Merge branch 'prep-release' into security-v9_14

doc rebuild
prep 9.14.1
2019-04-06 20:09:59 +00:00 · 2019-04-06 20:09:50 +00:00 · 2019-04-06 20:04:17 +00:00 · 2019-04-06 12:58:15 -07:00 · 2019-04-06 12:58:12 -07:00 · 2019-04-06 12:58:01 -07:00
254 changed files with 3597 additions and 3642 deletions
@@ -1,36 +1,58 @@
-Makefile
-config.log
-config.h
-config.cache
-config.status
-libtool
-/isc-config.sh
-/configure.lineno
-autom4te.cache/
-*.rej
-*.orig
-*.o
-*.lo
-*.so
-*.a
-*.la
-*.gcno
-*.gcda
-*_test
 *-symtbl.c
-timestamp
-ans.run
-named.run
-named.memstats
-gen.dSYM/
+*.a
+*.gcda
+*.gcno
+*.la
+*.lo
+*.o
+*.orig
+*.plist/ # ccc-analyzer store its results in .plist directories
+*.rej
+*.so
+*_test
+*~
 .ccache/
+.cproject
 .deps/
 .dirstamp
 .libs/
-# ccc-analyzer store its results in .plist directories
-*.plist/
-*~
 .project
-.cproject
 .settings
-kyua.log
+/aclocal.m4
+/ar-lib
+/autom4te.cache/
+/bind.keys.h
+/compile
+/config.cache
+/config.guess
+/config.h
+/config.h.in
+/config.log
+/config.status
+/config.sub
+/configure
+/configure.lineno
+/depcomp
+/install-sh
+/isc-config.sh
+/libltdl/*
+/libtool
+/ltmain.sh
+/m4/libtool.m4
+/m4/ltargz.m4
+/m4/ltdl.m4
+/m4/ltoptions.m4
+/m4/ltsugar.m4
+/m4/ltversion.m4
+/m4/lt~obsolete.m4
+/missing
+/py-compile
+/stamp-h1
+/test-driver
+Makefile
+ans.run
+gen.dSYM/
+kyua.log
+named.memstats
+named.run
+timestamp
@@ -167,6 +167,7 @@ misc:sid:amd64:
    - if test "$(git status --porcelain | grep -Ev '\?\?' | wc -l)" -gt "0"; then git status --short; exit 1; fi
    - xmllint --noout --nonet `git ls-files '*.xml' '*.docbook'`
    - xmllint --noout --nonet --html `git ls-files '*.html'`
+    - sh util/check-win32util-configure
  artifacts:
    paths:
      - util/newcopyrights
@@ -1,3 +1,108 @@
+	--- 9.14.1 released ---
+
+5201.	[bug]		Fix a possible deadlock in RPZ update code. [GL #973]
+
+5200.	[security]	tcp-clients settings could be exceeded in some cases,
+			which could lead to exhaustion of file descriptors.
+			(CVE-2018-5743) [GL #615]
+
+5199.	[security]	In certain configurations, named could crash
+			if nxdomain-redirect was in use and a redirected
+			query resulted in an NXDOMAIN from the cache.
+			(CVE-2019-6467) [GL #880]
+
+5198.	[bug]		If a fetch context was being shut down and, at the same
+			time, we returned from qname minimization, an INSIST
+			could be hit. [GL #966]
+
+5197.	[bug]		dig could die in best effort mode on multiple SIG(0)
+			records. Similarly on multiple OPT and multiple TSIG
+			records. [GL #920]
+
+5196.	[bug]		make install failed with --with-dlopen=no. [GL #955]
+
+5195.	[bug]		"allow-update" and "allow-update-forwarding" were
+			treated as configuration errors if used at the
+			options or view level. [GL #913]
+
+5194.	[bug]		Enforce non empty ZOMEMD hash. [GL #899]
+
+5193.	[bug]		EID and NIMLOC failed to do multi-line output
+			correctly. [GL #899]
+
+5189.	[cleanup]	Remove revoked root DNSKEY from bind.keys. [GL #945]
+
+5187.	[test]		Set time zone before running any tests in dnstap_test.
+			[GL #940]
+
+5186.	[cleanup]	More dnssec-keygen manual tidying. [GL !1678]
+
+5184.	[bug]		Missing unlocks in sdlz.c. [GL #936]
+
+5183.	[bug]		Reinitialize ECS data before reusing client
+			structures. [GL #881]
+
+	--- 9.14.0 released ---
+
+	--- 9.14.0rc3 released ---
+
+5182.	[bug]		Fix a high-load race/crash in handling of
+			isc_socket_close() in resolver. [GL #834]
+
+5180.	[bug]		delv now honors the operating system's preferred
+			ephemeral port range. [GL #925]
+
+5179.	[cleanup]	Replace some vague type declarations with the more
+			specific dns_secalg_t and dns_dsdigest_t.
+			Thanks to Tony Finch. [GL !1498]
+
+5178.	[bug]		Handle EDQUOT (disk quota) and ENOSPC (disk full)
+			errors when writing files. [GL #902]
+
+5177.	[func]		Add the ability to specify in named.conf whether a
+			response-policy zone's SOA record should be added
+			to the additional section (add-soa yes/no). [GL #865]
+
+5167.	[bug]		nxdomain-redirect could sometimes lookup the wrong
+			redirect name. [GL #892]
+
+	--- 9.14.0rc2 released ---
+
+5176.	[tests]		Remove a dependency on libxml in statschannel system
+			test. [GL #926]
+
+5175.	[bug]		Fixed a problem with file input in dnssec-keymgr,
+			dnssec-coverage and dnssec-checkds when using
+			python3. [GL #882]
+
+5174.	[doc]		Tidy dnssec-keygen manual. [GL !1557]
+
+5173.	[bug]		Fixed a race in socket code that could occur when
+			accept, send, or recv were called from an event
+			loop but the socket had been closed by another
+			thread. [RT #874]
+
+5172.	[bug]		nsupdate now honors the operating system's preferred
+			ephemeral port range. [GL #905]
+
+5171.	[func]		named plugins are now installed into a separate
+			directory.  Supplying a filename (a string without path
+			separators) in a "plugin" configuration stanza now
+			causes named to look for that plugin in that directory.
+			[GL #878]
+
+5170.	[test]		Added --with-dlz-filesystem to feature-test. [GL !1587]
+
+5169.	[bug]		The presence of certain types in an otherwise
+			empty node could cause a crash while processing a
+			type ANY query. [GL #901]
+
+	--- 9.14.0rc1 released ---
+
+5168.	[bug]		Do not crash on shutdown when RPZ fails to load.  Also,
+			keep previous version of the database if RPZ fails to
+			load. [GL #813]
+
 5165.	[contrib]	Removed SDB drivers from contrib; they're obsolete.
 			[GL #428]

@@ -25,6 +130,18 @@
 5157.	[bug]		Nslookup now errors out if there are extra command
 			line arguments. [GL #207]

+5141.	[security]	Zone transfer controls for writable DLZ zones were
+			not effective as the allowzonexfr method was not being
+			called for such zones. (CVE-2019-6465) [GL #790]
+
+5118.	[security]	Named could crash if it is managing a key with
+			`managed-keys` and the authoritative zone is rolling
+			the key to an unsupported algorithm. (CVE-2018-5745)
+			[GL #780]
+
+5110.	[security]	Named leaked memory if there were multiple Key Tag
+			EDNS options present. (CVE-2018-5744) [GL #772]
+
 	--- 9.13.6 released ---

 5156.	[doc]		Extended and refined the section of the ARM describing
@@ -48,7 +165,7 @@
 			- Zone signing and DNSKEY maintenance events are
 			  now logged to the "dnssec" category
 			- Messages are now logged when DNSSEC keys are
-			  pubished, activated, inactivated, deleted,
+			  published, activated, inactivated, deleted,
 			  or revoked.
 			[GL #714]

@@ -85,8 +202,6 @@
 			and "nsdname-enable" both now default to yes,
 			regardless of compile-time settings. [GL #824]

-5141.	[placeholder]
-
 5140.	[bug]		Don't immediately mark existing keys as inactive and
 			deleted when running dnssec-keymgr for the first
 			time. [GL #117]
@@ -157,8 +272,6 @@

 5119.	[placeholder]

-5118.	[placeholder]
-
 5117.	[placeholder]

 5116.	[bug]		Named/named-checkconf triggered a assertion when
@@ -179,8 +292,6 @@
 5111.	[bug]		Occluded DNSKEY records could make it into the
 			delegating NSEC/NSEC3 bitmap. [GL #742]

-5110.	[placeholder]
-
 5109.	[cleanup]	Remove support for RSAMD5 algorithm. [GL #628]

 	--- 9.13.5 released ---
@@ -259,8 +370,8 @@
 5091.	[func]		Two new global and per-view options min-cache-ttl
 			and min-ncache-ttl [GL #613]

-5090.	[bug]		dig and mdig failed to properly preparse dash value
-			pairs when value was a seperate argument and started
+5090.	[bug]		dig and mdig failed to properly pre-parse dash value
+			pairs when value was a separate argument and started
 			with a dash. [GL #584]

 5089.	[bug]		Restore localhost fallback in dig and host which is
@@ -326,7 +437,7 @@
 5072.	[bug]		Add unit tests for isc_buffer_copyregion() and fix its
 			behavior for auto-reallocated buffers. [GL #644]

-5071.	[bug]		Comparision of NXT records was broken. [GL #631]
+5071.	[bug]		Comparison of NXT records was broken. [GL #631]

 5070.	[bug]		Record types which support a empty rdata field were
 			not handling the empty rdata field case. [GL #638]
@@ -345,7 +456,7 @@

 5065.	[bug]		Only set IPV6_USE_MIN_MTU on IPv6. [GL #553]

-5064.	[test]		Initalize TZ environment variable before calling
+5064.	[test]		Initialize TZ environment variable before calling
 			dns_test_begin in dnstap_test. [GL #624]

 5063.	[test]		In statschannel test try a few times before failing
@@ -571,7 +682,7 @@
 5001.	[bug]		Fix refcount errors on error paths. [GL !563]

 5000.	[bug]		named_server_servestale() could leave the server in
-			exclusive mode if an error occured. [GL #441]
+			exclusive mode if an error occurred. [GL #441]

 4999.	[cleanup]	Remove custom printf implementation in lib/isc/print.c.
 			[GL #261]
@@ -13,7 +13,7 @@ offer support on a "best effort" basis for some.

 Regularly tested platforms

-As of Jan 2019, BIND 9.13 is fully supported and regularly tested on the
+As of Feb 2019, BIND 9.14 is fully supported and regularly tested on the
 following systems:

  * Debian 8, 9, 10
@@ -51,7 +51,7 @@ Server 2012 R2, none of these are tested regularly by ISC.

 Unsupported platforms

-These are platforms on which BIND 9.13 is known not to build or run:
+These are platforms on which BIND 9.14 is known not to build or run:

  * Platforms without at least OpenSSL 1.0.2
  * Windows 10 / x86
@@ -88,3 +88,11 @@ Debian armhf documentation):
 The configure command should look like this:

 CFLAGS="-march=armv7-a -mfpu=vfpv3-d16 -Os -g" ./configure
+
+NetBSD 6 i386
+
+The i386 build of NetBSD requires the libatomic library, available from
+the gcc5-libs package. Because this library is in a non-standard path, its
+location must be specified in the configure command line:
+
+LDFLAGS="-L/usr/pkg/gcc5/i486--netbsdelf/lib/ -Wl,-R/usr/pkg/gcc5/i486--netbsdelf/lib/" ./configure
@@ -23,7 +23,7 @@ offer support on a "best effort" basis for some.

 ### Regularly tested platforms

-As of Jan 2019, BIND 9.13 is fully supported and regularly tested on the
+As of Feb 2019, BIND 9.14 is fully supported and regularly tested on the
 following systems:

 * Debian 8, 9, 10
@@ -60,7 +60,7 @@ Server 2012 R2, none of these are tested regularly by ISC.

 ## Unsupported platforms

-These are platforms on which BIND 9.13 is known *not* to build or run:
+These are platforms on which BIND 9.14 is known *not* to build or run:

 * Platforms without at least OpenSSL 1.0.2
 * Windows 10 / x86
@@ -95,8 +95,18 @@ armhf documentation):
  the processors to support here, therefore the recommended build option is
  `-mfpu=vfpv3-d16`.

-The configure command should look like this:
+The `configure` command should look like this:

 ```
 CFLAGS="-march=armv7-a -mfpu=vfpv3-d16 -Os -g" ./configure
 ```
+
+### NetBSD 6 i386
+
+The i386 build of NetBSD requires the `libatomic` library, available from
+the `gcc5-libs` package.  Because this library is in a non-standard path,
+its location must be specified in the `configure` command line:
+
+```
+LDFLAGS="-L/usr/pkg/gcc5/i486--netbsdelf/lib/ -Wl,-R/usr/pkg/gcc5/i486--netbsdelf/lib/" ./configure
+```
@@ -5,7 +5,7 @@ Contents
 1. Introduction
 2. Reporting bugs and getting help
 3. Contributing to BIND
- 4. BIND 9.13 features
+ 4. BIND 9.14 features
 5. Building BIND
 6. macOS
 7. Dependencies
@@ -100,17 +100,19 @@ If you prefer, you may also submit code by opening a GitLab Issue and
 including your patch as an attachment, preferably generated by git
 format-patch.

-BIND 9.13 features
+BIND 9.14 features

-BIND 9.13 is the newest development branch of BIND 9. It includes a number
-of changes from BIND 9.12 and earlier releases. New features include:
+BIND 9.14.0 is the first release from a new stable branch of BIND 9,
+incorporating all changes from the 9.13 development branch, updating the
+most recent stable branch, 9.12. These changes include:

  * A new "plugin" mechanism has been added to allow query functionality
    to be extended using dynamically loadable libraries. The "filter-aaaa"
    feature has been removed from named and is now implemented as a
    plugin.
-  * Socket and task code has been refactored to improve performance.
  * QNAME minimization, as described in RFC 7816, is now supported.
+  * Socket and task code has been refactored to improve performance on
+    most modern machines.
  * "Root key sentinel" support, enabling validating resolvers to indicate
    via a special query which trust anchors are configured for the root
    zone.
@@ -138,7 +140,13 @@ is now mandatory: building BIND without DNSSEC is no longer supported.
 Special code to support certain legacy operating systems has also been
 removed; see the file PLATFORMS.md for details of supported platforms. In
 addition to OpenSSL, BIND now requires support for IPv6, threads, and
-standard atomic operations provided by the C compiler.
+standard atomic operations provided by the C compiler. Non-threaded builds
+are no longer supported.
+
+BIND 9.14.1
+
+BIND 9.14.1 is a maintenance release, and addresses security
+vulnerabilities disclosed in CVE-2018-5743 and CVE-2019-6467.

 Building BIND

@@ -15,7 +15,7 @@
 1. [Introduction](#intro)
 1. [Reporting bugs and getting help](#help)
 1. [Contributing to BIND](#contrib)
-1. [BIND 9.13 features](#features)
+1. [BIND 9.14 features](#features)
 1. [Building BIND](#build)
 1. [macOS](#macos)
 1. [Dependencies](#dependencies)
@@ -117,17 +117,18 @@ If you prefer, you may also submit code by opening a
 including your patch as an attachment, preferably generated by
 `git format-patch`.

-### <a name="features"/> BIND 9.13 features
+### <a name="features"/> BIND 9.14 features

-BIND 9.13 is the newest development branch of BIND 9. It includes a
-number of changes from BIND 9.12 and earlier releases.  New features
-include:
+BIND 9.14.0 is the first release from a new stable branch of BIND 9,
+incorporating all changes from the 9.13 development branch, updating
+the most recent stable branch, 9.12.  These changes include:

 * A new "plugin" mechanism has been added to allow query functionality
  to be extended using dynamically loadable libraries. The "filter-aaaa"
  feature has been removed from named and is now implemented as a plugin.
-* Socket and task code has been refactored to improve performance.
 * QNAME minimization, as described in RFC 7816, is now supported.
+* Socket and task code has been refactored to improve performance on most
+  modern machines.
 * "Root key sentinel" support, enabling validating resolvers to indicate
  via a special query which trust anchors are configured for the root zone.
 * Secondary zones can now be configured as "mirror" zones; their contents
@@ -157,7 +158,12 @@ Special code to support certain legacy operating systems has also
 been removed; see the file [PLATFORMS.md](PLATFORMS.md) for details
 of supported platforms. In addition to OpenSSL, BIND now requires
 support for IPv6, threads, and standard atomic operations provided
-by the C compiler.
+by the C compiler. Non-threaded builds are no longer supported.
+
+#### BIND 9.14.1
+
+BIND 9.14.1 is a maintenance release, and addresses security
+vulnerabilities disclosed in CVE-2018-5743 and CVE-2019-6467.

 ### <a name="build"/> Building BIND

@@ -63,7 +63,7 @@ usage(void) ISC_PLATFORM_NORETURN_POST;

 static void
 usage(void) {
-	fprintf(stderr, "usage: %s [-hjlvz] [-p [-x]] [-t directory] "
+	fprintf(stderr, "usage: %s [-chjlvz] [-p [-x]] [-t directory] "
 		"[named.conf]\n", program);
 	exit(1);
 }
@@ -86,7 +86,7 @@ static dns_rdataclass_t rdclass = dns_rdataclass_in;
 * List of digest types used by ds_from_cdnskey(), filled in by add_dtype()
 * from -a arguments. The size of the array is an arbitrary limit.
 */
-static uint8_t dtype[8];
+static dns_dsdigest_t dtype[8];

 static const char *startstr  = NULL;	/* from which we derive notbefore */
 static isc_stdtime_t notbefore = 0;	/* restrict sig inception times */
@@ -129,7 +129,7 @@ static int nkey; /* number of child zone DNSKEY records */
 typedef struct keyinfo {
 	dns_rdata_t rdata;
 	dst_key_t *dst;
-	uint8_t algo;
+	dns_secalg_t algo;
 	dns_keytag_t tag;
 } keyinfo_t;

@@ -614,12 +614,12 @@ free_keytable(keyinfo_t **keytable_p) {
 * otherwise the key algorithm. This is used by the signature coverage
 * check functions below.
 */
-static uint8_t *
+static dns_secalg_t *
 matching_sigs(keyinfo_t *keytbl, dns_rdataset_t *rdataset,
 	      dns_rdataset_t *sigset)
 {
 	isc_result_t result;
-	uint8_t *algo;
+	dns_secalg_t *algo;
 	int i;

 	algo = isc_mem_get(mctx, nkey);
@@ -702,7 +702,7 @@ matching_sigs(keyinfo_t *keytbl, dns_rdataset_t *rdataset,
 * fetched from the child zone, any working signature is enough.
 */
 static bool
-signed_loose(uint8_t *algo) {
+signed_loose(dns_secalg_t *algo) {
 	bool ok = false;
 	int i;
 	for (i = 0; i < nkey; i++) {
@@ -721,7 +721,7 @@ signed_loose(uint8_t *algo) {
 * RRset.
 */
 static bool
-signed_strict(dns_rdataset_t *dsset, uint8_t *algo) {
+signed_strict(dns_rdataset_t *dsset, dns_secalg_t *algo) {
 	isc_result_t result;
 	bool all_ok = true;

@@ -844,14 +844,14 @@ ds_from_cdnskey(dns_rdatalist_t *dslist, isc_buffer_t *buf,
 */
 static int
 cmp_dtype(const void *ap, const void *bp) {
-	int a = *(const uint8_t *)ap;
-	int b = *(const uint8_t *)bp;
+	int a = *(const dns_dsdigest_t *)ap;
+	int b = *(const dns_dsdigest_t *)bp;
 	return (a - b);
 }

 static void
 add_dtype(const char *dn) {
-	uint8_t dt;
+	dns_dsdigest_t dt;
 	unsigned i, n;

 	dt = strtodsdigest(dn);
@@ -936,7 +936,7 @@ consistent_digests(dns_rdataset_t *dsset) {
 	dns_rdata_t *arrdata;
 	dns_rdata_ds_t *ds;
 	dns_keytag_t key_tag;
-	uint8_t algorithm;
+	dns_secalg_t algorithm;
 	bool match;
 	int i, j, n, d;

