WIP use user+net namespace

WIP namespaces.py
Merge branch 'nicki/add-another-placeholder-for-4480' into 'main'
2024-06-24 16:31:21 +02:00 · 2024-06-24 16:30:09 +02:00 · 2024-06-11 07:33:46 +00:00 · 2024-06-11 09:30:47 +02:00 · 2024-06-10 15:52:21 +00:00 · 2024-06-10 16:19:03 +02:00
304 changed files with 8046 additions and 3156 deletions
@@ -1538,3 +1538,5 @@ ffbe6b95371c99b7fb05e6de17a8d6b7bf4f629f
 4cb8b13987b930952238cc88e84272b8cf911933
 # Reformat sources with up-to-date clang-format-17
 79d93600116faabd89798522817ad95a69684fff
+# Reformat sources with up-to-date clang-format-18
+b7de2c7cb959fa35099d72c3f9b13938348c74e6
@@ -75,6 +75,7 @@ doc/man/dnssec-importkey.8in
 doc/man/dnssec-keyfromlabel.8in
 doc/man/dnssec-keygen.8in
 doc/man/dnssec-keymgr.8in
+doc/man/dnssec-ksr.8in
 doc/man/dnssec-revoke.8in
 doc/man/dnssec-settime.8in
 doc/man/dnssec-signzone.8in
@@ -15,7 +15,7 @@ variables:
  TEST_PARALLEL_JOBS: 4

  CONFIGURE: ./configure
-  CLANG_VERSION: 17
+  CLANG_VERSION: 18
  CLANG: "clang-${CLANG_VERSION}"
  SCAN_BUILD: "scan-build-${CLANG_VERSION}"
  LLVM_SYMBOLIZER: "/usr/lib/llvm-${CLANG_VERSION}/bin/llvm-symbolizer"
@@ -55,6 +55,8 @@ variables:
  BIND_STRESS_TEST_OS: linux
  BIND_STRESS_TEST_ARCH: amd64

+  HYPOTHESIS_PROFILE: "ci"
+
 default:
  # Allow all running CI jobs to be automatically canceled when a new
  # version of a branch is pushed.
@@ -71,6 +73,7 @@ stages:
  - performance
  - docs
  - postcheck
+  - postmerge
  - release

 ### Runner Tag Templates
@@ -80,14 +83,6 @@ stages:
    - libvirt
    - amd64

-# Jobs with these tags do not run on AWS but on permanent OVH systems.
-
-.linux-respdiff-amd64: &linux_respdiff_amd64
-  tags:
-    - linux
-    - ovh
-    - amd64
-
 # Autoscaling GitLab Runner on AWS EC2 (amd64)

 .linux-amd64: &linux_amd64
@@ -106,21 +101,23 @@ stages:
    - runner-manager
    - aarch64

-# Stress-testing runners
+# Autoscaling GitLab Runner on AWS EC2 (FreeBSD)

 .freebsd-stress-amd64: &freebsd_stress_amd64
  tags:
-    - amd64
+    - bsd-stress-test
    - aws
-    - bsd-stress
-    - stress
+    - autoscaler
+    - shell
+    - stress-test
+    - amd64

 ### Docker Image Templates

 # Alpine Linux

-.alpine-3.19-amd64: &alpine_3_19_amd64_image
-  image: "$CI_REGISTRY_IMAGE:alpine-3.19-amd64"
+.alpine-3.20-amd64: &alpine_3_20_amd64_image
+  image: "$CI_REGISTRY_IMAGE:alpine-3.20-amd64"
  <<: *linux_amd64

 # Oracle Linux
@@ -147,10 +144,6 @@ stages:
  image: "$CI_REGISTRY_IMAGE:debian-bullseye-amd64"
  <<: *linux_amd64

-.respdiff-debian-bookworm-amd64: &respdiff_debian_bookworm_amd64_image
-  image: "$CI_REGISTRY_IMAGE:debian-bookworm-amd64"
-  <<: *linux_respdiff_amd64
-
 .debian-bookworm-amd64: &debian_bookworm_amd64_image
  image: "$CI_REGISTRY_IMAGE:debian-bookworm-amd64"
  <<: *linux_amd64
@@ -175,16 +168,16 @@ stages:

 # Fedora

-.tsan-fedora-39-amd64: &tsan_fedora_39_amd64_image
-  image: "$CI_REGISTRY_IMAGE:tsan-fedora-39-amd64"
+.tsan-fedora-40-amd64: &tsan_fedora_40_amd64_image
+  image: "$CI_REGISTRY_IMAGE:tsan-fedora-40-amd64"
  <<: *linux_amd64

-.fedora-39-amd64: &fedora_39_amd64_image
-  image: "$CI_REGISTRY_IMAGE:fedora-39-amd64"
+.fedora-40-amd64: &fedora_40_amd64_image
+  image: "$CI_REGISTRY_IMAGE:fedora-40-amd64"
  <<: *linux_amd64

-.fedora-39-arm64: &fedora_39_arm64_image
-  image: "$CI_REGISTRY_IMAGE:fedora-39-arm64"
+.fedora-40-arm64: &fedora_40_arm64_image
+  image: "$CI_REGISTRY_IMAGE:fedora-40-arm64"
  <<: *linux_arm64

 # Ubuntu
@@ -197,6 +190,10 @@ stages:
  image: "$CI_REGISTRY_IMAGE:ubuntu-jammy-amd64"
  <<: *linux_amd64

+.ubuntu-noble-amd64: &ubuntu_noble_amd64_image
+  image: "$CI_REGISTRY_IMAGE:ubuntu-noble-amd64"
+  <<: *linux_amd64
+
 # Base image
 # This is a meta image that is used as a base for non-specific jobs

@@ -214,7 +211,7 @@ stages:
  <<: *libvirt_amd64

 .openbsd-amd64: &openbsd_amd64_image
-  image: "openbsd-7.4-x86_64"
+  image: "openbsd-7.5-x86_64"
  <<: *libvirt_amd64

 ### Job Templates
@@ -276,11 +273,11 @@ stages:

 # change directory to the workspace before including this
 .find_python: &find_python
-  - PYTHON="$(source bin/tests/system/conf.sh; echo $PYTHON)"
+  - PYTHON="$(cat bin/tests/system/isctest/vars/.ac_vars/PYTHON)"
  - test -x "$PYTHON"

 .find_pytest: &find_pytest
-  - PYTEST="$(source bin/tests/system/conf.sh; echo $PYTEST)"
+  - PYTEST="$(cat bin/tests/system/isctest/vars/.ac_vars/PYTEST)"
  - test -x "$PYTEST"

 .parse_tsan: &parse_tsan
@@ -482,14 +479,14 @@ stages:
    - *configure
    - make -j${BUILD_PARALLEL_JOBS:-1} V=1
    - *setup_interfaces
-    - git clone --depth 1 https://gitlab-ci-token:${CI_JOB_TOKEN}@gitlab.isc.org/isc-private/bind-qa.git
-    - cd bind-qa/bind9/respdiff
+    - git clone --depth 1 https://gitlab.isc.org/isc-projects/bind9-qa.git
+    - cd bind9-qa/respdiff
  needs: []
  artifacts:
    paths:
-      - bind-qa/bind9/respdiff
+      - bind9-qa/respdiff
    exclude:
-      - bind-qa/bind9/respdiff/rspworkdir/data.mdb # Exclude a 10 GB file.
+      - bind9-qa/respdiff/rspworkdir/data.mdb # Exclude a 10 GB file.
    untracked: true
    when: always

@@ -624,8 +621,6 @@ danger:
  only:
    refs:
      - merge_requests
-    variables:
-      - $DANGER_GITLAB_API_TOKEN

 checkbashisms:
  <<: *precheck_job
@@ -693,6 +688,7 @@ cross-version-config-tests:
    # Disable option checking to prevent problems with new default options in
    # the &configure anchor.
    EXTRA_CONFIGURE: "--disable-option-checking"
+    PYTEST: "/usr/bin/pytest-3"
  script:
    - *configure
    - *setup_interfaces
@@ -702,12 +698,16 @@ cross-version-config-tests:
    - autoreconf -fi
    - *configure
    - make -j${BUILD_PARALLEL_JOBS:-1}
-    - *find_pytest
    - cd bin/tests/system
    # Run the setup phase of all system tests in the most recently tagged BIND 9
    # release using the binaries built for the current BIND 9 version.  This
    # intends to detect obvious backward compatibility issues with the latter.
-    - sed -i -E "s|(export TOP_BUILDDIR)=.*|\1=${CI_PROJECT_DIR}|" conf.sh
+    - >
+      if [ -f isctest/vars/autoconf.py ]; then
+        echo "${CI_PROJECT_DIR}" > isctest/vars/.ac_vars/TOP_BUILDDIR
+      else
+        sed -i -E "s|(export TOP_BUILDDIR)=.*|\1=${CI_PROJECT_DIR}|" conf.sh;
+      fi
    - >
      "$PYTEST" --setup-only --junit-xml="$CI_PROJECT_DIR"/junit.xml -n "${TEST_PARALLEL_JOBS:-1}"
  needs:
@@ -725,28 +725,28 @@ cross-version-config-tests:
    expire_in: "1 day"
    when: always

-# Jobs for regular GCC builds on Alpine Linux 3.19 (amd64)
+# Jobs for regular GCC builds on Alpine Linux 3.20 (amd64)

-gcc:alpine3.19:amd64:
+gcc:alpine3.20:amd64:
  variables:
    CC: gcc
    CFLAGS: "${CFLAGS_COMMON}"
    EXTRA_CONFIGURE: "${WITHOUT_READLINE}"
-  <<: *alpine_3_19_amd64_image
+  <<: *alpine_3_20_amd64_image
  <<: *build_job

-system:gcc:alpine3.19:amd64:
-  <<: *alpine_3_19_amd64_image
+system:gcc:alpine3.20:amd64:
+  <<: *alpine_3_20_amd64_image
  <<: *system_test_job
  needs:
-    - job: gcc:alpine3.19:amd64
+    - job: gcc:alpine3.20:amd64
      artifacts: true

-unit:gcc:alpine3.19:amd64:
-  <<: *alpine_3_19_amd64_image
+unit:gcc:alpine3.20:amd64:
+  <<: *alpine_3_20_amd64_image
  <<: *unit_test_job
  needs:
-    - job: gcc:alpine3.19:amd64
+    - job: gcc:alpine3.20:amd64
      artifacts: true

 # Jobs for regular GCC builds on Oracle Linux 8 (amd64)
@@ -894,6 +894,30 @@ unit:gcc:bookworm:amd64:
    - job: gcc:bookworm:amd64
      artifacts: true

+# Jobs for RBT zone- & cache-enabled GCC builds on Debian 12 "bookworm" (amd64)
+
+gcc:bookworm:rbt:amd64:
+  variables:
+    CC: gcc
+    CFLAGS: "${CFLAGS_COMMON}"
+    EXTRA_CONFIGURE: "--with-libidn2 --with-zonedb=rbt --with-cachedb=rbt"
+  <<: *debian_bookworm_amd64_image
+  <<: *build_job
+
+system:gcc:bookworm:rbt:amd64:
+  <<: *debian_bookworm_amd64_image
+  <<: *system_test_job
+  needs:
+    - job: unit:gcc:bookworm:rbt:amd64
+      artifacts: true
+
+unit:gcc:bookworm:rbt:amd64:
+  <<: *debian_bookworm_amd64_image
+  <<: *unit_test_job
+  needs:
+    - job: gcc:bookworm:rbt:amd64
+      artifacts: true
+
 # Build job for cross-compiled GCC builds on 64-bit Debian 12 "bookworm"
 # (amd64) with 32-bit BIND 9.

@@ -1145,7 +1169,31 @@ unit:gcc:jammy:amd64:
    - job: gcc:jammy:amd64
      artifacts: true

-# Jobs for ASAN builds on Fedora 39 (amd64)
+# Jobs for regular GCC builds on Ubuntu 24.04 Noble Numbat (amd64)
+
+gcc:noble:amd64:
+  variables:
+    CC: gcc
+    CFLAGS: "${CFLAGS_COMMON}"
+    EXTRA_CONFIGURE: "--with-libidn2"
+  <<: *ubuntu_noble_amd64_image
+  <<: *build_job
+
+system:gcc:noble:amd64:
+  <<: *ubuntu_noble_amd64_image
+  <<: *system_test_job
+  needs:
+    - job: gcc:noble:amd64
+      artifacts: true
+
+unit:gcc:noble:amd64:
+  <<: *ubuntu_noble_amd64_image
+  <<: *unit_test_job
+  needs:
+    - job: gcc:noble:amd64
+      artifacts: true
+
+# Jobs for ASAN builds on Fedora 40 (amd64)

 gcc:asan:
  variables:
@@ -1153,20 +1201,20 @@ gcc:asan:
    CFLAGS: "${CFLAGS_COMMON} -fsanitize=address,undefined"
    LDFLAGS: "-fsanitize=address,undefined"
    EXTRA_CONFIGURE: "--with-libidn2 --without-jemalloc"
-  <<: *fedora_39_amd64_image
+  <<: *fedora_40_amd64_image
  <<: *build_job

 system:gcc:asan:
  variables:
    LSAN_OPTIONS: "suppressions=$CI_PROJECT_DIR/suppr-lsan.txt"
-  <<: *fedora_39_amd64_image
+  <<: *fedora_40_amd64_image
  <<: *system_test_job
  needs:
    - job: gcc:asan
      artifacts: true

 unit:gcc:asan:
-  <<: *fedora_39_amd64_image
+  <<: *fedora_40_amd64_image
  <<: *unit_test_job
  needs:
    - job: gcc:asan
@@ -1195,7 +1243,7 @@ unit:clang:asan:
    - job: clang:asan
      artifacts: true

-# Jobs for TSAN builds on Fedora 39 (amd64)
+# Jobs for TSAN builds on Fedora 40 (amd64)

 gcc:tsan:
  variables:
@@ -1203,13 +1251,13 @@ gcc:tsan:
    CFLAGS: "${CFLAGS_COMMON} -fsanitize=thread"
    LDFLAGS: "-fsanitize=thread"
    EXTRA_CONFIGURE: "--with-libidn2 --enable-pthread-rwlock --without-jemalloc"
-  <<: *tsan_fedora_39_amd64_image
+  <<: *tsan_fedora_40_amd64_image
  <<: *build_job

 system:gcc:tsan:
  variables:
    TSAN_OPTIONS: "${TSAN_OPTIONS_FEDORA}"
-  <<: *tsan_fedora_39_amd64_image
+  <<: *tsan_fedora_40_amd64_image
  <<: *system_test_tsan_job
  needs:
    - job: gcc:tsan
@@ -1218,7 +1266,7 @@ system:gcc:tsan:
 unit:gcc:tsan:
  variables:
    TSAN_OPTIONS: "${TSAN_OPTIONS_FEDORA}"
-  <<: *tsan_fedora_39_amd64_image
+  <<: *tsan_fedora_40_amd64_image
  <<: *unit_test_tsan_job
  needs:
    - job: gcc:tsan
@@ -1534,51 +1582,10 @@ coverity:

 # Respdiff tests

-respdiff-short:
+respdiff:
  <<: *respdiff_job
  <<: *default_triggering_rules
  <<: *debian_bookworm_amd64_image
-  variables:
-    CC: gcc
-    CFLAGS: "${CFLAGS_COMMON} -Og -DISC_TRACK_PTHREADS_OBJECTS"
-    MAX_DISAGREEMENTS_PERCENTAGE: "0.5"
-  script:
-    - bash respdiff.sh -m /usr/lib/x86_64-linux-gnu/libjemalloc.so.2 -s named -q "${PWD}/10k_a.txt" -c 3 -w "${PWD}/rspworkdir" "${CI_PROJECT_DIR}" "/usr/local/respdiff-reference-bind/sbin/named"
-
-respdiff-short:asan:
-  <<: *respdiff_job
-  <<: *default_triggering_rules
-  <<: *debian_bookworm_amd64_image
-  variables:
-    CC: gcc
-    CFLAGS: "${CFLAGS_COMMON} -Og -fsanitize=address,undefined"
-    LDFLAGS: "-fsanitize=address,undefined"
-    EXTRA_CONFIGURE: "--disable-dnsrps --without-jemalloc"
-    MAX_DISAGREEMENTS_PERCENTAGE: "0.5"
-  script:
-    - bash respdiff.sh -s named -q "${PWD}/10k_a.txt" -c 3 -w "${PWD}/rspworkdir" "${CI_PROJECT_DIR}" "/usr/local/respdiff-reference-bind/sbin/named"
-
-respdiff-short:tsan:
-  <<: *respdiff_job
-  <<: *default_triggering_rules
-  <<: *tsan_debian_bookworm_amd64_image
-  variables:
-    CC: gcc
-    CFLAGS: "${CFLAGS_COMMON} -Og -fsanitize=thread"
-    LDFLAGS: "-fsanitize=thread"
-    EXTRA_CONFIGURE: "--disable-dnsrps --enable-pthread-rwlock --without-jemalloc"
-    MAX_DISAGREEMENTS_PERCENTAGE: "0.5"
-    TSAN_OPTIONS: "${TSAN_OPTIONS_DEBIAN}"
-  script:
-    - bash respdiff.sh -s named -q "${PWD}/10k_a.txt" -c 3 -w "${PWD}/rspworkdir" "${CI_PROJECT_DIR}" "/usr/local/respdiff-reference-bind/sbin/named"
-  after_script:
-    - *find_python
-    - *parse_tsan
-
-respdiff-long:
-  <<: *respdiff_job
-  <<: *api_pipelines_schedules_tags_triggers_web_triggering_rules
-  <<: *respdiff_debian_bookworm_amd64_image
  variables:
    CC: gcc
    CFLAGS: "${CFLAGS_COMMON} -Og -DISC_TRACK_PTHREADS_OBJECTS"
@@ -1586,9 +1593,9 @@ respdiff-long:
  script:
    - bash respdiff.sh -m /usr/lib/x86_64-linux-gnu/libjemalloc.so.2 -s named -q "${PWD}/100k_mixed.txt" -c 3 -w "${PWD}/rspworkdir" "${CI_PROJECT_DIR}" "/usr/local/respdiff-reference-bind/sbin/named"

-respdiff-long:asan:
+respdiff:asan:
  <<: *respdiff_job
-  <<: *api_pipelines_schedules_tags_triggers_web_triggering_rules
+  <<: *default_triggering_rules
  <<: *debian_bookworm_amd64_image
  variables:
    CC: gcc
@@ -1599,9 +1606,9 @@ respdiff-long:asan:
  script:
    - bash respdiff.sh -s named -q "${PWD}/100k_mixed.txt" -c 3 -w "${PWD}/rspworkdir" "${CI_PROJECT_DIR}" "/usr/local/respdiff-reference-bind/sbin/named"

-respdiff-long:tsan:
+respdiff:tsan:
  <<: *respdiff_job
-  <<: *api_pipelines_schedules_tags_triggers_web_triggering_rules
+  <<: *default_triggering_rules
  <<: *tsan_debian_bookworm_amd64_image
  variables:
    CC: gcc
@@ -1615,11 +1622,10 @@ respdiff-long:tsan:
  after_script:
    - *find_python
    - *parse_tsan
-  allow_failure: true  # affected by GL #4475

-respdiff-long-third-party:
+respdiff-third-party:
  <<: *respdiff_job
-  <<: *api_pipelines_schedules_tags_triggers_web_triggering_rules
+  <<: *default_triggering_rules
  <<: *debian_bookworm_amd64_image
  variables:
    CC: gcc
@@ -1655,157 +1661,269 @@ shotgun:dot:
  when: delayed
  start_in: 5 minutes

-# Parallel build in the "make" step is avoided since multiple jobs can be
-# executed concurrently on the same runner. This may present problems when one
-# job runs a performance-sensitive task of replying to queries while another
-# takes all cores to build BIND.
-.stress: &stress_job
+.stress-test: &stress_test
  stage: performance
  script:
    - *configure
    - *setup_interfaces
-    - make -k all V=1
+    - make -j${BUILD_PARALLEL_JOBS:-1} -k all V=1
    - make DESTDIR="${INSTALL_PATH}" install
-    - git clone --depth 1 https://gitlab-ci-token:${CI_JOB_TOKEN}@gitlab.isc.org/isc-private/bind-qa.git
-    - cd bind-qa/bind9/stress
+    - git clone --depth 1 https://gitlab.isc.org/isc-projects/bind9-qa.git
+    - cd bind9-qa/stress
    - LD_LIBRARY_PATH="${INSTALL_PATH}/usr/local/lib" BIND_INSTALL_PATH="${INSTALL_PATH}/usr/local" WORKSPACE="${CI_PROJECT_DIR}" bash stress.sh
  needs:
    - job: autoreconf
      artifacts: true
+
+.stress-test-short: &stress_test_short_job
+  <<: *stress_test
+  artifacts:
+    untracked: true
+    when: always
+  only:
+    - merge_requests
+
+stress:short:authoritative:fedora:40:amd64:
+  <<: *fedora_40_amd64_image
+  <<: *linux_amd64
+  <<: *stress_test_short_job
+  variables:
+    CC: gcc
+    CFLAGS: "${CFLAGS_COMMON} -Og"
+    FLAME: /usr/bin/flame
+    MODE: authoritative
+    RATE: 10000
+    RUN_TIME: 15
+
+stress:short:recursive:fedora:40:amd64:
+  <<: *fedora_40_amd64_image
+  <<: *linux_amd64
+  <<: *stress_test_short_job
+  variables:
+    CC: gcc
+    CFLAGS: "${CFLAGS_COMMON} -Og"
+    FLAME: /usr/bin/flame
+    MODE: recursive
+    RATE: 10000
+    RUN_TIME: 15
+
+stress:short:rpz:fedora:40:amd64:
+  <<: *fedora_40_amd64_image
+  <<: *linux_amd64
+  <<: *stress_test_short_job
+  variables:
+    CC: gcc
+    CFLAGS: "${CFLAGS_COMMON} -Og"
+    FLAME: /usr/bin/flame
+    MODE: rpz
+    RATE: 1500
+    RUN_TIME: 15
+
+stress:short:authoritative:fedora:40:arm64:
+  <<: *fedora_40_arm64_image
+  <<: *linux_arm64
+  <<: *stress_test_short_job
+  variables:
+    CC: gcc
+    CFLAGS: "${CFLAGS_COMMON} -Og"
+    FLAME: /usr/bin/flame
+    MODE: authoritative
+    RATE: 10000
+    RUN_TIME: 15
+
+stress:short:recursive:fedora:40:arm64:
+  <<: *fedora_40_arm64_image
+  <<: *linux_arm64
+  <<: *stress_test_short_job
+  variables:
+    CC: gcc
+    CFLAGS: "${CFLAGS_COMMON} -Og"
+    FLAME: /usr/bin/flame
+    MODE: recursive
+    RATE: 10000
+    RUN_TIME: 15
+
+stress:short:rpz:fedora:40:arm64:
+  <<: *fedora_40_arm64_image
+  <<: *linux_arm64
+  <<: *stress_test_short_job
+  variables:
+    CC: gcc
+    CFLAGS: "${CFLAGS_COMMON} -Og"
+    FLAME: /usr/bin/flame
+    MODE: rpz
+    RATE: 1500
+    RUN_TIME: 15
+
+stress:short:authoritative:freebsd13:amd64:
+  <<: *freebsd_stress_amd64
+  <<: *stress_test_short_job
+  variables:
+    CC: clang
+    CFLAGS: "${CFLAGS_COMMON} -Og"
+    FLAME: /usr/local/bin/flame
+    MODE: authoritative
+    RATE: 10000
+    RUN_TIME: 15
+
+stress:short:recursive:freebsd13:amd64:
+  <<: *freebsd_stress_amd64
+  <<: *stress_test_short_job
+  variables:
+    CC: clang
+    CFLAGS: "${CFLAGS_COMMON} -Og"
+    FLAME: /usr/local/bin/flame
+    MODE: recursive
+    RATE: 10000
+    RUN_TIME: 15
+
+stress:short:rpz:freebsd13:amd64:
+  <<: *freebsd_stress_amd64
+  <<: *stress_test_short_job
+  variables:
+    CC: clang
+    CFLAGS: "${CFLAGS_COMMON} -Og"
+    FLAME: /usr/local/bin/flame
+    MODE: rpz
+    RATE: 1500
+    RUN_TIME: 15
+
+.stress-test-long: &stress_test_long_job
+  <<: *stress_test
  artifacts:
    untracked: true
    expire_in: "1 week"
    when: always
  timeout: 2h

