Merge branch 'prep-release' into v9_14

doc rebuild
prep 9.14.0rc1
2019-02-28 00:05:32 +00:00 · 2019-02-28 00:05:06 +00:00 · 2019-02-27 23:50:01 +00:00 · 2019-02-27 18:33:05 -05:00 · 2019-02-27 18:06:35 -05:00 · 2019-02-22 10:05:07 -05:00
107 changed files with 1251 additions and 1203 deletions
@@ -1,3 +1,14 @@
+	--- 9.14.0rc1 released ---
+
+5168.	[bug]		Do not crash on shutdown when RPZ fails to load.  Also,
+			keep previous version of the database if RPZ fails to
+			load. [GL #813]
+
+5167.	[bug]		nxdomain-redirect could sometimes lookup the wrong
+			redirect name. [GL #892]
+
+5166.	[placeholder]
+
 5165.	[contrib]	Removed SDB drivers from contrib; they're obsolete.
 			[GL #428]

@@ -25,6 +36,18 @@
 5157.	[bug]		Nslookup now errors out if there are extra command
 			line arguments. [GL #207]

+5141.	[security]	Zone transfer controls for writable DLZ zones were
+			not effective as the allowzonexfr method was not being
+			called for such zones. (CVE-2019-6465) [GL #790]
+
+5118.	[security]	Named could crash if it is managing a key with
+			`managed-keys` and the authoritative zone is rolling
+			the key to an unsupported algorithm. (CVE-2018-5745)
+			[GL #780]
+
+5110.	[security]	Named leaked memory if there were multiple Key Tag
+			EDNS options present. (CVE-2018-5744) [GL #772]
+
 	--- 9.13.6 released ---

 5156.	[doc]		Extended and refined the section of the ARM describing
@@ -85,8 +108,6 @@
 			and "nsdname-enable" both now default to yes,
 			regardless of compile-time settings. [GL #824]

-5141.	[placeholder]
-
 5140.	[bug]		Don't immediately mark existing keys as inactive and
 			deleted when running dnssec-keymgr for the first
 			time. [GL #117]
@@ -157,8 +178,6 @@

 5119.	[placeholder]

-5118.	[placeholder]
-
 5117.	[placeholder]

 5116.	[bug]		Named/named-checkconf triggered a assertion when
@@ -179,8 +198,6 @@
 5111.	[bug]		Occluded DNSKEY records could make it into the
 			delegating NSEC/NSEC3 bitmap. [GL #742]

-5110.	[placeholder]
-
 5109.	[cleanup]	Remove support for RSAMD5 algorithm. [GL #628]

 	--- 9.13.5 released ---
@@ -13,7 +13,7 @@ offer support on a "best effort" basis for some.

 Regularly tested platforms

-As of Jan 2019, BIND 9.13 is fully supported and regularly tested on the
+As of Feb 2019, BIND 9.14 is fully supported and regularly tested on the
 following systems:

  * Debian 8, 9, 10
@@ -51,7 +51,7 @@ Server 2012 R2, none of these are tested regularly by ISC.

 Unsupported platforms

-These are platforms on which BIND 9.13 is known not to build or run:
+These are platforms on which BIND 9.14 is known not to build or run:

  * Platforms without at least OpenSSL 1.0.2
  * Windows 10 / x86
@@ -23,7 +23,7 @@ offer support on a "best effort" basis for some.

 ### Regularly tested platforms

-As of Jan 2019, BIND 9.13 is fully supported and regularly tested on the
+As of Feb 2019, BIND 9.14 is fully supported and regularly tested on the
 following systems:

 * Debian 8, 9, 10
@@ -60,7 +60,7 @@ Server 2012 R2, none of these are tested regularly by ISC.

 ## Unsupported platforms

-These are platforms on which BIND 9.13 is known *not* to build or run:
+These are platforms on which BIND 9.14 is known *not* to build or run:

 * Platforms without at least OpenSSL 1.0.2
 * Windows 10 / x86
@@ -5,7 +5,7 @@ Contents
 1. Introduction
 2. Reporting bugs and getting help
 3. Contributing to BIND
- 4. BIND 9.13 features
+ 4. BIND 9.14 features
 5. Building BIND
 6. macOS
 7. Dependencies
@@ -100,17 +100,19 @@ If you prefer, you may also submit code by opening a GitLab Issue and
 including your patch as an attachment, preferably generated by git
 format-patch.

-BIND 9.13 features
+BIND 9.14 features

-BIND 9.13 is the newest development branch of BIND 9. It includes a number
-of changes from BIND 9.12 and earlier releases. New features include:
+BIND 9.14.0 is the first release from a new stable branch of BIND 9,
+incorporating all changes from the 9.13 development branch, updating the
+most recent stable branch, 9.12. These changes include:

  * A new "plugin" mechanism has been added to allow query functionality
    to be extended using dynamically loadable libraries. The "filter-aaaa"
    feature has been removed from named and is now implemented as a
    plugin.
-  * Socket and task code has been refactored to improve performance.
  * QNAME minimization, as described in RFC 7816, is now supported.
+  * Socket and task code has been refactored to improve performance on
+    most modern machines.
  * "Root key sentinel" support, enabling validating resolvers to indicate
    via a special query which trust anchors are configured for the root
    zone.
@@ -138,7 +140,8 @@ is now mandatory: building BIND without DNSSEC is no longer supported.
 Special code to support certain legacy operating systems has also been
 removed; see the file PLATFORMS.md for details of supported platforms. In
 addition to OpenSSL, BIND now requires support for IPv6, threads, and
-standard atomic operations provided by the C compiler.
+standard atomic operations provided by the C compiler. Non-threaded builds
+are no longer supported.

 Building BIND

@@ -15,7 +15,7 @@
 1. [Introduction](#intro)
 1. [Reporting bugs and getting help](#help)
 1. [Contributing to BIND](#contrib)
-1. [BIND 9.13 features](#features)
+1. [BIND 9.14 features](#features)
 1. [Building BIND](#build)
 1. [macOS](#macos)
 1. [Dependencies](#dependencies)
@@ -117,17 +117,18 @@ If you prefer, you may also submit code by opening a
 including your patch as an attachment, preferably generated by
 `git format-patch`.

-### <a name="features"/> BIND 9.13 features
+### <a name="features"/> BIND 9.14 features

-BIND 9.13 is the newest development branch of BIND 9. It includes a
-number of changes from BIND 9.12 and earlier releases.  New features
-include:
+BIND 9.14.0 is the first release from a new stable branch of BIND 9,
+incorporating all changes from the 9.13 development branch, updating
+the most recent stable branch, 9.12.  These changes include:

 * A new "plugin" mechanism has been added to allow query functionality
  to be extended using dynamically loadable libraries. The "filter-aaaa"
  feature has been removed from named and is now implemented as a plugin.
-* Socket and task code has been refactored to improve performance.
 * QNAME minimization, as described in RFC 7816, is now supported.
+* Socket and task code has been refactored to improve performance on most
+  modern machines.
 * "Root key sentinel" support, enabling validating resolvers to indicate
  via a special query which trust anchors are configured for the root zone.
 * Secondary zones can now be configured as "mirror" zones; their contents
@@ -157,7 +158,7 @@ Special code to support certain legacy operating systems has also
 been removed; see the file [PLATFORMS.md](PLATFORMS.md) for details
 of supported platforms. In addition to OpenSSL, BIND now requires
 support for IPv6, threads, and standard atomic operations provided
-by the C compiler.
+by the C compiler. Non-threaded builds are no longer supported.

 ### <a name="build"/> Building BIND

@@ -10,12 +10,12 @@
 .\"     Title: named.conf
 .\"    Author: 
 .\" Generator: DocBook XSL Stylesheets v1.78.1 <http://docbook.sf.net/>
-.\"      Date: 2018-12-07
+.\"      Date: 2019-02-06
 .\"    Manual: BIND9
 .\"    Source: ISC
 .\"  Language: English
 .\"
-.TH "NAMED\&.CONF" "5" "2018\-12\-07" "ISC" "BIND9"
+.TH "NAMED\&.CONF" "5" "2019\-02\-06" "ISC" "BIND9"
 .\" -----------------------------------------------------------------
 .\" * Define some portability stuff
 .\" -----------------------------------------------------------------
@@ -13,7 +13,7 @@

 <refentry xmlns:db="http://docbook.org/ns/docbook" version="5.0" xml:id="man.named.conf">
  <info>
-    <date>2018-12-07</date>
+    <date>2019-02-06</date>
  </info>
  <refentryinfo>
    <corpname>ISC</corpname>
@@ -49,7 +49,7 @@ and
 \fBdnssec\-settime\fR\&.
 .PP
 DNSSEC policy can be read from a configuration file (default
-/etc/dnssec\-policy\&.conf), from which the key parameters, publication and rollover schedule, and desired coverage duration for any given zone can be determined\&. This file may be used to define individual DNSSEC policies on a per\-zone basis, or to set a default policy used for all zones\&.
+/etc/dnssec\-policy\&.conf), from which the key parameters, publication and rollover schedule, and desired coverage duration for any given zone can be determined\&. This file may be used to define individual DNSSEC policies on a per\-zone basis, or to set a "default" policy used for all zones\&.
 .PP
 When
 \fBdnssec\-keymgr\fR
@@ -181,7 +181,8 @@ would be used for zones that had unusually high security needs\&.
 .sp -1
 .IP \(bu 2.3
 .\}
-Algorithm policies: (\fBalgorithm\-policy \fR\fB\fIalgorithm\fR\fR\fB { \&.\&.\&. };\fR
+\fIAlgorithm policies:\fR
+(\fBalgorithm\-policy \fR\fB\fIalgorithm\fR\fR\fB { \&.\&.\&. };\fR
 ) override default per\-algorithm settings\&. For example, by default, RSASHA256 keys use 2048\-bit key sizes for both KSK and ZSK\&. This can be modified using
 \fBalgorithm\-policy\fR, and the new key sizes would then be used for any key of type RSASHA256\&.
 .RE
@@ -194,59 +195,60 @@ Algorithm policies: (\fBalgorithm\-policy \fR\fB\fIalgorithm\fR\fR\fB { \&.\&.\&
 .sp -1
 .IP \(bu 2.3
 .\}
-Zone policies: (\fBzone \fR\fB\fIname\fR\fR\fB { \&.\&.\&. };\fR
+\fIZone policies:\fR
+(\fBzone \fR\fB\fIname\fR\fR\fB { \&.\&.\&. };\fR
 ) set policy for a single zone by name\&. A zone policy can inherit a policy class by including a
 \fBpolicy\fR
-option\&. Zone names beginning with digits (i\&.e\&., 0\-9) must be quoted\&.
+option\&. Zone names beginning with digits (i\&.e\&., 0\-9) must be quoted\&. If a zone does not have its own policy then the "default" policy applies\&.
 .RE
 .PP
 Options that can be specified in policies:
 .PP
-\fBalgorithm\fR
+\fBalgorithm\fR \fIname\fR;
 .RS 4
 The key algorithm\&. If no policy is defined, the default is RSASHA256\&.
 .RE
 .PP
-\fBcoverage\fR
+\fBcoverage\fR \fIduration\fR;
 .RS 4
 The length of time to ensure that keys will be correct; no action will be taken to create new keys to be activated after this time\&. This can be represented as a number of seconds, or as a duration using human\-readable units (examples: "1y" or "6 months")\&. A default value for this option can be set in algorithm policies as well as in policy classes or zone policies\&. If no policy is configured, the default is six months\&.
 .RE
 .PP
-\fBdirectory\fR
+\fBdirectory\fR \fIpath\fR;
 .RS 4
 Specifies the directory in which keys should be stored\&.
 .RE
 .PP
-\fBkey\-size\fR
+\fBkey\-size\fR \fIkeytype\fR \fIsize\fR;
 .RS 4
-Specifies the number of bits to use in creating keys\&. Takes two arguments: keytype (eihter "zsk" or "ksk") and size\&. A default value for this option can be set in algorithm policies as well as in policy classes or zone policies\&. If no policy is configured, the default is 2048 bits for RSA keys\&.
+Specifies the number of bits to use in creating keys\&. The keytype is either "zsk" or "ksk"\&. A default value for this option can be set in algorithm policies as well as in policy classes or zone policies\&. If no policy is configured, the default is 2048 bits for RSA keys\&.
 .RE
 .PP
-\fBkeyttl\fR
+\fBkeyttl\fR \fIduration\fR;
 .RS 4
 The key TTL\&. If no policy is defined, the default is one hour\&.
 .RE
 .PP
-\fBpost\-publish\fR
+\fBpost\-publish\fR \fIkeytype\fR \fIduration\fR;
 .RS 4
 How long after inactivation a key should be deleted from the zone\&. Note: If
 \fBroll\-period\fR
-is not set, this value is ignored\&. Takes two arguments: keytype (eihter "zsk" or "ksk") and a duration\&. A default value for this option can be set in algorithm policies as well as in policy classes or zone policies\&. The default is one month\&.
+is not set, this value is ignored\&. The keytype is either "zsk" or "ksk"\&. A default duration for this option can be set in algorithm policies as well as in policy classes or zone policies\&. The default is one month\&.
 .RE
 .PP
-\fBpre\-publish\fR
+\fBpre\-publish\fR \fIkeytype\fR \fIduration\fR;
 .RS 4
 How long before activation a key should be published\&. Note: If
 \fBroll\-period\fR
-is not set, this value is ignored\&. Takes two arguments: keytype (either "zsk" or "ksk") and a duration\&. A default value for this option can be set in algorithm policies as well as in policy classes or zone policies\&. The default is one month\&.
+is not set, this value is ignored\&. The keytype is either "zsk" or "ksk"\&. A default duration for this option can be set in algorithm policies as well as in policy classes or zone policies\&. The default is one month\&.
 .RE
 .PP
-\fBroll\-period\fR
+\fBroll\-period\fR \fIkeytype\fR \fIduration\fR;
 .RS 4
-How frequently keys should be rolled over\&. Takes two arguments: keytype (eihter "zsk" or "ksk") and a duration\&. A default value for this option can be set in algorithm policies as well as in policy classes or zone policies\&. If no policy is configured, the default is one year for ZSK\*(Aqs\&. KSK\*(Aqs do not roll over by default\&.
+How frequently keys should be rolled over\&. The keytype is either "zsk" or "ksk"\&. A default duration for this option can be set in algorithm policies as well as in policy classes or zone policies\&. If no policy is configured, the default is one year for ZSKs\&. KSKs do not roll over by default\&.
 .RE
 .PP
-\fBstandby\fR
+\fBstandby\fR \fIkeytype\fR \fInumber\fR;
 .RS 4
 Not yet implemented\&.
 .RE
@@ -57,11 +57,12 @@
    </p>
    <p>
      DNSSEC policy can be read from a configuration file (default
-      <code class="filename">/etc/dnssec-policy.conf</code>), from which the key
-      parameters, publication and rollover schedule, and desired
-      coverage duration for any given zone can be determined.  This
+      <code class="filename">/etc/dnssec-policy.conf</code>), from which the
+      key parameters, publication and rollover schedule, and desired
+      coverage duration for any given zone can be determined. This
      file may be used to define individual DNSSEC policies on a
-      per-zone basis, or to set a default policy used for all zones.
+      per-zone basis, or to set a "<code class="literal">default</code>" policy
+      used for all zones.
    </p>
    <p>
      When <span class="command"><strong>dnssec-keymgr</strong></span> runs, it examines the DNSSEC
@@ -210,7 +211,7 @@
      </li>
 <li class="listitem">
 	<p>
-	  Algorithm policies:
+	  <span class="emphasis"><em>Algorithm policies:</em></span>
 	  (<code class="option">algorithm-policy <em class="replaceable"><code>algorithm</code></em> { ... };</code> )
 	  override default per-algorithm settings.  For example, by default,
 	  RSASHA256 keys use 2048-bit key sizes for both KSK and ZSK. This
@@ -220,11 +221,13 @@
      </li>
 <li class="listitem">
 	<p>
-	  Zone policies:
+	  <span class="emphasis"><em>Zone policies:</em></span>
 	  (<code class="option">zone <em class="replaceable"><code>name</code></em> { ... };</code> )
 	  set policy for a single zone by name. A zone policy can inherit
 	  a policy class by including a <code class="option">policy</code> option.
 	  Zone names beginning with digits (i.e., 0-9) must be quoted.
+	  If a zone does not have its own policy then the
+	  "<code class="literal">default</code>" policy applies.
 	</p>
      </li>
 </ul></div>
@@ -232,81 +235,90 @@
      Options that can be specified in policies:
    </p>
    <div class="variablelist"><dl class="variablelist">
-<dt><span class="term"><span class="command"><strong>algorithm</strong></span></span></dt>
+<dt><span class="term"><span class="command"><strong>algorithm</strong></span>
+	  <em class="replaceable"><code>name</code></em><code class="literal">;</code></span></dt>
 <dd>
 	  <p>
 	    The key algorithm. If no policy is defined, the default is
 	    RSASHA256.
 	  </p>
 	</dd>
-<dt><span class="term"><span class="command"><strong>coverage</strong></span></span></dt>
+<dt><span class="term"><span class="command"><strong>coverage</strong></span>
+	  <em class="replaceable"><code>duration</code></em><code class="literal">;</code></span></dt>
 <dd>
 	  <p>
 	    The length of time to ensure that keys will be correct; no action
 	    will be taken to create new keys to be activated after this time.
-	    This can be represented as a number of seconds, or as a duration using
-	    human-readable units (examples: "1y" or "6 months").
+	    This can be represented as a number of seconds, or as a duration
+	    using human-readable units (examples: "1y" or "6 months").
 	    A default value for this option can be set in algorithm policies
 	    as well as in policy classes or zone policies.
 	    If no policy is configured, the default is six months.
 	  </p>
 	</dd>
-<dt><span class="term"><span class="command"><strong>directory</strong></span></span></dt>
+<dt><span class="term"><span class="command"><strong>directory</strong></span>
+	  <em class="replaceable"><code>path</code></em><code class="literal">;</code></span></dt>
 <dd>
 	  <p>
 	    Specifies the directory in which keys should be stored.
 	  </p>
 	</dd>
-<dt><span class="term"><span class="command"><strong>key-size</strong></span></span></dt>
+<dt><span class="term"><span class="command"><strong>key-size</strong></span> <em class="replaceable"><code>keytype</code></em>
+	  <em class="replaceable"><code>size</code></em><code class="literal">;</code></span></dt>
 <dd>
 	  <p>
 	    Specifies the number of bits to use in creating keys.
-	    Takes two arguments: keytype (eihter "zsk" or "ksk") and size.
+	    The keytype is either "zsk" or "ksk".
 	    A default value for this option can be set in algorithm policies
 	    as well as in policy classes or zone policies. If no policy is
 	    configured, the default is 2048 bits for RSA keys.
 	  </p>
 	</dd>
-<dt><span class="term"><span class="command"><strong>keyttl</strong></span></span></dt>
+<dt><span class="term"><span class="command"><strong>keyttl</strong></span>
+	  <em class="replaceable"><code>duration</code></em><code class="literal">;</code></span></dt>
 <dd>
 	  <p>
 	    The key TTL. If no policy is defined, the default is one hour.
 	  </p>
 	</dd>
-<dt><span class="term"><span class="command"><strong>post-publish</strong></span></span></dt>
+<dt><span class="term"><span class="command"><strong>post-publish</strong></span> <em class="replaceable"><code>keytype</code></em>
+	  <em class="replaceable"><code>duration</code></em><code class="literal">;</code></span></dt>
 <dd>
 	  <p>
 	    How long after inactivation a key should be deleted from the zone.
 	    Note: If <code class="option">roll-period</code> is not set, this value is
-	    ignored. Takes two arguments: keytype (eihter "zsk" or "ksk") and a
-	    duration. A default value for this option can be set in algorithm
+	    ignored. The keytype is either "zsk" or "ksk".
+	    A default duration for this option can be set in algorithm
 	    policies as well as in policy classes or zone policies. The default
 	    is one month.
 	  </p>
 	</dd>
-<dt><span class="term"><span class="command"><strong>pre-publish</strong></span></span></dt>
+<dt><span class="term"><span class="command"><strong>pre-publish</strong></span> <em class="replaceable"><code>keytype</code></em>
+	  <em class="replaceable"><code>duration</code></em><code class="literal">;</code></span></dt>
 <dd>
 	  <p>
 	    How long before activation a key should be published.  Note: If
 	    <code class="option">roll-period</code> is not set, this value is ignored.
-	    Takes two arguments: keytype (either "zsk" or "ksk") and a duration.
-	    A default value for this option can be set in algorithm policies
+	    The keytype is either "zsk" or "ksk".
+	    A default duration for this option can be set in algorithm policies
 	    as well as in policy classes or zone policies.  The default is
 	    one month.
 	  </p>
 	</dd>
-<dt><span class="term"><span class="command"><strong>roll-period</strong></span></span></dt>
+<dt><span class="term"><span class="command"><strong>roll-period</strong></span> <em class="replaceable"><code>keytype</code></em>
+	  <em class="replaceable"><code>duration</code></em><code class="literal">;</code></span></dt>
 <dd>
 	  <p>
 	    How frequently keys should be rolled over.
-	    Takes two arguments: keytype (eihter "zsk" or "ksk") and a duration.
-	    A default value for this option can be set in algorithm policies
+	    The keytype is either "zsk" or "ksk".
+	    A default duration for this option can be set in algorithm policies
 	    as well as in policy classes or zone policies.  If no policy is
-	    configured, the default is one year for ZSK's. KSK's do not
+	    configured, the default is one year for ZSKs. KSKs do not
 	    roll over by default.
 	  </p>
 	</dd>
-<dt><span class="term"><span class="command"><strong>standby</strong></span></span></dt>
+<dt><span class="term"><span class="command"><strong>standby</strong></span> <em class="replaceable"><code>keytype</code></em>
+	  <em class="replaceable"><code>number</code></em><code class="literal">;</code></span></dt>
 <dd>
 	  <p>
 	    Not yet implemented.
@@ -536,10 +536,22 @@ dlz_lookup(const char *zone, const char *name, void *dbdata,
 */
 isc_result_t
 dlz_allowzonexfr(void *dbdata, const char *name, const char *client) {
-	UNUSED(client);
+	isc_result_t result;

