nonfunctional qpdb-lite checkpoint

begin replacement of the underlying dns_rbt data structures in
dns_rbtdb with dns_qp. this is not complete and won't build.

done:
- add qpmethods functions and change tree, nsec, and nsec3 struct
  members from dns_rbt to dns_qp
- add a dns_qpdata structure to take the place of dns_rbtnode
- remove hashsize implementation since it's irrelevant now

not done yet:
- replace dns_rbt_findnode() and dns_rbt_addnode() with
  dns_qp_lookup() and dns_qp_insert()
- replace dns_rbt_nodefromname() etc with functions to get the name
  from the qpdata
- rewrite the dbiterator functions to use dns_qpiter
- rewrite remaining uses of dns_rbtnodechain to use dns_qpchain
- either rewrite is_leaf() for the QP trie or determine that
  we don't need it anymore
- ...etc?

.git-blame-ignore-revs

@@ -1536,5 +1536,3 @@ ffbe6b95371c99b7fb05e6de17a8d6b7bf4f629f
 05baf7206b7baaf91cb8e049ad13e413c52cdf3f
 # reformat shell scripts with shfmt
 4cb8b13987b930952238cc88e84272b8cf911933
-# Reformat sources with up-to-date clang-format-17
-79d93600116faabd89798522817ad95a69684fff

.gitlab-ci.yml

@@ -34,6 +34,8 @@ variables:
 
   UBSAN_OPTIONS: "halt_on_error=1:abort_on_error=1:disable_coredump=0"
 
+  TARBALL_EXTENSION: xz
+
   AM_COLOR_TESTS: always
 
   WITHOUT_READLINE: "--without-readline"
@@ -119,8 +121,8 @@ stages:
 
 # Alpine Linux
 
-.alpine-3.19-amd64: &alpine_3_19_amd64_image
-  image: "$CI_REGISTRY_IMAGE:alpine-3.19-amd64"
+.alpine-3.18-amd64: &alpine_3_18_amd64_image
+  image: "$CI_REGISTRY_IMAGE:alpine-3.18-amd64"
   <<: *linux_amd64
 
 # Oracle Linux
@@ -175,16 +177,16 @@ stages:
 
 # Fedora
 
-.tsan-fedora-39-amd64: &tsan_fedora_39_amd64_image
-  image: "$CI_REGISTRY_IMAGE:tsan-fedora-39-amd64"
+.tsan-fedora-38-amd64: &tsan_fedora_38_amd64_image
+  image: "$CI_REGISTRY_IMAGE:tsan-fedora-38-amd64"
   <<: *linux_amd64
 
-.fedora-39-amd64: &fedora_39_amd64_image
-  image: "$CI_REGISTRY_IMAGE:fedora-39-amd64"
+.fedora-38-amd64: &fedora_38_amd64_image
+  image: "$CI_REGISTRY_IMAGE:fedora-38-amd64"
   <<: *linux_amd64
 
-.fedora-39-arm64: &fedora_39_arm64_image
-  image: "$CI_REGISTRY_IMAGE:fedora-39-arm64"
+.fedora-38-arm64: &fedora_38_arm64_image
+  image: "$CI_REGISTRY_IMAGE:fedora-38-arm64"
   <<: *linux_arm64
 
 # Ubuntu
@@ -205,12 +207,12 @@ stages:
 
 ### QCOW2 Image Templates
 
-.freebsd-13-amd64: &freebsd_13_amd64_image
-  image: "freebsd-13.3-x86_64"
+.freebsd-12-amd64: &freebsd_12_amd64_image
+  image: "freebsd-12.4-x86_64"
   <<: *libvirt_amd64
 
-.freebsd-14-amd64: &freebsd_14_amd64_image
-  image: "freebsd-14.0-x86_64"
+.freebsd-13-amd64: &freebsd_13_amd64_image
+  image: "freebsd-13.2-x86_64"
   <<: *libvirt_amd64
 
 .openbsd-amd64: &openbsd_amd64_image
@@ -219,19 +221,17 @@ stages:
 
 ### Job Templates
 
-.api-pipelines-schedules-tags-triggers-web-triggering-rules: &api_pipelines_schedules_tags_triggers_web_triggering_rules
+.api-schedules-tags-triggers-web-triggering-rules: &api_schedules_tags_triggers_web_triggering_rules
   only:
     - api
-    - pipelines
     - schedules
     - tags
     - triggers
     - web
 
-.api-pipelines-schedules-triggers-web-triggering-rules: &api_pipelines_schedules_triggers_web_triggering_rules
+.api-schedules-triggers-web-triggering-rules: &api_schedules_triggers_web_triggering_rules
   only:
     - api
-    - pipelines
     - schedules
     - triggers
     - web
@@ -240,7 +240,6 @@ stages:
   only:
     - api
     - merge_requests
-    - pipelines
     - schedules
     - tags
     - triggers
@@ -303,8 +302,8 @@ stages:
 
 # Unpack release tarball and continue work in the extracted directory.
 .unpack_release_tarball: &unpack_release_tarball
-  - tar --extract --file bind-*.tar.xz
-  - rm -f bind-*.tar.xz
+  - tar --extract --file bind-*.tar.${TARBALL_EXTENSION}
+  - rm -f bind-*.tar.${TARBALL_EXTENSION}
   - cd bind-*
 
 .build: &build_job
@@ -341,30 +340,55 @@ stages:
         sudo sh -x bin/tests/system/ifconfig.sh up;
       fi
 
+cross-version-config-tests:
+  stage: system
+  <<: *base_image
+  <<: *default_triggering_rules
+  variables:
+    CC: gcc
+    CFLAGS: "${CFLAGS_COMMON}"
+    # Disable option checking to prevent problems with new default options in
+    # the &configure anchor.
+    EXTRA_CONFIGURE: "--disable-option-checking"
+  script:
+    - *configure
+    - *setup_interfaces
+    - make -j${BUILD_PARALLEL_JOBS:-1}
+    - export BIND_BRANCH="$(sed -n -E "s|^m4_define\(\[bind_VERSION_MINOR\], ([0-9]+)\)dnl$|\1|p" configure.ac)"
+    # When testing a .0 release, compare it against the previous development
+    # release (e.g., 9.19.0 and 9.18.0 should both be compared against 9.17.22).
+    - if [ "$(sed -n -E "s|^m4_define\(\[bind_VERSION_PATCH\], ([0-9]+)\)dnl$|\1|p" configure.ac)" = "0" ]; then export BIND_BRANCH=$((BIND_BRANCH - 1 - (BIND_BRANCH % 2))); fi
+    - BASELINE="$(curl -s "https://gitlab.isc.org/api/v4/projects/1/repository/tags?search=^v9.${BIND_BRANCH}&order_by=version" | jq -r ".[0].name")"
+    - git clone --branch "${BASELINE}" --depth 1 https://gitlab.isc.org/isc-projects/bind9.git "bind-${BASELINE}"
+    - cd "bind-${BASELINE}"
+    - autoreconf -fi
+    - *configure
+    - make -j${BUILD_PARALLEL_JOBS:-1}
+    - *find_pytest
+    - cd bin/tests/system
+    # Run the setup phase of all system tests in the most recently tagged BIND 9
+    # release using the binaries built for the current BIND 9 version.  This
+    # intends to detect obvious backward compatibility issues with the latter.
+    - sed -i -E "s|(export TOP_BUILDDIR)=.*|\1=${CI_PROJECT_DIR}|" conf.sh
+    - >
+      "$PYTEST" --setup-only --junit-xml="$CI_PROJECT_DIR"/junit.xml -n "${TEST_PARALLEL_JOBS:-1}"
+  needs:
+    - job: autoreconf
+      artifacts: true
+  artifacts:
+    reports:
+      junit: junit.xml
+    paths:
+      - bind-*
+      - junit.xml
+    untracked: true
+    expire_in: "1 day"
+    when: always
+
 .display_pytest_failures: &display_pytest_failures
     - awk '/^=+ FAILURES =+/{flag=1;next}/^=+.*=+$/{flag=0}flag' bin/tests/system/pytest.out.txt || true
     - awk '/^=+ ERRORS =+/{flag=1;next}/^=+.*=+$/{flag=0}flag' bin/tests/system/pytest.out.txt || true
 
-.shotgun: &shotgun_job
-  <<: *base_image
-  <<: *api_pipelines_schedules_tags_triggers_web_triggering_rules
-  stage: performance
-  script:
-    - if [ -z "$CI_COMMIT_TAG" ]; then export SHOTGUN_ROUNDS=1; else export SHOTGUN_ROUNDS=3; fi
-    - PIPELINE_ID=$(curl -s -X POST --fail
-        -F "token=$CI_JOB_TOKEN"
-        -F ref=main
-        -F "variables[SHOTGUN_TEST_VERSION]=['$CI_COMMIT_REF_NAME', '$BIND_BASELINE_VERSION']"
-        -F "variables[SHOTGUN_DURATION]=300"
-        -F "variables[SHOTGUN_ROUNDS]=$SHOTGUN_ROUNDS"
-        -F "variables[SHOTGUN_TRAFFIC_MULTIPLIER]=$SHOTGUN_TRAFFIC_MULTIPLIER"
-        -F "variables[SHOTGUN_SCENARIO]=$SHOTGUN_SCENARIO"
-        https://gitlab.isc.org/api/v4/projects/188/trigger/pipeline | jq .id)
-    - util/ci-wait-shotgun.py $PIPELINE_ID
-  needs:
-    - job: ci-variables
-      artifacts: true
-
 .system_test_common: &system_test_common
   <<: *default_triggering_rules
   stage: system
@@ -504,6 +528,15 @@ misc:
   <<: *precheck_job
   script:
     - sh util/checklibs.sh > checklibs.out
+    - sh util/tabify-changes < CHANGES > CHANGES.tmp
+    - diff -urNap CHANGES CHANGES.tmp
+    - perl util/check-changes CHANGES
+    - sh util/check-line-length.sh CHANGES
+    - test ! -f CHANGES.SE || sh util/tabify-changes < CHANGES.SE > CHANGES.tmp
+    - test ! -f CHANGES.SE || diff -urNap CHANGES.SE CHANGES.tmp
+    - test ! -f CHANGES.SE || perl util/check-changes master=0 CHANGES.SE
+    - test ! -f CHANGES.SE || sh util/check-line-length.sh CHANGES.SE
+    - rm CHANGES.tmp
     - sh util/check-categories.sh
     - sh util/check-gitignore.sh
     - sh util/check-trailing-whitespace.sh
@@ -516,18 +549,6 @@ misc:
       - checklibs.out
     when: on_failure
 
-changes:
-  <<: *precheck_job
-  except:
-    - pipelines
-  script:
-    - sh util/tabify-changes < CHANGES > CHANGES.tmp
-    - diff -urNap CHANGES CHANGES.tmp
-    - perl util/check-changes CHANGES
-    - sh util/check-line-length.sh CHANGES
-    - rm CHANGES.tmp
-  needs: []
-
 black:
   <<: *precheck_job
   needs: []
@@ -541,23 +562,6 @@ black:
     expire_in: "1 week"
     when: on_failure
 
-ci-variables:
-  stage: precheck
-  <<: *precheck_job
-  script:
-    - export BIND_BASELINE_BRANCH="$(sed -n -E "s|^m4_define\(\[bind_VERSION_MINOR\], ([0-9]+)\)dnl$|\1|p" configure.ac)"
-    # When testing a .0 release, compare it against the previous development
-    # release (e.g., 9.19.0 and 9.18.0 should both be compared against 9.17.22).
-    - if [ "$(sed -n -E "s|^m4_define\(\[bind_VERSION_PATCH\], ([0-9]+)\)dnl$|\1|p" configure.ac)" = "0" ]; then export BIND_BASELINE_BRANCH=$((BIND_BASELINE_BRANCH - 1 - (BIND_BASELINE_BRANCH % 2))); fi
-    - BIND_BASELINE_VERSION="$(curl -s "https://gitlab.isc.org/api/v4/projects/1/repository/tags?search=^v9.${BIND_BASELINE_BRANCH}&order_by=version" | jq -r ".[0].name")"
-    - echo "BIND_BASELINE_VERSION=$BIND_BASELINE_VERSION" >> ci_vars.env
-  needs:
-    - job: autoreconf
-      artifacts: true
-  artifacts:
-    reports:
-      dotenv: ci_vars.env
-
 clang-format:
   <<: *precheck_job
   needs: []
@@ -581,8 +585,6 @@ coccinelle:
 pylint:
   <<: *precheck_job
   needs: []
-  variables:
-    PYTHONPATH: "${CI_PROJECT_DIR}/bin/tests/system"
   script:
     - pylint --rcfile $CI_PROJECT_DIR/.pylintrc $(git ls-files '*.py' | grep -vE '(ans\.py|dangerfile\.py|^bin/tests/system/)')
       # Ignore Pylint wrong-import-position error in system test to enable use of pytest.importorskip
@@ -612,15 +614,9 @@ shfmt:
 
 danger:
   <<: *precheck_job
-  # Keep the GIT_DEPTH environment variable set to a "high number" before
-  # https://github.com/libgit2/libgit2/pull/6662 is addressed and integrated
-  # into pygit2.
-  variables:
-    GIT_DEPTH: 1000
   needs: []
   script:
-    - pip install git+https://gitlab.isc.org/isc-projects/hazard.git
-    - hazard
+    - danger-python ci -f
   only:
     refs:
       - merge_requests
@@ -633,11 +629,6 @@ checkbashisms:
   script:
     - checkbashisms $(find . -path './.git' -prune -o -type f -exec sh -c 'head -n 1 "{}" | grep -qsF "#!/bin/sh"' \; -print)
 
-mypy:
-  <<: *precheck_job
-  script:
-    - mypy "bin/tests/system/isctest/"
-
 tarball-create:
   stage: precheck
   <<: *base_image
@@ -653,7 +644,7 @@ tarball-create:
   artifacts:
     paths:
       - diff.patch
-      - bind-*.tar.xz
+      - bind-*.tar.${TARBALL_EXTENSION}
     when: always
   needs:
     - job: autoreconf
@@ -681,72 +672,28 @@ docs:tarball:
     - job: tarball-create
       artifacts: true
 
-# Job detecting named.conf breakage introduced since the previous point release
+# Jobs for regular GCC builds on Alpine Linux 3.18 (amd64)
 
-cross-version-config-tests:
-  stage: system
-  <<: *base_image
-  <<: *default_triggering_rules
-  variables:
-    CC: gcc
-    CFLAGS: "${CFLAGS_COMMON}"
-    # Disable option checking to prevent problems with new default options in
-    # the &configure anchor.
-    EXTRA_CONFIGURE: "--disable-option-checking"
-  script:
-    - *configure
-    - *setup_interfaces
-    - make -j${BUILD_PARALLEL_JOBS:-1}
-    - git clone --branch "${BIND_BASELINE_VERSION}" --depth 1 https://gitlab.isc.org/isc-projects/bind9.git "bind-${BIND_BASELINE_VERSION}"
-    - cd "bind-${BIND_BASELINE_VERSION}"
-    - autoreconf -fi
-    - *configure
-    - make -j${BUILD_PARALLEL_JOBS:-1}
-    - *find_pytest
-    - cd bin/tests/system
-    # Run the setup phase of all system tests in the most recently tagged BIND 9
-    # release using the binaries built for the current BIND 9 version.  This
-    # intends to detect obvious backward compatibility issues with the latter.
-    - sed -i -E "s|(export TOP_BUILDDIR)=.*|\1=${CI_PROJECT_DIR}|" conf.sh
-    - >
-      "$PYTEST" --setup-only --junit-xml="$CI_PROJECT_DIR"/junit.xml -n "${TEST_PARALLEL_JOBS:-1}"
-  needs:
-    - job: autoreconf
-      artifacts: true
-    - job: ci-variables
-      artifacts: true
-  artifacts:
-    reports:
-      junit: junit.xml
-    paths:
-      - bind-*
-      - junit.xml
-    untracked: true
-    expire_in: "1 day"
-    when: always
-
-# Jobs for regular GCC builds on Alpine Linux 3.19 (amd64)
-
-gcc:alpine3.19:amd64:
+gcc:alpine3.18:amd64:
   variables:
     CC: gcc
     CFLAGS: "${CFLAGS_COMMON}"
     EXTRA_CONFIGURE: "${WITHOUT_READLINE}"
-  <<: *alpine_3_19_amd64_image
+  <<: *alpine_3_18_amd64_image
   <<: *build_job
 
-system:gcc:alpine3.19:amd64:
-  <<: *alpine_3_19_amd64_image
+system:gcc:alpine3.18:amd64:
+  <<: *alpine_3_18_amd64_image
   <<: *system_test_job
   needs:
-    - job: gcc:alpine3.19:amd64
+    - job: gcc:alpine3.18:amd64
       artifacts: true
 
-unit:gcc:alpine3.19:amd64:
-  <<: *alpine_3_19_amd64_image
+unit:gcc:alpine3.18:amd64:
+  <<: *alpine_3_18_amd64_image
   <<: *unit_test_job
   needs:
-    - job: gcc:alpine3.19:amd64
+    - job: gcc:alpine3.18:amd64
       artifacts: true
 
 # Jobs for regular GCC builds on Oracle Linux 8 (amd64)
@@ -806,12 +753,12 @@ gcc:8fips:amd64:
     EXTRA_CONFIGURE: "--with-libidn2 --enable-fips-mode --disable-tracing"
   <<: *oraclelinux_8fips_amd64_image
   <<: *build_job
-  <<: *api_pipelines_schedules_tags_triggers_web_triggering_rules
+  <<: *api_schedules_tags_triggers_web_triggering_rules
 
 system:gcc:8fips:amd64:
   <<: *oraclelinux_8fips_amd64_image
   <<: *system_test_job
-  <<: *api_pipelines_schedules_tags_triggers_web_triggering_rules
+  <<: *api_schedules_tags_triggers_web_triggering_rules
   needs:
     - job: gcc:8fips:amd64
       artifacts: true
@@ -819,7 +766,7 @@ system:gcc:8fips:amd64:
 unit:gcc:8fips:amd64:
   <<: *oraclelinux_8fips_amd64_image
   <<: *unit_test_job
-  <<: *api_pipelines_schedules_tags_triggers_web_triggering_rules
+  <<: *api_schedules_tags_triggers_web_triggering_rules
   needs:
     - job: gcc:8fips:amd64
       artifacts: true
@@ -831,12 +778,12 @@ gcc:9fips:amd64:
     EXTRA_CONFIGURE: "--with-libidn2 --enable-fips-mode --disable-leak-detection --disable-tracing"
   <<: *oraclelinux_9fips_amd64_image
   <<: *build_job
-  <<: *api_pipelines_schedules_tags_triggers_web_triggering_rules
+  <<: *api_schedules_tags_triggers_web_triggering_rules
 
 system:gcc:9fips:amd64:
   <<: *oraclelinux_9fips_amd64_image
   <<: *system_test_job
-  <<: *api_pipelines_schedules_tags_triggers_web_triggering_rules
+  <<: *api_schedules_tags_triggers_web_triggering_rules
   needs:
     - job: gcc:9fips:amd64
       artifacts: true
@@ -844,7 +791,7 @@ system:gcc:9fips:amd64:
 unit:gcc:9fips:amd64:
   <<: *oraclelinux_9fips_amd64_image
   <<: *unit_test_job
-  <<: *api_pipelines_schedules_tags_triggers_web_triggering_rules
+  <<: *api_schedules_tags_triggers_web_triggering_rules
   needs:
     - job: gcc:9fips:amd64
       artifacts: true
@@ -948,7 +895,7 @@ gcc:ossl3:sid:amd64:
   <<: *build_job
 
 system:gcc:ossl3:sid:amd64:
-  # Set up environment variables to run pkcs11-provider based system tests
+  # Set up environment variables to run pkcs11-provider system tests
   variables:
     OPENSSL_CONF: "/var/tmp/etc/openssl-provider.cnf"
     SOFTHSM2_CONF: "/var/tmp/softhsm2/softhsm2.conf"
@@ -980,7 +927,6 @@ gcc:sid:amd64:
 system:gcc:sid:amd64:
   <<: *debian_sid_amd64_image
   <<: *system_test_job
-  <<: *system_test_make_check_job
   needs:
     - job: gcc:sid:amd64
       artifacts: true
@@ -1014,7 +960,7 @@ system:gcc:out-of-tree:
       artifacts: true
   <<: *base_image
   <<: *system_test_job
-  <<: *api_pipelines_schedules_tags_triggers_web_triggering_rules
+  <<: *api_schedules_tags_triggers_web_triggering_rules
 
 unit:gcc:out-of-tree:
   variables:
@@ -1024,7 +970,7 @@ unit:gcc:out-of-tree:
       artifacts: true
   <<: *base_image
   <<: *unit_test_job
-  <<: *api_pipelines_schedules_tags_triggers_web_triggering_rules
+  <<: *api_schedules_tags_triggers_web_triggering_rules
 
 # Jobs for tarball GCC builds on Debian 12 "bookworm" (amd64)
 
@@ -1044,7 +990,7 @@ gcc:tarball:
 system:gcc:tarball:
   <<: *base_image
   <<: *system_test_job
-  <<: *api_pipelines_schedules_tags_triggers_web_triggering_rules
+  <<: *api_schedules_tags_triggers_web_triggering_rules
   before_script:
     - cd bind-*
     - *setup_interfaces
@@ -1058,7 +1004,7 @@ system:gcc:tarball:
 unit:gcc:tarball:
   <<: *base_image
   <<: *unit_test_job
-  <<: *api_pipelines_schedules_tags_triggers_web_triggering_rules
+  <<: *api_schedules_tags_triggers_web_triggering_rules
   before_script:
     - cd bind-*
   needs:
@@ -1145,7 +1091,7 @@ unit:gcc:jammy:amd64:
     - job: gcc:jammy:amd64
       artifacts: true
 
-# Jobs for ASAN builds on Fedora 39 (amd64)
+# Jobs for ASAN builds on Fedora 38 (amd64)
 
 gcc:asan:
   variables:
@@ -1153,20 +1099,20 @@ gcc:asan:
     CFLAGS: "${CFLAGS_COMMON} -fsanitize=address,undefined"
     LDFLAGS: "-fsanitize=address,undefined"
     EXTRA_CONFIGURE: "--with-libidn2 --without-jemalloc"
-  <<: *fedora_39_amd64_image
+  <<: *fedora_38_amd64_image
   <<: *build_job
 
 system:gcc:asan:
   variables:
     LSAN_OPTIONS: "suppressions=$CI_PROJECT_DIR/suppr-lsan.txt"
-  <<: *fedora_39_amd64_image
+  <<: *fedora_38_amd64_image
   <<: *system_test_job
   needs:
     - job: gcc:asan
       artifacts: true
 
 unit:gcc:asan:
-  <<: *fedora_39_amd64_image
+  <<: *fedora_38_amd64_image
   <<: *unit_test_job
   needs:
     - job: gcc:asan
@@ -1195,7 +1141,7 @@ unit:clang:asan:
     - job: clang:asan
       artifacts: true
 
-# Jobs for TSAN builds on Fedora 39 (amd64)
+# Jobs for TSAN builds on Fedora 38 (amd64)
 
 gcc:tsan:
   variables:
@@ -1203,13 +1149,13 @@ gcc:tsan:
     CFLAGS: "${CFLAGS_COMMON} -fsanitize=thread"
     LDFLAGS: "-fsanitize=thread"
     EXTRA_CONFIGURE: "--with-libidn2 --enable-pthread-rwlock --without-jemalloc"
-  <<: *tsan_fedora_39_amd64_image
+  <<: *tsan_fedora_38_amd64_image
   <<: *build_job
 
 system:gcc:tsan:
   variables:
     TSAN_OPTIONS: "${TSAN_OPTIONS_FEDORA}"
-  <<: *tsan_fedora_39_amd64_image
+  <<: *tsan_fedora_38_amd64_image
   <<: *system_test_tsan_job
   needs:
     - job: gcc:tsan
@@ -1218,7 +1164,7 @@ system:gcc:tsan:
 unit:gcc:tsan:
   variables:
     TSAN_OPTIONS: "${TSAN_OPTIONS_FEDORA}"
-  <<: *tsan_fedora_39_amd64_image
+  <<: *tsan_fedora_38_amd64_image
   <<: *unit_test_tsan_job
   needs:
     - job: gcc:tsan
@@ -1332,14 +1278,38 @@ unit:clang:bookworm:amd64:
     - job: clang:bookworm:amd64
       artifacts: true
 
+# Jobs for Clang builds on FreeBSD 12 (amd64)
+
+clang:freebsd12:amd64:
+  variables:
+    CFLAGS: "${CFLAGS_COMMON}"
+    EXTRA_CONFIGURE: "${WITH_READLINE_EDITLINE}"
+    USER: gitlab-runner
+  <<: *freebsd_12_amd64_image
+  <<: *build_job
+
+system:clang:freebsd12:amd64:
+  <<: *freebsd_12_amd64_image
+  <<: *system_test_job
+  variables:
+    USER: gitlab-runner
+  needs:
+    - job: clang:freebsd12:amd64
+      artifacts: true
+
+unit:clang:freebsd12:amd64:
+  <<: *freebsd_12_amd64_image
+  <<: *unit_test_job
+  needs:
+    - job: clang:freebsd12:amd64
+      artifacts: true
+
 # Jobs for Clang builds on FreeBSD 13 (amd64)
 
 clang:freebsd13:amd64:
   variables:
     CFLAGS: "${CFLAGS_COMMON}"
-    # Use MIT Kerberos5 for BIND 9 GSS-API support because of FreeBSD Heimdal
-    # incompatibility; see https://bugs.freebsd.org/275241.
-    EXTRA_CONFIGURE: "${WITH_READLINE_LIBEDIT} --with-gssapi=/usr/local/bin/krb5-config"
+    EXTRA_CONFIGURE: "${WITH_READLINE_LIBEDIT}"
     USER: gitlab-runner
   <<: *freebsd_13_amd64_image
   <<: *build_job
@@ -1360,34 +1330,6 @@ unit:clang:freebsd13:amd64:
     - job: clang:freebsd13:amd64
       artifacts: true
 
-# Jobs for Clang builds on FreeBSD 14 (amd64)
-
-clang:freebsd14:amd64:
-  variables:
-    CFLAGS: "${CFLAGS_COMMON}"
-    # Use MIT Kerberos5 for BIND 9 GSS-API support because of FreeBSD Heimdal
-    # incompatibility; see https://bugs.freebsd.org/275241.
-    EXTRA_CONFIGURE: "${WITH_READLINE_EDITLINE} --with-gssapi=/usr/local/bin/krb5-config"
-    USER: gitlab-runner
-  <<: *freebsd_14_amd64_image
-  <<: *build_job
-
-system:clang:freebsd14:amd64:
-  <<: *freebsd_14_amd64_image
-  <<: *system_test_job
-  variables:
-    USER: gitlab-runner
-  needs:
-    - job: clang:freebsd14:amd64
-      artifacts: true
-
-unit:clang:freebsd14:amd64:
-  <<: *freebsd_14_amd64_image
-  <<: *unit_test_job
-  needs:
-    - job: clang:freebsd14:amd64
-      artifacts: true
-
 # Jobs for Clang builds on OpenBSD (amd64)
 
 clang:openbsd:amd64:
@@ -1398,6 +1340,18 @@ clang:openbsd:amd64:
   <<: *openbsd_amd64_image
   <<: *build_job
 
+system:clang:openbsd:amd64:
+  <<: *openbsd_amd64_image
+  <<: *system_test_job
+  <<: *system_test_make_check_job
+  <<: *api_schedules_triggers_web_triggering_rules
+  variables:
+    USER: gitlab-runner
+  needs:
+    - job: clang:openbsd:amd64
+      artifacts: true
+  allow_failure: true
+
 unit:clang:openbsd:amd64:
   <<: *openbsd_amd64_image
   <<: *unit_test_job
@@ -1407,24 +1361,26 @@ unit:clang:openbsd:amd64:
     - job: clang:openbsd:amd64
       artifacts: true
 
-# Job producing a release directory
+# Job producing a release tarball
 
 release:
   <<: *base_image
   stage: release
   script:
-    - export BIND_DIRECTORY="$(basename bind-*.tar.xz ".tar.xz")"
+    - export BIND_DIRECTORY="$(basename "$(find . -name "bind-*.tar.*" -printf "%f")" ".tar.${TARBALL_EXTENSION}")"
     # Prepare release tarball contents (tarballs + documentation)
-    - mkdir -p "${BIND_DIRECTORY}-release/doc/arm"
-    - pushd "${BIND_DIRECTORY}-release"
-    - mv "../${BIND_DIRECTORY}.tar.xz" .
-    - tar --extract --file="${BIND_DIRECTORY}.tar.xz"
+    - mkdir -p release/doc/arm
+    - pushd release
+    - mv "../${BIND_DIRECTORY}.tar.${TARBALL_EXTENSION}" .
+    - tar --extract --file="${BIND_DIRECTORY}.tar.${TARBALL_EXTENSION}"
     - mv "${BIND_DIRECTORY}"/{CHANGES*,COPYRIGHT,LICENSE,README.md,srcid} .
     - rm -rf "${BIND_DIRECTORY}"
     - mv "../doc/arm/_build/html" doc/arm/
     - mv "../doc/arm/_build/epub/Bv9ARM.epub" doc/arm/
     - echo '<!DOCTYPE HTML><html lang="en"><meta http-equiv="refresh" content="0; url=doc/arm/html/notes.html"><title>Redirect</title></html>' > "RELEASE-NOTES-${BIND_DIRECTORY}.html"
     - popd
+    # Create release tarball
+    - tar --create --file="${CI_COMMIT_TAG}.tar.gz" --gzip release/
   needs:
     - job: tarball-create
       artifacts: true
@@ -1432,52 +1388,10 @@ release:
       artifacts: true
   only:
     - tags
-  artifacts:
-    paths:
-      - "*-release"
-    expire_in: "1 month"
-
-# Job signing the source tarballs in the release directory
-
-sign:
-  stage: release
-  tags:
-    - signer
-  script:
-    - export RELEASE_DIRECTORY="$(echo *-release)"
-    - pushd "${RELEASE_DIRECTORY}"
-    - |
-      echo
-      cat > /tmp/sign-bind9.sh <<EOF
-      #!/bin/sh
-      {
-          for FILE in \$(find "${PWD}" -name "*.tar.xz" | sort); do
-              echo ">>> Signing \${FILE}..."
-              gpg2 --local-user "\${SIGNING_KEY_FINGERPRINT}" --armor --digest-algo SHA512 --detach-sign --output "\${FILE}.asc" "\${FILE}"
-          done
-      } 2>&1 | tee "${CI_PROJECT_DIR}/signing.log"
-      EOF
-      chmod +x /tmp/sign-bind9.sh
-      echo -e "\e[31m*** Please sign the releases by following the instructions at:\e[0m"
-      echo -e "\e[31m*** \e[0m"
-      echo -e "\e[31m*** ${SIGNING_HELP_URL}\e[0m"
-      echo -e "\e[31m*** \e[0m"
-      echo -e "\e[31m*** Sleeping until files in ${PWD} are signed... ⌛\e[0m"
-      while [ "$(find . -name "*.asc" -size +0 | sed "s|\.asc$||" | sort)" != "$(find . -name "*.tar.xz" | sort)" ]; do sleep 10; done
-    - popd
-    - tar --create --file="${RELEASE_DIRECTORY}.tar.gz" --gzip "${RELEASE_DIRECTORY}"
   artifacts:
     paths:
       - "*.tar.gz"
-      - signing.log
     expire_in: never
-  needs:
-    - job: release
-      artifacts: true
-  only:
-    - tags
-  when: manual
-  allow_failure: false
 
 # Coverity Scan analysis upload
 
@@ -1577,7 +1491,7 @@ respdiff-short:tsan:
 
 respdiff-long:
   <<: *respdiff_job
-  <<: *api_pipelines_schedules_tags_triggers_web_triggering_rules
+  <<: *api_schedules_tags_triggers_web_triggering_rules
   <<: *respdiff_debian_bookworm_amd64_image
   variables:
     CC: gcc
@@ -1588,7 +1502,7 @@ respdiff-long:
 
 respdiff-long:asan:
   <<: *respdiff_job
-  <<: *api_pipelines_schedules_tags_triggers_web_triggering_rules
+  <<: *api_schedules_tags_triggers_web_triggering_rules
   <<: *debian_bookworm_amd64_image
   variables:
     CC: gcc
@@ -1601,7 +1515,7 @@ respdiff-long:asan:
 
 respdiff-long:tsan:
   <<: *respdiff_job
-  <<: *api_pipelines_schedules_tags_triggers_web_triggering_rules
+  <<: *api_schedules_tags_triggers_web_triggering_rules
   <<: *tsan_debian_bookworm_amd64_image
   variables:
     CC: gcc
@@ -1615,11 +1529,10 @@ respdiff-long:tsan:
   after_script:
     - *find_python
     - *parse_tsan
-  allow_failure: true  # affected by GL #4475
 
 respdiff-long-third-party:
   <<: *respdiff_job
-  <<: *api_pipelines_schedules_tags_triggers_web_triggering_rules
+  <<: *api_schedules_tags_triggers_web_triggering_rules
   <<: *debian_bookworm_amd64_image
   variables:
     CC: gcc
@@ -1628,32 +1541,7 @@ respdiff-long-third-party:
   script:
     - bash respdiff.sh -s third_party -q "${PWD}/100k_mixed.txt" -c 1 -w "${PWD}/rspworkdir" "${CI_PROJECT_DIR}"
 
-# Performance tests
-
-# Run shotgun:udp right away, but delay other shotgun jobs sligthly in order to
-# allow re-use of the built container image. Otherwise, the jobs would do the
-# same builds in parallel rather than re-use the already built image.
-shotgun:udp:
-  <<: *shotgun_job
-  variables:
-    SHOTGUN_SCENARIO: udp
-    SHOTGUN_TRAFFIC_MULTIPLIER: 15
-
-shotgun:tcp:
-  <<: *shotgun_job
-  variables:
-    SHOTGUN_SCENARIO: tcp
-    SHOTGUN_TRAFFIC_MULTIPLIER: 6
-  when: delayed
-  start_in: 5 minutes
-
-shotgun:dot:
-  <<: *shotgun_job
-  variables:
-    SHOTGUN_SCENARIO: dot
-    SHOTGUN_TRAFFIC_MULTIPLIER: 3
-  when: delayed
-  start_in: 5 minutes
+# "Stress" tests
 
 # Parallel build in the "make" step is avoided since multiple jobs can be
 # executed concurrently on the same runner. This may present problems when one
@@ -1678,8 +1566,8 @@ shotgun:dot:
     when: always
   timeout: 2h
 
-stress:authoritative:fedora:39:amd64:
-  <<: *fedora_39_amd64_image
+stress:authoritative:fedora:38:amd64:
+  <<: *fedora_38_amd64_image
   <<: *linux_amd64
   <<: *stress_job
   variables:
@@ -1693,8 +1581,8 @@ stress:authoritative:fedora:39:amd64:
     variables:
       - $CI_COMMIT_TAG || ($BIND_STRESS_TEST_OS =~ /linux/i && $BIND_STRESS_TEST_MODE =~ /authoritative/i && $BIND_STRESS_TEST_ARCH =~ /amd64/i)
 
-stress:recursive:fedora:39:amd64:
-  <<: *fedora_39_amd64_image
+stress:recursive:fedora:38:amd64:
+  <<: *fedora_38_amd64_image
   <<: *linux_amd64
   <<: *stress_job
   variables:
@@ -1708,8 +1596,8 @@ stress:recursive:fedora:39:amd64:
     variables:
       - $CI_COMMIT_TAG || ($BIND_STRESS_TEST_OS =~ /linux/i && $BIND_STRESS_TEST_MODE =~ /recursive/i && $BIND_STRESS_TEST_ARCH =~ /amd64/i)
 
-stress:rpz:fedora:39:amd64:
-  <<: *fedora_39_amd64_image
+stress:rpz:fedora:38:amd64:
+  <<: *fedora_38_amd64_image
   <<: *linux_amd64
   <<: *stress_job
   variables:
@@ -1723,8 +1611,8 @@ stress:rpz:fedora:39:amd64:
     variables:
       - $CI_COMMIT_TAG || ($BIND_STRESS_TEST_OS =~ /linux/i && $BIND_STRESS_TEST_MODE =~ /rpz/i && $BIND_STRESS_TEST_ARCH =~ /amd64/i)
 
-stress:authoritative:fedora:39:arm64:
-  <<: *fedora_39_arm64_image
+stress:authoritative:fedora:38:arm64:
+  <<: *fedora_38_arm64_image
   <<: *linux_arm64
   <<: *stress_job
   variables:
@@ -1738,8 +1626,8 @@ stress:authoritative:fedora:39:arm64:
     variables:
       - $CI_COMMIT_TAG || ($BIND_STRESS_TEST_OS =~ /linux/i && $BIND_STRESS_TEST_MODE =~ /authoritative/i && $BIND_STRESS_TEST_ARCH =~ /arm64/i)
 
-stress:recursive:fedora:39:arm64:
-  <<: *fedora_39_arm64_image
+stress:recursive:fedora:38:arm64:
+  <<: *fedora_38_arm64_image
   <<: *linux_arm64
   <<: *stress_job
   variables:
@@ -1753,8 +1641,8 @@ stress:recursive:fedora:39:arm64:
     variables:
       - $CI_COMMIT_TAG || ($BIND_STRESS_TEST_OS =~ /linux/i && $BIND_STRESS_TEST_MODE =~ /recursive/i && $BIND_STRESS_TEST_ARCH =~ /arm64/i)
 
-stress:rpz:fedora:39:arm64:
-  <<: *fedora_39_arm64_image
+stress:rpz:fedora:38:arm64:
+  <<: *fedora_38_arm64_image
   <<: *linux_arm64
   <<: *stress_job
   variables:
@@ -1768,7 +1656,8 @@ stress:rpz:fedora:39:arm64:
     variables:
       - $CI_COMMIT_TAG || ($BIND_STRESS_TEST_OS =~ /linux/i && $BIND_STRESS_TEST_MODE =~ /rpz/i && $BIND_STRESS_TEST_ARCH =~ /arm64/i)
 
-stress:authoritative:freebsd13:amd64:
+stress:authoritative:freebsd12:amd64:
+  <<: *freebsd_12_amd64_image
   <<: *freebsd_stress_amd64
   <<: *stress_job
   variables:
@@ -1782,7 +1671,8 @@ stress:authoritative:freebsd13:amd64:
     variables:
       - $CI_COMMIT_TAG || ($BIND_STRESS_TEST_OS =~ /freebsd/i && $BIND_STRESS_TEST_MODE =~ /authoritative/i && $BIND_STRESS_TEST_ARCH =~ /amd64/i)
 
-stress:recursive:freebsd13:amd64:
+stress:recursive:freebsd12:amd64:
+  <<: *freebsd_12_amd64_image
   <<: *freebsd_stress_amd64
   <<: *stress_job
   variables:
@@ -1796,7 +1686,8 @@ stress:recursive:freebsd13:amd64:
     variables:
       - $CI_COMMIT_TAG || ($BIND_STRESS_TEST_OS =~ /freebsd/i && $BIND_STRESS_TEST_MODE =~ /recursive/i && $BIND_STRESS_TEST_ARCH =~ /amd64/i)
 
-stress:rpz:freebsd13:amd64:
+stress:rpz:freebsd12:amd64:
+  <<: *freebsd_12_amd64_image
   <<: *freebsd_stress_amd64
   <<: *stress_job
   variables:

.gitlab/issue_templates/Bug.md

@@ -2,62 +2,45 @@
 If the bug you are reporting is potentially security-related - for example,
 if it involves an assertion failure or other crash in `named` that can be
 triggered repeatedly - then please make sure that you make the new issue
-confidential by clicking the checkbox at the bottom!
+confidential!
 -->
 
 ### Summary
 
-<!-- Concisely summarize the bug encountered. -->
+(Summarize the bug encountered concisely.)
 
-### BIND version affected
-<!--
-Make sure you are testing with the **latest** supported version of BIND
-for a given branch. Many bugs have been fixed over time!
+### BIND version used
 
-See https://kb.isc.org/docs/supported-platforms for the current list.
-The latest source is available from https://www.isc.org/download/#BIND
-
-Paste the output of `named -V` here.
--->
+(Paste the output of `named -V`.)
 
 ### Steps to reproduce
 
-<!--
-This is extremely important! Be precise and use itemized lists, please.
-
-Even if a default configuration is affected, please include the full configuration
-files _you were testing with_.
-
-Example:
-1. Use _attached_ configuration file
-2. Start BIND server with command: `named -g -c named.conf ...`
-3. Simulate legitimate clients using command `dnsperf -S1 -d legit-queries ...`
-4. Simulate attack traffic using command `dnsperf -S1 -d attack-queries ...`
--->
-
-1.
-2.
-3.
+(How one can reproduce the issue - this is very important.)
 
 ### What is the current *bug* behavior?
 
-<!-- What actually happens. -->
+(What actually happens.)
 
 ### What is the expected *correct* behavior?
 
-<!-- What you should see instead. -->
+(What you should see instead.)
 
 ### Relevant configuration files
 
-<!-- Paste any relevant configuration files here - please use code blocks (```)
+(Paste any relevant configuration files - please use code blocks (```)
 to format console output. If submitting the contents of your
-configuration file in a non-confidential issue, it is advisable to
-obscure key secrets; this can be done automatically by using
-`named-checkconf -px`. -->
+configuration file in a non-confidential Issue, it is advisable to
+obscure key secrets: this can be done automatically by using
+`named-checkconf -px`.)
 
-### Relevant logs
+### Relevant logs and/or screenshots
 
-<!-- Paste any relevant logs here - please use code blocks (```) to format console
-output, logs, and code, as it's very hard to read otherwise. -->
+(Paste any relevant logs - please use code blocks (```) to format console
+output, logs, and code, as it's very hard to read otherwise.)
 
-/label ~Bug
+### Possible fixes
+
+(If you can, link to the line of code that might be responsible for the
+problem.)
+
+/label ~bug

.gitlab/issue_templates/CVE.md

@@ -16,9 +16,11 @@ confidential!
 | Mattermost Channel:      | [CVE-YYYY-NNNN][mattermost_url]      |
 | Support Ticket:          | [URL]                                |
 | Release Checklist:       | #NNNN                                |
+| Post-mortem Etherpad:    | [postmortem-YYYY-MM][postmortem_url] |
 
 [cvss_score]: https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:X/AC:X/PR:X/UI:X/S:X/C:X/I:X/A:X&version=3.1
 [mattermost_url]:
+[postmortem_url]:
 
 :bulb: **Click [here][checklist_explanations] (internal resource) for general information about the security incident handling process.**
 
@@ -28,14 +30,14 @@ confidential!
 
