
 static void
 process_section(const section_filter_t *filter) {
 	query_ctx_t *qctx = filter->qctx;
 	filter_a_t mode = filter->mode;
 	dns_section_t section = filter->section;
 	const dns_name_t *name = filter->name;
 	dns_rdatatype_t type = filter->type;
 	bool only_if_aaaa_exists = filter->only_if_aaaa_exists;
 	dns_message_t *message = qctx->client->message;
 	isc_result_t result;
 	for (result = dns_message_firstname(message, section);
 	     result == ISC_R_SUCCESS;
 	     result = dns_message_nextname(message, section))
 	{
 		dns_name_t *cur = NULL;
 		dns_message_currentname(message, section, &cur);
 		if (name != NULL && !dns_name_equal(name, cur)) {
 			/*
 			 * We only want to process 'name' and this is not it.
 			 */
 			continue;
 		}
 		if (!process_name(qctx, mode, cur, type, only_if_aaaa_exists)) {
 			/*
 			 * Response was not modified, do not touch the AD bit.
 			 */
 			continue;
 		}
 		if (section == DNS_SECTION_ANSWER ||
 		    section == DNS_SECTION_AUTHORITY) {
 			message->flags &= ~DNS_MESSAGEFLAG_AD;
 		}
 	}
 }
 /*
 * Initialize filter state, fetching it from a memory pool and storing it
 * in a hash table keyed according to the client object; this enables us to
 * retrieve persistent data related to a client query for as long as the
 * object persists.
 */
 static ns_hookresult_t
 filter_qctx_initialize(void *arg, void *cbdata, isc_result_t *resp) {
 	query_ctx_t *qctx = (query_ctx_t *)arg;
 	filter_instance_t *inst = (filter_instance_t *)cbdata;
 	filter_data_t *client_state;
 	*resp = ISC_R_UNSET;
 	client_state = client_state_get(qctx, inst);
 	if (client_state == NULL) {
 		client_state_create(qctx, inst);
 	}
 	return (NS_HOOK_CONTINUE);
 }
 /*
 * Determine whether this client should have A filtered or not, based on
 * the client address family and the settings of filter-a-on-v6 and
 * filter-a-on-v4.
 */
 static ns_hookresult_t
 filter_prep_response_begin(void *arg, void *cbdata, isc_result_t *resp) {
 	query_ctx_t *qctx = (query_ctx_t *)arg;
 	filter_instance_t *inst = (filter_instance_t *)cbdata;
 	filter_data_t *client_state = client_state_get(qctx, inst);
 	isc_result_t result;
 	*resp = ISC_R_UNSET;
 	if (client_state == NULL) {
 		return (NS_HOOK_CONTINUE);
 	}
 	if (inst->v4_a != NONE || inst->v6_a != NONE) {
 		result = ns_client_checkaclsilent(qctx->client, NULL,
 						  inst->a_acl, true);
 		if (result == ISC_R_SUCCESS && inst->v4_a != NONE &&
 		    is_v4_client(qctx->client)) {
 			client_state->mode = inst->v4_a;
 		} else if (result == ISC_R_SUCCESS && inst->v6_a != NONE &&
 			   is_v6_client(qctx->client))
 		{
 			client_state->mode = inst->v6_a;
 		}
 	}
 	return (NS_HOOK_CONTINUE);
 }
 /*
 * Hide A rrsets if there is a matching AAAA. Trigger recursion if
 * necessary to find out whether an AAAA exists.
 *
 * (This version is for processing answers to explicit A queries; ANY
 * queries are handled in filter_respond_any_found().)
 */
 static ns_hookresult_t
 filter_respond_begin(void *arg, void *cbdata, isc_result_t *resp) {
 	query_ctx_t *qctx = (query_ctx_t *)arg;
 	filter_instance_t *inst = (filter_instance_t *)cbdata;
 	filter_data_t *client_state = client_state_get(qctx, inst);
 	isc_result_t result = ISC_R_UNSET;
 	*resp = ISC_R_UNSET;
 	if (client_state == NULL) {
 		return (NS_HOOK_CONTINUE);
 	}
 	if (client_state->mode != BREAK_DNSSEC &&
 	    (client_state->mode != FILTER ||
 	     (WANTDNSSEC(qctx->client) && qctx->sigrdataset != NULL &&
 	      dns_rdataset_isassociated(qctx->sigrdataset))))
 	{
 		return (NS_HOOK_CONTINUE);
 	}
 	if (qctx->qtype == dns_rdatatype_a) {
 		dns_rdataset_t *trdataset;
 		trdataset = ns_client_newrdataset(qctx->client);
 		result = dns_db_findrdataset(
 			qctx->db, qctx->node, qctx->version, dns_rdatatype_aaaa,
 			0, qctx->client->now, trdataset, NULL);
 		if (dns_rdataset_isassociated(trdataset)) {
 			dns_rdataset_disassociate(trdataset);
 		}
 		ns_client_putrdataset(qctx->client, &trdataset);
 		/*
 		 * We found an A. If we also found an AAAA, then the A
 		 * must not be rendered.
 		 *
 		 * If the AAAA is not in our cache, then any result other than
 		 * DNS_R_DELEGATION or ISC_R_NOTFOUND means there is no AAAAA,
 		 * and so AAAAs are okay.
 		 *
 		 * We assume there is no AAAA if we can't recurse for this
 		 * client. That might be the wrong answer, but what else
 		 * can we do?  Besides, the fact that we have the A and
 		 * are using this mechanism in the first place suggests
 		 * that we care more about AAAAs than As, and would have
 		 * cached an AAAA if it existed.
 		 */
 		if (result == ISC_R_SUCCESS) {
 			mark_as_rendered(qctx->rdataset, qctx->sigrdataset);
 			qctx->client->message->flags &= ~DNS_MESSAGEFLAG_AD;
 			client_state->flags |= FILTER_A_FILTERED;
 		} else if (!qctx->authoritative && RECURSIONOK(qctx->client) &&
 			   (result == DNS_R_DELEGATION ||
 			    result == ISC_R_NOTFOUND))
 		{
 			/*
 			 * This is an ugly kludge to recurse
 			 * for the AAAA and discard the result.???
 			 *
 			 * Continue to add the A now.
 			 * We'll make a note to not render it
 			 * if the recursion for the AAAA succeeds.
 			 */
 			result = ns_query_recurse(qctx->client,
 						  dns_rdatatype_aaaa,
 						  qctx->client->query.qname,
 						  NULL, NULL, qctx->resuming);
 			if (result == ISC_R_SUCCESS) {
 				client_state->flags |= FILTER_A_RECURSING;
 				qctx->client->query.attributes |=
 					NS_QUERYATTR_RECURSING;
 			}
 		}
 	} else if (qctx->qtype == dns_rdatatype_aaaa &&
 		   (client_state->flags & FILTER_A_RECURSING) != 0)
 	{
 		const section_filter_t filter_answer = {
 			.qctx = qctx,
 			.mode = client_state->mode,
 			.section = DNS_SECTION_ANSWER,
 			.name = qctx->fname,
 			.type = dns_rdatatype_a,
 		};
 		process_section(&filter_answer);
 		client_state->flags &= ~FILTER_A_RECURSING;
 		result = ns_query_done(qctx);
 		*resp = result;
 		return (NS_HOOK_RETURN);
 	}
 	*resp = result;
 	return (NS_HOOK_CONTINUE);
 }
 /*
 * When answering an ANY query, remove A if AAAA is present.
 */
 static ns_hookresult_t
 filter_respond_any_found(void *arg, void *cbdata, isc_result_t *resp) {
 	query_ctx_t *qctx = (query_ctx_t *)arg;
 	filter_instance_t *inst = (filter_instance_t *)cbdata;
 	filter_data_t *client_state = client_state_get(qctx, inst);
 	*resp = ISC_R_UNSET;
 	if (client_state != NULL && client_state->mode != NONE) {
 		/*
 		 * If we are authoritative, require an AAAA record to be
 		 * present before filtering out A records; otherwise,
 		 * just assume an AAAA record exists even if it was not in the
 		 * cache (and therefore is not in the response message),
 		 * thus proceeding with filtering out A records.
