Update BIND version to 9.18.1

Prepare documentation for BIND 9.18.1

See merge request isc-private/bind9!392

.clang-format

@@ -34,10 +34,6 @@ PointerAlignment: Right
 PointerBindsToType: false
 IncludeBlocks: Regroup
 IncludeCategories:
-  - Regex:           '^<(urcu\.h|urcu/urcu-|urcu-)'
-    Priority:        2
-  - Regex:           '^<urcu/'
-    Priority:        3
   - Regex:           '^<isc/'
     Priority:        5
   - Regex:           '^<(pk11|pkcs11)/'
@@ -54,18 +50,18 @@ IncludeCategories:
     Priority:        35
   - Regex:           '^<irs/'
     Priority:        40
+  - Regex:           '^<bind9/'
+    Priority:        45
   - Regex:           '^<(dig|named|rndc|confgen|dlz)/'
     Priority:        50
   - Regex:           '^<dlz_'
     Priority:        55
   - Regex:           '^".*"'
     Priority:        99
-  - Regex:           '^<tests/'
-    Priority:        100
   - Regex:           '<openssl/'
-    Priority:        4
+    Priority:        1
   - Regex:           '<(mysql|protobuf-c)/'
-    Priority:        4
+    Priority:        1
   - Regex:           '.*'
     Priority:        0
 IndentExternBlock: NoIndent
@@ -78,4 +74,3 @@ PenaltyBreakString: 80
 PenaltyExcessCharacter: 100
 Standard: Cpp11
 ContinuationIndentWidth: 8
-ForEachMacros: [ 'cds_lfs_for_each', 'cds_lfs_for_each_safe', 'cds_list_for_each_entry_safe', 'ISC_LIST_FOREACH', 'ISC_LIST_FOREACH_SAFE', 'ISC_LIST_FOREACH_REV', 'ISC_LIST_FOREACH_REV_SAFE' ]

.clang-format.headers

@@ -34,40 +34,24 @@ PointerAlignment: Right
 PointerBindsToType: false
 IncludeBlocks: Regroup
 IncludeCategories:
-  - Regex:           '^<(urcu/urcu-|urcu-)'
-    Priority:        2
-  - Regex:           '^<urcu/'
-    Priority:        3
   - Regex:           '^<isc/'
-    Priority:        5
-  - Regex:           '^<(pk11|pkcs11)/'
-    Priority:        10
+    Priority:        2
   - Regex:           '^<dns/'
-    Priority:        15
-  - Regex:           '^<dst/'
-    Priority:        20
-  - Regex:           '^<isccc/'
-    Priority:        25
+    Priority:        3
+  - Regex:           '^<iscccc/'
+    Priority:        4
   - Regex:           '^<isccfg/'
-    Priority:        30
+    Priority:        5
   - Regex:           '^<ns/'
-    Priority:        35
-  - Regex:           '^<irs/'
-    Priority:        40
-  - Regex:           '^<(dig|named|rndc|confgen|dlz)/'
-    Priority:        50
-  - Regex:           '^<dlz_'
-    Priority:        55
-  - Regex:           '^".*"'
-    Priority:        99
-  - Regex:           '^<tests/'
-    Priority:        100
-  - Regex:           '<openssl/'
-    Priority:        4
-  - Regex:           '<(mysql|protobuf-c)/'
-    Priority:        4
-  - Regex:           '.*'
-    Priority:        0
+    Priority:        6
+  - Regex:           '^<bind9/)'
+    Priority:        7
+  - Regex:           '^(<[^/]*)/)'
+    Priority:        8
+  - Regex:           '<[[:alnum:].]+>'
+    Priority:        1
+  - Regex:           '".*"'
+    Priority:        9
 IndentExternBlock: NoIndent
 KeepEmptyLinesAtTheStartOfBlocks: false
 MaxEmptyLinesToKeep: 1

.dir-locals.el

@@ -49,10 +49,6 @@
 	       (expand-file-name
 		(concat directory-of-current-dir-locals-file "lib/bind9/include"))
 
-	       ;; libtest
-	       (expand-file-name
-		(concat directory-of-current-dir-locals-file "tests/include"))
-
 	       ;; bin
 	       (expand-file-name
 		(concat directory-of-current-dir-locals-file "bin/check"))
@@ -61,7 +57,7 @@
 	       (expand-file-name
 		(concat directory-of-current-dir-locals-file "bin/confgen"))
 	       (expand-file-name
-		(concat directory-of-current-dir-locals-file "bin/confgen/include"))
+		(concat directory-of-current-dir-locals-file "bin/confgen/include"))	       
 	       (expand-file-name
 		(concat directory-of-current-dir-locals-file "bin/dig/include"))
 	       (expand-file-name
@@ -79,7 +75,7 @@
 
 	       (expand-file-name "/usr/include/libxml2")
 	       (expand-file-name "/usr/include/json-c")
-
+	       
 	       (expand-file-name "/usr/local/opt/openssl@1.1/include")
 	       (expand-file-name "/usr/local/opt/libxml2/include/libxml2")
 	       (expand-file-name "/usr/local/opt/json-c/include/json-c/")

.editorconfig

@@ -1,5 +0,0 @@
-[*.sh{,.in}]
-indent_style = space
-indent_size = 2
-binary_next_line   = true
-switch_case_indent = true

.github/workflows/codeql.yml

@@ -1,55 +0,0 @@
-name: "CodeQL"
-
-on:
-  push:
-    branches: [ "bind-9.16", "bind-9.18", "main" ]
-  schedule:
-    - cron: '39 8 * * 3'
-
-jobs:
-  analyze:
-    name: Analyze
-    runs-on: ubuntu-latest
-    permissions:
-      actions: read
-      contents: read
-      security-events: write
-
-    strategy:
-      fail-fast: false
-      matrix:
-        language: [ 'cpp' ]
-
-    steps:
-    - name: Checkout repository
-      uses: actions/checkout@v3
-
-    - name: Install build dependencies
-      uses: awalsh128/cache-apt-pkgs-action@latest
-      with:
-        packages: liburcu-dev libuv1-dev libssl-dev libnghttp2-dev libxml2-dev liblmdb-dev libjson-c-dev pkg-config autoconf automake autotools-dev libtool-bin libjemalloc-dev libedit-dev libcap-dev libidn2-dev libkrb5-dev libmaxminddb-dev zlib1g-dev python3-ply
-        version: 1.0
-
-    # Initializes the CodeQL tools for scanning.
-    - name: Initialize CodeQL
-      uses: github/codeql-action/init@v2
-      with:
-        languages: ${{ matrix.language }}
-
-    - name: Autobuild
-      uses: github/codeql-action/autobuild@v2
-
-    # ℹ️ Command-line programs to run using the OS shell.
-    # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
-
-    #   If the Autobuild fails above, remove it and uncomment the following three lines.
-    #   modify them (or add more) to build your code if your project, please refer to the EXAMPLE below for guidance.
-
-    # - run: |
-    #   echo "Run, Build Application using script"
-    #   ./location_of_script_within_repo/buildscript.sh
-
-    - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v2
-      with:
-        category: "/language:${{matrix.language}}"

.github/workflows/sonarcloud.yml

@@ -1,50 +0,0 @@
-name: SonarCloud
-
-on:
-  push:
-    branches: [ "bind-9.16", "bind-9.18", "main" ]
-  schedule:
-    - cron: '39 8 * * 3'
-
-jobs:
-  build:
-    name: Build and analyze
-    runs-on: ubuntu-latest
-    permissions:
-      actions: read
-      contents: read
-      security-events: write
-
-    strategy:
-      fail-fast: false
-      matrix:
-        language: [ 'cpp' ]
-
-    env:
-      BUILD_WRAPPER_OUT_DIR: build_wrapper_output_directory
-
-    steps:
-    - name: Checkout repository
-      uses: actions/checkout@v3
-
-    - name: Install build dependencies
-      uses: awalsh128/cache-apt-pkgs-action@latest
-      with:
-        packages: liburcu-dev libuv1-dev libssl-dev libnghttp2-dev libxml2-dev liblmdb-dev libjson-c-dev pkg-config autoconf automake autotools-dev libtool-bin libjemalloc-dev libedit-dev libcap-dev libidn2-dev libkrb5-dev libmaxminddb-dev zlib1g-dev python3-ply
-        version: 1.0
-
-    - name: Install sonar-scanner and build-wrapper
-      uses: SonarSource/sonarcloud-github-c-cpp@v1
-
-    - name: Run build-wrapper
-      run: |
-        autoreconf -fi
-        ./configure
-        build-wrapper-linux-x86-64 --out-dir ${{ env.BUILD_WRAPPER_OUT_DIR }} make clean all
-
-    - name: Run sonar-scanner
-      env:
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
-      run: |
-        sonar-scanner --define sonar.cfamily.build-wrapper-output="${{ env.BUILD_WRAPPER_OUT_DIR }}"

.gitignore

@@ -5,7 +5,6 @@
 *.la
 *.lo
 *.log
-*.log.txt
 *.o
 *.orig
 *.plist/ # ccc-analyzer store its results in .plist directories
@@ -55,7 +54,6 @@ __pycache__/
 /test-driver
 Makefile
 Makefile.in
-Makefile.user
 ans.run
 gen.dSYM/
 named.memstats
@@ -90,7 +88,6 @@ doc/man/pkcs11-list.8in
 doc/man/pkcs11-tokens.8in
 # clangd index directory
 /\.cache/
-/\.*_clangd/
 # GNU Global index files
 /GPATH
 /GRTAGS

.gitlab/issue_templates/Bug.md

@@ -1,63 +1,46 @@
 <!--
 If the bug you are reporting is potentially security-related - for example,
 if it involves an assertion failure or other crash in `named` that can be
-triggered repeatedly - then please make sure that you make the new issue
-confidential by clicking the checkbox at the bottom!
+triggered repeatedly - then please do *NOT* report it here, but send an
+email to [security-officer@isc.org](security-officer@isc.org).
 -->
 
 ### Summary
 
-<!-- Concisely summarize the bug encountered. -->
+(Summarize the bug encountered concisely.)
 
-### BIND version affected
-<!--
-Make sure you are testing with the **latest** supported version of BIND
-for a given branch. Many bugs have been fixed over time!
+### BIND version used
 
-See https://kb.isc.org/docs/supported-platforms for the current list.
-The latest source is available from https://www.isc.org/download/#BIND
-
-Paste the output of `named -V` here.
--->
+(Paste the output of `named -V`.)
 
 ### Steps to reproduce
 
-<!--
-This is extremely important! Be precise and use itemized lists, please.
-
-Even if a default configuration is affected, please include the full configuration
-files _you were testing with_.
-
-Example:
-1. Use _attached_ configuration file
-2. Start BIND server with command: `named -g -c named.conf ...`
-3. Simulate legitimate clients using command `dnsperf -S1 -d legit-queries ...`
-4. Simulate attack traffic using command `dnsperf -S1 -d attack-queries ...`
--->
-
-1.
-2.
-3.
+(How one can reproduce the issue - this is very important.)
 
 ### What is the current *bug* behavior?
 
-<!-- What actually happens. -->
+(What actually happens.)
 
 ### What is the expected *correct* behavior?
 
-<!-- What you should see instead. -->
+(What you should see instead.)
 
 ### Relevant configuration files
 
-<!-- Paste any relevant configuration files here - please use code blocks (```)
+(Paste any relevant configuration files - please use code blocks (```)
 to format console output. If submitting the contents of your
-configuration file in a non-confidential issue, it is advisable to
-obscure key secrets; this can be done automatically by using
-`named-checkconf -px`. -->
+configuration file in a non-confidential Issue, it is advisable to
+obscure key secrets: this can be done automatically by using
+`named-checkconf -px`.)
 
-### Relevant logs
+### Relevant logs and/or screenshots
 
-<!-- Paste any relevant logs here - please use code blocks (```) to format console
-output, logs, and code, as it's very hard to read otherwise. -->
+(Paste any relevant logs - please use code blocks (```) to format console
+output, logs, and code, as it's very hard to read otherwise.)
 