@@ -235,7 +235,7 @@ logkey(dns_rdata_t *rdata)
 }

 static void
-emit(unsigned int dtype, bool showall, char *lookaside,
+emit(dns_dsdigest_t dtype, bool showall, char *lookaside,
     bool cds, dns_rdata_t *rdata)
 {
 	isc_result_t result;
@@ -350,7 +350,7 @@ main(int argc, char **argv) {
 	char		*lookaside = NULL;
 	char		*endp;
 	int		ch;
-	unsigned int	dtype = DNS_DSDIGEST_SHA1;
+	dns_dsdigest_t	dtype = DNS_DSDIGEST_SHA1;
 	bool	cds = false;
 	bool	both = true;
 	bool	usekeyset = false;
@@ -39,7 +39,7 @@
 dnssec-keygen \- DNSSEC key generation tool
 .SH "SYNOPSIS"
 .HP \w'\fBdnssec\-keygen\fR\ 'u
-\fBdnssec\-keygen\fR [\fB\-a\ \fR\fB\fIalgorithm\fR\fR] [\fB\-b\ \fR\fB\fIkeysize\fR\fR] [\fB\-n\ \fR\fB\fInametype\fR\fR] [\fB\-3\fR] [\fB\-A\ \fR\fB\fIdate/offset\fR\fR] [\fB\-C\fR] [\fB\-c\ \fR\fB\fIclass\fR\fR] [\fB\-D\ \fR\fB\fIdate/offset\fR\fR] [\fB\-D\ sync\ \fR\fB\fIdate/offset\fR\fR] [\fB\-E\ \fR\fB\fIengine\fR\fR] [\fB\-f\ \fR\fB\fIflag\fR\fR] [\fB\-G\fR] [\fB\-g\ \fR\fB\fIgenerator\fR\fR] [\fB\-h\fR] [\fB\-I\ \fR\fB\fIdate/offset\fR\fR] [\fB\-i\ \fR\fB\fIinterval\fR\fR] [\fB\-K\ \fR\fB\fIdirectory\fR\fR] [\fB\-k\fR] [\fB\-L\ \fR\fB\fIttl\fR\fR] [\fB\-P\ \fR\fB\fIdate/offset\fR\fR] [\fB\-P\ sync\ \fR\fB\fIdate/offset\fR\fR] [\fB\-p\ \fR\fB\fIprotocol\fR\fR] [\fB\-q\fR] [\fB\-R\ \fR\fB\fIdate/offset\fR\fR] [\fB\-S\ \fR\fB\fIkey\fR\fR] [\fB\-s\ \fR\fB\fIstrength\fR\fR] [\fB\-t\ \fR\fB\fItype\fR\fR] [\fB\-V\fR] [\fB\-v\ \fR\fB\fIlevel\fR\fR] [\fB\-z\fR] {name}
+\fBdnssec\-keygen\fR [\fB\-3\fR] [\fB\-A\ \fR\fB\fIdate/offset\fR\fR] [\fB\-a\ \fR\fB\fIalgorithm\fR\fR] [\fB\-b\ \fR\fB\fIkeysize\fR\fR] [\fB\-C\fR] [\fB\-c\ \fR\fB\fIclass\fR\fR] [\fB\-D\ \fR\fB\fIdate/offset\fR\fR] [\fB\-D\ sync\ \fR\fB\fIdate/offset\fR\fR] [\fB\-E\ \fR\fB\fIengine\fR\fR] [\fB\-f\ \fR\fB\fIflag\fR\fR] [\fB\-G\fR] [\fB\-g\ \fR\fB\fIgenerator\fR\fR] [\fB\-h\fR] [\fB\-I\ \fR\fB\fIdate/offset\fR\fR] [\fB\-i\ \fR\fB\fIinterval\fR\fR] [\fB\-K\ \fR\fB\fIdirectory\fR\fR] [\fB\-k\fR] [\fB\-L\ \fR\fB\fIttl\fR\fR] [\fB\-n\ \fR\fB\fInametype\fR\fR] [\fB\-P\ \fR\fB\fIdate/offset\fR\fR] [\fB\-P\ sync\ \fR\fB\fIdate/offset\fR\fR] [\fB\-p\ \fR\fB\fIprotocol\fR\fR] [\fB\-q\fR] [\fB\-R\ \fR\fB\fIdate/offset\fR\fR] [\fB\-S\ \fR\fB\fIkey\fR\fR] [\fB\-s\ \fR\fB\fIstrength\fR\fR] [\fB\-t\ \fR\fB\fItype\fR\fR] [\fB\-V\fR] [\fB\-v\ \fR\fB\fIlevel\fR\fR] {name}
 .SH "DESCRIPTION"
 .PP
 \fBdnssec\-keygen\fR
@@ -58,6 +58,13 @@ may be preferable to direct use of
 \fBdnssec\-keygen\fR\&.
 .SH "OPTIONS"
 .PP
+\-3
+.RS 4
+Use an NSEC3\-capable algorithm to generate a DNSSEC key\&. If this option is used with an algorithm that has both NSEC and NSEC3 versions, then the NSEC3 version will be used; for example,
+\fBdnssec\-keygen \-3a RSASHA1\fR
+specifies the NSEC3RSASHA1 algorithm\&.
+.RE
+.PP
 \-a \fIalgorithm\fR
 .RS 4
 Selects the cryptographic algorithm\&. For DNSSEC keys, the value of
@@ -83,29 +90,15 @@ to generate TSIG keys\&.
 .PP
 \-b \fIkeysize\fR
 .RS 4
-Specifies the number of bits in the key\&. The choice of key size depends on the algorithm used\&. RSA keys must be between 1024 and 2048 bits\&. Diffie Hellman keys must be between 128 and 4096 bits\&. DSA keys must be between 512 and 1024 bits and an exact multiple of 64\&. HMAC keys must be between 1 and 512 bits\&. Elliptic curve algorithms don\*(Aqt need this parameter\&.
+Specifies the number of bits in the key\&. The choice of key size depends on the algorithm used\&. RSA keys must be between 1024 and 4096 bits\&. Diffie Hellman keys must be between 128 and 4096 bits\&. Elliptic curve algorithms don\*(Aqt need this parameter\&.
 .sp
 If the key size is not specified, some algorithms have pre\-defined defaults\&. For example, RSA keys for use as DNSSEC zone signing keys have a default size of 1024 bits; RSA keys for use as key signing keys (KSKs, generated with
 \fB\-f KSK\fR) default to 2048 bits\&.
 .RE
 .PP
-\-n \fInametype\fR
-.RS 4
-Specifies the owner type of the key\&. The value of
-\fBnametype\fR
-must either be ZONE (for a DNSSEC zone key (KEY/DNSKEY)), HOST or ENTITY (for a key associated with a host (KEY)), USER (for a key associated with a user(KEY)) or OTHER (DNSKEY)\&. These values are case insensitive\&. Defaults to ZONE for DNSKEY generation\&.
-.RE
-.PP
-\-3
-.RS 4
-Use an NSEC3\-capable algorithm to generate a DNSSEC key\&. If this option is used with an algorithm that has both NSEC and NSEC3 versions, then the NSEC3 version will be used; for example,
-\fBdnssec\-keygen \-3a RSASHA1\fR
-specifies the NSEC3RSASHA1 algorithm\&.
-.RE
-.PP
 \-C
 .RS 4
-Compatibility mode: generates an old\-style key, without any metadata\&. By default,
+Compatibility mode: generates an old\-style key, without any timing metadata\&. By default,
 \fBdnssec\-keygen\fR
 will include the key\*(Aqs creation date in the metadata stored with the private key, and other dates may be set there as well (publication date, activation date, etc)\&. Keys that include this data may be incompatible with older versions of BIND; the
 \fB\-C\fR
@@ -150,11 +143,6 @@ Prints a short summary of the options and arguments to
 Sets the directory in which the key files are to be written\&.
 .RE
 .PP
-\-k
-.RS 4
-Deprecated in favor of \-T KEY\&.
-.RE
-.PP
 \-L \fIttl\fR
 .RS 4
 Sets the default TTL to use for this key when it is converted into a DNSKEY RR\&. If the key is imported into a zone, this is the TTL that will be used for it, unless there was already a DNSKEY RRset in place, in which case the existing TTL would take precedence\&. If this value is not set and there is no existing DNSKEY RRset, the TTL will default to the SOA TTL\&. Setting the default TTL to
@@ -164,9 +152,17 @@ none
 is the same as leaving it unset\&.
 .RE
 .PP
+\-n \fInametype\fR
+.RS 4
+Specifies the owner type of the key\&. The value of
+\fBnametype\fR
+must either be ZONE (for a DNSSEC zone key (KEY/DNSKEY)), HOST or ENTITY (for a key associated with a host (KEY)), USER (for a key associated with a user(KEY)) or OTHER (DNSKEY)\&. These values are case insensitive\&. Defaults to ZONE for DNSKEY generation\&.
+.RE
+.PP
 \-p \fIprotocol\fR
 .RS 4
-Sets the protocol value for the generated key\&. The protocol is a number between 0 and 255\&. The default is 3 (DNSSEC)\&. Other possible values for this argument are listed in RFC 2535 and its successors\&.
+Sets the protocol value for the generated key, for use with
+\fB\-T KEY\fR\&. The protocol is a number between 0 and 255\&. The default is 3 (DNSSEC)\&. Other possible values for this argument are listed in RFC 2535 and its successors\&.
 .RE
 .PP
 \-q
@@ -193,27 +189,25 @@ Specifies the strength value of the key\&. The strength is a number between 0 an
 Specifies the resource record type to use for the key\&.
 \fBrrtype\fR
 must be either DNSKEY or KEY\&. The default is DNSKEY when using a DNSSEC algorithm, but it can be overridden to KEY for use with SIG(0)\&.
-Specifying any TSIG algorithm (HMAC\-* or DH) with
-\fB\-a\fR
-forces this option to KEY\&.
 .RE
 .PP
 \-t \fItype\fR
 .RS 4
-Indicates the use of the key\&.
+Indicates the use of the key, for use with
+\fB\-T KEY\fR\&.
 \fBtype\fR
 must be one of AUTHCONF, NOAUTHCONF, NOAUTH, or NOCONF\&. The default is AUTHCONF\&. AUTH refers to the ability to authenticate data, and CONF the ability to encrypt data\&.
 .RE
 .PP
-\-v \fIlevel\fR
-.RS 4
-Sets the debugging level\&.
-.RE
-.PP
 \-V
 .RS 4
 Prints version information\&.
 .RE
+.PP
+\-v \fIlevel\fR
+.RS 4
+Sets the debugging level\&.
+.RE
 .SH "TIMING OPTIONS"
 .PP
 Dates can be expressed in the format YYYYMMDD or YYYYMMDDHHMMSS\&. If the argument begins with a \*(Aq+\*(Aq or \*(Aq\-\*(Aq, it is interpreted as an offset from the present time\&. For convenience, if such an offset is followed by one of the suffixes \*(Aqy\*(Aq, \*(Aqmo\*(Aq, \*(Aqw\*(Aq, \*(Aqd\*(Aq, \*(Aqh\*(Aq, or \*(Aqmi\*(Aq, then the offset is computed in years (defined as 365 24\-hour days, ignoring leap years), months (defined as 30 24\-hour days), weeks, days, hours, or minutes, respectively\&. Without a suffix, the offset is computed in seconds\&. To explicitly prevent a date from being set, use \*(Aqnone\*(Aq or \*(Aqnever\*(Aq\&.
@@ -314,23 +308,24 @@ contains the private key\&.
 .PP
 The
 \&.key
-file contains a DNS KEY record that can be inserted into a zone file (directly or with a $INCLUDE statement)\&.
+file contains a DNSKEY or KEY record\&. When a zone is being signed by
+\fBnamed\fR
+or
+\fBdnssec\-signzone\fR\fB\-S\fR, DNSKEY records are included automatically\&. In other cases, the
+\&.key
+file can be inserted into a zone file manually or with a
+\fB$INCLUDE\fR
+statement\&.
 .PP
 The
 \&.private
 file contains algorithm\-specific fields\&. For obvious security reasons, this file does not have general read permission\&.
-.PP
-Both
-\&.key
-and
-\&.private
-files are generated for symmetric cryptography algorithms such as HMAC\-MD5, even though the public and private key are equivalent\&.
 .SH "EXAMPLE"
 .PP
-To generate an ECDSAP256SHA256 key for the domain
-\fBexample\&.com\fR, the following command would be issued:
+To generate an ECDSAP256SHA256 zone\-signing key for the zone
+\fBexample\&.com\fR, issue the command:
 .PP
-\fBdnssec\-keygen \-a ECDSAP256SHA256 \-n ZONE example\&.com\fR
+\fBdnssec\-keygen \-a ECDSAP256SHA256 example\&.com\fR
 .PP
 The command would print a string of the form:
 .PP
@@ -342,6 +337,10 @@ creates the files
 Kexample\&.com\&.+013+26160\&.key
 and
 Kexample\&.com\&.+013+26160\&.private\&.
+.PP
+To generate a matching key\-signing key, issue the command:
+.PP
+\fBdnssec\-keygen \-a ECDSAP256SHA256 \-f KSK example\&.com\fR
 .SH "SEE ALSO"
 .PP
 \fBdnssec-signzone\fR(8),
@@ -241,7 +241,7 @@ main(int argc, char **argv) {
 	/*
 	 * Process memory debugging argument first.
 	 */
-#define CMDLINE_FLAGS "3A:a:b:Cc:D:d:E:eFf:Gg:hI:i:K:kL:m:n:P:p:qR:r:S:s:T:t:" \
+#define CMDLINE_FLAGS "3A:a:b:Cc:D:d:E:eFf:Gg:hI:i:K:L:m:n:P:p:qR:r:S:s:T:t:" \
 		      "v:V"
 	while ((ch = isc_commandline_parse(argc, argv, CMDLINE_FLAGS)) != -1) {
 		switch (ch) {
@@ -322,11 +322,6 @@ main(int argc, char **argv) {
 				fatal("cannot open directory %s: %s",
 				      directory, isc_result_totext(ret));
 			break;
-		case 'k':
-			fatal("The -k option has been deprecated.\n"
-			      "To generate a key-signing key, use -f KSK.\n"
-			      "To generate a key with TYPE=KEY, use -T KEY.\n");
-			break;
 		case 'L':
 			ttl = strtottl(isc_commandline_argument);
 			setttl = true;
@@ -58,11 +58,10 @@
  <refsynopsisdiv>
    <cmdsynopsis sepchar=" ">
      <command>dnssec-keygen</command>
-      <arg rep="norepeat"><option>-a <replaceable class="parameter">algorithm</replaceable></option></arg>
-      <arg choice="opt" rep="norepeat"><option>-b <replaceable class="parameter">keysize</replaceable></option></arg>
-      <arg choice="opt" rep="norepeat"><option>-n <replaceable class="parameter">nametype</replaceable></option></arg>
      <arg choice="opt" rep="norepeat"><option>-3</option></arg>
      <arg choice="opt" rep="norepeat"><option>-A <replaceable class="parameter">date/offset</replaceable></option></arg>
+      <arg rep="norepeat"><option>-a <replaceable class="parameter">algorithm</replaceable></option></arg>
+      <arg choice="opt" rep="norepeat"><option>-b <replaceable class="parameter">keysize</replaceable></option></arg>
      <arg choice="opt" rep="norepeat"><option>-C</option></arg>
      <arg choice="opt" rep="norepeat"><option>-c <replaceable class="parameter">class</replaceable></option></arg>
      <arg choice="opt" rep="norepeat"><option>-D <replaceable class="parameter">date/offset</replaceable></option></arg>
@@ -77,6 +76,7 @@
      <arg choice="opt" rep="norepeat"><option>-K <replaceable class="parameter">directory</replaceable></option></arg>
      <arg choice="opt" rep="norepeat"><option>-k</option></arg>
      <arg choice="opt" rep="norepeat"><option>-L <replaceable class="parameter">ttl</replaceable></option></arg>
+      <arg choice="opt" rep="norepeat"><option>-n <replaceable class="parameter">nametype</replaceable></option></arg>
      <arg choice="opt" rep="norepeat"><option>-P <replaceable class="parameter">date/offset</replaceable></option></arg>
      <arg choice="opt" rep="norepeat"><option>-P sync <replaceable class="parameter">date/offset</replaceable></option></arg>
      <arg choice="opt" rep="norepeat"><option>-p <replaceable class="parameter">protocol</replaceable></option></arg>
@@ -87,7 +87,6 @@
      <arg choice="opt" rep="norepeat"><option>-t <replaceable class="parameter">type</replaceable></option></arg>
      <arg choice="opt" rep="norepeat"><option>-V</option></arg>
      <arg choice="opt" rep="norepeat"><option>-v <replaceable class="parameter">level</replaceable></option></arg>
-      <arg choice="opt" rep="norepeat"><option>-z</option></arg>
      <arg choice="req" rep="norepeat">name</arg>
    </cmdsynopsis>
  </refsynopsisdiv>
@@ -118,6 +117,20 @@


    <variablelist>
+
+      <varlistentry>
+	<term>-3</term>
+	<listitem>
+	  <para>
+	    Use an NSEC3-capable algorithm to generate a DNSSEC key.
+	    If this option is used with an algorithm that has both
+	    NSEC and NSEC3 versions, then the NSEC3 version will be
+	    used; for example, <command>dnssec-keygen -3a RSASHA1</command>
+	    specifies the NSEC3RSASHA1 algorithm.
+	  </para>
+	</listitem>
+      </varlistentry>
+
      <varlistentry>
 	<term>-a <replaceable class="parameter">algorithm</replaceable></term>
 	<listitem>
@@ -157,11 +170,9 @@
 	  <para>
 	    Specifies the number of bits in the key.  The choice of key
 	    size depends on the algorithm used.  RSA keys must be
-	    between 1024 and 2048 bits.  Diffie Hellman keys must be between
-	    128 and 4096 bits.  DSA keys must be between 512 and 1024
-	    bits and an exact multiple of 64.  HMAC keys must be
-	    between 1 and 512 bits. Elliptic curve algorithms don't need
-	    this parameter.
+	    between 1024 and 4096 bits.  Diffie Hellman keys must be between
+	    128 and 4096 bits.  Elliptic curve algorithms don't need this
+	    parameter.
 	  </para>
 	  <para>
 	    If the key size is not specified, some algorithms have
@@ -173,43 +184,16 @@
 	</listitem>
      </varlistentry>

-      <varlistentry>
-	<term>-n <replaceable class="parameter">nametype</replaceable></term>
-	<listitem>
-	  <para>
-	    Specifies the owner type of the key.  The value of
-	    <option>nametype</option> must either be ZONE (for a DNSSEC
-	    zone key (KEY/DNSKEY)), HOST or ENTITY (for a key associated
-	    with a host (KEY)), USER (for a key associated with a
-	    user(KEY)) or OTHER (DNSKEY).  These values are case
-	    insensitive.  Defaults to ZONE for DNSKEY generation.
-	  </para>
-	</listitem>
-      </varlistentry>
-
-      <varlistentry>
-	<term>-3</term>
-	<listitem>
-	  <para>
-	    Use an NSEC3-capable algorithm to generate a DNSSEC key.
-	    If this option is used with an algorithm that has both
-	    NSEC and NSEC3 versions, then the NSEC3 version will be
-	    used; for example, <command>dnssec-keygen -3a RSASHA1</command>
-	    specifies the NSEC3RSASHA1 algorithm.
-	  </para>
-	</listitem>
-      </varlistentry>
-
      <varlistentry>
 	<term>-C</term>
 	<listitem>
 	  <para>
-	    Compatibility mode:  generates an old-style key, without
-	    any metadata.  By default, <command>dnssec-keygen</command>
-	    will include the key's creation date in the metadata stored
-	    with the private key, and other dates may be set there as well
-	    (publication date, activation date, etc).  Keys that include
-	    this data may be incompatible with older versions of BIND; the
+	    Compatibility mode: generates an old-style key, without any
+	    timing metadata. By default, <command>dnssec-keygen</command>
+	    will include the key's creation date in the metadata stored with
+	    the private key, and other dates may be set there as well
+	    (publication date, activation date, etc). Keys that include this
+	    data may be incompatible with older versions of BIND; the
 	    <option>-C</option> option suppresses them.
 	  </para>
 	</listitem>
@@ -293,15 +277,6 @@
 	</listitem>
      </varlistentry>

-      <varlistentry>
-	<term>-k</term>
-	<listitem>
-	  <para>
-	    Deprecated in favor of -T KEY.
-	  </para>
-	</listitem>
-      </varlistentry>
-
      <varlistentry>
 	<term>-L <replaceable class="parameter">ttl</replaceable></term>
 	<listitem>
@@ -318,14 +293,28 @@
 	</listitem>
      </varlistentry>

+      <varlistentry>
+	<term>-n <replaceable class="parameter">nametype</replaceable></term>
+	<listitem>
+	  <para>
+	    Specifies the owner type of the key.  The value of
+	    <option>nametype</option> must either be ZONE (for a DNSSEC
+	    zone key (KEY/DNSKEY)), HOST or ENTITY (for a key associated
+	    with a host (KEY)), USER (for a key associated with a
+	    user(KEY)) or OTHER (DNSKEY).  These values are case
+	    insensitive.  Defaults to ZONE for DNSKEY generation.
+	  </para>
+	</listitem>
+      </varlistentry>
+
      <varlistentry>
 	<term>-p <replaceable class="parameter">protocol</replaceable></term>
 	<listitem>
 	  <para>
-	    Sets the protocol value for the generated key.  The protocol
-	    is a number between 0 and 255.  The default is 3 (DNSSEC).
-	    Other possible values for this argument are listed in
-	    RFC 2535 and its successors.
+	    Sets the protocol value for the generated key, for use
+	    with <option>-T KEY</option>. The protocol is a number between 0
+	    and 255. The default is 3 (DNSSEC). Other possible values for
+	    this argument are listed in RFC 2535 and its successors.
 	  </para>
 	</listitem>
      </varlistentry>
@@ -383,10 +372,6 @@
 	    <option>rrtype</option> must be either DNSKEY or KEY.  The
 	    default is DNSKEY when using a DNSSEC algorithm, but it can be
 	    overridden to KEY for use with SIG(0).
-	  <para>
-	  </para>
-	    Specifying any TSIG algorithm (HMAC-* or DH) with
-	    <option>-a</option> forces this option to KEY.
 	  </para>
 	</listitem>
      </varlistentry>
@@ -395,19 +380,11 @@
 	<term>-t <replaceable class="parameter">type</replaceable></term>
 	<listitem>
 	  <para>
-	    Indicates the use of the key.  <option>type</option> must be
-	    one of AUTHCONF, NOAUTHCONF, NOAUTH, or NOCONF.  The default
-	    is AUTHCONF.  AUTH refers to the ability to authenticate
-	    data, and CONF the ability to encrypt data.
-	  </para>
-	</listitem>
-      </varlistentry>
-
-      <varlistentry>
-	<term>-v <replaceable class="parameter">level</replaceable></term>
-	<listitem>
-	  <para>
-	    Sets the debugging level.
+	    Indicates the use of the key, for use with <option>-T
+	    KEY</option>. <option>type</option> must be one of AUTHCONF,
+	    NOAUTHCONF, NOAUTH, or NOCONF. The default is AUTHCONF. AUTH
+	    refers to the ability to authenticate data, and CONF the ability
+	    to encrypt data.
 	  </para>
 	</listitem>
      </varlistentry>
@@ -421,6 +398,15 @@
 	</listitem>
      </varlistentry>