 		 */
 		const section_filter_t filter_answer = {
 			.qctx = qctx,
 			.mode = client_state->mode,
 			.section = DNS_SECTION_ANSWER,
 			.name = qctx->tname,
 			.type = dns_rdatatype_a,
 			.only_if_aaaa_exists = qctx->authoritative,
 		};
 		process_section(&filter_answer);
 	}
 	return (NS_HOOK_CONTINUE);
 }
 /*
 * Hide A rrsets in the additional section if there is a matching AAAA, and
 * hide NS in the authority section if A was filtered in the answer
 * section.
 */
 static ns_hookresult_t
 filter_query_done_send(void *arg, void *cbdata, isc_result_t *resp) {
 	query_ctx_t *qctx = (query_ctx_t *)arg;
 	filter_instance_t *inst = (filter_instance_t *)cbdata;
 	filter_data_t *client_state = client_state_get(qctx, inst);
 	*resp = ISC_R_UNSET;
 	if (client_state != NULL && client_state->mode != NONE) {
 		const section_filter_t filter_additional = {
 			.qctx = qctx,
 			.mode = client_state->mode,
 			.section = DNS_SECTION_ADDITIONAL,
 			.type = dns_rdatatype_a,
 			.only_if_aaaa_exists = true,
 		};
 		process_section(&filter_additional);
 		if ((client_state->flags & FILTER_A_FILTERED) != 0) {
 			const section_filter_t filter_authority = {
 				.qctx = qctx,
 				.mode = client_state->mode,
 				.section = DNS_SECTION_AUTHORITY,
 				.type = dns_rdatatype_ns,
 			};
 			process_section(&filter_authority);
 		}
 	}
 	return (NS_HOOK_CONTINUE);
 }
 /*
 * If the client is being detached, then we can delete our persistent data
 * from hash table and return it to the memory pool.
 */
 static ns_hookresult_t
 filter_qctx_destroy(void *arg, void *cbdata, isc_result_t *resp) {
 	query_ctx_t *qctx = (query_ctx_t *)arg;
 	filter_instance_t *inst = (filter_instance_t *)cbdata;
 	*resp = ISC_R_UNSET;
 	if (!qctx->detach_client) {
 		return (NS_HOOK_CONTINUE);
 	}
 	client_state_destroy(qctx, inst);
 	return (NS_HOOK_CONTINUE);
 }
@@ -1,95 +0,0 @@
 .. 
   Copyright (C) Internet Systems Consortium, Inc. ("ISC")
   This Source Code Form is subject to the terms of the Mozilla Public
   License, v. 2.0. If a copy of the MPL was not distributed with this
   file, you can obtain one at https://mozilla.org/MPL/2.0/.
   See the COPYRIGHT file distributed with this work for additional
   information regarding copyright ownership.
 ..
   Copyright (C) Internet Systems Consortium, Inc. ("ISC")
   This Source Code Form is subject to the terms of the Mozilla Public
   License, v. 2.0. If a copy of the MPL was not distributed with this
   file, You can obtain one at http://mozilla.org/MPL/2.0/.
   See the COPYRIGHT file distributed with this work for additional
   information regarding copyright ownership.
 .. highlight: console
 .. _man_filter-a:
 filter-a.so - filter A in DNS responses when AAAA is present
 ---------------------------------------------------------------
 Synopsis
 ~~~~~~~~
 :program:`plugin query` "filter-a.so" [{ parameters }];
 Description
 ~~~~~~~~~~~
 ``filter-a.so`` is a query plugin module for ``named``, enabling
 ``named`` to omit some IPv4 addresses when responding to clients.
 For example:
 ::
   plugin query "/usr/local/lib/filter-a.so" {
           filter-a-on-v6 yes;
           filter-a-on-v4 yes;
           filter-a { 192.0.2.1; 2001:db8:2::1; };
   };
 This module is intended to aid transition from IPv4 to IPv6 by
 withholding IPv4 addresses from DNS clients which are not connected to
 the IPv4 Internet, when the name being looked up has an IPv6 address
 available. Use of this module is not recommended unless absolutely
 necessary.
 Note: This mechanism can erroneously cause other servers not to give
 A records to their clients. If a recursing server with both IPv6 and
 IPv4 network connections queries an authoritative server using this
 mechanism via IPv6, it is denied A records even if its client is
 using IPv4.
 Options
 ~~~~~~~
 ``filter-a``
   This option specifies a list of client addresses for which A filtering is to
   be applied. The default is ``any``.
 ``filter-a-on-v6``
   If set to ``yes``, this option indicates that the DNS client is at an IPv6 address, in
   ``filter-a``. If the response does not include DNSSEC
   signatures, then all A records are deleted from the response. This
   filtering applies to all responses, not only authoritative
   ones.
   If set to ``break-dnssec``, then A records are deleted even when
   DNSSEC is enabled. As suggested by the name, this causes the response
   to fail to verify, because the DNSSEC protocol is designed to detect
   deletions.
   This mechanism can erroneously cause other servers not to give A
   records to their clients. If a recursing server with both IPv6 and IPv4
   network connections queries an authoritative server using this
   mechanism via IPv6, it is denied A records even if its client is
   using IPv4.
 ``filter-a-on-v4``
   This option is identical to ``filter-a-on-v6``, except that it filters A responses
   to queries from IPv4 clients instead of IPv6 clients. To filter all
   responses, set both options to ``yes``.
 See Also
 ~~~~~~~~
 BIND 9 Administrator Reference Manual.
@@ -22,7 +22,6 @@
 #include <isc/commandline.h>
 #include <isc/file.h>
 #include <isc/log.h>
 #include <isc/managers.h>
 #include <isc/mem.h>
 #include <isc/net.h>
 #include <isc/netmgr.h>
@@ -60,7 +59,6 @@
 const char *progname = NULL;
 bool verbose;
 static isc_nm_t *netmgr = NULL;
 static isc_taskmgr_t *taskmgr = NULL;
 static isc_task_t *rndc_task = NULL;
@@ -74,6 +72,7 @@ static bool local4set = false, local6set = false;
 static int nserveraddrs;
 static int currentaddr = 0;
 static unsigned int remoteport = 0;
 static isc_nm_t *netmgr = NULL;
 static isc_buffer_t *databuf = NULL;
 static isccc_ccmsg_t rndc_ccmsg;
 static uint32_t algorithm;
@@ -575,6 +574,7 @@ rndc_connected(isc_nmhandle_t *handle, isc_result_t result, void *arg) {
 static void
 rndc_startconnect(isc_sockaddr_t *addr) {
 	isc_result_t result;
 	char socktext[ISC_SOCKADDR_FORMATSIZE];
 	isc_sockaddr_t *local = NULL;
@@ -600,8 +600,10 @@ rndc_startconnect(isc_sockaddr_t *addr) {
 	}
 	atomic_fetch_add_relaxed(&connects, 1);
-	isc_nm_tcpconnect(netmgr, local, addr, rndc_connected, &rndc_ccmsg,
+	DO("create connection",
-			  60000, 0);
+	   isc_nm_tcpconnect(netmgr, (isc_nmiface_t *)local,
 			     (isc_nmiface_t *)addr, rndc_connected, &rndc_ccmsg,
 			     10000, 0));
 }
 static void
@@ -1031,7 +1033,9 @@ main(int argc, char **argv) {
 	serial = isc_random32();
 	isc_mem_create(&rndc_mctx);
-	isc_managers_create(rndc_mctx, 1, 0, 0, &netmgr, &taskmgr, NULL, NULL);
+	netmgr = isc_nm_start(rndc_mctx, 1);
 	DO("create task manager",
 	   isc_taskmgr_create(rndc_mctx, 1, 0, netmgr, &taskmgr));
 	DO("create task", isc_task_create(taskmgr, 0, &rndc_task));
 	isc_log_create(rndc_mctx, &log, &logconfig);
 	isc_log_setcontext(log);
@@ -1088,7 +1092,9 @@ main(int argc, char **argv) {
 	}
 	isc_task_detach(&rndc_task);
-	isc_managers_destroy(&netmgr, &taskmgr, NULL, NULL);
+	isc_taskmgr_destroy(&taskmgr);
 	isc_nm_closedown(netmgr);
 	/*
 	 * Note: when TCP connections are shut down, there will be a final
@@ -1098,6 +1104,8 @@ main(int argc, char **argv) {
 	 */
 	isccc_ccmsg_invalidate(&rndc_ccmsg);
 	isc_nm_destroy(&netmgr);
 	isc_log_destroy(&log);
 	isc_log_setcontext(NULL);
@@ -136,7 +136,7 @@ Currently supported commands are:
   This sample ``addzone`` command adds the zone ``example.com`` to
   the default view:
-   ``rndc addzone example.com '{ type master; file "example.com.db"; };'``
+   ``$ \ rndc addzone example.com '{ type master; file "example.com.db"; };'``
   (Note the brackets around and semi-colon after the zone configuration
   text.)