-	/* Just say yes for all our zones */
-	return (dlz_findzonedb(dbdata, name, NULL, NULL));
+	result = dlz_findzonedb(dbdata, name, NULL, NULL);
+	if (result != ISC_R_SUCCESS) {
+		return (result);
+	}
+
+	/*
+	 * Exception for 10.53.0.5 so we can test that allow-transfer
+	 * is effective.
+	 */
+	if (strcmp(client, "10.53.0.5") == 0) {
+		return (ISC_R_NOPERM);
+	}
+
+	return (ISC_R_SUCCESS);
 }

 /*
@@ -108,15 +108,23 @@ test_update testdc1.alternate.nil. A "86400 A 10.53.0.10" "10.53.0.10" || ret=1
 status=`expr $status + $ret`

 newtest "testing AXFR from DLZ drivers"
-$DIG $DIGOPTS +noall +answer axfr example.nil > dig.out.ns1.test$n
-lines=`cat dig.out.ns1.test$n | wc -l`
+$DIG $DIGOPTS +noall +answer axfr example.nil > dig.out.example.ns1.test$n
+lines=`cat dig.out.example.ns1.test$n | wc -l`
 [ ${lines:-0} -eq 4 ] || ret=1
-$DIG $DIGOPTS +noall +answer axfr alternate.nil > dig.out.ns1.test$n
-lines=`cat dig.out.ns1.test$n | wc -l`
+$DIG $DIGOPTS +noall +answer axfr alternate.nil > dig.out.alternate.ns1.test$n
+lines=`cat dig.out.alternate.ns1.test$n | wc -l`
 [ ${lines:-0} -eq 5 ] || ret=1
 [ "$ret" -eq 0 ] || echo_i "failed"
 status=`expr $status + $ret`

+newtest "testing AXFR denied from DLZ drivers"
+$DIG $DIGOPTS -b 10.53.0.5 +noall +answer axfr example.nil > dig.out.example.ns1.test$n
+grep "; Transfer failed" dig.out.example.ns1.test$n > /dev/null || ret=1
+$DIG $DIGOPTS -b 10.53.0.5 +noall +answer axfr alternate.nil > dig.out.alternate.ns1.test$n
+grep "; Transfer failed" dig.out.alternate.ns1.test$n > /dev/null || ret=1
+[ "$ret" -eq 0 ] || echo_i "failed"
+status=`expr $status + $ret`
+
 newtest "testing unsearched/unregistered DLZ zone is not found"
 $DIG $DIGOPTS +noall +answer ns other.nil > dig.out.ns1.test$n
 grep "3600.IN.NS.other.nil." dig.out.ns1.test$n > /dev/null && ret=1
@@ -247,7 +247,7 @@ zsk=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone")
 cat "$infile" "$ksk.key" "$zsk.key" unsupported-algorithm.key > "$zonefile"

 # "$SIGNER" -P -3 - -o "$zone" -f ${zonefile}.signed "$zonefile" > /dev/null 2>&1
-"$SIGNER" -P -3 - -o "$zone" -f ${zonefile}.signed "$zonefile"
+"$SIGNER" -P -3 - -o "$zone" -f ${zonefile}.signed "$zonefile" > /dev/null 2>&1

 #
 # A zone with a unknown DNSKEY algorithm + unknown NSEC3 hash algorithm (-U).
@@ -3593,12 +3593,23 @@ status=$((status+ret))

 echo_i "check that KEY-TAG trust-anchor-telemetry queries are logged ($n)"
 ret=0
-dig_with_opts . dnskey +ednsopt=KEY-TAG:ffff @10.53.0.1 > dig.out.ns4.test$n || ret=1
+dig_with_opts . dnskey +ednsopt=KEY-TAG:ffff @10.53.0.1 > dig.out.ns1.test$n || ret=1
 grep "trust-anchor-telemetry './IN' from .* 65535" ns1/named.run > /dev/null || ret=1
 n=$((n+1))
 test "$ret" -eq 0 || echo_i "failed"
 status=$((status+ret))

+echo_i "check that multiple KEY-TAG trust-anchor-telemetry options don't leak memory ($n)"
+ret=0
+dig_with_opts . dnskey +ednsopt=KEY-TAG:fffe +ednsopt=KEY-TAG:fffd @10.53.0.1 > dig.out.ns1.test$n || ret=1
+grep "trust-anchor-telemetry './IN' from .* 65534" ns1/named.run > /dev/null || ret=1
+grep "trust-anchor-telemetry './IN' from .* 65533" ns1/named.run > /dev/null && ret=1
+$PERL $SYSTEMTESTTOP/stop.pl dnssec ns1 || ret=1
+$PERL $SYSTEMTESTTOP/start.pl --noclean --restart --port ${PORT} dnssec ns1 || ret=1
+n=$(($n+1))
+test "$ret" -eq 0 || echo_i "failed"
+status=$((status+ret))
+
 echo_i "check that the view is logged in messages from the validator when using views ($n)"
 ret=0
 grep "view rec: *validat" ns4/named.run > /dev/null || ret=1
@@ -19,3 +19,6 @@ managed-keys.jnl, causing RFC 5011 initialization to fail.

 ns5 is a validator which is prevented from getting a response from the
 root server, causing key refresh queries to fail.
+
+ns6 is a validator which has unsupported algorithms, one at start up,
+one because of an algorithm rollover.
@@ -16,9 +16,10 @@ rm -f */named.conf
 rm -f */named.memstats */named.run */named.run.prev
 rm -f dig.out* delv.out* rndc.out* signer.out*
 rm -f dsset-. ns1/dsset-.
+rm -f ns1/zone.key
 rm -f ns*/managed-keys.bind*
 rm -f ns*/named.lock
 rm -f ns1/named.secroots ns1/root.db.signed* ns1/root.db.tmp
 rm -f ns5/named.args
-rm -f ns6/view1.mkeys ns6/view2.mkeys
+rm -f ns7/view1.mkeys ns7/view2.mkeys
 rm -rf ns4/nope
@@ -8,16 +8,16 @@
 ; information regarding copyright ownership.

 $TTL 20
-. 			IN SOA	gson.nominum.com. a.root.servers.nil. (
-				2000042100   	; serial
-				600         	; refresh
-				600         	; retry
-				1200    	; expire
-				2       	; minimum
-				)
-.			NS	a.root-servers.nil.
-a.root-servers.nil.	A	10.53.0.1
+.                      IN SOA  gson.nominum.com. a.root.servers.nil. (
+                               2000042100      ; serial
+                               600             ; refresh
+                               600             ; retry
+                               1200            ; expire
+                               2               ; minimum
+                               )
+.                      NS      a.root-servers.nil.
+a.root-servers.nil.    A       10.53.0.1

 ; no delegation

-example.		TXT	"This is a test."
+example.               TXT     "This is a test."
@@ -26,13 +26,18 @@ cp managed.conf ../ns2/managed.conf
 cp managed.conf ../ns4/managed.conf
 cp managed.conf ../ns5/managed.conf

-# Configure a trusted key statement (used by delv)
+# Configure a trusted key statement (used by delv).
 keyfile_to_trusted_keys $keyname > trusted.conf

+# Prepare an unsupported algorithm key.
+unsupportedkey=Kunknown.+255+00000
+cp unsupported.key "${unsupportedkey}.key"
+
 #
 #  Save keyname and keyid for managed key id test.
 #
 echo "$keyname" > managed.key
+echo "$zskkeyname" > zone.key
 keyid=`expr $keyname : 'K\.+00.+\([0-9]*\)'`
 keyid=`expr $keyid + 0`
 echo "$keyid" > managed.key.id
@@ -0,0 +1 @@
+.	IN	DNSKEY	257 3 255 BJiXuidPHuGIne8GlCBLG+Oq/FZruQd2s3uBo+SxY16NUP/Vwl8MctMK62KsblDU1gIJAdEMVep2tsOkuSm0bIbJ8NBex+N9rSvzH2YJlDCT9QnNfv4q5RRTcVA3lk9nkmWHo6zcAT33yuS+THOCSznOMCJRq8JGZ6xqMJLv9FucuK6CCe6QBAZ5e98dpyGTWQLu7AERKKFqda9YCk3KQfdzx/HZ4SpQpRLncIXvGm1PIMT8Ar95NB/BsFJGwr5ZTaQtRYOXf2DD7wD3pfMsTJCdZyC0J0EtGBG109I+Oou1cswUfqZLXip/aV3eaBAUqLcZpg8P8vAbrvEq4uMS4OMZeXL6nu0irrdS1Pqmax8RsC+x3fg9EBH3QmHroJZtiU5h+0x4qApp7HE4Z5zFRuxIp9iB
@@ -0,0 +1 @@
+-m record,size,mctx -T clienttest -c named.conf -d 99 -X named.lock -g -T mkeytimers=5/10/20
@@ -22,8 +22,8 @@ options {
 	recursion yes;
 	notify no;
 	dnssec-enable yes;
-	dnssec-validation auto;
-	bindkeys-file "managed.conf";
+	dnssec-validation yes;
+	trust-anchor-telemetry no;
 };

 key rndc_key {
@@ -35,16 +35,9 @@ controls {
 	inet 10.53.0.6 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
 };

-view view1 {
-	zone "." {
-		type hint;
-		file "../../common/root.hint";
-	};
+zone "." {
+	type hint;
+	file "../../common/root.hint";
 };

-view view2 {
-	zone "." {
-		type hint;
-		file "../../common/root.hint";
-	};
-};
+include "managed.conf";
@@ -0,0 +1,30 @@
+#!/bin/sh -e
+#
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+SYSTEMTESTTOP=../..
+. $SYSTEMTESTTOP/conf.sh
+
+zone=.
+zonefile=root.db
+
+# an RSA key
+rsakey=`$KEYGEN -a rsasha256 -qfk rsasha256.`
+
+# a key with unsupported algorithm
+unsupportedkey=Kunknown.+255+00000
+cp unsupported-managed.key "${unsupportedkey}.key"
+
+# root key
+rootkey=`cat ../ns1/managed.key`
+cp "../ns1/${rootkey}.key" .
+
+# Configure the resolving server with a managed trusted key.
+keyfile_to_managed_keys $unsupportedkey $rsakey $rootkey > managed.conf
@@ -0,0 +1 @@
+unsupported.	IN	DNSKEY	257 3 255 BOOVAhiJDPqhfU7+yGXjhetrtC/rtjmwO1yo52BUHUd8R4hQ/ZPdYCVvQlvNkRxDblPkFM5YRXkesS30pJSoNYrg+djbMNumJrLG+lbhFIc/ahTjlYOxb1zm2z00ubHju/1uGBifiRvKWSK0Vr0u6NtS4PKZfsnXt+piSHiRAHSfkjGHwqPYYKh9EUW12kJmIzlMaM6WYl+gJOvL+f8VqNLtvsMPT6OPK/3h/Dnfnxyeudp/jzAnNDDiTgX2XfzIXB4UwxtzIOGaHLnprpNf3zoBm0kyaEdSQQ/qKkpCOqjBasYEHRjVz3RncPUkdLr7PQuPBfFDr3SUMMJqufJrO4IJjtD4cCBT7K1i39Jg471nEzU1vkPzxF+Rw1QHT4nZaXbltf3BEZGS4Knoe9XPwi5KjGW6
@@ -0,0 +1,50 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+// NS7
+
+options {
+	query-source address 10.53.0.7;
+	notify-source 10.53.0.7;
+	transfer-source 10.53.0.7;
+	port @PORT@;
+	pid-file "named.pid";
+	listen-on { 10.53.0.7; };
+	listen-on-v6 { none; };
+	recursion yes;
+	notify no;
+	dnssec-enable yes;
+	dnssec-validation auto;
+	bindkeys-file "managed.conf";
+};
+
+key rndc_key {
+	secret "1234abcd8765";
+	algorithm hmac-sha256;
+};
+
+controls {
+	inet 10.53.0.7 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
+};
+
+view view1 {
+	zone "." {
+		type hint;
+		file "../../common/root.hint";
+	};
+};
+
+view view2 {
+	zone "." {
+		type hint;
+		file "../../common/root.hint";
+	};
+};
@@ -20,10 +20,12 @@ copy_setports ns3/named.conf.in ns3/named.conf
 copy_setports ns4/named.conf.in ns4/named.conf
 copy_setports ns5/named.conf.in ns5/named.conf
 copy_setports ns6/named.conf.in ns6/named.conf
+copy_setports ns7/named.conf.in ns7/named.conf

 cp ns5/named1.args ns5/named.args

 ( cd ns1 && $SHELL sign.sh )
+( cd ns6 && $SHELL setup.sh )

 cp ns2/managed.conf ns2/managed1.conf

@@ -745,7 +745,7 @@ nextpart ns5/named.run > /dev/null
 mkeys_reconfig_on 1
 wait_for_log "Returned from key fetch in keyfetch_done() for '.': success" ns5/named.run
 mkeys_secroots_on 5
-grep '; managed' ns5/named.secroots > /dev/null 2>&1 || ret=1
+grep '; managed' ns5/named.secroots > /dev/null || ret=1
 # ns1 should not longer REFUSE queries from ns5, so managed keys should be
 # correctly refreshed and resolving should succeed
 $DIG $DIGOPTS +noauth example. @10.53.0.5 txt > dig.out.ns5.b.test$n || ret=1
@@ -755,17 +755,71 @@ grep "status: NOERROR" dig.out.ns5.b.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`

+n=`expr $n + 1`
+echo_i "reinitialize trust anchors, add unsupported algorithm ($n)"
+ret=0
+$PERL $SYSTEMTESTTOP/stop.pl --use-rndc --port ${CONTROLPORT} mkeys ns6
+rm -f ns6/managed-keys.bind*
+nextpart ns6/named.run > /dev/null
+$PERL $SYSTEMTESTTOP/start.pl --noclean --restart --port ${PORT} mkeys ns6
+# log when an unsupported algorithm is encountered during startup
+wait_for_log "skipping managed key for 'unsupported\.': algorithm is unsupported" ns6/named.run
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=`expr $status + $ret`
+
+n=`expr $n + 1`
+echo_i "skipping unsupported algorithm in managed-keys ($n)"
+ret=0
+mkeys_status_on 6 > rndc.out.$n 2>&1
+# there should still be only two keys listed (for . and rsasha256.)
+count=`grep -c "keyid: " rndc.out.$n`
+[ "$count" -eq 2 ] || ret=1
+# two lines indicating trust status
+count=`grep -c "trust" rndc.out.$n`
+[ "$count" -eq 2 ] || ret=1
+
+n=`expr $n + 1`
+echo_i "introduce unsupported algorithm rollover in authoritative zone ($n)"
+ret=0
+cp ns1/root.db ns1/root.db.orig
+ksk=`cat ns1/managed.key`
+zsk=`cat ns1/zone.key`
+cat "ns1/${ksk}.key" "ns1/${zsk}.key" ns1/unsupported.key >> ns1/root.db
+grep "\..*IN.*DNSKEY.*257 3 255" ns1/root.db > /dev/null || ret=1
+$SIGNER -K ns1 -N unixtime -o . ns1/root.db $ksk $zsk > /dev/null 2>/dev/null || ret=1
+grep "DNSKEY.*257 3 255" ns1/root.db.signed > /dev/null || ret=1
+cp ns1/root.db.orig ns1/root.db
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=`expr $status + $ret`
+
+n=`expr $n + 1`
+echo_i "skipping unsupported algorithm in rollover ($n)"
+ret=0
+mkeys_reload_on 1
+mkeys_refresh_on 6
+mkeys_status_on 6 > rndc.out.$n 2>&1
+# there should still be only two keys listed (for . and rsasha256.)
+count=`grep -c "keyid: " rndc.out.$n`
+[ "$count" -eq 2 ] || ret=1
+# two lines indicating trust status
+count=`grep -c "trust" rndc.out.$n`
+[ "$count" -eq 2 ] || ret=1
+# log when an unsupported algorithm is encountered during rollover
+wait_for_log "Cannot compute tag for key in zone \.: algorithm is unsupported" ns6/named.run
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=`expr $status + $ret`
+
 n=`expr $n + 1`
 echo_i "check 'rndc managed-keys' and views ($n)"
 ret=0
-$RNDCCMD 10.53.0.6 managed-keys refresh in view1 > rndc.out.ns6.view1.test$n || ret=1
-grep "refreshing managed keys for 'view1'" rndc.out.ns6.view1.test$n > /dev/null || ret=1
-lines=`wc -l < rndc.out.ns6.view1.test$n`
+$RNDCCMD 10.53.0.7 managed-keys refresh in view1 > rndc.out.ns7.view1.test$n || ret=1
+grep "refreshing managed keys for 'view1'" rndc.out.ns7.view1.test$n > /dev/null || ret=1
+lines=`wc -l < rndc.out.ns7.view1.test$n`
 [ $lines -eq 1 ] || ret=1
-$RNDCCMD 10.53.0.6 managed-keys refresh > rndc.out.ns6.view2.test$n || ret=1
-lines=`wc -l < rndc.out.ns6.view2.test$n`
-grep "refreshing managed keys for 'view1'" rndc.out.ns6.view2.test$n > /dev/null || ret=1
-grep "refreshing managed keys for 'view2'" rndc.out.ns6.view2.test$n > /dev/null || ret=1
+$RNDCCMD 10.53.0.7 managed-keys refresh > rndc.out.ns7.view2.test$n || ret=1
+lines=`wc -l < rndc.out.ns7.view2.test$n`
+grep "refreshing managed keys for 'view1'" rndc.out.ns7.view2.test$n > /dev/null || ret=1
+grep "refreshing managed keys for 'view2'" rndc.out.ns7.view2.test$n > /dev/null || ret=1
 [ $lines -eq 2 ] || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
@@ -0,0 +1,29 @@
+Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+
+See COPYRIGHT in the source root or http://isc.org/copyright.html for terms.
+
+The test setup for the RPZ tests prepares a query perf tool and sets up
+policy zones.
+
+Name servers
+------------
+
+ns1 is the root server.
+
+ns2 and ns4 are authoritative servers for the various test domains.
+
+ns3 is the main rewriting resolver.
+
+ns5 and ns7 are additional rewriting resolvers.
+
+ns6 is a forwarding server.
+
+
+Updating the response policy zones
+----------------------------------
+
+test1, test2, test3, test4, test5, and test6 are dynamic update files.  These
+updates are made against ns3.  The script function "start_group" is called to
+start an new batch of tests that may depend on certain server updates.  The
+function takes an optional file name and if provided the server updates are
+performed before executing the test batch.
@@ -30,6 +30,7 @@ fi
 rm -f ns*/*.key ns*/*.private
 rm -f ns2/tld2s.db ns2/bl.tld2.db
 rm -f ns3/bl*.db ns*/empty.db
+rm -f ns3/manual-update-rpz.db
 rm -f ns5/example.db ns5/bl.db
 rm -f */policy2.db
 rm -f */*.jnl
@@ -0,0 +1,16 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0. If a copy of the MPL was not distributed with this
+; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+; RPZ test
+;   This basic file is copied to several zone files before being used.
+;   Its contents are also changed with nsupdate
+
+
+; broken zone
+foobar
@@ -0,0 +1,20 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0. If a copy of the MPL was not distributed with this
+; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+; RPZ test
+;   This basic file is copied to several zone files before being used.
+;   Its contents are also changed with nsupdate
+
+
+$TTL 300
+@				SOA	bl-reload.  hostmaster.ns.bl-reload. ( 2 3600 1200 604800 60 )
+				NS	ns.tld3.
+
+walled.tld2.bl-reload.	 300	A	10.0.0.2
+
@@ -0,0 +1,20 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0. If a copy of the MPL was not distributed with this
+; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+; RPZ test
+;   This basic file is copied to several zone files before being used.
+;   Its contents are also changed with nsupdate
+
+
+$TTL 300
+@					SOA	manual-update-rpz.  hostmaster.ns.manual-rpz-update. ( 1 3600 1200 604800 60 )
+					NS	ns.tld3.
+
+walled.tld2.manual-update-rpz.	 300	A	10.0.0.1
+
@@ -44,6 +44,7 @@ options {
 	    zone "bl-drop"	policy drop;
 	    zone "bl-tcp-only"	policy tcp-only;
 	    zone "bl.tld2";
+	    zone "manual-update-rpz";
 	}
 	min-ns-dots 0
 	qname-wait-recurse yes
@@ -102,3 +103,9 @@ zone "bl.tld2."		{type slave; file "bl.tld2.db"; masters {10.53.0.2;};

 zone "crash1.tld2"	{type master; file "crash1"; notify no;};
 zone "crash2.tld3."	{type master; file "crash2"; notify no;};
+
+zone "manual-update-rpz." {
+	type master;
+	file "manual-update-rpz.db";
+	notify no;
+};
@@ -68,8 +68,13 @@ test -z "`grep 'dnsrps-enable yes' dnsrps.conf`" && TEST_DNSRPS=
 for NM in '' -2 -given -disabled -passthru -no-op -nodata -nxdomain -cname -wildcname -garden -drop -tcp-only; do
    sed -e "/SOA/s/blx/bl$NM/g" ns3/base.db >ns3/bl$NM.db
 done
+#  bl zones are dynamically updated.  Add one zone that is updated manually.
+cp ns3/manual-update-rpz.db.in ns3/manual-update-rpz.db

-# $1=directory, $2=domain name, $3=input zone file, $4=output file
+# $1=directory
+# $2=domain name
+# $3=input zone file
+# $4=output file
 signzone () {
    KEYNAME=`$KEYGEN -q -a rsasha256 -K $1 $2`
    cat $1/$3 $1/$KEYNAME.key > $1/tmp
@@ -80,7 +85,6 @@ signzone () {
 }
 signzone ns2 tld2s. base-tld2s.db tld2s.db

-
 # Performance and a few other checks.
 cat <<EOF >ns5/rpz-switch
 response-policy {
@@ -106,7 +106,8 @@ setret () {
 }

 # set $SN to the SOA serial number of a zone
-# $1=domain  $2=DNS server and client IP address
+# $1=domain
+# $2=DNS server and client IP address
 get_sn() {
    SOA=`$DIG -p ${PORT} +short +norecurse soa "$1" "@$2" "-b$2"`
    SN=`expr "$SOA" : '[^ ]* [^ ]* \([^ ]*\) .*'`
@@ -125,7 +126,8 @@ get_sn_fast () {
 }

 # check that dnsrpzd has loaded its zones
-# $1=domain  $2=DNS server IP address
+# $1=domain
+# $2=DNS server IP address
 FZONES=`sed -n -e 's/^zone "\(.*\)".*\(10.53.0..\).*/Z=\1;M=\2/p' dnsrpzd.conf`
 dnsrps_loaded() {
    test "$mode" = dnsrps || return
@@ -150,8 +152,10 @@ dnsrps_loaded() {
 }