   - [ ] [:link:][step_deputy]            **(IM)** Pick a Deputy Incident Manager
   - [ ] [:link:][step_respond]           **(IM)** Respond to the bug reporter
+  - [ ] [:link:][step_etherpad]          **(IM)** Create an Etherpad for post-mortem
   - [ ] [:link:][step_public_mrs]        **(SwEng)** Ensure there are no public merge requests which inadvertently disclose the issue
   - [ ] [:link:][step_assign_cve_id]     **(IM)** Assign a CVE identifier
   - [ ] [:link:][step_note_cve_info]     **(SwEng)** Update this issue with the assigned CVE identifier and the CVSS score
   - [ ] [:link:][step_versions_affected] **(SwEng)** Determine the range of product versions affected (including the Subscription Edition)
   - [ ] [:link:][step_workarounds]       **(SwEng)** Determine whether workarounds for the problem exist
   - [ ] [:link:][step_coordinate]        **(SwEng)** If necessary, coordinate with other parties
-  - [ ] [:link:][step_earliest_prepare]  **(Support)** Prepare "earliest" notification text and hand it off to Marketing
-  - [ ] [:link:][step_earliest_send]     **(Marketing)** Update "earliest" notification document in SF portal and send bulk email to earliest customers
+  - [ ] [:link:][step_earliest]          **(Support)** Prepare and send out "earliest" notifications
   - [ ] [:link:][step_advisory_mr]       **(Support)** Create a merge request for the Security Advisory and include all readily available information in it
   - [ ] [:link:][step_reproducer_mr]     **(SwEng)** Prepare a private merge request containing a system test reproducing the problem
   - [ ] [:link:][step_notify_support]    **(SwEng)** Notify Support when a reproducer is ready
@@ -53,42 +55,46 @@ confidential!
 
 ### At T-5
 
-  - [ ] [:link:][step_asn_documents]     **(Marketing)** Update the text on the T-5 (from the Printing Press project) and "earliest" ASN documents in the SF portal
-  - [ ] [:link:][step_asn_links]         **(Marketing)** (BIND 9 only) Update the BIND -S information document in SF with download links to the new versions
-  - [ ] [:link:][step_asn_send]          **(Marketing)** Bulk email eligible customers to check the SF portal
-  - [ ] [:link:][step_preannouncement]   **(Marketing)** (BIND 9 only) Send a pre-announcement email to the *bind-announce* mailing list to alert users that the upcoming release will include security fixes
+  - [ ] [:link:][step_send_asn]          **(Support)** Send ASN to eligible customers
+  - [ ] [:link:][step_preannouncement]   **(Support)** (BIND 9 only) Send a pre-announcement email to the *bind-announce* mailing list to alert users that the upcoming release will include security fixes
+
+### At T-4
+
+  - [ ] [:link:][step_verify_asn]        **(Support)** Verify that all ASN-eligible customers have received the notification email
 
 ### At T-1
 
+  - [ ] [:link:][step_check_customers]   **(Support)** Verify that any new or reinstated customers have received the notification email
   - [ ] [:link:][step_packager_emails]   **(First IM)** Send notifications to OS packagers
 
 ### On the Day of Public Disclosure
 
-  - [ ] [:link:][step_clearance]         **(IM)** Grant QA & Marketing clearance to proceed with public release
-  - [ ] [:link:][step_publish]           **(QA/Marketing)** Publish the releases (as outlined in the release checklist)
+  - [ ] [:link:][step_clearance]         **(IM)** Grant Support clearance to proceed with public release
+  - [ ] [:link:][step_publish]           **(Support)** Publish the releases (as outlined in the release checklist)
   - [ ] [:link:][step_matrix]            **(Support)** (BIND 9 only) Add the new CVEs to the vulnerability matrix in the Knowledge Base
   - [ ] [:link:][step_publish_advisory]  **(Support)** Bump Document Version for the Security Advisory and publish it in the Knowledge Base
   - [ ] [:link:][step_notifications]     **(First IM)** Send notification emails to third parties
   - [ ] [:link:][step_mitre]             **(First IM)** Advise MITRE about the disclosed CVEs
   - [ ] [:link:][step_merge_advisory]    **(First IM)** Merge the Security Advisory merge request
   - [ ] [:link:][step_embargo_end]       **(IM)** Inform original reporter (if external) that the security disclosure process is complete
-  - [ ] [:link:][step_asn_clear]         **(Marketing)** Update the SF portal to clear the ASN
-  - [ ] [:link:][step_customers]         **(Marketing)** Email ASN recipients that the embargo is lifted
+  - [ ] [:link:][step_customers]         **(Support)** Inform customers a fix has been released
 
 ### After Public Disclosure
 
+  - [ ] [:link:][step_postmortem]        **(First IM)** Organize post-mortem meeting and make sure it happens
+  - [ ] [:link:][step_tickets]           **(Support)** Close support tickets
   - [ ] [:link:][step_regression]        **(QA)** Merge a regression test reproducing the bug into all affected (and still maintained) branches
 
 [step_deputy]:            https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#pick-a-deputy-incident-manager
 [step_respond]:           https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#respond-to-the-bug-reporter
+[step_etherpad]:          https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#create-an-etherpad-for-post-mortem
 [step_public_mrs]:        https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#ensure-there-are-no-public-merge-requests-which-inadvertently-disclose-the-issue
 [step_assign_cve_id]:     https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#assign-a-cve-identifier
 [step_note_cve_info]:     https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#update-this-issue-with-the-assigned-cve-identifier-and-the-cvss-score
 [step_versions_affected]: https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#determine-the-range-of-product-versions-affected-including-the-subscription-edition
 [step_workarounds]:       https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#determine-whether-workarounds-for-the-problem-exist
 [step_coordinate]:        https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#if-necessary-coordinate-with-other-parties
-[step_earliest_prepare]:  https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#prepare-earliest-notification-text-and-hand-it-off-to-marketing
-[step_earliest_send]:     https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#update-earliest-notification-document-in-sf-portal-and-send-bulk-email-to-earliest-customers
+[step_earliest]:          https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#prepare-and-send-out-earliest-notifications
 [step_advisory_mr]:       https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#create-a-merge-request-for-the-security-advisory-and-include-all-readily-available-information-in-it
 [step_reproducer_mr]:     https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#prepare-a-private-merge-request-containing-a-system-test-reproducing-the-problem
 [step_notify_support]:    https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#notify-support-when-a-reproducer-is-ready
@@ -103,12 +109,12 @@ confidential!
 [step_merge_fixes]:       https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#merge-the-cve-fixes-in-cve-identifier-order
 [step_patches]:           https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#prepare-a-standalone-patch-for-the-last-stable-release-of-each-affected-and-still-maintained-product-branch
 [step_asn_releases]:      https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#prepare-asn-releases-as-outlined-in-the-release-checklist
-[step_asn_documents]:     https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#update-the-text-on-the-t-5-from-the-printing-press-project-and-earliest-asn-documents-in-the-sf-portal
-[step_asn_links]:         https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#bind-9-only-update-the-bind-s-information-document-in-sf-with-download-links-to-the-new-versions
-[step_asn_send]:          https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#bulk-email-eligible-customers-to-check-the-sf-portal
+[step_send_asn]:          https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#send-asn-to-eligible-customers
 [step_preannouncement]:   https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#bind-9-only-send-a-pre-announcement-email-to-the-bind-announce-mailing-list-to-alert-users-that-the-upcoming-release-will-include-security-fixes
+[step_verify_asn]:        https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#verify-that-all-asn-eligible-customers-have-received-the-notification-email
+[step_check_customers]:   https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#verify-that-any-new-or-reinstated-customers-have-received-the-notification-email
 [step_packager_emails]:   https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#send-notifications-to-os-packagers
-[step_clearance]:         https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#grant-qa-marketing-clearance-to-proceed-with-public-release
+[step_clearance]:         https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#grant-support-clearance-to-proceed-with-public-release
 [step_publish]:           https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#publish-the-releases-as-outlined-in-the-release-checklist
 [step_matrix]:            https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#bind-9-only-add-the-new-cves-to-the-vulnerability-matrix-in-the-knowledge-base
 [step_publish_advisory]:  https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#bump-document-version-for-the-security-advisory-and-publish-it-in-the-knowledge-base
@@ -116,8 +122,7 @@ confidential!
 [step_mitre]:             https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#advise-mitre-about-the-disclosed-cves
 [step_merge_advisory]:    https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#merge-the-security-advisory-merge-request
 [step_embargo_end]:       https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#inform-original-reporter-if-external-that-the-security-disclosure-process-is-complete
-[step_asn_clear]:         https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#update-the-sf-portal-to-clear-the-asn
-[step_customers]:         https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#email-asn-recipients-that-the-embargo-is-lifted
+[step_customers]:         https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#inform-customers-a-fix-has-been-released
+[step_postmortem]:        https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#organize-post-mortem-meeting-and-make-sure-it-happens
+[step_tickets]:           https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#close-support-tickets
 [step_regression]:        https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#merge-a-regression-test-reproducing-the-bug-into-all-affected-and-still-maintained-branches
-
-/confidential

.gitlab/issue_templates/Default.md

@@ -1,8 +0,0 @@
-Hi and thanks for filing an issue! It will be read with care by human beings.
-
-It would be a tremendous help if you could follow these steps first:
-- [ ] Search the existing issues in GitLab (both open and closed) to see if your report might be a duplicate. We have a large database here and many issues have already been fixed in the latest versions!
-- [ ] Make sure this is **not** a support question. If you have specific trouble configuring or debugging your setup, please use the bind-users mailing list: https://lists.isc.org/mailman/listinfo/bind-users
-- [ ] You have read and understood the "out in the open" support policy: https://blog.powerdns.com/2016/01/18/open-source-support-out-in-the-open/ . Even though it was written by the PowerDNS folks, we follow it as well!
-
-Before continuing, **please select the appropriate issue template in the drop-down menu above, under the heading _Description_**.

.gitlab/issue_templates/Feature_Request.md

@@ -8,4 +8,4 @@
 
 ### Links / references
 
-/label ~Feature
+/label ~"feature request"

.gitlab/issue_templates/Release.md

@@ -0,0 +1,100 @@
+## Release Schedule
+
+**Code Freeze:**
+
+**Tagging Deadline:**
+
+**Public Release:**
+
+## Documentation Review Links
+
+**Closed issues assigned to the milestone without a release note:**
+
+ - []()
+ - []()
+ - []()
+
+**Merge requests merged into the milestone without a release note:**
+
+ - []()
+ - []()
+ - []()
+
+**Merge requests merged into the milestone without a `CHANGES` entry:**
+
+ - []()
+ - []()
+ - []()
+
+## Release Checklist
+
+### Before the Code Freeze
+
+ - [ ] ***(QA)*** Rebase -S editions on top of current open-source versions: `git checkout bind-9.18-sub && git rebase origin/bind-9.18`
+ - [ ] ***(QA)*** [Inform](https://gitlab.isc.org/isc-private/bind-qa/-/blob/master/bind9/releng/inform_supp_marketing.py) Support and Marketing of impending release (and give estimated release dates).
+ - [ ] ***(QA)*** Ensure there are no permanent test failures on any platform. Check [public](https://gitlab.isc.org/isc-projects/bind9/-/pipelines?scope=all&source=schedule) and [private](https://gitlab.isc.org/isc-private/bind9/-/pipelines?scope=all&source=schedule) scheduled pipelines.
+ - [ ] ***(QA)*** Check [Perflab](https://perflab.isc.org/) to ensure there has been no unexplained drop in performance for the versions being released.
+ - [ ] ***(QA)*** Check whether all issues assigned to the release milestone are resolved[^1].
+ - [ ] ***(QA)*** Ensure that there are no outstanding [merge requests in the private repository](https://gitlab.isc.org/isc-private/bind9/-/merge_requests/)[^1] (Subscription Edition only).
+ - [ ] ***(QA)*** [Ensure](https://gitlab.isc.org/isc-private/bind-qa/-/blob/master/bind9/releng/check_backports.py) all merge requests marked for backporting have been indeed backported.
+ - [ ] ***(QA)*** [Announce](https://gitlab.isc.org/isc-private/bind-qa/-/blob/master/bind9/releng/inform_code_freeze.py) (on Mattermost) that the code freeze is in effect.
+
+### Before the Tagging Deadline
+
+ - [ ] ***(QA)*** Inspect the current output of the `cross-version-config-tests` job to verify that no unexpected backward-incompatible change was introduced in the current release cycle.
+ - [ ] ***(QA)*** Ensure release notes are correct, ask Support and Marketing to check them as well. [Example](https://gitlab.isc.org/isc-private/bind9/-/merge_requests/510)
+ - [ ] ***(QA)*** Add a release marker to `CHANGES`. Examples: [9.18](https://gitlab.isc.org/isc-projects/bind9/-/commit/f14d8ad78c0506fd4247187f2177f8eceeb6b3b9), [9.16](https://gitlab.isc.org/isc-projects/bind9/-/commit/1bcdf21874f99a00da389d723e0ad07dfd70f9f1)
+ - [ ] ***(QA)*** Add a release marker to `CHANGES.SE` (Subscription Edition only). [Example](https://gitlab.isc.org/isc-private/bind9/-/commit/0f03d5737bcbdaa1bf713c6db1887b14938c3421)
+ - [ ] ***(QA)*** Update BIND 9 version in `configure.ac` ([9.18+](https://gitlab.isc.org/isc-projects/bind9/-/commit/3c85ab7f4c35e6d8acef1393606002a0a8730100)) or `version` ([9.16](https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/7692/diffs?commit_id=1bcdf21874f99a00da389d723e0ad07dfd70f9f1)).
+ - [ ] ***(QA)*** Rebuild `configure` using Autoconf on `docs.isc.org` (9.16).
+ - [ ] ***(QA)*** Update GitLab settings for all maintained branches to disallow merging to them: [public](https://gitlab.isc.org/isc-projects/bind9/-/settings/repository), [private](https://gitlab.isc.org/isc-private/bind9/-/settings/repository)
+ - [ ] ***(QA)*** Tag the releases in the private repository (`git tag -s -m "BIND 9.x.y" v9.x.y`).
+
+### Before the ASN Deadline (for ASN Releases) or the Public Release Date (for Regular Releases)
+
+ - [ ] ***(QA)*** Check that the formatting is correct for the HTML version of release notes.
+ - [ ] ***(QA)*** Check that the formatting of the generated man pages is correct.
+ - [ ] ***(QA)*** Verify GitLab CI results [for the tags](https://gitlab.isc.org/isc-private/bind9/-/pipelines?scope=tags) created and sign off on the releases to be published.
+ - [ ] ***(QA)*** Update GitLab settings for all maintained branches to allow merging to them again: [public](https://gitlab.isc.org/isc-projects/bind9/-/settings/repository), [private](https://gitlab.isc.org/isc-private/bind9/-/settings/repository)
+ - [ ] ***(QA)*** Prepare (using [`version_bump.py`](https://gitlab.isc.org/isc-private/bind-qa/-/blob/master/bind9/releng/version_bump.py)) and merge MRs resetting the release notes and updating the version string for each maintained branch.
+ - [ ] ***(QA)*** Announce (on Mattermost) that the code freeze is over.
+ - [ ] ***(QA)*** Request signatures for the tarballs, providing their location and checksums. Ask [signers on Mattermost](https://mattermost.isc.org/isc/channels/bind-9-qa).
+ - [ ] ***(Signers)*** Ensure that the contents of tarballs and tags are identical.
+ - [ ] ***(Signers)*** Validate tarball checksums, sign tarballs, and upload signatures.
+ - [ ] ***(QA)*** Verify tarball signatures and check tarball checksums again: Run `publish_bind.sh` on repo.isc.org to pre-publish.
+ - [ ] ***(Support)*** Pre-publish ASN and/or Subscription Edition tarballs so that packages can be built.
+ - [ ] ***(QA)*** Build and test ASN and/or Subscription Edition packages (in [cloudsmith branch in private repo](https://gitlab.isc.org/isc-private/rpms/bind/-/tree/cloudsmith)). [Example](https://gitlab.isc.org/isc-private/rpms/bind/-/commit/e2512f4cfaf991827a635e374e7e93b27a5f38ba)
+ - [ ] ***(QA)*** Prepare the `patches/` subdirectory for each security release (if applicable).
+ - [ ] ***(QA)*** Notify Support that the releases have been prepared.
+ - [ ] ***(Support)*** Send out ASNs (if applicable).
+
+### On the Day of Public Release
+
+ - [ ] ***(Support)*** Wait for clearance from Security Officer to proceed with the public release (if applicable).
+ - [ ] ***(Support)*** Place tarballs in public location on FTP site.
+ - [ ] ***(Support)*** Publish links to downloads on ISC website. [Example](https://gitlab.isc.org/website/theme-staging-site/-/commit/1ac7b30b73cb03228df4cd5651fa4e774ac35625)
+ - [ ] ***(Support)*** Add the new releases to the [vulnerability matrix in the Knowledge Base](https://kb.isc.org/docs/aa-00913).
+ - [ ] ***(Support)*** Use the [Printing Press project](https://gitlab.isc.org/isc-private/printing-press/-/wikis/home#adding-new-documents) to prepare a release announcement email and send it to the *bind-announce* mailing list.
+ - [ ] ***(Support)*** Write email to *bind-users* (if a major release). [Example](https://lists.isc.org/pipermail/bind-users/2022-January/105624.html)
+ - [ ] ***(Support)*** Send eligible customers updated links to the Subscription Edition (update the -S edition delivery tickets, even if those links were provided earlier via an ASN ticket).
+ - [ ] ***(Support)*** Update tickets in case of waiting support customers.
+ - [ ] ***(QA)*** Build and test any outstanding private packages in [private repo](https://gitlab.isc.org/isc-private/rpms/bind/-/tree/cloudsmith). [Example](https://gitlab.isc.org/isc-private/rpms/bind/-/commit/2007d566db81dd9dfd79e571e2f600a3bc284da4)
+ - [ ] ***(QA)*** Build [public RPMs](https://gitlab.isc.org/isc-packages/rpms/bind). [Example commit](https://gitlab.isc.org/isc-packages/rpms/bind/-/commit/3b5e851ea7c4e3570371a4878b5461f02a44f8cc) which triggers [Copr builds](https://copr.fedorainfracloud.org/coprs/isc/) automatically
+ - [ ] ***(SwEng)*** Build Debian/Ubuntu packages.
+ - [ ] ***(SwEng)*** Update Docker files [here](https://gitlab.isc.org/isc-projects/bind9-docker/-/branches) and make sure push is synchronized to [GitHub](https://github.com/isc-projects/bind9-docker). [Docker Hub](https://hub.docker.com/r/internetsystemsconsortium/bind9) should pick it up automatically. [Example](https://gitlab.isc.org/isc-projects/bind9-docker/-/commit/cada7e10e9af951595c98bfffc4bd42512faac05)
+ - [ ] ***(QA)*** Inform Marketing of the release.
+ - [ ] ***(Marketing)*** Post a short note to Mastodon.
+ - [ ] ***(Marketing)*** Update [Wikipedia entry for BIND](https://en.wikipedia.org/wiki/BIND).
+ - [ ] ***(Marketing)*** Write blog article (if a major release).
+ - [ ] ***(QA)*** Ensure all new tags are annotated and signed. `git show --show-signature v9.19.12`
+ - [ ] ***(QA)*** Push tags for the published releases to the public repository.
+ - [ ] ***(QA)*** Using [`merge_tag.py`](https://gitlab.isc.org/isc-private/bind-qa/-/blob/master/bind9/releng/merge_tag.py), merge published release tags back into the their relevant development/maintenance branches.
+ - [ ] ***(QA)*** Ensure `allow_failure: true` is removed from the `cross-version-config-tests` job if it was set during the current release cycle.
+ - [ ] ***(QA)*** Sanitize confidential issues which are assigned to the current release milestone and do not describe a security vulnerability, then make them public.
+ - [ ] ***(QA)*** Sanitize [confidential issues](https://gitlab.isc.org/isc-projects/bind9/-/issues/?sort=milestone_due_desc&state=opened&confidential=yes) which are assigned to older release milestones and describe security vulnerabilities, then make them public if appropriate[^2].
+ - [ ] ***(QA)*** Update QA tools used in GitLab CI (e.g. Black, PyLint, Sphinx) by modifying the relevant [`Dockerfile`](https://gitlab.isc.org/isc-projects/images/-/merge_requests/228/diffs).
+ - [ ] ***(QA)*** Run a pipeline to rebuild all [images](https://gitlab.isc.org/isc-projects/images) used in GitLab CI.
+ - [ ] ***(QA)*** Update [`metadata.json`](https://gitlab.isc.org/isc-private/bind-qa/-/blob/master/bind9/releng/metadata.json) with the upcoming release information.
+
+[^1]: If not, use the time remaining until the tagging deadline to ensure all outstanding issues are either resolved or moved to a different milestone.
+[^2]: As a rule of thumb, security vulnerabilities which have reproducers merged to the public repository are considered okay for full disclosure.

.gitlab/issue_templates/Security_issue.md

@@ -1,139 +0,0 @@
-### Summary
-<!--
-Concisely summarize the bug encountered,
-preferably in one paragraph or less.
--->
-
-### BIND versions affected
-<!--
-Make sure you are testing with the **latest** supported version of BIND.
-See https://kb.isc.org/docs/supported-platforms for the current list.
-The latest source is available from https://www.isc.org/download/#BIND
-
-Paste the output of `named -V` here.
--->
-
-### Preconditions and assumptions
-<!--
-Is a specific setup needed?
-
-Please check the BIND Security Assumptions chapter in the ARM:
-https://bind9.readthedocs.io/en/latest/chapter7.html#security-assumptions
-
-E.g. DNSSEC validation must be disabled, etc.
-E.g. Resolver must be configured to forward to attacker's server via DNS-over-TLS, etc.
-E.g. Authoritative server must be configured to transfer specific primary zone.
-E.g. Attacker must be in posession of a key authorized to modify at least one zone.
-E.g. Attacker can affect system clock on the server running BIND.
--->
-
-### Attacker's abilities
-<!--
-What resources does an attacker need to have under their control to mount this attack?
-
-E.g. If attacking an authoritative server, does the attacked have to have prior
-relationship with it? "The authoritative server under attack needs to
-transfer a malicious zone from attacker's authoritative server via TLS."
-
-E.g. If attacking a resolver, does the attacker need the ability to send
-arbitrary queries to the resolver under attack? Do they need to _also_ control
-an authoritative server at the same time?
--->
-
-
-### Impact
-<!--
-Who or what is the victim of the attack and what is the impact?
-
-Is a third party receiving many packets generated by a reflection attack?
-
-If the affected party is the BIND server itself, please quantify the impact
-on legitimate clients:
-E.g. After launching the attack, the answers-per-second metric for legitimate
-traffic drops to 1/1000 within the first minute of the attack.
--->
-
-
-### Steps to reproduce
-<!--
-This is extremely important! Be precise and use itemized lists, please.
-
-Even if a default configuration is affected, please include the full configuration
-files _you were testing with_.
-
-Example:
-1. Use the _attached_ configuration file
-2. Start the BIND server with command: `named -g -c named.conf ...`
-3. Simulate legitimate clients using the command `dnsperf -S1 -d legit-queries ...`
-4. Simulate attack traffic using the command `dnsperf -S1 -d attack-queries ...`
--->
-
-1.
-2.
-3.
-
-### What is the current *bug* behavior?
-
-<!--
-Examples:
-Legitimate QPS drops 1000x.
-Memory consumption increases out of bounds and the server crashes.
-The server crashes immediately.
--->
-
-### What is the expected *correct* behavior?
-
-<!--
-If the attack causes resource exhaustion, what do you think the correct
-behavior should be? Should BIND refuse to process more requests?
-
-What heuristic do you propose to distinguish legitimate and attack traffic?
--->
-
-### Relevant logs
-<!--
-Please provide log files from your testing. Include full named logs and also
-the output from any testing tools (e.g. dnsperf, DNS Shotgun, kxdpgun, etc.)
-
-If multiple log files are needed, make sure all the files have matching timestamps
-so we can correlate log events across log files.
-
-In the case of resource exhaustion attacks, please _also_ include system monitoring
-data. You can use https://gitlab.isc.org/isc-projects/resource-monitor/ to
-gather system-wide statistics.
--->
-
-### Coordination
-- Does this issue affect multiple implementations?
-<!--
-Issues affecting multiple implementations require very careful coordination. We
-have to make sure the information does not leak to the public until vendors are ready to
-release fixed versions. If it is a multi-vendor issue, we need to know about the situation
-as soon as possible to start the (confidential!) coordination process within
-DNS-OARC and other suitable fora.
-
-Please list implementations you have tested.
--->
-
-- Have you shared the information with anyone else?
-<!--
-Have you informed other affected vendors? Or maybe submitted a paper for
-review?
--->
-
-- What is your plan to publicize this issue?
-<!--
-E.g. we plan to go public during conference XYZ on 20XX-XX-XX
--->
-
-### Acknowledgements
-<!--
-Please specify whether and how you would like to be publicly credited with
-discovering the issue. We normally use the format:
-First_name Last_name, Company_or_Team.
--->
-
-<!-- DO NOT modify the following two lines. -->
-
-/label ~Bug ~Security
-/confidential

.reuse/dep5

@@ -54,9 +54,6 @@ Files: **/*.after*
        bin/tests/system/keepalive/expected
        bin/tests/system/legacy/ns6/edns512.db.signed
        bin/tests/system/legacy/ns7/edns512-notcp.db.signed
-       bin/tests/system/masterfile/knowngood.include
-       bin/tests/system/masterfile/knowngood.ttl1
-       bin/tests/system/masterfile/knowngood.ttl2
        bin/tests/system/nsupdate/CA/CA.cfg
        bin/tests/system/nsupdate/CA/README
        bin/tests/system/nsupdate/CA/index.txt

CHANGES

@@ -1,373 +1,3 @@
-6369.	[func]		The 'fixed' value for the 'rrset-order' option has
-			been marked and documented as deprecated. [GL #4446]
-
-6368.	[func]		The 'sortlist' option has been marked and documented
-			as deprecated. [GL #4593]
-
-6367.	[bug]		Since the dns_validator_destroy() function doesn't
-			guarantee that it destroys the validator, rename it to
-			dns_validator_shutdown() and require explicit
-			dns_validator_detach() to follow. Implement an expected
-			behavior of the function to release a name associated
-			with the validator. [GL #4654]
-
-6366.	[bug]		An assertion could be triggered in the QPDB cache when
-			encountering a delegation below a DNAME. [GL #4652]
-
-6365.	[placeholder]
-
-6364.	[protocol]	Add RESOLVER.ARPA to the built in empty zones.
-			[GL #4580]
-
-6363.	[bug]		dig/mdig +ednsflags=<non-zero-value> did not re-enable
-			EDNS if it had been disabled. [GL #4641]
-
-6362.	[bug]		Reduce memory consumption of QP-trie based databases
-			by dynamically allocating the nodenames. [GL #4614]
-
-6361.	[bug]		Some invalid ISO 8601 durations were accepted
-			erroneously. [GL #4624]
-
-6360.	[bug]		Don't return static-stub synthesised NS RRset.
-			[GL #4608]
-
-6359.	[bug]		Fix bug in Depends (keymgr_dep) function. [GL #4552]
-
-	--- 9.19.22 released ---
-
-6358.	[bug]		Fix validate_dnskey_dsset when KSK is not signing,
-			do not skip remainder of DS RRset. [GL #4625]
-
-6357.	[func]		The QP zone database implementation introduced in
-			change #6355 has now been replaced with a version
-			based on the multithreaded dns_qpmulti API, which
-			is based on RCU and reduces the need for locking.
-			The new implementation is called "qpzone". The
-			previous "qp" implementation has been renamed
-			"qpcache", and can only be used for the cache.
-			[GL #4348]
-
-6356.	[bug]		Attach the loop also in the dns_cache_flush(), so
-			the cache pruning still works after the flush.
-			[GL #4621]
-
-6355.	[func]		The red-black tree data structure underlying the
-			RBTDB has been replaced with QP-tries.  This is
-			expected to improve scalability and reduce
-			CPU consumption under load. It is currently known to
-			have higher memory consumption than the traditional
-			RBTDB; this will be addressed in future releases.
-
-			Nodes in a QP-trie contain the full domain name,
-			while nodes in a red-black tree only contain names
-			relative to a parent.  Because of this difference,
-			zone files dumped with masterfile-style "relative"
-			will no longer have multiple different $ORIGIN
-			statements throughout the file.
-
-			This version is a minimal adaptation, keeping RBTDB
-			code largely unchanged, except as needed to replace
-			the underlying data structure. It uses the
-			single-thread "dns_qp" interface with locks for
-			synchronization. A future version will use the
-			multithreaded "dns_qpmulti" interface instead,
-			and will be renamed to QPDB.
-
-			The RBT-based version of RBTDB is still in place
-			for now, and can be used by specifying "database rbt"
-			in a "zone" statement, or by compiling with
-			"configure --with-zonedb=rbt --with-cachedb=rbt".
-			[GL #4411]
-
-6354.	[bug]		Change 6035 introduced a regression when chasing DS
-			records resulting in an assertion failure. [GL #4612]
-
-6353.	[bug]		Improve the TTL-based cleaning by removing the expired
-			headers from the heap, so they don't block the next
-			cleaning round and clean more than a single item for
-			each new addition to the RBTDB. [GL #4591]
-
-6352.	[bug]		Revert change 6319 and decrease lock contention during
-			RBTDB tree pruning by not cleaning up nodes recursively
-			within a single prune_tree() call. [GL #4596]
-
-6351.	[protocol]	Support for the RESINFO record type has been added.
-			[GL #4413]
-
-6350.	[bug]		Address use after free in expire_lru_headers. [GL #4495]
-
-6349.	[placeholder]
-
-6348.	[bug]		BIND could previously abort when trying to
-			establish a connection to a remote server using an
-			incorrect 'tls' configuration. That has been
-			fixed. Thanks to Tobias Wolter for bringing
-			the issue to our attention. [GL #4572]
-
-6347.	[func]		Disallow stale-answer-client-timeout non-zero values.
-			[GL #4447]
-
-6346.	[bug]		Cleaned up several minor bugs in the RBTDB dbiterator
-			implementation. [GL !8741]
-
-6345.	[bug]		Added missing dns_rdataset_disassociate calls in
-			validator.c:findnsec3proofs. [GL #4571]
-
-6344.	[bug]		Fix case insensitive setting for isc_ht hashtable.
-			[GL #4568]
-
-6343.	[bug]		Fix case insensitive setting for isc_ht hashtable.
-			[GL #4568]
-
-6342.	[placeholder]
-
-6341.	[bug]		Address use after free in ccmsg_senddone. [GL #4549]
-
-6340.	[test]		Fix incorrectly reported errors when running tests
-			with `make test` on platforms with older pytest.
-			[GL #4560]
-
-6339.	[bug]		The alignas() can't be used on types larger than
-			max_align_t; instead add padding into the structures
-			where we want avoid false memory sharing. [GL #4187]
-
-6338.	[func]		Optimize slabheader placement, so the infrastructure
-			records are put in the beginning of the slabheader
-			linked list. [GL !8675]
-
-6337.	[bug]		Nsupdate could assert while shutting down. [GL #4529]
-
-6336.	[func]		Expose the zones with the 'first refresh' flag set in
-			statistics channel's "Incoming Zone Transfers" section
-			to indicate the zones that are not yet fully ready, and
-			their first refresh is pending or is in-progress. Also
-			expose the number of such zones in the output of the
-			'rndc status' command. [GL #4241]
-
-6335.	[func]		The 'dnssec-validation yes' option now requires an
-			explicitly configured 'trust-anchors' statement (or
-			'managed-keys' or 'trusted-keys' statements, both
-			deprecated). [GL #4373]
-
-6334.	[doc]		Improve ARM parental-agents definition. [GL #4531]
-
-6333.	[bug]		Fix the DNS_GETDB_STALEFIRST flag, which was defined
-			incorrectly in lib/ns/query.c. [GL !8683]
-
-6332.	[bug]		Range-check the arguments to fetch-quota-param.
-			[GL #362]
-
-6331.	[func]		Add HSM support for dnssec-policy. You can now
-			configure keys with a key-store that allows you to
-			set the directory to store key files and to set a
-			PKCS #11 URI string. [GL #1129]
-
-6330.	[doc]		Update ZSK minimum lifetime documentation in ARM, also
-			depends on signing delay. [GL #4510]
-
-6329.	[func]		Nsupdate can now set the UL EDNS option when sending
-			UPDATE requests. [GL #4419]
-
-6328.	[func]		Add workaround to enforce dynamic linker to pull
-			jemalloc earlier than libc to ensure all memory
-			allocations are done via jemalloc. [GL #4404]
-
-6327.	[func]		Expose the TCP client count in statistics channel.
-			[GL #4425]
-
-6326.	[bug]		Changes to "listen-on" statements were ignored on
-			reconfiguration unless the port or interface address was
-			changed, making it impossible to change a related
-			listener transport type. Thanks to Thomas Amgarten.
-			[GL #4518] [GL #4528]
-
-6325.	[func]		The 'tls' block was extended with a new
-			'cipher-suites' option that allows setting
-			allowed cipher suites for TLSv1.3.
-			[GL #3504]
-
-6324.	[bug]		Fix a possible crash in 'dig +nssearch +nofail' and
-			'host -C' commands when one of the name servers returns
-			SERVFAIL. [GL #4508]
-
-	--- 9.19.21 released ---
-
-6323.	[placeholder]
-
-6322.	[security]	Specific DNS answers could cause a denial-of-service
-			condition due to DNS validation taking a long time.
-			(CVE-2023-50387) [GL #4424]
-
-			The same code change also addresses another problem:
-			preparing NSEC3 closest encloser proofs could exhaust
-			available CPU resources. (CVE-2023-50868) [GL #4459]
-
-6321.	[security]	Change 6315 inadvertently introduced regressions that
-			could cause named to crash. [GL #4234]
-
-6320.	[placeholder]
-
-	--- 9.19.20 released ---
-
-6319.	[func]		Limit isc_async_run() overhead for RBTDB tree pruning.
-			[GL #4383]
-
-6318.	[placeholder]
-
-6317.	[security]	Restore DNS64 state when handling a serve-stale timeout.
-			(CVE-2023-5679) [GL #4334]
-
-6316.	[security]	Specific queries could trigger an assertion check with
-			nxdomain-redirect enabled. (CVE-2023-5517) [GL #4281]
-
-6315.	[security]	Speed up parsing of DNS messages with many different
-			names. (CVE-2023-4408) [GL #4234]
-
-6314.	[bug]		Address race conditions in dns_tsigkey_find().
-			[GL #4182]
-
-6313.	[bug]		When dnssec-policy is in effect the DNSKEY's TTLs in
-			the zone where not being updated to match the policy.
-			This lead to failures when DNSKEYs where updated as the
-			TTLs mismatched. [GL #4466]
-
-6312.	[bug]		Conversion from NSEC3 signed to NSEC signed could
-			temporarily put the zone into a state where it was
-			treated as unsigned until the NSEC chain was built.
-			Additionally conversion from one set of NSEC3 parameters
-			to another could also temporarily put the zone into a
-			state where it was treated as unsigned until the new
-			NSEC3 chain was built. [GL #1794] [GL #4495]
-
-6311.	[func]		Zone content checks are now disabled by default
-			when running named-compilezone. named-checkzone
-			can still be used for checking zone integrity,
-			or the former checks in named-compilezone can be
-			re-enabled by using "named-compilezone -i full
-			-k fail -n fail -r warn -m warn -M warn -S warn
-			-T warn -W warn -C check-svcb:fail". [GL #4364]
-
-6310.	[bug]		Memory leak in zone.c:sign_zone. When named signed a
-			zone it could leak dst_keys due to a misplaced
-			'continue'. [GL #4488]
-
-6309.	[bug]		Changing a zone's primaries while a refresh was in
-			progress could trigger an assertion. [GL #4310]
-
-6308.	[bug]		Prevent crashes caused by the zone journal getting
-			destroyed before all changes from an incoming IXFR are
-			written to it. [GL #4496]
-
-6307.	[bug]		Obtain a client->handle reference when calling
-			async_restart. [GL #4439]
-
-6306.	[func]		Log more details about the cause of "not exact" errors.
-			[GL #4500]
-
-6305.	[placeholder]
-
-6304.	[bug]		The wrong time was being used to determine what RRSIGs
-			where to be generated when dnssec-policy was in use.
-			[GL #4494]
-
-6303.	[bug]		Dig failed to correctly process a SIGINT received while
-			waiting for a TCP connection to complete. [GL #4138]
-
-6302.	[func]		The "trust-anchor-telemetry" statement is no longer
-			marked as experimental. This silences a relevant log
-			message that was emitted even when the feature was
-			explicitly disabled. [GL #4497]
-
-6301.	[bug]		Fix data races with atomic members of the xfrin
-			structure in xfrin_start() and xfrin_send_request()
-			functions. [GL #4493]
-
-6300.	[bug]		Fix statistics export to use full 64 bit signed numbers
-			instead of truncating values to unsigned 32 bits.
-			[GL #4467]
-
-6299.	[port]		NetBSD has added 'hmac' to libc which collides with our
-			use of 'hmac'. [GL #4478]
-
-6298.	[bug]		Fix dns_qp_lookup bugs related to the iterator.
-			[GL !8558]
-
-	--- 9.19.19 released ---
-
-6297.	[bug]		Improve LRU cleaning behaviour. [GL #4448]
-
-6296.	[func]		The "resolver-nonbackoff-tries" and
-			"resolver-retry-interval" options have been removed;
-			Using them is now a fatal error. [GL #4405]
-
-6295.	[bug]		Fix an assertion failure which could occur during
-			shutdown when DNSSEC validation was running. [GL #4462]
-
-6294.	[bug]		BIND might sometimes crash after startup or
-			re-configuration when one 'tls' entry is used multiple
-			times to connect to remote servers due to initialisation
-			attempts from contexts of multiple threads. That has
-			been fixed. [GL #4464]
-
-6293.	[func]		Initial support for accepting the PROXYv2 protocol in
-			all currently implemented DNS transports in BIND and
-			complementary support for sending it in dig are included
-			into this release. [GL #4388]
-
-6292.	[func]		Lower the maximum number of allowed NSEC3 iterations,
-			from 150 to 50. DNSSEC responses with a higher
-			iteration count are treated as insecure. For signing
-			with dnssec-policy, iterations must be set to zero.
-			[GL #4363]
-
-6291.	[bug]		SIGTERM failed to properly stop multiple outstanding
-			lookup in dig. [GL #4457]
-
-6290.	[bug]		Dig +yaml will now report "no servers could be reached"
-			also for UDP setup failure when no other servers or
-			tries are left. [GL #1229]
-
-6289.	[test]		Remove legacy system test runner in favor of pytest.
-			[GL #4251]
-
-6288.	[func]		Refactor the isc_mem overmem handling to always use
-			isc_mem_isovermem and remove the water callback.
-			[GL #4451]
-
-6287.	[bug]		Recognize escapes when reading the public key from file.
-			[GL !8502]
-
-6286.	[bug]		Dig +yaml will now report "no servers could be reached"
-			on TCP connection failure as well as for UDP timeouts.
-			[GL #4396]
-
-6285.	[func]		Remove AES-based DNS cookies. [GL #4421]
-
-6284.	[bug]		Fix a catz db update notification callback registration
-			logic error, which could cause an assertion failure when
-			receiving an AXFR update for a catalog zone while the
-			previous update process of the catalog zone was already
-			running. [GL #4418]
-
-6283.	[bug]		Fix a data race in isc_hashmap by using atomics for the
-			iterators number. [GL !8474]
-
-6282.	[func]		Deprecate AES-based DNS cookies. [GL #4421]
-
-6281.	[bug]		Fix a data race in dns_tsigkeyring_dump(). [GL #4328]
-
-	--- 9.19.18 released ---
-
-6280.	[bug]		Fix missing newlines in the output of "rndc nta -dump".
-			[GL !8454]
-
-6279.	[func]		Use QNAME minimization when fetching nameserver
-			addresses. [GL #4209]
-
-6278.	[bug]		The call to isc_mem_setwater() was incorrectly
-			removed from dns_cache_setcachesize(), causing
-			cache overmem conditions not to be detected. [GL #4340]
-
 6277.	[bug]		Take into account local authoritative zones when
 			falling back to serve-stale. [GL #4355]
 
@@ -403,9 +33,7 @@
 6268.	[func]		Offload the IXFR and AXFR processing to unblock
 			the networking threads. [GL #4367]
 
-6267.	[func]		The timeouts for resending zone refresh queries over UDP
-			were lowered to enable named to more quickly determine
-			that a primary is down. [GL #4260]
+6267.	[func]		Adjust UDP timeouts used in zone maintenance. [GL #4260]
 
 6266.	[func]		The zone option 'inline-signing' is ignored from now
 			on iff there is no 'dnssec-policy' configured for the

Makefile.tests

@@ -21,8 +21,3 @@ AM_CPPFLAGS +=					\
 LDADD +=						\
 	$(top_builddir)/tests/libtest/libtest.la	\
 	$(CMOCKA_LIBS)
-
-if HAVE_JEMALLOC
-AM_CFLAGS += $(JEMALLOC_CFLAGS)
-LDADD += $(JEMALLOC_LIBS)
-endif

Makefile.top

@@ -23,20 +23,12 @@ AM_LDFLAGS +=					\
 	-Wl,-flat_namespace
 endif HOST_MACOS
 
-if HAVE_JEMALLOC
-LIBISC_CFLAGS = $(JEMALLOC_CFLAGS)
-LIBISC_LIBS = $(JEMALLOC_LIBS)
-else
-LIBISC_CFLAGS =
-LIBISC_LIBS =
-endif
-
-LIBISC_CFLAGS +=						\
+LIBISC_CFLAGS =						\
 	-I$(top_srcdir)/include				\
 	-I$(top_srcdir)/lib/isc/include			\
 	-I$(top_builddir)/lib/isc/include
 
-LIBISC_LIBS += $(top_builddir)/lib/isc/libisc.la
+LIBISC_LIBS = $(top_builddir)/lib/isc/libisc.la
 if HAVE_DTRACE
 LIBISC_DTRACE = $(top_builddir)/lib/isc/probes.lo
 endif

bin/check/check-tool.c

@@ -73,7 +73,7 @@
 #define ERR_IS_MXCNAME	   6
 #define ERR_IS_SRVCNAME	   7
 
-static const char *dbtype[] = { ZONEDB_DEFAULT };
+static const char *dbtype[] = { "rbt" };
 
 int debug = 0;
 const char *journal = NULL;
@@ -88,7 +88,6 @@ bool dochecksrv = false;
 bool docheckns = false;
 #endif /* if CHECK_LOCAL */
 dns_zoneopt_t zone_options = DNS_ZONEOPT_CHECKNS | DNS_ZONEOPT_CHECKMX |
-			     DNS_ZONEOPT_CHECKDUPRR | DNS_ZONEOPT_CHECKSPF |
 			     DNS_ZONEOPT_MANYERRORS | DNS_ZONEOPT_CHECKNAMES |
 			     DNS_ZONEOPT_CHECKINTEGRITY |
 #if CHECK_SIBLING

bin/check/named-checkconf.c

@@ -63,7 +63,7 @@ usage(void) {
 		"usage: %s [-achijlvz] [-p [-x]] [-t directory] "
 		"[named.conf]\n",
 		program);
-	exit(EXIT_SUCCESS);
+	exit(1);
 }
 
 /*% directory callback */
@@ -242,9 +242,7 @@ configure_zone(const char *vclass, const char *view, const cfg_obj_t *zconfig,
 	 * Skip checks when using an alternate data source.
 	 */
 	cfg_map_get(zoptions, "database", &dbobj);
-	if (dbobj != NULL &&
-	    strcmp(ZONEDB_DEFAULT, cfg_obj_asstring(dbobj)) != 0)
-	{
+	if (dbobj != NULL && strcmp("rbt", cfg_obj_asstring(dbobj)) != 0) {
 		return (ISC_R_SUCCESS);
 	}
 

bin/check/named-checkzone.c

@@ -79,7 +79,7 @@ usage(void) {
 		"%s zonename [ (filename|-) ]\n",
 		prog_name,
 		progmode == progmode_check ? "[-o filename]" : "-o filename");
-	exit(EXIT_FAILURE);
+	exit(1);
 }
 
 static void
@@ -147,12 +147,15 @@ main(int argc, char **argv) {
 		UNREACHABLE();
 	}
 