-stress:authoritative:fedora:39:amd64:
-  <<: *fedora_39_amd64_image
+stress:authoritative:fedora:40:amd64:
+  <<: *fedora_40_amd64_image
  <<: *linux_amd64
-  <<: *stress_job
+  <<: *stress_test_long_job
  variables:
    CC: gcc
    CFLAGS: "${CFLAGS_COMMON} -Og"
    FLAME: /usr/bin/flame
    MODE: authoritative
    RATE: 10000
-    RUN_TIME: 1
+    RUN_TIME: 60
  only:
    variables:
      - $CI_COMMIT_TAG || ($BIND_STRESS_TEST_OS =~ /linux/i && $BIND_STRESS_TEST_MODE =~ /authoritative/i && $BIND_STRESS_TEST_ARCH =~ /amd64/i)

-stress:recursive:fedora:39:amd64:
-  <<: *fedora_39_amd64_image
+stress:recursive:fedora:40:amd64:
+  <<: *fedora_40_amd64_image
  <<: *linux_amd64
-  <<: *stress_job
+  <<: *stress_test_long_job
  variables:
    CC: gcc
    CFLAGS: "${CFLAGS_COMMON} -Og"
    FLAME: /usr/bin/flame
    MODE: recursive
    RATE: 10000
-    RUN_TIME: 1
+    RUN_TIME: 60
  only:
    variables:
      - $CI_COMMIT_TAG || ($BIND_STRESS_TEST_OS =~ /linux/i && $BIND_STRESS_TEST_MODE =~ /recursive/i && $BIND_STRESS_TEST_ARCH =~ /amd64/i)

-stress:rpz:fedora:39:amd64:
-  <<: *fedora_39_amd64_image
+stress:rpz:fedora:40:amd64:
+  <<: *fedora_40_amd64_image
  <<: *linux_amd64
-  <<: *stress_job
+  <<: *stress_test_long_job
  variables:
    CC: gcc
    CFLAGS: "${CFLAGS_COMMON} -Og"
    FLAME: /usr/bin/flame
    MODE: rpz
    RATE: 1500
-    RUN_TIME: 1
+    RUN_TIME: 60
  only:
    variables:
      - $CI_COMMIT_TAG || ($BIND_STRESS_TEST_OS =~ /linux/i && $BIND_STRESS_TEST_MODE =~ /rpz/i && $BIND_STRESS_TEST_ARCH =~ /amd64/i)

-stress:authoritative:fedora:39:arm64:
-  <<: *fedora_39_arm64_image
+stress:authoritative:fedora:40:arm64:
+  <<: *fedora_40_arm64_image
  <<: *linux_arm64
-  <<: *stress_job
+  <<: *stress_test_long_job
  variables:
    CC: gcc
    CFLAGS: "${CFLAGS_COMMON} -Og"
    FLAME: /usr/bin/flame
    MODE: authoritative
    RATE: 10000
-    RUN_TIME: 1
+    RUN_TIME: 60
  only:
    variables:
      - $CI_COMMIT_TAG || ($BIND_STRESS_TEST_OS =~ /linux/i && $BIND_STRESS_TEST_MODE =~ /authoritative/i && $BIND_STRESS_TEST_ARCH =~ /arm64/i)

-stress:recursive:fedora:39:arm64:
-  <<: *fedora_39_arm64_image
+stress:recursive:fedora:40:arm64:
+  <<: *fedora_40_arm64_image
  <<: *linux_arm64
-  <<: *stress_job
+  <<: *stress_test_long_job
  variables:
    CC: gcc
    CFLAGS: "${CFLAGS_COMMON} -Og"
    FLAME: /usr/bin/flame
    MODE: recursive
    RATE: 10000
-    RUN_TIME: 1
+    RUN_TIME: 60
  only:
    variables:
      - $CI_COMMIT_TAG || ($BIND_STRESS_TEST_OS =~ /linux/i && $BIND_STRESS_TEST_MODE =~ /recursive/i && $BIND_STRESS_TEST_ARCH =~ /arm64/i)

-stress:rpz:fedora:39:arm64:
-  <<: *fedora_39_arm64_image
+stress:rpz:fedora:40:arm64:
+  <<: *fedora_40_arm64_image
  <<: *linux_arm64
-  <<: *stress_job
+  <<: *stress_test_long_job
  variables:
    CC: gcc
    CFLAGS: "${CFLAGS_COMMON} -Og"
    FLAME: /usr/bin/flame
    MODE: rpz
    RATE: 1500
-    RUN_TIME: 1
+    RUN_TIME: 60
  only:
    variables:
      - $CI_COMMIT_TAG || ($BIND_STRESS_TEST_OS =~ /linux/i && $BIND_STRESS_TEST_MODE =~ /rpz/i && $BIND_STRESS_TEST_ARCH =~ /arm64/i)

 stress:authoritative:freebsd13:amd64:
  <<: *freebsd_stress_amd64
-  <<: *stress_job
+  <<: *stress_test_long_job
  variables:
    CC: clang
    CFLAGS: "${CFLAGS_COMMON} -Og"
    FLAME: /usr/local/bin/flame
    MODE: authoritative
    RATE: 10000
-    RUN_TIME: 1
+    RUN_TIME: 60
  only:
    variables:
      - $CI_COMMIT_TAG || ($BIND_STRESS_TEST_OS =~ /freebsd/i && $BIND_STRESS_TEST_MODE =~ /authoritative/i && $BIND_STRESS_TEST_ARCH =~ /amd64/i)

 stress:recursive:freebsd13:amd64:
  <<: *freebsd_stress_amd64
-  <<: *stress_job
+  <<: *stress_test_long_job
  variables:
    CC: clang
    CFLAGS: "${CFLAGS_COMMON} -Og"
    FLAME: /usr/local/bin/flame
    MODE: recursive
    RATE: 10000
-    RUN_TIME: 1
+    RUN_TIME: 60
  only:
    variables:
      - $CI_COMMIT_TAG || ($BIND_STRESS_TEST_OS =~ /freebsd/i && $BIND_STRESS_TEST_MODE =~ /recursive/i && $BIND_STRESS_TEST_ARCH =~ /amd64/i)

 stress:rpz:freebsd13:amd64:
  <<: *freebsd_stress_amd64
-  <<: *stress_job
+  <<: *stress_test_long_job
  variables:
    CC: clang
    CFLAGS: "${CFLAGS_COMMON} -Og"
    FLAME: /usr/local/bin/flame
    MODE: rpz
    RATE: 1500
-    RUN_TIME: 1
+    RUN_TIME: 60
  only:
    variables:
      - $CI_COMMIT_TAG || ($BIND_STRESS_TEST_OS =~ /freebsd/i && $BIND_STRESS_TEST_MODE =~ /rpz/i && $BIND_STRESS_TEST_ARCH =~ /amd64/i)
@@ -1878,3 +1996,24 @@ pairwise:
  only:
    variables:
      - $PAIRWISE_TESTING
+
+backports:
+  <<: *base_image
+  stage: postmerge
+  rules:
+    - if: '$CI_PIPELINE_SOURCE == "push" && ($CI_COMMIT_REF_NAME =~ /^bind-9.[0-9]+$/ || $CI_COMMIT_REF_NAME == $CI_DEFAULT_BRANCH)'
+  variables:
+    # automated commits will inherit identification from the user who pressed Merge button
+    GIT_COMMITTER_NAME: $GITLAB_USER_NAME
+    GIT_COMMITTER_EMAIL: $GITLAB_USER_EMAIL
+    # avoid leftover branches from previous jobs
+    GIT_STRATEGY: clone
+    # assumed max depth of a MR for backport
+    GIT_DEPTH: 200
+  script:
+    # CI job token is not sufficient for push operations
+    - git remote get-url origin | sed -e "s/gitlab-ci-token:$CI_JOB_TOKEN/oauth2:$BIND_TEAM_WRITE_TOKEN/" | xargs git remote set-url --push origin
+    # force-pushing is disabled so we have to have merge request on top
+    - MERGE_REQUEST_ID="$(git log -1 --format='%b' | sed --silent -e 's/^See merge request [^!]\+!//p')"
+    - git clone --depth 1 https://gitlab.isc.org/isc-projects/bind9-qa.git
+    - bind9-qa/releng/backport_mr.py $CI_PROJECT_ID "$MERGE_REQUEST_ID"
@@ -0,0 +1,26 @@
+Alan Clegg <aclegg@isc.org>
+Aram Sargsyan <aram@isc.org>
+Artem Boldariev <artem@isc.org> <artem@boldariev.com>
+Curtis Blackburn <ckb@isc.org> <ckb@freebsd11.local>
+Curtis Blackburn <ckb@isc.org> <ckb@isc.org>
+Diego Fronza <diego@isc.org>
+Evan Hunt <each@isc.org> Evan Hunt <fanf@isc.org>
+Håvard Eidnes <he@uninett.no>
+Jeremy C. Reed <jreed@isc.org> <jreed@docs.lab.isc.org>
+Jeremy C. Reed <jreed@isc.org> <jreed@ISC.org>
+Joey Salazar <joey@isc.org>
+John H. DuBois III <johnd>
+Mark Andrews <marka@isc.org>
+Mark Andrews <marka@isc.org> <marka@daemon.lab.isc.org>
+Mark Andrews <marka@isc.org> <marka@newdocs.lab.isc.org>
+Matthijs Mekking <matthijs@isc.org> <github@pletterpet.nl>
+Nicki Křížek <nicki@isc.org> <tkrizek@isc.org>
+Ondřej Surý <ondrej@isc.org>
+Ondřej Surý <ondrej@isc.org> <ondrej@openbsd-6-9.home.sury.org>
+Ondřej Surý <ondrej@isc.org> <ondrej@sury.org>
+Petr Menšík <pemensik@redhat.com>
+Petr Menšík <pemensik@redhat.com> <pmensik@redhat.com>
+Robert Edmonds <edmonds>
+Tatuya JINMEI 神明達哉 <jinmei@isc.org>
+Witold Kręcicki <wpk@isc.org>
+Witold Kręcicki <wpk@isc.org> <wpk@culm.net>
@@ -5,6 +5,7 @@ disable=
    C0115, # missing-class-docstring
    C0116, # missing-function-docstring
    C0209, # consider-using-f-string
+    C0301, # line-too-long, handled better by black
    C0415, # import-outside-toplevel
    R0801, # duplicate-code
    R0903, # too-few-public-methods
@@ -24,6 +24,7 @@ Files: **/*.after*
       **/testdata/*
       .github/*
       .gitlab/*
+       .mailmap
       AUTHORS
       CHANGES
       COPYRIGHT
@@ -38,15 +39,31 @@ Files: **/*.after*
       bin/tests/system/doth/CA/index.txt
       bin/tests/system/doth/CA/index.txt.attr
       bin/tests/system/doth/CA/serial
-       bin/tests/system/notify/ns4/named.port.in
+       bin/tests/system/formerr/badnsec3owner
+       bin/tests/system/formerr/badrecordname
+       bin/tests/system/formerr/dupans
+       bin/tests/system/formerr/dupquestion
+       bin/tests/system/formerr/keyclass
+       bin/tests/system/formerr/malformeddeltype
+       bin/tests/system/formerr/malformedrrsig
       bin/tests/system/formerr/nametoolong
       bin/tests/system/formerr/noquestions
-       bin/tests/system/formerr/twoquestions
+       bin/tests/system/formerr/optwrongname
+       bin/tests/system/formerr/qtypeasanswer
+       bin/tests/system/formerr/questionclass
+       bin/tests/system/formerr/shortquestion
+       bin/tests/system/formerr/shortrecord
+       bin/tests/system/formerr/tsignotlast
+       bin/tests/system/formerr/tsigwrongclass
+       bin/tests/system/formerr/twoquestionnames
+       bin/tests/system/formerr/twoquestiontypes
+       bin/tests/system/formerr/wrongclass
       bin/tests/system/forward/CA/CA.cfg
       bin/tests/system/forward/CA/README
       bin/tests/system/forward/CA/index.txt
       bin/tests/system/forward/CA/index.txt.attr
       bin/tests/system/forward/CA/serial
+       bin/tests/system/isctest/vars/.ac_vars/*
       bin/tests/system/journal/ns1/managed-keys.bind.in
       bin/tests/system/journal/ns1/managed-keys.bind.jnl.in
       bin/tests/system/journal/ns2/managed-keys.bind.in
@@ -57,6 +74,7 @@ Files: **/*.after*
       bin/tests/system/masterfile/knowngood.include
       bin/tests/system/masterfile/knowngood.ttl1
       bin/tests/system/masterfile/knowngood.ttl2
+       bin/tests/system/notify/ns4/named.port.in
       bin/tests/system/nsupdate/CA/CA.cfg
       bin/tests/system/nsupdate/CA/README
       bin/tests/system/nsupdate/CA/index.txt
@@ -1,3 +1,112 @@
+6404.	[placeholder]
+
+6403.	[placeholder]
+
+6402.	[placeholder]
+
+6401.	[placeholder]
+
+6400.	[placeholder]
+
+6399.	[placeholder]
+
+6398.	[placeholder]
+
+6397.	[placeholder]
+
+6396.	[func]		Outgoing zone transfers are no longer enabled by
+			default. To enable them, an "allow-transfer" ACL
+			must be specified. [GL #4728]
+
+6395.	[bug]		Handle ISC_R_HOSTDOWN and ISC_R_NETDOWN in resolver.c.
+			[GL #4736]
+
+6394.	[bug]		Named's -4 and -6 options now apply to zone primaries,
+			also-notify and parental-agents.  Report when a zone
+			has these options configured but does not have an IPv4
+			or IPv6 address listed respectively. [GL #3472]
+
+6393.	[func]		Deal with uv_tcp_close_reset() error return codes
+			more gracefully. [GL #4708]
+
+6392.	[bug]		Use a completely new memory context when flushing the
+			cache. [GL #2744]
+
+6391.	[placeholder]
+
+6390.	[placeholder]
+
+6389.	[bug]		dnssec-verify and dnssec-signzone could fail if there
+			was an obscured DNSKEY RRset at a delegatation.
+			[GL #4517]
+
+6388.	[placeholder]
+
+6387.	[func]		Added a new statistics variable "recursive high-water"
+			that reports the maximum number of simultaneous
+			recursive clients BIND has handled while running.
+			[GL #4668]
+
+6386.	[bug]		When shutting down catzs->view could point to freed
+			memory. Obtain a reference to the view to prevent this.
+			[GL #4502]
+
+6385.	[func]		Relax SVCB alias mode checks to allow parameters.
+			[GL #4704]
+
+6384.	[bug]		Remove infinite loop when including a directory in a
+			zone file. [GL #4357]
+
+6383.	[bug]		Address an infinite loop in $GENERATE when a negative
+			value was converted in nibble mode. [GL #4353]
+
+6382.	[bug]		Fix RPZ response's SOA record TTL, which was incorrectly
+			set to 1 if 'add-soa' is used. [GL #3323]
+
+	--- 9.19.24 released ---
+
+6381.	[bug]		dns_qp_lookup() could position the iterator at the
+			wrong predecessor when searching for names with
+			uncommon characters, which are encoded as two-octet
+			sequences in QP trie keys. [GL #4702]
+
+6380.	[func]		Queries and responses now emit distinct dnstap entries
+			for DoT and DoH. [GL #4523]
+
+6379.	[bug]		A QP iterator bug could result in DNSSEC validation
+			failing because the wrong NSEC was returned. [GL #4659]
+
+6378.	[func]		The option to specify the number of UDP dispatches was
+			previously removed. An attempt to use the option now
+			prints a warning. [GL #1879]
+
+6377.	[func]		Introduce 'dnssec-ksr', a DNSSEC tool to create
+			Key Signing Requests (KSRs) and Signed Key Responses
+			(SKRs). [GL #1128]
+
+6376.	[func]		Allow 'dnssec-keygen' options '-f' and '-k' to be used
+			together to create a subset of keys from the DNSSEC
+			policy. [GL !8188]
+
+6375.	[func]		Allow multiple RNDC message to be processed from
+			a single TCP read. [GL #4416]
+
+6374.	[func]		Don't count expired / future RRSIGs in verification
+			failure quota. [GL #4586]
+
+6373.	[func]		Offload the isc_http response processing to worker
+			thread. [GL #4680]
+
+6372.	[func]		Implement signature jitter for dnssec-policy. [GL #4554]
+
+6371.	[bug]		Access to the trust bytes in the ncache data needed to
+			be made thread safe. [GL #4475]
+
+6370.	[bug]		Wrong source address used for IPv6 notify messages.
+			[GL #4669]
+
+	--- 9.19.23 released ---
+
 6369.	[func]		The 'fixed' value for the 'rrset-order' option has
 			been marked and documented as deprecated. [GL #4446]

@@ -2151,7 +2151,7 @@ run_server(void *arg) {

 	CHECK(dns_view_create(mctx, dispatchmgr, dns_rdataclass_in, "_default",
 			      &view));
-	CHECK(dns_cache_create(loopmgr, dns_rdataclass_in, "", &cache));
+	CHECK(dns_cache_create(loopmgr, dns_rdataclass_in, "", mctx, &cache));
 	dns_view_setcache(view, cache, false);
 	dns_cache_detach(&cache);
 	dns_view_setdstport(view, destport);
@@ -2,6 +2,7 @@ dnssec-cds
 dnssec-dsfromkey
 dnssec-keyfromlabel
 dnssec-keygen
+dnssec-ksr
 dnssec-makekeyset
 dnssec-revoke
 dnssec-settime
@@ -2,6 +2,7 @@ include $(top_srcdir)/Makefile.top

 AM_CPPFLAGS +=			\
 	$(LIBISC_CFLAGS)	\
+	$(LIBISCCFG_CFLAGS)	\
 	$(LIBDNS_CFLAGS)

 AM_CPPFLAGS +=			\
@@ -12,6 +13,7 @@ noinst_LTLIBRARIES = libdnssectool.la
 LDADD +=			\
 	libdnssectool.la	\
 	$(LIBISC_LIBS)		\
+	$(LIBISCCFG_LIBS)	\
 	$(LIBDNS_LIBS)		\
 	$(OPENSSL_LIBS)

@@ -21,6 +23,7 @@ bin_PROGRAMS = \
 	dnssec-importkey	\
 	dnssec-keyfromlabel	\
 	dnssec-keygen		\
+	dnssec-ksr		\
 	dnssec-revoke		\
 	dnssec-settime		\
 	dnssec-signzone		\
@@ -32,20 +35,16 @@ libdnssectool_la_SOURCES =	\

 dnssec_keygen_CPPFLAGS =	\
 	$(AM_CPPFLAGS)		\
-	$(LIBISCCFG_CFLAGS)	\
 	$(OPENSSL_CFLAGS)

 dnssec_keygen_LDADD =		\
 	$(LDADD)		\
-	$(LIBISCCFG_LIBS)	\
 	$(OPENSSL_LIBS)

 dnssec_signzone_CPPFLAGS =	\
 	$(AM_CPPFLAGS)		\
-	$(LIBISCCFG_CFLAGS)	\
 	$(OPENSSL_CFLAGS)

 dnssec_signzone_LDADD =		\
 	$(LDADD)		\
-	$(LIBISCCFG_LIBS)	\
 	$(OPENSSL_LIBS)
@@ -54,6 +54,7 @@ static dns_name_t *name = NULL;
 static isc_mem_t *mctx = NULL;
 static uint32_t ttl;
 static bool emitttl = false;
+static unsigned int split_width = 0;

 static isc_result_t
 initname(char *setname) {
@@ -279,8 +280,8 @@ emit(dns_dsdigest_t dt, bool showall, bool cds, dns_rdata_t *rdata) {
 		fatal("can't print name");
 	}

-	result = dns_rdata_tofmttext(&ds, (dns_name_t *)NULL, 0, 0, 0, "",
-				     &textb);
+	result = dns_rdata_tofmttext(&ds, (dns_name_t *)NULL, 0, 0, split_width,
+				     "", &textb);

 	if (result != ISC_R_SUCCESS) {
 		fatal("can't print rdata");
@@ -347,6 +348,7 @@ usage(void) {
 			"    -f zonefile: read keys from a zone file\n"
 			"    -h: print help information\n"
 			"    -K directory: where to find key or keyset files\n"
+			"    -w split base64 rdata text into chunks\n"
 			"    -s: read keys from keyset-<dnsname> file\n"
 			"    -T: TTL of output records (omitted by default)\n"
 			"    -v level: verbosity\n"
@@ -380,7 +382,7 @@ main(int argc, char **argv) {

 	isc_commandline_errprint = false;