+      <varlistentry>
+	<term>-v <replaceable class="parameter">level</replaceable></term>
+	<listitem>
+	  <para>
+	    Sets the debugging level.
+	  </para>
+	</listitem>
+      </varlistentry>
+
    </variablelist>
  </refsection>

@@ -585,10 +571,12 @@
      key.
    </para>
    <para>
-      The <filename>.key</filename> file contains a DNS KEY record
-      that
-      can be inserted into a zone file (directly or with a $INCLUDE
-      statement).
+      The <filename>.key</filename> file contains a DNSKEY or KEY record.
+      When a zone is being signed by <command>named</command>
+      or <command>dnssec-signzone</command> <option>-S</option>, DNSKEY
+      records are included automatically. In other cases,
+      the <filename>.key</filename> file can be inserted into a zone file
+      manually or with a <userinput>$INCLUDE</userinput> statement.
    </para>
    <para>
      The <filename>.private</filename> file contains
@@ -596,21 +584,16 @@
      fields.  For obvious security reasons, this file does not have
      general read permission.
    </para>
-    <para>
-      Both <filename>.key</filename> and <filename>.private</filename>
-      files are generated for symmetric cryptography algorithms such as
-      HMAC-MD5, even though the public and private key are equivalent.
-    </para>
  </refsection>

  <refsection><info><title>EXAMPLE</title></info>

    <para>
-      To generate an ECDSAP256SHA256 key for the domain
-      <userinput>example.com</userinput>, the following command would be
-      issued:
+      To generate an ECDSAP256SHA256 zone-signing key for the zone
+      <userinput>example.com</userinput>, issue the command:
    </para>
-    <para><userinput>dnssec-keygen -a ECDSAP256SHA256 -n ZONE example.com</userinput>
+    <para>
+      <userinput>dnssec-keygen -a ECDSAP256SHA256 example.com</userinput>
    </para>
    <para>
      The command would print a string of the form:
@@ -623,6 +606,12 @@
      and
      <filename>Kexample.com.+013+26160.private</filename>.
    </para>
+    <para>
+      To generate a matching key-signing key, issue the command:
+    </para>
+    <para>
+      <userinput>dnssec-keygen -a ECDSAP256SHA256 -f KSK example.com</userinput>
+    </para>
  </refsection>

  <refsection><info><title>SEE ALSO</title></info>
@@ -33,11 +33,10 @@
 <h2>Synopsis</h2>
    <div class="cmdsynopsis"><p>
      <code class="command">dnssec-keygen</code> 
-       [<code class="option">-a <em class="replaceable"><code>algorithm</code></em></code>]
-       [<code class="option">-b <em class="replaceable"><code>keysize</code></em></code>]
-       [<code class="option">-n <em class="replaceable"><code>nametype</code></em></code>]
       [<code class="option">-3</code>]
       [<code class="option">-A <em class="replaceable"><code>date/offset</code></em></code>]
+       [<code class="option">-a <em class="replaceable"><code>algorithm</code></em></code>]
+       [<code class="option">-b <em class="replaceable"><code>keysize</code></em></code>]
       [<code class="option">-C</code>]
       [<code class="option">-c <em class="replaceable"><code>class</code></em></code>]
       [<code class="option">-D <em class="replaceable"><code>date/offset</code></em></code>]
@@ -52,6 +51,7 @@
       [<code class="option">-K <em class="replaceable"><code>directory</code></em></code>]
       [<code class="option">-k</code>]
       [<code class="option">-L <em class="replaceable"><code>ttl</code></em></code>]
+       [<code class="option">-n <em class="replaceable"><code>nametype</code></em></code>]
       [<code class="option">-P <em class="replaceable"><code>date/offset</code></em></code>]
       [<code class="option">-P sync <em class="replaceable"><code>date/offset</code></em></code>]
       [<code class="option">-p <em class="replaceable"><code>protocol</code></em></code>]
@@ -62,7 +62,6 @@
       [<code class="option">-t <em class="replaceable"><code>type</code></em></code>]
       [<code class="option">-V</code>]
       [<code class="option">-v <em class="replaceable"><code>level</code></em></code>]
-       [<code class="option">-z</code>]
       {name}
    </p></div>
  </div>
@@ -95,6 +94,16 @@


    <div class="variablelist"><dl class="variablelist">
+<dt><span class="term">-3</span></dt>
+<dd>
+	  <p>
+	    Use an NSEC3-capable algorithm to generate a DNSSEC key.
+	    If this option is used with an algorithm that has both
+	    NSEC and NSEC3 versions, then the NSEC3 version will be
+	    used; for example, <span class="command"><strong>dnssec-keygen -3a RSASHA1</strong></span>
+	    specifies the NSEC3RSASHA1 algorithm.
+	  </p>
+	</dd>
 <dt><span class="term">-a <em class="replaceable"><code>algorithm</code></em></span></dt>
 <dd>
 	  <p>
@@ -130,11 +139,9 @@
 	  <p>
 	    Specifies the number of bits in the key.  The choice of key
 	    size depends on the algorithm used.  RSA keys must be
-	    between 1024 and 2048 bits.  Diffie Hellman keys must be between
-	    128 and 4096 bits.  DSA keys must be between 512 and 1024
-	    bits and an exact multiple of 64.  HMAC keys must be
-	    between 1 and 512 bits. Elliptic curve algorithms don't need
-	    this parameter.
+	    between 1024 and 4096 bits.  Diffie Hellman keys must be between
+	    128 and 4096 bits.  Elliptic curve algorithms don't need this
+	    parameter.
 	  </p>
 	  <p>
 	    If the key size is not specified, some algorithms have
@@ -144,36 +151,15 @@
 	    <code class="option">-f KSK</code>) default to 2048 bits.
 	  </p>
 	</dd>
-<dt><span class="term">-n <em class="replaceable"><code>nametype</code></em></span></dt>
-<dd>
-	  <p>
-	    Specifies the owner type of the key.  The value of
-	    <code class="option">nametype</code> must either be ZONE (for a DNSSEC
-	    zone key (KEY/DNSKEY)), HOST or ENTITY (for a key associated
-	    with a host (KEY)), USER (for a key associated with a
-	    user(KEY)) or OTHER (DNSKEY).  These values are case
-	    insensitive.  Defaults to ZONE for DNSKEY generation.
-	  </p>
-	</dd>
-<dt><span class="term">-3</span></dt>
-<dd>
-	  <p>
-	    Use an NSEC3-capable algorithm to generate a DNSSEC key.
-	    If this option is used with an algorithm that has both
-	    NSEC and NSEC3 versions, then the NSEC3 version will be
-	    used; for example, <span class="command"><strong>dnssec-keygen -3a RSASHA1</strong></span>
-	    specifies the NSEC3RSASHA1 algorithm.
-	  </p>
-	</dd>
 <dt><span class="term">-C</span></dt>
 <dd>
 	  <p>
-	    Compatibility mode:  generates an old-style key, without
-	    any metadata.  By default, <span class="command"><strong>dnssec-keygen</strong></span>
-	    will include the key's creation date in the metadata stored
-	    with the private key, and other dates may be set there as well
-	    (publication date, activation date, etc).  Keys that include
-	    this data may be incompatible with older versions of BIND; the
+	    Compatibility mode: generates an old-style key, without any
+	    timing metadata. By default, <span class="command"><strong>dnssec-keygen</strong></span>
+	    will include the key's creation date in the metadata stored with
+	    the private key, and other dates may be set there as well
+	    (publication date, activation date, etc). Keys that include this
+	    data may be incompatible with older versions of BIND; the
 	    <code class="option">-C</code> option suppresses them.
 	  </p>
 	</dd>
@@ -234,12 +220,6 @@
 	    Sets the directory in which the key files are to be written.
 	  </p>
 	</dd>
-<dt><span class="term">-k</span></dt>
-<dd>
-	  <p>
-	    Deprecated in favor of -T KEY.
-	  </p>
-	</dd>
 <dt><span class="term">-L <em class="replaceable"><code>ttl</code></em></span></dt>
 <dd>
 	  <p>
@@ -253,13 +233,24 @@
 	    or <code class="literal">none</code> is the same as leaving it unset.
 	  </p>
 	</dd>
+<dt><span class="term">-n <em class="replaceable"><code>nametype</code></em></span></dt>
+<dd>
+	  <p>
+	    Specifies the owner type of the key.  The value of
+	    <code class="option">nametype</code> must either be ZONE (for a DNSSEC
+	    zone key (KEY/DNSKEY)), HOST or ENTITY (for a key associated
+	    with a host (KEY)), USER (for a key associated with a
+	    user(KEY)) or OTHER (DNSKEY).  These values are case
+	    insensitive.  Defaults to ZONE for DNSKEY generation.
+	  </p>
+	</dd>
 <dt><span class="term">-p <em class="replaceable"><code>protocol</code></em></span></dt>
 <dd>
 	  <p>
-	    Sets the protocol value for the generated key.  The protocol
-	    is a number between 0 and 255.  The default is 3 (DNSSEC).
-	    Other possible values for this argument are listed in
-	    RFC 2535 and its successors.
+	    Sets the protocol value for the generated key, for use
+	    with <code class="option">-T KEY</code>. The protocol is a number between 0
+	    and 255. The default is 3 (DNSSEC). Other possible values for
+	    this argument are listed in RFC 2535 and its successors.
 	  </p>
 	</dd>
 <dt><span class="term">-q</span></dt>
@@ -306,26 +297,15 @@
 	    default is DNSKEY when using a DNSSEC algorithm, but it can be
 	    overridden to KEY for use with SIG(0).
 	  </p>
-<p>
-	  </p>
-<p>
-	    Specifying any TSIG algorithm (HMAC-* or DH) with
-	    <code class="option">-a</code> forces this option to KEY.
-	  </p>
 	</dd>
 <dt><span class="term">-t <em class="replaceable"><code>type</code></em></span></dt>
 <dd>
 	  <p>
-	    Indicates the use of the key.  <code class="option">type</code> must be
-	    one of AUTHCONF, NOAUTHCONF, NOAUTH, or NOCONF.  The default
-	    is AUTHCONF.  AUTH refers to the ability to authenticate
-	    data, and CONF the ability to encrypt data.
-	  </p>
-	</dd>
-<dt><span class="term">-v <em class="replaceable"><code>level</code></em></span></dt>
-<dd>
-	  <p>
-	    Sets the debugging level.
+	    Indicates the use of the key, for use with <code class="option">-T
+	    KEY</code>. <code class="option">type</code> must be one of AUTHCONF,
+	    NOAUTHCONF, NOAUTH, or NOCONF. The default is AUTHCONF. AUTH
+	    refers to the ability to authenticate data, and CONF the ability
+	    to encrypt data.
 	  </p>
 	</dd>
 <dt><span class="term">-V</span></dt>
@@ -334,6 +314,12 @@
 	    Prints version information.
 	  </p>
 	</dd>
+<dt><span class="term">-v <em class="replaceable"><code>level</code></em></span></dt>
+<dd>
+	  <p>
+	    Sets the debugging level.
+	  </p>
+	</dd>
 </dl></div>
  </div>

@@ -476,10 +462,12 @@
      key.
    </p>
    <p>
-      The <code class="filename">.key</code> file contains a DNS KEY record
-      that
-      can be inserted into a zone file (directly or with a $INCLUDE
-      statement).
+      The <code class="filename">.key</code> file contains a DNSKEY or KEY record.
+      When a zone is being signed by <span class="command"><strong>named</strong></span>
+      or <span class="command"><strong>dnssec-signzone</strong></span> <code class="option">-S</code>, DNSKEY
+      records are included automatically. In other cases,
+      the <code class="filename">.key</code> file can be inserted into a zone file
+      manually or with a <strong class="userinput"><code>$INCLUDE</code></strong> statement.
    </p>
    <p>
      The <code class="filename">.private</code> file contains
@@ -487,22 +475,17 @@
      fields.  For obvious security reasons, this file does not have
      general read permission.
    </p>
-    <p>
-      Both <code class="filename">.key</code> and <code class="filename">.private</code>
-      files are generated for symmetric cryptography algorithms such as
-      HMAC-MD5, even though the public and private key are equivalent.
-    </p>
  </div>

  <div class="refsection">
 <a name="id-1.11"></a><h2>EXAMPLE</h2>

    <p>
-      To generate an ECDSAP256SHA256 key for the domain
-      <strong class="userinput"><code>example.com</code></strong>, the following command would be
-      issued:
+      To generate an ECDSAP256SHA256 zone-signing key for the zone
+      <strong class="userinput"><code>example.com</code></strong>, issue the command:
    </p>
-    <p><strong class="userinput"><code>dnssec-keygen -a ECDSAP256SHA256 -n ZONE example.com</code></strong>
+    <p>
+      <strong class="userinput"><code>dnssec-keygen -a ECDSAP256SHA256 example.com</code></strong>
    </p>
    <p>
      The command would print a string of the form:
@@ -515,6 +498,12 @@
      and
      <code class="filename">Kexample.com.+013+26160.private</code>.
    </p>
+    <p>
+      To generate a matching key-signing key, issue the command:
+    </p>
+    <p>
+      <strong class="userinput"><code>dnssec-keygen -a ECDSAP256SHA256 -f KSK example.com</code></strong>
+    </p>
  </div>

  <div class="refsection">
@@ -10,12 +10,12 @@
 .\"     Title: named.conf
 .\"    Author: 
 .\" Generator: DocBook XSL Stylesheets v1.78.1 <http://docbook.sf.net/>
-.\"      Date: 2018-12-07
+.\"      Date: 2019-02-06
 .\"    Manual: BIND9
 .\"    Source: ISC
 .\"  Language: English
 .\"
-.TH "NAMED\&.CONF" "5" "2018\-12\-07" "ISC" "BIND9"
+.TH "NAMED\&.CONF" "5" "2019\-02\-06" "ISC" "BIND9"
 .\" -----------------------------------------------------------------
 .\" * Define some portability stuff
 .\" -----------------------------------------------------------------
@@ -13,7 +13,7 @@

 <refentry xmlns:db="http://docbook.org/ns/docbook" version="5.0" xml:id="man.named.conf">
  <info>
-    <date>2018-12-07</date>
+    <date>2019-02-06</date>
  </info>
  <refentryinfo>
    <corpname>ISC</corpname>
@@ -2115,6 +2115,7 @@ configure_rpz_name2(dns_view_t *view, const cfg_obj_t *obj, dns_name_t *name,
 static isc_result_t
 configure_rpz_zone(dns_view_t *view, const cfg_listelt_t *element,
 		   bool recursive_only_default,
+		   bool add_soa_default,
 		   dns_ttl_t ttl_default,
 		   uint32_t minupdateinterval_default,
 		   const dns_rpz_zone_t *old,
@@ -2259,6 +2260,13 @@ configure_rpz_zone(dns_view_t *view, const cfg_listelt_t *element,
 			     !dns_name_equal(&old->cname, &zone->cname)))
 		*old_rpz_okp = false;

+	obj = cfg_tuple_get(rpz_obj, "add-soa");
+	if (cfg_obj_isvoid(obj)) {
+		zone->addsoa = add_soa_default;
+	} else {
+		zone->addsoa = cfg_obj_asboolean(obj);
+	}
+
 	return (ISC_R_SUCCESS);
 }

@@ -2271,7 +2279,7 @@ configure_rpz(dns_view_t *view, const cfg_obj_t **maps,
 	char *rps_cstr;
 	size_t rps_cstr_size;
 	const cfg_obj_t *sub_obj;
-	bool recursive_only_default;
+	bool recursive_only_default, add_soa_default;
 	bool nsip_enabled, nsdname_enabled;
 	dns_rpz_zbits_t nsip_on, nsdname_on;
 	dns_ttl_t ttl_default;
@@ -2367,6 +2375,13 @@ configure_rpz(dns_view_t *view, const cfg_obj_t **maps,
 		recursive_only_default = true;
 	}

+	sub_obj = cfg_tuple_get(rpz_obj, "add-soa");
+	if (!cfg_obj_isvoid(sub_obj) && !cfg_obj_asboolean(sub_obj)) {
+		add_soa_default = false;
+	} else {
+		add_soa_default = true;
+	}
+
 	sub_obj = cfg_tuple_get(rpz_obj, "break-dnssec");
 	if (!cfg_obj_isvoid(sub_obj) && cfg_obj_asboolean(sub_obj)) {
 		zones->p.break_dnssec = true;
@@ -2429,6 +2444,7 @@ configure_rpz(dns_view_t *view, const cfg_obj_t **maps,
 		}
 		result = configure_rpz_zone(view, zone_element,
 					    recursive_only_default,
+					    add_soa_default,
 					    ttl_default,
 					    minupdateinterval_default,
 					    old_zone, old_rpz_okp);
@@ -3655,9 +3671,21 @@ register_one_plugin(const cfg_obj_t *config, const cfg_obj_t *obj,
 		    void *callback_data)
 {
 	dns_view_t *view = callback_data;
+	char full_path[PATH_MAX];
 	isc_result_t result;

-	result = ns_plugin_register(plugin_path, parameters, config,
+	result = ns_plugin_expandpath(plugin_path,
+				      full_path, sizeof(full_path));
+	if (result != ISC_R_SUCCESS) {
+		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+			      NAMED_LOGMODULE_SERVER, ISC_LOG_ERROR,
+			      "%s: plugin configuration failed: "
+			      "unable to get full plugin path: %s",
+			      plugin_path, isc_result_totext(result));
+		return (result);
+	}
+
+	result = ns_plugin_register(full_path, parameters, config,
 				    cfg_obj_file(obj), cfg_obj_line(obj),
 				    named_g_mctx, named_g_lctx,
 				    named_g_aclconfctx, view);
@@ -3665,7 +3693,7 @@ register_one_plugin(const cfg_obj_t *config, const cfg_obj_t *obj,
 		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 			      NAMED_LOGMODULE_SERVER, ISC_LOG_ERROR,
 			      "%s: plugin configuration failed: %s",
-			      plugin_path, isc_result_totext(result));
+			      full_path, isc_result_totext(result));
 	}

 	return (result);
@@ -4993,8 +5021,9 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,

 	/*
 	 * Configure default allow-update and allow-update-forwarding ACLs,
-	 * so they can be inherited by zones.  (Note these cannot be set at
-	 * options/view level.)
+	 * so they can be inherited by zones. (XXX: These are not
+	 * read from the options/view level here. However, they may be
+	 * read from there in zoneconf.c:configure_zone_acl() later.)
 	 */
 	if (view->updateacl == NULL) {
 		CHECK(configure_view_acl(NULL, NULL, named_g_config,
@@ -11453,13 +11482,13 @@ named_server_status(named_server_t *server, isc_buffer_t **text) {
 		   ? "ON" : "OFF");
 	CHECK(putstr(text, line));

-	snprintf(line, sizeof(line), "recursive clients: %d/%d/%d\n",
+	snprintf(line, sizeof(line), "recursive clients: %u/%u/%u\n",
 		     isc_quota_getused(&server->sctx->recursionquota),
 		     isc_quota_getsoft(&server->sctx->recursionquota),
 		     isc_quota_getmax(&server->sctx->recursionquota));
 	CHECK(putstr(text, line));

-	snprintf(line, sizeof(line), "tcp clients: %d/%d\n",
+	snprintf(line, sizeof(line), "tcp clients: %u/%u\n",
 		     isc_quota_getused(&server->sctx->tcpquota),
 		     isc_quota_getmax(&server->sctx->tcpquota));
 	CHECK(putstr(text, line));
@@ -14664,13 +14693,13 @@ named_server_nta(named_server_t *server, isc_lex_t *lex,
 				      "added NTA '%s' (%d sec) in view '%s'",
 				      namebuf, ntattl, view->name);
 		} else {
-			bool removed;
+			bool wasremoved;

 			result = dns_ntatable_delete(ntatable, ntaname);
 			if (result == ISC_R_SUCCESS) {
-				removed = true;
+				wasremoved = true;
 			} else if (result == ISC_R_NOTFOUND) {
-				removed = false;
+				wasremoved = false;
 			} else {
 				goto cleanup;
 			}
@@ -14681,13 +14710,13 @@ named_server_nta(named_server_t *server, isc_lex_t *lex,
 			first = false;