-	/* When compiling, disable checks by default */
+	/* Compilation specific defaults */
 	if (progmode == progmode_compile) {
-		zone_options = 0;
-		docheckmx = false;
-		docheckns = false;
-		dochecksrv = false;
+		zone_options |= (DNS_ZONEOPT_CHECKNS | DNS_ZONEOPT_FATALNS |
+				 DNS_ZONEOPT_CHECKSPF | DNS_ZONEOPT_CHECKDUPRR |
+				 DNS_ZONEOPT_CHECKNAMES |
+				 DNS_ZONEOPT_CHECKNAMESFAIL |
+				 DNS_ZONEOPT_CHECKWILDCARD);
+	} else {
+		zone_options |= (DNS_ZONEOPT_CHECKDUPRR | DNS_ZONEOPT_CHECKSPF);
 	}
 
 #define ARGCMP(X) (strcmp(isc_commandline_argument, X) == 0)
@@ -206,7 +209,7 @@ main(int argc, char **argv) {
 			} else {
 				fprintf(stderr, "invalid argument to -i: %s\n",
 					isc_commandline_argument);
-				exit(EXIT_FAILURE);
+				exit(1);
 			}
 			break;
 
@@ -240,7 +243,7 @@ main(int argc, char **argv) {
 			} else {
 				fprintf(stderr, "invalid argument to -k: %s\n",
 					isc_commandline_argument);
-				exit(EXIT_FAILURE);
+				exit(1);
 			}
 			break;
 
@@ -251,7 +254,7 @@ main(int argc, char **argv) {
 			if (*endp != '\0') {
 				fprintf(stderr, "source serial number "
 						"must be numeric");
-				exit(EXIT_FAILURE);
+				exit(1);
 			}
 			break;
 
@@ -262,7 +265,7 @@ main(int argc, char **argv) {
 			if (*endp != '\0') {
 				fprintf(stderr, "maximum TTL "
 						"must be numeric");
-				exit(EXIT_FAILURE);
+				exit(1);
 			}
 			break;
 
@@ -279,7 +282,7 @@ main(int argc, char **argv) {
 			} else {
 				fprintf(stderr, "invalid argument to -n: %s\n",
 					isc_commandline_argument);
-				exit(EXIT_FAILURE);
+				exit(1);
 			}
 			break;
 
@@ -296,7 +299,7 @@ main(int argc, char **argv) {
 			} else {
 				fprintf(stderr, "invalid argument to -m: %s\n",
 					isc_commandline_argument);
-				exit(EXIT_FAILURE);
+				exit(1);
 			}
 			break;
 
@@ -321,7 +324,7 @@ main(int argc, char **argv) {
 			} else {
 				fprintf(stderr, "invalid argument to -r: %s\n",
 					isc_commandline_argument);
-				exit(EXIT_FAILURE);
+				exit(1);
 			}
 			break;
 
@@ -334,7 +337,7 @@ main(int argc, char **argv) {
 				fprintf(stderr,
 					"unknown or unsupported style: %s\n",
 					isc_commandline_argument);
-				exit(EXIT_FAILURE);
+				exit(1);
 			}
 			break;
 
@@ -344,13 +347,13 @@ main(int argc, char **argv) {
 				fprintf(stderr, "isc_dir_chroot: %s: %s\n",
 					isc_commandline_argument,
 					isc_result_totext(result));
-				exit(EXIT_FAILURE);
+				exit(1);
 			}
 			break;
 
 		case 'v':
 			printf("%s\n", PACKAGE_VERSION);
-			exit(EXIT_SUCCESS);
+			exit(0);
 
 		case 'w':
 			workdir = isc_commandline_argument;
@@ -364,7 +367,7 @@ main(int argc, char **argv) {
 			} else {
 				fprintf(stderr, "invalid argument to -C: %s\n",
 					isc_commandline_argument);
-				exit(EXIT_FAILURE);
+				exit(1);
 			}
 			break;
 
@@ -385,7 +388,7 @@ main(int argc, char **argv) {
 			} else {
 				fprintf(stderr, "invalid argument to -M: %s\n",
 					isc_commandline_argument);
-				exit(EXIT_FAILURE);
+				exit(1);
 			}
 			break;
 
@@ -402,7 +405,7 @@ main(int argc, char **argv) {
 			} else {
 				fprintf(stderr, "invalid argument to -S: %s\n",
 					isc_commandline_argument);
-				exit(EXIT_FAILURE);
+				exit(1);
 			}
 			break;
 
@@ -414,7 +417,7 @@ main(int argc, char **argv) {
 			} else {
 				fprintf(stderr, "invalid argument to -T: %s\n",
 					isc_commandline_argument);
-				exit(EXIT_FAILURE);
+				exit(1);
 			}
 			break;
 
@@ -438,7 +441,7 @@ main(int argc, char **argv) {
 		default:
 			fprintf(stderr, "%s: unhandled option -%c\n", prog_name,
 				isc_commandline_option);
-			exit(EXIT_FAILURE);
+			exit(1);
 		}
 	}
 
@@ -447,7 +450,7 @@ main(int argc, char **argv) {
 		if (result != ISC_R_SUCCESS) {
 			fprintf(stderr, "isc_dir_chdir: %s: %s\n", workdir,
 				isc_result_totext(result));
-			exit(EXIT_FAILURE);
+			exit(1);
 		}
 	}
 
@@ -463,7 +466,7 @@ main(int argc, char **argv) {
 		} else {
 			fprintf(stderr, "unknown file format: %s\n",
 				inputformatstr);
-			exit(EXIT_FAILURE);
+			exit(1);
 		}
 	}
 
@@ -481,12 +484,12 @@ main(int argc, char **argv) {
 			    rawversion > 1U)
 			{
 				fprintf(stderr, "unknown raw format version\n");
-				exit(EXIT_FAILURE);
+				exit(1);
 			}
 		} else {
 			fprintf(stderr, "unknown file format: %s\n",
 				outputformatstr);
-			exit(EXIT_FAILURE);
+			exit(1);
 		}
 	}
 

bin/check/named-compilezone.rst

@@ -30,16 +30,10 @@ Description
 
 :program:`named-compilezone` checks the syntax and integrity of a zone file,
 and dumps the zone contents to a specified file in a specified format.
-
-Unlike :program:`named-checkzone`, zone contents are not strictly checked
-by default. If the output is to be used as an actual zone file to be loaded
-by :iscman:`named`, then the check levels should be manually configured to
-be at least as strict as those specified in the :iscman:`named` configuration
-file.
-
-Running :program:`named-checkzone` on the input prior to compiling will
-ensure that the zone compiles with the default requirements of
-:iscman:`named`.
+It applies strict check levels by default, since the
+dump output is used as an actual zone file loaded by :iscman:`named`.
+When manually specified otherwise, the check levels must at least be as
+strict as those specified in the :iscman:`named` configuration file.
 
 Options
 ~~~~~~~
@@ -83,13 +77,13 @@ Options
 
    ``check-svcb:fail`` turns on additional checks on ``_dns`` SVCB
    records and ``check-svcb:ignore`` disables these checks.  The
-   default is ``check-svcb:ignore``.
+   default is ``check-svcb:fail``.
 
 .. option:: -i mode
 
    This option performs post-load zone integrity checks. Possible modes are
-   ``full``, ``full-sibling``, ``local``,
-   ``local-sibling``, and ``none`` (the default).
+   ``full`` (the default), ``full-sibling``, ``local``,
+   ``local-sibling``, and ``none``.
 
    Mode ``full`` checks that MX records refer to A or AAAA records
    (both in-zone and out-of-zone hostnames). Mode ``local`` only
@@ -133,7 +127,7 @@ Options
 .. option:: -k mode
 
    This option performs ``check-names`` checks with the specified failure mode.
-   Possible modes are ``fail``, ``warn``, and ``ignore`` (the default).
+   Possible modes are ``fail`` (the default), ``warn``, and ``ignore``.
 
 .. option:: -l ttl
 
@@ -150,19 +144,19 @@ Options
 .. option:: -m mode
 
    This option specifies whether MX records should be checked to see if they are
-   addresses. Possible modes are ``fail``, ``warn``, and
-   ``ignore`` (the default).
+   addresses. Possible modes are ``fail``, ``warn`` (the default), and
+   ``ignore``.
 
 .. option:: -M mode
 
    This option checks whether a MX record refers to a CNAME. Possible modes are
-   ``fail``, ``warn``, and ``ignore`` (the default).
+   ``fail``, ``warn`` (the default), and ``ignore``.
 
 .. option:: -n mode
 
    This option specifies whether NS records should be checked to see if they are
-   addresses. Possible modes are ``fail``, ``warn``,  and
-   ``ignore`` (the default).
+   addresses. Possible modes are ``fail`` (the default), ``warn``,  and
+   ``ignore``.
 
 .. option:: -o filename
 
@@ -173,7 +167,7 @@ Options
 
    This option checks for records that are treated as different by DNSSEC but are
    semantically equal in plain DNS. Possible modes are ``fail``,
-   ``warn``, and ``ignore`` (the default).
+   ``warn`` (the default), and ``ignore``.
 
 .. option:: -s style
 
@@ -186,7 +180,7 @@ Options
 .. option:: -S mode
 
    This option checks whether an SRV record refers to a CNAME. Possible modes are
-   ``fail``, ``warn``, and ``ignore`` (the default).
+   ``fail``, ``warn`` (the default), and ``ignore``.
 
 .. option:: -t directory
 
@@ -198,7 +192,7 @@ Options
 
    This option checks whether Sender Policy Framework (SPF) records exist and issues a
    warning if an SPF-formatted TXT record is not also present. Possible
-   modes are ``warn`` and ``ignore`` (the default).
+   modes are ``warn`` (the default) and ``ignore``.
 
 .. option:: -w directory
 
@@ -216,7 +210,7 @@ Options
    This option specifies whether to check for non-terminal wildcards. Non-terminal
    wildcards are almost always the result of a failure to understand the
    wildcard matching algorithm (:rfc:`4592`). Possible modes are ``warn``
-   and ``ignore`` (the default).
+   (the default) and ``ignore``.
 
 .. option:: zonename
 

bin/confgen/keygen.c

@@ -124,7 +124,7 @@ generate_key(isc_mem_t *mctx, dns_secalg_t alg, int keysize,
 
 	DO("generate key",
 	   dst_key_generate(dns_rootname, alg, keysize, 0, 0, DNS_KEYPROTO_ANY,
-			    dns_rdataclass_in, NULL, mctx, &key, NULL));
+			    dns_rdataclass_in, mctx, &key, NULL));
 
 	isc_buffer_init(&key_rawbuffer, &key_rawsecret, sizeof(key_rawsecret));
 

bin/confgen/rndc-confgen.c

@@ -146,8 +146,7 @@ main(int argc, char **argv) {
 			keyfile = isc_commandline_argument;
 			break;
 		case 'h':
-			usage(EXIT_SUCCESS);
-			break;
+			usage(0);
 		case 'k':
 		case 'y': /* Compatible with rndc -y. */
 			keyname = isc_commandline_argument;
@@ -193,15 +192,15 @@ main(int argc, char **argv) {
 			if (isc_commandline_option != '?') {
 				fprintf(stderr, "%s: invalid argument -%c\n",
 					program, isc_commandline_option);
-				usage(EXIT_FAILURE);
+				usage(1);
 			} else {
-				usage(EXIT_SUCCESS);
+				usage(0);
 			}
 			break;
 		default:
 			fprintf(stderr, "%s: unhandled option -%c\n", program,
 				isc_commandline_option);
-			exit(EXIT_FAILURE);
+			exit(1);
 		}
 	}
 
@@ -210,7 +209,7 @@ main(int argc, char **argv) {
 	POST(argv);
 
 	if (argc > 0) {
-		usage(EXIT_FAILURE);
+		usage(1);
 	}
 
 	if (alg == DST_ALG_HMACMD5) {

bin/confgen/tsig-keygen.c

@@ -138,13 +138,13 @@ main(int argc, char **argv) {
 			keysize = alg_bits(alg);
 			break;
 		case 'h':
-			usage(EXIT_SUCCESS);
+			usage(0);
 		case 'k':
 		case 'y':
 			if (progmode == progmode_confgen) {
 				keyname = isc_commandline_argument;
 			} else {
-				usage(EXIT_FAILURE);
+				usage(1);
 			}
 			break;
 		case 'M':
@@ -157,7 +157,7 @@ main(int argc, char **argv) {
 			if (progmode == progmode_confgen) {
 				quiet = true;
 			} else {
-				usage(EXIT_FAILURE);
+				usage(1);
 			}
 			break;
 		case 'r':
@@ -167,29 +167,29 @@ main(int argc, char **argv) {
 			if (progmode == progmode_confgen) {
 				self_domain = isc_commandline_argument;
 			} else {
-				usage(EXIT_FAILURE);
+				usage(1);
 			}
 			break;
 		case 'z':
 			if (progmode == progmode_confgen) {
 				zone = isc_commandline_argument;
 			} else {
-				usage(EXIT_FAILURE);
+				usage(1);
 			}
 			break;
 		case '?':
 			if (isc_commandline_option != '?') {
 				fprintf(stderr, "%s: invalid argument -%c\n",
 					program, isc_commandline_option);
-				usage(EXIT_FAILURE);
+				usage(1);
 			} else {
-				usage(EXIT_SUCCESS);
+				usage(0);
 			}
 			break;
 		default:
 			fprintf(stderr, "%s: unhandled option -%c\n", program,
 				isc_commandline_option);
-			exit(EXIT_FAILURE);
+			exit(1);
 		}
 	}
 
@@ -200,11 +200,11 @@ main(int argc, char **argv) {
 	POST(argv);
 
 	if (self_domain != NULL && zone != NULL) {
-		usage(EXIT_FAILURE); /* -s and -z cannot coexist */
+		usage(1); /* -s and -z cannot coexist */
 	}
 
 	if (argc > isc_commandline_index) {
-		usage(EXIT_FAILURE);
+		usage(1);
 	}
 
 	/* Use canonical algorithm name */

bin/confgen/tsig-keygen.rst

@@ -27,10 +27,9 @@ Synopsis
 Description
 ~~~~~~~~~~~
 
-:program:`tsig-keygen` is an utility that generates keys for use with TSIG
-(Transaction Signatures) as defined in :rfc:`2845`. The resulting keys can be used,
-for example, to secure dynamic DNS updates to a zone, or for the :iscman:`rndc`
-command channel.
+:program:`tsig-keygen` is an utility that generates keys for use in TSIG signing.
+The resulting keys can be used, for example, to secure dynamic DNS updates
+to a zone, or for the :iscman:`rndc` command channel.
 
 A domain name can be specified on the command line to be used as the name
 of the generated key. If no name is specified, the default is ``tsig-key``.

bin/confgen/util.c

@@ -13,16 +13,14 @@
 
 /*! \file */
 
+#include "util.h"
 #include <stdarg.h>
 #include <stdbool.h>
 #include <stdio.h>
 #include <stdlib.h>
-#include <unistd.h>
 
 #include <isc/tls.h>
 
-#include "util.h"
-
 extern bool verbose;
 extern const char *progname;
 
@@ -47,5 +45,6 @@ fatal(const char *format, ...) {
 	vfprintf(stderr, format, args);
 	va_end(args);
 	fprintf(stderr, "\n");
-	_exit(EXIT_FAILURE);
+	isc__tls_setfatalmode();
+	exit(1);
 }

bin/delv/delv.c

@@ -247,7 +247,7 @@ usage(void) {
 		"process)\n"
 		"                 +[no]yaml           (Present the results as "
 		"YAML)\n");
-	exit(EXIT_FAILURE);
+	exit(1);
 }
 
 noreturn static void
@@ -263,7 +263,8 @@ fatal(const char *format, ...) {
 	vfprintf(stderr, format, args);
 	va_end(args);
 	fprintf(stderr, "\n");
-	_exit(EXIT_FAILURE);
+	isc__tls_setfatalmode();
+	exit(1);
 }
 
 static void
@@ -1162,7 +1163,7 @@ plus_option(char *option) {
 			if (state) {
 				fprintf(stderr, "Invalid option: "
 						"+dlv is obsolete\n");
-				exit(EXIT_FAILURE);
+				exit(1);
 			}
 			break;
 		case 'n': /* dnssec */
@@ -1377,6 +1378,10 @@ plus_option(char *option) {
 		fprintf(stderr, "Invalid option: +%s\n", option);
 		usage();
 	}
+
+	if (qmin && !fulltrace) {
+		fatal("'+qmin' cannot be used without '+ns'");
+	}
 	return;
 }
 
@@ -1429,7 +1434,7 @@ dash_option(char *option, char *next, bool *open_type_class) {
 			break;
 		case 'h':
 			usage();
-			exit(EXIT_SUCCESS);
+			exit(0);
 		case 'i':
 			no_sigs = true;
 			root_validation = false;
@@ -1439,7 +1444,7 @@ dash_option(char *option, char *next, bool *open_type_class) {
 			break;
 		case 'v':
 			printf("delv %s\n", PACKAGE_VERSION);
-			exit(EXIT_SUCCESS);
+			exit(0);
 		default:
 			UNREACHABLE();
 		}
@@ -1576,7 +1581,7 @@ dash_option(char *option, char *next, bool *open_type_class) {
 			typeset = true;
 		} else {
 			fprintf(stderr, "Invalid IP address %s\n", value);
-			exit(EXIT_FAILURE);
+			exit(1);
 		}
 		return (value_from_next);
 	invalid_option:
@@ -1725,11 +1730,6 @@ parse_args(int argc, char **argv) {
 		}
 	}
 
-	/* check consistency */
-	if (qmin && !fulltrace) {
-		fatal("'+qmin' cannot be used without '+ns'");
-	}
-
 	/*
 	 * If no qname or qtype specified, search for root/NS
 	 * If no qtype specified, use A
@@ -2103,8 +2103,9 @@ sendquery(void *arg) {
 
 	dns_view_attach(view, &(dns_view_t *){ NULL });
 	CHECK(dns_request_create(requestmgr, message, NULL, &peer, NULL, NULL,
-				 DNS_REQUESTOPT_TCP, NULL, 1, 0, 0, isc_loop(),
-				 recvresponse, message, &request));
+				 DNS_REQUESTOPT_TCP, NULL, 1, 0, 0,
+				 isc_loop_current(loopmgr), recvresponse,
+				 message, &request));
 	return;
 
 cleanup:
@@ -2166,8 +2167,8 @@ run_server(void *arg) {
 	dns_view_initsecroots(view);
 	CHECK(setup_dnsseckeys(NULL, view));
 
-	CHECK(dns_view_createresolver(view, netmgr, 0, tlsctx_client_cache,
-				      dispatch, NULL));
+	CHECK(dns_view_createresolver(view, loopmgr, netmgr, 0,
+				      tlsctx_client_cache, dispatch, NULL));
 
 	isc_stats_create(mctx, &resstats, dns_resstatscounter_max);
 	dns_resolver_setstats(view->resolver, resstats);
@@ -2183,10 +2184,9 @@ run_server(void *arg) {
 
 	CHECK(isc_nm_listenstreamdns(netmgr, ISC_NM_LISTEN_ONE, &addr,
 				     ns_client_request, ifp, accept_cb, ifp, 10,
-				     NULL, NULL, ISC_NM_PROXY_NONE,
-				     &ifp->tcplistensocket));
+				     NULL, NULL, &ifp->tcplistensocket));
 	ifp->flags |= NS_INTERFACEFLAG_LISTENING;
-	isc_async_current(sendquery, ifp->tcplistensocket);
+	isc_async_current(loopmgr, sendquery, ifp->tcplistensocket);
 
 	return;
 

bin/dig/dig.c

@@ -119,7 +119,7 @@ usage(void) {
 	print_usage(stderr);
 	fprintf(stderr, "\nUse \"dig -h\" (or \"dig -h | more\") "
 			"for complete list of options\n");
-	exit(EXIT_FAILURE);
+	exit(1);
 }
 #endif /* if TARGET_OS_IPHONE */
 
@@ -252,14 +252,6 @@ help(void) {
 	       "request)\n"
 	       "                 +padding=###        (Set padding block size "
 	       "[0])\n"
-	       "                 "
-	       "+[no]proxy[=src_addr[#src_port]-dst_addr[#dst_port]]        "
-	       "(Add PROXYv2 headers to the queries. If addresses are omitted, "
-	       "LOCAL PROXYv2 headers are added)\n"
-	       "                 "
-	       "+[no]proxy-plain[=src_addr[#src_port]-dst_addr[#dst_port]]  "
-	       "(The same as '+[no]proxy', but send PROXYv2 headers ahead of "
-	       "any encryption if an encrypted transport is used)\n"
 	       "                 +qid=###            (Specify the query ID to "
 	       "use when sending queries)\n"
 	       "                 +[no]qr             (Print question before "
@@ -306,7 +298,8 @@ help(void) {
 	       "                 +[no]tls-keyfile=file (Load client TLS "
 	       "private key from file)\n"
 	       "                 +[no]trace          (Trace delegation down "
-	       "from root [implies +dnssec])\n"
+	       "from root "
+	       "[+dnssec])\n"
 	       "                 +tries=###          (Set number of UDP "
 	       "attempts) [3]\n"
 	       "                 +[no]ttlid          (Control display of ttls "
@@ -372,39 +365,6 @@ received(unsigned int bytes, isc_sockaddr_t *from, dig_query_t *query) {
 		}
 		printf(";; SERVER: %s(%s) (%s)\n", fromtext, query->userarg,
 		       proto);
-
-		if (query->lookup->proxy_mode) {
-			printf(";; CLIENT PROXY HEADER");
-
-			if ((dig_lookup_is_tls(query->lookup) ||
-			     (query->lookup->https_mode &&
-			      !query->lookup->http_plain)) &&
-			    query->lookup->proxy_plain)
-			{
-				printf(" (plain)");
-			}
-
-			printf(": ");
-
-			if (!query->lookup->proxy_local) {
-				char src_buf[ISC_SOCKADDR_FORMATSIZE] = { 0 };
-				char dst_buf[ISC_SOCKADDR_FORMATSIZE] = { 0 };
-
-				isc_sockaddr_format(
-					&query->lookup->proxy_src_addr, src_buf,
-					sizeof(src_buf));
-
-				isc_sockaddr_format(
-					&query->lookup->proxy_dst_addr, dst_buf,
-					sizeof(dst_buf));
-				printf("source: %s, destination: %s", src_buf,
-				       dst_buf);
-			} else {
-				printf("LOCAL");
-			}
-
-			printf("\n");
-		}
 		time(&tnow);
 		(void)localtime_r(&tnow, &tmnow);
 
@@ -1092,323 +1052,6 @@ printgreeting(int argc, char **argv, dig_lookup_t *lookup) {
 			goto invalid_option;                             \
 	} while (0)
 
-/*
- * Parse source and destination addresses in the same format as used by "kdig":
- *
- * SRC_ADDR[#SRC_PORT]-DST_ADDR[#DST_PORT]
- *
- * This can be described (pretty closely for our purpose) using the
- * following EBNF grammar:
- *
- * S = proxy-addrs. (* start rule *)
- * proxy-addrs = addr "-" addr EOF.
- * addr = addr-char { addr-char } ["#" port ].
- * port = digit { digit }.
- * addr-char = <aby but "#", "-", EOF >.
- * EOF = '\0'.
- */
-#define MATCH(ch)     (st->str[0] == (ch))
-#define MATCH_DIGIT() isdigit((unsigned char)(st->str[0]))
-#define ADVANCE()     st->str++
-#define GETP()	      (st->str)
-
-typedef struct isc_proxy_addrs_parser_state {
-	const char *str;
-
-	const char *last_addr_start;
-	size_t last_addr_len;
-
-	const char *last_port_start;
-	size_t last_port_len;
-
-	const char *src_addr_start;
-	size_t src_addr_len;
-
-	const char *src_port_start;
-	size_t src_port_len;
-
-	const char *dst_addr_start;
-	size_t dst_addr_len;
-
-	const char *dst_port_start;
-	size_t dst_port_len;
-} isc_proxy_addrs_parser_state_t;
-
-static bool
-rule_proxy_addrs(isc_proxy_addrs_parser_state_t *st);
-
-static bool
-rule_addr(isc_proxy_addrs_parser_state_t *st);
-
-static bool
-rule_port(isc_proxy_addrs_parser_state_t *st);
-
-static bool
-rule_addr_char(isc_proxy_addrs_parser_state_t *st);
-
-static void
-proxy_handle_port_string(const char *port_start, const size_t port_len,
-			 in_port_t *pport) {
-	char buf[512] = { 0 }; /* max */
-	size_t string_size = 0, max_string_bytes = 0;
-	unsigned int tmp;
-	isc_result_t result;
-
-	string_size = port_len + 1;
-	max_string_bytes = string_size > sizeof(buf) ? sizeof(buf)
-						     : string_size;
-
-	(void)strlcpy(buf, port_start, max_string_bytes);
-	result = parse_uint(&tmp, buf, MAXPORT, "port number");
-	if (result != ISC_R_SUCCESS) {
-		fatal("Couldn't parse port number");
-	}
-	*pport = tmp;
-}
-
-static isc_result_t
-proxy_handle_addr_string(const char *addr_start, const size_t addr_len,
-			 const in_port_t addr_port, isc_sockaddr_t *addr) {
-	isc_result_t result = ISC_R_FAILURE;
-	char buf[512] = { 0 }; /* max */
-	size_t string_size = 0, max_string_bytes = 0;
-	struct in_addr ipv4 = { 0 };
-	struct in6_addr ipv6 = { 0 };
-	int ret = 0;
-
-	string_size = addr_len + 1;
-	max_string_bytes = string_size > sizeof(buf) ? sizeof(buf)
-						     : string_size;
-
-	(void)strlcpy(buf, addr_start, max_string_bytes);
-
-	ret = inet_pton(AF_INET, buf, &ipv4);
-	if (ret == 1) {
-		isc_sockaddr_fromin(addr, &ipv4, addr_port);
-		result = ISC_R_SUCCESS;
-	} else {
-		ret = inet_pton(AF_INET6, buf, &ipv6);
-		if (ret == 1) {
-			isc_sockaddr_fromin6(addr, &ipv6, addr_port);
-			result = ISC_R_SUCCESS;
-		}
-	}
-
-	return (result);
-}
-
-static bool
-parse_proxy_addresses(const char *addrs, isc_sockaddr_t *psrc,
-		      isc_sockaddr_t *pdst) {
-	isc_result_t result = ISC_R_FAILURE;
-	isc_sockaddr_t src = { 0 }, dst = { 0 };
-	isc_proxy_addrs_parser_state_t st = { 0 };
-	in_port_t src_port = 0, dst_port = 53; /* Follow kdig footsteps */
-
-	REQUIRE(addrs != NULL && *addrs != '\0');
-	REQUIRE(psrc != NULL);
-	REQUIRE(pdst != NULL);
-
-	st.str = addrs;
-
-	/* start syntax analysis and verification */
-	if (!rule_proxy_addrs(&st)) {
-		warn("PROXY source and destination addresses cannot be parsed");
-		return (false);
-	}
-
-	/* get port numeric values */
-	if (st.src_port_len > 0) {
-		INSIST(st.src_port_start != NULL);
-		proxy_handle_port_string(st.src_port_start, st.src_port_len,
-					 &src_port);
-	}
-
-	if (st.dst_port_len > 0) {
-		INSIST(st.dst_port_start != NULL);
-		proxy_handle_port_string(st.dst_port_start, st.dst_port_len,
-					 &dst_port);
-	}
-
-	/* get addresses */
-	INSIST(st.src_addr_len > 0);
-	INSIST(st.src_addr_start != NULL);
-	INSIST(st.dst_addr_len > 0);
-	INSIST(st.dst_addr_start != NULL);
-
-	result = proxy_handle_addr_string(st.src_addr_start, st.src_addr_len,
-					  src_port, &src);
-	if (result != ISC_R_SUCCESS) {
-		warn("Cannot get PROXY source address: %s",
-		     isc_result_totext(result));
-		return (false);
-	}
-
-	result = proxy_handle_addr_string(st.dst_addr_start, st.dst_addr_len,
-					  dst_port, &dst);
-	if (result != ISC_R_SUCCESS) {
-		warn("Cannot get PROXY destination address: %s",
-		     isc_result_totext(result));
-		return (false);
-	}
-
-	/* addresses should be of the same type */
-	if (isc_sockaddr_pf(&src) != isc_sockaddr_pf(&dst)) {
-		warn("PROXY source and destination addresses must be of the "
-		     "same type");
-		return (false);
-	}
-
-	*psrc = src;
-	*pdst = dst;
-
-	return (true);
-}
-
-static bool
-rule_proxy_addrs(isc_proxy_addrs_parser_state_t *st) {
-	if (!rule_addr(st)) {
-		return (false);
-	}
-
-	st->src_addr_start = st->last_addr_start;
-	st->src_addr_len = st->last_addr_len;
-	st->src_port_start = st->last_port_start;
-	st->src_port_len = st->last_port_len;
-
-	if (!MATCH('-')) {
-		return (false);
-	}
-
-	ADVANCE();
-
-	if (!rule_addr(st)) {
-		return (false);
-	}
-
-	st->dst_addr_start = st->last_addr_start;
-	st->dst_addr_len = st->last_addr_len;
-	st->dst_port_start = st->last_port_start;
-	st->dst_port_len = st->last_port_len;
-
-	if (!MATCH('\0')) {
-		return (false);
-	}
-
-	return (true);
-}
-
-static bool
-rule_addr(isc_proxy_addrs_parser_state_t *st) {
-	const char *start = GETP();
-	if (!rule_addr_char(st)) {
-		return (false);
-	}
-
-	while (rule_addr_char(st)) {
-		/* skip */
-	}
-
-	st->last_addr_start = start;
-	st->last_addr_len = GETP() - start;
-
-	if (MATCH('#')) {
-		ADVANCE();
-
-		if (!rule_port(st)) {
-			return (false);
-		}
-	}
-
-	return (true);
-}
-
-static bool
-rule_port(isc_proxy_addrs_parser_state_t *st) {
-	const char *start = GETP();
-	if (!MATCH_DIGIT()) {
-		return (false);
-	}
-
-	ADVANCE();
-
-	while (MATCH_DIGIT()) {
-		ADVANCE();
-	}
-
-	st->last_port_start = start;
-	st->last_port_len = GETP() - start;
-
-	return (true);
-}
-
-static bool
-rule_addr_char(isc_proxy_addrs_parser_state_t *st) {
-	if (MATCH('#') || MATCH('-') || MATCH('\0')) {
-		return (false);
-	}
-
-	ADVANCE();
-
-	return (true);
-}
-
-#undef GETP
-#undef ADVANCE
-#undef MATCH_DIGIT
-#undef MATCH
-
-static bool
-plus_proxy_handle_addresses(const char *value, const bool state,
-			    dig_lookup_t *lookup) {
-	lookup->proxy_mode = state;
-	if (!state) {
-		/*
-		 * We are not interested in the option value in that
-		 * case
-		 */
-		return (true);
-	}
-
-	if (value == NULL || *value == '\0') {
-		lookup->proxy_local = true;
-		return (true);
-	}
-
-	if (!parse_proxy_addresses(value, &lookup->proxy_src_addr,
-				   &lookup->proxy_dst_addr))
-	{
-		return (false);
-	}
-	return (true);
-}
-
-static bool
-plus_proxy_options(const char *cmd, const char *value, const bool state,
-		   dig_lookup_t *lookup) {
-	switch (cmd[5]) {
-	case '-':
-		FULLCHECK("proxy-plain");
-		lookup->proxy_plain = state;
-		if (!plus_proxy_handle_addresses(value, state, lookup)) {
-			goto invalid_option;
-		}
-		break;
-	case '\0':
-		FULLCHECK("proxy");
-		if (!plus_proxy_handle_addresses(value, state, lookup)) {
-			goto invalid_option;
-		}
-		break;
-	default:
-		goto invalid_option;
-	}
-	return (true);
-
-invalid_option:
-	return (false);
-}
-
 static bool
 plus_tls_options(const char *cmd, const char *value, const bool state,
 		 dig_lookup_t *lookup) {
@@ -1675,8 +1318,6 @@ plus_option(char *option, bool is_batchfile, bool *need_clone,
 		switch (cmd[1]) {
 		case 'e': /* defname */
 			FULLCHECK("defname");
-			fprintf(stderr, ";; +[no]defname option is "
-					"deprecated; use +[no]search\n");
 			if (!lookup->trace) {
 				usesearch = state;
 			}
@@ -1797,10 +1438,6 @@ plus_option(char *option, bool is_batchfile, bool *need_clone,
 							     "ednsflags");
 							goto exit_or_usage;
 						}
-						if (lookup->edns == -1) {
-							lookup->edns =
-								DEFAULT_EDNS_VERSION;
-						}
 						lookup->ednsflags = num;
 						break;
 					case 'n':
@@ -2055,11 +1692,12 @@ plus_option(char *option, bool is_batchfile, bool *need_clone,
 			goto invalid_option;
 		}
 		break;
-	case 'm':
+	case 'm': /* multiline */
 		switch (cmd[1]) {
 		case 'a':
 			FULLCHECK("mapped");
-			fatal("+mapped option no longer supported");
+			fprintf(stderr, ";; +mapped option is deprecated");
+			break;
 		case 'u':
 			FULLCHECK("multiline");
 			lookup->multiline = state;
@@ -2159,30 +1797,19 @@ plus_option(char *option, bool is_batchfile, bool *need_clone,
 		}
 		break;
 	case 'p':
-		switch (cmd[1]) {
-		case 'a':
-			FULLCHECK("padding");
-			if (state && lookup->edns == -1) {
-				lookup->edns = DEFAULT_EDNS_VERSION;
-			}
-			if (value == NULL) {
-				goto need_value;
-			}
-			result = parse_uint(&num, value, 512, "padding");
-			if (result != ISC_R_SUCCESS) {
-				warn("Couldn't parse padding");
-				goto exit_or_usage;
-			}
-			lookup->padding = (uint16_t)num;
-			break;
-		case 'r':
-			if (!plus_proxy_options(cmd, value, state, lookup)) {
-				goto invalid_option;
-			}
-			break;
-		default:
-			goto invalid_option;
+		FULLCHECK("padding");
+		if (state && lookup->edns == -1) {
+			lookup->edns = DEFAULT_EDNS_VERSION;
 		}
+		if (value == NULL) {
+			goto need_value;
+		}
+		result = parse_uint(&num, value, 512, "padding");
+		if (result != ISC_R_SUCCESS) {
+			warn("Couldn't parse padding");
+			goto exit_or_usage;
+		}
+		lookup->padding = (uint16_t)num;
 		break;
 	case 'q':
 		switch (cmd[1]) {
@@ -2313,7 +1940,8 @@ plus_option(char *option, bool is_batchfile, bool *need_clone,
 			break;
 		case 'i': /* sigchase */
 			FULLCHECK("sigchase");
-			fatal("+sigchase option no longer supported");
+			fprintf(stderr, ";; +sigchase option is deprecated");
+			break;
 		case 'p': /* split */
 			FULLCHECK("split");
 			if (value != NULL && !state) {
@@ -2437,7 +2065,8 @@ plus_option(char *option, bool is_batchfile, bool *need_clone,
 			break;
 		case 'o':
 			FULLCHECK("topdown");
-			fatal("+topdown option no longer supported");
+			fprintf(stderr, ";; +topdown option is deprecated");
+			break;
 		case 'r':
 			switch (cmd[2]) {
 			case 'a': /* trace */
@@ -2478,8 +2107,9 @@ plus_option(char *option, bool is_batchfile, bool *need_clone,
 				break;
 			case 'u': /* trusted-key */
 				FULLCHECK("trusted-key");
-				fatal("+trusted-key option "
-				      "no longer supported");
+				fprintf(stderr, ";; +trusted-key option is "
+						"deprecated");
+				break;
 			default:
 				goto invalid_option;
 			}
@@ -2516,8 +2146,9 @@ plus_option(char *option, bool is_batchfile, bool *need_clone,
 			switch (cmd[2]) {
 			case 'e':
 				FULLCHECK("unexpected");
-				fatal("+unexpected option "
-				      "no longer supported");
+				fprintf(stderr, ";; +unexpected option "
+						"is deprecated");
+				break;
 			case 'k':
 				FULLCHECK("unknownformat");
 				lookup->print_unknown_format = state;
@@ -2525,7 +2156,11 @@ plus_option(char *option, bool is_batchfile, bool *need_clone,
 			default:
 				goto invalid_option;
 			}
+			break;
+		default:
+			goto invalid_option;
 		}
+
 		break;
 	case 'v':
 		FULLCHECK("vc");
@@ -2628,15 +2263,17 @@ dash_option(char *option, char *next, dig_lookup_t **lookup,
 			break;
 		case 'h':
 			help();
-			exit(EXIT_SUCCESS);
+			exit(0);
 			break;
 		case 'i':
-			fatal("-%c removed", option[0]);
+			/* deprecated */
+			break;
 		case 'm': /* memdebug */
 			/* memdebug is handled in preparse_args() */
 			break;
 		case 'n':
-			fatal("-%c removed", option[0]);
+			/* deprecated */
+			break;
 		case 'r':
 			debug("digrc (late)");
 			digrc = false;
@@ -2646,7 +2283,7 @@ dash_option(char *option, char *next, dig_lookup_t **lookup,
 			break;
 		case 'v':
 			printf("DiG %s\n", PACKAGE_VERSION);
-			exit(EXIT_SUCCESS);
+			exit(0);
 			break;
 		}
 		if (strlen(option) > 1U) {
@@ -2821,7 +2458,7 @@ dash_option(char *option, char *next, dig_lookup_t **lookup,
 			ptr = ptr2;
 			ptr2 = ptr3;
 		} else {
-			hmac_alg = DST_ALG_HMACMD5;
+			hmac = DST_ALG_HMACMD5;
 			digestbits = 0;
 		}
 		/* XXXONDREJ: FIXME */
@@ -2855,7 +2492,7 @@ dash_option(char *option, char *next, dig_lookup_t **lookup,
 			ISC_LIST_APPEND(lookup_list, *lookup, link);
 		} else {
 			fprintf(stderr, "Invalid IP address %s\n", value);
-			exit(EXIT_FAILURE);
+			exit(1);
 		}
 		return (value_from_next);
 	invalid_option:

bin/dig/dig.rst

@@ -507,44 +507,6 @@ abbreviation is unambiguous; for example, :option:`+cd` is equivalent to
    mandatory. Responses to padded queries may also be padded, but only
    if the query uses TCP or DNS COOKIE.
 
-.. option:: +proxy[=src_addr[#src_port]-dst_addr[#dst_port]], +noproxy
-
-   When this option is set, :program:`dig` adds PROXYv2 headers to the
-   queries. When source and destination addresses are specified, the
-   headers contain them and use the ``PROXY`` command. It means for
-   the remote peer that the queries were sent on behalf of another
-   node and that the PROXYv2 header reflects the original connection
-   endpoints. The default source port is ``0`` and destination port is
-   `53`.
-
-   For encrypted DNS transports, to prevent accidental information
-   leakage, encryption is applied to the PROXYv2 headers: the headers
-   are sent right after the handshake process has been completed.
-
-   For plain DNS transports, no encryption is applied to the PROXYv2
-   headers.
-
-   If the addressees are omitted, PROXYv2 headers, that use the
-   ``LOCAL`` command set, are added instead. For the remote peer, that
-   means that the queries were sent on purpose without being relayed,
-   so the real connection endpoint addresses must be used.
-
-.. option:: +proxy-plain[=src_addr[#src_port]-dst_addr[#dst_port], +noproxy-plain
-
-   The same as ``+[no]proxy``, but instructs ``dig`` to send PROXYv2
-   headers ahead of any encryption, before any handshake messages are
-   sent. That makes :program:`dig` behave exactly how it is described
-   in the PROXY protocol specification, but not all software expects
-   such behaviour.
-
-   Please consult the software documentation to find out if you need
-   this option. (for example, ``dnsdist`` expects encrypted PROXYv2
-   headers sent over TLS when encryption is used, while ``HAProxy``
-   and many other software packages expect plain ones).
-
-   For plain DNS transports the option is effectively an alias for the
-   ``+[no]proxy`` described above.
-
 .. option:: +qid=value
 
    This option specifies the query ID to use when sending queries.
@@ -614,6 +576,11 @@ abbreviation is unambiguous; for example, :option:`+cd` is equivalent to
 
    This option performs [or does not perform] a search showing intermediate results.
 
+.. option:: +sigchase, +nosigchase
+
+   This feature is now obsolete and has been removed; use :iscman:`delv`
+   instead.
+
 .. option:: +split=W
 
    This option splits long hex- or base64-formatted fields in resource records into
@@ -683,23 +650,25 @@ abbreviation is unambiguous; for example, :option:`+cd` is equivalent to
    server TLS certificate verification. Otherwise, the DNS server name
    is used. This option has no effect if :option:`+tls-ca` is not specified.
 
+.. option:: +topdown, +notopdown
+
+   This feature is related to :option:`dig +sigchase`, which is obsolete and
+   has been removed. Use :iscman:`delv` instead.
+
 .. option:: +trace, +notrace
 
-   This option toggles tracing of the delegation path from the root name
-   servers for the name being looked up. Tracing is disabled by default.
-   When tracing is enabled, :program:`dig` makes iterative queries to
-   resolve the name being looked up. It follows referrals from the root
-   servers, showing the answer from each server that was used to resolve
-   the lookup.
+   This option toggles tracing of the delegation path from the root name servers for
+   the name being looked up. Tracing is disabled by default. When
+   tracing is enabled, :program:`dig` makes iterative queries to resolve the
+   name being looked up. It follows referrals from the root servers,
+   showing the answer from each server that was used to resolve the
+   lookup.
 
    If ``@server`` is also specified, it affects only the initial query for
    the root zone name servers.
 
-   :option:`+dnssec` is set when :option:`+trace` is set, to better
-   emulate the default queries from a name server.
-
-   Note that the ``delv +ns`` option can also be used for tracing the
-   resolution of a name from the root (see :iscman:`delv`).
+   :option:`+dnssec` is also set when :option:`+trace` is set, to better emulate the
+   default queries from a name server.
 
 .. option:: +tries=T
 
@@ -707,6 +676,11 @@ abbreviation is unambiguous; for example, :option:`+cd` is equivalent to
    instead of the default, 3. If ``T`` is less than or equal to zero,
    the number of tries is silently rounded up to 1.
 