-#define OPTIONS "12Aa:Cc:d:Ff:K:l:sT:v:hV"
+#define OPTIONS "12Aa:Cc:d:Ff:K:l:sT:v:whV"
 	while ((ch = isc_commandline_parse(argc, argv, OPTIONS)) != -1) {
 		switch (ch) {
 		case '1':
@@ -432,6 +434,9 @@ main(int argc, char **argv) {
 				fatal("-v must be followed by a number");
 			}
 			break;
+		case 'w':
+			split_width = UINT_MAX;
+			break;
 		case 'F':
 			/* Reserved for FIPS mode */
 			FALLTHROUGH;
@@ -56,10 +56,6 @@

 #include <dst/dst.h>

-#include <isccfg/cfg.h>
-#include <isccfg/grammar.h>
-#include <isccfg/kaspconf.h>
-#include <isccfg/namedconf.h>
 #if OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_API_LEVEL >= 30000
 #include <openssl/err.h>
 #include <openssl/provider.h>
@@ -67,9 +63,6 @@

 #include "dnssectool.h"

-#define MAX_RSA 4096 /* should be long enough... */
-#define MAX_DH	4096 /* should be long enough... */
-
 const char *program = "dnssec-keygen";

 /*
@@ -103,8 +96,9 @@ struct keygen_ctx {
 	int options;
 	int dbits;
 	dns_ttl_t ttl;
-	uint16_t kskflag;
-	uint16_t revflag;
+	bool wantzsk;
+	bool wantksk;
+	bool wantrev;
 	dns_secalg_t alg;
 	/* timing data */
 	int prepub;
@@ -184,7 +178,7 @@ usage(void) {
 	fprintf(stderr, "    -d <digest bits> (0 => max, default)\n");
 	fprintf(stderr, "    -E <engine>:\n");
 	fprintf(stderr, "        name of an OpenSSL engine to use\n");
-	fprintf(stderr, "    -f <keyflag>: KSK | REVOKE\n");
+	fprintf(stderr, "    -f <keyflag>: ZSK | KSK | REVOKE\n");
 	fprintf(stderr, "    -F: FIPS mode\n");
 	fprintf(stderr, "    -L <ttl>: default key TTL\n");
 	fprintf(stderr, "    -p <protocol>: (default: 3 [dnssec])\n");
@@ -254,90 +248,6 @@ progress(int p) {
 	(void)fflush(stderr);
 }

-static void
-kasp_from_conf(cfg_obj_t *config, isc_mem_t *mctx, const char *name,
-	       const char *keydir, const char *engine, dns_kasp_t **kaspp) {
-	isc_result_t result = ISC_R_NOTFOUND;
-	const cfg_listelt_t *element;
-	const cfg_obj_t *kasps = NULL;
-	dns_kasp_t *kasp = NULL, *kasp_next;
-	dns_kasplist_t kasplist;
-	const cfg_obj_t *keystores = NULL;
-	dns_keystore_t *ks = NULL, *ks_next;
-	dns_keystorelist_t kslist;
-
-	ISC_LIST_INIT(kasplist);
-	ISC_LIST_INIT(kslist);
-
-	(void)cfg_map_get(config, "key-store", &keystores);
-	for (element = cfg_list_first(keystores); element != NULL;
-	     element = cfg_list_next(element))
-	{
-		cfg_obj_t *kconfig = cfg_listelt_value(element);
-		ks = NULL;
-		result = cfg_keystore_fromconfig(kconfig, mctx, lctx, engine,
-						 &kslist, NULL);
-		if (result != ISC_R_SUCCESS) {
-			fatal("failed to configure key-store '%s': %s",
-			      cfg_obj_asstring(cfg_tuple_get(kconfig, "name")),
-			      isc_result_totext(result));
-		}
-	}
-	/* Default key-directory key store. */
-	ks = NULL;
-	(void)cfg_keystore_fromconfig(NULL, mctx, lctx, engine, &kslist, &ks);
-	INSIST(ks != NULL);
-	if (keydir != NULL) {
-		/* '-K keydir' takes priority */
-		dns_keystore_setdirectory(ks, keydir);
-	}
-	dns_keystore_detach(&ks);
-
-	(void)cfg_map_get(config, "dnssec-policy", &kasps);
-	for (element = cfg_list_first(kasps); element != NULL;
-	     element = cfg_list_next(element))
-	{
-		cfg_obj_t *kconfig = cfg_listelt_value(element);
-		kasp = NULL;
-		if (strcmp(cfg_obj_asstring(cfg_tuple_get(kconfig, "name")),
-			   name) != 0)
-		{
-			continue;
-		}
-
-		result = cfg_kasp_fromconfig(kconfig, NULL, true, mctx, lctx,
-					     &kslist, &kasplist, &kasp);
-		if (result != ISC_R_SUCCESS) {
-			fatal("failed to configure dnssec-policy '%s': %s",
-			      cfg_obj_asstring(cfg_tuple_get(kconfig, "name")),
-			      isc_result_totext(result));
-		}
-		INSIST(kasp != NULL);
-		dns_kasp_freeze(kasp);
-		break;
-	}
-
-	*kaspp = kasp;
-
-	/*
-	 * Cleanup kasp list.
-	 */
-	for (kasp = ISC_LIST_HEAD(kasplist); kasp != NULL; kasp = kasp_next) {
-		kasp_next = ISC_LIST_NEXT(kasp, link);
-		ISC_LIST_UNLINK(kasplist, kasp, link);
-		dns_kasp_detach(&kasp);
-	}
-
-	/*
-	 * Cleanup keystore list.
-	 */
-	for (ks = ISC_LIST_HEAD(kslist); ks != NULL; ks = ks_next) {
-		ks_next = ISC_LIST_NEXT(ks, link);
-		ISC_LIST_UNLINK(kslist, ks, link);
-		dns_keystore_detach(&ks);
-	}
-}
-
 static void
 keygen(keygen_ctx_t *ctx, isc_mem_t *mctx, int argc, char **argv) {
 	char filename[255];
@@ -645,8 +555,12 @@ keygen(keygen_ctx_t *ctx, isc_mem_t *mctx, int argc, char **argv) {
 	if ((ctx->options & DST_TYPE_KEY) != 0) { /* KEY */
 		flags |= ctx->signatory;
 	} else if ((flags & DNS_KEYOWNER_ZONE) != 0) { /* DNSKEY */
-		flags |= ctx->kskflag;
-		flags |= ctx->revflag;
+		if (ctx->ksk || ctx->wantksk) {
+			flags |= DNS_KEYFLAG_KSK;
+		}
+		if (ctx->wantrev) {
+			flags |= DNS_KEYFLAG_REVOKE;
+		}
 	}

 	if (ctx->protocol == -1) {
@@ -769,7 +683,7 @@ keygen(keygen_ctx_t *ctx, isc_mem_t *mctx, int argc, char **argv) {
 			}

 			if (ctx->setrev) {
-				if (ctx->kskflag == 0) {
+				if (!ctx->wantksk) {
 					fprintf(stderr,
 						"%s: warning: Key is "
 						"not flagged as a KSK, but -R "
@@ -1013,9 +927,11 @@ main(int argc, char **argv) {
 		case 'f':
 			c = (unsigned char)(isc_commandline_argument[0]);
 			if (toupper(c) == 'K') {
-				ctx.kskflag = DNS_KEYFLAG_KSK;
+				ctx.wantksk = true;
+			} else if (toupper(c) == 'Z') {
+				ctx.wantzsk = true;
 			} else if (toupper(c) == 'R') {
-				ctx.revflag = DNS_KEYFLAG_REVOKE;
+				ctx.wantrev = true;
 			} else {
 				fatal("unknown flag '%s'",
 				      isc_commandline_argument);
@@ -1289,8 +1205,8 @@ main(int argc, char **argv) {
 		if (ctx.size != -1) {
 			fatal("-k and -b cannot be used together");
 		}
-		if (ctx.kskflag || ctx.revflag) {
-			fatal("-k and -f cannot be used together");
+		if (ctx.wantrev) {
+			fatal("-k and -fR cannot be used together");
 		}
 		if (ctx.options & DST_TYPE_KEY) {
 			fatal("-k and -T KEY cannot be used together");
@@ -1305,7 +1221,6 @@ main(int argc, char **argv) {
 			ctx.use_nsec3 = false;
 			ctx.alg = DST_ALG_ECDSA256;
 			ctx.size = 0;
-			ctx.kskflag = DNS_KEYFLAG_KSK;
 			ctx.ttl = 3600;
 			ctx.setttl = true;
 			ctx.ksk = true;
@@ -1330,8 +1245,8 @@ main(int argc, char **argv) {
 				      ctx.policy, ctx.configfile);
 			}

-			kasp_from_conf(config, mctx, ctx.policy, ctx.directory,
-				       engine, &kasp);
+			kasp_from_conf(config, mctx, lctx, ctx.policy,
+				       ctx.directory, engine, &kasp);
 			if (kasp == NULL) {
 				fatal("failed to load dnssec-policy '%s'",
 				      ctx.policy);
@@ -1345,15 +1260,13 @@ main(int argc, char **argv) {
 			ctx.ttl = dns_kasp_dnskeyttl(kasp);
 			ctx.setttl = true;

-			kaspkey = ISC_LIST_HEAD(dns_kasp_keys(kasp));
-
-			while (kaspkey != NULL) {
+			for (kaspkey = ISC_LIST_HEAD(dns_kasp_keys(kasp));
+			     kaspkey != NULL;
+			     kaspkey = ISC_LIST_NEXT(kaspkey, link))
+			{
 				ctx.use_nsec3 = false;
 				ctx.alg = dns_kasp_key_algorithm(kaspkey);
 				ctx.size = dns_kasp_key_size(kaspkey);
-				ctx.kskflag = dns_kasp_key_ksk(kaspkey)
-						      ? DNS_KEYFLAG_KSK
-						      : 0;
 				ctx.ksk = dns_kasp_key_ksk(kaspkey);
 				ctx.zsk = dns_kasp_key_zsk(kaspkey);
 				ctx.lifetime = dns_kasp_key_lifetime(kaspkey);
@@ -1361,9 +1274,12 @@ main(int argc, char **argv) {
 				if (ctx.keystore != NULL) {
 					check_keystore_options(&ctx);
 				}
+				if ((ctx.ksk && !ctx.wantksk && ctx.wantzsk) ||
+				    (ctx.zsk && !ctx.wantzsk && ctx.wantksk))
+				{
+					continue;
+				}
 				keygen(&ctx, mctx, argc, argv);
-
-				kaspkey = ISC_LIST_NEXT(kaspkey, link);
 			}

 			dns_kasp_detach(&kasp);
@@ -105,7 +105,13 @@ Options
 .. option:: -f flag

   This option sets the specified flag in the flag field of the KEY/DNSKEY record.
-   The only recognized flags are KSK (Key-Signing Key) and REVOKE.
+   The only recognized flags are ZSK (Zone-Signing Key), KSK (Key-Signing Key)
+   and REVOKE.
+
+   Note that ZSK is not a physical flag in the DNSKEY record, it is merely used
+   to explicitly tell that you want to create a ZSK. Setting :option:`-f` in
+   conjunction with :option:`-k` will result in generating keys that only
+   match the given role set with this option.

 .. option:: -F

@@ -0,0 +1,162 @@
+.. Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+..
+.. SPDX-License-Identifier: MPL-2.0
+..
+.. This Source Code Form is subject to the terms of the Mozilla Public
+.. License, v. 2.0.  If a copy of the MPL was not distributed with this
+.. file, you can obtain one at https://mozilla.org/MPL/2.0/.
+..
+.. See the COPYRIGHT file distributed with this work for additional
+.. information regarding copyright ownership.
+
+.. highlight: console
+
+.. iscman:: dnssec-ksr
+.. program:: dnssec-ksr
+.. _man_dnssec-ksr:
+
+dnssec-ksr - Create signed key response (SKR) files for offline KSK setups
+--------------------------------------------------------------------------
+
+Synopsis
+~~~~~~~~
+
+:program:`dnssec-ksr` [**-E** engine] [**-e** date/offset] [**-F**] [**-h**] [**-i** date/offset] [**-K** directory] [**-k** policy] [**-l** file] [**-V**] [**-v** level] {command} {zone}
+
+Description
+~~~~~~~~~~~
+
+The :program:`dnssec-ksr` can be used to issue several commands that are needed
+to generate presigned RRsets for a zone where the private key file of the Key
+Signing Key (KSK) is typically offline. This requires Zone Signing Keys
+(ZSKs) to be pregenerated, and the DNSKEY, CDNSKEY, and CDS RRsets to be
+already signed in advance.
+
+The latter is done by creating Key Signing Requests (KSRs) that can be imported
+to the environment where the KSK is available. Once there, this program can
+create Signed Key Responses (SKRs) that can be loaded by an authoritative DNS
+server.
+
+Options
+~~~~~~~
+
+.. option:: -E engine
+
+   This option specifies the cryptographic hardware to use, when applicable.
+
+   When BIND 9 is built with OpenSSL, this needs to be set to the OpenSSL
+   engine identifier that drives the cryptographic accelerator or
+   hardware service module (usually ``pkcs11``).
+
+.. option:: -e date/offset
+
+   This option sets the end date for which keys or SKRs need to be generated
+   (depending on the command).
+
+.. option:: -F
+
+   This options turns on FIPS (US Federal Information Processing Standards)
+   mode if the underlying crytographic library supports running in FIPS
+   mode.
+
+.. option:: -h
+
+   This option prints a short summary of the options and arguments to
+   :program:`dnssec-ksr`.
+
+.. option:: -i date/offset
+
+   This option sets the start date for which keys or SKRs need to be generated
+   (depending on the command).
+
+.. option:: -K directory
+
+   This option sets the directory in which the key files are to be read or
+   written (depending on the command).
+
+.. option:: -k policy
+
+   This option sets the specific ``dnssec-policy`` for which keys need to
+   be generated, or signed.
+
+.. option:: -l file
+
+   This option provides a configuration file that contains a ``dnssec-policy``
+   statement (matching the policy set with :option:`-k`).
+
+.. option:: -V
+
+   This option prints version information.
+
+.. option:: -v level
+
+   This option sets the debugging level. Level 1 is intended to be usefully
+   verbose for general users; higher levels are intended for developers.
+
+``command``
+
+   The KSR command to be executed. See below for the available commands.
+
+``zone``
+
+   The name of the zone for which the KSR command is being executed.
+
+Commands
+~~~~~~~~
+
+.. option:: keygen
+
+  Pregenerate a number of zone signing keys (ZSKs), given a DNSSEC policy and
+  an interval. The number of generated keys depends on the interval and the
+  ZSK lifetime.
+
+.. option:: request
+
+  Create a Key Signing Request (KSR), given a DNSSEC policy and an interval.
+  This will generate a file with a number of key bundles, where each bundle
+  contains the currently published ZSKs (according to the timing metadata).
+
+.. option:: sign
+
+  Sign a Key Signing Request (KSR), given a DNSSEC policy and an interval,
+  creating a Signed Key Response (SKR). This will add the corresponding DNSKEY,
+  CDS, and CDNSKEY records for the KSK that is being used for signing.
+
+Exit Status
+~~~~~~~~~~~
+
+The :program:`dnssec-ksr` command exits 0 on success, or non-zero if an error
+occurred.
+
+Examples
+~~~~~~~~
+
+When you need to generate keys for the zone "example.com" for the next year,
+given a ``dnssec-policy`` named "mypolicy":
+
+::
+
+    dnssec-ksr -i now -e +1y -k mypolicy -l named.conf keygen example.com
+
+Creating a KSR for the same zone and period can be done with:
+
+::
+
+    dnssec-ksr -i now -e +1y -k mypolicy -l named.conf request example.com > ksr.txt
+
+Typically you would now transfer the KSR to the system that has access to the KSK.
+
+Signing the KSR created above can be done with:
+
+::
+
+    dnssec-ksr -i now -e +1y -k kskpolicy -l named.conf -f ksr.txt sign example.com
+
+Make sure that the DNSSEC parameters in ``kskpolicy`` match those in ``mypolicy``.
+
+See Also
+~~~~~~~~
+
+:iscman:`dnssec-keygen(8) <dnssec-keygen>`,
+:iscman:`dnssec-signzone(8) <dnssec-signzone>`,
+BIND 9 Administrator Reference Manual.
@@ -1167,7 +1167,7 @@ has_dname(dns_db_t *db, dns_dbversion_t *ver, dns_dbnode_t *node) {
 * Signs all records at a name.
 */
 static void
-signname(dns_dbnode_t *node, dns_name_t *name) {
+signname(dns_dbnode_t *node, bool apex, dns_name_t *name) {
 	isc_result_t result;
 	dns_rdataset_t rdataset;
 	dns_rdatasetiter_t *rdsiter;
@@ -1218,6 +1218,10 @@ signname(dns_dbnode_t *node, dns_name_t *name) {
 			dns_name_format(name, namebuf, sizeof(namebuf));
 			fatal("'%s': found DS RRset without NS RRset\n",
 			      namebuf);
+		} else if (rdataset.type == dns_rdatatype_dnskey && !apex) {
+			char namebuf[DNS_NAME_FORMATSIZE];
+			dns_name_format(name, namebuf, sizeof(namebuf));
+			fatal("'%s': Non-apex DNSKEY RRset\n", namebuf);
 		}

 		signset(&del, &add, node, name, &rdataset);
@@ -1537,7 +1541,7 @@ signapex(void) {
 	check_result(result, "dns_dbiterator_seek()");
 	result = dns_dbiterator_current(gdbiter, &node, name);
 	check_dns_dbiterator_current(result);
-	signname(node, name);
+	signname(node, true, name);
 	dumpnode(name, node);
 	dns_db_detachnode(gdb, &node);
 	result = dns_dbiterator_first(gdbiter);
@@ -1666,7 +1670,7 @@ assignwork(void *arg) {

 	UNLOCK(&namelock);

-	signname(node, dns_fixedname_name(&fname));
+	signname(node, false, dns_fixedname_name(&fname));

 	/*%
 	 * Write a node to the output file, and restart the worker task.
@@ -273,7 +273,7 @@ Options
   with cached copies of the old DNSKEY RRset. The :option:`-Q` option forces
   :program:`dnssec-signzone` to remove signatures from keys that are no longer
   active. This enables ZSK rollover using the procedure described in
-   :rfc:`4641#4.2.1.1` ("Pre-Publish Key Rollover").
+   :rfc:`6781#4.1.1.1` ("Pre-Publish Key Rollover").

 .. option:: -q

@@ -290,7 +290,7 @@ Options
   This option is similar to :option:`-Q`, except it forces
   :program:`dnssec-signzone` to remove signatures from keys that are no longer
   published. This enables ZSK rollover using the procedure described in
-   :rfc:`4641#4.2.1.2` ("Double Signature Zone Signing Key
+   :rfc:`6781#4.1.1.2` ("Double Signature Zone Signing Key
   Rollover").

 .. option:: -S
@@ -374,6 +374,7 @@ Options

   .. note::
      ``-3 -`` is the recommended configuration. Adding salt provides no practical benefits.
+      See :rfc:`9276`.

 .. option:: -H iterations

@@ -382,6 +383,7 @@ Options

   .. warning::
      Values greater than 0 cause interoperability issues and also increase the risk of CPU-exhausting DoS attacks.
+      See :rfc:`9276`.

 .. option:: -A

@@ -390,6 +392,7 @@ Options

   .. warning::
      Do not use this option unless all its implications are fully understood. This option is intended only for extremely large zones (comparable to ``com.``) with sparse secure delegations.
+      See :rfc:`9276`.