 # check the serial number in an SOA to ensure that a policy zone has
-#	been (re)loaded
-# $1=serial number  $2=domain  $3=DNS server
+#   been (re)loaded
+# $1=serial number
+# $2=domain
+# $3=DNS server
 ck_soa() {
    n=0
    while true; do
@@ -186,6 +190,9 @@ load_db () {
    fi
 }

+# restart name server
+# $1 ns number
+# $2 rebuild bl rpz zones if "rebuild-bl-rpz"
 restart () {
    # try to ensure that the server really has stopped
    # and won't mess with ns$1/name.pid
@@ -201,17 +208,20 @@ restart () {
 	fi
    fi
    rm -f ns$1/*.jnl
-    if test -f ns$1/base.db; then
-	for NM in ns$1/bl*.db; do
-	    cp -f ns$1/base.db $NM
-	done
+    if [ "$2" == "rebuild-bl-rpz" ]; then
+        if test -f ns$1/base.db; then
+	    for NM in ns$1/bl*.db; do
+	        cp -f ns$1/base.db $NM
+            done
+        fi
    fi
    $PERL $SYSTEMTESTTOP/start.pl --noclean --restart --port ${PORT} rpz ns$1
    load_db
    dnsrps_loaded
 }

-# $1=server and irrelevant args  $2=error message
+# $1=server and irrelevant args
+# $2=error message
 ckalive () {
    CKALIVE_NS=`expr "$1" : '.*@ns\([1-9]\).*'`
    if test -z "$CKALIVE_NS"; then
@@ -222,7 +232,7 @@ ckalive () {
    HAVE_CORE=yes
    setret "$2"
    # restart the server to avoid stalling waiting for it to stop
-    restart $CKALIVE_NS
+    restart $CKALIVE_NS "rebuild-bl-rpz"
    return 1
 }

@@ -264,7 +274,8 @@ ckstatsrange () {
    eval "${NSDIR}_CNT=$NEW_CNT"
 }

-# $1=message  $2=optional test file name
+# $1=message
+# $2=optional test file name
 start_group () {
    ret=0
    t=`expr $t + 1`
@@ -299,7 +310,8 @@ clean_result () {
    fi
 }

-# $1=dig args $2=other dig output file
+# $1=dig args
+# $2=other dig output file
 ckresult () {
    #ckalive "$1" "server crashed by 'dig $1'" || return 1
    if grep "flags:.* aa .*ad;" $DIGNM; then
@@ -322,7 +334,8 @@ ckresult () {
 }

 # check only that the server does not crash
-# $1=target domain  $2=optional query type
+# $1=target domain
+# $2=optional query type
 nocrash () {
    digcmd $* >/dev/null
    ckalive "$*" "server crashed by 'dig $*'"
@@ -330,7 +343,8 @@ nocrash () {


 # check rewrite to NXDOMAIN
-# $1=target domain  $2=optional query type
+# $1=target domain
+# $2=optional query type
 nxdomain () {
    make_dignm
    digcmd $*								\
@@ -341,7 +355,8 @@ nxdomain () {
 }

 # check rewrite to NODATA
-# $1=target domain  $2=optional query type
+# $1=target domain
+# $2=optional query type
 nodata () {
    make_dignm
    digcmd $*								\
@@ -351,7 +366,9 @@ nodata () {

 # check rewrite to an address
 #   modify the output so that it is easily compared, but save the original line
-# $1=IPv4 address  $2=digcmd args  $3=optional TTL
+# $1=IPv4 address
+# $2=digcmd args
+# $3=optional TTL
 addr () {
    ADDR=$1
    make_dignm
@@ -373,7 +390,8 @@ addr () {
 # Check that a response is not rewritten
 #   Use $ns1 instead of the authority for most test domains, $ns2 to prevent
 #   spurious differences for `dig +norecurse`
-# $1=optional "TCP"  remaining args for dig
+# $1=optional "TCP"
+# remaining args for dig
 nochange () {
    make_dignm
    digcmd $* >$DIGNM
@@ -455,102 +473,104 @@ for mode in native dnsrps; do
  digcmd txt-only.tld2 @$ns2 >proto.nodata

  start_group "QNAME rewrites" test1
-  nochange .				# 1 do not crash or rewrite root
-  nxdomain a0-1.tld2			# 2
-  nodata a3-1.tld2			# 3
-  nodata a3-2.tld2			# 4 nodata at DNAME itself
-  nochange sub.a3-2.tld2		# 5 miss where DNAME might work
-  nxdomain a4-2.tld2			# 6 rewrite based on CNAME target
-  nxdomain a4-2-cname.tld2		# 7
-  nodata a4-3-cname.tld2		# 8
-  addr 12.12.12.12  a4-1.sub1.tld2	# 9 A replacement
-  addr 12.12.12.12  a4-1.sub2.tld2	# 10 A replacement with wildcard
-  addr 12.12.12.12  nxc1.sub1.tld2	# 11 replace NXDOMAIN with CNAME
-  addr 12.12.12.12  nxc2.sub1.tld2	# 12 replace NXDOMAIN with CNAME chain
-  addr 127.4.4.1	  a4-4.tld2	# 13 prefer 1st conflicting QNAME zone
-  nochange a6-1.tld2			# 14
-  addr 127.6.2.1	  a6-2.tld2	# 15
-  addr 56.56.56.56  a3-6.tld2		# 16 wildcard CNAME
-  addr 57.57.57.57  a3-7.sub1.tld2	# 17 wildcard CNAME
-  addr 127.0.0.16	  a4-5-cname3.tld2	# 18 CNAME chain
-  addr 127.0.0.17	  a4-6-cname3.tld2	# 19 stop short in CNAME chain
-  nochange a5-2.tld2	    +norecurse	# 20 check that RD=1 is required
-  nochange a5-3.tld2	    +norecurse	# 21
-  nochange a5-4.tld2	    +norecurse	# 22
-  nochange sub.a5-4.tld2	    +norecurse	# 23
-  nxdomain c1.crash2.tld3		# 24 assert in rbtdb.c
-  nxdomain a0-1.tld2	    +dnssec	# 25 simple DO=1 without signatures
-  nxdomain a0-1.tld2s	    +nodnssec	# 26 simple DO=0 with signatures
-  nochange a0-1.tld2s	    +dnssec	# 27 simple DO=1 with signatures
-  nxdomain a0-1s-cname.tld2s  +dnssec	# 28 DNSSEC too early in CNAME chain
-  nochange a0-1-scname.tld2   +dnssec	# 29 DNSSEC on target in CNAME chain
-  nochange a0-1.tld2s srv +auth +dnssec	# 30 no write for DNSSEC and no record
-  nxdomain a0-1.tld2s srv	    +nodnssec	# 31
-  drop a3-8.tld2 any			# 32 drop
-  nochange tcp a3-9.tld2		# 33 tcp-only
-  here x.servfail <<'EOF'		# 34 qname-wait-recurse yes
+  nochange .					# 1 do not crash or rewrite root
+  nxdomain a0-1.tld2				# 2
+  nodata a3-1.tld2				# 3
+  nodata a3-2.tld2				# 4 nodata at DNAME itself
+  nochange sub.a3-2.tld2			# 5 miss where DNAME might work
+  nxdomain a4-2.tld2				# 6 rewrite based on CNAME target
+  nxdomain a4-2-cname.tld2			# 7
+  nodata a4-3-cname.tld2			# 8
+  addr 12.12.12.12  a4-1.sub1.tld2		# 9 A replacement
+  addr 12.12.12.12  a4-1.sub2.tld2		# 10 A replacement with wildcard
+  addr 12.12.12.12  nxc1.sub1.tld2		# 11 replace NXDOMAIN with CNAME
+  addr 12.12.12.12  nxc2.sub1.tld2		# 12 replace NXDOMAIN with CNAME chain
+  addr 127.4.4.1    a4-4.tld2			# 13 prefer 1st conflicting QNAME zone
+  nochange a6-1.tld2				# 14
+  addr 127.6.2.1    a6-2.tld2			# 15
+  addr 56.56.56.56  a3-6.tld2			# 16 wildcard CNAME
+  addr 57.57.57.57  a3-7.sub1.tld2		# 17 wildcard CNAME
+  addr 127.0.0.16   a4-5-cname3.tld2		# 18 CNAME chain
+  addr 127.0.0.17   a4-6-cname3.tld2		# 19 stop short in CNAME chain
+  nochange a5-2.tld2 +norecurse			# 20 check that RD=1 is required
+  nochange a5-3.tld2 +norecurse			# 21
+  nochange a5-4.tld2 +norecurse			# 22
+  nochange sub.a5-4.tld2 +norecurse		# 23
+  nxdomain c1.crash2.tld3			# 24 assert in rbtdb.c
+  nxdomain a0-1.tld2  +dnssec			# 25 simple DO=1 without signatures
+  nxdomain a0-1.tld2s +nodnssec			# 26 simple DO=0 with signatures
+  nochange a0-1.tld2s +dnssec			# 27 simple DO=1 with signatures
+  nxdomain a0-1s-cname.tld2s +dnssec		# 28 DNSSEC too early in CNAME chain
+  nochange a0-1-scname.tld2  +dnssec		# 29 DNSSEC on target in CNAME chain
+  nochange a0-1.tld2s srv +auth +dnssec		# 30 no write for DNSSEC and no record
+  nxdomain a0-1.tld2s srv +nodnssec		# 31
+  drop a3-8.tld2 any				# 32 drop
+  nochange tcp a3-9.tld2			# 33 tcp-only
+  here x.servfail <<'EOF'			# 34 qname-wait-recurse yes
    ;; status: SERVFAIL, x
 EOF
-  addr 35.35.35.35 "x.servfail @$ns5"	# 35 qname-wait-recurse no
+  addr 35.35.35.35 "x.servfail @$ns5"		# 35 qname-wait-recurse no
  end_group
  ckstats $ns3 test1 ns3 22
  ckstats $ns5 test1 ns5 1
  ckstats $ns6 test1 ns6 0

  start_group "NXDOMAIN/NODATA action on QNAME trigger" test1
-  nxdomain a0-1.tld2 @$ns6		   # 1
-  nodata a3-1.tld2 @$ns6			   # 2
-  nodata a3-2.tld2 @$ns6			   # 3 nodata at DNAME itself
-  nxdomain a4-2.tld2 @$ns6		   # 4 rewrite based on CNAME target
-  nxdomain a4-2-cname.tld2 @$ns6		   # 5
-  nodata a4-3-cname.tld2 @$ns6		   # 6
-  addr 12.12.12.12  "a4-1.sub1.tld2 @$ns6"   # 7 A replacement
-  addr 12.12.12.12  "a4-1.sub2.tld2 @$ns6"   # 8 A replacement with wildcard
-  addr 127.4.4.1    "a4-4.tld2 @$ns6"	   # 9 prefer 1st conflicting QNAME zone
-  addr 12.12.12.12  "nxc1.sub1.tld2 @$ns6"   # 10 replace NXDOMAIN w/ CNAME
-  addr 12.12.12.12  "nxc2.sub1.tld2 @$ns6"   # 11 replace NXDOMAIN w/ CNAME chain
-  addr 127.6.2.1    "a6-2.tld2 @$ns6"	   # 12
-  addr 56.56.56.56  "a3-6.tld2 @$ns6"	   # 13 wildcard CNAME
-  addr 57.57.57.57  "a3-7.sub1.tld2 @$ns6"   # 14 wildcard CNAME
-  addr 127.0.0.16   "a4-5-cname3.tld2 @$ns6" # 15 CNAME chain
-  addr 127.0.0.17   "a4-6-cname3.tld2 @$ns6" # 16 stop short in CNAME chain
-  nxdomain c1.crash2.tld3 @$ns6		   # 17 assert in rbtdb.c
-  nxdomain a0-1.tld2 +dnssec @$ns6	   # 18 simple DO=1 without sigs
-  nxdomain a0-1s-cname.tld2s  +dnssec @$ns6  # 19
-  drop a3-8.tld2 any @$ns6		   # 20 drop
+  nxdomain a0-1.tld2 @$ns6			# 1
+  nodata a3-1.tld2 @$ns6			# 2
+  nodata a3-2.tld2 @$ns6			# 3 nodata at DNAME itself
+  nxdomain a4-2.tld2 @$ns6			# 4 rewrite based on CNAME target
+  nxdomain a4-2-cname.tld2 @$ns6		# 5
+  nodata a4-3-cname.tld2 @$ns6			# 6
+  addr 12.12.12.12  "a4-1.sub1.tld2 @$ns6"	# 7 A replacement
+  addr 12.12.12.12  "a4-1.sub2.tld2 @$ns6"	# 8 A replacement with wildcard
+  addr 127.4.4.1    "a4-4.tld2 @$ns6"		# 9 prefer 1st conflicting QNAME zone
+  addr 12.12.12.12  "nxc1.sub1.tld2 @$ns6"	# 10 replace NXDOMAIN w/ CNAME
+  addr 12.12.12.12  "nxc2.sub1.tld2 @$ns6"	# 11 replace NXDOMAIN w/ CNAME chain
+  addr 127.6.2.1    "a6-2.tld2 @$ns6"		# 12
+  addr 56.56.56.56  "a3-6.tld2 @$ns6"		# 13 wildcard CNAME
+  addr 57.57.57.57  "a3-7.sub1.tld2 @$ns6"	# 14 wildcard CNAME
+  addr 127.0.0.16   "a4-5-cname3.tld2 @$ns6"	# 15 CNAME chain
+  addr 127.0.0.17   "a4-6-cname3.tld2 @$ns6"	# 16 stop short in CNAME chain
+  nxdomain c1.crash2.tld3 @$ns6			# 17 assert in rbtdb.c
+  nxdomain a0-1.tld2 +dnssec @$ns6		# 18 simple DO=1 without sigs
+  nxdomain a0-1s-cname.tld2s  +dnssec @$ns6	# 19
+  drop a3-8.tld2 any @$ns6			# 20 drop
  end_group
  ckstatsrange $ns3 test1 ns3 22 30
  ckstats $ns5 test1 ns5 0
  ckstats $ns6 test1 ns6 0

  start_group "IP rewrites" test2
-  nodata a3-1.tld2			# 1 NODATA
-  nochange a3-2.tld2			# 2 no policy record so no change
-  nochange a4-1.tld2			# 3 obsolete PASSTHRU record style
-  nxdomain a4-2.tld2			# 4
-  nochange a4-2.tld2 -taaaa		# 5 no A => no policy rewrite
-  nochange a4-2.tld2 -ttxt		# 6 no A => no policy rewrite
-  nxdomain a4-2.tld2 -tany		# 7 no A => no policy rewrite
-  nodata a4-3.tld2			# 8
-  nxdomain a3-1.tld2 -taaaa		# 9 IPv6 policy
-  nochange a4-1-aaaa.tld2 -taaaa	# 10
-  addr 127.0.0.1	 a5-1-2.tld2	# 11 prefer smallest policy address
-  addr 127.0.0.1	 a5-3.tld2	# 12 prefer first conflicting IP zone
-  nochange a5-4.tld2	    +norecurse	# 13 check that RD=1 is required for #14
-  addr 14.14.14.14 a5-4.tld2		# 14 prefer QNAME to IP
-  nochange a4-4.tld2			# 15 PASSTHRU
-  nxdomain c2.crash2.tld3		# 16 assert in rbtdb.c
-  addr 127.0.0.17 "a4-4.tld2 -b $ns1"	# 17 client-IP address trigger
-  nxdomain a7-1.tld2			# 18 slave policy zone (RT34450)
+  nodata a3-1.tld2				# 1 NODATA
+  nochange a3-2.tld2				# 2 no policy record so no change
+  nochange a4-1.tld2				# 3 obsolete PASSTHRU record style
+  nxdomain a4-2.tld2				# 4
+  nochange a4-2.tld2 -taaaa			# 5 no A => no policy rewrite
+  nochange a4-2.tld2 -ttxt			# 6 no A => no policy rewrite
+  nxdomain a4-2.tld2 -tany			# 7 no A => no policy rewrite
+  nodata a4-3.tld2				# 8
+  nxdomain a3-1.tld2 -taaaa			# 9 IPv6 policy
+  nochange a4-1-aaaa.tld2 -taaaa		# 10
+  addr 127.0.0.1 a5-1-2.tld2			# 11 prefer smallest policy address
+  addr 127.0.0.1 a5-3.tld2			# 12 prefer first conflicting IP zone
+  nochange a5-4.tld2 +norecurse			# 13 check that RD=1 is required for #14
+  addr 14.14.14.14 a5-4.tld2			# 14 prefer QNAME to IP
+  nochange a4-4.tld2				# 15 PASSTHRU
+  nxdomain c2.crash2.tld3			# 16 assert in rbtdb.c
+  addr 127.0.0.17 "a4-4.tld2 -b $ns1"		# 17 client-IP address trigger
+  nxdomain a7-1.tld2				# 18 slave policy zone (RT34450)
+  # updating an response zone policy
  cp ns2/blv2.tld2.db.in ns2/bl.tld2.db
  rndc_reload ns2 $ns2 bl.tld2
  ck_soa 2 bl.tld2 $ns3
-  nochange a7-1.tld2			# 19 PASSTHRU
-  sleep 1	# ensure that a clock tick has occured so that named will do the reload
+  nochange a7-1.tld2				# 19 PASSTHRU
+  # ensure that a clock tick has occured so that named will do the reload
+  sleep 1
  cp ns2/blv3.tld2.db.in ns2/bl.tld2.db
  rndc_reload ns2 $ns2 bl.tld2
  ck_soa 3 bl.tld2 $ns3
-  nxdomain a7-1.tld2			# 20 slave policy zone (RT34450)
+  nxdomain a7-1.tld2				# 20 slave policy zone (RT34450)
  end_group
  ckstats $ns3 test2 ns3 12

@@ -572,20 +592,20 @@ EOF

  # these tests assume "min-ns-dots 0"
  start_group "NSDNAME rewrites" test3
-  nochange a3-1.tld2			# 1
-  nochange a3-1.tld2	    +dnssec	# 2 this once caused problems
+  nochange a3-1.tld2				# 1
+  nochange a3-1.tld2 +dnssec			# 2 this once caused problems
  nxdomain a3-1.sub1.tld2			# 3 NXDOMAIN *.sub1.tld2 by NSDNAME
-  nxdomain a3-1.subsub.sub1.tld2
-  nxdomain a3-1.subsub.sub1.tld2 -tany
+  nxdomain a3-1.subsub.sub1.tld2		# 4
+  nxdomain a3-1.subsub.sub1.tld2 -tany		# 5
  addr 12.12.12.12 a4-2.subsub.sub2.tld2	# 6 walled garden for *.sub2.tld2
-  nochange a3-2.tld2.			# 7 exempt rewrite by name
-  nochange a0-1.tld2.			# 8 exempt rewrite by address block
-  addr 12.12.12.12 a4-1.tld2		# 9 prefer QNAME policy to NSDNAME
-  addr 127.0.0.1 a3-1.sub3.tld2		# 10 prefer policy for largest NSDNAME
-  addr 127.0.0.2 a3-1.subsub.sub3.tld2
-  nxdomain xxx.crash1.tld2		# 12 dns_db_detachnode() crash
+  nochange a3-2.tld2.				# 7 exempt rewrite by name
+  nochange a0-1.tld2.				# 8 exempt rewrite by address block
+  addr 12.12.12.12 a4-1.tld2			# 9 prefer QNAME policy to NSDNAME
+  addr 127.0.0.1 a3-1.sub3.tld2			# 10 prefer policy for largest NSDNAME
+  addr 127.0.0.2 a3-1.subsub.sub3.tld2		# 11
+  nxdomain xxx.crash1.tld2			# 12 dns_db_detachnode() crash
  if [ "$mode" = dnsrps ]; then
-    addr 12.12.12.12 as-ns.tld5.	# 13 qname-as-ns
+    addr 12.12.12.12 as-ns.tld5.		# 13 qname-as-ns
  fi
  end_group
  if [ "$mode" = dnsrps ]; then
@@ -596,19 +616,19 @@ EOF

  # these tests assume "min-ns-dots 0"
  start_group "NSIP rewrites" test4
-  nxdomain a3-1.tld2			# 1 NXDOMAIN for all of tld2
-  nochange a3-2.tld2.			# 2 exempt rewrite by name
-  nochange a0-1.tld2.			# 3 exempt rewrite by address block
-  nochange a3-1.tld4			# 4 different NS IP address
+  nxdomain a3-1.tld2				# 1 NXDOMAIN for all of tld2
+  nochange a3-2.tld2.				# 2 exempt rewrite by name
+  nochange a0-1.tld2.				# 3 exempt rewrite by address block
+  nochange a3-1.tld4				# 4 different NS IP address
  if [ "$mode" = dnsrps ]; then
-      addr 12.12.12.12 as-ns.tld5.	# 5 ip-as-ns
+      addr 12.12.12.12 as-ns.tld5.		# 5 ip-as-ns
  fi
  end_group

  start_group "walled garden NSIP rewrites" test4a
-  addr 41.41.41.41 a3-1.tld2		# 1 walled garden for all of tld2
-  addr 2041::41   'a3-1.tld2 AAAA'	# 2 walled garden for all of tld2
-  here a3-1.tld2 TXT <<'EOF'		# 3 text message for all of tld2
+  addr 41.41.41.41 a3-1.tld2			# 1 walled garden for all of tld2
+  addr 2041::41   'a3-1.tld2 AAAA'		# 2 walled garden for all of tld2
+  here a3-1.tld2 TXT <<'EOF'			# 3 text message for all of tld2
    ;; status: NOERROR, x
    a3-1.tld2.	    x	IN	TXT   "NSIP walled garden"
 EOF
@@ -620,30 +640,30 @@ EOF
  fi