+.. option:: +trusted-key=####
+
+   This option formerly specified trusted keys for use with :option:`dig +sigchase`. This
+   feature is now obsolete and has been removed; use :iscman:`delv` instead.
+
 .. option:: +ttlid, +nottlid
 
    This option displays [or does not display] the TTL when printing the record.

bin/dig/dighost.c

@@ -138,7 +138,7 @@ char keyfile[MXNAME] = "";
 char keysecret[MXNAME] = "";
 unsigned char cookie_secret[33];
 unsigned char cookie[8];
-dst_algorithm_t hmac_alg = DST_ALG_UNKNOWN;
+dst_algorithm_t hmac = DST_ALG_UNKNOWN;
 unsigned int digestbits = 0;
 isc_buffer_t *namebuf = NULL;
 dns_tsigkey_t *tsigkey = NULL;
@@ -359,6 +359,8 @@ get_reverse(char *reverse, size_t len, char *value, bool strict) {
 	}
 }
 
+void (*dighost_pre_exit_hook)(void) = NULL;
+
 #if TARGET_OS_IPHONE
 void
 warn(const char *format, ...) {
@@ -391,7 +393,10 @@ digexit(void) {
 		exitcode = 10;
 	}
 	if (fatalexit != 0) {
-		_exit(fatalexit);
+		exitcode = fatalexit;
+	}
+	if (dighost_pre_exit_hook != NULL) {
+		dighost_pre_exit_hook();
 	}
 	exit(exitcode);
 }
@@ -406,11 +411,7 @@ fatal(const char *format, ...) {
 	vfprintf(stderr, format, args);
 	va_end(args);
 	fprintf(stderr, "\n");
-	if (fatalexit == 0 && exitcode != 0) {
-		fatalexit = exitcode;
-	} else if (fatalexit == 0) {
-		fatalexit = EXIT_FAILURE;
-	}
+	isc__tls_setfatalmode();
 	digexit();
 }
 
@@ -793,11 +794,6 @@ clone_lookup(dig_lookup_t *lookold, bool servers) {
 	looknew->rrcomments = lookold->rrcomments;
 	looknew->fuzzing = lookold->fuzzing;
 	looknew->fuzztime = lookold->fuzztime;
-	looknew->proxy_mode = lookold->proxy_mode;
-	looknew->proxy_plain = lookold->proxy_plain;
-	looknew->proxy_local = lookold->proxy_local;
-	looknew->proxy_src_addr = lookold->proxy_src_addr;
-	looknew->proxy_dst_addr = lookold->proxy_dst_addr;
 
 	if (lookold->ecs_addr != NULL) {
 		looknew->ecs_addr = isc_mem_get(mctx,
@@ -878,7 +874,7 @@ setup_text_key(void) {
 
 	secretsize = isc_buffer_usedlength(&secretbuf);
 
-	if (hmac_alg == DST_ALG_UNKNOWN) {
+	if (hmac == DST_ALG_UNKNOWN) {
 		result = DST_R_UNSUPPORTEDALG;
 		goto failure;
 	}
@@ -888,7 +884,7 @@ setup_text_key(void) {
 		goto failure;
 	}
 
-	result = dns_tsigkey_create(&keyname, hmac_alg, secretstore,
+	result = dns_tsigkey_create(&keyname, hmac, secretstore,
 				    (int)secretsize, mctx, &tsigkey);
 failure:
 	if (result != ISC_R_SUCCESS) {
@@ -1040,35 +1036,35 @@ parse_hmac(const char *algname) {
 	digestbits = 0;
 
 	if (strcasecmp(buf, "hmac-md5") == 0) {
-		hmac_alg = DST_ALG_HMACMD5;
+		hmac = DST_ALG_HMACMD5;
 	} else if (strncasecmp(buf, "hmac-md5-", 9) == 0) {
-		hmac_alg = DST_ALG_HMACMD5;
+		hmac = DST_ALG_HMACMD5;
 		digestbits = parse_bits(&buf[9], "digest-bits [0..128]", 128);
 	} else if (strcasecmp(buf, "hmac-sha1") == 0) {
-		hmac_alg = DST_ALG_HMACSHA1;
+		hmac = DST_ALG_HMACSHA1;
 		digestbits = 0;
 	} else if (strncasecmp(buf, "hmac-sha1-", 10) == 0) {
-		hmac_alg = DST_ALG_HMACSHA1;
+		hmac = DST_ALG_HMACSHA1;
 		digestbits = parse_bits(&buf[10], "digest-bits [0..160]", 160);
 	} else if (strcasecmp(buf, "hmac-sha224") == 0) {
-		hmac_alg = DST_ALG_HMACSHA224;
+		hmac = DST_ALG_HMACSHA224;
 	} else if (strncasecmp(buf, "hmac-sha224-", 12) == 0) {
-		hmac_alg = DST_ALG_HMACSHA224;
+		hmac = DST_ALG_HMACSHA224;
 		digestbits = parse_bits(&buf[12], "digest-bits [0..224]", 224);
 	} else if (strcasecmp(buf, "hmac-sha256") == 0) {
-		hmac_alg = DST_ALG_HMACSHA256;
+		hmac = DST_ALG_HMACSHA256;
 	} else if (strncasecmp(buf, "hmac-sha256-", 12) == 0) {
-		hmac_alg = DST_ALG_HMACSHA256;
+		hmac = DST_ALG_HMACSHA256;
 		digestbits = parse_bits(&buf[12], "digest-bits [0..256]", 256);
 	} else if (strcasecmp(buf, "hmac-sha384") == 0) {
-		hmac_alg = DST_ALG_HMACSHA384;
+		hmac = DST_ALG_HMACSHA384;
 	} else if (strncasecmp(buf, "hmac-sha384-", 12) == 0) {
-		hmac_alg = DST_ALG_HMACSHA384;
+		hmac = DST_ALG_HMACSHA384;
 		digestbits = parse_bits(&buf[12], "digest-bits [0..384]", 384);
 	} else if (strcasecmp(buf, "hmac-sha512") == 0) {
-		hmac_alg = DST_ALG_HMACSHA512;
+		hmac = DST_ALG_HMACSHA512;
 	} else if (strncasecmp(buf, "hmac-sha512-", 12) == 0) {
-		hmac_alg = DST_ALG_HMACSHA512;
+		hmac = DST_ALG_HMACSHA512;
 		digestbits = parse_bits(&buf[12], "digest-bits [0..512]", 512);
 	} else {
 		fprintf(stderr,
@@ -1174,7 +1170,7 @@ setup_file_key(void) {
 	case DST_ALG_HMACSHA256:
 	case DST_ALG_HMACSHA384:
 	case DST_ALG_HMACSHA512:
-		hmac_alg = dst_key_alg(dstkey);
+		hmac = dst_key_alg(dstkey);
 		break;
 	default:
 		dst_key_attach(dstkey, &sig0key);
@@ -1183,9 +1179,9 @@ setup_file_key(void) {
 	}
 
 	if (dstkey != NULL) {
-		result = dns_tsigkey_createfromkey(
-			dst_key_name(dstkey), hmac_alg, dstkey, false, false,
-			NULL, 0, 0, mctx, &tsigkey);
+		result = dns_tsigkey_createfromkey(dst_key_name(dstkey), hmac,
+						   dstkey, false, false, NULL,
+						   0, 0, mctx, &tsigkey);
 		if (result != ISC_R_SUCCESS) {
 			printf(";; Couldn't create key %s: %s\n", keynametext,
 			       isc_result_totext(result));
@@ -1387,7 +1383,6 @@ typedef struct dig_ednsoptname {
 
 dig_ednsoptname_t optnames[] = {
 	{ 1, "LLQ" },	       /* draft-sekar-dns-llq */
-	{ 2, "UL" },	       /* draft-ietf-dnssd-update-lease */
 	{ 3, "NSID" },	       /* RFC 5001 */
 	{ 5, "DAU" },	       /* RFC 6975 */
 	{ 6, "DHU" },	       /* RFC 6975 */
@@ -2926,9 +2921,6 @@ start_tcp(dig_query_t *query) {
 	bool tls_mode = false;
 	isc_tlsctx_client_session_cache_t *sess_cache = NULL;
 	int local_timeout;
-	isc_nm_proxy_type_t proxy_type = ISC_NM_PROXY_NONE;
-	isc_nm_proxyheader_info_t proxy_info = { 0 };
-	isc_nm_proxyheader_info_t *ppi = NULL;
 
 	REQUIRE(DIG_VALID_QUERY(query));
 
@@ -3020,22 +3012,6 @@ start_tcp(dig_query_t *query) {
 		}
 	}
 
-	if (query->lookup->proxy_mode) {
-		proxy_type = ISC_NM_PROXY_PLAIN;
-		if ((tls_mode || (query->lookup->https_mode &&
-				  !query->lookup->http_plain)) &&
-		    !query->lookup->proxy_plain)
-		{
-			proxy_type = ISC_NM_PROXY_ENCRYPTED;
-		}
-		if (!query->lookup->proxy_local) {
-			isc_nm_proxyheader_info_init(
-				&proxy_info, &query->lookup->proxy_src_addr,
-				&query->lookup->proxy_dst_addr, NULL);
-			ppi = &proxy_info;
-		}
-	}
-
 	REQUIRE(query != NULL);
 
 	query_attach(query, &connectquery);
@@ -3048,8 +3024,7 @@ start_tcp(dig_query_t *query) {
 		}
 		isc_nm_streamdnsconnect(netmgr, &localaddr, &query->sockaddr,
 					tcp_connected, connectquery,
-					local_timeout, tlsctx, sess_cache,
-					proxy_type, ppi);
+					local_timeout, tlsctx, sess_cache);
 #if HAVE_LIBNGHTTP2
 	} else if (query->lookup->https_mode) {
 		char uri[4096] = { 0 };
@@ -3069,13 +3044,12 @@ start_tcp(dig_query_t *query) {
 		isc_nm_httpconnect(netmgr, &localaddr, &query->sockaddr, uri,
 				   !query->lookup->https_get, tcp_connected,
 				   connectquery, tlsctx, sess_cache,
-				   local_timeout, proxy_type, ppi);
+				   local_timeout);
 #endif
 	} else {
 		isc_nm_streamdnsconnect(netmgr, &localaddr, &query->sockaddr,
 					tcp_connected, connectquery,
-					local_timeout, NULL, NULL, proxy_type,
-					ppi);
+					local_timeout, NULL, NULL);
 	}
 
 	return;
@@ -3231,7 +3205,6 @@ udp_ready(isc_nmhandle_t *handle, isc_result_t eresult, void *arg) {
 			start_udp(next);
 			check_if_done();
 		} else {
-			dighost_error("no servers could be reached\n");
 			clear_current_lookup();
 		}
 
@@ -3325,24 +3298,9 @@ start_udp(dig_query_t *query) {
 	}
 
 	query_attach(query, &connectquery);
-	if (query->lookup->proxy_mode) {
-		isc_nm_proxyheader_info_t proxy_info = { 0 };
-		isc_nm_proxyheader_info_t *ppi = NULL;
-		if (!query->lookup->proxy_local) {
-			isc_nm_proxyheader_info_init(
-				&proxy_info, &query->lookup->proxy_src_addr,
-				&query->lookup->proxy_dst_addr, NULL);
-			ppi = &proxy_info;
-		}
-		isc_nm_proxyudpconnect(netmgr, &localaddr, &query->sockaddr,
-				       udp_ready, connectquery,
-				       (timeout ? timeout : UDP_TIMEOUT) * 1000,
-				       ppi);
-	} else {
-		isc_nm_udpconnect(netmgr, &localaddr, &query->sockaddr,
-				  udp_ready, connectquery,
-				  (timeout ? timeout : UDP_TIMEOUT) * 1000);
-	}
+	isc_nm_udpconnect(netmgr, &localaddr, &query->sockaddr, udp_ready,
+			  connectquery,
+			  (timeout ? timeout : UDP_TIMEOUT) * 1000);
 }
 
 /*%
@@ -3566,12 +3524,6 @@ tcp_connected(isc_nmhandle_t *handle, isc_result_t eresult, void *arg) {
 	debug("tcp_connected(%p, %s, %p)", handle, isc_result_totext(eresult),
 	      query);
 
-	if (eresult == ISC_R_SHUTTINGDOWN) {
-		query_detach(&query);
-		cancel_all();
-		return;
-	}
-
 	lookup_attach(query->lookup, &l);
 
 	if (eresult == ISC_R_CANCELED || eresult == ISC_R_TLSBADPEERCERT ||
@@ -3650,7 +3602,6 @@ tcp_connected(isc_nmhandle_t *handle, isc_result_t eresult, void *arg) {
 			start_tcp(next);
 			check_if_done();
 		} else {
-			dighost_error("no servers could be reached\n");
 			clear_current_lookup();
 		}
 
@@ -3957,9 +3908,7 @@ recv_done(isc_nmhandle_t *handle, isc_result_t eresult, isc_region_t *region,
 	{
 		debug("recv_done: cancel");
 		isc_nmhandle_detach(&query->readhandle);
-		if (eresult == ISC_R_SHUTTINGDOWN) {
-			cancel_all();
-		} else if (!query->canceled) {
+		if (!query->canceled) {
 			cancel_lookup(l);
 		}
 		query_detach(&query);
@@ -4354,32 +4303,29 @@ recv_done(isc_nmhandle_t *handle, isc_result_t eresult, isc_region_t *region,
 	if ((msg->rcode == dns_rcode_servfail && !l->servfail_stops) ||
 	    (check_ra && (msg->flags & DNS_MESSAGEFLAG_RA) == 0 && l->recurse))
 	{
-		const char *err = (msg->rcode == dns_rcode_servfail &&
-				   !l->servfail_stops)
-					  ? "SERVFAIL reply"
-					  : "recursion not available";
 		dig_query_t *next = ISC_LIST_NEXT(query, link);
 		if (l->current_query == query) {
 			query_detach(&l->current_query);
 		}
-		if (next != NULL && (!l->ns_search_only || l->trace_root)) {
-			dighost_comments(l,
-					 "Got %s from %s, trying next server",
-					 err, query->servname);
+		if (next != NULL) {
 			debug("sending query %p", next);
 			if (l->tcp_mode) {
 				start_tcp(next);
 			} else {
 				start_udp(next);
 			}
+			dighost_comments(l,
+					 "Got %s from %s, trying next "
+					 "server",
+					 msg->rcode == dns_rcode_servfail
+						 ? "SERVFAIL reply"
+						 : "recursion not available",
+					 query->servname);
 			if (check_if_queries_done(l, query)) {
 				goto cancel_lookup;
 			}
 
 			goto detach_query;
-		} else {
-			dighost_comments(l, "Got %s from %s", err,
-					 query->servname);
 		}
 	}
 

bin/dig/dighost.h

@@ -187,13 +187,6 @@ struct dig_lookup {
 		char *tls_key_file;
 		isc_tlsctx_cache_t *tls_ctx_cache;
 	};
-	struct {
-		bool proxy_mode;
-		bool proxy_plain;
-		bool proxy_local;
-		isc_sockaddr_t proxy_src_addr;
-		isc_sockaddr_t proxy_dst_addr;
-	};
 	isc_stdtime_t fuzztime;
 };
 
@@ -266,7 +259,7 @@ extern isc_sockaddr_t localaddr;
 extern char keynametext[MXNAME];
 extern char keyfile[MXNAME];
 extern char keysecret[MXNAME];
-extern dst_algorithm_t hmac_alg;
+extern dst_algorithm_t hmac;
 extern unsigned int digestbits;
 extern dns_tsigkey_t *tsigkey;
 extern bool validated;

bin/dig/host.c

@@ -132,7 +132,7 @@ show_usage(void) {
 		"       -W specifies how long to wait for a reply\n"
 		"       -4 use IPv4 query transport only\n"
 		"       -6 use IPv6 query transport only\n");
-	exit(EXIT_FAILURE);
+	exit(1);
 }
 
 static void
@@ -654,7 +654,7 @@ pre_parse_args(int argc, char **argv) {
 			break;
 		case 'V':
 			printf("host %s\n", PACKAGE_VERSION);
-			exit(EXIT_SUCCESS);
+			exit(0);
 			break;
 		case 'w':
 			break;

bin/dig/nslookup.c

@@ -849,7 +849,7 @@ usage(void) {
 			"'host' using default server\n");
 	fprintf(stderr, "   nslookup [-opt ...] host server # just look up "
 			"'host' using 'server'\n");
-	exit(EXIT_FAILURE);
+	exit(1);
 }
 
 static void
@@ -862,7 +862,7 @@ parse_args(int argc, char **argv) {
 		if (argv[0][0] == '-') {
 			if (strncasecmp(argv[0], "-ver", 4) == 0) {
 				printf("nslookup %s\n", PACKAGE_VERSION);
-				exit(EXIT_SUCCESS);
+				exit(0);
 			} else if (argv[0][1] != 0) {
 				setoption(&argv[0][1]);
 			} else {

bin/dnssec/dnssec-cds.c

@@ -247,8 +247,8 @@ static void
 load_db(const char *filename, dns_db_t **dbp, dns_dbnode_t **nodep) {
 	isc_result_t result;
 
-	result = dns_db_create(mctx, ZONEDB_DEFAULT, name, dns_dbtype_zone,
-			       rdclass, 0, NULL, dbp);
+	result = dns_db_create(mctx, "rbt", name, dns_dbtype_zone, rdclass, 0,
+			       NULL, dbp);
 	check_result(result, "dns_db_create()");
 
 	result = dns_db_load(*dbp, filename, dns_masterformat_text,
@@ -979,8 +979,8 @@ update_diff(const char *cmd, uint32_t ttl, dns_rdataset_t *addset,
 	dns_rdataset_t diffset;
 	uint32_t save;
 
-	result = dns_db_create(mctx, ZONEDB_DEFAULT, name, dns_dbtype_zone,
-			       rdclass, 0, NULL, &update_db);
+	result = dns_db_create(mctx, "rbt", name, dns_dbtype_zone, rdclass, 0,
+			       NULL, &update_db);
 	check_result(result, "dns_db_create()");
 
 	result = dns_db_newversion(update_db, &update_version);
@@ -1056,7 +1056,7 @@ usage(void) {
 			"    -T <ttl>           TTL of DS records\n"
 			"    -V                 print version\n"
 			"    -v <verbosity>\n");
-	exit(EXIT_FAILURE);
+	exit(1);
 }
 
 static void
@@ -1354,6 +1354,5 @@ main(int argc, char *argv[]) {
 cleanup:
 	print_mem_stats = true;
 	cleanup();
-
-	return (0);
+	exit(0);
 }

bin/dnssec/dnssec-dsfromkey.c

@@ -100,8 +100,8 @@ loadset(const char *filename, dns_rdataset_t *rdataset) {
 
 	dns_name_format(name, setname, sizeof(setname));
 
-	result = dns_db_create(mctx, ZONEDB_DEFAULT, name, dns_dbtype_zone,
-			       rdclass, 0, NULL, &db);
+	result = dns_db_create(mctx, "rbt", name, dns_dbtype_zone, rdclass, 0,
+			       NULL, &db);
 	if (result != ISC_R_SUCCESS) {
 		fatal("can't create database");
 	}
@@ -353,7 +353,7 @@ usage(void) {
 			"    -V: print version information\n");
 	fprintf(stderr, "Output: DS or CDS RRs\n");
 
-	exit(EXIT_FAILURE);
+	exit(-1);
 }
 
 int
@@ -452,7 +452,7 @@ main(int argc, char **argv) {
 		default:
 			fprintf(stderr, "%s: unhandled option -%c\n", program,
 				isc_commandline_option);
-			exit(EXIT_FAILURE);
+			exit(1);
 		}
 	}
 

bin/dnssec/dnssec-importkey.c

@@ -103,8 +103,8 @@ loadset(const char *filename, dns_rdataset_t *rdataset) {
 
 	dns_name_format(name, setname, sizeof(setname));
 
-	result = dns_db_create(mctx, ZONEDB_DEFAULT, name, dns_dbtype_zone,
-			       rdclass, 0, NULL, &db);
+	result = dns_db_create(mctx, "rbt", name, dns_dbtype_zone, rdclass, 0,
+			       NULL, &db);
 	if (result != ISC_R_SUCCESS) {
 		fatal("can't create database");
 	}
@@ -289,7 +289,7 @@ usage(void) {
 	fprintf(stderr, "    -D sync date/[+-]offset/none: set/unset "
 			"CDS and CDNSKEY deletion date\n");
 
-	exit(EXIT_FAILURE);
+	exit(-1);
 }
 
 int
@@ -395,7 +395,7 @@ main(int argc, char **argv) {
 		default:
 			fprintf(stderr, "%s: unhandled option -%c\n", program,
 				isc_commandline_option);
-			exit(EXIT_FAILURE);
+			exit(1);
 		}
 	}
 

bin/dnssec/dnssec-keyfromlabel.c

@@ -102,7 +102,7 @@ usage(void) {
 	fprintf(stderr, "     K<name>+<alg>+<id>.key, "
 			"K<name>+<alg>+<id>.private\n");
 
-	exit(EXIT_FAILURE);
+	exit(-1);
 }
 
 int
@@ -331,7 +331,7 @@ main(int argc, char **argv) {
 		default:
 			fprintf(stderr, "%s: unhandled option -%c\n", program,
 				isc_commandline_option);
-			exit(EXIT_FAILURE);
+			exit(1);
 		}
 	}
 
@@ -606,7 +606,7 @@ main(int argc, char **argv) {
 		fatal("failed to get key %s/%s: %s", namestr, algstr,
 		      isc_result_totext(ret));
 		UNREACHABLE();
-		exit(EXIT_FAILURE);
+		exit(-1);
 	}
 
 	/*

bin/dnssec/dnssec-keygen.c

@@ -92,7 +92,6 @@ struct keygen_ctx {
 	const char *policy;
 	const char *configfile;
 	const char *directory;
-	dns_keystore_t *keystore;
 	char *algname;
 	char *nametype;
 	char *type;
@@ -227,7 +226,7 @@ usage(void) {
 	fprintf(stderr, "     K<name>+<alg>+<id>.key, "
 			"K<name>+<alg>+<id>.private\n");
 
-	exit(EXIT_FAILURE);
+	exit(-1);
 }
 
 static void
@@ -256,42 +255,14 @@ progress(int p) {
 
 static void
 kasp_from_conf(cfg_obj_t *config, isc_mem_t *mctx, const char *name,
-	       const char *keydir, const char *engine, dns_kasp_t **kaspp) {
-	isc_result_t result = ISC_R_NOTFOUND;
+	       dns_kasp_t **kaspp) {
 	const cfg_listelt_t *element;
 	const cfg_obj_t *kasps = NULL;
 	dns_kasp_t *kasp = NULL, *kasp_next;
+	isc_result_t result = ISC_R_NOTFOUND;
 	dns_kasplist_t kasplist;
-	const cfg_obj_t *keystores = NULL;
-	dns_keystore_t *ks = NULL, *ks_next;
-	dns_keystorelist_t kslist;
 
 	ISC_LIST_INIT(kasplist);
-	ISC_LIST_INIT(kslist);
-
-	(void)cfg_map_get(config, "key-store", &keystores);
-	for (element = cfg_list_first(keystores); element != NULL;
-	     element = cfg_list_next(element))
-	{
-		cfg_obj_t *kconfig = cfg_listelt_value(element);
-		ks = NULL;
-		result = cfg_keystore_fromconfig(kconfig, mctx, lctx, engine,
-						 &kslist, NULL);
-		if (result != ISC_R_SUCCESS) {
-			fatal("failed to configure key-store '%s': %s",
-			      cfg_obj_asstring(cfg_tuple_get(kconfig, "name")),
-			      isc_result_totext(result));
-		}
-	}
-	/* Default key-directory key store. */
-	ks = NULL;
-	(void)cfg_keystore_fromconfig(NULL, mctx, lctx, engine, &kslist, &ks);
-	INSIST(ks != NULL);
-	if (keydir != NULL) {
-		/* '-K keydir' takes priority */
-		dns_keystore_setdirectory(ks, keydir);
-	}
-	dns_keystore_detach(&ks);
 
 	(void)cfg_map_get(config, "dnssec-policy", &kasps);
 	for (element = cfg_list_first(kasps); element != NULL;
@@ -306,7 +277,7 @@ kasp_from_conf(cfg_obj_t *config, isc_mem_t *mctx, const char *name,
 		}
 
 		result = cfg_kasp_fromconfig(kconfig, NULL, true, mctx, lctx,
-					     &kslist, &kasplist, &kasp);
+					     &kasplist, &kasp);
 		if (result != ISC_R_SUCCESS) {
 			fatal("failed to configure dnssec-policy '%s': %s",
 			      cfg_obj_asstring(cfg_tuple_get(kconfig, "name")),
@@ -327,15 +298,6 @@ kasp_from_conf(cfg_obj_t *config, isc_mem_t *mctx, const char *name,
 		ISC_LIST_UNLINK(kasplist, kasp, link);
 		dns_kasp_detach(&kasp);
 	}
-
-	/*
-	 * Cleanup keystore list.
-	 */
-	for (ks = ISC_LIST_HEAD(kslist); ks != NULL; ks = ks_next) {
-		ks_next = ISC_LIST_NEXT(ks, link);
-		ISC_LIST_UNLINK(kslist, ks, link);
-		dns_keystore_detach(&ks);
-	}
 }
 
 static void
@@ -693,27 +655,16 @@ keygen(keygen_ctx_t *ctx, isc_mem_t *mctx, int argc, char **argv) {
 
 		if (!ctx->quiet && show_progress) {
 			fprintf(stderr, "Generating key pair.");
-		}
-
-		if (ctx->keystore != NULL && ctx->policy != NULL) {
-			ret = dns_keystore_keygen(
-				ctx->keystore, name, ctx->policy, ctx->rdclass,
-				mctx, ctx->alg, ctx->size, flags, &key);
-		} else if (!ctx->quiet && show_progress) {
 			ret = dst_key_generate(name, ctx->alg, ctx->size, param,
 					       flags, ctx->protocol,
-					       ctx->rdclass, NULL, mctx, &key,
+					       ctx->rdclass, mctx, &key,
 					       &progress);
+			putc('\n', stderr);
+			fflush(stderr);
 		} else {
 			ret = dst_key_generate(name, ctx->alg, ctx->size, param,
 					       flags, ctx->protocol,
-					       ctx->rdclass, NULL, mctx, &key,
-					       NULL);
-		}
-
-		if (!ctx->quiet && show_progress) {
-			putc('\n', stderr);
-			fflush(stderr);
+					       ctx->rdclass, mctx, &key, NULL);
 		}
 
 		if (ret != ISC_R_SUCCESS) {
@@ -909,18 +860,6 @@ keygen(keygen_ctx_t *ctx, isc_mem_t *mctx, int argc, char **argv) {
 	}
 }
 
-static void
-check_keystore_options(keygen_ctx_t *ctx) {
-	ctx->directory = dns_keystore_directory(ctx->keystore, NULL);
-	if (ctx->directory != NULL) {
-		isc_result_t ret = try_dir(ctx->directory);
-		if (ret != ISC_R_SUCCESS) {
-			fatal("cannot open directory %s: %s", ctx->directory,
-			      isc_result_totext(ret));
-		}
-	}
-}
-
 int
 main(int argc, char **argv) {
 	char *algname = NULL, *freeit = NULL;
@@ -1196,7 +1135,7 @@ main(int argc, char **argv) {
 		default:
 			fprintf(stderr, "%s: unhandled option -%c\n", program,
 				isc_commandline_option);
-			exit(EXIT_FAILURE);
+			exit(1);
 		}
 	}
 
@@ -1330,8 +1269,7 @@ main(int argc, char **argv) {
 				      ctx.policy, ctx.configfile);
 			}
 
-			kasp_from_conf(config, mctx, ctx.policy, ctx.directory,
-				       engine, &kasp);
+			kasp_from_conf(config, mctx, ctx.policy, &kasp);
 			if (kasp == NULL) {
 				fatal("failed to load dnssec-policy '%s'",
 				      ctx.policy);
@@ -1357,10 +1295,7 @@ main(int argc, char **argv) {
 				ctx.ksk = dns_kasp_key_ksk(kaspkey);
 				ctx.zsk = dns_kasp_key_zsk(kaspkey);
 				ctx.lifetime = dns_kasp_key_lifetime(kaspkey);
-				ctx.keystore = dns_kasp_key_keystore(kaspkey);
-				if (ctx.keystore != NULL) {
-					check_keystore_options(&ctx);
-				}
+
 				keygen(&ctx, mctx, argc, argv);
 
 				kaspkey = ISC_LIST_NEXT(kaspkey, link);