 .. option:: -AA

@@ -443,4 +446,4 @@ See Also
 ~~~~~~~~

 :iscman:`dnssec-keygen(8) <dnssec-keygen>`, BIND 9 Administrator Reference Manual, :rfc:`4033`,
-:rfc:`4641`.
+:rfc:`6781`.
@@ -602,3 +602,88 @@ loadjournal(isc_mem_t *mctx, dns_db_t *db, const char *file) {
 cleanup:
 	dns_journal_destroy(&jnl);
 }
+
+void
+kasp_from_conf(cfg_obj_t *config, isc_mem_t *mctx, isc_log_t *lctx,
+	       const char *name, const char *keydir, const char *engine,
+	       dns_kasp_t **kaspp) {
+	isc_result_t result = ISC_R_NOTFOUND;
+	const cfg_listelt_t *element;
+	const cfg_obj_t *kasps = NULL;
+	dns_kasp_t *kasp = NULL, *kasp_next;
+	dns_kasplist_t kasplist;
+	const cfg_obj_t *keystores = NULL;
+	dns_keystore_t *ks = NULL, *ks_next;
+	dns_keystorelist_t kslist;
+
+	ISC_LIST_INIT(kasplist);
+	ISC_LIST_INIT(kslist);
+
+	(void)cfg_map_get(config, "key-store", &keystores);
+	for (element = cfg_list_first(keystores); element != NULL;
+	     element = cfg_list_next(element))
+	{
+		cfg_obj_t *kconfig = cfg_listelt_value(element);
+		ks = NULL;
+		result = cfg_keystore_fromconfig(kconfig, mctx, lctx, engine,
+						 &kslist, NULL);
+		if (result != ISC_R_SUCCESS) {
+			fatal("failed to configure key-store '%s': %s",
+			      cfg_obj_asstring(cfg_tuple_get(kconfig, "name")),
+			      isc_result_totext(result));
+		}
+	}
+	/* Default key-directory key store. */
+	ks = NULL;
+	(void)cfg_keystore_fromconfig(NULL, mctx, lctx, engine, &kslist, &ks);
+	INSIST(ks != NULL);
+	if (keydir != NULL) {
+		/* '-K keydir' takes priority */
+		dns_keystore_setdirectory(ks, keydir);
+	}
+	dns_keystore_detach(&ks);
+
+	(void)cfg_map_get(config, "dnssec-policy", &kasps);
+	for (element = cfg_list_first(kasps); element != NULL;
+	     element = cfg_list_next(element))
+	{
+		cfg_obj_t *kconfig = cfg_listelt_value(element);
+		kasp = NULL;
+		if (strcmp(cfg_obj_asstring(cfg_tuple_get(kconfig, "name")),
+			   name) != 0)
+		{
+			continue;
+		}
+
+		result = cfg_kasp_fromconfig(kconfig, NULL, true, mctx, lctx,
+					     &kslist, &kasplist, &kasp);
+		if (result != ISC_R_SUCCESS) {
+			fatal("failed to configure dnssec-policy '%s': %s",
+			      cfg_obj_asstring(cfg_tuple_get(kconfig, "name")),
+			      isc_result_totext(result));
+		}
+		INSIST(kasp != NULL);
+		dns_kasp_freeze(kasp);
+		break;
+	}
+
+	*kaspp = kasp;
+
+	/*
+	 * Cleanup kasp list.
+	 */
+	for (kasp = ISC_LIST_HEAD(kasplist); kasp != NULL; kasp = kasp_next) {
+		kasp_next = ISC_LIST_NEXT(kasp, link);
+		ISC_LIST_UNLINK(kasplist, kasp, link);
+		dns_kasp_detach(&kasp);
+	}
+
+	/*
+	 * Cleanup keystore list.
+	 */
+	for (ks = ISC_LIST_HEAD(kslist); ks != NULL; ks = ks_next) {
+		ks_next = ISC_LIST_NEXT(ks, link);
+		ISC_LIST_UNLINK(kslist, ks, link);
+		dns_keystore_detach(&ks);
+	}
+}
@@ -20,10 +20,18 @@
 #include <isc/log.h>
 #include <isc/stdtime.h>

+#include <dns/kasp.h>
 #include <dns/rdatastruct.h>

 #include <dst/dst.h>

+#include <isccfg/cfg.h>
+#include <isccfg/kaspconf.h>
+#include <isccfg/namedconf.h>
+
+#define MAX_RSA 4096 /* should be long enough... */
+#define MAX_DH	4096 /* should be long enough... */
+
 /*! verbosity: set by -v and -q option in each program, defined in dnssectool.c
 */
 extern int verbose;
@@ -108,3 +116,8 @@ isoptarg(const char *arg, char **argv, void (*usage)(void));

 void
 loadjournal(isc_mem_t *mctx, dns_db_t *db, const char *journal);
+
+void
+kasp_from_conf(cfg_obj_t *config, isc_mem_t *mctx, isc_log_t *lctx,
+	       const char *name, const char *keydir, const char *engine,
+	       dns_kasp_t **kaspp);
@@ -529,13 +529,17 @@ authors_lookup(bdbnode_t *node) {
 	isc_result_t result;
 	const char **p = NULL;
 	static const char *authors[] = {
-		"Mark Andrews",	  "Curtis Blackburn",	"James Brister",
-		"Ben Cottrell",	  "John H. DuBois III", "Francis Dupont",
-		"Michael Graff",  "Andreas Gustafsson", "Bob Halley",
-		"Evan Hunt",	  "JINMEI Tatuya",	"Witold Krecicki",
-		"David Lawrence", "Scott Mann",		"Danny Mayer",
-		"Damien Neil",	  "Matt Nelson",	"Jeremy C. Reed",
-		"Michael Sawyer", "Brian Wellington",	NULL
+		"Mark Andrews",	      "Curtis Blackburn",
+		"James Brister",      "Ben Cottrell",
+		"John H. DuBois III", "Francis Dupont",
+		"Michael Graff",      "Andreas Gustafsson",
+		"Bob Halley",	      "Evan Hunt",
+		"JINMEI Tatuya",      "Witold Krecicki",
+		"David Lawrence",     "Scott Mann",
+		"Danny Mayer",	      "Aydin Mercan",
+		"Damien Neil",	      "Matt Nelson",
+		"Jeremy C. Reed",     "Michael Sawyer",
+		"Brian Wellington",   NULL
 	};

 	/*
@@ -207,7 +207,7 @@ options {\n\
 	/* zone */\n\
 	allow-query {any;};\n\
 	allow-query-on {any;};\n\
-	allow-transfer {any;};\n\
+	allow-transfer {none;};\n\
 #	also-notify <none>\n\
 	check-integrity yes;\n\
 	check-mx-cname warn;\n\
@@ -298,6 +298,7 @@ dnssec-policy \"default\" {\n\
 	publish-safety " DNS_KASP_PUBLISH_SAFETY "; \n\
 	retire-safety " DNS_KASP_RETIRE_SAFETY "; \n\
 	purge-keys " DNS_KASP_PURGE_KEYS "; \n\
+	signatures-jitter " DNS_KASP_SIG_JITTER "; \n\
 	signatures-refresh " DNS_KASP_SIG_REFRESH "; \n\
 	signatures-validity " DNS_KASP_SIG_VALIDITY "; \n\
 	signatures-validity-dnskey " DNS_KASP_SIG_VALIDITY_DNSKEY "; \n\
@@ -949,6 +949,7 @@ parse_command_line(int argc, char *argv[]) {
 			break;
 		case 'U':
 			/* Obsolete.  No longer in use.  Ignore. */
+			named_main_earlywarning("option '-U' has been removed");
 			break;
 		case 'u':
 			named_g_username = isc_commandline_argument;
@@ -21,7 +21,7 @@ named - Internet domain name server
 Synopsis
 ~~~~~~~~

-:program:`named` [ [**-4**] | [**-6**] ] [**-c** config-file] [**-C**] [**-d** debug-level] [**-D** string] [**-E** engine-name] [**-f**] [**-g**] [**-L** logfile] [**-M** option] [**-m** flag] [**-n** #cpus] [**-p** port] [**-s**] [**-t** directory] [**-U** #listeners] [**-u** user] [**-v**] [**-V**] ]
+:program:`named` [ [**-4**] | [**-6**] ] [**-c** config-file] [**-C**] [**-d** debug-level] [**-D** string] [**-E** engine-name] [**-f**] [**-g**] [**-L** logfile] [**-M** option] [**-m** flag] [**-n** #cpus] [**-p** port] [**-s**] [**-t** directory] [**-u** user] [**-v**] [**-V**] ]

