xxx

This reverts commit 650900f2e9.

.gitlab-ci.yml

@@ -60,15 +60,15 @@ stages:
 
 .openbsd-amd64: &openbsd_amd64
   tags:
-    - openbsd
+    - libvirt
     - amd64
 
 ### Docker Image Templates
 
 # Alpine Linux
 
-.alpine-3.10-amd64: &alpine_3_10_amd64_image
-  image: "$CI_REGISTRY_IMAGE:alpine-3.10-amd64"
+.alpine-3.11-amd64: &alpine_3_11_amd64_image
+  image: "$CI_REGISTRY_IMAGE:alpine-3.11-amd64"
   <<: *linux_amd64
 
 # CentOS
@@ -111,6 +111,12 @@ stages:
   image: "$CI_REGISTRY_IMAGE:debian-sid-i386"
   <<: *linux_i386
 
+# openSUSE Tumbleweed
+
+.tumbleweed-latest-amd64: &tumbleweed_latest_amd64_image
+  image: "$CI_REGISTRY_IMAGE:tumbleweed-latest-amd64"
+  <<: *linux_amd64
+
 # Fedora
 
 .fedora-31-amd64: &fedora_31_amd64_image
@@ -170,7 +176,7 @@ stages:
       - configure
       - ltmain.sh
       - m4/libtool.m4
-    expire_in: "1 week"
+    expire_in: "1 day"
 
 .configure: &configure |
     ${CONFIGURE} \
@@ -191,6 +197,7 @@ stages:
   stage: build
   before_script:
     - test -w "${CCACHE_DIR}" && export PATH="/usr/lib/ccache:${PATH}"
+    - test -n "${OOT_BUILD_WORKSPACE}" && mkdir "${OOT_BUILD_WORKSPACE}" && cd "${OOT_BUILD_WORKSPACE}"
   script:
     - *configure
     - ${MAKE} -j${BUILD_PARALLEL_JOBS:-1} -k all V=1
@@ -201,7 +208,7 @@ stages:
     - autoreconf:sid:amd64
   artifacts:
     untracked: true
-    expire_in: "1 week"
+    expire_in: "1 day"
 
 .windows_build: &windows_build_job
   stage: build
@@ -231,7 +238,7 @@ stages:
     - autoreconf:sid:amd64
   artifacts:
     untracked: true
-    expire_in: "1 week"
+    expire_in: "1 day"
 
 .setup_interfaces: &setup_interfaces |
     if [ "$(id -u)" -eq "0" ]; then
@@ -254,7 +261,7 @@ stages:
     - test -s bin/tests/system/systests.output
   artifacts:
     untracked: true
-    expire_in: "1 week"
+    expire_in: "1 day"
     when: on_failure
 
 .kyua_report: &kyua_report_html |
@@ -281,7 +288,7 @@ stages:
     - 'If (Test-Path C:/CrashDumps/*) { dir C:/CrashDumps; Throw }'
   artifacts:
     untracked: true
-    expire_in: "1 week"
+    expire_in: "1 day"
     when: on_failure
   only:
     - schedules
@@ -302,7 +309,7 @@ stages:
       - kyua.log
       - kyua.results
       - kyua_html/
-    expire_in: "1 week"
+    expire_in: "1 day"
     when: on_failure
 
 .cppcheck_args: &run_cppcheck |
@@ -340,7 +347,7 @@ stages:
       - compile_commands.json
       - cppcheck.results
       - cppcheck_html/
-    expire_in: "1 week"
+    expire_in: "1 day"
     when: on_failure
 
 ### Job Definitions
@@ -357,8 +364,11 @@ misc:sid:amd64:
     - sh util/checklibs.sh > checklibs.out
     - sh util/tabify-changes < CHANGES > CHANGES.tmp
     - diff -urNap CHANGES CHANGES.tmp
-    - rm CHANGES.tmp
     - perl util/check-changes CHANGES
+    - test ! -f CHANGES.SE || sh util/tabify-changes < CHANGES.SE > CHANGES.tmp
+    - test ! -f CHANGES.SE || diff -urNap CHANGES.SE CHANGES.tmp
+    - test ! -f CHANGES.SE || perl util/check-changes master=0 CHANGES.SE
+    - rm CHANGES.tmp
     - perl -w util/merge_copyrights
     - diff -urNap util/copyrights util/newcopyrights
     - rm util/newcopyrights
@@ -371,7 +381,7 @@ misc:sid:amd64:
     paths:
       - util/newcopyrights
       - checklibs.out
-    expire_in: "1 week"
+    expire_in: "1 day"
     when: on_failure
 
 🐞:sid:amd64:
@@ -415,7 +425,7 @@ docs:sid:amd64:
   artifacts:
     paths:
       - doc/arm/
-    expire_in: "1 month"
+    expire_in: "1 day"
 
 push:docs:sid:amd64:
   <<: *debian_sid_amd64_image
@@ -427,29 +437,29 @@ push:docs:sid:amd64:
     - master@isc-projects/bind9
     - /^v9_[1-9][0-9]$/@isc-projects/bind9
 
-# Jobs for regular GCC builds on Alpine Linux 3.10 (amd64)
+# Jobs for regular GCC builds on Alpine Linux 3.11 (amd64)
 
-gcc:alpine3.10:amd64:
+gcc:alpine3.11:amd64:
   variables:
     CC: gcc
     CFLAGS: "${CFLAGS_COMMON}"
     EXTRA_CONFIGURE: "--enable-dnstap"
-  <<: *alpine_3_10_amd64_image
+  <<: *alpine_3_11_amd64_image
   <<: *build_job
 
-system:gcc:alpine3.10:amd64:
-  <<: *alpine_3_10_amd64_image
+system:gcc:alpine3.11:amd64:
+  <<: *alpine_3_11_amd64_image
   <<: *system_test_job
   dependencies:
-    - gcc:alpine3.10:amd64
-  needs: ["gcc:alpine3.10:amd64"]
+    - gcc:alpine3.11:amd64
+  needs: ["gcc:alpine3.11:amd64"]
 
-unit:gcc:alpine3.10:amd64:
-  <<: *alpine_3_10_amd64_image
+unit:gcc:alpine3.11:amd64:
+  <<: *alpine_3_11_amd64_image
   <<: *unit_test_job
   dependencies:
-    - gcc:alpine3.10:amd64
-  needs: ["gcc:alpine3.10:amd64"]
+    - gcc:alpine3.11:amd64
+  needs: ["gcc:alpine3.11:amd64"]
 
 # Jobs for regular GCC builds on CentOS 6 (amd64)
 
@@ -622,7 +632,7 @@ scan-build:buster:amd64:
   artifacts:
     paths:
       - scan-build.reports/
-    expire_in: "1 week"
+    expire_in: "1 day"
     when: on_failure
 
 # Jobs for regular GCC builds on Debian Sid (amd64)
@@ -658,6 +668,19 @@ cppcheck:gcc:sid:amd64:
     - gcc:sid:amd64
   needs: ["gcc:sid:amd64"]
 
+# Job for out-of-tree GCC build on Debian Sid (amd64)
+
+oot:sid:amd64:
+  variables:
+    CC: gcc
+    CFLAGS: "${CFLAGS_COMMON} -O3"
+    CONFIGURE: ../configure
+    EXTRA_CONFIGURE: "--enable-dnstap --with-libidn2"
+    RUN_MAKE_INSTALL: 1
+    OOT_BUILD_WORKSPACE: workspace
+  <<: *debian_sid_amd64_image
+  <<: *build_job
+
 # Jobs for tarball GCC builds on Debian Sid (amd64)
 
 tarball:sid:amd64:
@@ -724,6 +747,30 @@ unit:gcc:sid:i386:
     - gcc:sid:i386
   needs: ["gcc:sid:i386"]
 
+# Jobs for regular GCC builds on openSUSE Tumbleweed (amd64)
+
+gcc:tumbleweed:amd64:
+  variables:
+    CC: gcc
+    CFLAGS: "${CFLAGS_COMMON}"
+    EXTRA_CONFIGURE: "--with-libidn2"
+  <<: *tumbleweed_latest_amd64_image
+  <<: *build_job
+
+system:gcc:tumbleweed:amd64:
+  <<: *tumbleweed_latest_amd64_image
+  <<: *system_test_job
+  dependencies:
+    - gcc:tumbleweed:amd64
+  needs: ["gcc:tumbleweed:amd64"]
+
+unit:gcc:tumbleweed:amd64:
+  <<: *tumbleweed_latest_amd64_image
+  <<: *unit_test_job
+  dependencies:
+    - gcc:tumbleweed:amd64
+  needs: ["gcc:tumbleweed:amd64"]
+
 # Jobs for regular GCC builds on Fedora 31 (amd64)
 
 gcc:fedora31:amd64:
@@ -851,7 +898,7 @@ system:tsan:buster:amd64:
   after_script:
     - find bin -name 'tsan.*' -exec python3 util/parse_tsan.py {} \;
   artifacts:
-    expire_in: "1 week"
+    expire_in: "1 day"
     paths:
       - bin/tests/system/*/tsan.*
       - bin/tests/system/*/*/tsan.*
@@ -873,7 +920,7 @@ unit:tsan:buster:amd64:
   after_script:
     - find lib -name 'tsan.*' -exec python3 util/parse_tsan.py {} \;
   artifacts:
-    expire_in: "1 week"
+    expire_in: "1 day"
     paths:
       - lib/*/tests/tsan.*
       - tsan/
@@ -1024,20 +1071,23 @@ unit:clang:freebsd12.0:amd64:
     - clang:freebsd12.0:amd64
   needs: ["clang:freebsd12.0:amd64"]
 
-# Jobs for Clang builds on OpenBSD 6.5 (amd64)
+# Jobs for Clang builds on OpenBSD 6.6 (amd64)
 
-clang:openbsd6.5:amd64:
+clang:openbsd6.6:amd64:
   variables:
     CC: clang
+    USER: gitlab-runner
   <<: *openbsd_amd64
   <<: *build_job
 
-system:clang:openbsd6.5:amd64:
+system:clang:openbsd6.6:amd64:
   <<: *openbsd_amd64
   <<: *system_test_job
+  variables:
+    USER: gitlab-runner
   dependencies:
-    - clang:openbsd6.5:amd64
-  needs: ["clang:openbsd6.5:amd64"]
+    - clang:openbsd6.6:amd64
+  needs: ["clang:openbsd6.6:amd64"]
   only:
     - schedules
     - tags
@@ -1140,4 +1190,4 @@ release:sid:amd64:
   artifacts:
     paths:
       - "*.tar.gz"
-    expire_in: "1 week"
+    expire_in: "1 day"

CHANGES

@@ -1,3 +1,63 @@
+5354.	[bug]		dnssec-policy created new KSK keys when zone is in
+			initial stage of signing (the DS is not yet in
+			rumoured or omnipresent state).  Fix by checking
+			key goals rather than active state when determining
+			new keys are needed. [GL #1593]
+
+5353.	[doc]		Document port and dscp parameters in forwarders
+			configuration option. [GL !914]
+
+5352.	[bug]		Correctly handle catalog zone entries containing
+			characters that aren't legal in filenames. [GL #1592]
+
+5351.	[bug]		CDS / CDNSKEY consistency checks failed to handle
+			removal records. [GL #1554]
+
+5350.	[bug]		When a view was configured with class CHAOS, the
+			server could crash while processing a query for a
+			non-existent record. [GL #1540]
+
+5349.	[bug]		Fix a race in task_pause/unpause. [GL #1571]
+
+5348.	[bug]		dnssec-settime -Psync was not being honoured.
+			[GL !2893]
+
+	--- 9.15.8 released ---
+
+5347.	[bug]		Fixed a bug that could cause an intermittent crash
+			in validator.c when validating a negative cache
+			entry. [GL #1561]
+
+5346.	[bug]		Make hazard pointer array allocations dynamic, fixing
+			a bug that caused named to crash on machines with more
+			than 40 cores. [GL #1493]
+
+5345.	[func]		Key-style trust anchors and DS-style trust anchors
+			can now both be used for the same name. [GL #1237]
+
+5344.	[bug]		Handle accept() errors properly in netmgr. [GL !2880]
+
+5343.	[func]		Add statistics counters to the netmgr. [GL #1311]
+
+5342.	[bug]		Disable pktinfo for IPv6 and bind to each interface
+			explicitly instead, because libuv doesn't support
+			pktinfo control messages. [GL #1558]
+
+5341.	[func]		Simplify passing the bound TCP socket to child
+			threads by using isc_uv_export/import functions.
+			[GL !2825]
+
+5340.	[bug]		Don't deadlock when binding to a TCP socket fails.
+			[GL #1499]
+
+5339.	[bug]		With some libmaxminddb versions, named could erroneously
+			match an IP address not belonging to any subnet defined
+			in a given GeoIP2 database to one of the existing
+			entries in that database. [GL #1552]
+
+5338.	[bug]		Fix line spacing in `rndc secroots`.
+			Thanks to Tony Finch. [GL !2478]
+
 5337.	[func]		'named -V' now reports maxminddb and protobuf-c
 			versions. [GL !2686]
 

HISTORY.md

@@ -150,7 +150,7 @@ releases.  New features include:
 - "rndc modzone" reconfigures a single zone, without requiring the entire
   server to be reconfigured.
 - "rndc showzone" displays the current configuration of a zone.
-- "rndc managed-keys" can be used to check the status of RFC 5001 managed
+- "rndc managed-keys" can be used to check the status of RFC 5011 managed
   trust anchors, or to force trust anchors to be refreshed.
 - "max-cache-size" can now be set to a percentage of available memory. The
   default is 90%.

PLATFORMS

@@ -34,7 +34,7 @@ offer support on a "best effort" basis for some.
 
 Regularly tested platforms
 
-As of Dec 2019, BIND 9.15 is fully supported and regularly tested on the
+As of Feb 2020, BIND 9.15 is fully supported and regularly tested on the
 following systems:
 
   * Debian 9, 10
@@ -42,7 +42,7 @@ following systems:
   * Fedora 31
   * Red Hat Enterprise Linux / CentOS 7, 8
   * FreeBSD 11.3, 12.0
-  * OpenBSD 6.5
+  * OpenBSD 6.6
   * Alpine Linux
 
 The amd64, i386, armhf and arm64 CPU architectures are all fully

PLATFORMS.md

@@ -42,7 +42,7 @@ offer support on a "best effort" basis for some.
 
 ### Regularly tested platforms
 
-As of Dec 2019, BIND 9.15 is fully supported and regularly tested on the
+As of Feb 2020, BIND 9.15 is fully supported and regularly tested on the
 following systems:
 
 * Debian 9, 10
@@ -50,7 +50,7 @@ following systems:
 * Fedora 31
 * Red Hat Enterprise Linux / CentOS 7, 8
 * FreeBSD 11.3, 12.0
-* OpenBSD 6.5
+* OpenBSD 6.6
 * Alpine Linux
 
 The amd64, i386, armhf and arm64 CPU architectures are all fully supported.

README

@@ -111,10 +111,10 @@ BIND 9.15 features
 BIND 9.15 is the newest development branch of BIND 9. It includes a number
 of changes from BIND 9.14 and earlier releases. New features include:
 
-  * New "dnssec-policy" statement to configure a key and signing policy
-    for zones, enabling automatic key regeneration and rollover.
-  * New new network manager based on libuv.
-  * Support for the new GeoIP2 geolocation API
+  * New dnssec-policy statement to configure a key and signing policy for
+    zones, enabling automatic key regeneration and rollover.
+  * New network manager based on libuv.
+  * Added support for the new GeoIP2 geolocation API, libmaxminddb.
   * Improved DNSSEC trust anchor configuration using the trust-anchors
     statement, permitting configuration of trust anchors in DS as well as
     DNSKEY format.
@@ -136,8 +136,8 @@ including RHEL/CentOS, Fedora, Debian, Ubuntu, SLES, openSUSE, Slackware,
 Alpine, FreeBSD, NetBSD, OpenBSD, macOS, Solaris, OpenIndiana, OmniOS CE,
 HP-UX, and OpenWRT.
 
-BIND is also available for Windows Server 2008 and higher. See win32utils/
-build.txt for details on building for Windows systems.
+BIND is also available for Windows Server 2012 R2 and higher. See
+win32utils/build.txt for details on building for Windows systems.
 
 To build on a UNIX or Linux system, use:
 

README.md

@@ -127,10 +127,10 @@ BIND 9.15 is the newest development branch of BIND 9. It includes a
 number of changes from BIND 9.14 and earlier releases. New features
 include:
 
-* New "dnssec-policy" statement to configure a key and signing policy
+* New `dnssec-policy` statement to configure a key and signing policy
   for zones, enabling automatic key regeneration and rollover.
-* New new network manager based on libuv.
-* Support for the new GeoIP2 geolocation API
+* New network manager based on libuv.
+* Added support for the new GeoIP2 geolocation API, `libmaxminddb`.
 * Improved DNSSEC trust anchor configuration using the `trust-anchors`
   statement, permitting configuration of trust anchors in DS as well as
   DNSKEY format.
@@ -153,7 +153,7 @@ UNIX, including RHEL/CentOS, Fedora, Debian, Ubuntu, SLES, openSUSE,
 Slackware, Alpine, FreeBSD, NetBSD, OpenBSD, macOS, Solaris,
 OpenIndiana, OmniOS CE, HP-UX, and OpenWRT.
 