-/label ~Bug
+### Possible fixes
+
+(If you can, link to the line of code that might be responsible for the
+problem.)
+
+/label ~bug

.gitlab/issue_templates/CVE.md

@@ -0,0 +1,37 @@
+<!--
+THIS ISSUE TEMPLATE IS INTENDED ONLY FOR INTERNAL USE.
+
+If the bug you are reporting is potentially security-related - for example,
+if it involves an assertion failure or other crash in `named` that can be
+triggered repeatedly - then please do *NOT* report it here, but send an
+email to [security-officer@isc.org](security-officer@isc.org).
+-->
+
+### CVE-specific actions
+
+  - [ ] Assign a CVE identifier
+  - [ ] Determine CVSS score
+  - [ ] Determine the range of BIND versions affected (including the Subscription Edition)
+  - [ ] Determine whether workarounds for the problem exists
+  - [ ] Create a draft of the security advisory and put the information above in there
+  - [ ] Prepare a detailed description of the problem which should include the following by default:
+      - instructions for reproducing the problem (a system test is good enough)
+      - explanation of code flow which triggers the problem (a system test is *not* good enough)
+  - [ ] Prepare a private merge request containing the following items in separate commits:
+      - a test for the issue (may be moved to a separate merge request for deferred merging)
+      - a fix for the issue
+      - documentation updates (`CHANGES`, release notes, anything else applicable)
+  - [ ] Ensure the merge request from the previous step is reviewed by SWENG staff and has no outstanding discussions
+  - [ ] Ensure the documentation changes introduced by the merge request addressing the problem are reviewed by Support and Marketing staff
+  - [ ] Prepare backports of the merge request addressing the problem for all affected (and still maintained) BIND branches (backporting might affect the issue's scope and/or description)
+  - [ ] Prepare a standalone patch for the last stable release of each affected (and still maintained) BIND branch
+
+### Release-specific actions
+
+  - [ ] Create/update the private issue containing links to fixes & reproducers for all CVEs fixed in a given release cycle
+  - [ ] Reserve a block of `CHANGES` placeholders once the complete set of vulnerabilities fixed in a given release cycle is determined
+  - [ ] Ensure the merge requests containing CVE fixes are merged into `security-*` branches in CVE identifier order
+
+### Post-disclosure actions
+
+  - [ ] Merge a regression test reproducing the bug into all affected (and still maintained) BIND branches

.gitlab/issue_templates/Default.md

@@ -1,8 +0,0 @@
-Hi and thanks for filing an issue! It will be read with care by human beings.
-
-It would be a tremendous help if you could follow these steps first:
-- [ ] Search the existing issues in GitLab (both open and closed) to see if your report might be a duplicate. We have a large database here and many issues have already been fixed in the latest versions!
-- [ ] Make sure this is **not** a support question. If you have specific trouble configuring or debugging your setup, please use the bind-users mailing list: https://lists.isc.org/mailman/listinfo/bind-users
-- [ ] You have read and understood the "out in the open" support policy: https://blog.powerdns.com/2016/01/18/open-source-support-out-in-the-open/ . Even though it was written by the PowerDNS folks, we follow it as well!
-
-Before continuing, **please select the appropriate issue template in the drop-down menu above, under the heading _Description_**.

.gitlab/issue_templates/Feature_Request.md

@@ -8,4 +8,4 @@
 
 ### Links / references
 
-/label ~Feature
+/label ~"feature request"

.gitlab/issue_templates/Internal_use_only-CVE.md

@@ -1,123 +0,0 @@
-<!--
-THIS ISSUE TEMPLATE IS INTENDED ONLY FOR INTERNAL USE.
-
-If the bug you are reporting is potentially security-related - for example,
-if it involves an assertion failure or other crash in `named` that can be
-triggered repeatedly - then please make sure that you make the new issue
-confidential!
--->
-| Quick Links              | :link:                               |
-| ------------------------ | ------------------------------------ |
-| Incident Manager:        | @user                                |
-| Deputy Incident Manager: | @user                                |
-| Public Disclosure Date:  | YYYY-MM-DD                           |
-| CVSS Score:              | [0.0][cvss_score]                    |
-| Security Advisory:       | isc-private/printing-press!NNN       |
-| Mattermost Channel:      | [CVE-YYYY-NNNN][mattermost_url]      |
-| Support Ticket:          | [URL]                                |
-| Release Checklist:       | #NNNN                                |
-
-[cvss_score]: https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:X/AC:X/PR:X/UI:X/S:X/C:X/I:X/A:X&version=3.1
-[mattermost_url]:
-
-:bulb: **Click [here][checklist_explanations] (internal resource) for general information about the security incident handling process.**
-
-[checklist_explanations]: https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations
-
-### Earlier Than T-5
-
-  - [ ] [:link:][step_deputy]            **(IM)** Pick a Deputy Incident Manager
-  - [ ] [:link:][step_respond]           **(IM)** Respond to the bug reporter
-  - [ ] [:link:][step_public_mrs]        **(SwEng)** Ensure there are no public merge requests which inadvertently disclose the issue
-  - [ ] [:link:][step_assign_cve_id]     **(IM)** Assign a CVE identifier
-  - [ ] [:link:][step_note_cve_info]     **(SwEng)** Update this issue with the assigned CVE identifier and the CVSS score
-  - [ ] [:link:][step_versions_affected] **(SwEng)** Determine the range of product versions affected (including the Subscription Edition)
-  - [ ] [:link:][step_workarounds]       **(SwEng)** Determine whether workarounds for the problem exist
-  - [ ] [:link:][step_coordinate]        **(SwEng)** If necessary, coordinate with other parties
-  - [ ] [:link:][step_earliest_prepare]  **(Support)** Prepare "earliest" notification text and hand it off to Marketing
-  - [ ] [:link:][step_earliest_send]     **(Marketing)** Update "earliest" notification document in SF portal and send bulk email to earliest customers
-  - [ ] [:link:][step_advisory_mr]       **(Support)** Create a merge request for the Security Advisory and include all readily available information in it
-  - [ ] [:link:][step_reproducer_mr]     **(SwEng)** Prepare a private merge request containing a system test reproducing the problem
-  - [ ] [:link:][step_notify_support]    **(SwEng)** Notify Support when a reproducer is ready
-  - [ ] [:link:][step_code_analysis]     **(SwEng)** Prepare a detailed explanation of the code flow triggering the problem
-  - [ ] [:link:][step_fix_mr]            **(SwEng)** Prepare a private merge request with the fix
-  - [ ] [:link:][step_review_fix]        **(SwEng)** Ensure the merge request with the fix is reviewed and has no outstanding discussions
-  - [ ] [:link:][step_review_docs]       **(Support)** Review the documentation changes introduced by the merge request with the fix
-  - [ ] [:link:][step_backports]         **(SwEng)** Prepare backports of the merge request addressing the problem for all affected (and still maintained) branches of a given product
-  - [ ] [:link:][step_finish_advisory]   **(Support)** Finish preparing the Security Advisory
-  - [ ] [:link:][step_meta_issue]        **(QA)** Create (or update) the private issue containing links to fixes & reproducers for all CVEs fixed in a given release cycle
-  - [ ] [:link:][step_changes]           **(QA)** (BIND 9 only) Reserve a block of `CHANGES` placeholders once the complete set of vulnerabilities fixed in a given release cycle is determined
-  - [ ] [:link:][step_merge_fixes]       **(QA)** Merge the CVE fixes in CVE identifier order
-  - [ ] [:link:][step_patches]           **(QA)** Prepare a standalone patch for the last stable release of each affected (and still maintained) product branch
-  - [ ] [:link:][step_asn_releases]      **(QA)** Prepare ASN releases (as outlined in the Release Checklist)
-
-### At T-5
-
-  - [ ] [:link:][step_asn_documents]     **(Marketing)** Update the text on the T-5 (from the Printing Press project) and "earliest" ASN documents in the SF portal
-  - [ ] [:link:][step_asn_links]         **(Marketing)** (BIND 9 only) Update the BIND -S information document in SF with download links to the new versions
-  - [ ] [:link:][step_asn_send]          **(Marketing)** Bulk email eligible customers to check the SF portal
-  - [ ] [:link:][step_preannouncement]   **(Marketing)** (BIND 9 only) Send a pre-announcement email to the *bind-announce* mailing list to alert users that the upcoming release will include security fixes
-
-### At T-1
-
-  - [ ] [:link:][step_packager_emails]   **(First IM)** Send notifications to OS packagers
-
-### On the Day of Public Disclosure
-
-  - [ ] [:link:][step_clearance]         **(IM)** Grant QA & Marketing clearance to proceed with public release
-  - [ ] [:link:][step_publish]           **(QA/Marketing)** Publish the releases (as outlined in the release checklist)
-  - [ ] [:link:][step_matrix]            **(Support)** (BIND 9 only) Add the new CVEs to the vulnerability matrix in the Knowledge Base
-  - [ ] [:link:][step_publish_advisory]  **(Support)** Bump Document Version for the Security Advisory and publish it in the Knowledge Base
-  - [ ] [:link:][step_notifications]     **(First IM)** Send notification emails to third parties
-  - [ ] [:link:][step_mitre]             **(First IM)** Advise MITRE about the disclosed CVEs
-  - [ ] [:link:][step_merge_advisory]    **(First IM)** Merge the Security Advisory merge request
-  - [ ] [:link:][step_embargo_end]       **(IM)** Inform original reporter (if external) that the security disclosure process is complete
-  - [ ] [:link:][step_asn_clear]         **(Marketing)** Update the SF portal to clear the ASN
-  - [ ] [:link:][step_customers]         **(Marketing)** Email ASN recipients that the embargo is lifted
-
-### After Public Disclosure
-
-  - [ ] [:link:][step_regression]        **(QA)** Merge a regression test reproducing the bug into all affected (and still maintained) branches
-
-[step_deputy]:            https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#pick-a-deputy-incident-manager
-[step_respond]:           https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#respond-to-the-bug-reporter
-[step_public_mrs]:        https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#ensure-there-are-no-public-merge-requests-which-inadvertently-disclose-the-issue
-[step_assign_cve_id]:     https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#assign-a-cve-identifier
-[step_note_cve_info]:     https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#update-this-issue-with-the-assigned-cve-identifier-and-the-cvss-score
-[step_versions_affected]: https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#determine-the-range-of-product-versions-affected-including-the-subscription-edition
-[step_workarounds]:       https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#determine-whether-workarounds-for-the-problem-exist
-[step_coordinate]:        https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#if-necessary-coordinate-with-other-parties
-[step_earliest_prepare]:  https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#prepare-earliest-notification-text-and-hand-it-off-to-marketing
-[step_earliest_send]:     https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#update-earliest-notification-document-in-sf-portal-and-send-bulk-email-to-earliest-customers
-[step_advisory_mr]:       https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#create-a-merge-request-for-the-security-advisory-and-include-all-readily-available-information-in-it
-[step_reproducer_mr]:     https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#prepare-a-private-merge-request-containing-a-system-test-reproducing-the-problem
-[step_notify_support]:    https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#notify-support-when-a-reproducer-is-ready
-[step_code_analysis]:     https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#prepare-a-detailed-explanation-of-the-code-flow-triggering-the-problem
-[step_fix_mr]:            https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#prepare-a-private-merge-request-with-the-fix
-[step_review_fix]:        https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#ensure-the-merge-request-with-the-fix-is-reviewed-and-has-no-outstanding-discussions
-[step_review_docs]:       https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#review-the-documentation-changes-introduced-by-the-merge-request-with-the-fix
-[step_backports]:         https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#prepare-backports-of-the-merge-request-addressing-the-problem-for-all-affected-and-still-maintained-branches-of-a-given-product
-[step_finish_advisory]:   https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#finish-preparing-the-security-advisory
-[step_meta_issue]:        https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#create-or-update-the-private-issue-containing-links-to-fixes-reproducers-for-all-cves-fixed-in-a-given-release-cycle
-[step_changes]:           https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#bind-9-only-reserve-a-block-of-changes-placeholders-once-the-complete-set-of-vulnerabilities-fixed-in-a-given-release-cycle-is-determined
-[step_merge_fixes]:       https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#merge-the-cve-fixes-in-cve-identifier-order
-[step_patches]:           https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#prepare-a-standalone-patch-for-the-last-stable-release-of-each-affected-and-still-maintained-product-branch
-[step_asn_releases]:      https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#prepare-asn-releases-as-outlined-in-the-release-checklist
-[step_asn_documents]:     https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#update-the-text-on-the-t-5-from-the-printing-press-project-and-earliest-asn-documents-in-the-sf-portal
-[step_asn_links]:         https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#bind-9-only-update-the-bind-s-information-document-in-sf-with-download-links-to-the-new-versions
-[step_asn_send]:          https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#bulk-email-eligible-customers-to-check-the-sf-portal
-[step_preannouncement]:   https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#bind-9-only-send-a-pre-announcement-email-to-the-bind-announce-mailing-list-to-alert-users-that-the-upcoming-release-will-include-security-fixes
-[step_packager_emails]:   https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#send-notifications-to-os-packagers
-[step_clearance]:         https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#grant-qa-marketing-clearance-to-proceed-with-public-release
-[step_publish]:           https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#publish-the-releases-as-outlined-in-the-release-checklist
-[step_matrix]:            https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#bind-9-only-add-the-new-cves-to-the-vulnerability-matrix-in-the-knowledge-base
-[step_publish_advisory]:  https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#bump-document-version-for-the-security-advisory-and-publish-it-in-the-knowledge-base
-[step_notifications]:     https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#send-notification-emails-to-third-parties
-[step_mitre]:             https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#advise-mitre-about-the-disclosed-cves
-[step_merge_advisory]:    https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#merge-the-security-advisory-merge-request
-[step_embargo_end]:       https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#inform-original-reporter-if-external-that-the-security-disclosure-process-is-complete
-[step_asn_clear]:         https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#update-the-sf-portal-to-clear-the-asn
-[step_customers]:         https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#email-asn-recipients-that-the-embargo-is-lifted
-[step_regression]:        https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#merge-a-regression-test-reproducing-the-bug-into-all-affected-and-still-maintained-branches
-
-/confidential