@@ -1,4 +1,3 @@
 .cache
 __pycache__
 dig.out*
 rndc.out*
@@ -14,7 +13,8 @@ named.run
 parallel.mk
 /*.log
 /*.trs
-/resolve
+/get_ports.state
 /get_ports.lock
 /run.sh
 /run.log
 /start.sh
@@ -23,7 +23,6 @@ check_PROGRAMS =		\
 	feature-test		\
 	makejournal		\
 	pipelined/pipequeries	\
 	resolve			\
 	rndc/gencheck		\
 	rpz/dnsrps		\
 	tkey/keycreate		\
@@ -49,14 +48,6 @@ pipelined_pipequeries_LDADD =	\
 	$(LDADD)		\
 	$(LIBDNS_LIBS)
 resolve_CPPFLAGS =		\
 	$(AM_CPPFLAGS)		\
 	$(LIBISC_CFLAGS)	\
 	$(LIBDNS_CFLAGS)	\
 	$(LIBIRS_CFLAGS)
 resolve_LDADD = $(LIBISC_LIBS) $(LIBIRS_LIBS) $(LIBDNS_LIBS)
 tkey_keycreate_CPPFLAGS =	\
 	$(AM_CPPFLAGS)		\
 	$(LIBDNS_CFLAGS)
@@ -104,12 +95,10 @@ TESTS +=			\
 	dlz			\
 	dlzexternal		\
 	dns64			\
 	doth			\
 	dscp			\
 	dsdigest		\
 	dyndb			\
 	ecdsa			\
 	eddsa			\
 	ednscompliance		\
 	emptyzones		\
 	filter-aaaa		\
@@ -121,7 +110,6 @@ TESTS +=			\
 	inline			\
 	integrity		\
 	hooks			\
 	journal			\
 	keepalive		\
 	legacy			\
 	limits			\
@@ -163,8 +151,12 @@ TESTS +=			\
 	views			\
 	wildcard		\
 	xferquota		\
 	xot			\
 	zonechecks
 # eddsa test is broken
 # TESTS += eddsa
 # The "stress" test is not run by default since it creates enough
 # load on the machine to make it unusable to other users.
 # The "dialup", "delzone", and "dupsigs" tests are also not run by
@@ -185,6 +177,7 @@ TESTS +=		\
 	nsupdate	\
 	resolver	\
 	statistics	\
 	dot		\
 	upforwd		\
 	zero
@@ -207,10 +200,10 @@ endif HAVE_PERLMOD_NET_DNS_NAMESERVER
 endif HAVE_PERLMOD_NET_DNS
 if HAVE_PYTHON
-TESTS += kasp keymgr2kasp tcp pipelined
+TESTS += kasp tcp pipelined
 if HAVE_PYMOD_DNS
-TESTS += qmin cookie timeouts
+TESTS += qmin cookie
 if HAVE_PERLMOD_NET_DNS
 TESTS += dnssec
@@ -250,4 +243,7 @@ AM_LOG_FLAGS = -r
 $(TESTS): run.sh
 clean-local:
 	-rm -f get_ports.state get_ports.lock
 test-local: check
@@ -214,6 +214,9 @@ This indicates the type of message.  This is one of:
            FAIL        The test failed
            SKIPPED     The test was not run, usually because some
                        prerequisites required to run the test are missing.
            UNTESTED    The test was not run for some other reason, e.g. a
                        prerequisite is available but is not compatible with
                        the platform on which the test is run.
 <test-name>
 This is the name of the test from which the message emanated, which is also the
@@ -267,9 +270,9 @@ As noted above, each test is in a separate directory.  To interact with the
 test framework, the directories contain the following standard files:
 prereq.sh   Run at the beginning to determine whether the test can be run at
-            all; if not, we see a R:SKIPPED result.  This file is optional:
+            all; if not, we see a result of R:SKIPPED or R:UNTESTED.  This file
-            if not present, the test is assumed to have all its prerequisites
+            is optional: if not present, the test is assumed to have all its
-            met.
+            prerequisites met.
 setup.sh    Run after prereq.sh, this sets up the preconditions for the tests.
            Although optional, virtually all tests will require such a file to
@@ -1,2 +0,0 @@
@ IN SOA localhost. localhost.localhost. 1 10800 3600 605800 86400
@ IN NS localhost.
@@ -1,89 +0,0 @@
 ############################################################################
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.
 ############################################################################
 import concurrent.futures
 import os
 import subprocess
 import time
 def run_rndc(server, rndc_command):
    '''
    Send the specified 'rndc_command' to 'server' with a timeout of 2 seconds
    '''
    rndc = os.getenv('RNDC')
    port = os.getenv('CONTROLPORT')
    cmdline = [rndc, '-c', '../common/rndc.conf', '-p', port, '-s', server]
    cmdline.extend(rndc_command)
    subprocess.check_output(cmdline, stderr=subprocess.STDOUT, timeout=2)
 def rndc_loop(test_state, domain):
    '''
    Run "rndc addzone", "rndc modzone", and "rndc delzone" in a tight loop
    until the test is considered finished, ignoring errors
    '''
    rndc_commands = [
        ['addzone', domain,
         '{ type master; file "example.db"; };'],
        ['modzone', domain,
         '{ type master; file "example.db"; allow-transfer { any; }; };'],
        ['delzone', domain],
    ]
    while not test_state['finished']:
        for command in rndc_commands:
            try:
                run_rndc('10.53.0.3', command)
            except subprocess.SubprocessError:
                pass
 def check_if_server_is_responsive():
    '''
    Check if server status can be successfully retrieved using "rndc status"
    '''
    try:
        run_rndc('10.53.0.3', ['status'])
        return True
    except subprocess.SubprocessError:
        return False
 def test_rndc_deadlock():
    '''
    Test whether running "rndc addzone", "rndc modzone", and "rndc delzone"
    commands concurrently does not trigger a deadlock
    '''
    test_state = {'finished': False}
    # Create 4 worker threads running "rndc" commands in a loop.
    with concurrent.futures.ThreadPoolExecutor() as executor:
        for i in range(1, 5):
            domain = 'example%d' % i
            executor.submit(rndc_loop, test_state, domain)
        # Run "rndc status" in 1-second intervals for a maximum of 10 seconds.
        # If any "rndc status" command fails, the loop will be interrupted.
        server_is_responsive = True
        attempts = 10
        while server_is_responsive and attempts > 0:
            server_is_responsive = check_if_server_is_responsive()
            attempts -= 1
            time.sleep(1)
        # Signal worker threads that the test is finished.
        test_state['finished'] = True
    # Check whether all "rndc status" commands succeeded.
    assert server_is_responsive
@@ -1590,7 +1590,7 @@ status=`expr $status + $ret`
 echo_i "check that DNAME at apex with NSEC3 is correctly signed (auto-dnssec maintain) ($n)"
 ret=0
 $DIG $DIGOPTS txt dname-at-apex-nsec3.example @10.53.0.3 > dig.out.ns3.test$n || ret=1
-grep "RRSIG NSEC3 7 3 600" dig.out.ns3.test$n > /dev/null || ret=1
+grep "RRSIG NSEC3 7 3 3600" dig.out.ns3.test$n > /dev/null || ret=1
 n=`expr $n + 1`
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
@@ -1 +0,0 @@
 -m record,size,mctx -c named.conf -d 1 -D cacheclean-ns1 -X named.lock -g -T maxcachesize=2097152
@@ -1 +0,0 @@
 -m record,size,mctx -c named.conf -d 3 -D cacheclean-ns2 -X named.lock -g -T maxcachesize=2097152
@@ -80,34 +80,6 @@ sub reply_handler {
 	$rr = new Net::DNS::RR("$synth2 $ttl $qclass DNAME .");
 	push @ans, $rr;
 	$rcode = "NOERROR";