 			CHECK(putstr(text, "Negative trust anchor "));
-			CHECK(putstr(text, removed ? "removed: "
-						   : "not found: "));
+			CHECK(putstr(text, wasremoved ? "removed: "
+						      : "not found: "));
 			CHECK(putstr(text, namebuf));
 			CHECK(putstr(text, "/"));
 			CHECK(putstr(text, view->name));

-			if (removed) {
+			if (wasremoved) {
 				isc_log_write(named_g_lctx,
 					      NAMED_LOGCATEGORY_GENERAL,
 					      NAMED_LOGMODULE_SERVER,
@@ -33,6 +33,7 @@
 #include <isc/mem.h>
 #include <isc/nonce.h>
 #include <isc/parseint.h>
+#include <isc/portset.h>
 #include <isc/print.h>
 #include <isc/platform.h>
 #include <isc/random.h>
@@ -748,6 +749,34 @@ shutdown_program(isc_task_t *task, isc_event_t *event) {
 	maybeshutdown();
 }

+/*
+ * Try honoring the operating system's preferred ephemeral port range.
+ */
+static void
+set_source_ports(dns_dispatchmgr_t *manager) {
+	isc_portset_t *v4portset = NULL, *v6portset = NULL;
+	in_port_t udpport_low, udpport_high;
+	isc_result_t result;
+
+	result = isc_portset_create(gmctx, &v4portset);
+	check_result(result, "isc_portset_create (v4)");
+	result = isc_net_getudpportrange(AF_INET, &udpport_low, &udpport_high);
+	check_result(result, "isc_net_getudpportrange (v4)");
+	isc_portset_addrange(v4portset, udpport_low, udpport_high);
+
+	result = isc_portset_create(gmctx, &v6portset);
+	check_result(result, "isc_portset_create (v6)");
+	result = isc_net_getudpportrange(AF_INET6, &udpport_low, &udpport_high);
+	check_result(result, "isc_net_getudpportrange (v6)");
+	isc_portset_addrange(v6portset, udpport_low, udpport_high);
+
+	result = dns_dispatchmgr_setavailports(manager, v4portset, v6portset);
+	check_result(result, "dns_dispatchmgr_setavailports");
+
+	isc_portset_destroy(gmctx, &v4portset);
+	isc_portset_destroy(gmctx, &v6portset);
+}
+
 static void
 setup_system(void) {
 	isc_result_t result;
@@ -898,6 +927,8 @@ setup_system(void) {
 	check_result(result, "dst_lib_init");
 	is_dst_up = true;

+	set_source_ports(dispatchmgr);
+
 	attrmask = DNS_DISPATCHATTR_UDP | DNS_DISPATCHATTR_TCP;
 	attrmask |= DNS_DISPATCHATTR_IPV4 | DNS_DISPATCHATTR_IPV6;

@@ -25,6 +25,7 @@ NSLIBS =	../../lib/ns/libns.@A@
 LIBS =

 SO_TARGETS =	lib/filter-aaaa.@SO@
+SO_INSTALL =	filter-aaaa.@SO@
 TARGETS =	@SO_TARGETS@

 SO_OBJS =	filter-aaaa.@O@
@@ -59,14 +60,20 @@ clean distclean::
 	rm -f ${TARGETS} ${OBJS}

 installdirs:
-	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${libdir}
+	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${plugindir}
 	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${mandir}/man8

-install:: filter-aaaa.@SO@ installdirs
-	${LIBTOOL_MODE_INSTALL} ${INSTALL_LIBRARY} filter-aaaa.@SO@ \
-		${DESTDIR}${libdir}
+install:: @SO_TARGETS@ installdirs
+	for i in ${SO_INSTALL} ; \
+	do \
+		if test -f $$i ; \
+		then \
+			${LIBTOOL_MODE_INSTALL} ${INSTALL_LIBRARY} $$i \
+				 ${DESTDIR}${plugindir}; \
+		fi \
+	done
 	${INSTALL_DATA} ${srcdir}/filter-aaaa.8 ${DESTDIR}${mandir}/man8

 uninstall::
-	${LIBTOOL_MODE_UNINSTALL} rm -f ${DESTDIR}${libdir}/filter-aaaa.@SO@
+	${LIBTOOL_MODE_UNINSTALL} rm -f ${DESTDIR}${plugindir}/filter-aaaa.@SO@
 	rm -f ${DESTDIR}${mandir}/man8/filter-aaaa.8
@@ -49,7 +49,7 @@ and
 \fBdnssec\-settime\fR\&.
 .PP
 DNSSEC policy can be read from a configuration file (default
-/etc/dnssec\-policy\&.conf), from which the key parameters, publication and rollover schedule, and desired coverage duration for any given zone can be determined\&. This file may be used to define individual DNSSEC policies on a per\-zone basis, or to set a default policy used for all zones\&.
+/etc/dnssec\-policy\&.conf), from which the key parameters, publication and rollover schedule, and desired coverage duration for any given zone can be determined\&. This file may be used to define individual DNSSEC policies on a per\-zone basis, or to set a "default" policy used for all zones\&.
 .PP
 When
 \fBdnssec\-keymgr\fR
@@ -181,7 +181,8 @@ would be used for zones that had unusually high security needs\&.
 .sp -1
 .IP \(bu 2.3
 .\}
-Algorithm policies: (\fBalgorithm\-policy \fR\fB\fIalgorithm\fR\fR\fB { \&.\&.\&. };\fR
+\fIAlgorithm policies:\fR
+(\fBalgorithm\-policy \fR\fB\fIalgorithm\fR\fR\fB { \&.\&.\&. };\fR
 ) override default per\-algorithm settings\&. For example, by default, RSASHA256 keys use 2048\-bit key sizes for both KSK and ZSK\&. This can be modified using
 \fBalgorithm\-policy\fR, and the new key sizes would then be used for any key of type RSASHA256\&.
 .RE
@@ -194,59 +195,60 @@ Algorithm policies: (\fBalgorithm\-policy \fR\fB\fIalgorithm\fR\fR\fB { \&.\&.\&
 .sp -1
 .IP \(bu 2.3
 .\}
-Zone policies: (\fBzone \fR\fB\fIname\fR\fR\fB { \&.\&.\&. };\fR
+\fIZone policies:\fR
+(\fBzone \fR\fB\fIname\fR\fR\fB { \&.\&.\&. };\fR
 ) set policy for a single zone by name\&. A zone policy can inherit a policy class by including a
 \fBpolicy\fR
-option\&. Zone names beginning with digits (i\&.e\&., 0\-9) must be quoted\&.
+option\&. Zone names beginning with digits (i\&.e\&., 0\-9) must be quoted\&. If a zone does not have its own policy then the "default" policy applies\&.
 .RE
 .PP
 Options that can be specified in policies:
 .PP
-\fBalgorithm\fR
+\fBalgorithm\fR \fIname\fR;
 .RS 4
 The key algorithm\&. If no policy is defined, the default is RSASHA256\&.
 .RE
 .PP
-\fBcoverage\fR
+\fBcoverage\fR \fIduration\fR;
 .RS 4
 The length of time to ensure that keys will be correct; no action will be taken to create new keys to be activated after this time\&. This can be represented as a number of seconds, or as a duration using human\-readable units (examples: "1y" or "6 months")\&. A default value for this option can be set in algorithm policies as well as in policy classes or zone policies\&. If no policy is configured, the default is six months\&.
 .RE
 .PP
-\fBdirectory\fR
+\fBdirectory\fR \fIpath\fR;
 .RS 4
 Specifies the directory in which keys should be stored\&.
 .RE
 .PP
-\fBkey\-size\fR
+\fBkey\-size\fR \fIkeytype\fR \fIsize\fR;
 .RS 4
-Specifies the number of bits to use in creating keys\&. Takes two arguments: keytype (eihter "zsk" or "ksk") and size\&. A default value for this option can be set in algorithm policies as well as in policy classes or zone policies\&. If no policy is configured, the default is 2048 bits for RSA keys\&.
+Specifies the number of bits to use in creating keys\&. The keytype is either "zsk" or "ksk"\&. A default value for this option can be set in algorithm policies as well as in policy classes or zone policies\&. If no policy is configured, the default is 2048 bits for RSA keys\&.
 .RE
 .PP
-\fBkeyttl\fR
+\fBkeyttl\fR \fIduration\fR;
 .RS 4
 The key TTL\&. If no policy is defined, the default is one hour\&.
 .RE
 .PP
-\fBpost\-publish\fR
+\fBpost\-publish\fR \fIkeytype\fR \fIduration\fR;
 .RS 4
 How long after inactivation a key should be deleted from the zone\&. Note: If
 \fBroll\-period\fR
-is not set, this value is ignored\&. Takes two arguments: keytype (eihter "zsk" or "ksk") and a duration\&. A default value for this option can be set in algorithm policies as well as in policy classes or zone policies\&. The default is one month\&.
+is not set, this value is ignored\&. The keytype is either "zsk" or "ksk"\&. A default duration for this option can be set in algorithm policies as well as in policy classes or zone policies\&. The default is one month\&.
 .RE
 .PP
-\fBpre\-publish\fR
+\fBpre\-publish\fR \fIkeytype\fR \fIduration\fR;
 .RS 4
 How long before activation a key should be published\&. Note: If
 \fBroll\-period\fR
-is not set, this value is ignored\&. Takes two arguments: keytype (either "zsk" or "ksk") and a duration\&. A default value for this option can be set in algorithm policies as well as in policy classes or zone policies\&. The default is one month\&.
+is not set, this value is ignored\&. The keytype is either "zsk" or "ksk"\&. A default duration for this option can be set in algorithm policies as well as in policy classes or zone policies\&. The default is one month\&.
 .RE
 .PP
-\fBroll\-period\fR
+\fBroll\-period\fR \fIkeytype\fR \fIduration\fR;
 .RS 4
-How frequently keys should be rolled over\&. Takes two arguments: keytype (eihter "zsk" or "ksk") and a duration\&. A default value for this option can be set in algorithm policies as well as in policy classes or zone policies\&. If no policy is configured, the default is one year for ZSK\*(Aqs\&. KSK\*(Aqs do not roll over by default\&.
+How frequently keys should be rolled over\&. The keytype is either "zsk" or "ksk"\&. A default duration for this option can be set in algorithm policies as well as in policy classes or zone policies\&. If no policy is configured, the default is one year for ZSKs\&. KSKs do not roll over by default\&.
 .RE
 .PP
-\fBstandby\fR
+\fBstandby\fR \fIkeytype\fR \fInumber\fR;
 .RS 4
 Not yet implemented\&.
 .RE
@@ -57,11 +57,12 @@
    </p>
    <p>
      DNSSEC policy can be read from a configuration file (default
-      <code class="filename">/etc/dnssec-policy.conf</code>), from which the key
-      parameters, publication and rollover schedule, and desired
-      coverage duration for any given zone can be determined.  This
+      <code class="filename">/etc/dnssec-policy.conf</code>), from which the
+      key parameters, publication and rollover schedule, and desired
+      coverage duration for any given zone can be determined. This
      file may be used to define individual DNSSEC policies on a
-      per-zone basis, or to set a default policy used for all zones.
+      per-zone basis, or to set a "<code class="literal">default</code>" policy
+      used for all zones.
    </p>
    <p>
      When <span class="command"><strong>dnssec-keymgr</strong></span> runs, it examines the DNSSEC
@@ -210,7 +211,7 @@
      </li>
 <li class="listitem">
 	<p>
-	  Algorithm policies:
+	  <span class="emphasis"><em>Algorithm policies:</em></span>
 	  (<code class="option">algorithm-policy <em class="replaceable"><code>algorithm</code></em> { ... };</code> )
 	  override default per-algorithm settings.  For example, by default,
 	  RSASHA256 keys use 2048-bit key sizes for both KSK and ZSK. This
@@ -220,11 +221,13 @@
      </li>
 <li class="listitem">
 	<p>
-	  Zone policies:
+	  <span class="emphasis"><em>Zone policies:</em></span>
 	  (<code class="option">zone <em class="replaceable"><code>name</code></em> { ... };</code> )
 	  set policy for a single zone by name. A zone policy can inherit
 	  a policy class by including a <code class="option">policy</code> option.
 	  Zone names beginning with digits (i.e., 0-9) must be quoted.
+	  If a zone does not have its own policy then the
+	  "<code class="literal">default</code>" policy applies.
 	</p>
      </li>
 </ul></div>
@@ -232,81 +235,90 @@
      Options that can be specified in policies:
    </p>
    <div class="variablelist"><dl class="variablelist">
-<dt><span class="term"><span class="command"><strong>algorithm</strong></span></span></dt>
+<dt><span class="term"><span class="command"><strong>algorithm</strong></span>
+	  <em class="replaceable"><code>name</code></em><code class="literal">;</code></span></dt>
 <dd>
 	  <p>
 	    The key algorithm. If no policy is defined, the default is
 	    RSASHA256.
 	  </p>
 	</dd>
-<dt><span class="term"><span class="command"><strong>coverage</strong></span></span></dt>
+<dt><span class="term"><span class="command"><strong>coverage</strong></span>
+	  <em class="replaceable"><code>duration</code></em><code class="literal">;</code></span></dt>
 <dd>
 	  <p>
 	    The length of time to ensure that keys will be correct; no action
 	    will be taken to create new keys to be activated after this time.
-	    This can be represented as a number of seconds, or as a duration using
-	    human-readable units (examples: "1y" or "6 months").
+	    This can be represented as a number of seconds, or as a duration
+	    using human-readable units (examples: "1y" or "6 months").
 	    A default value for this option can be set in algorithm policies
 	    as well as in policy classes or zone policies.
 	    If no policy is configured, the default is six months.
 	  </p>
 	</dd>
-<dt><span class="term"><span class="command"><strong>directory</strong></span></span></dt>
+<dt><span class="term"><span class="command"><strong>directory</strong></span>
+	  <em class="replaceable"><code>path</code></em><code class="literal">;</code></span></dt>
 <dd>
 	  <p>
 	    Specifies the directory in which keys should be stored.
 	  </p>
 	</dd>
-<dt><span class="term"><span class="command"><strong>key-size</strong></span></span></dt>
+<dt><span class="term"><span class="command"><strong>key-size</strong></span> <em class="replaceable"><code>keytype</code></em>
+	  <em class="replaceable"><code>size</code></em><code class="literal">;</code></span></dt>
 <dd>
 	  <p>
 	    Specifies the number of bits to use in creating keys.
-	    Takes two arguments: keytype (eihter "zsk" or "ksk") and size.
+	    The keytype is either "zsk" or "ksk".
 	    A default value for this option can be set in algorithm policies
 	    as well as in policy classes or zone policies. If no policy is
 	    configured, the default is 2048 bits for RSA keys.
 	  </p>
 	</dd>
-<dt><span class="term"><span class="command"><strong>keyttl</strong></span></span></dt>
+<dt><span class="term"><span class="command"><strong>keyttl</strong></span>
+	  <em class="replaceable"><code>duration</code></em><code class="literal">;</code></span></dt>
 <dd>
 	  <p>
 	    The key TTL. If no policy is defined, the default is one hour.
 	  </p>
 	</dd>
-<dt><span class="term"><span class="command"><strong>post-publish</strong></span></span></dt>
+<dt><span class="term"><span class="command"><strong>post-publish</strong></span> <em class="replaceable"><code>keytype</code></em>
+	  <em class="replaceable"><code>duration</code></em><code class="literal">;</code></span></dt>
 <dd>
 	  <p>
 	    How long after inactivation a key should be deleted from the zone.
 	    Note: If <code class="option">roll-period</code> is not set, this value is
-	    ignored. Takes two arguments: keytype (eihter "zsk" or "ksk") and a
-	    duration. A default value for this option can be set in algorithm
+	    ignored. The keytype is either "zsk" or "ksk".
+	    A default duration for this option can be set in algorithm
 	    policies as well as in policy classes or zone policies. The default
 	    is one month.
 	  </p>
 	</dd>
-<dt><span class="term"><span class="command"><strong>pre-publish</strong></span></span></dt>
+<dt><span class="term"><span class="command"><strong>pre-publish</strong></span> <em class="replaceable"><code>keytype</code></em>
+	  <em class="replaceable"><code>duration</code></em><code class="literal">;</code></span></dt>
 <dd>
 	  <p>
 	    How long before activation a key should be published.  Note: If
 	    <code class="option">roll-period</code> is not set, this value is ignored.
-	    Takes two arguments: keytype (either "zsk" or "ksk") and a duration.
-	    A default value for this option can be set in algorithm policies
+	    The keytype is either "zsk" or "ksk".
+	    A default duration for this option can be set in algorithm policies
 	    as well as in policy classes or zone policies.  The default is
 	    one month.
 	  </p>
 	</dd>
-<dt><span class="term"><span class="command"><strong>roll-period</strong></span></span></dt>
+<dt><span class="term"><span class="command"><strong>roll-period</strong></span> <em class="replaceable"><code>keytype</code></em>
+	  <em class="replaceable"><code>duration</code></em><code class="literal">;</code></span></dt>
 <dd>
 	  <p>
 	    How frequently keys should be rolled over.
-	    Takes two arguments: keytype (eihter "zsk" or "ksk") and a duration.
-	    A default value for this option can be set in algorithm policies
+	    The keytype is either "zsk" or "ksk".
+	    A default duration for this option can be set in algorithm policies
 	    as well as in policy classes or zone policies.  If no policy is
-	    configured, the default is one year for ZSK's. KSK's do not
+	    configured, the default is one year for ZSKs. KSKs do not
 	    roll over by default.
 	  </p>
 	</dd>
-<dt><span class="term"><span class="command"><strong>standby</strong></span></span></dt>
+<dt><span class="term"><span class="command"><strong>standby</strong></span> <em class="replaceable"><code>keytype</code></em>
+	  <em class="replaceable"><code>number</code></em><code class="literal">;</code></span></dt>
 <dd>
 	  <p>
 	    Not yet implemented.
@@ -107,6 +107,8 @@ def check(zone, args):
        fp, _ = Popen(cmd, stdout=PIPE).communicate()

    for line in fp.splitlines():
+        if type(line) is not str:
+            line = line.decode('ascii')
        rrlist.append(SECRR(line, args.lookaside))
    rrlist = sorted(rrlist, key=lambda rr: (rr.keyid, rr.keyalg, rr.hashalg))

@@ -128,6 +130,8 @@ def check(zone, args):
        fp, _ = Popen(cmd, stdin=PIPE, stdout=PIPE).communicate(intods)

    for line in fp.splitlines():
+        if type(line) is not str:
+            line = line.decode('ascii')
        klist.append(SECRR(line, args.lookaside))

    if len(klist) < 1:
@@ -43,6 +43,8 @@ class keyzone:
        fp, _ = Popen([czpath, "-o", "-", name, filename],
                      stdout=PIPE, stderr=PIPE).communicate()
        for line in fp.splitlines():
+            if type(line) is not str:
+                line = line.decode('ascii')
            if re.search('^[:space:]*;', line):
                continue
            fields = line.split()
@@ -19,7 +19,7 @@ SUBDIRS =	dlzexternal dyndb pipelined rndc rpz rsabigexponent tkey

 CINCLUDES =	${ISC_INCLUDES} ${DNS_INCLUDES}

-CDEFINES =	@USE_GSSAPI@
+CDEFINES =	@USE_GSSAPI@ @CONTRIB_DLZ@
 CWARNINGS =

 DNSLIBS =
@@ -23,7 +23,4 @@ copy_setports ns2/named1.conf.in ns2/named.conf
 copy_setports ns3/named1.conf.in ns3/named.conf

 cp -f ns2/default.nzf.in ns2/3bf305731dd26307.nzf
-rm -f ns3/*.nzf ns3/*.nzf~
-rm -f ns3/*.nzd ns3/*.nzd-lock
-rm -f ns3/inlineslave.db
 mkdir ns2/new-zones
@@ -12,7 +12,7 @@
 SYSTEMTESTTOP=..
 . $SYSTEMTESTTOP/conf.sh

-. ./clean.sh
+$SHELL clean.sh

 copy_setports ns1/named.conf.in ns1/named.conf
 copy_setports ns2/named.conf.in ns2/named.conf
@@ -1404,8 +1404,12 @@ for i in 0 1 2 3 4 5 6 7 8 9; do
 	$DIG $DIGOPTS delzsk.example NSEC3PARAM @10.53.0.3 > dig.out.ns3.1.test$n 2>&1 || ret=1
 	grep "NSEC3PARAM.*12345678" dig.out.ns3.1.test$n > /dev/null 2>&1
 	if [ $? -eq 0 ]; then
-		_ret=0
-		break
+		$RNDCCMD 10.53.0.3 signing -list delzsk.example > signing.out.2.test$n 2>&1
+		grep "Creating NSEC3 chain " signing.out.2.test$n > /dev/null 2>&1
+		if [ $? -ne 0 ]; then
+			_ret=0
+			break
+		fi
 	fi
 	sleep 1
 done
@@ -1420,10 +1424,10 @@ $SETTIME -D now-1h $file > settime.out.test$n 2>&1 || ret=1
 $RNDCCMD 10.53.0.3 loadkeys delzsk.example 2>&1 | sed 's/^/ns3 /' | cat_i
 for i in 0 1 2 3 4 5 6 7 8 9; do
 	_ret=1
-	$RNDCCMD 10.53.0.3 signing -list delzsk.example > signing.out.2.test$n 2>&1
-	grep "Signing " signing.out.2.test$n > /dev/null 2>&1
+	$RNDCCMD 10.53.0.3 signing -list delzsk.example > signing.out.3.test$n 2>&1
+	grep "Signing " signing.out.3.test$n > /dev/null 2>&1
 	if [ $? -ne 0 ]; then
-		if [ `cat signing.out.2.test$n | wc -l` -eq 2 ]; then
+		if [ `grep "Done signing " signing.out.3.test$n | wc -l` -eq 2 ]; then
 			_ret=0
 			break
 		fi
@@ -10,7 +10,8 @@
 SYSTEMTESTTOP=..
 . $SYSTEMTESTTOP/conf.sh