.gitlab/issue_templates/Release.md

@@ -0,0 +1,97 @@
+## Release Schedule
+
+**Code Freeze:**
+
+**Tagging Deadline:**
+
+**Public Release:**
+
+## Documentation Review Links
+
+**Closed issues assigned to the milestone without a release note:**
+
+ - []()
+ - []()
+ - []()
+
+**Merge requests merged into the milestone without a release note:**
+
+ - []()
+ - []()
+ - []()
+
+**Merge requests merged into the milestone without a `CHANGES` entry:**
+
+ - []()
+ - []()
+ - []()
+
+## Release Checklist
+
+### Before the Code Freeze
+
+ - [ ] ***(QA)*** Inform Support and Marketing of impending release (and give estimated release dates).
+ - [ ] ***(QA)*** Ensure there are no permanent test failures on any platform.
+ - [ ] ***(QA)*** Check Perflab to ensure there has been no unexplained drop in performance for the versions being released.
+ - [ ] ***(QA)*** Check whether all issues assigned to the release milestone are resolved[^1].
+ - [ ] ***(QA)*** Ensure that there are no outstanding merge requests in the private repository[^1] (Subscription Edition only).
+ - [ ] ***(QA)*** Ensure all merge requests marked for backporting have been indeed backported.
+ - [ ] ***(QA)*** Announce (on Mattermost) that the code freeze is in effect.
+
+### Before the Tagging Deadline
+
+ - [ ] ***(QA)*** Look for outstanding documentation issues (e.g. `CHANGES` mistakes) and address them if any are found.
+ - [ ] ***(QA)*** Ensure release notes are correct, ask Support and Marketing to check them as well.
+ - [ ] ***(QA)*** Update API files for libraries with new version information.
+ - [ ] ***(QA)*** Change software version and library versions in `configure.ac` (new major release only).
+ - [ ] ***(QA)*** Rebuild `configure` using Autoconf on `docs.isc.org`.
+ - [ ] ***(QA)*** Update `CHANGES`.
+ - [ ] ***(QA)*** Update `CHANGES.SE` (Subscription Edition only).
+ - [ ] ***(QA)*** Update `README.md`.
+ - [ ] ***(QA)*** Update `version`.
+ - [ ] ***(QA)*** Build documentation on `docs.isc.org`.
+ - [ ] ***(QA)*** Check that the formatting is correct for text, PDF, and HTML versions of release notes.
+ - [ ] ***(QA)*** Check that the formatting of the generated man pages is correct.
+ - [ ] ***(QA)*** Tag the releases in the private repository (`git tag -s -m "BIND 9.x.y" v9_x_y`).
+
+### Before the ASN Deadline (for ASN Releases) or the Public Release Date (for Regular Releases)
+
+ - [ ] ***(QA)*** Verify GitLab CI results for the tags created and prepare a QA report for the releases to be published.
+ - [ ] ***(QA)*** Announce (on Mattermost) that the code freeze is over.
+ - [ ] ***(QA)*** Request signatures for the tarballs, providing their location and checksums.
+ - [ ] ***(Signers)*** Validate tarball checksums, sign tarballs, and upload signatures.
+ - [ ] ***(QA)*** Verify tarball signatures and check tarball checksums again.
+ - [ ] ***(Support)*** Pre-publish ASN and/or Subscription Edition tarballs so that packages can be built.
+ - [ ] ***(QA)*** Build and test ASN and/or Subscription Edition packages.
+ - [ ] ***(QA)*** Notify Support that the releases have been prepared.
+ - [ ] ***(Support)*** Send out ASNs (if applicable).
+
+### On the Day of Public Release
+
+ - [ ] ***(Support)*** Wait for clearance from Security Officer to proceed with the public release (if applicable).
+ - [ ] ***(Support)*** Place tarballs in public location on FTP site.
+ - [ ] ***(Support)*** Publish links to downloads on ISC website.
+ - [ ] ***(Support)*** Write release email to *bind-announce*.
+ - [ ] ***(Support)*** Write email to *bind-users* (if a major release).
+ - [ ] ***(Support)*** Send eligible customers updated links to the Subscription Edition (update the -S edition delivery tickets, even if those links were provided earlier via an ASN ticket).
+ - [ ] ***(Support)*** Update tickets in case of waiting support customers.
+ - [ ] ***(QA)*** Build and test any outstanding private packages.
+ - [ ] ***(QA)*** Build public RPMs.
+ - [ ] ***(SwEng) *** Build Debian/Ubuntu packages.
+ - [ ] ***(SwEng) *** Update Docker images.
+ - [ ] ***(QA)*** Inform Marketing of the release.
+ - [ ] ***(QA)*** Update the internal [BIND release dates wiki page](https://wiki.isc.org/bin/view/Main/BindReleaseDates) when public announcement has been made.
+ - [ ] ***(Marketing)*** Post short note to Twitter.
+ - [ ] ***(Marketing)*** Update [Wikipedia entry for BIND](https://en.wikipedia.org/wiki/BIND).
+ - [ ] ***(Marketing)*** Write blog article (if a major release).
+ - [ ] ***(QA)*** Ensure all new tags are annotated and signed.
+ - [ ] ***(QA)*** Push tags for the published releases to the public repository.
+ - [ ] ***(QA)*** Merge the automatically prepared `prep 9.x.y` commit which updates `version` and documentation on the release branch into the relevant maintenance branch (`v9_x`).
+ - [ ] ***(QA)*** For each maintained branch, update the `BIND_BASELINE_VERSION` variable for the `abi-check` job in `.gitlab-ci.yml` to the latest published BIND version tag for a given branch.
+ - [ ] ***(QA)*** Prepare empty release notes for the next set of releases.
+ - [ ] ***(QA)*** Sanitize confidential issues which are assigned to the current release milestone and do not describe a security vulnerability, then make them public.
+ - [ ] ***(QA)*** Sanitize confidential issues which are assigned to older release milestones and describe security vulnerabilities, then make them public if appropriate[^2].
+ - [ ] ***(QA)*** Update QA tools used in GitLab CI (e.g. Flake8, PyLint) by modifying the relevant `Dockerfile`.
+
+[^1]: If not, use the time remaining until the tagging deadline to ensure all outstanding issues are either resolved or moved to a different milestone.
+[^2]: As a rule of thumb, security vulnerabilities which have reproducers merged to the public repository are considered okay for full disclosure.

.gitlab/issue_templates/Security_issue.md

@@ -1,139 +0,0 @@
-### Summary
-<!--
-Concisely summarize the bug encountered,
-preferably in one paragraph or less.
--->
-
-### BIND versions affected
-<!--
-Make sure you are testing with the **latest** supported version of BIND.
-See https://kb.isc.org/docs/supported-platforms for the current list.
-The latest source is available from https://www.isc.org/download/#BIND
-
-Paste the output of `named -V` here.
--->
-
-### Preconditions and assumptions
-<!--
-Is a specific setup needed?
-
-Please check the BIND Security Assumptions chapter in the ARM:
-https://bind9.readthedocs.io/en/latest/chapter7.html#security-assumptions
-
-E.g. DNSSEC validation must be disabled, etc.
-E.g. Resolver must be configured to forward to attacker's server via DNS-over-TLS, etc.
-E.g. Authoritative server must be configured to transfer specific primary zone.
-E.g. Attacker must be in posession of a key authorized to modify at least one zone.
-E.g. Attacker can affect system clock on the server running BIND.
--->
-
-### Attacker's abilities
-<!--
-What resources does an attacker need to have under their control to mount this attack?
-
-E.g. If attacking an authoritative server, does the attacked have to have prior
-relationship with it? "The authoritative server under attack needs to
-transfer a malicious zone from attacker's authoritative server via TLS."
-
-E.g. If attacking a resolver, does the attacker need the ability to send
-arbitrary queries to the resolver under attack? Do they need to _also_ control
-an authoritative server at the same time?
--->
-
-
-### Impact
-<!--
-Who or what is the victim of the attack and what is the impact?
-
-Is a third party receiving many packets generated by a reflection attack?
-
-If the affected party is the BIND server itself, please quantify the impact
-on legitimate clients:
-E.g. After launching the attack, the answers-per-second metric for legitimate
-traffic drops to 1/1000 within the first minute of the attack.
--->
-
-
-### Steps to reproduce
-<!--
-This is extremely important! Be precise and use itemized lists, please.
-
-Even if a default configuration is affected, please include the full configuration
-files _you were testing with_.
-
-Example:
-1. Use the _attached_ configuration file
-2. Start the BIND server with command: `named -g -c named.conf ...`
-3. Simulate legitimate clients using the command `dnsperf -S1 -d legit-queries ...`
-4. Simulate attack traffic using the command `dnsperf -S1 -d attack-queries ...`
--->
-
-1.
-2.
-3.
-
-### What is the current *bug* behavior?
-
-<!--
-Examples:
-Legitimate QPS drops 1000x.
-Memory consumption increases out of bounds and the server crashes.
-The server crashes immediately.
--->
-
-### What is the expected *correct* behavior?
-
-<!--
-If the attack causes resource exhaustion, what do you think the correct
-behavior should be? Should BIND refuse to process more requests?
-
-What heuristic do you propose to distinguish legitimate and attack traffic?
--->
-
-### Relevant logs
-<!--
-Please provide log files from your testing. Include full named logs and also
-the output from any testing tools (e.g. dnsperf, DNS Shotgun, kxdpgun, etc.)
-
-If multiple log files are needed, make sure all the files have matching timestamps
-so we can correlate log events across log files.
-
-In the case of resource exhaustion attacks, please _also_ include system monitoring
-data. You can use https://gitlab.isc.org/isc-projects/resource-monitor/ to
-gather system-wide statistics.
--->
-
-### Coordination
-- Does this issue affect multiple implementations?
-<!--
-Issues affecting multiple implementations require very careful coordination. We
-have to make sure the information does not leak to the public until vendors are ready to
-release fixed versions. If it is a multi-vendor issue, we need to know about the situation
-as soon as possible to start the (confidential!) coordination process within
-DNS-OARC and other suitable fora.
-
-Please list implementations you have tested.
--->
-
-- Have you shared the information with anyone else?
-<!--
-Have you informed other affected vendors? Or maybe submitted a paper for
-review?
--->
-
-- What is your plan to publicize this issue?
-<!--
-E.g. we plan to go public during conference XYZ on 20XX-XX-XX
--->
-
-### Acknowledgements
-<!--
-Please specify whether and how you would like to be publicly credited with
-discovering the issue. We normally use the format:
-First_name Last_name, Company_or_Team.
--->
-
-<!-- DO NOT modify the following two lines. -->
-
-/label ~Bug ~Security
-/confidential

.lgtm.yml

@@ -0,0 +1,35 @@
+extraction:
+  cpp:
+    prepare:
+      packages:
+      - "libxml2-dev"
+      - "libjson-c-dev"
+      - "libssl-dev"
+      - "zlib1g-dev"
+      - "libcmocka-dev"
+      - "pkg-config"
+      - "libcap2-dev"
+      - "libedit-dev"
+      - "libidn2-dev"
+      - "libmaxminddb-dev"
+      - "libuv1-dev"
+      - "libnghttp2-dev"
+    configure:
+      command:
+      - "autoreconf -fi"
+      - "CFLAGS=\"-Og -g\" ./configure --enable-developer"
+path_classifiers:
+  test:
+    - "lib/*/tests/"
+    - "bin/tests/"
+  docs:
+    - "**/*.xml"
+    - "**/*.docbook"
+    - "**/*.html"
+    - "**/*.1"
+    - "**/*.5"
+    - "**/*.8"
+queries:
+  - exclude: fuzz/
+  - exclude: "bin/tests/system/*/ans*/*.py"
+  - exclude: cpp/use-of-goto

.pylintrc

@@ -7,4 +7,3 @@ disable=
     C0209, # consider-using-f-string
     C0415, # import-outside-toplevel
     R0801, # duplicate-code
-    R0903, # too-few-public-methods

.readthedocs.yaml

@@ -1,20 +0,0 @@
-# See https://docs.readthedocs.io/en/stable/config-file/v2.html for details
-
-version: 2
-
-build:
-  os: ubuntu-22.04
-  tools:
-    python: "3.11"
-
-# Build documentation in doc/arm/ with Sphinx
-sphinx:
-  configuration: doc/arm/conf.py
-
-# Build all formats
-formats: all
-
-# Explicitly set the version of Python and its requirements
-python:
-   install:
-   - requirements: doc/arm/requirements.txt