bin/dnssec/dnssec-keygen.rst

@@ -27,7 +27,9 @@ Description
 ~~~~~~~~~~~
 
 :program:`dnssec-keygen` generates keys for DNSSEC (Secure DNS), as defined in
-:rfc:`2535` and :rfc:`4034`.
+:rfc:`2535` and :rfc:`4034`. It can also generate keys for use with TSIG
+(Transaction Signatures) as defined in :rfc:`2845`, or TKEY (Transaction
+Key) as defined in :rfc:`2930`.
 
 The ``name`` of the key is specified on the command line. For DNSSEC
 keys, this must match the name of the zone for which the key is being

bin/dnssec/dnssec-revoke.c

@@ -58,7 +58,7 @@ usage(void) {
 	fprintf(stderr, "     K<name>+<alg>+<new id>.key, "
 			"K<name>+<alg>+<new id>.private\n");
 
-	exit(EXIT_FAILURE);
+	exit(-1);
 }
 
 int
@@ -130,7 +130,7 @@ main(int argc, char **argv) {
 		default:
 			fprintf(stderr, "%s: unhandled option -%c\n", program,
 				isc_commandline_option);
-			exit(EXIT_FAILURE);
+			exit(1);
 		}
 	}
 

bin/dnssec/dnssec-settime.c

@@ -101,7 +101,7 @@ usage(void) {
 	fprintf(stderr, "     K<name>+<alg>+<new id>.key, "
 			"K<name>+<alg>+<new id>.private\n");
 
-	exit(EXIT_FAILURE);
+	exit(-1);
 }
 
 static void
@@ -536,7 +536,7 @@ main(int argc, char **argv) {
 		default:
 			fprintf(stderr, "%s: unhandled option -%c\n", program,
 				isc_commandline_option);
-			exit(EXIT_FAILURE);
+			exit(1);
 		}
 	}
 

bin/dnssec/dnssec-signzone.c

@@ -998,8 +998,8 @@ opendb(const char *prefix, dns_name_t *name, dns_rdataclass_t rdclass,
 	}
 	isc_buffer_putuint8(&b, 0);
 
-	result = dns_db_create(mctx, ZONEDB_DEFAULT, dns_rootname,
-			       dns_dbtype_zone, rdclass, 0, NULL, dbp);
+	result = dns_db_create(mctx, "rbt", dns_rootname, dns_dbtype_zone,
+			       rdclass, 0, NULL, dbp);
 	check_result(result, "dns_db_create()");
 
 	result = dns_db_load(*dbp, filename, inputformat, DNS_MASTER_HINT);
@@ -1674,7 +1674,7 @@ assignwork(void *arg) {
 	lock_and_dumpnode(dns_fixedname_name(&fname), node);
 	dns_db_detachnode(gdb, &node);
 
-	isc_async_current(assignwork, NULL);
+	isc_async_current(loopmgr, assignwork, NULL);
 }
 
 /*%
@@ -2572,8 +2572,8 @@ loadzone(char *file, char *origin, dns_rdataclass_t rdclass, dns_db_t **db) {
 		      isc_result_totext(result));
 	}
 
-	result = dns_db_create(mctx, ZONEDB_DEFAULT, name, dns_dbtype_zone,
-			       rdclass, 0, NULL, db);
+	result = dns_db_create(mctx, "rbt", name, dns_dbtype_zone, rdclass, 0,
+			       NULL, db);
 	check_result(result, "dns_db_create()");
 
 	result = dns_db_load(*db, file, inputformat, 0);
@@ -2639,7 +2639,7 @@ loadzonekeys(bool preserve_keys, bool load_public) {
 
 	/* Load keys corresponding to the existing DNSKEY RRset. */
 	result = dns_dnssec_keylistfromrdataset(
-		gorigin, NULL, directory, mctx, &rdataset, &keysigs, &soasigs,
+		gorigin, directory, mctx, &rdataset, &keysigs, &soasigs,
 		preserve_keys, load_public, &keylist);
 	if (result != ISC_R_SUCCESS) {
 		fatal("failed to load the zone keys: %s",
@@ -2830,8 +2830,8 @@ findkeys:
 	/*
 	 * Find keys that match this zone in the key repository.
 	 */
-	result = dns_dnssec_findmatchingkeys(gorigin, NULL, directory, NULL,
-					     now, mctx, &matchkeys);
+	result = dns_dnssec_findmatchingkeys(gorigin, directory, now, mctx,
+					     &matchkeys);
 	if (result == ISC_R_NOTFOUND) {
 		result = ISC_R_SUCCESS;
 	}
@@ -3162,8 +3162,8 @@ writeset(const char *prefix, dns_rdatatype_t type) {
 		dns_diff_append(&diff, &tuple);
 	}
 
-	result = dns_db_create(mctx, ZONEDB_DEFAULT, dns_rootname,
-			       dns_dbtype_zone, gclass, 0, NULL, &db);
+	result = dns_db_create(mctx, "rbt", dns_rootname, dns_dbtype_zone,
+			       gclass, 0, NULL, &db);
 	check_result(result, "dns_db_create");
 
 	result = dns_db_newversion(db, &dbversion);
@@ -3300,7 +3300,7 @@ usage(void) {
 	fprintf(stderr, "(default: all zone keys that have private keys)\n");
 	fprintf(stderr, "\tkeyfile (Kname+alg+tag)\n");
 
-	exit(EXIT_FAILURE);
+	exit(0);
 }
 
 static void
@@ -3494,7 +3494,7 @@ main(int argc, char *argv[]) {
 			set_iter = true;
 			/* too-many is NOT DOCUMENTED */
 			if (strcmp(isc_commandline_argument, "too-many") == 0) {
-				nsec3iter = 51;
+				nsec3iter = 151;
 				no_max_check = true;
 				break;
 			}
@@ -3550,7 +3550,7 @@ main(int argc, char *argv[]) {
 			if (*endp != '\0') {
 				fprintf(stderr, "source serial number "
 						"must be numeric");
-				exit(EXIT_FAILURE);
+				exit(1);
 			}
 			break;
 
@@ -3565,7 +3565,7 @@ main(int argc, char *argv[]) {
 			if (*endp != '\0') {
 				fprintf(stderr, "maximum TTL "
 						"must be numeric");
-				exit(EXIT_FAILURE);
+				exit(1);
 			}
 			break;
 
@@ -3689,7 +3689,7 @@ main(int argc, char *argv[]) {
 		default:
 			fprintf(stderr, "%s: unhandled option -%c\n", program,
 				isc_commandline_option);
-			exit(EXIT_FAILURE);
+			exit(1);
 		}
 	}
 
@@ -3818,7 +3818,7 @@ main(int argc, char *argv[]) {
 			    rawversion > 1U)
 			{
 				fprintf(stderr, "unknown raw format version\n");
-				exit(EXIT_FAILURE);
+				exit(1);
 			}
 		} else {
 			fatal("unknown file format: %s", outputformatstr);

bin/dnssec/dnssec-verify.c

@@ -109,8 +109,8 @@ loadzone(char *file, char *origin, dns_rdataclass_t rdclass, dns_db_t **db) {
 		      isc_result_totext(result));
 	}
 
-	result = dns_db_create(mctx, ZONEDB_DEFAULT, name, dns_dbtype_zone,
-			       rdclass, 0, NULL, db);
+	result = dns_db_create(mctx, "rbt", name, dns_dbtype_zone, rdclass, 0,
+			       NULL, db);
 	check_result(result, "dns_db_create()");
 
 	result = dns_db_load(*db, file, inputformat, 0);
@@ -162,7 +162,7 @@ usage(void) {
 	fprintf(stderr, "\t-x:\tDNSKEY record signed with KSKs only, "
 			"not ZSKs\n");
 	fprintf(stderr, "\t-z:\tAll records signed with KSKs\n");
-	exit(EXIT_SUCCESS);
+	exit(0);
 }
 
 int
@@ -271,7 +271,7 @@ main(int argc, char *argv[]) {
 		default:
 			fprintf(stderr, "%s: unhandled option -%c\n", program,
 				isc_commandline_option);
-			exit(EXIT_FAILURE);
+			exit(1);
 		}
 	}
 

bin/dnssec/dnssectool.c

@@ -20,7 +20,6 @@
 #include <inttypes.h>
 #include <stdbool.h>
 #include <stdlib.h>
-#include <unistd.h>
 
 #include <isc/base32.h>
 #include <isc/buffer.h>
@@ -84,7 +83,8 @@ fatal(const char *format, ...) {
 	if (fatalcallback != NULL) {
 		(*fatalcallback)();
 	}
-	_exit(EXIT_FAILURE);
+	isc__tls_setfatalmode();
+	exit(1);
 }
 
 void
@@ -114,7 +114,7 @@ vbprintf(int level, const char *fmt, ...) {
 void
 version(const char *name) {
 	printf("%s %s\n", name, PACKAGE_VERSION);
-	exit(EXIT_SUCCESS);
+	exit(0);
 }
 
 void
@@ -498,8 +498,7 @@ key_collision(dst_key_t *dstkey, dns_name_t *name, const char *dir,
 	alg = dst_key_alg(dstkey);
 
 	ISC_LIST_INIT(matchkeys);
-	result = dns_dnssec_findmatchingkeys(name, NULL, dir, NULL, now, mctx,
-					     &matchkeys);
+	result = dns_dnssec_findmatchingkeys(name, dir, now, mctx, &matchkeys);
 	if (result == ISC_R_NOTFOUND) {
 		return (false);
 	}

bin/named/bind9.xsl

@@ -919,7 +919,6 @@
                   <th>Local Serial</th>
                   <th>Remote Serial</th>
                   <th>IXFR</th>
-                  <th>First Refresh</th>
                   <th>State</th>
                   <th>Additional Refresh Queued</th>
                   <th>Local Address</th>
@@ -947,7 +946,6 @@
                     <td><xsl:value-of select="serial"/></td>
                     <td><xsl:value-of select="remoteserial"/></td>
                     <td><xsl:value-of select="ixfr"/></td>
-                    <td><xsl:value-of select="firstrefresh"/></td>
                     <td><xsl:value-of select="state"/></td>
                     <td><xsl:value-of select="refreshqueued"/></td>
                     <td><xsl:value-of select="localaddr"/></td>

bin/named/config.c

@@ -132,8 +132,6 @@ options {\n\
 	/* view */\n\
 	allow-new-zones no;\n\
 	allow-notify {none;};\n\
-	allow-proxy {none;};\n\
-	allow-proxy-on {any;};\n\
 	allow-query-cache { localnets; localhost; };\n\
 	allow-query-cache-on { any; };\n\
 	allow-recursion { localnets; localhost; };\n\
@@ -189,6 +187,8 @@ options {\n\
 	request-expire true;\n\
 	request-ixfr true;\n\
 	require-server-cookie no;\n\
+	resolver-nonbackoff-tries 3;\n\
+	resolver-retry-interval 800; /* in milliseconds */\n\
 	root-key-sentinel yes;\n\
 	servfail-ttl 1;\n\
 #	sortlist <none>\n\

bin/named/control.c

@@ -177,7 +177,6 @@ named_control_docommand(isccc_sexpr_t *message, bool readonly,
 		/* Do not flush master files */
 		named_server_flushonshutdown(named_g_server, false);
 		named_os_shutdownmsg(cmdline, *text);
-		isc_loopmgr_shutdown(named_g_loopmgr);
 		result = ISC_R_SHUTTINGDOWN;
 	} else if (command_compare(command, NAMED_COMMAND_STOP)) {
 		/*
@@ -195,7 +194,6 @@ named_control_docommand(isccc_sexpr_t *message, bool readonly,
 #endif /* ifdef HAVE_LIBSCF */
 		named_server_flushonshutdown(named_g_server, true);
 		named_os_shutdownmsg(cmdline, *text);
-		isc_loopmgr_shutdown(named_g_loopmgr);
 		result = ISC_R_SHUTTINGDOWN;
 	} else if (command_compare(command, NAMED_COMMAND_ADDZONE) ||
 		   command_compare(command, NAMED_COMMAND_MODZONE))

bin/named/controlconf.c

@@ -91,7 +91,7 @@ struct controllistener {
 	isc_sockaddr_t address;
 	isc_nmsocket_t *sock;
 	dns_acl_t *acl;
-	bool shuttingdown;
+	bool exiting;
 	isc_refcount_t references;
 	controlkeylist_t keys;
 	controlconnectionlist_t connections;
@@ -119,8 +119,6 @@ static void
 conn_cleanup(controlconnection_t *conn);
 static void
 conn_free(controlconnection_t *conn);
-static void
-conn_shutdown(controlconnection_t *conn);
 
 #if NAMED_CONTROLCONF_TRACE
 #define controllistener_ref(ptr) \
@@ -149,14 +147,6 @@ ISC_REFCOUNT_DECL(controlconnection);
 
 #define CLOCKSKEW 300
 
-#define CHECK(x)                               \
-	{                                      \
-		result = (x);                  \
-		if (result != ISC_R_SUCCESS) { \
-			goto cleanup;          \
-		}                              \
-	}
-
 static void
 free_controlkey(controlkey_t *key, isc_mem_t *mctx) {
 	if (key->keyname != NULL) {
@@ -179,7 +169,8 @@ free_controlkeylist(controlkeylist_t *keylist, isc_mem_t *mctx) {
 
 static void
 free_listener(controllistener_t *listener) {
-	REQUIRE(listener->shuttingdown);
+	REQUIRE(isc_tid() == 0);
+	REQUIRE(listener->exiting);
 	REQUIRE(ISC_LIST_EMPTY(listener->connections));
 	REQUIRE(listener->sock == NULL);
 
@@ -202,32 +193,28 @@ ISC_REFCOUNT_IMPL(controlconnection, conn_free);
 
 static void
 shutdown_listener(controllistener_t *listener) {
-	controlconnection_t *conn = NULL;
-	controlconnection_t *next = NULL;
+	REQUIRE(isc_tid() == 0);
+	if (!listener->exiting) {
+		char socktext[ISC_SOCKADDR_FORMATSIZE];
 
-	/* Don't shutdown the same listener twice */
-	if (listener->shuttingdown) {
-		return;
+		for (controlconnection_t *conn =
+			     ISC_LIST_HEAD(listener->connections);
+		     conn != NULL; conn = ISC_LIST_HEAD(listener->connections))
+		{
+			control_recvmessage(conn->ccmsg.handle,
+					    ISC_R_SHUTTINGDOWN, conn);
+		}
+
+		ISC_LIST_UNLINK(listener->controls->listeners, listener, link);
+
+		isc_sockaddr_format(&listener->address, socktext,
+				    sizeof(socktext));
+		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+			      NAMED_LOGMODULE_CONTROL, ISC_LOG_NOTICE,
+			      "stopping command channel on %s", socktext);
+
+		listener->exiting = true;
 	}
-	listener->shuttingdown = true;
-
-	for (conn = ISC_LIST_HEAD(listener->connections); conn != NULL;
-	     conn = next)
-	{
-		/*
-		 * 'conn' is likely to be freed by the conn_shutdown() call.
-		 */
-		next = ISC_LIST_NEXT(conn, link);
-		conn_shutdown(conn);
-	}
-
-	ISC_LIST_UNLINK(listener->controls->listeners, listener, link);
-
-	char socktext[ISC_SOCKADDR_FORMATSIZE];
-	isc_sockaddr_format(&listener->address, socktext, sizeof(socktext));
-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-		      NAMED_LOGMODULE_CONTROL, ISC_LOG_NOTICE,
-		      "stopping command channel on %s", socktext);
 
 	isc_nm_stoplistening(listener->sock);
 	isc_nmsocket_close(&listener->sock);
@@ -252,36 +239,35 @@ address_ok(isc_sockaddr_t *sockaddr, controllistener_t *listener) {
 static void
 control_senddone(isc_nmhandle_t *handle, isc_result_t result, void *arg) {
 	controlconnection_t *conn = (controlconnection_t *)arg;
+	controllistener_t *listener = conn->listener;
+	isc_sockaddr_t peeraddr = isc_nmhandle_peeraddr(handle);
 
-	if (conn->shuttingdown) {
-		/* The connection is shuttingdown */
-		result = ISC_R_SHUTTINGDOWN;
+	if (conn->result == ISC_R_SHUTTINGDOWN) {
+		isc_loopmgr_shutdown(named_g_loopmgr);
+		goto cleanup_sendhandle;
 	}
 
-	if (result == ISC_R_SUCCESS) {
-		/* Everything is peachy, continue reading from the socket */
-		isccc_ccmsg_readmessage(&conn->ccmsg, control_recvmessage,
-					conn);
-		/* Detach the sending reference */
-		controlconnection_detach(&conn);
-		return;
-	}
-
-	if (result != ISC_R_SHUTTINGDOWN) {
+	if (listener->controls->shuttingdown || result == ISC_R_SHUTTINGDOWN) {
+		goto cleanup_sendhandle;
+	} else if (result != ISC_R_SUCCESS) {
 		char socktext[ISC_SOCKADDR_FORMATSIZE];
-		isc_sockaddr_t peeraddr = isc_nmhandle_peeraddr(handle);
 
 		isc_sockaddr_format(&peeraddr, socktext, sizeof(socktext));
 		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 			      NAMED_LOGMODULE_CONTROL, ISC_LOG_WARNING,
 			      "error sending command response to %s: %s",
 			      socktext, isc_result_totext(result));
+		goto cleanup_sendhandle;
 	}
 
-	/* Shutdown the reading */
-	conn_shutdown(conn);
+	isccc_ccmsg_readmessage(&conn->ccmsg, control_recvmessage, conn);
 
-	/* Detach the sending reference */
+cleanup_sendhandle:
+	if (result != ISC_R_SUCCESS) {
+		control_recvmessage(handle, result, conn);
+	}
+
+	REQUIRE(isc_tid() == 0);
 	controlconnection_detach(&conn);
 }
 
@@ -388,7 +374,7 @@ control_respond(controlconnection_t *conn) {
 	r.base = conn->buffer->base;
 	r.length = conn->buffer->used;
 
-	/* Attach the sending reference */
+	REQUIRE(isc_tid() == 0);
 	controlconnection_ref(conn);
 	isccc_ccmsg_sendmessage(&conn->ccmsg, &r, control_senddone, conn);
 
@@ -399,33 +385,15 @@ cleanup:
 static void
 control_command(void *arg) {
 	controlconnection_t *conn = (controlconnection_t *)arg;
+	controllistener_t *listener = conn->listener;
 
-	/* Don't run the command if we already started the shutdown */
-	if (!conn->shuttingdown) {
+	if (!listener->controls->shuttingdown) {
 		conn->result = named_control_docommand(
-			conn->request, conn->listener->readonly, &conn->text);
+			conn->request, listener->readonly, &conn->text);
 		control_respond(conn);
 	}
 
-	/* Detach the control command reference */
-	controlconnection_detach(&conn);
-}
-
-static void
-conn_shutdown(controlconnection_t *conn) {
-	/* Don't shutdown the same controlconnection twice */
-	if (conn->shuttingdown) {
-		return;
-	}
-	conn->shuttingdown = true;
-
-	/*
-	 * Close the TCP connection to make sure that no read callback will be
-	 * called for it ever again.
-	 */
-	isccc_ccmsg_disconnect(&conn->ccmsg);
-
-	/* Detach the reading reference */
+	REQUIRE(isc_tid() == 0);
 	controlconnection_detach(&conn);
 }
 
@@ -439,7 +407,19 @@ control_recvmessage(isc_nmhandle_t *handle ISC_ATTR_UNUSED, isc_result_t result,
 	isccc_time_t exp;
 	uint32_t nonce;
 
+	INSIST(!conn->shuttingdown);
+
+	/* Is the server shutting down? */
+	if (listener->controls->shuttingdown) {
+		result = ISC_R_SHUTTINGDOWN;
+	}
+
 	if (result != ISC_R_SUCCESS) {
+		if (result == ISC_R_SHUTTINGDOWN) {
+			listener->controls->shuttingdown = true;
+		} else if (result != ISC_R_EOF) {
+			log_invalid(&conn->ccmsg, result);
+		}
 		goto cleanup;
 	}
 
@@ -465,13 +445,13 @@ control_recvmessage(isc_nmhandle_t *handle ISC_ATTR_UNUSED, isc_result_t result,
 	}
 
 	if (key == NULL) {
-		result = ISCCC_R_BADAUTH;
+		log_invalid(&conn->ccmsg, ISCCC_R_BADAUTH);
 		goto cleanup;
 	}
 
 	/* We shouldn't be getting a reply. */
 	if (isccc_cc_isreply(conn->request)) {
-		result = ISC_R_FAILURE;
+		log_invalid(&conn->ccmsg, ISC_R_FAILURE);
 		goto cleanup;
 	}
 
@@ -482,7 +462,7 @@ control_recvmessage(isc_nmhandle_t *handle ISC_ATTR_UNUSED, isc_result_t result,
 	 */
 	conn->ctrl = isccc_alist_lookup(conn->request, "_ctrl");
 	if (!isccc_alist_alistp(conn->ctrl)) {
-		result = ISC_R_FAILURE;
+		log_invalid(&conn->ccmsg, ISC_R_FAILURE);
 		goto cleanup;
 	}
 
@@ -490,11 +470,11 @@ control_recvmessage(isc_nmhandle_t *handle ISC_ATTR_UNUSED, isc_result_t result,
 		if ((sent + CLOCKSKEW) < conn->now ||
 		    (sent - CLOCKSKEW) > conn->now)
 		{
-			result = ISCCC_R_CLOCKSKEW;
+			log_invalid(&conn->ccmsg, ISCCC_R_CLOCKSKEW);
 			goto cleanup;
 		}
 	} else {
-		result = ISC_R_FAILURE;
+		log_invalid(&conn->ccmsg, ISC_R_FAILURE);
 		goto cleanup;
 	}
 
@@ -504,7 +484,7 @@ control_recvmessage(isc_nmhandle_t *handle ISC_ATTR_UNUSED, isc_result_t result,
 	if (isccc_cc_lookupuint32(conn->ctrl, "_exp", &exp) == ISC_R_SUCCESS &&
 	    conn->now > exp)
 	{
-		result = ISCCC_R_EXPIRED;
+		log_invalid(&conn->ccmsg, ISCCC_R_EXPIRED);
 		goto cleanup;
 	}
 
@@ -520,6 +500,7 @@ control_recvmessage(isc_nmhandle_t *handle ISC_ATTR_UNUSED, isc_result_t result,
 		if (result == ISC_R_EXISTS) {
 			result = ISCCC_R_DUPLICATE;
 		}
+		log_invalid(&conn->ccmsg, result);
 		goto cleanup;
 	}
 
@@ -528,7 +509,7 @@ control_recvmessage(isc_nmhandle_t *handle ISC_ATTR_UNUSED, isc_result_t result,
 		     ISC_R_SUCCESS ||
 	     conn->nonce != nonce))
 	{
-		result = ISCCC_R_BADAUTH;
+		log_invalid(&conn->ccmsg, ISCCC_R_BADAUTH);
 		goto cleanup;
 	}
 
@@ -546,35 +527,31 @@ control_recvmessage(isc_nmhandle_t *handle ISC_ATTR_UNUSED, isc_result_t result,
 		return;
 	}
 
-	/* Attach the command reference */
+	/*
+	 * Trigger the command.
+	 */
+	REQUIRE(isc_tid() == 0);
 	controlconnection_ref(conn);
-
-	/* Trigger the command asynchronously. */
 	isc_async_run(named_g_mainloop, control_command, conn);
 
 	return;
 
 cleanup:
-	switch (result) {
-	case ISC_R_SHUTTINGDOWN:
-	case ISC_R_EOF:
-		break;
-	default:
-		log_invalid(&conn->ccmsg, result);
-	}
+	/* Make sure no read callbacks are called again */
+	isccc_ccmsg_invalidate(&conn->ccmsg);
 
-	conn_shutdown(conn);
+	conn->shuttingdown = true;
+
+	REQUIRE(isc_tid() == 0);
+	controlconnection_detach(&conn);
 }
 
 static void
 conn_free(controlconnection_t *conn) {
-	/* Make sure that the connection was shutdown first */
-	REQUIRE(conn->shuttingdown);
+	REQUIRE(isc_tid() == 0);
 
 	controllistener_t *listener = conn->listener;
 
-	isccc_ccmsg_invalidate(&conn->ccmsg);
-
 	conn_cleanup(conn);
 
 	if (conn->buffer != NULL) {
@@ -599,26 +576,17 @@ conn_free(controlconnection_t *conn) {
 
 static void
 newconnection(controllistener_t *listener, isc_nmhandle_t *handle) {
-	/* Don't create new connection if we are shutting down */
-	if (listener->shuttingdown) {
-		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-			      NAMED_LOGMODULE_CONTROL, ISC_LOG_DEBUG(3),
-			      "rejected new control connection: %s",
-			      isc_result_totext(ISC_R_SHUTTINGDOWN));
-		return;
-	}
+	REQUIRE(isc_tid() == 0);
 
 	controlconnection_t *conn = isc_mem_get(listener->mctx, sizeof(*conn));
 	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 		      NAMED_LOGMODULE_CONTROL, ISC_LOG_DEBUG(3),
 		      "allocate new control connection");
 
-	*conn = (controlconnection_t){
-		.alg = DST_ALG_UNKNOWN,
-		.references = ISC_REFCOUNT_INITIALIZER(1),
-		.listener = controllistener_ref(listener),
-		.link = ISC_LINK_INITIALIZER,
-	};
+	*conn = (controlconnection_t){ .alg = DST_ALG_UNKNOWN };
+
+	isc_refcount_init(&conn->references, 1);
+	controllistener_attach(listener, &conn->listener);
 
 	/* isccc_ccmsg_init() attaches to the handle */
 	isccc_ccmsg_init(listener->mctx, handle, &conn->ccmsg);
@@ -626,9 +594,8 @@ newconnection(controllistener_t *listener, isc_nmhandle_t *handle) {
 	/* Set a 32 KiB upper limit on incoming message. */
 	isccc_ccmsg_setmaxsize(&conn->ccmsg, 32768);
 
-	ISC_LIST_APPEND(listener->connections, conn, link);
+	ISC_LIST_INITANDAPPEND(listener->connections, conn, link);
 
-	/* The reading reference has been initialized in the initializer */
 	isccc_ccmsg_readmessage(&conn->ccmsg, control_recvmessage, conn);
 }
 
@@ -668,7 +635,8 @@ controls_shutdown(named_controls_t *controls) {
 	     listener = next)
 	{
 		/*
-		 * As listeners shut down, they will call their callbacks.
+		 * This is asynchronous.  As listeners shut down, they will
+		 * call their callbacks.
 		 */
 		next = ISC_LIST_NEXT(listener, link);
 		shutdown_listener(listener);
@@ -677,20 +645,8 @@ controls_shutdown(named_controls_t *controls) {
 
 void
 named_controls_shutdown(named_controls_t *controls) {
-	/*
-	 * Don't ever shutdown the controls twice.
-	 *
-	 * NOTE: This functions is called when the server is shutting down, but
-	 * controls_shutdown() can and will be called multiple times - on each
-	 * reconfiguration, the listeners will be torn down and recreated again,
-	 * see named_controls_configure() for details.
-	 */
-	if (controls->shuttingdown) {
-		return;
-	}
-	controls->shuttingdown = true;
-
 	controls_shutdown(controls);
+	controls->shuttingdown = true;
 }
 
 static isc_result_t
@@ -819,6 +775,14 @@ register_keys(const cfg_obj_t *control, const cfg_obj_t *keylist,
 	}
 }
 
+#define CHECK(x)                               \
+	do {                                   \
+		result = (x);                  \
+		if (result != ISC_R_SUCCESS) { \
+			goto cleanup;          \
+		}                              \
+	} while (0)
+
 static isc_result_t
 get_rndckey(isc_mem_t *mctx, controlkeylist_t *keyids) {
 	isc_result_t result;
@@ -1078,12 +1042,6 @@ add_listener(named_controls_t *cp, controllistener_t **listenerp,
 	isc_result_t result = ISC_R_SUCCESS;
 	int pf;
 
-	/* Don't create new listener if we are shutting down */
-	if (cp->shuttingdown) {
-		result = ISC_R_SHUTTINGDOWN;
-		goto shuttingdown;
-	}
-
 	listener = isc_mem_get(mctx, sizeof(*listener));
 	*listener = (controllistener_t){ .controls = cp,
 					 .address = *addr,
@@ -1154,10 +1112,9 @@ add_listener(named_controls_t *cp, controllistener_t **listenerp,
 
 cleanup:
 	isc_refcount_decrement(&listener->references);
-	listener->shuttingdown = true;
+	listener->exiting = true;
 	free_listener(listener);
 
-shuttingdown:
 	if (control != NULL) {
 		cfg_obj_log(control, named_g_lctx, ISC_LOG_WARNING,
 			    "couldn't add command channel %s: %s", socktext,
@@ -1375,7 +1332,6 @@ named_controls_destroy(named_controls_t **ctrlsp) {
 	named_controls_t *controls = *ctrlsp;
 	*ctrlsp = NULL;
 
-	REQUIRE(controls->shuttingdown);
 	REQUIRE(ISC_LIST_EMPTY(controls->listeners));
 
 	LOCK(&controls->symtab_lock);

bin/named/include/named/server.h

@@ -65,7 +65,6 @@ struct named_server {
 	dns_zonemgr_t	  *zonemgr;
 	dns_viewlist_t	   viewlist;
 	dns_kasplist_t	   kasplist;
-	dns_keystorelist_t keystorelist;
 	ns_interfacemgr_t *interfacemgr;
 	dns_db_t	  *in_roothints;
 

bin/named/include/named/zoneconf.h

@@ -28,8 +28,8 @@ ISC_LANG_BEGINDECLS
 isc_result_t
 named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 		     const cfg_obj_t *zconfig, cfg_aclconfctx_t *ac,
-		     dns_kasplist_t *kasplist, dns_keystorelist_t *keystores,
-		     dns_zone_t *zone, dns_zone_t *raw);
+		     dns_kasplist_t *kasplist, dns_zone_t *zone,
+		     dns_zone_t *raw);
 /*%<
  * Configure or reconfigure a zone according to the named.conf
  * data.

bin/named/main.c

@@ -194,7 +194,7 @@ named_main_earlyfatal(const char *format, ...) {
 	}
 	va_end(args);
 
-	_exit(EXIT_FAILURE);
+	exit(1);
 }
 
 noreturn static void
@@ -233,7 +233,7 @@ assertion_failed(const char *file, int line, isc_assertiontype_t type,
 	if (named_g_coreok) {
 		abort();
 	}
-	_exit(EXIT_FAILURE);
+	exit(1);
 }
 
 noreturn static void
@@ -273,7 +273,7 @@ library_fatal_error(const char *file, int line, const char *func,
 	if (named_g_coreok) {
 		abort();
 	}
-	_exit(EXIT_FAILURE);
+	exit(1);
 }
 
 static void
@@ -892,7 +892,7 @@ parse_command_line(int argc, char *argv[]) {
 			printf("# Built-in default values. "
 			       "This is NOT the run-time configuration!\n");
 			printf("%s", named_config_getdefault());
-			exit(EXIT_SUCCESS);
+			exit(0);
 		case 'd':
 			named_g_debuglevel = parse_int(isc_commandline_argument,
 						       "debug "
@@ -955,10 +955,10 @@ parse_command_line(int argc, char *argv[]) {
 			break;
 		case 'v':
 			printversion(false);
-			exit(EXIT_SUCCESS);
+			exit(0);
 		case 'V':
 			printversion(true);
-			exit(EXIT_SUCCESS);
+			exit(0);
 		case 'x':
 			/* Obsolete. No longer in use. Ignore. */
 			break;
@@ -993,7 +993,7 @@ parse_command_line(int argc, char *argv[]) {
 		case '?':
 			usage();
 			if (isc_commandline_option == '?') {
-				exit(EXIT_SUCCESS);
+				exit(0);
 			}
 			p = strchr(NAMED_MAIN_ARGS, isc_commandline_option);
 			if (p == NULL || *++p != ':') {

bin/named/os.c

@@ -428,10 +428,10 @@ named_os_daemonize(void) {
 			char buf;
 			n = read(dfd[0], &buf, 1);
 			if (n == 1) {
-				_exit(EXIT_SUCCESS);
+				_exit(0);
 			}
 		} while (n == -1 && errno == EINTR);
-		_exit(EXIT_FAILURE);
+		_exit(1);
 	}
 	(void)close(dfd[0]);
 

bin/named/server.c

@@ -32,6 +32,7 @@
 #include <systemd/sd-daemon.h>
 #endif
 
+#include <isc/aes.h>
 #include <isc/async.h>
 #include <isc/attributes.h>
 #include <isc/base64.h>
@@ -79,7 +80,6 @@
 #include <dns/journal.h>
 #include <dns/kasp.h>
 #include <dns/keymgr.h>
-#include <dns/keystore.h>
 #include <dns/keytable.h>
 #include <dns/keyvalues.h>
 #include <dns/master.h>
@@ -400,9 +400,6 @@ const char *empty_zones[] = {
 	/* RFC 8375 */
 	"HOME.ARPA",
 
-	/* RFC 9462 */
-	"RESOLVER.ARPA",
-
 	NULL
 };
 
@@ -417,8 +414,7 @@ static isc_result_t
 listenelt_http(const cfg_obj_t *http, const uint16_t family, bool tls,
 	       const ns_listen_tls_params_t *tls_params,
 	       isc_tlsctx_cache_t *tlsctx_cache, in_port_t port,
-	       isc_mem_t *mctx, isc_nm_proxy_type_t proxy,
-	       ns_listenelt_t **target);
+	       isc_mem_t *mctx, ns_listenelt_t **target);
 #endif
 
 static isc_result_t
@@ -445,8 +441,8 @@ static isc_result_t
 configure_zone(const cfg_obj_t *config, const cfg_obj_t *zconfig,
 	       const cfg_obj_t *vconfig, dns_view_t *view,
 	       dns_viewlist_t *viewlist, dns_kasplist_t *kasplist,
-	       dns_keystorelist_t *keystores, cfg_aclconfctx_t *aclconf,
-	       bool added, bool old_rpz_ok, bool modify);
+	       cfg_aclconfctx_t *aclconf, bool added, bool old_rpz_ok,
+	       bool modify);
 
 static void
 configure_zone_setviewcommit(isc_result_t result, const cfg_obj_t *zconfig,
@@ -2791,12 +2787,12 @@ catz_addmodzone_cb(void *arg) {
 	zoneobj = cfg_listelt_value(cfg_list_first(zlist));
 
 	/* Mark view unfrozen so that zone can be added */
+
 	isc_loopmgr_pause(named_g_loopmgr);
 	dns_view_thaw(cz->view);
 	result = configure_zone(cfg->config, zoneobj, cfg->vconfig, cz->view,
 				&cz->cbd->server->viewlist,
-				&cz->cbd->server->kasplist,
-				&cz->cbd->server->keystorelist, cfg->actx, true,
+				&cz->cbd->server->kasplist, cfg->actx, true,
 				false, cz->mod);
 	dns_view_freeze(cz->view);
 	isc_loopmgr_resume(named_g_loopmgr);
@@ -3380,7 +3376,7 @@ create_empty_zone(dns_zone_t *pzone, dns_name_t *name, dns_view_t *view,
 	const cfg_obj_t *obj;
 	const cfg_obj_t *zconfig;
 	const cfg_obj_t *zoptions;
-	const char *default_dbtype[4] = { ZONEDB_DEFAULT };
+	const char *rbt_dbtype[4] = { "rbt" };
 	const char *sep = ": view ";
 	const char *str;
 	const char *viewname = view->name;
@@ -3393,7 +3389,7 @@ create_empty_zone(dns_zone_t *pzone, dns_name_t *name, dns_view_t *view,
 	dns_name_t *ns;
 	dns_name_t *zname;
 	dns_zone_t *zone = NULL;
-	int default_dbtypec = 1;
+	int rbt_dbtypec = 1;
 	isc_result_t result;
 	dns_namereln_t namereln;
 	int order;
@@ -3435,7 +3431,7 @@ create_empty_zone(dns_zone_t *pzone, dns_name_t *name, dns_view_t *view,
 			}
 		}
 		if (db == NULL) {
-			CHECK(dns_db_create(view->mctx, ZONEDB_DEFAULT, name,
+			CHECK(dns_db_create(view->mctx, "rbt", name,
 					    dns_dbtype_zone, view->rdclass, 0,
 					    NULL, &db));
 			CHECK(dns_db_newversion(db, &version));
@@ -3455,15 +3451,15 @@ create_empty_zone(dns_zone_t *pzone, dns_name_t *name, dns_view_t *view,
 	}
 
 	/*
-	 * Is the existing zone ok to use?
+	 * Is the existing zone the ok to use?
 	 */
 	if (pzone != NULL) {
 		unsigned int typec;
-		const char **dbargv = NULL;
+		const char **dbargv;
 
 		if (db != NULL) {
-			typec = default_dbtypec;
-			dbargv = default_dbtype;
+			typec = rbt_dbtypec;
+			dbargv = rbt_dbtype;
 		} else {
 			typec = empty_dbtypec;
 			dbargv = empty_dbtype;
@@ -3979,9 +3975,8 @@ static const char *const response_synonyms[] = { "response", NULL };
 static isc_result_t
 configure_view(dns_view_t *view, dns_viewlist_t *viewlist, cfg_obj_t *config,
 	       cfg_obj_t *vconfig, named_cachelist_t *cachelist,
-	       dns_kasplist_t *kasplist, dns_keystorelist_t *keystores,
-	       const cfg_obj_t *bindkeys, isc_mem_t *mctx,
-	       cfg_aclconfctx_t *actx, bool need_hints) {
+	       dns_kasplist_t *kasplist, const cfg_obj_t *bindkeys,
+	       isc_mem_t *mctx, cfg_aclconfctx_t *actx, bool need_hints) {
 	const cfg_obj_t *maps[4];
 	const cfg_obj_t *cfgmaps[3];
 	const cfg_obj_t *optionmaps[3];
@@ -4039,6 +4034,7 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist, cfg_obj_t *config,
 	unsigned int query_timeout;
 	bool old_rpz_ok = false;
 	dns_dyndbctx_t *dctx = NULL;
+	unsigned int resolver_param;
 	dns_ntatable_t *ntatable = NULL;
 	const char *qminmode = NULL;
 	dns_adb_t *adb = NULL;
@@ -4126,8 +4122,7 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist, cfg_obj_t *config,
 	{
 		const cfg_obj_t *zconfig = cfg_listelt_value(element);
 		CHECK(configure_zone(config, zconfig, vconfig, view, viewlist,
-				     kasplist, keystores, actx, false,
-				     old_rpz_ok, false));
+				     kasplist, actx, false, old_rpz_ok, false));
 		zone_element_latest = element;
 	}
 
@@ -4545,19 +4540,6 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist, cfg_obj_t *config,
 		view->staleanswerclienttimeout = (uint32_t)-1;
 	} else {
 		view->staleanswerclienttimeout = cfg_obj_asuint32(obj);
-
-		/*
-		 * BIND 9 no longer supports non-zero values of
-		 * stale-answer-client-timeout.
-		 */
-		if (view->staleanswerclienttimeout != 0) {
-			view->staleanswerclienttimeout = 0;
-			isc_log_write(
-				named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-				NAMED_LOGMODULE_SERVER, ISC_LOG_WARNING,
-				"BIND 9 no longer supports non-zero values of "
-				"stale-answer-client-timeout, adjusted to 0");
-		}
 	}
 
 	obj = NULL;
@@ -4701,9 +4683,9 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist, cfg_obj_t *config,
 		goto cleanup;
 	}
 
-	CHECK(dns_view_createresolver(view, named_g_netmgr, resopts,
-				      named_g_server->tlsctx_client_cache,
-				      dispatch4, dispatch6));
+	CHECK(dns_view_createresolver(
+		view, named_g_loopmgr, named_g_netmgr, resopts,
+		named_g_server->tlsctx_client_cache, dispatch4, dispatch6));
 
 	if (resstats == NULL) {
 		isc_stats_create(mctx, &resstats, dns_resstatscounter_max);
@@ -4822,6 +4804,27 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist, cfg_obj_t *config,
 	query_timeout = cfg_obj_asuint32(obj);
 	dns_resolver_settimeout(view->resolver, query_timeout);
 
+	/*
+	 * Adjust stale-answer-client-timeout upper bound
+	 * to be resolver-query-timeout - 1s.
+	 * This assignment is safe as dns_resolver_settimeout()
+	 * ensures that resolver->querytimeout value will be in the
+	 * [MINIMUM_QUERY_TIMEOUT, MAXIMUM_QUERY_TIMEOUT] range and
+	 * MINIMUM_QUERY_TIMEOUT is > 1000 (in ms).
+	 */
+	if (view->staleanswerclienttimeout != (uint32_t)-1 &&
+	    view->staleanswerclienttimeout >
+		    (dns_resolver_gettimeout(view->resolver) - 1000))
+	{
+		view->staleanswerclienttimeout =
+			dns_resolver_gettimeout(view->resolver) - 1000;
+		isc_log_write(
+			named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+			NAMED_LOGMODULE_SERVER, ISC_LOG_WARNING,
+			"stale-answer-client-timeout adjusted to %" PRIu32,
+			view->staleanswerclienttimeout);
+	}
+
 	/* Specify whether to use 0-TTL for negative response for SOA query */
 	dns_resolver_setzeronosoattl(view->resolver, zero_no_soattl);
 
@@ -4885,6 +4888,23 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist, cfg_obj_t *config,
 	}
 	view->maxbits = maxbits;
 
+	/*
+	 * Set resolver retry parameters.
+	 */
+	obj = NULL;
+	CHECK(named_config_get(maps, "resolver-retry-interval", &obj));
+	resolver_param = cfg_obj_asuint32(obj);
+	if (resolver_param > 0) {
+		dns_resolver_setretryinterval(view->resolver, resolver_param);
+	}
+
+	obj = NULL;
+	CHECK(named_config_get(maps, "resolver-nonbackoff-tries", &obj));
+	resolver_param = cfg_obj_asuint32(obj);
+	if (resolver_param > 0) {
+		dns_resolver_setnonbackofftries(view->resolver, resolver_param);
+	}
+
 	/*
 	 * Set supported DNSSEC algorithms.
 	 */
@@ -5185,13 +5205,6 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist, cfg_obj_t *config,
 	CHECK(configure_view_acl(vconfig, config, NULL, "allow-query-cache-on",
 				 NULL, actx, named_g_mctx, &view->cacheonacl));
 
-	CHECK(configure_view_acl(vconfig, config, named_g_config, "allow-proxy",
-				 NULL, actx, named_g_mctx, &view->proxyacl));
-
-	CHECK(configure_view_acl(vconfig, config, named_g_config,
-				 "allow-proxy-on", NULL, actx, named_g_mctx,
-				 &view->proxyonacl));
-
 	if (strcmp(view->name, "_bind") != 0 &&
 	    view->rdclass != dns_rdataclass_chaos)
 	{
@@ -5453,21 +5466,6 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist, cfg_obj_t *config,
 	INSIST(result == ISC_R_SUCCESS);
 	dns_resolver_setmaxqueries(view->resolver, cfg_obj_asuint32(obj));
 
-	obj = NULL;
-	result = named_config_get(maps, "max-validations-per-fetch", &obj);
-	if (result == ISC_R_SUCCESS) {
-		dns_resolver_setmaxvalidations(view->resolver,
-					       cfg_obj_asuint32(obj));
-	}
-
-	obj = NULL;
-	result = named_config_get(maps, "max-validation-failures-per-fetch",
-				  &obj);
-	if (result == ISC_R_SUCCESS) {
-		dns_resolver_setmaxvalidationfails(view->resolver,
-						   cfg_obj_asuint32(obj));
-	}
-
 	obj = NULL;
 	result = named_config_get(maps, "fetches-per-zone", &obj);
 	INSIST(result == ISC_R_SUCCESS);
@@ -6442,8 +6440,8 @@ static isc_result_t
 configure_zone(const cfg_obj_t *config, const cfg_obj_t *zconfig,
 	       const cfg_obj_t *vconfig, dns_view_t *view,
 	       dns_viewlist_t *viewlist, dns_kasplist_t *kasplist,
-	       dns_keystorelist_t *keystores, cfg_aclconfctx_t *aclconf,
-	       bool added, bool old_rpz_ok, bool modify) {
+	       cfg_aclconfctx_t *aclconf, bool added, bool old_rpz_ok,
+	       bool modify) {
 	dns_view_t *pview = NULL; /* Production view */
 	dns_zone_t *zone = NULL;  /* New or reused zone */
 	dns_zone_t *raw = NULL;	  /* New or reused raw zone */
@@ -6637,7 +6635,7 @@ configure_zone(const cfg_obj_t *config, const cfg_obj_t *zconfig,
 			dns_zone_setstats(zone, named_g_server->zonestats);
 		}
 		CHECK(named_zone_configure(config, vconfig, zconfig, aclconf,
-					   kasplist, keystores, zone, NULL));
+					   kasplist, zone, NULL));
 		dns_zone_attach(zone, &view->redirect);
 		goto cleanup;
 	}
@@ -6813,7 +6811,7 @@ configure_zone(const cfg_obj_t *config, const cfg_obj_t *zconfig,
 	 * Configure the zone.
 	 */
 	CHECK(named_zone_configure(config, vconfig, zconfig, aclconf, kasplist,
-				   keystores, zone, raw));
+				   zone, raw));
 
 	/*
 	 * Add the zone to its view in the new view list.
@@ -7054,7 +7052,7 @@ tat_done(void *arg) {
 	dns_fetchresponse_t *resp = (dns_fetchresponse_t *)arg;
 	ns_tat_t *tat = NULL;
 
-	INSIST(resp != NULL);
+	INSIST(resp != NULL && resp->type == FETCHDONE);
 
 	tat = resp->arg;
 
@@ -7447,7 +7445,7 @@ generate_session_key(const char *filename, const char *keynamestr,
 
 	/* generate key */
 	result = dst_key_generate(keyname, alg, bits, 1, 0, DNS_KEYPROTO_ANY,
-				  dns_rdataclass_in, NULL, mctx, &key, NULL);
+				  dns_rdataclass_in, mctx, &key, NULL);
 	if (result != ISC_R_SUCCESS) {
 		return (result);
 	}
@@ -7813,8 +7811,7 @@ configure_newzones(dns_view_t *view, cfg_obj_t *config, cfg_obj_t *vconfig,
 		const cfg_obj_t *zconfig = cfg_listelt_value(element);
 		CHECK(configure_zone(config, zconfig, vconfig, view,
 				     &named_g_server->viewlist,
-				     &named_g_server->kasplist,
-				     &named_g_server->keystorelist, actx, true,
+				     &named_g_server->kasplist, actx, true,
 				     false, false));
 	}
 
@@ -7999,8 +7996,7 @@ configure_newzone(const cfg_obj_t *zconfig, cfg_obj_t *config,
 		  cfg_aclconfctx_t *actx) {
 	return (configure_zone(
 		config, zconfig, vconfig, view, &named_g_server->viewlist,
-		&named_g_server->kasplist, &named_g_server->keystorelist, actx,
-		true, false, false));
+		&named_g_server->kasplist, actx, true, false, false));
 }
 
 /*%
@@ -8144,14 +8140,10 @@ load_configuration(const char *filename, named_server_t *server,
 	const cfg_obj_t *options;
 	const cfg_obj_t *usev4ports, *avoidv4ports, *usev6ports, *avoidv6ports;
 	const cfg_obj_t *kasps;
-	const cfg_obj_t *keystores;
 	dns_kasp_t *kasp = NULL;
 	dns_kasp_t *kasp_next = NULL;
 	dns_kasp_t *default_kasp = NULL;
 	dns_kasplist_t tmpkasplist, kasplist;
-	dns_keystore_t *keystore = NULL;
-	dns_keystore_t *keystore_next = NULL;
-	dns_keystorelist_t tmpkeystorelist, keystorelist;
 	const cfg_obj_t *views;
 
 	dns_view_t *view_next = NULL;
@@ -8187,10 +8179,9 @@ load_configuration(const char *filename, named_server_t *server,
 	/*
 	 * Require the reconfiguration to happen always on the main loop
 	 */
-	REQUIRE(isc_loop() == named_g_mainloop);
+	REQUIRE(isc_loop_current(named_g_loopmgr) == named_g_mainloop);
 
 	ISC_LIST_INIT(kasplist);
-	ISC_LIST_INIT(keystorelist);
 	ISC_LIST_INIT(viewlist);
 	ISC_LIST_INIT(builtin_viewlist);
 	ISC_LIST_INIT(cachelist);
@@ -8902,33 +8893,6 @@ load_configuration(const char *filename, named_server_t *server,
 	 */
 	(void)configure_session_key(maps, server, named_g_mctx, first_time);
 
-	/*
-	 * Create the built-in key store ("key-directory").
-	 */
-	result = cfg_keystore_fromconfig(NULL, named_g_mctx, named_g_lctx,
-					 named_g_engine, &keystorelist, NULL);
-	if (result != ISC_R_SUCCESS) {
-		goto cleanup_keystorelist;
-	}
-
-	/*
-	 * Create the DNSSEC key stores.
-	 */
-	keystores = NULL;
-	(void)cfg_map_get(config, "key-store", &keystores);
-	for (element = cfg_list_first(keystores); element != NULL;
-	     element = cfg_list_next(element))
-	{
-		cfg_obj_t *kconfig = cfg_listelt_value(element);
-		keystore = NULL;
-		result = cfg_keystore_fromconfig(kconfig, named_g_mctx,
-						 named_g_lctx, named_g_engine,
-						 &keystorelist, NULL);
-		if (result != ISC_R_SUCCESS) {
-			goto cleanup_keystorelist;
-		}
-	}
-
 	/*
 	 * Create the built-in kasp policies ("default", "insecure").
 	 */
@@ -8942,7 +8906,7 @@ load_configuration(const char *filename, named_server_t *server,
 		kasp = NULL;
 		result = cfg_kasp_fromconfig(kconfig, default_kasp, true,
 					     named_g_mctx, named_g_lctx,
-					     &keystorelist, &kasplist, &kasp);
+					     &kasplist, &kasp);
 		if (result != ISC_R_SUCCESS) {
 			goto cleanup_kasplist;
 		}
@@ -8971,7 +8935,7 @@ load_configuration(const char *filename, named_server_t *server,
 		kasp = NULL;
 		result = cfg_kasp_fromconfig(kconfig, default_kasp, true,
 					     named_g_mctx, named_g_lctx,
-					     &keystorelist, &kasplist, &kasp);
+					     &kasplist, &kasp);
 		if (result != ISC_R_SUCCESS) {
 			goto cleanup_kasplist;
 		}
@@ -8979,15 +8943,8 @@ load_configuration(const char *filename, named_server_t *server,
 		dns_kasp_freeze(kasp);
 		dns_kasp_detach(&kasp);
 	}
+
 	dns_kasp_detach(&default_kasp);
-
-	/*
-	 * Save keystore list and kasp list.
-	 */
-	tmpkeystorelist = server->keystorelist;
-	server->keystorelist = keystorelist;
-	keystorelist = tmpkeystorelist;
-
 	tmpkasplist = server->kasplist;
 	server->kasplist = kasplist;
 	kasplist = tmpkasplist;
@@ -9091,8 +9048,7 @@ load_configuration(const char *filename, named_server_t *server,
 		}
 
 		result = configure_view(view, &viewlist, config, vconfig,
-					&cachelist, &server->kasplist,
-					&server->keystorelist, bindkeys,
+					&cachelist, &server->kasplist, bindkeys,
 					named_g_mctx, named_g_aclconfctx, true);
 		if (result != ISC_R_SUCCESS) {
 			dns_view_detach(&view);
@@ -9113,8 +9069,7 @@ load_configuration(const char *filename, named_server_t *server,
 			goto cleanup_cachelist;
 		}
 		result = configure_view(view, &viewlist, config, NULL,
-					&cachelist, &server->kasplist,
-					&server->keystorelist, bindkeys,
+					&cachelist, &server->kasplist, bindkeys,
 					named_g_mctx, named_g_aclconfctx, true);
 		if (result != ISC_R_SUCCESS) {
 			dns_view_detach(&view);
@@ -9141,10 +9096,10 @@ load_configuration(const char *filename, named_server_t *server,
 			goto cleanup_cachelist;
 		}
 
-		result = configure_view(
-			view, &viewlist, config, vconfig, &cachelist,
-			&server->kasplist, &server->keystorelist, bindkeys,
-			named_g_mctx, named_g_aclconfctx, false);
+		result = configure_view(view, &viewlist, config, vconfig,