 Description
 ~~~~~~~~~~~
@@ -163,14 +163,7 @@ Options

 .. option:: -U #listeners

-   This option tells :program:`named` the number of ``#listeners`` worker threads to listen on, for incoming UDP packets on
-   each address. If not specified, :program:`named` calculates a default
-   value based on the number of detected CPUs: 1 for 1 CPU, and the
-   number of detected CPUs minus one for machines with more than 1 CPU.
-   This cannot be increased to a value higher than the number of CPUs.
-   If :option:`-n` has been set to a higher value than the number of detected
-   CPUs, then :option:`-U` may be increased as high as that value, but no
-   higher.
+   This option has been removed. Attempts to use it now result in a warning.

 .. option:: -u user

@@ -152,11 +152,11 @@
 #endif /* HAVE_LMDB */

 #ifndef SIZE_MAX
-#define SIZE_MAX ((size_t)-1)
+#define SIZE_MAX ((size_t) - 1)
 #endif /* ifndef SIZE_MAX */

 #ifndef SIZE_AS_PERCENT
-#define SIZE_AS_PERCENT ((size_t)-2)
+#define SIZE_AS_PERCENT ((size_t) - 2)
 #endif /* ifndef SIZE_AS_PERCENT */

 /* RFC7828 defines timeout as 16-bit value specified in units of 100
@@ -2656,6 +2656,10 @@ catz_addmodzone_cb(void *arg) {
 	ns_cfgctx_t *cfg = NULL;
 	dns_zone_t *zone = NULL;

+	if (isc_loop_shuttingdown(isc_loop_get(named_g_loopmgr, isc_tid()))) {
+		goto cleanup;
+	}
+
 	cfg = (ns_cfgctx_t *)cz->view->new_zone_config;
 	if (cfg == NULL) {
 		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
@@ -2852,7 +2856,7 @@ cleanup:
 	}
 	dns_catz_entry_detach(cz->origin, &cz->entry);
 	dns_catz_zone_detach(&cz->origin);
-	dns_view_detach(&cz->view);
+	dns_view_weakdetach(&cz->view);
 	isc_mem_putanddetach(&cz->mctx, cz, sizeof(*cz));
 }

@@ -2865,6 +2869,10 @@ catz_delzone_cb(void *arg) {
 	char cname[DNS_NAME_FORMATSIZE];
 	const char *file = NULL;

+	if (isc_loop_shuttingdown(isc_loop_get(named_g_loopmgr, isc_tid()))) {
+		goto cleanup;
+	}
+
 	isc_loopmgr_pause(named_g_loopmgr);

 	dns_name_format(dns_catz_entry_getname(cz->entry), cname,
@@ -2877,7 +2885,7 @@ catz_delzone_cb(void *arg) {
 			      "catz: catz_delzone_cb: "
 			      "zone '%s' not found",
 			      cname);
-		goto cleanup;
+		goto resume;
 	}

 	if (!dns_zone_getadded(zone)) {
@@ -2886,7 +2894,7 @@ catz_delzone_cb(void *arg) {
 			      "catz: catz_delzone_cb: "
 			      "zone '%s' is not a dynamically added zone",
 			      cname);
-		goto cleanup;
+		goto resume;
 	}

 	if (dns_zone_get_parentcatz(zone) != cz->origin) {
@@ -2895,7 +2903,7 @@ catz_delzone_cb(void *arg) {
 			      "catz: catz_delzone_cb: zone "
 			      "'%s' exists in multiple catalog zones",
 			      cname);
-		goto cleanup;
+		goto resume;
 	}

 	/* Stop answering for this zone */
@@ -2904,7 +2912,9 @@ catz_delzone_cb(void *arg) {
 		dns_zone_unload(zone);
 	}

-	CHECK(dns_view_delzone(cz->view, zone));
+	if (dns_view_delzone(cz->view, zone) != ISC_R_SUCCESS) {
+		goto resume;
+	}
 	file = dns_zone_getfile(zone);
 	if (file != NULL) {
 		isc_file_remove(file);
@@ -2919,14 +2929,15 @@ catz_delzone_cb(void *arg) {
 		      "catz: catz_delzone_cb: "
 		      "zone '%s' deleted",
 		      cname);
-cleanup:
+resume:
 	isc_loopmgr_resume(named_g_loopmgr);
+cleanup:
 	if (zone != NULL) {
 		dns_zone_detach(&zone);
 	}
 	dns_catz_entry_detach(cz->origin, &cz->entry);
 	dns_catz_zone_detach(&cz->origin);
-	dns_view_detach(&cz->view);
+	dns_view_weakdetach(&cz->view);
 	isc_mem_putanddetach(&cz->mctx, cz, sizeof(*cz));
 }

@@ -2958,7 +2969,7 @@ catz_run(dns_catz_entry_t *entry, dns_catz_zone_t *origin, dns_view_t *view,

 	dns_catz_entry_attach(entry, &cz->entry);
 	dns_catz_zone_attach(origin, &cz->origin);
-	dns_view_attach(view, &cz->view);
+	dns_view_weakattach(view, &cz->view);

 	isc_async_run(named_g_mainloop, action, cz);

@@ -4660,7 +4671,7 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist, cfg_obj_t *config,
 			 * is simply a named cache that is not shared.
 			 */
 			CHECK(dns_cache_create(named_g_loopmgr, view->rdclass,
-					       cachename, &cache));
+					       cachename, mctx, &cache));
 		}
 		nsc = isc_mem_get(mctx, sizeof(*nsc));
 		nsc->cache = NULL;
@@ -12173,6 +12184,12 @@ named_server_status(named_server_t *server, isc_buffer_t **text) {
 		 isc_quota_getmax(&server->sctx->recursionquota));
 	CHECK(putstr(text, line));

+	snprintf(line, sizeof(line), "recursive high-water: %u\n",
+		 (unsigned int)ns_stats_get_counter(
+			 server->sctx->nsstats,
+			 ns_statscounter_recurshighwater));
+	CHECK(putstr(text, line));
+
 	snprintf(line, sizeof(line), "tcp clients: %u/%u\n",
 		 isc_quota_getused(&server->sctx->tcpquota),
 		 isc_quota_getmax(&server->sctx->tcpquota));
@@ -15081,29 +15098,26 @@ named_server_zonestatus(named_server_t *server, isc_lex_t *lex,
 	{
 		dns_name_t *name;
 		dns_fixedname_t fixed;
-		dns_rdataset_t next;
+		isc_stdtime_t resign;
+		dns_typepair_t typepair;

-		dns_rdataset_init(&next);
 		name = dns_fixedname_initname(&fixed);

-		result = dns_db_getsigningtime(db, &next, name);
+		result = dns_db_getsigningtime(db, &resign, name, &typepair);
 		if (result == ISC_R_SUCCESS) {
 			char namebuf[DNS_NAME_FORMATSIZE];
 			char typebuf[DNS_RDATATYPE_FORMATSIZE];

+			resign -= dns_zone_getsigresigninginterval(zone);
+
 			dns_name_format(name, namebuf, sizeof(namebuf));
-			dns_rdatatype_format(next.covers, typebuf,
-					     sizeof(typebuf));
+			dns_rdatatype_format(DNS_TYPEPAIR_COVERS(typepair),
+					     typebuf, sizeof(typebuf));
 			snprintf(resignbuf, sizeof(resignbuf), "%s/%s", namebuf,
 				 typebuf);
-			isc_time_set(
-				&resigntime,
-				next.resign -
-					dns_zone_getsigresigninginterval(zone),
-				0);
+			isc_time_set(&resigntime, resign, 0);
 			isc_time_formathttptimestamp(&resigntime, rtbuf,
 						     sizeof(rtbuf));
-			dns_rdataset_disassociate(&next);
 		}
 	}

@@ -327,6 +327,8 @@ init_desc(void) {
 	SET_NSSTATDESC(updatebadprereq,
 		       "updates rejected due to prerequisite failure",
 		       "UpdateBadPrereq");
+	SET_NSSTATDESC(recurshighwater, "Recursive clients high-water",
+		       "RecursHighwater");
 	SET_NSSTATDESC(recursclients, "recursing clients", "RecursClients");
 	SET_NSSTATDESC(dns64, "queries answered by DNS64", "DNS64");
 	SET_NSSTATDESC(ratedropped, "responses dropped for rate limits",
@@ -305,8 +305,7 @@ rndc_recvdone(isc_nmhandle_t *handle, isc_result_t result, void *arg) {
 		fatal("recv failed: %s", isc_result_totext(result));
 	}

-	source.rstart = isc_buffer_base(ccmsg->buffer);
-	source.rend = isc_buffer_used(ccmsg->buffer);
+	isccc_ccmsg_toregion(ccmsg, &source);

 	DO("parse message",
 	   isccc_cc_fromwire(&source, &response, algorithm, &secret));
@@ -381,8 +380,7 @@ rndc_recvnonce(isc_nmhandle_t *handle ISC_ATTR_UNUSED, isc_result_t result,
 		fatal("recv failed: %s", isc_result_totext(result));
 	}

-	source.rstart = isc_buffer_base(ccmsg->buffer);
-	source.rend = isc_buffer_used(ccmsg->buffer);
+	isccc_ccmsg_toregion(ccmsg, &source);

 	DO("parse message",
 	   isccc_cc_fromwire(&source, &response, algorithm, &secret));
@@ -3,7 +3,6 @@ nxtify
 sdig
 *_test
 gsstest
-conf.sh
 dlopen
 keycreate
 keydelete
@@ -19,6 +19,8 @@ named.run
 /start.sh
 /stop.sh
 /ifconfig.sh
+/isctest/vars/.ac_vars/*
+!/isctest/vars/.ac_vars/*.in

 # Ignore file names with underscore in their name except python or shell files.
 # This is done to ignore the temporary directories and symlinks created by the
@@ -128,6 +128,7 @@ TESTS =				\
 	kasp			\
 	keepalive		\
 	keyfromlabel		\
+	ksr			\
 	legacy			\
 	limits			\
 	logfileconfig		\
@@ -25,6 +25,7 @@ options {
 	pid-file "named.pid";
 	listen-on { 10.53.0.1; };
 	listen-on-v6 { none; };
+	allow-transfer { any; };
 	allow-query { any; };
 	allow-new-zones yes;
 	recursion no;
@@ -23,6 +23,7 @@ options {
 	listen-on { 10.53.0.3; };
 	listen-on-v6 { none; };
 	allow-query { any; };
+	allow-transfer { any; };
 	recursion no;
 	allow-new-zones yes;
 	dnssec-validation no;
@@ -23,6 +23,7 @@ options {
 	listen-on { 10.53.0.3; };
 	listen-on-v6 { none; };
 	allow-query { any; };
+	allow-transfer { any; };
 	recursion no;
 	allow-new-zones yes;
 	dnssec-validation no;
@@ -25,6 +25,8 @@ options {
 };

 view main in {
+	allow-transfer { any; };
+
 	zone example.net {
 		type primary;
 		file "example.net.db";
@@ -21,6 +21,7 @@ options {
 	pid-file "named.pid";
 	listen-on { 10.53.0.1; };
 	listen-on-v6 { none; };
+	allow-transfer { any; };
 	recursion no;
 	notify yes;
 	dnssec-validation yes;
@@ -21,6 +21,7 @@ options {
 	pid-file "named.pid";
 	listen-on { 10.53.0.2; };
 	listen-on-v6 { none; };
+	allow-transfer { any; };
 	recursion no;
 	notify yes;
 	dnssec-validation yes;
@@ -24,6 +24,7 @@ options {
 	pid-file "named.pid";
 	listen-on { 10.53.0.3; };
 	listen-on-v6 { none; };
+	allow-transfer { any; };
 	recursion no;
 	notify yes;
 	dnssec-validation yes;
@@ -87,6 +88,7 @@ dnssec-policy "jitter" {
 	signatures-validity P10D;
 	signatures-validity-dnskey P10D;
 	signatures-refresh P2D;
+	signatures-jitter P8D;
 };

 # Jitter, NSEC3
@@ -91,10 +91,10 @@ checkjitter() {

  _count=0
  # Check if we have at least 4 days
-  # This number has been tuned for `signatures-validity 10d; signatures-refresh 2d`, as
-  # 1 signature expiration dates should be spread out across at most 8 (10-2) days
-  # 2. we remove first and last day to remove frequency outlier, we are left with 6 (8-2) days
-  # 3. we subtract two more days to allow test pass on day boundaries, etc. leaving us with 4 (6-2)
+  # This number has been tuned for `signatures-validity 10d; signatures-jitter 8d`, as
+  # 1. signature expiration dates should be spread out across at most 8 days
+  # 2. we remove first and last day to remove frequency outlier, we are left with 6 days
+  # 3. we subtract two more days to allow test pass on day boundaries, etc. leaving us with 4 days
  for _num in $_expiretimes; do
    _count=$((_count + 1))
  done
@@ -19,6 +19,7 @@ options {
 	pid-file "named.pid";
 	listen-on { 10.53.0.1; };
 	listen-on-v6 { none; };
+	allow-transfer { any; };
 	recursion no;
 	dnssec-validation no;
 	notify yes;
@@ -19,6 +19,7 @@ options {
 	pid-file "named.pid";
 	listen-on { 10.53.0.1; };
 	listen-on-v6 { none; };
+	allow-transfer { any; };
 	recursion no;
 	notify yes;
 	ixfr-from-differences yes;
@@ -19,6 +19,7 @@ options {
 	pid-file "named.pid";
 	listen-on { 10.53.0.2; };
 	listen-on-v6 { none; };
+	allow-transfer { any; };
 	recursion no;
 	notify yes;
 	ixfr-from-differences yes;
@@ -25,6 +25,7 @@ options {
 	pid-file "named.pid";
 	listen-on { 10.53.0.2; };
 	listen-on-v6 { fd92:7065:b8e:ffff::2; };
+	allow-transfer { any; };
 	notify no;
 	notify-delay 0;
 	recursion no;
@@ -25,6 +25,7 @@ options {
 	pid-file "named.pid";
 	listen-on { 10.53.0.2; };
 	listen-on-v6 { fd92:7065:b8e:ffff::2; };
+	allow-transfer { any; };
 	notify no;
 	notify-delay 0;
 	recursion no;
@@ -27,6 +27,7 @@ options {
 	provide-ixfr no;
 	listen-on { 10.53.0.3; };
 	listen-on-v6 { fd92:7065:b8e:ffff::3; };
+	allow-transfer { any; };
 	notify no;
 	notify-delay 0;
 	recursion no;
@@ -26,6 +26,7 @@ options {
 	pid-file "named.pid";
 	listen-on { 10.53.0.4; };
 	listen-on-v6 { fd92:7065:b8e:ffff::4; };
+	allow-transfer { any; };
 	notify no;
 	notify-delay 0;
 	recursion no;
@@ -0,0 +1,27 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+/*
+ * The dnssec-policy jitter is more than signatures-validity,
+ * which is not allowed.
+ */
+dnssec-policy high-jitter {
+	signatures-jitter P8DT1S;
+	signatures-validity P8D;
+};
+
+zone "example.net" {
+	type primary;
+	file "example.db";
+	dnssec-policy high-jitter;
+};
@@ -34,6 +34,7 @@ dnssec-policy "test" {
 	parent-propagation-delay PT1H;
 	publish-safety PT3600S;
 	retire-safety PT3600S;
+	signatures-jitter PT12H;
 	signatures-refresh P3D;
 	signatures-validity P2W;
 	signatures-validity-dnskey P14D;
@@ -34,6 +34,7 @@ dnssec-policy "test" {
 	publish-safety PT3600S;
 	purge-keys P90D;
 	retire-safety PT3600S;
+	signatures-jitter PT12H;
 	signatures-refresh P3D;
 	signatures-validity P2W;
 	signatures-validity-dnskey P14D;
@@ -14,10 +14,10 @@
 from typing import NamedTuple, Tuple

 import os
-import subprocess
 import sys
 import time

+import isctest
 import pytest

 pytest.importorskip("dns", minversion="2.0.0")
@@ -87,7 +87,7 @@ def verify_zone(zone, transfer):
    # dnssec-verify command with default arguments.
    verify_cmd = [verify, "-z", "-o", zone, filename]

-    verifier = subprocess.run(verify_cmd, capture_output=True, check=True)
+    verifier = isctest.run.cmd(verify_cmd)

    if verifier.returncode != 0:
        print(f"error: dnssec-verify {zone} failed")
@@ -234,7 +234,7 @@ def rekey(zone):
        "loadkeys",
        zone,
    ]
-    controller = subprocess.run(rndc_cmd, capture_output=True, check=True)
+    controller = isctest.run.cmd(rndc_cmd)

    if controller.returncode != 0:
        print(f"error: rndc loadkeys {zone} failed")
@@ -19,6 +19,7 @@ options {
 	pid-file "named.pid";
 	listen-on { 10.53.0.4; };
 	listen-on-v6 { none; };
+	allow-transfer { any; };
 	recursion yes;
 	dnssec-validation yes;
 	check-names primary ignore;
@@ -19,6 +19,7 @@ options {
 	pid-file "named.pid";
 	listen-on { 10.53.0.5; };
 	listen-on-v6 { none; };
+	allow-transfer { any; };
 	recursion yes;
 	dnssec-validation yes;
 	check-names master ignore;
@@ -0,0 +1,13 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$INCLUDE .
+$INCLUDE ..
@@ -18,3 +18,4 @@ $GENERATE 0-7   host$	A 1.2.3.${1,0,d}
 $GENERATE 8-9   host$	A 1.2.3.${1,0}
 $GENERATE 10-11 host$	A 1.2.3.${1}
 $GENERATE 1024-1026 ${0,3,n}	AAAA 2001:db8::${0,4,x}
+$GENERATE 1024-1026 ${-2000,0,n}	AAAA 2001:db8::${0,4,x}
@@ -11,146 +11,92 @@
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.

+# When sourcing the script outside the pytest environment (e.g. during helper
+# script development), the env variables have to be loaded.
+if [ -z "$TOP_SRCDIR" ]; then
+  SCRIPT_DIR=$(cd "$(dirname "$0")" && pwd | sed -E 's|(.*bin/tests/system).*|\1|')
+  eval "$(PYTHONPATH="$SCRIPT_DIR:$PYTHONPATH" /usr/bin/env python3 -m isctest)"
+fi
+
 testsock6() {
-	if test -n "$PERL" && $PERL -e "use IO::Socket::IP;" 2> /dev/null
-	then
-		$PERL "$TOP_SRCDIR/bin/tests/system/testsock6.pl" "$@"
-	else
-		false
-	fi
+  if test -n "$PERL" && $PERL -e "use IO::Socket::IP;" 2>/dev/null; then
+    $PERL "$TOP_SRCDIR/bin/tests/system/testsock6.pl" "$@"
+  else
+    false
+  fi
 }

-export LANG=C
+echofail() {
+  echo "$*"
+}
+echowarn() {
+  echo "$*"
+}
+echopass() {
+  echo "$*"
+}
+echoinfo() {
+  echo "$*"
+}
+echostart() {
+  echo "$*"
+}
+echoend() {
+  echo "$*"
+}

+echo_i() {
+  echo "$@" | while IFS= read -r __LINE; do
+    echoinfo "I:$__LINE"
+  done
+}

-#
-# Set up color-coded test output
-#
-if [ ${SYSTEMTEST_FORCE_COLOR:-0} -eq 1 ] || test -t 1 && type tput > /dev/null 2>&1 && tput setaf 7 > /dev/null 2>&1 ; then
-    export COLOR_END=$(tput setaf 4)    # blue
-    export COLOR_FAIL=$(tput setaf 1)   # red
-    export COLOR_INFO=$(tput bold)      # bold
-    export COLOR_NONE=$(tput sgr0)
-    export COLOR_PASS=$(tput setaf 2)   # green
-    export COLOR_START=$(tput setaf 4)  # blue
-    export COLOR_WARN=$(tput setaf 3)   # yellow
-else
-    # set to empty strings so printf succeeds
-    export COLOR_END=''
-    export COLOR_FAIL=''
-    export COLOR_INFO=''
-    export COLOR_NONE=''
-    export COLOR_PASS=''
-    export COLOR_START=''
-    export COLOR_WARN=''
-fi
+echo_ic() {
+  echo "$@" | while IFS= read -r __LINE; do
+    echoinfo "I:  $__LINE"
+  done
+}

-export SYSTESTDIR="$(basename $PWD)"
-
-if type printf > /dev/null 2>&1
-then
-	echofail () {
-		printf "${COLOR_FAIL}%s${COLOR_NONE}\n" "$*"
-	}
-	echowarn () {
-		printf "${COLOR_WARN}%s${COLOR_NONE}\n" "$*"
-	}
-	echopass () {
-		printf "${COLOR_PASS}%s${COLOR_NONE}\n" "$*"
-	}
-	echoinfo () {
-		printf "${COLOR_INFO}%s${COLOR_NONE}\n" "$*"
-	}
-	echostart () {
-		printf "${COLOR_START}%s${COLOR_NONE}\n" "$*"
-	}
-	echoend () {
-		printf "${COLOR_END}%s${COLOR_NONE}\n" "$*"
-	}
-	echo_i() {
-	    printf '%s\n' "$*" | while IFS= read -r __LINE ; do
-	       echoinfo "I:$__LINE"
-	    done
-	}
-
-	echo_ic() {
-	    printf '%s\n' "$*" | while IFS= read -r __LINE ; do
-	       echoinfo "I:  $__LINE"
-	    done
-	}
-
-	echo_d() {
-	    printf '%s\n' "$*" | while IFS= read -r __LINE ; do
-	       echoinfo "D:$__LINE"
-	    done
-	}
-else
-	echofail () {
-		echo "$*"
-	}
-	echowarn () {
-		echo "$*"
-	}
-	echopass () {
-		echo "$*"
-	}
-	echoinfo () {
-		echo "$*"
-	}
-	echostart () {
-		echo "$*"
-	}
-	echoend () {
-		echo "$*"
-	}
-
-	echo_i() {
-	    echo "$@" | while IFS= read -r __LINE ; do
-	       echoinfo "I:$__LINE"
-	    done
-	}
-
-	echo_ic() {
-	    echo "$@" | while IFS= read -r __LINE ; do
-	       echoinfo "I:  $__LINE"
-	    done
-	}
-
-	echo_d() {
-	    echo "$@" | while IFS= read -r __LINE ; do
-	       echoinfo "D:$__LINE"
-	    done
-	}
-fi
+echo_d() {
+  echo "$@" | while IFS= read -r __LINE; do
+    echoinfo "D:$__LINE"
+  done
+}

 cat_i() {
-    while IFS= read -r __LINE ; do
-       echoinfo "I:$__LINE"
-    done
+  while IFS= read -r __LINE; do
+    echoinfo "I:$__LINE"
+  done
 }

 cat_d() {
-    while IFS= read -r __LINE ; do
-       echoinfo "D:$__LINE"
-    done
+  while IFS= read -r __LINE; do
+    echoinfo "D:$__LINE"
+  done
 }

 digcomp() {
-    { output=$($PERL $TOP_SRCDIR/bin/tests/system/digcomp.pl "$@"); result=$?; } || true
-    [ -n "$output" ] &&  { echo "digcomp failed:"; echo "$output"; } | cat_i
-    return $result
+  {
+    output=$($PERL $TOP_SRCDIR/bin/tests/system/digcomp.pl "$@")
+    result=$?
+  } || true
+  [ -n "$output" ] && {
+    echo "digcomp failed:"
+    echo "$output"
+  } | cat_i
+  return $result
 }

 start_server() {
-    $PERL "$TOP_SRCDIR/bin/tests/system/start.pl" "$SYSTESTDIR" "$@"
+  $PERL "$TOP_SRCDIR/bin/tests/system/start.pl" "$SYSTESTDIR" "$@"
 }

 stop_server() {
-    $PERL "$TOP_SRCDIR/bin/tests/system/stop.pl" "$SYSTESTDIR" "$@"
+  $PERL "$TOP_SRCDIR/bin/tests/system/stop.pl" "$SYSTESTDIR" "$@"
 }

 send() {
-    $PERL "$TOP_SRCDIR/bin/tests/system/send.pl" "$@"
+  $PERL "$TOP_SRCDIR/bin/tests/system/send.pl" "$@"
 }

 #
@@ -199,94 +145,94 @@ export DEFAULT_HMAC=hmac-sha256
 # the error using the description of the tested variable provided in $3
 # and return 1.
 assert_int_equal() {
-	found="$1"
-	expected="$2"
-	description="$3"
+  found="$1"
+  expected="$2"
+  description="$3"

-	if [ "${expected}" -ne "${found}" ]; then
-		echo_i "incorrect ${description}: got ${found}, expected ${expected}"
-		return 1
-	fi
+  if [ "${expected}" -ne "${found}" ]; then
+    echo_i "incorrect ${description}: got ${found}, expected ${expected}"
+    return 1
+  fi

-	return 0
+  return 0
 }

 # keyfile_to_keys_section: helper function for keyfile_to_*_keys() which
 # converts keyfile data into a key-style trust anchor configuration
 # section using the supplied parameters
 keyfile_to_keys() {
-    section_name=$1
-    key_prefix=$2
-    shift
-    shift
-    echo "$section_name {"
-    for keyname in $*; do
-	awk '!/^; /{
+  section_name=$1
+  key_prefix=$2
+  shift
+  shift
+  echo "$section_name {"
+  for keyname in $*; do
+    awk '!/^; /{
 	    printf "\t\""$1"\" "
 	    printf "'"$key_prefix "'"
 	    printf $4 " " $5 " " $6 " \""
 	    for (i=7; i<=NF; i++) printf $i
 	    printf "\";\n"
 	}' $keyname.key
-    done
-    echo "};"
+  done
+  echo "};"
 }

 # keyfile_to_dskeys_section: helper function for keyfile_to_*_dskeys()
 # converts keyfile data into a DS-style trust anchor configuration
 # section using the supplied parameters
 keyfile_to_dskeys() {
-    section_name=$1
-    key_prefix=$2
-    shift
-    shift
-    echo "$section_name {"
-    for keyname in $*; do
-        $DSFROMKEY $keyname.key | \
-	awk '!/^; /{
+  section_name=$1
+  key_prefix=$2
+  shift
+  shift
+  echo "$section_name {"
+  for keyname in $*; do
+    $DSFROMKEY $keyname.key \
+      | awk '!/^; /{
 	    printf "\t\""$1"\" "
 	    printf "'"$key_prefix "'"
 	    printf $4 " " $5 " " $6 " \""
 	    for (i=7; i<=NF; i++) printf $i
 	    printf "\";\n"
 	}'
-    done
-    echo "};"
+  done
+  echo "};"
 }

 # keyfile_to_trusted_keys: convert key data contained in the keyfile(s)
 # provided to a "trust-keys" section suitable for including in a
 # resolver's configuration file
 keyfile_to_trusted_keys() {
