WIP: Pull rwlock fixes from wpk branch and sync up the logic with 9.11

2021-03-24 18:14:50 +01:00
390 changed files with 14368 additions and 13778 deletions
@@ -34,15 +34,11 @@ variables:
  WITH_READLINE_LIBEDIT: "--with-readline=libedit"
  WITH_READLINE_READLINE: "--with-readline=readline"

-  INSTALL_PATH: "${CI_PROJECT_DIR}/.local"
+  BIND_INSTALL_PATH: "${CI_PROJECT_DIR}/.local"

  # In multithreaded unit tests, abort on the first failure
  CMOCKA_TEST_ABORT: 1

-  # Disable pytest's "cacheprovider" plugin to prevent it from creating
-  # cross-testrun files as there is no need to use that feature in CI.
-  PYTEST_ADDOPTS: "-p no:cacheprovider"
-
  # Default platforms to run "stress" tests on
  BIND_STRESS_TEST_OS: linux
  BIND_STRESS_TEST_ARCH: amd64
@@ -137,20 +133,16 @@ stages:

 # Fedora

-.fedora-34-amd64: &fedora_34_amd64_image
-  image: "$CI_REGISTRY_IMAGE:fedora-34-amd64"
+.fedora-33-amd64: &fedora_33_amd64_image
+  image: "$CI_REGISTRY_IMAGE:fedora-33-amd64"
  <<: *linux_amd64

-.fedora-34-arm64: &fedora_34_arm64_image
-  image: "$CI_REGISTRY_IMAGE:fedora-34-arm64"
+.fedora-33-arm64: &fedora_33_arm64_image
+  image: "$CI_REGISTRY_IMAGE:fedora-33-arm64"
  <<: *linux_stress_arm64

 # Ubuntu

-.ubuntu-bionic-amd64: &ubuntu_bionic_amd64_image
-  image: "$CI_REGISTRY_IMAGE:ubuntu-bionic-amd64"
-  <<: *linux_amd64
-
 .ubuntu-focal-amd64: &ubuntu_focal_amd64_image
  image: "$CI_REGISTRY_IMAGE:ubuntu-focal-amd64"
  <<: *linux_amd64
@@ -177,12 +169,8 @@ stages:
  image: "freebsd-12.2-x86_64"
  <<: *libvirt_amd64

-.freebsd-13-amd64: &freebsd_13_amd64_image
-  image: "freebsd-13.0-x86_64"
-  <<: *libvirt_amd64
-
 .openbsd-amd64: &openbsd_amd64_image
-  image: "openbsd-6.9-x86_64"
+  image: "openbsd-6.8-x86_64"
  <<: *libvirt_amd64

 ### Job Templates
@@ -203,12 +191,6 @@ stages:
    - main@isc-projects/bind9
    - /^v9_[1-9][0-9]$/@isc-projects/bind9

-.schedules-tags-web-triggering-rules: &schedules_tags_web_triggering_rules
-  only:
-    - schedules
-    - tags
-    - web
-
 .precheck: &precheck_job
  <<: *default_triggering_rules
  <<: *base_image
@@ -229,10 +211,10 @@ stages:
    --disable-maintainer-mode \
    --enable-developer \
    --enable-option-checking=fatal \
-    --enable-dnstap \
    --with-cmocka \
    --with-libxml2 \
    --with-json-c \
+    --prefix="${BIND_INSTALL_PATH}" \
    $EXTRA_CONFIGURE \
    || (test -s config.log && cat config.log; exit 1)

@@ -251,18 +233,6 @@ stages:
      grep "^#define HAVE_READLINE_READLINE" config.h; \
    fi

-# Move the out-of-tree workspace to CI project dir to save it for use in
-# dependent jobs.
-.save_out_of_tree_workspace: &save_out_of_tree_workspace
-  - test -n "${OUT_OF_TREE_WORKSPACE}" && mv "${OUT_OF_TREE_WORKSPACE}" "${CI_PROJECT_DIR}"
-
-# Move the artifacts from the out-of-tree build job to their original
-# location (the out-of-tree workspace) and then continue work in the
-# out-of-tree workspace.
-.retrieve_out_of_tree_workspace: &retrieve_out_of_tree_workspace
-  - test -n "${OUT_OF_TREE_WORKSPACE}" && mv "$(basename "${OUT_OF_TREE_WORKSPACE}")" "${OUT_OF_TREE_WORKSPACE}"
-  - test -n "${OUT_OF_TREE_WORKSPACE}" && cd "${OUT_OF_TREE_WORKSPACE}"
-
 .build: &build_job
  <<: *default_triggering_rules
  stage: build
@@ -273,12 +243,12 @@ stages:
    - *configure
    - *check_readline_setup
    - make -j${BUILD_PARALLEL_JOBS:-1} -k all V=1
-    - test -z "${RUN_MAKE_INSTALL}" || make DESTDIR="${INSTALL_PATH}" install
-    - test -z "${RUN_MAKE_INSTALL}" || DESTDIR="${INSTALL_PATH}" sh util/check-make-install
+    - test -z "${RUN_MAKE_INSTALL}" || make install
+    - test -z "${RUN_MAKE_INSTALL}" || sh util/check-make-install
    - if [[ "${CFLAGS}" == *"-fsanitize=address"* ]]; then ( ! grep -F AddressSanitizer config.log ); fi
    - if test -z "${OUT_OF_TREE_WORKSPACE}" && test "$(git status --porcelain | grep -Ev '\?\?' | wc -l)" -gt "0"; then git status --short; exit 1; fi
  after_script:
-    - *save_out_of_tree_workspace
+    - test -n "${OUT_OF_TREE_WORKSPACE}" && mv "${OUT_OF_TREE_WORKSPACE}" "${CI_PROJECT_DIR}"
  needs:
    - job: autoreconf
      artifacts: true
@@ -329,7 +299,10 @@ stages:
  stage: system
  before_script:
    - *setup_softhsm
-    - *retrieve_out_of_tree_workspace
+    # Move the artifacts from the out-of-tree build job to their original location (the out-of-tree workspace).
+    - test -n "${OUT_OF_TREE_WORKSPACE}" && mv "$(basename "${OUT_OF_TREE_WORKSPACE}")" "${OUT_OF_TREE_WORKSPACE}"
+    # Continue work in the out-of-tree workspace.
+    - test -n "${OUT_OF_TREE_WORKSPACE}" && cd "${OUT_OF_TREE_WORKSPACE}"
    - *setup_interfaces
  script:
    - cd bin/tests/system
@@ -339,7 +312,7 @@ stages:
    - test -n "${OUT_OF_TREE_WORKSPACE}" && cd "${OUT_OF_TREE_WORKSPACE}"
    - test -d bind-* && cd bind-*
    - cat bin/tests/system/test-suite.log
-    - *save_out_of_tree_workspace
+    - test -n "${OUT_OF_TREE_WORKSPACE}" && mv "${OUT_OF_TREE_WORKSPACE}" "${CI_PROJECT_DIR}"

 .system_test: &system_test_job
  <<: *system_test_common
@@ -366,7 +339,6 @@ stages:
    when: on_failure

 .windows_system_test: &windows_system_test_job
-  <<: *schedules_tags_web_triggering_rules
  stage: system
  script:
    - 'Push-Location bin/tests/system'
@@ -382,17 +354,19 @@ stages:
    untracked: true
    expire_in: "1 day"
    when: on_failure
+  only:
+    - schedules
+    - tags
+    - web

 .unit_test_common: &unit_test_common
  <<: *default_triggering_rules
  stage: unit
  before_script:
+    - if [ -n "$TCP_CONNECTIONTIMEOUT" ]; then sudo sysctl 'net.inet.tcp.keepinittime=1'; fi
    - *setup_softhsm
-    - *retrieve_out_of_tree_workspace
  script:
    - make -j${TEST_PARALLEL_JOBS:-1} -k unit V=1
-  after_script:
-    - *save_out_of_tree_workspace

 .unit_test: &unit_test_job
  <<: *unit_test_common
@@ -594,7 +568,7 @@ gcc:alpine3.13:amd64:
  variables:
    CC: gcc
    CFLAGS: "${CFLAGS_COMMON}"
-    EXTRA_CONFIGURE: "${WITHOUT_READLINE}"
+    EXTRA_CONFIGURE: "--enable-dnstap ${WITHOUT_READLINE}"
  <<: *alpine_3_13_amd64_image
  <<: *build_job

@@ -618,7 +592,7 @@ gcc:centos7:amd64:
  variables:
    CC: gcc
    CFLAGS: "${CFLAGS_COMMON}"
-    EXTRA_CONFIGURE: "--with-libidn2"
+    EXTRA_CONFIGURE: "--enable-dnstap --with-libidn2"
  <<: *centos_centos7_amd64_image
  <<: *build_job

@@ -666,7 +640,7 @@ gcc:stretch:amd64:
  variables:
    CC: gcc
    CFLAGS: "${CFLAGS_COMMON} -O2"
-    EXTRA_CONFIGURE: "--without-cmocka --without-gssapi"
+    EXTRA_CONFIGURE: "--without-cmocka"
  <<: *debian_stretch_amd64_image
  <<: *build_job

@@ -690,7 +664,7 @@ gcc:buster:amd64:
  variables:
    CC: gcc
    CFLAGS: "${CFLAGS_COMMON} --coverage -O0"
-    EXTRA_CONFIGURE: "--with-libidn2 ${WITH_READLINE_LIBEDIT}"
+    EXTRA_CONFIGURE: "--enable-dnstap --with-libidn2 ${WITH_READLINE_LIBEDIT}"
  <<: *debian_buster_amd64_image
  <<: *build_job

@@ -726,7 +700,7 @@ scan-build:
    CC: "${CLANG}"
    CFLAGS: "${CFLAGS_COMMON}"
    CONFIGURE: "${SCAN_BUILD} ./configure"
-    EXTRA_CONFIGURE: "--with-libidn2"
+    EXTRA_CONFIGURE: "--enable-dnstap --with-libidn2"
  script:
    - *configure
    - *scan_build
@@ -746,7 +720,7 @@ gcc:sid:amd64:
  variables:
    CC: gcc
    CFLAGS: "${CFLAGS_COMMON} -O3"
-    EXTRA_CONFIGURE: "--with-libidn2 --without-lmdb"
+    EXTRA_CONFIGURE: "--enable-dnstap --with-libidn2 --without-lmdb"
    RUN_MAKE_INSTALL: 1
  <<: *debian_sid_amd64_image
  <<: *build_job
@@ -777,7 +751,7 @@ gcc:out-of-tree:
    CC: gcc
    CFLAGS: "${CFLAGS_COMMON} -Og"
    CONFIGURE: "${CI_PROJECT_DIR}/configure"
-    EXTRA_CONFIGURE: "--with-libidn2 --with-lmdb"
+    EXTRA_CONFIGURE: "--enable-dnstap --with-libidn2 --with-lmdb"
    RUN_MAKE_INSTALL: 1
    OUT_OF_TREE_WORKSPACE: /tmp/out_of_tree_workspace
  <<: *base_image
@@ -791,24 +765,17 @@ system:gcc:out-of-tree:
      artifacts: true
  <<: *base_image
  <<: *system_test_job
-  <<: *schedules_tags_web_triggering_rules
-
-unit:gcc:out-of-tree:
-  variables:
-    OUT_OF_TREE_WORKSPACE: /tmp/out_of_tree_workspace
-  needs:
-    - job: gcc:out-of-tree
-      artifacts: true
-  <<: *base_image
-  <<: *unit_test_job
-  <<: *schedules_tags_web_triggering_rules
+  only:
+    - schedules
+    - tags
+    - web

 # Jobs for tarball GCC builds on Debian 10 "buster" (amd64)

 gcc:tarball:
  variables:
    CC: gcc
-    EXTRA_CONFIGURE: "--with-libidn2"
+    EXTRA_CONFIGURE: "--enable-dnstap --with-libidn2"
    RUN_MAKE_INSTALL: 1
  <<: *base_image
  <<: *build_job
@@ -819,27 +786,34 @@ gcc:tarball:
  needs:
    - job: tarball-create
      artifacts: true
+  only:
+    - schedules
+    - tags

 system:gcc:tarball:
  <<: *base_image
  <<: *system_test_job
-  <<: *schedules_tags_web_triggering_rules
  before_script:
    - cd bind-*
    - *setup_interfaces
  needs:
    - job: gcc:tarball
      artifacts: true
+  only:
+    - schedules
+    - tags

 unit:gcc:tarball:
  <<: *base_image
  <<: *unit_test_job
-  <<: *schedules_tags_web_triggering_rules
  before_script:
    - cd bind-*
  needs:
    - job: gcc:tarball
      artifacts: true
+  only:
+    - schedules
+    - tags

 # Jobs for debug GCC builds on openSUSE Tumbleweed (amd64)

@@ -865,30 +839,6 @@ unit:gcc:tumbleweed:amd64:
    - job: gcc:tumbleweed:amd64
      artifacts: true

-# Jobs for regular GCC builds on Ubuntu 18.04 Bionic Beaver (amd64)
-
-gcc:bionic:amd64:
-  variables:
-    CC: gcc
-    CFLAGS: "${CFLAGS_COMMON} -O2"
-    EXTRA_CONFIGURE: "--disable-dnstap --disable-geoip"
-  <<: *ubuntu_bionic_amd64_image
-  <<: *build_job
-
-system:gcc:bionic:amd64:
-  <<: *ubuntu_bionic_amd64_image
-  <<: *system_test_job
-  needs:
-    - job: gcc:bionic:amd64
-      artifacts: true
-
-unit:gcc:bionic:amd64:
-  <<: *ubuntu_bionic_amd64_image
-  <<: *unit_test_job
-  needs:
-    - job: gcc:bionic:amd64
-      artifacts: true
-
 # Jobs for regular GCC builds on Ubuntu 20.04 Focal Fossa (amd64)

 gcc:focal:amd64:
@@ -991,7 +941,7 @@ system:gcc:tsan:

 unit:gcc:tsan:
  variables:
-    TSAN_OPTIONS: ${TSAN_OPTIONS_COMMON} suppressions=$CI_PROJECT_DIR/tsan-suppressions.txt
+    TSAN_OPTIONS: ${TSAN_OPTIONS_COMMON}
  <<: *base_image
  <<: *unit_test_tsan_job
  needs:
@@ -1018,7 +968,7 @@ system:clang:tsan:

 unit:clang:tsan:
  variables:
-    TSAN_OPTIONS: ${TSAN_OPTIONS_COMMON} suppressions=$CI_PROJECT_DIR/tsan-suppressions.txt
+    TSAN_OPTIONS: ${TSAN_OPTIONS_COMMON}
  <<: *base_image
  <<: *unit_test_tsan_job
  needs:
@@ -1096,25 +1046,25 @@ unit:gcc:softhsm2.4:
    - job: gcc:softhsm2.4
      artifacts: true

-# Jobs for PKCS#11-enabled GCC builds on Fedora 34 (amd64)
+# Jobs for PKCS#11-enabled GCC builds on Fedora 33 (amd64)

 gcc:softhsm2.6:
  variables:
    CC: gcc
    CFLAGS: "${CFLAGS_COMMON} -O1"
    EXTRA_CONFIGURE: "--with-libidn2 --enable-native-pkcs11 --with-pkcs11=/usr/lib64/pkcs11/libsofthsm2.so"
-  <<: *fedora_34_amd64_image
+  <<: *fedora_33_amd64_image
  <<: *build_job

 system:gcc:softhsm2.6:
-  <<: *fedora_34_amd64_image
+  <<: *fedora_33_amd64_image
  <<: *system_test_job
  needs:
    - job: gcc:softhsm2.6
      artifacts: true

 unit:gcc:softhsm2.6:
-  <<: *fedora_34_amd64_image
+  <<: *fedora_33_amd64_image
  <<: *unit_test_job
  needs:
    - job: gcc:softhsm2.6
@@ -1129,12 +1079,10 @@ clang:freebsd11:amd64:
    USER: gitlab-runner
  <<: *freebsd_11_amd64_image
  <<: *build_job
-  <<: *schedules_tags_web_triggering_rules

 system:clang:freebsd11:amd64:
  <<: *freebsd_11_amd64_image
  <<: *system_test_job
-  <<: *schedules_tags_web_triggering_rules
  variables:
    USER: gitlab-runner
    TEST_PARALLEL_JOBS: 4
@@ -1145,7 +1093,6 @@ system:clang:freebsd11:amd64:
 unit:clang:freebsd11:amd64:
  <<: *freebsd_11_amd64_image
  <<: *unit_test_job
-  <<: *schedules_tags_web_triggering_rules
  needs:
    - job: clang:freebsd11:amd64
      artifacts: true
@@ -1155,7 +1102,7 @@ unit:clang:freebsd11:amd64:
 clang:freebsd12:amd64:
  variables:
    CFLAGS: "${CFLAGS_COMMON}"
-    EXTRA_CONFIGURE: "${WITH_READLINE_EDITLINE}"
+    EXTRA_CONFIGURE: "--enable-dnstap ${WITH_READLINE_EDITLINE}"
    USER: gitlab-runner
  <<: *freebsd_12_amd64_image
  <<: *build_job
@@ -1177,40 +1124,12 @@ unit:clang:freebsd12:amd64:
    - job: clang:freebsd12:amd64
      artifacts: true

-# Jobs for Clang builds on FreeBSD 13 (amd64)
-
-clang:freebsd13:amd64:
-  variables:
-    CFLAGS: "${CFLAGS_COMMON}"
-    EXTRA_CONFIGURE: "${WITH_READLINE_LIBEDIT}"
-    USER: gitlab-runner
-  <<: *freebsd_13_amd64_image
-  <<: *build_job
-
-system:clang:freebsd13:amd64:
-  <<: *freebsd_13_amd64_image
-  <<: *system_test_job
-  variables:
-    USER: gitlab-runner
-    TEST_PARALLEL_JOBS: 4
-  needs:
-    - job: clang:freebsd13:amd64
-      artifacts: true
-
-unit:clang:freebsd13:amd64:
-  <<: *freebsd_13_amd64_image
-  <<: *unit_test_job
-  needs:
-    - job: clang:freebsd13:amd64
-      artifacts: true
-
 # Jobs for Clang builds on OpenBSD (amd64)

 clang:openbsd:amd64:
  variables:
    CC: clang
    USER: gitlab-runner
-    EXTRA_CONFIGURE: "--disable-dnstap"
  <<: *openbsd_amd64_image
  <<: *build_job

@@ -1231,6 +1150,8 @@ unit:clang:openbsd:amd64:
  <<: *unit_test_job
  variables:
    USER: gitlab-runner
+    # There's no socket option on OpenBSD, so we need to set this globally
+    TCP_CONNECTIONTIMEOUT: 1
  needs:
    - job: clang:openbsd:amd64
      artifacts: true
@@ -1256,9 +1177,12 @@ system:msvc:windows:amd64:
 msvc-debug:windows:amd64:
  <<: *windows_server_2016_amd64_image
  <<: *windows_build_job
-  <<: *schedules_tags_web_triggering_rules
  variables:
    VSCONF: Debug
+  only:
+    - schedules
+    - tags
+    - web

 system:msvc-debug:windows:amd64:
  <<: *windows_server_2016_amd64_image
@@ -1350,7 +1274,7 @@ coverity:
  variables:
    CC: gcc
    CFLAGS: "${CFLAGS_COMMON} -Og"
-    EXTRA_CONFIGURE: "--with-libidn2"
+    EXTRA_CONFIGURE: "--enable-dnstap --with-libidn2"
  script:
    - *coverity_cache_prep
    - *configure
@@ -1416,10 +1340,10 @@ respdiff:
    - *setup_interfaces
    - *setup_softhsm
    - make -j${BUILD_PARALLEL_JOBS:-1} -k all V=1
-    - make DESTDIR="${INSTALL_PATH}" install
+    - make install
    - git clone --depth 1 https://gitlab-ci-token:${CI_JOB_TOKEN}@gitlab.isc.org/isc-private/bind-qa.git
    - cd bind-qa/bind9/stress
-    - LD_LIBRARY_PATH="${INSTALL_PATH}/usr/local/lib" BIND_INSTALL_PATH="${INSTALL_PATH}/usr/local" WORKSPACE="${CI_PROJECT_DIR}" bash stress.sh
+    - DIG="${BIND_INSTALL_PATH}/bin/dig" WORKSPACE="${CI_PROJECT_DIR}" bash stress.sh
  needs:
    - job: autoreconf
      artifacts: true
@@ -1429,8 +1353,8 @@ respdiff:
    when: always
  timeout: 2h

-stress:authoritative:fedora:34:amd64:
-  <<: *fedora_34_amd64_image
+stress:authoritative:fedora:33:amd64:
+  <<: *fedora_33_amd64_image
  <<: *linux_stress_amd64
  <<: *stress_job
  variables:
@@ -1443,8 +1367,8 @@ stress:authoritative:fedora:34:amd64:
    variables:
      - $CI_COMMIT_TAG || ($BIND_STRESS_TEST_OS =~ /linux/i && $BIND_STRESS_TEST_MODE =~ /authoritative/i && $BIND_STRESS_TEST_ARCH =~ /amd64/i)

-stress:recursive:fedora:34:amd64:
-  <<: *fedora_34_amd64_image
+stress:recursive:fedora:33:amd64:
+  <<: *fedora_33_amd64_image
  <<: *linux_stress_amd64
  <<: *stress_job
  variables:
@@ -1457,8 +1381,8 @@ stress:recursive:fedora:34:amd64:
    variables:
      - $CI_COMMIT_TAG || ($BIND_STRESS_TEST_OS =~ /linux/i && $BIND_STRESS_TEST_MODE =~ /recursive/i && $BIND_STRESS_TEST_ARCH =~ /amd64/i)

-stress:authoritative:fedora:34:arm64:
-  <<: *fedora_34_arm64_image
+stress:authoritative:fedora:33:arm64:
+  <<: *fedora_33_arm64_image
  <<: *linux_stress_arm64
  <<: *stress_job
  variables:
@@ -1471,8 +1395,8 @@ stress:authoritative:fedora:34:arm64:
    variables:
      - $CI_COMMIT_TAG || ($BIND_STRESS_TEST_OS =~ /linux/i && $BIND_STRESS_TEST_MODE =~ /authoritative/i && $BIND_STRESS_TEST_ARCH =~ /arm64/i)

-stress:recursive:fedora:34:arm64:
-  <<: *fedora_34_arm64_image
+stress:recursive:fedora:33:arm64:
+  <<: *fedora_33_arm64_image
  <<: *linux_stress_arm64
  <<: *stress_job
  variables:
@@ -13,7 +13,6 @@ email to [security-officer@isc.org](security-officer@isc.org).
  - [ ] Determine CVSS score
  - [ ] Determine the range of BIND versions affected (including the Subscription Edition)
  - [ ] Determine whether workarounds for the problem exists
-  - [ ] Create a draft of the security advisory and put the information above in there
  - [ ] Prepare a detailed description of the problem which should include the following by default:
      - instructions for reproducing the problem (a system test is good enough)
      - explanation of code flow which triggers the problem (a system test is *not* good enough)
@@ -85,9 +85,7 @@
 - [ ] ***(QA)*** Merge the automatically prepared `prep 9.x.y` commit which updates `version` and documentation on the release branch into the relevant maintenance branch (`v9_x`).
 - [ ] ***(QA)*** For each maintained branch, update the `BIND_BASELINE_VERSION` variable for the `abi-check` job in `.gitlab-ci.yml` to the latest published BIND version tag for a given branch.
 - [ ] ***(QA)*** Prepare empty release notes for the next set of releases.
- - [ ] ***(QA)*** Sanitize confidential issues which are assigned to the current release milestone and do not describe a security vulnerability, then make them public.
- - [ ] ***(QA)*** Sanitize confidential issues which are assigned to older release milestones and describe security vulnerabilities, then make them public if appropriate[^2].
+ - [ ] ***(QA)*** Sanitize all confidential issues assigned to the release milestone and make them public.
 - [ ] ***(QA)*** Update QA tools used in GitLab CI (e.g. Flake8, PyLint) by modifying the relevant `Dockerfile`.

 [^1]: If not, use the time remaining until the tagging deadline to ensure all outstanding issues are either resolved or moved to a different milestone.
-[^2]: As a rule of thumb, security vulnerabilities which have reproducers merged to the public repository are considered okay for full disclosure.
@@ -13,7 +13,6 @@ extraction:
      - "libidn2-dev"
      - "libmaxminddb-dev"
      - "libuv1-dev"
-      - "libnghttp2-dev"
    configure:
      command:
      - "autoreconf -fi"
@@ -1,245 +1,39 @@
-5652.	[bug]		Copy and paste error caused the socket option to
-			be enabled instead of disabled. [GL #2746]
+5607.	[bug]		Rekey after 'rndc dnssec -checkds' or 'rndc dnssec
+			-rollover' command is received, because such a command
+			may influence the next key event. [GL #2488]

-5651.	[func]		Refactor zone dumping to be processed asynchronously
-			via the uv_work_t thread pool API. [GL #2732]
+5606.	[bug]		CDS/CDNSKEY DELETE records were not removed when a zone
+			transitioned from secure to insecure. "named-checkzone"
+			should not complain if such records exist in an
+			unsigned zone. [GL #2517]

-5650.	[bug]		Prevent a crash that could occur if serve-stale
-			was enabled and a prefetch was triggered during a
-			query restart. [GL #2733]
-
-5649.	[bug]		If a query was answered with stale data on a server
-			with DNS64 enabled, an assertion could occur if a
-			non-stale answer arrived afterward. [GL #2731]
-
-5648.	[bug]		The calculation of the estimated IXFR transaction
-			size by dns_journal_iter_init() was invalid. [GL #2685]
-
-5647.	[func]		The interfacemgr has been refactored to use fewer
-			clientmgr objects, which in turn use fewer memory
-			contexts and tasks.  This should result in less
-			fragmented memory and better startup performance.
-			[GL #2433]
-
-5646.	[bug]		The default TCP timeout for rndc has been increased
-			to 60 seconds. This was its original value, but it
-			had been inadvertently lowered to 10. [GL #2643]
-
-5645.	[cleanup]	Remove the rarely-used dns_name_copy() function
-			and rename dns_name_copynf() to dns_name_copy().
-			[GL !5081]
-
-5644.	[bug]		Fix a race condition in reading and writing key files
-			for KASP zones in multiple views. [GL #1875]
-
-5643.	[placeholder]
-
-5642.	[bug]		Check "key-directory" conflicts in "named.conf" for
-			zones in multiple views with different "dnssec-policy".
-			[GL #2463].
-
-5641.	[bug]		Address potential memory leak in dst_key_fromnamedfile.
-			[GL #2689]
-
-5640.	[func]		Add new configuration option to set the operating system
-			receive and send buffers. [GL #2313]
-
-5639.	[bug]		Check that the first and last SOA record of an AXFR
-			are consistent. [GL #2528]
-
-	--- 9.17.13 released ---
-
-5638.	[bug]		Improvements related to network manager/task manager
-			integration:
-			- isc_managers_create() and isc_managers_destroy()
-			  functions were added to handle setup and teardown of
-			  netmgr, taskmgr, timermgr, and socketmgr, since these
-			  require a precise order of operations now.
-			- Event queue processing is now quantized to prevent
-			  infinite looping.
-			- The netmgr can now be paused from within a netmgr
-			  thread.
-			- Deadlocks due to a conflict between netmgr's
-			  pause/resume and listen/stoplistening operations were
-			  fixed.
-			[GL #2654]
-
-5637.	[placeholder]
-
-5636.	[bug]		named and named-checkconf did not report an error when
-			multiple zones with the "dnssec-policy" option set were
-			using the same zone file. This has been fixed.
-			[GL #2603]
-
-5635.	[bug]		Journal compaction could fail when a journal with
-			invalid transaction headers was not detected at startup.
-			This has been fixed. [GL #2670]
-
-5634.	[bug]		If "dnssec-policy" was active and a private key file was
-			temporarily offline during a rekey event, named could
-			incorrectly introduce replacement keys and break a
-			signed zone. This has been fixed. [GL #2596]
-
-5633.	[doc]		The "inline-signing" option was incorrectly described as
-			being inherited from the "options"/"view" levels and was
-			incorrectly accepted at those levels without effect.
-			This has been fixed. [GL #2536]
-
-5632.	[func]		Add a new built-in KASP, "insecure", which is used to
-			transition a zone from a signed to an unsigned state.
-			The existing built-in KASP "none" should no longer be
-			used to unsign a zone. [GL #2645]
-
-5631.	[protocol]	Update the implementation of the ZONEMD RR type to match
-			RFC 8976. [GL #2658]
-
-5630.	[func]		Treat DNSSEC responses containing NSEC3 records with
-			iteration counts greater than 150 as insecure.
-			[GL #2445]
-
-5629.	[func]		Reduce the maximum supported number of NSEC3 iterations
-			that can be configured for a zone to 150. [GL #2642]
-
-5628.	[bug]		Host and nslookup could crash upon receiving a SERVFAIL
-			response. This has been fixed. [GL #2564]
-
-5627.	[bug]		RRSIG(SOA) RRsets placed anywhere other than at the zone
-			apex were triggering infinite resigning loops. This has
-			been fixed. [GL #2650]
-
-5626.	[bug]		When generating zone signing keys, KASP now also checks
-			for key ID conflicts among newly created keys, rather
-			than just between new and existing ones. [GL #2628]
-
-5625.	[bug]		A deadlock could occur when multiple "rndc addzone",
-			"rndc delzone", and/or "rndc modzone" commands were
-			invoked simultaneously for different zones. This has
-			been fixed. [GL #2626]
-
-5624.	[func]		Task manager events are now processed inside network
-			manager loops. The task manager no longer needs its own
-			set of worker threads, which improves resolver
-			performance. [GL #2638]
-
-5623.	[bug]		When named was shut down during an ongoing zone
-			transfer, xfrin_fail() could incorrectly be called
-			twice. This has been fixed. [GL #2630]
-
-5622.	[cleanup]	The lib/samples/ directory has been removed, as export
-			versions of libraries are no longer maintained.
-			[GL !4835]
-
-5621.	[placeholder]
-
-5620.	[bug]		If zone journal files written by BIND 9.16.11 or earlier
-			were present when BIND was upgraded, the zone file for
-			that zone could have been inadvertently rewritten with
-			the current zone contents. This caused the original zone
-			file structure (e.g. comments, $INCLUDE directives) to
-			be lost, although the zone data itself was preserved.
-			This has been fixed. [GL #2623]
-
-5619.	[protocol]	Implement draft-vandijk-dnsop-nsec-ttl, updating the
-			protocol such that NSEC(3) TTL values are set to the
-			minimum of the SOA MINIMUM value or the SOA TTL.
-			[GL #2347]
-
-5618.	[bug]		Change 5149 introduced some inconsistencies in the way
-			record TTLs were presented in cache dumps. These
-			inconsistencies have been eliminated. [GL #389]
-			[GL #2289]
-
-	--- 9.17.12 released ---
-
-5617.	[placeholder]
-
-5616.	[security]	named crashed when a DNAME record placed in the ANSWER
-			section during DNAME chasing turned out to be the final
-			answer to a client query. (CVE-2021-25215) [GL #2540]
-
-5615.	[security]	Insufficient IXFR checks could result in named serving a
-			zone without an SOA record at the apex, leading to a
-			RUNTIME_CHECK assertion failure when the zone was
-			subsequently refreshed. This has been fixed by adding an
-			owner name check for all SOA records which are included
-			in a zone transfer. (CVE-2021-25214) [GL #2467]
-
-5614.	[bug]		Ensure all resources are properly cleaned up when a call
-			to gss_accept_sec_context() fails. [GL #2620]
-
-5613.	[bug]		It was possible to write an invalid transaction header
-			in the journal file for a managed-keys database after
-			upgrading. This has been fixed. Invalid headers in
-			existing journal files are detected and named is able
-			to recover from them. [GL #2600]
-
-5612.	[bug]		Continued refactoring of the network manager:
-			- allow recovery from read and connect timeout events,
-			- ensure that calls to isc_nm_*connect() always
-			  return the connection status via a callback
-			  function.
-			[GL #2401]
-
-5611.	[func]		Set "stale-answer-client-timeout" to "off" by default.
-			[GL #2608]
-
-5610.	[bug]		Prevent a crash which could happen when a lookup
-			triggered by "stale-answer-client-timeout" was attempted
-			right after recursion for a client query finished.
-			[GL #2594]
-
-5609.	[func]		The ISC implementation of SPNEGO was removed from BIND 9
-			source code. It was no longer necessary as all major
-			contemporary Kerberos/GSSAPI libraries include support
-			for SPNEGO. [GL #2607]
-
-5608.	[bug]		When sending queries over TCP, dig now properly handles
-			"+tries=1 +retry=0" by not retrying the connection when
-			the remote server closes the connection prematurely.
-			[GL #2490]
-
-5607.	[bug]		As "rndc dnssec -checkds" and "rndc dnssec -rollover"
-			commands may affect the next scheduled key event,
-			reconfiguration of zone keys is now triggered after
-			receiving either of these commands to prevent
-			unnecessary key rollover delays. [GL #2488]
-
-5606.	[bug]		CDS/CDNSKEY DELETE records are now removed when a zone
-			transitions from a secure to an insecure state.
-			named-checkzone also no longer reports an error when
-			such records are found in an unsigned zone. [GL #2517]
-
-5605.	[bug]		"dig -u" now uses the CLOCK_REALTIME clock source for
-			more accurate time reporting. [GL #2592]
+5605.	[bug]		"dig -u" now uses CLOCK_REALTIME for more accurate
+			time reporting. [GL #2592]

 5604.	[experimental]	A "filter-a.so" plugin, which is similar to the
 			"filter-aaaa.so" plugin but which omits A records
 			instead of AAAA records, has been added. Thanks to
-			GitLab user @treysis. [GL #2585]
+			'@treysis' (GitLab). [GL #2585]

 5603.	[placeholder]

-5602.	[bug]		Fix TCPDNS and TLSDNS timers in Network Manager. This
-			makes the "tcp-initial-timeout" and "tcp-idle-timeout"
-			options work correctly again. [GL #2583]
+5602.	[bug]		Fix the TCPDNS and TLSDNS timers, so TCP initial
+			and idle timers work correctly. [GL #2573]

-5601.	[bug]		Zones using KASP could not be thawed after they were
-			frozen using "rndc freeze". This has been fixed.
-			[GL #2523]
+5601.	[bug]		Dynamic zones with dnssec-policy could not be thawed
+			because KASP zones were always considered dynamic;
+			previously, dynamic KASP zones did not check whether
+			updates were disabled. This has been fixed. [GL #2523]

-5600.	[bug]		Send a full certificate chain instead of just the leaf
-			certificate to DNS-over-TLS (DoT) and DNS-over-HTTPS
-			(DoH) clients. This makes BIND 9 DoT/DoH servers
-			compatible with a broader set of clients. [GL #2514]
+5600.	[bug]		Load a certificate chain file so that the full chain is
+			sent to DNS-over-TLS (DoT) and DNS-over-HTTPS (DoH)
+			clients that require full chain verification. [GL #2514]

-5599.	[bug]		Fix a named crash which occurred after skipping a
-			primary server while transferring a zone over TLS.
-			[GL #2562]
+5599.	[bug]		Fix a crash when transferring a zone over TLS,
+			after "named" previously skipped a master. [GL #2562]

-5598.	[port]		Silence -Wchar-subscripts compiler warnings triggered on
-			some platforms due to calling character classification
-			functions declared in the <ctype.h> header with
-			arguments of type char. [GL #2567]
+5598.	[port]		Cast (char) to (unsigned char) when calling ctype
+			tests. [GL #2567]

 	--- 9.17.11 released ---

@@ -46,11 +46,11 @@ As of Nov 2020, BIND 9.17 is fully supported and regularly tested on the
 following systems:

 * Debian 9, 10
-* Ubuntu LTS 18.04, 20.04
-* Fedora 34
+* Ubuntu LTS 16.04, 20.04
+* Fedora 33
 * Red Hat Enterprise Linux / CentOS 7, 8
-* FreeBSD 11.4, 12.2, 13.0
-* OpenBSD 6.9
+* FreeBSD 11.4, 12.2
+* OpenBSD 6.8
 * Alpine Linux 3.13

 The amd64, i386, armhf and arm64 CPU architectures are all fully supported.
@@ -69,7 +69,7 @@ Server 2016, none of these are tested regularly by ISC.
 * Solaris 11
 * NetBSD
 * Other Linux distributions still supported by their vendors, such as:
-    * Ubuntu 20.10+
+    * Ubuntu 19.04+
    * Gentoo
    * Arch Linux
 * OpenWRT/LEDE 17.01+
@@ -86,7 +86,7 @@ assessed against the risk of adverse effect on officially supported
 platforms.