  # policies in ./test5 overridden by response-policy{} in ns3/named.conf
-  #   and in ns5/named.conf
+  # and in ns5/named.conf
  start_group "policy overrides" test5
-  addr 127.0.0.1 a3-1.tld2		# 1 bl-given
-  nochange a3-2.tld2			# 2 bl-passthru
-  nochange a3-3.tld2			# 3 bl-no-op	obsolete for passthru
-  nochange a3-4.tld2			# 4 bl-disabled
-  nodata a3-5.tld2			# 5 bl-nodata	zone recursive-only no
-  nodata a3-5.tld2    +norecurse		# 6 bl-nodata	zone recursive-only no
-  nodata a3-5.tld2			# 7 bl-nodata		not needed
-  nxdomain a3-5.tld2  +norecurse	@$ns5	# 8 bl-nodata	global recursive-only no
-  nxdomain a3-5.tld2s		@$ns5	# 9 bl-nodata	global break-dnssec
-  nxdomain a3-5.tld2s +dnssec	@$ns5	# 10 bl-nodata	global break-dnssec
-  nxdomain a3-6.tld2			# 11 bl-nxdomain
-  here a3-7.tld2 -tany <<'EOF'
+  addr 127.0.0.1 a3-1.tld2			# 1 bl-given
+  nochange a3-2.tld2				# 2 bl-passthru
+  nochange a3-3.tld2				# 3 bl-no-op (obsolete for passthru)
+  nochange a3-4.tld2				# 4 bl-disabled
+  nodata a3-5.tld2				# 5 bl-nodata zone recursive-only no
+  nodata a3-5.tld2 +norecurse			# 6 bl-nodata zone recursive-only no
+  nodata a3-5.tld2				# 7 bl-nodata not needed
+  nxdomain a3-5.tld2 +norecurse @$ns5		# 8 bl-nodata global recursive-only no
+  nxdomain a3-5.tld2s @$ns5			# 9 bl-nodata global break-dnssec
+  nxdomain a3-5.tld2s +dnssec @$ns5		# 10 bl-nodata global break-dnssec
+  nxdomain a3-6.tld2				# 11 bl-nxdomain
+  here a3-7.tld2 -tany <<'EOF'			# 12
    ;; status: NOERROR, x
    a3-7.tld2.	    x	IN	CNAME   txt-only.tld2.
    txt-only.tld2.  x	IN	TXT     "txt-only-tld2"
 EOF
-  addr 58.58.58.58 a3-8.tld2		# 13 bl_wildcname
+  addr 58.58.58.58 a3-8.tld2			# 13 bl_wildcname
  addr 59.59.59.59 a3-9.sub9.tld2		# 14 bl_wildcname
-  addr 12.12.12.12 a3-15.tld2		# 15 bl-garden	via CNAME to a12.tld2
-  addr 127.0.0.16 a3-16.tld2	    100	# 16 bl		    max-policy-ttl 100
-  addr 17.17.17.17 "a3-17.tld2 @$ns5" 90	# 17 ns5 bl	    max-policy-ttl 90
-  drop a3-18.tld2 any			# 18 bl-drop
+  addr 12.12.12.12 a3-15.tld2			# 15 bl-garden via CNAME to a12.tld2
+  addr 127.0.0.16 a3-16.tld2 100		# 16 bl	max-policy-ttl 100
+  addr 17.17.17.17 "a3-17.tld2 @$ns5" 90	# 17 ns5 bl max-policy-ttl 90
+  drop a3-18.tld2 any				# 18 bl-drop
  nxdomain TCP a3-19.tld2			# 19 bl-tcp-only
  end_group
  ckstats $ns3 test5 ns3 12
@@ -666,7 +686,6 @@ EOF
  end_group
  ckstats $ns3 bugs ns3 8

-
  # superficial test for major performance bugs
  QPERF=`sh qperf.sh`
  if test -n "$QPERF"; then
@@ -742,7 +761,7 @@ EOF
  # restart the main test RPZ server to see if that creates a core file
  if test -z "$HAVE_CORE"; then
    $PERL $SYSTEMTESTTOP/stop.pl --use-rndc --port ${CONTROLPORT} rpz ns3
-    restart 3
+    restart 3 "rebuild-bl-rpz"
    HAVE_CORE=`find ns* -name '*core*' -print`
    test -z "$HAVE_CORE" || setret "found $HAVE_CORE; memory leak?"
  fi
@@ -757,6 +776,28 @@ EOF
    fi
  done

+  # restart the main test RPZ server with a bad zone.
+  t=`expr $t + 1`
+  echo_i "checking that ns3 with broken rpz does not crash (${t})"
+  $PERL $SYSTEMTESTTOP/stop.pl --use-rndc --port ${CONTROLPORT} rpz ns3
+  cp ns3/broken.db.in ns3/bl.db
+  restart 3 # do not rebuild rpz zones
+  nocrash a3-1.tld2 -tA
+  $PERL $SYSTEMTESTTOP/stop.pl --use-rndc --port ${CONTROLPORT} rpz ns3
+  restart 3 "rebuild-bl-rpz"
+
+  # reload a RPZ zone that is now deliberately broken.
+  t=`expr $t + 1`
+  echo_i "checking rpz failed update will keep previous rpz rules (${t})"
+  $DIG -p ${PORT} @$ns3 walled.tld2 > dig.out.$t.before
+  grep "walled\.tld2\..*IN.*A.*10\.0\.0\.1" dig.out.$t.before > /dev/null || setret "failed"
+  cp ns3/broken.db.in ns3/manual-update-rpz.db
+  rndc_reload ns3 $ns3 manual-update-rpz
+  sleep 1
+  # ensure previous RPZ rules still apply.
+  $DIG -p ${PORT} @$ns3 walled.tld2 > dig.out.$t.after
+  grep "walled\.tld2\..*IN.*A.*10\.0\.0\.1" dig.out.$t.after > /dev/null || setret "failed"
+
  t=`expr $t + 1`
  echo_i "checking that ttl values are not zeroed when qtype is '*' (${t})"
  $DIG +noall +answer -p ${PORT} @$ns3 any a3-2.tld2 > dig.out.$t
@@ -60,7 +60,7 @@
 /* Define if clock_gettime is available. */
 #undef HAVE_CLOCK_GETTIME

-/* Use cmocka */
+/* Use CMocka */
 #undef HAVE_CMOCKA

 /* Define to 1 if you have the `cpuset_setaffinity' function. */
@@ -1,6 +1,6 @@
 #! /bin/sh
 # Guess values for system-dependent variables and create Makefiles.
-# Generated by GNU Autoconf 2.69 for BIND 9.13.
+# Generated by GNU Autoconf 2.69 for BIND 9.14.
 #
 # Report bugs to <info@isc.org>.
 #
@@ -589,8 +589,8 @@ MAKEFLAGS=
 # Identity of this package.
 PACKAGE_NAME='BIND'
 PACKAGE_TARNAME='bind'
-PACKAGE_VERSION='9.13'
-PACKAGE_STRING='BIND 9.13'
+PACKAGE_VERSION='9.14'
+PACKAGE_STRING='BIND 9.14'
 PACKAGE_BUGREPORT='info@isc.org'
 PACKAGE_URL='https://www.isc.org/downloads/BIND/'

@@ -1501,7 +1501,7 @@ if test "$ac_init_help" = "long"; then
  # Omit some internal or obsolete options to make the list less imposing.
  # This message is too long to be a string in the A/UX 3.1 sh.
  cat <<_ACEOF
-\`configure' configures BIND 9.13 to adapt to many kinds of systems.
+\`configure' configures BIND 9.14 to adapt to many kinds of systems.

 Usage: $0 [OPTION]... [VAR=VALUE]...

@@ -1566,7 +1566,7 @@ fi

 if test -n "$ac_init_help"; then
  case $ac_init_help in
-     short | recursive ) echo "Configuration of BIND 9.13:";;
+     short | recursive ) echo "Configuration of BIND 9.14:";;
   esac
  cat <<\_ACEOF

@@ -1770,7 +1770,7 @@ fi
 test -n "$ac_init_help" && exit $ac_status
 if $ac_init_version; then
  cat <<\_ACEOF
-BIND configure 9.13
+BIND configure 9.14
 generated by GNU Autoconf 2.69

 Copyright (C) 2012 Free Software Foundation, Inc.
@@ -2193,7 +2193,7 @@ cat >config.log <<_ACEOF
 This file contains any messages produced by compilers while
 running configure, to aid debugging if configure makes a mistake.

-It was created by BIND $as_me 9.13, which was
+It was created by BIND $as_me 9.14, which was
 generated by GNU Autoconf 2.69.  Invocation command line was

  $ $0 $@
@@ -21995,7 +21995,7 @@ cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1
 # report actual input values of CONFIG_FILES etc. instead of their
 # values after options handling.
 ac_log="
-This file was extended by BIND $as_me 9.13, which was
+This file was extended by BIND $as_me 9.14, which was
 generated by GNU Autoconf 2.69.  Invocation command line was

  CONFIG_FILES    = $CONFIG_FILES
@@ -22062,7 +22062,7 @@ _ACEOF
 cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1
 ac_cs_config="`$as_echo "$ac_configure_args" | sed 's/^ //; s/[\\""\`\$]/\\\\&/g'`"
 ac_cs_version="\\
-BIND config.status 9.13
+BIND config.status 9.14
 configured by $0, generated by GNU Autoconf 2.69,
  with options \\"\$ac_cs_config\\"

@@ -7,7 +7,7 @@
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.

-AC_INIT(BIND, [9.13], [info@isc.org], [], [https://www.isc.org/downloads/BIND/])
+AC_INIT(BIND, [9.14], [info@isc.org], [], [https://www.isc.org/downloads/BIND/])
 AC_PREREQ([2.60])

 AC_CONFIG_HEADER(config.h)
@@ -75,7 +75,7 @@
        <acronym class="acronym">BIND</acronym> version 9 software package for
        system administrators.
      </p>
-      <p>This version of the manual corresponds to BIND version 9.13.</p>
+      <p>This version of the manual corresponds to BIND version 9.14.</p>
    </div>

    <div class="section">
@@ -614,6 +614,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.13.6 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.14.0rc1 (Stable Release)</p>
 </body>
 </html>
@@ -146,6 +146,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.13.6 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.14.0rc1 (Stable Release)</p>
 </body>
 </html>
@@ -856,6 +856,6 @@ controls {
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.13.6 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.14.0rc1 (Stable Release)</p>
 </body>
 </html>
@@ -2863,6 +2863,6 @@ $ORIGIN 0.0.0.0.0.0.0.0.8.b.d.0.1.0.0.2.ip6.arpa.
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.13.6 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.14.0rc1 (Stable Release)</p>
 </body>
 </html>
@@ -11219,6 +11219,20 @@ view external {
                    </td>
 </tr>
 <tr>
+<td>
+                      <p>
+                        AMTRELAY
+                      </p>
+                    </td>
+<td>
+                      <p>
+                        Automatic Multicast Tunneling Relay
+                        discovery record.
+                        Work in progress draft-ietf-mboned-driad-amt-discovery.
+                      </p>
+                    </td>
+</tr>
+<tr>
 <td>
                      <p>
                        APL
@@ -12175,6 +12189,19 @@ view external {
                      </p>
                    </td>
 </tr>
+<tr>
+<td>
+                      <p>
+                        ZONEMD
+                      </p>
+                    </td>
+<td>
+                      <p>
+                        Zone Message Digest.
+                        Work in progress draft-wessels-dns-zone-digest.
+                      </p>
+                    </td>
+</tr>
 </tbody>
 </table>
            </div>
@@ -14804,6 +14831,6 @@ HOST-127.EXAMPLE. MX 0 .
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.13.6 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.14.0rc1 (Stable Release)</p>
 </body>
 </html>
@@ -361,6 +361,6 @@ allow-query { !{ !10/8; any; }; key example; };
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.13.6 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.14.0rc1 (Stable Release)</p>
 </body>
 </html>
@@ -191,6 +191,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.13.6 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.14.0rc1 (Stable Release)</p>
 </body>
 </html>
@@ -36,17 +36,15 @@
 <div class="toc">
 <p><b>Table of Contents</b></p>
 <dl class="toc">
-<dt><span class="section"><a href="Bv9ARM.ch08.html#id-1.9.2">Release Notes for BIND Version 9.13.6</a></span></dt>
+<dt><span class="section"><a href="Bv9ARM.ch08.html#id-1.9.2">Release Notes for BIND Version 9.14.0rc1</a></span></dt>
 <dd><dl>
 <dt><span class="section"><a href="Bv9ARM.ch08.html#relnotes_intro">Introduction</a></span></dt>
 <dt><span class="section"><a href="Bv9ARM.ch08.html#relnotes_versions">Note on Version Numbering</a></span></dt>
 <dt><span class="section"><a href="Bv9ARM.ch08.html#relnotes_platforms">Supported Platforms</a></span></dt>
 <dt><span class="section"><a href="Bv9ARM.ch08.html#relnotes_download">Download</a></span></dt>
-<dt><span class="section"><a href="Bv9ARM.ch08.html#relnotes_security">Security Fixes</a></span></dt>
 <dt><span class="section"><a href="Bv9ARM.ch08.html#relnotes_features">New Features</a></span></dt>
 <dt><span class="section"><a href="Bv9ARM.ch08.html#relnotes_removed">Removed Features</a></span></dt>
 <dt><span class="section"><a href="Bv9ARM.ch08.html#relnotes_changes">Feature Changes</a></span></dt>
-<dt><span class="section"><a href="Bv9ARM.ch08.html#relnotes_bugs">Bug Fixes</a></span></dt>
 <dt><span class="section"><a href="Bv9ARM.ch08.html#relnotes_license">License</a></span></dt>
 <dt><span class="section"><a href="Bv9ARM.ch08.html#end_of_life">End of Life</a></span></dt>
 <dt><span class="section"><a href="Bv9ARM.ch08.html#relnotes_thanks">Thank You</a></span></dt>
@@ -55,17 +53,22 @@
 </div>
      <div class="section">
 <div class="titlepage"><div><div><h2 class="title" style="clear: both">
-<a name="id-1.9.2"></a>Release Notes for BIND Version 9.13.6</h2></div></div></div>
+<a name="id-1.9.2"></a>Release Notes for BIND Version 9.14.0rc1</h2></div></div></div>
  
  <div class="section">
 <div class="titlepage"><div><div><h3 class="title">
 <a name="relnotes_intro"></a>Introduction</h3></div></div></div>
    <p>
-      BIND 9.13 is an unstable development release of BIND.
-      This document summarizes new features and functional changes that
-      have been introduced on this branch.  With each development release
-      leading up to the stable BIND 9.14 release, this document will be
-      updated with additional features added and bugs fixed.
+      BIND 9.14.0 is the first release of a new stable branch of BIND.
+      This document summarizes new features and functional changes
+      that have been introduced, as well as features that have been
+      deprecated or removed, since the last stable branch, 9.12.
+    </p>
+<p>
+    </p>
+<p>
+      Please see the file <code class="filename">CHANGES</code> for a more
+      detailed list of changes and bug fixes.
    </p>
  </div>

@@ -73,23 +76,11 @@
 <div class="titlepage"><div><div><h3 class="title">
 <a name="relnotes_versions"></a>Note on Version Numbering</h3></div></div></div>
    <p>
-      Prior to BIND 9.13, new feature development releases were tagged
-      as "alpha" and "beta", leading up to the first stable release
-      for a given development branch, which always ended in ".0".
-    </p>
-    <p>
-      Now, however, BIND has adopted the "odd-unstable/even-stable"
-      release numbering convention. There will be no "alpha" or "beta"
-      releases in the 9.13 branch, only increasing version numbers.
-      So, for example, what would previously have been called 9.13.0a1,
-      9.13.0a2, 9.13.0b1, and so on, will instead be called 9.13.0,
-      9.13.1, 9.13.2, etc.
-    </p>
-    <p>
-      The first stable release from this development branch will be
-      renamed as 9.14.0. Thereafter, maintenance releases will continue
-      on the 9.14 branch, while unstable feature development proceeds in
-      9.15.
+      As of BIND 9.13/9.14, BIND has adopted the "odd-unstable/even-stable"
+      release numbering convention.  BIND 9.14 contains new features added
+      during the BIND 9.13 development process. Henceforth, the 9.14 branch
+      will be limited to bug fixes and new feature development will proceed
+      in the unstable 9.15 branch, and so forth.
    </p>
  </div>

@@ -97,12 +88,15 @@
 <div class="titlepage"><div><div><h3 class="title">
 <a name="relnotes_platforms"></a>Supported Platforms</h3></div></div></div>
    <p>
-      BIND 9.13 has undergone substantial code refactoring and cleanup,
-      and some very old code has been removed that was needed to support
-      legacy platforms which are no longer supported by their vendors
-      and for which ISC is no longer able to perform quality assurance
-      testing.  Specifically, workarounds for old versions of UnixWare,
-      BSD/OS, AIX, Tru64, SunOS, TruCluster and IRIX have been removed.
+      Since 9.12, BIND has undergone substantial code refactoring and
+      cleanup, and some very old code has been removed that was needed
+      to support legacy platforms which are no longer supported by their
+      vendors and for which ISC is no longer able to perform quality
+      assurance testing.  Specifically, workarounds for old versions of
+      UnixWare, BSD/OS, AIX, Tru64, SunOS, TruCluster and IRIX have been
+      removed.
+    </p>
+    <p>
      On UNIX-like systems, BIND now requires support for POSIX.1c
      threads (IEEE Std 1003.1c-1995), the Advanced Sockets API for
      IPv6 (RFC 3542), and standard atomic operations provided by the
@@ -117,7 +111,7 @@
      for systems that are still supported by their respective vendors.
    </p>
    <p>
-      As of BIND 9.13, the BIND development team has also made cryptography
+      As of BIND 9.14, the BIND development team has also made cryptography
      (i.e., TSIG and DNSSEC) an integral part of the DNS server.  The
      OpenSSL cryptography library must be available for the target
      platform.  A PKCS#11 provider can be used instead for Public Key
@@ -141,58 +135,6 @@

  <div class="section">
 <div class="titlepage"><div><div><h3 class="title">
-<a name="relnotes_security"></a>Security Fixes</h3></div></div></div>
-    <div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; ">
-<li class="listitem">
-        <p>
-          There was a long-existing flaw in the documentation for
-          <span class="command"><strong>ms-self</strong></span>, <span class="command"><strong>krb5-self</strong></span>,
-          <span class="command"><strong>ms-subdomain</strong></span>, and <span class="command"><strong>krb5-subdomain</strong></span>
-          rules in <span class="command"><strong>update-policy</strong></span> statements.  Though
-          the policies worked as intended, operators who configured their
-          servers according to the misleading documentation may have
-          thought zone updates were more restricted than they were;
-          users of these rule types are advised to review the documentation
-          and correct their configurations if necessary.  New rule types
-          matching the previously documented behavior will be introduced
-          in a future maintenance release. [GL !708]
-        </p>
-      </li>
-<li class="listitem">
-	<p>
-	  When recursion is enabled but the <span class="command"><strong>allow-recursion</strong></span>
-	  and <span class="command"><strong>allow-query-cache</strong></span> ACLs are not specified, they
-	  should be limited to local networks, but they were inadvertently set
-	  to match the default <span class="command"><strong>allow-query</strong></span>, thus allowing
-	  remote queries. This flaw is disclosed in CVE-2018-5738. [GL #309]
-	</p>
-      </li>
-<li class="listitem">
-	<p>
-	  <span class="command"><strong>named</strong></span> could crash during recursive processing
-	  of DNAME records when <span class="command"><strong>deny-answer-aliases</strong></span> was
-	  in use. This flaw is disclosed in CVE-2018-5740. [GL #387]
-	</p>
-      </li>
-<li class="listitem">
-	<p>
-	  Code change #4964, intended to prevent double signatures
-	  when deleting an inactive zone DNSKEY in some situations,
-	  introduced a new problem during zone processing in which
-	  some delegation glue RRsets are incorrectly identified
-	  as needing RRSIGs, which are then created for them using
-	  the current active ZSK for the zone. In some, but not all
-	  cases, the newly-signed RRsets are added to the zone's
-	  NSEC/NSEC3 chain, but incompletely -- this can result in
-	  a broken chain, affecting validation of proof of nonexistence
-	  for records in the zone. [GL #771]
-	</p>
-      </li>
-</ul></div>
-  </div>
-
-  <div class="section">
-<div class="titlepage"><div><div><h3 class="title">
 <a name="relnotes_features"></a>New Features</h3></div></div></div>
    <div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; ">
 <li class="listitem">
@@ -206,15 +148,11 @@
      </li>
 <li class="listitem">
 	<p>
-	  A new secondary zone option, <span class="command"><strong>mirror</strong></span>,
-	  enables <span class="command"><strong>named</strong></span> to serve a transferred copy
-	  of a zone's contents without acting as an authority for the
-	  zone. A zone must be fully validated against an active trust
-	  anchor before it can be used as a mirror zone. DNS responses
-	  from mirror zones do not set the AA bit ("authoritative answer"),
-	  but do set the AD bit ("authenticated data"). This feature is
-	  meant to facilitate deployment of a local copy of the root zone,
-	  as described in RFC 7706. [GL #33]
+	  Support for QNAME minimization was added and enabled by default
+	  in <span class="command"><strong>relaxed</strong></span> mode, in which BIND will fall back
+	  to normal resolution if the remote server returns something
+	  unexpected during the query minimization process. This default
+	  setting might change to <span class="command"><strong>strict</strong></span> in the future.
 	</p>
      </li>
 <li class="listitem">
@@ -230,6 +168,19 @@
 	  as further plugins are implemented. [GL #15]
 	</p>
      </li>
+<li class="listitem">
+	<p>
+	  A new secondary zone option, <span class="command"><strong>mirror</strong></span>,
+	  enables <span class="command"><strong>named</strong></span> to serve a transferred copy
+	  of a zone's contents without acting as an authority for the
+	  zone. A zone must be fully validated against an active trust
+	  anchor before it can be used as a mirror zone. DNS responses
+	  from mirror zones do not set the AA bit ("authoritative answer"),
+	  but do set the AD bit ("authenticated data"). This feature is
+	  meant to facilitate deployment of a local copy of the root zone,
+	  as described in RFC 7706. [GL #33]
+	</p>
+      </li>
 <li class="listitem">
 	<p>
 	  BIND now can be compiled against the <span class="command"><strong>libidn2</strong></span>
@@ -256,15 +207,6 @@
 	  signatures covering DNSKEY RRsets. [GL #145]
 	</p>
      </li>
-<li class="listitem">
-	<p>
-	  Support for QNAME minimization was added and enabled by default
-	  in <span class="command"><strong>relaxed</strong></span> mode, in which BIND will fall back
-	  to normal resolution if the remote server returns something
-	  unexpected during the query minimization process. This default
-	  setting might change to <span class="command"><strong>strict</strong></span> in the future.
-	</p>
-      </li>
 <li class="listitem">
 	<p>
 	  When built on Linux, BIND now requires the <span class="command"><strong>libcap</strong></span>
@@ -319,6 +261,22 @@
          configuration is being reloaded.
        </p>
      </li>
+<li class="listitem">
+	<p>
+	  The new <span class="command"><strong>answer-cookie</strong></span> option, if set to
+	  <code class="literal">no</code>, prevents <span class="command"><strong>named</strong></span> from
+	  returning a DNS COOKIE option to a client, even if such an
+	  option was present in the request.  This is only intended as
+	  a temporary measure, for use when <span class="command"><strong>named</strong></span>
+	  shares an IP address with other servers that do not yet
+	  support DNS COOKIE.  A mismatch between servers on the same
+	  address is not expected to cause operational problems, but the
+	  option to disable COOKIE responses so that all servers have the
+	  same behavior is provided out of an abundance of caution.
+	  DNS COOKIE is an important security mechanism, and this option
+	  should not be used to disable it unless absolutely necessary.
+	</p>
+      </li>
 </ul></div>
  </div>