+					&cachelist, &server->kasplist, bindkeys,
+					named_g_mctx, named_g_aclconfctx,
+					false);
 		if (result != ISC_R_SUCCESS) {
 			dns_view_detach(&view);
 			goto cleanup_cachelist;
@@ -9463,6 +9418,8 @@ load_configuration(const char *filename, named_server_t *server,
 	INSIST(result == ISC_R_SUCCESS);
 	if (strcasecmp(cfg_obj_asstring(obj), "siphash24") == 0) {
 		server->sctx->cookiealg = ns_cookiealg_siphash24;
+	} else if (strcasecmp(cfg_obj_asstring(obj), "aes") == 0) {
+		server->sctx->cookiealg = ns_cookiealg_aes;
 	} else {
 		UNREACHABLE();
 	}
@@ -9529,6 +9486,21 @@ load_configuration(const char *filename, named_server_t *server,
 					goto cleanup_altsecrets;
 				}
 				break;
+			case ns_cookiealg_aes:
+				expectedlength = ISC_AES128_KEYLENGTH;
+				if (usedlength != expectedlength) {
+					result = ISC_R_RANGE;
+					isc_log_write(
+						named_g_lctx,
+						NAMED_LOGCATEGORY_GENERAL,
+						NAMED_LOGMODULE_SERVER,
+						ISC_LOG_ERROR,
+						"AES cookie-secret must be 128 "
+						"bits: %s",
+						isc_result_totext(result));
+					goto cleanup_altsecrets;
+				}
+				break;
 			}
 		}
 	} else {
@@ -9641,15 +9613,6 @@ cleanup_kasplist:
 		dns_kasp_detach(&kasp);
 	}
 
-cleanup_keystorelist:
-	for (keystore = ISC_LIST_HEAD(keystorelist); keystore != NULL;
-	     keystore = keystore_next)
-	{
-		keystore_next = ISC_LIST_NEXT(keystore, link);
-		ISC_LIST_UNLINK(keystorelist, keystore, link);
-		dns_keystore_detach(&keystore);
-	}
-
 cleanup_v6portset:
 	isc_portset_destroy(named_g_mctx, &v6portset);
 
@@ -9838,7 +9801,8 @@ run_server(void *arg) {
 	named_server_t *server = (named_server_t *)arg;
 	dns_geoip_databases_t *geoip = NULL;
 
-	dns_zonemgr_create(named_g_mctx, named_g_netmgr, &server->zonemgr);
+	dns_zonemgr_create(named_g_mctx, named_g_loopmgr, named_g_netmgr,
+			   &server->zonemgr);
 
 	CHECKFATAL(dns_dispatchmgr_create(named_g_mctx, named_g_loopmgr,
 					  named_g_netmgr, &named_g_dispatchmgr),
@@ -9913,7 +9877,6 @@ shutdown_server(void *arg) {
 	named_server_t *server = (named_server_t *)arg;
 	dns_view_t *view = NULL, *view_next = NULL;
 	dns_kasp_t *kasp = NULL, *kasp_next = NULL;
-	dns_keystore_t *keystore = NULL, *keystore_next = NULL;
 	bool flush = server->flushonshutdown;
 	named_cache_t *nsc = NULL;
 
@@ -9960,14 +9923,6 @@ shutdown_server(void *arg) {
 		dns_kasp_detach(&kasp);
 	}
 
-	for (keystore = ISC_LIST_HEAD(server->keystorelist); keystore != NULL;
-	     keystore = keystore_next)
-	{
-		keystore_next = ISC_LIST_NEXT(keystore, link);
-		ISC_LIST_UNLINK(server->keystorelist, keystore, link);
-		dns_keystore_detach(&keystore);
-	}
-
 	for (view = ISC_LIST_HEAD(server->viewlist); view != NULL;
 	     view = view_next)
 	{
@@ -10074,7 +10029,6 @@ named_server_create(isc_mem_t *mctx, named_server_t **serverp) {
 
 	/* Initialize server data structures. */
 	ISC_LIST_INIT(server->kasplist);
-	ISC_LIST_INIT(server->keystorelist);
 	ISC_LIST_INIT(server->viewlist);
 
 	/* Must be first. */
@@ -10183,7 +10137,6 @@ named_server_destroy(named_server_t **serverp) {
 	dst_lib_destroy();
 
 	INSIST(ISC_LIST_EMPTY(server->kasplist));
-	INSIST(ISC_LIST_EMPTY(server->keystorelist));
 	INSIST(ISC_LIST_EMPTY(server->viewlist));
 	INSIST(ISC_LIST_EMPTY(server->cachelist));
 
@@ -10212,7 +10165,8 @@ fatal(const char *msg, isc_result_t result) {
 		      NAMED_LOGMODULE_SERVER, ISC_LOG_CRITICAL,
 		      "exiting (due to fatal error)");
 	named_os_shutdown();
-	_exit(EXIT_FAILURE);
+	isc__tls_setfatalmode();
+	exit(1);
 }
 
 static isc_result_t
@@ -10855,10 +10809,9 @@ listenelt_fromconfig(const cfg_obj_t *listener, const cfg_obj_t *config,
 	const cfg_obj_t *tlsobj = NULL, *httpobj = NULL;
 	const cfg_obj_t *portobj = NULL;
 	const cfg_obj_t *http_server = NULL;
-	const cfg_obj_t *proxyobj = NULL;
 	in_port_t port = 0;
 	const char *key = NULL, *cert = NULL, *ca_file = NULL,
-		   *dhparam_file = NULL, *ciphers = NULL, *cipher_suites = NULL;
+		   *dhparam_file = NULL, *ciphers = NULL;
 	bool tls_prefer_server_ciphers = false,
 	     tls_prefer_server_ciphers_set = false;
 	bool tls_session_tickets = false, tls_session_tickets_set = false;
@@ -10867,7 +10820,6 @@ listenelt_fromconfig(const cfg_obj_t *listener, const cfg_obj_t *config,
 	uint32_t tls_protos = 0;
 	ns_listen_tls_params_t tls_params = { 0 };
 	const char *tlsname = NULL;
-	isc_nm_proxy_type_t proxy = ISC_NM_PROXY_NONE;
 
 	REQUIRE(target != NULL && *target == NULL);
 
@@ -10888,7 +10840,6 @@ listenelt_fromconfig(const cfg_obj_t *listener, const cfg_obj_t *config,
 			const cfg_obj_t *tlsmap = NULL;
 			const cfg_obj_t *tls_proto_list = NULL;
 			const cfg_obj_t *ciphers_obj = NULL;
-			const cfg_obj_t *cipher_suites_obj = NULL;
 			const cfg_obj_t *prefer_server_ciphers_obj = NULL;
 			const cfg_obj_t *session_tickets_obj = NULL;
 
@@ -10949,13 +10900,6 @@ listenelt_fromconfig(const cfg_obj_t *listener, const cfg_obj_t *config,
 				ciphers = cfg_obj_asstring(ciphers_obj);
 			}
 
-			if (cfg_map_get(tlsmap, "cipher-suites",
-					&cipher_suites_obj) == ISC_R_SUCCESS)
-			{
-				cipher_suites =
-					cfg_obj_asstring(cipher_suites_obj);
-			}
-
 			if (cfg_map_get(tlsmap, "prefer-server-ciphers",
 					&prefer_server_ciphers_obj) ==
 			    ISC_R_SUCCESS)
@@ -10983,7 +10927,6 @@ listenelt_fromconfig(const cfg_obj_t *listener, const cfg_obj_t *config,
 		.protocols = tls_protos,
 		.dhparam_file = dhparam_file,
 		.ciphers = ciphers,
-		.cipher_suites = cipher_suites,
 		.prefer_server_ciphers = tls_prefer_server_ciphers,
 		.prefer_server_ciphers_set = tls_prefer_server_ciphers_set,
 		.session_tickets = tls_session_tickets,
@@ -11060,31 +11003,16 @@ listenelt_fromconfig(const cfg_obj_t *listener, const cfg_obj_t *config,
 		port = (in_port_t)cfg_obj_asuint32(portobj);
 	}
 
-	proxyobj = cfg_tuple_get(ltup, "proxy");
-	if (proxyobj != NULL && cfg_obj_isstring(proxyobj)) {
-		const char *proxyval = cfg_obj_asstring(proxyobj);
-
-		if (strcasecmp(proxyval, "encrypted") == 0) {
-			INSIST(do_tls == true);
-			proxy = ISC_NM_PROXY_ENCRYPTED;
-		} else if (strcasecmp(proxyval, "plain") == 0) {
-			proxy = ISC_NM_PROXY_PLAIN;
-		} else {
-			UNREACHABLE();
-		}
-	}
-
 #ifdef HAVE_LIBNGHTTP2
 	if (http) {
 		CHECK(listenelt_http(http_server, family, do_tls, &tls_params,
-				     tlsctx_cache, port, mctx, proxy, &delt));
+				     tlsctx_cache, port, mctx, &delt));
 	}
 #endif /* HAVE_LIBNGHTTP2 */
 
 	if (!http) {
 		CHECK(ns_listenelt_create(mctx, port, NULL, family, do_tls,
-					  &tls_params, tlsctx_cache, proxy,
-					  &delt));
+					  &tls_params, tlsctx_cache, &delt));
 	}
 
 	result = cfg_acl_fromconfig(cfg_tuple_get(listener, "acl"), config,
@@ -11105,8 +11033,7 @@ static isc_result_t
 listenelt_http(const cfg_obj_t *http, const uint16_t family, bool tls,
 	       const ns_listen_tls_params_t *tls_params,
 	       isc_tlsctx_cache_t *tlsctx_cache, in_port_t port,
-	       isc_mem_t *mctx, isc_nm_proxy_type_t proxy,
-	       ns_listenelt_t **target) {
+	       isc_mem_t *mctx, ns_listenelt_t **target) {
 	isc_result_t result = ISC_R_SUCCESS;
 	ns_listenelt_t *delt = NULL;
 	char **endpoints = NULL;
@@ -11171,9 +11098,9 @@ listenelt_http(const cfg_obj_t *http, const uint16_t family, bool tls,
 
 	INSIST(i == len);
 
-	result = ns_listenelt_create_http(
-		mctx, port, NULL, family, tls, tls_params, tlsctx_cache, proxy,
-		endpoints, len, max_clients, max_streams, &delt);
+	result = ns_listenelt_create_http(mctx, port, NULL, family, tls,
+					  tls_params, tlsctx_cache, endpoints,
+					  len, max_clients, max_streams, &delt);
 	if (result != ISC_R_SUCCESS) {
 		goto error;
 	}
@@ -12071,8 +11998,8 @@ named_server_flushnode(named_server_t *server, isc_lex_t *lex, bool tree) {
 isc_result_t
 named_server_status(named_server_t *server, isc_buffer_t **text) {
 	isc_result_t result;
-	unsigned int zonecount, xferrunning, xferdeferred, xferfirstrefresh;
-	unsigned int soaqueries, automatic;
+	unsigned int zonecount, xferrunning, xferdeferred, soaqueries;
+	unsigned int automatic;
 	const char *ob = "", *cb = "", *alt = "";
 	char boottime[ISC_FORMATHTTPTIMESTAMP_SIZE];
 	char configtime[ISC_FORMATHTTPTIMESTAMP_SIZE];
@@ -12095,8 +12022,6 @@ named_server_status(named_server_t *server, isc_buffer_t **text) {
 					   DNS_ZONESTATE_XFERRUNNING);
 	xferdeferred = dns_zonemgr_getcount(server->zonemgr,
 					    DNS_ZONESTATE_XFERDEFERRED);
-	xferfirstrefresh = dns_zonemgr_getcount(server->zonemgr,
-						DNS_ZONESTATE_XFERFIRSTREFRESH);
 	soaqueries = dns_zonemgr_getcount(server->zonemgr,
 					  DNS_ZONESTATE_SOAQUERY);
 	automatic = dns_zonemgr_getcount(server->zonemgr,
@@ -12153,10 +12078,6 @@ named_server_status(named_server_t *server, isc_buffer_t **text) {
 	snprintf(line, sizeof(line), "xfers deferred: %u\n", xferdeferred);
 	CHECK(putstr(text, line));
 
-	snprintf(line, sizeof(line), "xfers first refresh: %u\n",
-		 xferfirstrefresh);
-	CHECK(putstr(text, line));
-
 	snprintf(line, sizeof(line), "soa queries in progress: %u\n",
 		 soaqueries);
 	CHECK(putstr(text, line));
@@ -13431,9 +13352,8 @@ do_addzone(named_server_t *server, ns_cfgctx_t *cfg, dns_view_t *view,
 	/* Mark view unfrozen and configure zone */
 	dns_view_thaw(view);
 	result = configure_zone(cfg->config, zoneobj, cfg->vconfig, view,
-				&server->viewlist, &server->kasplist,
-				&server->keystorelist, cfg->actx, true, false,
-				false);
+				&server->viewlist, &server->kasplist, cfg->actx,
+				true, false, false);
 	dns_view_freeze(view);
 
 	isc_loopmgr_resume(named_g_loopmgr);
@@ -13617,9 +13537,8 @@ do_modzone(named_server_t *server, ns_cfgctx_t *cfg, dns_view_t *view,
 	/* Reconfigure the zone */
 	dns_view_thaw(view);
 	result = configure_zone(cfg->config, zoneobj, cfg->vconfig, view,
-				&server->viewlist, &server->kasplist,
-				&server->keystorelist, cfg->actx, true, false,
-				true);
+				&server->viewlist, &server->kasplist, cfg->actx,
+				true, false, true);
 	dns_view_freeze(view);
 
 	isc_loopmgr_resume(named_g_loopmgr);
@@ -14643,6 +14562,7 @@ named_server_dnssec(named_server_t *server, isc_lex_t *lex,
 	char output[4096];
 	isc_stdtime_t now, when;
 	isc_time_t timenow, timewhen;
+	const char *dir;
 	dns_db_t *db = NULL;
 	dns_dbversion_t *version = NULL;
 
@@ -14777,6 +14697,7 @@ named_server_dnssec(named_server_t *server, isc_lex_t *lex,
 	}
 
 	/* Get DNSSEC keys. */
+	dir = dns_zone_getkeydirectory(zone);
 	CHECK(dns_zone_getdb(zone, &db));
 	dns_db_currentversion(db, &version);
 	LOCK(&kasp->lock);
@@ -14808,11 +14729,11 @@ named_server_dnssec(named_server_t *server, isc_lex_t *lex,
 
 		LOCK(&kasp->lock);
 		if (use_keyid) {
-			result = dns_keymgr_checkds_id(kasp, &keys, now, when,
-						       dspublish, keyid,
+			result = dns_keymgr_checkds_id(kasp, &keys, dir, now,
+						       when, dspublish, keyid,
 						       (unsigned int)algorithm);
 		} else {
-			result = dns_keymgr_checkds(kasp, &keys, now, when,
+			result = dns_keymgr_checkds(kasp, &keys, dir, now, when,
 						    dspublish);
 		}
 		UNLOCK(&kasp->lock);
@@ -14863,7 +14784,7 @@ named_server_dnssec(named_server_t *server, isc_lex_t *lex,
 		isc_result_t ret;
 
 		LOCK(&kasp->lock);
-		result = dns_keymgr_rollover(kasp, &keys, now, when, keyid,
+		result = dns_keymgr_rollover(kasp, &keys, dir, now, when, keyid,
 					     (unsigned int)algorithm);
 		UNLOCK(&kasp->lock);
 
@@ -15332,8 +15253,6 @@ named_server_nta(named_server_t *server, isc_lex_t *lex, bool readonly,
 	 * If -dump was specified, list NTA's and return
 	 */
 	if (dump) {
-		size_t last = 0;
-
 		for (view = ISC_LIST_HEAD(server->viewlist); view != NULL;
 		     view = ISC_LIST_NEXT(view, link))
 		{
@@ -15345,12 +15264,6 @@ named_server_nta(named_server_t *server, isc_lex_t *lex, bool readonly,
 				continue;
 			}
 
-			if (last != isc_buffer_usedlength(*text)) {
-				CHECK(putstr(text, "\n"));
-			}
-
-			last = isc_buffer_usedlength(*text);
-
 			CHECK(dns_ntatable_totext(ntatable, view->name, text));
 		}
 		CHECK(putnull(text));

bin/named/statschannel.c

@@ -611,10 +611,6 @@ init_desc(void) {
 	SET_SOCKSTATDESC(udp6active, "UDP/IPv6 sockets active", "UDP6Active");
 	SET_SOCKSTATDESC(tcp4active, "TCP/IPv4 sockets active", "TCP4Active");
 	SET_SOCKSTATDESC(tcp6active, "TCP/IPv6 sockets active", "TCP6Active");
-	SET_SOCKSTATDESC(tcp4clients, "TCP/IPv4 clients currently connected",
-			 "TCP4Clients");
-	SET_SOCKSTATDESC(tcp6clients, "TCP/IPv6 clients currently connected",
-			 "TCP6Clients");
 	INSIST(i == isc_sockstatscounter_max);
 
 	/* Initialize DNSSEC statistics */
@@ -1470,7 +1466,7 @@ xfrin_xmlrender(dns_zone_t *zone, void *arg) {
 	dns_zonestat_level_t statlevel;
 	int xmlrc;
 	dns_xfrin_t *xfr = NULL;
-	bool is_firstrefresh, is_running, is_deferred, is_presoa, is_pending;
+	bool is_running, is_deferred, is_presoa, is_pending;
 	bool needs_refresh;
 	bool is_first_data_received, is_ixfr;
 	unsigned int nmsg = 0;
@@ -1482,9 +1478,8 @@ xfrin_xmlrender(dns_zone_t *zone, void *arg) {
 		return (ISC_R_SUCCESS);
 	}
 
-	if (dns_zone_getxfr(zone, &xfr, &is_firstrefresh, &is_running,
-			    &is_deferred, &is_presoa, &is_pending,
-			    &needs_refresh) != ISC_R_SUCCESS)
+	if (dns_zone_getxfr(zone, &xfr, &is_running, &is_deferred, &is_presoa,
+			    &is_pending, &needs_refresh) != ISC_R_SUCCESS)
 	{
 		/*
 		 * Failed to get information about the zone's incoming transfer
@@ -1551,11 +1546,6 @@ xfrin_xmlrender(dns_zone_t *zone, void *arg) {
 	}
 	TRY0(xmlTextWriterEndElement(writer));
 
-	TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "firstrefresh"));
-	TRY0(xmlTextWriterWriteString(
-		writer, ISC_XMLCHAR(is_firstrefresh ? "Yes" : "No")));
-	TRY0(xmlTextWriterEndElement(writer));
-
 	TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "state"));
 	if (is_running) {
 		const char *xfr_state = NULL;
@@ -2544,7 +2534,7 @@ xfrin_jsonrender(dns_zone_t *zone, void *arg) {
 	dns_transport_type_t transport_type;
 	dns_zonestat_level_t statlevel;
 	dns_xfrin_t *xfr = NULL;
-	bool is_firstrefresh, is_running, is_deferred, is_presoa, is_pending;
+	bool is_running, is_deferred, is_presoa, is_pending;
 	bool needs_refresh;
 	bool is_first_data_received, is_ixfr;
 	unsigned int nmsg = 0;
@@ -2576,9 +2566,8 @@ xfrin_jsonrender(dns_zone_t *zone, void *arg) {
 		goto cleanup;
 	}
 
-	result = dns_zone_getxfr(zone, &xfr, &is_firstrefresh, &is_running,
-				 &is_deferred, &is_presoa, &is_pending,
-				 &needs_refresh);
+	result = dns_zone_getxfr(zone, &xfr, &is_running, &is_deferred,
+				 &is_presoa, &is_pending, &needs_refresh);
 	if (result != ISC_R_SUCCESS) {
 		result = ISC_R_SUCCESS;
 		goto cleanup;
@@ -2604,10 +2593,6 @@ xfrin_jsonrender(dns_zone_t *zone, void *arg) {
 		}
 	}
 
-	json_object_object_add(
-		xfrinobj, "firstrefresh",
-		json_object_new_string(is_firstrefresh ? "Yes" : "No"));
-
 	if (is_running) {
 		const char *xfr_state = NULL;
 

bin/named/transportconf.c

@@ -120,13 +120,11 @@ add_doh_transports(const cfg_obj_t *transportlist, dns_transport_list_t *list) {
 					     dns_transport_set_tls_versions);
 		parse_transport_option(doh, transport, "ciphers",
 				       dns_transport_set_ciphers);
-		parse_transport_option(doh, transport, "cipher-suites",
-				       dns_transport_set_cipher_suites);
 		parse_transport_bool_option(
 			doh, transport, "prefer-server-ciphers",
-			dns_transport_set_prefer_server_ciphers);
-		parse_transport_option(doh, transport, "ca-file",
-				       dns_transport_set_cafile);
+			dns_transport_set_prefer_server_ciphers)
+			parse_transport_option(doh, transport, "ca-file",
+					       dns_transport_set_cafile);
 		parse_transport_option(doh, transport, "remote-hostname",
 				       dns_transport_set_remote_hostname);
 	}
@@ -174,13 +172,11 @@ add_tls_transports(const cfg_obj_t *transportlist, dns_transport_list_t *list) {
 					     dns_transport_set_tls_versions);
 		parse_transport_option(tls, transport, "ciphers",
 				       dns_transport_set_ciphers);
-		parse_transport_option(tls, transport, "cipher-suites",
-				       dns_transport_set_cipher_suites);
 		parse_transport_bool_option(
 			tls, transport, "prefer-server-ciphers",
-			dns_transport_set_prefer_server_ciphers);
-		parse_transport_option(tls, transport, "ca-file",
-				       dns_transport_set_cafile);
+			dns_transport_set_prefer_server_ciphers)
+			parse_transport_option(tls, transport, "ca-file",
+					       dns_transport_set_cafile);
 		parse_transport_option(tls, transport, "remote-hostname",
 				       dns_transport_set_remote_hostname);
 	}

bin/named/zoneconf.c

@@ -866,8 +866,8 @@ process_notifytype(dns_notifytype_t ntype, dns_zonetype_t ztype,
 isc_result_t
 named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 		     const cfg_obj_t *zconfig, cfg_aclconfctx_t *ac,
-		     dns_kasplist_t *kasplist, dns_keystorelist_t *keystorelist,
-		     dns_zone_t *zone, dns_zone_t *raw) {
+		     dns_kasplist_t *kasplist, dns_zone_t *zone,
+		     dns_zone_t *raw) {
 	isc_result_t result;
 	const char *zname;
 	dns_rdataclass_t zclass;
@@ -885,7 +885,7 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 	uint32_t count;
 	unsigned int dbargc;
 	char **dbargv;
-	static char default_dbtype[] = ZONEDB_DEFAULT;
+	static char default_dbtype[] = "rbt";
 	static char dlz_dbtype[] = "dlz";
 	char *cpval = default_dbtype;
 	isc_mem_t *mctx = dns_zone_getmctx(zone);
@@ -1576,8 +1576,6 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 			filename = cfg_obj_asstring(obj);
 			CHECK(dns_zone_setkeydirectory(zone, filename));
 		}
-		/* Also save a reference to the keystore list. */
-		dns_zone_setkeystores(zone, keystorelist);
 
 		obj = NULL;
 		result = named_config_get(maps, "sig-signing-signatures", &obj);

bin/nsupdate/nsupdate.c

@@ -102,8 +102,6 @@
 
 #define DNSDEFAULTPORT 53
 
-#define DEFAULT_EDNS_BUFSIZE 1232
-
 /* Number of addresses to request from isc_getaddresses() */
 #define MAX_SERVERADDRS 4
 
@@ -177,8 +175,6 @@ static isc_mutex_t answer_lock;
 static dns_message_t *answer = NULL;
 static uint32_t default_ttl = 0;
 static bool default_ttl_set = false;
-static uint32_t lease = 0, keylease = 0;
-static bool lease_set = false, keylease_set = false;
 static bool checknames = true;
 static bool checksvcb = true;
 static const char *resolvconf = RESOLV_CONF;
@@ -279,7 +275,8 @@ fatal(const char *format, ...) {
 	vfprintf(stderr, format, args);
 	va_end(args);
 	fprintf(stderr, "\n");
-	_exit(EXIT_FAILURE);
+	isc__tls_setfatalmode();
+	exit(1);
 }
 
 static void
@@ -382,13 +379,13 @@ reset_system(void) {
 }
 
 static bool
-parse_hmac(const char *hmacstr, size_t len, dst_algorithm_t *hmac_alg,
+parse_hmac(const char *hmacstr, size_t len, dst_algorithm_t *hmac,
 	   uint16_t *digestbitsp) {
 	uint16_t digestbits = 0;
 	isc_result_t result;
 	char buf[20];
 
-	REQUIRE(hmac_alg != NULL);
+	REQUIRE(hmac != NULL);
 	REQUIRE(hmacstr != NULL);
 
 	if (len >= sizeof(buf)) {
@@ -400,9 +397,9 @@ parse_hmac(const char *hmacstr, size_t len, dst_algorithm_t *hmac_alg,
 	strlcpy(buf, hmacstr, ISC_MIN(len + 1, sizeof(buf)));
 
 	if (strcasecmp(buf, "hmac-md5") == 0) {
-		*hmac_alg = DST_ALG_HMACMD5;
+		*hmac = DST_ALG_HMACMD5;
 	} else if (strncasecmp(buf, "hmac-md5-", 9) == 0) {
-		*hmac_alg = DST_ALG_HMACMD5;
+		*hmac = DST_ALG_HMACMD5;
 		result = isc_parse_uint16(&digestbits, &buf[9], 10);
 		if (result != ISC_R_SUCCESS || digestbits > 128) {
 			error("digest-bits out of range [0..128]");
@@ -410,9 +407,9 @@ parse_hmac(const char *hmacstr, size_t len, dst_algorithm_t *hmac_alg,
 		}
 		*digestbitsp = (digestbits + 7) & ~0x7U;
 	} else if (strcasecmp(buf, "hmac-sha1") == 0) {
-		*hmac_alg = DST_ALG_HMACSHA1;
+		*hmac = DST_ALG_HMACSHA1;
 	} else if (strncasecmp(buf, "hmac-sha1-", 10) == 0) {
-		*hmac_alg = DST_ALG_HMACSHA1;
+		*hmac = DST_ALG_HMACSHA1;
 		result = isc_parse_uint16(&digestbits, &buf[10], 10);
 		if (result != ISC_R_SUCCESS || digestbits > 160) {
 			error("digest-bits out of range [0..160]");
@@ -420,9 +417,9 @@ parse_hmac(const char *hmacstr, size_t len, dst_algorithm_t *hmac_alg,
 		}
 		*digestbitsp = (digestbits + 7) & ~0x7U;
 	} else if (strcasecmp(buf, "hmac-sha224") == 0) {
-		*hmac_alg = DST_ALG_HMACSHA224;
+		*hmac = DST_ALG_HMACSHA224;
 	} else if (strncasecmp(buf, "hmac-sha224-", 12) == 0) {
-		*hmac_alg = DST_ALG_HMACSHA224;
+		*hmac = DST_ALG_HMACSHA224;
 		result = isc_parse_uint16(&digestbits, &buf[12], 10);
 		if (result != ISC_R_SUCCESS || digestbits > 224) {
 			error("digest-bits out of range [0..224]");
@@ -430,9 +427,9 @@ parse_hmac(const char *hmacstr, size_t len, dst_algorithm_t *hmac_alg,
 		}
 		*digestbitsp = (digestbits + 7) & ~0x7U;
 	} else if (strcasecmp(buf, "hmac-sha256") == 0) {
-		*hmac_alg = DST_ALG_HMACSHA256;
+		*hmac = DST_ALG_HMACSHA256;
 	} else if (strncasecmp(buf, "hmac-sha256-", 12) == 0) {
-		*hmac_alg = DST_ALG_HMACSHA256;
+		*hmac = DST_ALG_HMACSHA256;
 		result = isc_parse_uint16(&digestbits, &buf[12], 10);
 		if (result != ISC_R_SUCCESS || digestbits > 256) {
 			error("digest-bits out of range [0..256]");
@@ -440,9 +437,9 @@ parse_hmac(const char *hmacstr, size_t len, dst_algorithm_t *hmac_alg,
 		}
 		*digestbitsp = (digestbits + 7) & ~0x7U;
 	} else if (strcasecmp(buf, "hmac-sha384") == 0) {
-		*hmac_alg = DST_ALG_HMACSHA384;
+		*hmac = DST_ALG_HMACSHA384;
 	} else if (strncasecmp(buf, "hmac-sha384-", 12) == 0) {
-		*hmac_alg = DST_ALG_HMACSHA384;
+		*hmac = DST_ALG_HMACSHA384;
 		result = isc_parse_uint16(&digestbits, &buf[12], 10);
 		if (result != ISC_R_SUCCESS || digestbits > 384) {
 			error("digest-bits out of range [0..384]");
@@ -450,9 +447,9 @@ parse_hmac(const char *hmacstr, size_t len, dst_algorithm_t *hmac_alg,
 		}
 		*digestbitsp = (digestbits + 7) & ~0x7U;
 	} else if (strcasecmp(buf, "hmac-sha512") == 0) {
-		*hmac_alg = DST_ALG_HMACSHA512;
+		*hmac = DST_ALG_HMACSHA512;
 	} else if (strncasecmp(buf, "hmac-sha512-", 12) == 0) {
-		*hmac_alg = DST_ALG_HMACSHA512;
+		*hmac = DST_ALG_HMACSHA512;
 		result = isc_parse_uint16(&digestbits, &buf[12], 10);
 		if (result != ISC_R_SUCCESS || digestbits > 512) {
 			error("digest-bits out of range [0..512]");
@@ -492,7 +489,7 @@ setup_keystr(void) {
 	dns_fixedname_t fkeyname;
 	dns_name_t *mykeyname = NULL;
 	char *name = NULL;
-	dst_algorithm_t hmac_alg;
+	dst_algorithm_t hmac;
 	uint16_t digestbits = 0;
 
 	mykeyname = dns_fixedname_initname(&fkeyname);
@@ -511,11 +508,11 @@ setup_keystr(void) {
 		}
 		name = secretstr;
 		secretstr = n + 1;
-		if (!parse_hmac(keystr, s - keystr, &hmac_alg, &digestbits)) {
-			exit(EXIT_FAILURE);
+		if (!parse_hmac(keystr, s - keystr, &hmac, &digestbits)) {
+			exit(1);
 		}
 	} else {
-		hmac_alg = DST_ALG_HMACMD5;
+		hmac = DST_ALG_HMACMD5;
 		name = keystr;
 		n = s;
 	}
@@ -542,8 +539,8 @@ setup_keystr(void) {
 	secretlen = isc_buffer_usedlength(&secretbuf);
 
 	debug("keycreate");
-	result = dns_tsigkey_create(mykeyname, hmac_alg, secret, secretlen,
-				    gmctx, &tsigkey);
+	result = dns_tsigkey_create(mykeyname, hmac, secret, secretlen, gmctx,
+				    &tsigkey);
 	if (result != ISC_R_SUCCESS) {
 		fprintf(stderr, "could not create key from %s: %s\n", keystr,
 			isc_result_totext(result));
@@ -626,7 +623,7 @@ static void
 setup_keyfile(isc_mem_t *mctx, isc_log_t *lctx) {
 	dst_key_t *dstkey = NULL;
 	isc_result_t result;
-	dst_algorithm_t hmac_alg = DST_ALG_UNKNOWN;
+	dst_algorithm_t hmac = DST_ALG_UNKNOWN;
 
 	debug("Creating key...");
 
@@ -662,7 +659,7 @@ setup_keyfile(isc_mem_t *mctx, isc_log_t *lctx) {
 	case DST_ALG_HMACSHA256:
 	case DST_ALG_HMACSHA384:
 	case DST_ALG_HMACSHA512:
-		hmac_alg = dst_key_alg(dstkey);
+		hmac = dst_key_alg(dstkey);
 		break;
 	default:
 		dst_key_attach(dstkey, &sig0key);
@@ -670,9 +667,9 @@ setup_keyfile(isc_mem_t *mctx, isc_log_t *lctx) {
 		return;
 	}
 
-	result = dns_tsigkey_createfromkey(dst_key_name(dstkey), hmac_alg,
-					   dstkey, false, false, NULL, 0, 0,
-					   mctx, &tsigkey);
+	result = dns_tsigkey_createfromkey(dst_key_name(dstkey), hmac, dstkey,
+					   false, false, NULL, 0, 0, mctx,
+					   &tsigkey);
 	dst_key_free(&dstkey);
 	if (result != ISC_R_SUCCESS) {
 		fprintf(stderr, "could not create key from %s: %s\n", keyfile,
@@ -1053,7 +1050,7 @@ pre_parse_args(int argc, char **argv) {
 					"[-A tlscafile] [-H tlshostname] "
 					"[-O] ] [-v] [-V] [-P] [-T] [-4 | -6] "
 					"[filename]\n");
-			exit(EXIT_FAILURE);
+			exit(1);
 
 		case 'P':
 			for (t = 0xff00; t <= 0xfffe; t++) {
@@ -1091,7 +1088,7 @@ pre_parse_args(int argc, char **argv) {
 		}
 	}
 	if (doexit) {
-		exit(EXIT_SUCCESS);
+		exit(0);
 	}
 	isc_commandline_reset = true;
 	isc_commandline_index = 1;
@@ -1166,7 +1163,7 @@ parse_args(int argc, char **argv) {
 					"bad library debug value "
 					"'%s'\n",
 					isc_commandline_argument);
-				exit(EXIT_FAILURE);
+				exit(1);
 			}
 			logdebuglevel = i;
 			break;
@@ -1197,7 +1194,7 @@ parse_args(int argc, char **argv) {
 					"bad port number "
 					"'%s'\n",
 					isc_commandline_argument);
-				exit(EXIT_FAILURE);
+				exit(1);
 			}
 			break;
 		case 'S':
@@ -1209,7 +1206,7 @@ parse_args(int argc, char **argv) {
 			if (result != ISC_R_SUCCESS) {
 				fprintf(stderr, "bad timeout '%s'\n",
 					isc_commandline_argument);
-				exit(EXIT_FAILURE);
+				exit(1);
 			}
 			if (timeout == 0) {
 				timeout = UINT_MAX;
@@ -1221,7 +1218,7 @@ parse_args(int argc, char **argv) {
 			if (result != ISC_R_SUCCESS) {
 				fprintf(stderr, "bad udp timeout '%s'\n",
 					isc_commandline_argument);
-				exit(EXIT_FAILURE);
+				exit(1);
 			}
 			break;
 		case 'r':
@@ -1230,7 +1227,7 @@ parse_args(int argc, char **argv) {
 			if (result != ISC_R_SUCCESS) {
 				fprintf(stderr, "bad udp retries '%s'\n",
 					isc_commandline_argument);
-				exit(EXIT_FAILURE);
+				exit(1);
 			}
 			break;
 
@@ -1241,19 +1238,19 @@ parse_args(int argc, char **argv) {
 		default:
 			fprintf(stderr, "%s: unhandled option: %c\n", argv[0],
 				isc_commandline_option);
-			exit(EXIT_FAILURE);
+			exit(1);
 		}
 	}
 	if (keyfile != NULL && keystr != NULL) {
 		fprintf(stderr, "%s: cannot specify both -k and -y\n", argv[0]);
-		exit(EXIT_FAILURE);
+		exit(1);
 	}
 
 #if HAVE_GSSAPI
 	if (usegsstsig && (keyfile != NULL || keystr != NULL)) {
 		fprintf(stderr, "%s: cannot specify -g with -k or -y\n",
 			argv[0]);
-		exit(EXIT_FAILURE);
+		exit(1);
 	}
 #else  /* HAVE_GSSAPI */
 	if (usegsstsig) {
@@ -1261,7 +1258,7 @@ parse_args(int argc, char **argv) {
 			"%s: cannot specify -g	or -o, "
 			"program not linked with GSS API Library\n",
 			argv[0]);
-		exit(EXIT_FAILURE);
+		exit(1);
 	}
 #endif /* HAVE_GSSAPI */
 
@@ -1274,14 +1271,14 @@ parse_args(int argc, char **argv) {
 				"%s: cannot specify the -K option without"
 				"the -E option, and vice versa.\n",
 				argv[0]);
-			exit(EXIT_FAILURE);
+			exit(1);
 		}
 		if (tls_ca_file != NULL && tls_always_verify_remote == false) {
 			fprintf(stderr,
 				"%s: cannot specify the -A option in "
 				"conjuction with the -O option.\n",
 				argv[0]);
-			exit(EXIT_FAILURE);
+			exit(1);
 		}
 	}
 
@@ -1295,7 +1292,7 @@ parse_args(int argc, char **argv) {
 				fprintf(stderr, "could not open '%s': %s\n",
 					argv[isc_commandline_index],
 					isc_result_totext(result));
-				exit(EXIT_FAILURE);
+				exit(1);
 			}
 		}
 		if (!force_interactive) {
@@ -1521,90 +1518,6 @@ evaluate_prereq(char *cmdline) {
 	return (make_prereq(cmdline, ispositive, isrrset));
 }
 
-static void
-updateopt(void) {
-	isc_result_t result;
-	dns_ednsopt_t ednsopts[1];
-	unsigned char ul[8];
-	unsigned int count = 0;
-
-	if (lease_set) {
-		isc_buffer_t b;
-		INSIST(count < ARRAY_SIZE(ednsopts));
-		ednsopts[count++] = (dns_ednsopt_t){ .code = DNS_OPT_UL,
-						     .length = keylease_set ? 8
-									    : 4,
-						     .value = ul };
-
-		isc_buffer_init(&b, ul, sizeof(ul));
-		isc_buffer_putuint32(&b, lease);
-		isc_buffer_putuint32(&b, keylease);
-	}
-
-	if (count != 0) {
-		dns_rdataset_t *opt = NULL;
-		result = dns_message_buildopt(updatemsg, &opt, 0,
-					      DEFAULT_EDNS_BUFSIZE, 0, ednsopts,
-					      count);
-		check_result(result, "dns_message_buildopt");
-		result = dns_message_setopt(updatemsg, opt);
-		check_result(result, "dns_message_setopt");
-	} else {
-		result = dns_message_setopt(updatemsg, NULL);
-		check_result(result, "dns_message_setopt");
-	}
-}
-
-static uint16_t
-evaluate_lease(char *cmdline) {
-	char *word;
-	isc_result_t result;
-	uint32_t value1, value2;
-
-	word = nsu_strsep(&cmdline, " \t\r\n");
-	if (word == NULL || *word == 0) {
-		fprintf(stderr, "could not read ttl\n");
-		return (STATUS_SYNTAX);
-	}
-
-	if (!strcasecmp(word, "none")) {
-		lease = 0;
-		lease_set = false;
-		keylease = 0;
-		keylease_set = false;
-		updateopt();
-		return (STATUS_MORE);
-	}
-
-	result = isc_parse_uint32(&value1, word, 10);
-	if (result != ISC_R_SUCCESS) {
-		return (STATUS_SYNTAX);
-	}
-
-	word = nsu_strsep(&cmdline, " \t\r\n");
-	if (word == NULL || *word == 0) {
-		lease = value1;
-		lease_set = true;
-		keylease = 0;
-		keylease_set = false;
-		updateopt();
-		return (STATUS_MORE);
-	}
-
-	result = isc_parse_uint32(&value2, word, 10);
-	if (result != ISC_R_SUCCESS) {
-		return (STATUS_SYNTAX);
-	}
-
-	lease = value1;
-	lease_set = true;
-	keylease = value2;
-	keylease_set = true;
-	updateopt();
-
-	return (STATUS_MORE);
-}
-
 static uint16_t
 evaluate_server(char *cmdline) {
 	char *word, *server;
@@ -1721,7 +1634,7 @@ evaluate_key(char *cmdline) {
 	int secretlen;
 	unsigned char *secret = NULL;
 	isc_buffer_t secretbuf;
-	dst_algorithm_t hmac_alg = DST_ALG_UNKNOWN;
+	dst_algorithm_t hmac = DST_ALG_UNKNOWN;
 	uint16_t digestbits = 0;
 	char *n;
 
@@ -1735,12 +1648,12 @@ evaluate_key(char *cmdline) {
 
 	n = strchr(namestr, ':');
 	if (n != NULL) {
-		if (!parse_hmac(namestr, n - namestr, &hmac_alg, &digestbits)) {
+		if (!parse_hmac(namestr, n - namestr, &hmac, &digestbits)) {
 			return (STATUS_SYNTAX);
 		}
 		namestr = n + 1;
 	} else {
-		hmac_alg = DST_ALG_HMACMD5;
+		hmac = DST_ALG_HMACMD5;
 	}
 
 	isc_buffer_init(&b, namestr, strlen(namestr));
@@ -1772,8 +1685,8 @@ evaluate_key(char *cmdline) {
 	if (tsigkey != NULL) {
 		dns_tsigkey_detach(&tsigkey);
 	}
-	result = dns_tsigkey_create(mykeyname, hmac_alg, secret, secretlen,
-				    gmctx, &tsigkey);
+	result = dns_tsigkey_create(mykeyname, hmac, secret, secretlen, gmctx,
+				    &tsigkey);
 	isc_mem_free(gmctx, secret);
 	if (result != ISC_R_SUCCESS) {
 		fprintf(stderr, "could not create key from %s %s: %s\n",
@@ -2246,7 +2159,7 @@ show_message(FILE *stream, dns_message_t *msg, const char *description) {
 		if (bufsz > MAXTEXT) {
 			fprintf(stderr, "could not allocate large enough "
 					"buffer to display message\n");
-			exit(EXIT_FAILURE);
+			exit(1);
 		}
 		if (buf != NULL) {
 			isc_buffer_free(&buf);
@@ -2309,9 +2222,6 @@ do_next_command(char *cmdline) {
 	if (strcasecmp(word, "add") == 0) {
 		return (update_addordelete(cmdline, false));
 	}
-	if (strcasecmp(word, "lease") == 0) {
-		return (evaluate_lease(cmdline));
-	}
 	if (strcasecmp(word, "server") == 0) {
 		return (evaluate_server(cmdline));
 	}
@@ -2484,7 +2394,7 @@ static void
 done_update(void) {
 	ddebug("done_update()");
 
-	isc_async_current(getinput, NULL);
+	isc_async_current(loopmgr, getinput, NULL);
 }
 
 static void
@@ -3576,7 +3486,7 @@ main(int argc, char **argv) {
 
 	if (seenerror) {
 		return (2);
+	} else {
+		return (0);
 	}
-
-	return (0);
 }

bin/nsupdate/nsupdate.rst

@@ -323,11 +323,6 @@ The command formats and their meanings are as follows:
    By default check-svcb processing is on. If check-svcb processing
    fails, the record is not added to the UPDATE message.
 
-``lease time [keytime]``
-   Set the EDNS Update Lease (UL) option to value to ``time`` and
-   optionally also set the key lease time to ``keytime`` in seconds.
-   If ``time`` is ``none`` the lease times are cleared.
-
 ``prereq nxdomain domain-name``
    This command requires that no resource record of any type exist with the name
    ``domain-name``.

bin/rndc/rndc.c

@@ -348,7 +348,7 @@ rndc_recvdone(isc_nmhandle_t *handle, isc_result_t result, void *arg) {
 
 	isccc_sexpr_free(&response);
 
-	isccc_ccmsg_disconnect(ccmsg);
+	isccc_ccmsg_invalidate(ccmsg);
 	isc_loopmgr_shutdown(loopmgr);
 }
 
@@ -932,7 +932,7 @@ main(int argc, char **argv) {
 		default:
 			fprintf(stderr, "%s: unhandled option -%c\n", program,
 				isc_commandline_option);
-			exit(EXIT_FAILURE);
+			exit(1);
 		}
 	}
 
@@ -1003,8 +1003,6 @@ main(int argc, char **argv) {
 
 	isc_loopmgr_run(loopmgr);
 
-	isccc_ccmsg_invalidate(&rndc_ccmsg);
-
 	isc_log_destroy(&log);
 	isc_log_setcontext(NULL);
 

bin/rndc/rndc.conf

@@ -0,0 +1,41 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+/*
+ * Sample rndc configuration file.
+ */
+
+options {
+	default-server  localhost;
+	default-key     "key";
+};
+
+server localhost {
+	key     "key";
+};
+
+key "cc64b3d1db63fc88d7cb5d2f9f57d258" {
+	algorithm hmac-sha256;
+	secret "34f88008d07deabbe65bd01f1d233d47";
+};
+
+server "test1" {
+	key "cc64b3d1db63fc88d7cb5d2f9f57d258";
+	port 5353;
+	addresses { 10.53.0.1; };
+};
+
+key "key" {
+	algorithm       hmac-sha256;
+	secret "c3Ryb25nIGVub3VnaCBmb3IgYSBtYW4gYnV0IG1hZGUgZm9yIGEgd29tYW4K";
+};

bin/rndc/util.c

@@ -18,7 +18,6 @@
 #include <stdbool.h>
 #include <stdio.h>
 #include <stdlib.h>
-#include <unistd.h>
 
 #include <isc/tls.h>
 
@@ -46,5 +45,6 @@ fatal(const char *format, ...) {
 	vfprintf(stderr, format, args);
 	va_end(args);
 	fprintf(stderr, "\n");
-	_exit(EXIT_FAILURE);
+	isc__tls_setfatalmode();
+	exit(1);
 }

bin/tests/system/.gitignore

@@ -15,6 +15,7 @@ named.run
 /*.trs
 /*.xml
 /resolve
+/legacy.run.sh
 /run.log
 /start.sh
 /stop.sh

bin/tests/system/Makefile.am

@@ -145,7 +145,6 @@ TESTS =				\
 	nzd2nzf			\
 	padding			\
 	pending			\
-	proxy			\
 	pipelined		\
 	qmin			\
 	reclimit		\

bin/tests/system/README

@@ -0,0 +1,793 @@
+Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+
+SPDX-License-Identifier: MPL-2.0
+
+This Source Code Form is subject to the terms of the Mozilla Public
+License, v. 2.0.  If a copy of the MPL was not distributed with this
+file, you can obtain one at https://mozilla.org/MPL/2.0/.
+
+See the COPYRIGHT file distributed with this work for additional
+information regarding copyright ownership.
+
+Introduction
+===
+This directory holds a simple test environment for running bind9 system tests
+involving multiple name servers.
+
+Each system test directory holds a set of scripts and configuration files to
+test different parts of BIND.  The directories are named for the aspect of BIND
+they test, for example:
+
+  dnssec/       DNSSEC tests
+  forward/      Forwarding tests
+  glue/         Glue handling tests
+
+etc.
+
+A system test directory must start with an alphabetic character and may not
+contain any special characters. Only hyphen may be used as a word separator.
+
+Typically each set of tests sets up 2-5 name servers and then performs one or
+more tests against them.  Within the test subdirectory, each name server has a
+separate subdirectory containing its configuration data.  These subdirectories
+are named "nsN" or "ansN" (where N is a number between 1 and 8, e.g. ns1, ans2
+etc.)
+
+The tests are completely self-contained and do not require access to the real
+DNS.  Generally, one of the test servers (usually ns1) is set up as a root
+nameserver and is listed in the hints file of the others.
+
+
+Preparing to Run the Tests
+===
+To enable all servers to run on the same machine, they bind to separate virtual
+IP addresses on the loopback interface.  ns1 runs on 10.53.0.1, ns2 on
+10.53.0.2, etc.  Before running any tests, you must set up these addresses by
+running the command
+
+    sh ifconfig.sh up
+
+as root.  The interfaces can be removed by executing the command:
+
+    sh ifconfig.sh down
+
+... also as root.
+
+The servers use unprivileged ports (above 1024) instead of the usual port 53,
+so they can be run without root privileges once the interfaces have been set
+up.
+
+
+Note for MacOS Users
+---
+If you wish to make the interfaces survive across reboots, copy
+org.isc.bind.system and org.isc.bind.system.plist to /Library/LaunchDaemons
+then run
+
+    launchctl load /Library/LaunchDaemons/org.isc.bind.system.plist
+
+... as root.
+
+
+Running the System Tests with pytest
+===
+
+The pytest system test runner is currently in development, but it is the
+recommended way to run tests. Please report issues to QA.
+
+Running an Individual Test
+---
+
+pytest -k <test-name>
+
+Note that in comparison to the legacy test runner, some additional tests might
+be picked up when specifying just the system test directory name. To check
+which tests will be executed, you can use the `--collect-only` option. You
+might also be able to find a more specific test name to provide to ensure only
+your desired test is executed. See help for `-k` option in `pytest --help` for
+more info.
+
+It is also possible to run a single individual pytest test case. For example,
+you can use the name test_sslyze_dot to execute just the test_sslyze_dot()
+function from doth/tests_sslyze.py. The entire needed setup and teardown will
+be handled by the framework.
+
+Running All the System Tests
+---
+
+Issuing plain `pytest` command without any argument will execute all tests
+sequenatially. To execute them in parallel, ensure you have pytest-xdist
+installed and run:
+
+pytest -n <number-of-workers>
+
+
+Running the System Tests Using the Legacy Runner
+===
+
+!!! WARNING !!!
+---
+The legacy way to run system tests is currently being reworked into a pytest
+system test runner described in the previous section. The contents of this
+section might be out of date and no longer applicable. Please try and use the
+pytest runner if possible and report issues and missing features.
+
+Running an Individual Test
+---
+The tests can be run individually using the following command:
+
+    sh legacy.run.sh [flags] <test-name> [<test-arguments>]
+
+e.g.
+
+    sh legacy.run.sh [flags] notify
+
+Optional flags are:
+
+    -k              Keep servers running after the test completes.  Each test
+                    usually starts a number of nameservers, either instances
+                    of the "named" being tested, or custom servers (written in
+                    Python or Perl) that feature test-specific behavior.  The
+                    servers are automatically started before the test is run
+                    and stopped after it ends.  This flag leaves them running
+                    at the end of the test, so that additional queries can be
+                    sent by hand.  To stop the servers afterwards, use the
+                    command "sh stop.sh <test-name>".
+
+    -n              Noclean - do not remove the output files if the test
+                    completes successfully.  By default, files created by the
+                    test are deleted if it passes;  they are not deleted if the
+                    test fails.
+
+    -p <number>     Sets the range of ports used by the test.  A block of 100
+                    ports is available for each test, the number given to the
+                    "-p" switch being the number of the start of that block
+                    (e.g. "-p 7900" will mean that the test is able to use
+                    ports 7900 through 7999).  If not specified, the test will
+                    have ports 5000 to 5099 available to it.
+
+Arguments are:
+
+    test-name       Mandatory.  The name of the test, which is the name of the
+                    subdirectory in bin/tests/system holding the test files.
+
+    test-arguments  Optional arguments that are passed to each of the test's
+                    scripts.
+
+
+Running All The System Tests
+---
+To run all the system tests, enter the command:
+
+    make [-j numproc] test
+
+The optional "numproc" argument specifies the maximum number of tests that can
+run in parallel.  The default is 1, which means that all of the tests run
+sequentially.  If greater than 1, up to "numproc" tests will run simultaneously,
+new tests being started as tests finish.  Each test will get a unique set of
+ports, so there is no danger of tests interfering with one another.  Parallel
+running will reduce the total time taken to run the BIND system tests, but will
+mean that the output from all the tests sent to the screen will be mixed up
+with one another.
+
+In this case, retention of the output files after a test completes successfully
+is specified by setting the environment variable SYSTEMTEST_NO_CLEAN to 1 prior
+to running make, e.g.
+
+    SYSTEMTEST_NO_CLEAN=1 make [-j numproc] test
+
+while setting environment variable SYSTEMTEST_FORCE_COLOR to 1 forces system
+test output to be printed in color.
+
+
+Format of Test Output
+---
+All output from the system tests is in the form of lines with the following
+structure:
+
+    <letter>:<test-name>:<message> [(<number>)]
+
+e.g.
+