 * Platforms past or close to their respective EOL dates, such as:
-    * Ubuntu 14.04, 16.04 (Ubuntu ESM releases are not supported)
+    * Ubuntu 14.04, 18.10
    * CentOS 6
    * Debian Jessie
    * FreeBSD 10.x
@@ -34,10 +34,8 @@
 #include <isc/hex.h>
 #include <isc/lib.h>
 #include <isc/log.h>
-#include <isc/managers.h>
 #include <isc/md.h>
 #include <isc/mem.h>
-#include <isc/netmgr.h>
 #ifdef WIN32
 #include <isc/ntpaths.h>
 #endif /* ifdef WIN32 */
@@ -1738,7 +1736,6 @@ main(int argc, char *argv[]) {
 	dns_namelist_t namelist;
 	unsigned int resopt;
 	isc_appctx_t *actx = NULL;
-	isc_nm_t *netmgr = NULL;
 	isc_taskmgr_t *taskmgr = NULL;
 	isc_socketmgr_t *socketmgr = NULL;
 	isc_timermgr_t *timermgr = NULL;
@@ -1762,8 +1759,9 @@ main(int argc, char *argv[]) {
 	isc_mem_create(&mctx);

 	CHECK(isc_appctx_create(mctx, &actx));
-	isc_managers_create(mctx, 1, 0, 0, &netmgr, &taskmgr, &timermgr,
-			    &socketmgr);
+	CHECK(isc_taskmgr_createinctx(mctx, 1, 0, &taskmgr));
+	CHECK(isc_socketmgr_createinctx(mctx, &socketmgr));
+	CHECK(isc_timermgr_createinctx(mctx, &timermgr));

 	parse_args(argc, argv);

@@ -1783,8 +1781,8 @@ main(int argc, char *argv[]) {
 #endif /* ifndef WIN32 */

 	/* Create client */
-	result = dns_client_create(mctx, actx, taskmgr, socketmgr, timermgr, 0,
-				   &client, srcaddr4, srcaddr6);
+	result = dns_client_createx(mctx, actx, taskmgr, socketmgr, timermgr, 0,
+				    &client, srcaddr4, srcaddr6);
 	if (result != ISC_R_SUCCESS) {
 		delv_log(ISC_LOG_ERROR, "dns_client_create: %s",
 			 isc_result_totext(result));
@@ -1804,7 +1802,7 @@ main(int argc, char *argv[]) {
 	CHECK(convert_name(&qfn, &query_name, qname));

 	/* Set up resolution options */
-	resopt = DNS_CLIENTRESOPT_NOCDFLAG;
+	resopt = DNS_CLIENTRESOPT_ALLOWRUN | DNS_CLIENTRESOPT_NOCDFLAG;
 	if (no_sigs) {
 		resopt |= DNS_CLIENTRESOPT_NODNSSEC;
 	}
@@ -1866,7 +1864,15 @@ cleanup:
 	if (client != NULL) {
 		dns_client_destroy(&client);
 	}
-	isc_managers_destroy(&netmgr, &taskmgr, &timermgr, &socketmgr);
+	if (taskmgr != NULL) {
+		isc_taskmgr_destroy(&taskmgr);
+	}
+	if (timermgr != NULL) {
+		isc_timermgr_destroy(&timermgr);
+	}
+	if (socketmgr != NULL) {
+		isc_socketmgr_destroy(&socketmgr);
+	}
 	if (actx != NULL) {
 		isc_appctx_destroy(&actx);
 	}
@@ -480,8 +480,8 @@ abbreviation is unambiguous; for example, ``+cd`` is equivalent to
   ``+nssearch`` or ``+trace`` query option is used.

 ``+retry=T``
-   This option sets the number of times to retry UDP and TCP queries to server to ``T``
-   instead of the default, 2.  Unlike ``+tries``, this does not include
+   This option sets the number of times to retry UDP queries to server to ``T``
+   instead of the default, 2. Unlike ``+tries``, this does not include
   the initial query.

 ``+[no]rrcomments``
@@ -569,7 +569,7 @@ abbreviation is unambiguous; for example, ``+cd`` is equivalent to
   default queries from a name server.

 ``+tries=T``
-   This option sets the number of times to try UDP and TCP queries to server to ``T``
+   This option sets the number of times to try UDP queries to server to ``T``
   instead of the default, 3. If ``T`` is less than or equal to zero,
   the number of tries is silently rounded up to 1.

@@ -41,7 +41,6 @@
 #include <isc/hex.h>
 #include <isc/lang.h>
 #include <isc/log.h>
-#include <isc/managers.h>
 #include <isc/netaddr.h>
 #include <isc/netdb.h>
 #include <isc/nonce.h>
@@ -107,9 +106,9 @@ unsigned int timeout = 0;
 unsigned int extrabytes;
 isc_mem_t *mctx = NULL;
 isc_log_t *lctx = NULL;
-isc_nm_t *netmgr = NULL;
 isc_taskmgr_t *taskmgr = NULL;
 isc_task_t *global_task = NULL;
+isc_nm_t *netmgr = NULL;
 isc_sockaddr_t localaddr;
 isc_refcount_t sendcount = ATOMIC_VAR_INIT(0);
 isc_refcount_t recvcount = ATOMIC_VAR_INIT(0);
@@ -227,9 +226,8 @@ void (*dighost_shutdown)(void);

 /* forward declarations */

-#define cancel_lookup(l) _cancel_lookup(l, __FILE__, __LINE__)
 static void
-_cancel_lookup(dig_lookup_t *lookup, const char *file, unsigned int line);
+cancel_lookup(dig_lookup_t *lookup);

 static void
 recv_done(isc_nmhandle_t *handle, isc_result_t eresult, isc_region_t *region,
@@ -797,8 +795,8 @@ clone_lookup(dig_lookup_t *lookold, bool servers) {
 		memmove(looknew->ecs_addr, lookold->ecs_addr, len);
 	}

-	dns_name_copy(dns_fixedname_name(&lookold->fdomain),
-		      dns_fixedname_name(&looknew->fdomain));
+	dns_name_copynf(dns_fixedname_name(&lookold->fdomain),
+			dns_fixedname_name(&looknew->fdomain));

 	if (servers) {
 		clone_server_list(lookold->my_server_list,
@@ -1362,7 +1360,10 @@ setup_libs(void) {

 	isc_log_setdebuglevel(lctx, 0);

-	isc_managers_create(mctx, 1, 0, 0, &netmgr, &taskmgr, NULL, NULL);
+	netmgr = isc_nm_start(mctx, 1);
+
+	result = isc_taskmgr_create(mctx, 1, 0, netmgr, &taskmgr);
+	check_result(result, "isc_taskmgr_create");

 	result = isc_task_create(taskmgr, 0, &global_task);
 	check_result(result, "isc_task_create");
@@ -1540,13 +1541,12 @@ _destroy_lookup(dig_lookup_t *lookup) {
 	dig_server_t *s;
 	void *ptr;

-	REQUIRE(lookup != NULL);
-	REQUIRE(ISC_LIST_EMPTY(lookup->q));
-
 	debug("destroy_lookup");

 	isc_refcount_destroy(&lookup->references);

+	REQUIRE(ISC_LIST_EMPTY(lookup->q));
+
 	s = ISC_LIST_HEAD(lookup->my_server_list);
 	while (s != NULL) {
 		debug("freeing server %p belonging to %p", s, lookup);
@@ -1691,16 +1691,14 @@ _query_detach(dig_query_t **queryp, const char *file, unsigned int line) {
 		query_detach(&lookup->current_query);
 	}

+	if (ISC_LINK_LINKED(query, link)) {
+		ISC_LIST_UNLINK(lookup->q, query, link);
+	}
+
 	debug("%s:%u:query_detach(%p) = %" PRIuFAST32, file, line, query,
 	      isc_refcount_current(&query->references) - 1);

 	if (isc_refcount_decrement(&query->references) == 1) {
-		INSIST(query->readhandle == NULL);
-		INSIST(query->sendhandle == NULL);
-
-		if (ISC_LINK_LINKED(query, link)) {
-			ISC_LIST_UNLINK(lookup->q, query, link);
-		}
 		destroy_query(query, file, line);
 	}
 }
@@ -1754,18 +1752,13 @@ start_lookup(void) {
 * decremented, current_lookup will not be set to NULL.)
 */
 static void
-clear_current_lookup(void) {
+clear_current_lookup() {
 	dig_lookup_t *lookup = current_lookup;

 	INSIST(!free_now);

 	debug("clear_current_lookup()");

-	if (lookup == NULL) {
-		debug("current_lookup is already detached");
-		return;
-	}
-
 	if (ISC_LIST_HEAD(lookup->q) != NULL) {
 		debug("still have a worker");
 		return;
@@ -1890,7 +1883,7 @@ followup_lookup(dns_message_t *msg, dig_query_t *query, dns_section_t section) {
 					lookup->recurse = false;
 				}
 				domain = dns_fixedname_name(&lookup->fdomain);
-				dns_name_copy(name, domain);
+				dns_name_copynf(name, domain);
 			}
 			debug("adding server %s", namestr);
 			num = getaddresses(lookup, namestr, &lresult);
@@ -2065,6 +2058,7 @@ insert_soa(dig_lookup_t *lookup) {

 	result = dns_message_gettempname(lookup->sendmsg, &soaname);
 	check_result(result, "dns_message_gettempname");
+	dns_name_init(soaname, NULL);
 	dns_name_clone(lookup->name, soaname);
 	ISC_LIST_INIT(soaname->list);
 	ISC_LIST_APPEND(soaname->list, rdataset, link);
@@ -2162,6 +2156,7 @@ setup_lookup(dig_lookup_t *lookup) {
 	}
 	result = dns_message_gettempname(lookup->sendmsg, &lookup->name);
 	check_result(result, "dns_message_gettempname");
+	dns_name_init(lookup->name, NULL);

 	isc_buffer_init(&lookup->namebuf, lookup->name_space,
 			sizeof(lookup->name_space));
@@ -2205,6 +2200,7 @@ setup_lookup(dig_lookup_t *lookup) {
 		result = dns_message_gettempname(lookup->sendmsg,
 						 &lookup->oname);
 		check_result(result, "dns_message_gettempname");
+		dns_name_init(lookup->oname, NULL);
 		/* XXX Helper funct to conv char* to name? */
 		origin = lookup->origin->origin;
 #ifdef HAVE_LIBIDN2
@@ -2244,7 +2240,9 @@ setup_lookup(dig_lookup_t *lookup) {
 						name, lookup->oname,
 						lookup->name, &lookup->namebuf);
 				} else {
-					dns_name_copy(name, lookup->name);
+					result = dns_name_copy(
+						name, lookup->name,
+						&lookup->namebuf);
 				}
 			}
 			if (result != ISC_R_SUCCESS) {
@@ -2673,12 +2671,11 @@ send_done(isc_nmhandle_t *handle, isc_result_t eresult, void *arg) {
 /*%
 * Cancel a lookup, sending canceling reads on all existing sockets.
 */
-
 static void
-_cancel_lookup(dig_lookup_t *lookup, const char *file, unsigned int line) {
+cancel_lookup(dig_lookup_t *lookup) {
 	dig_query_t *query, *next;

-	debug("%s:%u:%s()", file, line, __func__);
+	debug("cancel_lookup()");
 	query = ISC_LIST_HEAD(lookup->q);
 	while (query != NULL) {
 		REQUIRE(DIG_VALID_QUERY(query));
@@ -2797,10 +2794,12 @@ start_tcp(dig_query_t *query) {
 		if (query->lookup->tls_mode) {
 			result = isc_tlsctx_createclient(&query->tlsctx);
 			RUNTIME_CHECK(result == ISC_R_SUCCESS);
-			isc_nm_tlsdnsconnect(netmgr, &localaddr,
-					     &query->sockaddr, tcp_connected,
-					     query, local_timeout, 0,
-					     query->tlsctx);
+			result = isc_nm_tlsdnsconnect(
+				netmgr, (isc_nmiface_t *)&localaddr,
+				(isc_nmiface_t *)&query->sockaddr,
+				tcp_connected, query, local_timeout, 0,
+				query->tlsctx);
+			check_result(result, "isc_nm_tlsdnsconnect");
 		} else if (query->lookup->https_mode) {
 			char uri[4096] = { 0 };
 			snprintf(uri, sizeof(uri), "https://%s:%u%s",
@@ -2815,14 +2814,18 @@ start_tcp(dig_query_t *query) {
 					query->tlsctx);
 			}

-			isc_nm_httpconnect(netmgr, &localaddr, &query->sockaddr,
-					   uri, !query->lookup->https_get,
-					   tcp_connected, query, query->tlsctx,
-					   local_timeout, 0);
+			result = isc_nm_httpconnect(
+				netmgr, (isc_nmiface_t *)&localaddr,
+				(isc_nmiface_t *)&query->sockaddr, uri,
+				!query->lookup->https_get, tcp_connected, query,
+				query->tlsctx, local_timeout, 0);
+			check_result(result, "isc_nm_httpconnect");
 		} else {
-			isc_nm_tcpdnsconnect(netmgr, &localaddr,
-					     &query->sockaddr, tcp_connected,
-					     query, local_timeout, 0);
+			result = isc_nm_tcpdnsconnect(
+				netmgr, (isc_nmiface_t *)&localaddr,
+				(isc_nmiface_t *)&query->sockaddr,
+				tcp_connected, query, local_timeout, 0);
+			check_result(result, "isc_nm_tcpdnsconnect");
 		}

 		/* XXX: set DSCP */
@@ -2897,16 +2900,13 @@ udp_ready(isc_nmhandle_t *handle, isc_result_t eresult, void *arg) {
 		query_detach(&query);
 		return;
 	} else if (eresult != ISC_R_SUCCESS) {
-		dig_lookup_t *l = query->lookup;
-
 		if (eresult != ISC_R_CANCELED) {
 			debug("udp setup failed: %s",
 			      isc_result_totext(eresult));
 		}
-
-		cancel_lookup(l);
-		lookup_detach(&l);
-		query_detach(&query);
+		if (query->tries == 0) {
+			query_detach(&query);
+		}
 		return;
 	}

@@ -2942,7 +2942,6 @@ static void
 start_udp(dig_query_t *query) {
 	isc_result_t result;
 	dig_query_t *next = NULL;
-	dig_query_t *connectquery = NULL;

 	REQUIRE(DIG_VALID_QUERY(query));

@@ -2994,10 +2993,24 @@ start_udp(dig_query_t *query) {
 		}
 	}

-	query_attach(query, &connectquery);
-	isc_nm_udpconnect(netmgr, &localaddr, &query->sockaddr, udp_ready,
-			  connectquery,
-			  (timeout ? timeout : UDP_TIMEOUT) * 1000, 0);
+	query->tries = 3;
+	do {
+		int local_timeout = timeout * 1000;
+		if (local_timeout == 0) {
+			local_timeout = UDP_TIMEOUT * 1000;
+		}
+
+		/*
+		 * On FreeBSD the UDP connect() call sometimes results
+		 * in a spurious transient EADDRINUSE. Try a few more times
+		 * before giving up.
+		 */
+		debug("isc_nm_udpconnect(): %d tries left", --query->tries);
+		result = isc_nm_udpconnect(netmgr, (isc_nmiface_t *)&localaddr,
+					   (isc_nmiface_t *)&query->sockaddr,
+					   udp_ready, query, local_timeout, 0);
+	} while (result != ISC_R_SUCCESS && query->tries > 0);
+	check_result(result, "isc_nm_udpconnect");
 }

 /*%
@@ -3104,8 +3117,7 @@ force_next(dig_query_t *query) {
 */
 static void
 requeue_or_update_exitcode(dig_lookup_t *lookup) {
-	if (lookup->eoferr == 0U && lookup->retries > 1) {
-		--lookup->retries;
+	if (lookup->eoferr == 0U) {
 		/*
 		 * Peer closed the connection prematurely for the first time
 		 * for this lookup.  Try again, keeping track of this failure.
@@ -3571,19 +3583,16 @@ recv_done(isc_nmhandle_t *handle, isc_result_t eresult, isc_region_t *region,
 	      region, arg);

 	LOCK_LOOKUP;
+	lookup_attach(query->lookup, &l);

 	isc_refcount_decrement0(&recvcount);
 	debug("recvcount=%" PRIuFAST32, isc_refcount_current(&recvcount));

 	if (eresult == ISC_R_CANCELED) {
 		debug("recv_done: cancel");
-		isc_nmhandle_detach(&query->readhandle);
-		query_detach(&query);
-		return;
+		goto detach_query;
 	}

-	lookup_attach(query->lookup, &l);
-
 	if (query->lookup->use_usec) {
 		TIME_NOW_HIRES(&query->time_recv);
 	} else {
@@ -4194,23 +4203,19 @@ cancel_all(void) {
 		return;
 	}
 	atomic_store(&cancel_now, true);
-	while (current_lookup != NULL) {
+	if (current_lookup != NULL) {
 		for (q = ISC_LIST_HEAD(current_lookup->q); q != NULL; q = nq) {
 			nq = ISC_LIST_NEXT(q, link);
 			debug("canceling pending query %p, belonging to %p", q,
 			      current_lookup);
 			if (q->readhandle != NULL) {
-				isc_nm_cancelread(q->readhandle);
+				isc_refcount_decrement0(&recvcount);
+				debug("recvcount=%" PRIuFAST32,
+				      isc_refcount_current(&recvcount));
 			}
 			query_detach(&q);
 		}
-
-		/*
-		 * current_lookup could have been detached via query_detach().
-		 */
-		if (current_lookup != NULL) {
-			lookup_detach(&current_lookup);
-		}
+		lookup_detach(&current_lookup);
 	}
 	l = ISC_LIST_HEAD(lookup_list);
 	while (l != NULL) {
@@ -4236,8 +4241,20 @@ destroy_libs(void) {
 		debug("freeing task");
 		isc_task_detach(&global_task);
 	}
+	/*
+	 * The taskmgr_destroy() and isc_nm_destroy() calls block until
+	 * all events are cleared.
+	 */
+	if (taskmgr != NULL) {
+		debug("freeing taskmgr");
+		isc_taskmgr_destroy(&taskmgr);
+	}

-	isc_managers_destroy(&netmgr, &taskmgr, NULL, NULL);
+	debug("closing down netmgr");
+	isc_nm_closedown(netmgr);
+
+	debug("destroy netmgr");
+	isc_nm_destroy(&netmgr);

 	LOCK_LOOKUP;
 	isc_refcount_destroy(&recvcount);
@@ -208,6 +208,7 @@ struct dig_query {
 	isc_time_t time_recv;
 	uint64_t byte_count;
 	isc_timer_t *timer;
+	uint8_t tries;
 	isc_tlsctx_t *tlsctx;
 };

@@ -379,7 +379,7 @@ chase_cnamechain(dns_message_t *msg, dns_name_t *qname) {
 		dns_rdataset_current(rdataset, &rdata);
 		result = dns_rdata_tostruct(&rdata, &cname, NULL);
 		check_result(result, "dns_rdata_tostruct");
-		dns_name_copy(&cname.cname, qname);
+		dns_name_copynf(&cname.cname, qname);
 		dns_rdata_freestruct(&cname);
 	}
 }
@@ -442,7 +442,7 @@ printmessage(dig_query_t *query, const isc_buffer_t *msgbuf, dns_message_t *msg,

 		/* Add AAAA and MX lookups. */
 		name = dns_fixedname_initname(&fixed);
-		dns_name_copy(query->lookup->name, name);
+		dns_name_copynf(query->lookup->name, name);
 		chase_cnamechain(msg, name);
 		dns_name_format(name, namestr, sizeof(namestr));
 		lookup = clone_lookup(query->lookup, false);
@@ -391,7 +391,7 @@ chase_cnamechain(dns_message_t *msg, dns_name_t *qname) {
 		dns_rdataset_current(rdataset, &rdata);
 		result = dns_rdata_tostruct(&rdata, &cname, NULL);
 		check_result(result, "dns_rdata_tostruct");
-		dns_name_copy(&cname.cname, qname);
+		dns_name_copynf(&cname.cname, qname);
 		dns_rdata_freestruct(&cname);
 	}
 }
@@ -448,7 +448,7 @@ printmessage(dig_query_t *query, const isc_buffer_t *msgbuf, dns_message_t *msg,

 		/* Add AAAA lookup. */
 		name = dns_fixedname_initname(&fixed);
-		dns_name_copy(query->lookup->name, name);
+		dns_name_copynf(query->lookup->name, name);
 		chase_cnamechain(msg, name);
 		dns_name_format(name, namestr, sizeof(namestr));
 		lookup = clone_lookup(query->lookup, false);
@@ -215,7 +215,7 @@ loadkey(char *filename, unsigned char *key_buf, unsigned int key_buf_size,
 	rdclass = dst_key_class(key);

 	name = dns_fixedname_initname(&fixed);
-	dns_name_copy(dst_key_name(key), name);
+	dns_name_copynf(dst_key_name(key), name);

 	dst_key_free(&key);
 }
@@ -185,7 +185,7 @@ loadkey(char *filename, unsigned char *key_buf, unsigned int key_buf_size,
 	rdclass = dst_key_class(key);

 	name = dns_fixedname_initname(&fixed);
-	dns_name_copy(dst_key_name(key), name);
+	dns_name_copynf(dst_key_name(key), name);

 	dst_key_free(&key);
 }
@@ -40,7 +40,6 @@
 #include <isc/file.h>
 #include <isc/hash.h>
 #include <isc/hex.h>
-#include <isc/managers.h>
 #include <isc/md.h>
 #include <isc/mem.h>
 #include <isc/mutex.h>
@@ -145,7 +144,6 @@ static unsigned int nsigned = 0, nretained = 0, ndropped = 0;
 static unsigned int nverified = 0, nverifyfailed = 0;
 static const char *directory = NULL, *dsdir = NULL;
 static isc_mutex_t namelock, statslock;
-static isc_nm_t *netmgr = NULL;
 static isc_taskmgr_t *taskmgr = NULL;
 static dns_db_t *gdb;		  /* The database */
 static dns_dbversion_t *gversion; /* The database version */
@@ -179,9 +177,8 @@ static bool remove_orphansigs = false;
 static bool remove_inactkeysigs = false;
 static bool output_dnssec_only = false;
 static bool output_stdout = false;
-static bool set_maxttl = false;
+bool set_maxttl = false;
 static dns_ttl_t maxttl = 0;
-static bool no_max_check = false;

 #define INCSTAT(counter)            \
 	if (printstats) {           \
@@ -201,7 +198,7 @@ savezonecut(dns_fixedname_t *fzonecut, dns_name_t *name) {
 	dns_name_t *result;

 	result = dns_fixedname_initname(fzonecut);
-	dns_name_copy(name, result);
+	dns_name_copynf(name, result);

 	return (result);
 }
@@ -1337,8 +1334,8 @@ get_soa_ttls(void) {
 	result = dns_rdataset_first(&soaset);
 	check_result(result, "dns_rdataset_first");
 	dns_rdataset_current(&soaset, &rdata);
+	zone_soa_min_ttl = dns_soa_getminimum(&rdata);
 	soa_ttl = soaset.ttl;
-	zone_soa_min_ttl = ISC_MIN(dns_soa_getminimum(&rdata), soa_ttl);
 	if (set_maxttl) {
 		zone_soa_min_ttl = ISC_MIN(zone_soa_min_ttl, maxttl);
 		soa_ttl = ISC_MIN(soa_ttl, maxttl);
@@ -2397,7 +2394,7 @@ nsec3ify(unsigned int hashalg, dns_iterations_t iterations,
 			break;
 		}
 		if (result == ISC_R_NOMORE) {
-			dns_name_copy(gorigin, nextname);
+			dns_name_copynf(gorigin, nextname);
 			done = true;
 		} else if (result != ISC_R_SUCCESS) {
 			fatal("iterating through the database failed: %s",
@@ -2534,7 +2531,7 @@ nsec3ify(unsigned int hashalg, dns_iterations_t iterations,
 			break;
 		}
 		if (result == ISC_R_NOMORE) {
-			dns_name_copy(gorigin, nextname);
+			dns_name_copynf(gorigin, nextname);
 			done = true;
 		} else if (result != ISC_R_SUCCESS) {
 			fatal("iterating through the database failed: %s",
@@ -3441,12 +3438,6 @@ main(int argc, char *argv[]) {

 		case 'H':
 			set_iter = true;
-			/* too-many is NOT DOCUMENTED */
-			if (strcmp(isc_commandline_argument, "too-many") == 0) {
-				nsec3iter = 151;
-				no_max_check = true;
-				break;
-			}
 			nsec3iter = strtoul(isc_commandline_argument, &endp, 0);
 			if (*endp != '\0') {
 				fatal("iterations must be numeric");
@@ -3865,6 +3856,7 @@ main(int argc, char *argv[]) {
 	warnifallksk(gdb);

 	if (IS_NSEC3) {
+		unsigned int max;
 		bool answer;

 		hash_length = dns_nsec3_hashlength(dns_hash_sha1);
@@ -3883,15 +3875,12 @@ main(int argc, char *argv[]) {
 			      "NSEC-only DNSKEY");
 		}

-		if (nsec3iter > dns_nsec3_maxiterations()) {
-			if (no_max_check) {
-				fprintf(stderr,
-					"Ignoring max iterations check.\n");
-			} else {
-				fatal("NSEC3 iterations too big. Maximum "
-				      "iterations allowed %u.",
-				      dns_nsec3_maxiterations());
-			}
+		result = dns_nsec3_maxiterations(gdb, NULL, mctx, &max);
+		check_result(result, "dns_nsec3_maxiterations()");
+		if (nsec3iter > max) {
+			fatal("NSEC3 iterations too big for weakest DNSKEY "
+			      "strength. Maximum iterations allowed %u.",
+			      max);
 		}
 	} else {
 		hashlist_init(&hashlist, 0, 0); /* silence clang */
@@ -3964,7 +3953,11 @@ main(int argc, char *argv[]) {
 	print_time(outfp);
 	print_version(outfp);

-	isc_managers_create(mctx, ntasks, 0, 0, &netmgr, &taskmgr, NULL, NULL);
+	result = isc_taskmgr_create(mctx, ntasks, 0, NULL, &taskmgr);
+	if (result != ISC_R_SUCCESS) {
+		fatal("failed to create task manager: %s",
+		      isc_result_totext(result));
+	}

 	master = NULL;
 	result = isc_task_create(taskmgr, 0, &master);
@@ -4015,7 +4008,7 @@ main(int argc, char *argv[]) {
 	for (i = 0; i < (int)ntasks; i++) {
 		isc_task_detach(&tasks[i]);
 	}
-	isc_managers_destroy(&netmgr, &taskmgr, NULL, NULL);
+	isc_taskmgr_destroy(&taskmgr);
 	isc_mem_put(mctx, tasks, ntasks * sizeof(isc_task_t *));
 	postsign();
 	TIME_NOW(&sign_finish);
@@ -123,8 +123,6 @@ options {\n\
 	tcp-initial-timeout 300;\n\
 	tcp-keepalive-timeout 300;\n\
 	tcp-listen-queue 10;\n\
-	tcp-receive-buffer 0;\n\
-	tcp-send-buffer 0;\n\
 #	tkey-dhkey <none>\n\
 #	tkey-domain <none>\n\
 #	tkey-gssapi-credential <none>\n\
@@ -135,8 +133,6 @@ options {\n\
 #	treat-cr-as-space <obsolete>;\n\
 	trust-anchor-telemetry yes;\n\
 #	use-id-pool <obsolete>;\n\
-	udp-receive-buffer 0;\n\
-	udp-send-buffer 0;\n\
 \n\
 	/* view */\n\
 	allow-new-zones no;\n\
@@ -199,8 +195,8 @@ options {\n\
 	root-key-sentinel yes;\n\
 	servfail-ttl 1;\n\
 #	sortlist <none>\n\
-	stale-answer-client-timeout off;\n\
 	stale-answer-enable false;\n\
+	stale-answer-client-timeout 1800; /* in milliseconds */\n\
 	stale-answer-ttl 30; /* 30 seconds */\n\
 	stale-cache-enable false;\n\
 	stale-refresh-time 30; /* 30 seconds */\n\
@@ -229,7 +225,7 @@ options {\n\
 	dnssec-update-mode maintain;\n\
 #	forward <none>\n\
 #	forwarders <none>\n\
-#	inline-signing no;\n\
+	inline-signing no;\n\
 	ixfr-from-differences false;\n\
 #	maintain-ixfr-base <obsolete>;\n\
 #	max-ixfr-log-size <obsolete>\n\
@@ -1164,9 +1164,10 @@ add_listener(named_controls_t *cp, controllistener_t **listenerp,
 	}
 #endif

-	CHECK(isc_nm_listentcp(
-		named_g_netmgr, &listener->address, control_newconn, listener,
-		sizeof(controlconnection_t), 5, NULL, &listener->sock));
+	CHECK(isc_nm_listentcp(named_g_nm, (isc_nmiface_t *)&listener->address,
+			       control_newconn, listener,
+			       sizeof(controlconnection_t), 5, NULL,
+			       &listener->sock));
 #if 0
 	/* XXX: no unix socket support yet */
 	if (type == isc_socktype_unix) {
@@ -1466,7 +1467,6 @@ named_controls_create(named_server_t *server, named_controls_t **ctrlsp) {

 	ISC_LIST_INIT(controls->listeners);

-	atomic_init(&controls->shuttingdown, false);
 	isc_mutex_init(&controls->symtab_lock);
 	LOCK(&controls->symtab_lock);
 	result = isccc_cc_createsymtab(&controls->symtab);
@@ -62,7 +62,7 @@ EXTERN bool named_g_run_done INIT(false);
 */
 EXTERN isc_timermgr_t *named_g_timermgr INIT(NULL);
 EXTERN isc_socketmgr_t *named_g_socketmgr INIT(NULL);
-EXTERN isc_nm_t *named_g_netmgr INIT(NULL);
+EXTERN isc_nm_t *named_g_nm INIT(NULL);
 EXTERN cfg_parser_t *named_g_parser INIT(NULL);
 EXTERN cfg_parser_t *named_g_addparser INIT(NULL);
 EXTERN const char *named_g_version     INIT(PACKAGE_VERSION);
@@ -31,7 +31,6 @@
 #include <isc/hash.h>
 #include <isc/hp.h>
 #include <isc/httpd.h>
-#include <isc/managers.h>
 #include <isc/netmgr.h>
 #include <isc/os.h>
 #include <isc/platform.h>
@@ -206,6 +205,8 @@ assertion_failed(const char *file, int line, isc_assertiontype_t type,
 		 const char *cond) {
 	void *tracebuf[BACKTRACE_MAXFRAME];
 	int nframes;
+	isc_result_t result;
+	const char *logsuffix = "";