.reuse/dep5

@@ -33,35 +33,25 @@ Files: **/*.after*
        bin/tests/system/checkzone/zones/bad1.db
        bin/tests/system/checkzone/zones/crashzone.db
        bin/tests/system/dnstap/large-answer.fstrm
-       bin/tests/system/doth/CA/CA.cfg
-       bin/tests/system/doth/CA/README
-       bin/tests/system/doth/CA/index.txt
-       bin/tests/system/doth/CA/index.txt.attr
-       bin/tests/system/doth/CA/serial
        bin/tests/system/notify/ns4/named.port.in
        bin/tests/system/formerr/nametoolong
        bin/tests/system/formerr/noquestions
        bin/tests/system/formerr/twoquestions
-       bin/tests/system/forward/CA/CA.cfg
-       bin/tests/system/forward/CA/README
-       bin/tests/system/forward/CA/index.txt
-       bin/tests/system/forward/CA/index.txt.attr
-       bin/tests/system/forward/CA/serial
        bin/tests/system/journal/ns1/managed-keys.bind.in
        bin/tests/system/journal/ns1/managed-keys.bind.jnl.in
        bin/tests/system/journal/ns2/managed-keys.bind.in
        bin/tests/system/journal/ns2/managed-keys.bind.jnl.in
        bin/tests/system/keepalive/expected
+       bin/tests/system/legacy/ns10/named.ednsrefused
+       bin/tests/system/legacy/ns2/named.dropedns
+       bin/tests/system/legacy/ns3/named.dropedns
+       bin/tests/system/legacy/ns3/named.notcp
+       bin/tests/system/legacy/ns5/named.notcp
        bin/tests/system/legacy/ns6/edns512.db.signed
        bin/tests/system/legacy/ns7/edns512-notcp.db.signed
-       bin/tests/system/masterfile/knowngood.include
-       bin/tests/system/masterfile/knowngood.ttl1
-       bin/tests/system/masterfile/knowngood.ttl2
-       bin/tests/system/nsupdate/CA/CA.cfg
-       bin/tests/system/nsupdate/CA/README
-       bin/tests/system/nsupdate/CA/index.txt
-       bin/tests/system/nsupdate/CA/index.txt.attr
-       bin/tests/system/nsupdate/CA/serial
+       bin/tests/system/legacy/ns7/named.notcp
+       bin/tests/system/legacy/ns8/named.ednsformerr
+       bin/tests/system/legacy/ns9/named.ednsnotimp
        bin/tests/system/nsupdate/commandlist
        bin/tests/system/nsupdate/verylarge.in
        bin/tests/system/org.isc.bind.system.plist
@@ -84,10 +74,7 @@ Files: **/*.after*
        bin/tests/system/unknown/large.out
        bin/tests/system/xfer/ans5/badkeydata
        bin/tests/system/xfer/ans5/badmessageid
-       bin/tests/system/xfer/ans5/ednsformerr
-       bin/tests/system/xfer/ans5/ednsnotimp
        bin/tests/system/xfer/ans5/goodaxfr
-       bin/tests/system/xfer/ans5/ixfrnotimp
        bin/tests/system/xfer/ans5/partial
        bin/tests/system/xfer/ans5/soamismatch
        bin/tests/system/xfer/ans5/unknownkey
@@ -98,8 +85,6 @@ Files: **/*.after*
        cocci/*.cocci
        cocci/*.disabled
        cocci/*.spatch
-       doc/arm/*.dia
-       doc/arm/*.png
        doc/arm/isc-logo.pdf
        doc/arm/requirements.txt
        doc/man/*.1in
@@ -149,35 +134,20 @@ Files: **/.clang-format
        **/.gitattributes
        **/.gitignore
        **/named*.args
-       **/named.dropedns
-       **/named.ednsformerr
-       **/named.ednsnotimp
-       **/named.ednsrefused
-       **/named.maxudp1460
-       **/named.maxudp512
-       **/named.noaa
-       **/named.noedns
-       **/named.nosoa
-       **/named.notcp
        **/startme
        .clang-format
        .clang-format.headers
        .dir-locals.el
-       .editorconfig
-       .git-blame-ignore-revs
        .gitattributes
        .gitignore
        .gitlab-ci.yml
        .lgtm.yml
        .pylintrc
-       .readthedocs.yaml
-       .tsan-suppress
        .uncrustify.cfg
        doc/misc/*.zoneopt
        doc/misc/options
-       doc/misc/rndc.grammar
-       sonar-project.properties
-       tests/bench/names.csv
+       doc/misc/options.active
+       tsan-suppressions.txt
 Copyright: Internet Systems Consortium, Inc. ("ISC")
 License: CC0-1.0
 

.tsan-suppress

@@ -1,3 +0,0 @@
-# Uninstrumented libraries
-called_from_lib:libfstrm.so
-race:dummyrpz

AUTHORS

@@ -51,4 +51,3 @@ Anay Panvalkar
 colleen
 Robert Edmonds
 João Damas
-Artem Boldariev (Артем Болдарєв)

CONTRIBUTING.md

@@ -71,14 +71,14 @@ To clone the repository, use:
 
 >       $ git clone https://gitlab.isc.org/isc-projects/bind9.git
 
-Release branch names are of the form `bind-9.X`, where X represents the second
-number in the BIND 9 version number.  So, to check out the BIND 9.18
+Release branch names are of the form `v9_X`, where X represents the second
+number in the BIND 9 version number.  So, to check out the BIND 9.12
 branch, use:
 
->       $ git checkout bind-9.18
+>       $ git checkout v9_12
 
 Whenever a branch is ready for publication, a tag is placed of the
-form `v9.X.Y`.  The 9.18.0 release, for instance, is tagged as `v9.18.0`.
+form `v9_X_Y`.  The 9.12.0 release, for instance, is tagged as `v9_12_0`.
 
 The branch in which the next major release is being developed is called
 `main`.
@@ -102,7 +102,22 @@ Twitter, or Facebook.
 
 ### Reporting possible security issues
 
-See `SECURITY.md`.
+If you think you may be seeing a potential security vulnerability in BIND
+(for example, a crash with REQUIRE, INSIST, or ASSERT failure), please
+report it immediately by emailing to security-officer@isc.org. Plain-text
+e-mail is not a secure choice for communications concerning undisclosed
+security issues so please encrypt your communications to us if possible,
+using the [ISC Security Officer public key](https://www.isc.org/pgpkey/).
+
+Do not discuss undisclosed security vulnerabilities on any public mailing list.
+ISC has a long history of handling reported vulnerabilities promptly and
+effectively and we respect and acknowledge responsible reporters.
+
+ISC's Security Vulnerability Disclosure Policy is documented at
+[https://kb.isc.org/docs/aa-00861](https://kb.isc.org/docs/aa-00861).
+
+If you have a crash, you may want to consult
+["What to do if your BIND or DHCP server has crashed."](https://kb.isc.org/docs/aa-00340)
 
 ### <a name="contrib"></a>Contributing code
 
@@ -173,7 +188,7 @@ of documentation in the BIND source tree:
   they document, in files ending in `.rst`: for example, the
   `named` man page is `bin/named/named.rst`.
 * The *BIND 9 Administrator Reference Manual* is in the .rst files in
-  `doc/arm/`; the HTML version is automatically generated from
+  `doc/arm/`; the PDF and HTML versions are automatically generated from
   the `.rst` files.
 * API documentation is in the header file describing the API, in
   Doxygen-formatted comments.

COPYRIGHT

@@ -1,4 +1,4 @@
-Copyright (C) 1996-2023  Internet Systems Consortium, Inc. ("ISC")
+Copyright (C) 1996-2022  Internet Systems Consortium, Inc. ("ISC")
 
 This Source Code Form is subject to the terms of the Mozilla Public
 License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -133,7 +133,7 @@ modification, are permitted provided that the following conditions are met:
 3. Neither the name of the University nor the names of its contributors may
    be used to endorse or promote products derived from this software
    without specific prior written permission.
-
+ 
 THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
 AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
@@ -149,35 +149,35 @@ POSSIBILITY OF SUCH DAMAGE.
  -----------------------------------------------------------------------------
 
 Copyright (c) 1997 - 2003 Kungliga Tekniska Högskolan
-(Royal Institute of Technology, Stockholm, Sweden).
-All rights reserved.
+(Royal Institute of Technology, Stockholm, Sweden). 
+All rights reserved. 
 
-Redistribution and use in source and binary forms, with or without
-modification, are permitted provided that the following conditions
-are met:
+Redistribution and use in source and binary forms, with or without 
+modification, are permitted provided that the following conditions 
+are met: 
 
-1. Redistributions of source code must retain the above copyright
-   notice, this list of conditions and the following disclaimer.
+1. Redistributions of source code must retain the above copyright 
+   notice, this list of conditions and the following disclaimer. 
 
-2. Redistributions in binary form must reproduce the above copyright
-   notice, this list of conditions and the following disclaimer in the
-   documentation and/or other materials provided with the distribution.
+2. Redistributions in binary form must reproduce the above copyright 
+   notice, this list of conditions and the following disclaimer in the 
+   documentation and/or other materials provided with the distribution. 
 
-3. Neither the name of the Institute nor the names of its contributors
-   may be used to endorse or promote products derived from this software
-   without specific prior written permission.
+3. Neither the name of the Institute nor the names of its contributors 
+   may be used to endorse or promote products derived from this software 
+   without specific prior written permission. 
 
-THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
-ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
-IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
-ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
-FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
-DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
-OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
-HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
-LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
-OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
-SUCH DAMAGE.
+THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND 
+ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 
+IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 
+ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE 
+FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 
+DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 
+OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 
+HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 
+LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 
+OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 
+SUCH DAMAGE. 
 
  -----------------------------------------------------------------------------
 

Makefile.am

@@ -1,25 +1,19 @@
 include $(top_srcdir)/Makefile.top
 
-SUBDIRS = . lib doc
+SUBDIRS = . lib doc bin fuzz
 
-# build libtest before fuzz/* and bin/tests
-SUBDIRS += tests
-
-# run fuzz tests before system tests
-SUBDIRS += fuzz bin
-
-BUILT_SOURCES += bind.keys.h
-CLEANFILES += bind.keys.h
+BUILT_SOURCES = bind.keys.h
+CLEANFILES = bind.keys.h
 
 bind.keys.h: bind.keys Makefile
 	${PERL} ${top_srcdir}/util/bindkeys.pl ${top_srcdir}/bind.keys > $@
 
+dist_sysconf_DATA = bind.keys
+
 .PHONY: doc
 
-EXTRA_DIST =			\
-	bind.keys		\
+EXTRA_DIST = 			\
 	util/bindkeys.pl	\
-	util/dtrace.sh		\
 	contrib			\
 	CHANGES			\
 	COPYRIGHT		\

Makefile.docs

@@ -2,7 +2,6 @@ SPHINX_V = $(SPHINX_V_@AM_V@)
 SPHINX_V_ = $(SPHINX_V_@AM_DEFAULT_V@)
 SPHINX_V_0 = -q
 SPHINX_V_1 = -n
-SPHINX_W = -W
 
 AM_V_SPHINX = $(AM_V_SPHINX_@AM_V@)
 AM_V_SPHINX_ = $(AM_V_SPHINX_@AM_DEFAULT_V@)
@@ -14,19 +13,23 @@ LF = \n
 RNDC_CONF = .. |rndc_conf| replace:: ``$(sysconfdir)/rndc.conf``
 RNDC_KEY = .. |rndc_key| replace:: ``$(sysconfdir)/rndc.key``
 NAMED_CONF = .. |named_conf| replace:: ``$(sysconfdir)/named.conf``
+BIND_KEYS = .. |bind_keys| replace:: ``$(sysconfdir)/bind.keys``
 NAMED_PID = .. |named_pid| replace:: ``$(runstatedir)/named.pid``
 SESSION_KEY = .. |session_key| replace:: ``$(runstatedir)/session.key``
 
 export RST_EPILOG = $(RNDC_CONF)$(LF)$(RNDC_KEY)$(LF)$(NAMED_CONF)$(LF)$(BIND_KEYS)$(LF)$(NAMED_PID)$(LF)$(SESSION_KEY)
 
 common_SPHINXOPTS =			\
-	$(SPHINX_W)			\
+	-W				\
 	-c $(srcdir)			\
 	-a				\
 	$(SPHINX_V)
 
+# The "today" variable set below is not directly used in the ARM, but its value
+# is implicitly inserted on the title page of the PDF file produced by Sphinx.
 ALLSPHINXOPTS =					\
 	$(common_SPHINXOPTS)			\
+	-D today="$(RELEASE_DATE)"		\
 	-D rst_epilog="$$(printf "$${RST_EPILOG}")"	\
 	$(SPHINXOPTS)				\
 	$(srcdir)
@@ -57,3 +60,15 @@ AM_V_SED_0 = @echo "  SED $@";
 AM_V_CFG_TEST = $(AM_V_CFG_TEST_@AM_V@)
 AM_V_CFG_TEST_ = $(AM_V_CFG_TEST_@AM_DEFAULT_V@)
 AM_V_CFG_TEST_0 = @echo "  CFG_GEN $@";
+
+AM_V_RST_OPTIONS = $(AM_V_CFG_TEST_@AM_V@)
+AM_V_RST_OPTIONS_ = $(AM_V_RST_OPTIONS_@AM_DEFAULT_V@)
+AM_V_RST_OPTIONS_0 = @echo "  RST_OPTIONS $@";
+
+AM_V_RST_ZONEOPT = $(AM_V_CFG_TEST_@AM_V@)
+AM_V_RST_ZONEOPT_ = $(AM_V_RST_ZONEOPT_@AM_DEFAULT_V@)
+AM_V_RST_ZONEOPT_0 = @echo "  RST_ZONEOPT $@";
+
+AM_V_RST_GRAMMARS = $(AM_V_CFG_TEST_@AM_V@)
+AM_V_RST_GRAMMARS_ = $(AM_V_RST_GRAMMARS_@AM_DEFAULT_V@)
+AM_V_RST_GRAMMARS_0 = @echo "  RST_GRAMMARS $@";

Makefile.dtrace

@@ -1,20 +0,0 @@
-# Hey Emacs, this is -*- makefile-automake -*- file!
-# vim: filetype=automake
-
-AM_V_DTRACE = $(AM_V_DTRACE_@AM_V@)
-AM_V_DTRACE_ = $(AM_V_DTRACE_@AM_DEFAULT_V@)
-AM_V_DTRACE_0 = @echo "  DTRACE   $@";
-
-BUILT_SOURCES += probes.h
-CLEANFILES += probes.h probes.o
-
-probes.h: Makefile probes.d
-	$(AM_V_DTRACE)$(DTRACE) -s $(srcdir)/probes.d -h -o $@
-probes.lo: Makefile probes.d $(DTRACE_DEPS)
-	$(AM_V_DTRACE)$(LIBTOOL) --mode=compile --tag=CC $(DTRACE) -s $(srcdir)/probes.d -G -o $@ $(DTRACE_OBJS)
-
-if HAVE_DTRACE
-if !HOST_MACOS
-DTRACE_LIBADD = probes.lo
-endif
-endif