    # The following three code branches referring to the "example.dname"
    # zone are necessary for the resolver variant of the CVE-2021-25215
    # regression test to work.  A named instance cannot be used for
    # serving the DNAME records below as a version of BIND vulnerable to
    # CVE-2021-25215 would crash while answering the queries asked by
    # the tested resolver.
    } elsif ($qname eq "ns3.example.dname") {
 	if ($qtype eq "A") {
 		my $rr = new Net::DNS::RR("$qname $ttl $qclass A 10.53.0.3");
 		push @ans, $rr;
 	}
 	if ($qtype eq "AAAA") {
 		my $rr = new Net::DNS::RR("example.dname. $ttl $qclass SOA . . 0 0 0 0 $ttl");
 		push @auth, $rr;
 	}
 	$rcode = "NOERROR";
    } elsif ($qname eq "self.example.self.example.dname") {
 	my $rr = new Net::DNS::RR("self.example.dname. $ttl $qclass DNAME dname.");
 	push @ans, $rr;
 	$rr = new Net::DNS::RR("$qname $ttl $qclass CNAME self.example.dname.");
 	push @ans, $rr;
 	$rcode = "NOERROR";
    } elsif ($qname eq "self.example.dname") {
 	if ($qtype eq "DNAME") {
 		my $rr = new Net::DNS::RR("$qname $ttl $qclass DNAME dname.");
 		push @ans, $rr;
 	}
 	$rcode = "NOERROR";
    } else {
 	$rcode = "REFUSED";
    }
@@ -24,10 +24,6 @@ ns2.example.		A	10.53.0.2
 example.broken.		NS	ns3.example.broken.
 ns3.example.broken.	A	10.53.0.3
 ; for the resolver variant of the CVE-2021-25215 regression test
 example.dname.		NS	ns3.example.dname.
 ns3.example.dname.	A	10.53.0.3
 domain0.nil.		NS	ns2.domain0.nil
 domain1.nil.		NS	ns2.domain0.nil
 domain2.nil.		NS	ns2.domain0.nil
@@ -16,5 +16,3 @@ ns2	86400	AAAA    fd92:7065:b8e:ffff::2
@       86400	AAAA 	1:2:3::4
 *       86400	A 	1.2.3.4
 *       86400	AAAA 	1:2:3::4
 ; CVE-2021-25215 regression test data
 self	86400	DNAME	nil.
@@ -295,23 +295,5 @@ grep 'status: NOERROR' dig.out.7.$n > /dev/null 2>&1 || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
 # Regression test for CVE-2021-25215 (authoritative server).
 n=`expr $n + 1`
 echo_i "checking DNAME resolution via itself (authoritative) ($n)"
 ret=0
 $DIG $DIGOPTS @10.53.0.2 DNAME self.domain0.self.domain0.nil. > dig.out.2.$n 2>&1
 grep 'status: NOERROR' dig.out.2.$n > /dev/null 2>&1 || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
 # Regression test for CVE-2021-25215 (recursive resolver).
 n=`expr $n + 1`
 echo_i "checking DNAME resolution via itself (recursive) ($n)"
 ret=0
 $DIG $DIGOPTS @10.53.0.7 DNAME self.example.self.example.dname. > dig.out.7.$n 2>&1
 grep 'status: NOERROR' dig.out.7.$n > /dev/null 2>&1 || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
 echo_i "exit status: $status"
 [ $status -eq 0 ] || exit 1
@@ -1,24 +0,0 @@
 /*
 * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 *
 * This Source Code Form is subject to the terms of the Mozilla Public
 * License, v. 2.0. If a copy of the MPL was not distributed with this
 * file, You can obtain one at http://mozilla.org/MPL/2.0/.
 *
 * See the COPYRIGHT file distributed with this work for additional
 * information regarding copyright ownership.
 */
 tls local-tls {
 	key-file "key.pem";
 	cert-file "cert.pem";
 };
 http local-http-server {
 	endpoints { "/dns-query"; };
 };
 # undefined 'tls' specification
 options {
 	listen-on port 8080 http local-http-server tls unknown { 10.53.0.1; };
 };
@@ -1,20 +0,0 @@
 /*
 * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 *
 * This Source Code Form is subject to the terms of the Mozilla Public
 * License, v. 2.0. If a copy of the MPL was not distributed with this
 * file, You can obtain one at http://mozilla.org/MPL/2.0/.
 *
 * See the COPYRIGHT file distributed with this work for additional
 * information regarding copyright ownership.
 */
 tls local-tls {
 	key-file "key.pem";
 	cert-file "cert.pem";
 };
 # undefined 'http' specification
 options {
 	listen-on port 8080 http unknown tls local-tls { 10.53.0.1; };
 };
@@ -1,19 +0,0 @@
 /*
 * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 *
 * This Source Code Form is subject to the terms of the Mozilla Public
 * License, v. 2.0. If a copy of the MPL was not distributed with this
 * file, You can obtain one at http://mozilla.org/MPL/2.0/.
 *
 * See the COPYRIGHT file distributed with this work for additional
 * information regarding copyright ownership.
 */
 http local-http-server {
 	endpoints { "/dns-query"; };
 };
 # no 'tls' specification
 options {
 	listen-on port 8080 http unknown { 10.53.0.1; };
 };
@@ -1,15 +0,0 @@
 /*
 * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 *
 * This Source Code Form is subject to the terms of the Mozilla Public
 * License, v. 2.0. If a copy of the MPL was not distributed with this
 * file, You can obtain one at http://mozilla.org/MPL/2.0/.
 *
 * See the COPYRIGHT file distributed with this work for additional
 * information regarding copyright ownership.
 */
 # undefined 'tls' specification
 options {
 	listen-on port 853 tls local-tls { 10.53.0.1; };
 };
@@ -1,29 +0,0 @@
 /*
 * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 *
 * This Source Code Form is subject to the terms of the Mozilla Public
 * License, v. 2.0. If a copy of the MPL was not distributed with this
 * file, You can obtain one at http://mozilla.org/MPL/2.0/.
 *
 * See the COPYRIGHT file distributed with this work for additional
 * information regarding copyright ownership.
 */
 /*
 * inline-signing not allowed at view level.
 */
 view "a" {
 	inline-signing yes;
 	zone "." {
 		type primary;
 		file "root.db.signed";
 	};
 };
 view "b" {
 	zone "." {
 		type primary;
 		file "root.db";
 	};
 };
@@ -1,21 +0,0 @@
 /*
 * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 *
 * This Source Code Form is subject to the terms of the Mozilla Public
 * License, v. 2.0. If a copy of the MPL was not distributed with this
 * file, You can obtain one at http://mozilla.org/MPL/2.0/.
 *
 * See the COPYRIGHT file distributed with this work for additional
 * information regarding copyright ownership.
 */
 // 'insecure' is a built-in policy, redefinition not allowed.
 dnssec-policy "insecure" {
 	signatures-refresh P5D;
 };
 zone "example.net" {
 	type master;
 	file "example.db";
 	dnssec-policy "insecure";
 };
@@ -1,42 +0,0 @@
 /*
 * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 *
 * This Source Code Form is subject to the terms of the Mozilla Public
 * License, v. 2.0. If a copy of the MPL was not distributed with this
 * file, You can obtain one at http://mozilla.org/MPL/2.0/.
 *
 * See the COPYRIGHT file distributed with this work for additional
 * information regarding copyright ownership.
 */
 key "keyforview1" {
 	algorithm "hmac-sha1";
 	secret "YPfMoAk6h+3iN8MDRQC004iSNHY=";
 };
 key "keyforview2" {
 	algorithm "hmac-sha1";
 	secret "4xILSZQnuO1UKubXHkYUsvBRPu8=";
 };
 view "example1" {
 	match-clients { key "keyforview1"; };
 	zone "example.net" {
 		type primary;
 		dnssec-policy "default";
 		key-directory ".";
 		file "example1.db";
 	};
 };
 view "example2" {
 	match-clients { key "keyforview2"; };
 	zone "example.net" {
 		type primary;
 		dnssec-policy "insecure";
 		key-directory ".";
 		file "example2.db";
 	};
 };
@@ -1,40 +0,0 @@
 /*
 * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 *
 * This Source Code Form is subject to the terms of the Mozilla Public
 * License, v. 2.0. If a copy of the MPL was not distributed with this
 * file, You can obtain one at http://mozilla.org/MPL/2.0/.
 *
 * See the COPYRIGHT file distributed with this work for additional
 * information regarding copyright ownership.