@@ -463,51 +421,43 @@
      </li>
 <li class="listitem">
 	<p>
-	  Support for ECC-GOST (GOST R 34.11-94) algorithm has been
-	  removed from BIND as the algorithm has been superseded by
-	  GOST R 34.11-2012 in RFC6986 and it must not be used in new
-	  deployments.  BIND will neither create new DNSSEC keys,
-	  signatures and digest, nor it will validate them.
+	  Support for the RSAMD5 algorithm has been removed freom BIND as
+	  the usage of the RSAMD5 algorithm for DNSSEC has been deprecated
+	  in RFC6725, the security of the MD5 algorithm has been compromised,
+	  and its usage is considered harmful.
 	</p>
      </li>
 <li class="listitem">
 	<p>
-	  Add the ability to not return a DNS COOKIE option when one
-	  is present in the request.  To prevent a cookie being returned
-	  add 'answer-cookie no;' to named.conf. [GL #173]
-	</p>
-	<p>
-	  <span class="command"><strong>answer-cookie</strong></span> is only intended as a temporary
-	  measure, for use when <span class="command"><strong>named</strong></span> shares an IP address
-	  with other servers that do not yet support DNS COOKIE.  A mismatch
-	  between servers on the same address is not expected to cause
-	  operational problems, but the option to disable COOKIE responses so
-	  that all servers have the same behavior is provided out of an
-	  abundance of caution. DNS COOKIE is an important security mechanism,
-	  and should not be disabled unless absolutely necessary.
-	</p>
-	<p>
-	  Remove support for silently ignoring 'no-change' deltas from
-	  BIND 8 when processing an IXFR stream.  'no-change' deltas
-	  will now trigger a fallback to AXFR as the recovery mechanism.
-	</p>
-	<p>
-	  BIND 9 will no longer build on platforms that doesn't have
-	  proper IPv6 support.  BIND 9 now also requires non-broken
-	  POSIX-compatible pthread support.  Such platforms are
-	  usually long after their end-of-life date and they are
-	  neither developed nor supported by their respective vendors.
+	  Support for the ECC-GOST (GOST R 34.11-94) algorithm has been
+	  removed from BIND, as the algorithm has been superseded by
+	  GOST R 34.11-2012 in RFC6986 and it must not be used in new
+	  deployments.  BIND will neither create new DNSSEC keys,
+	  signatures and digests, nor it will validate them.
 	</p>
+      </li>
+<li class="listitem">
 	<p>
 	  Support for DSA and DSA-NSEC3-SHA1 algorithms has been
 	  removed from BIND as the DSA key length is limited to 1024
 	  bits and this is not considered secure enough.
 	</p>
+      </li>
+<li class="listitem">
 	<p>
-	  Support for RSAMD5 algorithm has been removed freom BIND as the usage
-	  of the RSAMD5 algorithm for DNSSEC has been deprecated in RFC6725 and
-	  the security of MD5 algorithm has been compromised and the its usage
-	  is considered harmful.
+	  <span class="command"><strong>named</strong></span> will no longer ignore "no-change" deltas
+	  when processing an IXFR stream.  This had previously been
+	  permitted for compatibility with BIND 8, but now "no-change"
+	  deltas will trigger a fallback to AXFR as the recovery mechanism.
+	</p>
+      </li>
+<li class="listitem">
+	<p>
+	  BIND 9 will no longer build on platforms that don't have
+	  proper IPv6 support.  BIND 9 now also requires POSIX-compatible
+	  pthread support.  Most of the platforms that lack these featuers
+	  are long past their end-of-lifew dates, and they are neither
+	  developed nor supported by their respective vendors.
 	</p>
      </li>
 <li class="listitem">
@@ -531,7 +481,7 @@
 	<p>
 	  BIND will now always use the best CSPRNG (cryptographically-secure
 	  pseudo-random number generator) available on the platform where
-	  it is compiled.  It will use <span class="command"><strong>arc4random()</strong></span>
+	  it is compiled.  It will use the <span class="command"><strong>arc4random()</strong></span>
 	  family of functions on BSD operating systems,
 	  <span class="command"><strong>getrandom()</strong></span> on Linux and Solaris,
 	  <span class="command"><strong>CryptGenRandom</strong></span> on Windows, and the selected
@@ -662,64 +612,6 @@

  <div class="section">
 <div class="titlepage"><div><div><h3 class="title">
-<a name="relnotes_bugs"></a>Bug Fixes</h3></div></div></div>
-    <div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; ">
-<li class="listitem">
-        <p>
-          Running <span class="command"><strong>rndc reconfig</strong></span> could cause
-          <span class="command"><strong>inline-signing</strong></span> zones to stop signing.
-	  [GL #439]
-        </p>
-      </li>
-<li class="listitem">
-        <p>
-          Reloading all zones caused zone maintenance to stop for
-          <span class="command"><strong>inline-signing</strong></span> zones. [GL #435]
-        </p>
-      </li>
-<li class="listitem">
-        <p>
-          Signatures loaded from the journal for the signed version
-          of an <span class="command"><strong>inline-signing</strong></span> zone were not scheduled
-	  for refresh. [GL #482]
-        </p>
-      </li>
-<li class="listitem">
-        <p>
-          A referral response with a non-empty ANSWER section was
-          incorrectly treated as an error; this caused certain domains
-          to be non-resolvable. [GL #390]
-        </p>
-      </li>
-<li class="listitem">
-	<p>
-	  When a negative trust anchor was added to multiple views
-	  using <span class="command"><strong>rndc nta</strong></span>, the text returned via
-	  <span class="command"><strong>rndc</strong></span> was incorrectly truncated after the
-	  first line, making it appear that only one NTA had been
-	  added. This has been fixed. [GL #105]
-	</p>
-      </li>
-<li class="listitem">
-	<p>
-	  The view name is now included in the output of
-	  <span class="command"><strong>rndc nta -dump</strong></span>, for consistency with
-	  other options. [GL !816]
-	</p>
-      </li>
-<li class="listitem">
-	<p>
-	  <span class="command"><strong>named</strong></span> now rejects excessively large
-	  incremental (IXFR) zone transfers in order to prevent
-	  possible corruption of journal files which could cause
-	  <span class="command"><strong>named</strong></span> to abort when loading zones. [GL #339]
-	</p>
-      </li>
-</ul></div>
-  </div>
-
-  <div class="section">
-<div class="titlepage"><div><div><h3 class="title">
 <a name="relnotes_license"></a>License</h3></div></div></div>
    <p>
      BIND is open source software licenced under the terms of the Mozilla
@@ -745,11 +637,6 @@
  <div class="section">
 <div class="titlepage"><div><div><h3 class="title">
 <a name="end_of_life"></a>End of Life</h3></div></div></div>
-    <p>
-      BIND 9.13 is an unstable development branch. When its development
-      is complete, it will be renamed to BIND 9.14, which will be a
-      stable branch.
-    </p>
    <p>
      The end of life date for BIND 9.14 has not yet been determined.
      For those needing long term support, the current Extended Support
@@ -790,6 +677,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.13.6 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.14.0rc1 (Stable Release)</p>
 </body>
 </html>
@@ -148,6 +148,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.13.6 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.14.0rc1 (Stable Release)</p>
 </body>
 </html>
@@ -914,6 +914,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.13.6 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.14.0rc1 (Stable Release)</p>
 </body>
 </html>
@@ -533,6 +533,6 @@ $ <strong class="userinput"><code>sample-update -a sample-update -k Kxxx.+nnn+mm
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.13.6 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.14.0rc1 (Stable Release)</p>
 </body>
 </html>
@@ -210,6 +210,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.13.6 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.14.0rc1 (Stable Release)</p>
 </body>
 </html>
@@ -32,7 +32,7 @@
 <div>
 <div><h1 class="title">
 <a name="id-1"></a>BIND 9 Administrator Reference Manual</h1></div>
-<div><p class="releaseinfo">BIND Version 9.13.6</p></div>
+<div><p class="releaseinfo">BIND Version 9.14.0rc1</p></div>
 <div><p class="copyright">Copyright © 2000-2019 Internet Systems Consortium, Inc. ("ISC")</p></div>
 </div>
 <hr>
@@ -242,17 +242,15 @@
 </dl></dd>
 <dt><span class="appendix"><a href="Bv9ARM.ch08.html">A. Release Notes</a></span></dt>
 <dd><dl>
-<dt><span class="section"><a href="Bv9ARM.ch08.html#id-1.9.2">Release Notes for BIND Version 9.13.6</a></span></dt>
+<dt><span class="section"><a href="Bv9ARM.ch08.html#id-1.9.2">Release Notes for BIND Version 9.14.0rc1</a></span></dt>
 <dd><dl>
 <dt><span class="section"><a href="Bv9ARM.ch08.html#relnotes_intro">Introduction</a></span></dt>
 <dt><span class="section"><a href="Bv9ARM.ch08.html#relnotes_versions">Note on Version Numbering</a></span></dt>
 <dt><span class="section"><a href="Bv9ARM.ch08.html#relnotes_platforms">Supported Platforms</a></span></dt>
 <dt><span class="section"><a href="Bv9ARM.ch08.html#relnotes_download">Download</a></span></dt>
-<dt><span class="section"><a href="Bv9ARM.ch08.html#relnotes_security">Security Fixes</a></span></dt>
 <dt><span class="section"><a href="Bv9ARM.ch08.html#relnotes_features">New Features</a></span></dt>
 <dt><span class="section"><a href="Bv9ARM.ch08.html#relnotes_removed">Removed Features</a></span></dt>
 <dt><span class="section"><a href="Bv9ARM.ch08.html#relnotes_changes">Feature Changes</a></span></dt>
-<dt><span class="section"><a href="Bv9ARM.ch08.html#relnotes_bugs">Bug Fixes</a></span></dt>
 <dt><span class="section"><a href="Bv9ARM.ch08.html#relnotes_license">License</a></span></dt>
 <dt><span class="section"><a href="Bv9ARM.ch08.html#end_of_life">End of Life</a></span></dt>
 <dt><span class="section"><a href="Bv9ARM.ch08.html#relnotes_thanks">Thank You</a></span></dt>
@@ -440,6 +438,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.13.6 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.14.0rc1 (Stable Release)</p>
 </body>
 </html>
@@ -90,6 +90,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.13.6 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.14.0rc1 (Stable Release)</p>
 </body>
 </html>
@@ -220,6 +220,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.13.6 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.14.0rc1 (Stable Release)</p>
 </body>
 </html>
@@ -625,6 +625,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.13.6 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.14.0rc1 (Stable Release)</p>
 </body>
 </html>
@@ -1151,6 +1151,6 @@ dig +qr www.isc.org any -x 127.0.0.1 isc.org ns +noqr
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.13.6 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.14.0rc1 (Stable Release)</p>
 </body>
 </html>
@@ -376,6 +376,6 @@ nsupdate -l
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.13.6 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.14.0rc1 (Stable Release)</p>
 </body>
 </html>
@@ -150,6 +150,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.13.6 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.14.0rc1 (Stable Release)</p>
 </body>
 </html>
@@ -270,6 +270,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.13.6 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.14.0rc1 (Stable Release)</p>
 </body>
 </html>
@@ -352,6 +352,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.13.6 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.14.0rc1 (Stable Release)</p>
 </body>
 </html>
@@ -250,6 +250,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.13.6 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.14.0rc1 (Stable Release)</p>
 </body>
 </html>
@@ -498,6 +498,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.13.6 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.14.0rc1 (Stable Release)</p>
 </body>
 </html>
@@ -568,6 +568,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.13.6 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.14.0rc1 (Stable Release)</p>
 </body>
 </html>
@@ -75,11 +75,12 @@
    </p>
    <p>
      DNSSEC policy can be read from a configuration file (default
-      <code class="filename">/etc/dnssec-policy.conf</code>), from which the key
-      parameters, publication and rollover schedule, and desired
-      coverage duration for any given zone can be determined.  This
+      <code class="filename">/etc/dnssec-policy.conf</code>), from which the
+      key parameters, publication and rollover schedule, and desired
+      coverage duration for any given zone can be determined. This
      file may be used to define individual DNSSEC policies on a
-      per-zone basis, or to set a default policy used for all zones.
+      per-zone basis, or to set a "<code class="literal">default</code>" policy
+      used for all zones.
    </p>
    <p>
      When <span class="command"><strong>dnssec-keymgr</strong></span> runs, it examines the DNSSEC
@@ -228,7 +229,7 @@
      </li>
 <li class="listitem">
 	<p>
-	  Algorithm policies:
+	  <span class="emphasis"><em>Algorithm policies:</em></span>
 	  (<code class="option">algorithm-policy <em class="replaceable"><code>algorithm</code></em> { ... };</code> )
 	  override default per-algorithm settings.  For example, by default,
 	  RSASHA256 keys use 2048-bit key sizes for both KSK and ZSK. This
@@ -238,11 +239,13 @@
      </li>
 <li class="listitem">
 	<p>
-	  Zone policies:
+	  <span class="emphasis"><em>Zone policies:</em></span>
 	  (<code class="option">zone <em class="replaceable"><code>name</code></em> { ... };</code> )
 	  set policy for a single zone by name. A zone policy can inherit
 	  a policy class by including a <code class="option">policy</code> option.
 	  Zone names beginning with digits (i.e., 0-9) must be quoted.
+	  If a zone does not have its own policy then the
+	  "<code class="literal">default</code>" policy applies.
 	</p>
      </li>
 </ul></div>
@@ -250,81 +253,90 @@
      Options that can be specified in policies:
    </p>
    <div class="variablelist"><dl class="variablelist">
-<dt><span class="term"><span class="command"><strong>algorithm</strong></span></span></dt>
+<dt><span class="term"><span class="command"><strong>algorithm</strong></span>
+	  <em class="replaceable"><code>name</code></em><code class="literal">;</code></span></dt>
 <dd>
 	  <p>
 	    The key algorithm. If no policy is defined, the default is
 	    RSASHA256.
 	  </p>
 	</dd>
-<dt><span class="term"><span class="command"><strong>coverage</strong></span></span></dt>
+<dt><span class="term"><span class="command"><strong>coverage</strong></span>
+	  <em class="replaceable"><code>duration</code></em><code class="literal">;</code></span></dt>
 <dd>
 	  <p>
 	    The length of time to ensure that keys will be correct; no action
 	    will be taken to create new keys to be activated after this time.
-	    This can be represented as a number of seconds, or as a duration using
-	    human-readable units (examples: "1y" or "6 months").
+	    This can be represented as a number of seconds, or as a duration
+	    using human-readable units (examples: "1y" or "6 months").
 	    A default value for this option can be set in algorithm policies
 	    as well as in policy classes or zone policies.
 	    If no policy is configured, the default is six months.
 	  </p>
 	</dd>
-<dt><span class="term"><span class="command"><strong>directory</strong></span></span></dt>
+<dt><span class="term"><span class="command"><strong>directory</strong></span>
+	  <em class="replaceable"><code>path</code></em><code class="literal">;</code></span></dt>
 <dd>
 	  <p>
 	    Specifies the directory in which keys should be stored.
 	  </p>
 	</dd>
-<dt><span class="term"><span class="command"><strong>key-size</strong></span></span></dt>
+<dt><span class="term"><span class="command"><strong>key-size</strong></span> <em class="replaceable"><code>keytype</code></em>
+	  <em class="replaceable"><code>size</code></em><code class="literal">;</code></span></dt>
 <dd>
 	  <p>
 	    Specifies the number of bits to use in creating keys.
-	    Takes two arguments: keytype (eihter "zsk" or "ksk") and size.
+	    The keytype is either "zsk" or "ksk".
 	    A default value for this option can be set in algorithm policies
 	    as well as in policy classes or zone policies. If no policy is
 	    configured, the default is 2048 bits for RSA keys.
 	  </p>
 	</dd>
-<dt><span class="term"><span class="command"><strong>keyttl</strong></span></span></dt>
+<dt><span class="term"><span class="command"><strong>keyttl</strong></span>
+	  <em class="replaceable"><code>duration</code></em><code class="literal">;</code></span></dt>
 <dd>
 	  <p>
 	    The key TTL. If no policy is defined, the default is one hour.
 	  </p>
 	</dd>
-<dt><span class="term"><span class="command"><strong>post-publish</strong></span></span></dt>
+<dt><span class="term"><span class="command"><strong>post-publish</strong></span> <em class="replaceable"><code>keytype</code></em>
+	  <em class="replaceable"><code>duration</code></em><code class="literal">;</code></span></dt>
 <dd>
 	  <p>
 	    How long after inactivation a key should be deleted from the zone.
 	    Note: If <code class="option">roll-period</code> is not set, this value is
-	    ignored. Takes two arguments: keytype (eihter "zsk" or "ksk") and a
-	    duration. A default value for this option can be set in algorithm
+	    ignored. The keytype is either "zsk" or "ksk".
+	    A default duration for this option can be set in algorithm
 	    policies as well as in policy classes or zone policies. The default
 	    is one month.
 	  </p>
 	</dd>
-<dt><span class="term"><span class="command"><strong>pre-publish</strong></span></span></dt>
+<dt><span class="term"><span class="command"><strong>pre-publish</strong></span> <em class="replaceable"><code>keytype</code></em>
+	  <em class="replaceable"><code>duration</code></em><code class="literal">;</code></span></dt>
 <dd>
 	  <p>
 	    How long before activation a key should be published.  Note: If
 	    <code class="option">roll-period</code> is not set, this value is ignored.
-	    Takes two arguments: keytype (either "zsk" or "ksk") and a duration.
-	    A default value for this option can be set in algorithm policies
+	    The keytype is either "zsk" or "ksk".
+	    A default duration for this option can be set in algorithm policies
 	    as well as in policy classes or zone policies.  The default is
 	    one month.
 	  </p>
 	</dd>
-<dt><span class="term"><span class="command"><strong>roll-period</strong></span></span></dt>
+<dt><span class="term"><span class="command"><strong>roll-period</strong></span> <em class="replaceable"><code>keytype</code></em>
+	  <em class="replaceable"><code>duration</code></em><code class="literal">;</code></span></dt>
 <dd>
 	  <p>
 	    How frequently keys should be rolled over.
-	    Takes two arguments: keytype (eihter "zsk" or "ksk") and a duration.
-	    A default value for this option can be set in algorithm policies
+	    The keytype is either "zsk" or "ksk".
+	    A default duration for this option can be set in algorithm policies
 	    as well as in policy classes or zone policies.  If no policy is
-	    configured, the default is one year for ZSK's. KSK's do not
+	    configured, the default is one year for ZSKs. KSKs do not
 	    roll over by default.
 	  </p>
 	</dd>
-<dt><span class="term"><span class="command"><strong>standby</strong></span></span></dt>
+<dt><span class="term"><span class="command"><strong>standby</strong></span> <em class="replaceable"><code>keytype</code></em>
+	  <em class="replaceable"><code>number</code></em><code class="literal">;</code></span></dt>
 <dd>
 	  <p>
 	    Not yet implemented.
@@ -393,6 +405,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.13.6 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.14.0rc1 (Stable Release)</p>
 </body>
 </html>
@@ -171,6 +171,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.13.6 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.14.0rc1 (Stable Release)</p>
 </body>
 </html>
@@ -349,6 +349,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.13.6 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.14.0rc1 (Stable Release)</p>
 </body>
 </html>
@@ -701,6 +701,6 @@ db.example.com.signed
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.13.6 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.14.0rc1 (Stable Release)</p>
 </body>
 </html>
@@ -202,6 +202,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.13.6 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.14.0rc1 (Stable Release)</p>
 </body>
 </html>
@@ -143,6 +143,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.13.6 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.14.0rc1 (Stable Release)</p>
 </body>
 </html>
@@ -168,6 +168,6 @@ plugin query "/usr/local/lib/filter-aaaa.so" {
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.13.6 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.14.0rc1 (Stable Release)</p>
 </body>
 </html>
@@ -366,6 +366,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.13.6 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.14.0rc1 (Stable Release)</p>
 </body>
 </html>
@@ -604,6 +604,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.13.6 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.14.0rc1 (Stable Release)</p>
 </body>
 </html>
@@ -208,6 +208,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.13.6 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.14.0rc1 (Stable Release)</p>
 </body>
 </html>
@@ -463,6 +463,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.13.6 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.14.0rc1 (Stable Release)</p>
 </body>
 </html>
@@ -117,6 +117,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.13.6 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.14.0rc1 (Stable Release)</p>
 </body>
 </html>
@@ -119,6 +119,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.13.6 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.14.0rc1 (Stable Release)</p>
 </body>
 </html>
@@ -121,6 +121,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.13.6 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.14.0rc1 (Stable Release)</p>
 </body>
 </html>
@@ -1073,6 +1073,6 @@ zone
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.13.6 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.14.0rc1 (Stable Release)</p>
 </body>
 </html>
@@ -492,6 +492,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.13.6 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.14.0rc1 (Stable Release)</p>
 </body>
 </html>
@@ -155,6 +155,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.13.6 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.14.0rc1 (Stable Release)</p>
 </body>
 </html>
@@ -437,6 +437,6 @@ nslookup -query=hinfo  -timeout=10
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.13.6 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.14.0rc1 (Stable Release)</p>
 </body>
 </html>
@@ -818,6 +818,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.13.6 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.14.0rc1 (Stable Release)</p>
 </body>
 </html>
@@ -162,6 +162,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.13.6 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.14.0rc1 (Stable Release)</p>
 </body>
 </html>
@@ -200,6 +200,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.13.6 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.14.0rc1 (Stable Release)</p>
 </body>
 </html>
@@ -158,6 +158,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.13.6 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.14.0rc1 (Stable Release)</p>
 </body>
 </html>
@@ -123,6 +123,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.13.6 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.14.0rc1 (Stable Release)</p>
 </body>
 </html>
@@ -260,6 +260,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.13.6 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.14.0rc1 (Stable Release)</p>
 </body>
 </html>
@@ -268,6 +268,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.13.6 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.14.0rc1 (Stable Release)</p>
 </body>
 </html>
@@ -1024,6 +1024,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.13.6 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.14.0rc1 (Stable Release)</p>
 </body>
 </html>
@@ -15,17 +15,22 @@