-    keyfile_to_keys "trusted-keys" "" $*
+  keyfile_to_keys "trusted-keys" "" $*
 }

 # keyfile_to_static_keys: convert key data contained in the keyfile(s)
 # provided to a *static-key* "trust-anchors" section suitable for including in
 # a resolver's configuration file
 keyfile_to_static_keys() {
-    keyfile_to_keys "trust-anchors" "static-key" $*
+  keyfile_to_keys "trust-anchors" "static-key" $*
 }

 # keyfile_to_initial_keys: convert key data contained in the keyfile(s)
 # provided to an *initial-key* "trust-anchors" section suitable for including
 # in a resolver's configuration file
 keyfile_to_initial_keys() {
-    keyfile_to_keys "trust-anchors" "initial-key" $*
+  keyfile_to_keys "trust-anchors" "initial-key" $*
 }

 # keyfile_to_static_ds_keys: convert key data contained in the keyfile(s)
 # provided to a *static-ds* "trust-anchors" section suitable for including in a
 # resolver's configuration file
 keyfile_to_static_ds() {
-    keyfile_to_dskeys "trust-anchors" "static-ds" $*
+  keyfile_to_dskeys "trust-anchors" "static-ds" $*
 }

 # keyfile_to_initial_ds_keys: convert key data contained in the keyfile(s)
 # provided to an *initial-ds* "trust-anchors" section suitable for including
 # in a resolver's configuration file
 keyfile_to_initial_ds() {
-    keyfile_to_dskeys "trust-anchors" "initial-ds" $*
+  keyfile_to_dskeys "trust-anchors" "initial-ds" $*
 }

 # keyfile_to_key_id: convert a key file name to a key ID
@@ -295,7 +241,7 @@ keyfile_to_initial_ds() {
 # print the key ID with leading zeros stripped ("6160" for the
 # aforementioned example).
 keyfile_to_key_id() {
-	echo "$1" | sed "s/.*+0\{0,4\}//"
+  echo "$1" | sed "s/.*+0\{0,4\}//"
 }

 # private_type_record: write a private type record recording the state of the
@@ -305,13 +251,13 @@ keyfile_to_key_id() {
 # private type record with default type value of 65534, indicating that the
 # signing process for this key is completed.
 private_type_record() {
-        _zone=$1
-        _algorithm=$2
-        _keyfile=$3
+  _zone=$1
+  _algorithm=$2
+  _keyfile=$3

-        _id=$(keyfile_to_key_id "$_keyfile")
+  _id=$(keyfile_to_key_id "$_keyfile")

-        printf "%s. 0 IN TYPE65534 %s 5 %02x%04x0000\n" "$_zone" "\\#" "$_algorithm" "$_id"
+  printf "%s. 0 IN TYPE65534 %s 5 %02x%04x0000\n" "$_zone" "\\#" "$_algorithm" "$_id"
 }

 # nextpart*() - functions for reading files incrementally
@@ -362,51 +308,51 @@ private_type_record() {
 # nextpartreset: reset the marker used by nextpart() and nextpartpeek()
 # so that it points to the start of the given file
 nextpartreset() {
-    echo "0" > $1.prev
+  echo "0" >$1.prev
 }

 # nextpartread: read everything that's been appended to a file since the
 # last time nextpart() was called and print it to stdout, print the
 # total number of lines read from that file so far to file descriptor 3
 nextpartread() {
-    [ -f $1.prev ] || nextpartreset $1
-    prev=$(cat $1.prev)
-    awk "NR > $prev "'{ print }
+  [ -f $1.prev ] || nextpartreset $1
+  prev=$(cat $1.prev)
+  awk "NR > $prev "'{ print }
 	 END          { print NR > "/dev/stderr" }' $1 2>&3
 }

 # nextpart: read everything that's been appended to a file since the
 # last time nextpart() was called
 nextpart() {
-	nextpartread $1 3> $1.prev.tmp
-	mv $1.prev.tmp $1.prev
+  nextpartread $1 3>$1.prev.tmp
+  mv $1.prev.tmp $1.prev
 }

 # nextpartpeek: read everything that's been appended to a file since the
 # last time nextpart() was called
 nextpartpeek() {
-	nextpartread $1 3> /dev/null
+  nextpartread $1 3>/dev/null
 }

 # _search_log: look for message $1 in file $2 with nextpart().
 _search_log() (
-	msg="$1"
-	file="$2"
-	nextpart "$file" | grep -F -e "$msg" > /dev/null
+  msg="$1"
+  file="$2"
+  nextpart "$file" | grep -F -e "$msg" >/dev/null
 )

 # _search_log_re: same as _search_log but the message is an grep -E regex
 _search_log_re() (
-	msg="$1"
-	file="$2"
-	nextpart "$file" | grep -E -e "$msg" > /dev/null
+  msg="$1"
+  file="$2"
+  nextpart "$file" | grep -E -e "$msg" >/dev/null
 )

 # _search_log_peek: look for message $1 in file $2 with nextpartpeek().
 _search_log_peek() (
-	msg="$1"
-	file="$2"
-	nextpartpeek "$file" | grep -F -e "$msg" > /dev/null
+  msg="$1"
+  file="$2"
+  nextpartpeek "$file" | grep -F -e "$msg" >/dev/null
 )

 # wait_for_log: wait until message $2 in file $3 appears.  Bail out after
@@ -415,108 +361,108 @@ _search_log_peek() (
 # set correctly.  Tests using wait_for_log() are responsible for cleaning up
 # the created <file>.prev files.
 wait_for_log() (
-	timeout="$1"
-	msg="$2"
-	file="$3"
-	retry_quiet "$timeout" _search_log "$msg" "$file" && return 0
-	echo_i "exceeded time limit waiting for literal '$msg' in $file"
-        return 1
+  timeout="$1"
+  msg="$2"
+  file="$3"
+  retry_quiet "$timeout" _search_log "$msg" "$file" && return 0
+  echo_i "exceeded time limit waiting for literal '$msg' in $file"
+  return 1
 )

 # wait_for_log_re: same as wait_for_log, but the message is an grep -E regex
 wait_for_log_re() (
-	timeout="$1"
-	msg="$2"
-	file="$3"
-	retry_quiet "$timeout" _search_log_re "$msg" "$file" && return 0
-	echo_i "exceeded time limit waiting for regex '$msg' in $file"
-        return 1
+  timeout="$1"
+  msg="$2"
+  file="$3"
+  retry_quiet "$timeout" _search_log_re "$msg" "$file" && return 0
+  echo_i "exceeded time limit waiting for regex '$msg' in $file"
+  return 1
 )

 # wait_for_log_peek: similar to wait_for_log() but peeking, so the file offset
 # does not change.
 wait_for_log_peek() (
-	timeout="$1"
-	msg="$2"
-	file="$3"
-	retry_quiet "$timeout" _search_log_peek "$msg" "$file" && return 0
-	echo_i "exceeded time limit waiting for literal '$msg' in $file"
-        return 1
+  timeout="$1"
+  msg="$2"
+  file="$3"
+  retry_quiet "$timeout" _search_log_peek "$msg" "$file" && return 0
+  echo_i "exceeded time limit waiting for literal '$msg' in $file"
+  return 1
 )

 # _retry: keep running a command until it succeeds, up to $1 times, with
 # one-second intervals, optionally printing a message upon every attempt
 _retry() {
-	__retries="${1}"
-	shift
+  __retries="${1}"
+  shift

-	while :; do
-		if "$@"; then
-			return 0
-		fi
-		__retries=$((__retries-1))
-		if [ "${__retries}" -gt 0 ]; then
-			if [ "${__retry_quiet}" -ne 1 ]; then
-				echo_i "retrying"
-			fi
-			sleep 1
-		else
-			return 1
-		fi
-	done
+  while :; do
+    if "$@"; then
+      return 0
+    fi
+    __retries=$((__retries - 1))
+    if [ "${__retries}" -gt 0 ]; then
+      if [ "${__retry_quiet}" -ne 1 ]; then
+        echo_i "retrying"
+      fi
+      sleep 1
+    else
+      return 1
+    fi
+  done
 }

 # retry: call _retry() in verbose mode
 retry() {
-	__retry_quiet=0
-	_retry "$@"
+  __retry_quiet=0
+  _retry "$@"
 }

 # retry_quiet: call _retry() in silent mode
 retry_quiet() {
-	__retry_quiet=1
-	_retry "$@"
+  __retry_quiet=1
+  _retry "$@"
 }

 # _repeat: keep running command up to $1 times, unless it fails
 _repeat() (
-    __retries="${1}"
-    shift
-    while :; do
-	if ! "$@"; then
-	    return 1
-	fi
-	__retries=$((__retries-1))
-	if [ "${__retries}" -le 0 ]; then
-	    break
-	fi
-    done
-    return 0
+  __retries="${1}"
+  shift
+  while :; do
+    if ! "$@"; then
+      return 1
+    fi
+    __retries=$((__retries - 1))
+    if [ "${__retries}" -le 0 ]; then
+      break
+    fi
+  done
+  return 0
 )

 _times() {
-	awk "BEGIN{ for(i = 1; i <= $1; i++) print i}";
+  awk "BEGIN{ for(i = 1; i <= $1; i++) print i}"
 }

 rndc_reload() {
-    $RNDC -c ../_common/rndc.conf -s $2 -p ${CONTROLPORT} reload $3 2>&1 | sed 's/^/'"I:$1"' /'
-    # reloading single zone is synchronous, if we're reloading whole server
-    # we need to wait for reload to finish
-    if [ -z "$3" ]; then
-        for _ in $(_times 10); do
-            $RNDC -c ../_common/rndc.conf -s $2 -p ${CONTROLPORT} status | grep "reload/reconfig in progress" > /dev/null || break
-            sleep 1
-        done
-    fi
+  $RNDC -c ../_common/rndc.conf -s $2 -p ${CONTROLPORT} reload $3 2>&1 | sed 's/^/'"I:$1"' /'
+  # reloading single zone is synchronous, if we're reloading whole server
+  # we need to wait for reload to finish
+  if [ -z "$3" ]; then
+    for _ in $(_times 10); do
+      $RNDC -c ../_common/rndc.conf -s $2 -p ${CONTROLPORT} status | grep "reload/reconfig in progress" >/dev/null || break
+      sleep 1
+    done
+  fi
 }

 rndc_reconfig() {
-    seconds=${3:-10}
-    $RNDC -c ../_common/rndc.conf -s "$2" -p "${CONTROLPORT}" reconfig 2>&1 | sed 's/^/'"I:$1"' /'
-    for _ in $(_times "$seconds"); do
-        "$RNDC" -c ../_common/rndc.conf -s "$2" -p "${CONTROLPORT}" status | grep "reload/reconfig in progress" > /dev/null || break
-        sleep 1
-    done
+  seconds=${3:-10}
+  $RNDC -c ../_common/rndc.conf -s "$2" -p "${CONTROLPORT}" reconfig 2>&1 | sed 's/^/'"I:$1"' /'
+  for _ in $(_times "$seconds"); do
+    "$RNDC" -c ../_common/rndc.conf -s "$2" -p "${CONTROLPORT}" status | grep "reload/reconfig in progress" >/dev/null || break
+    sleep 1
+  done
 }

 # rndc_dumpdb: call "rndc dumpdb [...]" and wait until it completes
@@ -535,39 +481,38 @@ rndc_reconfig() {
 # code other than 0 or if the "; Dump complete" string does not appear in the
 # dump within 10 seconds.
 rndc_dumpdb() {
-	__ret=0
-	__dump_complete=0
-	__server="${1}"
-	__ip="10.53.0.$(echo "${__server}" | tr -c -d "0-9")"
+  __ret=0
+  __dump_complete=0
+  __server="${1}"
+  __ip="10.53.0.$(echo "${__server}" | tr -c -d "0-9")"

-	shift
-	${RNDC} -c ../_common/rndc.conf -p "${CONTROLPORT}" -s "${__ip}" dumpdb "$@" > "rndc.out.test${n}" 2>&1 || __ret=1
+  shift
+  ${RNDC} -c ../_common/rndc.conf -p "${CONTROLPORT}" -s "${__ip}" dumpdb "$@" >"rndc.out.test${n}" 2>&1 || __ret=1

-	for _ in 0 1 2 3 4 5 6 7 8 9
-	do
-		if grep '^; Dump complete$' "${__server}/named_dump.db" > /dev/null; then
-			mv "${__server}/named_dump.db" "${__server}/named_dump.db.test${n}"
-			__dump_complete=1
-			break
-		fi
-		sleep 1
-	done
+  for _ in 0 1 2 3 4 5 6 7 8 9; do
+    if grep '^; Dump complete$' "${__server}/named_dump.db" >/dev/null; then
+      mv "${__server}/named_dump.db" "${__server}/named_dump.db.test${n}"
+      __dump_complete=1
+      break
+    fi
+    sleep 1
+  done

-	if [ ${__dump_complete} -eq 0 ]; then
-		echo_i "timed out waiting for 'rndc dumpdb' to finish"
-		__ret=1
-	fi
+  if [ ${__dump_complete} -eq 0 ]; then
+    echo_i "timed out waiting for 'rndc dumpdb' to finish"
+    __ret=1
+  fi

-	return ${__ret}
+  return ${__ret}
 }

 # get_dig_xfer_stats: extract transfer statistics from dig output stored
 # in $1, converting them to a format used by some system tests.
 get_dig_xfer_stats() {
-	LOGFILE="$1"
-	sed -n "s/^;; XFR size: .*messages \([0-9][0-9]*\).*/messages=\1/p" "${LOGFILE}"
-	sed -n "s/^;; XFR size: \([0-9][0-9]*\) records.*/records=\1/p" "${LOGFILE}"
-	sed -n "s/^;; XFR size: .*bytes \([0-9][0-9]*\).*/bytes=\1/p" "${LOGFILE}"
+  LOGFILE="$1"
+  sed -n "s/^;; XFR size: .*messages \([0-9][0-9]*\).*/messages=\1/p" "${LOGFILE}"
+  sed -n "s/^;; XFR size: \([0-9][0-9]*\) records.*/records=\1/p" "${LOGFILE}"
+  sed -n "s/^;; XFR size: .*bytes \([0-9][0-9]*\).*/bytes=\1/p" "${LOGFILE}"
 }

 # get_named_xfer_stats: from named log file $1, extract transfer
@@ -575,16 +520,16 @@ get_dig_xfer_stats() {
 # message which has to contain the string provided in $4), converting
 # them to a format used by some system tests.
 get_named_xfer_stats() {
-	LOGFILE="$1"
-	PEER="$(echo $2 | sed 's/\./\\./g')"
-	ZONE="$(echo $3 | sed 's/\./\\./g')"
-	MESSAGE="$4"
-	grep " ${PEER}#.*${MESSAGE}:" "${LOGFILE}" | \
-		sed -n "s/.* '${ZONE}\/.* \([0-9][0-9]*\) messages.*/messages=\1/p" | tail -1
-	grep " ${PEER}#.*${MESSAGE}:" "${LOGFILE}" | \
-		sed -n "s/.* '${ZONE}\/.* \([0-9][0-9]*\) records.*/records=\1/p" | tail -1
-	grep " ${PEER}#.*${MESSAGE}:" "${LOGFILE}" | \
-		sed -n "s/.* '${ZONE}\/.* \([0-9][0-9]*\) bytes.*/bytes=\1/p" | tail -1
+  LOGFILE="$1"
+  PEER="$(echo $2 | sed 's/\./\\./g')"
+  ZONE="$(echo $3 | sed 's/\./\\./g')"
+  MESSAGE="$4"
+  grep " ${PEER}#.*${MESSAGE}:" "${LOGFILE}" \
+    | sed -n "s/.* '${ZONE}\/.* \([0-9][0-9]*\) messages.*/messages=\1/p" | tail -1
+  grep " ${PEER}#.*${MESSAGE}:" "${LOGFILE}" \
+    | sed -n "s/.* '${ZONE}\/.* \([0-9][0-9]*\) records.*/records=\1/p" | tail -1
+  grep " ${PEER}#.*${MESSAGE}:" "${LOGFILE}" \
+    | sed -n "s/.* '${ZONE}\/.* \([0-9][0-9]*\) bytes.*/bytes=\1/p" | tail -1
 }

 # copy_setports - Copy Configuration File and Replace Ports
@@ -598,57 +543,33 @@ get_named_xfer_stats() {
 #   copy_setports infile outfile
 #
 copy_setports() {
-    dir=$(echo "$TMPDIR" | sed 's/\//\\\//g')
+  dir=$(echo "$TMPDIR" | sed 's/\//\\\//g')

-    sed -e "s/@TMPDIR@/${dir}/g" \
-        -e "s/@PORT@/${PORT}/g" \
-        -e "s/@TLSPORT@/${TLSPORT}/g" \
-        -e "s/@HTTPPORT@/${HTTPPORT}/g" \
-        -e "s/@HTTPSPORT@/${HTTPSPORT}/g" \
-        -e "s/@EXTRAPORT1@/${EXTRAPORT1}/g" \
-        -e "s/@EXTRAPORT2@/${EXTRAPORT2}/g" \
-        -e "s/@EXTRAPORT3@/${EXTRAPORT3}/g" \
-        -e "s/@EXTRAPORT4@/${EXTRAPORT4}/g" \
-        -e "s/@EXTRAPORT5@/${EXTRAPORT5}/g" \
-        -e "s/@EXTRAPORT6@/${EXTRAPORT6}/g" \
-        -e "s/@EXTRAPORT7@/${EXTRAPORT7}/g" \
-        -e "s/@EXTRAPORT8@/${EXTRAPORT8}/g" \
-        -e "s/@CONTROLPORT@/${CONTROLPORT}/g" \
-        -e "s/@DEFAULT_ALGORITHM@/${DEFAULT_ALGORITHM}/g" \
-        -e "s/@DEFAULT_ALGORITHM_NUMBER@/${DEFAULT_ALGORITHM_NUMBER}/g" \
-        -e "s/@DEFAULT_BITS@/${DEFAULT_BITS}/g" \
-        -e "s/@ALTERNATIVE_ALGORITHM@/${ALTERNATIVE_ALGORITHM}/g" \
-        -e "s/@ALTERNATIVE_ALGORITHM_NUMBER@/${ALTERNATIVE_ALGORITHM_NUMBER}/g" \
-        -e "s/@ALTERNATIVE_BITS@/${ALTERNATIVE_BITS}/g" \
-        -e "s/@DEFAULT_HMAC@/${DEFAULT_HMAC}/g" \
-        -e "s/@DISABLED_ALGORITHM@/${DISABLED_ALGORITHM}/g" \
-        -e "s/@DISABLED_ALGORITHM_NUMBER@/${DISABLED_ALGORITHM_NUMBER}/g" \
-        -e "s/@DISABLED_BITS@/${DISABLED_BITS}/g" \
-        $1 > $2
-}
-
-# parse_openssl_config - Parse OpenSSL configuration for HSM settings
-#
-# Will set SOFTHSM2_MODULE, OPENSSL_ENGINE and ENGINE_ARG based on openssl configuration.
-parse_openssl_config() {
-    ENGINE_ARG=""
-    [ -f "$OPENSSL_CONF" ] || return 0
-    while IFS="=" read key val; do
-        # trim variables
-        key="${key## }"
-        key="${key%% }"
-        val="${val## }"
-        val="${val%% }"
-        case "$key" in
-        "engine_id")
-            OPENSSL_ENGINE="$val"
-            ENGINE_ARG="-E $OPENSSL_ENGINE"
-            ;;
-        "MODULE_PATH"|"pkcs11-module-path")
-            SOFTHSM2_MODULE="$val"
-            ;;
-        esac
-    done < "$OPENSSL_CONF"
+  sed -e "s/@TMPDIR@/${dir}/g" \
+    -e "s/@PORT@/${PORT}/g" \
+    -e "s/@TLSPORT@/${TLSPORT}/g" \
+    -e "s/@HTTPPORT@/${HTTPPORT}/g" \
+    -e "s/@HTTPSPORT@/${HTTPSPORT}/g" \
+    -e "s/@EXTRAPORT1@/${EXTRAPORT1}/g" \
+    -e "s/@EXTRAPORT2@/${EXTRAPORT2}/g" \
+    -e "s/@EXTRAPORT3@/${EXTRAPORT3}/g" \
+    -e "s/@EXTRAPORT4@/${EXTRAPORT4}/g" \
+    -e "s/@EXTRAPORT5@/${EXTRAPORT5}/g" \
+    -e "s/@EXTRAPORT6@/${EXTRAPORT6}/g" \
+    -e "s/@EXTRAPORT7@/${EXTRAPORT7}/g" \
+    -e "s/@EXTRAPORT8@/${EXTRAPORT8}/g" \
+    -e "s/@CONTROLPORT@/${CONTROLPORT}/g" \
+    -e "s/@DEFAULT_ALGORITHM@/${DEFAULT_ALGORITHM}/g" \
+    -e "s/@DEFAULT_ALGORITHM_NUMBER@/${DEFAULT_ALGORITHM_NUMBER}/g" \
+    -e "s/@DEFAULT_BITS@/${DEFAULT_BITS}/g" \
+    -e "s/@ALTERNATIVE_ALGORITHM@/${ALTERNATIVE_ALGORITHM}/g" \
+    -e "s/@ALTERNATIVE_ALGORITHM_NUMBER@/${ALTERNATIVE_ALGORITHM_NUMBER}/g" \
+    -e "s/@ALTERNATIVE_BITS@/${ALTERNATIVE_BITS}/g" \
+    -e "s/@DEFAULT_HMAC@/${DEFAULT_HMAC}/g" \
+    -e "s/@DISABLED_ALGORITHM@/${DISABLED_ALGORITHM}/g" \
+    -e "s/@DISABLED_ALGORITHM_NUMBER@/${DISABLED_ALGORITHM_NUMBER}/g" \
+    -e "s/@DISABLED_BITS@/${DISABLED_BITS}/g" \
+    $1 >$2
 }

 grep_v() { grep -v "$@" || test $? = 1; }
@@ -1,99 +0,0 @@
-#!/bin/sh
-#
-# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-#
-# SPDX-License-Identifier: MPL-2.0
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, you can obtain one at https://mozilla.org/MPL/2.0/.
-#
-# See the COPYRIGHT file distributed with this work for additional
-# information regarding copyright ownership.
-
-#
-# Common configuration data for system tests, to be sourced into
-# other shell scripts.
-#
-
-# Find the top of the BIND9 tree.
-export TOP_BUILDDIR=@abs_top_builddir@
-export TOP_SRCDIR=@abs_top_srcdir@
-
-# Provide TMPDIR variable for tests that need it.
-export TMPDIR=${TMPDIR:-/tmp}
-
-export ARPANAME=$TOP_BUILDDIR/bin/tools/arpaname
-export CDS=$TOP_BUILDDIR/bin/dnssec/dnssec-cds
-export CHECKCONF=$TOP_BUILDDIR/bin/check/named-checkconf
-export CHECKZONE=$TOP_BUILDDIR/bin/check/named-checkzone
-if [ -z "$TSAN_OPTIONS" ]; then # workaround for GL#4119
-  export DELV=$TOP_BUILDDIR/bin/delv/delv
-else
-  export DELV=:
-fi
-export DIG=$TOP_BUILDDIR/bin/dig/dig
-export DNSTAPREAD=$TOP_BUILDDIR/bin/tools/dnstap-read
-export DSFROMKEY=$TOP_BUILDDIR/bin/dnssec/dnssec-dsfromkey
-export FEATURETEST=$TOP_BUILDDIR/bin/tests/system/feature-test
-export FSTRM_CAPTURE=@FSTRM_CAPTURE@
-export HOST=$TOP_BUILDDIR/bin/dig/host
-export IMPORTKEY=$TOP_BUILDDIR/bin/dnssec/dnssec-importkey
-export JOURNALPRINT=$TOP_BUILDDIR/bin/tools/named-journalprint
-export KEYFRLAB=$TOP_BUILDDIR/bin/dnssec/dnssec-keyfromlabel
-export KEYGEN=$TOP_BUILDDIR/bin/dnssec/dnssec-keygen
-export MDIG=$TOP_BUILDDIR/bin/tools/mdig
-export NAMED=$TOP_BUILDDIR/bin/named/named
-export NSEC3HASH=$TOP_BUILDDIR/bin/tools/nsec3hash
-export NSLOOKUP=$TOP_BUILDDIR/bin/dig/nslookup
-export NSUPDATE=$TOP_BUILDDIR/bin/nsupdate/nsupdate
-export NZD2NZF=$TOP_BUILDDIR/bin/tools/named-nzd2nzf
-export REVOKE=$TOP_BUILDDIR/bin/dnssec/dnssec-revoke
-export RNDC=$TOP_BUILDDIR/bin/rndc/rndc
-export RNDCCONFGEN=$TOP_BUILDDIR/bin/confgen/rndc-confgen
-export RRCHECKER=$TOP_BUILDDIR/bin/tools/named-rrchecker
-export SETTIME=$TOP_BUILDDIR/bin/dnssec/dnssec-settime
-export SIGNER=$TOP_BUILDDIR/bin/dnssec/dnssec-signzone
-export TSIGKEYGEN=$TOP_BUILDDIR/bin/confgen/tsig-keygen
-export VERIFY=$TOP_BUILDDIR/bin/dnssec/dnssec-verify
-export WIRETEST=$TOP_BUILDDIR/bin/tests/wire_test
-
-export BIGKEY=$TOP_BUILDDIR/bin/tests/system/rsabigexponent/bigkey
-export GENCHECK=$TOP_BUILDDIR/bin/tests/system/rndc/gencheck
-export MAKEJOURNAL=$TOP_BUILDDIR/bin/tests/system/makejournal
-export PIPEQUERIES=$TOP_BUILDDIR/bin/tests/system/pipelined/pipequeries
-
-# we don't want a KRB5_CONFIG setting breaking the tests
-export KRB5_CONFIG=/dev/null
-# use local keytab instead of default /etc/krb5.keytab
-export KRB5_KTNAME=dns.keytab
-
-export ANS_LOG_LEVEL=debug
-
-#
-# Programs detected by configure
-# Variables will be empty if no program was found by configure
-#
-export SHELL=@SHELL@
-export CURL=@CURL@
-export NC=@NC@
-export XMLLINT=@XMLLINT@
-export XSLTPROC=@XSLTPROC@
-export PYTEST=@PYTEST@
-
-#
-# Interpreters for system tests detected by configure
-#
-export PERL=$(command -v "@PERL@" || true)
-if ! test -x "$PERL"; then
-  echo "Perl interpreter is required for system tests."
-  exit 77
-fi
-export PYTHON=$(command -v "@PYTHON@" || true)
-if ! test -x "$PYTHON"; then
-  echo "Python interpreter is required for system tests."
-  exit 77
-fi
-
-# Load common values
-. $TOP_SRCDIR/bin/tests/system/conf.sh.common
@@ -14,16 +14,20 @@ import os
 from pathlib import Path
 import re
 import shutil
+import socket
 import subprocess
 import tempfile
 import time
-from typing import Any, Dict, List, Optional
+from typing import Any, List, Optional

+import pyroute2  # TODO confitional
 import pytest

 pytest.register_assert_rewrite("isctest")

 import isctest
+from isctest.vars.dirs import SYSTEM_TEST_DIR_GIT_PATH
+from namespaces import Namespace


 # Silence warnings caused by passing a pytest fixture to another fixture.
@@ -32,6 +36,7 @@ import isctest

 isctest.log.init_conftest_logger()
 isctest.log.avoid_duplicated_logs()
+isctest.vars.init_vars()

 # ----------------- Older pytest / xdist compatibility -------------------
 # As of 2023-01-11, the minimal supported pytest / xdist versions are
@@ -52,9 +57,6 @@ else:
 XDIST_WORKER = os.environ.get("PYTEST_XDIST_WORKER", "")
 FILE_DIR = os.path.abspath(Path(__file__).parent)