Makefile.tests

@@ -3,26 +3,15 @@
 
 unit-local: check
 
-if HAVE_CMOCKA
 TESTS = $(check_PROGRAMS)
-endif HAVE_CMOCKA
 
-LOG_COMPILER = $(top_builddir)/tests/unit-test-driver.sh
-
-AM_CFLAGS +=					\
-	-I$(top_srcdir)/tests/include		\
-	$(TEST_CFLAGS)
+LOG_COMPILER = $(builddir)/../../unit-test-driver.sh
 
 AM_CPPFLAGS +=					\
 	$(CMOCKA_CFLAGS)			\
-	-DNAMED_PLUGINDIR=\"$(pkglibdir)\"	\
+	-DNAMED_PLUGINDIR=\"$(libdir)/named\"	\
+	-DSKIPPED_TEST_EXIT_CODE=77		\
 	-DTESTS_DIR=\"$(abs_srcdir)\"
 
-LDADD +=						\
-	$(top_builddir)/tests/libtest/libtest.la	\
+LDADD +=					\
 	$(CMOCKA_LIBS)
-
-if HAVE_JEMALLOC
-AM_CFLAGS += $(JEMALLOC_CFLAGS)
-LDADD += $(JEMALLOC_LIBS)
-endif

Makefile.top

@@ -11,35 +11,20 @@ AM_CPPFLAGS =					\
 	-include $(top_builddir)/config.h	\
 	-I$(srcdir)/include
 
-AM_LDFLAGS =					\
-	$(STD_LDFLAGS)
+AM_LDFLAGS =
 LDADD =
 
-BUILT_SOURCES =
-CLEANFILES =
-
 if HOST_MACOS
 AM_LDFLAGS +=					\
 	-Wl,-flat_namespace
 endif HOST_MACOS
 
-if HAVE_JEMALLOC
-LIBISC_CFLAGS = $(JEMALLOC_CFLAGS)
-LIBISC_LIBS = $(JEMALLOC_LIBS)
-else
-LIBISC_CFLAGS =
-LIBISC_LIBS =
-endif
-
-LIBISC_CFLAGS +=						\
+LIBISC_CFLAGS =						\
 	-I$(top_srcdir)/include				\
 	-I$(top_srcdir)/lib/isc/include			\
 	-I$(top_builddir)/lib/isc/include
 
-LIBISC_LIBS += $(top_builddir)/lib/isc/libisc.la
-if HAVE_DTRACE
-LIBISC_DTRACE = $(top_builddir)/lib/isc/probes.lo
-endif
+LIBISC_LIBS = $(top_builddir)/lib/isc/libisc.la
 
 LIBDNS_CFLAGS = \
 	-I$(top_srcdir)/lib/dns/include			\
@@ -47,18 +32,18 @@ LIBDNS_CFLAGS = \
 
 LIBDNS_LIBS = \
 	$(top_builddir)/lib/dns/libdns.la
-if HAVE_DTRACE
-LIBDNS_DTRACE = $(top_builddir)/lib/dns/probes.lo
-endif
 
 LIBNS_CFLAGS = \
 	-I$(top_srcdir)/lib/ns/include
 
 LIBNS_LIBS = \
 	$(top_builddir)/lib/ns/libns.la
-if HAVE_DTRACE
-LIBNS_DTRACE = $(top_builddir)/lib/ns/probes.lo
-endif
+
+LIBIRS_CFLAGS = \
+	-I$(top_srcdir)/lib/irs/include
+
+LIBIRS_LIBS = \
+	$(top_builddir)/lib/irs/libirs.la
 
 LIBISCCFG_CFLAGS = \
 	-I$(top_srcdir)/lib/isccfg/include
@@ -71,3 +56,9 @@ LIBISCCC_CFLAGS = \
 
 LIBISCCC_LIBS = \
 	$(top_builddir)/lib/isccc/libisccc.la
+
+LIBBIND9_CFLAGS = \
+	-I$(top_srcdir)/lib/bind9/include
+
+LIBBIND9_LIBS = \
+	$(top_builddir)/lib/bind9/libbind9.la

OPTIONS.md

@@ -26,4 +26,3 @@ Some of these settings are:
 | `-DISC_MEM_TRACKLINES=0`     | Don't track memory allocations by file and line number; this improves performance but makes debugging more difficult                   |
 | `-DNAMED_RUN_PID_DIR=0`      | Create default PID files in `${localstatedir}/run` rather than `${localstatedir}/run/named/`                                           |
 | `-DNS_CLIENT_DROPPORT=0`     | Disable dropping queries from particular well-known ports                                                                              |
-| `-DOPENSSL_API_COMPAT=10100` | Build using the deprecated OpenSSL APIs so that the `engine` API is available when building with OpenSSL 3.0.0 for PKCS#11 support     |

README.md

@@ -74,9 +74,17 @@ contents of your configuration file in a non-confidential issue, it is
 advisable to obscure key secrets; this can be done automatically by
 using `named-checkconf -px`.
 
-For information about ISC's Security Vulnerability Disclosure Policy and
-information about reporting potential security issues, please see
-`SECURITY.md`.
+If you are reporting a bug that is a potential security issue, such as an
+assertion failure or other crash in `named`, please do *NOT* use GitLab to
+report it. Instead, send mail to
+[security-officer@isc.org](mailto:security-officer@isc.org) using our
+OpenPGP key to secure your message. (Information about OpenPGP and links
+to our key can be found at
+[https://www.isc.org/pgpkey](https://www.isc.org/pgpkey).) Please do not
+discuss the bug on any public mailing list.
+
+For a general overview of ISC security policies, read the Knowledgebase
+article at [https://kb.isc.org/docs/aa-00861](https://kb.isc.org/docs/aa-00861).
 
 Professional support and training for BIND are available from
 ISC. Contact us at [https://www.isc.org/contact](https://www.isc.org/contact)
@@ -117,7 +125,7 @@ including your patch as an attachment, preferably generated by
 ### <a name="build"/> Building BIND 9
 
 For information about building BIND 9, see the
-["Building BIND 9"](doc/arm/build.inc.rst) section in the BIND 9
+["Building BIND 9"](doc/arm/build.rst) section in the BIND 9
 Administrator Reference Manual.
 
 ### <a name="testing"/> Automated testing
@@ -128,7 +136,7 @@ multiple servers to run locally and communicate with each other). These
 IP addresses can be configured by running the command
 `bin/tests/system/ifconfig.sh up` as root.
 
-Some tests require Perl and the `Net::DNS` and/or `IO::Socket::IP` modules,
+Some tests require Perl and the `Net::DNS` and/or `IO::Socket::INET6` modules,
 and are skipped if these are not available. Some tests require Python
 and the `dnspython` module and are skipped if these are not available.
 See bin/tests/system/README for further details.
@@ -141,18 +149,9 @@ parallel test driver; unit tests are also run by `make check`.
 
 The *BIND 9 Administrator Reference Manual* (ARM) is included with the source
 distribution, and in .rst format, in the `doc/arm`
-directory. The HTML version is automatically generated and can
+directory. HTML and PDF versions are automatically generated and can
 be viewed at [https://bind9.readthedocs.io/en/latest/index.html](https://bind9.readthedocs.io/en/latest/index.html).
 
-The PDF version can be built by running:
-
-    cd doc/arm/
-    sphinx-build -b latex . pdf/
-    make -C pdf/ all-pdf
-
-The above requires TeX Live in order to work. The PDF will be written to
-`doc/arm/pdf/Bv9ARM.pdf`.
-
 Man pages for some of the programs in the BIND 9 distribution
 are also included in the BIND ARM.
 

SECURITY.md

@@ -1,35 +0,0 @@
-<!--
-Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-
-SPDX-License-Identifier: MPL-2.0
-
-This Source Code Form is subject to the terms of the Mozilla Public
-License, v. 2.0.  If a copy of the MPL was not distributed with this
-file, you can obtain one at https://mozilla.org/MPL/2.0/.
-
-See the COPYRIGHT file distributed with this work for additional
-information regarding copyright ownership.
--->
-# Security Policy
-
-ISC's Security Vulnerability Disclosure Policy is documented in the
-relevant [ISC Knowledgebase article][1].
-
-## Reporting possible security issues
-
-If you think you may be seeing a potential security vulnerability in
-BIND (for example, a crash with a REQUIRE, INSIST, or ASSERT failure),
-please report it immediately by [opening a confidential GitLab issue][2]
-(preferred) or emailing bind-security@isc.org.
-
-Please do not discuss undisclosed security vulnerabilities on any public
-mailing list. ISC has a long history of handling reported
-vulnerabilities promptly and effectively and we respect and acknowledge
-responsible reporters.
-
-If you have a crash, you may want to consult the Knowledgebase article
-entitled ["What to do if your BIND or DHCP server has crashed"][3].
-
-[1]: https://kb.isc.org/docs/aa-00861
-[2]: https://gitlab.isc.org/isc-projects/bind9/-/issues/new?issue[confidential]=true&issuable_template=Bug
-[3]: https://kb.isc.org/docs/aa-00340

bin/check/Makefile.am

@@ -4,7 +4,8 @@ AM_CPPFLAGS +=			\
 	$(LIBISC_CFLAGS)	\
 	$(LIBDNS_CFLAGS)	\
 	$(LIBNS_CFLAGS)		\
-	$(LIBISCCFG_CFLAGS)
+	$(LIBISCCFG_CFLAGS)	\
+	$(LIBBIND9_CFLAGS)
 
 AM_CPPFLAGS +=			\
 	-DNAMED_CONFFILE=\"${sysconfdir}/named.conf\"
@@ -20,7 +21,8 @@ LDADD +=			\
 	$(LIBISC_LIBS)		\
 	$(LIBDNS_LIBS)		\
 	$(LIBNS_LIBS)		\
-	$(LIBISCCFG_LIBS)
+	$(LIBISCCFG_LIBS)	\
+	$(LIBBIND9_LIBS)
 
 bin_PROGRAMS = named-checkconf named-checkzone
 

bin/check/check-tool.c

@@ -14,7 +14,6 @@
 /*! \file */
 
 #include <inttypes.h>
-#include <netdb.h>
 #include <stdbool.h>
 #include <stdio.h>
 
@@ -22,6 +21,8 @@
 #include <isc/log.h>
 #include <isc/mem.h>
 #include <isc/net.h>
+#include <isc/netdb.h>
+#include <isc/print.h>
 #include <isc/region.h>
 #include <isc/result.h>
 #include <isc/stdio.h>
@@ -73,7 +74,7 @@
 #define ERR_IS_MXCNAME	   6
 #define ERR_IS_SRVCNAME	   7
 
-static const char *dbtype[] = { ZONEDB_DEFAULT };
+static const char *dbtype[] = { "rbt" };
 
 int debug = 0;
 const char *journal = NULL;
@@ -88,13 +89,12 @@ bool dochecksrv = false;
 bool docheckns = false;
 #endif /* if CHECK_LOCAL */
 dns_zoneopt_t zone_options = DNS_ZONEOPT_CHECKNS | DNS_ZONEOPT_CHECKMX |
-			     DNS_ZONEOPT_CHECKDUPRR | DNS_ZONEOPT_CHECKSPF |
 			     DNS_ZONEOPT_MANYERRORS | DNS_ZONEOPT_CHECKNAMES |
 			     DNS_ZONEOPT_CHECKINTEGRITY |
 #if CHECK_SIBLING
 			     DNS_ZONEOPT_CHECKSIBLING |
 #endif /* if CHECK_SIBLING */
-			     DNS_ZONEOPT_CHECKSVCB | DNS_ZONEOPT_CHECKWILDCARD |
+			     DNS_ZONEOPT_CHECKWILDCARD |
 			     DNS_ZONEOPT_WARNMXCNAME | DNS_ZONEOPT_WARNSRVCNAME;
 
 /*
@@ -205,8 +205,7 @@ checkns(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner,
 		 */
 		cur = ai;
 		while (cur != NULL && cur->ai_canonname == NULL &&
-		       cur->ai_next != NULL)
-		{
+		       cur->ai_next != NULL) {
 			cur = cur->ai_next;
 		}
 		if (cur != NULL && cur->ai_canonname != NULL &&
@@ -408,8 +407,7 @@ checkmx(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner) {
 		 */
 		cur = ai;
 		while (cur != NULL && cur->ai_canonname == NULL &&
-		       cur->ai_next != NULL)
-		{
+		       cur->ai_next != NULL) {
 			cur = cur->ai_next;
 		}
 		if (cur != NULL && cur->ai_canonname != NULL &&
@@ -495,8 +493,7 @@ checksrv(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner) {
 		 */
 		cur = ai;
 		while (cur != NULL && cur->ai_canonname == NULL &&
-		       cur->ai_next != NULL)
-		{
+		       cur->ai_next != NULL) {
 			cur = cur->ai_next;
 		}
 		if (cur != NULL && cur->ai_canonname != NULL &&
@@ -596,7 +593,7 @@ load_zone(isc_mem_t *mctx, const char *zonename, const char *filename,
 			zonename, filename, classname);
 	}
 
-	dns_zone_create(&zone, mctx, 0);
+	CHECK(dns_zone_create(&zone, mctx));
 
 	dns_zone_settype(zone, dns_zone_primary);
 
@@ -617,7 +614,7 @@ load_zone(isc_mem_t *mctx, const char *zonename, const char *filename,
 		CHECK(dns_zone_setjournal(zone, journal));
 	}
 