 	/*
 	 * Handle assertion failures.
@@ -218,23 +219,32 @@ assertion_failed(const char *file, int line, isc_assertiontype_t type,
 		 */
 		isc_assertion_setcallback(NULL);

-		nframes = isc_backtrace(tracebuf, BACKTRACE_MAXFRAME);
+		result = isc_backtrace_gettrace(tracebuf, BACKTRACE_MAXFRAME,
+						&nframes);
+		if (result == ISC_R_SUCCESS && nframes > 0) {
+			logsuffix = ", back trace";
+		}
 		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 			      NAMED_LOGMODULE_MAIN, ISC_LOG_CRITICAL,
 			      "%s:%d: %s(%s) failed%s", file, line,
-			      isc_assertion_typetotext(type), cond,
-			      (nframes > 0) ? ", back trace" : "");
-		if (nframes > 0) {
-			char **strs = isc_backtrace_symbols(tracebuf, nframes);
-			if (strs != NULL) {
-				for (int i = 0; i < nframes; i++) {
-					isc_log_write(named_g_lctx,
-						      NAMED_LOGCATEGORY_GENERAL,
-						      NAMED_LOGMODULE_MAIN,
-						      ISC_LOG_CRITICAL, "%s",
-						      strs[i]);
-				}
+			      isc_assertion_typetotext(type), cond, logsuffix);
+		if (result == ISC_R_SUCCESS) {
+#if HAVE_BACKTRACE_SYMBOLS
+			char **strs = backtrace_symbols(tracebuf, nframes);
+			for (int i = 0; i < nframes; i++) {
+				isc_log_write(named_g_lctx,
+					      NAMED_LOGCATEGORY_GENERAL,
+					      NAMED_LOGMODULE_MAIN,
+					      ISC_LOG_CRITICAL, "%s", strs[i]);
 			}
+#else  /* HAVE_BACKTRACE_SYMBOLS */
+			for (int i = 0; i < nframes; i++) {
+				isc_log_write(
+					named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+					NAMED_LOGMODULE_MAIN, ISC_LOG_CRITICAL,
+					"#%d %p in ??", i, tracebuf[i]);
+			}
+#endif /* HAVE_BACKTRACE_SYMBOLS */
 		}
 		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 			      NAMED_LOGMODULE_MAIN, ISC_LOG_CRITICAL,
@@ -320,14 +330,11 @@ library_unexpected_error(const char *file, int line, const char *format,
 static void
 usage(void) {
 	fprintf(stderr, "usage: named [-4|-6] [-c conffile] [-d debuglevel] "
-			"[-D comment] [-E engine]\n"
-			"             [-f|-g] [-L logfile] [-n number_of_cpus] "
-			"[-p port] [-s]\n"
-			"             [-S sockets] [-t chrootdir] [-u "
-			"username] [-U listeners]\n"
-			"             [-X lockfile] [-m "
-			"{usage|trace|record|size|mctx}]\n"
-			"             [-M fill|nofill]\n"
+			"[-E engine] [-f|-g]\n"
+			"             [-n number_of_cpus] [-p port] [-s] "
+			"[-S sockets] [-t chrootdir]\n"
+			"             [-u username] [-U listeners] "
+			"[-m {usage|trace|record|size|mctx}]\n"
 			"usage: named [-v|-V]\n");
 }

@@ -938,17 +945,45 @@ create_managers(void) {
 		      "using %u UDP listener%s per interface", named_g_udpdisp,
 		      named_g_udpdisp == 1 ? "" : "s");

-	result = isc_managers_create(named_g_mctx, named_g_cpus,
-				     0 /* quantum */, maxsocks, &named_g_netmgr,
-				     &named_g_taskmgr, &named_g_timermgr,
-				     &named_g_socketmgr);
-	if (result != ISC_R_SUCCESS) {
-		return (result);
+	/*
+	 * We have ncpus network threads, ncpus worker threads, ncpus
+	 * old network threads - make it 4x just to be safe. The memory
+	 * impact is negligible.
+	 */
+	isc_hp_init(4 * named_g_cpus);
+	named_g_nm = isc_nm_start(named_g_mctx, named_g_cpus);
+	if (named_g_nm == NULL) {
+		UNEXPECTED_ERROR(__FILE__, __LINE__, "isc_nm_start() failed");
+		return (ISC_R_UNEXPECTED);
 	}

-	isc_socketmgr_maxudp(named_g_socketmgr, maxudp);
-	isc_nm_maxudp(named_g_netmgr, maxudp);
+	result = isc_taskmgr_create(named_g_mctx, named_g_cpus, 0, named_g_nm,
+				    &named_g_taskmgr);
+	if (result != ISC_R_SUCCESS) {
+		UNEXPECTED_ERROR(__FILE__, __LINE__,
+				 "isc_taskmgr_create() failed: %s",
+				 isc_result_totext(result));
+		return (ISC_R_UNEXPECTED);
+	}

+	result = isc_timermgr_create(named_g_mctx, &named_g_timermgr);
+	if (result != ISC_R_SUCCESS) {
+		UNEXPECTED_ERROR(__FILE__, __LINE__,
+				 "isc_timermgr_create() failed: %s",
+				 isc_result_totext(result));
+		return (ISC_R_UNEXPECTED);
+	}
+
+	result = isc_socketmgr_create2(named_g_mctx, &named_g_socketmgr,
+				       maxsocks, named_g_cpus);
+	if (result != ISC_R_SUCCESS) {
+		UNEXPECTED_ERROR(__FILE__, __LINE__,
+				 "isc_socketmgr_create() failed: %s",
+				 isc_result_totext(result));
+		return (ISC_R_UNEXPECTED);
+	}
+	isc_socketmgr_maxudp(named_g_socketmgr, maxudp);
+	isc_nm_maxudp(named_g_nm, maxudp);
 	result = isc_socketmgr_getmaxsockets(named_g_socketmgr, &socks);
 	if (result == ISC_R_SUCCESS) {
 		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
@@ -961,8 +996,25 @@ create_managers(void) {

 static void
 destroy_managers(void) {
-	isc_managers_destroy(&named_g_netmgr, &named_g_taskmgr,
-			     &named_g_timermgr, &named_g_socketmgr);
+	/*
+	 * isc_nm_closedown() closes all active connections, freeing
+	 * attached clients and other resources and preventing new
+	 * connections from being established, but it not does not
+	 * stop all processing or destroy the netmgr yet.
+	 */
+	isc_nm_closedown(named_g_nm);
+
+	/*
+	 * isc_taskmgr_destroy() will block until all tasks have exited.
+	 */
+	isc_taskmgr_destroy(&named_g_taskmgr);
+	isc_timermgr_destroy(&named_g_timermgr);
+	isc_socketmgr_destroy(&named_g_socketmgr);
+
+	/*
+	 * At this point is safe to destroy the netmgr.
+	 */
+	isc_nm_destroy(&named_g_nm);
 }

 static void
@@ -276,6 +276,7 @@ OPTIONS
  	hostname ( quoted_string | none );
  	http-port integer;
  	https-port integer;
+  	inline-signing boolean;
  	interface-interval duration;
  	ipv4only-contact string;
  	ipv4only-enable boolean;
@@ -432,8 +433,6 @@ OPTIONS
  	tcp-initial-timeout integer;
  	tcp-keepalive-timeout integer;
  	tcp-listen-queue integer;
-  	tcp-receive-buffer integer;
-  	tcp-send-buffer integer;
  	tkey-dhkey quoted_string integer;
  	tkey-domain quoted_string;
  	tkey-gssapi-credential quoted_string;
@@ -450,8 +449,6 @@ OPTIONS
  	transfers-per-ns integer;
  	trust-anchor-telemetry boolean; // experimental
  	try-tcp-refresh boolean;
-  	udp-receive-buffer integer;
-  	udp-send-buffer integer;
  	update-check-ksk boolean;
  	use-alt-transfer-source boolean;
  	use-v4-udp-ports { portrange; ... };
@@ -669,6 +666,7 @@ VIEW
  	forwarders [ port integer ] [ dscp integer ] { ( ipv4_address
  	    | ipv6_address ) [ port integer ] [ dscp integer ]; ... };
  	glue-cache boolean;// deprecated
+  	inline-signing boolean;
  	ipv4only-contact string;
  	ipv4only-enable boolean;
  	ipv4only-server string;
@@ -5081,8 +5081,8 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist, cfg_obj_t *config,
 	/*
 	 * Copy the aclenv object.
 	 */
-	dns_aclenv_copy(view->aclenv, ns_interfacemgr_getaclenv(
-					      named_g_server->interfacemgr));
+	dns_aclenv_copy(&view->aclenv, ns_interfacemgr_getaclenv(
+					       named_g_server->interfacemgr));

 	/*
 	 * Configure the "match-clients" and "match-destinations" ACL.
@@ -7330,7 +7330,7 @@ dotat(dns_keytable_t *keytable, dns_keynode_t *keynode, dns_name_t *keyname,
 	tat->view = NULL;
 	dns_rdataset_init(&tat->rdataset);
 	dns_rdataset_init(&tat->sigrdataset);
-	dns_name_copy(keyname, dns_fixedname_initname(&tat->keyname));
+	dns_name_copynf(keyname, dns_fixedname_initname(&tat->keyname));
 	result = get_tat_qname(dns_fixedname_initname(&tat->tatname), keyname,
 			       keynode);
 	if (result != ISC_R_SUCCESS) {
@@ -8503,10 +8503,6 @@ load_configuration(const char *filename, named_server_t *server,
 	uint32_t reserved;
 	uint32_t udpsize;
 	uint32_t transfer_message_size;
-	uint32_t recv_tcp_buffer_size;
-	uint32_t send_tcp_buffer_size;
-	uint32_t recv_udp_buffer_size;
-	uint32_t send_udp_buffer_size;
 	named_cache_t *nsc;
 	named_cachelist_t cachelist, tmpcachelist;
 	ns_altsecret_t *altsecret;
@@ -8778,9 +8774,6 @@ load_configuration(const char *filename, named_server_t *server,
 					     named_g_aclconfctx),
 	       "configuring statistics server(s)");

-	/*
-	 * Configure the network manager
-	 */
 	obj = NULL;
 	result = named_config_get(maps, "tcp-initial-timeout", &obj);
 	INSIST(result == ISC_R_SUCCESS);
@@ -8847,46 +8840,7 @@ load_configuration(const char *filename, named_server_t *server,
 		advertised = MAX_ADVERTISED_TIMEOUT;
 	}

-	isc_nm_settimeouts(named_g_netmgr, initial, idle, keepalive,
-			   advertised);
-
-#define CAP_IF_NOT_ZERO(v, min, max)        \
-	if (v > 0 && v < min) {             \
-		recv_tcp_buffer_size = min; \
-	} else if (v > max) {               \
-		recv_tcp_buffer_size = max; \
-	}
-
-	/* Set the kernel send and receive buffer sizes */
-	obj = NULL;
-	result = named_config_get(maps, "tcp-receive-buffer", &obj);
-	INSIST(result == ISC_R_SUCCESS);
-	recv_tcp_buffer_size = cfg_obj_asuint32(obj);
-	CAP_IF_NOT_ZERO(recv_tcp_buffer_size, 4096, INT32_MAX);
-
-	obj = NULL;
-	result = named_config_get(maps, "tcp-send-buffer", &obj);
-	INSIST(result == ISC_R_SUCCESS);
-	send_tcp_buffer_size = cfg_obj_asuint32(obj);
-	CAP_IF_NOT_ZERO(send_tcp_buffer_size, 4096, INT32_MAX);
-
-	obj = NULL;
-	result = named_config_get(maps, "udp-receive-buffer", &obj);
-	INSIST(result == ISC_R_SUCCESS);
-	recv_udp_buffer_size = cfg_obj_asuint32(obj);
-	CAP_IF_NOT_ZERO(recv_udp_buffer_size, 4096, INT32_MAX);
-
-	obj = NULL;
-	result = named_config_get(maps, "udp-send-buffer", &obj);
-	INSIST(result == ISC_R_SUCCESS);
-	send_udp_buffer_size = cfg_obj_asuint32(obj);
-	CAP_IF_NOT_ZERO(send_udp_buffer_size, 4096, INT32_MAX);
-
-	isc_nm_setnetbuffers(named_g_netmgr, recv_tcp_buffer_size,
-			     send_tcp_buffer_size, recv_udp_buffer_size,
-			     send_udp_buffer_size);
-
-#undef CAP_IF_NOT_ZERO
+	isc_nm_settimeouts(named_g_nm, initial, idle, keepalive, advertised);

 	/*
 	 * Configure sets of UDP query source ports.
@@ -9220,7 +9174,7 @@ load_configuration(const char *filename, named_server_t *server,
 		dns_kasp_detach(&kasp);
 	}
 	/*
-	 * Create the built-in kasp policies ("default", "insecure").
+	 * Create the built-in kasp policies ("default", "none").
 	 */
 	kasp = NULL;
 	CHECK(cfg_kasp_fromconfig(NULL, "default", named_g_mctx, named_g_lctx,
@@ -9230,7 +9184,7 @@ load_configuration(const char *filename, named_server_t *server,
 	dns_kasp_detach(&kasp);

 	kasp = NULL;
-	CHECK(cfg_kasp_fromconfig(NULL, "insecure", named_g_mctx, named_g_lctx,
+	CHECK(cfg_kasp_fromconfig(NULL, "none", named_g_mctx, named_g_lctx,
 				  &kasplist, &kasp));
 	INSIST(kasp != NULL);
 	dns_kasp_freeze(kasp);
@@ -9914,9 +9868,8 @@ view_loaded(void *arg) {
 static isc_result_t
 load_zones(named_server_t *server, bool init, bool reconfig) {
 	isc_result_t result;
-	isc_taskmgr_t *taskmgr = dns_zonemgr_gettaskmgr(server->zonemgr);
-	ns_zoneload_t *zl = NULL;
-	dns_view_t *view = NULL;
+	dns_view_t *view;
+	ns_zoneload_t *zl;

 	zl = isc_mem_get(server->mctx, sizeof(*zl));
 	zl->server = server;
@@ -9968,28 +9921,19 @@ cleanup:
 	if (isc_refcount_decrement(&zl->refs) == 1) {
 		isc_refcount_destroy(&zl->refs);
 		isc_mem_put(server->mctx, zl, sizeof(*zl));
-	}
-
-	if (init) {
+	} else if (init) {
 		/*
-		 * If we're setting up the server for the first time, set
-		 * the task manager into privileged mode; this ensures
-		 * that no other tasks will begin to run until after zone
-		 * loading is complete. We won't return from exclusive mode
-		 * until the loading is finished; we can then drop out of
-		 * privileged mode.
-		 *
-		 * We do *not* want to do this in the case of reload or
-		 * reconfig, as loading a large zone could cause the server
-		 * to be inactive for too long a time.
+		 * Place the task manager into privileged mode.  This
+		 * ensures that after we leave task-exclusive mode, no
+		 * other tasks will be able to run except for the ones
+		 * that are loading zones. (This should only be done during
+		 * the initial server setup; it isn't necessary during
+		 * a reload.)
 		 */
-		isc_taskmgr_setmode(taskmgr, isc_taskmgrmode_privileged);
-		isc_task_endexclusive(server->task);
-		isc_taskmgr_setmode(taskmgr, isc_taskmgrmode_normal);
-	} else {
-		isc_task_endexclusive(server->task);
+		isc_taskmgr_setprivilegedmode(named_g_taskmgr);
 	}

+	isc_task_endexclusive(server->task);
 	return (result);
 }

@@ -10016,7 +9960,7 @@ run_server(isc_task_t *task, isc_event_t *event) {

 	CHECKFATAL(ns_interfacemgr_create(
 			   named_g_mctx, server->sctx, named_g_taskmgr,
-			   named_g_timermgr, named_g_socketmgr, named_g_netmgr,
+			   named_g_timermgr, named_g_socketmgr, named_g_nm,
 			   named_g_dispatchmgr, server->task, named_g_udpdisp,
 			   geoip, named_g_cpus, &server->interfacemgr),
 		   "creating interface manager");
@@ -10247,7 +10191,7 @@ named_server_create(isc_mem_t *mctx, named_server_t **serverp) {
 	 * startup and shutdown of the server, as well as all exclusive
 	 * tasks.
 	 */
-	CHECKFATAL(isc_task_create_bound(named_g_taskmgr, 0, &server->task, 0),
+	CHECKFATAL(isc_task_create(named_g_taskmgr, 0, &server->task),
 		   "creating server task");
 	isc_task_setname(server->task, "server", server);
 	isc_taskmgr_setexcltask(named_g_taskmgr, server->task);
@@ -10286,7 +10230,7 @@ named_server_create(isc_mem_t *mctx, named_server_t **serverp) {

 	CHECKFATAL(dns_zonemgr_create(named_g_mctx, named_g_taskmgr,
 				      named_g_timermgr, named_g_socketmgr,
-				      named_g_netmgr, &server->zonemgr),
+				      named_g_nm, &server->zonemgr),
 		   "dns_zonemgr_create");
 	CHECKFATAL(dns_zonemgr_setsize(server->zonemgr, 1000), "dns_zonemgr_"
 							       "setsize");
@@ -10326,7 +10270,7 @@ named_server_create(isc_mem_t *mctx, named_server_t **serverp) {
 				    isc_sockstatscounter_max),
 		   "isc_stats_create");
 	isc_socketmgr_setstats(named_g_socketmgr, server->sockstats);
-	isc_nm_setstats(named_g_netmgr, server->sockstats);
+	isc_nm_setstats(named_g_nm, server->sockstats);

 	CHECKFATAL(isc_stats_create(named_g_mctx, &server->zonestats,
 				    dns_zonestatscounter_max),
@@ -11487,7 +11431,7 @@ resume:
 				";\n; Cache dump of view '%s' (cache %s)\n;\n",
 				dctx->view->view->name,
 				dns_cache_getname(dctx->view->view->cache));
-			result = dns_master_dumptostreamasync(
+			result = dns_master_dumptostreaminc(
 				dctx->mctx, dctx->cache, NULL, style, dctx->fp,
 				dctx->task, dumpdone, dctx, &dctx->mdctx);
 			if (result == DNS_R_CONTINUE) {
@@ -11547,7 +11491,7 @@ resume:
 				goto nextzone;
 			}
 			dns_db_currentversion(dctx->db, &dctx->version);
-			result = dns_master_dumptostreamasync(
+			result = dns_master_dumptostreaminc(
 				dctx->mctx, dctx->db, dctx->version, style,
 				dctx->fp, dctx->task, dumpdone, dctx,
 				&dctx->mdctx);
@@ -13749,13 +13693,13 @@ do_addzone(named_server_t *server, ns_cfgctx_t *cfg, dns_view_t *view,
 #ifndef HAVE_LMDB
 	FILE *fp = NULL;
 	bool cleanup_config = false;
-#else /* HAVE_LMDB */
+#else  /* HAVE_LMDB */
 	MDB_txn *txn = NULL;
 	MDB_dbi dbi;
-	bool locked = false;

 	UNUSED(zoneconf);
-#endif
+	LOCK(&view->new_zone_lock);
+#endif /* HAVE_LMDB */

 	/* Zone shouldn't already exist */
 	if (redirect) {
@@ -13775,16 +13719,12 @@ do_addzone(named_server_t *server, ns_cfgctx_t *cfg, dns_view_t *view,
 		goto cleanup;
 	}

-	result = isc_task_beginexclusive(server->task);
-	RUNTIME_CHECK(result == ISC_R_SUCCESS);
-
 #ifndef HAVE_LMDB
 	/*
 	 * Make sure we can open the configuration save file
 	 */
 	result = isc_stdio_open(view->new_zone_file, "a", &fp);
 	if (result != ISC_R_SUCCESS) {
-		isc_task_endexclusive(server->task);
 		TCHECK(putstr(text, "unable to create '"));
 		TCHECK(putstr(text, view->new_zone_file));
 		TCHECK(putstr(text, "': "));
@@ -13795,12 +13735,9 @@ do_addzone(named_server_t *server, ns_cfgctx_t *cfg, dns_view_t *view,
 	(void)isc_stdio_close(fp);
 	fp = NULL;
 #else  /* HAVE_LMDB */
-	LOCK(&view->new_zone_lock);
-	locked = true;
 	/* Make sure we can open the NZD database */
 	result = nzd_writable(view);
 	if (result != ISC_R_SUCCESS) {
-		isc_task_endexclusive(server->task);
 		TCHECK(putstr(text, "unable to open NZD database for '"));
 		TCHECK(putstr(text, view->new_zone_db));
 		TCHECK(putstr(text, "'"));
@@ -13809,6 +13746,9 @@ do_addzone(named_server_t *server, ns_cfgctx_t *cfg, dns_view_t *view,
 	}
 #endif /* HAVE_LMDB */

+	result = isc_task_beginexclusive(server->task);
+	RUNTIME_CHECK(result == ISC_R_SUCCESS);
+
 	/* Mark view unfrozen and configure zone */
 	dns_view_thaw(view);
 	result = configure_zone(cfg->config, zoneobj, cfg->vconfig,
@@ -13912,9 +13852,7 @@ cleanup:
 	if (txn != NULL) {
 		(void)nzd_close(&txn, false);
 	}
-	if (locked) {
-		UNLOCK(&view->new_zone_lock);
-	}
+	UNLOCK(&view->new_zone_lock);
 #endif /* HAVE_LMDB */

 	if (zone != NULL) {
@@ -13938,7 +13876,7 @@ do_modzone(named_server_t *server, ns_cfgctx_t *cfg, dns_view_t *view,
 #else  /* HAVE_LMDB */
 	MDB_txn *txn = NULL;
 	MDB_dbi dbi;
-	bool locked = false;
+	LOCK(&view->new_zone_lock);
 #endif /* HAVE_LMDB */

 	/* Zone must already exist */
@@ -13984,8 +13922,6 @@ do_modzone(named_server_t *server, ns_cfgctx_t *cfg, dns_view_t *view,
 	(void)isc_stdio_close(fp);
 	fp = NULL;
 #else  /* HAVE_LMDB */
-	LOCK(&view->new_zone_lock);
-	locked = true;
 	/* Make sure we can open the NZD database */
 	result = nzd_writable(view);
 	if (result != ISC_R_SUCCESS) {
@@ -14138,9 +14074,7 @@ cleanup:
 	if (txn != NULL) {
 		(void)nzd_close(&txn, false);
 	}
-	if (locked) {
-		UNLOCK(&view->new_zone_lock);
-	}
+	UNLOCK(&view->new_zone_lock);
 #endif /* HAVE_LMDB */

 	if (zone != NULL) {
@@ -14852,8 +14786,7 @@ named_server_signing(named_server_t *server, isc_lex_t *lex,
 				return (ISC_R_BADNUMBER);
 			}

-			if (hash > 0xffU || flags > 0xffU ||
-			    iter > dns_nsec3_maxiterations()) {
+			if (hash > 0xffU || flags > 0xffU) {
 				return (ISC_R_RANGE);
 			}

@@ -14893,7 +14826,7 @@ named_server_signing(named_server_t *server, isc_lex_t *lex,
 		CHECK(ISC_R_UNEXPECTEDEND);
 	}

-	if (dns_zone_getkasp(zone) != NULL) {
+	if (dns_zone_use_kasp(zone)) {
 		(void)putstr(text, "zone uses dnssec-policy, use rndc dnssec "
 				   "command instead");
 		(void)putnull(text);
@@ -15001,8 +14934,8 @@ named_server_dnssec(named_server_t *server, isc_lex_t *lex,
 	isc_result_t result = ISC_R_SUCCESS;
 	dns_zone_t *zone = NULL;
 	dns_kasp_t *kasp = NULL;
-	dns_dnsseckeylist_t keys, dnskeys;
-	dns_dnsseckey_t *key, *key_next = NULL;
+	dns_dnsseckeylist_t keys;
+	dns_dnsseckey_t *key;
 	char *ptr, *zonetext = NULL;
 	const char *msg = NULL;
 	/* variables for -checkds */
@@ -15019,11 +14952,6 @@ named_server_dnssec(named_server_t *server, isc_lex_t *lex,
 	isc_stdtime_t now, when;
 	isc_time_t timenow, timewhen;
 	const char *dir;
-	dns_name_t *origin;
-	dns_db_t *db = NULL;
-	dns_dbnode_t *node = NULL;
-	dns_dbversion_t *version = NULL;
-	dns_rdataset_t keyset;

 	/* Skip the command name. */
 	ptr = next_token(lex, text);
@@ -15042,9 +14970,7 @@ named_server_dnssec(named_server_t *server, isc_lex_t *lex,
 	now = isc_time_seconds(&timenow);
 	when = now;

-	ISC_LIST_INIT(dnskeys);
 	ISC_LIST_INIT(keys);
-	dns_rdataset_init(&keyset);

 	if (strcasecmp(ptr, "-status") == 0) {
 		status = true;
@@ -15157,46 +15083,13 @@ named_server_dnssec(named_server_t *server, isc_lex_t *lex,

 	/* Get DNSSEC keys. */
 	dir = dns_zone_getkeydirectory(zone);
-	origin = dns_zone_getorigin(zone);
-	CHECK(dns_zone_getdb(zone, &db));
-	CHECK(dns_db_findnode(db, origin, false, &node));
-	dns_db_currentversion(db, &version);
-	/* Get keys from private key files. */
-	dns_zone_lock_keyfiles(zone);
+	LOCK(&kasp->lock);
 	result = dns_dnssec_findmatchingkeys(dns_zone_getorigin(zone), dir, now,
 					     dns_zone_getmctx(zone), &keys);
-	dns_zone_unlock_keyfiles(zone);
+	UNLOCK(&kasp->lock);
 	if (result != ISC_R_SUCCESS && result != ISC_R_NOTFOUND) {
 		goto cleanup;
 	}
-	/* Get public keys (dnskeys). */
-	result = dns_db_findrdataset(db, node, version, dns_rdatatype_dnskey,
-				     dns_rdatatype_none, 0, &keyset, NULL);
-	if (result == ISC_R_SUCCESS) {
-		CHECK(dns_dnssec_keylistfromrdataset(
-			origin, dir, dns_zone_getmctx(zone), &keyset, NULL,
-			NULL, false, false, &dnskeys));
-	} else if (result != ISC_R_NOTFOUND) {
-		CHECK(result);
-	}
-	/* Add new 'dnskeys' to 'keys'. */
-	for (dns_dnsseckey_t *k1 = ISC_LIST_HEAD(dnskeys); k1 != NULL;
-	     k1 = key_next) {
-		dns_dnsseckey_t *k2 = NULL;
-		key_next = ISC_LIST_NEXT(k1, link);
-
-		for (k2 = ISC_LIST_HEAD(keys); k2 != NULL;
-		     k2 = ISC_LIST_NEXT(k2, link)) {
-			if (dst_key_compare(k1->key, k2->key)) {
-				break;
-			}
-		}
-		/* No match found, add the new key. */
-		if (k2 == NULL) {
-			ISC_LIST_UNLINK(dnskeys, k1, link);
-			ISC_LIST_APPEND(keys, k1, link);
-		}
-	}

 	if (status) {
 		/*
@@ -15316,24 +15209,6 @@ cleanup:
 		(void)putnull(text);
 	}

-	if (dns_rdataset_isassociated(&keyset)) {
-		dns_rdataset_disassociate(&keyset);
-	}
-	if (node != NULL) {
-		dns_db_detachnode(db, &node);
-	}
-	if (version != NULL) {
-		dns_db_closeversion(db, &version, false);
-	}
-	if (db != NULL) {
-		dns_db_detach(&db);
-	}
-
-	while (!ISC_LIST_EMPTY(dnskeys)) {
-		key = ISC_LIST_HEAD(dnskeys);
-		ISC_LIST_UNLINK(dnskeys, key, link);
-		dns_dnsseckey_destroy(dns_zone_getmctx(zone), &key);
-	}
 	while (!ISC_LIST_EMPTY(keys)) {
 		key = ISC_LIST_HEAD(keys);
 		ISC_LIST_UNLINK(keys, key, link);
@@ -16408,7 +16283,7 @@ named_server_tcptimeouts(isc_lex_t *lex, isc_buffer_t **text) {
 		return (ISC_R_UNEXPECTEDEND);
 	}

-	isc_nm_gettimeouts(named_g_netmgr, &initial, &idle, &keepalive,
+	isc_nm_gettimeouts(named_g_nm, &initial, &idle, &keepalive,
 			   &advertised);

 	/* Look for optional arguments. */
@@ -16462,7 +16337,7 @@ named_server_tcptimeouts(isc_lex_t *lex, isc_buffer_t **text) {
 		result = isc_task_beginexclusive(named_g_server->task);
 		RUNTIME_CHECK(result == ISC_R_SUCCESS);

-		isc_nm_settimeouts(named_g_netmgr, initial, idle, keepalive,
+		isc_nm_settimeouts(named_g_nm, initial, idle, keepalive,
 				   advertised);

 		isc_task_endexclusive(named_g_server->task);
@@ -3612,7 +3612,7 @@ add_listener(named_server_t *server, named_statschannel_t **listenerp,
 		CHECK(ISC_R_FAMILYNOSUPPORT);
 	}

-	CHECK(isc_httpdmgr_create(named_g_netmgr, server->mctx, addr, client_ok,
+	CHECK(isc_httpdmgr_create(named_g_nm, server->mctx, addr, client_ok,
 				  destroy_listener, listener,
 				  &listener->httpdmgr));

@@ -379,7 +379,7 @@ all_digits(const char *s) {
 		return (false);
 	}
 	while (*s != '\0') {
-		if (!isdigit((unsigned char)(*s))) {
+		if (!isdigit((*s) & 0xff)) {
 			return (false);
 		}
 		s++;
@@ -272,8 +272,8 @@ configure_zone_ssutable(const cfg_obj_t *zconfig, dns_zone_t *zone,

 		dns_fixedname_init(&fname);
 		if (usezone) {
-			dns_name_copy(dns_zone_getorigin(zone),
-				      dns_fixedname_name(&fname));
+			dns_name_copynf(dns_zone_getorigin(zone),
+					dns_fixedname_name(&fname));
 		} else {
 			str = cfg_obj_asstring(dname);
 			isc_buffer_constinit(&b, str, strlen(str));
@@ -1249,23 +1249,15 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 		result = named_config_get(maps, "dnssec-policy", &obj);
 		if (result == ISC_R_SUCCESS) {
 			kaspname = cfg_obj_asstring(obj);
-			if (strcmp(kaspname, "none") != 0) {
-				result = dns_kasplist_find(kasplist, kaspname,
-							   &kasp);
-				if (result != ISC_R_SUCCESS) {
-					cfg_obj_log(
-						obj, named_g_lctx,
-						ISC_LOG_ERROR,
-						"dnssec-policy '%s' not found ",
-						kaspname);
-					RETERR(result);
-				}
-				dns_zone_setkasp(zone, kasp);
-				use_kasp = true;
+			result = dns_kasplist_find(kasplist, kaspname, &kasp);
+			if (result != ISC_R_SUCCESS) {
+				cfg_obj_log(obj, named_g_lctx, ISC_LOG_ERROR,
+					    "'dnssec-policy '%s' not found ",
+					    kaspname);
+				RETERR(result);
 			}
-		}
-		if (!use_kasp) {
-			dns_zone_setkasp(zone, NULL);
+			dns_zone_setkasp(zone, kasp);
+			use_kasp = dns_zone_use_kasp(zone);
 		}

 		obj = NULL;
@@ -1679,11 +1671,10 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,

 		obj = NULL;
 		result = cfg_map_get(zoptions, "auto-dnssec", &obj);
-		if (kasp != NULL) {
-			bool s2i = (strcmp(dns_kasp_getname(kasp),
-					   "insecure") != 0);
+		if (kasp != NULL && strcmp(dns_kasp_getname(kasp), "none") != 0)
+		{
 			dns_zone_setkeyopt(zone, DNS_ZONEKEY_ALLOW, true);
-			dns_zone_setkeyopt(zone, DNS_ZONEKEY_CREATE, !s2i);
+			dns_zone_setkeyopt(zone, DNS_ZONEKEY_CREATE, true);
 			dns_zone_setkeyopt(zone, DNS_ZONEKEY_MAINTAIN, true);
 		} else if (result == ISC_R_SUCCESS) {
 			const char *arg = cfg_obj_asstring(obj);
@@ -1700,6 +1691,11 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 			dns_zone_setkeyopt(zone, DNS_ZONEKEY_ALLOW, allow);
 			dns_zone_setkeyopt(zone, DNS_ZONEKEY_CREATE, false);
 			dns_zone_setkeyopt(zone, DNS_ZONEKEY_MAINTAIN, maint);
+		} else {
+			bool s2i = dns_zone_secure_to_insecure(zone, false);
+			dns_zone_setkeyopt(zone, DNS_ZONEKEY_ALLOW, s2i);
+			dns_zone_setkeyopt(zone, DNS_ZONEKEY_CREATE, false);
+			dns_zone_setkeyopt(zone, DNS_ZONEKEY_MAINTAIN, s2i);
 		}
 	}