-BIND is also available for Windows Server 2008 and higher.  See
+BIND is also available for Windows Server 2012 R2 and higher.  See
 `win32utils/build.txt` for details on building for Windows
 systems.
 

bin/check/named-checkconf.8

@@ -1,4 +1,4 @@
-.\" Copyright (C) 2000-2002, 2004, 2005, 2007, 2009, 2014-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2000-2002, 2004, 2005, 2007, 2009, 2014-2016, 2018-2020 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" This Source Code Form is subject to the terms of the Mozilla Public
 .\" License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -148,5 +148,5 @@ BIND 9 Administrator Reference Manual\&.
 \fBInternet Systems Consortium, Inc\&.\fR
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2000-2002, 2004, 2005, 2007, 2009, 2014-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2000-2002, 2004, 2005, 2007, 2009, 2014-2016, 2018-2020 Internet Systems Consortium, Inc. ("ISC")
 .br

bin/check/named-checkconf.html

@@ -1,6 +1,6 @@
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2000-2002, 2004, 2005, 2007, 2009, 2014-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2000-2002, 2004, 2005, 2007, 2009, 2014-2016, 2018-2020 Internet Systems Consortium, Inc. ("ISC")
  - 
  - This Source Code Form is subject to the terms of the Mozilla Public
  - License, v. 2.0. If a copy of the MPL was not distributed with this

bin/check/named-checkzone.8

@@ -1,4 +1,4 @@
-.\" Copyright (C) 2000-2002, 2004-2007, 2009-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2000-2002, 2004-2007, 2009-2016, 2018-2020 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" This Source Code Form is subject to the terms of the Mozilla Public
 .\" License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -325,5 +325,5 @@ BIND 9 Administrator Reference Manual\&.
 \fBInternet Systems Consortium, Inc\&.\fR
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2000-2002, 2004-2007, 2009-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2000-2002, 2004-2007, 2009-2016, 2018-2020 Internet Systems Consortium, Inc. ("ISC")
 .br

bin/check/named-checkzone.html

@@ -1,6 +1,6 @@
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2000-2002, 2004-2007, 2009-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2000-2002, 2004-2007, 2009-2016, 2018-2020 Internet Systems Consortium, Inc. ("ISC")
  - 
  - This Source Code Form is subject to the terms of the Mozilla Public
  - License, v. 2.0. If a copy of the MPL was not distributed with this

bin/confgen/ddns-confgen.8

@@ -1,4 +1,4 @@
-.\" Copyright (C) 2009, 2014-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2009, 2014-2016, 2018-2020 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" This Source Code Form is subject to the terms of the Mozilla Public
 .\" License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -144,5 +144,5 @@ BIND 9 Administrator Reference Manual\&.
 \fBInternet Systems Consortium, Inc\&.\fR
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2009, 2014-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2009, 2014-2016, 2018-2020 Internet Systems Consortium, Inc. ("ISC")
 .br

bin/confgen/ddns-confgen.html

@@ -1,6 +1,6 @@
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2009, 2014-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2009, 2014-2016, 2018-2020 Internet Systems Consortium, Inc. ("ISC")
  - 
  - This Source Code Form is subject to the terms of the Mozilla Public
  - License, v. 2.0. If a copy of the MPL was not distributed with this

bin/confgen/rndc-confgen.8

@@ -1,4 +1,4 @@
-.\" Copyright (C) 2001, 2003-2005, 2007, 2009, 2013-2019 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2001, 2003-2005, 2007, 2009, 2013-2020 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" This Source Code Form is subject to the terms of the Mozilla Public
 .\" License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -206,5 +206,5 @@ BIND 9 Administrator Reference Manual\&.
 \fBInternet Systems Consortium, Inc\&.\fR
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2001, 2003-2005, 2007, 2009, 2013-2019 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2001, 2003-2005, 2007, 2009, 2013-2020 Internet Systems Consortium, Inc. ("ISC")
 .br

bin/confgen/rndc-confgen.html

@@ -1,6 +1,6 @@
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2001, 2003-2005, 2007, 2009, 2013-2019 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2001, 2003-2005, 2007, 2009, 2013-2020 Internet Systems Consortium, Inc. ("ISC")
  - 
  - This Source Code Form is subject to the terms of the Mozilla Public
  - License, v. 2.0. If a copy of the MPL was not distributed with this

bin/delv/delv.1

@@ -1,4 +1,4 @@
-.\" Copyright (C) 2014-2019 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2014-2020 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" This Source Code Form is subject to the terms of the Mozilla Public
 .\" License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -433,5 +433,5 @@ RFC5155\&.
 \fBInternet Systems Consortium, Inc\&.\fR
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2014-2019 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2014-2020 Internet Systems Consortium, Inc. ("ISC")
 .br

bin/delv/delv.html

@@ -1,6 +1,6 @@
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2014-2019 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2014-2020 Internet Systems Consortium, Inc. ("ISC")
  - 
  - This Source Code Form is subject to the terms of the Mozilla Public
  - License, v. 2.0. If a copy of the MPL was not distributed with this

bin/dig/dig.1

@@ -1,4 +1,4 @@
-.\" Copyright (C) 2000-2011, 2013-2019 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2000-2011, 2013-2020 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" This Source Code Form is subject to the terms of the Mozilla Public
 .\" License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -849,5 +849,5 @@ There are probably too many query options\&.
 \fBInternet Systems Consortium, Inc\&.\fR
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2000-2011, 2013-2019 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2000-2011, 2013-2020 Internet Systems Consortium, Inc. ("ISC")
 .br

bin/dig/dig.c

@@ -568,8 +568,7 @@ printmessage(dig_query_t *query, const isc_buffer_t *msgbuf,
 	if (!query->lookup->comments)
 		flags |= DNS_MESSAGETEXTFLAG_NOCOMMENTS;
 
-	result = isc_buffer_allocate(mctx, &buf, len);
-	check_result(result, "isc_buffer_allocate");
+	isc_buffer_allocate(mctx, &buf, len);
 
 	if (yaml) {
 		enum { Q = 0x1, R = 0x2 }; /* Q:query; R:ecursive */
@@ -742,11 +741,8 @@ repopulate_buffer:
 buftoosmall:
 			len += OUTPUTBUF;
 			isc_buffer_free(&buf);
-			result = isc_buffer_allocate(mctx, &buf, len);
-			if (result == ISC_R_SUCCESS)
-				goto repopulate_buffer;
-			else
-				goto cleanup;
+			isc_buffer_allocate(mctx, &buf, len);
+			goto repopulate_buffer;
 		}
 		check_result(result,
 		     "dns_message_pseudosectiontotext");
@@ -827,7 +823,6 @@ buftoosmall:
 	       (char *)isc_buffer_base(buf));
 	isc_buffer_free(&buf);
 
-cleanup:
 	if (style != NULL)
 		dns_master_styledestroy(&style, mctx);
 	return (result);

bin/dig/dig.html

@@ -1,6 +1,6 @@
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2000-2011, 2013-2019 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2000-2011, 2013-2020 Internet Systems Consortium, Inc. ("ISC")
  - 
  - This Source Code Form is subject to the terms of the Mozilla Public
  - License, v. 2.0. If a copy of the MPL was not distributed with this

bin/dig/dighost.c

@@ -883,10 +883,8 @@ setup_text_key(void) {
 	unsigned char *secretstore;
 
 	debug("setup_text_key()");
-	result = isc_buffer_allocate(mctx, &namebuf, MXNAME);
-	check_result(result, "isc_buffer_allocate");
+	isc_buffer_allocate(mctx, &namebuf, MXNAME);
 	dns_name_init(&keyname, NULL);
-	check_result(result, "dns_name_init");
 	isc_buffer_putstr(namebuf, keynametext);
 	secretsize = (unsigned int) strlen(keysecret) * 3 / 4;
 	secretstore = isc_mem_allocate(mctx, secretsize);
@@ -1396,8 +1394,7 @@ setup_libs(void) {
 	check_result(result, "dst_lib_init");
 	is_dst_up = true;
 
-	result = isc_mempool_create(mctx, COMMSIZE, &commctx);
-	check_result(result, "isc_mempool_create");
+	isc_mempool_create(mctx, COMMSIZE, &commctx);
 	isc_mempool_setname(commctx, "COMMPOOL");
 	/*
 	 * 6 and 2 set as reasonable parameters for 3 or 4 nameserver

bin/dig/host.1

@@ -1,4 +1,4 @@
-.\" Copyright (C) 2000-2002, 2004, 2005, 2007-2009, 2014-2019 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2000-2002, 2004, 2005, 2007-2009, 2014-2020 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" This Source Code Form is subject to the terms of the Mozilla Public
 .\" License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -269,5 +269,5 @@ runs\&.
 \fBInternet Systems Consortium, Inc\&.\fR
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2000-2002, 2004, 2005, 2007-2009, 2014-2019 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2000-2002, 2004, 2005, 2007-2009, 2014-2020 Internet Systems Consortium, Inc. ("ISC")
 .br

bin/dig/host.c

@@ -199,8 +199,7 @@ say_message(dns_name_t *name, const char *msg, dns_rdata_t *rdata,
 
 	dns_name_format(name, namestr, sizeof(namestr));
  retry:
-	result = isc_buffer_allocate(mctx, &b, bufsize);
-	check_result(result, "isc_buffer_allocate");
+	isc_buffer_allocate(mctx, &b, bufsize);
 	result = dns_rdata_totext(rdata, NULL, b);
 	if (result == ISC_R_NOSPACE) {
 		isc_buffer_free(&b);

bin/dig/host.html

@@ -1,6 +1,6 @@
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2000-2002, 2004, 2005, 2007-2009, 2014-2019 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2000-2002, 2004, 2005, 2007-2009, 2014-2020 Internet Systems Consortium, Inc. ("ISC")
  - 
  - This Source Code Form is subject to the terms of the Mozilla Public
  - License, v. 2.0. If a copy of the MPL was not distributed with this

bin/dig/nslookup.1

@@ -1,4 +1,4 @@
-.\" Copyright (C) 2004-2007, 2010, 2013-2019 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2004-2007, 2010, 2013-2020 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" This Source Code Form is subject to the terms of the Mozilla Public
 .\" License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -301,5 +301,5 @@ runs or when the standard output is not a tty\&.
 \fBInternet Systems Consortium, Inc\&.\fR
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2004-2007, 2010, 2013-2019 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2004-2007, 2010, 2013-2020 Internet Systems Consortium, Inc. ("ISC")
 .br

bin/dig/nslookup.c

@@ -221,9 +221,7 @@ printrdata(dns_rdata_t *rdata) {
 		printf("rdata_%d = ", rdata->type);
 
 	while (!done) {
-		result = isc_buffer_allocate(mctx, &b, size);
-		if (result != ISC_R_SUCCESS)
-			check_result(result, "isc_buffer_allocate");
+		isc_buffer_allocate(mctx, &b, size);
 		result = dns_rdata_totext(rdata, NULL, b);
 		if (result == ISC_R_SUCCESS) {
 			printf("%.*s\n", (int)isc_buffer_usedlength(b),

bin/dig/nslookup.docbook

@@ -308,7 +308,7 @@ nslookup -query=hinfo  -timeout=10
                     The class specifies the protocol group of the information.
 
                   </para>
-		  <para>
+                  <para>
                     (Default = IN; abbreviation = cl)
                   </para>
                 </listitem>
@@ -318,10 +318,10 @@ nslookup -query=hinfo  -timeout=10
                 <term><constant><replaceable><optional>no</optional></replaceable>debug</constant></term>
                 <listitem>
                   <para>
-		    Turn on or off the display of the full response packet and
-		    any intermediate response packets when searching.
+                    Turn on or off the display of the full response packet and
+                    any intermediate response packets when searching.
                   </para>
-		  <para>
+                  <para>
                     (Default = nodebug; abbreviation = <optional>no</optional>deb)
                   </para>
                 </listitem>
@@ -332,9 +332,9 @@ nslookup -query=hinfo  -timeout=10
                 <listitem>
                   <para>
                     Turn debugging mode on or off.  This displays more about
-	            what nslookup is doing.
+                    what nslookup is doing.
                   </para>
-		  <para>
+                  <para>
                     (Default = nod2)
                   </para>
                 </listitem>
@@ -358,7 +358,7 @@ nslookup -query=hinfo  -timeout=10
                     names in the domain search list to the request until an
                     answer is received.
                   </para>
-		  <para>
+                  <para>
                     (Default = search)
                   </para>
                 </listitem>
@@ -370,7 +370,7 @@ nslookup -query=hinfo  -timeout=10
                   <para>
                     Change the default TCP/UDP name server port to <replaceable>value</replaceable>.
                   </para>
-		  <para>
+                  <para>
                     (Default = 53; abbreviation = po)
                   </para>
                 </listitem>
@@ -389,9 +389,15 @@ nslookup -query=hinfo  -timeout=10
                   <para>
                     Change the type of the information query.
                   </para>
-		  <para>
-                    (Default = A; abbreviations = q, ty)
+                  <para>
+                    (Default = A and then AAAA; abbreviations = q, ty)
                   </para>
+                    <para>
+                      <emphasis role="bold">Note:</emphasis> It is
+                      only possible to specify one query type, only
+                      the default behavior looks up both when an
+                      alternative is not specified.
+                    </para>
                 </listitem>
               </varlistentry>
 
@@ -403,7 +409,7 @@ nslookup -query=hinfo  -timeout=10
                     have the
                     information.
                   </para>
-		  <para>
+                  <para>
                     (Default = recurse; abbreviation = [no]rec)
                   </para>
                 </listitem>
@@ -413,9 +419,9 @@ nslookup -query=hinfo  -timeout=10
                 <term><constant>ndots=</constant><replaceable>number</replaceable></term>
                 <listitem>
                   <para>
-		    Set the number of dots (label separators) in a domain
-		    that will disable searching.  Absolute names always
-		    stop searching.
+                    Set the number of dots (label separators) in a domain
+                    that will disable searching.  Absolute names always
+                    stop searching.
                   </para>
                 </listitem>
               </varlistentry>
@@ -446,7 +452,7 @@ nslookup -query=hinfo  -timeout=10
                     Always use a virtual circuit when sending requests to the
                     server.
                   </para>
-		  <para>
+                  <para>
                     (Default = novc)
                   </para>
                 </listitem>
@@ -456,15 +462,15 @@ nslookup -query=hinfo  -timeout=10
                 <term><constant><replaceable><optional>no</optional></replaceable>fail</constant></term>
                 <listitem>
                   <para>
-		    Try the next nameserver if a nameserver responds with
-		    SERVFAIL or a referral (nofail) or terminate query
-		    (fail) on such a response.
-		  </para>
-		  <para>
+                    Try the next nameserver if a nameserver responds with
+                    SERVFAIL or a referral (nofail) or terminate query
+                    (fail) on such a response.
+                  </para>
+                  <para>
                     (Default = nofail)
                   </para>
-	        </listitem>
-	      </varlistentry>
+                </listitem>
+              </varlistentry>
 
             </variablelist>
           </para>

bin/dig/nslookup.html

@@ -1,6 +1,6 @@
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2004-2007, 2010, 2013-2019 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004-2007, 2010, 2013-2020 Internet Systems Consortium, Inc. ("ISC")
  - 
  - This Source Code Form is subject to the terms of the Mozilla Public
  - License, v. 2.0. If a copy of the MPL was not distributed with this

bin/dnssec/dnssec-cds.8

@@ -1,4 +1,4 @@
-.\" Copyright (C) 2017-2019 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2017-2020 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" This Source Code Form is subject to the terms of the Mozilla Public
 .\" License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -293,5 +293,5 @@ RFC 7344\&.
 .RE
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2017-2019 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2017-2020 Internet Systems Consortium, Inc. ("ISC")
 .br

bin/dnssec/dnssec-cds.c

@@ -370,8 +370,7 @@ formatset(dns_rdataset_t *rdataset) {
 					mctx);
 	check_result(result, "dns_master_stylecreate2 failed");
 
-	result = isc_buffer_allocate(mctx, &buf, MAX_CDS_RDATA_TEXT_SIZE);
-	check_result(result, "printing DS records");
+	isc_buffer_allocate(mctx, &buf, MAX_CDS_RDATA_TEXT_SIZE);
 	result = dns_master_rdatasettotext(name, rdataset, style, NULL, buf);
 
 	if ((result == ISC_R_SUCCESS) && isc_buffer_availablelength(buf) < 1) {
@@ -834,8 +833,7 @@ make_new_ds_set(ds_maker_func_t *ds_from_rdata,
 		result = dns_rdatalist_tordataset(dslist, &new_ds_set);
 		check_result(result, "dns_rdatalist_tordataset(dslist)");
 
-		result = isc_buffer_allocate(mctx, &new_ds_buf, size);
-		check_result(result, "building new DS records");
+		isc_buffer_allocate(mctx, &new_ds_buf, size);
 
 		for (result = dns_rdataset_first(rdset);
 		     result == ISC_R_SUCCESS;

bin/dnssec/dnssec-cds.html

@@ -1,6 +1,6 @@
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2017-2019 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2017-2020 Internet Systems Consortium, Inc. ("ISC")
  - 
  - This Source Code Form is subject to the terms of the Mozilla Public
  - License, v. 2.0. If a copy of the MPL was not distributed with this

bin/dnssec/dnssec-dsfromkey.8

@@ -1,4 +1,4 @@
-.\" Copyright (C) 2008-2012, 2014-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2008-2012, 2014-2016, 2018-2020 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" This Source Code Form is subject to the terms of the Mozilla Public
 .\" License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -222,5 +222,5 @@ RFC 7344
 \fBInternet Systems Consortium, Inc\&.\fR
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2008-2012, 2014-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2008-2012, 2014-2016, 2018-2020 Internet Systems Consortium, Inc. ("ISC")
 .br

bin/dnssec/dnssec-dsfromkey.html

@@ -1,6 +1,6 @@
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2008-2012, 2014-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2008-2012, 2014-2016, 2018-2020 Internet Systems Consortium, Inc. ("ISC")
  - 
  - This Source Code Form is subject to the terms of the Mozilla Public
  - License, v. 2.0. If a copy of the MPL was not distributed with this

bin/dnssec/dnssec-importkey.8

@@ -1,4 +1,4 @@
-.\" Copyright (C) 2013-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2013-2016, 2018-2020 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" This Source Code Form is subject to the terms of the Mozilla Public
 .\" License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -134,5 +134,5 @@ RFC 5011\&.
 \fBInternet Systems Consortium, Inc\&.\fR
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2013-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2013-2016, 2018-2020 Internet Systems Consortium, Inc. ("ISC")
 .br

bin/dnssec/dnssec-importkey.html

@@ -1,6 +1,6 @@
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2013-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2013-2016, 2018-2020 Internet Systems Consortium, Inc. ("ISC")
  - 
  - This Source Code Form is subject to the terms of the Mozilla Public
  - License, v. 2.0. If a copy of the MPL was not distributed with this

bin/dnssec/dnssec-keyfromlabel.8

@@ -1,4 +1,4 @@
-.\" Copyright (C) 2008-2012, 2014-2019 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2008-2012, 2014-2020 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" This Source Code Form is subject to the terms of the Mozilla Public
 .\" License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -307,5 +307,5 @@ The PKCS#11 URI Scheme (draft\-pechanec\-pkcs11uri\-13)\&.
 \fBInternet Systems Consortium, Inc\&.\fR
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2008-2012, 2014-2019 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2008-2012, 2014-2020 Internet Systems Consortium, Inc. ("ISC")
 .br

bin/dnssec/dnssec-keyfromlabel.html

@@ -1,6 +1,6 @@
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2008-2012, 2014-2019 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2008-2012, 2014-2020 Internet Systems Consortium, Inc. ("ISC")
  - 
  - This Source Code Form is subject to the terms of the Mozilla Public
  - License, v. 2.0. If a copy of the MPL was not distributed with this

bin/dnssec/dnssec-keygen.8

@@ -1,4 +1,4 @@
-.\" Copyright (C) 2000-2005, 2007-2012, 2014-2019 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2000-2005, 2007-2012, 2014-2020 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" This Source Code Form is subject to the terms of the Mozilla Public
 .\" License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -374,5 +374,5 @@ RFC 4034\&.
 \fBInternet Systems Consortium, Inc\&.\fR
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2000-2005, 2007-2012, 2014-2019 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2000-2005, 2007-2012, 2014-2020 Internet Systems Consortium, Inc. ("ISC")
 .br