 */
 key "keyforview1" {
 	algorithm "hmac-sha1";
 	secret "YPfMoAk6h+3iN8MDRQC004iSNHY=";
 };
 key "keyforview2" {
 	algorithm "hmac-sha1";
 	secret "4xILSZQnuO1UKubXHkYUsvBRPu8=";
 };
 view "example1" {
 	match-clients { key "keyforview1"; };
 	zone "example.net" {
 		type primary;
 		dnssec-policy "default";
 		file "example1.db";
 	};
 };
 view "example2" {
 	match-clients { key "keyforview2"; };
 	zone "example.net" {
 		type primary;
 		dnssec-policy "insecure";
 		file "example2.db";
 	};
 };
@@ -9,7 +9,7 @@
 * information regarding copyright ownership.
 */
-// 'default' is a built-in policy, redefinition not allowed.
+// Using the keyword 'default' is not allowed.
 dnssec-policy "default" {
 	signatures-refresh P5D;
 };
@@ -19,3 +19,4 @@ zone "example.net" {
 	file "example.db";
 	dnssec-policy "default";
 };
@@ -1,26 +0,0 @@
 /*
 * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 *
 * This Source Code Form is subject to the terms of the Mozilla Public
 * License, v. 2.0. If a copy of the MPL was not distributed with this
 * file, You can obtain one at http://mozilla.org/MPL/2.0/.
 *
 * See the COPYRIGHT file distributed with this work for additional
 * information regarding copyright ownership.
 */
 // One zone with dnssec-policy 'none', one zone with dnssec-policy 'insecure',
 // both using the same zone file.
 zone "example1.net" {
 	type master;
 	file "example.db";
 	dnssec-policy "none";
 };
 zone "example2.net" {
 	type master;
 	file "example.db";
 	dnssec-policy "insecure";
 };
@@ -1,26 +0,0 @@
 /*
 * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 *
 * This Source Code Form is subject to the terms of the Mozilla Public
 * License, v. 2.0. If a copy of the MPL was not distributed with this
 * file, You can obtain one at http://mozilla.org/MPL/2.0/.
 *
 * See the COPYRIGHT file distributed with this work for additional
 * information regarding copyright ownership.
 */
 // One zone with a dnssec-policy, the other with allow-update,
 // with the same zone file.
 zone "example1.net" {
 	type master;
 	file "example.db";
 	dnssec-policy "default";
 };
 zone "example2.net" {
 	type master;
 	file "example.db";
 	allow-update { any; };
 };
@@ -1,28 +0,0 @@
 /*
 * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 *
 * This Source Code Form is subject to the terms of the Mozilla Public
 * License, v. 2.0. If a copy of the MPL was not distributed with this
 * file, You can obtain one at http://mozilla.org/MPL/2.0/.
 *
 * See the COPYRIGHT file distributed with this work for additional
 * information regarding copyright ownership.
 */
 // One zone with a dnssec-policy, the other with update-policy,
 // with the same zone file.
 zone "example1.net" {
 	type master;
 	file "example.db";
 	dnssec-policy "default";
 };
 zone "example2.net" {
 	type master;
 	file "example.db";
 	update-policy {
 		grant * self * TXT;
 	};
 };
@@ -1,26 +0,0 @@
 /*
 * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 *
 * This Source Code Form is subject to the terms of the Mozilla Public
 * License, v. 2.0. If a copy of the MPL was not distributed with this
 * file, You can obtain one at http://mozilla.org/MPL/2.0/.
 *
 * See the COPYRIGHT file distributed with this work for additional
 * information regarding copyright ownership.
 */
 // One zone transitioning to insecure, the other with allow-update,
 // with the same zone file.
 zone "example1.net" {
 	type master;
 	file "example.db";
 	dnssec-policy "insecure";
 };
 zone "example2.net" {
 	type master;
 	file "example.db";
 	allow-update { any; };
 };
@@ -9,7 +9,7 @@
 * information regarding copyright ownership.
 */
-// 'none' is a built-in policy, redefinition not allowed.
+// Using the keyword 'none' is not allowed.
 dnssec-policy "none" {
 	signatures-refresh P5D;
 };
@@ -19,3 +19,4 @@ zone "example.net" {
 	file "example.db";
 	dnssec-policy "none";
 };
@@ -1,25 +0,0 @@
 /*
 * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 *
 * This Source Code Form is subject to the terms of the Mozilla Public
 * License, v. 2.0. If a copy of the MPL was not distributed with this
 * file, You can obtain one at http://mozilla.org/MPL/2.0/.
 *
 * See the COPYRIGHT file distributed with this work for additional
 * information regarding copyright ownership.
 */
 // Two zones with dnssec-policy with the same zone file.
 zone "example1.net" {
 	type master;
 	file "example.db";
 	dnssec-policy "default";
 };
 zone "example2.net" {
 	type master;
 	file "example.db";
 	dnssec-policy "default";
 };
@@ -1,26 +0,0 @@
 /*
 * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 *
 * This Source Code Form is subject to the terms of the Mozilla Public
 * License, v. 2.0. If a copy of the MPL was not distributed with this
 * file, You can obtain one at http://mozilla.org/MPL/2.0/.
 *
 * See the COPYRIGHT file distributed with this work for additional
 * information regarding copyright ownership.
 */
 // Two zones with dnssec-policy 'insecure' (transitioning to insecure)
 // with the same zone file.
 zone "example1.net" {
 	type master;
 	file "example.db";
 	dnssec-policy "insecure";
 };
 zone "example2.net" {
 	type master;
 	file "example.db";
 	dnssec-policy "insecure";
 };
@@ -1,26 +0,0 @@
 /*
 * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 *
 * This Source Code Form is subject to the terms of the Mozilla Public
 * License, v. 2.0. If a copy of the MPL was not distributed with this
 * file, You can obtain one at http://mozilla.org/MPL/2.0/.
 *
 * See the COPYRIGHT file distributed with this work for additional
 * information regarding copyright ownership.
 */
 // One zone with dnssec-policy, the other zone has 'dnssec-policy none',
 // both with the same zone file.
 zone "example1.net" {
 	type master;
 	file "example.db";
 	dnssec-policy "default";
 };
 zone "example2.net" {
 	type master;
 	file "example.db";
 	dnssec-policy "none";
 };
@@ -1,26 +0,0 @@
 /*
 * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 *
 * This Source Code Form is subject to the terms of the Mozilla Public
 * License, v. 2.0. If a copy of the MPL was not distributed with this
 * file, You can obtain one at http://mozilla.org/MPL/2.0/.
 *
 * See the COPYRIGHT file distributed with this work for additional
 * information regarding copyright ownership.
 */
 // One zone with dnssec-policy, the other zone has 'dnssec-policy insecure'
 // (transitioning to inseure), both with the same zone file.
 zone "example1.net" {
 	type master;
 	file "example.db";
 	dnssec-policy "default";
 };
 zone "example2.net" {
 	type master;
 	file "example.db";
 	dnssec-policy "insecure";
 };
@@ -1,27 +0,0 @@
 /*
 * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 *
 * This Source Code Form is subject to the terms of the Mozilla Public
 * License, v. 2.0. If a copy of the MPL was not distributed with this
 * file, You can obtain one at http://mozilla.org/MPL/2.0/.
 *
 * See the COPYRIGHT file distributed with this work for additional
 * information regarding copyright ownership.
 */
 tls local-tls {
 	key-file "key.pem";
 	cert-file "cert.pem";
 };
 http local-http-server {
 	endpoints { "/dns-query"; };
 };
 options {
 	listen-on { 10.53.0.1; };
 	http-port 80;
 	https-port 443;
 	listen-on port 443 http local-http-server tls local-tls { 10.53.0.1; };
 	listen-on port 8080 tls none http local-http-server { 10.53.0.1; };
 };
@@ -1,17 +0,0 @@
 /*
 * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 *
 * This Source Code Form is subject to the terms of the Mozilla Public
 * License, v. 2.0. If a copy of the MPL was not distributed with this
 * file, You can obtain one at http://mozilla.org/MPL/2.0/.
 *
 * See the COPYRIGHT file distributed with this work for additional
 * information regarding copyright ownership.