-${SHELL} clean.sh
+$SHELL clean.sh
+
 cp -f ns1/dynamic.db.in ns1/dynamic.db
 copy_setports ns1/named.conf.in ns1/named.conf
 copy_setports ns2/named.conf.in ns2/named.conf
@@ -9,6 +9,6 @@
 * information regarding copyright ownership.
 */

-view {
+view one {
 	allow-update-forwarding { any; };
 };
@@ -9,6 +9,6 @@
 * information regarding copyright ownership.
 */

-view {
+view one {
 	allow-update { any; };
 };
@@ -0,0 +1,15 @@
+#!/bin/sh
+#
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+# shellcheck source=conf.sh
+. "$SYSTEMTESTTOP/conf.sh"
+
+$SHELL clean.sh
@@ -10,7 +10,8 @@
 SYSTEMTESTTOP=..
 . $SYSTEMTESTTOP/conf.sh

-rm -f named-compilezone
+$SHELL clean.sh
+
 ln -s $CHECKZONE named-compilezone

 ./named-compilezone -D -F raw -o good1.db.raw example \
@@ -18,8 +18,6 @@ ln -s $CHECKZONE named-compilezone

 # Test 1: KSK goes inactive before successor is active
 dir=01-ksk-inactive
-rm -f $dir/K*.key
-rm -f $dir/K*.private
 ksk1=`$KEYGEN -q -K $dir -a rsasha1 -3fk example.com`
 $SETTIME -K $dir -I +9mo -D +1y $ksk1 > /dev/null 2>&1
 ksk2=`$KEYGEN -q -K $dir -S $ksk1`
@@ -28,8 +26,6 @@ zsk1=`$KEYGEN -q -K $dir -a rsasha1 -3 example.com`

 # Test 2: ZSK goes inactive before successor is active
 dir=02-zsk-inactive
-rm -f $dir/K*.key
-rm -f $dir/K*.private
 zsk1=`$KEYGEN -q -K $dir -a rsasha1 -3 example.com`
 $SETTIME -K $dir -I +9mo -D +1y $zsk1 > /dev/null 2>&1
 zsk2=`$KEYGEN -q -K $dir -S $zsk1`
@@ -38,8 +34,6 @@ ksk1=`$KEYGEN -q -K $dir -a rsasha1 -3fk example.com`

 # Test 3: KSK is unpublished before its successor is published
 dir=03-ksk-unpublished
-rm -f $dir/K*.key
-rm -f $dir/K*.private
 ksk1=`$KEYGEN -q -K $dir -a rsasha1 -3fk example.com`
 $SETTIME -K $dir -I +9mo -D +1y $ksk1 > /dev/null 2>&1
 ksk2=`$KEYGEN -q -K $dir -S $ksk1`
@@ -48,8 +42,6 @@ zsk1=`$KEYGEN -q -K $dir -a rsasha1 -3 example.com`

 # Test 4: ZSK is unpublished before its successor is published
 dir=04-zsk-unpublished
-rm -f $dir/K*.key
-rm -f $dir/K*.private
 zsk1=`$KEYGEN -q -K $dir -a rsasha1 -3 example.com`
 $SETTIME -K $dir -I +9mo -D +1y $zsk1 > /dev/null 2>&1
 zsk2=`$KEYGEN -q -K $dir -S $zsk1`
@@ -59,8 +51,6 @@ ksk1=`$KEYGEN -q -K $dir -a rsasha1 -3fk example.com`
 # Test 5: KSK deleted and successor published before KSK is deactivated
 # and successor activated.
 dir=05-ksk-unpub-active
-rm -f $dir/K*.key
-rm -f $dir/K*.private
 ksk1=`$KEYGEN -q -K $dir -a rsasha1 -3fk example.com`
 $SETTIME -K $dir -I +9mo -D +8mo $ksk1 > /dev/null 2>&1
 ksk2=`$KEYGEN -q -K $dir -S $ksk1`
@@ -69,8 +59,6 @@ zsk1=`$KEYGEN -q -K $dir -a rsasha1 -3 example.com`
 # Test 6: ZSK deleted and successor published before ZSK is deactivated
 # and successor activated.
 dir=06-zsk-unpub-active
-rm -f $dir/K*.key
-rm -f $dir/K*.private
 zsk1=`$KEYGEN -q -K $dir -a rsasha1 -3 example.com`
 $SETTIME -K $dir -I +9mo -D +8mo $zsk1 > /dev/null 2>&1
 zsk2=`$KEYGEN -q -K $dir -S $zsk1`
@@ -78,8 +66,6 @@ ksk1=`$KEYGEN -q -K $dir -a rsasha1 -3fk example.com`

 # Test 7: KSK rolled with insufficient delay after prepublication.
 dir=07-ksk-ttl
-rm -f $dir/K*.key
-rm -f $dir/K*.private
 ksk1=`$KEYGEN -q -K $dir -a rsasha1 -3fk example.com`
 $SETTIME -K $dir -I +9mo -D +1y $ksk1 > /dev/null 2>&1
 ksk2=`$KEYGEN -q -K $dir -S $ksk1`
@@ -89,8 +75,6 @@ zsk1=`$KEYGEN -q -K $dir -a rsasha1 -3 example.com`

 # Test 8: ZSK rolled with insufficient delay after prepublication.
 dir=08-zsk-ttl
-rm -f $dir/K*.key
-rm -f $dir/K*.private
 zsk1=`$KEYGEN -q -K $dir -a rsasha1 -3 example.com`
 $SETTIME -K $dir -I +9mo -D +1y $zsk1 > /dev/null 2>&1
 zsk2=`$KEYGEN -q -K $dir -S $zsk1`
@@ -100,8 +84,6 @@ ksk1=`$KEYGEN -q -K $dir -a rsasha1 -3fk example.com`

 # Test 9: KSK goes inactive before successor is active, but checking ZSKs
 dir=09-check-zsk
-rm -f $dir/K*.key
-rm -f $dir/K*.private
 ksk1=`$KEYGEN -q -K $dir -a rsasha1 -3fk example.com`
 $SETTIME -K $dir -I +9mo -D +1y $ksk1 > /dev/null 2>&1
 ksk2=`$KEYGEN -q -K $dir -S $ksk1`
@@ -110,8 +92,6 @@ zsk1=`$KEYGEN -q -K $dir -a rsasha1 -3 example.com`

 # Test 10: ZSK goes inactive before successor is active, but checking KSKs
 dir=10-check-ksk
-rm -f $dir/K*.key
-rm -f $dir/K*.private
 zsk1=`$KEYGEN -q -K $dir -a rsasha1 -3 example.com`
 $SETTIME -K $dir -I +9mo -D +1y $zsk1 > /dev/null 2>&1
 zsk2=`$KEYGEN -q -K $dir -S $zsk1`
@@ -120,8 +100,6 @@ ksk1=`$KEYGEN -q -K $dir -a rsasha1 -3fk example.com`

 # Test 11: ZSK goes inactive before successor is active, but after cutoff
 dir=11-cutoff
-rm -f $dir/K*.key
-rm -f $dir/K*.private
 zsk1=`$KEYGEN -q -K $dir -a rsasha1 -3 example.com`
 $SETTIME -K $dir -I +18mo -D +2y $zsk1 > /dev/null 2>&1
 zsk2=`$KEYGEN -q -K $dir -S $zsk1`
@@ -0,0 +1,14 @@
+#!/bin/sh
+#
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+rm -f ns2/example.bk
+rm -f ns3/example.bk
+rm -f */named.memstats */named.run
@@ -7,5 +7,7 @@
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.

-rm -f ns2/example.bk
-rm -f ns3/example.bk
+# shellcheck source=conf.sh
+. "$SYSTEMTESTTOP/conf.sh"
+
+$SHELL clean.sh
@@ -32,6 +32,6 @@ cat $infile $keyname1.key $keyname2.key >$zonefile
 $SIGNER -l $dlvzone -g -o $zone -f $outfile $zonefile > /dev/null 2> signer.err || cat signer.err

 $CHECKZONE -q -D -i none druz druz.pre |
-sed '/IN DNSKEY/s/\([a-z0-9A-Z/]\{10\}\)[a-z0-9A-Z/]\{16\}/\1XXXXXXXXXXXXXXXX/'> druz.signed
+sed '/IN DNSKEY/s/\([a-z0-9A-Z+/]\{10\}\)[a-z0-9A-Z+/]\{16\}/\1XXXXXXXXXXXXXXXX/'> druz.signed

 echo_i "signed $zone"
@@ -12,6 +12,8 @@
 SYSTEMTESTTOP=..
 . $SYSTEMTESTTOP/conf.sh

+$SHELL clean.sh
+
 copy_setports ns1/named.conf.in ns1/named.conf
 copy_setports ns2/named.conf.in ns2/named.conf
 copy_setports ns3/named.conf.in ns3/named.conf
@@ -12,7 +12,7 @@
 SYSTEMTESTTOP=..
 . $SYSTEMTESTTOP/conf.sh

-if [ "@DLZ_SYSTEM_TEST@" != "filesystem" ]; then
+if ! $FEATURETEST --with-dlz-filesystem; then
        echo_i "DLZ filesystem driver not supported"
        exit 255
 fi
@@ -40,6 +40,13 @@
 			goto failure; \
 	} while (0)

+#define loginfo(...) \
+	({ if ((state != NULL) && (state->log != NULL)) \
+		 state->log(ISC_LOG_INFO, __VA_ARGS__); })
+#define logerr(...) \
+	({ if ((state != NULL) && (state->log != NULL)) \
+		 state->log(ISC_LOG_ERROR, __VA_ARGS__); })
+
 /* For this simple example, use fixed sized strings */
 struct record {
 	char name[100];
@@ -109,9 +116,7 @@ add_name(struct dlz_example_data *state, struct record *list,
 		i = first_empty;
 	}
 	if (i == MAX_RECORDS) {
-		if (state->log != NULL)
-			state->log(ISC_LOG_ERROR,
-				   "dlz_example: out of record space");
+		logerr("dlz_example: out of record space");
 		return (ISC_R_FAILURE);
 	}

@@ -244,9 +249,7 @@ dlz_create(const char *dlzname, unsigned int argc, char *argv[],
 	va_end(ap);

 	if (argc < 2 || argv[1][0] == '\0') {
-		if (state->log != NULL)
-			state->log(ISC_LOG_ERROR,
-				   "dlz_example: please specify a zone name");
+		logerr("dlz_example: please specify a zone name");
 		dlz_destroy(state);
 		return (ISC_R_FAILURE);
 	}
@@ -282,9 +285,7 @@ dlz_create(const char *dlzname, unsigned int argc, char *argv[],
 	add_name(state, &state->current[0], state->zone_name,
 		 "a", 1800, "10.53.0.1");

-	if (state->log != NULL)
-		state->log(ISC_LOG_INFO, "dlz_example: started for zone %s",
-			   state->zone_name);
+	loginfo("dlz_example: started for zone %s", state->zone_name);

 	*dbdata = state;
 	return (ISC_R_SUCCESS);
@@ -302,10 +303,7 @@ void
 dlz_destroy(void *dbdata) {
 	struct dlz_example_data *state = (struct dlz_example_data *)dbdata;

-	if (state->log != NULL)
-		state->log(ISC_LOG_INFO,
-			   "dlz_example: shutting down zone %s",
-			   state->zone_name);
+	loginfo("dlz_example: shutting down zone %s", state->zone_name);
 	free(state->zone_name);
 	free(state);
 }
@@ -333,10 +331,8 @@ dlz_findzonedb(void *dbdata, const char *name,
 		fmt_address(src, addrbuf, sizeof(addrbuf));
 	}

-	state->log(ISC_LOG_INFO,
-		   "dlz_example: dlz_findzonedb called with name '%s' "
-		   "in zone DB '%s' from %s",
-		   name, state->zone_name, addrbuf);
+	loginfo("dlz_example: dlz_findzonedb called with name '%s' "
+		"in zone DB '%s' from %s", name, state->zone_name, addrbuf);

 	/*
 	 * Returning ISC_R_NOTFOUND will cause the query logic to
@@ -436,7 +432,7 @@ dlz_lookup(const char *zone, const char *name, void *dbdata,
 		count = 1;
 		memcpy(last, full_name, size + 1);
 	}
-	state->log(ISC_LOG_INFO, "lookup #%d for %s", count, full_name);
+	loginfo("lookup #%d for %s", count, full_name);

 	/*
 	 * If we need to know the database version (as set in
@@ -456,10 +452,9 @@ dlz_lookup(const char *zone, const char *name, void *dbdata,
 	if (clientinfo != NULL &&
 	    clientinfo->version >= DNS_CLIENTINFO_VERSION) {
 		dbversion = clientinfo->dbversion;
-		if (dbversion != NULL && *(bool *)dbversion)
-			state->log(ISC_LOG_INFO,
-				   "dlz_example: lookup against live "
-				   "transaction");
+		if (dbversion != NULL && *(bool *)dbversion) {
+			loginfo("dlz_example: lookup against live transaction");
+		}
 	}

 	if (strcmp(name, "source-addr") == 0) {
@@ -474,8 +469,7 @@ dlz_lookup(const char *zone, const char *name, void *dbdata,
 			fmt_address(src, buf, sizeof(buf));
 		}

-		state->log(ISC_LOG_INFO,
-			   "dlz_example: lookup connection from %s", buf);
+		loginfo("dlz_example: lookup connection from %s", buf);

 		found = true;
 		result = state->putrr(lookup, "TXT", 0, buf);
@@ -536,10 +530,30 @@ dlz_lookup(const char *zone, const char *name, void *dbdata,
 */
 isc_result_t
 dlz_allowzonexfr(void *dbdata, const char *name, const char *client) {
-	UNUSED(client);
+	struct dlz_example_data *state = (struct dlz_example_data *)dbdata;
+	isc_result_t result;

-	/* Just say yes for all our zones */
-	return (dlz_findzonedb(dbdata, name, NULL, NULL));
+	loginfo("dlz_example: dlz_allowzonexfr called for %s", name);
+
+	result = dlz_findzonedb(dbdata, name, NULL, NULL);
+	if (result != ISC_R_SUCCESS) {
+		loginfo("dlz_example: findzonedb returned %s",
+			isc_result_totext(result));
+		return (result);
+	}
+
+	/*
+	 * Exception for 10.53.0.5 so we can test that allow-transfer
+	 * is effective.
+	 */
+	if (strcmp(client, "10.53.0.5") == 0) {
+		loginfo("dlz_example: disallow transfer to 10.53.0.5");
+		return (ISC_R_NOPERM);
+	}
+
+	loginfo("dlz_example: transfer allowed for %s", name);
+
+	return (ISC_R_SUCCESS);
 }

 /*
@@ -580,10 +594,8 @@ dlz_newversion(const char *zone, void *dbdata, void **versionp) {
 	struct dlz_example_data *state = (struct dlz_example_data *)dbdata;

 	if (state->transaction_started) {
-		if (state->log != NULL)
-			state->log(ISC_LOG_INFO,
-				   "dlz_example: transaction already "
-				   "started for zone %s", zone);
+		loginfo("dlz_example: transaction already started for zone %s",
+			zone);
 		return (ISC_R_FAILURE);
 	}

@@ -603,9 +615,8 @@ dlz_closeversion(const char *zone, bool commit,
 	struct dlz_example_data *state = (struct dlz_example_data *)dbdata;

 	if (!state->transaction_started) {
-		if (state->log != NULL)
-			state->log(ISC_LOG_INFO, "dlz_example: transaction not "
-				   "started for zone %s", zone);
+		loginfo("dlz_example: transaction not started for zone %s",
+			zone);
 		*versionp = NULL;
 		return;
 	}
@@ -616,9 +627,7 @@ dlz_closeversion(const char *zone, bool commit,

 	if (commit) {
 		int i;
-		if (state->log != NULL)
-			state->log(ISC_LOG_INFO, "dlz_example: committing "
-				   "transaction on zone %s", zone);
+		loginfo("dlz_example: committing transaction on zone %s", zone);
 		for (i = 0; i < MAX_RECORDS; i++) {
 			if (strlen(state->deletes[i].name) > 0U) {
 				(void)del_name(state, &state->current[0],
@@ -638,9 +647,7 @@ dlz_closeversion(const char *zone, bool commit,
 			}
 		}
 	} else {
-		if (state->log != NULL)
-			state->log(ISC_LOG_INFO, "dlz_example: cancelling "
-				   "transaction on zone %s", zone);
+		loginfo("dlz_example: cancelling transaction on zone %s", zone);
 	}
 	memset(state->adds, 0, sizeof(state->adds));
 	memset(state->deletes, 0, sizeof(state->deletes));
@@ -655,27 +662,21 @@ dlz_configure(dns_view_t *view, dns_dlzdb_t *dlzdb, void *dbdata) {
 	struct dlz_example_data *state = (struct dlz_example_data *)dbdata;
 	isc_result_t result;

-	if (state->log != NULL)
-		state->log(ISC_LOG_INFO, "dlz_example: starting configure");
+	loginfo("dlz_example: starting configure");

 	if (state->writeable_zone == NULL) {
-		if (state->log != NULL)
-			state->log(ISC_LOG_INFO, "dlz_example: no "
-				   "writeable_zone method available");
+		loginfo("dlz_example: no writeable_zone method available");
 		return (ISC_R_FAILURE);
 	}

 	result = state->writeable_zone(view, dlzdb, state->zone_name);
 	if (result != ISC_R_SUCCESS) {
-		if (state->log != NULL)
-			state->log(ISC_LOG_ERROR, "dlz_example: failed to "
-				   "configure zone %s", state->zone_name);
+		loginfo("dlz_example: failed to configure zone %s",
+			state->zone_name);
 		return (result);
 	}

-	if (state->log != NULL)
-		state->log(ISC_LOG_INFO, "dlz_example: configured writeable "
-			   "zone %s", state->zone_name);
+	loginfo("dlz_example: configured writeable zone %s", state->zone_name);
 	return (ISC_R_SUCCESS);
 }

@@ -696,14 +697,11 @@ dlz_ssumatch(const char *signer, const char *name, const char *tcpaddr,
 	UNUSED(keydata);

 	if (strncmp(name, "deny.", 5) == 0) {
-		if (state->log != NULL)
-			state->log(ISC_LOG_INFO, "dlz_example: denying update "
-				   "of name=%s by %s", name, signer);
+		loginfo("dlz_example: denying update of name=%s by %s",
+			name, signer);
 		return (false);
 	}
-	if (state->log != NULL)
-		state->log(ISC_LOG_INFO, "dlz_example: allowing update of "
-			   "name=%s by %s", name, signer);
+	loginfo("dlz_example: allowing update of name=%s by %s", name, signer);
 	return (true);
 }

@@ -774,9 +772,7 @@ dlz_addrdataset(const char *name, const char *rdatastr,
 	if (version != (void *) &state->transaction_started)
 		return (ISC_R_FAILURE);

-	if (state->log != NULL)
-		state->log(ISC_LOG_INFO, "dlz_example: adding rdataset %s '%s'",
-			   name, rdatastr);
+	loginfo("dlz_example: adding rdataset %s '%s'", name, rdatastr);

 	return (modrdataset(state, name, rdatastr, &state->adds[0]));
 }
@@ -790,9 +786,7 @@ dlz_subrdataset(const char *name, const char *rdatastr,
 	if (version != (void *) &state->transaction_started)
 		return (ISC_R_FAILURE);

-	if (state->log != NULL)
-		state->log(ISC_LOG_INFO, "dlz_example: subtracting rdataset "
-			   "%s '%s'", name, rdatastr);
+	loginfo("dlz_example: subtracting rdataset %s '%s'", name, rdatastr);

 	return (modrdataset(state, name, rdatastr, &state->deletes[0]));
 }
@@ -806,9 +800,7 @@ dlz_delrdataset(const char *name, const char *type,
 	if (version != (void *) &state->transaction_started)
 		return (ISC_R_FAILURE);

-	if (state->log != NULL)
-		state->log(ISC_LOG_INFO, "dlz_example: deleting rdataset %s "
-			   "of type %s", name, type);
+	loginfo("dlz_example: deleting rdataset %s of type %s", name, type);

 	return (ISC_R_SUCCESS);
 }
@@ -12,6 +12,8 @@
 SYSTEMTESTTOP=..
 . $SYSTEMTESTTOP/conf.sh