-	region.base = UNCONST(classname);
+	DE_CONST(classname, region.base);
 	region.length = strlen(classname);
 	CHECK(dns_rdataclass_fromtext(&rdclass, &region));
 

bin/check/named-checkconf.c

@@ -24,6 +24,7 @@
 #include <isc/hash.h>
 #include <isc/log.h>
 #include <isc/mem.h>
+#include <isc/print.h>
 #include <isc/result.h>
 #include <isc/string.h>
 #include <isc/util.h>
@@ -36,14 +37,17 @@
 #include <dns/rootns.h>
 #include <dns/zone.h>
 
-#include <isccfg/check.h>
 #include <isccfg/grammar.h>
 #include <isccfg/namedconf.h>
 
+#include <bind9/check.h>
+
 #include "check-tool.h"
 
 static const char *program = "named-checkconf";
 
+static bool loadplugins = true;
+
 isc_log_t *logc = NULL;
 
 #define CHECK(r)                             \
@@ -54,16 +58,16 @@ isc_log_t *logc = NULL;
 	} while (0)
 
 /*% usage */
-noreturn static void
+ISC_NORETURN static void
 usage(void);
 
 static void
 usage(void) {
 	fprintf(stderr,
-		"usage: %s [-achijlvz] [-p [-x]] [-t directory] "
+		"usage: %s [-chijlvz] [-p [-x]] [-t directory] "
 		"[named.conf]\n",
 		program);
-	exit(EXIT_SUCCESS);
+	exit(1);
 }
 
 /*% directory callback */
@@ -155,7 +159,7 @@ configure_hint(const char *zfile, const char *zclass, isc_mem_t *mctx) {
 		return (ISC_R_FAILURE);
 	}
 
-	r.base = UNCONST(zclass);
+	DE_CONST(zclass, r.base);
 	r.length = strlen(zclass);
 	result = dns_rdataclass_fromtext(&rdclass, &r);
 	if (result != ISC_R_SUCCESS) {
@@ -242,8 +246,8 @@ configure_zone(const char *vclass, const char *view, const cfg_obj_t *zconfig,
 	 * Skip checks when using an alternate data source.
 	 */
 	cfg_map_get(zoptions, "database", &dbobj);
-	if (dbobj != NULL &&
-	    strcmp(ZONEDB_DEFAULT, cfg_obj_asstring(dbobj)) != 0)
+	if (dbobj != NULL && strcmp("rbt", cfg_obj_asstring(dbobj)) != 0 &&
+	    strcmp("rbt64", cfg_obj_asstring(dbobj)) != 0)
 	{
 		return (ISC_R_SUCCESS);
 	}
@@ -302,7 +306,8 @@ configure_zone(const char *vclass, const char *view, const cfg_obj_t *zconfig,
 			zone_options &= ~DNS_ZONEOPT_CHECKDUPRR;
 			zone_options &= ~DNS_ZONEOPT_CHECKDUPRRFAIL;
 		} else {
-			UNREACHABLE();
+			INSIST(0);
+			ISC_UNREACHABLE();
 		}
 	} else {
 		zone_options |= DNS_ZONEOPT_CHECKDUPRR;
@@ -321,7 +326,8 @@ configure_zone(const char *vclass, const char *view, const cfg_obj_t *zconfig,
 			zone_options &= ~DNS_ZONEOPT_CHECKMX;
 			zone_options &= ~DNS_ZONEOPT_CHECKMXFAIL;
 		} else {
-			UNREACHABLE();
+			INSIST(0);
+			ISC_UNREACHABLE();
 		}
 	} else {
 		zone_options |= DNS_ZONEOPT_CHECKMX;
@@ -351,7 +357,8 @@ configure_zone(const char *vclass, const char *view, const cfg_obj_t *zconfig,
 			zone_options |= DNS_ZONEOPT_WARNMXCNAME;
 			zone_options |= DNS_ZONEOPT_IGNOREMXCNAME;
 		} else {
-			UNREACHABLE();
+			INSIST(0);
+			ISC_UNREACHABLE();
 		}
 	} else {
 		zone_options |= DNS_ZONEOPT_WARNMXCNAME;
@@ -370,7 +377,8 @@ configure_zone(const char *vclass, const char *view, const cfg_obj_t *zconfig,
 			zone_options |= DNS_ZONEOPT_WARNSRVCNAME;
 			zone_options |= DNS_ZONEOPT_IGNORESRVCNAME;
 		} else {
-			UNREACHABLE();
+			INSIST(0);
+			ISC_UNREACHABLE();
 		}
 	} else {
 		zone_options |= DNS_ZONEOPT_WARNSRVCNAME;
@@ -393,34 +401,13 @@ configure_zone(const char *vclass, const char *view, const cfg_obj_t *zconfig,
 		} else if (strcasecmp(cfg_obj_asstring(obj), "ignore") == 0) {
 			zone_options &= ~DNS_ZONEOPT_CHECKSPF;
 		} else {
-			UNREACHABLE();
+			INSIST(0);
+			ISC_UNREACHABLE();
 		}
 	} else {
 		zone_options |= DNS_ZONEOPT_CHECKSPF;
 	}
 
-	obj = NULL;
-	if (get_maps(maps, "check-svcb", &obj)) {
-		if (cfg_obj_asboolean(obj)) {
-			zone_options |= DNS_ZONEOPT_CHECKSVCB;
-		} else {
-			zone_options &= ~DNS_ZONEOPT_CHECKSVCB;
-		}
-	} else {
-		zone_options |= DNS_ZONEOPT_CHECKSVCB;
-	}
-
-	obj = NULL;
-	if (get_maps(maps, "check-wildcard", &obj)) {
-		if (cfg_obj_asboolean(obj)) {
-			zone_options |= DNS_ZONEOPT_CHECKWILDCARD;
-		} else {
-			zone_options &= ~DNS_ZONEOPT_CHECKWILDCARD;
-		}
-	} else {
-		zone_options |= DNS_ZONEOPT_CHECKWILDCARD;
-	}
-
 	obj = NULL;
 	if (get_checknames(maps, &obj)) {
 		if (strcasecmp(cfg_obj_asstring(obj), "warn") == 0) {
@@ -433,7 +420,8 @@ configure_zone(const char *vclass, const char *view, const cfg_obj_t *zconfig,
 			zone_options &= ~DNS_ZONEOPT_CHECKNAMES;
 			zone_options &= ~DNS_ZONEOPT_CHECKNAMESFAIL;
 		} else {
-			UNREACHABLE();
+			INSIST(0);
+			ISC_UNREACHABLE();
 		}
 	} else {
 		zone_options |= DNS_ZONEOPT_CHECKNAMES;
@@ -449,7 +437,8 @@ configure_zone(const char *vclass, const char *view, const cfg_obj_t *zconfig,
 		} else if (strcasecmp(masterformatstr, "raw") == 0) {
 			masterformat = dns_masterformat_raw;
 		} else {
-			UNREACHABLE();
+			INSIST(0);
+			ISC_UNREACHABLE();
 		}
 	}
 
@@ -512,7 +501,7 @@ config_getclass(const cfg_obj_t *classobj, dns_rdataclass_t defclass,
 		*classp = defclass;
 		return (ISC_R_SUCCESS);
 	}
-	r.base = UNCONST(cfg_obj_asstring(classobj));
+	DE_CONST(cfg_obj_asstring(classobj), r.base);
 	r.length = strlen(r.base);
 	return (dns_rdataclass_fromtext(classp, &r));
 }
@@ -577,10 +566,10 @@ cleanup:
 
 static void
 output(void *closure, const char *text, int textlen) {
+	UNUSED(closure);
 	if (fwrite(text, 1, textlen, stdout) != (size_t)textlen) {
-		isc_result_t *result = closure;
 		perror("fwrite");
-		*result = ISC_R_FAILURE;
+		exit(1);
 	}
 }
 
@@ -592,21 +581,20 @@ main(int argc, char **argv) {
 	cfg_obj_t *config = NULL;
 	const char *conffile = NULL;
 	isc_mem_t *mctx = NULL;
-	isc_result_t result = ISC_R_SUCCESS;
-	bool cleanup_dst = true;
+	isc_result_t result;
+	int exit_status = 0;
 	bool load_zones = false;
 	bool list_zones = false;
 	bool print = false;
 	bool nodeprecate = false;
 	unsigned int flags = 0;
-	unsigned int checkflags = BIND_CHECK_PLUGINS | BIND_CHECK_ALGORITHMS;
 
 	isc_commandline_errprint = false;
 
 	/*
 	 * Process memory debugging argument first.
 	 */
-#define CMDLINE_FLAGS "acdhijlm:t:pvxz"
+#define CMDLINE_FLAGS "cdhijlm:t:pvxz"
 	while ((c = isc_commandline_parse(argc, argv, CMDLINE_FLAGS)) != -1) {
 		switch (c) {
 		case 'm':
@@ -633,12 +621,8 @@ main(int argc, char **argv) {
 
 	while ((c = isc_commandline_parse(argc, argv, CMDLINE_FLAGS)) != EOF) {
 		switch (c) {
-		case 'a':
-			checkflags &= ~BIND_CHECK_ALGORITHMS;
-			break;
-
 		case 'c':
-			checkflags &= ~BIND_CHECK_PLUGINS;
+			loadplugins = false;
 			break;
 
 		case 'd':
@@ -665,7 +649,7 @@ main(int argc, char **argv) {
 			if (result != ISC_R_SUCCESS) {
 				fprintf(stderr, "isc_dir_chroot: %s\n",
 					isc_result_totext(result));
-				CHECK(result);
+				exit(1);
 			}
 			break;
 
@@ -675,8 +659,7 @@ main(int argc, char **argv) {
 
 		case 'v':
 			printf("%s\n", PACKAGE_VERSION);
-			result = ISC_R_SUCCESS;
-			goto cleanup;
+			exit(0);
 
 		case 'x':
 			flags |= CFG_PRINTER_XKEY;
@@ -694,29 +677,27 @@ main(int argc, char **argv) {
 				fprintf(stderr, "%s: invalid argument -%c\n",
 					program, isc_commandline_option);
 			}
-			FALLTHROUGH;
+		/* FALLTHROUGH */
 		case 'h':
-			isc_mem_detach(&mctx);
 			usage();
 
 		default:
 			fprintf(stderr, "%s: unhandled option -%c\n", program,
 				isc_commandline_option);
-			CHECK(ISC_R_FAILURE);
+			exit(1);
 		}
 	}
 
 	if (((flags & CFG_PRINTER_XKEY) != 0) && !print) {
 		fprintf(stderr, "%s: -x cannot be used without -p\n", program);
-		CHECK(ISC_R_FAILURE);
+		exit(1);
 	}
 	if (print && list_zones) {
 		fprintf(stderr, "%s: -l cannot be used with -p\n", program);
-		CHECK(ISC_R_FAILURE);
+		exit(1);
 	}
 
 	if (isc_commandline_index + 1 < argc) {
-		isc_mem_detach(&mctx);
 		usage();
 	}
 	if (argv[isc_commandline_index] != NULL) {
@@ -726,48 +707,43 @@ main(int argc, char **argv) {
 		conffile = NAMED_CONFFILE;
 	}
 
-	CHECK(setup_logging(mctx, stdout, &logc));
+	RUNTIME_CHECK(setup_logging(mctx, stdout, &logc) == ISC_R_SUCCESS);
 
-	CHECK(dst_lib_init(mctx, NULL));
-	cleanup_dst = true;
-
-	CHECK(cfg_parser_create(mctx, logc, &parser));
+	RUNTIME_CHECK(cfg_parser_create(mctx, logc, &parser) == ISC_R_SUCCESS);
 
 	if (nodeprecate) {
 		cfg_parser_setflags(parser, CFG_PCTX_NODEPRECATED, true);
 	}
 	cfg_parser_setcallback(parser, directory_callback, NULL);
 
-	CHECK(cfg_parse_file(parser, conffile, &cfg_type_namedconf, &config));
-	CHECK(isccfg_check_namedconf(config, checkflags, logc, mctx));
-	if (load_zones || list_zones) {
-		CHECK(load_zones_fromconfig(config, mctx, list_zones));
+	if (cfg_parse_file(parser, conffile, &cfg_type_namedconf, &config) !=
+	    ISC_R_SUCCESS)
+	{
+		exit(1);
 	}
 
-	if (print) {
-		cfg_printx(config, flags, output, &result);
+	result = bind9_check_namedconf(config, loadplugins, logc, mctx);
+	if (result != ISC_R_SUCCESS) {
+		exit_status = 1;
 	}
 
-cleanup:
-	if (config != NULL) {
-		cfg_obj_destroy(parser, &config);
+	if (result == ISC_R_SUCCESS && (load_zones || list_zones)) {
+		result = load_zones_fromconfig(config, mctx, list_zones);
+		if (result != ISC_R_SUCCESS) {
+			exit_status = 1;
+		}
 	}
 
-	if (parser != NULL) {
-		cfg_parser_destroy(&parser);
+	if (print && exit_status == 0) {
+		cfg_printx(config, flags, output, NULL);
 	}
+	cfg_obj_destroy(parser, &config);
 
-	if (cleanup_dst) {
-		dst_lib_destroy();
-	}
+	cfg_parser_destroy(&parser);
 
-	if (logc != NULL) {
-		isc_log_destroy(&logc);
-	}
+	isc_log_destroy(&logc);
 
-	if (mctx != NULL) {
-		isc_mem_destroy(&mctx);
-	}
+	isc_mem_destroy(&mctx);
 
-	return (result == ISC_R_SUCCESS ? 0 : 1);
+	return (exit_status);
 }

bin/check/named-checkconf.rst

@@ -11,8 +11,6 @@
 
 .. highlight: console
 
-.. iscman:: named-checkconf
-.. program:: named-checkconf
 .. _man_named-checkconf:
 
 named-checkconf - named configuration file syntax checking tool
@@ -21,96 +19,77 @@ named-checkconf - named configuration file syntax checking tool
 Synopsis
 ~~~~~~~~
 
-:program:`named-checkconf` [**-achjlvz**] [**-p** [**-x** ]] [**-t** directory] {filename}
+:program:`named-checkconf` [**-chjlvz**] [**-p** [**-x** ]] [**-t** directory] {filename}
 
 Description
 ~~~~~~~~~~~
 
-:program:`named-checkconf` checks the syntax, but not the semantics, of a
-:iscman:`named` configuration file. The file, along with all files included by it, is parsed and checked for syntax
+``named-checkconf`` checks the syntax, but not the semantics, of a
+``named`` configuration file. The file, along with all files included by it, is parsed and checked for syntax
 errors. If no file is specified,
 |named_conf| is read by default.
 