 */
 options {
 	listen-on { 10.53.0.1; };
 	http-port 80;
 	https-port 443;
 	listen-on port 8080 tls none http default { 10.53.0.1; };
 };
@@ -23,5 +23,5 @@ options {
 	http-port 80;
 	https-port 443;
 	listen-on port 443 tls local-tls http local-http-server { 10.53.0.1; };
-	listen-on port 8080 tls none http local-http-server { 10.53.0.1; };
+	listen-on port 8080 http local-http-server { 10.53.0.1; };
 };
@@ -49,13 +49,8 @@ zone "example3" {
 	file "example3.db";
 	dnssec-policy "default";
 };
-zone "dnssec-policy-none-shared-zonefile1" {
+zone "example4" {
 	type master;
-	file "shared.db";
+	file "example4.db";
 	dnssec-policy "none";
 };
 zone "dnssec-policy-none-shared-zonefile2" {
 	type master;
 	file "shared.db";
 	dnssec-policy "none";
 };
@@ -26,7 +26,6 @@ dnssec-policy "test" {
 	parent-ds-ttl 7200;
 	parent-propagation-delay PT1H;
 	publish-safety PT3600S;
 	purge-keys P90D;
 	retire-safety PT3600S;
 	signatures-refresh P3D;
 	signatures-validity P2W;
@@ -192,53 +191,7 @@ view "fourth" {
 		file "dnssec-none.db";
 		dnssec-policy "none";
 	};
 	zone "dnssec-view1" {
 		type master;
 		file "dnssec-view41.db";
 		dnssec-policy "test";
 	};
 	zone "dnssec-view2" {
 		type master;
 		file "dnssec-view42.db";
 	};
 	zone "dnssec-view3" {
 		type master;
 		file "dnssec-view43.db";
 		dnssec-policy "none";
 		key-directory "keys";
 	};
 	zone "dnssec-view4" {
 		type master;
 		file "dnssec-view44.db";
 		dnssec-policy "none";
 	};
 	dnssec-policy "default";
 	key-directory ".";
 };
 view "fifth" {
 	zone "dnssec-view1" {
 		type master;
 		file "dnssec-view51.db";
 		dnssec-policy "test";
 	};
 	zone "dnssec-view2" {
 		type master;
 		file "dnssec-view52.db";
 		dnssec-policy "test";
 		key-directory "keys";
 	};
 	zone "dnssec-view3" {
 		type master;
 		file "dnssec-view53.db";
 		dnssec-policy "default";
 		key-directory "keys";
 	};
 	zone "dnssec-view4" {
 		type master;
 		file "dnssec-view54.db";
 		dnssec-policy "none";
 	};
 	key-directory ".";
 };
 view "chaos" chaos {
 	zone "hostname.bind" chaos {
@@ -13,12 +13,4 @@ dnssec-test IN fourth master
 dnssec-default IN fourth master
 dnssec-inherit IN fourth master
 dnssec-none IN fourth master
 dnssec-view1 IN fourth master
 dnssec-view2 IN fourth master
 dnssec-view3 IN fourth master
 dnssec-view4 IN fourth master
 dnssec-view1 IN fifth master
 dnssec-view2 IN fifth master
 dnssec-view3 IN fifth master
 dnssec-view4 IN fifth master
 hostname.bind chaos chaos master
@@ -27,28 +27,28 @@ dnssec-policy "rsasha256" {
 	keys {
 		csk lifetime P10Y algorithm rsasha256 2048;
 	};
-	nsec3param iterations 150;
+	nsec3param iterations 500;
 };
 dnssec-policy "rsasha256-bad" {
 	keys {
 		csk lifetime P10Y algorithm rsasha256 2048;
 	};
-	nsec3param iterations 151;
+	nsec3param iterations 501;
 };
 dnssec-policy "rsasha512" {
 	keys {
 		csk lifetime P10Y algorithm rsasha512 4096;
 	};
-	nsec3param iterations 150;
+	nsec3param iterations 2500;
 };
 dnssec-policy "rsasha512-bad" {
 	keys {
 		csk lifetime P10Y algorithm rsasha512 4096;
 	};
-	nsec3param iterations 151;
+	nsec3param iterations 2501;
 };
 zone "example.net" {
@@ -12,8 +12,6 @@
 status=0
 n=0
 mkdir keys
 n=`expr $n + 1`
 echo_i "checking that named-checkconf handles a known good config ($n)"
 ret=0
@@ -497,6 +495,8 @@ echo_i "checking named-checkconf kasp nsec3 iterations errors ($n)"
 ret=0
 $CHECKCONF kasp-bad-nsec3-iter.conf > checkconf.out$n 2>&1 && ret=1
 grep "dnssec-policy: nsec3 iterations value 151 out of range" < checkconf.out$n > /dev/null || ret=1
 grep "dnssec-policy: nsec3 iterations value 501 out of range" < checkconf.out$n > /dev/null || ret=1
 grep "dnssec-policy: nsec3 iterations value 2501 out of range" < checkconf.out$n > /dev/null || ret=1
 lines=$(wc -l < "checkconf.out$n")
 if [ $lines != 3 ]; then ret=1; fi
 if [ $ret != 0 ]; then echo_i "failed"; fi
@@ -551,7 +551,5 @@ grep "exceeds 100%" < checkconf.out$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; ret=1; fi
 status=`expr $status + $ret`
 rmdir keys
 echo_i "exit status: $status"
 [ $status -eq 0 ] || exit 1
@@ -17,7 +17,7 @@ do
 	echo_i "checking $db ($n)"
 	ret=0
 	case $db in
-	zones/good-gc-msdcs.db|zones/good-spf-exception.db)
+	zones/good-gc-msdcs.db)
 		$CHECKZONE -k fail -i local example $db > test.out.$n 2>&1 || ret=1
 		;;
 	zones/good-dns-sd-reverse.db)
@@ -1,5 +0,0 @@
 example.	0	SOA	. . 0 0 0 0 0
 example.	0	NS	.
 example.	0	CDS	0 0 0 00
 example.	0	CDNSKEY	0 3 0 AA==
@@ -1,16 +0,0 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
 ; This Source Code Form is subject to the terms of the Mozilla Public
 ; License, v. 2.0. If a copy of the MPL was not distributed with this
 ; file, You can obtain one at http://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
 $TTL 600
@		SOA	ns hostmaster 2011012708 3600 1200 604800 1200
 		NS	ns
 ns		A	192.0.2.1
 a._spf		A	192.0.2.2
 a._spf_rate	A	192.0.2.2
 a._spf_verify	A	192.0.2.2
@@ -86,7 +86,6 @@ include-multiplecfg
 inline
 integrity
 ixfr
 journal
 keepalive
 limits
 masterfile
@@ -669,7 +668,7 @@ copy_setports() {
    atsign="@"
    sed -e "s/${atsign}PORT${atsign}/${PORT}/g" \
        -e "s/${atsign}TLSPORT${atsign}/${TLSPORT}/g" \
-		-e "s/${atsign}HTTPPORT${atsign}/${HTTPPORT}/g" \
+		-e "s/${atsign}HTTPPORT${atsign}/${HTTPSPORT}/g" \
        -e "s/${atsign}HTTPSPORT${atsign}/${HTTPSPORT}/g" \
        -e "s/${atsign}EXTRAPORT1${atsign}/${EXTRAPORT1}/g" \
        -e "s/${atsign}EXTRAPORT2${atsign}/${EXTRAPORT2}/g" \
@@ -713,7 +712,6 @@ export KEYGEN
 export KEYSETTOOL
 export KEYSIGNER