+$SHELL clean.sh
+
 $DDNSCONFGEN -q -z example.nil > ns1/ddns.key

 copy_setports ns1/named.conf.in ns1/named.conf
@@ -108,15 +108,23 @@ test_update testdc1.alternate.nil. A "86400 A 10.53.0.10" "10.53.0.10" || ret=1
 status=`expr $status + $ret`

 newtest "testing AXFR from DLZ drivers"
-$DIG $DIGOPTS +noall +answer axfr example.nil > dig.out.ns1.test$n
-lines=`cat dig.out.ns1.test$n | wc -l`
+$DIG $DIGOPTS +noall +answer axfr example.nil > dig.out.example.ns1.test$n
+lines=`cat dig.out.example.ns1.test$n | wc -l`
 [ ${lines:-0} -eq 4 ] || ret=1
-$DIG $DIGOPTS +noall +answer axfr alternate.nil > dig.out.ns1.test$n
-lines=`cat dig.out.ns1.test$n | wc -l`
+$DIG $DIGOPTS +noall +answer axfr alternate.nil > dig.out.alternate.ns1.test$n
+lines=`cat dig.out.alternate.ns1.test$n | wc -l`
 [ ${lines:-0} -eq 5 ] || ret=1
 [ "$ret" -eq 0 ] || echo_i "failed"
 status=`expr $status + $ret`

+newtest "testing AXFR denied from DLZ drivers"
+$DIG $DIGOPTS -b 10.53.0.5 +noall +answer axfr example.nil > dig.out.example.ns1.test$n
+grep "; Transfer failed" dig.out.example.ns1.test$n > /dev/null || ret=1
+$DIG $DIGOPTS -b 10.53.0.5 +noall +answer axfr alternate.nil > dig.out.alternate.ns1.test$n
+grep "; Transfer failed" dig.out.alternate.ns1.test$n > /dev/null || ret=1
+[ "$ret" -eq 0 ] || echo_i "failed"
+status=`expr $status + $ret`
+
 newtest "testing unsearched/unregistered DLZ zone is not found"
 $DIG $DIGOPTS +noall +answer ns other.nil > dig.out.ns1.test$n
 grep "3600.IN.NS.other.nil." dig.out.ns1.test$n > /dev/null && ret=1
@@ -21,4 +21,5 @@ ns			A	10.53.0.3
 a			A	10.0.0.1
 b			A	10.0.0.2
 d			A	10.0.0.4
+x			DNSKEY	258 3 5 Cg==
 z			A	10.0.0.26
@@ -28,6 +28,7 @@ g			A	10.0.0.7
 z			A	10.0.0.26
 a.a.a.a.a.a.a.a.a.a.e	A	10.0.0.27
 x			CNAME	a
+zz			DNSKEY	258 3 5 Cg==

 private			NS	ns.private
 ns.private		A	10.53.0.2
@@ -247,7 +247,7 @@ zsk=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone")
 cat "$infile" "$ksk.key" "$zsk.key" unsupported-algorithm.key > "$zonefile"

 # "$SIGNER" -P -3 - -o "$zone" -f ${zonefile}.signed "$zonefile" > /dev/null 2>&1
-"$SIGNER" -P -3 - -o "$zone" -f ${zonefile}.signed "$zonefile"
+"$SIGNER" -P -3 - -o "$zone" -f ${zonefile}.signed "$zonefile" > /dev/null 2>&1

 #
 # A zone with a unknown DNSKEY algorithm + unknown NSEC3 hash algorithm (-U).
@@ -1399,6 +1399,19 @@ n=$((n+1))
 test "$ret" -eq 0 || echo_i "failed"
 status=$((status+ret))

+get_rsasha1_key_ids_from_sigs() {
+	awk '
+		NF < 8 { next }
+		$(NF-5) != "RRSIG" { next }
+		$(NF-3) != "5" { next }
+		$NF != "(" { next }
+		{
+			getline;
+			print $3;
+		}
+	' signer/example.db.signed | sort -u
+}
+
 echo_i "checking that we can sign a zone with out-of-zone records ($n)"
 ret=0
 zone=example
@@ -1499,8 +1512,8 @@ cat example.db.in "$key1.key" "$key3.key" > example.db
 echo "\$INCLUDE \"example.db.signed\"" >> example.db
 $SIGNER -D -o example example.db > /dev/null 2>&1
 ) || ret=1
-grep " $keyid2 " signer/example.db.signed > /dev/null 2>&1 || ret=1
-grep " $keyid3 " signer/example.db.signed > /dev/null 2>&1 || ret=1
+get_rsasha1_key_ids_from_sigs | grep "^$keyid2$" > /dev/null || ret=1
+get_rsasha1_key_ids_from_sigs | grep "^$keyid3$" > /dev/null || ret=1
 n=$((n+1))
 test "$ret" -eq 0 || echo_i "failed"
 status=$((status+ret))
@@ -1511,8 +1524,8 @@ ret=0
 cd signer || exit 1
 $SIGNER -RD -o example example.db > /dev/null 2>&1
 ) || ret=1
-grep " $keyid2 " signer/example.db.signed > /dev/null 2>&1 && ret=1
-grep " $keyid3 " signer/example.db.signed > /dev/null 2>&1 || ret=1
+get_rsasha1_key_ids_from_sigs | grep "^$keyid2$" > /dev/null && ret=1
+get_rsasha1_key_ids_from_sigs | grep "^$keyid3$" > /dev/null || ret=1
 n=$((n+1))
 test "$ret" -eq 0 || echo_i "failed"
 status=$((status+ret))
@@ -1529,8 +1542,8 @@ echo "\$INCLUDE \"example.db.signed\"" >> example.db
 $SETTIME -I now "$key2" > /dev/null 2>&1
 $SIGNER -SD -o example example.db > /dev/null 2>&1
 ) || ret=1
-grep " $keyid2 " signer/example.db.signed > /dev/null 2>&1 || ret=1
-grep " $keyid3 " signer/example.db.signed > /dev/null 2>&1 || ret=1
+get_rsasha1_key_ids_from_sigs | grep "^$keyid2$" > /dev/null || ret=1
+get_rsasha1_key_ids_from_sigs | grep "^$keyid3$" > /dev/null || ret=1
 n=$((n+1))
 test "$ret" -eq 0 || echo_i "failed"
 status=$((status+ret))
@@ -1541,8 +1554,8 @@ ret=0
 cd signer || exit 1
 $SIGNER -SDQ -o example example.db > /dev/null 2>&1
 ) || ret=1
-grep " $keyid2 " signer/example.db.signed > /dev/null 2>&1 && ret=1
-grep " $keyid3 " signer/example.db.signed > /dev/null 2>&1 || ret=1
+get_rsasha1_key_ids_from_sigs | grep "^$keyid2$" > /dev/null && ret=1
+get_rsasha1_key_ids_from_sigs | grep "^$keyid3$" > /dev/null || ret=1
 n=$((n+1))
 test "$ret" -eq 0 || echo_i "failed"
 status=$((status+ret))
@@ -1864,8 +1877,8 @@ echo_i "waiting for NTA rechecks/expirations"

 #
 # secure.example and badds.example used default nta-duration
-# (configured as 10s in ns4/named1.conf), but nta recheck interval
-# is configured to 7s, so at t=8 the NTAs for secure.example and
+# (configured as 12s in ns4/named1.conf), but nta recheck interval
+# is configured to 9s, so at t=10 the NTAs for secure.example and
 # fakenode.secure.example should both be lifted, but badds.example
 # should still be going.
 #
@@ -1886,9 +1899,9 @@ status=$((status+ret))
 ret=0

 #
-# bogus.example was set to expire in 20s, so at t=11
+# bogus.example was set to expire in 20s, so at t=13
 # it should still be NTA'd, but badds.example used the default
-# lifetime of 10s, so it should revert to SERVFAIL now.
+# lifetime of 12s, so it should revert to SERVFAIL now.
 #
 # shellcheck disable=SC2016
 $PERL -e 'my $delay = '"$start"' + 13 - time(); select(undef, undef, undef, $delay) if ($delay > 0);'
@@ -2087,11 +2100,11 @@ else
    exit 1
 fi

-# nta-recheck is configured as 7s, so at t=10 the NTAs for
+# nta-recheck is configured as 9s, so at t=12 the NTAs for
 # secure.example. should be lifted as it is not a forced NTA.
-echo_i "waiting till 10s have passed after ns4 was restarted"
+echo_i "waiting till 12s have passed after ns4 was restarted"
 # shellcheck disable=SC2016
-$PERL -e 'my $delay = '"$start"' + 10 - time(); select(undef, undef, undef, $delay) if ($delay > 0);'
+$PERL -e 'my $delay = '"$start"' + 12 - time(); select(undef, undef, undef, $delay) if ($delay > 0);'

 # secure.example. should now return an AD=1 answer (still validates) as
 # the NTA has been lifted.
@@ -2143,11 +2156,11 @@ else
    exit 1
 fi

-# nta-recheck is configured as 7s, but even at t=10 the NTAs for
+# nta-recheck is configured as 9s, but even at t=12 the NTAs for
 # secure.example. should not be lifted as it is a forced NTA.
-echo_i "waiting till 10s have passed after ns4 was restarted"
+echo_i "waiting till 12s have passed after ns4 was restarted"
 # shellcheck disable=SC2016
-$PERL -e 'my $delay = '"$start"' + 10 - time(); select(undef, undef, undef, $delay) if ($delay > 0);'
+$PERL -e 'my $delay = '"$start"' + 12 - time(); select(undef, undef, undef, $delay) if ($delay > 0);'

 # secure.example. should now return an AD=0 answer (non-authenticated)
 # as the NTA is still there.
@@ -2795,10 +2808,10 @@ dig_with_answeropts expiring.example soa @10.53.0.4 > dig.out.ns4.2.$n
 ttls=$(awk '$1 != ";;" {print $2}' dig.out.ns4.1.$n)
 ttls2=$(awk '$1 != ";;" {print $2}' dig.out.ns4.2.$n)
 for ttl in ${ttls:-0}; do
-    [ "${ttl:-0}" -eq 300 ] || ret=1
+    [ "${ttl}" -eq 300 ] || ret=1
 done
 for ttl in ${ttls2:-0}; do
-    [ "${ttl:-0}" -le 60 ] || ret=1
+    [ "${ttl}" -le 60 ] || ret=1
 done
 n=$((n+1))
 test "$ret" -eq 0 || echo_i "failed"
@@ -2813,7 +2826,7 @@ dig_with_additionalopts expiring.example ns @10.53.0.4 > dig.out.ns4.2.$n
 ttls=$(awk '$1 != ";;" {print $2}' dig.out.ns4.1.$n)
 ttls2=$(awk '$1 != ";;" {print $2}' dig.out.ns4.2.$n)
 for ttl in ${ttls:-300}; do
-    [ "$ttl" -eq 300 ] || ret=1
+    [ "$ttl" -le 300 ] && [ "$ttl" -gt 240 ] || ret=1
 done
 for ttl in ${ttls2:-0}; do
    [ "$ttl" -le 60 ] || ret=1
@@ -2831,7 +2844,7 @@ dig_with_additionalopts expiring.example mx @10.53.0.4 > dig.out.ns4.2.$n
 ttls=$(awk '$1 != ";;" {print $2}' dig.out.ns4.1.$n)
 ttls2=$(awk '$1 != ";;" {print $2}' dig.out.ns4.2.$n)
 for ttl in ${ttls:-300}; do
-    [ "$ttl" -eq 300 ] || ret=1
+    [ "$ttl" -le 300 ] && [ "$ttl" -gt 240 ] || ret=1
 done
 for ttl in ${ttls2:-0}; do
    [ "$ttl" -le 60 ] || ret=1
@@ -2855,7 +2868,7 @@ for ttl in ${ttls:-0}; do
    [ "$ttl" -eq 300 ] || ret=1
 done
 for ttl in ${ttls2:-0}; do
-    [ "$ttl" -le 120 ] && [ "$ttl" -gt 60 ] || ret=1
+    [ "$ttl" -eq 120 ] || ret=1
 done
 n=$((n+1))
 test "$ret" -eq 0 || echo_i "failed"
@@ -2871,7 +2884,7 @@ for ttl in ${ttls:-0}; do
    [ "$ttl" -eq 300 ] || ret=1
 done
 for ttl in ${ttls2:-0}; do
-    [ "$ttl" -le 120 ] && [ "$ttl" -gt 60 ] || ret=1
+    [ "$ttl" -eq 120 ] || ret=1
 done
 n=$((n+1))
 test "$ret" -eq 0 || echo_i "failed"
@@ -2880,12 +2893,12 @@ status=$((status+ret))
 echo_i "testing TTL is capped at RRSIG expiry time for records in the additional section with dnssec-accept-expired yes; ($n)"
 ret=0
 rndccmd 10.53.0.4 flush 2>&1 | sed 's/^/ns4 /' | cat_i
-dig_with_answeropts +cd expiring.example mx @10.53.0.4 > dig.out.ns4.1.$n
-dig_with_answeropts expiring.example mx @10.53.0.4 > dig.out.ns4.2.$n
+dig_with_additionalopts +cd expiring.example mx @10.53.0.4 > dig.out.ns4.1.$n
+dig_with_additionalopts expiring.example mx @10.53.0.4 > dig.out.ns4.2.$n
 ttls=$(awk '$1 != ";;" {print $2}' dig.out.ns4.1.$n)
 ttls2=$(awk '$1 != ";;" {print $2}' dig.out.ns4.2.$n)
 for ttl in ${ttls:-300}; do
-    [ "$ttl" -eq 300 ] || ret=1
+    [ "$ttl" -le 300 ] && [ "$ttl" -gt 240 ] || ret=1
 done
 for ttl in ${ttls2:-0}; do
    [ "$ttl" -le 120 ] && [ "$ttl" -gt 60 ] || ret=1
@@ -3593,12 +3606,23 @@ status=$((status+ret))

 echo_i "check that KEY-TAG trust-anchor-telemetry queries are logged ($n)"
 ret=0
-dig_with_opts . dnskey +ednsopt=KEY-TAG:ffff @10.53.0.1 > dig.out.ns4.test$n || ret=1
+dig_with_opts . dnskey +ednsopt=KEY-TAG:ffff @10.53.0.1 > dig.out.ns1.test$n || ret=1
 grep "trust-anchor-telemetry './IN' from .* 65535" ns1/named.run > /dev/null || ret=1
 n=$((n+1))
 test "$ret" -eq 0 || echo_i "failed"
 status=$((status+ret))

+echo_i "check that multiple KEY-TAG trust-anchor-telemetry options don't leak memory ($n)"
+ret=0
+dig_with_opts . dnskey +ednsopt=KEY-TAG:fffe +ednsopt=KEY-TAG:fffd @10.53.0.1 > dig.out.ns1.test$n || ret=1
+grep "trust-anchor-telemetry './IN' from .* 65534" ns1/named.run > /dev/null || ret=1
+grep "trust-anchor-telemetry './IN' from .* 65533" ns1/named.run > /dev/null && ret=1
+$PERL $SYSTEMTESTTOP/stop.pl dnssec ns1 || ret=1
+$PERL $SYSTEMTESTTOP/start.pl --noclean --restart --port ${PORT} dnssec ns1 || ret=1
+n=$(($n+1))
+test "$ret" -eq 0 || echo_i "failed"
+status=$((status+ret))
+
 echo_i "check that the view is logged in messages from the validator when using views ($n)"
 ret=0
 grep "view rec: *validat" ns4/named.run > /dev/null || ret=1
@@ -3624,6 +3648,19 @@ n=$((n+1))
 test "$ret" -eq 0 || echo_i "failed"
 status=$((status+ret))

+echo_i "checking DNSSEC records are occluded from ANY in an insecure zone ($n)"
+ret=0
+dig_with_opts any x.insecure.example. @10.53.0.3 > dig.out.ns3.1.test$n || ret=1
+grep "status: NOERROR" dig.out.ns3.1.test$n > /dev/null || ret=1
+grep "ANSWER: 0," dig.out.ns3.1.test$n > /dev/null || ret=1
+dig_with_opts any zz.secure.example. @10.53.0.3 > dig.out.ns3.2.test$n || ret=1
+grep "status: NOERROR" dig.out.ns3.2.test$n > /dev/null || ret=1
+# DNSKEY+RRSIG, NSEC+RRSIG
+grep "ANSWER: 4," dig.out.ns3.2.test$n > /dev/null || ret=1
+n=$((n+1))
+test "$ret" -eq 0 || echo_i "failed"
+status=$((status+ret))
+
 # Note: after this check, ns4 will not be validating any more; do not add any
 # further validation tests employing ns4 below this check.
 echo_i "check that validation defaults to off when dnssec-enable is off ($n)"
@@ -12,6 +12,8 @@
 SYSTEMTESTTOP=..
 . $SYSTEMTESTTOP/conf.sh

+$SHELL clean.sh
+
 copy_setports ns1/named.conf.in ns1/named.conf
 copy_setports ns2/named.conf.in ns2/named.conf
 copy_setports ns3/named.conf.in ns3/named.conf
@@ -10,7 +10,7 @@
 SYSTEMTESTTOP=..
 . $SYSTEMTESTTOP/conf.sh

-test -f clean.sh && $SHELL clean.sh
+$SHELL clean.sh

 test -r $RANDFILE || $GENRANDOM 800 $RANDFILE

@@ -12,4 +12,6 @@
 SYSTEMTESTTOP=..
 . $SYSTEMTESTTOP/conf.sh

+$SHELL clean.sh
+
 cd ns1 && $SHELL sign.sh
@@ -12,4 +12,6 @@
 SYSTEMTESTTOP=..
 . $SYSTEMTESTTOP/conf.sh

+$SHELL clean.sh
+
 cd ns1 && $SHELL sign.sh
@@ -47,6 +47,7 @@ usage() {
 	fprintf(stderr, "	--ipv6only=no\n");
 	fprintf(stderr, "	--with-idn\n");
 	fprintf(stderr, "	--with-lmdb\n");
+	fprintf(stderr, "	--with-dlz-filesystem\n");
 }

 int
@@ -150,6 +151,14 @@ main(int argc, char **argv) {
 #endif
 	}

+	if (strcmp(argv[1], "--with-dlz-filesystem") == 0) {
+#ifdef DLZ_FILESYSTEM
+		return (0);
+#else
+		return (1);
+#endif
+	}
+
 	if (strcmp(argv[1], "--ipv6only=no") == 0) {
 #ifdef WIN32
 		return (0);
@@ -21,7 +21,7 @@
 #

 config_guess=""
-for f in ./config.guess ../../../config.guess
+for f in ./config.guess ../../../config.guess /usr/share/automake*/config.guess
 do
 	if test -f $f
 	then
@@ -13,7 +13,6 @@ SYSTEMTESTTOP=..
 $SHELL clean.sh

 cp ns1/root.db.in ns1/root.db
-rm -f ns1/root.db.signed

 touch ns2/trusted.conf
 cp ns2/nsec3-loop.db.in ns2/nsec3-loop.db
@@ -24,7 +23,6 @@ cp ns2/bits.db.in ns2/nokeys.db
 cp ns2/bits.db.in ns2/removedkeys-secondary.db
 cp ns2/bits.db.in ns2/retransfer.db
 cp ns2/bits.db.in ns2/retransfer3.db
-rm -f ns2/bits.db.jnl

 cp ns3/master.db.in ns3/master.db
 cp ns3/master.db.in ns3/dynamic.db
@@ -39,7 +37,6 @@ mkdir ns3/removedkeys

 touch ns4/trusted.conf
 cp ns4/noixfr.db.in ns4/noixfr.db
-rm -f ns4/noixfr.db.jnl

 copy_setports ns1/named.conf.in ns1/named.conf
 copy_setports ns2/named.conf.in ns2/named.conf
@@ -10,7 +10,7 @@
 # information regarding copyright ownership.

 rm -f stats.*
-rm -f ns1/myftp.db
+rm -f ns1/*.db ns1/*.jnl
 rm -f ns3/*.jnl ns3/mytest.db ns3/subtest.db
 rm -f ns4/*.jnl ns4/*.db
 rm -f */named.memstats
@@ -12,7 +12,7 @@
 SYSTEMTESTTOP=..
 . $SYSTEMTESTTOP/conf.sh