  <div class="section">
 <div class="titlepage"><div><div><h2 class="title" style="clear: both">
-<a name="id-1.2"></a>Release Notes for BIND Version 9.13.6</h2></div></div></div>
+<a name="id-1.2"></a>Release Notes for BIND Version 9.14.0rc1</h2></div></div></div>
  
  <div class="section">
 <div class="titlepage"><div><div><h3 class="title">
 <a name="relnotes_intro"></a>Introduction</h3></div></div></div>
    <p>
-      BIND 9.13 is an unstable development release of BIND.
-      This document summarizes new features and functional changes that
-      have been introduced on this branch.  With each development release
-      leading up to the stable BIND 9.14 release, this document will be
-      updated with additional features added and bugs fixed.
+      BIND 9.14.0 is the first release of a new stable branch of BIND.
+      This document summarizes new features and functional changes
+      that have been introduced, as well as features that have been
+      deprecated or removed, since the last stable branch, 9.12.
+    </p>
+<p>
+    </p>
+<p>
+      Please see the file <code class="filename">CHANGES</code> for a more
+      detailed list of changes and bug fixes.
    </p>
  </div>

@@ -33,23 +38,11 @@
 <div class="titlepage"><div><div><h3 class="title">
 <a name="relnotes_versions"></a>Note on Version Numbering</h3></div></div></div>
    <p>
-      Prior to BIND 9.13, new feature development releases were tagged
-      as "alpha" and "beta", leading up to the first stable release
-      for a given development branch, which always ended in ".0".
-    </p>
-    <p>
-      Now, however, BIND has adopted the "odd-unstable/even-stable"
-      release numbering convention. There will be no "alpha" or "beta"
-      releases in the 9.13 branch, only increasing version numbers.
-      So, for example, what would previously have been called 9.13.0a1,
-      9.13.0a2, 9.13.0b1, and so on, will instead be called 9.13.0,
-      9.13.1, 9.13.2, etc.
-    </p>
-    <p>
-      The first stable release from this development branch will be
-      renamed as 9.14.0. Thereafter, maintenance releases will continue
-      on the 9.14 branch, while unstable feature development proceeds in
-      9.15.
+      As of BIND 9.13/9.14, BIND has adopted the "odd-unstable/even-stable"
+      release numbering convention.  BIND 9.14 contains new features added
+      during the BIND 9.13 development process. Henceforth, the 9.14 branch
+      will be limited to bug fixes and new feature development will proceed
+      in the unstable 9.15 branch, and so forth.
    </p>
  </div>

@@ -57,12 +50,15 @@
 <div class="titlepage"><div><div><h3 class="title">
 <a name="relnotes_platforms"></a>Supported Platforms</h3></div></div></div>
    <p>
-      BIND 9.13 has undergone substantial code refactoring and cleanup,
-      and some very old code has been removed that was needed to support
-      legacy platforms which are no longer supported by their vendors
-      and for which ISC is no longer able to perform quality assurance
-      testing.  Specifically, workarounds for old versions of UnixWare,
-      BSD/OS, AIX, Tru64, SunOS, TruCluster and IRIX have been removed.
+      Since 9.12, BIND has undergone substantial code refactoring and
+      cleanup, and some very old code has been removed that was needed
+      to support legacy platforms which are no longer supported by their
+      vendors and for which ISC is no longer able to perform quality
+      assurance testing.  Specifically, workarounds for old versions of
+      UnixWare, BSD/OS, AIX, Tru64, SunOS, TruCluster and IRIX have been
+      removed.
+    </p>
+    <p>
      On UNIX-like systems, BIND now requires support for POSIX.1c
      threads (IEEE Std 1003.1c-1995), the Advanced Sockets API for
      IPv6 (RFC 3542), and standard atomic operations provided by the
@@ -77,7 +73,7 @@
      for systems that are still supported by their respective vendors.
    </p>
    <p>
-      As of BIND 9.13, the BIND development team has also made cryptography
+      As of BIND 9.14, the BIND development team has also made cryptography
      (i.e., TSIG and DNSSEC) an integral part of the DNS server.  The
      OpenSSL cryptography library must be available for the target
      platform.  A PKCS#11 provider can be used instead for Public Key
@@ -101,58 +97,6 @@

  <div class="section">
 <div class="titlepage"><div><div><h3 class="title">
-<a name="relnotes_security"></a>Security Fixes</h3></div></div></div>
-    <div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; ">
-<li class="listitem">
-        <p>
-          There was a long-existing flaw in the documentation for
-          <span class="command"><strong>ms-self</strong></span>, <span class="command"><strong>krb5-self</strong></span>,
-          <span class="command"><strong>ms-subdomain</strong></span>, and <span class="command"><strong>krb5-subdomain</strong></span>
-          rules in <span class="command"><strong>update-policy</strong></span> statements.  Though
-          the policies worked as intended, operators who configured their
-          servers according to the misleading documentation may have
-          thought zone updates were more restricted than they were;
-          users of these rule types are advised to review the documentation
-          and correct their configurations if necessary.  New rule types
-          matching the previously documented behavior will be introduced
-          in a future maintenance release. [GL !708]
-        </p>
-      </li>
-<li class="listitem">
-	<p>
-	  When recursion is enabled but the <span class="command"><strong>allow-recursion</strong></span>
-	  and <span class="command"><strong>allow-query-cache</strong></span> ACLs are not specified, they
-	  should be limited to local networks, but they were inadvertently set
-	  to match the default <span class="command"><strong>allow-query</strong></span>, thus allowing
-	  remote queries. This flaw is disclosed in CVE-2018-5738. [GL #309]
-	</p>
-      </li>
-<li class="listitem">
-	<p>
-	  <span class="command"><strong>named</strong></span> could crash during recursive processing
-	  of DNAME records when <span class="command"><strong>deny-answer-aliases</strong></span> was
-	  in use. This flaw is disclosed in CVE-2018-5740. [GL #387]
-	</p>
-      </li>
-<li class="listitem">
-	<p>
-	  Code change #4964, intended to prevent double signatures
-	  when deleting an inactive zone DNSKEY in some situations,
-	  introduced a new problem during zone processing in which
-	  some delegation glue RRsets are incorrectly identified
-	  as needing RRSIGs, which are then created for them using
-	  the current active ZSK for the zone. In some, but not all
-	  cases, the newly-signed RRsets are added to the zone's
-	  NSEC/NSEC3 chain, but incompletely -- this can result in
-	  a broken chain, affecting validation of proof of nonexistence
-	  for records in the zone. [GL #771]
-	</p>
-      </li>
-</ul></div>
-  </div>
-
-  <div class="section">
-<div class="titlepage"><div><div><h3 class="title">
 <a name="relnotes_features"></a>New Features</h3></div></div></div>
    <div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; ">
 <li class="listitem">
@@ -166,15 +110,11 @@
      </li>
 <li class="listitem">
 	<p>
-	  A new secondary zone option, <span class="command"><strong>mirror</strong></span>,
-	  enables <span class="command"><strong>named</strong></span> to serve a transferred copy
-	  of a zone's contents without acting as an authority for the
-	  zone. A zone must be fully validated against an active trust
-	  anchor before it can be used as a mirror zone. DNS responses
-	  from mirror zones do not set the AA bit ("authoritative answer"),
-	  but do set the AD bit ("authenticated data"). This feature is
-	  meant to facilitate deployment of a local copy of the root zone,
-	  as described in RFC 7706. [GL #33]
+	  Support for QNAME minimization was added and enabled by default
+	  in <span class="command"><strong>relaxed</strong></span> mode, in which BIND will fall back
+	  to normal resolution if the remote server returns something
+	  unexpected during the query minimization process. This default
+	  setting might change to <span class="command"><strong>strict</strong></span> in the future.
 	</p>
      </li>
 <li class="listitem">
@@ -190,6 +130,19 @@
 	  as further plugins are implemented. [GL #15]
 	</p>
      </li>
+<li class="listitem">
+	<p>
+	  A new secondary zone option, <span class="command"><strong>mirror</strong></span>,
+	  enables <span class="command"><strong>named</strong></span> to serve a transferred copy
+	  of a zone's contents without acting as an authority for the
+	  zone. A zone must be fully validated against an active trust
+	  anchor before it can be used as a mirror zone. DNS responses
+	  from mirror zones do not set the AA bit ("authoritative answer"),
+	  but do set the AD bit ("authenticated data"). This feature is
+	  meant to facilitate deployment of a local copy of the root zone,
+	  as described in RFC 7706. [GL #33]
+	</p>
+      </li>
 <li class="listitem">
 	<p>
 	  BIND now can be compiled against the <span class="command"><strong>libidn2</strong></span>
@@ -216,15 +169,6 @@
 	  signatures covering DNSKEY RRsets. [GL #145]
 	</p>
      </li>
-<li class="listitem">
-	<p>
-	  Support for QNAME minimization was added and enabled by default
-	  in <span class="command"><strong>relaxed</strong></span> mode, in which BIND will fall back
-	  to normal resolution if the remote server returns something
-	  unexpected during the query minimization process. This default
-	  setting might change to <span class="command"><strong>strict</strong></span> in the future.
-	</p>
-      </li>
 <li class="listitem">
 	<p>
 	  When built on Linux, BIND now requires the <span class="command"><strong>libcap</strong></span>
@@ -279,6 +223,22 @@
          configuration is being reloaded.
        </p>
      </li>
+<li class="listitem">
+	<p>
+	  The new <span class="command"><strong>answer-cookie</strong></span> option, if set to
+	  <code class="literal">no</code>, prevents <span class="command"><strong>named</strong></span> from
+	  returning a DNS COOKIE option to a client, even if such an
+	  option was present in the request.  This is only intended as
+	  a temporary measure, for use when <span class="command"><strong>named</strong></span>
+	  shares an IP address with other servers that do not yet
+	  support DNS COOKIE.  A mismatch between servers on the same
+	  address is not expected to cause operational problems, but the
+	  option to disable COOKIE responses so that all servers have the
+	  same behavior is provided out of an abundance of caution.
+	  DNS COOKIE is an important security mechanism, and this option
+	  should not be used to disable it unless absolutely necessary.
+	</p>
+      </li>
 </ul></div>
  </div>

@@ -423,51 +383,43 @@
      </li>
 <li class="listitem">
 	<p>
-	  Support for ECC-GOST (GOST R 34.11-94) algorithm has been
-	  removed from BIND as the algorithm has been superseded by
-	  GOST R 34.11-2012 in RFC6986 and it must not be used in new
-	  deployments.  BIND will neither create new DNSSEC keys,
-	  signatures and digest, nor it will validate them.
+	  Support for the RSAMD5 algorithm has been removed freom BIND as
+	  the usage of the RSAMD5 algorithm for DNSSEC has been deprecated
+	  in RFC6725, the security of the MD5 algorithm has been compromised,
+	  and its usage is considered harmful.
 	</p>
      </li>
 <li class="listitem">
 	<p>
-	  Add the ability to not return a DNS COOKIE option when one
-	  is present in the request.  To prevent a cookie being returned
-	  add 'answer-cookie no;' to named.conf. [GL #173]
-	</p>
-	<p>
-	  <span class="command"><strong>answer-cookie</strong></span> is only intended as a temporary
-	  measure, for use when <span class="command"><strong>named</strong></span> shares an IP address
-	  with other servers that do not yet support DNS COOKIE.  A mismatch
-	  between servers on the same address is not expected to cause
-	  operational problems, but the option to disable COOKIE responses so
-	  that all servers have the same behavior is provided out of an
-	  abundance of caution. DNS COOKIE is an important security mechanism,
-	  and should not be disabled unless absolutely necessary.
-	</p>
-	<p>
-	  Remove support for silently ignoring 'no-change' deltas from
-	  BIND 8 when processing an IXFR stream.  'no-change' deltas
-	  will now trigger a fallback to AXFR as the recovery mechanism.
-	</p>
-	<p>
-	  BIND 9 will no longer build on platforms that doesn't have
-	  proper IPv6 support.  BIND 9 now also requires non-broken
-	  POSIX-compatible pthread support.  Such platforms are
-	  usually long after their end-of-life date and they are
-	  neither developed nor supported by their respective vendors.
+	  Support for the ECC-GOST (GOST R 34.11-94) algorithm has been
+	  removed from BIND, as the algorithm has been superseded by
+	  GOST R 34.11-2012 in RFC6986 and it must not be used in new
+	  deployments.  BIND will neither create new DNSSEC keys,
+	  signatures and digests, nor it will validate them.
 	</p>
+      </li>
+<li class="listitem">
 	<p>
 	  Support for DSA and DSA-NSEC3-SHA1 algorithms has been
 	  removed from BIND as the DSA key length is limited to 1024
 	  bits and this is not considered secure enough.
 	</p>
+      </li>
+<li class="listitem">
 	<p>
-	  Support for RSAMD5 algorithm has been removed freom BIND as the usage
-	  of the RSAMD5 algorithm for DNSSEC has been deprecated in RFC6725 and
-	  the security of MD5 algorithm has been compromised and the its usage
-	  is considered harmful.
+	  <span class="command"><strong>named</strong></span> will no longer ignore "no-change" deltas
+	  when processing an IXFR stream.  This had previously been
+	  permitted for compatibility with BIND 8, but now "no-change"
+	  deltas will trigger a fallback to AXFR as the recovery mechanism.
+	</p>
+      </li>
+<li class="listitem">
+	<p>
+	  BIND 9 will no longer build on platforms that don't have
+	  proper IPv6 support.  BIND 9 now also requires POSIX-compatible
+	  pthread support.  Most of the platforms that lack these featuers
+	  are long past their end-of-lifew dates, and they are neither
+	  developed nor supported by their respective vendors.
 	</p>
      </li>
 <li class="listitem">
@@ -491,7 +443,7 @@
 	<p>
 	  BIND will now always use the best CSPRNG (cryptographically-secure
 	  pseudo-random number generator) available on the platform where
-	  it is compiled.  It will use <span class="command"><strong>arc4random()</strong></span>
+	  it is compiled.  It will use the <span class="command"><strong>arc4random()</strong></span>
 	  family of functions on BSD operating systems,
 	  <span class="command"><strong>getrandom()</strong></span> on Linux and Solaris,
 	  <span class="command"><strong>CryptGenRandom</strong></span> on Windows, and the selected
@@ -622,64 +574,6 @@

  <div class="section">
 <div class="titlepage"><div><div><h3 class="title">
-<a name="relnotes_bugs"></a>Bug Fixes</h3></div></div></div>
-    <div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; ">
-<li class="listitem">
-        <p>
-          Running <span class="command"><strong>rndc reconfig</strong></span> could cause
-          <span class="command"><strong>inline-signing</strong></span> zones to stop signing.
-	  [GL #439]
-        </p>
-      </li>
-<li class="listitem">
-        <p>
-          Reloading all zones caused zone maintenance to stop for
-          <span class="command"><strong>inline-signing</strong></span> zones. [GL #435]
-        </p>
-      </li>
-<li class="listitem">
-        <p>
-          Signatures loaded from the journal for the signed version
-          of an <span class="command"><strong>inline-signing</strong></span> zone were not scheduled
-	  for refresh. [GL #482]
-        </p>
-      </li>
-<li class="listitem">
-        <p>
-          A referral response with a non-empty ANSWER section was
-          incorrectly treated as an error; this caused certain domains
-          to be non-resolvable. [GL #390]
-        </p>
-      </li>
-<li class="listitem">
-	<p>
-	  When a negative trust anchor was added to multiple views
-	  using <span class="command"><strong>rndc nta</strong></span>, the text returned via
-	  <span class="command"><strong>rndc</strong></span> was incorrectly truncated after the
-	  first line, making it appear that only one NTA had been
-	  added. This has been fixed. [GL #105]
-	</p>
-      </li>
-<li class="listitem">
-	<p>
-	  The view name is now included in the output of
-	  <span class="command"><strong>rndc nta -dump</strong></span>, for consistency with
-	  other options. [GL !816]
-	</p>
-      </li>
-<li class="listitem">
-	<p>
-	  <span class="command"><strong>named</strong></span> now rejects excessively large
-	  incremental (IXFR) zone transfers in order to prevent
-	  possible corruption of journal files which could cause
-	  <span class="command"><strong>named</strong></span> to abort when loading zones. [GL #339]
-	</p>
-      </li>
-</ul></div>
-  </div>
-
-  <div class="section">
-<div class="titlepage"><div><div><h3 class="title">
 <a name="relnotes_license"></a>License</h3></div></div></div>
    <p>
      BIND is open source software licenced under the terms of the Mozilla
@@ -705,11 +599,6 @@
  <div class="section">
 <div class="titlepage"><div><div><h3 class="title">
 <a name="end_of_life"></a>End of Life</h3></div></div></div>
-    <p>
-      BIND 9.13 is an unstable development branch. When its development
-      is complete, it will be renamed to BIND 9.14, which will be a
-      stable branch.
-    </p>
    <p>
      The end of life date for BIND 9.14 has not yet been determined.
      For those needing long term support, the current Extended Support
@@ -1,40 +1,35 @@
-Release Notes for BIND Version 9.13.6
+Release Notes for BIND Version 9.14.0rc1

 Introduction

-BIND 9.13 is an unstable development release of BIND. This document
-summarizes new features and functional changes that have been introduced
-on this branch. With each development release leading up to the stable
-BIND 9.14 release, this document will be updated with additional features
-added and bugs fixed.
+BIND 9.14.0 is the first release of a new stable branch of BIND. This
+document summarizes new features and functional changes that have been
+introduced, as well as features that have been deprecated or removed,
+since the last stable branch, 9.12.
+
+Please see the file CHANGES for a more detailed list of changes and bug
+fixes.

 Note on Version Numbering

-Prior to BIND 9.13, new feature development releases were tagged as
-"alpha" and "beta", leading up to the first stable release for a given
-development branch, which always ended in ".0".
-
-Now, however, BIND has adopted the "odd-unstable/even-stable" release
-numbering convention. There will be no "alpha" or "beta" releases in the
-9.13 branch, only increasing version numbers. So, for example, what would
-previously have been called 9.13.0a1, 9.13.0a2, 9.13.0b1, and so on, will
-instead be called 9.13.0, 9.13.1, 9.13.2, etc.
-
-The first stable release from this development branch will be renamed as
-9.14.0. Thereafter, maintenance releases will continue on the 9.14 branch,
-while unstable feature development proceeds in 9.15.
+As of BIND 9.13/9.14, BIND has adopted the "odd-unstable/even-stable"
+release numbering convention. BIND 9.14 contains new features added during
+the BIND 9.13 development process. Henceforth, the 9.14 branch will be
+limited to bug fixes and new feature development will proceed in the
+unstable 9.15 branch, and so forth.

 Supported Platforms

-BIND 9.13 has undergone substantial code refactoring and cleanup, and some
-very old code has been removed that was needed to support legacy platforms
-which are no longer supported by their vendors and for which ISC is no
-longer able to perform quality assurance testing. Specifically,
+Since 9.12, BIND has undergone substantial code refactoring and cleanup,
+and some very old code has been removed that was needed to support legacy
+platforms which are no longer supported by their vendors and for which ISC
+is no longer able to perform quality assurance testing. Specifically,
 workarounds for old versions of UnixWare, BSD/OS, AIX, Tru64, SunOS,
-TruCluster and IRIX have been removed. On UNIX-like systems, BIND now
-requires support for POSIX.1c threads (IEEE Std 1003.1c-1995), the
-Advanced Sockets API for IPv6 (RFC 3542), and standard atomic operations
-provided by the C compiler.
+TruCluster and IRIX have been removed.
+
+On UNIX-like systems, BIND now requires support for POSIX.1c threads (IEEE
+Std 1003.1c-1995), the Advanced Sockets API for IPv6 (RFC 3542), and
+standard atomic operations provided by the C compiler.

 More information can be found in the PLATFORM.md file that is included in
 the source distribution of BIND 9. If your platform compiler and system
@@ -43,7 +38,7 @@ that isn't the case, the BIND development team will generally accept
 patches that add support for systems that are still supported by their
 respective vendors.

-As of BIND 9.13, the BIND development team has also made cryptography
+As of BIND 9.14, the BIND development team has also made cryptography
 (i.e., TSIG and DNSSEC) an integral part of the DNS server. The OpenSSL
 cryptography library must be available for the target platform. A PKCS#11
 provider can be used instead for Public Key cryptography (i.e., DNSSEC
@@ -57,38 +52,6 @@ www.isc.org/downloads/. There you will find additional information about
 each release, source code, and pre-compiled versions for Microsoft Windows
 operating systems.

-Security Fixes
-
-  * There was a long-existing flaw in the documentation for ms-self,
-    krb5-self, ms-subdomain, and krb5-subdomain rules in update-policy
-    statements. Though the policies worked as intended, operators who
-    configured their servers according to the misleading documentation may
-    have thought zone updates were more restricted than they were; users
-    of these rule types are advised to review the documentation and
-    correct their configurations if necessary. New rule types matching the
-    previously documented behavior will be introduced in a future
-    maintenance release. [GL !708]
-
-  * When recursion is enabled but the allow-recursion and
-    allow-query-cache ACLs are not specified, they should be limited to
-    local networks, but they were inadvertently set to match the default
-    allow-query, thus allowing remote queries. This flaw is disclosed in
-    CVE-2018-5738. [GL #309]
-
-  * named could crash during recursive processing of DNAME records when
-    deny-answer-aliases was in use. This flaw is disclosed in
-    CVE-2018-5740. [GL #387]
-
-  * Code change #4964, intended to prevent double signatures when deleting
-    an inactive zone DNSKEY in some situations, introduced a new problem
-    during zone processing in which some delegation glue RRsets are
-    incorrectly identified as needing RRSIGs, which are then created for
-    them using the current active ZSK for the zone. In some, but not all
-    cases, the newly-signed RRsets are added to the zone's NSEC/NSEC3
-    chain, but incompletely -- this can result in a broken chain,
-    affecting validation of proof of nonexistence for records in the zone.
-    [GL #771]
-
 New Features

  * Task manager and socket code have been substantially modified. The
@@ -96,6 +59,20 @@ New Features
    event loops in CPU-affinitive threads. This greatly improves
    performance on large systems, especially when using multi-queue NICs.