+    I:catz:checking that dom1.example is not served by primary (1)
+
+The meanings of the fields are as follows:
+
+<letter>
+This indicates the type of message.  This is one of:
+
+    S   Start of the test
+    A   Start of test (retained for backwards compatibility)
+    T   Start of test (retained for backwards compatibility)
+    E   End of the test
+    I   Information.  A test will typically output many of these messages
+        during its run, indicating test progress.  Note that such a message may
+        be of the form "I:testname:failed", indicating that a sub-test has
+        failed.
+    R   Result.  Each test will result in one such message, which is of the
+        form:
+
+                R:<test-name>:<result>
+
+        where <result> is one of:
+
+            PASS        The test passed
+            FAIL        The test failed
+            SKIPPED     The test was not run, usually because some
+                        prerequisites required to run the test are missing.
+
+<test-name>
+This is the name of the test from which the message emanated, which is also the
+name of the subdirectory holding the test files.
+
+<message>
+This is text output by the test during its execution.
+
+(<number>)
+If present, this will correlate with a file created by the test.  The tests
+execute commands and route the output of each command to a file.  The name of
+this file depends on the command and the test, but will usually be of the form:
+
+    <command>.out.<suffix><number>
+
+e.g. nsupdate.out.test28, dig.out.q3.  This aids diagnosis of problems by
+allowing the output that caused the problem message to be identified.
+
+
+Re-Running the Tests
+---
+If there is a requirement to re-run a test (or the entire test suite), the
+files produced by the tests should be deleted first.  Normally, these files are
+deleted if the test succeeds but are retained on error.  The legacy.run.sh
+script automatically calls a given test's clean.sh script before invoking its
+setup.sh script.
+
+Deletion of the files produced by the set of tests (e.g. after the execution of
+make) can be carried out using the command:
+
+    sh cleanall.sh
+
+or
+
+    make testclean
+
+(Note that the Makefile has two other targets for cleaning up files: "clean"
+will delete all the files produced by the tests, as well as the object and
+executable files used by the tests.  "distclean" does all the work of "clean"
+as well as deleting configuration files produced by "configure".)
+
+
+Developer Notes
+===
+This section is intended for developers writing new tests.
+
+
+Overview
+---
+As noted above, each test is in a separate directory.  To interact with the
+test framework, the directories contain the following standard files:
+
+prereq.sh   Run at the beginning to determine whether the test can be run at
+            all; if not, we see a R:SKIPPED result.  This file is optional:
+            if not present, the test is assumed to have all its prerequisites
+            met.
+
+setup.sh    Run after prereq.sh, this sets up the preconditions for the tests.
+            Although optional, virtually all tests will require such a file to
+            set up the ports they should use for the test.
+
+tests.sh    Runs the actual tests.  This file is mandatory.
+
+tests_sh_xyz.py  A glue file for the pytest runner for executing shell tests.
+
+clean.sh    Run at the end to clean up temporary files, but only if the test
+            was completed successfully and its running was not inhibited by the
+            "-n" switch being passed to "legacy.run.sh".  Otherwise the
+            temporary files are left in place for inspection.
+
+ns<N>       These subdirectories contain test name servers that can be queried
+	    or can interact with each other.  The value of N indicates the
+	    address the server listens on: for example, ns2 listens on
+	    10.53.0.2, and ns4 on 10.53.0.4.  All test servers use an
+	    unprivileged port, so they don't need to run as root.  These
+	    servers log at the highest debug level and the log is captured in
+	    the file "named.run".
+
+ans<N>      Like ns[X], but these are simple mock name servers implemented in
+            Perl or Python.  They are generally programmed to misbehave in ways
+            named would not so as to exercise named's ability to interoperate
+            with badly behaved name servers.
+
+
+Port Usage
+---
+In order for the tests to run in parallel, each test requires a unique set of
+ports.  These are specified by the "-p" option passed to "legacy.run.sh", which
+sets environment variables that the scripts listed above can reference.
+
+The convention used in the system tests is that the number passed is the start
+of a range of 100 ports.  The test is free to use the ports as required,
+although the first ten ports in the block are named and generally tests use the
+named ports for their intended purpose.  The names of the environment variables
+are:
+
+    PORT                     Number to be used for the query port.
+    CONTROLPORT              Number to be used as the RNDC control port.
+    EXTRAPORT1 - EXTRAPORT8  Eight port numbers that can be used as needed.
+
+Two other environment variables are defined:
+
+    LOWPORT                  The lowest port number in the range.
+    HIGHPORT                 The highest port number in the range.
+
+Since port ranges usually start on a boundary of 10, the variables are set such
+that the last digit of the port number corresponds to the number of the
+EXTRAPORTn variable.  For example, if the port range were to start at 5200, the
+port assignments would be:
+
+    PORT = 5200
+    EXTRAPORT1 = 5201
+        :
+    EXTRAPORT8 = 5208
+    CONTROLPORT = 5209
+    LOWPORT = 5200
+    HIGHPORT = 5299
+
+When running tests in parallel (i.e. giving a value of "numproc" greater than 1
+in the "make" command listed above), it is guaranteed that each
+test will get a set of unique port numbers.
+
+
+Writing a Test
+---
+The test framework requires up to four shell scripts (listed above) as well as
+a number of nameserver instances to run.  Certain expectations are put on each
+script:
+
+
+General
+---
+1. Each of the four scripts will be invoked with the command
+
+    (cd <test-directory> ; sh <script> [<arguments>] )
+
+... so that working directory when the script starts executing is the test
+directory.
+
+2. Arguments can be only passed to the script if the test is being run as a
+one-off with "legacy.run.sh".  In this case, everything on the command line
+after the name of the test is passed to each script.  For example, the command:
+
+    sh legacy.run.sh -p 12300 mytest -D xyz
+
+... will run "mytest" with a port range of 12300 to 12399.  Each of the
+framework scripts provided by the test will be invoked using the remaining
+arguments, e.g.:
+
+   (cd mytest ; sh prereq.sh -D xyz)
+   (cd mytest ; sh setup.sh -D xyz)
+   (cd mytest ; sh tests.sh -D xyz)
+   (cd mytest ; sh clean.sh -D xyz)
+
+No arguments will be passed to the test scripts if the test is run as part of
+a run of the full test suite (e.g. the tests are started with make).
+
+3.  Each script should start with the following lines:
+
+    . ../conf.sh
+
+"conf.sh" defines a series of environment variables together with functions
+useful for the test scripts.
+
+
+prereq.sh
+---
+As noted above, this is optional.  If present, it should check whether specific
+software needed to run the test is available and/or whether BIND has been
+configured with the appropriate options required.
+
+    * If the software required to run the test is present and the BIND
+      configure options are correct, prereq.sh should return with a status code
+      of 0.
+
+    * If the software required to run the test is not available and/or BIND
+      has not been configured with the appropriate options, prereq.sh should
+      return with a status code of 1.
+
+    * If there is some other problem (e.g. prerequisite software is available
+      but is not properly configured), a status code of 255 should be returned.
+
+
+setup.sh
+---
+This is responsible for setting up the configuration files used in the test.
+
+To cope with the varying port number, ports are not hard-coded into
+configuration files (or, for that matter, scripts that emulate nameservers).
+Instead, setup.sh is responsible for editing the configuration files to set the
+port numbers.
+
+To do this, configuration files should be supplied in the form of templates
+containing tokens identifying ports.  The tokens have the same name as the
+environment variables listed above, but are prefixed and suffixed by the "@"
+symbol.  For example, a fragment of a configuration file template might look
+like:
+
+    controls {
+        inet 10.53.0.1 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
+    };
+
+    options {
+        query-source address 10.53.0.1;
+        notify-source 10.53.0.1;
+        transfer-source 10.53.0.1;
+        port @PORT@;
+        allow-new-zones yes;
+    };
+
+setup.sh should copy the template to the desired filename using the
+"copy_setports" shell function defined in "conf.sh", i.e.
+
+    copy_setports ns1/named.conf.in ns1/named.conf
+
+This replaces the tokens @PORT@, @CONTROLPORT@, @EXTRAPORT1@ through
+@EXTRAPORT8@ with the contents of the environment variables listed above.
+setup.sh should do this for all configuration files required when the test
+starts.
+
+("setup.sh" should also use this method for replacing the tokens in any Perl or
+Python name servers used in the test.)
+
+
+tests.sh
+---
+This is the main test file and the contents depend on the test.  The contents
+are completely up to the developer, although most test scripts have a form
+similar to the following for each sub-test:
+
+    1. n=$((n + 1))
+    2. echo_i "prime cache nodata.example ($n)"
+    3. ret=0
+    4. $DIG -p ${PORT} @10.53.0.1 nodata.example TXT > dig.out.test$n
+    5. grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
+    6. grep "ANSWER: 0," dig.out.test$n > /dev/null || ret=1
+    7. if [ $ret != 0 ]; then echo_i "failed"; fi
+    8. status=$((status + ret))
+
+1.  Increment the test number "n" (initialized to zero at the start of the
+    script).
+
+2.  Indicate that the sub-test is about to begin.  Note that "echo_i" instead
+    of "echo" is used.  echo_i is a function defined in "conf.sh" which will
+    prefix the message with "I:<testname>:", so allowing the output from each
+    test to be identified within the output.  The test number is included in
+    the message in order to tie the sub-test with its output.
+
+3. Initialize return status.
+
+4 - 6. Carry out the sub-test.  In this case, a nameserver is queried (note
+    that the port used is given by the PORT environment variable, which was set
+    by the inclusion of the file "conf.sh" at the start of the script).  The
+    output is routed to a file whose suffix includes the test number.  The
+    response from the server is examined and, in this case, if the required
+    string is not found, an error is indicated by setting "ret" to 1.
+
+7.  If the sub-test failed, a message is printed. "echo_i" is used to print
+    the message to add the prefix "I:<test-name>:" before it is output.
+
+8.  "status", used to track how many of the sub-tests have failed, is
+    incremented accordingly.  The value of "status" determines the status
+    returned by "tests.sh", which in turn determines whether the framework
+    prints the PASS or FAIL message.
+
+Regardless of this, rules that should be followed are:
+
+a.  Use the environment variables set by conf.sh to determine the ports to use
+    for sending and receiving queries.
+
+b.  Use a counter to tag messages and to associate the messages with the output
+    files.
+
+c.  Store all output produced by queries/commands into files.  These files
+    should be named according to the command that produced them, e.g. "dig"
+    output should be stored in a file "dig.out.<suffix>", the suffix being
+    related to the value of the counter.
+
+d.  Use "echo_i" to output informational messages.
+
+e.  Retain a count of test failures and return this as the exit status from
+    the script.
+
+
+tests_sh_xyz.py
+---------------
+This glue file is required by the pytest runner in order to find and execute
+the shell tests in tests.sh.
+
+Replace the "xyz" with the system test name and create the file with the
+following contents.
+
+    def test_xyz(run_tests_sh):
+        run_tests_sh()
+
+clean.sh
+---
+The inverse of "setup.sh", this is invoked by the framework to clean up the
+test directory.  It should delete all files that have been created by the test
+during its run.
+
+
+Starting Nameservers
+---
+As noted earlier, a system test will involve a number of nameservers.  These
+will be either instances of named, or special servers written in a language
+such as Perl or Python.
+
+For the former, the version of "named" being run is that in the "bin/named"
+directory in the tree holding the tests (i.e. if "make test" is being run
+immediately after "make", the version of "named" used is that just built).  The
+configuration files, zone files etc. for these servers are located in
+subdirectories of the test directory named "nsN", where N is a small integer.
+The latter are special nameservers, mostly used for generating deliberately bad
+responses, located in subdirectories named "ansN" (again, N is an integer).
+In addition to configuration files, these directories should hold the
+appropriate script files as well.
+
+Note that the "N" for a particular test forms a single number space, e.g. if
+there is an "ns2" directory, there cannot be an "ans2" directory as well.
+Ideally, the directory numbers should start at 1 and work upwards.
+
+When running a test, the servers are started using "start.sh" (which is nothing
+more than a wrapper for start.pl).  The options for "start.pl" are documented
+in the header for that file, so will not be repeated here.  In summary, when
+invoked by "legacy.run.sh", start.pl looks for directories named "nsN" or
+"ansN" in the test directory and starts the servers it finds there.
+
+
+"named" Command-Line Options
+---
+By default, start.pl starts a "named" server with the following options:
+
+    -c named.conf   Specifies the configuration file to use (so by implication,
+                    each "nsN" nameserver's configuration file must be called
+                    named.conf).
+
+    -d 99           Sets the maximum debugging level.
+
+    -D <name>       The "-D" option sets a string used to identify the
+                    nameserver in a process listing.  In this case, the string
+                    is the name of the subdirectory.
+
+    -g              Runs the server in the foreground and logs everything to
+                    stderr.
+
+    -m record
+                    Turns on these memory usage debugging flags.
+
+    -U 4            Uses four listeners.
+
+      Acquires a lock on this file in the "nsN" directory, so
+                    preventing multiple instances of this named running in this
+                    directory (which could possibly interfere with the test).
+
+All output is sent to a file called "named.run" in the nameserver directory.
+
+The options used to start named can be altered.  There are three ways of doing
+this.  "start.pl" checks the methods in a specific order: if a check succeeds,
+the options are set and any other specification is ignored.  In order, these
+are:
+
+1. Specifying options to "start.sh"/"start.pl" after the name of the test
+directory, e.g.
+
+    sh start.sh reclimit ns1 -- "-c n.conf -d 43"
+
+(This is only really useful when running tests interactively.)
+
+2. Including a file called "named.args" in the "nsN" directory.  If present,
+the contents of the first non-commented, non-blank line of the file are used as
+the named command-line arguments.  The rest of the file is ignored.
+
+3. Tweaking the default command line arguments with "-T" options.  This flag is
+used to alter the behavior of BIND for testing and is not documented in the
+ARM.  The presence of certain files in the "nsN" directory adds flags to
+the default command line (the content of the files is irrelevant - it
+is only the presence that counts):
+
+    named.noaa       Appends "-T noaa" to the command line, which causes
+                     "named" to never set the AA bit in an answer.
+
+    named.dropedns   Adds "-T dropedns" to the command line, which causes
+                     "named" to recognise EDNS options in messages, but drop
+                     messages containing them.
+
+    named.maxudp1460 Adds "-T maxudp1460" to the command line, setting the
+                     maximum UDP size handled by named to 1460.
+
+    named.maxudp512  Adds "-T maxudp512" to the command line, setting the
+                     maximum UDP size handled by named to 512.
+
+    named.noedns     Appends "-T noedns" to the command line, which disables
+                     recognition of EDNS options in messages.
+
+    named.notcp      Adds "-T notcp", which disables TCP in "named".
+
+    named.soa        Appends "-T nosoa" to the command line, which disables
+                     the addition of SOA records to negative responses (or to
+                     the additional section if the response is triggered by RPZ
+                     rewriting).
+
+Starting Other Nameservers
+---
+In contrast to "named", nameservers written in Perl or Python (whose script
+file should have the name "ans.pl" or "ans.py" respectively) are started with a
+fixed command line.  In essence, the server is given the address and nothing
+else.
+
+(This is not strictly true: Python servers are provided with the number of the
+query port to use.  Altering the port used by Perl servers currently requires
+creating a template file containing the "@PORT@" token, and having "setup.sh"
+substitute the actual port being used before the test starts.)
+
+
+Stopping Nameservers
+---
+As might be expected, the test system stops nameservers with the script
+"stop.sh", which is little more than a wrapper for "stop.pl".  Like "start.pl",
+the options available are listed in the file's header and will not be repeated
+here.
+
+In summary though, the nameservers for a given test, if left running by
+specifying the "-k" flag to "legacy.run.sh" when the test is started, can be
+stopped by the command:
+
+    sh stop.sh <test-name> [server]
+
+... where if the server (e.g. "ns1", "ans3") is not specified, all servers
+associated with the test are stopped.
+
+
+Adding a Test to the System Test Suite
+---
+Once a test has been created, the following files should be edited:
+
+* conf.sh.common The name of the test should be added to the PARALLEL_COMMON
+variable.
+
+* Makefile.am The name of the test should be added to the TESTS variable.
+
+(It is likely that a future iteration of the system test suite will remove the
+need to edit multiple files to add a test.)
+
+
+Valgrind
+---
+When running system tests, named can be run under Valgrind.  The output from
+Valgrind are sent to per-process files that can be reviewed after the test has
+completed.  To enable this, set the USE_VALGRIND environment variable to
+"helgrind" to run the Helgrind tool, or any other value to run the Memcheck
+tool.  To use "helgrind" effectively, build BIND with --disable-atomic.
+
+Developer Notes for pytest runner
+===
+
+Test discovery and collection
+---
+There are two distinct types of system tests. The first is a shell script
+tests.sh containing individual test cases executed sequentially and the
+success/failure is determined by return code. The second type is a regular
+pytest file which contains test functions.
+
+Dealing with the regular pytest files doesn't require any special consideration
+as long as the naming conventions are met. Discovering the tests.sh tests is
+more complicated.
+
+The chosen solution is to add a bit of glue for each system test. For every
+tests.sh, there is an accompanying tests_sh_*.py file that contains a test
+function which utilizes a custom run_tests_sh fixture to call the tests.sh
+script. Other solutions were tried and eventually rejected. While this
+introduces a bit of extra glue, it is the most portable, compatible and least
+complex solution.
+
+Module scope
+---
+Pytest fixtures can have a scope. The "module" scope is the most important for
+our use. A module is a python file which contains test functions. Every system
+test directory may contain multiple modules (i.e. tests_*.py files)!
+
+The server setup/teardown is done for a module. Bundling test cases together
+inside a single module may save some resources. However, test cases inside a
+single module can't be executed in parallel.
+
+It is possible to execute different modules defined within a single system test
+directory in parallel. This is possible thanks to executing the tests inside a
+temporary directory and proper port assignment to ensure there won't be any
+conflicts.
+
+Test logging
+---
+Each module has a separate log which will be saved as pytest.log.txt in the
+temporary directory in which the test is executed. This log includes messages
+for this module setup/teardown as well as any logging from the tests using the
+`logger` fixture. Logging level DEBUG and above will be present in this log.
+
+In general, any log messages using INFO or above will also be printed out
+during pytest execution. In CI, the pytest output is also saved to
+pytest.out.txt in the bin/tests/system directory.
+
+Parallel execution
+---
+As mentioned in the previous section, test cases inside a single module can't
+be executed in parallel. To put it differently, all tests cases inside the same
+module must be performed by the same worker/thread. Otherwise, server
+setup/teardown fixtures won't be shared and runtime issues due to port
+collisions are likely to occur.
+
+Pytest-xdist is used for executing pytest test cases in parallel using the `-n
+N_WORKERS` option. By default, xdist will distribute any test case to any
+worker, which would lead to the issue described above. Therefore, conftest.py
+enforces equivalent of `--dist loadscope` option which ensures that test cases
+within the same (module) scope will be handled by the same worker. Parallelism
+is automatically disabled when xdist.scheduler.loadscope library is not
+available.
+
+$ pytest -n auto
+
+Test selection
+---
+It is possible to run just a single pytest test case from any module. Use
+standard pytest facility to select the desired test case(s), i.e. pass a
+sufficiently unique identifier for `-k` parameter. You can also check which
+tests will be executed by using the `--collect-only` flag to debug your `-k`
+expression.
+
+Compatibility with older pytest version
+---
+Keep in mind that the pytest runner must work with ancient versions of pytest.
+When implementing new features, it is advisable to check feature support in
+pytest and pytest-xdist in older distributions first.
+
+As a general rule, any changes to the pytest runner need to keep working on all
+platforms in CI that use the pytest runner. As of 2023-01-13, the oldest
+supported version is whatever is available in EL8.
+
+We may need to add more compat code eventually to handle breaking upstream
+changes. For example, using request.fspath attribute is already deprecatred in
+latest pytest.
+
+Maintenance Notes for legacy runner
+===
+This section is aimed at developers maintaining BIND's system test framework.
+
+Notes on Parallel Execution
+---
+Although execution of an individual test is controlled by "legacy.run.sh",
+which executes the above shell scripts (and starts the relevant servers) for
+each test, the running of all tests in the test suite is controlled by the
+Makefile.
+
+All system tests are capable of being run in parallel.  For this to work, each
+test needs to use a unique set of ports.  To avoid the need to define which
+tests use which ports (and so risk port clashes as further tests are added),
+the ports are determined by "get_ports.sh", a port broker script which keeps
+track of ports given to each individual system test.
+
+
+Cleaning Up From Tests
+---
+When a test is run, up to three different types of files are created:
+
+1. Files generated by the test itself, e.g. output from "dig" and "rndc", are
+stored in the test directory.
+
+2. Files produced by named which may not be cleaned up if named exits
+abnormally, e.g. core files, PID files etc., are stored in the test directory.
+
+If the test fails, all these files are retained.  But if the test succeeds,
+they are cleaned up at different times:
+
+1. Files generated by the test itself are cleaned up by the test's own
+"clean.sh", which is called from "legacy.run.sh".
+
+2. Files that may not be cleaned up if named exits abnormally can be removed
+using the "cleanall.sh" script.

bin/tests/system/README.md

@@ -1,474 +0,0 @@
-<!--
-Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-
-SPDX-License-Identifier: MPL-2.0
-
-This Source Code Form is subject to the terms of the Mozilla Public
-License, v. 2.0.  If a copy of the MPL was not distributed with this
-file, you can obtain one at https://mozilla.org/MPL/2.0/.
-
-See the COPYRIGHT file distributed with this work for additional
-information regarding copyright ownership.
--->
-
-# BIND9 System Test Framework
-
-This directory holds test environments for running bind9 system tests involving
-multiple name servers.
-
-Each system test directory holds a set of scripts and configuration files to
-test different parts of BIND.  The directories are named for the aspect of BIND
-they test, for example:
-
-    dnssec/       DNSSEC tests
-    forward/      Forwarding tests
-    glue/         Glue handling tests
-
-etc.
-
-A system test directory must start with an alphabetic character and may not
-contain any special characters. Only hyphen may be used as a word separator.
-
-Typically each set of tests sets up 2-5 name servers and then performs one or
-more tests against them.  Within the test subdirectory, each name server has a
-separate subdirectory containing its configuration data.  These subdirectories
-are named "nsN" or "ansN" (where N is a number between 1 and 8, e.g. ns1, ans2
-etc.)
-
-The tests are completely self-contained and do not require access to the real
-DNS.  Generally, one of the test servers (usually ns1) is set up as a root
-nameserver and is listed in the hints file of the others.
-
-
-## Running the Tests
-
-### Prerequisites
-
-To run system tests, make sure you have the following dependencies installed:
-
-- python3
-- pytest
-- perl
-- dnspython
-- pytest-xdist (for parallel execution)
-
-Individual system tests might also require additional dependencies. If those
-are missing, the affected tests will be skipped and should produce a message
-specifying what additional prerequisites they expect.
-
-### Network Setup
-
-To enable all servers to run on the same machine, they bind to separate virtual
-IP addresses on the loopback interface.  ns1 runs on 10.53.0.1, ns2 on
-10.53.0.2, etc.  Before running any tests, you must set up these addresses by
-running the command
-
-    sh ifconfig.sh up
-
-as root.  The interfaces can be removed by executing the command:
-
-    sh ifconfig.sh down
-
-... also as root.
-
-The servers use unprivileged ports (above 1024) instead of the usual port 53,
-so they can be run without root privileges once the interfaces have been set
-up.
-
-**Note for MacOS Users**
-
-If you wish to make the interfaces survive across reboots, copy
-org.isc.bind.system and org.isc.bind.system.plist to /Library/LaunchDaemons
-then run
-
-    launchctl load /Library/LaunchDaemons/org.isc.bind.system.plist
-
-... as root.
-
-### Running a Single Test
-
-The recommended way is to use pytest and its test selection facilities:
-
-    pytest -k <test-name-or-pattern>
-
-Using `-k` to specify a pattern allows to run a single pytest test case within
-a system test. E.g. you can use `-k test_sslyze_dot` to execute just the
-`test_sslyze_dot()` function from `doth/tests_sslyze.py`.
-
-However, using the `-k` pattern might pick up more tests than intended. You can
-use the `--collect-only` option to check the list of tests which match you `-k`
-pattern. If you just want to execute all system tests within a single test
-directory, you can also use the utility script:
-
-    ./run.sh system_test_dir_name
-
-### Running All the System Tests
-
-Issuing plain `pytest` command without any argument will execute all tests
-sequentially. To execute them in parallel, ensure you have pytest-xdist
-installed and run:
-
-    pytest [-n <number-of-workers>]
-
-Alternately, using the make command is also supported:
-
-    make [-j numproc] test
-
-### rr
-
-When running system tests, named can be run under the rr tool. rr records a
-trace to the $system_test/nsX/named-Y/ directory, which can be later used to
-replay named. To enable this, execute start.pl with the USE_RR environment
-variable set.
-
-### Test Artifacts
-
-Each test module is executed inside a unique temporary directory which contains
-all the artifacts from the test run. If the tests succeed, they are deleted by
-default. To override this behaviour, pass `--noclean` to pytest.
-
-The directory name starts with the system test name, followed by `_tmp_XXXXXX`,
-i.e. `dns64_tmp_r07vei9s` for `dns64` test run. Since this name changes each
-run, a convenience symlink that has a stable name is also created. It points to
-the latest test artifacts directory and has a form of `dns64_sh_dns64`
-(depending on the particular test module).
-
-To clean up the temporary directories and symlinks, run `make clean-local` in
-the system test directory.
-
-The following test artifacts are typically available:
-
-- pytest.log.txt: main log file with test output
-- files generated by the test itself, e.g. output from "dig" and "rndc"
-- files produced by named, other tools or helper scripts
-
-
-## Writing System Tests
-
-### File Overview
-
-Tests are organized into system test directories which may hold one or more
-test modules (python files). Each module may have multiple test cases. The
-system test directories may contain the following standard files:
-
-- `tests_*.py`: These python files are picked up by pytest as modules. If they
-  contain any test functions, they're added to the test suite.
-
-- `setup.sh`: This sets up the preconditions for the tests. Although optional,
-  virtually all tests will require such a file to set up the ports they should
-  use for the test.
-
-- `tests.sh`: Any shell-based tests are located within this file. Runs the
-  actual tests.
-
-- `tests_sh_*.py`: A glue file for the pytest runner for executing shell tests.
-
-- `ns<N>`: These subdirectories contain test name servers that can be queried
-  or can interact with each other. The value of N indicates the address the
-  server listens on: for example, ns2 listens on 10.53.0.2, and ns4 on
-  10.53.0.4. All test servers use an unprivileged port, so they don't need to
-  run as root. These servers log at the highest debug level and the log is
-  captured in the file "named.run".
-
-- `ans<N>`: Like ns[X], but these are simple mock name servers implemented in
-  Perl or Python.  They are generally programmed to misbehave in ways named
-  would not so as to exercise named's ability to interoperate with badly
-  behaved name servers.
-
-### Module Scope
-
-A module is a python file which contains test functions. Every system
-test directory may contain multiple modules (i.e. tests_*.py files).
-
-The server setup/teardown is performed for each module. Bundling test cases
-together inside a single module may save some resources. However, test cases
-inside a single module can't be executed in parallel.
-
-It is possible to execute different modules defined within a single system test
-directory in parallel. This is possible thanks to executing the tests inside a
-temporary directory and proper port assignment to ensure there won't be any
-conflicts.
-
-### Port Usage
-
-In order for the tests to run in parallel, each test requires a unique set of
-ports. This is ensured by the pytest runner, which assigns a unique set of
-ports to each test module.
-
-Inside the python tests, it is possible to use the `ports` fixture to get the
-assigned port numbers. They're also set as environment variables. These include:
-
-- `PORT`: used as the basic dns port
-- `TLSPORT`: used as the port for DNS-over-TLS
-- `HTTPPORT`, `HTTPSPORT`: used as the ports for DNS-over-HTTP
-- `CONTROLPORT`: used as the RNDC control port
-- `EXTRAPORT1` through `EXTRAPORT8`: additional ports that can be used as needed
-
-### Logging
-
-Each module has a separate log which will be saved as pytest.log.txt in the
-temporary directory in which the test is executed. This log includes messages
-for this module setup/teardown as well as any logging from the tests. Logging
-level DEBUG and above will be present in this log.
-
-In general, any log messages using INFO or above will also be printed out
-during pytest execution. In CI, the pytest output is also saved to
-pytest.out.txt in the bin/tests/system directory.
-
-### Adding a Test to the System Test Suite
-
-Once a test has been created it will be automatically picked up by the pytest
-runner if it upholds the convention expected by pytest (especially when it comes
-to naming files and test functions).
-
-However, if a new system test directory is created, it also needs to be added to
-`TESTS` in `Makefile.am`, in order to work with `make check`.
-
-
-## Test Files
-
-### setup.sh
-
-This script is responsible for setting up the configuration files used in the
-test. It is used by both the python and shell tests. It is interpreted just
-before the servers are started up for each test module.
-
-To cope with the varying port number, ports are not hard-coded into
-configuration files (or, for that matter, scripts that emulate nameservers).
-Instead, setup.sh is responsible for editing the configuration files to set the
-port numbers.
-
-To do this, configuration files should be supplied in the form of templates
-containing tokens identifying ports.  The tokens have the same name as the
-environment variables listed above, but are prefixed and suffixed by the "@"
-symbol.  For example, a fragment of a configuration file template might look
-like:
-
-    controls {
-        inet 10.53.0.1 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
-    };
-
-    options {
-        query-source address 10.53.0.1;
-        notify-source 10.53.0.1;
-        transfer-source 10.53.0.1;
-        port @PORT@;
-        allow-new-zones yes;
-    };
-
-setup.sh should copy the template to the desired filename using the
-"copy_setports" shell function defined in "conf.sh", i.e.
-
-    copy_setports ns1/named.conf.in ns1/named.conf
-
-This replaces tokens like @PORT@ with the contents of the environment variables
-listed above. setup.sh should do this for all configuration files required when
-the test starts.
-
-("setup.sh" should also use this method for replacing the tokens in any Perl or
-Python name servers used in the test.)
-
-### tests_*.py
-
-These are test modules containing tests written in python. Every test is a
-function which begins with the name `test_` (according to pytest convention). It
-is possible to pass fixtures to the test function by specifying their name as
-function arguments. Fixtures are used to provide context to the tests, e.g.:
-
-- `ports` is a dictionary with assigned port numbers
-
-### tests_sh_*.py
-
-These are glue files that are required to execute shell based tests (see below).
-These modules shouldn't contain any python tests (use a separate file instead).
-
-### tests.sh
-
-This is the test file for shell based tests.
-
-
-## Nameservers
-
-As noted earlier, a system test will involve a number of nameservers.  These
-will be either instances of named, or special servers written in a language
-such as Perl or Python.
-
-For the former, the version of "named" being run is that in the "bin/named"
-directory in the tree holding the tests (i.e. if "make test" is being run
-immediately after "make", the version of "named" used is that just built).  The
-configuration files, zone files etc. for these servers are located in
-subdirectories of the test directory named "nsN", where N is a small integer.
-The latter are special nameservers, mostly used for generating deliberately bad
-responses, located in subdirectories named "ansN" (again, N is an integer).
-In addition to configuration files, these directories should hold the
-appropriate script files as well.
-
-Note that the "N" for a particular test forms a single number space, e.g. if
-there is an "ns2" directory, there cannot be an "ans2" directory as well.
-Ideally, the directory numbers should start at 1 and work upwards.
-
-When tests are executed, pytest takes care of the test setup and teardown. It
-looks for any `nsN` and `ansN` directories in the system test directory and
-starts those servers.
-
-### `named` Command-Line Options
-
-By default, `named` server is started with the following options:
-
-    -c named.conf   Specifies the configuration file to use (so by implication,
-                    each "nsN" nameserver's configuration file must be called
-                    named.conf).
-
-    -d 99           Sets the maximum debugging level.
-
-    -D <name>       The "-D" option sets a string used to identify the
-                    nameserver in a process listing.  In this case, the string
-                    is the name of the subdirectory.
-
-    -g              Runs the server in the foreground and logs everything to
-                    stderr.
-
-    -m record
-                    Turns on these memory usage debugging flags.
-
-All output is sent to a file called `named.run` in the nameserver directory.
-
-The options used to start named can be altered. There are a couple ways of
-doing this. `start.pl` checks the methods in a specific order: if a check
-succeeds, the options are set and any other specification is ignored.  In order,
-these are:
-
-1. Specifying options to `start.pl` or `start_server` shell utility function
-   after the name of the test directory, e.g.
-
-   start_server --noclean --restart --port ${PORT} ns1 -- "-D xfer-ns1 -T transferinsecs -T transferslowly"
-
-2. Including a file called "named.args" in the "nsN" directory.  If present,
-the contents of the first non-commented, non-blank line of the file are used as
-the named command-line arguments.  The rest of the file is ignored.
-
-3. Tweaking the default command line arguments with "-T" options.  This flag is
-used to alter the behavior of BIND for testing and is not documented in the
-ARM.  The presence of certain files in the "nsN" directory adds flags to
-the default command line (the content of the files is irrelevant - it
-is only the presence that counts):
-
-    named.noaa       Appends "-T noaa" to the command line, which causes
-                     "named" to never set the AA bit in an answer.
-
-    named.dropedns   Adds "-T dropedns" to the command line, which causes
-                     "named" to recognise EDNS options in messages, but drop
-                     messages containing them.
-
-    named.maxudp1460 Adds "-T maxudp1460" to the command line, setting the
-                     maximum UDP size handled by named to 1460.
-
-    named.maxudp512  Adds "-T maxudp512" to the command line, setting the
-                     maximum UDP size handled by named to 512.
-
-    named.noedns     Appends "-T noedns" to the command line, which disables
-                     recognition of EDNS options in messages.
-
-    named.notcp      Adds "-T notcp", which disables TCP in "named".
-
-    named.soa        Appends "-T nosoa" to the command line, which disables
-                     the addition of SOA records to negative responses (or to
-                     the additional section if the response is triggered by RPZ
-                     rewriting).
-
-### Running Nameservers Interactively
-
-In order to debug the nameservers, you can let pytest perform the nameserver
-setup and interact with the servers before the test starts, or even at specific
-points during the test, using the `--trace` option to drop you into pdb debugger
-which pauses the execution of the tests, while keeping the server state intact:
-
-    pytest -k dns64 --trace
-
-
-## Developer Notes
-
-### Test discovery and collection
-
-There are two distinct types of system tests. The first is a shell script
-tests.sh containing individual test cases executed sequentially and the
-success/failure is determined by return code. The second type is a regular
-pytest file which contains test functions.
-
-Dealing with the regular pytest files doesn't require any special consideration