-Note: files that :iscman:`named` reads in separate parser contexts, such as
-``rndc.conf`` or ``rndc.key``, are not automatically read by
-:program:`named-checkconf`.  Configuration errors in these files may cause
-:iscman:`named` to fail to run, even if :program:`named-checkconf` was
-successful.  However, :program:`named-checkconf` can be run on these files
-explicitly.
+Note: files that ``named`` reads in separate parser contexts, such as
+``rndc.key`` and ``bind.keys``, are not automatically read by
+``named-checkconf``. Configuration errors in these files may cause
+``named`` to fail to run, even if ``named-checkconf`` was successful.
+However, ``named-checkconf`` can be run on these files explicitly.
 
 Options
 ~~~~~~~
 
-.. option:: -a
-
-   Don't check the `dnssec-policy`'s DNSSEC key algorithms against
-   those supported by the crypto provider.  This is useful when checking
-   a `named.conf` intended to be run on another machine with possibly a
-   different set of supported DNSSEC key algorithms.
-
-.. option:: -h
-
+``-h``
    This option prints the usage summary and exits.
 
-.. option:: -j
-
-   When loading a zonefile, this option instructs :iscman:`named` to read the journal if it exists.
-
-.. option:: -l
+``-j``
+   When loading a zonefile, this option instructs ``named`` to read the journal if it exists.
 
+``-l``
    This option lists all the configured zones. Each line of output contains the zone
    name, class (e.g. IN), view, and type (e.g. primary or secondary).
 
-.. option:: -c
-
+``-c``
    This option specifies that only the "core" configuration should be checked. This suppresses the loading of
    plugin modules, and causes all parameters to ``plugin`` statements to
    be ignored.
 
-.. option:: -i
-
+``-i``
    This option ignores warnings on deprecated options.
 
-.. option:: -p
+``-p``
+   This option prints out the ``named.conf`` and included files in canonical form if
+   no errors were detected. See also the ``-x`` option.
 
-   This option prints out the :iscman:`named.conf` and included files in canonical form if
-   no errors were detected. See also the :option:`-x` option.
-
-.. option:: -t directory
-
-   This option instructs :iscman:`named` to chroot to ``directory``, so that ``include`` directives in the
+``-t directory``
+   This option instructs ``named`` to chroot to ``directory``, so that ``include`` directives in the
    configuration file are processed as if run by a similarly chrooted
-   :iscman:`named`.
+   ``named``.
 
-.. option:: -v
-
-   This option prints the version of the :program:`named-checkconf` program and exits.
-
-.. option:: -x
+``-v``
+   This option prints the version of the ``named-checkconf`` program and exits.
 
+``-x``
    When printing the configuration files in canonical form, this option obscures
    shared secrets by replacing them with strings of question marks
-   (``?``). This allows the contents of :iscman:`named.conf` and related files
+   (``?``). This allows the contents of ``named.conf`` and related files
    to be shared - for example, when submitting bug reports -
    without compromising private data. This option cannot be used without
-   :option:`-p`.
+   ``-p``.
 
-.. option:: -z
-
-   This option performs a test load of all zones of type ``primary`` found in :iscman:`named.conf`.
-
-.. option:: filename
+``-z``
+   This option performs a test load of all zones of type ``primary`` found in ``named.conf``.
 
+``filename``
    This indicates the name of the configuration file to be checked. If not specified,
    it defaults to |named_conf|.
 
 Return Values
 ~~~~~~~~~~~~~
 
-:program:`named-checkconf` returns an exit status of 1 if errors were detected
+``named-checkconf`` returns an exit status of 1 if errors were detected
 and 0 otherwise.
 
 See Also
 ~~~~~~~~
 
-:iscman:`named(8) <named>`, :iscman:`named-checkzone(8) <named-checkzone>`, BIND 9 Administrator Reference Manual.
+:manpage:`named(8)`, :manpage:`named-checkzone(8)`, BIND 9 Administrator Reference Manual.

bin/check/named-checkzone.c

@@ -17,6 +17,7 @@
 #include <stdbool.h>
 #include <stdlib.h>
 
+#include <isc/app.h>
 #include <isc/attributes.h>
 #include <isc/commandline.h>
 #include <isc/dir.h>
@@ -24,8 +25,10 @@
 #include <isc/hash.h>
 #include <isc/log.h>
 #include <isc/mem.h>
+#include <isc/print.h>
 #include <isc/result.h>
 #include <isc/string.h>
+#include <isc/task.h>
 #include <isc/timer.h>
 #include <isc/util.h>
 
@@ -62,7 +65,7 @@ static enum { progmode_check, progmode_compile } progmode;
 		}                                                             \
 	} while (0)
 
-noreturn static void
+ISC_NORETURN static void
 usage(void);
 
 static void
@@ -79,7 +82,7 @@ usage(void) {
 		"%s zonename [ (filename|-) ]\n",
 		prog_name,
 		progmode == progmode_check ? "[-o filename]" : "-o filename");
-	exit(EXIT_FAILURE);
+	exit(1);
 }
 
 static void
@@ -144,15 +147,19 @@ main(int argc, char **argv) {
 	} else if (PROGCMP("named-compilezone")) {
 		progmode = progmode_compile;
 	} else {
-		UNREACHABLE();
+		INSIST(0);
+		ISC_UNREACHABLE();
 	}
 
-	/* When compiling, disable checks by default */
+	/* Compilation specific defaults */
 	if (progmode == progmode_compile) {
-		zone_options = 0;
-		docheckmx = false;
-		docheckns = false;
-		dochecksrv = false;
+		zone_options |= (DNS_ZONEOPT_CHECKNS | DNS_ZONEOPT_FATALNS |
+				 DNS_ZONEOPT_CHECKSPF | DNS_ZONEOPT_CHECKDUPRR |
+				 DNS_ZONEOPT_CHECKNAMES |
+				 DNS_ZONEOPT_CHECKNAMESFAIL |
+				 DNS_ZONEOPT_CHECKWILDCARD);
+	} else {
+		zone_options |= (DNS_ZONEOPT_CHECKDUPRR | DNS_ZONEOPT_CHECKSPF);
 	}
 
 #define ARGCMP(X) (strcmp(isc_commandline_argument, X) == 0)
@@ -160,8 +167,8 @@ main(int argc, char **argv) {
 	isc_commandline_errprint = false;
 
 	while ((c = isc_commandline_parse(argc, argv,
-					  "c:df:hi:jJ:k:L:l:m:n:qr:s:t:o:vw:C:"
-					  "DF:M:S:T:W:")) != EOF)
+					  "c:df:hi:jJ:k:L:l:m:n:qr:s:t:o:vw:DF:"
+					  "M:S:T:W:")) != EOF)
 	{
 		switch (c) {
 		case 'c':
@@ -206,7 +213,7 @@ main(int argc, char **argv) {
 			} else {
 				fprintf(stderr, "invalid argument to -i: %s\n",
 					isc_commandline_argument);
-				exit(EXIT_FAILURE);
+				exit(1);
 			}
 			break;
 
@@ -240,7 +247,7 @@ main(int argc, char **argv) {
 			} else {
 				fprintf(stderr, "invalid argument to -k: %s\n",
 					isc_commandline_argument);
-				exit(EXIT_FAILURE);
+				exit(1);
 			}
 			break;
 
@@ -251,7 +258,7 @@ main(int argc, char **argv) {
 			if (*endp != '\0') {
 				fprintf(stderr, "source serial number "
 						"must be numeric");
-				exit(EXIT_FAILURE);
+				exit(1);
 			}
 			break;
 
@@ -262,7 +269,7 @@ main(int argc, char **argv) {
 			if (*endp != '\0') {
 				fprintf(stderr, "maximum TTL "
 						"must be numeric");
-				exit(EXIT_FAILURE);
+				exit(1);
 			}
 			break;
 
@@ -279,7 +286,7 @@ main(int argc, char **argv) {
 			} else {
 				fprintf(stderr, "invalid argument to -n: %s\n",
 					isc_commandline_argument);
-				exit(EXIT_FAILURE);
+				exit(1);
 			}
 			break;
 
@@ -296,7 +303,7 @@ main(int argc, char **argv) {
 			} else {
 				fprintf(stderr, "invalid argument to -m: %s\n",
 					isc_commandline_argument);
-				exit(EXIT_FAILURE);
+				exit(1);
 			}
 			break;
 
@@ -321,7 +328,7 @@ main(int argc, char **argv) {
 			} else {
 				fprintf(stderr, "invalid argument to -r: %s\n",
 					isc_commandline_argument);
-				exit(EXIT_FAILURE);
+				exit(1);
 			}
 			break;
 
@@ -334,7 +341,7 @@ main(int argc, char **argv) {
 				fprintf(stderr,
 					"unknown or unsupported style: %s\n",
 					isc_commandline_argument);
-				exit(EXIT_FAILURE);
+				exit(1);
 			}
 			break;
 
@@ -344,30 +351,18 @@ main(int argc, char **argv) {
 				fprintf(stderr, "isc_dir_chroot: %s: %s\n",
 					isc_commandline_argument,
 					isc_result_totext(result));
-				exit(EXIT_FAILURE);
+				exit(1);
 			}
 			break;
 
 		case 'v':
 			printf("%s\n", PACKAGE_VERSION);
-			exit(EXIT_SUCCESS);
+			exit(0);
 
 		case 'w':
 			workdir = isc_commandline_argument;
 			break;
 
-		case 'C':
-			if (ARGCMP("check-svcb:fail")) {
-				zone_options |= DNS_ZONEOPT_CHECKSVCB;
-			} else if (ARGCMP("check-svcb:ignore")) {
-				zone_options &= ~DNS_ZONEOPT_CHECKSVCB;
-			} else {
-				fprintf(stderr, "invalid argument to -C: %s\n",
-					isc_commandline_argument);
-				exit(EXIT_FAILURE);
-			}
-			break;
-
 		case 'D':
 			dumpzone++;
 			break;
@@ -385,7 +380,7 @@ main(int argc, char **argv) {
 			} else {
 				fprintf(stderr, "invalid argument to -M: %s\n",
 					isc_commandline_argument);
-				exit(EXIT_FAILURE);
+				exit(1);
 			}
 			break;
 
@@ -402,7 +397,7 @@ main(int argc, char **argv) {
 			} else {
 				fprintf(stderr, "invalid argument to -S: %s\n",
 					isc_commandline_argument);
-				exit(EXIT_FAILURE);
+				exit(1);
 			}
 			break;
 
@@ -414,7 +409,7 @@ main(int argc, char **argv) {
 			} else {
 				fprintf(stderr, "invalid argument to -T: %s\n",
 					isc_commandline_argument);
-				exit(EXIT_FAILURE);
+				exit(1);
 			}
 			break;
 
@@ -431,14 +426,14 @@ main(int argc, char **argv) {
 				fprintf(stderr, "%s: invalid argument -%c\n",
 					prog_name, isc_commandline_option);
 			}
-			FALLTHROUGH;
+		/* FALLTHROUGH */
 		case 'h':
 			usage();
 
 		default:
 			fprintf(stderr, "%s: unhandled option -%c\n", prog_name,
 				isc_commandline_option);
-			exit(EXIT_FAILURE);
+			exit(1);
 		}
 	}
 
@@ -447,7 +442,7 @@ main(int argc, char **argv) {
 		if (result != ISC_R_SUCCESS) {
 			fprintf(stderr, "isc_dir_chdir: %s: %s\n", workdir,
 				isc_result_totext(result));
-			exit(EXIT_FAILURE);
+			exit(1);
 		}
 	}
 
@@ -463,7 +458,7 @@ main(int argc, char **argv) {
 		} else {
 			fprintf(stderr, "unknown file format: %s\n",
 				inputformatstr);
-			exit(EXIT_FAILURE);
+			exit(1);
 		}
 	}
 
@@ -478,15 +473,14 @@ main(int argc, char **argv) {
 			outputformat = dns_masterformat_raw;
 			rawversion = strtol(outputformatstr + 4, &end, 10);
 			if (end == outputformatstr + 4 || *end != '\0' ||
-			    rawversion > 1U)
-			{
+			    rawversion > 1U) {
 				fprintf(stderr, "unknown raw format version\n");
-				exit(EXIT_FAILURE);
+				exit(1);
 			}
 		} else {
 			fprintf(stderr, "unknown file format: %s\n",
 				outputformatstr);
-			exit(EXIT_FAILURE);
+			exit(1);
 		}
 	}
 
@@ -518,8 +512,7 @@ main(int argc, char **argv) {
 	}
 
 	if (argc - isc_commandline_index < 1 ||
-	    argc - isc_commandline_index > 2)
-	{
+	    argc - isc_commandline_index > 2) {
 		usage();
 	}
 

bin/check/named-checkzone.rst

@@ -11,74 +11,60 @@
 
 .. highlight: console
 
-.. BEWARE: Do not forget to edit also named-compilezone.rst!
-
-.. iscman:: named-checkzone
-.. program:: named-checkzone
-.. _man_named-checkzone:
-
-named-checkzone - zone file validation tool
--------------------------------------------
+named-checkzone, named-compilezone - zone file validity checking or converting tool
+-----------------------------------------------------------------------------------
 
 Synopsis
 ~~~~~~~~
 