@@ -2220,6 +2216,13 @@ named_zone_inlinesigning(dns_zone_t *zone, const cfg_obj_t *zconfig,
 			dns_zone_log(zone, ISC_LOG_DEBUG(1),
 				     "inline-signing: "
 				     "implicitly through dnssec-policy");
+		} else {
+			inline_signing = dns_zone_secure_to_insecure(zone,
+								     true);
+			dns_zone_log(
+				zone, ISC_LOG_DEBUG(1), "inline-signing: %s",
+				inline_signing ? "transitioning to insecure"
+					       : "no");
 		}
 	}

@@ -29,7 +29,6 @@
 #include <isc/hash.h>
 #include <isc/lex.h>
 #include <isc/log.h>
-#include <isc/managers.h>
 #include <isc/mem.h>
 #include <isc/nonce.h>
 #include <isc/parseint.h>
@@ -58,7 +57,6 @@
 #include <dns/masterdump.h>
 #include <dns/message.h>
 #include <dns/name.h>
-#include <dns/nsec3.h>
 #include <dns/rcode.h>
 #include <dns/rdata.h>
 #include <dns/rdataclass.h>
@@ -127,7 +125,6 @@ static bool usegsstsig = false;
 static bool use_win2k_gsstsig = false;
 static bool tried_other_gsstsig = false;
 static bool local_only = false;
-static isc_nm_t *netmgr = NULL;
 static isc_taskmgr_t *taskmgr = NULL;
 static isc_task_t *global_task = NULL;
 static isc_event_t *global_event = NULL;
@@ -924,8 +921,14 @@ setup_system(void) {
 	result = dns_dispatchmgr_create(gmctx, &dispatchmgr);
 	check_result(result, "dns_dispatchmgr_create");

-	isc_managers_create(gmctx, 1, 0, 0, &netmgr, &taskmgr, &timermgr,
-			    &socketmgr);
+	result = isc_socketmgr_create(gmctx, &socketmgr);
+	check_result(result, "dns_socketmgr_create");
+
+	result = isc_timermgr_create(gmctx, &timermgr);
+	check_result(result, "dns_timermgr_create");
+
+	result = isc_taskmgr_create(gmctx, 1, 0, NULL, &taskmgr);
+	check_result(result, "isc_taskmgr_create");

 	result = isc_task_create(taskmgr, 0, &global_task);
 	check_result(result, "isc_task_create");
@@ -1264,6 +1267,7 @@ static uint16_t
 parse_name(char **cmdlinep, dns_message_t *msg, dns_name_t **namep) {
 	isc_result_t result;
 	char *word;
+	isc_buffer_t *namebuf = NULL;
 	isc_buffer_t source;

 	word = nsu_strsep(cmdlinep, " \t\r\n");
@@ -1274,6 +1278,10 @@ parse_name(char **cmdlinep, dns_message_t *msg, dns_name_t **namep) {

 	result = dns_message_gettempname(msg, namep);
 	check_result(result, "dns_message_gettempname");
+	isc_buffer_allocate(gmctx, &namebuf, DNS_NAME_MAXWIRE);
+	dns_name_init(*namep, NULL);
+	dns_name_setbuffer(*namep, namebuf);
+	dns_message_takebuffer(msg, &namebuf);
 	isc_buffer_init(&source, word, strlen(word));
 	isc_buffer_add(&source, strlen(word));
 	result = dns_name_fromtext(*namep, &source, dns_rootname, 0, NULL);
@@ -1957,19 +1965,6 @@ parseclass:
 		}
 	}

-	if (!isdelete && rdata->type == dns_rdatatype_nsec3param) {
-		dns_rdata_nsec3param_t nsec3param;
-
-		result = dns_rdata_tostruct(rdata, &nsec3param, NULL);
-		check_result(result, "dns_rdata_tostruct");
-		if (nsec3param.iterations > dns_nsec3_maxiterations()) {
-			fprintf(stderr,
-				"NSEC3PARAM has excessive iterations (> %u)\n",
-				dns_nsec3_maxiterations());
-			goto failure;
-		}
-	}
-
 doneparsing:

 	result = dns_message_gettemprdatalist(updatemsg, &rdatalist);
@@ -2068,6 +2063,7 @@ setzone(dns_name_t *zonename) {
 	if (zonename != NULL) {
 		result = dns_message_gettempname(updatemsg, &name);
 		check_result(result, "dns_message_gettempname");
+		dns_name_init(name, NULL);
 		dns_name_clone(zonename, name);
 		result = dns_message_gettemprdataset(updatemsg, &rdataset);
 		check_result(result, "dns_message_gettemprdataset");
@@ -2730,7 +2726,7 @@ lookforsoa:
 		 * address.
 		 */
 		zname = dns_fixedname_initname(&fzname);
-		dns_name_copy(name, zname);
+		dns_name_copynf(name, zname);
 	}

 	if (debugging) {
@@ -3242,6 +3238,7 @@ start_update(void) {
 	dns_rdataset_makequestion(rdataset, getzoneclass(), dns_rdatatype_soa);

 	if (userzone != NULL) {
+		dns_name_init(name, NULL);
 		dns_name_clone(userzone, name);
 	} else {
 		dns_rdataset_t *tmprdataset;
@@ -3260,6 +3257,7 @@ start_update(void) {
 		}
 		firstname = NULL;
 		dns_message_currentname(updatemsg, section, &firstname);
+		dns_name_init(name, NULL);
 		dns_name_clone(firstname, name);
 		/*
 		 * Looks to see if the first name references a DS record
@@ -3310,12 +3308,18 @@ cleanup(void) {
 		dst_key_free(&sig0key);
 	}

-	ddebug("Shutting down managers");
-	isc_managers_destroy(&netmgr, &taskmgr, &timermgr, &socketmgr);
+	ddebug("Shutting down task manager");
+	isc_taskmgr_destroy(&taskmgr);

 	ddebug("Destroying event");
 	isc_event_free(&global_event);

+	ddebug("Shutting down socket manager");
+	isc_socketmgr_destroy(&socketmgr);
+
+	ddebug("Shutting down timer manager");
+	isc_timermgr_destroy(&timermgr);
+
 #ifdef HAVE_GSSAPI
 	/*
 	 * Cleanup GSSAPI resources after taskmgr has been destroyed.
@@ -22,7 +22,6 @@
 #include <isc/commandline.h>
 #include <isc/file.h>
 #include <isc/log.h>
-#include <isc/managers.h>
 #include <isc/mem.h>
 #include <isc/net.h>
 #include <isc/netmgr.h>
@@ -60,7 +59,6 @@
 const char *progname = NULL;
 bool verbose;

-static isc_nm_t *netmgr = NULL;
 static isc_taskmgr_t *taskmgr = NULL;
 static isc_task_t *rndc_task = NULL;

@@ -74,6 +72,7 @@ static bool local4set = false, local6set = false;
 static int nserveraddrs;
 static int currentaddr = 0;
 static unsigned int remoteport = 0;
+static isc_nm_t *netmgr = NULL;
 static isc_buffer_t *databuf = NULL;
 static isccc_ccmsg_t rndc_ccmsg;
 static uint32_t algorithm;
@@ -575,6 +574,7 @@ rndc_connected(isc_nmhandle_t *handle, isc_result_t result, void *arg) {

 static void
 rndc_startconnect(isc_sockaddr_t *addr) {
+	isc_result_t result;
 	char socktext[ISC_SOCKADDR_FORMATSIZE];
 	isc_sockaddr_t *local = NULL;

@@ -600,8 +600,10 @@ rndc_startconnect(isc_sockaddr_t *addr) {
 	}

 	atomic_fetch_add_relaxed(&connects, 1);
-	isc_nm_tcpconnect(netmgr, local, addr, rndc_connected, &rndc_ccmsg,
-			  60000, 0);
+	DO("create connection",
+	   isc_nm_tcpconnect(netmgr, (isc_nmiface_t *)local,
+			     (isc_nmiface_t *)addr, rndc_connected, &rndc_ccmsg,
+			     10000, 0));
 }

 static void
@@ -1031,7 +1033,9 @@ main(int argc, char **argv) {
 	serial = isc_random32();

 	isc_mem_create(&rndc_mctx);
-	isc_managers_create(rndc_mctx, 1, 0, 0, &netmgr, &taskmgr, NULL, NULL);
+	netmgr = isc_nm_start(rndc_mctx, 1);
+	DO("create task manager",
+	   isc_taskmgr_create(rndc_mctx, 1, 0, netmgr, &taskmgr));
 	DO("create task", isc_task_create(taskmgr, 0, &rndc_task));
 	isc_log_create(rndc_mctx, &log, &logconfig);
 	isc_log_setcontext(log);
@@ -1088,7 +1092,9 @@ main(int argc, char **argv) {
 	}

 	isc_task_detach(&rndc_task);
-	isc_managers_destroy(&netmgr, &taskmgr, NULL, NULL);
+	isc_taskmgr_destroy(&taskmgr);
+
+	isc_nm_closedown(netmgr);

 	/*
 	 * Note: when TCP connections are shut down, there will be a final
@@ -1098,6 +1104,8 @@ main(int argc, char **argv) {
 	 */
 	isccc_ccmsg_invalidate(&rndc_ccmsg);

+	isc_nm_destroy(&netmgr);
+
 	isc_log_destroy(&log);
 	isc_log_setcontext(NULL);

@@ -136,7 +136,7 @@ Currently supported commands are:
   This sample ``addzone`` command adds the zone ``example.com`` to
   the default view:

-   ``rndc addzone example.com '{ type master; file "example.com.db"; };'``
+   ``$ \ rndc addzone example.com '{ type master; file "example.com.db"; };'``

   (Note the brackets around and semi-colon after the zone configuration
   text.)
@@ -1,4 +1,3 @@
-.cache
 __pycache__
 dig.out*
 rndc.out*
@@ -14,7 +13,8 @@ named.run
 parallel.mk
 /*.log
 /*.trs
-/resolve
+/get_ports.state
+/get_ports.lock
 /run.sh
 /run.log
 /start.sh
@@ -23,7 +23,6 @@ check_PROGRAMS =		\
 	feature-test		\
 	makejournal		\
 	pipelined/pipequeries	\
-	resolve			\
 	rndc/gencheck		\
 	rpz/dnsrps		\
 	tkey/keycreate		\
@@ -49,14 +48,6 @@ pipelined_pipequeries_LDADD =	\
 	$(LDADD)		\
 	$(LIBDNS_LIBS)

-resolve_CPPFLAGS =		\
-	$(AM_CPPFLAGS)		\
-	$(LIBISC_CFLAGS)	\
-	$(LIBDNS_CFLAGS)	\
-	$(LIBIRS_CFLAGS)
-
-resolve_LDADD = $(LIBISC_LIBS) $(LIBIRS_LIBS) $(LIBDNS_LIBS)
-
 tkey_keycreate_CPPFLAGS =	\
 	$(AM_CPPFLAGS)		\
 	$(LIBDNS_CFLAGS)
@@ -250,4 +241,7 @@ AM_LOG_FLAGS = -r

 $(TESTS): run.sh

+clean-local:
+	-rm -f get_ports.state get_ports.lock
+
 test-local: check
@@ -1,2 +0,0 @@
-@ IN SOA localhost. localhost.localhost. 1 10800 3600 605800 86400
-@ IN NS localhost.
@@ -1,89 +0,0 @@
-############################################################################
-# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, you can obtain one at https://mozilla.org/MPL/2.0/.
-#
-# See the COPYRIGHT file distributed with this work for additional
-# information regarding copyright ownership.
-############################################################################
-
-import concurrent.futures
-import os
-import subprocess
-import time
-
-
-def run_rndc(server, rndc_command):
-    '''
-    Send the specified 'rndc_command' to 'server' with a timeout of 2 seconds
-    '''
-    rndc = os.getenv('RNDC')
-    port = os.getenv('CONTROLPORT')
-
-    cmdline = [rndc, '-c', '../common/rndc.conf', '-p', port, '-s', server]
-    cmdline.extend(rndc_command)
-
-    subprocess.check_output(cmdline, stderr=subprocess.STDOUT, timeout=2)
-
-
-def rndc_loop(test_state, domain):
-    '''
-    Run "rndc addzone", "rndc modzone", and "rndc delzone" in a tight loop
-    until the test is considered finished, ignoring errors
-    '''
-    rndc_commands = [
-        ['addzone', domain,
-         '{ type master; file "example.db"; };'],
-        ['modzone', domain,
-         '{ type master; file "example.db"; allow-transfer { any; }; };'],
-        ['delzone', domain],
-    ]
-
-    while not test_state['finished']:
-        for command in rndc_commands:
-            try:
-                run_rndc('10.53.0.3', command)
-            except subprocess.SubprocessError:
-                pass
-
-
-def check_if_server_is_responsive():
-    '''
-    Check if server status can be successfully retrieved using "rndc status"
-    '''
-    try:
-        run_rndc('10.53.0.3', ['status'])
-        return True
-    except subprocess.SubprocessError:
-        return False
-
-
-def test_rndc_deadlock():
-    '''
-    Test whether running "rndc addzone", "rndc modzone", and "rndc delzone"
-    commands concurrently does not trigger a deadlock
-    '''
-    test_state = {'finished': False}
-
-    # Create 4 worker threads running "rndc" commands in a loop.
-    with concurrent.futures.ThreadPoolExecutor() as executor:
-        for i in range(1, 5):
-            domain = 'example%d' % i
-            executor.submit(rndc_loop, test_state, domain)
-
-        # Run "rndc status" in 1-second intervals for a maximum of 10 seconds.
-        # If any "rndc status" command fails, the loop will be interrupted.
-        server_is_responsive = True
-        attempts = 10
-        while server_is_responsive and attempts > 0:
-            server_is_responsive = check_if_server_is_responsive()
-            attempts -= 1
-            time.sleep(1)
-
-        # Signal worker threads that the test is finished.
-        test_state['finished'] = True
-
-    # Check whether all "rndc status" commands succeeded.
-    assert server_is_responsive
@@ -1590,7 +1590,7 @@ status=`expr $status + $ret`
 echo_i "check that DNAME at apex with NSEC3 is correctly signed (auto-dnssec maintain) ($n)"
 ret=0
 $DIG $DIGOPTS txt dname-at-apex-nsec3.example @10.53.0.3 > dig.out.ns3.test$n || ret=1
-grep "RRSIG NSEC3 7 3 600" dig.out.ns3.test$n > /dev/null || ret=1
+grep "RRSIG NSEC3 7 3 3600" dig.out.ns3.test$n > /dev/null || ret=1
 n=`expr $n + 1`
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
@@ -1 +0,0 @@
-m record,size,mctx -c named.conf -d 1 -D cacheclean-ns1 -X named.lock -g -T maxcachesize=2097152
@@ -1 +0,0 @@
-m record,size,mctx -c named.conf -d 3 -D cacheclean-ns2 -X named.lock -g -T maxcachesize=2097152
@@ -80,34 +80,6 @@ sub reply_handler {
 	$rr = new Net::DNS::RR("$synth2 $ttl $qclass DNAME .");
 	push @ans, $rr;
 	$rcode = "NOERROR";
-    # The following three code branches referring to the "example.dname"
-    # zone are necessary for the resolver variant of the CVE-2021-25215
-    # regression test to work.  A named instance cannot be used for
-    # serving the DNAME records below as a version of BIND vulnerable to
-    # CVE-2021-25215 would crash while answering the queries asked by
-    # the tested resolver.
-    } elsif ($qname eq "ns3.example.dname") {
-	if ($qtype eq "A") {
-		my $rr = new Net::DNS::RR("$qname $ttl $qclass A 10.53.0.3");
-		push @ans, $rr;
-	}
-	if ($qtype eq "AAAA") {
-		my $rr = new Net::DNS::RR("example.dname. $ttl $qclass SOA . . 0 0 0 0 $ttl");
-		push @auth, $rr;
-	}
-	$rcode = "NOERROR";
-    } elsif ($qname eq "self.example.self.example.dname") {
-	my $rr = new Net::DNS::RR("self.example.dname. $ttl $qclass DNAME dname.");
-	push @ans, $rr;
-	$rr = new Net::DNS::RR("$qname $ttl $qclass CNAME self.example.dname.");
-	push @ans, $rr;
-	$rcode = "NOERROR";
-    } elsif ($qname eq "self.example.dname") {
-	if ($qtype eq "DNAME") {
-		my $rr = new Net::DNS::RR("$qname $ttl $qclass DNAME dname.");
-		push @ans, $rr;
-	}
-	$rcode = "NOERROR";
    } else {
 	$rcode = "REFUSED";
    }
@@ -24,10 +24,6 @@ ns2.example.		A	10.53.0.2
 example.broken.		NS	ns3.example.broken.
 ns3.example.broken.	A	10.53.0.3

-; for the resolver variant of the CVE-2021-25215 regression test
-example.dname.		NS	ns3.example.dname.
-ns3.example.dname.	A	10.53.0.3
-
 domain0.nil.		NS	ns2.domain0.nil
 domain1.nil.		NS	ns2.domain0.nil
 domain2.nil.		NS	ns2.domain0.nil
@@ -16,5 +16,3 @@ ns2	86400	AAAA    fd92:7065:b8e:ffff::2
@       86400	AAAA 	1:2:3::4
 *       86400	A 	1.2.3.4
 *       86400	AAAA 	1:2:3::4
-; CVE-2021-25215 regression test data
-self	86400	DNAME	nil.
@@ -295,23 +295,5 @@ grep 'status: NOERROR' dig.out.7.$n > /dev/null 2>&1 || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`

-# Regression test for CVE-2021-25215 (authoritative server).
-n=`expr $n + 1`
-echo_i "checking DNAME resolution via itself (authoritative) ($n)"
-ret=0
-$DIG $DIGOPTS @10.53.0.2 DNAME self.domain0.self.domain0.nil. > dig.out.2.$n 2>&1
-grep 'status: NOERROR' dig.out.2.$n > /dev/null 2>&1 || ret=1
-if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
-
-# Regression test for CVE-2021-25215 (recursive resolver).
-n=`expr $n + 1`
-echo_i "checking DNAME resolution via itself (recursive) ($n)"
-ret=0
-$DIG $DIGOPTS @10.53.0.7 DNAME self.example.self.example.dname. > dig.out.7.$n 2>&1
-grep 'status: NOERROR' dig.out.7.$n > /dev/null 2>&1 || ret=1
-if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
-
 echo_i "exit status: $status"
 [ $status -eq 0 ] || exit 1
@@ -1,22 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-/*
- * inline-signing not allowed at options level.
- */
-options {
-	inline-signing yes;
-};
-
-zone "." {
-	type primary;
-	file "root.db";
-};
@@ -1,29 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-/*
- * inline-signing not allowed at view level.
- */
-view "a" {
-	inline-signing yes;
-
-	zone "." {
-		type primary;
-		file "root.db.signed";
-	};
-};
-
-view "b" {
-	zone "." {
-		type primary;
-		file "root.db";
-	};
-};
@@ -1,21 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-// 'insecure' is a built-in policy, redefinition not allowed.
-dnssec-policy "insecure" {
-	signatures-refresh P5D;
-};
-
-zone "example.net" {
-	type master;
-	file "example.db";
-	dnssec-policy "insecure";
-};
@@ -1,42 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-key "keyforview1" {
-	algorithm "hmac-sha1";
-	secret "YPfMoAk6h+3iN8MDRQC004iSNHY=";
-};
-
-key "keyforview2" {
-	algorithm "hmac-sha1";
-	secret "4xILSZQnuO1UKubXHkYUsvBRPu8=";
-};
-
-view "example1" {
-	match-clients { key "keyforview1"; };
-
-	zone "example.net" {
-		type primary;
-		dnssec-policy "default";
-		key-directory ".";
-		file "example1.db";
-	};
-};
-
-view "example2" {
-	match-clients { key "keyforview2"; };
-
-	zone "example.net" {
-		type primary;
-		dnssec-policy "insecure";
-		key-directory ".";
-		file "example2.db";
-	};
-};
@@ -1,40 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-key "keyforview1" {
-	algorithm "hmac-sha1";
-	secret "YPfMoAk6h+3iN8MDRQC004iSNHY=";
-};
-
-key "keyforview2" {
-	algorithm "hmac-sha1";
-	secret "4xILSZQnuO1UKubXHkYUsvBRPu8=";
-};
-
-view "example1" {
-	match-clients { key "keyforview1"; };
-
-	zone "example.net" {
-		type primary;
-		dnssec-policy "default";
-		file "example1.db";
-	};
-};
-
-view "example2" {
-	match-clients { key "keyforview2"; };
-
-	zone "example.net" {
-		type primary;
-		dnssec-policy "insecure";
-		file "example2.db";
-	};
-};
@@ -9,7 +9,7 @@
 * information regarding copyright ownership.
 */

-// 'default' is a built-in policy, redefinition not allowed.
+// Using the keyword 'default' is not allowed.
 dnssec-policy "default" {
 	signatures-refresh P5D;
 };
@@ -19,3 +19,4 @@ zone "example.net" {
 	file "example.db";
 	dnssec-policy "default";
 };
+
@@ -1,26 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-// One zone with dnssec-policy 'none', one zone with dnssec-policy 'insecure',
-// both using the same zone file.
-
-zone "example1.net" {
-	type master;
-	file "example.db";
-	dnssec-policy "none";
-};
-
-zone "example2.net" {
-	type master;
-	file "example.db";
-	dnssec-policy "insecure";
-};
-
@@ -1,26 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-// One zone with a dnssec-policy, the other with allow-update,
-// with the same zone file.
-
-zone "example1.net" {
-	type master;
-	file "example.db";
-	dnssec-policy "default";
-};
-
-zone "example2.net" {
-	type master;
-	file "example.db";
-	allow-update { any; };
-};
-
@@ -1,28 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-// One zone with a dnssec-policy, the other with update-policy,
-// with the same zone file.
-
-zone "example1.net" {
-	type master;
-	file "example.db";
-	dnssec-policy "default";
-};
-
-zone "example2.net" {
-	type master;
-	file "example.db";
-	update-policy {
-		grant * self * TXT;
-	};
-};
-
@@ -1,26 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-// One zone transitioning to insecure, the other with allow-update,
-// with the same zone file.
-
-zone "example1.net" {
-	type master;
-	file "example.db";
-	dnssec-policy "insecure";
-};
-
-zone "example2.net" {
-	type master;
-	file "example.db";
-	allow-update { any; };
-};
-
@@ -9,7 +9,7 @@
 * information regarding copyright ownership.
 */

-// 'none' is a built-in policy, redefinition not allowed.
+// Using the keyword 'none' is not allowed.
 dnssec-policy "none" {
 	signatures-refresh P5D;
 };
@@ -19,3 +19,4 @@ zone "example.net" {
 	file "example.db";
 	dnssec-policy "none";
 };
+
@@ -1,25 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-// Two zones with dnssec-policy with the same zone file.
-
-zone "example1.net" {
-	type master;
-	file "example.db";
-	dnssec-policy "default";
-};
-
-zone "example2.net" {
-	type master;
-	file "example.db";
-	dnssec-policy "default";
-};
-
@@ -1,26 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-// Two zones with dnssec-policy 'insecure' (transitioning to insecure)
-// with the same zone file.
-
-zone "example1.net" {
-	type master;
-	file "example.db";
-	dnssec-policy "insecure";
-};
-
-zone "example2.net" {
-	type master;
-	file "example.db";
-	dnssec-policy "insecure";
-};
-
@@ -1,26 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-// One zone with dnssec-policy, the other zone has 'dnssec-policy none',
-// both with the same zone file.
-
-zone "example1.net" {
-	type master;
-	file "example.db";
-	dnssec-policy "default";
-};
-
-zone "example2.net" {
-	type master;
-	file "example.db";
-	dnssec-policy "none";
-};
-
@@ -1,26 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-// One zone with dnssec-policy, the other zone has 'dnssec-policy insecure'
-// (transitioning to inseure), both with the same zone file.
-
-zone "example1.net" {
-	type master;
-	file "example.db";
-	dnssec-policy "default";
-};
-
-zone "example2.net" {
-	type master;
-	file "example.db";
-	dnssec-policy "insecure";
-};
-
@@ -49,13 +49,8 @@ zone "example3" {
 	file "example3.db";
 	dnssec-policy "default";
 };
-zone "dnssec-policy-none-shared-zonefile1" {
+zone "example4" {
 	type master;
-	file "shared.db";
-	dnssec-policy "none";
-};
-zone "dnssec-policy-none-shared-zonefile2" {
-	type master;
-	file "shared.db";
+	file "example4.db";
 	dnssec-policy "none";
 };
@@ -192,53 +192,7 @@ view "fourth" {
 		file "dnssec-none.db";
 		dnssec-policy "none";
 	};
-	zone "dnssec-view1" {
-		type master;
-		file "dnssec-view41.db";
-		dnssec-policy "test";
-	};
-	zone "dnssec-view2" {
-		type master;
-		file "dnssec-view42.db";
-	};
-	zone "dnssec-view3" {
-		type master;
-		file "dnssec-view43.db";
-		dnssec-policy "none";
-		key-directory "keys";
-	};
-	zone "dnssec-view4" {
-		type master;
-		file "dnssec-view44.db";
-		dnssec-policy "none";
-	};
 	dnssec-policy "default";
-	key-directory ".";
-};
-view "fifth" {
-	zone "dnssec-view1" {
-		type master;
-		file "dnssec-view51.db";
-		dnssec-policy "test";
-	};
-	zone "dnssec-view2" {
-		type master;
-		file "dnssec-view52.db";
-		dnssec-policy "test";
-		key-directory "keys";
-	};
-	zone "dnssec-view3" {
-		type master;
-		file "dnssec-view53.db";
-		dnssec-policy "default";
-		key-directory "keys";
-	};
-	zone "dnssec-view4" {
-		type master;
-		file "dnssec-view54.db";
-		dnssec-policy "none";
-	};
-	key-directory ".";
 };
 view "chaos" chaos {
 	zone "hostname.bind" chaos {
@@ -13,12 +13,4 @@ dnssec-test IN fourth master
 dnssec-default IN fourth master
 dnssec-inherit IN fourth master
 dnssec-none IN fourth master
-dnssec-view1 IN fourth master
-dnssec-view2 IN fourth master
-dnssec-view3 IN fourth master
-dnssec-view4 IN fourth master
-dnssec-view1 IN fifth master
-dnssec-view2 IN fifth master
-dnssec-view3 IN fifth master
-dnssec-view4 IN fifth master
 hostname.bind chaos chaos master
@@ -27,28 +27,28 @@ dnssec-policy "rsasha256" {
 	keys {
 		csk lifetime P10Y algorithm rsasha256 2048;
 	};
-	nsec3param iterations 150;
+	nsec3param iterations 500;
 };

 dnssec-policy "rsasha256-bad" {
 	keys {
 		csk lifetime P10Y algorithm rsasha256 2048;
 	};
-	nsec3param iterations 151;
+	nsec3param iterations 501;
 };

 dnssec-policy "rsasha512" {
 	keys {
 		csk lifetime P10Y algorithm rsasha512 4096;
 	};
-	nsec3param iterations 150;
+	nsec3param iterations 2500;
 };

 dnssec-policy "rsasha512-bad" {
 	keys {
 		csk lifetime P10Y algorithm rsasha512 4096;
 	};
-	nsec3param iterations 151;
+	nsec3param iterations 2501;
 };

 zone "example.net" {
@@ -12,8 +12,6 @@
 status=0
 n=0

-mkdir keys
-
 n=`expr $n + 1`
 echo_i "checking that named-checkconf handles a known good config ($n)"
 ret=0
@@ -497,6 +495,8 @@ echo_i "checking named-checkconf kasp nsec3 iterations errors ($n)"
 ret=0
 $CHECKCONF kasp-bad-nsec3-iter.conf > checkconf.out$n 2>&1 && ret=1
 grep "dnssec-policy: nsec3 iterations value 151 out of range" < checkconf.out$n > /dev/null || ret=1
+grep "dnssec-policy: nsec3 iterations value 501 out of range" < checkconf.out$n > /dev/null || ret=1
+grep "dnssec-policy: nsec3 iterations value 2501 out of range" < checkconf.out$n > /dev/null || ret=1
 lines=$(wc -l < "checkconf.out$n")
 if [ $lines != 3 ]; then ret=1; fi
 if [ $ret != 0 ]; then echo_i "failed"; fi
@@ -551,7 +551,5 @@ grep "exceeds 100%" < checkconf.out$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; ret=1; fi
 status=`expr $status + $ret`

-rmdir keys
-
 echo_i "exit status: $status"
 [ $status -eq 0 ] || exit 1
@@ -713,7 +713,6 @@ export KEYGEN
 export KEYSETTOOL
 export KEYSIGNER
 export KRB5_CONFIG
-export KRB5_KTNAME
 export MAKEJOURNAL
 export MDIG
 export NAMED
@@ -731,6 +730,7 @@ export PYTHON
 export RESOLVE
 export RNDC
 export RRCHECKER
+export SAMPLEUPDATE
 export SIGNER
 export SUBDIRS
 export TMPDIR
@@ -51,7 +51,7 @@ NZD2NZF=$TOP_BUILDDIR/bin/tools/named-nzd2nzf
 PK11DEL="$TOP_BUILDDIR/bin/pkcs11/pkcs11-destroy -s ${SLOT:-0} -p ${HSMPIN:-1234} -w 0"
 PK11GEN="$TOP_BUILDDIR/bin/pkcs11/pkcs11-keygen -q -s ${SLOT:-0} -p ${HSMPIN:-1234}"
 PK11LIST="$TOP_BUILDDIR/bin/pkcs11/pkcs11-list -s ${SLOT:-0} -p ${HSMPIN:-1234}"
-RESOLVE=$TOP_BUILDDIR/bin/tests/system/resolve
+RESOLVE=$TOP_BUILDDIR/lib/samples/resolve
 REVOKE=$TOP_BUILDDIR/bin/dnssec/dnssec-revoke
 RNDC=$TOP_BUILDDIR/bin/rndc/rndc
 RNDCCONFGEN=$TOP_BUILDDIR/bin/confgen/rndc-confgen
@@ -68,11 +68,10 @@ KEYCREATE=$TOP_BUILDDIR/bin/tests/system/tkey/keycreate
 KEYDELETE=$TOP_BUILDDIR/bin/tests/system/tkey/keydelete
 MAKEJOURNAL=$TOP_BUILDDIR/bin/tests/system/makejournal
 PIPEQUERIES=$TOP_BUILDDIR/bin/tests/system/pipelined/pipequeries
+SAMPLEUPDATE=$TOP_BUILDDIR/lib/samples/sample-update

 # we don't want a KRB5_CONFIG setting breaking the tests
 KRB5_CONFIG=/dev/null
-# use local keytab instead of default /etc/krb5.keytab
-KRB5_KTNAME=dns.keytab

 #
 # Construct the lists of tests to run
@@ -51,10 +51,12 @@ NZD2NZF=$TOP_BUILDDIR/Build/$VSCONF/named-nzd2nzf@EXEEXT@
 PK11DEL="$TOP_BUILDDIR/Build/$VSCONF/pkcs11-destroy@EXEEXT@ -s ${SLOT:-0} -p ${HSMPIN:-1234} -w 0"
 PK11GEN="$TOP_BUILDDIR/Build/$VSCONF/pkcs11-keygen@EXEEXT@ -q -s ${SLOT:-0} -p ${HSMPIN:-1234}"
 PK11LIST="$TOP_BUILDDIR/Build/$VSCONF/pkcs11-list@EXEEXT@ -s ${SLOT:-0} -p ${HSMPIN:-1234}"
+RESOLVE=$TOP_BUILDDIR/lib/samples/resolve
 REVOKE=$TOP_BUILDDIR/Build/$VSCONF/dnssec-revoke@EXEEXT@
 RNDC=$TOP_BUILDDIR/Build/$VSCONF/rndc@EXEEXT@
 RNDCCONFGEN=$TOP_BUILDDIR/Build/$VSCONF/rndc-confgen@EXEEXT@
 RRCHECKER=$TOP_BUILDDIR/Build/$VSCONF/named-rrchecker@EXEEXT@
+SAMPLEUPDATE=$TOP_BUILDDIR/Build/$VSCONF/update@EXEEXT@
 SETTIME=$TOP_BUILDDIR/Build/$VSCONF/dnssec-settime@EXEEXT@
 SIGNER=$TOP_BUILDDIR/Build/$VSCONF/dnssec-signzone@EXEEXT@
 TSIGKEYGEN=$TOP_BUILDDIR/Build/$VSCONF/tsig-keygen@EXEEXT@
@@ -69,7 +71,7 @@ KEYCREATE=$TOP_BUILDDIR/Build/$VSCONF/keycreate@EXEEXT@
 KEYDELETE=$TOP_BUILDDIR/Build/$VSCONF/keydelete@EXEEXT@
 MAKEJOURNAL=$TOP_BUILDDIR/Build/$VSCONF/makejournal@EXEEXT@
 PIPEQUERIES=$TOP_BUILDDIR/Build/$VSCONF/pipequeries@EXEEXT@
-RESOLVE=$TOP_BUILDDIR/Build/$VSCONF/resolve@EXEEXT@
+# to port SAMPLEUPDATE=$TOP_BUILDDIR/lib/samples/sample-update