-rm -f ns1/*.db ns1/*.jnl ns3/*.jnl ns4/*.db ns4/*.jnl
+$SHELL clean.sh

 cat <<EOF >ns1/named.conf
 options {
@@ -19,8 +19,6 @@ $SHELL clean.sh
 # Test 1: KSK goes inactive before successor is active
 dir=01-ksk-inactive
 echo_i "set up $dir"
-rm -f $dir/K*.key
-rm -f $dir/K*.private
 ksk1=`$KEYGEN -K $dir -a rsasha1 -3fk example.com`
 $SETTIME -K $dir -I +9mo -D +1y $ksk1 > /dev/null 2>&1
 ksk2=`$KEYGEN -K $dir -S $ksk1`
@@ -30,8 +28,6 @@ zsk1=`$KEYGEN -K $dir -a rsasha1 -3 example.com`
 # Test 2: ZSK goes inactive before successor is active
 dir=02-zsk-inactive
 echo_i "set up $dir"
-rm -f $dir/K*.key
-rm -f $dir/K*.private
 zsk1=`$KEYGEN -K $dir -a rsasha1 -3 example.com`
 $SETTIME -K $dir -I +9mo -D +1y $zsk1 > /dev/null 2>&1
 zsk2=`$KEYGEN -K $dir -S $zsk1`
@@ -41,8 +37,6 @@ ksk1=`$KEYGEN -K $dir -a rsasha1 -3fk example.com`
 # Test 3: KSK is unpublished before its successor is published
 dir=03-ksk-unpublished
 echo_i "set up $dir"
-rm -f $dir/K*.key
-rm -f $dir/K*.private
 ksk1=`$KEYGEN -K $dir -a rsasha1 -3fk example.com`
 $SETTIME -K $dir -I +9mo -D +1y $ksk1 > /dev/null 2>&1
 ksk2=`$KEYGEN -K $dir -S $ksk1`
@@ -52,8 +46,6 @@ zsk1=`$KEYGEN -K $dir -a rsasha1 -3 example.com`
 # Test 4: ZSK is unpublished before its successor is published
 dir=04-zsk-unpublished
 echo_i "set up $dir"
-rm -f $dir/K*.key
-rm -f $dir/K*.private
 zsk1=`$KEYGEN -K $dir -a rsasha1 -3 example.com`
 $SETTIME -K $dir -I +9mo -D +1y $zsk1 > /dev/null 2>&1
 zsk2=`$KEYGEN -K $dir -S $zsk1`
@@ -64,8 +56,6 @@ ksk1=`$KEYGEN -K $dir -a rsasha1 -3fk example.com`
 # and successor activated.
 dir=05-ksk-unpub-active
 echo_i "set up $dir"
-rm -f $dir/K*.key
-rm -f $dir/K*.private
 ksk1=`$KEYGEN -K $dir -a rsasha1 -3fk example.com`
 $SETTIME -K $dir -I +9mo -D +8mo $ksk1 > /dev/null 2>&1
 ksk2=`$KEYGEN -K $dir -S $ksk1`
@@ -75,8 +65,6 @@ zsk1=`$KEYGEN -K $dir -a rsasha1 -3 example.com`
 # and successor activated.
 dir=06-zsk-unpub-active
 echo_i "set up $dir"
-rm -f $dir/K*.key
-rm -f $dir/K*.private
 zsk1=`$KEYGEN -K $dir -a rsasha1 -3 example.com`
 $SETTIME -K $dir -I +9mo -D +8mo $zsk1 > /dev/null 2>&1
 zsk2=`$KEYGEN -K $dir -S $zsk1`
@@ -85,8 +73,6 @@ ksk1=`$KEYGEN -K $dir -a rsasha1 -3fk example.com`
 # Test 7: KSK rolled with insufficient delay after prepublication.
 dir=07-ksk-ttl
 echo_i "set up $dir"
-rm -f $dir/K*.key
-rm -f $dir/K*.private
 ksk1=`$KEYGEN -K $dir -a rsasha1 -3fk example.com`
 $SETTIME -K $dir -I +9mo -D +1y $ksk1 > /dev/null 2>&1
 ksk2=`$KEYGEN -K $dir -S $ksk1`
@@ -96,8 +82,6 @@ zsk1=`$KEYGEN -K $dir -a rsasha1 -3 example.com`
 # Test 8: ZSK rolled with insufficient delay after prepublication.
 dir=08-zsk-ttl
 echo_i "set up $dir"
-rm -f $dir/K*.key
-rm -f $dir/K*.private
 zsk1=`$KEYGEN -K $dir -a rsasha1 -3 example.com`
 $SETTIME -K $dir -I +9mo -D +1y $zsk1 > /dev/null 2>&1
 zsk2=`$KEYGEN -K $dir -S $zsk1`
@@ -106,14 +90,10 @@ $SETTIME -K $dir -P +269d $zsk2 > /dev/null 2>&1
 ksk1=`$KEYGEN -K $dir -a rsasha1 -3fk example.com`

 # Test 9: No special preparation needed
-rm -f $dir/K*.key
-rm -f $dir/K*.private

 # Test 10: Valid key set, but rollover period has changed
 dir=10-change-roll
 echo_i "set up $dir"
-rm -f $dir/K*.key
-rm -f $dir/K*.private
 ksk1=`$KEYGEN -K $dir -a rsasha1 -3fk example.com`
 zsk1=`$KEYGEN -K $dir -a rsasha1 -3 example.com`
 $SETTIME -K $dir -I +3mo -D +4mo $zsk1 > /dev/null 2>&1
@@ -122,8 +102,6 @@ zsk2=`$KEYGEN -K $dir -S $zsk1`
 # Test 11: Many keys all simultaneously scheduled to be active in the future
 dir=11-many-simul
 echo_i "set up $dir"
-rm -f $dir/K*.key
-rm -f $dir/K*.private
 k1=`$KEYGEN -K $dir -a rsasha1 -q3fk -P now+1mo -A now+1mo example.com`
 z1=`$KEYGEN -K $dir -a rsasha1 -q3 -P now+1mo -A now+1mo example.com`
 z2=`$KEYGEN -K $dir -a rsasha1 -q3 -P now+1mo -A now+1mo example.com`
@@ -133,8 +111,6 @@ z4=`$KEYGEN -K $dir -a rsasha1 -q3 -P now+1mo -A now+1mo example.com`
 # Test 12: Many keys all simultaneously scheduled to be active in the past
 dir=12-many-active
 echo_i "set up $dir"
-rm -f $dir/K*.key
-rm -f $dir/K*.private
 k1=`$KEYGEN -K $dir -a rsasha1 -q3fk example.com`
 z1=`$KEYGEN -K $dir -a rsasha1 -q3 example.com`
 z2=`$KEYGEN -K $dir -a rsasha1 -q3 example.com`
@@ -144,8 +120,6 @@ z4=`$KEYGEN -K $dir -a rsasha1 -q3 example.com`
 # Test 13: Multiple simultaneous keys with no configured roll period
 dir=13-noroll
 echo_i "set up $dir"
-rm -f $dir/K*.key
-rm -f $dir/K*.private
 k1=`$KEYGEN -K $dir -a rsasha1 -q3fk example.com`
 k2=`$KEYGEN -K $dir -a rsasha1 -q3fk example.com`
 k3=`$KEYGEN -K $dir -a rsasha1 -q3fk example.com`
@@ -154,8 +128,6 @@ z1=`$KEYGEN -K $dir -a rsasha1 -q3 example.com`
 # Test 14: Keys exist but have the wrong algorithm
 dir=14-wrongalg
 echo_i "set up $dir"
-rm -f $dir/K*.key
-rm -f $dir/K*.private
 k1=`$KEYGEN -K $dir -a rsasha1 -qfk example.com`
 z1=`$KEYGEN -K $dir -a rsasha1 -q example.com`
 $SETTIME -K $dir -I now+6mo -D now+8mo $z1 > /dev/null
@@ -168,8 +140,6 @@ z4=`$KEYGEN -K $dir -q -S ${z3}.key`
 # Test 15: No zones specified; just search the directory for keys
 dir=15-unspec
 echo_i "set up $dir"
-rm -f $dir/K*.key
-rm -f $dir/K*.private
 k1=`$KEYGEN -K $dir -a rsasha1 -q3fk example.com`
 z1=`$KEYGEN -K $dir -a rsasha1 -q3 example.com`
 $SETTIME -K $dir -I now+6mo -D now+8mo $z1 > /dev/null
@@ -183,8 +153,6 @@ z4=`$KEYGEN -K $dir -q -S ${z3}.key`
 # keys have the wrong algorithm for their policies
 dir=16-wrongalg-unspec
 echo_i "set up $dir"
-rm -f $dir/K*.key
-rm -f $dir/K*.private
 k1=`$KEYGEN -K $dir -a rsasha1 -qfk example.com`
 z1=`$KEYGEN -K $dir -a rsasha1 -q example.com`
 $SETTIME -K $dir -I now+6mo -D now+8mo $z1 > /dev/null
@@ -198,8 +166,6 @@ z4=`$KEYGEN -K $dir -q -S ${z3}.key`
 # flag (this should fail)
 dir=17-noforce
 echo_i "set up $dir"
-rm -f $dir/K*.key
-rm -f $dir/K*.private
 k1=`$KEYGEN -K $dir -a rsasha1 -q3fk example.com`
 z1=`$KEYGEN -K $dir -a rsasha1 -q3 example.com`
 z2=`$KEYGEN -K $dir -a rsasha1 -q3 example.com`
@@ -209,8 +175,6 @@ z4=`$KEYGEN -K $dir -a rsasha1 -q3 example.com`
 # Test 18: Prepublication interval is set to a nonstandard value
 dir=18-nonstd-prepub
 echo_i "set up $dir"
-rm -f $dir/K*.key
-rm -f $dir/K*.private
 ksk1=`$KEYGEN -K $dir -a rsasha1 -3fk example.com`
 zsk1=`$KEYGEN -K $dir -a rsasha1 -3 example.com`
 $SETTIME -K $dir -I now+2mo -D now+3mo $zsk1 > /dev/null
@@ -218,8 +182,6 @@ $SETTIME -K $dir -I now+2mo -D now+3mo $zsk1 > /dev/null
 # Test 19: Key has been published/active a long time
 dir=19-old-keys
 echo_i "set up $dir"
-rm -f $dir/K*.key
-rm -f $dir/K*.private
 ksk1=`$KEYGEN -K $dir -a rsasha1 -3fk example.com`
 zsk1=`$KEYGEN -K $dir -a rsasha1 -3 example.com`
 $SETTIME -K $dir -P now-2y -A now-2y $ksk1 > /dev/null
@@ -12,7 +12,7 @@
 SYSTEMTESTTOP=..
 . $SYSTEMTESTTOP/conf.sh

-DIGOPTS="-p ${PORT}"
+DIGOPTS="-p ${PORT} +tries=3 +time=5"

 status=0
 n=0
@@ -12,11 +12,12 @@
 # shellcheck source=conf.sh
 . "$SYSTEMTESTTOP/conf.sh"

+$SHELL clean.sh
+
 copy_setports ns1/named.conf.in ns1/named.conf
 copy_setports ns2/named.conf.in ns2/named.conf
 copy_setports ns3/named.conf.in ns3/named.conf

-rm -f ns1/example.db.raw
 cp ns1/example.db ns2/
 cp ns2/formerly-text.db.in ns2/formerly-text.db
 cp ns1/large.db.in ns1/large.db
@@ -12,7 +12,7 @@
 SYSTEMTESTTOP=..
 . $SYSTEMTESTTOP/conf.sh

-$SHELL ./clean.sh
+$SHELL clean.sh

 pzone=parent.nil
 czone=child.parent.nil
@@ -1 +1 @@
-D mirror-ns3 -X named.lock -m record,size,mctx -T clienttest -c named.conf -d 99 -g -U 4 -T tat=1
+-D mirror-ns3 -X named.lock -m record,size,mctx -T clienttest -c named.conf -d 99 -g -U 4 -T tat=3
@@ -12,7 +12,7 @@
 SYSTEMTESTTOP=..
 . $SYSTEMTESTTOP/conf.sh

-DIGOPTS="-p ${PORT} -b 10.53.0.1 +dnssec +time=1 +tries=1 +multi"
+DIGOPTS="-p ${PORT} -b 10.53.0.1 +dnssec +time=2 +tries=1 +multi"
 RNDCCMD="$RNDC -c $SYSTEMTESTTOP/common/rndc.conf -p ${CONTROLPORT} -s"

 # Wait until the transfer of the given zone to ns3 either completes successfully
@@ -213,6 +213,14 @@ nextpartpeek ns3/named.run | grep "verify-load.*mirror zone is now in use" > /de
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`

+n=`expr $n + 1`
+echo_i "ensuring trust anchor telemetry queries are sent upstream for a mirror zone ($n)"
+ret=0
+# ns3 is started with "-T tat=3", so TAT queries should have already been sent.
+grep "_ta-[-0-9a-f]*/NULL" ns1/named.run > /dev/null || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=`expr $status + $ret`
+
 n=`expr $n + 1`
 echo_i "checking that loading a correctly signed mirror zone from disk succeeds ($n)"
 ret=0
@@ -541,13 +549,5 @@ grep "flags:.* ad" dig.out.ns3.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`

-n=`expr $n + 1`
-echo_i "ensuring trust anchor telemetry queries are sent upstream for a mirror zone ($n)"
-ret=0
-# ns3 is started with "-T tat=1", so TAT queries should have already been sent.
-grep "_ta-[-0-9a-f]*/NULL" ns1/named.run > /dev/null || ret=1
-if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
-
 echo_i "exit status: $status"
 [ $status -eq 0 ] || exit 1
@@ -19,3 +19,6 @@ managed-keys.jnl, causing RFC 5011 initialization to fail.

 ns5 is a validator which is prevented from getting a response from the
 root server, causing key refresh queries to fail.
+
+ns6 is a validator which has unsupported algorithms, one at start up,
+one because of an algorithm rollover.
@@ -16,9 +16,10 @@ rm -f */named.conf
 rm -f */named.memstats */named.run */named.run.prev
 rm -f dig.out* delv.out* rndc.out* signer.out*
 rm -f dsset-. ns1/dsset-.
+rm -f ns1/zone.key
 rm -f ns*/managed-keys.bind*
 rm -f ns*/named.lock
 rm -f ns1/named.secroots ns1/root.db.signed* ns1/root.db.tmp
 rm -f ns5/named.args
-rm -f ns6/view1.mkeys ns6/view2.mkeys
+rm -f ns7/view1.mkeys ns7/view2.mkeys
 rm -rf ns4/nope
@@ -8,16 +8,16 @@
 ; information regarding copyright ownership.

 $TTL 20
-. 			IN SOA	gson.nominum.com. a.root.servers.nil. (
-				2000042100   	; serial
-				600         	; refresh
-				600         	; retry
-				1200    	; expire
-				2       	; minimum
-				)
-.			NS	a.root-servers.nil.
-a.root-servers.nil.	A	10.53.0.1
+.                      IN SOA  gson.nominum.com. a.root.servers.nil. (
+                               2000042100      ; serial
+                               600             ; refresh
+                               600             ; retry
+                               1200            ; expire
+                               2               ; minimum
+                               )
+.                      NS      a.root-servers.nil.
+a.root-servers.nil.    A       10.53.0.1

 ; no delegation

-example.		TXT	"This is a test."
+example.               TXT     "This is a test."
@@ -26,13 +26,18 @@ cp managed.conf ../ns2/managed.conf
 cp managed.conf ../ns4/managed.conf
 cp managed.conf ../ns5/managed.conf

-# Configure a trusted key statement (used by delv)
+# Configure a trusted key statement (used by delv).
 keyfile_to_trusted_keys $keyname > trusted.conf

+# Prepare an unsupported algorithm key.
+unsupportedkey=Kunknown.+255+00000
+cp unsupported.key "${unsupportedkey}.key"
+
 #
 #  Save keyname and keyid for managed key id test.
 #
 echo "$keyname" > managed.key
+echo "$zskkeyname" > zone.key
 keyid=`expr $keyname : 'K\.+00.+\([0-9]*\)'`
 keyid=`expr $keyid + 0`
 echo "$keyid" > managed.key.id
@@ -0,0 +1 @@
+.	IN	DNSKEY	257 3 255 BJiXuidPHuGIne8GlCBLG+Oq/FZruQd2s3uBo+SxY16NUP/Vwl8MctMK62KsblDU1gIJAdEMVep2tsOkuSm0bIbJ8NBex+N9rSvzH2YJlDCT9QnNfv4q5RRTcVA3lk9nkmWHo6zcAT33yuS+THOCSznOMCJRq8JGZ6xqMJLv9FucuK6CCe6QBAZ5e98dpyGTWQLu7AERKKFqda9YCk3KQfdzx/HZ4SpQpRLncIXvGm1PIMT8Ar95NB/BsFJGwr5ZTaQtRYOXf2DD7wD3pfMsTJCdZyC0J0EtGBG109I+Oou1cswUfqZLXip/aV3eaBAUqLcZpg8P8vAbrvEq4uMS4OMZeXL6nu0irrdS1Pqmax8RsC+x3fg9EBH3QmHroJZtiU5h+0x4qApp7HE4Z5zFRuxIp9iB
@@ -24,6 +24,7 @@ options {
 	dnssec-enable yes;
 	dnssec-validation auto;
 	bindkeys-file "managed.conf";
+	servfail-ttl 0;
 };

 key rndc_key {
@@ -0,0 +1 @@
+-m record,size,mctx -T clienttest -c named.conf -d 99 -X named.lock -g -T mkeytimers=5/10/20
@@ -22,8 +22,8 @@ options {
 	recursion yes;
 	notify no;
 	dnssec-enable yes;
-	dnssec-validation auto;
-	bindkeys-file "managed.conf";
+	dnssec-validation yes;
+	trust-anchor-telemetry no;
 };

 key rndc_key {
@@ -35,16 +35,9 @@ controls {
 	inet 10.53.0.6 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
 };

-view view1 {
-	zone "." {
-		type hint;
-		file "../../common/root.hint";
-	};
+zone "." {
+	type hint;
+	file "../../common/root.hint";
 };

-view view2 {
-	zone "." {
-		type hint;
-		file "../../common/root.hint";
-	};
-};
+include "managed.conf";
@@ -0,0 +1,30 @@
+#!/bin/sh -e
+#
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+SYSTEMTESTTOP=../..
+. $SYSTEMTESTTOP/conf.sh
+
+zone=.
+zonefile=root.db
+
+# an RSA key
+rsakey=`$KEYGEN -a rsasha256 -qfk rsasha256.`
+
+# a key with unsupported algorithm
+unsupportedkey=Kunknown.+255+00000
+cp unsupported-managed.key "${unsupportedkey}.key"
+
+# root key
+rootkey=`cat ../ns1/managed.key`
+cp "../ns1/${rootkey}.key" .
+
+# Configure the resolving server with a managed trusted key.
+keyfile_to_managed_keys $unsupportedkey $rsakey $rootkey > managed.conf
@@ -0,0 +1 @@
+unsupported.	IN	DNSKEY	257 3 255 BOOVAhiJDPqhfU7+yGXjhetrtC/rtjmwO1yo52BUHUd8R4hQ/ZPdYCVvQlvNkRxDblPkFM5YRXkesS30pJSoNYrg+djbMNumJrLG+lbhFIc/ahTjlYOxb1zm2z00ubHju/1uGBifiRvKWSK0Vr0u6NtS4PKZfsnXt+piSHiRAHSfkjGHwqPYYKh9EUW12kJmIzlMaM6WYl+gJOvL+f8VqNLtvsMPT6OPK/3h/Dnfnxyeudp/jzAnNDDiTgX2XfzIXB4UwxtzIOGaHLnprpNf3zoBm0kyaEdSQQ/qKkpCOqjBasYEHRjVz3RncPUkdLr7PQuPBfFDr3SUMMJqufJrO4IJjtD4cCBT7K1i39Jg471nEzU1vkPzxF+Rw1QHT4nZaXbltf3BEZGS4Knoe9XPwi5KjGW6
@@ -0,0 +1,50 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+// NS7
+
+options {
+	query-source address 10.53.0.7;
+	notify-source 10.53.0.7;
+	transfer-source 10.53.0.7;
+	port @PORT@;
+	pid-file "named.pid";
+	listen-on { 10.53.0.7; };
+	listen-on-v6 { none; };
+	recursion yes;
+	notify no;
+	dnssec-enable yes;
+	dnssec-validation auto;
+	bindkeys-file "managed.conf";
+};
+
+key rndc_key {
+	secret "1234abcd8765";
+	algorithm hmac-sha256;
+};
+
+controls {
+	inet 10.53.0.7 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
+};
+
+view view1 {
+	zone "." {
+		type hint;
+		file "../../common/root.hint";
+	};
+};
+
+view view2 {
+	zone "." {
+		type hint;
+		file "../../common/root.hint";
+	};
+};
@@ -20,10 +20,12 @@ copy_setports ns3/named.conf.in ns3/named.conf
 copy_setports ns4/named.conf.in ns4/named.conf
 copy_setports ns5/named.conf.in ns5/named.conf
 copy_setports ns6/named.conf.in ns6/named.conf
+copy_setports ns7/named.conf.in ns7/named.conf

 cp ns5/named1.args ns5/named.args

 ( cd ns1 && $SHELL sign.sh )
+( cd ns6 && $SHELL setup.sh )

 cp ns2/managed.conf ns2/managed1.conf

@@ -745,7 +745,7 @@ nextpart ns5/named.run > /dev/null
 mkeys_reconfig_on 1
 wait_for_log "Returned from key fetch in keyfetch_done() for '.': success" ns5/named.run
 mkeys_secroots_on 5
-grep '; managed' ns5/named.secroots > /dev/null 2>&1 || ret=1
+grep '; managed' ns5/named.secroots > /dev/null || ret=1
 # ns1 should not longer REFUSE queries from ns5, so managed keys should be
 # correctly refreshed and resolving should succeed
 $DIG $DIGOPTS +noauth example. @10.53.0.5 txt > dig.out.ns5.b.test$n || ret=1
@@ -755,17 +755,71 @@ grep "status: NOERROR" dig.out.ns5.b.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`