bin/dnssec/dnssec-keygen.html

@@ -1,6 +1,6 @@
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2000-2005, 2007-2012, 2014-2019 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2000-2005, 2007-2012, 2014-2020 Internet Systems Consortium, Inc. ("ISC")
  - 
  - This Source Code Form is subject to the terms of the Mozilla Public
  - License, v. 2.0. If a copy of the MPL was not distributed with this

bin/dnssec/dnssec-revoke.8

@@ -1,4 +1,4 @@
-.\" Copyright (C) 2009, 2011, 2014-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2009, 2011, 2014-2016, 2018-2020 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" This Source Code Form is subject to the terms of the Mozilla Public
 .\" License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -99,5 +99,5 @@ RFC 5011\&.
 \fBInternet Systems Consortium, Inc\&.\fR
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2009, 2011, 2014-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2009, 2011, 2014-2016, 2018-2020 Internet Systems Consortium, Inc. ("ISC")
 .br

bin/dnssec/dnssec-revoke.html

@@ -1,6 +1,6 @@
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2009, 2011, 2014-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2009, 2011, 2014-2016, 2018-2020 Internet Systems Consortium, Inc. ("ISC")
  - 
  - This Source Code Form is subject to the terms of the Mozilla Public
  - License, v. 2.0. If a copy of the MPL was not distributed with this

bin/dnssec/dnssec-settime.8

@@ -1,4 +1,4 @@
-.\" Copyright (C) 2009-2011, 2014-2019 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2009-2011, 2014-2020 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" This Source Code Form is subject to the terms of the Mozilla Public
 .\" License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -251,5 +251,5 @@ RFC 5011\&.
 \fBInternet Systems Consortium, Inc\&.\fR
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2009-2011, 2014-2019 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2009-2011, 2014-2020 Internet Systems Consortium, Inc. ("ISC")
 .br

bin/dnssec/dnssec-settime.html

@@ -1,6 +1,6 @@
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2009-2011, 2014-2019 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2009-2011, 2014-2020 Internet Systems Consortium, Inc. ("ISC")
  - 
  - This Source Code Form is subject to the terms of the Mozilla Public
  - License, v. 2.0. If a copy of the MPL was not distributed with this

bin/dnssec/dnssec-signzone.8

@@ -1,4 +1,4 @@
-.\" Copyright (C) 2000-2009, 2011-2019 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2000-2009, 2011-2020 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" This Source Code Form is subject to the terms of the Mozilla Public
 .\" License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -470,5 +470,5 @@ RFC 4641\&.
 \fBInternet Systems Consortium, Inc\&.\fR
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2000-2009, 2011-2019 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2000-2009, 2011-2020 Internet Systems Consortium, Inc. ("ISC")
 .br

bin/dnssec/dnssec-signzone.c

@@ -226,8 +226,7 @@ dumpnode(dns_name_t *name, dns_dbnode_t *node) {
 
 	dns_rdataset_init(&rds);
 
-	result = isc_buffer_allocate(mctx, &buffer, bufsize);
-	check_result(result, "isc_buffer_allocate");
+	isc_buffer_allocate(mctx, &buffer, bufsize);
 
 	for (result = dns_rdatasetiter_first(iter);
 	     result == ISC_R_SUCCESS;
@@ -253,8 +252,7 @@ dumpnode(dns_name_t *name, dns_dbnode_t *node) {
 
 			bufsize <<= 1;
 			isc_buffer_free(&buffer);
-			result = isc_buffer_allocate(mctx, &buffer, bufsize);
-			check_result(result, "isc_buffer_allocate");
+			isc_buffer_allocate(mctx, &buffer, bufsize);
 		}
 		check_result(result, "dns_master_rdatasettotext");
 

bin/dnssec/dnssec-signzone.html

@@ -1,6 +1,6 @@
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2000-2009, 2011-2019 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2000-2009, 2011-2020 Internet Systems Consortium, Inc. ("ISC")
  - 
  - This Source Code Form is subject to the terms of the Mozilla Public
  - License, v. 2.0. If a copy of the MPL was not distributed with this

bin/dnssec/dnssec-verify.8

@@ -1,4 +1,4 @@
-.\" Copyright (C) 2012, 2014-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2012, 2014-2016, 2018-2020 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" This Source Code Form is subject to the terms of the Mozilla Public
 .\" License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -120,5 +120,5 @@ RFC 4033\&.
 \fBInternet Systems Consortium, Inc\&.\fR
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2012, 2014-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2012, 2014-2016, 2018-2020 Internet Systems Consortium, Inc. ("ISC")
 .br

bin/dnssec/dnssec-verify.html

@@ -1,6 +1,6 @@
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2012, 2014-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2012, 2014-2016, 2018-2020 Internet Systems Consortium, Inc. ("ISC")
  - 
  - This Source Code Form is subject to the terms of the Mozilla Public
  - License, v. 2.0. If a copy of the MPL was not distributed with this

bin/named/controlconf.c

@@ -445,9 +445,7 @@ control_recvmessage(isc_task_t *task, isc_event_t *event) {
 		goto cleanup_request;
 	}
 
-	result = isc_buffer_allocate(listener->mctx, &text, 2 * 2048);
-	if (result != ISC_R_SUCCESS)
-		goto cleanup_request;
+	isc_buffer_allocate(listener->mctx, &text, 2 * 2048);
 
 	/*
 	 * Establish nonce.
@@ -493,10 +491,7 @@ control_recvmessage(isc_task_t *task, isc_event_t *event) {
 		goto cleanup_response;
 
 	if (conn->buffer == NULL) {
-		result = isc_buffer_allocate(listener->mctx,
-					     &conn->buffer, 2 * 2048);
-		if (result != ISC_R_SUCCESS)
-			goto cleanup_response;
+		isc_buffer_allocate(listener->mctx, &conn->buffer, 2 * 2048);
 	}
 
 	isc_buffer_clear(conn->buffer);

bin/named/main.c

@@ -23,6 +23,7 @@
 #include <isc/dir.h>
 #include <isc/file.h>
 #include <isc/hash.h>
+#include <isc/hp.h>
 #include <isc/httpd.h>
 #include <isc/netmgr.h>
 #include <isc/os.h>
@@ -140,7 +141,6 @@ static bool nonearest = false;
 static bool nosoa = false;
 static bool notcp = false;
 static bool sigvalinsecs = false;
-static unsigned int delay = 0;
 
 /*
  * -4 and -6
@@ -637,14 +637,10 @@ parse_T_opt(char *option) {
 	/*
 	 * force the server to behave (or misbehave) in
 	 * specified ways for testing purposes.
-	 * delay=xxxx: delay client responses by xxxx ms to
-	 *	       simulate remote servers.
 	 * dscp=x:     check that dscp values are as
 	 * 	       expected and assert otherwise.
 	 */
-	if (!strncmp(option, "delay=", 6)) {
-		delay = atoi(option + 6);
-	} else if (!strcmp(option, "dropedns")) {
+	if (!strcmp(option, "dropedns")) {
 		dropedns = true;
 	} else if (!strncmp(option, "dscp=", 5)) {
 		isc_dscp_check_value = atoi(option + 5);
@@ -907,6 +903,12 @@ create_managers(void) {
 		      "using %u UDP listener%s per interface",
 		      named_g_udpdisp, named_g_udpdisp == 1 ? "" : "s");
 
+	/*
+	 * We have ncpus network threads, ncpus worker threads, ncpus
+	 * old network threads - make it 4x just to be safe. The memory
+	 * impact is neglible.
+	 */
+	isc_hp_init(4*named_g_cpus);
 	named_g_nm = isc_nm_start(named_g_mctx, named_g_cpus);
 	if (named_g_nm == NULL) {
 		UNEXPECTED_ERROR(__FILE__, __LINE__,
@@ -1311,8 +1313,6 @@ setup(void) {
 		ns_server_setoption(sctx, NS_SERVER_NOTCP, true);
 	if (sigvalinsecs)
 		ns_server_setoption(sctx, NS_SERVER_SIGVALINSECS, true);
-
-	named_g_server->sctx->delay = delay;
 }
 
 static void

bin/named/named.8

@@ -1,4 +1,4 @@
-.\" Copyright (C) 2000, 2001, 2003-2009, 2011, 2013-2019 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2000, 2001, 2003-2009, 2011, 2013-2020 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" This Source Code Form is subject to the terms of the Mozilla Public
 .\" License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -378,5 +378,5 @@ BIND 9 Administrator Reference Manual\&.
 \fBInternet Systems Consortium, Inc\&.\fR
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2000, 2001, 2003-2009, 2011, 2013-2019 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2000, 2001, 2003-2009, 2011, 2013-2020 Internet Systems Consortium, Inc. ("ISC")
 .br

bin/named/named.conf.5

@@ -1,4 +1,4 @@
-.\" Copyright (C) 2004-2019 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2004-2020 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" This Source Code Form is subject to the terms of the Mozilla Public
 .\" License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -1107,5 +1107,5 @@ BIND 9 Administrator Reference Manual\&.
 \fBInternet Systems Consortium, Inc\&.\fR
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2004-2019 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2004-2020 Internet Systems Consortium, Inc. ("ISC")
 .br

bin/named/named.conf.html

@@ -1,6 +1,6 @@
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2004-2019 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004-2020 Internet Systems Consortium, Inc. ("ISC")
  - 
  - This Source Code Form is subject to the terms of the Mozilla Public
  - License, v. 2.0. If a copy of the MPL was not distributed with this

bin/named/named.html

@@ -1,6 +1,6 @@
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2000, 2001, 2003-2009, 2011, 2013-2019 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2000, 2001, 2003-2009, 2011, 2013-2020 Internet Systems Consortium, Inc. ("ISC")
  - 
  - This Source Code Form is subject to the terms of the Mozilla Public
  - License, v. 2.0. If a copy of the MPL was not distributed with this

bin/named/server.c

@@ -700,11 +700,12 @@ configure_view_nametable(const cfg_obj_t *vconfig, const cfg_obj_t *config,
 }
 
 static isc_result_t
-ta_fromconfig(const cfg_obj_t *key, bool *initialp, dst_key_t **keyp,
-	      dns_rdata_ds_t **dsp, const char **namestrp, isc_mem_t *mctx)
+ta_fromconfig(const cfg_obj_t *key, bool *initialp, const char **namestrp,
+	      unsigned char *digest, dns_rdata_ds_t *ds)
 {
+	isc_result_t result;
 	dns_rdata_dnskey_t keystruct;
-	dns_rdata_ds_t *ds = NULL;
+	dns_rdata_t rdata = DNS_RDATA_INIT;
 	uint32_t rdata1, rdata2, rdata3;
 	const char *datastr = NULL, *namestr = NULL;
 	unsigned char data[4096];
@@ -715,8 +716,6 @@ ta_fromconfig(const cfg_obj_t *key, bool *initialp, dst_key_t **keyp,
 	dns_fixedname_t fname;
 	dns_name_t *name = NULL;
 	isc_buffer_t namebuf;
-	isc_result_t result;
-	dst_key_t *dstkey = NULL;
 	const char *atstr = NULL;
 	enum {
 		INIT_DNSKEY,
@@ -726,9 +725,8 @@ ta_fromconfig(const cfg_obj_t *key, bool *initialp, dst_key_t **keyp,
 		TRUSTED
 	} anchortype;
 
-	REQUIRE(keyp != NULL && *keyp == NULL);
-	REQUIRE(dsp != NULL && *dsp == NULL);
 	REQUIRE(namestrp != NULL && *namestrp == NULL);
+	REQUIRE(ds != NULL);
 
 	/* if DNSKEY, flags; if DS, key tag */
 	rdata1 = cfg_obj_asuint32(cfg_tuple_get(key, "rdata1"));
@@ -775,6 +773,13 @@ ta_fromconfig(const cfg_obj_t *key, bool *initialp, dst_key_t **keyp,
 	isc_buffer_init(&databuf, data, sizeof(data));
 	isc_buffer_init(&rrdatabuf, rrdata, sizeof(rrdata));
 
+	*ds = (dns_rdata_ds_t){
+		.common.rdclass = dns_rdataclass_in,
+		.common.rdtype = dns_rdatatype_ds
+	};
+
+	ISC_LINK_INIT(&ds->common, link);
+
 	switch(anchortype) {
 	case INIT_DNSKEY:
 	case STATIC_DNSKEY:
@@ -802,7 +807,7 @@ ta_fromconfig(const cfg_obj_t *key, bool *initialp, dst_key_t **keyp,
 		if (rdata2 > 0xff) {
 			CHECKM(ISC_R_RANGE, "key protocol");
 		}
-		if (rdata3> 0xff) {
+		if (rdata3 > 0xff) {
 			CHECKM(ISC_R_RANGE, "key algorithm");
 		}
 
@@ -810,30 +815,25 @@ ta_fromconfig(const cfg_obj_t *key, bool *initialp, dst_key_t **keyp,
 		keystruct.protocol = (uint8_t)rdata2;
 		keystruct.algorithm = (uint8_t)rdata3;
 
+		if (!dst_algorithm_supported(keystruct.algorithm)) {
+			CHECK(DST_R_UNSUPPORTEDALG);
+		}
+
 		datastr = cfg_obj_asstring(cfg_tuple_get(key, "data"));
 		CHECK(isc_base64_decodestring(datastr, &databuf));
 		isc_buffer_usedregion(&databuf, &r);
 		keystruct.datalen = r.length;
 		keystruct.data = r.base;
 
-		CHECK(dns_rdata_fromstruct(NULL, keystruct.common.rdclass,
+		CHECK(dns_rdata_fromstruct(&rdata, keystruct.common.rdclass,
 					   keystruct.common.rdtype,
 					   &keystruct, &rrdatabuf));
-		CHECK(dst_key_fromdns(name, dns_rdataclass_in,
-				      &rrdatabuf, mctx, &dstkey));
-
-		*keyp = dstkey;
+		CHECK(dns_ds_fromkeyrdata(name, &rdata, DNS_DSDIGEST_SHA256,
+					  digest, ds));
 		break;
 
 	case INIT_DS:
 	case STATIC_DS:
-		ds = isc_mem_get(mctx, sizeof(*ds));
-		ds->common.rdclass = dns_rdataclass_in;
-		ds->common.rdtype = dns_rdatatype_ds;
-		ds->mctx = NULL;
-
-		ISC_LINK_INIT(&ds->common, link);
-
 		if (rdata1 > 0xffff) {
 			CHECKM(ISC_R_RANGE, "key tag");
 		}
@@ -878,13 +878,10 @@ ta_fromconfig(const cfg_obj_t *key, bool *initialp, dst_key_t **keyp,
 			break;
 		}
 
-		ds->mctx = mctx;
 		ds->length = r.length;
-		ds->digest = isc_mem_allocate(mctx, r.length);
+		ds->digest = digest;
 		memmove(ds->digest, r.base, r.length);
 
-		*dsp = ds;
-		ds = NULL;
 		break;
 
 	default:
@@ -895,15 +892,6 @@ ta_fromconfig(const cfg_obj_t *key, bool *initialp, dst_key_t **keyp,
 	return (ISC_R_SUCCESS);
 
  cleanup:
-	if (dstkey != NULL) {
-		dst_key_free(&dstkey);
-	}
-
-	if (ds != NULL) {
-		dns_rdata_freestruct(ds);
-		isc_mem_put(mctx, ds, sizeof(*ds));
-	}
-
 	return (result);
 }
 
@@ -921,46 +909,30 @@ ta_fromconfig(const cfg_obj_t *key, bool *initialp, dst_key_t **keyp,
 static isc_result_t
 process_key(const cfg_obj_t *key, dns_keytable_t *secroots,
 	    const dns_name_t *keyname_match, dns_resolver_t *resolver,
-	    bool managed, isc_mem_t *mctx)
+	    bool managed)
 {
 	dns_fixedname_t fkeyname;
 	dns_name_t *keyname = NULL;
 	const char *namestr = NULL;
-	dst_key_t *dstkey = NULL;
-	dns_rdata_ds_t *ds = NULL;
-	unsigned int keyalg;
+	dns_rdata_ds_t ds;
 	isc_result_t result;
 	bool initializing = managed;
+	unsigned char digest[ISC_MAX_MD_SIZE];
+	isc_buffer_t b;
 
-	result = ta_fromconfig(key, &initializing, &dstkey, &ds,
-			       &namestr, mctx);
+	result = ta_fromconfig(key, &initializing, &namestr, digest, &ds);
 
 	switch (result) {
 	case ISC_R_SUCCESS:
 		/*
-		 * Trust anchor was parsed correctly. If dstkey is
-		 * not NULL, then it was a key anchor, its algorithm
-		 * is supported by the crypto library, and it is not
-		 * revoked. If dstkey is NULL, then it was a DS
-		 * trust anchor instead.
+		 * Trust anchor was parsed correctly.
 		 */
-		if (dstkey != NULL) {
-			keyname = dst_key_name(dstkey);
-			keyalg = dst_key_alg(dstkey);
-		} else {
-			isc_buffer_t b;
-
-			INSIST(ds != NULL);
-
-			isc_buffer_constinit(&b, namestr, strlen(namestr));
-			isc_buffer_add(&b, strlen(namestr));
-			keyname = dns_fixedname_initname(&fkeyname);
-			result = dns_name_fromtext(keyname, &b,
-						   dns_rootname, 0, NULL);
-			if (result != ISC_R_SUCCESS) {
-				return (result);
-			}
-			keyalg = ds->algorithm;
+		isc_buffer_constinit(&b, namestr, strlen(namestr));
+		isc_buffer_add(&b, strlen(namestr));
+		keyname = dns_fixedname_initname(&fkeyname);
+		result = dns_name_fromtext(keyname, &b, dns_rootname, 0, NULL);
+		if (result != ISC_R_SUCCESS) {
+			return (result);
 		}
 		break;
 	case DST_R_UNSUPPORTEDALG:
@@ -1011,7 +983,8 @@ process_key(const cfg_obj_t *key, dns_keytable_t *secroots,
 	 * its owner name.  If it does not, do not load the key and log a
 	 * warning, but do not prevent further keys from being processed.
 	 */
-	if (!dns_resolver_algorithm_supported(resolver, keyname, keyalg)) {
+	if (!dns_resolver_algorithm_supported(resolver, keyname, ds.algorithm))
+	{
 		cfg_obj_log(key, named_g_lctx, ISC_LOG_WARNING,
 			    "ignoring %s for '%s': algorithm is disabled",
 			    initializing ? "initial-key" : "static-key",
@@ -1026,29 +999,10 @@ process_key(const cfg_obj_t *key, dns_keytable_t *secroots,
 	 * managed, so we use 'initializing' twice here, for both the
 	 * 'managed' and 'initializing' arguments to dns_keytable_add().
 	 */
-	result = dns_keytable_add(secroots, initializing,
-				  initializing, keyname,
-				  dstkey != NULL ? &dstkey : NULL,
-				  ds);
+	result = dns_keytable_add(secroots, initializing, initializing,
+				  keyname, &ds);
 
  done:
-	/*
-	 * Ensure 'dstkey' does not leak.  Note that if dns_keytable_add()
-	 * succeeds, ownership of the key structure is transferred to the key
-	 * table, i.e. 'dstkey' is set to NULL.
-	 */
-	if (dstkey != NULL) {
-		dst_key_free(&dstkey);
-	}
-
-	/*
-	 * Free 'ds'.
-	 */
-	if (ds != NULL) {
-		dns_rdata_freestruct(ds);
-		isc_mem_put(mctx, ds, sizeof(*ds));
-	}
-
 	return (result);
 }
 