+  * Support for QNAME minimization was added and enabled by default in
+    relaxed mode, in which BIND will fall back to normal resolution if the
+    remote server returns something unexpected during the query
+    minimization process. This default setting might change to strict in
+    the future.
+
+  * A new plugin mechanism has been added to allow extension of query
+    processing functionality through the use of external libraries. The
+    new filter-aaaa.so plugin replaces the filter-aaaa feature that was
+    formerly implemented as a native part of BIND.
+
+    The plugin API is a work in progress and is likely to evolve as
+    further plugins are implemented. [GL #15]
+
  * A new secondary zone option, mirror, enables named to serve a
    transferred copy of a zone's contents without acting as an authority
    for the zone. A zone must be fully validated against an active trust
@@ -105,14 +82,6 @@ New Features
    facilitate deployment of a local copy of the root zone, as described
    in RFC 7706. [GL #33]

-  * A new plugin mechanism has been added to allow extension of query
-    processing functionality through the use of external libraries. The
-    new filter-aaaa.so plugin replaces the filter-aaaa feature that was
-    formerly implemented as a native part of BIND.
-
-    The plugin API is a work in progress and is likely to evolve as
-    further plugins are implemented. [GL #15]
-
  * BIND now can be compiled against the libidn2 library to add IDNA2008
    support. Previously, BIND supported IDNA2003 using the (now obsolete
    and unsupported) idnkit-1 library.
@@ -126,12 +95,6 @@ New Features
  * The dnskey-sig-validity option allows the sig-validity-interval to be
    overriden for signatures covering DNSKEY RRsets. [GL #145]

-  * Support for QNAME minimization was added and enabled by default in
-    relaxed mode, in which BIND will fall back to normal resolution if the
-    remote server returns something unexpected during the query
-    minimization process. This default setting might change to strict in
-    the future.
-
  * When built on Linux, BIND now requires the libcap library to set
    process privileges. The adds a new compile-time dependency, which can
    be met on most Linux platforms by installing the libcap-dev or
@@ -164,6 +127,17 @@ New Features
  * rndc status output now includes a reconfig/reload in progress status
    line if named configuration is being reloaded.

+  * The new answer-cookie option, if set to no, prevents named from
+    returning a DNS COOKIE option to a client, even if such an option was
+    present in the request. This is only intended as a temporary measure,
+    for use when named shares an IP address with other servers that do not
+    yet support DNS COOKIE. A mismatch between servers on the same address
+    is not expected to cause operational problems, but the option to
+    disable COOKIE responses so that all servers have the same behavior is
+    provided out of an abundance of caution. DNS COOKIE is an important
+    security mechanism, and this option should not be used to disable it
+    unless absolutely necessary.
+
 Removed Features

  * Workarounds for servers that misbehave when queried with EDNS have
@@ -243,43 +217,31 @@ Removed Features
    The -p option to use pseudo-random data has been removed from the
    dnssec-signzone command.

-  * Support for ECC-GOST (GOST R 34.11-94) algorithm has been removed from
-    BIND as the algorithm has been superseded by GOST R 34.11-2012 in
-    RFC6986 and it must not be used in new deployments. BIND will neither
-    create new DNSSEC keys, signatures and digest, nor it will validate
-    them.
+  * Support for the RSAMD5 algorithm has been removed freom BIND as the
+    usage of the RSAMD5 algorithm for DNSSEC has been deprecated in
+    RFC6725, the security of the MD5 algorithm has been compromised, and
+    its usage is considered harmful.

-  * Add the ability to not return a DNS COOKIE option when one is present
-    in the request. To prevent a cookie being returned add 'answer-cookie
-    no;' to named.conf. [GL #173]
+  * Support for the ECC-GOST (GOST R 34.11-94) algorithm has been removed
+    from BIND, as the algorithm has been superseded by GOST R 34.11-2012
+    in RFC6986 and it must not be used in new deployments. BIND will
+    neither create new DNSSEC keys, signatures and digests, nor it will
+    validate them.

-    answer-cookie is only intended as a temporary measure, for use when
-    named shares an IP address with other servers that do not yet support
-    DNS COOKIE. A mismatch between servers on the same address is not
-    expected to cause operational problems, but the option to disable
-    COOKIE responses so that all servers have the same behavior is
-    provided out of an abundance of caution. DNS COOKIE is an important
-    security mechanism, and should not be disabled unless absolutely
-    necessary.
-
-    Remove support for silently ignoring 'no-change' deltas from BIND 8
-    when processing an IXFR stream. 'no-change' deltas will now trigger a
-    fallback to AXFR as the recovery mechanism.
-
-    BIND 9 will no longer build on platforms that doesn't have proper IPv6
-    support. BIND 9 now also requires non-broken POSIX-compatible pthread
-    support. Such platforms are usually long after their end-of-life date
-    and they are neither developed nor supported by their respective
-    vendors.
-
-    Support for DSA and DSA-NSEC3-SHA1 algorithms has been removed from
+  * Support for DSA and DSA-NSEC3-SHA1 algorithms has been removed from
    BIND as the DSA key length is limited to 1024 bits and this is not
    considered secure enough.

-    Support for RSAMD5 algorithm has been removed freom BIND as the usage
-    of the RSAMD5 algorithm for DNSSEC has been deprecated in RFC6725 and
-    the security of MD5 algorithm has been compromised and the its usage
-    is considered harmful.
+  * named will no longer ignore "no-change" deltas when processing an IXFR
+    stream. This had previously been permitted for compatibility with BIND
+    8, but now "no-change" deltas will trigger a fallback to AXFR as the
+    recovery mechanism.
+
+  * BIND 9 will no longer build on platforms that don't have proper IPv6
+    support. BIND 9 now also requires POSIX-compatible pthread support.
+    Most of the platforms that lack these featuers are long past their
+    end-of-lifew dates, and they are neither developed nor supported by
+    their respective vendors.

  * The incomplete support for internationalization message catalogs has
    been removed from BIND. Since the internationalization was never
@@ -292,7 +254,7 @@ Feature Changes

  * BIND will now always use the best CSPRNG (cryptographically-secure
    pseudo-random number generator) available on the platform where it is
-    compiled. It will use arc4random() family of functions on BSD
+    compiled. It will use the arc4random() family of functions on BSD
    operating systems, getrandom() on Linux and Solaris, CryptGenRandom on
    Windows, and the selected cryptography provider library (OpenSSL or
    PKCS#11) as the last resort. [GL #221]
@@ -355,33 +317,6 @@ Feature Changes
  * Zone signing and key maintenance events are now logged to the dnssec
    category rather than zone.

-Bug Fixes
-
-  * Running rndc reconfig could cause inline-signing zones to stop
-    signing. [GL #439]
-
-  * Reloading all zones caused zone maintenance to stop for inline-signing
-    zones. [GL #435]
-
-  * Signatures loaded from the journal for the signed version of an
-    inline-signing zone were not scheduled for refresh. [GL #482]
-
-  * A referral response with a non-empty ANSWER section was incorrectly
-    treated as an error; this caused certain domains to be non-resolvable.
-    [GL #390]
-
-  * When a negative trust anchor was added to multiple views using rndc
-    nta, the text returned via rndc was incorrectly truncated after the
-    first line, making it appear that only one NTA had been added. This
-    has been fixed. [GL #105]
-
-  * The view name is now included in the output of rndc nta -dump, for
-    consistency with other options. [GL !816]
-
-  * named now rejects excessively large incremental (IXFR) zone transfers
-    in order to prevent possible corruption of journal files which could
-    cause named to abort when loading zones. [GL #339]
-
 License

 BIND is open source software licenced under the terms of the Mozilla
@@ -399,9 +334,6 @@ www.isc.org/mission/contact/.

 End of Life

-BIND 9.13 is an unstable development branch. When its development is
-complete, it will be renamed to BIND 9.14, which will be a stable branch.
-
 The end of life date for BIND 9.14 has not yet been determined. For those
 needing long term support, the current Extended Support Version (ESV) is
 BIND 9.11, which will be supported until at least December 2021. See
@@ -21,44 +21,38 @@
  <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="noteversion.xml"/>
  <section xml:id="relnotes_intro"><info><title>Introduction</title></info>
    <para>
-      BIND 9.13 is an unstable development release of BIND.
-      This document summarizes new features and functional changes that
-      have been introduced on this branch.  With each development release
-      leading up to the stable BIND 9.14 release, this document will be
-      updated with additional features added and bugs fixed.
+      BIND 9.14.0 is the first release of a new stable branch of BIND.
+      This document summarizes new features and functional changes
+      that have been introduced, as well as features that have been
+      deprecated or removed, since the last stable branch, 9.12.
+    <para>
+    </para>
+      Please see the file <filename>CHANGES</filename> for a more
+      detailed list of changes and bug fixes.
    </para>
  </section>

  <section xml:id="relnotes_versions"><info><title>Note on Version Numbering</title></info>
    <para>
-      Prior to BIND 9.13, new feature development releases were tagged
-      as "alpha" and "beta", leading up to the first stable release
-      for a given development branch, which always ended in ".0".
-    </para>
-    <para>
-      Now, however, BIND has adopted the "odd-unstable/even-stable"
-      release numbering convention. There will be no "alpha" or "beta"
-      releases in the 9.13 branch, only increasing version numbers.
-      So, for example, what would previously have been called 9.13.0a1,
-      9.13.0a2, 9.13.0b1, and so on, will instead be called 9.13.0,
-      9.13.1, 9.13.2, etc.
-    </para>
-    <para>
-      The first stable release from this development branch will be
-      renamed as 9.14.0. Thereafter, maintenance releases will continue
-      on the 9.14 branch, while unstable feature development proceeds in
-      9.15.
+      As of BIND 9.13/9.14, BIND has adopted the "odd-unstable/even-stable"
+      release numbering convention.  BIND 9.14 contains new features added
+      during the BIND 9.13 development process. Henceforth, the 9.14 branch
+      will be limited to bug fixes and new feature development will proceed
+      in the unstable 9.15 branch, and so forth.
    </para>
  </section>

  <section xml:id="relnotes_platforms"><info><title>Supported Platforms</title></info>
    <para>
-      BIND 9.13 has undergone substantial code refactoring and cleanup,
-      and some very old code has been removed that was needed to support
-      legacy platforms which are no longer supported by their vendors
-      and for which ISC is no longer able to perform quality assurance
-      testing.  Specifically, workarounds for old versions of UnixWare,
-      BSD/OS, AIX, Tru64, SunOS, TruCluster and IRIX have been removed.
+      Since 9.12, BIND has undergone substantial code refactoring and
+      cleanup, and some very old code has been removed that was needed
+      to support legacy platforms which are no longer supported by their
+      vendors and for which ISC is no longer able to perform quality
+      assurance testing.  Specifically, workarounds for old versions of
+      UnixWare, BSD/OS, AIX, Tru64, SunOS, TruCluster and IRIX have been
+      removed.
+    </para>
+    <para>
      On UNIX-like systems, BIND now requires support for POSIX.1c
      threads (IEEE Std 1003.1c-1995), the Advanced Sockets API for
      IPv6 (RFC 3542), and standard atomic operations provided by the
@@ -73,7 +67,7 @@
      for systems that are still supported by their respective vendors.
    </para>
    <para>
-      As of BIND 9.13, the BIND development team has also made cryptography
+      As of BIND 9.14, the BIND development team has also made cryptography
      (i.e., TSIG and DNSSEC) an integral part of the DNS server.  The
      OpenSSL cryptography library must be available for the target
      platform.  A PKCS#11 provider can be used instead for Public Key
@@ -93,56 +87,6 @@
    </para>
  </section>

-  <section xml:id="relnotes_security"><info><title>Security Fixes</title></info>
-    <itemizedlist>
-      <listitem>
-        <para>
-          There was a long-existing flaw in the documentation for
-          <command>ms-self</command>, <command>krb5-self</command>,
-          <command>ms-subdomain</command>, and <command>krb5-subdomain</command>
-          rules in <command>update-policy</command> statements.  Though
-          the policies worked as intended, operators who configured their
-          servers according to the misleading documentation may have
-          thought zone updates were more restricted than they were;
-          users of these rule types are advised to review the documentation
-          and correct their configurations if necessary.  New rule types
-          matching the previously documented behavior will be introduced
-          in a future maintenance release. [GL !708]
-        </para>
-      </listitem>
-      <listitem>
-	<para>
-	  When recursion is enabled but the <command>allow-recursion</command>
-	  and <command>allow-query-cache</command> ACLs are not specified, they
-	  should be limited to local networks, but they were inadvertently set
-	  to match the default <command>allow-query</command>, thus allowing
-	  remote queries. This flaw is disclosed in CVE-2018-5738. [GL #309]
-	</para>
-      </listitem>
-      <listitem>
-	<para>
-	  <command>named</command> could crash during recursive processing
-	  of DNAME records when <command>deny-answer-aliases</command> was
-	  in use. This flaw is disclosed in CVE-2018-5740. [GL #387]
-	</para>
-      </listitem>
-      <listitem>
-	<para>
-	  Code change #4964, intended to prevent double signatures
-	  when deleting an inactive zone DNSKEY in some situations,
-	  introduced a new problem during zone processing in which
-	  some delegation glue RRsets are incorrectly identified
-	  as needing RRSIGs, which are then created for them using
-	  the current active ZSK for the zone. In some, but not all
-	  cases, the newly-signed RRsets are added to the zone's
-	  NSEC/NSEC3 chain, but incompletely -- this can result in
-	  a broken chain, affecting validation of proof of nonexistence
-	  for records in the zone. [GL #771]
-	</para>
-      </listitem>
-    </itemizedlist>
-  </section>
-
  <section xml:id="relnotes_features"><info><title>New Features</title></info>
    <itemizedlist>
      <listitem>
@@ -156,15 +100,11 @@
      </listitem>
      <listitem>
 	<para>
-	  A new secondary zone option, <command>mirror</command>,
-	  enables <command>named</command> to serve a transferred copy
-	  of a zone's contents without acting as an authority for the
-	  zone. A zone must be fully validated against an active trust
-	  anchor before it can be used as a mirror zone. DNS responses
-	  from mirror zones do not set the AA bit ("authoritative answer"),
-	  but do set the AD bit ("authenticated data"). This feature is
-	  meant to facilitate deployment of a local copy of the root zone,
-	  as described in RFC 7706. [GL #33]
+	  Support for QNAME minimization was added and enabled by default
+	  in <command>relaxed</command> mode, in which BIND will fall back
+	  to normal resolution if the remote server returns something
+	  unexpected during the query minimization process. This default
+	  setting might change to <command>strict</command> in the future.
 	</para>
      </listitem>
      <listitem>
@@ -180,6 +120,19 @@
 	  as further plugins are implemented. [GL #15]
 	</para>
      </listitem>
+      <listitem>
+	<para>
+	  A new secondary zone option, <command>mirror</command>,
+	  enables <command>named</command> to serve a transferred copy
+	  of a zone's contents without acting as an authority for the
+	  zone. A zone must be fully validated against an active trust
+	  anchor before it can be used as a mirror zone. DNS responses
+	  from mirror zones do not set the AA bit ("authoritative answer"),
+	  but do set the AD bit ("authenticated data"). This feature is
+	  meant to facilitate deployment of a local copy of the root zone,
+	  as described in RFC 7706. [GL #33]
+	</para>
+      </listitem>
      <listitem>
 	<para>
 	  BIND now can be compiled against the <command>libidn2</command>
@@ -206,15 +159,6 @@
 	  signatures covering DNSKEY RRsets. [GL #145]
 	</para>
      </listitem>
-      <listitem>
-	<para>
-	  Support for QNAME minimization was added and enabled by default
-	  in <command>relaxed</command> mode, in which BIND will fall back
-	  to normal resolution if the remote server returns something
-	  unexpected during the query minimization process. This default
-	  setting might change to <command>strict</command> in the future.
-	</para>
-      </listitem>
      <listitem>
 	<para>
 	  When built on Linux, BIND now requires the <command>libcap</command>
@@ -269,6 +213,22 @@
          configuration is being reloaded.
        </para>
      </listitem>
+      <listitem>
+	<para>
+	  The new <command>answer-cookie</command> option, if set to
+	  <literal>no</literal>, prevents <command>named</command> from
+	  returning a DNS COOKIE option to a client, even if such an
+	  option was present in the request.  This is only intended as
+	  a temporary measure, for use when <command>named</command>
+	  shares an IP address with other servers that do not yet
+	  support DNS COOKIE.  A mismatch between servers on the same
+	  address is not expected to cause operational problems, but the
+	  option to disable COOKIE responses so that all servers have the
+	  same behavior is provided out of an abundance of caution.
+	  DNS COOKIE is an important security mechanism, and this option
+	  should not be used to disable it unless absolutely necessary.
+	</para>
+      </listitem>
    </itemizedlist>
  </section>

@@ -412,51 +372,43 @@
      </listitem>
      <listitem>
 	<para>
-	  Support for ECC-GOST (GOST R 34.11-94) algorithm has been
-	  removed from BIND as the algorithm has been superseded by
-	  GOST R 34.11-2012 in RFC6986 and it must not be used in new
-	  deployments.  BIND will neither create new DNSSEC keys,
-	  signatures and digest, nor it will validate them.
+	  Support for the RSAMD5 algorithm has been removed freom BIND as
+	  the usage of the RSAMD5 algorithm for DNSSEC has been deprecated
+	  in RFC6725, the security of the MD5 algorithm has been compromised,
+	  and its usage is considered harmful.
 	</para>
      </listitem>
      <listitem>
 	<para>
-	  Add the ability to not return a DNS COOKIE option when one
-	  is present in the request.  To prevent a cookie being returned
-	  add 'answer-cookie no;' to named.conf. [GL #173]
-	</para>
-	<para>
-	  <command>answer-cookie</command> is only intended as a temporary
-	  measure, for use when <command>named</command> shares an IP address
-	  with other servers that do not yet support DNS COOKIE.  A mismatch
-	  between servers on the same address is not expected to cause
-	  operational problems, but the option to disable COOKIE responses so
-	  that all servers have the same behavior is provided out of an
-	  abundance of caution. DNS COOKIE is an important security mechanism,
-	  and should not be disabled unless absolutely necessary.
-	</para>
-	<para>
-	  Remove support for silently ignoring 'no-change' deltas from
-	  BIND 8 when processing an IXFR stream.  'no-change' deltas
-	  will now trigger a fallback to AXFR as the recovery mechanism.
-	</para>
-	<para>
-	  BIND 9 will no longer build on platforms that doesn't have
-	  proper IPv6 support.  BIND 9 now also requires non-broken
-	  POSIX-compatible pthread support.  Such platforms are
-	  usually long after their end-of-life date and they are
-	  neither developed nor supported by their respective vendors.
+	  Support for the ECC-GOST (GOST R 34.11-94) algorithm has been
+	  removed from BIND, as the algorithm has been superseded by
+	  GOST R 34.11-2012 in RFC6986 and it must not be used in new
+	  deployments.  BIND will neither create new DNSSEC keys,
+	  signatures and digests, nor it will validate them.
 	</para>
+      </listitem>
+      <listitem>
 	<para>
 	  Support for DSA and DSA-NSEC3-SHA1 algorithms has been
 	  removed from BIND as the DSA key length is limited to 1024
 	  bits and this is not considered secure enough.
 	</para>
+      </listitem>
+      <listitem>
 	<para>
-	  Support for RSAMD5 algorithm has been removed freom BIND as the usage
-	  of the RSAMD5 algorithm for DNSSEC has been deprecated in RFC6725 and
-	  the security of MD5 algorithm has been compromised and the its usage
-	  is considered harmful.
+	  <command>named</command> will no longer ignore "no-change" deltas
+	  when processing an IXFR stream.  This had previously been
+	  permitted for compatibility with BIND 8, but now "no-change"
+	  deltas will trigger a fallback to AXFR as the recovery mechanism.
+	</para>
+      </listitem>
+      <listitem>
+	<para>
+	  BIND 9 will no longer build on platforms that don't have
+	  proper IPv6 support.  BIND 9 now also requires POSIX-compatible
+	  pthread support.  Most of the platforms that lack these featuers
+	  are long past their end-of-lifew dates, and they are neither
+	  developed nor supported by their respective vendors.
 	</para>
      </listitem>
      <listitem>
@@ -478,7 +430,7 @@
 	<para>
 	  BIND will now always use the best CSPRNG (cryptographically-secure
 	  pseudo-random number generator) available on the platform where
-	  it is compiled.  It will use <command>arc4random()</command>
+	  it is compiled.  It will use the <command>arc4random()</command>
 	  family of functions on BSD operating systems,
 	  <command>getrandom()</command> on Linux and Solaris,
 	  <command>CryptGenRandom</command> on Windows, and the selected
@@ -607,62 +559,6 @@
    </itemizedlist>
  </section>

-  <section xml:id="relnotes_bugs"><info><title>Bug Fixes</title></info>
-    <itemizedlist>
-      <listitem>
-        <para>
-          Running <command>rndc reconfig</command> could cause
-          <command>inline-signing</command> zones to stop signing.
-	  [GL #439]
-        </para>
-      </listitem>
-      <listitem>
-        <para>
-          Reloading all zones caused zone maintenance to stop for
-          <command>inline-signing</command> zones. [GL #435]
-        </para>
-      </listitem>
-      <listitem>
-        <para>
-          Signatures loaded from the journal for the signed version
-          of an <command>inline-signing</command> zone were not scheduled
-	  for refresh. [GL #482]
-        </para>
-      </listitem>
-      <listitem>
-        <para>
-          A referral response with a non-empty ANSWER section was
-          incorrectly treated as an error; this caused certain domains
-          to be non-resolvable. [GL #390]
-        </para>
-      </listitem>
-      <listitem>
-	<para>
-	  When a negative trust anchor was added to multiple views
-	  using <command>rndc nta</command>, the text returned via
-	  <command>rndc</command> was incorrectly truncated after the
-	  first line, making it appear that only one NTA had been
-	  added. This has been fixed. [GL #105]
-	</para>
-      </listitem>
-      <listitem>
-	<para>
-	  The view name is now included in the output of
-	  <command>rndc nta -dump</command>, for consistency with
-	  other options. [GL !816]
-	</para>
-      </listitem>
-      <listitem>
-	<para>
-	  <command>named</command> now rejects excessively large
-	  incremental (IXFR) zone transfers in order to prevent
-	  possible corruption of journal files which could cause
-	  <command>named</command> to abort when loading zones. [GL #339]
-	</para>
-      </listitem>
-    </itemizedlist>
-  </section>
-
  <section xml:id="relnotes_license"><info><title>License</title></info>
    <para>
      BIND is open source software licenced under the terms of the Mozilla
@@ -688,11 +584,6 @@
  </section>