+n=`expr $n + 1`
+echo_i "reinitialize trust anchors, add unsupported algorithm ($n)"
+ret=0
+$PERL $SYSTEMTESTTOP/stop.pl --use-rndc --port ${CONTROLPORT} mkeys ns6
+rm -f ns6/managed-keys.bind*
+nextpart ns6/named.run > /dev/null
+$PERL $SYSTEMTESTTOP/start.pl --noclean --restart --port ${PORT} mkeys ns6
+# log when an unsupported algorithm is encountered during startup
+wait_for_log "skipping managed key for 'unsupported\.': algorithm is unsupported" ns6/named.run
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=`expr $status + $ret`
+
+n=`expr $n + 1`
+echo_i "skipping unsupported algorithm in managed-keys ($n)"
+ret=0
+mkeys_status_on 6 > rndc.out.$n 2>&1
+# there should still be only two keys listed (for . and rsasha256.)
+count=`grep -c "keyid: " rndc.out.$n`
+[ "$count" -eq 2 ] || ret=1
+# two lines indicating trust status
+count=`grep -c "trust" rndc.out.$n`
+[ "$count" -eq 2 ] || ret=1
+
+n=`expr $n + 1`
+echo_i "introduce unsupported algorithm rollover in authoritative zone ($n)"
+ret=0
+cp ns1/root.db ns1/root.db.orig
+ksk=`cat ns1/managed.key`
+zsk=`cat ns1/zone.key`
+cat "ns1/${ksk}.key" "ns1/${zsk}.key" ns1/unsupported.key >> ns1/root.db
+grep "\..*IN.*DNSKEY.*257 3 255" ns1/root.db > /dev/null || ret=1
+$SIGNER -K ns1 -N unixtime -o . ns1/root.db $ksk $zsk > /dev/null 2>/dev/null || ret=1
+grep "DNSKEY.*257 3 255" ns1/root.db.signed > /dev/null || ret=1
+cp ns1/root.db.orig ns1/root.db
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=`expr $status + $ret`
+
+n=`expr $n + 1`
+echo_i "skipping unsupported algorithm in rollover ($n)"
+ret=0
+mkeys_reload_on 1
+mkeys_refresh_on 6
+mkeys_status_on 6 > rndc.out.$n 2>&1
+# there should still be only two keys listed (for . and rsasha256.)
+count=`grep -c "keyid: " rndc.out.$n`
+[ "$count" -eq 2 ] || ret=1
+# two lines indicating trust status
+count=`grep -c "trust" rndc.out.$n`
+[ "$count" -eq 2 ] || ret=1
+# log when an unsupported algorithm is encountered during rollover
+wait_for_log "Cannot compute tag for key in zone \.: algorithm is unsupported" ns6/named.run
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=`expr $status + $ret`
+
 n=`expr $n + 1`
 echo_i "check 'rndc managed-keys' and views ($n)"
 ret=0
-$RNDCCMD 10.53.0.6 managed-keys refresh in view1 > rndc.out.ns6.view1.test$n || ret=1
-grep "refreshing managed keys for 'view1'" rndc.out.ns6.view1.test$n > /dev/null || ret=1
-lines=`wc -l < rndc.out.ns6.view1.test$n`
+$RNDCCMD 10.53.0.7 managed-keys refresh in view1 > rndc.out.ns7.view1.test$n || ret=1
+grep "refreshing managed keys for 'view1'" rndc.out.ns7.view1.test$n > /dev/null || ret=1
+lines=`wc -l < rndc.out.ns7.view1.test$n`
 [ $lines -eq 1 ] || ret=1
-$RNDCCMD 10.53.0.6 managed-keys refresh > rndc.out.ns6.view2.test$n || ret=1
-lines=`wc -l < rndc.out.ns6.view2.test$n`
-grep "refreshing managed keys for 'view1'" rndc.out.ns6.view2.test$n > /dev/null || ret=1
-grep "refreshing managed keys for 'view2'" rndc.out.ns6.view2.test$n > /dev/null || ret=1
+$RNDCCMD 10.53.0.7 managed-keys refresh > rndc.out.ns7.view2.test$n || ret=1
+lines=`wc -l < rndc.out.ns7.view2.test$n`
+grep "refreshing managed keys for 'view1'" rndc.out.ns7.view2.test$n > /dev/null || ret=1
+grep "refreshing managed keys for 'view2'" rndc.out.ns7.view2.test$n > /dev/null || ret=1
 [ $lines -eq 2 ] || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
@@ -12,7 +12,11 @@
 SYSTEMTESTTOP=..
 . $SYSTEMTESTTOP/conf.sh

+#
+# jnl and database files MUST be removed before we start
+#
 $SHELL clean.sh
+
 copy_setports ns1/named.conf.in ns1/named.conf
 copy_setports ns2/named.conf.in ns2/named.conf
 copy_setports ns3/named.conf.in ns3/named.conf
@@ -25,15 +29,6 @@ copy_setports ns10/named.conf.in ns10/named.conf

 copy_setports verylarge.in verylarge

-#
-# jnl and database files MUST be removed before we start
-#
-
-rm -f ns1/*.jnl ns1/example.db ns2/*.jnl ns2/example.bk
-rm -f ns2/update.bk ns2/update.alt.bk
-rm -f ns3/example.db.jnl
-rm -f ns3/too-big.test.db.jnl
-
 cp -f ns1/example1.db ns1/example.db
 sed 's/example.nil/other.nil/g' ns1/example1.db > ns1/other.db
 sed 's/example.nil/unixtime.nil/g' ns1/example1.db > ns1/unixtime.db
@@ -71,13 +66,11 @@ $DDNSCONFGEN -q -a hmac-sha512 -k sha512-key -z keytests.nil > ns1/sha512.key
 (cd ns3; $SHELL -e sign.sh)

 cp -f ns1/many.test.db.in ns1/many.test.db
-rm -f ns1/many.test.db.jnl

 cp ns1/sample.db.in ns1/sample.db
 cp ns2/sample.db.in ns2/sample.db

 cp -f ns1/maxjournal.db.in ns1/maxjournal.db
-rm -f ns1/maxjournal.db.jnl

 cp -f ns5/local.db.in ns5/local.db
 cp -f ns6/in-addr.db.in ns6/in-addr.db
@@ -12,6 +12,8 @@
 SYSTEMTESTTOP=..
 . $SYSTEMTESTTOP/conf.sh

+$SHELL clean.sh
+
 copy_setports ns1/named.conf.in ns1/named.conf
 copy_setports ns2/named.conf.in ns2/named.conf
 copy_setports ns3/named.conf.in ns3/named.conf
@@ -12,6 +12,8 @@
 SYSTEMTESTTOP=..
 . $SYSTEMTESTTOP/conf.sh

+$SHELL clean.sh
+
 infile=ns1/example.db.in

 /bin/echo -n ${HSMPIN:-1234}> pin
@@ -27,5 +27,10 @@ rm -f ns3/dsset-signed.
 rm -f ns3/nsec3.db*
 rm -f ns3/signed.db*
 rm -f ns4/*.db
+rm -f ns5/dsset-*
+rm -f ns5/K* ns5/sign.ns5.*
+rm -f ns5/root.db ns5/root.db.signed
+rm -f ns5/signed.db ns5/signed.db.signed
+rm -f ns6/signed.db.signed
 rm -f rndc.out
 rm -f ns*/managed-keys.bind*
@@ -11,7 +11,7 @@ $TTL 3600
@		SOA	a.root-servers.nil. marka.isc.org. 0 0 0 0 0
@		NS	a.root-servers.nil.
 a.root-servers.nil.      A   10.53.0.1
-example 	NS	ns1.example.
+example		NS	ns1.example.
 ns1.example.	A	10.53.0.1
 signed		NS	ns1.example.
 ns1.signed.	A	10.53.0.1
@@ -16,7 +16,7 @@ controls { /* empty */ };
 acl rfc1918 { 10/8; 192.168/16; 172.16/12; };

 options {
-	query-source address 10.53.0.2;	/* note this is not 10.53.0.3 */
+	query-source address 10.53.0.2;	/* note this is not 10.53.0.4 */
 	notify-source 10.53.0.4;
 	transfer-source 10.53.0.4;
 	port @PORT@;
@@ -28,7 +28,6 @@ options {
 	dnssec-enable yes;
 	dnssec-validation yes;
 	nxdomain-redirect "redirect";
-
 };

 key rndc_key {
@@ -0,0 +1,30 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+// NS5
+
+options {
+	port @PORT@;
+	listen-on port @PORT@ { 10.53.0.5; };
+	pid-file "named.pid";
+	nxdomain-redirect signed;
+};
+
+zone "." {
+        type master;
+        file "root.db.signed";
+};
+
+// An unsigned zone that ns6 has a delegation for.
+zone "unsigned." {
+        type master;
+        file "unsigned.db";
+};
@@ -0,0 +1,16 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0. If a copy of the MPL was not distributed with this
+; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+.			86400	IN	SOA	a.root-servers.nil. hostmaster.example.net. 2019022100 1800 900 604800 86400
+.			518400	IN	NS	a.root-servers.nil.
+a.root-servers.nil.	518400	IN	A	10.53.0.5
+signed.			172800	IN	NS	ns.signed.
+ns.signed.		172800	IN	A	10.53.0.6
+unsigned.		172800	IN	NS	ns.unsigned.
+ns.unsigned.		172800	IN	A	10.53.0.5
@@ -0,0 +1,43 @@
+#!/bin/sh -e
+#
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+SYSTEMTESTTOP=../..
+. $SYSTEMTESTTOP/conf.sh
+
+# We sign the zone here and move the signed zone to ns6.
+# The ns5 server actually does not serve this zone but
+# the DS and NS records are in the test root zone, and
+# delegate to ns6.
+zone=signed.
+infile=signed.db.in
+zonefile=signed.db
+
+key1=`$KEYGEN -q -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS $zone 2> /dev/null`
+key2=`$KEYGEN -q -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -fk $zone 2> /dev/null`
+
+cat $infile $key1.key $key2.key > $zonefile
+
+$SIGNER -P -g -O full -o $zone $zonefile > sign.ns5.signed.out 2>&1
+
+cp signed.db.signed ../ns6
+
+# Root zone.
+zone=.
+infile=root.db.in
+zonefile=root.db
+
+key1=`$KEYGEN -q -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS $zone 2> /dev/null`
+key2=`$KEYGEN -q -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -fk $zone 2> /dev/null`
+
+# cat $infile $key1.key $key2.key > $zonefile
+cat $infile dsset-signed. $key1.key $key2.key > $zonefile
+
+$SIGNER -P -g -O full -o $zone $zonefile > sign.ns5.root.out 2>&1
@@ -0,0 +1,18 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0. If a copy of the MPL was not distributed with this
+; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 300
+@			IN SOA	ns.signed. hostmaster.signed. 0 0 0 0 0
+@			IN NS	ns.signed.
+
+ns.signed.		IN A	10.0.53.6
+domain.signed.		IN A	10.0.53.1
+
+*			IN A	100.100.100.1
+*			IN AAAA	2001:ffff:ffff::100.100.100.1
@@ -0,0 +1,18 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0. If a copy of the MPL was not distributed with this
+; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 300
+@			IN SOA	ns.unsigned. hostmaster.unsigned. 0 0 0 0 0
+@			IN NS	ns.unsigned.
+
+ns.unsigned.		IN A	10.53.0.6
+domain.unsigned.	IN A	10.0.53.1
+
+*			IN A	100.100.100.1
+*			IN AAAA	2001:ffff:ffff::100.100.100.1
@@ -0,0 +1,30 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+// NS6
+
+options {
+	port @PORT@;
+	listen-on port @PORT@ { 10.53.0.6; };
+	pid-file "named.pid";
+	nxdomain-redirect unsigned;
+};
+
+zone "." {
+        type master;
+        file "root.db";
+};
+
+// A signed zone that ns5 has a delegation for.
+zone "signed." {
+        type master;
+        file "signed.db.signed";
+};
@@ -0,0 +1,16 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0. If a copy of the MPL was not distributed with this
+; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+.			86400	IN	SOA	a.root-servers.nil. hostmaster.example.net. 2019022100 1800 900 604800 86400
+.			518400	IN	NS	a.root-servers.nil.
+a.root-servers.nil.	518400	IN	A	10.53.0.6
+signed.			172800	IN	NS	ns.signed.
+ns.signed.		172800	IN	A	10.53.0.6
+unsigned.		172800	IN	NS	ns.unsigned.
+ns.unsigned.		172800	IN	A	10.53.0.5
@@ -18,6 +18,8 @@ copy_setports ns1/named.conf.in ns1/named.conf
 copy_setports ns2/named.conf.in ns2/named.conf
 copy_setports ns3/named.conf.in ns3/named.conf
 copy_setports ns4/named.conf.in ns4/named.conf
+copy_setports ns5/named.conf.in ns5/named.conf
+copy_setports ns6/named.conf.in ns6/named.conf

 cp ns2/redirect.db.in ns2/redirect.db
 cp ns2/example.db.in ns2/example.db
@@ -25,3 +27,4 @@ cp ns2/example.db.in ns2/example.db

 cp ns4/example.db.in ns4/example.db
 ( cd ns3 && $SHELL sign.sh )
+( cd ns5 && $SHELL sign.sh )
@@ -517,5 +517,21 @@ n=`expr $n + 1`
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`

+echo_i "checking tld nxdomain-redirect against signed root zone ($n)"
+ret=0
+$DIG $DIGOPTS @10.53.0.5 asdfasdfasdf > dig.out.ns5.test$n || ret=1
+grep "status: NXDOMAIN" dig.out.ns5.test$n > /dev/null || ret=1
+n=`expr $n + 1`
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=`expr $status + $ret`
+
+echo_i "checking tld nxdomain-redirect against unsigned root zone ($n)"
+ret=0
+$DIG $DIGOPTS @10.53.0.6 asdfasdfasdf > dig.out.ns6.test$n || ret=1
+grep "status: NXDOMAIN" dig.out.ns6.test$n > /dev/null || ret=1
+n=`expr $n + 1`
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=`expr $status + $ret`
+
 echo_i "exit status: $status"
 [ $status -eq 0 ] || exit 1
@@ -12,6 +12,8 @@
 SYSTEMTESTTOP=..
 . $SYSTEMTESTTOP/conf.sh

+$SHELL clean.sh
+
 cp ns4/tld1.db ns4/tld.db
 cp ns6/to-be-removed.tld.db.in ns6/to-be-removed.tld.db
 cp ns7/server.db.in ns7/server.db
@@ -770,20 +770,20 @@ status=`expr $status + $ret`
 n=`expr $n + 1`
 echo_i "check that the resolver accepts a reply with empty question section with TC=1 and retries over TCP ($n)"
 ret=0
-$DIG $DIGOPTS @10.53.0.5 truncated.no-questions. a > dig.ns5.out.${n} || ret=1
+$DIG $DIGOPTS @10.53.0.5 truncated.no-questions. a +tries=3 +time=5 > dig.ns5.out.${n} || ret=1
 grep "status: NOERROR" dig.ns5.out.${n} > /dev/null || ret=1
 grep "ANSWER: 1," dig.ns5.out.${n} > /dev/null || ret=1
-grep "1.2.3.4" dig.ns5.out.${n} > /dev/null || ret=1
+grep "1\.2\.3\.4" dig.ns5.out.${n} > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`

 n=`expr $n + 1`
 echo_i "check that the resolver rejects a reply with empty question section with TC=0 ($n)"
 ret=0
-$DIG $DIGOPTS @10.53.0.5 not-truncated.no-questions. a > dig.ns5.out.${n} || ret=1
+$DIG $DIGOPTS @10.53.0.5 not-truncated.no-questions. a +tries=3 +time=5 > dig.ns5.out.${n} || ret=1
 grep "status: NOERROR" dig.ns5.out.${n} > /dev/null && ret=1
 grep "ANSWER: 1," dig.ns5.out.${n} > /dev/null && ret=1
-grep "1.2.3.4" dig.ns5.out.${n} > /dev/null && ret=1
+grep "1\.2\.3\.4" dig.ns5.out.${n} > /dev/null && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`

@@ -0,0 +1,29 @@
+Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+
+See COPYRIGHT in the source root or http://isc.org/copyright.html for terms.
+
+The test setup for the RPZ tests prepares a query perf tool and sets up
+policy zones.
+
+Name servers
+------------
+
+ns1 is the root server.
+
+ns2 and ns4 are authoritative servers for the various test domains.
+
+ns3 is the main rewriting resolver.
+
+ns5 and ns7 are additional rewriting resolvers.
+
+ns6 is a forwarding server.
+
+
+Updating the response policy zones
+----------------------------------
+
+test1, test2, test3, test4, test5, and test6 are dynamic update files.  These
+updates are made against ns3.  The script function "start_group" is called to
+start an new batch of tests that may depend on certain server updates.  The
+function takes an optional file name and if provided the server updates are
+performed before executing the test batch.
@@ -30,7 +30,9 @@ fi
 rm -f ns*/*.key ns*/*.private
 rm -f ns2/tld2s.db ns2/bl.tld2.db
 rm -f ns3/bl*.db ns*/empty.db
+rm -f ns3/manual-update-rpz.db
 rm -f ns5/example.db ns5/bl.db
+rm -f ns8/manual-update-rpz.db
 rm -f */policy2.db
 rm -f */*.jnl

@@ -0,0 +1,16 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0. If a copy of the MPL was not distributed with this
+; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+; RPZ test
+;   This basic file is copied to several zone files before being used.
+;   Its contents are also changed with nsupdate
+
+
+; broken zone
+foobar
@@ -0,0 +1,20 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0. If a copy of the MPL was not distributed with this
+; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+; RPZ test
+;   This basic file is copied to several zone files before being used.
+;   Its contents are also changed with nsupdate
+
+
+$TTL 300
+@				SOA	bl-reload.  hostmaster.ns.bl-reload. ( 2 3600 1200 604800 60 )
+				NS	ns.tld3.
+
+walled.tld2.bl-reload.	 300	A	10.0.0.2
+
@@ -0,0 +1,19 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0. If a copy of the MPL was not distributed with this
+; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+; RPZ test
+;   This basic file is copied to several zone files before being used.
+;   Its contents are also changed with nsupdate
+
+
+$TTL 300
+@					SOA	manual-update-rpz.  hostmaster.ns.manual-rpz-update. ( 1 3600 1200 604800 60 )
+					NS	ns.tld3.
+
+walled.tld2.manual-update-rpz.	 300	A	10.0.0.1
@@ -44,7 +44,9 @@ options {
 	    zone "bl-drop"	policy drop;
 	    zone "bl-tcp-only"	policy tcp-only;
 	    zone "bl.tld2";
+	    zone "manual-update-rpz";
 	}
+	add-soa yes
 	min-ns-dots 0
 	qname-wait-recurse yes
 	min-update-interval 0
@@ -102,3 +104,9 @@ zone "bl.tld2."		{type slave; file "bl.tld2.db"; masters {10.53.0.2;};

 zone "crash1.tld2"	{type master; file "crash1"; notify no;};
 zone "crash2.tld3."	{type master; file "crash2"; notify no;};
+
+zone "manual-update-rpz." {
+	type master;
+	file "manual-update-rpz.db";
+	notify no;
+};
@@ -29,6 +29,7 @@ options {
 	response-policy {
 	    zone "policy1" min-update-interval 0;
 	} qname-wait-recurse yes
+	// add-soa yes # leave add-soa as default for unset test
 	nsip-enable yes
 	nsdname-enable yes;

@@ -24,7 +24,7 @@ options {
 	dnssec-validation yes;

 	response-policy {
-	    zone "policy2";
+	    zone "policy2" add-soa no;
 	} qname-wait-recurse no
 	nsip-enable yes
 	nsdname-enable yes
--- a/Show More
+++ b/Show More
				`@@ -0,0 +1 @@`
				`. IN DNSKEY 257 3 255 BJiXuidPHuGIne8GlCBLG+Oq/FZruQd2s3uBo+SxY16NUP/Vwl8MctMK62KsblDU1gIJAdEMVep2tsOkuSm0bIbJ8NBex+N9rSvzH2YJlDCT9QnNfv4q5RRTcVA3lk9nkmWHo6zcAT33yuS+THOCSznOMCJRq8JGZ6xqMJLv9FucuK6CCe6QBAZ5e98dpyGTWQLu7AERKKFqda9YCk3KQfdzx/HZ4SpQpRLncIXvGm1PIMT8Ar95NB/BsFJGwr5ZTaQtRYOXf2DD7wD3pfMsTJCdZyC0J0EtGBG109I+Oou1cswUfqZLXip/aV3eaBAUqLcZpg8P8vAbrvEq4uMS4OMZeXL6nu0irrdS1Pqmax8RsC+x3fg9EBH3QmHroJZtiU5h+0x4qApp7HE4Z5zFRuxIp9iB`
				`@@ -0,0 +1 @@`
				`-m record,size,mctx -T clienttest -c named.conf -d 99 -X named.lock -g -T mkeytimers=5/10/20`
				`@@ -0,0 +1 @@`
				`unsupported. IN DNSKEY 257 3 255 BOOVAhiJDPqhfU7+yGXjhetrtC/rtjmwO1yo52BUHUd8R4hQ/ZPdYCVvQlvNkRxDblPkFM5YRXkesS30pJSoNYrg+djbMNumJrLG+lbhFIc/ahTjlYOxb1zm2z00ubHju/1uGBifiRvKWSK0Vr0u6NtS4PKZfsnXt+piSHiRAHSfkjGHwqPYYKh9EUW12kJmIzlMaM6WYl+gJOvL+f8VqNLtvsMPT6OPK/3h/Dnfnxyeudp/jzAnNDDiTgX2XfzIXB4UwxtzIOGaHLnprpNf3zoBm0kyaEdSQQ/qKkpCOqjBasYEHRjVz3RncPUkdLr7PQuPBfFDr3SUMMJqufJrO4IJjtD4cCBT7K1i39Jg471nEzU1vkPzxF+Rw1QHT4nZaXbltf3BEZGS4Knoe9XPwi5KjGW6`