@@ -1059,7 +1013,7 @@ process_key(const cfg_obj_t *key, dns_keytable_t *secroots,
  */
 static isc_result_t
 load_view_keys(const cfg_obj_t *keys, dns_view_t *view, bool managed,
-	       const dns_name_t *keyname, isc_mem_t *mctx)
+	       const dns_name_t *keyname)
 {
 	const cfg_listelt_t *elt, *elt2;
 	const cfg_obj_t *keylist;
@@ -1078,9 +1032,8 @@ load_view_keys(const cfg_obj_t *keys, dns_view_t *view, bool managed,
 		     elt2 != NULL;
 		     elt2 = cfg_list_next(elt2))
 		{
-			CHECK(process_key(cfg_listelt_value(elt2),
-					  secroots, keyname, view->resolver,
-					  managed, mctx));
+			CHECK(process_key(cfg_listelt_value(elt2), secroots,
+					  keyname, view->resolver, managed));
 		}
 	}
 
@@ -1238,7 +1191,7 @@ configure_view_dnsseckeys(dns_view_t *view, const cfg_obj_t *vconfig,
 
 		if (builtin_keys != NULL) {
 			CHECK(load_view_keys(builtin_keys, view, true,
-					     dns_rootname, mctx));
+					     dns_rootname));
 		}
 
 		if (!keyloaded(view, dns_rootname)) {
@@ -1251,17 +1204,13 @@ configure_view_dnsseckeys(dns_view_t *view, const cfg_obj_t *vconfig,
 	}
 
 	if (view->rdclass == dns_rdataclass_in) {
-		CHECK(load_view_keys(view_keys, view, false, NULL, mctx));
-		CHECK(load_view_keys(view_trust_anchors, view, true, NULL,
-				     mctx));
-		CHECK(load_view_keys(view_managed_keys, view, true, NULL,
-				     mctx));
+		CHECK(load_view_keys(view_keys, view, false, NULL));
+		CHECK(load_view_keys(view_trust_anchors, view, true, NULL));
+		CHECK(load_view_keys(view_managed_keys, view, true, NULL));
 
-		CHECK(load_view_keys(global_keys, view, false, NULL, mctx));
-		CHECK(load_view_keys(global_trust_anchors, view, true,
-				     NULL, mctx));
-		CHECK(load_view_keys(global_managed_keys, view, true,
-				     NULL, mctx));
+		CHECK(load_view_keys(global_keys, view, false, NULL));
+		CHECK(load_view_keys(global_trust_anchors, view, true, NULL));
+		CHECK(load_view_keys(global_managed_keys, view, true, NULL));
 	}
 
 	/*
@@ -1395,7 +1344,7 @@ get_view_querysource_dispatch(const cfg_obj_t **maps, int af,
 		break;
 	}
 	if (isc_sockaddr_getport(&sa) == 0) {
-		attrs |= DNS_DISPATCHATTR_EXCLUSIVE;
+//		attrs |= DNS_DISPATCHATTR_EXCLUSIVE;
 		maxdispatchbuffers = EXCLBUFFERS;
 	} else {
 		INSIST(obj != NULL);
@@ -6835,11 +6784,7 @@ struct dotat_arg {
  * reported in the TAT query.
  */
 static isc_result_t
-get_tat_qname(dns_name_t *target, dns_name_t *keyname,
-	      dns_keytable_t *keytable, dns_keynode_t *keynode)
-{
-	dns_keynode_t *firstnode = keynode;
-	dns_keynode_t *nextnode = NULL;
+get_tat_qname(dns_name_t *target, dns_name_t *keyname, dns_keynode_t *keynode) {
 	dns_rdataset_t *dsset = NULL;
 	unsigned int i, n = 0;
 	uint16_t ids[12];
@@ -6866,23 +6811,6 @@ get_tat_qname(dns_name_t *target, dns_name_t *keyname,
 				n++;
 			}
 		}
-	} else {
-		do {
-			dst_key_t *key = dns_keynode_key(keynode);
-			if (key != NULL) {
-				if (n < (sizeof(ids)/sizeof(ids[0]))) {
-					ids[n] = dst_key_id(key);
-					n++;
-				}
-			}
-			nextnode = NULL;
-			(void)dns_keytable_nextkeynode(keytable, keynode,
-						       &nextnode);
-			if (keynode != firstnode) {
-				dns_keytable_detachkeynode(keytable, &keynode);
-			}
-			keynode = nextnode;
-		} while (keynode != NULL);
 	}
 
 	if (n == 0) {
@@ -6938,7 +6866,7 @@ dotat(dns_keytable_t *keytable, dns_keynode_t *keynode,
 	task = dotat_arg->task;
 
 	tatname = dns_fixedname_initname(&fixed);
-	result = get_tat_qname(tatname, keyname, keytable, keynode);
+	result = get_tat_qname(tatname, keyname, keynode);
 	if (result != ISC_R_SUCCESS) {
 		return;
 	}
@@ -7766,9 +7694,7 @@ data_to_cfg(dns_view_t *view, MDB_val *key, MDB_val *data,
 	REQUIRE(zoneconfig != NULL && *zoneconfig == NULL);
 
 	if (*text == NULL) {
-		result = isc_buffer_allocate(view->mctx, text, 256);
-		if (result != ISC_R_SUCCESS)
-			goto cleanup;
+		isc_buffer_allocate(view->mctx, text, 256);
 	} else {
 		isc_buffer_clear(*text);
 	}
@@ -9618,7 +9544,7 @@ run_server(isc_task_t *task, isc_event_t *event) {
 					  named_g_nm,
 					  named_g_dispatchmgr,
 					  server->task, named_g_udpdisp, geoip,
-					  &server->interfacemgr),
+					  named_g_cpus, &server->interfacemgr),
 		   "creating interface manager");
 
 	CHECKFATAL(isc_timer_create(named_g_timermgr, isc_timertype_inactive,
@@ -9941,6 +9867,7 @@ named_server_create(isc_mem_t *mctx, named_server_t **serverp) {
 				    isc_sockstatscounter_max),
 		   "isc_stats_create");
 	isc_socketmgr_setstats(named_g_socketmgr, server->sockstats);
+	isc_nm_setstats(named_g_nm, server->sockstats);
 
 	CHECKFATAL(isc_stats_create(named_g_mctx, &server->zonestats,
 				    dns_zonestatscounter_max),
@@ -10138,8 +10065,7 @@ named_add_reserved_dispatch(named_server_t *server,
 	return;
 
  cleanup:
-	if (dispatch != NULL)
-		isc_mem_put(server->mctx, dispatch, sizeof(*dispatch));
+	isc_mem_put(server->mctx, dispatch, sizeof(*dispatch));
 	isc_sockaddr_format(addr, addrbuf, sizeof(addrbuf));
 	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 		      NAMED_LOGMODULE_SERVER, ISC_LOG_WARNING,
@@ -11101,8 +11027,7 @@ named_server_dumpdb(named_server_t *server, isc_lex_t *lex,
 	return (ISC_R_SUCCESS);
 
  cleanup:
-	if (dctx != NULL)
-		dumpcontext_destroy(dctx);
+	dumpcontext_destroy(dctx);
 	return (result);
 }
 
@@ -11118,17 +11043,20 @@ named_server_dumpsecroots(named_server_t *server, isc_lex_t *lex,
 	FILE *fp = NULL;
 	isc_time_t now;
 	char tbuf[64];
+	unsigned int used = isc_buffer_usedlength(*text);
+	bool first = true;
 
 	/* Skip the command name. */
 	ptr = next_token(lex, text);
-	if (ptr == NULL)
+	if (ptr == NULL) {
 		return (ISC_R_UNEXPECTEDEND);
+	}
 
 	/* "-" here means print the output instead of dumping to file */
 	ptr = next_token(lex, text);
-	if (ptr != NULL && strcmp(ptr, "-") == 0)
+	if (ptr != NULL && strcmp(ptr, "-") == 0) {
 		ptr = next_token(lex, text);
-	else {
+	} else {
 		result = isc_stdio_open(server->secrootsfile, "w", &fp);
 		if (result != ISC_R_SUCCESS) {
 			(void) putstr(text, "could not open ");
@@ -11143,66 +11071,85 @@ named_server_dumpsecroots(named_server_t *server, isc_lex_t *lex,
 	CHECK(putstr(text, "secure roots as of "));
 	CHECK(putstr(text, tbuf));
 	CHECK(putstr(text, ":\n"));
+	used = isc_buffer_usedlength(*text);
 
 	do {
 		for (view = ISC_LIST_HEAD(server->viewlist);
 		     view != NULL;
 		     view = ISC_LIST_NEXT(view, link))
 		{
-			if (ptr != NULL && strcmp(view->name, ptr) != 0)
+			if (ptr != NULL && strcmp(view->name, ptr) != 0) {
 				continue;
-			if (secroots != NULL)
+			}
+			if (secroots != NULL) {
 				dns_keytable_detach(&secroots);
+			}
 			result = dns_view_getsecroots(view, &secroots);
 			if (result == ISC_R_NOTFOUND) {
 				result = ISC_R_SUCCESS;
 				continue;
 			}
-			CHECK(putstr(text, "\n Start view "));
+			if (first || used != isc_buffer_usedlength(*text)) {
+				CHECK(putstr(text, "\n"));
+				first = false;
+			}
+			CHECK(putstr(text, " Start view "));
 			CHECK(putstr(text, view->name));
 			CHECK(putstr(text, "\n   Secure roots:\n\n"));
+			used = isc_buffer_usedlength(*text);
 			CHECK(dns_keytable_totext(secroots, text));
 
-			if (ntatable != NULL)
+			if (ntatable != NULL) {
 				dns_ntatable_detach(&ntatable);
+			}
 			result = dns_view_getntatable(view, &ntatable);
 			if (result == ISC_R_NOTFOUND) {
 				result = ISC_R_SUCCESS;
 				continue;
 			}
-			CHECK(putstr(text, "\n   Negative trust anchors:\n\n"));
+			if (used != isc_buffer_usedlength(*text)) {
+				CHECK(putstr(text, "\n"));
+			}
+			CHECK(putstr(text, "   Negative trust anchors:\n\n"));
+			used = isc_buffer_usedlength(*text);
 			CHECK(dns_ntatable_totext(ntatable, NULL, text));
 		}
-		if (ptr != NULL)
+
+		if (ptr != NULL) {
 			ptr = next_token(lex, text);
+		}
 	} while (ptr != NULL);
 
  cleanup:
-	if (isc_buffer_usedlength(*text) > 0) {
-		if (fp != NULL)
-			(void)putstr(text, "\n");
-		else
-			(void)putnull(text);
-	}
-	if (secroots != NULL)
+	if (secroots != NULL) {
 		dns_keytable_detach(&secroots);
-	if (ntatable != NULL)
+	}
+	if (ntatable != NULL) {
 		dns_ntatable_detach(&ntatable);
+	}
+
 	if (fp != NULL) {
+		if (used != isc_buffer_usedlength(*text)) {
+			(void)putstr(text, "\n");
+		}
 		fprintf(fp, "%.*s", (int) isc_buffer_usedlength(*text),
 			(char *) isc_buffer_base(*text));
 		isc_buffer_clear(*text);
 		(void)isc_stdio_close(fp);
+	} else if (isc_buffer_usedlength(*text) > 0) {
+		(void)putnull(text);
 	}
-	if (result == ISC_R_SUCCESS)
+
+	if (result == ISC_R_SUCCESS) {
 		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 			      NAMED_LOGMODULE_SERVER, ISC_LOG_INFO,
 			      "dumpsecroots complete");
-	else
+	} else {
 		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 			      NAMED_LOGMODULE_SERVER, ISC_LOG_ERROR,
 			      "dumpsecroots failed: %s",
 			      dns_result_totext(result));
+	}
 	return (result);
 }
 
@@ -12443,17 +12390,7 @@ nzd_save(MDB_txn **txnp, MDB_dbi dbi, dns_zone_t *zone,
 		/* We're creating or overwriting the zone */
 		const cfg_obj_t *zoptions;
 
-		result = isc_buffer_allocate(view->mctx, &text, 256);
-		if (result != ISC_R_SUCCESS) {
-			isc_log_write(named_g_lctx,
-				      NAMED_LOGCATEGORY_GENERAL,
-				      NAMED_LOGMODULE_SERVER,
-				      ISC_LOG_ERROR,
-				      "Unable to allocate buffer in "
-				      "nzd_save(): %s",
-				      isc_result_totext(result));
-			goto cleanup;
-		}
+		isc_buffer_allocate(view->mctx, &text, 256);
 
 		zoptions = cfg_tuple_get(zconfig, "options");
 		if (zoptions == NULL) {
@@ -12478,7 +12415,7 @@ nzd_save(MDB_txn **txnp, MDB_dbi dbi, dns_zone_t *zone,
 				      ISC_LOG_ERROR,
 				      "Error writing zone config to "
 				      "buffer in nzd_save(): %s",
-				      isc_result_totext(result));
+				      isc_result_totext(dzarg.result));
 			result = dzarg.result;
 			goto cleanup;
 		}
@@ -12810,7 +12747,7 @@ migrate_nzf(dns_view_t *view) {
 
 	CHECK(nzd_open(view, 0, &txn, &dbi));
 
-	CHECK(isc_buffer_allocate(view->mctx, &text, 256));
+	isc_buffer_allocate(view->mctx, &text, 256);
 
 	for (element = cfg_list_first(zonelist);
 	     element != NULL;
@@ -13896,10 +13833,6 @@ named_server_delzone(named_server_t *server, isc_lex_t *lex,
 		dns_zone_detach(&raw);
 	if (zone != NULL)
 		dns_zone_detach(&zone);
-	if (dz != NULL) {
-		dns_zone_detach(&dz->zone);
-		isc_mem_put(named_g_mctx, dz, sizeof(*dz));
-	}
 
 	return (result);
 }

bin/nsupdate/nsupdate.1

@@ -1,4 +1,4 @@
-.\" Copyright (C) 2000-2012, 2014-2019 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2000-2012, 2014-2020 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" This Source Code Form is subject to the terms of the Mozilla Public
 .\" License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -519,5 +519,5 @@ The TSIG key is redundantly stored in two separate files\&. This is a consequenc
 \fBInternet Systems Consortium, Inc\&.\fR
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2000-2012, 2014-2019 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2000-2012, 2014-2020 Internet Systems Consortium, Inc. ("ISC")
 .br

bin/nsupdate/nsupdate.c

@@ -1238,8 +1238,7 @@ parse_name(char **cmdlinep, dns_message_t *msg, dns_name_t **namep) {
 
 	result = dns_message_gettempname(msg, namep);
 	check_result(result, "dns_message_gettempname");
-	result = isc_buffer_allocate(gmctx, &namebuf, DNS_NAME_MAXWIRE);
-	check_result(result, "isc_buffer_allocate");
+	isc_buffer_allocate(gmctx, &namebuf, DNS_NAME_MAXWIRE);
 	dns_name_init(*namep, NULL);
 	dns_name_setbuffer(*namep, namebuf);
 	dns_message_takebuffer(msg, &namebuf);
@@ -1284,16 +1283,14 @@ parse_rdata(char **cmdlinep, dns_rdataclass_t rdataclass,
 		isc_buffer_add(&source, strlen(cmdline));
 		result = isc_lex_openbuffer(lex, &source);
 		check_result(result, "isc_lex_openbuffer");
-		result = isc_buffer_allocate(gmctx, &buf, MAXWIRE);
-		check_result(result, "isc_buffer_allocate");
+		isc_buffer_allocate(gmctx, &buf, MAXWIRE);
 		result = dns_rdata_fromtext(NULL, rdataclass, rdatatype, lex,
 					    dns_rootname, 0, gmctx, buf,
 					    &callbacks);
 		isc_lex_destroy(&lex);
 		if (result == ISC_R_SUCCESS) {
 			isc_buffer_usedregion(buf, &r);
-			result = isc_buffer_allocate(gmctx, &newbuf, r.length);
-			check_result(result, "isc_buffer_allocate");
+			isc_buffer_allocate(gmctx, &newbuf, r.length);
 			isc_buffer_putmem(newbuf, r.base, r.length);
 			isc_buffer_usedregion(newbuf, &r);
 			dns_rdata_fromregion(rdata, rdataclass, rdatatype, &r);
@@ -2041,8 +2038,7 @@ show_message(FILE *stream, dns_message_t *msg, const char *description) {
 		}
 		if (buf != NULL)
 			isc_buffer_free(&buf);
-		result = isc_buffer_allocate(gmctx, &buf, bufsz);
-		check_result(result, "isc_buffer_allocate");
+		isc_buffer_allocate(gmctx, &buf, bufsz);
 		result = dns_message_totext(msg, style, 0, buf);
 		bufsz *= 2;
 	} while (result == ISC_R_NOSPACE);

bin/nsupdate/nsupdate.html

@@ -1,6 +1,6 @@
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2000-2012, 2014-2019 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2000-2012, 2014-2020 Internet Systems Consortium, Inc. ("ISC")
  - 
  - This Source Code Form is subject to the terms of the Mozilla Public
  - License, v. 2.0. If a copy of the MPL was not distributed with this

bin/pkcs11/pkcs11-destroy.8

@@ -1,4 +1,4 @@
-.\" Copyright (C) 2009, 2014-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2009, 2014-2016, 2018-2020 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" This Source Code Form is subject to the terms of the Mozilla Public
 .\" License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -93,5 +93,5 @@ Specify how long to pause before carrying out key destruction\&. The default is
 \fBInternet Systems Consortium, Inc\&.\fR
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2009, 2014-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2009, 2014-2016, 2018-2020 Internet Systems Consortium, Inc. ("ISC")
 .br

bin/pkcs11/pkcs11-destroy.html

@@ -1,6 +1,6 @@
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2009, 2014-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2009, 2014-2016, 2018-2020 Internet Systems Consortium, Inc. ("ISC")
  - 
  - This Source Code Form is subject to the terms of the Mozilla Public
  - License, v. 2.0. If a copy of the MPL was not distributed with this