 export KRB5_CONFIG
 export KRB5_KTNAME
 export MAKEJOURNAL
 export MDIG
 export NAMED
@@ -731,6 +729,7 @@ export PYTHON
 export RESOLVE
 export RNDC
 export RRCHECKER
 export SAMPLEUPDATE
 export SIGNER
 export SUBDIRS
 export TMPDIR
@@ -51,7 +51,7 @@ NZD2NZF=$TOP_BUILDDIR/bin/tools/named-nzd2nzf
 PK11DEL="$TOP_BUILDDIR/bin/pkcs11/pkcs11-destroy -s ${SLOT:-0} -p ${HSMPIN:-1234} -w 0"
 PK11GEN="$TOP_BUILDDIR/bin/pkcs11/pkcs11-keygen -q -s ${SLOT:-0} -p ${HSMPIN:-1234}"
 PK11LIST="$TOP_BUILDDIR/bin/pkcs11/pkcs11-list -s ${SLOT:-0} -p ${HSMPIN:-1234}"
-RESOLVE=$TOP_BUILDDIR/bin/tests/system/resolve
+RESOLVE=$TOP_BUILDDIR/lib/samples/resolve
 REVOKE=$TOP_BUILDDIR/bin/dnssec/dnssec-revoke
 RNDC=$TOP_BUILDDIR/bin/rndc/rndc
 RNDCCONFGEN=$TOP_BUILDDIR/bin/confgen/rndc-confgen
@@ -68,11 +68,10 @@ KEYCREATE=$TOP_BUILDDIR/bin/tests/system/tkey/keycreate
 KEYDELETE=$TOP_BUILDDIR/bin/tests/system/tkey/keydelete
 MAKEJOURNAL=$TOP_BUILDDIR/bin/tests/system/makejournal
 PIPEQUERIES=$TOP_BUILDDIR/bin/tests/system/pipelined/pipequeries
 SAMPLEUPDATE=$TOP_BUILDDIR/lib/samples/sample-update
 # we don't want a KRB5_CONFIG setting breaking the tests
 KRB5_CONFIG=/dev/null
 # use local keytab instead of default /etc/krb5.keytab
 KRB5_KTNAME=dns.keytab
 #
 # Construct the lists of tests to run
@@ -88,7 +87,6 @@ dnssec
 dyndb
 filter-aaaa
 kasp
 keymgr2kasp
 legacy
 logfileconfig
 nzd2nzf
@@ -51,10 +51,12 @@ NZD2NZF=$TOP_BUILDDIR/Build/$VSCONF/named-nzd2nzf@EXEEXT@
 PK11DEL="$TOP_BUILDDIR/Build/$VSCONF/pkcs11-destroy@EXEEXT@ -s ${SLOT:-0} -p ${HSMPIN:-1234} -w 0"
 PK11GEN="$TOP_BUILDDIR/Build/$VSCONF/pkcs11-keygen@EXEEXT@ -q -s ${SLOT:-0} -p ${HSMPIN:-1234}"
 PK11LIST="$TOP_BUILDDIR/Build/$VSCONF/pkcs11-list@EXEEXT@ -s ${SLOT:-0} -p ${HSMPIN:-1234}"
 RESOLVE=$TOP_BUILDDIR/lib/samples/resolve
 REVOKE=$TOP_BUILDDIR/Build/$VSCONF/dnssec-revoke@EXEEXT@
 RNDC=$TOP_BUILDDIR/Build/$VSCONF/rndc@EXEEXT@
 RNDCCONFGEN=$TOP_BUILDDIR/Build/$VSCONF/rndc-confgen@EXEEXT@
 RRCHECKER=$TOP_BUILDDIR/Build/$VSCONF/named-rrchecker@EXEEXT@
 SAMPLEUPDATE=$TOP_BUILDDIR/Build/$VSCONF/update@EXEEXT@
 SETTIME=$TOP_BUILDDIR/Build/$VSCONF/dnssec-settime@EXEEXT@
 SIGNER=$TOP_BUILDDIR/Build/$VSCONF/dnssec-signzone@EXEEXT@
 TSIGKEYGEN=$TOP_BUILDDIR/Build/$VSCONF/tsig-keygen@EXEEXT@
@@ -69,7 +71,7 @@ KEYCREATE=$TOP_BUILDDIR/Build/$VSCONF/keycreate@EXEEXT@
 KEYDELETE=$TOP_BUILDDIR/Build/$VSCONF/keydelete@EXEEXT@
 MAKEJOURNAL=$TOP_BUILDDIR/Build/$VSCONF/makejournal@EXEEXT@
 PIPEQUERIES=$TOP_BUILDDIR/Build/$VSCONF/pipequeries@EXEEXT@
-RESOLVE=$TOP_BUILDDIR/Build/$VSCONF/resolve@EXEEXT@
+# to port SAMPLEUPDATE=$TOP_BUILDDIR/lib/samples/sample-update
 # we don't want a KRB5_CONFIG setting breaking the tests
 KRB5_CONFIG=NUL
@@ -801,7 +801,7 @@ if [ -x "$DIG" ] ; then
  echo_i "checking exit code for a retry upon TCP EOF (immediate -> immediate) ($n)"
  ret=0
  echo "no_response no_response" | sendcmd 10.53.0.5
-  dig_with_opts @10.53.0.5 example AXFR +tries=2 > dig.out.test$n 2>&1 && ret=1
+  dig_with_opts @10.53.0.5 example AXFR +tries=1 > dig.out.test$n 2>&1 && ret=1
  # Sanity check: ensure ans5 behaves as expected.
  [ `grep "communications error.*end of file" dig.out.test$n | wc -l` -eq 2 ] || ret=1
  if [ $ret -ne 0 ]; then echo_i "failed"; fi
@@ -811,7 +811,7 @@ if [ -x "$DIG" ] ; then
  echo_i "checking exit code for a retry upon TCP EOF (partial AXFR -> partial AXFR) ($n)"
  ret=0
  echo "partial_axfr partial_axfr" | sendcmd 10.53.0.5
-  dig_with_opts @10.53.0.5 example AXFR +tries=2 > dig.out.test$n 2>&1 && ret=1
+  dig_with_opts @10.53.0.5 example AXFR +tries=1 > dig.out.test$n 2>&1 && ret=1
  # Sanity check: ensure ans5 behaves as expected.
  [ `grep "communications error.*end of file" dig.out.test$n | wc -l` -eq 2 ] || ret=1
  if [ $ret -ne 0 ]; then echo_i "failed"; fi
@@ -821,7 +821,7 @@ if [ -x "$DIG" ] ; then
  echo_i "checking exit code for a retry upon TCP EOF (immediate -> partial AXFR) ($n)"
  ret=0
  echo "no_response partial_axfr" | sendcmd 10.53.0.5
-  dig_with_opts @10.53.0.5 example AXFR +tries=2 > dig.out.test$n 2>&1 && ret=1
+  dig_with_opts @10.53.0.5 example AXFR +tries=1 > dig.out.test$n 2>&1 && ret=1
  # Sanity check: ensure ans5 behaves as expected.
  [ `grep "communications error.*end of file" dig.out.test$n | wc -l` -eq 2 ] || ret=1
  if [ $ret -ne 0 ]; then echo_i "failed"; fi
@@ -831,7 +831,7 @@ if [ -x "$DIG" ] ; then
  echo_i "checking exit code for a retry upon TCP EOF (partial AXFR -> immediate) ($n)"
  ret=0
  echo "partial_axfr no_response" | sendcmd 10.53.0.5
-  dig_with_opts @10.53.0.5 example AXFR +tries=2 > dig.out.test$n 2>&1 && ret=1
+  dig_with_opts @10.53.0.5 example AXFR +tries=1 > dig.out.test$n 2>&1 && ret=1
  # Sanity check: ensure ans5 behaves as expected.
  [ `grep "communications error.*end of file" dig.out.test$n | wc -l` -eq 2 ] || ret=1
  if [ $ret -ne 0 ]; then echo_i "failed"; fi
@@ -841,7 +841,7 @@ if [ -x "$DIG" ] ; then
  echo_i "checking exit code for a retry upon TCP EOF (immediate -> complete AXFR) ($n)"
  ret=0
  echo "no_response complete_axfr" | sendcmd 10.53.0.5
-  dig_with_opts @10.53.0.5 example AXFR +tries=2 > dig.out.test$n 2>&1 || ret=1
+  dig_with_opts @10.53.0.5 example AXFR +tries=1 > dig.out.test$n 2>&1 || ret=1
  # Sanity check: ensure ans5 behaves as expected.
  [ `grep "communications error.*end of file" dig.out.test$n | wc -l` -eq 1 ] || ret=1
  if [ $ret -ne 0 ]; then echo_i "failed"; fi
@@ -851,26 +851,7 @@ if [ -x "$DIG" ] ; then
  echo_i "checking exit code for a retry upon TCP EOF (partial AXFR -> complete AXFR) ($n)"