 # we don't want a KRB5_CONFIG setting breaking the tests
 KRB5_CONFIG=NUL
@@ -801,7 +801,7 @@ if [ -x "$DIG" ] ; then
  echo_i "checking exit code for a retry upon TCP EOF (immediate -> immediate) ($n)"
  ret=0
  echo "no_response no_response" | sendcmd 10.53.0.5
-  dig_with_opts @10.53.0.5 example AXFR +tries=2 > dig.out.test$n 2>&1 && ret=1
+  dig_with_opts @10.53.0.5 example AXFR +tries=1 > dig.out.test$n 2>&1 && ret=1
  # Sanity check: ensure ans5 behaves as expected.
  [ `grep "communications error.*end of file" dig.out.test$n | wc -l` -eq 2 ] || ret=1
  if [ $ret -ne 0 ]; then echo_i "failed"; fi
@@ -811,7 +811,7 @@ if [ -x "$DIG" ] ; then
  echo_i "checking exit code for a retry upon TCP EOF (partial AXFR -> partial AXFR) ($n)"
  ret=0
  echo "partial_axfr partial_axfr" | sendcmd 10.53.0.5
-  dig_with_opts @10.53.0.5 example AXFR +tries=2 > dig.out.test$n 2>&1 && ret=1
+  dig_with_opts @10.53.0.5 example AXFR +tries=1 > dig.out.test$n 2>&1 && ret=1
  # Sanity check: ensure ans5 behaves as expected.
  [ `grep "communications error.*end of file" dig.out.test$n | wc -l` -eq 2 ] || ret=1
  if [ $ret -ne 0 ]; then echo_i "failed"; fi
@@ -821,7 +821,7 @@ if [ -x "$DIG" ] ; then
  echo_i "checking exit code for a retry upon TCP EOF (immediate -> partial AXFR) ($n)"
  ret=0
  echo "no_response partial_axfr" | sendcmd 10.53.0.5
-  dig_with_opts @10.53.0.5 example AXFR +tries=2 > dig.out.test$n 2>&1 && ret=1
+  dig_with_opts @10.53.0.5 example AXFR +tries=1 > dig.out.test$n 2>&1 && ret=1
  # Sanity check: ensure ans5 behaves as expected.
  [ `grep "communications error.*end of file" dig.out.test$n | wc -l` -eq 2 ] || ret=1
  if [ $ret -ne 0 ]; then echo_i "failed"; fi
@@ -831,7 +831,7 @@ if [ -x "$DIG" ] ; then
  echo_i "checking exit code for a retry upon TCP EOF (partial AXFR -> immediate) ($n)"
  ret=0
  echo "partial_axfr no_response" | sendcmd 10.53.0.5
-  dig_with_opts @10.53.0.5 example AXFR +tries=2 > dig.out.test$n 2>&1 && ret=1
+  dig_with_opts @10.53.0.5 example AXFR +tries=1 > dig.out.test$n 2>&1 && ret=1
  # Sanity check: ensure ans5 behaves as expected.
  [ `grep "communications error.*end of file" dig.out.test$n | wc -l` -eq 2 ] || ret=1
  if [ $ret -ne 0 ]; then echo_i "failed"; fi
@@ -841,7 +841,7 @@ if [ -x "$DIG" ] ; then
  echo_i "checking exit code for a retry upon TCP EOF (immediate -> complete AXFR) ($n)"
  ret=0
  echo "no_response complete_axfr" | sendcmd 10.53.0.5
-  dig_with_opts @10.53.0.5 example AXFR +tries=2 > dig.out.test$n 2>&1 || ret=1
+  dig_with_opts @10.53.0.5 example AXFR +tries=1 > dig.out.test$n 2>&1 || ret=1
  # Sanity check: ensure ans5 behaves as expected.
  [ `grep "communications error.*end of file" dig.out.test$n | wc -l` -eq 1 ] || ret=1
  if [ $ret -ne 0 ]; then echo_i "failed"; fi
@@ -851,26 +851,7 @@ if [ -x "$DIG" ] ; then
  echo_i "checking exit code for a retry upon TCP EOF (partial AXFR -> complete AXFR) ($n)"
  ret=0
  echo "partial_axfr complete_axfr" | sendcmd 10.53.0.5
-  dig_with_opts @10.53.0.5 example AXFR +tries=2 > dig.out.test$n 2>&1 || ret=1
-  # Sanity check: ensure ans5 behaves as expected.
-  [ `grep "communications error.*end of file" dig.out.test$n | wc -l` -eq 1 ] || ret=1
-  if [ $ret -ne 0 ]; then echo_i "failed"; fi
-  status=$((status+ret))
-
-  n=$((n+1))
-  echo_i "checking +tries=1 won't retry twice upon TCP EOF ($n)"
-  ret=0
-  echo "no_response no_response" | sendcmd 10.53.0.5
-  dig_with_opts @10.53.0.5 example AXFR +tries=1 > dig.out.test$n 2>&1 && ret=1
-  # Sanity check: ensure ans5 behaves as expected.
-  [ `grep "communications error.*end of file" dig.out.test$n | wc -l` -eq 1 ] || ret=1
-  if [ $ret -ne 0 ]; then echo_i "failed"; fi
-  status=$((status+ret))
-
-  n=$((n+1))
-  echo_i "checking +retry=0 won't retry twice upon TCP EOF ($n)"
-  ret=0
-  dig_with_opts @10.53.0.5 example AXFR +retry=0 > dig.out.test$n 2>&1 && ret=1
+  dig_with_opts @10.53.0.5 example AXFR +tries=1 > dig.out.test$n 2>&1 || ret=1
  # Sanity check: ensure ans5 behaves as expected.
  [ `grep "communications error.*end of file" dig.out.test$n | wc -l` -eq 1 ] || ret=1
  if [ $ret -ne 0 ]; then echo_i "failed"; fi
@@ -4,10 +4,11 @@ AM_CPPFLAGS +=			\
 	$(LIBISC_CFLAGS)	\
 	$(LIBDNS_CFLAGS)

-check_LTLIBRARIES = dlzexternal.la
+dlzexternal_LTLIBRARIES = dlzexternal.la
+dlzexternaldir = $(abs_builddir)

 dlzexternal_la_SOURCES =	\
 	driver.c		\
 	driver.h

-dlzexternal_la_LDFLAGS = -avoid-version -module -shared -export-dynamic -rpath $(abs_builddir)
+dlzexternal_la_LDFLAGS = -avoid-version -module -shared -export-dynamic
@@ -25,7 +25,6 @@ rm -f ./canonical?.*
 rm -f ./delv.out*
 rm -f ./delve.out*
 rm -f ./dig.out.*
-rm -f ./ns2/too-many-iterations.db
 rm -f ./dnssectools.out*
 rm -f ./dsfromkey.out.*
 rm -f ./keygen.err
@@ -31,5 +31,3 @@ ns6.optout-tld.		A	10.53.0.6
 in-addr.arpa.		NS	ns2.example.
 inprogress.		NS	ns10.inprogress.
 ns10.inprogress.	A	10.53.0.10
-too-many-iterations.	NS	ns2.too-many-iterations.
-ns2.too-many-iterations.	A	10.53.0.2
@@ -26,7 +26,6 @@ echo_i "ns1/sign.sh"

 cp "../ns2/dsset-example$TP" .
 cp "../ns2/dsset-in-addr.arpa$TP" .
-cp "../ns2/dsset-too-many-iterations$TP" .

 grep "$DEFAULT_ALGORITHM_NUMBER [12] " "../ns2/dsset-algroll$TP" > "dsset-algroll$TP"
 cp "../ns6/dsset-optout-tld$TP" .
@@ -191,9 +191,4 @@ zone "hours-vs-days" {
 	allow-update { any; };
 };

-zone "too-many-iterations" {
-	type master;
-	file "too-many-iterations.db.signed";
-};
-
 include "trusted.conf";
@@ -318,14 +318,3 @@ key1=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone -f KSK "$
 key2=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone")
 $SETTIME -P sync now "$key1" > /dev/null
 cat "$infile" > "$zonefile.signed"
-
-#
-# Negative result from this zone should come back as insecure.
-#
-zone=too-many-iterations
-infile=too-many-iterations.db.in
-zonefile=too-many-iterations.db
-key1=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone -f KSK "$zone")
-key2=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone")
-cat "$infile" "$key1.key" "$key2.key" > "$zonefile"
-"$SIGNER" -P -3 - -H too-many -g -o "$zone" "$zonefile" > /dev/null 2>&1
@@ -1,25 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 30	; 5 minutes
-@			IN SOA	mname1. . (
-				2000042407 ; serial
-				20         ; refresh (20 seconds)
-				20         ; retry (20 seconds)
-				1814400    ; expire (3 weeks)
-				30       ; minimum (1 hour)
-				)
-			NS	ns2
-ns2			A	10.53.0.2
-ns3			A	10.53.0.3
-
-a			A	10.0.0.1
-*.a			A	10.0.0.3
-b			A	10.0.0.2
-d			A	10.0.0.4
@@ -363,12 +363,6 @@ zone "revoked.trusted" {
 	file "revoked.trusted.db.signed";
 };

-zone "too-many-iterations" {
-	type secondary;
-	primaries { 10.53.0.2; };
-	file "too-many-iterations.bk";
-};
-
 include "siginterval.conf";

 include "trusted.conf";
@@ -42,7 +42,6 @@ view rec {
 	recursion yes;
 	dnssec-validation yes;
 	dnssec-accept-expired yes;
-	minimal-responses no;

 	zone "." {
 		type hint;
@@ -25,18 +25,8 @@ k2=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone")

 cat "$infile" "$k1.key" "$k2.key" > "$zonefile"

-# The awk script below achieves two goals:
-#
-# - it puts one of the two RRSIG(SOA) records at the end of the zone file, so
-#   that these two records (forming a single RRset) are not placed immediately
-#   next to each other; the test then checks if RRSIG RRsets split this way are
-#   correctly added to resigning heaps,
-#
-# - it places a copy of one of the RRSIG(SOA) records somewhere else than at the
-#   zone apex; the test then checks whether such signatures are automatically
-#   removed from the zone after it is loaded.
 "$SIGNER" -P -3 - -A -o "$zone" -O full -f "$zonefile.unsplit" -e now-3600 -s now-7200 "$zonefile" > /dev/null 2>&1
 awk 'BEGIN { r = ""; }
     $4 == "RRSIG" && $5 == "SOA" && r == "" { r = $0; next; }
     { print }
-     END { print r; print "not-at-zone-apex." r; }' "$zonefile.unsplit" > "$zonefile.signed"
+     END { print r }' "$zonefile.unsplit" > "$zonefile.signed"
@@ -1,5 +0,0 @@
-; This is a key-signing key, keyid 15002, for example.com.
-; Created: 20210423012926 (Fri Apr 23 11:29:26 2021)
-; Publish: 20210423012926 (Fri Apr 23 11:29:26 2021)
-; Activate: 20210423012926 (Fri Apr 23 11:29:26 2021)
-example.com. IN DNSKEY 257 3 8 AwEAAdp+oCXl7vpKA3Mmyndx6/iA+wLrtxeMUiWL7uWJ9ZF24EdS8Dye 63p0lGlyvjvM9T5dTiyEpTAdutEBr79H0MlDqIBqpadrCdJRI2S4kC+0 nq5+Aj2CEyiAamPGujwWeXwtfLAvVPfBqs42PBr6wPQIJOByFYDaZBU3 enUEWgHYy/7OnJDrt0QlswKphR6SvYtyuixiUR8J/WouWXglUY5qlC7Z vVDxs9E4q7B1mfKCyoqcFMKPh9lzEBH+IfUZ543xXEYf2BEztKB1SZ2R QnpYedjATGDcgPis46uA2gHMfvDYJTQ5UqTBtveGb3Wsqc0oRXVPMEoY 3WnWhaKDzkk=
@@ -1,13 +0,0 @@
-Private-key-format: v1.3
-Algorithm: 8 (RSASHA256)
-Modulus: 2n6gJeXu+koDcybKd3Hr+ID7Auu3F4xSJYvu5Yn1kXbgR1LwPJ7renSUaXK+O8z1Pl1OLISlMB260QGvv0fQyUOogGqlp2sJ0lEjZLiQL7Sern4CPYITKIBqY8a6PBZ5fC18sC9U98GqzjY8GvrA9Agk4HIVgNpkFTd6dQRaAdjL/s6ckOu3RCWzAqmFHpK9i3K6LGJRHwn9ai5ZeCVRjmqULtm9UPGz0TirsHWZ8oLKipwUwo+H2XMQEf4h9RnnjfFcRh/YETO0oHVJnZFCelh52MBMYNyA+Kzjq4DaAcx+8NglNDlSpMG294ZvdaypzShFdU8wShjdadaFooPOSQ==
-PublicExponent: AQAB
-PrivateExponent: SD4X64/0DTONonRP+2Biej8DP7r6RcHyo1F6QtDzrg4VJ+AHaLPO/iUvsRHsTk99QwqMv3F4QMmDrHmXR3KSWQmS3Crm7M0aaTzErBfOLMfWs7EcQoQQm5KiGq1phFaWAnXzxTlRKb4SIK6T/wOr6sQKlV+DNqB++Pjn92rh67vLM8kZBUzWI14Vl9N0ib+xOOFH1oYFo7ynDgMfJhpnQSkuRfyQls3aD1eKQsNazRtZ7lFi2S0HR/V0AKYH2AQi7SdL5wH6hYba5cHfpKSw7PebI0lYkUJ4PAg3Xw7DPMkg8O0hkpLICpU8x7MPqQQ74eKDaEY+fjbL0KLL0Dy9UQ==
-Prime1: /IDRb7WzMY6wp14LqDORULoUnmiQOqkRjOQnCoEXT2KVpYwPmGMG+GR40hrMFgqqAZFVmi56VBoasWpYbSBEqM4aJv1JVimMPREk23v5i+TY93kxICO/ee9/v0hXgLmrKUkS1Kwu4a1PxLX5U/LAzXPR6zF+EHP9OKFjDRWHqN0=
-Prime2: 3YU9QdtsXofjNmlDETRwemKv45pa0oVNPmNvS1vtzIpQ3m/QSuhJxzyTgSP9x1XMiIsg63er3LOCtkRifXVE1IBrfIUgchp8YD5LsyesRl2ielE8Hw8PwSA1YjUVu90yRHcVfbZJ8lm2KyRKHgDWXz94t2Xnm/9M5XjUGuNW7l0=
-Exponent1: 7KIkpJYZyvW4ZAFk10sMgiUBMbs4f2D2i509YUC9ga4YJD7wVpVncN1nxS9L19RCopl7KbUo+yxDm8TX/dzhu3j7VVLFqbPiM1Cfw/mZUhszoii3ezFFPpbOl4rKRl66I0TSGvEKNoDfYrBPavby7Rf/wHRveifZRXspgpeMvRk=
-Exponent2: yvvtjuxW2CRiopg/+YL40lyd2cy2DpRRnKqW8BHzzGquAbWpwwopmOS8MSjewgqv2irK5pmJJTpku0nciiOsB6EJXVfLzGLSt4o96ZOf+/aPDNBla/xsLkaqRCxqlvPwvOX2DnS8O9PS5qNhOy7/QNYzcrJxUfPV7awTh/Pr040=
-Coefficient: PHxU1tqPKTpI/8nABvso0SRerc1m+RPWGRk7s/SVcADSBvEW7fUDcwiZeRfK9MdlwPvLiVozbYnRbgRQl8GuKSqAD1+Cnvn2yOQk81AgNKbuKPwF7UvKIdq/c/xnhj2bvZUVSavJ91ux/RlZNP50378Ks8bj5HJl1xzAMVHXB5o=
-Created: 20210423012926
-Publish: 20210423012926
-Activate: 20210423012926
@@ -1,5 +0,0 @@
-; This is a zone-signing key, keyid 63613, for example.com.
-; Created: 20210423012810 (Fri Apr 23 11:28:10 2021)
-; Publish: 20210423012810 (Fri Apr 23 11:28:10 2021)
-; Activate: 20210423012810 (Fri Apr 23 11:28:10 2021)
-example.com. IN DNSKEY 256 3 8 AwEAAZzun7bYfjmGDwUEn4pyJG34vsiawRMW6pEdoNMH87ozxriOzgG6 /4zTjEv8JyYjGQz2k2vcoWWcD+86xD5IUqfa1pdXXUU8bdhG9DBtW/K1 mc4P6g8heU+0f++mq/L4TPlWVZUG8lVH4H8mD6r8PsVK7v/QR7wMeg9b JpCYyxon2A9rZ4zS0J9kX9bfciQVh6ODGVENctwEK5FNp5u0VonPEIx3 5Kj+IVn/mHpfbz4LaC02s7C6Kgvn3ToFFSJczwbOaexl/d+/ai8FLJi7 8UgiAq5/178bcVLItMeY6aD5eQGkRtr2c3JZ/JR4Nf+TQAWFBnl9NSDa RH4Qa55ZNqs=
@@ -1,13 +0,0 @@
-Private-key-format: v1.3
-Algorithm: 8 (RSASHA256)
-Modulus: nO6ftth+OYYPBQSfinIkbfi+yJrBExbqkR2g0wfzujPGuI7OAbr/jNOMS/wnJiMZDPaTa9yhZZwP7zrEPkhSp9rWl1ddRTxt2Eb0MG1b8rWZzg/qDyF5T7R/76ar8vhM+VZVlQbyVUfgfyYPqvw+xUru/9BHvAx6D1smkJjLGifYD2tnjNLQn2Rf1t9yJBWHo4MZUQ1y3AQrkU2nm7RWic8QjHfkqP4hWf+Yel9vPgtoLTazsLoqC+fdOgUVIlzPBs5p7GX9379qLwUsmLvxSCICrn/XvxtxUsi0x5jpoPl5AaRG2vZzcln8lHg1/5NABYUGeX01INpEfhBrnlk2qw==
-PublicExponent: AQAB
-PrivateExponent: N4egcDzO/V/YdLgcFAsrpNY9/BH2e+DCA7NuMv4/WgX0LV4quyYGQzigDksdNzt4I8Qkiig53BCK+uXahwdkaAzhng/F6zfkzoDc6z3nKUzlLasn8U6w9Gk0VAKwGXuPETNheShKG68hWxyGssQrGfjX9SEoIPxxPHnOfZ/zTj95KAnVV5qPz90xVAb0+FUrLXAt72KuRwepOTlsETsMFDKe17uUCqCCdX98Ko0u14wrO6zGRQtNhUsfvNB/pY8fvbHD1GcCTbFSx4FxsUsZMrNtMsvMe3HN9ggC0Y9htbH9HV0hS0w9SKCUyoeOVwf/JZL4hlfoe8+jglsyJpAgoQ==
-Prime1: zeXvO3PT4iXv9GlGeebl39pF1sXs8tXY4B9VHUJGGSYlyOlyCEy4URQJIPfuL6VjFKCErSxUJSrGz0HyQuKr8l9qP/0MGxGRH7wxvUR7YTmai84yyQ4fFENRmn8bzxGwj0MVHIW7cKC59j7nWT24gseT21/NP5m8EnPsjz/K40M=
-Prime2: wx5vVFSydUfr8HtOHNS1kRrTjhnQOfjmj8SxGi72Hk+mgi9fBCTC5fRLifd80wGbgyFk1vZOXeStOC8L3IlnBGLX0O9MNip+vVX3hRzIRhLwHhL1ygN3xEd04qwVH0XJ8+4A0XCzh/FJgW59F62geN6gwedo7GmZAOSZUBAyRHk=
-Exponent1: IlkqeLuQ7Fgx2I87b5iiXp62Keco6TXdkT4I3/GvagCgKw0utc2+rd/uye4ycQZhKg7BM3aCrxScx/STaq8PykY6nmQjgdyDXkzx60YiYwzOCGakuD+/1YyJb4Gm7PthffTN780rgNV/UGIcDBoszrxmoSExR1vpMRbfruIQgas=
-Exponent2: or0Os/KUibc79W6Snv9WlLkgPAQRpViQzNaLtD/47R0Xzrs975HNsMgJ/P+bb86Ga1994MC8ahmh1BuBNCax8nmScWQ1V3QoEzjRYoe4DqIa/aposF4mFWJX/fry/wtRPo+CxSzPwJGh8j86PHaHQmjFAhVFcPE+OP1xVdK8alk=
-Coefficient: r5wPmPXUF5pVC0Y7La3jVkL4w/3wvq9LBz91tH9gA8OUNLpDDBuFZISiJdhOZ4JVw+qSSoHcEa+3Phd+BqxmXzwZDU1Fqta9mLDDGCqCWjVQOopeeJgrvkv9P0TIzEuoGmW50cQhyqHYCtuUxjOnHfiQSc53p7rfD4Vom1VQ3Ok=
-Created: 20210423012810
-Publish: 20210423012810
-Activate: 20210423012810
@@ -1,17 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-;	This is a zone which has two DNSKEY records, both of which have
-; existing private key files available.  They should be loaded automatically
-; and the zone correctly signed.
-;
-$TTL 3600
-example.com.	IN	SOA ns hostmaster 00090000 1200 3600 604800 300
-$include Kexample.com.+008+63613.key
-$include Kexample.com.+008+15002.key
@@ -1312,7 +1312,7 @@ status=$((status+ret))
 echo_ic "one non-KSK DNSKEY ($n)"
 ret=0
 (
-cd signer/general || exit 0
+cd signer/general || exit 1
 rm -f signed.zone
 $SIGNER -f signed.zone -o example.com. test2.zone > signer.out.$n
 test -f signed.zone
@@ -1324,7 +1324,7 @@ status=$((status+ret))
 echo_ic "one KSK DNSKEY ($n)"
 ret=0
 (
-cd signer/general || exit 0
+cd signer/general || exit 1
 rm -f signed.zone
 $SIGNER -f signed.zone -o example.com. test3.zone > signer.out.$n
 test -f signed.zone
@@ -1372,7 +1372,7 @@ status=$((status+ret))
 echo_ic "two DNSKEY, both private keys missing ($n)"
 ret=0
 (
-cd signer/general || exit 0
+cd signer/general || exit 1
 rm -f signed.zone
 $SIGNER -f signed.zone -o example.com. test7.zone > signer.out.$n
 test -f signed.zone
@@ -1384,7 +1384,7 @@ status=$((status+ret))
 echo_ic "two DNSKEY, one private key missing ($n)"
 ret=0
 (
-cd signer/general || exit 0
+cd signer/general || exit 1
 rm -f signed.zone
 $SIGNER -f signed.zone -o example.com. test8.zone > signer.out.$n
 test -f signed.zone
@@ -1393,30 +1393,6 @@ n=$((n+1))
 test "$ret" -eq 0 || echo_i "failed"
 status=$((status+ret))

-echo_ic "check that dnssec-signzone rejects excessive NSEC3 iterations ($n)"
-ret=0
-(
-cd signer/general || exit 0
-rm -f signed.zone
-$SIGNER -f signed.zone -3 - -H 151 -o example.com. test9.zone > signer.out.$n
-test -f signed.zone
-) && ret=1
-n=$((n+1))
-test "$ret" -eq 0 || echo_i "failed"
-status=$((status+ret))
-
-echo_ic "check that dnssec-signzone accepts maximum NSEC3 iterations ($n)"
-ret=0
-(
-cd signer/general || exit 1
-rm -f signed.zone
-$SIGNER -f signed.zone -3 - -H 150 -o example.com. test9.zone > signer.out.$n
-test -f signed.zone
-) || ret=1
-n=$((n+1))
-test "$ret" -eq 0 || echo_i "failed"
-status=$((status+ret))
-
 echo_i "checking that a key using an unsupported algorithm cannot be generated ($n)"
 ret=0
 zone=example
@@ -3268,14 +3244,6 @@ n=$((n+1))
 test "$ret" -eq 0 || echo_i "failed"
 status=$((status+ret))

-echo_i "check that not-at-zone-apex RRSIG(SOA) RRsets are removed from the zone after load ($n)"
-ret=0
-dig_with_opts split-rrsig AXFR @10.53.0.7 > dig.out.test$n || ret=1
-grep -q "not-at-zone-apex.*RRSIG.*SOA" dig.out.test$n && ret=1
-n=$((n+1))
-test "$ret" -eq 0 || echo_i "failed"
-status=$((status+ret))
-
 echo_i "check that 'dnssec-keygen -S' works for all supported algorithms ($n)"
 ret=0
 alg=1
@@ -3862,7 +3830,7 @@ status=$((status+ret))
 echo_i "check that DNAME at apex with NSEC3 is correctly signed (dnssec-signzone) ($n)"
 ret=0
 dig_with_opts txt dname-at-apex-nsec3.example @10.53.0.3 > dig.out.ns3.test$n || ret=1
-grep "RRSIG.NSEC3 ${DEFAULT_ALGORITHM_NUMBER} 3 600" dig.out.ns3.test$n > /dev/null || ret=1
+grep "RRSIG.NSEC3 ${DEFAULT_ALGORITHM_NUMBER} 3 3600" dig.out.ns3.test$n > /dev/null || ret=1
 n=$((n+1))
 test "$ret" -eq 0 || echo_i "failed"
 status=$((status+ret))
@@ -4323,64 +4291,5 @@ n=$((n+1))
 test "$ret" -eq 0 || echo_i "failed"
 status=$((status+ret))

-echo_i "checking excessive NSEC3 iteration warnings in named.run ($n)"
-ret=0
-grep "zone too-many-iterations/IN: excessive NSEC3PARAM iterations [0-9]* > 150" ns2/named.run >/dev/null 2>&1 || ret=1
-grep "zone too-many-iterations/IN: excessive NSEC3PARAM iterations [0-9]* > 150" ns3/named.run >/dev/null 2>&1 || ret=1
-n=$((n+1))
-test "$ret" -eq 0 || echo_i "failed"
-status=$((status+ret))
-
-# Check that the validating resolver will fallback to insecure if the answer
-# contains NSEC3 records with high iteration count.
-echo_i "checking fallback to insecure when NSEC3 iterations is too high (nxdomain) ($n)"
-ret=0
-dig_with_opts @10.53.0.2 does-not-exist.too-many-iterations > dig.out.ns2.test$n || ret=1
-dig_with_opts @10.53.0.4 does-not-exist.too-many-iterations > dig.out.ns4.test$n || ret=1
-digcomp dig.out.ns2.test$n dig.out.ns4.test$n || ret=1
-grep "flags: qr rd ra;" dig.out.ns4.test$n >/dev/null || ret=1
-grep "status: NXDOMAIN" dig.out.ns4.test$n >/dev/null || ret=1
-grep "ANSWER: 0, AUTHORITY: 6" dig.out.ns4.test$n > /dev/null || ret=1
-n=$((n+1))
-test "$ret" -eq 0 || echo_i "failed"
-status=$((status+ret))
-
-echo_i "checking fallback to insecure when NSEC3 iterations is too high (nodata) ($n)"
-ret=0
-dig_with_opts @10.53.0.2 a.too-many-iterations txt > dig.out.ns2.test$n || ret=1
-dig_with_opts @10.53.0.4 a.too-many-iterations txt > dig.out.ns4.test$n || ret=1
-digcomp dig.out.ns2.test$n dig.out.ns4.test$n || ret=1
-grep "flags: qr rd ra;" dig.out.ns4.test$n >/dev/null || ret=1
-grep "status: NOERROR" dig.out.ns4.test$n >/dev/null || ret=1
-grep "ANSWER: 0, AUTHORITY: 4" dig.out.ns4.test$n > /dev/null || ret=1
-n=$((n+1))
-test "$ret" -eq 0 || echo_i "failed"
-status=$((status+ret))
-
-echo_i "checking fallback to insecure when NSEC3 iterations is too high (wildcard) ($n)"
-ret=0
-dig_with_opts @10.53.0.2 wild.a.too-many-iterations > dig.out.ns2.test$n || ret=1
-dig_with_opts @10.53.0.4 wild.a.too-many-iterations > dig.out.ns4.test$n || ret=1
-digcomp dig.out.ns2.test$n dig.out.ns4.test$n || ret=1
-grep "flags: qr rd ra;" dig.out.ns4.test$n >/dev/null || ret=1
-grep "status: NOERROR" dig.out.ns4.test$n >/dev/null || ret=1
-grep 'wild\.a\.too-many-iterations\..*A.10\.0\.0\.3' dig.out.ns4.test$n >/dev/null || ret=1
-grep "ANSWER: 2, AUTHORITY: 4" dig.out.ns4.test$n > /dev/null || ret=1
-n=$((n+1))
-test "$ret" -eq 0 || echo_i "failed"
-status=$((status+ret))
-
-echo_i "checking fallback to insecure when NSEC3 iterations is too high (wildcard nodata) ($n)"
-ret=0
-dig_with_opts @10.53.0.2 type100 wild.a.too-many-iterations > dig.out.ns2.test$n || ret=1
-dig_with_opts @10.53.0.4 type100 wild.a.too-many-iterations > dig.out.ns4.test$n || ret=1
-digcomp dig.out.ns2.test$n dig.out.ns4.test$n || ret=1
-grep "flags: qr rd ra;" dig.out.ns4.test$n >/dev/null || ret=1
-grep "status: NOERROR" dig.out.ns4.test$n >/dev/null || ret=1
-grep "ANSWER: 0, AUTHORITY: 8" dig.out.ns4.test$n > /dev/null || ret=1
-n=$((n+1))
-test "$ret" -eq 0 || echo_i "failed"
-status=$((status+ret))
-
 echo_i "exit status: $status"
 [ $status -eq 0 ] || exit 1
@@ -164,8 +164,7 @@ wks01.example.		3600	IN	WKS	10.0.0.1 6 0 1 2 21 23
 wks02.example.		3600	IN	WKS	10.0.0.1 17 0 1 2 53
 wks03.example.		3600	IN	WKS	10.0.0.2 6 65535
 x2501.example.		3600	IN	X25	"123456789"
-zonemd01.example.	3600	IN	ZONEMD	2019020700 1 1 C220B8A6ED5728A971902F7E3D4FD93ADEEA88B0453C2E8E8C863D46 5AB06CF34EB95B266398C98B59124FA239CB7EEB
-zonemd02.example.	3600	IN	ZONEMD	2019020700 1 2 08CFA1115C7B948C4163A901270395EA226A930CD2CBCF2FA9A5E6EB 85F37C8A4E114D884E66F176EAB121CB02DB7D652E0CC4827E7A3204 F166B47E5613FD27
+zonemd01.example.	3600	IN	ZONEMD	2019020700 1 0 C220B8A6ED5728A971902F7E3D4FD93ADEEA88B0453C2E8E8C863D46 5AB06CF34EB95B266398C98B59124FA239CB7EEB
 8f1tmio9avcom2k0frp92lgcumak0cad.example. 3600 IN NSEC3	1 0 10 D2CF0294C020CE6C 8FPNS2UCT7FBS643THP2B77PEQ77K6IU A NS SOA MX AAAA RRSIG DNSKEY NSEC3PARAM
 kcd3juae64f9c5csl1kif1htaui7un0g.example. 3600 IN NSEC3	1 0 10 D2CF0294C020CE6C KD5MN2M20340DGO0BL7NTSB8JP4BSC7E
 mr5ukvsk1l37btu4q7b1dfevft4hkqdk.example. 3600 IN NSEC3	1 0 10 D2CF0294C020CE6C MT38J6VG7S0SN5G17MCUF6IQIKFUAJ05 A AAAA RRSIG
@@ -4,7 +4,8 @@ AM_CPPFLAGS +=			\
 	$(LIBISC_CFLAGS)	\
 	$(LIBDNS_CFLAGS)

-check_LTLIBRARIES = sample.la
+dyndb_LTLIBRARIES = sample.la
+dyndbdir = $(abs_builddir)

 sample_la_SOURCES =	\
 	db.c		\
@@ -22,4 +23,4 @@ sample_la_SOURCES =	\
 	util.h		\
 	zone.h

-sample_la_LDFLAGS = -avoid-version -module -shared -export-dynamic -rpath $(abs_builddir)
+sample_la_LDFLAGS = -avoid-version -module -shared -export-dynamic
@@ -229,7 +229,7 @@ syncptr(sample_instance_t *inst, dns_name_t *name, dns_rdata_t *addr_rdata,
 	/* Reverse zone is managed by this driver, prepare PTR record */
 	pevent->zone = NULL;
 	dns_zone_attach(ptr_zone, &pevent->zone);
-	dns_name_copy(name, dns_fixedname_name(&pevent->ptr_target_name));
+	dns_name_copynf(name, dns_fixedname_name(&pevent->ptr_target_name));
 	dns_name_clone(dns_fixedname_name(&pevent->ptr_target_name),
 		       &ptr_struct.ptr);
 	dns_diff_init(inst->mctx, &pevent->diff);
@@ -1 +0,0 @@
-m record,size,mctx -c named.conf -d 1 -D fetchlimit-ns3 -X named.lock -g -T maxcachesize=2097152
@@ -369,17 +369,11 @@ csync01			CSYNC	0 0 A NS AAAA
 csync02			CSYNC	0 0

 ;type	63
-zonemd01		ZONEMD	2019020700 1 1 (
+zonemd01		ZONEMD	2019020700 1 0 (
                                C220B8A6ED5728A971902F7E3D4FD93A
                                DEEA88B0453C2E8E8C863D465AB06CF3
                                4EB95B266398C98B59124FA239CB7EEB
 				)
-zonemd02		ZONEMD	2019020700 1 2 (
-				08CFA1115C7B948C4163A901270395EA
-			        226A930CD2CBCF2FA9A5E6EB85F37C8A
-                                4E114D884E66F176EAB121CB02DB7D65
-                                2E0CC4827E7A3204F166B47E5613FD27
-				)

 ; type 64 -- 98 (unassigned)

@@ -12,15 +12,60 @@
 # This script is a 'port' broker.  It keeps track of ports given to the
 # individual system subtests, so every test is given a unique port range.