bin/pkcs11/pkcs11-keygen.8

@@ -1,4 +1,4 @@
-.\" Copyright (C) 2009, 2014-2019 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2009, 2014-2020 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" This Source Code Form is subject to the terms of the Mozilla Public
 .\" License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -116,5 +116,5 @@ Open the session with the given PKCS#11 slot\&. The default is slot 0\&.
 \fBInternet Systems Consortium, Inc\&.\fR
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2009, 2014-2019 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2009, 2014-2020 Internet Systems Consortium, Inc. ("ISC")
 .br

bin/pkcs11/pkcs11-keygen.html

@@ -1,6 +1,6 @@
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2009, 2014-2019 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2009, 2014-2020 Internet Systems Consortium, Inc. ("ISC")
  - 
  - This Source Code Form is subject to the terms of the Mozilla Public
  - License, v. 2.0. If a copy of the MPL was not distributed with this

bin/pkcs11/pkcs11-list.8

@@ -1,4 +1,4 @@
-.\" Copyright (C) 2009, 2014-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2009, 2014-2016, 2018-2020 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" This Source Code Form is subject to the terms of the Mozilla Public
 .\" License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -94,5 +94,5 @@ will prompt for it\&.
 \fBInternet Systems Consortium, Inc\&.\fR
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2009, 2014-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2009, 2014-2016, 2018-2020 Internet Systems Consortium, Inc. ("ISC")
 .br

bin/pkcs11/pkcs11-list.html

@@ -1,6 +1,6 @@
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2009, 2014-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2009, 2014-2016, 2018-2020 Internet Systems Consortium, Inc. ("ISC")
  - 
  - This Source Code Form is subject to the terms of the Mozilla Public
  - License, v. 2.0. If a copy of the MPL was not distributed with this

bin/pkcs11/pkcs11-tokens.8

@@ -1,4 +1,4 @@
-.\" Copyright (C) 2014-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2014-2016, 2018-2020 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" This Source Code Form is subject to the terms of the Mozilla Public
 .\" License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -65,5 +65,5 @@ Make the PKCS#11 libisc initialization verbose\&.
 \fBInternet Systems Consortium, Inc\&.\fR
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2014-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2014-2016, 2018-2020 Internet Systems Consortium, Inc. ("ISC")
 .br

bin/pkcs11/pkcs11-tokens.html

@@ -1,6 +1,6 @@
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2014-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2014-2016, 2018-2020 Internet Systems Consortium, Inc. ("ISC")
  - 
  - This Source Code Form is subject to the terms of the Mozilla Public
  - License, v. 2.0. If a copy of the MPL was not distributed with this

bin/plugins/filter-aaaa.8

@@ -1,4 +1,4 @@
-.\" Copyright (C) 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2018-2020 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" This Source Code Form is subject to the terms of the Mozilla Public
 .\" License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -112,5 +112,5 @@ BIND 9 Administrator Reference Manual\&.
 \fBInternet Systems Consortium, Inc\&.\fR
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2018-2020 Internet Systems Consortium, Inc. ("ISC")
 .br

bin/plugins/filter-aaaa.c

@@ -374,8 +374,8 @@ plugin_register(const char *parameters,
 				       cfg_line, mctx, lctx, actx));
 	}
 
-	CHECK(isc_mempool_create(mctx, sizeof(filter_data_t),
-				 &inst->datapool));
+	isc_mempool_create(mctx, sizeof(filter_data_t),
+				 &inst->datapool);
 	CHECK(isc_ht_init(&inst->ht, mctx, 16));
 	isc_mutex_init(&inst->hlock);
 

bin/plugins/filter-aaaa.html

@@ -1,6 +1,6 @@
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2018-2020 Internet Systems Consortium, Inc. ("ISC")
  - 
  - This Source Code Form is subject to the terms of the Mozilla Public
  - License, v. 2.0. If a copy of the MPL was not distributed with this

bin/python/dnssec-checkds.8

@@ -1,4 +1,4 @@
-.\" Copyright (C) 2012-2019 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2012-2020 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" This Source Code Form is subject to the terms of the Mozilla Public
 .\" License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -91,5 +91,5 @@ binary\&. Used for testing\&.
 \fBInternet Systems Consortium, Inc\&.\fR
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2012-2019 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2012-2020 Internet Systems Consortium, Inc. ("ISC")
 .br

bin/python/dnssec-checkds.html

@@ -1,6 +1,6 @@
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2012-2019 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2012-2020 Internet Systems Consortium, Inc. ("ISC")
  - 
  - This Source Code Form is subject to the terms of the Mozilla Public
  - License, v. 2.0. If a copy of the MPL was not distributed with this

bin/python/dnssec-coverage.8

@@ -1,4 +1,4 @@
-.\" Copyright (C) 2013-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2013-2016, 2018-2020 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" This Source Code Form is subject to the terms of the Mozilla Public
 .\" License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -152,5 +152,5 @@ binary\&. Used for testing\&.
 \fBInternet Systems Consortium, Inc\&.\fR
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2013-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2013-2016, 2018-2020 Internet Systems Consortium, Inc. ("ISC")
 .br

bin/python/dnssec-coverage.html

@@ -1,6 +1,6 @@
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2013-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2013-2016, 2018-2020 Internet Systems Consortium, Inc. ("ISC")
  - 
  - This Source Code Form is subject to the terms of the Mozilla Public
  - License, v. 2.0. If a copy of the MPL was not distributed with this

bin/python/dnssec-keymgr.8

@@ -1,4 +1,4 @@
-.\" Copyright (C) 2016-2019 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2016-2020 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" This Source Code Form is subject to the terms of the Mozilla Public
 .\" License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -294,5 +294,5 @@ Allow configuration of standby keys and use of the REVOKE bit, for keys that use
 \fBInternet Systems Consortium, Inc\&.\fR
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2016-2019 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2016-2020 Internet Systems Consortium, Inc. ("ISC")
 .br

bin/python/dnssec-keymgr.html

@@ -1,6 +1,6 @@
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2016-2019 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2016-2020 Internet Systems Consortium, Inc. ("ISC")
  - 
  - This Source Code Form is subject to the terms of the Mozilla Public
  - License, v. 2.0. If a copy of the MPL was not distributed with this

bin/rndc/rndc.8

@@ -1,4 +1,4 @@
-.\" Copyright (C) 2000, 2001, 2004, 2005, 2007, 2013-2019 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2000, 2001, 2004, 2005, 2007, 2013-2020 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" This Source Code Form is subject to the terms of the Mozilla Public
 .\" License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -745,5 +745,5 @@ BIND 9 Administrator Reference Manual\&.
 \fBInternet Systems Consortium, Inc\&.\fR
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2000, 2001, 2004, 2005, 2007, 2013-2019 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2000, 2001, 2004, 2005, 2007, 2013-2020 Internet Systems Consortium, Inc. ("ISC")
 .br

bin/rndc/rndc.c

@@ -75,7 +75,9 @@ static isccc_region_t secret;
 static bool failed = false;
 static bool c_flag = false;
 static isc_mem_t *rndc_mctx;
-static isc_refcount_t sends, recvs, connects;
+static atomic_uint_fast32_t sends = ATOMIC_VAR_INIT(0);
+static atomic_uint_fast32_t recvs = ATOMIC_VAR_INIT(0);
+static atomic_uint_fast32_t connects = ATOMIC_VAR_INIT(0);
 static char *command;
 static char *args;
 static char program[256];
@@ -277,8 +279,8 @@ rndc_senddone(isc_task_t *task, isc_event_t *event) {
 		fatal("send failed: %s", isc_result_totext(sevent->result));
 	}
 	isc_event_free(&event);
-	if (isc_refcount_decrement(&sends) == 1 &&
-	    isc_refcount_current(&recvs) == 0)
+	if (atomic_fetch_sub_release(&sends, 1) == 1 &&
+	    atomic_load_acquire(&recvs) == 0)
 	{
 		isc_socket_detach(&sock);
 		isc_task_shutdown(task);
@@ -295,7 +297,7 @@ rndc_recvdone(isc_task_t *task, isc_event_t *event) {
 	char *textmsg = NULL;
 	isc_result_t result;
 
-	isc_refcount_decrement(&recvs);
+	atomic_fetch_sub_release(&recvs, 1);
 
 	if (ccmsg.result == ISC_R_EOF)
 		fatal("connection to remote host closed\n"
@@ -348,8 +350,8 @@ rndc_recvdone(isc_task_t *task, isc_event_t *event) {
 
 	isc_event_free(&event);
 	isccc_sexpr_free(&response);
-	if (isc_refcount_current(&sends) == 0
-	    && isc_refcount_current(&recvs) == 0) {
+	if (atomic_load_acquire(&sends) == 0
+	    && atomic_load_acquire(&recvs) == 0) {
 		isc_socket_detach(&sock);
 		isc_task_shutdown(task);
 		isc_app_shutdown();
@@ -369,7 +371,7 @@ rndc_recvnonce(isc_task_t *task, isc_event_t *event) {
 	isccc_sexpr_t *data;
 	isc_buffer_t b;
 
-	isc_refcount_decrement(&recvs);
+	atomic_fetch_sub_release(&recvs, 1);
 
 	if (ccmsg.result == ISC_R_EOF)
 		fatal("connection to remote host closed\n"
@@ -430,10 +432,10 @@ rndc_recvnonce(isc_task_t *task, isc_event_t *event) {
 	isccc_ccmsg_cancelread(&ccmsg);
 	DO("schedule recv", isccc_ccmsg_readmessage(&ccmsg, task,
 						    rndc_recvdone, NULL));
-	isc_refcount_increment(&recvs);
+	atomic_fetch_add_relaxed(&recvs, 1);
 	DO("send message", isc_socket_send(sock, &r, task, rndc_senddone,
 					   NULL));
-	isc_refcount_increment(&sends);
+	atomic_fetch_add_relaxed(&sends, 1);
 
 	isc_event_free(&event);
 	isccc_sexpr_free(&response);
@@ -452,7 +454,7 @@ rndc_connected(isc_task_t *task, isc_event_t *event) {
 	isc_buffer_t b;
 	isc_result_t result;
 
-	isc_refcount_decrement(&connects);
+	atomic_fetch_sub_release(&connects, 1);
 
 	if (sevent->result != ISC_R_SUCCESS) {
 		isc_sockaddr_format(&serveraddrs[currentaddr], socktext,
@@ -498,10 +500,10 @@ rndc_connected(isc_task_t *task, isc_event_t *event) {
 
 	DO("schedule recv", isccc_ccmsg_readmessage(&ccmsg, task,
 						    rndc_recvnonce, NULL));
-	isc_refcount_increment(&recvs);
+	atomic_fetch_add_relaxed(&recvs, 1);
 	DO("send message", isc_socket_send(sock, &r, task, rndc_senddone,
 					   NULL));
-	isc_refcount_increment(&sends);
+	atomic_fetch_add_relaxed(&sends, 1);
 	isc_event_free(&event);
 	isccc_sexpr_free(&request);
 }
@@ -536,7 +538,7 @@ rndc_startconnect(isc_sockaddr_t *addr, isc_task_t *task) {
 	}
 	DO("connect", isc_socket_connect(sock, addr, task, rndc_connected,
 					 NULL));
-	isc_refcount_increment(&connects);
+	atomic_fetch_add_relaxed(&connects, 1);
 }
 
 static void
@@ -963,8 +965,7 @@ main(int argc, char **argv) {
 
 	command = *argv;
 
-	DO("allocate data buffer",
-	   isc_buffer_allocate(rndc_mctx, &databuf, 2048));
+	isc_buffer_allocate(rndc_mctx, &databuf, 2048);
 
 	/*
 	 * Convert argc/argv into a space-delimited command string
@@ -1003,9 +1004,9 @@ main(int argc, char **argv) {
 	if (result != ISC_R_SUCCESS)
 		fatal("isc_app_run() failed: %s", isc_result_totext(result));
 
-	if (isc_refcount_current(&connects) > 0 ||
-	    isc_refcount_current(&sends) > 0 ||
-	    isc_refcount_current(&recvs) > 0)
+	if (atomic_load_acquire(&connects) > 0 ||
+	    atomic_load_acquire(&sends) > 0 ||
+	    atomic_load_acquire(&recvs) > 0)
 	{
 		isc_socket_cancel(sock, task, ISC_SOCKCANCEL_ALL);
 	}

bin/rndc/rndc.conf.5

@@ -1,4 +1,4 @@
-.\" Copyright (C) 2000, 2001, 2004, 2005, 2007, 2013-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2000, 2001, 2004, 2005, 2007, 2013-2016, 2018-2020 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" This Source Code Form is subject to the terms of the Mozilla Public
 .\" License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -230,5 +230,5 @@ BIND 9 Administrator Reference Manual\&.
 \fBInternet Systems Consortium, Inc\&.\fR
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2000, 2001, 2004, 2005, 2007, 2013-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2000, 2001, 2004, 2005, 2007, 2013-2016, 2018-2020 Internet Systems Consortium, Inc. ("ISC")
 .br

bin/rndc/rndc.conf.html

@@ -1,6 +1,6 @@
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2000, 2001, 2004, 2005, 2007, 2013-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2000, 2001, 2004, 2005, 2007, 2013-2016, 2018-2020 Internet Systems Consortium, Inc. ("ISC")
  - 
  - This Source Code Form is subject to the terms of the Mozilla Public
  - License, v. 2.0. If a copy of the MPL was not distributed with this

bin/rndc/rndc.html

@@ -1,6 +1,6 @@
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2000, 2001, 2004, 2005, 2007, 2013-2019 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2000, 2001, 2004, 2005, 2007, 2013-2020 Internet Systems Consortium, Inc. ("ISC")
  - 
  - This Source Code Form is subject to the terms of the Mozilla Public
  - License, v. 2.0. If a copy of the MPL was not distributed with this

bin/tests/optional/adb_test.c

@@ -297,8 +297,8 @@ main(int argc, char **argv) {
 	isc_mem_create(&mctx);
 
 	cmp = NULL;
-	RUNTIME_CHECK(isc_mempool_create(mctx, sizeof(client_t), &cmp)
-		      == ISC_R_SUCCESS);
+	isc_mempool_create(mctx, sizeof(client_t), &cmp)
+		      ;
 	isc_mempool_setname(cmp, "adb test clients");
 
 	result = isc_log_create(mctx, &lctx, &lcfg);

bin/tests/optional/mempool_test.c

@@ -34,10 +34,10 @@ main(int argc, char *argv[]) {
 	isc_mem_create(&mctx);
 
 	mp1 = NULL;
-	RUNTIME_CHECK(isc_mempool_create(mctx, 24, &mp1) == ISC_R_SUCCESS);
+	isc_mempool_create(mctx, 24, &mp1);
 
 	mp2 = NULL;
-	RUNTIME_CHECK(isc_mempool_create(mctx, 31, &mp2) == ISC_R_SUCCESS);
+	isc_mempool_create(mctx, 31, &mp2);
 
 	isc_mempool_associatelock(mp1, &lock);
 	isc_mempool_associatelock(mp2, &lock);

bin/tests/system/case/tests.sh

@@ -14,6 +14,12 @@ SYSTEMTESTTOP=..
 
 DIGOPTS="+tcp +nosea +nostat +noquest +nocomm +nocmd -p ${PORT}"
 
+wait_for_serial() (
+    $DIG $DIGOPTS "@$1" "$2" SOA > "$4"
+    serial=$(awk '$4 == "SOA" { print $7 }' "$4")
+    [ "$3" -eq "${serial:--1}" ]
+)
+
 status=0
 n=0
 
@@ -91,11 +97,13 @@ digcomp dig.ns1.test$n postupdate.good || ret=1
 test $ret -eq 0 || echo_i "failed"
 status=`expr $status + $ret`
 
-for i in 1 2 3 4 5 6 7 8 9
-do
-	$DIG $DIGOPTS soa dynamic @10.53.0.2 | grep 2000042408 > /dev/null && break
-	sleep 1
-done
+n=`expr $n + 1`
+ret=0
+echo_i "wait for zone to transfer ($n)"
+retry_quiet 20 wait_for_serial 10.53.0.2 dynamic 2000042408 dig.ns2.test$n || ret=1
+
+test $ret -eq 0 || echo_i "failed"
+status=`expr $status + $ret`
 
 n=`expr $n + 1`
 echo_i "check SOA owner case is transfered to slave ($n)"
@@ -121,11 +129,13 @@ digcomp dig.ns1.test$n postns1.good || ret=1
 test $ret -eq 0 || echo_i "failed"
 status=`expr $status + $ret`
 
-for i in 1 2 3 4 5 6 7 8 9
-do
-	$DIG $DIGOPTS soa dynamic @10.53.0.2 | grep 2000042409 > /dev/null && break
-	sleep 1
-done
+n=`expr $n + 1`
+ret=0
+echo_i "wait for zone to transfer ($n)"
+retry_quiet 20 wait_for_serial 10.53.0.2 dynamic 2000042409 dig.ns2.test$n || ret=1
+
+test $ret -eq 0 || echo_i "failed"
+status=`expr $status + $ret`
 
 n=`expr $n + 1`
 echo_i "check A owner case is transfered to slave ($n)"

bin/tests/system/catz/tests.sh

@@ -378,7 +378,7 @@ ret=0
 $NSUPDATE -d <<END >> nsupdate.out.test$n 2>&1 || ret=1
     server 10.53.0.1 ${PORT}
     update add masters.catalog1.example. 3600 IN A 10.53.0.3
-    update add masters.catalog1.example. 3600 IN AAAA  fd92:7065:b8e:ffff::3
+    update add masters.catalog1.example. 3600 IN AAAA fd92:7065:b8e:ffff::3
     update add 4346f565b4d63ddb99e5d2497ff22d04e878e8f8.zones.catalog1.example. 3600 IN PTR dom6.example.
     send
 END
@@ -759,96 +759,127 @@ if [ $ret -ne 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
 ##########################################################################
-echo_i "Testing very long domain in catalog"
-n=$((n+1))
-echo_i "checking that this.is.a.very.very.long.long.long.domain.that.will.cause.catalog.zones.to.generate.hash.instead.of.using.regular.filename.dom10.example. is not served by master ($n)"
-ret=0
-wait_for_no_soa @10.53.0.1 this.is.aery.very.long.long.long.domain.that.will.cause.catalog.zones.to.generate.hash.instead.of.using.regular.filename.dom10.example. dig.out.test$n || ret=1
-if [ $ret -ne 0 ]; then echo_i "failed"; fi
-status=$((status+ret))
+echo_i "Testing catalog entries that can't be represented as filenames"
+# note: we need 4 backslashes in the shell to get 2 backslashes in DNS
+# presentation format, which is 1 backslash on the wire.
+for special in \
+       this.is.a.very.very.long.long.long.domain.that.will.cause.catalog.zones.to.generate.hash.instead.of.using.regular.filename.dom10.example \
+       this.zone/domain.has.a.slash.dom10.example \
+       this.zone\\\\domain.has.backslash.dom10.example \
+       this.zone:domain.has.a.colon.dom.10.example
+do
+    # hashes below are generated by:
+    # python ${TOP}/contrib/scripts/catzhash.py "${special}"
 