-as long as the naming conventions are met. Discovering the tests.sh tests is
-more complicated.
-
-The chosen solution is to add a bit of glue for each system test. For every
-tests.sh, there is an accompanying tests_sh_*.py file that contains a test
-function which utilizes a custom run_tests_sh fixture to call the tests.sh
-script. Other solutions were tried and eventually rejected. While this
-introduces a bit of extra glue, it is the most portable, compatible and least
-complex solution.
-
-### Compatibility with older pytest version
-
-Keep in mind that the pytest runner must work with ancient versions of pytest.
-When implementing new features, it is advisable to check feature support in
-pytest and pytest-xdist in older distributions first.
-
-As a general rule, any changes to the pytest runner need to keep working on all
-platforms in CI that use the pytest runner. As of 2023-11-14, the oldest
-supported version is whatever is available in EL8.
-
-We may need to add more compat code eventually to handle breaking upstream
-changes. For example, using request.fspath attribute is already deprecated in
-latest pytest.
-
-### Format of Shell Test Output
-
-Shell-based tests have the following format of output:
-
-    <letter>:<test-name>:<message> [(<number>)]
-
-e.g.
-
-    I:catz:checking that dom1.example is not served by primary (1)
-
-The meanings of the fields are as follows:
-
-<letter>
-This indicates the type of message.  This is one of:
-
-    S   Start of the test
-    A   Start of test (retained for backwards compatibility)
-    T   Start of test (retained for backwards compatibility)
-    E   End of the test
-    I   Information.  A test will typically output many of these messages
-        during its run, indicating test progress.  Note that such a message may
-        be of the form "I:testname:failed", indicating that a sub-test has
-        failed.
-    R   Result.  Each test will result in one such message, which is of the
-        form:
-
-                R:<test-tmpdir>:<result>
-
-        where <result> is one of:
-
-            PASS        The test passed
-            FAIL        The test failed
-            SKIPPED     The test was not run, usually because some
-                        prerequisites required to run the test are missing.
-
-<test-tmpdir>
-This is the name of the temporary test directory from which the message
-emanated, which is also the name of the subdirectory holding the test files.
-
-<message>
-This is text output by the test during its execution.
-
-(<number>)
-If present, this will correlate with a file created by the test.  The tests
-execute commands and route the output of each command to a file.  The name of
-this file depends on the command and the test, but will usually be of the form:
-
-    <command>.out.<suffix><number>
-
-e.g. nsupdate.out.test28, dig.out.q3.  This aids diagnosis of problems by
-allowing the output that caused the problem message to be identified.
-

bin/tests/system/_common/root.hint.blackhole

@@ -1,14 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; SPDX-License-Identifier: MPL-2.0
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0.  If a copy of the MPL was not distributed with this
-; file, you can obtain one at https://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 999999
-.			 IN NS	ns99.root-servers.nil.
-ns99.root-servers.nil.	 IN A	10.53.0.99

bin/tests/system/additional/ns3/named.conf.in

@@ -26,8 +26,6 @@ options {
 	minimal-responses no;
 };
 
-trust-anchors { };
-
 zone "." {
 	type hint;
 	file "root.hint";

bin/tests/system/addzone/ns3/named1.conf.in

@@ -34,5 +34,5 @@ zone "." {
 };
 
 primaries "test" {
-	10.53.0.99;
+	192.5.5.241;
 };

bin/tests/system/addzone/tests_rndc_deadlock.py

@@ -10,12 +10,25 @@
 # information regarding copyright ownership.
 
 import concurrent.futures
+import os
+import subprocess
 import time
 
-import isctest
+
+def run_rndc(server, rndc_command):
+    """
+    Send the specified 'rndc_command' to 'server' with a timeout of 10 seconds
+    """
+    rndc = os.getenv("RNDC")
+    port = os.getenv("CONTROLPORT")
+
+    cmdline = [rndc, "-c", "../_common/rndc.conf", "-p", port, "-s", server]
+    cmdline.extend(rndc_command)
+
+    subprocess.check_output(cmdline, stderr=subprocess.STDOUT, timeout=10)
 
 
-def rndc_loop(test_state, domain, ns3):
+def rndc_loop(test_state, domain):
     """
     Run "rndc addzone", "rndc modzone", and "rndc delzone" in a tight loop
     until the test is considered finished, ignoring errors
@@ -32,33 +45,35 @@ def rndc_loop(test_state, domain, ns3):
 
     while not test_state["finished"]:
         for command in rndc_commands:
-            ns3.rndc(" ".join(command), ignore_errors=True, log=False)
+            try:
+                run_rndc("10.53.0.3", command)
+            except subprocess.SubprocessError:
+                pass
 
 
-def check_if_server_is_responsive(ns3):
+def check_if_server_is_responsive():
     """
     Check if server status can be successfully retrieved using "rndc status"
     """
     try:
-        ns3.rndc("status", log=False)
+        run_rndc("10.53.0.3", ["status"])
         return True
-    except isctest.rndc.RNDCException:
+    except subprocess.SubprocessError:
         return False
 
 
-def test_rndc_deadlock(servers):
+def test_rndc_deadlock():
     """
     Test whether running "rndc addzone", "rndc modzone", and "rndc delzone"
     commands concurrently does not trigger a deadlock
     """
     test_state = {"finished": False}
-    ns3 = servers["ns3"]
 
     # Create 4 worker threads running "rndc" commands in a loop.
     with concurrent.futures.ThreadPoolExecutor() as executor:
         for i in range(1, 5):
             domain = "example%d" % i
-            executor.submit(rndc_loop, test_state, domain, ns3)
+            executor.submit(rndc_loop, test_state, domain)
 
         # Run "rndc status" 10 times, with 1-second pauses between attempts.
         # Each "rndc status" invocation has a timeout of 10 seconds.  If any of
@@ -66,7 +81,7 @@ def test_rndc_deadlock(servers):
         server_is_responsive = True
         attempts = 10
         while server_is_responsive and attempts > 0:
-            server_is_responsive = check_if_server_is_responsive(ns3)
+            server_is_responsive = check_if_server_is_responsive()
             attempts -= 1
             time.sleep(1)
 

bin/tests/system/allow-query/tests.sh

@@ -639,9 +639,9 @@ n=$((n + 1))
 echo_i "test $n: default allow-recursion configuration"
 ret=0
 nextpart ns3/named.run >/dev/null
-$DIG -p ${PORT} @10.53.0.3 -b 127.0.0.1 a.normal.example a >dig.out.ns3.1.$n || ret=1
+$DIG -p ${PORT} @10.53.0.3 -b 127.0.0.1 a.normal.example a >dig.out.ns3.1.$n
 grep 'status: NOERROR' dig.out.ns3.1.$n >/dev/null || ret=1
-$DIG -p ${PORT} @10.53.0.3 -b 10.53.0.1 a.normal.example a >dig.out.ns3.2.$n || ret=1
+$DIG -p ${PORT} @10.53.0.3 -b 10.53.0.1 a.normal.example a >dig.out.ns3.2.$n
 grep 'status: REFUSED' dig.out.ns3.2.$n >/dev/null || ret=1
 grep 'EDE: 18 (Prohibited)' dig.out.ns3.2.$n >/dev/null || ret=1
 nextpart ns3/named.run | grep 'allow-recursion did not match' >/dev/null || ret=1
@@ -652,9 +652,9 @@ status=$((status + ret))
 n=$((n + 1))
 echo_i "test $n: default allow-query-cache configuration"
 ret=0
-$DIG -p ${PORT} @10.53.0.3 -b 127.0.0.1 ns . >dig.out.ns3.1.$n || ret=1
+$DIG -p ${PORT} @10.53.0.3 -b 127.0.0.1 ns . >dig.out.ns3.1.$n
 grep 'status: NOERROR' dig.out.ns3.1.$n >/dev/null || ret=1
-$DIG -p ${PORT} @10.53.0.3 -b 10.53.0.1 ns . >dig.out.ns3.2.$n || ret=1
+$DIG -p ${PORT} @10.53.0.3 -b 10.53.0.1 ns . >dig.out.ns3.2.$n
 grep 'status: REFUSED' dig.out.ns3.2.$n >/dev/null || ret=1
 grep 'EDE: 18 (Prohibited)' dig.out.ns3.2.$n >/dev/null || ret=1
 nextpart ns3/named.run | grep 'allow-recursion did not match' >/dev/null || ret=1
@@ -669,11 +669,11 @@ rndc_reload ns3 10.53.0.3
 echo_i "test $n: block recursion-on, allow query-cache-on"
 ret=0
 # this should query the cache, and an answer should already be there
-$DIG -p ${PORT} @10.53.0.3 a.normal.example a >dig.out.ns3.1.$n || ret=1
+$DIG -p ${PORT} @10.53.0.3 a.normal.example a >dig.out.ns3.1.$n
 grep 'recursion requested but not available' dig.out.ns3.1.$n >/dev/null || ret=1
 grep 'ANSWER: 1' dig.out.ns3.1.$n >/dev/null || ret=1
 # this should require recursion and therefore can't get an answer
-$DIG -p ${PORT} @10.53.0.3 b.normal.example a >dig.out.ns3.2.$n || ret=1
+$DIG -p ${PORT} @10.53.0.3 b.normal.example a >dig.out.ns3.2.$n
 grep 'recursion requested but not available' dig.out.ns3.2.$n >/dev/null || ret=1
 grep 'ANSWER: 0' dig.out.ns3.2.$n >/dev/null || ret=1
 nextpart ns3/named.run | grep 'allow-recursion-on did not match' >/dev/null || ret=1
@@ -688,18 +688,18 @@ rndc_reload ns3 10.53.0.3
 echo_i "test $n: inheritance of allow-query-cache-on"
 ret=0
 # this should query the cache, an answer should already be there
-$DIG -p ${PORT} @10.53.0.3 a.normal.example a >dig.out.ns3.1.$n || ret=1
+$DIG -p ${PORT} @10.53.0.3 a.normal.example a >dig.out.ns3.1.$n
 grep 'ANSWER: 1' dig.out.ns3.1.$n >/dev/null || ret=1
 # this should be refused due to allow-recursion-on/allow-query-cache-on
-$DIG -p ${PORT} @10.53.1.2 a.normal.example a >dig.out.ns3.2.$n || ret=1
+$DIG -p ${PORT} @10.53.1.2 a.normal.example a >dig.out.ns3.2.$n
 grep 'recursion requested but not available' dig.out.ns3.2.$n >/dev/null || ret=1
 grep 'status: REFUSED' dig.out.ns3.2.$n >/dev/null || ret=1
 grep 'EDE: 18 (Prohibited)' dig.out.ns3.2.$n >/dev/null || ret=1
 # this should require recursion and should be allowed
-$DIG -p ${PORT} @10.53.0.3 c.normal.example a >dig.out.ns3.3.$n || ret=1
+$DIG -p ${PORT} @10.53.0.3 c.normal.example a >dig.out.ns3.3.$n
 grep 'ANSWER: 1' dig.out.ns3.3.$n >/dev/null || ret=1
 # this should require recursion and be refused
-$DIG -p ${PORT} @10.53.1.2 d.normal.example a >dig.out.ns3.4.$n || ret=1
+$DIG -p ${PORT} @10.53.1.2 d.normal.example a >dig.out.ns3.4.$n
 grep 'recursion requested but not available' dig.out.ns3.4.$n >/dev/null || ret=1
 grep 'status: REFUSED' dig.out.ns3.4.$n >/dev/null || ret=1
 grep 'EDE: 18 (Prohibited)' dig.out.ns3.4.$n >/dev/null || ret=1
@@ -715,18 +715,18 @@ rndc_reload ns3 10.53.0.3
 echo_i "test $n: inheritance of allow-recursion-on"
 ret=0
 # this should query the cache, an answer should already be there
-$DIG -p ${PORT} @10.53.0.3 a.normal.example a >dig.out.ns3.1.$n || ret=1
+$DIG -p ${PORT} @10.53.0.3 a.normal.example a >dig.out.ns3.1.$n
 grep 'ANSWER: 1' dig.out.ns3.1.$n >/dev/null || ret=1
 # this should be refused due to allow-recursion-on/allow-query-cache-on
-$DIG -p ${PORT} @10.53.1.2 a.normal.example a >dig.out.ns3.2.$n || ret=1
+$DIG -p ${PORT} @10.53.1.2 a.normal.example a >dig.out.ns3.2.$n
 grep 'recursion requested but not available' dig.out.ns3.2.$n >/dev/null || ret=1
 grep 'status: REFUSED' dig.out.ns3.2.$n >/dev/null || ret=1
 grep 'EDE: 18 (Prohibited)' dig.out.ns3.2.$n >/dev/null || ret=1
 # this should require recursion and should be allowed
-$DIG -p ${PORT} @10.53.0.3 e.normal.example a >dig.out.ns3.3.$n || ret=1
+$DIG -p ${PORT} @10.53.0.3 e.normal.example a >dig.out.ns3.3.$n
 grep 'ANSWER: 1' dig.out.ns3.3.$n >/dev/null || ret=1
 # this should require recursion and be refused
-$DIG -p ${PORT} @10.53.1.2 f.normal.example a >dig.out.ns3.4.$n || ret=1
+$DIG -p ${PORT} @10.53.1.2 f.normal.example a >dig.out.ns3.4.$n
 grep 'recursion requested but not available' dig.out.ns3.4.$n >/dev/null || ret=1
 grep 'status: REFUSED' dig.out.ns3.4.$n >/dev/null || ret=1
 grep 'EDE: 18 (Prohibited)' dig.out.ns3.4.$n >/dev/null || ret=1

bin/tests/system/auth/tests.sh

@@ -180,7 +180,7 @@ status=$((status + ret))
 n=$((n + 1))
 echo_i "check that CHAOS addresses are compared correctly ($n)"
 ret=0
-$DIG $DIGOPTS @10.53.0.1 +noall +answer ch test.example.chaos >dig.out.test$n || ret=1
+$DIG $DIGOPTS @10.53.0.1 +noall +answer ch test.example.chaos >dig.out.test$n
 lines=$(wc -l <dig.out.test$n)
 [ ${lines:-0} -eq 2 ] || ret=1
 [ $ret -eq 0 ] || echo_i "failed"

bin/tests/system/autosign/clean.sh

@@ -35,7 +35,7 @@ rm -f ns2/child.nsec3.example.db
 rm -f ns2/child.optout.example.db
 rm -f ns2/example.db
 rm -f ns2/insecure.secure.example.db
-rm -f ns2/nsec3-with-ent.db
+rm -f ns2/optout-with-ent.db
 rm -f ns2/private.secure.example.db
 rm -f ns2/signing.*
 rm -f ns3/*.nzd ns3/*.nzd-lock ns3/*.nzf

bin/tests/system/autosign/ns2/keygen.sh

@@ -55,9 +55,9 @@ $DSFROMKEY Kbar.+013+60101.key >dsset-bar.
 $SIGNER -S -o bar. -O full $zonefile >signing.bar.out 2>&1
 
 # a zone with empty non-terminals.
-zone=nsec3-with-ent
-zonefile=nsec3-with-ent.db
-infile=nsec3-with-ent.db.in
+zone=optout-with-ent
+zonefile=optout-with-ent.db
+infile=optout-with-ent.db.in
 cat $infile >$zonefile
 kskname=$($KEYGEN -a ${DEFAULT_ALGORITHM} -3 -q -fk $zone)
 $KEYGEN -a ${DEFAULT_ALGORITHM} -3 -q $zone >/dev/null

bin/tests/system/autosign/ns2/named.conf.in

@@ -67,7 +67,7 @@ dnssec-policy "optout" {
 		zsk key-directory lifetime unlimited algorithm @DEFAULT_ALGORITHM@;
 	};
 
-	nsec3param iterations 0 optout yes salt-length 0;
+	nsec3param iterations 1 optout yes salt-length 0;
 };
 
 zone "." {
@@ -134,14 +134,14 @@ zone "child.optout.example" {
 	dnssec-policy optout;
 };
 
-zone "nsec3-with-ent" {
+zone "optout-with-ent" {
 	type primary;
-	file "nsec3-with-ent.db";
+	file "optout-with-ent.db";
 	allow-query { any; };
 	allow-transfer { any; };
 	allow-update { any; };
 	inline-signing no;
-	dnssec-policy nsec3;
+	dnssec-policy optout;
 };
 
 include "trusted.conf";

bin/tests/system/autosign/ns3/keygen.sh

@@ -195,14 +195,6 @@ $KEYGEN -q -a $DEFAULT_ALGORITHM -fk $zone >kg.out 2>&1 || dumpit kg.out
 $KEYGEN -q -a $DEFAULT_ALGORITHM $zone >kg.out 2>&1 || dumpit kg.out
 $SIGNER -S -3 beef -A -o $zone -f $zonefile $infile >s.out || dumpit s.out
 
-#
-# NSEC3->NSEC3 transition test zone.
-#
-setup nsec3-to-nsec3.example
-$KEYGEN -q -a $DEFAULT_ALGORITHM -fk $zone >kg.out 2>&1 || dumpit kg.out
-$KEYGEN -q -a $DEFAULT_ALGORITHM $zone >kg.out 2>&1 || dumpit kg.out
-$SIGNER -S -3 beef -A -o $zone -f $zonefile $infile >s.out || dumpit s.out
-
 #
 # Introducing a pre-published key test.
 #

bin/tests/system/autosign/ns3/named.conf.in

@@ -261,16 +261,6 @@ zone "nsec3-to-nsec.example" {
 	file "nsec3-to-nsec.example.db";
 	allow-update { any; };
 	inline-signing no;
-	max-journal-size 10M;
-	dnssec-policy autosign;
-};
-
-zone "nsec3-to-nsec3.example" {
-	type primary;
-	file "nsec3-to-nsec3.example.db";
-	allow-update { any; };
-	inline-signing no;
-	max-journal-size 10M;
 	dnssec-policy nsec3;
 };
 

bin/tests/system/autosign/ns3/nozsk.example.db.in

@@ -9,7 +9,7 @@
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
 
-$TTL 3600	; 1 hour
+$TTL 300	; 5 minutes
 @			IN SOA	mname1. . (
 				1          ; serial
 				20         ; refresh (20 seconds)

bin/tests/system/autosign/ns3/nsec3-to-nsec3.example.db.in

@@ -1,26 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; SPDX-License-Identifier: MPL-2.0
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0.  If a copy of the MPL was not distributed with this
-; file, you can obtain one at https://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 300	; 5 minutes
-@			IN SOA	mname1. . (
-				2009102722 ; serial
-				20         ; refresh (20 seconds)
-				20         ; retry (20 seconds)
-				1814400    ; expire (3 weeks)
-				3600       ; minimum (1 hour)
-				)
-			NS	ns
-ns			A	10.53.0.3
-
-a			A	10.0.0.1
-b			A	10.0.0.2
-d			A	10.0.0.4
-x			CNAME	a

bin/tests/system/autosign/tests.sh

@@ -258,7 +258,7 @@ echo_i "dumping zone files"
 
 now="$(TZ=UTC date +%Y%m%d%H%M%S)"
 check_expiry() (
-  $DIG $DIGOPTS AXFR oldsigs.example @10.53.0.3 >dig.out.test$n || return 1
+  $DIG $DIGOPTS AXFR oldsigs.example @10.53.0.3 >dig.out.test$n
   nearest_expiration="$(awk '$4 == "RRSIG" { print $9 }' <dig.out.test$n | sort -n | head -1)"
   if [ "$nearest_expiration" -le "$now" ]; then
     echo_i "failed: $nearest_expiration <= $now"
@@ -822,7 +822,7 @@ echo_i "prepublish key for ZSK $id"
 newserial=$oldserial
 try=0
 while [ $oldserial -eq $newserial -a $try -lt 42 ]; do
-  $DIG $DIGOPTS +short soa prepub.example @10.53.0.3 >dig.out.ns3.test$n.2 || true
+  $DIG $DIGOPTS +short soa prepub.example @10.53.0.3 >dig.out.ns3.test$n.2
   newserial=$(cat dig.out.ns3.test$n.2 | awk '$0 !~ /SOA/ {print $3}')
   sleep 1
   try=$((try + 1))
@@ -890,8 +890,7 @@ checkprivate private.secure.example 10.53.0.3 2 || ret=1 # pre-signed
 checkprivate nsec3.example 10.53.0.3 || ret=1
 checkprivate nsec3.nsec3.example 10.53.0.3 || ret=1
 checkprivate nsec3.optout.example 10.53.0.3 || ret=1
-checkprivate nsec3-to-nsec.example 10.53.0.3 2 || ret=1  # automatically removed
-checkprivate nsec3-to-nsec3.example 10.53.0.3 2 || ret=1 # automatically removed
+checkprivate nsec3-to-nsec.example 10.53.0.3 2 || ret=1 # automatically removed
 if $SHELL ../testcrypto.sh -q RSASHA1; then
   checkprivate nsec-only.example 10.53.0.3 || ret=1
 fi
@@ -1103,8 +1102,8 @@ status=$((status + ret))
 
 echo_i "test CDS and CDNSKEY auto generation ($n)"
 ret=0
-$DIG $DIGOPTS @10.53.0.3 sync.example cds >dig.out.ns3.cdstest$n || ret=1
-$DIG $DIGOPTS @10.53.0.3 sync.example cdnskey >dig.out.ns3.cdnskeytest$n || ret=1
+$DIG $DIGOPTS @10.53.0.3 sync.example cds >dig.out.ns3.cdstest$n
+$DIG $DIGOPTS @10.53.0.3 sync.example cdnskey >dig.out.ns3.cdnskeytest$n
 grep -i "sync.example.*in.cds.*[1-9][0-9]* " dig.out.ns3.cdstest$n >/dev/null || ret=1
 grep -i "sync.example.*in.cdnskey.*257 " dig.out.ns3.cdnskeytest$n >/dev/null || ret=1
 n=$((n + 1))
@@ -1113,9 +1112,9 @@ status=$((status + ret))
 
 echo_i "test 'csk' affects DNSKEY/CDS/CDNSKEY ($n)"
 ret=0
-$DIG $DIGOPTS @10.53.0.3 sync.example dnskey >dig.out.ns3.dnskeytest$n || ret=1
-$DIG $DIGOPTS @10.53.0.3 sync.example cdnskey >dig.out.ns3.cdnskeytest$n || ret=1
-$DIG $DIGOPTS @10.53.0.3 sync.example cds >dig.out.ns3.cdstest$n || ret=1
+$DIG $DIGOPTS @10.53.0.3 sync.example dnskey >dig.out.ns3.dnskeytest$n
+$DIG $DIGOPTS @10.53.0.3 sync.example cdnskey >dig.out.ns3.cdnskeytest$n
+$DIG $DIGOPTS @10.53.0.3 sync.example cds >dig.out.ns3.cdstest$n
 lines=$(awk '$4 == "RRSIG" && $5 == "DNSKEY" {print}' dig.out.ns3.dnskeytest$n | wc -l)
 test ${lines:-0} -eq 2 || ret=1
 lines=$(awk '$4 == "RRSIG" && $5 == "CDNSKEY" {print}' dig.out.ns3.cdnskeytest$n | wc -l)
@@ -1128,9 +1127,9 @@ status=$((status + ret))
 
 echo_i "test 'ksk' affects DNSKEY/CDS/CDNSKEY ($n)"
 ret=0
-$DIG $DIGOPTS @10.53.0.3 kskonly.example dnskey >dig.out.ns3.dnskeytest$n || ret=1
-$DIG $DIGOPTS @10.53.0.3 kskonly.example cdnskey >dig.out.ns3.cdnskeytest$n || ret=1
-$DIG $DIGOPTS @10.53.0.3 kskonly.example cds >dig.out.ns3.cdstest$n || ret=1
+$DIG $DIGOPTS @10.53.0.3 kskonly.example dnskey >dig.out.ns3.dnskeytest$n
+$DIG $DIGOPTS @10.53.0.3 kskonly.example cdnskey >dig.out.ns3.cdnskeytest$n
+$DIG $DIGOPTS @10.53.0.3 kskonly.example cds >dig.out.ns3.cdstest$n
 lines=$(awk '$4 == "RRSIG" && $5 == "DNSKEY" {print}' dig.out.ns3.dnskeytest$n | wc -l)
 test ${lines:-0} -eq 1 || ret=1
 lines=$(awk '$4 == "RRSIG" && $5 == "CDNSKEY" {print}' dig.out.ns3.cdnskeytest$n | wc -l)
@@ -1178,7 +1177,7 @@ status=$((status + ret))
 
 echo_i "check that zone with inactive ZSK and active KSK is properly autosigned ($n)"
 ret=0
-$DIG $DIGOPTS @10.53.0.3 axfr inaczsk2.example >dig.out.ns3.test$n || ret=1
+$DIG $DIGOPTS @10.53.0.3 axfr inaczsk2.example >dig.out.ns3.test$n
 grep "SOA ${DEFAULT_ALGORITHM_NUMBER} 2" dig.out.ns3.test$n >/dev/null || ret=1
 n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
@@ -1270,14 +1269,14 @@ n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status + ret))
 
-echo_i "check removal of ENT NSEC3 records when delegations are removed ($n)"
-zone=nsec3-with-ent
-hash=M9SFFA181BCTR8D18LQUPST4N6BL304D
+echo_i "check removal of ENT NSEC3 records when opt out delegations are removed"
+zone=optout-with-ent
+hash=JTR8R6AVFULU0DQH9I6HNN2KUK5956EL
 
 # check that NSEC3 for ENT is present
 echo_i "check ENT NSEC3 is initially present"
 ret=0
-$DIG $DIGOPTS @10.53.0.2 a "ent.${zone}" >dig.out.pre.ns2.test$n || ret=1
+$DIG $DIGOPTS @10.53.0.2 a "ent.${zone}" >dig.out.pre.ns2.test$n
 grep "status: NOERROR" dig.out.pre.ns2.test$n >/dev/null || ret=1
 grep "ANSWER: 0, AUTHORITY: 4, " dig.out.pre.ns2.test$n >/dev/null || ret=1
 grep "^${hash}.${zone}." dig.out.pre.ns2.test$n >/dev/null || ret=1
@@ -1295,8 +1294,8 @@ ret=0
   echo send
 ) | $NSUPDATE
 # check that NSEC3 for ENT is still present
-$DIG $DIGOPTS @10.53.0.2 a "ent.${zone}" >dig.out.pre.ns2.test$n || ret=1
-$DIG $DIGOPTS @10.53.0.2 a "ent.${zone}" >dig.out.mid.ns2.test$n || ret=1
+$DIG $DIGOPTS @10.53.0.2 a "ent.${zone}" >dig.out.pre.ns2.test$n
+$DIG $DIGOPTS @10.53.0.2 a "ent.${zone}" >dig.out.mid.ns2.test$n
 grep "status: NOERROR" dig.out.mid.ns2.test$n >/dev/null || ret=1
 grep "ANSWER: 0, AUTHORITY: 4, " dig.out.mid.ns2.test$n >/dev/null || ret=1
 grep "^${hash}.${zone}." dig.out.mid.ns2.test$n >/dev/null || ret=1
@@ -1315,55 +1314,15 @@ ret=0
 ) | $NSUPDATE
 # check that NSEC3 for ENT is gone
 echo_i "check ENT NSEC3 is gone for zone $zone hash $hash"
-$DIG $DIGOPTS @10.53.0.2 a "ent.${zone}" >dig.out.post.ns2.test$n || ret=1
+$DIG $DIGOPTS @10.53.0.2 a "ent.${zone}" >dig.out.post.ns2.test$n
 grep "status: NXDOMAIN" dig.out.post.ns2.test$n >/dev/null || ret=1
 grep "ANSWER: 0, AUTHORITY: 4, " dig.out.post.ns2.test$n >/dev/null || ret=1
 grep "^${hash}.${zone}." dig.out.post.ns2.test$n >/dev/null && ret=1
-$DIG $DIGOPTS @10.53.0.2 axfr "${zone}" >dig.out.axfr.ns2.test$n || ret=1
+$DIG $DIGOPTS @10.53.0.2 axfr "${zone}" >dig.out.axfr.ns2.test$n
 grep "^${hash}.${zone}." dig.out.axfr.ns2.test$n >/dev/null && ret=1
 n=$((n + 1))
 if [ "$ret" -ne 0 ]; then echo_i "failed"; fi
 status=$((status + ret))
 
-echo_i "check that the startup change from NSEC3 to NSEC is properly signed ($n)"
-ret=0
-$JOURNALPRINT ns3/nsec3-to-nsec.example.db.jnl \
-  | awk 'BEGIN { private=0; rrsig=0; ok=0 }
-$1 == "del" && $5 == "SOA" { if (private || rrsig) { if (private == rrsig) { exit(0); } else { exit(1); } } }
-$1 == "add" && $5 == "TYPE65534" { private=1 }
-$1 == "add" && $5 == "RRSIG" && $6 == "TYPE65534" { rrsig=1 }
-END { if (private || rrsig) { if (private == rrsig) { exit(0); } else { exit(1); } } else { exit (1); } }
-' || ret=1
-n=$((n + 1))
-if [ "$ret" -ne 0 ]; then echo_i "failed"; fi
-status=$((status + ret))
-
-echo_i "check that NSEC3 to NSEC builds the NSEC chain first ($n)"
-ret=0
-$JOURNALPRINT ns3/nsec3-to-nsec.example.db.jnl \
-  | awk 'BEGIN { nsec3param=0; nsec=0 }
-$1 == "del" && $5 == "SOA" { if (nsec3param || nsec) { if (nsec3param && !nsec) { exit(1); } else { exit(0); } } }
-$1 == "del" && $5 == "NSEC3PARAM" { nsec3param=1 }
-$1 == "add" && $2 == "nsec3-to-nsec.example." && $5 == "NSEC" { nsec=1 }
-END { if (nsec3param || nsec) { if (nsec3param && !nsec) { exit(1); } else { exit(0); } } else { exit(1); } }
-' || ret=1
-n=$((n + 1))
-if [ "$ret" -ne 0 ]; then echo_i "failed"; fi
-status=$((status + ret))
-
-echo_i "check that NSEC3 to NSEC3 builds the new NSEC3 chain first ($n)"
-ret=0
-$JOURNALPRINT ns3/nsec3-to-nsec3.example.db.jnl \
-  | awk 'BEGIN { addnsec3param=0; delnsec3param=0; nsec3=0 }
-$1 == "del" && $5 == "SOA" { if (delnsec3param || nsec3 || addnsec3param) { if (delnsec3param && (!nsec3 || !addnsec3param)) { exit(1); } else { exit(0); } } }
-$1 == "del" && $5 == "NSEC3PARAM" { delnsec3param=1 }
-$1 == "add" && $5 == "NSEC3PARAM" { addnsec3param=1 }
-$1 == "add" && $5 == "NSEC3" { nsec3=1 }
-END { if (delnsec3param || nsec3 || addnsec3param) { if (delnsec3param && (!nsec3 || !addnsec3param)) { exit(1); } else { exit(0); } } else { exit(1); } }
-' || ret=1
-n=$((n + 1))
-if [ "$ret" -ne 0 ]; then echo_i "failed"; fi
-status=$((status + ret))
-
 echo_i "exit status: $status"
 [ $status -eq 0 ] || exit 1

bin/tests/system/autosign/tests_sh_autosign.py

@@ -10,9 +10,5 @@
 # information regarding copyright ownership.
 
 
-import isctest.mark
-
-
-@isctest.mark.flaky(max_runs=2)
 def test_autosign(run_tests_sh):
     run_tests_sh()

bin/tests/system/builtin/tests.sh

@@ -120,8 +120,7 @@ A.E.F.IP6.ARPA
 B.E.F.IP6.ARPA
 8.B.D.0.1.0.0.2.IP6.ARPA
 EMPTY.AS112.ARPA
-HOME.ARPA
-RESOLVER.ARPA"
+HOME.ARPA"
 
 n=$((n + 1))
 ret=0
@@ -135,7 +134,7 @@ for zone in ${emptyzones}; do
   count=$((count + 1))
 done
 lines=$(grep "automatic empty zone: " ns1/named.run | wc -l)
-test $count -eq $lines -a $count -eq 100 || {
+test $count -eq $lines -a $count -eq 99 || {
   ret=1
   echo_i "failed (count mismatch)"
 }

bin/tests/system/cacheclean/ns2/named.conf.in

@@ -25,8 +25,6 @@ options {
 	dnssec-validation yes;
 };
 
-trust-anchors { };
-
 key rndc_key {
 	secret "1234abcd8765";
 	algorithm @DEFAULT_HMAC@;

bin/tests/system/chain/ans3/ans.pl

@@ -22,14 +22,9 @@ my $pidf = new IO::File "ans.pid", "w" or die "cannot open pid file: $!";
 print $pidf "$$\n" or die "cannot write pid file: $!";
 $pidf->close or die "cannot close pid file: $!";
 sub rmpid { unlink "ans.pid"; exit 1; };
-sub term { };
 
 $SIG{INT} = \&rmpid;
-if ($Net::DNS::VERSION > 1.41) {
-    $SIG{TERM} = \&term;
-} else {
-    $SIG{TERM} = \&rmpid;
-}
+$SIG{TERM} = \&rmpid;
 
 my $localaddr = "10.53.0.3";
 
@@ -51,22 +46,22 @@ sub reply_handler {
     STDOUT->flush();
 
     if ($qname eq "example.broken") {
-	if ($qtype eq "SOA") {
+        if ($qtype eq "SOA") {
 	    my $rr = new Net::DNS::RR("$qname $ttl $qclass SOA . . 0 0 0 0 0");
 	    push @ans, $rr;
-	} elsif ($qtype eq "NS") {
+        } elsif ($qtype eq "NS") {
 	    my $rr = new Net::DNS::RR("$qname $ttl $qclass NS $nsname");
 	    push @ans, $rr;
 	    $rr = new Net::DNS::RR("$nsname $ttl $qclass A $localaddr");
 	    push @add, $rr;
-	}
-	$rcode = "NOERROR";
+        }
+        $rcode = "NOERROR";
     } elsif ($qname eq "cname-to-$synth2") {
-	my $rr = new Net::DNS::RR("$qname $ttl $qclass CNAME name.$synth2");
+        my $rr = new Net::DNS::RR("$qname $ttl $qclass CNAME name.$synth2");
 	push @ans, $rr;
-	$rr = new Net::DNS::RR("name.$synth2 $ttl $qclass CNAME name");
+        $rr = new Net::DNS::RR("name.$synth2 $ttl $qclass CNAME name");
 	push @ans, $rr;
-	$rr = new Net::DNS::RR("$synth2 $ttl $qclass DNAME .");
+        $rr = new Net::DNS::RR("$synth2 $ttl $qclass DNAME .");
 	push @ans, $rr;
 	$rcode = "NOERROR";
     } elsif ($qname eq "$synth" || $qname eq "$synth2") {
@@ -115,30 +110,6 @@ sub reply_handler {
 		push @ans, $rr;
 	}
 	$rcode = "NOERROR";
-    # The next few branches produce a zone with an illegal NS below a DNAME.
-    } elsif ($qname eq "jeff.dname") {
-	if ($qtype eq "SOA") {
-	    my $rr = new Net::DNS::RR("$qname $ttl $qclass SOA . . 0 0 0 0 0");
-	    push @ans, $rr;
-	} elsif ($qtype eq "NS") {
-	    my $rr = new Net::DNS::RR("$qname $ttl $qclass NS ns.jeff.dname.");
-	    push @ans, $rr;
-	    $rr = new Net::DNS::RR("$nsname $ttl $qclass A $localaddr");
-	    push @add, $rr;
-	} elsif ($qtype eq "DNAME") {
-	    my $rr = new Net::DNS::RR("$qname $ttl $qclass DNAME mutt.example.");
-	    push @ans, $rr;
-	}
-	$rcode = "NOERROR";
-    } elsif ($qname eq "ns.jeff.dname") {
-	if ($qtype eq "A") {
-		my $rr = new Net::DNS::RR("$qname $ttl $qclass A 10.53.0.3");
-		push @ans, $rr;
-	} elsif ($qtype eq "AAAA") {
-		my $rr = new Net::DNS::RR("jeff.dname. $ttl $qclass SOA . . 0 0 0 0 $ttl");
-		push @auth, $rr;
-	}
-	$rcode = "NOERROR";
     } else {
 	$rcode = "REFUSED";
     }
@@ -157,11 +128,4 @@ my $ns = Net::DNS::Nameserver->new(
     Verbose => $verbose,
 );
 
-if ($Net::DNS::VERSION >= 1.42) {
-    $ns->start_server();
-    select(undef, undef, undef, undef);
-    $ns->stop_server();
-    unlink "ans.pid";
-} else {
-    $ns->main_loop;
-}
+$ns->main_loop;

bin/tests/system/chain/ns1/named.conf.in

@@ -24,6 +24,4 @@ options {
 	notify yes;
 };
 
-trust-anchors { };
-
 zone "." { type primary; file "root.db"; };

bin/tests/system/chain/ns1/root.db

@@ -30,10 +30,6 @@ ns3.example.broken.	A	10.53.0.3
 example.dname.		NS	ns3.example.dname.
 ns3.example.dname.	A	10.53.0.3
 
-; regression test for illegal NS below DNAME
-jeff.dname.		NS	ns.jeff.dname.
-ns.jeff.dname.	        A	10.53.0.3
-
 domain0.nil.		NS	ns2.domain0.nil
 domain1.nil.		NS	ns2.domain0.nil
 domain2.nil.		NS	ns2.domain0.nil

bin/tests/system/chain/ns2/example.db

@@ -48,9 +48,6 @@ signed-sub2		NS	ns2.sub2
 signed-sub2		DS	44137 8 2 1CB4F54E0B4F4F85109143113A3C679716A2377D86EB0907846A03FB 0C0A3927
 d			CNAME	d.signed-sub2
 
-mutt                    NS      ns5.mutt
-ns5.mutt                A       10.53.0.5
-
 ; long CNAME loop
 loop			CNAME	goop
 goop			CNAME	boop

bin/tests/system/chain/ns2/named.conf.in

@@ -26,11 +26,6 @@ options {
 	notify yes;
 };
 
-zone . {
-       type hint;
-       file "../../_common/root.hint";
-};
-
 zone "example" {
 	type primary;
 	file "example.db.signed";

bin/tests/system/chain/ns5/named.conf.in

@@ -40,8 +40,3 @@ zone "signed-sub5.example" {
 	type primary;
 	file "sub.db";
 };
-
-zone "mutt.example" {
-	type primary;
-	file "mutt.db";
-};

bin/tests/system/chain/ns7/named.conf.in

@@ -30,8 +30,6 @@ options {
 	};
 };
 
-trust-anchors { };
-
 key rndc_key {
 	secret "1234abcd8765";
 	algorithm @DEFAULT_HMAC@;

bin/tests/system/chain/tests.sh

@@ -626,16 +626,5 @@ grep 'status: NOERROR' dig.out.7.$n >/dev/null 2>&1 || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status + ret))
 
-# Regression test for GL #4652
-n=$((n + 1))
-echo_i "checking handling of illegal NS below DNAME ($n)"
-ret=0
-$DIG $DIGOPTS @10.53.0.7 DNAME jeff.dname. >dig.out.ns7.1.$n 2>&1
-grep 'status: NOERROR' dig.out.ns7.1.$n >/dev/null 2>&1 || ret=1
-$DIG $DIGOPTS @10.53.0.7 NS jeff.dname. >dig.out.ns7.2.$n 2>&1
-grep 'status: SERVFAIL' dig.out.ns7.2.$n >/dev/null 2>&1 || ret=1
-if [ $ret != 0 ]; then echo_i "failed"; fi
-status=$((status + ret))
-
 echo_i "exit status: $status"
 [ $status -eq 0 ] || exit 1

bin/tests/system/checkconf/bad-fetchparam.conf

@@ -1,17 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * SPDX-License-Identifier: MPL-2.0
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0.  If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-/* Bad fetch-quota-params */
-options {
-	fetch-quota-params 1 2 3 2;
-};

bin/tests/system/checkconf/bad-kasp-duration.conf

@@ -1,25 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * SPDX-License-Identifier: MPL-2.0
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0.  If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-dnssec-policy "invalid-sigrefresh" {
-	keys {
-		csk lifetime unlimited algorithm 13;
-	};
-	signatures-refresh P7.5D;
-};
-
-zone "example.net" {
-	type primary;
-	file "example.db";
-	dnssec-policy "invalid-sigrefresh";
-};

bin/tests/system/checkconf/bad-kasp-keydir-vs-keystore1.conf

@@ -1,59 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * SPDX-License-Identifier: MPL-2.0
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0.  If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-/*
- * The same zone in different views is using different DNSSEC policies, so it
- * may not use the same directory for storing keys.
- */
-
-
-key "keyforview1" {
-	algorithm "hmac-sha1";
-	secret "YPfMoAk6h+3iN8MDRQC004iSNHY=";
-};
-
-key "keyforview2" {
-	algorithm "hmac-sha1";
-	secret "4xILSZQnuO1UKubXHkYUsvBRPu8=";
-};
-
-key-store "store2" {
-	directory ".";
-};
-
-dnssec-policy "policy2" {
-	keys {
-		csk key-store "store2" lifetime unlimited algorithm 13;
-	};
-};
-
-view "example1" {
-	match-clients { key "keyforview1"; };
-
-	zone "example.net" {
-		type primary;
-		dnssec-policy "default";
-		key-directory ".";
-		file "example1.db";
-	};
-};
-
-view "example2" {
-	match-clients { key "keyforview2"; };
-
-	zone "example.net" {
-		type primary;
-		dnssec-policy "policy2";
-		file "example2.db";
-	};
-};

bin/tests/system/checkconf/bad-kasp-keydir-vs-keystore2.conf

@@ -1,59 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * SPDX-License-Identifier: MPL-2.0
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0.  If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-/*
- * In view "example1" no key-directory is set, so the default is used.
- * In view "example2" the key-store directory is set to "." which is the
- * default. This should fail because the same zone in different views is using
- * different DNSSEC policies.
- */
-
-key "keyforview1" {
-	algorithm "hmac-sha1";
-	secret "YPfMoAk6h+3iN8MDRQC004iSNHY=";
-};
-
-key "keyforview2" {
-	algorithm "hmac-sha1";
-	secret "4xILSZQnuO1UKubXHkYUsvBRPu8=";
-};
-
-key-store "store2" {
-	directory ".";
-};
-
-dnssec-policy "policy2" {
-	keys {
-		csk key-store "store2" lifetime unlimited algorithm 13;
-	};
-};
-
-view "example1" {
-	match-clients { key "keyforview1"; };
-
-	zone "example.net" {
-		type primary;
-		dnssec-policy "default";
-		file "example1.db";
-	};
-};
-
-view "example2" {
-	match-clients { key "keyforview2"; };
-
-	zone "example.net" {
-		type primary;
-		dnssec-policy "policy2";
-		file "example2.db";
-	};
-};

bin/tests/system/checkconf/bad-kasp-keydir-vs-keystore3.conf

@@ -1,64 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * SPDX-License-Identifier: MPL-2.0
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0.  If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-/*
- * The zone in view "example1" inherits the key directory value from "options",
- * but in view "example2" sets the key-store directory to the same value.
- * This should be detected as an error because the zone is using different
- * DNSSEC policies and should thus use different key directories.
- */
-
-key "keyforview1" {
-	algorithm "hmac-sha1";
-	secret "YPfMoAk6h+3iN8MDRQC004iSNHY=";
-};
-
-key "keyforview2" {
-	algorithm "hmac-sha1";
-	secret "4xILSZQnuO1UKubXHkYUsvBRPu8=";
-};
-
-key-store "store2" {
-	directory "keys";
-};
-
-dnssec-policy "policy2" {
-	keys {
-		csk key-store "store2" lifetime unlimited algorithm 13;
-	};
-};
-
-options {
-	key-directory "keys";
-};
-
-view "example1" {
-	match-clients { key "keyforview1"; };
-
-	zone "example.net" {
-		type primary;
-		/* key-directory inherited from options. */
-		dnssec-policy "default";
-		file "example1.db";
-	};
-};
-
-view "example2" {
-	match-clients { key "keyforview2"; };
-
-	zone "example.net" {
-		type primary;
-		dnssec-policy "policy2";
-		file "example2.db";
-	};
-};

bin/tests/system/checkconf/bad-kasp-keydir-vs-keystore4.conf

@@ -1,60 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * SPDX-License-Identifier: MPL-2.0
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0.  If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-/*
- * The zone inherits the key-directory from the "view" level. Both views use the
- * same directory for storing keys, but the zone uses a different DNSSEC policy
- * per view. This is a configuration error.
- */
-
-key "keyforview1" {
-	algorithm "hmac-sha1";
-	secret "YPfMoAk6h+3iN8MDRQC004iSNHY=";
-};
-
-key "keyforview2" {
-	algorithm "hmac-sha1";
-	secret "4xILSZQnuO1UKubXHkYUsvBRPu8=";
-};
-
-key-store "store2" {
-	directory "keys";
-};
-
-dnssec-policy "policy2" {
-	keys {
-		csk key-store "store2" lifetime unlimited algorithm 13;
-	};
-};
-
-view "example1" {
-	match-clients { key "keyforview1"; };
-
-	key-directory "keys";
-
-	zone "example.net" {
-		type primary;
-		dnssec-policy "default";
-		file "example1.db";
-	};
-};
-
-view "example2" {
-	match-clients { key "keyforview2"; };
-
-	zone "example.net" {
-		type primary;
-		dnssec-policy "policy2";
-		file "example2.db";
-	};
-};

bin/tests/system/checkconf/bad-kasp-keystore.conf

@@ -1,19 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * SPDX-License-Identifier: MPL-2.0
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0.  If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-// Bad dnssec-policy configuration because there is no key-store with this name.
-dnssec-policy "bad" {
-	keys {
-		csk key-store "ks404" lifetime unlimited algorithm 13;
-	};
-};

bin/tests/system/checkconf/bad-kasp-keystore1.conf

@@ -1,68 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * SPDX-License-Identifier: MPL-2.0
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0.  If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-/*
- * The same zone in different views is using different DNSSEC policies, so it
- * may not use the same key-store directory.
- */
-
-
-key "keyforview1" {
-	algorithm "hmac-sha1";
-	secret "YPfMoAk6h+3iN8MDRQC004iSNHY=";
-};
-
-key "keyforview2" {
-	algorithm "hmac-sha1";
-	secret "4xILSZQnuO1UKubXHkYUsvBRPu8=";
-};
-
-key-store "store1" {
-	directory "keys";
-};
-
-key-store "store2" {
-	directory "keys";
-};
-
-dnssec-policy "policy1" {
-	keys {
-		csk key-store "store1" lifetime unlimited algorithm 13;
-	};
-};
-
-dnssec-policy "policy2" {
-	keys {
-		csk key-store "store2" lifetime unlimited algorithm 13;
-	};
-};
-
-view "example1" {
-	match-clients { key "keyforview1"; };
-
-	zone "example.net" {
-		type primary;
-		dnssec-policy "policy1";
-		file "example1.db";
-	};
-};
-
-view "example2" {
-	match-clients { key "keyforview2"; };
-
-	zone "example.net" {
-		type primary;
-		dnssec-policy "policy2";
-		file "example2.db";
-	};
-};

bin/tests/system/checkconf/bad-kasp-keystore2.conf

@@ -1,64 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * SPDX-License-Identifier: MPL-2.0
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0.  If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-/*
- * Both policies use the same key-store. Should fail because the same zone in
- * different views is using different DNSSEC policies.
- */
-
-key "keyforview1" {
-	algorithm "hmac-sha1";
-	secret "YPfMoAk6h+3iN8MDRQC004iSNHY=";
-};
-
-key "keyforview2" {
-	algorithm "hmac-sha1";
-	secret "4xILSZQnuO1UKubXHkYUsvBRPu8=";
-};
-
-key-store "store" {
-	directory "keys";
-};
-
-dnssec-policy "policy1" {
-	keys {
-		csk key-store "store" lifetime unlimited algorithm 13;
-	};
-};
-
-dnssec-policy "policy2" {
-	keys {
-		csk key-store "store" lifetime unlimited algorithm 13;
-	};
-};
-
-
-view "example1" {
-	match-clients { key "keyforview1"; };
-
-	zone "example.net" {
-		type primary;
-		dnssec-policy "policy1";
-		file "example1.db";
-	};
-};
-
-view "example2" {
-	match-clients { key "keyforview2"; };
-
-	zone "example.net" {
-		type primary;
-		dnssec-policy "policy2";
-		file "example2.db";
-	};
-};

bin/tests/system/checkconf/bad-keystore-key-directory.conf

@@ -1,24 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * SPDX-License-Identifier: MPL-2.0
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0.  If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-// Bad key-store configuration because the keyword 'key-directory' may not
-// be used.
-key-store "key-directory" {
-	directory ".";
-};
-
-dnssec-policy "bad" {
-	keys {
-		csk key-store "key-directory" lifetime unlimited algorithm 13;
-	};
-};

bin/tests/system/checkconf/bad-proxy-encrypted-doh-plain.conf

@@ -1,22 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * SPDX-License-Identifier: MPL-2.0
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0.  If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-http local-http-server {
-	endpoints { "/dns-query"; };
-	listener-clients 100;
-	streams-per-connection 100;
-};
-
-options {
-	listen-on port 8080 proxy encrypted tls none http local-http-server { 10.53.0.1; };
-};

bin/tests/system/checkconf/bad-tls-cipher-suites-ciphers-string.conf

@@ -1,26 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * SPDX-License-Identifier: MPL-2.0
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0.  If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-tls local-tls {
-	protocols { TLSv1.3; };
-	key-file "key.pem";
-	cert-file "cert.pem";
-	dhparam-file "dhparam.pem";
-	cipher-suites "HIGH:!aNULL:!MD5:!RC4";
-	prefer-server-ciphers yes;
-	session-tickets no;
-};
-
-options {
-	listen-on port 853 tls local-tls { 10.53.0.1; };
-};

bin/tests/system/checkconf/bad-tls-cipher-suites-empty-string.conf

@@ -1,26 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * SPDX-License-Identifier: MPL-2.0
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0.  If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-tls local-tls {
-	protocols { TLSv1.3; };
-	key-file "key.pem";
-	cert-file "cert.pem";
-	dhparam-file "dhparam.pem";
-	cipher-suites "";
-	prefer-server-ciphers yes;
-	session-tickets no;
-};
-
-options {
-	listen-on port 853 tls local-tls { 10.53.0.1; };
-};

bin/tests/system/checkconf/bad-tls-cipher-suites-wrong-string.conf

@@ -1,26 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * SPDX-License-Identifier: MPL-2.0
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0.  If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-tls local-tls {
-	protocols { TLSv1.3; };
-	key-file "key.pem";
-	cert-file "cert.pem";
-	dhparam-file "dhparam.pem";
-	cipher-suites "lalalalalgggg";
-	prefer-server-ciphers yes;
-	session-tickets no;
-};
-
-options {
-	listen-on port 853 tls local-tls { 10.53.0.1; };
-};