-total_tests=$(find . -maxdepth 1 -mindepth 1 -type d | wc -l)
-ports_per_test=20
+lockfile=get_ports.lock
+statefile=get_ports.state

 port_min=5001
-port_max=$((32767 - (total_tests * ports_per_test)))
+port_max=32767
+
+get_random() (
+    # shellcheck disable=SC2005,SC2046
+    echo $(dd if=/dev/urandom bs=1 count=2 2>/dev/null | od -tu2 -An) | sed -e 's/^0*//'
+)
+
+get_port() {
+    tries=10
+    port=0
+    while [ "${tries}" -gt 0 ]; do
+	if ( set -o noclobber; echo "$$" > "${lockfile}" ) 2> /dev/null; then
+	    trap 'rm -f "${lockfile}"; exit $?' INT TERM EXIT
+
+	    port=$(cat "${statefile}" 2>/dev/null)
+
+	    if [ -z "${port}" ]; then
+		if [ "$1" -gt 0 ]; then
+		    port="$1"
+		else
+		    port_range=$((port_max-port_min))
+		    port_random=$(get_random)
+		    port=$((port_random%port_range+port_min))
+		fi
+	    fi
+
+	    if [ "$((port+1))" -gt "${port_max}" ]; then
+		port="${port_min}"
+	    fi
+
+	    echo $((port+1)) > get_ports.state
+
+	    # clean up after yourself, and release your trap
+	    rm -f "${lockfile}"
+	    trap - INT TERM EXIT
+
+	    # we have our port
+	    break
+	fi
+	sleep 1
+	tries=$((tries-1))
+    done
+    if [ "$port" -eq 0 ]; then
+	exit 1
+    fi
+    echo "$port"
+}

 baseport=0
-test_index=0
-while getopts "p:t:-:" OPT; do
+while getopts "p:-:" OPT; do
    if [ "$OPT" = "-" ] && [ -n "$OPTARG" ]; then
 	OPT="${OPTARG%%=*}"
 	OPTARG="${OPTARG#$OPT}"
@@ -30,36 +75,24 @@ while getopts "p:t:-:" OPT; do
    # shellcheck disable=SC2214
    case "$OPT" in
 	p | port) baseport=$OPTARG ;;
-	t | test)
-		test_index=$(find . -maxdepth 1 -mindepth 1 -type d | sort | grep -F -x -n "./${OPTARG}" | cut -d: -f1)
-		if [ -z "${test_index}" ]; then
-			echo "Test '${OPTARG}' not found" >&2
-			exit 1
-		fi
-		;;
 	-) break ;;
 	*) echo "invalid option" >&2; exit 1 ;;
    esac
 done

-port_pool_size=$((port_max - port_min))
-if [ "${baseport}" -eq 0 ]; then
-	baseport="$((($(date +%s) / 3600 % port_pool_size) + port_min + (test_index * ports_per_test)))"
-fi
-
-echo "export PORT=$((baseport))"
-echo "export TLSPORT=$((baseport + 1))"
-echo "export HTTPPORT=$((baseport + 2))"
-echo "export HTTPSPORT=$((baseport + 3))"
-echo "export EXTRAPORT1=$((baseport + 4))"
-echo "export EXTRAPORT2=$((baseport + 5))"
-echo "export EXTRAPORT3=$((baseport + 6))"
-echo "export EXTRAPORT4=$((baseport + 7))"
-echo "export EXTRAPORT5=$((baseport + 8))"
-echo "export EXTRAPORT6=$((baseport + 9))"
-echo "export EXTRAPORT7=$((baseport + 10))"
-echo "export EXTRAPORT8=$((baseport + 11))"
-echo "export CONTROLPORT=$((baseport + 12))"
+echo "export PORT=$(get_port "$baseport")"
+echo "export TLSPORT=$(get_port)"
+echo "export HTTPPORT=$(get_port)"
+echo "export HTTPSPORT=$(get_port)"
+echo "export EXTRAPORT1=$(get_port)"
+echo "export EXTRAPORT2=$(get_port)"
+echo "export EXTRAPORT3=$(get_port)"
+echo "export EXTRAPORT4=$(get_port)"
+echo "export EXTRAPORT5=$(get_port)"
+echo "export EXTRAPORT6=$(get_port)"
+echo "export EXTRAPORT7=$(get_port)"
+echo "export EXTRAPORT8=$(get_port)"
+echo "export CONTROLPORT=$(get_port)"

 # Local Variables:
 # sh-basic-offset: 4
@@ -6,7 +6,8 @@ AM_CPPFLAGS +=			\
 	$(LIBNS_CFLAGS)		\
 	$(LIBISCCFG_CFLAGS)

-check_LTLIBRARIES = test-async.la
+hooks_LTLIBRARIES = test-async.la
+hooksdir = $(abs_builddir)

 test_async_la_SOURCES = test-async.c
-test_async_la_LDFLAGS = -avoid-version -module -shared -export-dynamic -rpath $(abs_builddir)
+test_async_la_LDFLAGS = -avoid-version -module -shared -export-dynamic
@@ -1 +0,0 @@
-f		A	10.0.0.7
@@ -1,24 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 300	; 5 minutes
-@			IN SOA	ns3 . (
-				2000042412 ; serial
-				20         ; refresh (20 seconds)
-				20         ; retry (20 seconds)
-				1814400    ; expire (3 weeks)
-				3600       ; minimum (1 hour)
-				)
-			NS	ns3
-ns3			A	10.53.0.3
-
-c			A	10.0.0.3
-e			A	10.0.0.5
-
-$INCLUDE include.db
@@ -30,7 +30,6 @@ cp ns3/master.db.in ns3/nsec3.db
 cp ns3/master.db.in ns3/externalkey.db
 cp ns3/master.db.in ns3/delayedkeys.db
 cp ns3/master.db.in ns3/removedkeys-primary.db
-cp ns3/include.db.in ns3/include.db

 mkdir ns3/removedkeys

@@ -940,17 +940,17 @@ status=`expr $status + $ret`

 n=`expr $n + 1`
 echo_i "check that reloading errors prevent synchronization ($n)"
-ret=1
+ret=0
 $DIG $DIGOPTS +short @10.53.0.3 master SOA > dig.out.ns3.test$n.1 || ret=1
 sleep 1
 nextpart ns3/named.run > /dev/null
-cp ns3/master6.db.in ns3/master.db
+cp ns3/master5.db.in ns3/master.db
 rndc_reload ns3 10.53.0.3
 for i in 1 2 3 4 5 6 7 8 9 10
 do
-	if nextpart ns3/named.run | grep "not loaded due to errors" > /dev/null
+	if nextpart ns3/named.run |
+           grep "not loaded due to errors" > /dev/null
        then
-		ret=0
 		break
 	fi
 	sleep 1
@@ -961,30 +961,6 @@ $DIFF dig.out.ns3.test$n.1  dig.out.ns3.test$n.2 > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`

-n=`expr $n + 1`
-echo_i "check inline-signing with an include file ($n)"
-ret=0
-$DIG $DIGOPTS +short @10.53.0.3 master SOA > dig.out.ns3.test$n.1 || ret=1
-if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
-sleep 1
-nextpart ns3/named.run > /dev/null
-cp ns3/master7.db.in ns3/master.db
-rndc_reload ns3 10.53.0.3
-_includefile_loaded() {
-	$DIG $DIGOPTS @10.53.0.3 f.master A > dig.out.ns3.test$n
-	grep "status: NOERROR" dig.out.ns3.test$n > /dev/null || return 1
-	grep "ANSWER: 2," dig.out.ns3.test$n > /dev/null || return 1
-	grep "10\.0\.0\.7" dig.out.ns3.test$n > /dev/null || return 1
-	return 0
-}
-retry_quiet 10 _includefile_loaded
-# Sanity check: the SOA record should be changed
-$DIG $DIGOPTS +short @10.53.0.3 master SOA > dig.out.ns3.test$n.2 || ret=1
-$DIFF dig.out.ns3.test$n.1  dig.out.ns3.test$n.2 > /dev/null && ret=1
-if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
-
 n=`expr $n + 1`
 echo_i "test add/del zone combinations ($n)"
 ret=0
@@ -108,7 +108,7 @@ if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))

 n=$((n+1))
-echo_i "testing AXFR fallback after IXFR failure (not exact error) ($n)"
+echo_i "testing AXFR fallback after IXFR failure ($n)"
 ret=0

 # Provide a broken IXFR response and a working fallback AXFR response
@@ -142,66 +142,6 @@ $DIG $DIGOPTS @10.53.0.1 nil. TXT | grep 'fallback AXFR' >/dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))

-n=$((n+1))
-echo_i "testing AXFR fallback after IXFR failure (bad SOA owner) ($n)"
-ret=0
-
-# Prepare for checking the logs later on.
-nextpart ns1/named.run >/dev/null
-
-# Provide a broken IXFR response and a working fallback AXFR response.
-sendcmd <<EOF
-/SOA/
-nil.      	300	SOA	ns.nil. root.nil. 4 300 300 604800 300
-/IXFR/
-nil.      	300	SOA	ns.nil. root.nil. 4 300 300 604800 300
-nil.      	300	SOA	ns.nil. root.nil. 3 300 300 604800 300
-bad-owner.    	300	SOA	ns.nil. root.nil. 4 300 300 604800 300
-test.nil.	300	TXT	"serial 4, malformed IXFR"
-nil.      	300	SOA	ns.nil. root.nil. 4 300 300 604800 300
-/AXFR/
-nil.      	300	SOA	ns.nil. root.nil. 4 300 300 604800 300
-/AXFR/
-nil.      	300	NS	ns.nil.
-test.nil.      	300	TXT	"serial 4, fallback AXFR"
-/AXFR/
-nil.      	300	SOA	ns.nil. root.nil. 4 300 300 604800 300
-EOF
-$RNDCCMD 10.53.0.1 refresh nil | sed 's/^/ns1 /' | cat_i
-
-# A broken server would accept the malformed IXFR and apply its contents to the
-# zone.  A fixed one would reject the IXFR and fall back to AXFR.  Both IXFR and
-# AXFR above bring the nil. zone up to serial 4, but we cannot reliably query
-# for the SOA record to check whether the transfer was finished because a broken
-# server would send back SERVFAIL responses to SOA queries after accepting the
-# malformed IXFR.  Instead, check transfer progress by querying for a TXT record
-# at test.nil. which is present in both IXFR and AXFR (with different contents).
-_wait_until_transfer_is_finished() {
-	$DIG $DIGOPTS +tries=1 +time=1 @10.53.0.1 test.nil. TXT > dig.out.test$n.1 &&
-	grep -q -F "serial 4" dig.out.test$n.1
-}
-if ! retry_quiet 10 _wait_until_transfer_is_finished; then
-	echo_i "timed out waiting for version 4 of zone nil. to be transferred"
-	ret=1
-fi
-
-# At this point a broken server would be serving a zone with no SOA records.
-# Try crashing it by triggering a SOA refresh query.
-$RNDCCMD 10.53.0.1 refresh nil | sed 's/^/ns1 /' | cat_i
-
-# Do not wait until the zone refresh completes - even if a crash has not
-# happened by now, a broken server would never serve the record which is only
-# present in the fallback AXFR, so checking for that is enough to verify if a
-# server is broken or not; if it is, it is bound to crash shortly anyway.
-$DIG $DIGOPTS test.nil. TXT @10.53.0.1 > dig.out.test$n.2 || ret=1
-grep -q -F "serial 4, fallback AXFR" dig.out.test$n.2 || ret=1
-
-# Ensure the expected error is logged.
-nextpart ns1/named.run | grep -q -F "SOA name mismatch" || ret=1
-
-if [ $ret != 0 ]; then echo_i "failed"; fi
-status=$((status+ret))
-
 n=$((n+1))
 echo_i "testing ixfr-from-differences option ($n)"
 # ns3 is primary; ns4 is secondary
@@ -311,25 +251,12 @@ $DIG $DIGOPTS ixfr=1 +notcp test @10.53.0.4 > dig.out2.test$n || ret=1
 digcomp dig.out1.test$n dig.out2.test$n || ret=1
 awk '$4 == "SOA" { soacnt++} END {if (soacnt == 1) exit(0); else exit(1);}' dig.out1.test$n || ret=1
 awk '$4 == "SOA" { if ($7 == 3) exit(0); else exit(1);}' dig.out1.test$n || ret=1
-#
-nextpart ns4/named.run > /dev/null
 # Should be incremental transfer.
 $DIG $DIGOPTS ixfr=1 test @10.53.0.4 > dig.out3.test$n || ret=1
 awk '$4 == "SOA" { soacnt++} END { if (soacnt == 6) exit(0); else exit(1);}' dig.out3.test$n || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))

-n=$((n+1))
-echo_i "check estimated IXFR size ($n)"
-ret=0
-# note IXFR delta size will be slightly bigger with version 1 transaction
-# headers as there is no correction for the overall record length storage.
-# Ver1 = 4 * (6 + 10 + 10 + 17 + 5 * 4) + 2 * (13 + 10 + 4) + (6 * 4) = 330
-# Ver2 = 4 * (6 + 10 + 10 + 17 + 5 * 4) + 2 * (13 + 10 + 4) = 306
-nextpart ns4/named.run | grep "IXFR delta size (306 bytes)" > /dev/null || ret=1
-if [ $ret != 0 ]; then echo_i "failed"; fi
-status=$((status+ret))
-
 # make sure ns5 has transfered the zone
 # wait for secondary to reload
 tret=0
@@ -7,11 +7,8 @@
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.

-rm -f */*.db */*.jnl
-rm -f */named.conf
 rm -f */named.memstats
 rm -f */named.run
+rm -f */named.conf
+rm -f */*.db */*.jnl
 rm -f dig.out*
-rm -f journalprint.out.*
-rm -f ns1/managed-keys.bind
-rm -f tmp.jnl
@@ -1,2 +0,0 @@
-.			0	IN	SOA	. . 3297 0 0 0 0
-.			0	IN	TYPE65533 \# 276 60621140598E0A83000000000101030803010001ACFFB409BCC939F8 31F7A1E5EC88F7A59255EC53040BE432027390A4CE896D6F9086F3C5 E177FBFE118163AAEC7AF1462C47945944C4E2C026BE5E98BBCDED25 978272E1E3E079C5094D573F0E83C92F02B32D3513B1550B826929C8 0DD0F92CAC966D17769FD5867B647C3F38029ABDC48152EB8F207159 ECC5D232C7C1537C79F4B7AC28FF11682F21681BF6D6ABA555032BF6 F9F036BEB2AAA5B3778D6EEBFBA6BF9EA191BE4AB0CAEA759E2F773A 1F9029C73ECB8D5735B9321DB085F1B8E2D8038FE2941992548CEE0D 67DD4547E11DD63AF9C9FC1C5466FB684CF009D7197C2CF79E792AB5 01E6A8A1CA519AF2CB9B5F6367E94C0D47502451357BE1B5
@@ -1,704 +0,0 @@
-3b42494e44204c4f472056390a000000
-00000cd20000020000000ce200002bf8
-00000038000000000000000000000000
-00000000000000000000000000000000
-00000cd20000020000000cd30000049c
-00000cd40000073800000cd5000009d8
-00000cd600000c7800000cd700000f18
-00000cd8000011b800000cd900001458
-00000cda000016f800000cdb00001998
-00000cdc00001c3800000cdd00001ed8
-00000cde0000217800000cdf00002418
-00000ce0000026b800000ce100002958
-00000000000000000000000000000000
-00000000000000000000000000000000
-00000000000000000000000000000000
-00000000000000000000000000000000
-00000000000000000000000000000000
-00000000000000000000000000000000
-00000000000000000000000000000000
-00000000000000000000000000000000
-00000000000000000000000000000000
-00000000000000000000000000000000
-00000000000000000000000000000000
-00000000000000000000000000000000
-00000000000000000000000000000000
-00000000000000000000000000000000
-00000000000000000000000000000000
-00000000000000000000000000000000
-00000000000000000000000000000000
-00000000000000000000000000000000
-00000000000000000000000000000000
-00000000000000000000000000000000
-0000029000000cd200000cd300000021
-0000060001000000000016000000000c
-d2000000000000000000000000000000
-000000011f00fffd0001000000000114
-6058a4c2598e0a830000000001010308
-03010001acffb409bcc939f831f7a1e5
-ec88f7a59255ec53040be432027390a4
-ce896d6f9086f3c5e177fbfe118163aa
-ec7af1462c47945944c4e2c026be5e98
-bbcded25978272e1e3e079c5094d573f
-0e83c92f02b32d3513b1550b826929c8
-0dd0f92cac966d17769fd5867b647c3f
-38029abdc48152eb8f207159ecc5d232
-c7c1537c79f4b7ac28ff11682f21681b
-f6d6aba555032bf6f9f036beb2aaa5b3
-778d6eebfba6bf9ea191be4ab0caea75
-9e2f773a1f9029c73ecb8d5735b9321d
-b085f1b8e2d8038fe2941992548cee0d
-67dd4547e11dd63af9c9fc1c5466fb68
-4cf009d7197c2cf79e792ab501e6a8a1
-ca519af2cb9b5f6367e94c0d47502451
-357be1b5000000210000060001000000
-000016000000000cd300000000000000
-0000000000000000000000011f00fffd
-00010000000001146058e4a0598e0a83
-000000000101030803010001acffb409
-bcc939f831f7a1e5ec88f7a59255ec53
-040be432027390a4ce896d6f9086f3c5
-e177fbfe118163aaec7af1462c479459
-44c4e2c026be5e98bbcded25978272e1
-e3e079c5094d573f0e83c92f02b32d35
-13b1550b826929c80dd0f92cac966d17
-769fd5867b647c3f38029abdc48152eb
-8f207159ecc5d232c7c1537c79f4b7ac
-28ff11682f21681bf6d6aba555032bf6
-f9f036beb2aaa5b3778d6eebfba6bf9e
-a191be4ab0caea759e2f773a1f9029c7
-3ecb8d5735b9321db085f1b8e2d8038f
-e2941992548cee0d67dd4547e11dd63a
-f9c9fc1c5466fb684cf009d7197c2cf7
-9e792ab501e6a8a1ca519af2cb9b5f63
-67e94c0d47502451357be1b500000290
-00000cd300000cd40000002100000600
-01000000000016000000000cd3000000
-00000000000000000000000000000001
-1f00fffd00010000000001146058e4a0
-598e0a83000000000101030803010001
-acffb409bcc939f831f7a1e5ec88f7a5
-9255ec53040be432027390a4ce896d6f
-9086f3c5e177fbfe118163aaec7af146
-2c47945944c4e2c026be5e98bbcded25
-978272e1e3e079c5094d573f0e83c92f
-02b32d3513b1550b826929c80dd0f92c
-ac966d17769fd5867b647c3f38029abd
-c48152eb8f207159ecc5d232c7c1537c
-79f4b7ac28ff11682f21681bf6d6aba5
-55032bf6f9f036beb2aaa5b3778d6eeb
-fba6bf9ea191be4ab0caea759e2f773a
-1f9029c73ecb8d5735b9321db085f1b8
-e2d8038fe2941992548cee0d67dd4547
-e11dd63af9c9fc1c5466fb684cf009d7
-197c2cf79e792ab501e6a8a1ca519af2
-cb9b5f6367e94c0d47502451357be1b5
-00000021000006000100000000001600
-0000000cd40000000000000000000000
-00000000000000011f00fffd00010000
-000001146059f642598e0a8300000000
-0101030803010001acffb409bcc939f8
-31f7a1e5ec88f7a59255ec53040be432
-027390a4ce896d6f9086f3c5e177fbfe
-118163aaec7af1462c47945944c4e2c0
-26be5e98bbcded25978272e1e3e079c5
-094d573f0e83c92f02b32d3513b1550b
-826929c80dd0f92cac966d17769fd586
-7b647c3f38029abdc48152eb8f207159
-ecc5d232c7c1537c79f4b7ac28ff1168
-2f21681bf6d6aba555032bf6f9f036be
-b2aaa5b3778d6eebfba6bf9ea191be4a
-b0caea759e2f773a1f9029c73ecb8d57
-35b9321db085f1b8e2d8038fe2941992
-548cee0d67dd4547e11dd63af9c9fc1c
-5466fb684cf009d7197c2cf79e792ab5
-01e6a8a1ca519af2cb9b5f6367e94c0d
-47502451357be1b50000029000000cd4
-00000cd5000000000000002100000600
-01000000000016000000000cd4000000
-00000000000000000000000000000001
-1f00fffd00010000000001146059f642
-598e0a83000000000101030803010001
-acffb409bcc939f831f7a1e5ec88f7a5
-9255ec53040be432027390a4ce896d6f
-9086f3c5e177fbfe118163aaec7af146
-2c47945944c4e2c026be5e98bbcded25
-978272e1e3e079c5094d573f0e83c92f
-02b32d3513b1550b826929c80dd0f92c
-ac966d17769fd5867b647c3f38029abd
-c48152eb8f207159ecc5d232c7c1537c
-79f4b7ac28ff11682f21681bf6d6aba5
-55032bf6f9f036beb2aaa5b3778d6eeb
-fba6bf9ea191be4ab0caea759e2f773a
-1f9029c73ecb8d5735b9321db085f1b8
-e2d8038fe2941992548cee0d67dd4547
-e11dd63af9c9fc1c5466fb684cf009d7
-197c2cf79e792ab501e6a8a1ca519af2
-cb9b5f6367e94c0d47502451357be1b5
-00000021000006000100000000001600
-0000000cd50000000000000000000000
-00000000000000011f00fffd00010000
-00000114605a283e598e0a8300000000
-0101030803010001acffb409bcc939f8
-31f7a1e5ec88f7a59255ec53040be432
-027390a4ce896d6f9086f3c5e177fbfe
-118163aaec7af1462c47945944c4e2c0
-26be5e98bbcded25978272e1e3e079c5
-094d573f0e83c92f02b32d3513b1550b
-826929c80dd0f92cac966d17769fd586
-7b647c3f38029abdc48152eb8f207159
-ecc5d232c7c1537c79f4b7ac28ff1168
-2f21681bf6d6aba555032bf6f9f036be
-b2aaa5b3778d6eebfba6bf9ea191be4a
-b0caea759e2f773a1f9029c73ecb8d57
-35b9321db085f1b8e2d8038fe2941992
-548cee0d67dd4547e11dd63af9c9fc1c
-5466fb684cf009d7197c2cf79e792ab5
-01e6a8a1ca519af2cb9b5f6367e94c0d
-47502451357be1b50000029000000cd5
-00000cd6000000000000002100000600
-01000000000016000000000cd5000000
-00000000000000000000000000000001
-1f00fffd0001000000000114605a283e
-598e0a83000000000101030803010001
-acffb409bcc939f831f7a1e5ec88f7a5
-9255ec53040be432027390a4ce896d6f
-9086f3c5e177fbfe118163aaec7af146
-2c47945944c4e2c026be5e98bbcded25
-978272e1e3e079c5094d573f0e83c92f
-02b32d3513b1550b826929c80dd0f92c
-ac966d17769fd5867b647c3f38029abd
-c48152eb8f207159ecc5d232c7c1537c
-79f4b7ac28ff11682f21681bf6d6aba5
-55032bf6f9f036beb2aaa5b3778d6eeb
-fba6bf9ea191be4ab0caea759e2f773a
-1f9029c73ecb8d5735b9321db085f1b8
-e2d8038fe2941992548cee0d67dd4547
-e11dd63af9c9fc1c5466fb684cf009d7
-197c2cf79e792ab501e6a8a1ca519af2
-cb9b5f6367e94c0d47502451357be1b5
-00000021000006000100000000001600
-0000000cd60000000000000000000000
-00000000000000011f00fffd00010000
-00000114605b47c2598e0a8300000000
-0101030803010001acffb409bcc939f8
-31f7a1e5ec88f7a59255ec53040be432
-027390a4ce896d6f9086f3c5e177fbfe
-118163aaec7af1462c47945944c4e2c0
-26be5e98bbcded25978272e1e3e079c5
-094d573f0e83c92f02b32d3513b1550b
-826929c80dd0f92cac966d17769fd586
-7b647c3f38029abdc48152eb8f207159
-ecc5d232c7c1537c79f4b7ac28ff1168
-2f21681bf6d6aba555032bf6f9f036be
-b2aaa5b3778d6eebfba6bf9ea191be4a
-b0caea759e2f773a1f9029c73ecb8d57
-35b9321db085f1b8e2d8038fe2941992
-548cee0d67dd4547e11dd63af9c9fc1c
-5466fb684cf009d7197c2cf79e792ab5
-01e6a8a1ca519af2cb9b5f6367e94c0d
-47502451357be1b50000029000000cd6
-00000cd7000000000000002100000600
-01000000000016000000000cd6000000
-00000000000000000000000000000001
-1f00fffd0001000000000114605b47c2
-598e0a83000000000101030803010001
-acffb409bcc939f831f7a1e5ec88f7a5
-9255ec53040be432027390a4ce896d6f
-9086f3c5e177fbfe118163aaec7af146
-2c47945944c4e2c026be5e98bbcded25
-978272e1e3e079c5094d573f0e83c92f
-02b32d3513b1550b826929c80dd0f92c
-ac966d17769fd5867b647c3f38029abd
-c48152eb8f207159ecc5d232c7c1537c
-79f4b7ac28ff11682f21681bf6d6aba5
-55032bf6f9f036beb2aaa5b3778d6eeb
-fba6bf9ea191be4ab0caea759e2f773a
-1f9029c73ecb8d5735b9321db085f1b8
-e2d8038fe2941992548cee0d67dd4547
-e11dd63af9c9fc1c5466fb684cf009d7
-197c2cf79e792ab501e6a8a1ca519af2
-cb9b5f6367e94c0d47502451357be1b5
-00000021000006000100000000001600
-0000000cd70000000000000000000000
-00000000000000011f00fffd00010000
-00000114605b79bf598e0a8300000000
-0101030803010001acffb409bcc939f8
-31f7a1e5ec88f7a59255ec53040be432
-027390a4ce896d6f9086f3c5e177fbfe
-118163aaec7af1462c47945944c4e2c0
-26be5e98bbcded25978272e1e3e079c5
-094d573f0e83c92f02b32d3513b1550b
-826929c80dd0f92cac966d17769fd586
-7b647c3f38029abdc48152eb8f207159
-ecc5d232c7c1537c79f4b7ac28ff1168
-2f21681bf6d6aba555032bf6f9f036be
-b2aaa5b3778d6eebfba6bf9ea191be4a
-b0caea759e2f773a1f9029c73ecb8d57
-35b9321db085f1b8e2d8038fe2941992
-548cee0d67dd4547e11dd63af9c9fc1c
-5466fb684cf009d7197c2cf79e792ab5
-01e6a8a1ca519af2cb9b5f6367e94c0d
-47502451357be1b50000029000000cd7
-00000cd8000000000000002100000600
-01000000000016000000000cd7000000
-00000000000000000000000000000001
-1f00fffd0001000000000114605b79bf
-598e0a83000000000101030803010001
-acffb409bcc939f831f7a1e5ec88f7a5
-9255ec53040be432027390a4ce896d6f
-9086f3c5e177fbfe118163aaec7af146
-2c47945944c4e2c026be5e98bbcded25
-978272e1e3e079c5094d573f0e83c92f
-02b32d3513b1550b826929c80dd0f92c
-ac966d17769fd5867b647c3f38029abd
-c48152eb8f207159ecc5d232c7c1537c
-79f4b7ac28ff11682f21681bf6d6aba5
-55032bf6f9f036beb2aaa5b3778d6eeb
-fba6bf9ea191be4ab0caea759e2f773a
-1f9029c73ecb8d5735b9321db085f1b8
-e2d8038fe2941992548cee0d67dd4547
-e11dd63af9c9fc1c5466fb684cf009d7
-197c2cf79e792ab501e6a8a1ca519af2
-cb9b5f6367e94c0d47502451357be1b5
-00000021000006000100000000001600
-0000000cd80000000000000000000000
-00000000000000011f00fffd00010000
-00000114605c9943598e0a8300000000
-0101030803010001acffb409bcc939f8
-31f7a1e5ec88f7a59255ec53040be432
-027390a4ce896d6f9086f3c5e177fbfe
-118163aaec7af1462c47945944c4e2c0
-26be5e98bbcded25978272e1e3e079c5
-094d573f0e83c92f02b32d3513b1550b
-826929c80dd0f92cac966d17769fd586
-7b647c3f38029abdc48152eb8f207159
-ecc5d232c7c1537c79f4b7ac28ff1168
-2f21681bf6d6aba555032bf6f9f036be
-b2aaa5b3778d6eebfba6bf9ea191be4a
-b0caea759e2f773a1f9029c73ecb8d57
-35b9321db085f1b8e2d8038fe2941992
-548cee0d67dd4547e11dd63af9c9fc1c
-5466fb684cf009d7197c2cf79e792ab5
-01e6a8a1ca519af2cb9b5f6367e94c0d
-47502451357be1b50000029000000cd8
-00000cd9000000000000002100000600
-01000000000016000000000cd8000000
-00000000000000000000000000000001
-1f00fffd0001000000000114605c9943
-598e0a83000000000101030803010001
-acffb409bcc939f831f7a1e5ec88f7a5
-9255ec53040be432027390a4ce896d6f
-9086f3c5e177fbfe118163aaec7af146
-2c47945944c4e2c026be5e98bbcded25
-978272e1e3e079c5094d573f0e83c92f
-02b32d3513b1550b826929c80dd0f92c
-ac966d17769fd5867b647c3f38029abd
-c48152eb8f207159ecc5d232c7c1537c
-79f4b7ac28ff11682f21681bf6d6aba5
-55032bf6f9f036beb2aaa5b3778d6eeb
-fba6bf9ea191be4ab0caea759e2f773a
-1f9029c73ecb8d5735b9321db085f1b8
-e2d8038fe2941992548cee0d67dd4547
-e11dd63af9c9fc1c5466fb684cf009d7
-197c2cf79e792ab501e6a8a1ca519af2
-cb9b5f6367e94c0d47502451357be1b5
-00000021000006000100000000001600
-0000000cd90000000000000000000000
-00000000000000011f00fffd00010000
-00000114605ccb40598e0a8300000000
-0101030803010001acffb409bcc939f8
-31f7a1e5ec88f7a59255ec53040be432
-027390a4ce896d6f9086f3c5e177fbfe
-118163aaec7af1462c47945944c4e2c0
-26be5e98bbcded25978272e1e3e079c5
-094d573f0e83c92f02b32d3513b1550b
-826929c80dd0f92cac966d17769fd586
-7b647c3f38029abdc48152eb8f207159
-ecc5d232c7c1537c79f4b7ac28ff1168
-2f21681bf6d6aba555032bf6f9f036be
-b2aaa5b3778d6eebfba6bf9ea191be4a
-b0caea759e2f773a1f9029c73ecb8d57
-35b9321db085f1b8e2d8038fe2941992
-548cee0d67dd4547e11dd63af9c9fc1c
-5466fb684cf009d7197c2cf79e792ab5
-01e6a8a1ca519af2cb9b5f6367e94c0d
-47502451357be1b50000029000000cd9
-00000cda000000000000002100000600
-01000000000016000000000cd9000000
-00000000000000000000000000000001
-1f00fffd0001000000000114605ccb40
-598e0a83000000000101030803010001
-acffb409bcc939f831f7a1e5ec88f7a5
-9255ec53040be432027390a4ce896d6f
-9086f3c5e177fbfe118163aaec7af146
-2c47945944c4e2c026be5e98bbcded25
-978272e1e3e079c5094d573f0e83c92f
-02b32d3513b1550b826929c80dd0f92c
-ac966d17769fd5867b647c3f38029abd
-c48152eb8f207159ecc5d232c7c1537c
-79f4b7ac28ff11682f21681bf6d6aba5
-55032bf6f9f036beb2aaa5b3778d6eeb
-fba6bf9ea191be4ab0caea759e2f773a
-1f9029c73ecb8d5735b9321db085f1b8
-e2d8038fe2941992548cee0d67dd4547
-e11dd63af9c9fc1c5466fb684cf009d7
-197c2cf79e792ab501e6a8a1ca519af2
-cb9b5f6367e94c0d47502451357be1b5
-00000021000006000100000000001600
-0000000cda0000000000000000000000
-00000000000000011f00fffd00010000
-00000114605deac4598e0a8300000000
-0101030803010001acffb409bcc939f8
-31f7a1e5ec88f7a59255ec53040be432
-027390a4ce896d6f9086f3c5e177fbfe
-118163aaec7af1462c47945944c4e2c0
-26be5e98bbcded25978272e1e3e079c5
-094d573f0e83c92f02b32d3513b1550b
-826929c80dd0f92cac966d17769fd586
-7b647c3f38029abdc48152eb8f207159
-ecc5d232c7c1537c79f4b7ac28ff1168
-2f21681bf6d6aba555032bf6f9f036be
-b2aaa5b3778d6eebfba6bf9ea191be4a
-b0caea759e2f773a1f9029c73ecb8d57
-35b9321db085f1b8e2d8038fe2941992
-548cee0d67dd4547e11dd63af9c9fc1c
-5466fb684cf009d7197c2cf79e792ab5
-01e6a8a1ca519af2cb9b5f6367e94c0d
-47502451357be1b50000029000000cda
-00000cdb000000000000002100000600
-01000000000016000000000cda000000
-00000000000000000000000000000001
-1f00fffd0001000000000114605deac4
-598e0a83000000000101030803010001
-acffb409bcc939f831f7a1e5ec88f7a5
-9255ec53040be432027390a4ce896d6f
-9086f3c5e177fbfe118163aaec7af146
-2c47945944c4e2c026be5e98bbcded25
-978272e1e3e079c5094d573f0e83c92f
-02b32d3513b1550b826929c80dd0f92c
-ac966d17769fd5867b647c3f38029abd
-c48152eb8f207159ecc5d232c7c1537c
-79f4b7ac28ff11682f21681bf6d6aba5
-55032bf6f9f036beb2aaa5b3778d6eeb
-fba6bf9ea191be4ab0caea759e2f773a
-1f9029c73ecb8d5735b9321db085f1b8
-e2d8038fe2941992548cee0d67dd4547
-e11dd63af9c9fc1c5466fb684cf009d7
-197c2cf79e792ab501e6a8a1ca519af2
-cb9b5f6367e94c0d47502451357be1b5
-00000021000006000100000000001600
-0000000cdb0000000000000000000000
-00000000000000011f00fffd00010000
-00000114605e1cc0598e0a8300000000
-0101030803010001acffb409bcc939f8
-31f7a1e5ec88f7a59255ec53040be432
-027390a4ce896d6f9086f3c5e177fbfe
-118163aaec7af1462c47945944c4e2c0
-26be5e98bbcded25978272e1e3e079c5
-094d573f0e83c92f02b32d3513b1550b
-826929c80dd0f92cac966d17769fd586
-7b647c3f38029abdc48152eb8f207159
-ecc5d232c7c1537c79f4b7ac28ff1168
-2f21681bf6d6aba555032bf6f9f036be
-b2aaa5b3778d6eebfba6bf9ea191be4a
-b0caea759e2f773a1f9029c73ecb8d57
-35b9321db085f1b8e2d8038fe2941992
-548cee0d67dd4547e11dd63af9c9fc1c
-5466fb684cf009d7197c2cf79e792ab5
-01e6a8a1ca519af2cb9b5f6367e94c0d
-47502451357be1b50000029000000cdb
-00000cdc000000000000002100000600
-01000000000016000000000cdb000000
-00000000000000000000000000000001
-1f00fffd0001000000000114605e1cc0
-598e0a83000000000101030803010001
-acffb409bcc939f831f7a1e5ec88f7a5
-9255ec53040be432027390a4ce896d6f
-9086f3c5e177fbfe118163aaec7af146
-2c47945944c4e2c026be5e98bbcded25
-978272e1e3e079c5094d573f0e83c92f
-02b32d3513b1550b826929c80dd0f92c
-ac966d17769fd5867b647c3f38029abd
-c48152eb8f207159ecc5d232c7c1537c
-79f4b7ac28ff11682f21681bf6d6aba5
-55032bf6f9f036beb2aaa5b3778d6eeb
-fba6bf9ea191be4ab0caea759e2f773a
-1f9029c73ecb8d5735b9321db085f1b8
-e2d8038fe2941992548cee0d67dd4547
-e11dd63af9c9fc1c5466fb684cf009d7
-197c2cf79e792ab501e6a8a1ca519af2
-cb9b5f6367e94c0d47502451357be1b5
-00000021000006000100000000001600
-0000000cdc0000000000000000000000
-00000000000000011f00fffd00010000
-00000114605efb3a598e0a8300000000
-0101030803010001acffb409bcc939f8
-31f7a1e5ec88f7a59255ec53040be432
-027390a4ce896d6f9086f3c5e177fbfe
-118163aaec7af1462c47945944c4e2c0
-26be5e98bbcded25978272e1e3e079c5
-094d573f0e83c92f02b32d3513b1550b
-826929c80dd0f92cac966d17769fd586
-7b647c3f38029abdc48152eb8f207159
-ecc5d232c7c1537c79f4b7ac28ff1168
-2f21681bf6d6aba555032bf6f9f036be
-b2aaa5b3778d6eebfba6bf9ea191be4a
-b0caea759e2f773a1f9029c73ecb8d57
-35b9321db085f1b8e2d8038fe2941992
-548cee0d67dd4547e11dd63af9c9fc1c
-5466fb684cf009d7197c2cf79e792ab5
-01e6a8a1ca519af2cb9b5f6367e94c0d
-47502451357be1b50000029000000cdc
-00000cdd000000000000002100000600
-01000000000016000000000cdc000000
-00000000000000000000000000000001
-1f00fffd0001000000000114605efb3a
-598e0a83000000000101030803010001
-acffb409bcc939f831f7a1e5ec88f7a5
-9255ec53040be432027390a4ce896d6f
-9086f3c5e177fbfe118163aaec7af146
-2c47945944c4e2c026be5e98bbcded25
-978272e1e3e079c5094d573f0e83c92f
-02b32d3513b1550b826929c80dd0f92c
-ac966d17769fd5867b647c3f38029abd
-c48152eb8f207159ecc5d232c7c1537c
-79f4b7ac28ff11682f21681bf6d6aba5
-55032bf6f9f036beb2aaa5b3778d6eeb
-fba6bf9ea191be4ab0caea759e2f773a
-1f9029c73ecb8d5735b9321db085f1b8
-e2d8038fe2941992548cee0d67dd4547
-e11dd63af9c9fc1c5466fb684cf009d7
-197c2cf79e792ab501e6a8a1ca519af2
-cb9b5f6367e94c0d47502451357be1b5
-00000021000006000100000000001600
-0000000cdd0000000000000000000000
-00000000000000011f00fffd00010000
-00000114605f6e40598e0a8300000000
-0101030803010001acffb409bcc939f8
-31f7a1e5ec88f7a59255ec53040be432
-027390a4ce896d6f9086f3c5e177fbfe
-118163aaec7af1462c47945944c4e2c0
-26be5e98bbcded25978272e1e3e079c5
-094d573f0e83c92f02b32d3513b1550b
-826929c80dd0f92cac966d17769fd586
-7b647c3f38029abdc48152eb8f207159
-ecc5d232c7c1537c79f4b7ac28ff1168
-2f21681bf6d6aba555032bf6f9f036be
-b2aaa5b3778d6eebfba6bf9ea191be4a
-b0caea759e2f773a1f9029c73ecb8d57
-35b9321db085f1b8e2d8038fe2941992
-548cee0d67dd4547e11dd63af9c9fc1c
-5466fb684cf009d7197c2cf79e792ab5
-01e6a8a1ca519af2cb9b5f6367e94c0d
-47502451357be1b50000029000000cdd
-00000cde000000000000002100000600
-01000000000016000000000cdd000000
-00000000000000000000000000000001
-1f00fffd0001000000000114605f6e40
-598e0a83000000000101030803010001
-acffb409bcc939f831f7a1e5ec88f7a5
-9255ec53040be432027390a4ce896d6f
-9086f3c5e177fbfe118163aaec7af146
-2c47945944c4e2c026be5e98bbcded25
-978272e1e3e079c5094d573f0e83c92f
-02b32d3513b1550b826929c80dd0f92c
-ac966d17769fd5867b647c3f38029abd
-c48152eb8f207159ecc5d232c7c1537c
-79f4b7ac28ff11682f21681bf6d6aba5
-55032bf6f9f036beb2aaa5b3778d6eeb
-fba6bf9ea191be4ab0caea759e2f773a
-1f9029c73ecb8d5735b9321db085f1b8
-e2d8038fe2941992548cee0d67dd4547
-e11dd63af9c9fc1c5466fb684cf009d7
-197c2cf79e792ab501e6a8a1ca519af2
-cb9b5f6367e94c0d47502451357be1b5
-00000021000006000100000000001600
-0000000cde0000000000000000000000
-00000000000000011f00fffd00010000
-0000011460604cbb598e0a8300000000
-0101030803010001acffb409bcc939f8
-31f7a1e5ec88f7a59255ec53040be432
-027390a4ce896d6f9086f3c5e177fbfe
-118163aaec7af1462c47945944c4e2c0
-26be5e98bbcded25978272e1e3e079c5
-094d573f0e83c92f02b32d3513b1550b
-826929c80dd0f92cac966d17769fd586
-7b647c3f38029abdc48152eb8f207159
-ecc5d232c7c1537c79f4b7ac28ff1168
-2f21681bf6d6aba555032bf6f9f036be
-b2aaa5b3778d6eebfba6bf9ea191be4a
-b0caea759e2f773a1f9029c73ecb8d57
-35b9321db085f1b8e2d8038fe2941992
-548cee0d67dd4547e11dd63af9c9fc1c
-5466fb684cf009d7197c2cf79e792ab5
-01e6a8a1ca519af2cb9b5f6367e94c0d
-47502451357be1b50000029000000cde
-00000cdf000000000000002100000600
-01000000000016000000000cde000000
-00000000000000000000000000000001
-1f00fffd000100000000011460604cbb
-598e0a83000000000101030803010001
-acffb409bcc939f831f7a1e5ec88f7a5
-9255ec53040be432027390a4ce896d6f
-9086f3c5e177fbfe118163aaec7af146
-2c47945944c4e2c026be5e98bbcded25
-978272e1e3e079c5094d573f0e83c92f
-02b32d3513b1550b826929c80dd0f92c
-ac966d17769fd5867b647c3f38029abd
-c48152eb8f207159ecc5d232c7c1537c
-79f4b7ac28ff11682f21681bf6d6aba5
-55032bf6f9f036beb2aaa5b3778d6eeb
-fba6bf9ea191be4ab0caea759e2f773a
-1f9029c73ecb8d5735b9321db085f1b8
-e2d8038fe2941992548cee0d67dd4547
-e11dd63af9c9fc1c5466fb684cf009d7
-197c2cf79e792ab501e6a8a1ca519af2
-cb9b5f6367e94c0d47502451357be1b5
-00000021000006000100000000001600
-0000000cdf0000000000000000000000
-00000000000000011f00fffd00010000
-000001146060bfc0598e0a8300000000
-0101030803010001acffb409bcc939f8
-31f7a1e5ec88f7a59255ec53040be432
-027390a4ce896d6f9086f3c5e177fbfe
-118163aaec7af1462c47945944c4e2c0
-26be5e98bbcded25978272e1e3e079c5
-094d573f0e83c92f02b32d3513b1550b
-826929c80dd0f92cac966d17769fd586
-7b647c3f38029abdc48152eb8f207159
-ecc5d232c7c1537c79f4b7ac28ff1168
-2f21681bf6d6aba555032bf6f9f036be
-b2aaa5b3778d6eebfba6bf9ea191be4a
-b0caea759e2f773a1f9029c73ecb8d57
-35b9321db085f1b8e2d8038fe2941992
-548cee0d67dd4547e11dd63af9c9fc1c
-5466fb684cf009d7197c2cf79e792ab5
-01e6a8a1ca519af2cb9b5f6367e94c0d
-47502451357be1b50000029000000cdf
-00000ce0000000000000002100000600
-01000000000016000000000cdf000000
-00000000000000000000000000000001
-1f00fffd00010000000001146060bfc0
-598e0a83000000000101030803010001
-acffb409bcc939f831f7a1e5ec88f7a5
-9255ec53040be432027390a4ce896d6f
-9086f3c5e177fbfe118163aaec7af146
-2c47945944c4e2c026be5e98bbcded25
-978272e1e3e079c5094d573f0e83c92f
-02b32d3513b1550b826929c80dd0f92c
-ac966d17769fd5867b647c3f38029abd
-c48152eb8f207159ecc5d232c7c1537c
-79f4b7ac28ff11682f21681bf6d6aba5
-55032bf6f9f036beb2aaa5b3778d6eeb
-fba6bf9ea191be4ab0caea759e2f773a
-1f9029c73ecb8d5735b9321db085f1b8
-e2d8038fe2941992548cee0d67dd4547
-e11dd63af9c9fc1c5466fb684cf009d7
-197c2cf79e792ab501e6a8a1ca519af2
-cb9b5f6367e94c0d47502451357be1b5
-00000021000006000100000000001600
-0000000ce00000000000000000000000
-00000000000000011f00fffd00010000
-0000011460619e3b598e0a8300000000
-0101030803010001acffb409bcc939f8
-31f7a1e5ec88f7a59255ec53040be432
-027390a4ce896d6f9086f3c5e177fbfe
-118163aaec7af1462c47945944c4e2c0
-26be5e98bbcded25978272e1e3e079c5
-094d573f0e83c92f02b32d3513b1550b
-826929c80dd0f92cac966d17769fd586
-7b647c3f38029abdc48152eb8f207159
-ecc5d232c7c1537c79f4b7ac28ff1168
-2f21681bf6d6aba555032bf6f9f036be
-b2aaa5b3778d6eebfba6bf9ea191be4a
-b0caea759e2f773a1f9029c73ecb8d57
-35b9321db085f1b8e2d8038fe2941992
-548cee0d67dd4547e11dd63af9c9fc1c
-5466fb684cf009d7197c2cf79e792ab5
-01e6a8a1ca519af2cb9b5f6367e94c0d
-47502451357be1b50000029000000ce0
-00000ce1000000000000002100000600
-01000000000016000000000ce0000000
-00000000000000000000000000000001
-1f00fffd000100000000011460619e3b
-598e0a83000000000101030803010001
-acffb409bcc939f831f7a1e5ec88f7a5
-9255ec53040be432027390a4ce896d6f
-9086f3c5e177fbfe118163aaec7af146
-2c47945944c4e2c026be5e98bbcded25
-978272e1e3e079c5094d573f0e83c92f
-02b32d3513b1550b826929c80dd0f92c
-ac966d17769fd5867b647c3f38029abd
-c48152eb8f207159ecc5d232c7c1537c
-79f4b7ac28ff11682f21681bf6d6aba5
-55032bf6f9f036beb2aaa5b3778d6eeb
-fba6bf9ea191be4ab0caea759e2f773a
-1f9029c73ecb8d5735b9321db085f1b8
-e2d8038fe2941992548cee0d67dd4547
-e11dd63af9c9fc1c5466fb684cf009d7
-197c2cf79e792ab501e6a8a1ca519af2
-cb9b5f6367e94c0d47502451357be1b5
-00000021000006000100000000001600
-0000000ce10000000000000000000000
-00000000000000011f00fffd00010000
-0000011460621140598e0a8300000000
-0101030803010001acffb409bcc939f8
-31f7a1e5ec88f7a59255ec53040be432
-027390a4ce896d6f9086f3c5e177fbfe
-118163aaec7af1462c47945944c4e2c0
-26be5e98bbcded25978272e1e3e079c5
-094d573f0e83c92f02b32d3513b1550b
-826929c80dd0f92cac966d17769fd586
-7b647c3f38029abdc48152eb8f207159
-ecc5d232c7c1537c79f4b7ac28ff1168
-2f21681bf6d6aba555032bf6f9f036be
-b2aaa5b3778d6eebfba6bf9ea191be4a
-b0caea759e2f773a1f9029c73ecb8d57
-35b9321db085f1b8e2d8038fe2941992
-548cee0d67dd4547e11dd63af9c9fc1c
-5466fb684cf009d7197c2cf79e792ab5
-01e6a8a1ca519af2cb9b5f6367e94c0d
-47502451357be1b50000029000000ce1
-00000ce2000000000000002100000600
-01000000000016000000000ce1000000
-00000000000000000000000000000001
-1f00fffd000100000000011460621140
-598e0a83000000000101030803010001
-acffb409bcc939f831f7a1e5ec88f7a5
-9255ec53040be432027390a4ce896d6f
-9086f3c5e177fbfe118163aaec7af146
-2c47945944c4e2c026be5e98bbcded25
-978272e1e3e079c5094d573f0e83c92f
-02b32d3513b1550b826929c80dd0f92c
-ac966d17769fd5867b647c3f38029abd
-c48152eb8f207159ecc5d232c7c1537c
-79f4b7ac28ff11682f21681bf6d6aba5
-55032bf6f9f036beb2aaa5b3778d6eeb
-fba6bf9ea191be4ab0caea759e2f773a
-1f9029c73ecb8d5735b9321db085f1b8
-e2d8038fe2941992548cee0d67dd4547
-e11dd63af9c9fc1c5466fb684cf009d7
-197c2cf79e792ab501e6a8a1ca519af2
-cb9b5f6367e94c0d47502451357be1b5
-00000021000006000100000000001600
-0000000ce20000000000000000000000
-00000000000000011f00fffd00010000
-000001146062efbb598e0a8300000000
-0101030803010001acffb409bcc939f8
-31f7a1e5ec88f7a59255ec53040be432
-027390a4ce896d6f9086f3c5e177fbfe
-118163aaec7af1462c47945944c4e2c0
-26be5e98bbcded25978272e1e3e079c5
-094d573f0e83c92f02b32d3513b1550b
-826929c80dd0f92cac966d17769fd586
-7b647c3f38029abdc48152eb8f207159
-ecc5d232c7c1537c79f4b7ac28ff1168
-2f21681bf6d6aba555032bf6f9f036be
-b2aaa5b3778d6eebfba6bf9ea191be4a
-b0caea759e2f773a1f9029c73ecb8d57
-35b9321db085f1b8e2d8038fe2941992
-548cee0d67dd4547e11dd63af9c9fc1c
-5466fb684cf009d7197c2cf79e792ab5
-01e6a8a1ca519af2cb9b5f6367e94c0d
-47502451357be1b5
@@ -40,6 +40,3 @@ cp ns1/maxjournal.jnl.saved ns1/maxjournal.db.jnl