 ENV_RE = re.compile(b"([^=]+)=(.*)")
-PORT_MIN = 5001
-PORT_MAX = 32767
-PORTS_PER_TEST = 20
 PRIORITY_TESTS = [
    # Tests that are scheduled first. Speeds up parallel execution.
    "rpz/",
@@ -64,48 +66,13 @@ PRIORITY_TESTS = [
    "upforwd/",
 ]
 PRIORITY_TESTS_RE = re.compile("|".join(PRIORITY_TESTS))
-SYSTEM_TEST_DIR_GIT_PATH = "bin/tests/system"
 SYSTEM_TEST_NAME_RE = re.compile(f"{SYSTEM_TEST_DIR_GIT_PATH}" + r"/([^/]+)")
 SYMLINK_REPLACEMENT_RE = re.compile(r"/tests(_.*)\.py")

-# ---------------------- Module initialization ---------------------------
+# ----------------------- Global requirements ----------------------------

-
-def parse_env(env_bytes):
-    """Parse the POSIX env format into Python dictionary."""
-    out = {}
-    for line in env_bytes.splitlines():
-        match = ENV_RE.match(line)
-        if match:
-            # EL8+ workaround for https://access.redhat.com/solutions/6994985
-            # FUTURE: can be removed when we no longer need to parse env vars
-            if match.groups()[0] in [b"which_declare", b"BASH_FUNC_which%%"]:
-                continue
-            out[match.groups()[0]] = match.groups()[1]
-    return out
-
-
-def get_env_bytes(cmd):
-    try:
-        proc = subprocess.run(
-            [cmd],
-            shell=True,
-            check=True,
-            cwd=FILE_DIR,
-            stdout=subprocess.PIPE,
-        )
-    except subprocess.CalledProcessError as exc:
-        isctest.log.error("failed to get shell env: %s", exc)
-        raise exc
-    env_bytes = proc.stdout
-    return parse_env(env_bytes)
-
-
-# Read common environment variables for running tests from conf.sh.
-# FUTURE: Remove conf.sh entirely and define all variables in pytest only.
-CONF_ENV = get_env_bytes(". ./conf.sh && env")
-os.environb.update(CONF_ENV)
-isctest.log.debug("variables in env: %s", ", ".join([str(key) for key in CONF_ENV]))
+isctest.check.is_executable(isctest.vars.ALL["PYTHON"], "Python interpreter required")
+isctest.check.is_executable(isctest.vars.ALL["PERL"], "Perl interpreter required")

 # --------------------------- pytest hooks -------------------------------

@@ -123,6 +90,7 @@ def pytest_configure(config):
    # Ensure this hook only runs on the main pytest instance if xdist is
    # used to spawn other workers.
    if not XDIST_WORKER:
+        Namespace("user").__enter__()
        if config.pluginmanager.has_plugin("xdist") and config.option.numprocesses:
            # system tests depend on module scope for setup & teardown
            # enforce use "loadscope" scheduler or disable paralelism
@@ -236,8 +204,10 @@ def module_base_ports(modules):
    exactly what happens - every worker thread will call this fixture to
    determine test ports.
    """
-    port_min = PORT_MIN
-    port_max = PORT_MAX - len(modules) * PORTS_PER_TEST
+    port_min = isctest.vars.ports.PORT_MIN
+    port_max = (
+        isctest.vars.ports.PORT_MAX - len(modules) * isctest.vars.ports.PORTS_PER_TEST
+    )
    if port_max < port_min:
        raise RuntimeError("not enough ports to assign unique port set to each module")

@@ -249,65 +219,38 @@ def module_base_ports(modules):
    # be misleading.
    base_port = int(time.time() // 3600) % (port_max - port_min) + port_min

-    return {mod: base_port + i * PORTS_PER_TEST for i, mod in enumerate(modules)}
+    return {
+        mod: base_port + i * isctest.vars.ports.PORTS_PER_TEST
+        for i, mod in enumerate(modules)
+    }


-@pytest.fixture(scope="module")
+@pytest.fixture(autouse=True, scope="module")
 def base_port(request, module_base_ports):
    """Start of the port range assigned to a particular test module."""
    port = module_base_ports[request.fspath]
+    isctest.vars.ports.set_base_port(port)
    return port


@pytest.fixture(scope="module")
-def ports(base_port):
-    """Dictionary containing port names and their assigned values."""
-    return {
-        "PORT": base_port,
-        "TLSPORT": base_port + 1,
-        "HTTPPORT": base_port + 2,
-        "HTTPSPORT": base_port + 3,
-        "EXTRAPORT1": base_port + 4,
-        "EXTRAPORT2": base_port + 5,
-        "EXTRAPORT3": base_port + 6,
-        "EXTRAPORT4": base_port + 7,
-        "EXTRAPORT5": base_port + 8,
-        "EXTRAPORT6": base_port + 9,
-        "EXTRAPORT7": base_port + 10,
-        "EXTRAPORT8": base_port + 11,
-        "CONTROLPORT": base_port + 12,
-    }
+def named_port():
+    return int(os.environ["PORT"])


@pytest.fixture(scope="module")
-def named_port(ports):
-    return ports["PORT"]
+def named_tlsport():
+    return int(os.environ["TLSPORT"])


@pytest.fixture(scope="module")
-def named_tlsport(ports):
-    return ports["TLSPORT"]
+def named_httpsport():
+    return int(os.environ["HTTPSPORT"])


@pytest.fixture(scope="module")
-def named_httpsport(ports):
-    return ports["HTTPSPORT"]
-
-
-@pytest.fixture(scope="module")
-def control_port(ports):
-    return ports["CONTROLPORT"]
-
-
-@pytest.fixture(scope="module")
-def env(ports):
-    """Dictionary containing environment variables for the test."""
-    env = os.environ.copy()
-    for portname, portnum in ports.items():
-        env[portname] = str(portnum)
-    env["builddir"] = f"{env['TOP_BUILDDIR']}/{SYSTEM_TEST_DIR_GIT_PATH}"
-    env["srcdir"] = f"{env['TOP_SRCDIR']}/{SYSTEM_TEST_DIR_GIT_PATH}"
-    return env
+def control_port():
+    return int(os.environ["CONTROLPORT"])


@pytest.fixture(scope="module")
@@ -348,7 +291,7 @@ def logger(request, system_test_name):

@pytest.fixture(scope="module")
 def system_test_dir(
-    request, env, system_test_name
+    request, system_test_name
 ):  # pylint: disable=too-many-statements,too-many-locals
    """
    Temporary directory for executing the test.
@@ -398,12 +341,13 @@ def system_test_dir(
            pass

    # Create a temporary directory with a copy of the original system test dir contents
-    system_test_root = Path(f"{env['TOP_BUILDDIR']}/{SYSTEM_TEST_DIR_GIT_PATH}")
+    system_test_root = Path(os.environ["builddir"])
    testdir = Path(
        tempfile.mkdtemp(prefix=f"{system_test_name}_tmp_", dir=system_test_root)
    )
    shutil.rmtree(testdir)
    shutil.copytree(system_test_root / system_test_name, testdir)
+    isctest.vars.dirs.set_system_test_name(testdir.name)

    # Create a convenience symlink with a stable and predictable name
    module_name = SYMLINK_REPLACEMENT_RE.sub(r"\1", request.node.name)
@@ -458,7 +402,6 @@ def system_test_dir(


 def _run_script(  # pylint: disable=too-many-arguments
-    env,
    system_test_dir: Path,
    interpreter: str,
    script: str,
@@ -482,7 +425,6 @@ def _run_script(  # pylint: disable=too-many-arguments
    cmd = [interpreter, script] + args
    with subprocess.Popen(
        cmd,
-        env=env,
        stdout=subprocess.PIPE,
        stderr=subprocess.STDOUT,
        bufsize=1,
@@ -500,15 +442,15 @@ def _run_script(  # pylint: disable=too-many-arguments


@pytest.fixture(scope="module")
-def shell(env, system_test_dir):
+def shell(system_test_dir):
    """Function to call a shell script with arguments."""
-    return partial(_run_script, env, system_test_dir, env["SHELL"])
+    return partial(_run_script, system_test_dir, os.environ["SHELL"])


@pytest.fixture(scope="module")
-def perl(env, system_test_dir):
+def perl(system_test_dir):
    """Function to call a perl script with arguments."""
-    return partial(_run_script, env, system_test_dir, env["PERL"])
+    return partial(_run_script, system_test_dir, os.environ["PERL"])


@pytest.fixture(scope="module")
@@ -521,13 +463,24 @@ def run_tests_sh(system_test_dir, shell):
    return run_tests


+@pytest.fixture(scope="module")
+def namespace(shell):
+    with Namespace("net"):
+        shell("ifconfig.sh", ["up"])
+        with pyroute2.IPRoute() as ipr:
+            lo = ipr.link_lookup(ifname="lo")[0]
+            ipr.route("add", gateway="127.0.0.1", oif=lo)
+            ipr.route("add", family=socket.AF_INET6, gateway="::1", oif=lo)
+        yield
+
+
@pytest.fixture(scope="module", autouse=True)
 def system_test(  # pylint: disable=too-many-arguments,too-many-statements
    request,
-    env: Dict[str, str],
    system_test_dir,
    shell,
    perl,
+    namespace,
 ):
    """
    Driver of the test setup/teardown process. Used automatically for every test module.
@@ -553,7 +506,7 @@ def system_test(  # pylint: disable=too-many-arguments,too-many-statements

    def check_net_interfaces():
        try:
-            perl("testsock.pl", ["-p", env["PORT"]])
+            perl("testsock.pl", ["-p", os.environ["PORT"]])
        except subprocess.CalledProcessError as exc:
            isctest.log.error("testsock.pl: exited with code %d", exc.returncode)
            pytest.skip("Network interface aliases not set up.")
@@ -577,7 +530,7 @@ def system_test(  # pylint: disable=too-many-arguments,too-many-statements

    def start_servers():
        try:
-            perl("start.pl", ["--port", env["PORT"], system_test_dir.name])
+            perl("start.pl", ["--port", os.environ["PORT"], system_test_dir.name])
        except subprocess.CalledProcessError as exc:
            isctest.log.error("Failed to start servers")
            pytest.fail(f"start.pl exited with {exc.returncode}")
@@ -597,10 +550,11 @@ def system_test(  # pylint: disable=too-many-arguments,too-many-statements
            isctest.log.error("Found core dumps or sanitizer reports")
            pytest.fail(f"get_core_dumps.sh exited with {exc.returncode}")

-    os.environ.update(env)  # Ensure pytests have the same env vars as shell tests.
    isctest.log.info(f"test started: {request.node.name}")
-    port = int(env["PORT"])
-    isctest.log.info("using port range: <%d, %d>", port, port + PORTS_PER_TEST - 1)
+    port = int(os.environ["PORT"])
+    isctest.log.info(
+        "using port range: <%d, %d>", port, port + isctest.vars.ports.PORTS_PER_TEST - 1
+    )

    if not hasattr(request.node, "stash"):  # compatibility with pytest<7.0.0
        request.node.stash = {}  # use regular dict instead of pytest.Stash
@@ -628,17 +582,13 @@ def system_test(  # pylint: disable=too-many-arguments,too-many-statements


@pytest.fixture
-def servers(ports, system_test_dir):
+def servers(system_test_dir):
    instances = {}
    for entry in system_test_dir.rglob("*"):
        if entry.is_dir():
            try:
                dir_name = entry.name
-                # LATER: Make ports fixture return NamedPorts directly
-                named_ports = isctest.instance.NamedPorts(
-                    dns=int(ports["PORT"]), rndc=int(ports["CONTROLPORT"])
-                )
-                instance = isctest.instance.NamedInstance(dir_name, named_ports)
+                instance = isctest.instance.NamedInstance(dir_name)
                instances[dir_name] = instance
            except ValueError:
                continue
@@ -6,7 +6,7 @@ scriptversion=2021-09-20.08 # UTC

 # Copyright (C) 2011-2020 Free Software Foundation, Inc.
 #
-# SPDX-License-Identifier: GPL-2.0-or-later WITH LicenseRef-Automake-exception-2.0
+# SPDX-License-Identifier: GPL-2.0-or-later WITH Autoconf-exception-generic
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License as published by
@@ -21,6 +21,7 @@ options {
 	pid-file "named.pid";
 	listen-on { 10.53.0.1; };
 	listen-on-v6 { none; };
+	allow-transfer { any; };
 	heartbeat-interval 1;
 	recursion no;
 	dnssec-validation no;
@@ -21,6 +21,7 @@ options {
 	pid-file "named.pid";
 	listen-on { 10.53.0.2; };
 	listen-on-v6 { none; };
+	allow-transfer { any; };
 	heartbeat-interval 1;
 	recursion no;
 	dnssec-validation no;
@@ -21,6 +21,7 @@ options {
 	pid-file "named.pid";
 	listen-on { 10.53.0.2; };
 	listen-on-v6 { none; };
+	allow-transfer { any; };
 	recursion no;
 	notify yes;
 	dnssec-validation yes;
@@ -60,10 +61,10 @@ dnssec-policy "not-enough-hours-in-day" {
 		zsk key-directory lifetime unlimited algorithm @DEFAULT_ALGORITHM@;
 	};

-	/* validity 500 days, resign in 449 days */
+	/* validity 500 days, with one 1 day jitter (resign in 499 days) */
+	signatures-jitter 1d;
 	signatures-validity-dnskey 500d;
 	signatures-validity 500d;
-	signatures-refresh 449d;
 };

 zone "." {
@@ -21,6 +21,7 @@ options {
 	pid-file "named.pid";
 	listen-on { 10.53.0.3; };
 	listen-on-v6 { none; };
+	allow-transfer { any; };
 	recursion no;
 	notify yes;
 	dnssec-validation yes;
@@ -30,7 +30,6 @@ g			A	10.0.0.7
 z			A	10.0.0.26
 a.a.a.a.a.a.a.a.a.a.e	A	10.0.0.27
 x			CNAME	a
-zz			DNSKEY	258 3 5 Cg==

 private			NS	ns.private
 ns.private		A	10.53.0.2
@@ -39,11 +39,6 @@ key auth {

 include "trusted.conf";

-zone "." {
-	type hint;
-	file "../../_common/root.hint";
-};
-
 view rec {
 	match-recursive-only yes;
 	recursion yes;
@@ -51,6 +46,11 @@ view rec {
 	dnssec-accept-expired yes;
 	minimal-responses no;

+	zone "." {
+		type hint;
+		file "../../_common/root.hint";
+	};
+
 	zone secure.example {
 		type static-stub;
 		server-addresses { 10.53.0.4; };
@@ -66,6 +66,11 @@ view auth {
 	recursion no;
 	allow-recursion { none; };

+	zone "." {
+		type hint;
+		file "../../_common/root.hint";
+	};
+
 	zone secure.example {
 		type secondary;
 		primaries { 10.53.0.3; };
@@ -3734,9 +3734,6 @@ n=$((n + 1))
 test "$ret" -eq 0 || echo_i "failed"
 status=$((status + ret))

-echo_i "status: $status"
-exit $status
-
 echo_i "checking initialization with a revoked managed key ($n)"
 ret=0
 copy_setports ns5/named2.conf.in ns5/named.conf
@@ -3908,9 +3905,9 @@ ret=0
 dig_with_opts any x.insecure.example. @10.53.0.3 >dig.out.ns3.1.test$n || ret=1
 grep "status: NOERROR" dig.out.ns3.1.test$n >/dev/null || ret=1
 grep "ANSWER: 0," dig.out.ns3.1.test$n >/dev/null || ret=1
-dig_with_opts any zz.secure.example. @10.53.0.3 >dig.out.ns3.2.test$n || ret=1
+dig_with_opts any z.secure.example. @10.53.0.3 >dig.out.ns3.2.test$n || ret=1
 grep "status: NOERROR" dig.out.ns3.2.test$n >/dev/null || ret=1
-# DNSKEY+RRSIG, NSEC+RRSIG
+# A+RRSIG, NSEC+RRSIG
 grep "ANSWER: 4," dig.out.ns3.2.test$n >/dev/null || ret=1
 n=$((n + 1))
 test "$ret" -eq 0 || echo_i "failed"
@@ -4083,6 +4080,10 @@ ZSK_ID=$(cat ns2/${zone}.zsk.id)
 SECTIONS="+answer +noauthority +noadditional"
 echo_i "testing zone $zone KSK=$KSK_ID ZSK=$ZSK_ID"

+# Set key state for KSK. The ZSK rollovers below assume that there is a chain
+# of trust established, so we tell named that the DS is in omnipresent state.
+$SETTIME -s -d OMNIPRESENT now -K ns2 $KSK >/dev/null
+
 # Print IDs of keys used for generating RRSIG records for RRsets of type $1
 # found in dig output file $2.
 get_keys_which_signed() {
@@ -4118,7 +4119,7 @@ test "$ret" -eq 0 || echo_i "failed"
 status=$((status + ret))

 # Roll the ZSK.
-zsk2=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -K ns2 -n zone "$zone")
+zsk2=$("$KEYGEN" -q -P none -A none -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -K ns2 -n zone "$zone")
 keyfile_to_key_id "$zsk2" >ns2/$zone.zsk.id2
 ZSK_ID2=$(cat ns2/$zone.zsk.id2)
 ret=0
@@ -4128,16 +4129,43 @@ n=$((n + 1))
 test "$ret" -eq 0 || echo_i "failed"
 status=$((status + ret))

+zsk_count_equals() {
+  expectedzsks=$1
+  dig_with_opts @10.53.0.2 DNSKEY $zone >dig.out.test$n
+  lines=$(cat dig.out.test$n | grep "DNSKEY.*256 3 13" | wc -l)
+  test "$lines" -eq $expectedzsks || return 1
+}
+echo_i "check DNSKEY RRset has successor ZSK $ZSK_ID2 ($n)"
+ret=0
+# The expected number of ZSKs is 2.
+retry_quiet 5 zsk_count_equals 2 || ret=1
+n=$((n + 1))
+test "$ret" -eq 0 || echo_i "failed"
+status=$((status + ret))
+
 # Make new ZSK active.
 echo_i "make ZSK $ZSK_ID inactive and make new ZSK $ZSK_ID2 active for zone $zone ($n)"
 ret=0
-$SETTIME -I now -K ns2 $ZSK >/dev/null
+$SETTIME -s -I now -K ns2 $ZSK >/dev/null
 $SETTIME -s -k OMNIPRESENT now -A now -K ns2 $zsk2 >/dev/null
 dnssec_loadkeys_on 2 $zone || ret=1
 n=$((n + 1))
 test "$ret" -eq 0 || echo_i "failed"
 status=$((status + ret))

+# Wait for newest ZSK to become active.
+echo_i "wait until new ZSK $ZSK_ID2 active and ZSK $ZSK_ID inactive"
+for i in 1 2 3 4 5 6 7 8 9 10; do
+  ret=0
+  grep "DNSKEY $zone/$DEFAULT_ALGORITHM/$ZSK_ID2 (ZSK) is now active" ns2/named.run >/dev/null || ret=1
+  grep "DNSKEY $zone/$DEFAULT_ALGORITHM/$ZSK_ID (ZSK) is now inactive" ns2/named.run >/dev/null || ret=1
+  [ "$ret" -eq 0 ] && break
+  sleep 1
+done
+n=$((n + 1))
+test "$ret" -eq 0 || echo_i "failed"
+status=$((status + ret))
+
 # Remove the KSK from disk.
 echo_i "remove the KSK $KSK_ID for zone $zone from disk"
 mv ns2/$KSK.key ns2/$KSK.key.bak
@@ -4187,15 +4215,14 @@ mv ns2/$KSK.key.bak ns2/$KSK.key
 mv ns2/$KSK.private.bak ns2/$KSK.private

 # Roll the ZSK again.
-zsk3=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -K ns2 -n zone "$zone")
+echo_i "delete old ZSK $ZSK_ID, schedule ZSK $ZSK_ID2 inactive, and new ZSK $ZSK_ID3 active for zone $zone ($n)"
+zsk3=$("$KEYGEN" -q -P none -A none -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -K ns2 -n zone "$zone")
+ret=0
 keyfile_to_key_id "$zsk3" >ns2/$zone.zsk.id3
 ZSK_ID3=$(cat ns2/$zone.zsk.id3)
-
-# Schedule the new ZSK (ZSK3) to become active.
-echo_i "delete old ZSK $ZSK_ID schedule ZSK $ZSK_ID2 inactive and new ZSK $ZSK_ID3 active for zone $zone ($n)"
-$SETTIME -s -k UNRETENTIVE -z HIDDEN -D now -K ns2 $ZSK >/dev/null
-$SETTIME -I +3600 -K ns2 $zsk2 >/dev/null
-$SETTIME -A +3600 -K ns2 $zsk3 >/dev/null
+$SETTIME -s -k HIDDEN now -z HIDDEN now -D now -K ns2 $ZSK >/dev/null
+$SETTIME -s -k OMNIPRESENT now -z OMNIPRESENT now -K ns2 $zsk2 >/dev/null
+dnssec_loadkeys_on 2 $zone || ret=1
 rndccmd 10.53.0.2 dnssec -rollover -key $ZSK_ID2 $zone 2>&1 | sed 's/^/ns2 /' | cat_i
 n=$((n + 1))
 test "$ret" -eq 0 || echo_i "failed"
@@ -4246,11 +4273,16 @@ for qtype in "SOA" "TXT"; do
  status=$((status + ret))
 done

+# Put back the KSK.
+echo_i "put back the KSK $KSK_ID for zone $zone from disk"
+mv ns2/$KSK.key.bak ns2/$KSK.key
+mv ns2/$KSK.private.bak ns2/$KSK.private
+
 # Make the new ZSK (ZSK3) active.
 echo_i "make new ZSK $ZSK_ID3 active for zone $zone ($n)"
-$SETTIME -I now -K ns2 $zsk2 >/dev/null
+ret=0
+$SETTIME -s -I now -K ns2 $zsk2 >/dev/null
 $SETTIME -s -k OMNIPRESENT now -A now -K ns2 $zsk3 >/dev/null
-
 dnssec_loadkeys_on 2 $zone || ret=1
 n=$((n + 1))
 test "$ret" -eq 0 || echo_i "failed"
@@ -4269,6 +4301,11 @@ n=$((n + 1))
 test "$ret" -eq 0 || echo_i "failed"
 status=$((status + ret))

+# Remove the KSK from disk.
+echo_i "remove the KSK $KSK_ID for zone $zone from disk"
+mv ns2/$KSK.key ns2/$KSK.key.bak
+mv ns2/$KSK.private ns2/$KSK.private.bak
+
 # Update the zone that requires a resign of the SOA RRset.
 echo_i "update the zone with $zone IN TXT nsupdate added me one more time"
 (
@@ -4323,7 +4360,7 @@ status=$((status + ret))

 echo_i "checking signatures-validity second field hours vs days ($n)"
 ret=0
-# zone configured with 'signatures-validity 500 499;'
+# zone configured with 'signatures-validity 500d; signatures-refresh 1d'
 # 499 days in the future w/ a 20 minute runtime to now allowance
 min=$(TZ=UTC $PERL -e '@lt=localtime(time() + 499*3600*24 - 20*60); printf "%.4d%0.2d%0.2d%0.2d%0.2d%0.2d\n",$lt[5]+1900,$lt[4]+1,$lt[3],$lt[2],$lt[1],$lt[0];')
 dig_with_opts @10.53.0.2 hours-vs-days AXFR >dig.out.ns2.test$n
@@ -4359,7 +4396,7 @@ dig_with_opts @10.53.0.4 does-not-exist.too-many-iterations >dig.out.ns4.test$n
 digcomp dig.out.ns2.test$n dig.out.ns4.test$n || ret=1
 grep "flags: qr rd ra;" dig.out.ns4.test$n >/dev/null || ret=1
 grep "status: NXDOMAIN" dig.out.ns4.test$n >/dev/null || ret=1
-grep "ANSWER: 0, AUTHORITY: 6" dig.out.ns4.test$n >/dev/null || ret=1
+grep "ANSWER: 0, AUTHORITY: 8" dig.out.ns4.test$n >/dev/null || ret=1
 n=$((n + 1))
 test "$ret" -eq 0 || echo_i "failed"
 status=$((status + ret))
@@ -12,9 +12,9 @@
 # information regarding copyright ownership.

 import shutil
-import subprocess

 import pytest
+import isctest


@pytest.fixture
@@ -25,11 +25,8 @@ def gnutls_cli_executable():
        pytest.skip("gnutls-cli not found in PATH")

    # Ensure gnutls-cli supports the --logfile command-line option.
-    output = subprocess.run(
-        [executable, "--logfile=/dev/null"],
-        stdout=subprocess.PIPE,
-        stderr=subprocess.STDOUT,
-        check=False,
+    output = isctest.run.cmd(
+        [executable, "--logfile=/dev/null"], log_stderr=False, raise_on_exception=False