-n=$((n+1))
-echo_i "Adding a domain this.is.a.very.very.long.long.long.domain.that.will.cause.catalog.zones.to.generate.hash.instead.of.using.regular.filename.dom10.example. to master via RNDC ($n)"
-ret=0
-echo "@ 3600 IN SOA . . 1 3600 3600 3600 3600" > ns1/dom10.example.db
-echo "@ IN NS invalid." >> ns1/dom10.example.db
-rndccmd 10.53.0.1 addzone this.is.a.very.very.long.long.long.domain.that.will.cause.catalog.zones.to.generate.hash.instead.of.using.regular.filename.dom10.example. '{type master; file "dom10.example.db";};' || ret=1
-if [ $ret -ne 0 ]; then echo_i "failed"; fi
-status=$((status+ret))
+    case "$special" in
+    this.is.a.very.very.long.long.long.domain.that.will.cause.catalog.zones.to.generate.hash.instead.of.using.regular.filename.dom10.example)
+        hash=825f48b1ce1b4cf5a041d20255a0c8e98d114858
+        db=__catz__4d70696f2335687069467f11f5d5378c480383f97782e553fb2d04a7bb2a23ed.db
+        ;;
+    this.zone/domain.has.a.slash.dom10.example)
+        hash=e64cc64c99bf52d0a77fb16dd7ed57cf925a36aa
+        db=__catz__46ba3e1b28d5955e5313d5fee61bedc78c71d08035aa7ea2f7bf0b8228ab3acc.db
+        ;;
+    this.zone\\\\domain.has.backslash.dom10.example)
+        hash=91e27e02153d38cf656a9b376d7747fbcd19f985
+        db=__catz__b667f7ff802c0895e0506699951cff9a1cab68c5ef8546aa0d07425f244ed870.db
+        ;;
+    this.zone:domain.has.a.colon.dom.10.example)
+        hash=8b7238bf4c34045834c573ba4116557ebb24d33c
+        db=__catz__5c721f7872913a4e7fa8ad42589cce5dd6e551a4c9e6ab3f86e77c0bbc7c2ca6.db
+        ;;
+    esac
 
-n=$((n+1))
-echo_i "checking that this.is.a.very.very.long.long.long.domain.that.will.cause.catalog.zones.to.generate.hash.instead.of.using.regular.filename.dom10.example. is now served by master ($n)"
-ret=0
-wait_for_soa @10.53.0.1 this.is.a.very.very.long.long.long.domain.that.will.cause.catalog.zones.to.generate.hash.instead.of.using.regular.filename.dom10.example. dig.out.test$n || ret=1
-if [ $ret -ne 0 ]; then echo_i "failed"; fi
-status=$((status+ret))
+    n=$((n+1))
+    echo_i "checking that ${special}. is not served by master ($n)"
+    ret=0
+    wait_for_no_soa @10.53.0.1 "${special}" dig.out.test$n || ret=1
+    if [ $ret -ne 0 ]; then echo_i "failed"; fi
+    status=$((status+ret))
 
-nextpart ns2/named.run >/dev/null
+    n=$((n+1))
+    echo_i "Adding a domain ${special}. to master via RNDC ($n)"
+    ret=0
+    echo "@ 3600 IN SOA . . 1 3600 3600 3600 3600" > ns1/dom10.example.db
+    echo "@ IN NS invalid." >> ns1/dom10.example.db
+    rndccmd 10.53.0.1 addzone '"'"${special}"'"' '{type master; file "dom10.example.db";};' || ret=1
+    if [ $ret -ne 0 ]; then echo_i "failed"; fi
+    status=$((status+ret))
 
-n=$((n+1))
-echo_i "Adding domain this.is.a.very.very.long.long.long.domain.that.will.cause.catalog.zones.to.generate.hash.instead.of.using.regular.filename.dom10.example. to catalog1 zone ($n)"
-ret=0
-$NSUPDATE -d <<END >> nsupdate.out.test$n 2>&1 || ret=1
-    server 10.53.0.1 ${PORT}
-    update add 825f48b1ce1b4cf5a041d20255a0c8e98d114858.zones.catalog1.example 3600 IN PTR this.is.a.very.very.long.long.long.domain.that.will.cause.catalog.zones.to.generate.hash.instead.of.using.regular.filename.dom10.example.
-    send
+    n=$((n+1))
+    echo_i "checking that ${special}. is now served by master ($n)"
+    ret=0
+    wait_for_soa @10.53.0.1 "${special}." dig.out.test$n || ret=1
+    if [ $ret -ne 0 ]; then echo_i "failed"; fi
+    status=$((status+ret))
+
+    nextpart ns2/named.run >/dev/null
+
+    n=$((n+1))
+    echo_i "Adding domain ${special}. to catalog1 zone ($n)"
+    ret=0
+    $NSUPDATE -d <<END >> nsupdate.out.test$n 2>&1 || ret=1
+      server 10.53.0.1 ${PORT}
+      update add ${hash}.zones.catalog1.example 3600 IN PTR ${special}.
+      send
 END
-if [ $ret -ne 0 ]; then echo_i "failed"; fi
-status=$((status+ret))
+    if [ $ret -ne 0 ]; then echo_i "failed"; fi
+    status=$((status+ret))
 
-n=$((n+1))
-echo_i "waiting for slave to sync up ($n)"
-ret=0
-wait_for_message ns2/named.run  "catz: adding zone 'this.is.a.very.very.long.long.long.domain.that.will.cause.catalog.zones.to.generate.hash.instead.of.using.regular.filename.dom10.example' from catalog 'catalog1.example'" &&
-wait_for_message ns2/named.run  "transfer of 'this.is.a.very.very.long.long.long.domain.that.will.cause.catalog.zones.to.generate.hash.instead.of.using.regular.filename.dom10.example/IN' from 10.53.0.1#${PORT}: Transfer status: success" || ret=1
-if [ $ret -ne 0 ]; then echo_i "failed"; fi
-status=$((status+ret))
+    n=$((n+1))
+    echo_i "waiting for slave to sync up ($n)"
+    ret=0
+    wait_for_message ns2/named.run  "catz: adding zone '$special' from catalog 'catalog1.example'" &&
+    wait_for_message ns2/named.run  "transfer of '$special/IN' from 10.53.0.1#${PORT}: Transfer status: success" || ret=1
+    if [ $ret -ne 0 ]; then echo_i "failed"; fi
+    status=$((status+ret))
 
-n=$((n+1))
-echo_i "checking that this.is.a.very.very.long.long.long.domain.that.will.cause.catalog.zones.to.generate.hash.instead.of.using.regular.filename.dom10.example. is served by slave ($n)"
-ret=0
-wait_for_soa @10.53.0.2 this.is.a.very.very.long.long.long.domain.that.will.cause.catalog.zones.to.generate.hash.instead.of.using.regular.filename.dom10.example. dig.out.test$n || ret=1
-if [ $ret -ne 0 ]; then echo_i "failed"; fi
-status=$((status+ret))
+    n=$((n+1))
+    echo_i "checking that ${special}. is served by slave ($n)"
+    ret=0
+    wait_for_soa @10.53.0.2 "${special}." dig.out.test$n || ret=1
+    if [ $ret -ne 0 ]; then echo_i "failed"; fi
+    status=$((status+ret))
 
-n=$((n+1))
-echo_i "checking that zone-directory is populated with a hashed filename ($n)"
-ret=0
-wait_for_zonefile "ns2/zonedir/__catz__4d70696f2335687069467f11f5d5378c480383f97782e553fb2d04a7bb2a23ed.db" || ret=1
-if [ $ret -ne 0 ]; then echo_i "failed"; fi
-status=$((status+ret))
+    n=$((n+1))
+    echo_i "checking that zone-directory is populated with a hashed filename ($n)"
+    ret=0
+    wait_for_zonefile "ns2/zonedir/$db" || ret=1
+    if [ $ret -ne 0 ]; then echo_i "failed"; fi
+    status=$((status+ret))
 
-n=$((n+1))
-echo_i "removing domain this.is.a.very.very.long.long.long.domain.that.will.cause.catalog.zones.to.generate.hash.instead.of.using.regular.filename.dom10.example.  from catalog1 zone ($n)"
-ret=0
-$NSUPDATE -d <<END >> nsupdate.out.test$n 2>&1 || ret=1
-   server 10.53.0.1 ${PORT}
-   update delete 825f48b1ce1b4cf5a041d20255a0c8e98d114858.zones.catalog1.example
-   send
+    n=$((n+1))
+    echo_i "removing domain ${special}. from catalog1 zone ($n)"
+    ret=0
+    $NSUPDATE -d <<END >> nsupdate.out.test$n 2>&1 || ret=1
+      server 10.53.0.1 ${PORT}
+      update delete ${hash}.zones.catalog1.example
+      send
 END
-if [ $ret -ne 0 ]; then echo_i "failed"; fi
-status=$((status+ret))
+    if [ $ret -ne 0 ]; then echo_i "failed"; fi
+    status=$((status+ret))
 
-n=$((n+1))
-echo_i "waiting for slave to sync up ($n)"
-ret=0
-wait_for_message ns2/named.run  "zone_shutdown: zone this.is.a.very.very.long.long.long.domain.that.will.cause.catalog.zones.to.generate.hash.instead.of.using.regular.filename.dom10.example/IN: shutting down" || ret=1
-if [ $ret -ne 0 ]; then echo_i "failed"; fi
-status=$((status+ret))
+    n=$((n+1))
+    echo_i "waiting for slave to sync up ($n)"
+    ret=0
+    wait_for_message ns2/named.run  "zone_shutdown: zone ${special}/IN: shutting down" || ret=1
+    if [ $ret -ne 0 ]; then echo_i "failed"; fi
+    status=$((status+ret))
 
-n=$((n+1))
-echo_i "checking that this.is.a.very.very.long.long.long.domain.that.will.cause.catalog.zones.to.generate.hash.instead.of.using.regular.filename.dom10.example. is not served by slave ($n)"
-ret=0
-wait_for_no_soa @10.53.0.2 this.is.aery.very.long.long.long.domain.that.will.cause.catalog.zones.to.generate.hash.instead.of.using.regular.filename.dom10.example. dig.out.test$n || ret=1
-if [ $ret -ne 0 ]; then echo_i "failed"; fi
-status=$((status+ret))
+    n=$((n+1))
+    echo_i "checking that ${special}. is not served by slave ($n)"
+    ret=0
+    wait_for_no_soa @10.53.0.2 "${special}." dig.out.test$n || ret=1
+    if [ $ret -ne 0 ]; then echo_i "failed"; fi
+    status=$((status+ret))
 
-n=$((n+1))
-echo_i "checking that zone-directory is emptied ($n)"
-ret=0
-wait_for_no_zonefile "ns2/zonedir/__catz__4d70696f2335687069467f11f5d5378c480383f97782e553fb2d04a7bb2a23ed.db" || ret=1
-if [ $ret -ne 0 ]; then echo_i "failed"; fi
-status=$((status+ret))
+    n=$((n+1))
+    echo_i "checking that zone-directory is emptied ($n)"
+    ret=0
+    wait_for_no_zonefile "ns2/zonedir/$db" || ret=1
+    if [ $ret -ne 0 ]; then echo_i "failed"; fi
+    status=$((status+ret))
+done
 
 ##########################################################################
 echo_i "Testing adding a domain and a subdomain of it"
@@ -954,8 +985,6 @@ wait_for_soa @10.53.0.2 subdomain.of.dom11.example. dig.out.test$n || ret=1
 if [ $ret -ne 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
-
-
 n=$((n+1))
 echo_i "removing domain dom11.example. from catalog1 zone ($n)"
 ret=0
@@ -1013,7 +1042,6 @@ wait_for_no_soa @10.53.0.2 subdomain.of.d11.example. dig.out.test$n || ret=1
 if [ $ret -ne 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
-
 ##########################################################################
 echo_i "Testing adding a catalog zone at runtime with rndc reconfig"
 n=$((n+1))

bin/tests/system/conf.sh.common

@@ -95,6 +95,8 @@ else
     COLOR_WARN=''
 fi
 
+SYSTESTDIR="`basename $PWD`"
+
 if type printf > /dev/null 2>&1
 then
 	echofail () {
@@ -115,6 +117,23 @@ then
 	echoend () {
 		printf "${COLOR_END}%s${COLOR_NONE}\n" "$*"
 	}
+	echo_i() {
+	    printf '%s\n' "$*" | while read -r __LINE ; do
+	       echoinfo "I:$SYSTESTDIR:$__LINE"
+	    done
+	}
+
+	echo_ic() {
+	    printf '%s\n' "$*" | while read -r __LINE ; do
+	       echoinfo "I:$SYSTESTDIR:  $__LINE"
+	    done
+	}
+
+	echo_d() {
+	    printf '%s\n' "$*" | while read -r __LINE ; do
+	       echoinfo "D:$SYSTESTDIR:$__LINE"
+	    done
+	}
 else
 	echofail () {
 		echo "$*"
@@ -134,36 +153,34 @@ else
 	echoend () {
 		echo "$*"
 	}
+
+	echo_i() {
+	    echo "$@" | while read -r __LINE ; do
+	       echoinfo "I:$SYSTESTDIR:$__LINE"
+	    done
+	}
+
+	echo_ic() {
+	    echo "$@" | while read -r __LINE ; do
+	       echoinfo "I:$SYSTESTDIR:  $__LINE"
+	    done
+	}
+
+	echo_d() {
+	    echo "$@" | while read -r __LINE ; do
+	       echoinfo "D:$SYSTESTDIR:$__LINE"
+	    done
+	}
 fi
 
-SYSTESTDIR="`basename $PWD`"
-
-echo_i() {
-    echo "$@" | while read __LINE ; do
-       echoinfo "I:$SYSTESTDIR:$__LINE"
-    done
-}
-
-echo_ic() {
-    echo "$@" | while read __LINE ; do
-       echoinfo "I:$SYSTESTDIR:  $__LINE"
-    done
-}
-
 cat_i() {
-    while read __LINE ; do
+    while read -r __LINE ; do
        echoinfo "I:$SYSTESTDIR:$__LINE"
     done
 }
 
-echo_d() {
-    echo "$@" | while read __LINE ; do
-       echoinfo "D:$SYSTESTDIR:$__LINE"
-    done
-}
-
 cat_d() {
-    while read __LINE ; do
+    while read -r __LINE ; do
        echoinfo "D:$SYSTESTDIR:$__LINE"
     done
 }
@@ -378,14 +395,14 @@ nextpartpeek() {
 _search_log() (
 	msg="$1"
 	file="$2"
-	nextpart "$file" | grep -F "$msg" > /dev/null
+	nextpart "$file" | grep -F -e "$msg" > /dev/null
 )
 
 # _search_log_peek: look for message $1 in file $2 with nextpartpeek().
 _search_log_peek() (
 	msg="$1"
 	file="$2"
-	nextpartpeek "$file" | grep -F "$msg" > /dev/null
+	nextpartpeek "$file" | grep -F -e "$msg" > /dev/null
 )
 
 # wait_for_log: wait until message $2 in file $3 appears.  Bail out after

bin/tests/system/dnssec/clean.sh

@@ -24,9 +24,9 @@ rm -f ./canonical?.*
 rm -f ./delv.out*
 rm -f ./delve.out*
 rm -f ./dig.out.*
+rm -f ./dnssectools.out*
 rm -f ./dsfromkey.out.*
 rm -f ./keygen.err
-rm -f ./dnssectools.out*
 rm -f ./named.secroots.test*
 rm -f ./nosign.before
 rm -f ./ns*/*.nta
@@ -37,19 +37,19 @@ rm -f ./ns1/root.db ./ns2/example.db ./ns2/managed.db ./ns2/trusted.db
 rm -f ./ns2/algroll.db
 rm -f ./ns2/badparam.db ./ns2/badparam.db.bad
 rm -f ./ns2/cdnskey-kskonly.secure.db
+rm -f ./ns2/cdnskey-kskonly.secure.id
 rm -f ./ns2/cdnskey-update.secure.db
 rm -f ./ns2/cdnskey-x.secure.db
 rm -f ./ns2/cdnskey.secure.db
 rm -f ./ns2/cds-auto.secure.db ./ns2/cds-auto.secure.db.jnl
 rm -f ./ns2/cds-kskonly.secure.db
+rm -f ./ns2/cds-kskonly.secure.id
 rm -f ./ns2/cds-update.secure.db ./ns2/cds-update.secure.db.jnl
 rm -f ./ns2/cds.secure.db ./ns2/cds-x.secure.db
 rm -f ./ns2/in-addr.arpa.db
 rm -f ./ns2/nsec3chain-test.db
 rm -f ./ns2/single-nsec3.db
 rm -f ./ns2/updatecheck-kskonly.secure.*
-rm -f ./ns3/secure.example.db ./ns3/*.managed.db ./ns3/*.trusted.db
-rm -f ./ns3/unsupported.managed.db.tmp ./ns3/unsupported.trusted.db.tmp
 rm -f ./ns3/auto-nsec.example.db ./ns3/auto-nsec3.example.db
 rm -f ./ns3/badds.example.db
 rm -f ./ns3/dname-at-apex-nsec3.example.db
@@ -57,10 +57,10 @@ rm -f ./ns3/dnskey-nsec3-unknown.example.db
 rm -f ./ns3/dnskey-nsec3-unknown.example.db.tmp
 rm -f ./ns3/dnskey-unknown.example.db
 rm -f ./ns3/dnskey-unknown.example.db.tmp
-rm -f ./ns3/dnskey-unsupported.example.db
-rm -f ./ns3/dnskey-unsupported.example.db.tmp
 rm -f ./ns3/dnskey-unsupported-2.example.db
 rm -f ./ns3/dnskey-unsupported-2.example.db.tmp
+rm -f ./ns3/dnskey-unsupported.example.db
+rm -f ./ns3/dnskey-unsupported.example.db.tmp
 rm -f ./ns3/dynamic.example.db ./ns3/dynamic.example.db.signed.jnl
 rm -f ./ns3/expired.example.db ./ns3/update-nsec3.example.db
 rm -f ./ns3/expiring.example.db ./ns3/nosign.example.db
@@ -80,6 +80,7 @@ rm -f ./ns3/publish-inactive.example.db
 rm -f ./ns3/revkey.example.db
 rm -f ./ns3/rsasha256.example.db ./ns3/rsasha512.example.db
 rm -f ./ns3/secure.below-cname.example.db
+rm -f ./ns3/secure.example.db ./ns3/*.managed.db ./ns3/*.trusted.db
 rm -f ./ns3/secure.nsec3.example.db
 rm -f ./ns3/secure.optout.example.db
 rm -f ./ns3/siginterval.conf
@@ -89,6 +90,7 @@ rm -f ./ns3/split-smart.example.db
 rm -f ./ns3/ttlpatch.example.db ./ns3/ttlpatch.example.db.signed
 rm -f ./ns3/ttlpatch.example.db.patched
 rm -f ./ns3/unsecure.example.db ./ns3/bogus.example.db ./ns3/keyless.example.db
+rm -f ./ns3/unsupported.managed.db.tmp ./ns3/unsupported.trusted.db.tmp
 rm -f ./ns4/managed-keys.bind*
 rm -f ./ns4/named_dump.db*
 rm -f ./ns6/optout-tld.db

bin/tests/system/dnssec/ns2/sign.sh

@@ -238,6 +238,7 @@ key1=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone -f KSK "$
 key2=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone")
 cat "$infile" "$key1.key" "$key2.key" > "$zonefile"
 "$SIGNER" -P -g -o "$zone" "$zonefile" > /dev/null 2>&1
+keyfile_to_key_id "$key1" > cds-kskonly.secure.id
 
 zone=cds-auto.secure
 infile=cds-auto.secure.db.in
@@ -281,6 +282,7 @@ key1=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone -f KSK "$
 key2=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone")
 cat "$infile" "$key1.key" "$key2.key" > "$zonefile"
 "$SIGNER" -P -g -o "$zone" "$zonefile" > /dev/null 2>&1
+keyfile_to_key_id "$key1" > cdnskey-kskonly.secure.id
 
 zone=cdnskey-auto.secure
 infile=cdnskey-auto.secure.db.in

bin/tests/system/dnssec/tests.sh

@@ -101,6 +101,22 @@ stripns () {
     awk '($4 == "NS") || ($4 == "RRSIG" && $5 == "NS") { next} { print }' "$1"
 }
 