 cp ns1/generic.db.in ns1/maxjournal2.db
 cp ns1/maxjournal2.jnl.saved ns1/maxjournal2.db.jnl
-
-cp ns1/managed-keys.bind.in ns1/managed-keys.bind
-$PERL ../fromhex.pl < ns1/managed-keys.bind.jnl.in > ns1/managed-keys.bind.jnl
@@ -28,7 +28,7 @@ ret=0
 dig_with_opts changed soa > dig.out.test$n
 grep 'status: NOERROR' dig.out.test$n > /dev/null || ret=1
 grep '2012010902' dig.out.test$n > /dev/null || ret=1
-grep 'zone changed/IN: journal rollforward completed successfully using old journal format' ns1/named.run > /dev/null || ret=1
+grep 'zone changed/IN: retried using old journal format' ns1/named.run > /dev/null || ret=1
 [ $ret -eq 0 ] || echo_i "failed"
 status=`expr $status + $ret`

@@ -62,8 +62,7 @@ ret=0
 dig_with_opts changed2 soa > dig.out.test$n
 grep 'status: NOERROR' dig.out.test$n > /dev/null || ret=1
 grep '2012010902' dig.out.test$n > /dev/null || ret=1
-grep 'zone changed2/IN: journal rollforward completed successfully: success' ns1/named.run > /dev/null || ret=1
-grep 'zone changed2/IN: journal rollforward completed successfully using old journal format' ns1/named.run > /dev/null && ret=1
+grep 'zone changed2/IN: retried using old journal format' ns1/named.run > /dev/null && ret=1
 [ $ret -eq 0 ] || echo_i "failed"
 status=`expr $status + $ret`

@@ -73,8 +72,7 @@ ret=0
 dig_with_opts unchanged2 soa > dig.out.test$n
 grep 'status: NOERROR' dig.out.test$n > /dev/null || ret=1
 grep '2012010901' dig.out.test$n > /dev/null || ret=1
-grep 'zone unchanged2/IN: journal rollforward completed successfully' ns1/named.run > /dev/null && ret=1
-grep 'zone unchanged2/IN: journal rollforward completed successfully using old journal format' ns1/named.run > /dev/null && ret=1
+grep 'zone unchanged2/IN: retried using old journal format' ns1/named.run > /dev/null && ret=1
 [ $ret -eq 0 ] || echo_i "failed"
 status=`expr $status + $ret`

@@ -92,7 +90,7 @@ ret=0
 dig_with_opts -t soa ixfr > dig.out.test$n
 grep 'status: NOERROR' dig.out.test$n > /dev/null || ret=1
 grep '2012010902' dig.out.test$n > /dev/null || ret=1
-grep 'zone ixfr/IN: journal rollforward completed successfully using old journal format: up to date' ns1/named.run > /dev/null || ret=1
+grep 'zone ixfr/IN: journal rollforward completed successfully: recoverable' ns1/named.run > /dev/null || ret=1
 [ $ret -eq 0 ] || echo_i "failed"
 status=`expr $status + $ret`

@@ -109,9 +107,7 @@ ret=0
 dig_with_opts -t soa hdr1d1d2d1d2 > dig.out.test$n
 grep 'status: NOERROR' dig.out.test$n > /dev/null || ret=1
 grep '2012010905' dig.out.test$n > /dev/null || ret=1
-grep 'zone hdr1d1d2d1d2/IN: journal rollforward completed successfully using old journal format: success' ns1/named.run > /dev/null || ret=1
-grep 'zone_journal_compact: zone hdr1d1d2d1d2/IN: repair full journal' ns1/named.run > /dev/null || ret=1
-grep 'hdr1d1d2d1d2/IN: dns_journal_compact: success' ns1/named.run > /dev/null || ret=1
+grep 'zone hdr1d1d2d1d2/IN: journal rollforward completed successfully: recoverable' ns1/named.run > /dev/null || ret=1
 [ $ret -eq 0 ] || echo_i "failed"
 status=`expr $status + $ret`

@@ -131,9 +127,7 @@ ret=0
 dig_with_opts -t soa hdr1d2d1d2d1 > dig.out.test$n
 grep 'status: NOERROR' dig.out.test$n > /dev/null || ret=1
 grep '2012010905' dig.out.test$n > /dev/null || ret=1
-grep 'zone hdr1d2d1d2d1/IN: journal rollforward completed successfully using old journal format: success' ns1/named.run > /dev/null || ret=1
-grep 'zone_journal_compact: zone hdr1d2d1d2d1/IN: repair full journal' ns1/named.run > /dev/null || ret=1
-grep 'zone hdr1d2d1d2d1/IN: dns_journal_compact: success' ns1/named.run > /dev/null || ret=1
+grep 'zone hdr1d2d1d2d1/IN: journal rollforward completed successfully: recoverable' ns1/named.run > /dev/null || ret=1
 [ $ret -eq 0 ] || echo_i "failed"
 status=`expr $status + $ret`

@@ -156,41 +150,6 @@ c2=$(cat -v ns1/*.jnl | grep -c "BIND LOG V9.2")
 [ $ret -eq 0 ] || echo_i "failed"
 status=`expr $status + $ret`

-n=`expr $n + 1`
-echo_i "Check that journal with mixed headers can be compacted (version 1,2,1,2) ($n)"
-ret=0
-journal=ns1/d1212.jnl.saved
-seriallist=$($JOURNALPRINT -x $journal | awk '$1 == "Transaction:" { print $11 }')
-for serial in $seriallist
-do
-        cp $journal tmp.jnl
-        $JOURNALPRINT -c $serial tmp.jnl || ret=1
-done
-[ $ret -eq 0 ] || echo_i "failed"
-status=`expr $status + $ret`
-
-n=`expr $n + 1`
-echo_i "Check that journal with mixed headers can be compacted (version 2,1,2,1) ($n)"
-ret=0
-journal=ns1/d2121.jnl.saved
-seriallist=$($JOURNALPRINT -x $journal | awk '$1 == "Transaction:" { print $11 }')
-for serial in $seriallist
-do
-        cp ns1/d1212.jnl.saved tmp.jnl
-        $JOURNALPRINT -c $serial tmp.jnl || ret=1
-done
-[ $ret -eq 0 ] || echo_i "failed"
-status=`expr $status + $ret`
-
-n=`expr $n + 1`
-echo_i "check upgrade of managed-keys.bind.jnl succeeded($n)"
-ret=0
-$JOURNALPRINT ns1/managed-keys.bind.jnl > journalprint.out.test$n
-lines=$(awk '$1 == "add" && $5 == "SOA" && $8 == "3297" { print }' journalprint.out.test$n | wc -l)
-test $lines -eq 1 || ret=1
-[ $ret -eq 0 ] || echo_i "failed"
-status=`expr $status + $ret`
-
 n=`expr $n + 1`
 echo_i "check journal downgrade/upgrade ($n)"
 ret=0
@@ -207,15 +166,10 @@ status=`expr $status + $ret`
 n=`expr $n + 1`
 echo_i "check max-journal-size works after journal update ($n)"
 ret=0
-# journal was repaired, it should still be big
-[ $(wc -c < ns1/maxjournal.db.jnl) -gt 12000 ] || ret=1
-# the zone hasn't been dumped yet, so 'rndc sync' should work without
-# needing a zone update first.
-rndc_with_opts 10.53.0.1 sync maxjournal
-check_size() (
-    [ $(wc -c < ns1/maxjournal.db.jnl) -lt 4000 ]
-)
-retry_quiet 10 check_size || ret=1
+# a dump should have been triggered by repairing the journal,
+# which would have resulted in the journal already being
+# compacted.
+[ $(wc -c < ns1/maxjournal.db.jnl) -lt 4000 ] || ret=1
 [ $ret -eq 0 ] || echo_i "failed"
 status=`expr $status + $ret`

@@ -59,7 +59,6 @@ VIEW2="4xILSZQnuO1UKubXHkYUsvBRPu8="
 # EXPECT_ZRRSIG
 # EXPECT_KRRSIG
 # LEGACY
-# PRIVATE

 key_key() {
 	echo "${1}__${2}"
@@ -113,7 +112,6 @@ key_clear() {
 	key_set "$1" "EXPECT_ZRRSIG" 'no'
 	key_set "$1" "EXPECT_KRRSIG" 'no'
 	key_set "$1" "LEGACY" 'no'
-	key_set "$1" "PRIVATE" 'yes'
 }

 # Start clear.
@@ -198,8 +196,8 @@ set_policy() {
 	CDS_DELETE="no"
 }
 # By default policies are considered to be secure.
-# If a zone sets its policy to "insecure", call 'set_cdsdelete' to tell the
-# system test to expect a CDS and CDNSKEY Delete record.
+# If a zone sets its policy to "none", call 'set_cdsdelete' to tell the system
+# test to expect a CDS and CDNSKEY Delete record.
 set_cdsdelete() {
 	CDS_DELETE="yes"
 }
@@ -305,7 +303,6 @@ check_key() {
 	_dnskey_ttl="$DNSKEY_TTL"
 	_lifetime=$(key_get "$1" LIFETIME)
 	_legacy=$(key_get "$1" LEGACY)
-	_private=$(key_get "$1" PRIVATE)

 	_published=$(key_get "$1" PUBLISHED)
 	_active=$(key_get "$1" ACTIVE)
@@ -344,9 +341,7 @@ check_key() {

 	# Check file existence.
 	[ -s "$KEY_FILE" ] || ret=1
-	if [ "$_private" = "yes" ]; then
-		[ -s "$PRIVATE_FILE" ] || ret=1
-	fi
+	[ -s "$PRIVATE_FILE" ] || ret=1
 	if [ "$_legacy" = "no" ]; then
 		[ -s "$STATE_FILE" ] || ret=1
 	fi
@@ -357,9 +352,7 @@ check_key() {
 	grep "; Created:" "$KEY_FILE" > "${ZONE}.${KEY_ID}.${_alg_num}.created" || _log_error "mismatch created comment in $KEY_FILE"
 	KEY_CREATED=$(awk '{print $3}' < "${ZONE}.${KEY_ID}.${_alg_num}.created")

-	if [ "$_private" = "yes" ]; then
-		grep "Created: ${KEY_CREATED}" "$PRIVATE_FILE" > /dev/null || _log_error "mismatch created in $PRIVATE_FILE"
-	fi
+	grep "Created: ${KEY_CREATED}" "$PRIVATE_FILE" > /dev/null || _log_error "mismatch created in $PRIVATE_FILE"
 	if [ "$_legacy" = "no" ]; then
 		grep "Generated: ${KEY_CREATED}" "$STATE_FILE" > /dev/null || _log_error "mismatch generated in $STATE_FILE"
 	fi
@@ -370,10 +363,8 @@ check_key() {
 	grep "This is a ${_role2} key, keyid ${_key_id}, for ${_zone}." "$KEY_FILE" > /dev/null || _log_error "mismatch top comment in $KEY_FILE"
 	grep "${_zone}\. ${_dnskey_ttl} IN DNSKEY ${_flags} 3 ${_alg_num}" "$KEY_FILE" > /dev/null || _log_error "mismatch DNSKEY record in $KEY_FILE"
 	# Now check the private key file.
-	if [ "$_private" = "yes" ]; then
-		grep "Private-key-format: v1.3" "$PRIVATE_FILE" > /dev/null || _log_error "mismatch private key format in $PRIVATE_FILE"
-		grep "Algorithm: ${_alg_num} (${_alg_string})" "$PRIVATE_FILE" > /dev/null || _log_error "mismatch algorithm in $PRIVATE_FILE"
-	fi
+	grep "Private-key-format: v1.3" "$PRIVATE_FILE" > /dev/null || _log_error "mismatch private key format in $PRIVATE_FILE"
+	grep "Algorithm: ${_alg_num} (${_alg_string})" "$PRIVATE_FILE" > /dev/null || _log_error "mismatch algorithm in $PRIVATE_FILE"
 	# Now check the key state file.
 	if [ "$_legacy" = "no" ]; then
 		grep "This is the state of key ${_key_id}, for ${_zone}." "$STATE_FILE" > /dev/null || _log_error "mismatch top comment in $STATE_FILE"
@@ -453,8 +444,6 @@ check_timingmetadata() {
 	_key_file="${_base_file}.key"
 	_private_file="${_base_file}.private"
 	_state_file="${_base_file}.state"
-	_legacy=$(key_get "$1" LEGACY)
-	_private=$(key_get "$1" PRIVATE)