  ret=0
  echo "partial_axfr complete_axfr" | sendcmd 10.53.0.5
-  dig_with_opts @10.53.0.5 example AXFR +tries=2 > dig.out.test$n 2>&1 || ret=1
+  dig_with_opts @10.53.0.5 example AXFR +tries=1 > dig.out.test$n 2>&1 || ret=1
  # Sanity check: ensure ans5 behaves as expected.
  [ `grep "communications error.*end of file" dig.out.test$n | wc -l` -eq 1 ] || ret=1
  if [ $ret -ne 0 ]; then echo_i "failed"; fi
  status=$((status+ret))
  n=$((n+1))
  echo_i "checking +tries=1 won't retry twice upon TCP EOF ($n)"
  ret=0
  echo "no_response no_response" | sendcmd 10.53.0.5
  dig_with_opts @10.53.0.5 example AXFR +tries=1 > dig.out.test$n 2>&1 && ret=1
  # Sanity check: ensure ans5 behaves as expected.
  [ `grep "communications error.*end of file" dig.out.test$n | wc -l` -eq 1 ] || ret=1
  if [ $ret -ne 0 ]; then echo_i "failed"; fi
  status=$((status+ret))
  n=$((n+1))
  echo_i "checking +retry=0 won't retry twice upon TCP EOF ($n)"
  ret=0
  dig_with_opts @10.53.0.5 example AXFR +retry=0 > dig.out.test$n 2>&1 && ret=1
  # Sanity check: ensure ans5 behaves as expected.
  [ `grep "communications error.*end of file" dig.out.test$n | wc -l` -eq 1 ] || ret=1
  if [ $ret -ne 0 ]; then echo_i "failed"; fi
@@ -4,10 +4,11 @@ AM_CPPFLAGS +=			\
 	$(LIBISC_CFLAGS)	\
 	$(LIBDNS_CFLAGS)
-check_LTLIBRARIES = dlzexternal.la
+dlzexternal_LTLIBRARIES = dlzexternal.la
 dlzexternaldir = $(abs_builddir)
 dlzexternal_la_SOURCES =	\
 	driver.c		\
 	driver.h
-dlzexternal_la_LDFLAGS = -avoid-version -module -shared -export-dynamic -rpath $(abs_builddir)
+dlzexternal_la_LDFLAGS = -avoid-version -module -shared -export-dynamic
@@ -25,7 +25,6 @@ rm -f ./canonical?.*
 rm -f ./delv.out*
 rm -f ./delve.out*
 rm -f ./dig.out.*
 rm -f ./ns2/too-many-iterations.db
 rm -f ./dnssectools.out*
 rm -f ./dsfromkey.out.*
 rm -f ./keygen.err
@@ -36,7 +35,6 @@ rm -f ./ns*/managed-keys.bind* ./ns*/*.mkeys*
 rm -f ./ns*/named.lock
 rm -f ./ns1/managed.key.id
 rm -f ./ns1/root.db ./ns2/example.db ./ns2/managed.db ./ns2/trusted.db
 rm -f ./ns1/trusted.keys
 rm -f ./ns2/algroll.db
 rm -f ./ns2/badparam.db ./ns2/badparam.db.bad
 rm -f ./ns2/cdnskey-kskonly.secure.db
@@ -31,5 +31,3 @@ ns6.optout-tld.		A	10.53.0.6
 in-addr.arpa.		NS	ns2.example.
 inprogress.		NS	ns10.inprogress.
 ns10.inprogress.	A	10.53.0.10
 too-many-iterations.	NS	ns2.too-many-iterations.
 ns2.too-many-iterations.	A	10.53.0.2
@@ -26,7 +26,6 @@ echo_i "ns1/sign.sh"
 cp "../ns2/dsset-example$TP" .
 cp "../ns2/dsset-in-addr.arpa$TP" .
 cp "../ns2/dsset-too-many-iterations$TP" .
 grep "$DEFAULT_ALGORITHM_NUMBER [12] " "../ns2/dsset-algroll$TP" > "dsset-algroll$TP"
 cp "../ns6/dsset-optout-tld$TP" .
@@ -191,9 +191,4 @@ zone "hours-vs-days" {
 	allow-update { any; };
 };
 zone "too-many-iterations" {
 	type master;
 	file "too-many-iterations.db.signed";
 };
 include "trusted.conf";
@@ -318,14 +318,3 @@ key1=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone -f KSK "$
 key2=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone")
 $SETTIME -P sync now "$key1" > /dev/null
 cat "$infile" > "$zonefile.signed"
 #
 # Negative result from this zone should come back as insecure.
 #
 zone=too-many-iterations
 infile=too-many-iterations.db.in
 zonefile=too-many-iterations.db
 key1=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone -f KSK "$zone")
 key2=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone")
 cat "$infile" "$key1.key" "$key2.key" > "$zonefile"
 "$SIGNER" -P -3 - -H too-many -g -o "$zone" "$zonefile" > /dev/null 2>&1
@@ -1,25 +0,0 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
 ; This Source Code Form is subject to the terms of the Mozilla Public
 ; License, v. 2.0. If a copy of the MPL was not distributed with this
 ; file, You can obtain one at http://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
 $TTL 30	; 5 minutes
@			IN SOA	mname1. . (
 				2000042407 ; serial
 				20         ; refresh (20 seconds)
 				20         ; retry (20 seconds)
 				1814400    ; expire (3 weeks)
 				30       ; minimum (1 hour)
 				)
 			NS	ns2
 ns2			A	10.53.0.2
 ns3			A	10.53.0.3
 a			A	10.0.0.1
 *.a			A	10.0.0.3
 b			A	10.0.0.2
 d			A	10.0.0.4
@@ -363,12 +363,6 @@ zone "revoked.trusted" {
 	file "revoked.trusted.db.signed";
 };
 zone "too-many-iterations" {
 	type secondary;
 	primaries { 10.53.0.2; };
 	file "too-many-iterations.bk";
 };
 include "siginterval.conf";
 include "trusted.conf";
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Ondřej SurýandArtem Boldariev	b6889fbf10	WIP: Add preliminary DoH client support to dig	2021-02-02 20:20:10 +02:00
Ondřej SurýandArtem Boldariev	81340a9ee0	Unit-test fixes and manual page updates for DoH configuration This commit contains fixes to unit tests to make them work well on various platforms (in particular ones shipping old versions of OpenSSL) and fo different configurations. It also updates the generated manpage to include DoH configuration options.	2021-02-02 20:20:10 +02:00
Artem Boldariev	bc1b832603	Initial support for DNS-over-HTTP(S) This commit completes the support for DNS-over-HTTP(S) built on top of nghttp2 and plugs it into the BIND. Support for both GET and POST requests is present, as required by RFC8484. Both encrypted (via TLS) and unencrypted HTTP/2 connections are supported. The latter are mostly there for debugging/troubleshooting purposes and for the means of encryption offloading to third-party software (as might be desirable in some environments to simplify TLS certificates management).	2021-02-02 20:20:01 +02:00
Witold KręcickiandArtem Boldariev	16966e5174	nghttp2-based HTTP layer in netmgr This commit includes work-in-progress implementation of DNS-over-HTTP(S). Server-side code remains mostly untested, and there is only support for POST requests.	2021-02-02 20:02:13 +02:00
Witold KręcickiandArtem Boldariev	ba72d6f015	Add isc_mem_strndup() function This commit adds an implementation of strndup() function which allocates memory from the supplied isc_mem_t memory context.	2021-02-02 19:53:34 +02:00
Evan HuntandArtem Boldariev	37f81ca5fb	Add parser support for DoH configuration options This commit adds stub parser support and tests for: - an "https-server" global option for HTTP/2 configuration. - an "https-endpoint" view option for DoH configuration. - add specific -p options to set dns, tls, or https port numbers by specifying -p dns-PORT, -p tls=PORT, or -p https=PORT. NOTE: this change only affects syntax; specifying the TLS port on the command line DOES NOT CURRENTLY HAVE ANY EFFECT. - change option names to tls-port and https-port for consistency. - change variable names in system tests to TLSPORT and HTTPSPORT, and report them when running tests. Documentation for these options has also been added to the ARM, but needs further work.	2021-02-02 19:44:52 +02:00
Artem Boldariev	fcb0b6a781	Resurrect old TLS code This commit resurrects the old TLS code from `8f73c70d23`. It also includes numerous stability fixes and support for isc_nm_cancelread() for the TLS layer. The code was resurrected to be used for DoH.	2021-02-02 19:29:56 +02:00
		`@@ -1,2 +0,0 @@`
			`@ IN SOA localhost. localhost.localhost. 1 10800 3600 605800 86400`
			`@ IN NS localhost.`
		`@@ -1 +0,0 @@`
			`-m record,size,mctx -c named.conf -d 1 -D cacheclean-ns1 -X named.lock -g -T maxcachesize=2097152`
		`@@ -1 +0,0 @@`
			`-m record,size,mctx -c named.conf -d 3 -D cacheclean-ns2 -X named.lock -g -T maxcachesize=2097152`