+#
+# Ensure there is not multiple consecutive blank lines.
+# Ensure there is a blank line before "Start view" and
+# "Negative trust anchors:".
+# Ensure there is not a blank line before "Secure roots:".
+#
+check_secroots_layout () {
+	tr -d '\r' < "$1" | \
+	awk '$0 == "" { if (empty) exit(1); empty=1; next }
+	     /Start view/ { if (!empty) exit(1) }
+	     /Secure roots:/ { if (empty) exit(1) }
+	     /Negative trust anchors:/ { if (!empty) exit(1) }
+	     { empty=0 }'
+	return $?
+}
+
 # Check that for a query against a validating resolver where the
 # authoritative zone is unsigned (insecure delegation), glue is returned
 # in the additional section
@@ -1058,6 +1074,23 @@ n=$((n+1))
 test "$ret" -eq 0 || echo_i "failed"
 status=$((status+ret))
 
+echo_i "checking insecurity proof works using negative cache ($n)"
+ret=0
+rndccmd 10.53.0.4 flush 2>&1 | sed 's/^/ns4 /' | cat_i
+dig_with_opts +cd @10.53.0.4 insecure.example. ds > dig.out.ns4.test$n.1 || ret=1
+for i in 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18
+do
+        dig_with_opts @10.53.0.4 nonexistent.insecure.example. > dig.out.ns4.test$n.2 || ret=1
+	if grep "status: NXDOMAIN" dig.out.ns4.test$n.2 >/dev/null; then
+		break
+	fi
+	sleep 1
+done
+grep "status: NXDOMAIN" dig.out.ns4.test$n.2 >/dev/null || ret=1
+n=$((n+1))
+test "$ret" -eq 0 || echo_i "failed"
+status=$((status+ret))
+
 echo_i "checking positive validation RSASHA256 NSEC ($n)"
 ret=0
 dig_with_opts +noauth a.rsasha256.example. @10.53.0.3 a > dig.out.ns3.test$n || ret=1
@@ -1703,13 +1736,14 @@ status=$((status+ret))
 # Test that "rndc secroots" is able to dump trusted keys
 echo_i "checking rndc secroots ($n)"
 ret=0
-rndccmd 10.53.0.4 secroots 2>&1 | sed 's/^/ns4 /' | cat_i
 keyid=$(cat ns1/managed.key.id)
+rndccmd 10.53.0.4 secroots 2>&1 | sed 's/^/ns4 /' | cat_i
 cp ns4/named.secroots named.secroots.test$n
+check_secroots_layout named.secroots.test$n || ret=1
 linecount=$(grep -c "./${DEFAULT_ALGORITHM}/$keyid ; static" named.secroots.test$n || true)
 [ "$linecount" -eq 1 ] || ret=1
 linecount=$(< named.secroots.test$n wc -l)
-[ "$linecount" -eq 10 ] || ret=1
+[ "$linecount" -eq 9 ] || ret=1
 n=$((n+1))
 test "$ret" -eq 0 || echo_i "failed"
 status=$((status+ret))
@@ -1860,10 +1894,12 @@ dig_with_opts a.fakenode.secure.example. a @10.53.0.4 > dig.out.ns4.test$n.7 ||
 grep "flags:[^;]* ad[^;]*;" dig.out.ns4.test$n.7 > /dev/null && ret=1
 echo_i "dumping secroots"
 rndccmd 10.53.0.4 secroots | sed 's/^/ns4 /' | cat_i
-grep "bogus.example: expiry" ns4/named.secroots > /dev/null || ret=1
-grep "badds.example: expiry" ns4/named.secroots > /dev/null || ret=1
-grep "secure.example: expiry" ns4/named.secroots > /dev/null || ret=1
-grep "fakenode.secure.example: expiry" ns4/named.secroots > /dev/null || ret=1
+cp ns4/named.secroots named.secroots.test$n
+check_secroots_layout named.secroots.test$n || ret=1
+grep "bogus.example: expiry" named.secroots.test$n > /dev/null || ret=1
+grep "badds.example: expiry" named.secroots.test$n > /dev/null || ret=1
+grep "secure.example: expiry" named.secroots.test$n > /dev/null || ret=1
+grep "fakenode.secure.example: expiry" named.secroots.test$n > /dev/null || ret=1
 
 if [ "$ret" -ne 0 ]; then echo_i "failed - with NTA's in place failed"; fi
 status=$((status+ret))
@@ -3281,6 +3317,24 @@ n=$((n+1))
 test "$ret" -eq 0 || echo_i "failed"
 status=$((status+ret))
 
+echo_i "check that a CDS deletion record is accepted ($n)"
+ret=0
+(
+echo zone cds-update.secure
+echo server 10.53.0.2 "$PORT"
+echo update delete cds-update.secure CDS
+echo update add cds-update.secure 0 CDS 0 0 0 00
+echo send
+) | $NSUPDATE > nsupdate.out.test$n 2>&1
+dig_with_opts +noall +answer @10.53.0.2 cds cds-update.secure > dig.out.test$n
+lines=$(awk '$4 == "CDS" {print}' dig.out.test$n | wc -l)
+test "${lines:-10}" -eq 1 || ret=1
+lines=$(tr -d '\r' < dig.out.test$n | awk '$4 == "CDS" && $5 == "0" && $6 == "0" && $7 == "0" && $8 == "00" {print}' | wc -l)
+test "$lines" -eq 1 || ret=1
+n=$((n+1))
+test "$ret" -eq 0 || echo_i "failed"
+status=$((status+ret))
+
 echo_i "check that CDS records are signed using KSK when added by nsupdate ($n)"
 ret=0
 (
@@ -3306,6 +3360,7 @@ status=$((status+ret))
 echo_i "check that CDS records are signed only using KSK when added by"
 echo_i "   nsupdate when dnssec-dnskey-kskonly is yes ($n)"
 ret=0
+keyid=$(cat ns2/cds-kskonly.secure.id)
 (
 echo zone cds-kskonly.secure
 echo server 10.53.0.2 "$PORT"
@@ -3320,12 +3375,38 @@ echo send
 dig_with_opts +noall +answer @10.53.0.2 cds cds-kskonly.secure > dig.out.test$n
 lines=$(awk '$4 == "RRSIG" && $5 == "CDS" {print}' dig.out.test$n | wc -l)
 test "$lines" -eq 1 || ret=1
+lines=$(awk -v id="${keyid}" '$4 == "RRSIG" && $5 == "CDS" && $11 == id {print}' dig.out.test$n | wc -l)
+test "$lines" -eq 1 || ret=1
 lines=$(awk '$4 == "CDS" {print}' dig.out.test$n | wc -l)
 test "$lines" -eq 2 || ret=1
 n=$((n+1))
 test "$ret" -eq 0 || echo_i "failed"
 status=$((status+ret))
 
+echo_i "check that CDS deletion records are signed only using KSK when added by"
+echo_i "   nsupdate when dnssec-dnskey-kskonly is yes ($n)"
+ret=0
+keyid=$(cat ns2/cds-kskonly.secure.id)
+(
+echo zone cds-kskonly.secure
+echo server 10.53.0.2 "$PORT"
+echo update delete cds-kskonly.secure CDS
+echo update add cds-kskonly.secure 0 CDS 0 0 0 00
+echo send
+) | $NSUPDATE
+dig_with_opts +noall +answer @10.53.0.2 cds cds-kskonly.secure > dig.out.test$n
+lines=$(awk '$4 == "RRSIG" && $5 == "CDS" {print}' dig.out.test$n | wc -l)
+test "$lines" -eq 1 || ret=1
+lines=$(awk -v id="${keyid}" '$4 == "RRSIG" && $5 == "CDS" && $11 == id {print}' dig.out.test$n | wc -l)
+test "$lines" -eq 1 || ret=1
+lines=$(awk '$4 == "CDS" {print}' dig.out.test$n | wc -l)
+test "$lines" -eq 1 || ret=1
+lines=$(tr -d '\r' < dig.out.test$n | awk '$4 == "CDS" && $5 == "0" && $6 == "0" && $7 == "0" && $8 == "00" {print}' | wc -l)
+test "$lines" -eq 1 || ret=1
+n=$((n+1))
+test "$ret" -eq 0 || echo_i "failed"
+status=$((status+ret))
+
 echo_i "checking that positive unknown NSEC3 hash algorithm with OPTOUT does validate ($n)"
 ret=0
 dig_with_opts +noauth +noadd +nodnssec +adflag @10.53.0.3 optout-unknown.example SOA > dig.out.ns3.test$n
@@ -3461,6 +3542,24 @@ n=$((n+1))
 test "$ret" -eq 0 || echo_i "failed"
 status=$((status+ret))
 
+echo_i "check that a CDNSKEY deletion record is accepted ($n)"
+ret=0
+(
+echo zone cdnskey-update.secure
+echo server 10.53.0.2 "$PORT"
+echo update delete cdnskey-update.secure CDNSKEY
+echo update add cdnskey-update.secure 0 CDNSKEY 0 3 0 AA==
+echo send
+) | $NSUPDATE > nsupdate.out.test$n 2>&1
+dig_with_opts +noall +answer @10.53.0.2 cdnskey cdnskey-update.secure > dig.out.test$n
+lines=$(awk '$4 == "CDNSKEY" {print}' dig.out.test$n | wc -l)
+test "${lines:-10}" -eq 1 || ret=1
+lines=$(tr -d '\r' < dig.out.test$n | awk '$4 == "CDNSKEY" && $5 == "0" && $6 == "3" && $7 == "0" && $8 == "AA==" {print}' | wc -l)
+test "${lines:-10}" -eq 1 || ret=1
+n=$((n+1))
+test "$ret" -eq 0 || echo_i "failed"
+status=$((status+ret))
+
 echo_i "checking that unknown DNSKEY algorithm + unknown NSEC3 has algorithm validates as insecure ($n)"
 ret=0
 dig_with_opts +noauth +noadd +nodnssec +adflag @10.53.0.3 dnskey-nsec3-unknown.example A > dig.out.ns3.test$n
@@ -3494,6 +3593,7 @@ status=$((status+ret))
 echo_i "check that CDNSKEY records are signed only using KSK when added by"
 echo_i "   nsupdate when dnssec-dnskey-kskonly is yes ($n)"
 ret=0
+keyid=$(cat ns2/cdnskey-kskonly.secure.id)
 (
 echo zone cdnskey-kskonly.secure
 echo server 10.53.0.2 "$PORT"
@@ -3505,12 +3605,38 @@ echo send
 dig_with_opts +noall +answer @10.53.0.2 cdnskey cdnskey-kskonly.secure > dig.out.test$n
 lines=$(awk '$4 == "RRSIG" && $5 == "CDNSKEY" {print}' dig.out.test$n | wc -l)
 test "$lines" -eq 1 || ret=1
+lines=$(awk -v id="${keyid}" '$4 == "RRSIG" && $5 == "CDNSKEY" && $11 == id {print}' dig.out.test$n | wc -l)
+test "$lines" -eq 1 || ret=1
 lines=$(awk '$4 == "CDNSKEY" {print}' dig.out.test$n | wc -l)
 test "$lines" -eq 1 || ret=1
 n=$((n+1))
 test "$ret" -eq 0 || echo_i "failed"
 status=$((status+ret))
 
+echo_i "check that CDNSKEY deletion records are signed only using KSK when added by"
+echo_i "   nsupdate when dnssec-dnskey-kskonly is yes ($n)"
+ret=0
+keyid=$(cat ns2/cdnskey-kskonly.secure.id)
+(
+echo zone cdnskey-kskonly.secure
+echo server 10.53.0.2 "$PORT"
+echo update delete cdnskey-kskonly.secure CDNSKEY
+echo update add cdnskey-kskonly.secure 0 CDNSKEY 0 3 0 AA==
+echo send
+) | $NSUPDATE
+dig_with_opts +noall +answer @10.53.0.2 cdnskey cdnskey-kskonly.secure > dig.out.test$n
+lines=$(awk '$4 == "RRSIG" && $5 == "CDNSKEY" {print}' dig.out.test$n | wc -l)
+test "$lines" -eq 1 || ret=1
+lines=$(awk -v id="${keyid}" '$4 == "RRSIG" && $5 == "CDNSKEY" && $11 == id {print}' dig.out.test$n | wc -l)
+test "$lines" -eq 1 || ret=1
+lines=$(awk '$4 == "CDNSKEY" {print}' dig.out.test$n | wc -l)
+test "$lines" -eq 1 || ret=1
+lines=$(tr -d '\r' < dig.out.test$n | awk '$4 == "CDNSKEY" && $5 == "0" && $6 == "3" && $7 == "0" && $8 == "AA==" {print}' | wc -l)
+test "${lines:-10}" -eq 1 || ret=1
+n=$((n+1))
+test "$ret" -eq 0 || echo_i "failed"
+status=$((status+ret))
+
 echo_i "checking initialization with a revoked managed key ($n)"
 ret=0
 copy_setports ns5/named2.conf.in ns5/named.conf
@@ -3635,11 +3761,19 @@ dig_with_opts . dnskey +ednsopt=KEY-TAG:fffe +ednsopt=KEY-TAG:fffd @10.53.0.1 >
 grep "trust-anchor-telemetry './IN' from .* 65534" ns1/named.run > /dev/null || ret=1
 grep "trust-anchor-telemetry './IN' from .* 65533" ns1/named.run > /dev/null && ret=1
 $PERL $SYSTEMTESTTOP/stop.pl dnssec ns1 || ret=1
+nextpart ns1/named.run > /dev/null
 $PERL $SYSTEMTESTTOP/start.pl --noclean --restart --port ${PORT} dnssec ns1 || ret=1
 n=$(($n+1))
 test "$ret" -eq 0 || echo_i "failed"
 status=$((status+ret))
 
+echo_i "waiting for root server to finish reloading ($n)"
+ret=0
+wait_for_log 20 "all zones loaded" ns1/named.run || ret=1
+n=$(($n+1))
+test "$ret" -eq 0 || echo_i "failed"
+status=$((status+ret))
+
 echo_i "check that the view is logged in messages from the validator when using views ($n)"
 ret=0
 grep "view rec: *validat" ns4/named.run > /dev/null || ret=1
@@ -3682,12 +3816,12 @@ status=$((status+ret))
 # DNSSEC tests related to unsupported, disabled and revoked trust anchors.
 #
 
-# This nameserver (ns8) is loaded with a bunch of trust anchors.  Some of them
-# are good (enabled.managed, enabled.trusted, secure.managed, secure.trusted),
-# and some of them are bad (disabled.managed, revoked.managed, unsupported.managed,
-# disabled.trusted, revoked.trusted, unsupported.trusted).  Make sure that the bad
-# trust anchors are ignored.  This is tested by looking for the corresponding
-# lines in the logfile.
+# This nameserver (ns8) is loaded with a bunch of trust anchors.  Some of
+# them are good (enabled.managed, enabled.trusted, secure.managed,
+# secure.trusted), and some of them are bad (disabled.managed,
+# revoked.managed, unsupported.managed, disabled.trusted, revoked.trusted,
+# unsupported.trusted).  Make sure that the bad trust anchors are ignored.
+# This is tested by looking for the corresponding lines in the logfile.
 echo_i "checking that keys with unsupported algorithms and disabled algorithms are ignored ($n)"
 ret=0
 grep -q "ignoring static-key for 'disabled\.trusted\.': algorithm is disabled" ns8/named.run || ret=1
@@ -4051,5 +4185,13 @@ do
   status=$((status+ret))
 done
 
+echo_i "checking secroots output with multiple views ($n)"
+rndccmd 10.53.0.4 secroots 2>&1 | sed 's/^/ns4 /' | cat_i
+cp ns4/named.secroots named.secroots.test$n
+check_secroots_layout named.secroots.test$n || ret=1
+n=$((n+1))
+test "$ret" -eq 0 || echo_i "failed"
+status=$((status+ret))
+
 echo_i "exit status: $status"
 [ $status -eq 0 ] || exit 1

bin/tests/system/dnstap/clean.sh

@@ -12,6 +12,7 @@
 rm -f */named.conf
 rm -f */named.memstats
 rm -f */named.run
+rm -f */named.run.prev
 rm -f */named.stats
 rm -f dig.out*
 rm -f dnstap.out dnstap.hex

bin/tests/system/dnstap/tests.sh

@@ -35,7 +35,21 @@ do
 	status=`expr $status + $ret`
 done
 
+echo_i "wait for servers to finish loading"
+ret=0
+wait_for_log 20 "all zones loaded" ns1/named.run || ret=1
+wait_for_log 20 "all zones loaded" ns2/named.run || ret=1
+wait_for_log 20 "all zones loaded" ns3/named.run || ret=1
+wait_for_log 20 "all zones loaded" ns4/named.run || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=`expr $status + $ret`
+
+# both the 'a.example/A' lookup and the './NS' lookup to ns1
+# need tocomplete before reopening/rolling for the counts to
+# be correct.
+
 $DIG $DIGOPTS @10.53.0.3 a.example > dig.out
+wait_for_log 20 "(./NS): query_reset" ns1/named.run || true
 