  <section xml:id="end_of_life"><info><title>End of Life</title></info>
-    <para>
-      BIND 9.13 is an unstable development branch. When its development
-      is complete, it will be renamed to BIND 9.14, which will be a
-      stable branch.
-    </para>
    <para>
      The end of life date for BIND 9.14 has not yet been determined.
      For those needing long term support, the current Extended Support
@@ -8,7 +8,7 @@
 # 9.10-sub: 180-189
 # 9.11: 160-169,1100-1199
 # 9.12: 1200-1299
-# 9.13: 1300-1399
+# 9.13/9.14: 1300-1499
 LIBINTERFACE = 1302
 LIBREVISION = 1
 LIBAGE = 0
@@ -8,7 +8,7 @@
 # 9.10-sub: 180-189
 # 9.11: 160-169,1100-1199
 # 9.12: 1200-1299
-# 9.13: 1300-1399
+# 9.13/9.14: 1300-1499
 LIBINTERFACE = 1306
-LIBREVISION = 0
+LIBREVISION = 1
 LIBAGE = 0
@@ -144,15 +144,14 @@ struct dns_rpz_zone {
 	isc_ht_t	 *nodes;	/* entries in zone */
 	dns_rpz_zones_t	 *rpzs;		/* owner */
 	isc_time_t	 lastupdated;	/* last time the zone was processed */
-	bool	 updatepending;	/* there is an update pending/waiting */
-	bool	 updaterunning;	/* there is an update running */
+	bool	 	 updatepending;	/* there is an update pending/waiting */
+	bool	 	 updaterunning;	/* there is an update running */
 	dns_db_t	 *db;		/* zones database */
 	dns_dbversion_t	 *dbversion;	/* version we will be updating to */
 	dns_db_t	 *updb;		/* zones database we're working on */
 	dns_dbversion_t	 *updbversion;	/* version we're currently working on */
 	dns_dbiterator_t *updbit;	/* iterator to use when updating */
 	isc_ht_t	 *newnodes;	/* entries in zone being updated */
-	bool	 db_registered;	/* is the notify event registered? */
 	isc_timer_t	 *updatetimer;
 	isc_event_t	 updateevent;
 };
@@ -70,8 +70,7 @@ typedef struct dst_context 	dst_context_t;
 #define DST_ALG_HMACSHA512	165	/* XXXMPA */
 #define DST_ALG_INDIRECT	252
 #define DST_ALG_PRIVATE		254
-#define DST_ALG_EXPAND		255
-#define DST_MAX_ALGS		255
+#define DST_MAX_ALGS		256

 /*% A buffer of this size is large enough to hold any key */
 #define DST_KEY_MAXSIZE		1280
@@ -1549,7 +1549,6 @@ dns_rpz_new_zone(dns_rpz_zones_t *rpzs, dns_rpz_zone_t **rpzp) {
 	zone->updbversion = NULL;
 	zone->updbit = NULL;
 	zone->rpzs = rpzs;
-	zone->db_registered = false;
 	ISC_EVENT_INIT(&zone->updateevent, sizeof(zone->updateevent),
 		       0, NULL, 0, NULL, NULL, NULL, NULL, NULL);

@@ -1584,8 +1583,6 @@ dns_rpz_dbupdate_callback(dns_db_t *db, void *fn_arg) {
 	REQUIRE(zone != NULL);

 	LOCK(&zone->rpzs->maint_lock);
-	REQUIRE(zone->db_registered);
-

 	/* New zone came as AXFR */
 	if (zone->db != NULL && zone->db != db) {
@@ -2097,14 +2094,12 @@ rpz_detach(dns_rpz_zone_t **rpzp, dns_rpz_zones_t *rpzs) {
 	if (dns_name_dynamic(&rpz->cname)) {
 		dns_name_free(&rpz->cname, rpzs->mctx);
 	}
-	if (rpz->db_registered) {
-		dns_db_updatenotify_unregister(rpz->db,
-					       dns_rpz_dbupdate_callback, rpz);
-	}
 	if (rpz->dbversion != NULL) {
 		dns_db_closeversion(rpz->db, &rpz->dbversion, false);
 	}
 	if (rpz->db != NULL) {
+		dns_db_updatenotify_unregister(
+			rpz->db, dns_rpz_dbupdate_callback, rpz);
 		dns_db_detach(&rpz->db);
 	}
 	if (rpz->updaterunning) {
@@ -1783,16 +1783,27 @@ dns_zone_get_rpz_num(dns_zone_t *zone) {
 void
 dns_zone_rpz_enable_db(dns_zone_t *zone, dns_db_t *db) {
 	isc_result_t result;
-	if (zone->rpz_num == DNS_RPZ_INVALID_NUM)
+	if (zone->rpz_num == DNS_RPZ_INVALID_NUM) {
 		return;
+	}
 	REQUIRE(zone->rpzs != NULL);
-	zone->rpzs->zones[zone->rpz_num]->db_registered = true;
 	result = dns_db_updatenotify_register(db,
 					      dns_rpz_dbupdate_callback,
 					      zone->rpzs->zones[zone->rpz_num]);
 	REQUIRE(result == ISC_R_SUCCESS);
 }

+static void
+dns_zone_rpz_disable_db(dns_zone_t *zone, dns_db_t *db) {
+	if (zone->rpz_num == DNS_RPZ_INVALID_NUM) {
+		return;
+	}
+	REQUIRE(zone->rpzs != NULL);
+	(void) dns_db_updatenotify_unregister(db,
+					      dns_rpz_dbupdate_callback,
+					      zone->rpzs->zones[zone->rpz_num]);
+}
+
 void
 dns_zone_catz_enable(dns_zone_t *zone, dns_catz_zones_t *catzs) {
 	REQUIRE(DNS_ZONE_VALID(zone));
@@ -1801,8 +1812,9 @@ dns_zone_catz_enable(dns_zone_t *zone, dns_catz_zones_t *catzs) {
 	LOCK_ZONE(zone);
 	INSIST(zone->catzs == NULL || zone->catzs == catzs);
 	dns_catz_catzs_set_view(catzs, zone->view);
-	if (zone->catzs == NULL)
+	if (zone->catzs == NULL) {
 		dns_catz_catzs_attach(catzs, &zone->catzs);
+	}
 	UNLOCK_ZONE(zone);
 }

@@ -1820,6 +1832,17 @@ dns_zone_catz_enable_db(dns_zone_t *zone, dns_db_t *db) {
 	}
 }

+static void
+dns_zone_catz_disable_db(dns_zone_t *zone, dns_db_t *db) {
+	REQUIRE(DNS_ZONE_VALID(zone));
+	REQUIRE(db != NULL);
+
+	if (zone->catzs != NULL) {
+		dns_db_updatenotify_unregister(db, dns_catz_dbupdate_callback,
+					       zone->catzs);
+	}
+}
+
 /*
 * Set catalog zone ownership of the zone
 */
@@ -2120,7 +2143,7 @@ zone_load(dns_zone_t *zone, unsigned int flags, bool locked) {
 		}
 	}

-	if (! dns_db_ispersistent(db)) {
+	if (!dns_db_ispersistent(db)) {
 		if (zone->masterfile != NULL) {
 			result = zone_startload(db, zone, loadtime);
 		} else {
@@ -2487,16 +2510,21 @@ dns_zone_setrawdata(dns_zone_t *zone, dns_masterrawheader_t *header) {

 static isc_result_t
 zone_startload(dns_db_t *db, dns_zone_t *zone, isc_time_t loadtime) {
+	const char me[] = "zone_startload";
 	dns_load_t *load;
 	isc_result_t result;
 	isc_result_t tresult;
 	unsigned int options;

+	ENTER;
+
 	dns_zone_rpz_enable_db(zone, db);
 	dns_zone_catz_enable_db(zone, db);
+
 	options = get_master_options(zone);
-	if (DNS_ZONE_OPTION(zone, DNS_ZONEOPT_MANYERRORS))
+	if (DNS_ZONE_OPTION(zone, DNS_ZONEOPT_MANYERRORS)) {
 		options |= DNS_MASTER_MANYERRORS;
+	}

 	if (zone->zmgr != NULL && zone->db != NULL && zone->loadtask != NULL) {
 		load = isc_mem_get(zone->mctx, sizeof(*load));
@@ -2516,8 +2544,9 @@ zone_startload(dns_db_t *db, dns_zone_t *zone, isc_time_t loadtime) {
 		load->callbacks.rawdata = zone_setrawdata;
 		zone_iattach(zone, &load->callbacks.zone);
 		result = dns_db_beginload(db, &load->callbacks);
-		if (result != ISC_R_SUCCESS)
+		if (result != ISC_R_SUCCESS) {
 			goto cleanup;
+		}
 		result = zonemgr_getio(zone->zmgr, true, zone->loadtask,
 				       zone_gotreadhandle, load,
 				       &zone->readio);
@@ -2528,8 +2557,9 @@ zone_startload(dns_db_t *db, dns_zone_t *zone, isc_time_t loadtime) {
 			 */
 			(void)dns_db_endload(load->db, &load->callbacks);
 			goto cleanup;
-		} else
+		} else {
 			result = DNS_R_CONTINUE;
+		}
 	} else {
 		dns_rdatacallbacks_t callbacks;

@@ -2550,8 +2580,9 @@ zone_startload(dns_db_t *db, dns_zone_t *zone, isc_time_t loadtime) {
 					     zone->masterformat,
 					     zone->maxttl);
 		tresult = dns_db_endload(db, &callbacks);
-		if (result == ISC_R_SUCCESS)
+		if (result == ISC_R_SUCCESS) {
 			result = tresult;
+		}
 		zone_idetach(&callbacks.zone);
 	}

@@ -3931,9 +3962,10 @@ compute_tag(dns_name_t *name, dns_rdata_dnskey_t *dnskey, isc_mem_t *mctx,
 			     dns_rdatatype_dnskey, dnskey, &buffer);

 	result = dns_dnssec_keyfromrdata(name, &rdata, mctx, &dstkey);
-	if (result == ISC_R_SUCCESS)
+	if (result == ISC_R_SUCCESS) {
 		*tag = dst_key_id(dstkey);
-	dst_key_free(&dstkey);
+		dst_key_free(&dstkey);
+	}

 	return (result);
 }
@@ -9652,6 +9684,17 @@ keyfetch_done(isc_task_t *task, isc_event_t *event) {

 		dns_keydata_todnskey(&keydata, &dnskey, NULL);
 		result = compute_tag(keyname, &dnskey, mctx, &keytag);
+		if (result != ISC_R_SUCCESS) {
+			/*
+			 * Skip if we cannot compute the key tag.
+			 * This may happen if the algorithm is unsupported
+			 */
+			dns_zone_log(zone, ISC_LOG_ERROR,
+				"Cannot compute tag for key in zone %s: %s "
+				"(skipping)",
+				namebuf, dns_result_totext(result));
+			continue;
+		}
 		RUNTIME_CHECK(result == ISC_R_SUCCESS);

 		/*
@@ -9765,6 +9808,17 @@ keyfetch_done(isc_task_t *task, isc_event_t *event) {
 		}

 		result = compute_tag(keyname, &dnskey, mctx, &keytag);
+		if (result != ISC_R_SUCCESS) {
+			/*
+			 * Skip if we cannot compute the key tag.
+			 * This may happen if the algorithm is unsupported
+			 */
+			dns_zone_log(zone, ISC_LOG_ERROR,
+				"Cannot compute tag for key in zone %s: %s "
+				"(skipping)",
+				namebuf, dns_result_totext(result));
+			continue;
+		}
 		RUNTIME_CHECK(result == ISC_R_SUCCESS);

 		revoked = ((dnskey.flags & DNS_KEYFLAG_REVOKE) != 0);
@@ -15778,6 +15832,15 @@ zone_loaddone(void *arg, isc_result_t result) {

 	ENTER;

+	/*
+	 * If zone loading failed, remove the update db callbacks prior
+	 * to calling the list of callbacks in the zone load structure.
+	 */
+	if (result != ISC_R_SUCCESS) {
+		dns_zone_rpz_disable_db(zone, load->db);
+		dns_zone_catz_disable_db(zone, load->db);
+	}
+
 	tresult = dns_db_endload(load->db, &load->callbacks);
 	if (tresult != ISC_R_SUCCESS &&
 	    (result == ISC_R_SUCCESS || result == DNS_R_SEENINCLUDE))
@@ -8,7 +8,7 @@
 # 9.10-sub: 180-189
 # 9.11: 160-169,1100-1199
 # 9.12: 1200-1299
-# 9.13: 1300-1399
+# 9.13/9.14: 1300-1499
 LIBINTERFACE = 1301
 LIBREVISION = 3
 LIBAGE = 0
@@ -8,7 +8,7 @@
 # 9.10-sub: 180-189
 # 9.11: 160-169,1100-1199
 # 9.12: 1200-1299
-# 9.13: 1300-1399
+# 9.13/9.14: 1300-1499
 LIBINTERFACE = 1306
-LIBREVISION = 0
+LIBREVISION = 1
 LIBAGE = 0
@@ -8,7 +8,7 @@
 # 9.10-sub: 180-189
 # 9.11: 160-169,1100-1199
 # 9.12: 1200-1299
-# 9.13: 1300-1399
+# 9.13/9.14: 1300-1499
 LIBINTERFACE = 1302
 LIBREVISION = 0
 LIBAGE = 0
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Tinderbox User	c2c957735f	Merge branch 'prep-release' into v9_14	2019-02-28 00:05:32 +00:00
Tinderbox User	4ea7fb82a7	doc rebuild	2019-02-28 00:05:06 +00:00
Tinderbox User	13c0bf922b	prep 9.14.0rc1	2019-02-27 23:50:01 +00:00
Evan Hunt	8d3931409e	Merge branch 'prep-914' into 'v9_14' documentation changes establishing the 9.14 stable branch See merge request isc-projects/bind9!1559	2019-02-27 18:33:05 -05:00
Evan Hunt	3396f9396f	documentation changes establishing the 9.14 stable branch	2019-02-27 18:06:35 -05:00
Matthijs Mekking	06d5da0204	Merge branch '813-matthijs-failure-loading-rpz-v9_14' into 'v9_14' Resolve "Problems after failure of loading rpz [ISC-support #14002]" See merge request isc-projects/bind9!1562	2019-02-22 10:05:07 -05:00
Matthijs MekkingandMatthijs Mekking	0f520ac026	Update CHANGES	2019-02-22 15:26:43 +01:00
Matthijs MekkingandMatthijs Mekking	05f156e8ba	Unregister RPZ CATZ db cbs when zone load fails In case when a zone fails to load because the file does not exist or is malformed, we should not run the callback that updates the zone database when the load is done. This is achieved by unregistering the callbacks if at zone load end if the result indicates something else than success.	2019-02-22 15:24:24 +01:00
Matthijs MekkingandMatthijs Mekking	ae159914b0	Update copyrights	2019-02-22 15:24:16 +01:00
Matthijs MekkingandMatthijs Mekking	d6cb3022a3	Add test for rpz zone load fail	2019-02-22 15:24:08 +01:00
Matthijs MekkingandMatthijs Mekking	6594f7acb2	Remove rpz->db_registered As pointed out in !813 db_registered is sort of redundant. It is set to `true` only in `dns_zone_rpz_enable_db()` right before the `dns_rpz_dbupdate_callback()` callback is registered. It is only required in that callback and it is the only place that the callback is registered. Therefore there is no path that that `REQUIRE` can fail. The `db_registered` variable is only set to `false` in `dns_rpz_new_zone`, so it is not like the variable is unset again later. The only other place where `db_registered` is checked is in `rpz_detach()`. If `true`, it will call `dns_db_updatenotify_unregister()`. However if that happens, the `db_registered` is not set back to `false` thus this implies that this may happen multiple times. If called a second time, most likely the unregister function will return `ISC_R_NOTFOUND`, but the return value is not checked anyway. So it can do without the `db_registered` check.	2019-02-22 15:23:59 +01:00
Matthijs MekkingandMatthijs Mekking	a4cd74e71a	Add curly brackets on if statements	2019-02-22 15:23:44 +01:00
Matthijs MekkingandMatthijs Mekking	48d7e4bb40	named crashes on shutdown after load rpz failed This may happen when loading an RPZ failed and the code path skips calling dns_db_endload(). The dns_rpz_zone_t object is still kept marked as having registered db. So when this object is finally destroyed in rpz_detach(), this code will incorrectly call `dns_db_updatenotify_unregister()`: if (rpz->db_registered) dns_db_updatenotify_unregister(rpz->db, dns_rpz_dbupdate_callback, rpz); and trigger this assertion failure: REQUIRE(db != NULL); To fix this, only call `dns_db_updatenotify_unregister()` when `rpz->db` is not NULL.	2019-02-22 15:23:33 +01:00
Matthijs MekkingandMatthijs Mekking	e2def297b6	Make RPZ tests more readable	2019-02-22 15:18:20 +01:00
Matthijs MekkingandMatthijs Mekking	c01d63373c	Add README to RPZ tests	2019-02-22 15:18:11 +01:00
Tinderbox User	6491691ac4	Merge branch 'prep-release' into security-v9_14	2019-02-21 02:11:26 +00:00
Tinderbox User	453f5da790	doc rebuild	2019-02-21 02:11:15 +00:00
Tinderbox User	856c74700f	prep 9.13.7	2019-02-21 01:57:08 +00:00
Evan Hunt	ce5857556b	Merge branch 'security-dlz-axfr-deny-broken' into security-master denied axfr requests were not effective for writable DLZ zones See merge request isc-private/bind9!57	2019-02-20 17:45:50 -08:00
Mark AndrewsandEvan Hunt	ed6c10d46b	add CHANGES and release notes entries	2019-02-20 17:45:50 -08:00
Mark AndrewsandEvan Hunt	bc01aadc02	denied axfr requests were not effective for writable DLZ zones	2019-02-20 17:45:50 -08:00
Evan Hunt	702e5dc21a	Merge 'keytag-memleak' into security-master	2019-02-20 17:45:49 -08:00
Evan Hunt	a47d2850c0	fix test error	2019-02-20 17:45:49 -08:00
Mark AndrewsandEvan Hunt	7d5b7192ec	add CHANGES and release note entries	2019-02-20 17:45:49 -08:00
Mark AndrewsandEvan Hunt	d68adfea9c	check that multiple KEY-TAG trust-anchor-telemetry options don't leak memory	2019-02-20 17:45:49 -08:00
Mark AndrewsandEvan Hunt	873c704de9	silently ignore additional keytag options	2019-02-20 17:45:49 -08:00
Evan Hunt	ff47556e26	Merge 'managed-key-assert' into security-master	2019-02-20 17:45:48 -08:00
Evan Hunt	f3fbbc20d2	Merge 'managed-key-assert' into security-master	2019-02-20 17:45:48 -08:00
Evan Hunt	8b8e492e48	use algorithm 255 for both unsupported keys	2019-02-20 17:45:48 -08:00
Matthijs MekkingandEvan Hunt	ea5a5b77f9	CHANGES, notes	2019-02-20 17:45:48 -08:00
Matthijs MekkingandEvan Hunt	98ef5c09d2	Update keyfetch_done compute_tag check If in keyfetch_done the compute_tag fails (because for example the algorithm is not supported), don't crash, but instead ignore the key.	2019-02-20 17:45:47 -08:00
Matthijs MekkingandEvan Hunt	3516864ade	Add tests for mkeys with unsupported algorithm These tests check if a key with an unsupported algorithm in managed-keys is ignored and when seeing an algorithm rollover to an unsupported algorithm, the new key will be ignored too.	2019-02-20 17:45:47 -08:00
Matthijs MekkingandEvan Hunt	5aa41ae9f8	Don't free key in compute_tag in case of failure If `dns_dnssec_keyfromrdata` failed we don't need to call `dst_key_free` because no `dstkey` was created. Doing so nevertheless will result in an assertion failure. This can happen if the key uses an unsupported algorithm.	2019-02-20 17:45:47 -08:00
Evan Hunt	566ad7021e	Merge branch 'setup-v914' into v9_14	2019-02-20 17:44:43 -08:00
Evan Hunt	2579f31f54	begin setup of 9.14 branch	2019-02-20 17:44:32 -08:00
				`@@ -0,0 +1 @@`
				`. IN DNSKEY 257 3 255 BJiXuidPHuGIne8GlCBLG+Oq/FZruQd2s3uBo+SxY16NUP/Vwl8MctMK62KsblDU1gIJAdEMVep2tsOkuSm0bIbJ8NBex+N9rSvzH2YJlDCT9QnNfv4q5RRTcVA3lk9nkmWHo6zcAT33yuS+THOCSznOMCJRq8JGZ6xqMJLv9FucuK6CCe6QBAZ5e98dpyGTWQLu7AERKKFqda9YCk3KQfdzx/HZ4SpQpRLncIXvGm1PIMT8Ar95NB/BsFJGwr5ZTaQtRYOXf2DD7wD3pfMsTJCdZyC0J0EtGBG109I+Oou1cswUfqZLXip/aV3eaBAUqLcZpg8P8vAbrvEq4uMS4OMZeXL6nu0irrdS1Pqmax8RsC+x3fg9EBH3QmHroJZtiU5h+0x4qApp7HE4Z5zFRuxIp9iB`
				`@@ -0,0 +1 @@`
				`-m record,size,mctx -T clienttest -c named.conf -d 99 -X named.lock -g -T mkeytimers=5/10/20`
				`@@ -0,0 +1 @@`
				`unsupported. IN DNSKEY 257 3 255 BOOVAhiJDPqhfU7+yGXjhetrtC/rtjmwO1yo52BUHUd8R4hQ/ZPdYCVvQlvNkRxDblPkFM5YRXkesS30pJSoNYrg+djbMNumJrLG+lbhFIc/ahTjlYOxb1zm2z00ubHju/1uGBifiRvKWSK0Vr0u6NtS4PKZfsnXt+piSHiRAHSfkjGHwqPYYKh9EUW12kJmIzlMaM6WYl+gJOvL+f8VqNLtvsMPT6OPK/3h/Dnfnxyeudp/jzAnNDDiTgX2XfzIXB4UwxtzIOGaHLnprpNf3zoBm0kyaEdSQQ/qKkpCOqjBasYEHRjVz3RncPUkdLr7PQuPBfFDr3SUMMJqufJrO4IJjtD4cCBT7K1i39Jg471nEzU1vkPzxF+Rw1QHT4nZaXbltf3BEZGS4Knoe9XPwi5KjGW6`