    ).stdout
    if b"illegal option" in output:
        pytest.skip("gnutls-cli does not support the --logfile option")
@@ -1,5 +1,6 @@
 example.		86400	IN	SOA	ns2.example. hostmaster.example. 1397051952 5 5 1814400 3600
 example.		3600	IN	NS	ns2.example.
+example.		3600	IN	DNSKEY	512 255 1 AQMFD5raczCJHViKtLYhWGz8hMY9UGRuniJDBzC7w0aRyzWZriO6i2od GWWQVucZqKVsENW91IOW4vqudngPZsY3GvQ/xVA8/7pyFj6b7Esga60z yGW6LFe9r8n6paHrlG5ojqf0BaqHT+8=
 a01.example.		3600	IN	A	0.0.0.0
 a02.example.		3600	IN	A	255.255.255.255
 a601.example.		3600	IN	A6	0 ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff
@@ -2541,7 +2542,6 @@ dlv.example.		3600	IN	DLV	30795 1 1 310D27F4D82C1FC2400704EA9939FE6E1CEAA3B9
 dname01.example.	3600	IN	DNAME	dname-target.
 dname02.example.	3600	IN	DNAME	dname-target.example.
 dname03.example.	3600	IN	DNAME	.
-dnskey01.example.	3600	IN	DNSKEY	512 255 1 AQMFD5raczCJHViKtLYhWGz8hMY9UGRuniJDBzC7w0aRyzWZriO6i2od GWWQVucZqKVsENW91IOW4vqudngPZsY3GvQ/xVA8/7pyFj6b7Esga60z yGW6LFe9r8n6paHrlG5ojqf0BaqHT+8=
 doa01.example.		3600	IN	DOA	1234567890 1234567890 1 "image/gif" R0lGODlhKAAZAOMCAGZmZgBmmf///zOZzMz//5nM/zNmmWbM/5nMzMzMzACZ/////////////////////yH5BAEKAA8ALAAAAAAoABkAAATH8IFJK5U2a4337F5ogRkpnoCJrly7PrCKyh8c3HgAhzT35MDbbtO7/IJIHbGiOiaTxVTpSVWWLqNq1UVyapNS1wd3OAxug0LhnCubcVhsxysQnOt4ATpvvzHlFzl1AwODhWeFAgRpen5/UhheAYMFdUB4SFcpGEGGdQeCAqBBLTuSk30EeXd9pEsAbKGxjHqDSE0Sp6ixN4N1BJmbc7lIhmsBich1awPAjkY1SZR8bJWrz382SGqIBQQFQd4IsUTaX+ceuudPEQA7
 doa02.example.		3600	IN	DOA	0 1 2 "" aHR0cHM6Ly93d3cuaXNjLm9yZy8=
 ds01.example.		3600	IN	NS	ns42.example.
@@ -1,5 +1,6 @@
 example8.		86400	IN	SOA	ns2.example8. hostmaster.example8. 1397051952 5 5 1814400 3600
 example8.		3600	IN	NS	ns2.example8.
+example8.		3600	IN	DNSKEY	512 255 1 AQMFD5raczCJHViKtLYhWGz8hMY9UGRuniJDBzC7w0aRyzWZriO6i2od GWWQVucZqKVsENW91IOW4vqudngPZsY3GvQ/xVA8/7pyFj6b7Esga60z yGW6LFe9r8n6paHrlG5ojqf0BaqHT+8=
 a01.example8.		3600	IN	A	0.0.0.0
 a02.example8.		3600	IN	A	255.255.255.255
 a601.example8.		3600	IN	A6	0 ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff
@@ -2541,7 +2542,6 @@ dlv.example8.		3600	IN	DLV	30795 1 1 310D27F4D82C1FC2400704EA9939FE6E1CEAA3B9
 dname01.example8.	3600	IN	DNAME	dname-target.
 dname02.example8.	3600	IN	DNAME	dname-target.example8.
 dname03.example8.	3600	IN	DNAME	.
-dnskey01.example8.	3600	IN	DNSKEY	512 255 1 AQMFD5raczCJHViKtLYhWGz8hMY9UGRuniJDBzC7w0aRyzWZriO6i2od GWWQVucZqKVsENW91IOW4vqudngPZsY3GvQ/xVA8/7pyFj6b7Esga60z yGW6LFe9r8n6paHrlG5ojqf0BaqHT+8=
 doa01.example8.		3600	IN	DOA	1234567890 1234567890 1 "image/gif" R0lGODlhKAAZAOMCAGZmZgBmmf///zOZzMz//5nM/zNmmWbM/5nMzMzMzACZ/////////////////////yH5BAEKAA8ALAAAAAAoABkAAATH8IFJK5U2a4337F5ogRkpnoCJrly7PrCKyh8c3HgAhzT35MDbbtO7/IJIHbGiOiaTxVTpSVWWLqNq1UVyapNS1wd3OAxug0LhnCubcVhsxysQnOt4ATpvvzHlFzl1AwODhWeFAgRpen5/UhheAYMFdUB4SFcpGEGGdQeCAqBBLTuSk30EeXd9pEsAbKGxjHqDSE0Sp6ixN4N1BJmbc7lIhmsBich1awPAjkY1SZR8bJWrz382SGqIBQQFQd4IsUTaX+ceuudPEQA7
 doa02.example8.		3600	IN	DOA	0 1 2 "" aHR0cHM6Ly93d3cuaXNjLm9yZy8=
 ds01.example8.		3600	IN	DS	12892 5 2 26584835CA80C81C91999F31CFAF2A0E89D4FF1C8FAFD0DDB31A85C7 19277C13
@@ -15,6 +15,7 @@ import os
 import pathlib
 import subprocess

+import isctest
 import pytest


@@ -46,12 +47,12 @@ def run_sslyze_in_a_loop(executable, port, log_file_prefix):
            # Run sslyze, logging stdout+stderr.  Ignore the exit code since
            # sslyze is only used for triggering crashes here rather than
            # actual TLS analysis.
-            subprocess.run(
+            isctest.run.cmd(
                sslyze_args,
                stdout=sslyze_log,
                stderr=subprocess.STDOUT,
                timeout=30,
-                check=False,
+                raise_on_exception=False,
            )
            # Ensure ns1 is still alive after each sslyze run.
            assert is_pid_alive(pid), f"ns1 (PID: {pid}) exited prematurely"
@@ -363,14 +363,13 @@ setsigningtime(dns_db_t *db, dns_rdataset_t *rdataset, isc_stdtime_t resign) {
 }

 static isc_result_t
-getsigningtime(dns_db_t *db, dns_rdataset_t *rdataset,
-	       dns_name_t *name DNS__DB_FLARG) {
+getsigningtime(dns_db_t *db, isc_stdtime_t *resign, dns_name_t *name,
+	       dns_typepair_t *type) {
 	sampledb_t *sampledb = (sampledb_t *)db;

 	REQUIRE(VALID_SAMPLEDB(sampledb));

-	return (dns__db_getsigningtime(sampledb->rbtdb, rdataset,
-				       name DNS__DB_FLARG_PASS));
+	return (dns_db_getsigningtime(sampledb->rbtdb, resign, name, type));
 }

 static dns_stats_t *
@@ -23,7 +23,6 @@
  exit 255
 }

-parse_openssl_config
 [ -f "$SOFTHSM2_MODULE" ] || {
  echo_i "skip: softhsm2 module not available"
  exit 1
@@ -20,7 +20,6 @@ $SHELL clean.sh

 OPENSSL_CONF= softhsm2-util --init-token --free --pin 1234 --so-pin 1234 --label "softhsm2-enginepkcs11" | awk '/^The token has been initialized and is reassigned to slot/ { print $NF }'

-parse_openssl_config
 printf '%s' "${HSMPIN:-1234}" >ns1/pin
 PWD=$(pwd)

@@ -16,7 +16,6 @@ set -e
 # shellcheck source=conf.sh
 . ../conf.sh

-parse_openssl_config
 PWD=$(pwd)

 status=0
@@ -0,0 +1,7 @@
+# bad NSEC3 owner (:) not in base32hex valid characters
+# header: id=0008 opcode=query questions=1 authority=1
+00 08 00 00 00 01 00 00 00 01 00 00
+# question: ./A/IN
+00 00 01 00 01
+# :./NSEC3/IN/1 length=7 hashtype=240 flags=0 interations=0 salt=- hashlen=1 hash=ff
+01 58 00 00 32 00 01 00 00 00 01 00 07 f0 00 00 00 00 01 ff
@@ -0,0 +1,21 @@
+# oversized owner name
+# header: additional=1
+00 00 00 00 00 00 00 00 00 00 00 01
+# owner name too big (256 octets) A/IN/1 0.0.0.0
+0f 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41
+0f 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41
+0f 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41
+0f 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41
+0f 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41
+0f 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41
+0f 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41
+0f 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41
+0f 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41
+0f 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41
+0f 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41
+0f 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41
+0f 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41
+0f 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41
+0f 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41
+0e 41 41 41 41 41 41 41 41 41 41 41 41 41 41 00
+00 01 00 01 00 00 00 01 00 04 00 00 00 00
@@ -11,10 +11,26 @@
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.

+rm -f badnsec3owner.out
+rm -f badrecordname.out
+rm -f dupans.out
+rm -f dupquestion.out
+rm -f keyclass.out
+rm -f malformeddeltype.out
+rm -f malformedrrsig.out
 rm -f nametoolong.out
-rm -f twoquestions.out
 rm -f noquestions.out
-rm -f ns*/named.conf
-rm -f ns*/named.run
-rm -f ns*/named.memstats
+rm -f optwrongname.out
 rm -f ns*/managed-keys.bind*
+rm -f ns*/named.conf
+rm -f ns*/named.memstats
+rm -f ns*/named.run
+rm -f qtypeasanswer.out
+rm -f questionclass.out
+rm -f shortquestion.out
+rm -f shortrecord.out
+rm -f tsignotlast.out
+rm -f tsigwrongclass.out
+rm -f twoquestionnames.out
+rm -f twoquestiontypes.out
+rm -f wrongclass.out
@@ -0,0 +1,8 @@
+# multiple singletons (SOA)
+# header questions=1 answers=2
+00 00 00 00 00 01 00 02 00 00 00 00
+# question SOA/IN
+00 00 06 00 01
+# 2 SOA records that differ in expire
+00 00 06 00 01 00 00 00 01 00 16 00 00 00 00 00 01 00 00 00 02 00 00 00 03 00 00 00 04 00 00 00 05
+00 00 06 00 01 00 00 00 01 00 16 00 00 00 00 00 01 00 00 00 02 00 00 00 03 00 00 00 04 00 00 00 06
@@ -0,0 +1,10 @@
+# header: 2 questions
+00 00 00 00 00 02 00 00 00 00 00 00
+# question: AAAAAAAAAAAAAA./A/IN
+0e 41 41 41 41 41 41 41 41 41 41 41 41 41 41 00
+00 01
+00 01
+# question: AAAAAAAAAAAAAA./A/IN
+0e 41 41 41 41 41 41 41 41 41 41 41 41 41 41 00
+00 01
+00 01
@@ -0,0 +1,7 @@
+# mismatched key class
+# header: questions=1 additional=1
+00 00 00 00 00 01 00 00 00 00 00 01
+# question: ./A/IN
+00 00 01 00 01
+# additional: ./KEY/CLASS2 flags=0 protocol=0 algorithm=248 keydata=00
+00 00 19 00 02 00 00 00 01 00 05 00 00 00 f8 00
@@ -0,0 +1,5 @@
+# UPDATE malformed 'delete type' update change (non empty data)
+# header: UPDATE authority=1
+00 00 28 00 00 00 00 00 00 01 00 00
+# ./A/ANY TTL=0 length=1 data=00
+00 00 01 00 ff 00 00 00 00 00 01 00
@@ -0,0 +1,5 @@
+# malformed RRRSIG
+# header: QUERY, additional=1
+00 00 00 00 00 00 00 00 00 00 00 01
+# ./RRSIG/IN TTL=1 covers=0 algorithm=240 labels=0 ttl=1 expire=2 signed=3 id=0
+00 00 2e 00 01 00 00 00 01 00 14 00 00 f0 00 00 00 00 01 00 00 00 02 00 00 00 03 00 00 00 00
@@ -0,0 +1,5 @@
+# OPT record with wrong name (not .)
+# header: QUERY, additional=1
+00 00 00 00 00 00 00 00 00 00 00 01
+# OPT record (owner A.)
+01 41 00 00 29 00 01 00 00 00 00 00 00
@@ -0,0 +1,5 @@
+# QTYPE-only type as answer
+# header, answers=1
+00 00 00 00 00 00 00 01 00 00 00 00
+# ./MAILB/IN
+00 00 fd 00 01 00 00 00 01 00 00
@@ -0,0 +1,7 @@
+# two questions of different classes
+# header: QUERY, questions=2
+00 00 00 00 00 02 00 00 00 00 00 00
+# ./A/IN
+00 00 01 00 01
+# ./A/CLASS2
+00 00 01 00 02
@@ -0,0 +1,5 @@
+# truncated question section
+# header: QUERY, questions=1
+00 00 00 00 00 01 00 00 00 00 00 00
+# truncated question (no class)
+00 00 01
@@ -0,0 +1,5 @@
+# truncated record
+# header: QUERY, additional=1
+00 09 00 00 00 00 00 00 00 00 00 01
+# truncated A record (no ttl, length or data)
+00 00 01 00 01
@@ -25,14 +25,46 @@ if [ "${ans}" != "got: 000080010000000000000000" ]; then
  status=$((status + 1))
 fi

-echo_i "two questions"
-$PERL formerr.pl -a 10.53.0.1 -p ${PORT} twoquestions >twoquestions.out
-ans=$(grep got: twoquestions.out)
+echo_i "two question names"
+$PERL formerr.pl -a 10.53.0.1 -p ${PORT} twoquestionnames >twoquestionnames.out
+ans=$(grep got: twoquestionnames.out)
 if [ "${ans}" != "got: 000080010000000000000000" ]; then
  echo_i "failed"
  status=$((status + 1))
 fi

+echo_i "two question types"
+$PERL formerr.pl -a 10.53.0.1 -p ${PORT} twoquestiontypes >twoquestiontypes.out
+ans=$(grep got: twoquestiontypes.out)
+if [ "${ans}" != "got: 0000800100020000000000000e41414141414141414141414141410000010001c00c00020001" ]; then
+  echo_i "failed"
+  status=$((status + 1))
+fi
+
+echo_i "duplicate questions"
+$PERL formerr.pl -a 10.53.0.1 -p ${PORT} dupquestion >dupquestion.out
+ans=$(grep got: dupquestion.out)
+if [ "${ans}" != "got: 000080010000000000000000" ]; then
+  echo_i "failed"
+  status=$(expr $status + 1)
+fi
+
+echo_i "duplicate answer"
+$PERL formerr.pl -a 10.53.0.1 -p ${PORT} dupans >dupans.out
+ans=$(grep got: dupans.out)
+if [ "${ans}" != "got: 0000800100010000000000000000060001" ]; then
+  echo_i "failed"
+  status=$(expr $status + 1)
+fi
+
+echo_i "question only type in answer"
+$PERL formerr.pl -a 10.53.0.1 -p ${PORT} qtypeasanswer >qtypeasanswer.out
+ans=$(grep got: qtypeasanswer.out)
+if [ "${ans}" != "got: 000080010000000000000000" ]; then
+  echo_i "failed"
+  status=$(expr $status + 1)
+fi
+
 # this would be NOERROR if it included a COOKIE option,
 # but is a FORMERR without one.
 echo_i "empty question section (and no COOKIE option)"
@@ -43,6 +75,103 @@ if [ "${ans}" != "got: 000080010000000000000000" ]; then
  status=$((status + 1))
 fi

+echo_i "bad nsec3 owner"
+$PERL formerr.pl -a 10.53.0.1 -p ${PORT} badnsec3owner >badnsec3owner.out
+ans=$(grep got: badnsec3owner.out)
+# SERVFAIL (2) rather than FORMERR (1)
+if [ "${ans}" != "got: 0008800200010000000000000000010001" ]; then
+  echo_i "failed"
+  status=$(expr $status + 1)
+fi
+
+echo_i "short record before rdata "
+$PERL formerr.pl -a 10.53.0.1 -p ${PORT} shortrecord >shortrecord.out
+ans=$(grep got: shortrecord.out)
+if [ "${ans}" != "got: 000980010000000000000000" ]; then
+  echo_i "failed"
+  status=$(expr $status + 1)
+fi
+
+echo_i "short question"
+$PERL formerr.pl -a 10.53.0.1 -p ${PORT} shortquestion >shortquestion.out
+ans=$(grep got: shortquestion.out)
+if [ "${ans}" != "got: 000080010000000000000000" ]; then
+  echo_i "failed"
+  status=$(expr $status + 1)
+fi
+
+echo_i "mismatch classes in question section"
+$PERL formerr.pl -a 10.53.0.1 -p ${PORT} questionclass >questionclass.out
+ans=$(grep got: questionclass.out)
+if [ "${ans}" != "got: 000080010000000000000000" ]; then
+  echo_i "failed"
+  status=$(expr $status + 1)
+fi
+
+echo_i "bad record owner name"
+$PERL formerr.pl -a 10.53.0.1 -p ${PORT} badrecordname >badrecordname.out
+ans=$(grep got: badrecordname.out)
+if [ "${ans}" != "got: 000080010000000000000000" ]; then
+  echo_i "failed"
+  status=$(expr $status + 1)
+fi
+
+echo_i "mismatched class in record"
+$PERL formerr.pl -a 10.53.0.1 -p ${PORT} wrongclass >wrongclass.out
+ans=$(grep got: wrongclass.out)
+if [ "${ans}" != "got: 000080010000000000000000" ]; then
+  echo_i "failed"
+  status=$(expr $status + 1)
+fi
+
+echo_i "mismatched KEY class"
+$PERL formerr.pl -a 10.53.0.1 -p ${PORT} keyclass >keyclass.out
+ans=$(grep got: keyclass.out)
+if [ "${ans}" != "got: 0000800100010000000000000000010001" ]; then
+  echo_i "failed"
+  status=$(expr $status + 1)
+fi
+
+echo_i "OPT wrong owner name"
+$PERL formerr.pl -a 10.53.0.1 -p ${PORT} optwrongname >optwrongname.out
+ans=$(grep got: optwrongname.out)
+if [ "${ans}" != "got: 000080010000000000000000" ]; then
+  echo_i "failed"
+  status=$(expr $status + 1)
+fi
+
+echo_i "RRSIG invalid covers"
+$PERL formerr.pl -a 10.53.0.1 -p ${PORT} malformedrrsig >malformedrrsig.out
+ans=$(grep got: malformedrrsig.out)
+if [ "${ans}" != "got: 000080010000000000000000" ]; then
+  echo_i "failed"
+  status=$(expr $status + 1)
+fi
+
+echo_i "UPDATE malformed delete type"
+$PERL formerr.pl -a 10.53.0.1 -p ${PORT} malformeddeltype >malformeddeltype.out
+ans=$(grep got: malformeddeltype.out)
+if [ "${ans}" != "got: 0000a8010000000000000000" ]; then
+  echo_i "failed"
+  status=$(expr $status + 1)
+fi
+
+echo_i "TSIG wrong class"
+$PERL formerr.pl -a 10.53.0.1 -p ${PORT} tsigwrongclass >tsigwrongclass.out
+ans=$(grep got: tsigwrongclass.out)
+if [ "${ans}" != "got: 000080010000000000000000" ]; then
+  echo_i "failed"
+  status=$(expr $status + 1)
+fi
+
+echo_i "TSIG not last"
+$PERL formerr.pl -a 10.53.0.1 -p ${PORT} tsignotlast >tsignotlast.out
+ans=$(grep got: tsignotlast.out)
+if [ "${ans}" != "got: 000080010000000000000000" ]; then
+  echo_i "failed"
+  status=$(expr $status + 1)
+fi
+
 echo_i "exit status: $status"

 [ $status -eq 0 ] || exit 1
@@ -0,0 +1,8 @@
+# SIG not last in additional
+# header: QUERY additional=2
+00 00 00 00 00 00 00 00 00 00 00 02
+# Additional records:
+# SIG record (class ANY)
+00 00 fa 00 ff 00 00 00 01 00 12 00 01 02 03 04 05 06 01 02 00 01 00 00 00 00 00 00 00
+# A record
+00 00 01 00 01 00 00 00 01 00 04 00 00 00 00
@@ -0,0 +1,5 @@
+# TSIG wrong class
+# header: QUERY, additional=1
+00 00 00 00 00 00 00 00 00 00 00 01
+# class should be ANY (00 ff) not IN (00 01)
+00 00 fa 00 01 00 00 00 01 00 12 00 01 02 03 04 05 06 01 02 00 01 00 00 00 00 00 00 00
@@ -0,0 +1,11 @@
+# two questions with different names
+00 00 00 00 00 02 00 00 00 00 00 00
+# AAAAAAAAAAAAAA./A/IN
+0e 41 41 41 41 41 41 41 41 41 41 41 41 41 41 00
+00 01
+00 01
+# AAAAAAAAAAAAAB./A/IN
+0e 41 41 41 41 41 41 41 41 41 41 41 41 41 41 00
+0e 41 41 41 41 41 41 41 41 41 41 41 41 41 42 00
+00 01
+00 01
@@ -1,7 +1,10 @@
+# two questions that differ by type
 00 00 00 00 00 02 00 00 00 00 00 00
+# AAAAAAAAAAAAAAA./A/IN
 0e 41 41 41 41 41 41 41 41 41 41 41 41 41 41 00
 00 01
+00 01
+# AAAAAAAAAAAAAAA./NS/IN
+0e 41 41 41 41 41 41 41 41 41 41 41 41 41 41 00
 00 02
-0e 41 41 41 41 41 41 41 41 41 41 41 41 41 41 00
-00 01
 00 01
@@ -0,0 +1,7 @@
+# class mismatch
+# header: QUERY, additional=2
+00 00 00 00 00 00 00 00 00 00 00 02
+# ./A/IN
+00 00 01 00 01 00 00 00 01 00 04 00 00 00 00
+# ./TYPE65280/CLASS256
+00 ff 00 01 00 02 00 00 01 00 04 00 00 00 00
@@ -277,7 +277,7 @@ nsec03			NSEC	. TYPE1
 nsec04			NSEC	. TYPE127

 ; type 48
-dnskey01		DNSKEY	512 ( 255 1 AQMFD5raczCJHViKtLYhWGz8hMY
+@			DNSKEY	512 ( 255 1 AQMFD5raczCJHViKtLYhWGz8hMY
 				9UGRuniJDBzC7w0aRyzWZriO6i2odGWWQVucZqKV
 				sENW91IOW4vqudngPZsY3GvQ/xVA8/7pyFj6b7Esg
 				a60zyGW6LFe9r8n6paHrlG5ojqf0BaqHT+8= )
@@ -15,7 +15,6 @@
 # Clean up after allow query tests.
 #

-rm -f dig.out.*
 rm -f ns*/named.conf
 rm -f */named.memstats
 rm -f ns*/named.run ns*/named.run.prev
@@ -17,7 +17,7 @@ options {
 	listen-on { 10.53.0.2; };
 	listen-on-v6 { none; };
 	recursion no;
-        notify no;
+	notify no;
 	dnssec-validation no;
 };

@@ -1,67 +0,0 @@
-#!/bin/sh
-
-# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-#
-# SPDX-License-Identifier: MPL-2.0
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0.  If a copy of the MPL was not distributed with this
-# file, you can obtain one at https://mozilla.org/MPL/2.0/.
-#
-# See the COPYRIGHT file distributed with this work for additional
-# information regarding copyright ownership.
-
-# Test of include statement with glob expression.
-
-set -e
-
-. ../conf.sh
-
-DIGOPTS="+tcp +nosea +nostat +nocmd +norec +noques +noadd +nostats -p ${PORT}"
-
-status=0
-n=0
-
-# Test 1 - check if zone1 was loaded.
-n=$((n + 1))
-echo_i "checking glob include of zone1 config ($n)"
-ret=0
-$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 zone1.com. a >dig.out.ns2.$n || ret=1
-grep 'status: NOERROR' dig.out.ns2.$n >/dev/null || ret=1
-grep '^zone1.com.' dig.out.ns2.$n >/dev/null || ret=1
-if [ $ret != 0 ]; then echo_i "failed"; fi
-status=$((status + ret))
-
-# Test 2 - check if zone2 was loaded.
-n=$((n + 1))
-echo_i "checking glob include of zone2 config ($n)"
-ret=0
-$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 zone2.com. a >dig.out.ns2.$n || ret=1
-grep 'status: NOERROR' dig.out.ns2.$n >/dev/null || ret=1
-grep '^zone2.com.' dig.out.ns2.$n >/dev/null || ret=1
-if [ $ret != 0 ]; then echo_i "failed"; fi
-status=$((status + ret))
-
-# Test 3 - check if standard file path (no magic chars) works.
-n=$((n + 1))
-echo_i "checking include of standard file path config ($n)"
-ret=0
-$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 mars.com. a >dig.out.ns2.$n || ret=1
-grep 'status: NOERROR' dig.out.ns2.$n >/dev/null || ret=1
-grep '^mars.com.' dig.out.ns2.$n >/dev/null || ret=1
-if [ $ret != 0 ]; then echo_i "failed"; fi
-status=$((status + ret))
-
-# Test 4: named-checkconf correctly parses glob includes.
-n=$((n + 1))
-echo_i "checking named-checkconf with glob include ($n)"
-ret=0
-(
-  cd ns2
-  $CHECKCONF named.conf
-) || ret=1
-if [ $ret != 0 ]; then echo_i "failed"; fi
-status=$((status + ret))
-
-echo_i "exit status: $status"
-[ $status -eq 0 ] || exit 1
@@ -0,0 +1,39 @@
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+import os
+
+import isctest
+import pytest
+
+import dns.message
+
+
+@pytest.mark.parametrize(
+    "qname",
+    [
+        "zone1.com.",  # glob include of zone1 config
+        "zone2.com.",  # glob include of zone2 config
+        "mars.com.",  # checking include of standard file path config
+    ],
+)
+def test_include_multiplecfg(qname):
+    msg = dns.message.make_query(qname, "A")
+    res = isctest.query.tcp(msg, "10.53.0.2")
+
+    isctest.check.noerror(res)
+
+    assert res.answer[0] == dns.rrset.from_text(qname, 86400, "IN", "A", "10.53.0.1")
+
+
+def test_include_multiplecfg_checkconf():
+    """Test that named-checkconf correctly parses glob includes"""
+    isctest.run.cmd([os.environ["CHECKCONF"], "named.conf"], cwd="ns2")
@@ -23,6 +23,7 @@ options {
 	pid-file "named.pid";
 	listen-on { 10.53.0.1; };
 	listen-on-v6 { none; };
+	allow-transfer { any; };
 	recursion no;
 	notify yes;
 	dnssec-validation yes;
@@ -27,6 +27,7 @@ options {
 	pid-file "named.pid";
 	listen-on { 10.53.0.2; };
 	listen-on-v6 { none; };
+	allow-transfer { any; };
 	recursion no;
 	notify yes;
 	notify-delay 0;
@@ -28,6 +28,7 @@ options {
 	listen-on { 10.53.0.3; };
 	listen-on-v6 { none; };
 	recursion no;
+	allow-transfer { any; };
 	notify yes;
 	try-tcp-refresh no;
 	notify-delay 0;
@@ -21,6 +21,7 @@ options {
 	pid-file "named.pid";
 	listen-on { 10.53.0.4; };
 	listen-on-v6 { none; };
+	allow-transfer { any; };
 	recursion no;
 	notify yes;
 	notify-delay 0;
--- a/Show More
+++ b/Show More