 # check three different dnstap reopen/roll methods:
 # ns1: dnstap-reopen; ns2: dnstap -reopen; ns3: dnstap -roll
@@ -71,6 +85,7 @@ EOF
 $RNDCCMD -s 10.53.0.1 stop | sed 's/^/ns1 /' | cat_i
 $RNDCCMD -s 10.53.0.2 stop | sed 's/^/ns2 /' | cat_i
 $RNDCCMD -s 10.53.0.3 stop | sed 's/^/ns3 /' | cat_i
+
 sleep 1
 
 echo_i "checking initial message counts"

bin/tests/system/dyndb/driver/driver.c

@@ -120,8 +120,7 @@ dyndb_init(isc_mem_t *mctx, const char *name, const char *parameters,
 	*instp = sample_inst;
 
  cleanup:
-	if (s != NULL)
-		isc_mem_free(mctx, s);
+	isc_mem_free(mctx, s);
 	if (argv != NULL)
 		isc_mem_put(mctx, argv, argc * sizeof(*argv));
 

bin/tests/system/inline/tests.sh

@@ -1351,6 +1351,7 @@ $PERL $SYSTEMTESTTOP/start.pl --noclean --restart --port ${PORT} inline ns3
 # receive_secure_serial() should refrain from introducing any zone changes.
 $PERL $SYSTEMTESTTOP/stop.pl --use-rndc --halt --port ${CONTROLPORT} inline ns3
 ensure_sigs_only_in_journal delayedkeys ns3/delayedkeys.db.signed
+nextpart ns3/named.run > /dev/null
 $PERL $SYSTEMTESTTOP/start.pl --noclean --restart --port ${PORT} inline ns3
 # We can now test whether the secure zone journal was correctly processed:
 # unless the records contained in it were scheduled for resigning, no resigning

bin/tests/system/kasp/ns3/named.conf.in

@@ -107,6 +107,16 @@ zone "pregenerated.kasp" {
 	dnssec-policy "rsasha1";
 };
 
+/*
+ * A configured dnssec-policy with one rumoured key.
+ * Bugfix case for GL #1593.
+ */
+zone "rumoured.kasp" {
+	type master;
+	file "rumoured.kasp.db";
+	dnssec-policy "rsasha1";
+};
+
 /*
  * Different algorithms.
  */

bin/tests/system/kasp/ns3/setup.sh

@@ -43,7 +43,7 @@ U="UNRETENTIVE"
 # Set up zones that will be initially signed.
 #
 for zn in default rsasha1 dnssec-keygen some-keys legacy-keys pregenerated \
-	  rsasha1-nsec3 rsasha256 rsasha512 ecdsa256 ecdsa384 inherit
+	  rumoured rsasha1-nsec3 rsasha256 rsasha512 ecdsa256 ecdsa384 inherit
 do
 	setup "${zn}.kasp"
 	cp template.db.in "$zonefile"
@@ -72,6 +72,16 @@ zone="pregenerated.kasp"
 $KEYGEN -k rsasha1 -l policies/kasp.conf $zone > keygen.out.$zone.1 2>&1
 $KEYGEN -k rsasha1 -l policies/kasp.conf $zone > keygen.out.$zone.2 2>&1
 
+zone="rumoured.kasp"
+Tpub="now"
+Tact="now+1d"
+KSK=$($KEYGEN  -a RSASHA1 -f KSK  -L 1234 $zone 2> keygen.out.$zone.1)
+ZSK1=$($KEYGEN -a RSASHA1 -b 2000 -L 1234 $zone 2> keygen.out.$zone.2)
+ZSK2=$($KEYGEN -a RSASHA1         -L 1234 $zone 2> keygen.out.$zone.3)
+$SETTIME -s -P $Tpub -A $Tact -g $O -k $R $Tpub -r $R $Tpub -d $H $Tpub  "$KSK"  > settime.out.$zone.1 2>&1
+$SETTIME -s -P $Tpub -A $Tact -g $O -k $R $Tpub -z $R $Tpub              "$ZSK1" > settime.out.$zone.2 2>&1
+$SETTIME -s -P $Tpub -A $Tact -g $O -k $R $Tpub -z $R $Tpub              "$ZSK2" > settime.out.$zone.2 2>&1
+
 #
 # Set up zones that are already signed.
 #

bin/tests/system/kasp/tests.sh

@@ -855,7 +855,7 @@ check_signatures() {
 response_has_cds_for_key() (
 	awk -v zone="${ZONE%%.}." \
 	    -v ttl="${DNSKEY_TTL}" \
-	    -v qtype="${_qtype}" \
+	    -v qtype="CDS" \
 	    -v keyid="$(key_get "${1}" ID)" \
 	    -v keyalg="${_key_algnum}" \
 	    -v hashalg="2" \
@@ -865,37 +865,70 @@ response_has_cds_for_key() (
 	    "$2"
 )
 
+response_has_cdnskey_for_key() (
+	awk -v zone="${ZONE%%.}." \
+	    -v ttl="${DNSKEY_TTL}" \
+	    -v qtype="CDNSKEY" \
+	    -v flags="257" \
+	    -v keyalg="${_key_algnum}" \
+	    'BEGIN { ret=1; }
+	     $1 == zone && $2 == ttl && $4 == qtype && $5 == flags && $7 == keyalg { ret=0; exit; }
+	     END { exit ret; }' \
+	    "$2"
+)
+
 # Test CDS and CDNSKEY publication.
 check_cds() {
 
-	_qtype="CDS"
 	_key_algnum="$(key_get KEY1 ALG_NUM)"
 
 	n=$((n+1))
-	echo_i "check ${_qtype} rrset is signed correctly for zone ${ZONE} ($n)"
+	echo_i "check CDS and CDNSKEY rrset are signed correctly for zone ${ZONE} ($n)"
 	ret=0
-	dig_with_opts "$ZONE" "@${SERVER}" $_qtype > "dig.out.$DIR.test$n" || log_error "dig ${ZONE} ${_qtype} failed"
-	grep "status: NOERROR" "dig.out.$DIR.test$n" > /dev/null || log_error "mismatch status in DNS response"
+
+	dig_with_opts "$ZONE" "@${SERVER}" "CDS" > "dig.out.$DIR.test$n.cds" || log_error "dig ${ZONE} CDS failed"
+	grep "status: NOERROR" "dig.out.$DIR.test$n.cds" > /dev/null || log_error "mismatch status in DNS response"
+
+	dig_with_opts "$ZONE" "@${SERVER}" "CDNSKEY" > "dig.out.$DIR.test$n.cdnskey" || log_error "dig ${ZONE} CDNSKEY failed"
+	grep "status: NOERROR" "dig.out.$DIR.test$n.cdnskey" > /dev/null || log_error "mismatch status in DNS response"
 
 	if [ "$(key_get KEY1 STATE_DS)" = "rumoured" ] || [ "$(key_get KEY1 STATE_DS)" = "omnipresent" ]; then
-		response_has_cds_for_key KEY1 "dig.out.$DIR.test$n" || log_error "missing ${_qtype} record in response for key $(key_get KEY1 ID)"
-		check_signatures $_qtype "dig.out.$DIR.test$n" "KSK"
+		response_has_cds_for_key KEY1 "dig.out.$DIR.test$n.cds" || log_error "missing CDS record in response for key $(key_get KEY1 ID)"
+		check_signatures "CDS" "dig.out.$DIR.test$n.cds" "KSK"
+		response_has_cdnskey_for_key KEY1 "dig.out.$DIR.test$n.cdnskey" || log_error "missing CDNSKEY record in response for key $(key_get KEY1 ID)"
+		check_signatures "CDNSKEY" "dig.out.$DIR.test$n.cdnskey" "KSK"
 	elif [ "$(key_get KEY1 EXPECT)" = "yes" ]; then
-		response_has_cds_for_key KEY1 "dig.out.$DIR.test$n" && log_error "unexpected ${_qtype} record in response for key $(key_get KEY1 ID)"
+		response_has_cds_for_key KEY1 "dig.out.$DIR.test$n.cds" && log_error "unexpected CDS record in response for key $(key_get KEY1 ID)"
+		# KEY1 should not have an associated CDNSKEY, but there may be
+		# one for another key.  Since the CDNSKEY has no field for key
+		# id, it is hard to check what key the CDNSKEY may belong to
+		# so let's skip this check for now.
 	fi
 
 	if [ "$(key_get KEY2 STATE_DS)" = "rumoured" ] || [ "$(key_get KEY2 STATE_DS)" = "omnipresent" ]; then
-		response_has_cds_for_key KEY2 "dig.out.$DIR.test$n" || log_error "missing ${_qtype} record in response for key $(key_get KEY2 ID)"
-		check_signatures $_qtype "dig.out.$DIR.test$n" "KSK"
+		response_has_cds_for_key KEY2 "dig.out.$DIR.test$n.cds" || log_error "missing CDS record in response for key $(key_get KEY2 ID)"
+		check_signatures "CDS" "dig.out.$DIR.test$n.cds" "KSK"
+		response_has_cdnskey_for_key KEY2 "dig.out.$DIR.test$n.cdnskey" || log_error "missing CDNSKEY record in response for key $(key_get KEY2 ID)"
+		check_signatures "CDNSKEY" "dig.out.$DIR.test$n.cdnskey" "KSK"
 	elif [ "$(key_get KEY2 EXPECT)" = "yes" ]; then
-		response_has_cds_for_key KEY2 "dig.out.$DIR.test$n" && log_error "unexpected ${_qtype} record in response for key $(key_get KEY2 ID)"
+		response_has_cds_for_key KEY2 "dig.out.$DIR.test$n.cds" && log_error "unexpected CDS record in response for key $(key_get KEY2 ID)"
+		# KEY2 should not have an associated CDNSKEY, but there may be
+		# one for another key.  Since the CDNSKEY has no field for key
+		# id, it is hard to check what key the CDNSKEY may belong to
+		# so let's skip this check for now.
 	fi
 
 	if [ "$(key_get KEY3 STATE_DS)" = "rumoured" ] || [ "$(key_get KEY3 STATE_DS)" = "omnipresent" ]; then
-		response_has_cds_for_key KEY3 "dig.out.$DIR.test$n" || log_error "missing ${_qtype} record in response for key $(key_get KEY3 ID)"
-		check_signatures $_qtype "dig.out.$DIR.test$n" "KSK"
+		response_has_cds_for_key KEY3 "dig.out.$DIR.test$n.cds" || log_error "missing CDS record in response for key $(key_get KEY3 ID)"
+		check_signatures "CDS" "dig.out.$DIR.test$n.cds" "KSK"
+		response_has_cdnskey_for_key KEY3 "dig.out.$DIR.test$n.cdnskey" || log_error "missing CDNSKEY record in response for key $(key_get KEY3 ID)"
+		check_signatures "CDNSKEY" "dig.out.$DIR.test$n.cdnskey" "KSK"
 	elif [ "$(key_get KEY3 EXPECT)" = "yes" ]; then
-		response_has_cds_for_key KEY3 "dig.out.$DIR.test$n" && log_error "unexpected ${_qtype} record in response for key $(key_get KEY3 ID)"
+		response_has_cds_for_key KEY3 "dig.out.$DIR.test$n.cds" && log_error "unexpected CDS record in response for key $(key_get KEY3 ID)"
+		# KEY3 should not have an associated CDNSKEY, but there may be
+		# one for another key.  Since the CDNSKEY has no field for key
+		# id, it is hard to check what key the CDNSKEY may belong to
+		# so let's skip this check for now.
 	fi
 
 	test "$ret" -eq 0 || echo_i "failed"
@@ -957,7 +990,7 @@ check_apex() {
 	test "$ret" -eq 0 || echo_i "failed"
 	status=$((status+ret))
 
-	# Test CDS publication.
+	# Test CDS and CDNSKEY publication.
 	check_cds
 }
 
@@ -1056,6 +1089,17 @@ check_apex
 check_subdomain
 dnssec_verify
 
+#
+# Zone: rumoured.kasp.
+#
+# There are three keys in rumoured state.
+zone_properties "ns3" "rumoured.kasp" "rsasha1" "1234" "3" "10.53.0.3"
+# key_properties, key_timings and key_states same as above.
+check_keys
+check_apex
+check_subdomain
+dnssec_verify
+
 #
 # Zone: secondary.kasp.
 #

bin/tests/system/mirror/tests.sh

@@ -540,7 +540,9 @@ n=`expr $n + 1`
 echo_i "checking that a mirror zone can be deleted using rndc ($n)"
 ret=0
 # Remove the mirror zone added in the previous test.
+nextpart ns3/named.run > /dev/null
 $RNDCCMD 10.53.0.3 delzone verify-addzone > rndc.out.ns3.test$n 2>&1 || ret=1
+wait_for_log 20 "zone verify-addzone/IN: mirror zone is no longer in use; reverting to normal recursion" ns3/named.run || ret=1
 # Check whether the mirror zone was removed.
 $DIG $DIGOPTS @10.53.0.3 +norec verify-addzone SOA > dig.out.ns3.test$n 2>&1 || ret=1
 grep "NXDOMAIN" dig.out.ns3.test$n > /dev/null || ret=1

bin/tests/system/mkeys/tests.sh

@@ -172,7 +172,7 @@ n=$((n+1))
 echo_i "remove untrusted standby key, check timer restarts ($n)"
 ret=0
 mkeys_sync_on 2 || ret=1
-t1=$(grep "trust pending" ns2/managed-keys.bind)
+t1=$(grep "trust pending" ns2/managed-keys.bind) || true
 $SETTIME -D now -K ns1 "$standby1" > /dev/null
 mkeys_loadkeys_on 1 || ret=1
 # Less than a second may have passed since the last time ns2 received a
@@ -182,7 +182,7 @@ mkeys_loadkeys_on 1 || ret=1
 sleep 1
 mkeys_refresh_on 2 || ret=1
 mkeys_sync_on 2 || ret=1
-t2=$(grep "trust pending" ns2/managed-keys.bind)
+t2=$(grep "trust pending" ns2/managed-keys.bind) || true
 # trust pending date must be different
 [ -n "$t2" ] || ret=1
 [ "$t1" = "$t2" ] && ret=1
@@ -220,7 +220,7 @@ count=$(grep -c "remove at" rndc.out.$n) || true
 count=$(grep -c "trust pending" rndc.out.$n) || true
 [ "$count" -eq 1 ] || ret=1
 # pending date moved forward for the standby key
-t2=$(grep "trust pending" ns2/managed-keys.bind)
+t2=$(grep "trust pending" ns2/managed-keys.bind) || true
 [ -n "$t2" ] || ret=1
 [ "$t1" = "$t2" ] && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
@@ -254,7 +254,7 @@ count=$(grep -c "remove at" rndc.out.$n) || true
 count=$(grep -c "trust pending" rndc.out.$n) || true
 [ "$count" -eq 1 ] || ret=1
 # pending date moved forward for the standby key
-t2=$(grep "trust pending" ns2/managed-keys.bind)
+t2=$(grep "trust pending" ns2/managed-keys.bind) || true
 [ -n "$t2" ] || ret=1
 [ "$t1" = "$t2" ] && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
@@ -292,7 +292,7 @@ count=$(grep -c "remove at" rndc.out.$n) || true
 count=$(grep -c "trust pending" rndc.out.$n) || true
 [ "$count" -eq 1 ] || ret=1
 # pending date moved forward for the standby key
-t2=$(grep "trust pending" ns2/managed-keys.bind)
+t2=$(grep "trust pending" ns2/managed-keys.bind) || true
 [ -n "$t2" ] || ret=1
 [ "$t1" = "$t2" ] && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
@@ -571,7 +571,7 @@ ret=0
 # set using -T mkeytimers).
 mkeys_refresh_on 2 || ret=1
 mkeys_status_on 2 > rndc.out.1.$n 2>&1 || ret=1
-t1=$(grep 'next refresh:' rndc.out.1.$n)
+t1=$(grep 'next refresh:' rndc.out.1.$n) || true
 $PERL $SYSTEMTESTTOP/stop.pl --use-rndc --port "${CONTROLPORT}" mkeys ns1
 rm -f ns1/root.db.signed.jnl
 cp ns1/root.db ns1/root.db.signed
@@ -594,7 +594,7 @@ count=$(grep -c "trust" rndc.out.2.$n) || true
 [ "$count" -eq 1 ] || ret=1
 count=$(grep -c "trusted since" rndc.out.2.$n) || true
 [ "$count" -eq 1 ] || ret=1
-t2=$(grep 'next refresh:' rndc.out.2.$n)
+t2=$(grep 'next refresh:' rndc.out.2.$n) || true
 [ "$t1" = "$t2" ] && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
@@ -605,7 +605,7 @@ ret=0
 # Refresh keys first to prevent previous checks from influencing this one
 mkeys_refresh_on 2 || ret=1
 mkeys_status_on 2 > rndc.out.1.$n 2>&1 || ret=1
-t1=$(grep 'next refresh:' rndc.out.1.$n)
+t1=$(grep 'next refresh:' rndc.out.1.$n) || true
 $PERL $SYSTEMTESTTOP/stop.pl --use-rndc --port "${CONTROLPORT}" mkeys ns1
 rm -f ns1/root.db.signed.jnl
 cat ns1/K*.key >> ns1/root.db.signed
@@ -632,7 +632,7 @@ count=$(grep -c "trust" rndc.out.2.$n) || true
 [ "$count" -eq 1 ] || ret=1
 count=$(grep -c "trusted since" rndc.out.2.$n) || true
 [ "$count" -eq 1 ] || ret=1
-t2=$(grep 'next refresh:' rndc.out.2.$n)
+t2=$(grep 'next refresh:' rndc.out.2.$n) || true
 [ "$t1" = "$t2" ] && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
@@ -682,7 +682,7 @@ echo_i "check that trust-anchor-telemetry queries contain the correct key ($n)"
 ret=0
 # convert the hexadecimal key from the TAT query into decimal and
 # compare against the known key.
-tathex=$(grep "query '_ta-[0-9a-f][0-9a-f]*/NULL/IN' approved" ns1/named.run | awk '{print $6; exit 0}' | sed -e 's/(_ta-\([0-9a-f][0-9a-f]*\)):/\1/')
+tathex=$(grep "query '_ta-[0-9a-f][0-9a-f]*/NULL/IN' approved" ns1/named.run | awk '{print $6; exit 0}' | sed -e 's/(_ta-\([0-9a-f][0-9a-f]*\)):/\1/') || true
 tatkey=$($PERL -e 'printf("%d\n", hex(@ARGV[0]));' "$tathex")
 realkey=$(rndccmd 10.53.0.2 secroots - | sed -n 's#.*SHA256/\([0-9][0-9]*\) ; .*managed.*#\1#p')
 [ "$tatkey" -eq "$realkey" ] || ret=1

bin/tests/system/padding/clean.sh

@@ -11,6 +11,7 @@ rm -f dig.out.*
 rm -f ns*/named.memstats
 rm -f ns*/named.run
 rm -f ns*/named.stats
+rm -f ns*/named.stats.prev
 rm -f ns*/named.lock
 rm -f ns*/named.conf
 rm -f ns*/managed-keys.bind*