 	_published=$(key_get "$1" PUBLISHED)
 	_syncpublish=$(key_get "$1" SYNCPUBLISH)
@@ -470,17 +459,13 @@ check_timingmetadata() {

 	if [ "$_published" = "none" ]; then
 		grep "; Publish:" "${_key_file}" > /dev/null && _log_error "unexpected publish comment in ${_key_file}"
-		if [ "$_private" = "yes" ]; then
-			grep "Publish:" "${_private_file}" > /dev/null && _log_error "unexpected publish in ${_private_file}"
-		fi
+		grep "Publish:" "${_private_file}" > /dev/null && _log_error "unexpected publish in ${_private_file}"
 		if [ "$_legacy" = "no" ]; then
 			grep "Published: " "${_state_file}" > /dev/null && _log_error "unexpected publish in ${_state_file}"
 		fi
 	else
 		grep "; Publish: $_published" "${_key_file}" > /dev/null || _log_error "mismatch publish comment in ${_key_file} (expected ${_published})"
-		if [ "$_private" = "yes" ]; then
-			grep "Publish: $_published" "${_private_file}" > /dev/null || _log_error "mismatch publish in ${_private_file} (expected ${_published})"
-		fi
+		grep "Publish: $_published" "${_private_file}" > /dev/null || _log_error "mismatch publish in ${_private_file} (expected ${_published})"
 		if [ "$_legacy" = "no" ]; then
 			grep "Published: $_published" "${_state_file}" > /dev/null || _log_error "mismatch publish in ${_state_file} (expected ${_published})"
 		fi
@@ -488,17 +473,13 @@ check_timingmetadata() {

 	if [ "$_syncpublish" = "none" ]; then
 		grep "; SyncPublish:" "${_key_file}" > /dev/null && _log_error "unexpected syncpublish comment in ${_key_file}"
-		if [ "$_private" = "yes" ]; then
-			grep "SyncPublish:" "${_private_file}" > /dev/null && _log_error "unexpected syncpublish in ${_private_file}"
-		fi
+		grep "SyncPublish:" "${_private_file}" > /dev/null && _log_error "unexpected syncpublish in ${_private_file}"
 		if [ "$_legacy" = "no" ]; then
 			grep "PublishCDS: " "${_state_file}" > /dev/null && _log_error "unexpected syncpublish in ${_state_file}"
 		fi
 	else
 		grep "; SyncPublish: $_syncpublish" "${_key_file}" > /dev/null || _log_error "mismatch syncpublish comment in ${_key_file} (expected ${_syncpublish})"
-		if [ "$_private" = "yes" ]; then
-			grep "SyncPublish: $_syncpublish" "${_private_file}" > /dev/null || _log_error "mismatch syncpublish in ${_private_file} (expected ${_syncpublish})"
-		fi
+		grep "SyncPublish: $_syncpublish" "${_private_file}" > /dev/null || _log_error "mismatch syncpublish in ${_private_file} (expected ${_syncpublish})"
 		if [ "$_legacy" = "no" ]; then
 			grep "PublishCDS: $_syncpublish" "${_state_file}" > /dev/null || _log_error "mismatch syncpublish in ${_state_file} (expected ${_syncpublish})"
 		fi
@@ -506,17 +487,13 @@ check_timingmetadata() {

 	if [ "$_active" = "none" ]; then
 		grep "; Activate:" "${_key_file}" > /dev/null && _log_error "unexpected active comment in ${_key_file}"
-		if [ "$_private" = "yes" ]; then
-			grep "Activate:" "${_private_file}" > /dev/null && _log_error "unexpected active in ${_private_file}"
-		fi
+		grep "Activate:" "${_private_file}" > /dev/null && _log_error "unexpected active in ${_private_file}"
 		if [ "$_legacy" = "no" ]; then
 			grep "Active: " "${_state_file}" > /dev/null && _log_error "unexpected active in ${_state_file}"
 		fi
 	else
 		grep "; Activate: $_active" "${_key_file}" > /dev/null || _log_error "mismatch active comment in ${_key_file} (expected ${_active})"
-		if [ "$_private" = "yes" ]; then
-			grep "Activate: $_active" "${_private_file}" > /dev/null || _log_error "mismatch active in ${_private_file} (expected ${_active})"
-		fi
+		grep "Activate: $_active" "${_private_file}" > /dev/null || _log_error "mismatch active in ${_private_file} (expected ${_active})"
 		if [ "$_legacy" = "no" ]; then
 			grep "Active: $_active" "${_state_file}" > /dev/null || _log_error "mismatch active in ${_state_file} (expected ${_active})"
 		fi
@@ -524,17 +501,13 @@ check_timingmetadata() {

 	if [ "$_retired" = "none" ]; then
 		grep "; Inactive:" "${_key_file}" > /dev/null && _log_error "unexpected retired comment in ${_key_file}"
-		if [ "$_private" = "yes" ]; then
-			grep "Inactive:" "${_private_file}" > /dev/null && _log_error "unexpected retired in ${_private_file}"
-		fi
+		grep "Inactive:" "${_private_file}" > /dev/null && _log_error "unexpected retired in ${_private_file}"
 		if [ "$_legacy" = "no" ]; then
 			grep "Retired: " "${_state_file}" > /dev/null && _log_error "unexpected retired in ${_state_file}"
 		fi
 	else
 		grep "; Inactive: $_retired" "${_key_file}" > /dev/null || _log_error "mismatch retired comment in ${_key_file} (expected ${_retired})"
-		if [ "$_private" = "yes" ]; then
-			grep "Inactive: $_retired" "${_private_file}" > /dev/null || _log_error "mismatch retired in ${_private_file} (expected ${_retired})"
-		fi
+		grep "Inactive: $_retired" "${_private_file}" > /dev/null || _log_error "mismatch retired in ${_private_file} (expected ${_retired})"
 		if [ "$_legacy" = "no" ]; then
 			grep "Retired: $_retired" "${_state_file}" > /dev/null || _log_error "mismatch retired in ${_state_file} (expected ${_retired})"
 		fi
@@ -542,17 +515,13 @@ check_timingmetadata() {

 	if [ "$_revoked" = "none" ]; then
 		grep "; Revoke:" "${_key_file}" > /dev/null && _log_error "unexpected revoked comment in ${_key_file}"
-		if [ "$_private" = "yes" ]; then
-			grep "Revoke:" "${_private_file}" > /dev/null && _log_error "unexpected revoked in ${_private_file}"
-		fi
+		grep "Revoke:" "${_private_file}" > /dev/null && _log_error "unexpected revoked in ${_private_file}"
 		if [ "$_legacy" = "no" ]; then
 			grep "Revoked: " "${_state_file}" > /dev/null && _log_error "unexpected revoked in ${_state_file}"
 		fi
 	else
 		grep "; Revoke: $_revoked" "${_key_file}" > /dev/null || _log_error "mismatch revoked comment in ${_key_file} (expected ${_revoked})"
-		if [ "$_private" = "yes" ]; then
-			grep "Revoke: $_revoked" "${_private_file}" > /dev/null || _log_error "mismatch revoked in ${_private_file} (expected ${_revoked})"
-		fi
+		grep "Revoke: $_revoked" "${_private_file}" > /dev/null || _log_error "mismatch revoked in ${_private_file} (expected ${_revoked})"
 		if [ "$_legacy" = "no" ]; then
 			grep "Revoked: $_revoked" "${_state_file}" > /dev/null || _log_error "mismatch revoked in ${_state_file} (expected ${_revoked})"
 		fi
@@ -560,17 +529,13 @@ check_timingmetadata() {

 	if [ "$_removed" = "none" ]; then
 		grep "; Delete:" "${_key_file}" > /dev/null && _log_error "unexpected removed comment in ${_key_file}"
-		if [ "$_private" = "yes" ]; then
-			grep "Delete:" "${_private_file}" > /dev/null && _log_error "unexpected removed in ${_private_file}"
-		fi
+		grep "Delete:" "${_private_file}" > /dev/null && _log_error "unexpected removed in ${_private_file}"
 		if [ "$_legacy" = "no" ]; then
 			grep "Removed: " "${_state_file}" > /dev/null && _log_error "unexpected removed in ${_state_file}"
 		fi
 	else
 		grep "; Delete: $_removed" "${_key_file}" > /dev/null || _log_error "mismatch removed comment in ${_key_file} (expected ${_removed})"
-		if [ "$_private" = "yes" ]; then
-			grep "Delete: $_removed" "${_private_file}" > /dev/null || _log_error "mismatch removed in ${_private_file} (expected ${_removed})"
-		fi
+		grep "Delete: $_removed" "${_private_file}" > /dev/null || _log_error "mismatch removed in ${_private_file} (expected ${_removed})"
 		if [ "$_legacy" = "no" ]; then
 			grep "Removed: $_removed" "${_state_file}" > /dev/null || _log_error "mismatch removed in ${_state_file} (expected ${_removed})"
 		fi
@@ -707,7 +672,7 @@ _check_keys() {
 	# Check key files.
 	_ids=$(get_keyids "$DIR" "$ZONE")
 	for _id in $_ids; do
-		# There are multiple key files with the same algorithm.
+		# There are three key files with the same algorithm.
 		# Check them until a match is found.
 		ret=0
 		echo_i "check key id $_id"
@@ -814,22 +779,18 @@ check_dnssecstatus() {

 	_rndccmd $_server dnssec -status $_zone in $_view > rndc.dnssec.status.out.$_zone.$n || _log_error "rndc dnssec -status zone ${_zone} failed"

-	if [ "$_policy" = "none" ]; then
-		grep "Zone does not have dnssec-policy" rndc.dnssec.status.out.$_zone.$n > /dev/null || log_error "bad dnssec status for unsigned zone ${_zone}"
-	else
-		grep "dnssec-policy: ${_policy}" rndc.dnssec.status.out.$_zone.$n > /dev/null || _log_error "bad dnssec status for signed zone ${_zone}"
-		if [ "$(key_get KEY1 EXPECT)" = "yes" ]; then
-			grep "key: $(key_get KEY1 ID)" rndc.dnssec.status.out.$_zone.$n > /dev/null || _log_error "missing key $(key_get KEY1 ID) from dnssec status"
-		fi
-		if [ "$(key_get KEY2 EXPECT)" = "yes" ]; then
-			grep "key: $(key_get KEY2 ID)" rndc.dnssec.status.out.$_zone.$n > /dev/null || _log_error "missing key $(key_get KEY2 ID) from dnssec status"
-		fi
-		if [ "$(key_get KEY3 EXPECT)" = "yes" ]; then
-			grep "key: $(key_get KEY3 ID)" rndc.dnssec.status.out.$_zone.$n > /dev/null || _log_error "missing key $(key_get KEY3 ID) from dnssec status"
-		fi
-		if [ "$(key_get KEY4 EXPECT)" = "yes" ]; then
-			grep "key: $(key_get KEY4 ID)" rndc.dnssec.status.out.$_zone.$n > /dev/null || _log_error "missing key $(key_get KEY4 ID) from dnssec status"
-		fi
+	grep "dnssec-policy: ${_policy}" rndc.dnssec.status.out.$_zone.$n > /dev/null || _log_error "bad dnssec status for signed zone ${_zone}"
+	if [ "$(key_get KEY1 EXPECT)" = "yes" ]; then
+		grep "key: $(key_get KEY1 ID)" rndc.dnssec.status.out.$_zone.$n > /dev/null || _log_error "missing key $(key_get KEY1 ID) from dnssec status"
+	fi
+	if [ "$(key_get KEY2 EXPECT)" = "yes" ]; then
+		grep "key: $(key_get KEY2 ID)" rndc.dnssec.status.out.$_zone.$n > /dev/null || _log_error "missing key $(key_get KEY2 ID) from dnssec status"
+	fi
+	if [ "$(key_get KEY3 EXPECT)" = "yes" ]; then
+		grep "key: $(key_get KEY3 ID)" rndc.dnssec.status.out.$_zone.$n > /dev/null || _log_error "missing key $(key_get KEY3 ID) from dnssec status"
+	fi
+	if [ "$(key_get KEY4 EXPECT)" = "yes" ]; then
+		grep "key: $(key_get KEY4 ID)" rndc.dnssec.status.out.$_zone.$n > /dev/null || _log_error "missing key $(key_get KEY4 ID) from dnssec status"
 	fi

 	test "$ret" -eq 0 || echo_i "failed"
@@ -838,13 +799,11 @@ check_dnssecstatus() {

 # Check if RRset of type $1 in file $2 is signed with the right keys.
 # The right keys are the ones that expect a signature and matches the role $3.
-_check_signatures() {
+check_signatures() {
 	_qtype=$1
 	_file=$2
 	_role=$3

-	numsigs=0
-
 	if [ "$_role" = "KSK" ]; then
 		_expect_type=EXPECT_KRRSIG
 	elif [ "$_role" = "ZSK" ]; then
@@ -852,41 +811,28 @@ _check_signatures() {
 	fi

 	if [ "$(key_get KEY1 "$_expect_type")" = "yes" ] && [ "$(key_get KEY1 "$_role")" = "yes" ]; then
-		get_keys_which_signed "$_qtype" "$_file" | grep "^$(key_get KEY1 ID)$" > /dev/null || return 1
-		numsigs=$((numsigs+1))
+		get_keys_which_signed "$_qtype" "$_file" | grep "^$(key_get KEY1 ID)$" > /dev/null || _log_error "${_qtype} RRset not signed with key $(key_get KEY1 ID)"
 	elif [ "$(key_get KEY1 EXPECT)" = "yes" ]; then
-		get_keys_which_signed "$_qtype" "$_file" | grep "^$(key_get KEY1 ID)$" > /dev/null && return 1
+		get_keys_which_signed "$_qtype" "$_file" | grep "^$(key_get KEY1 ID)$" > /dev/null && _log_error "${_qtype} RRset signed unexpectedly with key $(key_get KEY1 ID)"
 	fi

 	if [ "$(key_get KEY2 "$_expect_type")" = "yes" ] && [ "$(key_get KEY2 "$_role")" = "yes" ]; then
-		get_keys_which_signed "$_qtype" "$_file" | grep "^$(key_get KEY2 ID)$" > /dev/null || return 1
-		numsigs=$((numsigs+1))
+		get_keys_which_signed "$_qtype" "$_file" | grep "^$(key_get KEY2 ID)$" > /dev/null || _log_error "${_qtype} RRset not signed with key $(key_get KEY2 ID)"
 	elif [ "$(key_get KEY2 EXPECT)" = "yes" ]; then
-		get_keys_which_signed "$_qtype" "$_file" | grep "^$(key_get KEY2 ID)$" > /dev/null && return 1
+		get_keys_which_signed "$_qtype" "$_file" | grep "^$(key_get KEY2 ID)$" > /dev/null && _log_error "${_qtype} RRset signed unexpectedly with key $(key_get KEY2 ID)"
 	fi

 	if [ "$(key_get KEY3 "$_expect_type")" = "yes" ] && [ "$(key_get KEY3 "$_role")" = "yes" ]; then
-		get_keys_which_signed "$_qtype" "$_file" | grep "^$(key_get KEY3 ID)$" > /dev/null || return 1
-		numsigs=$((numsigs+1))
+		get_keys_which_signed "$_qtype" "$_file" | grep "^$(key_get KEY3 ID)$" > /dev/null || _log_error "${_qtype} RRset not signed with key $(key_get KEY3 ID)"
 	elif [ "$(key_get KEY3 EXPECT)" = "yes" ]; then
-		get_keys_which_signed "$_qtype" "$_file" | grep "^$(key_get KEY3 ID)$" > /dev/null && return 1
+		get_keys_which_signed "$_qtype" "$_file" | grep "^$(key_get KEY3 ID)$" > /dev/null && _log_error "${_qtype} RRset signed unexpectedly with key $(key_get KEY3 ID)"
 	fi

 	if [ "$(key_get KEY4 "$_expect_type")" = "yes" ] && [ "$(key_get KEY4 "$_role")" = "yes" ]; then
-		get_keys_which_signed "$_qtype" "$_file" | grep "^$(key_get KEY4 ID)$" > /dev/null || return 1
-		numsigs=$((numsigs+1))
+		get_keys_which_signed "$_qtype" "$_file" | grep "^$(key_get KEY4 ID)$" > /dev/null || _log_error "${_qtype} RRset not signed with key $(key_get KEY4 ID)"
 	elif [ "$(key_get KEY4 EXPECT)" = "yes" ]; then
-		get_keys_which_signed "$_qtype" "$_file" | grep "^$(key_get KEY4 ID)$" > /dev/null && return 1
+		get_keys_which_signed "$_qtype" "$_file" | grep "^$(key_get KEY4 ID)$" > /dev/null && _log_error "${_qtype} RRset signed unexpectedly with key $(key_get KEY4 ID)"
 	fi
-
-	lines=$(get_keys_which_signed "${_qtype}" "${_file}" | wc -l)
-	test "$lines" -eq "$numsigs" || echo_i "bad number of signatures for $_qtype (got $lines, expected $numsigs)"
-	test "$lines" -eq "$numsigs" || return 1
-
-	return 0
-}
-check_signatures() {
-	retry_quiet 3 _check_signatures $1 $2 $3 || _log_error "RRset $1 in zone $ZONE incorrectly signed"
 }

 response_has_cds_for_key() (
@@ -921,8 +867,6 @@ check_cds() {
 	echo_i "check CDS and CDNSKEY rrset are signed correctly for zone ${ZONE} ($n)"
 	ret=0

-	_checksig=0
-
 	_dig_with_opts "$ZONE" "@${SERVER}" "CDS" > "dig.out.$DIR.test$n.cds" || _log_error "dig ${ZONE} CDS failed"
 	grep "status: NOERROR" "dig.out.$DIR.test$n.cds" > /dev/null || _log_error "mismatch status in DNS response"

@@ -935,13 +879,13 @@ check_cds() {
 	else
 		grep "CDS.*0 0 0 00" "dig.out.$DIR.test$n.cds" > /dev/null || _log_error "missing CDS DELETE record in DNS response"
 		grep "CDNSKEY.*0 3 0 AA==" "dig.out.$DIR.test$n.cdnskey" > /dev/null || _log_error "missing CDNSKEY DELETE record in DNS response"
-		_checksig=1
 	fi

 	if [ "$(key_get KEY1 STATE_DS)" = "rumoured" ] || [ "$(key_get KEY1 STATE_DS)" = "omnipresent" ]; then
 		response_has_cds_for_key KEY1 "dig.out.$DIR.test$n.cds" || _log_error "missing CDS record in response for key $(key_get KEY1 ID)"
+		check_signatures "CDS" "dig.out.$DIR.test$n.cds" "KSK"
 		response_has_cdnskey_for_key KEY1 "dig.out.$DIR.test$n.cdnskey" || _log_error "missing CDNSKEY record in response for key $(key_get KEY1 ID)"
-		_checksig=1
+		check_signatures "CDNSKEY" "dig.out.$DIR.test$n.cdnskey" "KSK"
 	elif [ "$(key_get KEY1 EXPECT)" = "yes" ]; then
 		response_has_cds_for_key KEY1 "dig.out.$DIR.test$n.cds" && _log_error "unexpected CDS record in response for key $(key_get KEY1 ID)"
 		# KEY1 should not have an associated CDNSKEY, but there may be
@@ -952,8 +896,9 @@ check_cds() {

 	if [ "$(key_get KEY2 STATE_DS)" = "rumoured" ] || [ "$(key_get KEY2 STATE_DS)" = "omnipresent" ]; then
 		response_has_cds_for_key KEY2 "dig.out.$DIR.test$n.cds" || _log_error "missing CDS record in response for key $(key_get KEY2 ID)"
+		check_signatures "CDS" "dig.out.$DIR.test$n.cds" "KSK"
 		response_has_cdnskey_for_key KEY2 "dig.out.$DIR.test$n.cdnskey" || _log_error "missing CDNSKEY record in response for key $(key_get KEY2 ID)"
-		_checksig=1
+		check_signatures "CDNSKEY" "dig.out.$DIR.test$n.cdnskey" "KSK"
 	elif [ "$(key_get KEY2 EXPECT)" = "yes" ]; then
 		response_has_cds_for_key KEY2 "dig.out.$DIR.test$n.cds" && _log_error "unexpected CDS record in response for key $(key_get KEY2 ID)"
 		# KEY2 should not have an associated CDNSKEY, but there may be
@@ -964,8 +909,9 @@ check_cds() {

 	if [ "$(key_get KEY3 STATE_DS)" = "rumoured" ] || [ "$(key_get KEY3 STATE_DS)" = "omnipresent" ]; then
 		response_has_cds_for_key KEY3 "dig.out.$DIR.test$n.cds" || _log_error "missing CDS record in response for key $(key_get KEY3 ID)"
+		check_signatures "CDS" "dig.out.$DIR.test$n.cds" "KSK"
 		response_has_cdnskey_for_key KEY3 "dig.out.$DIR.test$n.cdnskey" || _log_error "missing CDNSKEY record in response for key $(key_get KEY3 ID)"
-		_checksig=1
+		check_signatures "CDNSKEY" "dig.out.$DIR.test$n.cdnskey" "KSK"
 	elif [ "$(key_get KEY3 EXPECT)" = "yes" ]; then
 		response_has_cds_for_key KEY3 "dig.out.$DIR.test$n.cds" && _log_error "unexpected CDS record in response for key $(key_get KEY3 ID)"
 		# KEY3 should not have an associated CDNSKEY, but there may be
@@ -976,8 +922,9 @@ check_cds() {

 	if [ "$(key_get KEY4 STATE_DS)" = "rumoured" ] || [ "$(key_get KEY4 STATE_DS)" = "omnipresent" ]; then
 		response_has_cds_for_key KEY4 "dig.out.$DIR.test$n.cds" || _log_error "missing CDS record in response for key $(key_get KEY4 ID)"
+		check_signatures "CDS" "dig.out.$DIR.test$n.cds" "KSK"
 		response_has_cdnskey_for_key KEY4 "dig.out.$DIR.test$n.cdnskey" || _log_error "missing CDNSKEY record in response for key $(key_get KEY4 ID)"
-		_checksig=1
+		check_signatures "CDNSKEY" "dig.out.$DIR.test$n.cdnskey" "KSK"
 	elif [ "$(key_get KEY4 EXPECT)" = "yes" ]; then
 		response_has_cds_for_key KEY4 "dig.out.$DIR.test$n.cds" && _log_error "unexpected CDS record in response for key $(key_get KEY4 ID)"
 		# KEY4 should not have an associated CDNSKEY, but there may be
@@ -986,81 +933,68 @@ check_cds() {
 		# so let's skip this check for now.
 	fi

-	test "$_checksig" -eq 0 || check_signatures "CDS" "dig.out.$DIR.test$n.cds" "KSK"
-	test "$_checksig" -eq 0 || check_signatures "CDNSKEY" "dig.out.$DIR.test$n.cdnskey" "KSK"
-
 	test "$ret" -eq 0 || echo_i "failed"
 	status=$((status+ret))
 }

-
-# Test DNSKEY query.
-_check_apex_dnskey() {
-	_dig_with_opts "$ZONE" "@${SERVER}" "DNSKEY" > "dig.out.$DIR.test$n" || return 1
-	grep "status: NOERROR" "dig.out.$DIR.test$n" > /dev/null || return 1
-
-	_checksig=0
-
-	if [ "$(key_get KEY1 STATE_DNSKEY)" = "rumoured" ] || [ "$(key_get KEY1 STATE_DNSKEY)" = "omnipresent" ]; then
-		grep "${ZONE}\..*${DNSKEY_TTL}.*IN.*DNSKEY.*257.*.3.*$(key_get KEY1 ALG_NUM)" "dig.out.$DIR.test$n" > /dev/null || return 1
-		_checksig=1
-	elif [ "$(key_get KEY1 EXPECT)" = "yes" ]; then
-		grep "${ZONE}\.*${DNSKEY_TTL}.*IN.*DNSKEY.*257.*.3.*$(key_get KEY1 ALG_NUM)" "dig.out.$DIR.test$n" > /dev/null && return 1
-	fi
-
-	if [ "$(key_get KEY2 STATE_DNSKEY)" = "rumoured" ] || [ "$(key_get KEY2 STATE_DNSKEY)" = "omnipresent" ]; then
-		grep "${ZONE}\..*${DNSKEY_TTL}.*IN.*DNSKEY.*257.*.3.*$(key_get KEY2 ALG_NUM)" "dig.out.$DIR.test$n" > /dev/null || return 1
-		_checksig=1
-	elif [ "$(key_get KEY2 EXPECT)" = "yes" ]; then
-		grep "${ZONE}\.*${DNSKEY_TTL}.*IN.*DNSKEY.*257.*.3.*$(key_get KEY2 ALG_NUM)" "dig.out.$DIR.test$n" > /dev/null && return 1
-	fi
-
-	if [ "$(key_get KEY3 STATE_DNSKEY)" = "rumoured" ] || [ "$(key_get KEY3 STATE_DNSKEY)" = "omnipresent" ]; then
-		grep "${ZONE}\..*${DNSKEY_TTL}.*IN.*DNSKEY.*257.*.3.*$(key_get KEY3 ALG_NUM)" "dig.out.$DIR.test$n" > /dev/null || return 1
-		_checksig=1
-	elif [ "$(key_get KEY3 EXPECT)" = "yes" ]; then
-		grep "${ZONE}\..*${DNSKEY_TTL}.*IN.*DNSKEY.*257.*.3.*$(key_get KEY3 ALG_NUM)" "dig.out.$DIR.test$n" > /dev/null && return 1
-	fi
-
-	if [ "$(key_get KEY4 STATE_DNSKEY)" = "rumoured" ] || [ "$(key_get KEY4 STATE_DNSKEY)" = "omnipresent" ]; then
-		grep "${ZONE}\..*${DNSKEY_TTL}.*IN.*DNSKEY.*257.*.3.*$(key_get KEY4 ALG_NUM)" "dig.out.$DIR.test$n" > /dev/null || return 1
-		_checksig=1
-	elif [ "$(key_get KEY4 EXPECT)" = "yes" ]; then
-		grep "${ZONE}\..*${DNSKEY_TTL}.*IN.*DNSKEY.*257.*.3.*$(key_get KEY4 ALG_NUM)" "dig.out.$DIR.test$n" > /dev/null && return 1
-	fi
-
-	test "$_checksig" -eq 0 && return 0
-
-	retry_quiet 3 _check_signatures "DNSKEY" "dig.out.$DIR.test$n" "KSK" || return 1
-
-	return 0
-}
-
 # Test the apex of a configured zone. This checks that the SOA and DNSKEY
 # RRsets are signed correctly and with the appropriate keys.
 check_apex() {
-
 	# Test DNSKEY query.
+	_qtype="DNSKEY"
 	n=$((n+1))
-	echo_i "check DNSKEY rrset is signed correctly for zone ${ZONE} ($n)"
+	echo_i "check ${_qtype} rrset is signed correctly for zone ${ZONE} ($n)"
 	ret=0
-	retry_quiet 3 _check_apex_dnskey || ret=1
+	_dig_with_opts "$ZONE" "@${SERVER}" $_qtype > "dig.out.$DIR.test$n" || _log_error "dig ${ZONE} ${_qtype} failed"
+	grep "status: NOERROR" "dig.out.$DIR.test$n" > /dev/null || _log_error "mismatch status in DNS response"
+
+	if [ "$(key_get KEY1 STATE_DNSKEY)" = "rumoured" ] || [ "$(key_get KEY1 STATE_DNSKEY)" = "omnipresent" ]; then
+		grep "${ZONE}\..*${DNSKEY_TTL}.*IN.*${_qtype}.*257.*.3.*$(key_get KEY1 ALG_NUM)" "dig.out.$DIR.test$n" > /dev/null || _log_error "missing ${_qtype} record in response for key $(key_get KEY1 ID)"
+		check_signatures $_qtype "dig.out.$DIR.test$n" "KSK"
+		numkeys=$((numkeys+1))
+	elif [ "$(key_get KEY1 EXPECT)" = "yes" ]; then
+		grep "${ZONE}\.*${DNSKEY_TTL}.*IN.*${_qtype}.*257.*.3.*$(key_get KEY1 ALG_NUM)" "dig.out.$DIR.test$n" > /dev/null && _log_error "unexpected ${_qtype} record in response for key $(key_get KEY1 ID)"
+	fi
+
+	if [ "$(key_get KEY2 STATE_DNSKEY)" = "rumoured" ] || [ "$(key_get KEY2 STATE_DNSKEY)" = "omnipresent" ]; then
+		grep "${ZONE}\..*${DNSKEY_TTL}.*IN.*${_qtype}.*257.*.3.*$(key_get KEY2 ALG_NUM)" "dig.out.$DIR.test$n" > /dev/null || _log_error "missing ${_qtype} record in response for key $(key_get KEY2 ID)"
+		check_signatures $_qtype "dig.out.$DIR.test$n" "KSK"
+		numkeys=$((numkeys+1))
+	elif [ "$(key_get KEY2 EXPECT)" = "yes" ]; then
+		grep "${ZONE}\.*${DNSKEY_TTL}.*IN.*${_qtype}.*257.*.3.*$(key_get KEY2 ALG_NUM)" "dig.out.$DIR.test$n" > /dev/null && _log_error "unexpected ${_qtype} record in response for key $(key_get KEY2 ID)"
+	fi
+
+	if [ "$(key_get KEY3 STATE_DNSKEY)" = "rumoured" ] || [ "$(key_get KEY3 STATE_DNSKEY)" = "omnipresent" ]; then
+		grep "${ZONE}\..*${DNSKEY_TTL}.*IN.*${_qtype}.*257.*.3.*$(key_get KEY3 ALG_NUM)" "dig.out.$DIR.test$n" > /dev/null || _log_error "missing ${_qtype} record in response for key $(key_get KEY3 ID)"
+		check_signatures $_qtype "dig.out.$DIR.test$n" "KSK"
+		numkeys=$((numkeys+1))
+	elif [ "$(key_get KEY3 EXPECT)" = "yes" ]; then
+		grep "${ZONE}\..*${DNSKEY_TTL}.*IN.*${_qtype}.*257.*.3.*$(key_get KEY3 ALG_NUM)" "dig.out.$DIR.test$n" > /dev/null && _log_error "unexpected ${_qtype} record in response for key $(key_get KEY3 ID)"
+	fi
+
+	if [ "$(key_get KEY4 STATE_DNSKEY)" = "rumoured" ] || [ "$(key_get KEY4 STATE_DNSKEY)" = "omnipresent" ]; then
+		grep "${ZONE}\..*${DNSKEY_TTL}.*IN.*${_qtype}.*257.*.3.*$(key_get KEY4 ALG_NUM)" "dig.out.$DIR.test$n" > /dev/null || _log_error "missing ${_qtype} record in response for key $(key_get KEY4 ID)"
+		check_signatures $_qtype "dig.out.$DIR.test$n" "KSK"
+		numkeys=$((numkeys+1))
+	elif [ "$(key_get KEY4 EXPECT)" = "yes" ]; then
+		grep "${ZONE}\..*${DNSKEY_TTL}.*IN.*${_qtype}.*257.*.3.*$(key_get KEY4 ALG_NUM)" "dig.out.$DIR.test$n" > /dev/null && _log_error "unexpected ${_qtype} record in response for key $(key_get KEY4 ID)"
+	fi
+
+	lines=$(get_keys_which_signed $_qtype "dig.out.$DIR.test$n" | wc -l)
+	check_signatures $_qtype "dig.out.$DIR.test$n" "KSK"
 	test "$ret" -eq 0 || echo_i "failed"
 	status=$((status+ret))

-	# We retry the DNSKEY query for at most three seconds to avoid test
-	# failures due to timing issues. If the DNSKEY query check passes this
-	# means the zone is resigned and further apex checks (SOA, CDS, CDNSKEY)
-	# don't need to be retried quietly.
-
 	# Test SOA query.
+	_qtype="SOA"
 	n=$((n+1))
-	echo_i "check SOA rrset is signed correctly for zone ${ZONE} ($n)"
+	echo_i "check ${_qtype} rrset is signed correctly for zone ${ZONE} ($n)"
 	ret=0
-	_dig_with_opts "$ZONE" "@${SERVER}" "SOA" > "dig.out.$DIR.test$n" || _log_error "dig ${ZONE} SOA failed"
+	_dig_with_opts "$ZONE" "@${SERVER}" $_qtype > "dig.out.$DIR.test$n" || _log_error "dig ${ZONE} ${_qtype} failed"
 	grep "status: NOERROR" "dig.out.$DIR.test$n" > /dev/null || _log_error "mismatch status in DNS response"
-	grep "${ZONE}\..*${DEFAULT_TTL}.*IN.*SOA.*" "dig.out.$DIR.test$n" > /dev/null || _log_error "missing SOA record in response"
-	check_signatures "SOA" "dig.out.$DIR.test$n" "ZSK"
+	grep "${ZONE}\..*${DEFAULT_TTL}.*IN.*${_qtype}.*" "dig.out.$DIR.test$n" > /dev/null || _log_error "missing ${_qtype} record in response"
+	lines=$(get_keys_which_signed $_qtype "dig.out.$DIR.test$n" | wc -l)
+	check_signatures $_qtype "dig.out.$DIR.test$n" "ZSK"
 	test "$ret" -eq 0 || echo_i "failed"
 	status=$((status+ret))

@@ -100,13 +100,6 @@ zone "unsigned.kasp" {
 	dnssec-policy "none";
 };

-/* A zone that is initially set to insecure. */
-zone "insecure.kasp" {
-	type primary;
-	file "insecure.kasp.db";
-	dnssec-policy "insecure";
-};
-
 /* A master zone with dnssec-policy but keys already created. */
 zone "dnssec-keygen.kasp" {
 	type primary;
@@ -252,15 +245,6 @@ zone "unfresh-sigs.autosign" {
 	dnssec-policy "autosign";
 };

-/*
- * Zone that has missing private KSK.
- */
-zone "ksk-missing.autosign" {
-	type primary;
-	file "ksk-missing.autosign.db";
-	dnssec-policy "autosign";
-};
-
 /*
 * Zone that has missing private ZSK.
 */
@@ -77,14 +77,6 @@ zone="unsigned.kasp"
 echo_i "setting up zone: $zone"
 zonefile="${zone}.db"
 infile="${zone}.db.infile"
-cp template.db.in $infile
-cp template.db.in $zonefile
-
-# Set up zone that stays unsigned.
-zone="insecure.kasp"
-echo_i "setting up zone: $zone"
-zonefile="${zone}.db"
-infile="${zone}.db.infile"
 cp template.db.in $zonefile

 # Some of these zones already have keys.
@@ -195,25 +187,7 @@ private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$KSK" >> "$infile"
 private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$ZSK" >> "$infile"
 $SIGNER -S -x -s now-1w -e now+1w -o $zone -O full -f $zonefile $infile > signer.out.$zone.1 2>&1

-# These signatures are still good, but the private KSK is missing.
-setup ksk-missing.autosign
-T="now-6mo"
-ksktimes="-P $T -A $T -P sync $T"
-zsktimes="-P $T -A $T"
-KSK=$($KEYGEN -a $DEFAULT_ALGORITHM -L 300 -f KSK $ksktimes $zone 2> keygen.out.$zone.1)
-ZSK=$($KEYGEN -a $DEFAULT_ALGORITHM -L 300        $zsktimes $zone 2> keygen.out.$zone.2)
-$SETTIME -s -g $O -d $O $T -k $O $T -r $O $T "$KSK" > settime.out.$zone.1 2>&1
-$SETTIME -s -g $O -k $O $T -z $O $T          "$ZSK" > settime.out.$zone.2 2>&1
-cat template.db.in "${KSK}.key" "${ZSK}.key" > "$infile"
-private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$KSK" >> "$infile"
-private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$ZSK" >> "$infile"
-$SIGNER -S -x -s now-1w -e now+1w -o $zone -O full -f $zonefile $infile > signer.out.$zone.1 2>&1
-echo "KSK: yes" >> "${KSK}".state
-echo "ZSK: no" >> "${KSK}".state
-echo "Lifetime: 63072000" >> "${KSK}".state # PT2Y
-rm -f "${KSK}".private
-
-# These signatures are still good, but the private ZSK is missing.
+# These signatures are already expired, and the private ZSK is missing.
 setup zsk-missing.autosign
 T="now-6mo"
 ksktimes="-P $T -A $T -P sync $T"
@@ -225,10 +199,7 @@ $SETTIME -s -g $O -k $O $T -z $O $T          "$ZSK" > settime.out.$zone.2 2>&1
 cat template.db.in "${KSK}.key" "${ZSK}.key" > "$infile"
 private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$KSK" >> "$infile"
 private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$ZSK" >> "$infile"
-$SIGNER -S -x -s now-1w -e now+1w -o $zone -O full -f $zonefile $infile > signer.out.$zone.1 2>&1
-echo "KSK: no" >> "${ZSK}".state
-echo "ZSK: yes" >> "${ZSK}".state
-echo "Lifetime: 31536000" >> "${ZSK}".state # PT1Y
+$SIGNER -PS -x -s now-2w -e now-1mi -o $zone -O full -f $zonefile $infile > signer.out.$zone.1 2>&1
 rm -f "${ZSK}".private

 # These signatures are already expired, and the private ZSK is retired.
@@ -50,12 +50,6 @@ zone "step1.going-insecure-dynamic.kasp" {
 	allow-update { any; };
 };

-zone "step1.going-straight-to-none.kasp" {
-	type master;
-	file "step1.going-straight-to-none.kasp.db";
-	dnssec-policy "default";
-};
-
 /* These are alorithm rollover test zones. */
 zone "step1.algorithm-roll.kasp" {
 	type primary;
--- a/Show More
+++ b/Show More
				`@@ -1 +0,0 @@`
				`-m record,size,mctx -c named.conf -d 1 -D cacheclean-ns1 -X named.lock -g -T maxcachesize=2097152`
				`@@ -1 +0,0 @@`
				`-m record,size,mctx -c named.conf -d 3 -D cacheclean-ns2 -X named.lock -g -T maxcachesize=2097152`