-:program:`named-checkzone` [**-d**] [**-h**] [**-j**] [**-q**] [**-v**] [**-c** class] [**-C** mode] [**-f** format] [**-F** format] [**-J** filename] [**-i** mode] [**-k** mode] [**-m** mode] [**-M** mode] [**-n** mode] [**-l** ttl] [**-L** serial] [**-o** filename] [**-r** mode] [**-s** style] [**-S** mode] [**-t** directory] [**-T** mode] [**-w** directory] [**-D**] [**-W** mode] {zonename} {filename}
+:program:`named-checkzone` [**-d**] [**-h**] [**-j**] [**-q**] [**-v**] [**-c** class] [**-f** format] [**-F** format] [**-J** filename] [**-i** mode] [**-k** mode] [**-m** mode] [**-M** mode] [**-n** mode] [**-l** ttl] [**-L** serial] [**-o** filename] [**-r** mode] [**-s** style] [**-S** mode] [**-t** directory] [**-T** mode] [**-w** directory] [**-D**] [**-W** mode] {zonename} {filename}
+
+:program:`named-compilezone` [**-d**] [**-j**] [**-q**] [**-v**] [**-c** class] [**-C** mode] [**-f** format] [**-F** format] [**-J** filename] [**-i** mode] [**-k** mode] [**-m** mode] [**-n** mode] [**-l** ttl] [**-L** serial] [**-r** mode] [**-s** style] [**-t** directory] [**-T** mode] [**-w** directory] [**-D**] [**-W** mode] {**-o** filename} {zonename} {filename}
 
 Description
 ~~~~~~~~~~~
 
-:program:`named-checkzone` checks the syntax and integrity of a zone file. It
-performs the same checks as :iscman:`named` does when loading a zone. This
-makes :program:`named-checkzone` useful for checking zone files before
+``named-checkzone`` checks the syntax and integrity of a zone file. It
+performs the same checks as ``named`` does when loading a zone. This
+makes ``named-checkzone`` useful for checking zone files before
 configuring them into a name server.
 
+``named-compilezone`` is similar to ``named-checkzone``, but it always
+dumps the zone contents to a specified file in a specified format.
+It also applies stricter check levels by default, since the
+dump output is used as an actual zone file loaded by ``named``.
+When manually specified otherwise, the check levels must at least be as
+strict as those specified in the ``named`` configuration file.
+
 Options
 ~~~~~~~
 
-.. option:: -d
-
+``-d``
    This option enables debugging.
 
-.. option:: -h
-
+``-h``
    This option prints the usage summary and exits.
 
-.. option:: -q
-
+``-q``
    This option sets quiet mode, which only sets an exit code to indicate
    successful or failed completion.
 
-.. option:: -v
+``-v``
+   This option prints the version of the ``named-checkzone`` program and exits.
 
-   This option prints the version of the :program:`named-checkzone` program and exits.
-
-.. option:: -j
-
-   When loading a zone file, this option tells :iscman:`named` to read the journal if it exists. The journal
+``-j``
+   When loading a zone file, this option tells ``named`` to read the journal if it exists. The journal
    file name is assumed to be the zone file name with the
    string ``.jnl`` appended.
 
-.. option:: -J filename
-
-   When loading the zone file, this option tells :iscman:`named` to read the journal from the given file, if
-   it exists. This implies :option:`-j`.
-
-.. option:: -c class
+``-J filename``
+   When loading the zone file, this option tells ``named`` to read the journal from the given file, if
+   it exists. This implies ``-j``.
 
+``-c class``
    This option specifies the class of the zone. If not specified, ``IN`` is assumed.
 
-.. option:: -C mode
-
-   This option controls check mode on zone files when loading.
-   Possible modes are ``check-svcb:fail`` and ``check-svcb:ignore``.
-
-   ``check-svcb:fail`` turns on additional checks on ``_dns`` SVCB
-   records and ``check-svcb:ignore`` disables these checks.  The
-   default is ``check-svcb:fail``.
-
-.. option:: -i mode
-
+``-i mode``
    This option performs post-load zone integrity checks. Possible modes are
    ``full`` (the default), ``full-sibling``, ``local``,
    ``local-sibling``, and ``none``.
@@ -104,128 +90,113 @@ Options
 
    Mode ``none`` disables the checks.
 
-.. option:: -f format
-
+``-f format``
    This option specifies the format of the zone file. Possible formats are
    ``text`` (the default), and ``raw``.
 
-.. option:: -F format
-
+``-F format``
    This option specifies the format of the output file specified. For
-   :program:`named-checkzone`, this does not have any effect unless it dumps
+   ``named-checkzone``, this does not have any effect unless it dumps
    the zone contents.
 
    Possible formats are ``text`` (the default), which is the standard
    textual representation of the zone, and ``raw`` and ``raw=N``, which
-   store the zone in a binary format for rapid loading by :iscman:`named`.
+   store the zone in a binary format for rapid loading by ``named``.
    ``raw=N`` specifies the format version of the raw zone file: if ``N`` is
-   0, the raw file can be read by any version of :iscman:`named`; if N is 1, the
+   0, the raw file can be read by any version of ``named``; if N is 1, the
    file can only be read by release 9.9.0 or higher. The default is 1.
 
-.. option:: -k mode
-
+``-k mode``
    This option performs ``check-names`` checks with the specified failure mode.
-   Possible modes are ``fail``, ``warn`` (the default), and ``ignore``.
-
-.. option:: -l ttl
+   Possible modes are ``fail`` (the default for ``named-compilezone``),
+   ``warn`` (the default for ``named-checkzone``), and ``ignore``.
 
+``-l ttl``
    This option sets a maximum permissible TTL for the input file. Any record with a
    TTL higher than this value causes the zone to be rejected. This
-   is similar to using the ``max-zone-ttl`` option in :iscman:`named.conf`.
-
-.. option:: -L serial
+   is similar to using the ``max-zone-ttl`` option in ``named.conf``.
 
+``-L serial``
    When compiling a zone to ``raw`` format, this option sets the "source
    serial" value in the header to the specified serial number. This is
    expected to be used primarily for testing purposes.
 
-.. option:: -m mode
-
+``-m mode``
    This option specifies whether MX records should be checked to see if they are
    addresses. Possible modes are ``fail``, ``warn`` (the default), and
    ``ignore``.
 
-.. option:: -M mode
-
+``-M mode``
    This option checks whether a MX record refers to a CNAME. Possible modes are
    ``fail``, ``warn`` (the default), and ``ignore``.
 
-.. option:: -n mode
-
+``-n mode``
    This option specifies whether NS records should be checked to see if they are
-   addresses. Possible modes are ``fail``, ``warn`` (the default), and ``ignore``.
-
-.. option:: -o filename
+   addresses. Possible modes are ``fail`` (the default for
+   ``named-compilezone``), ``warn`` (the default for ``named-checkzone``),
+   and ``ignore``.
 
+``-o filename``
    This option writes the zone output to ``filename``. If ``filename`` is ``-``, then
-   the zone output is written to standard output.
-
-.. option:: -r mode
+   the zone output is written to standard output. This is mandatory for ``named-compilezone``.
 
+``-r mode``
    This option checks for records that are treated as different by DNSSEC but are
    semantically equal in plain DNS. Possible modes are ``fail``,
    ``warn`` (the default), and ``ignore``.
 
-.. option:: -s style
-
+``-s style``
    This option specifies the style of the dumped zone file. Possible styles are
    ``full`` (the default) and ``relative``. The ``full`` format is most
    suitable for processing automatically by a separate script.
    The relative format is more human-readable and is thus
-   suitable for editing by hand. This does not have any effect unless it dumps
-   the zone contents. It also does not have any meaning if the output format
-   is not text.
-
-.. option:: -S mode
+   suitable for editing by hand. For ``named-checkzone``, this does not
+   have any effect unless it dumps the zone contents. It also does not
+   have any meaning if the output format is not text.
 
+``-S mode``
    This option checks whether an SRV record refers to a CNAME. Possible modes are
    ``fail``, ``warn`` (the default), and ``ignore``.
 
-.. option:: -t directory
-
-   This option tells :iscman:`named` to chroot to ``directory``, so that ``include`` directives in the
+``-t directory``
+   This option tells ``named`` to chroot to ``directory``, so that ``include`` directives in the
    configuration file are processed as if run by a similarly chrooted
-   :iscman:`named`.
-
-.. option:: -T mode
+   ``named``.
 
+``-T mode``
    This option checks whether Sender Policy Framework (SPF) records exist and issues a
    warning if an SPF-formatted TXT record is not also present. Possible
    modes are ``warn`` (the default) and ``ignore``.
 
-.. option:: -w directory
-
-   This option instructs :iscman:`named` to chdir to ``directory``, so that relative filenames in master file
+``-w directory``
+   This option instructs ``named`` to chdir to ``directory``, so that relative filenames in master file
    ``$INCLUDE`` directives work. This is similar to the directory clause in
-   :iscman:`named.conf`.
+   ``named.conf``.
 
-.. option:: -D
-
-   This option dumps the zone file in canonical format.
-
-.. option:: -W mode
+``-D``
+   This option dumps the zone file in canonical format. This is always enabled for
+   ``named-compilezone``.
 
+``-W mode``
    This option specifies whether to check for non-terminal wildcards. Non-terminal
    wildcards are almost always the result of a failure to understand the
-   wildcard matching algorithm (:rfc:`4592`). Possible modes are ``warn``
+   wildcard matching algorithm (:rfc:`1034`). Possible modes are ``warn``
    (the default) and ``ignore``.
 
-.. option:: zonename
-
+``zonename``
    This indicates the domain name of the zone being checked.
 
-.. option:: filename
-
+``filename``
    This is the name of the zone file.
 
 Return Values
 ~~~~~~~~~~~~~
 
-:program:`named-checkzone` returns an exit status of 1 if errors were detected
+``named-checkzone`` returns an exit status of 1 if errors were detected
 and 0 otherwise.
 
 See Also
 ~~~~~~~~
 
-:iscman:`named(8) <named>`, :iscman:`named-checkconf(8) <named-checkconf>`, :iscman:`named-compilezone(8) <named-compilezone>`, :rfc:`1035`, BIND 9 Administrator Reference
+:manpage:`named(8)`, :manpage:`named-checkconf(8)`, :rfc:`1035`, BIND 9 Administrator Reference
 Manual.

bin/check/named-compilezone.rst

@@ -1,239 +0,0 @@
-.. Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-..
-.. SPDX-License-Identifier: MPL-2.0
-..
-.. This Source Code Form is subject to the terms of the Mozilla Public
-.. License, v. 2.0.  If a copy of the MPL was not distributed with this
-.. file, you can obtain one at https://mozilla.org/MPL/2.0/.
-..
-.. See the COPYRIGHT file distributed with this work for additional
-.. information regarding copyright ownership.
-
-.. highlight: console
-
-.. BEWARE: Do not forget to edit also named-checkzone.rst!
-
-.. iscman:: named-compilezone
-.. program:: named-compilezone
-.. _man_named-compilezone:
-
-named-compilezone - zone file converting tool
----------------------------------------------
-
-Synopsis
-~~~~~~~~
-
-:program:`named-compilezone` [**-d**] [**-h**] [**-j**] [**-q**] [**-v**] [**-c** class] [**-C** mode] [**-f** format] [**-F** format] [**-J** filename] [**-i** mode] [**-k** mode] [**-m** mode] [**-M** mode] [**-n** mode] [**-l** ttl] [**-L** serial] [**-r** mode] [**-s** style] [**-S** mode] [**-t** directory] [**-T** mode] [**-w** directory] [**-D**] [**-W** mode] {**-o** filename} {zonename} {filename}
-
-Description
-~~~~~~~~~~~
-
-:program:`named-compilezone` checks the syntax and integrity of a zone file,
-and dumps the zone contents to a specified file in a specified format.
-
-Unlike :program:`named-checkzone`, zone contents are not strictly checked
-by default. If the output is to be used as an actual zone file to be loaded
-by :iscman:`named`, then the check levels should be manually configured to
-be at least as strict as those specified in the :iscman:`named` configuration
-file.
-
-Running :program:`named-checkzone` on the input prior to compiling will
-ensure that the zone compiles with the default requirements of
-:iscman:`named`.
-
-Options
-~~~~~~~
-
-.. option:: -d
-
-   This option enables debugging.
-
-.. option:: -h
-
-   This option prints the usage summary and exits.
-
-.. option:: -q
-
-   This option sets quiet mode, which only sets an exit code to indicate
-   successful or failed completion.
-
-.. option:: -v
-
-   This option prints the version of the :iscman:`named-checkzone` program and exits.
-
-.. option:: -j
-
-   When loading a zone file, this option tells :iscman:`named` to read the journal if it exists. The journal
-   file name is assumed to be the zone file name with the
-   string ``.jnl`` appended.
-
-.. option:: -J filename
-
-   When loading the zone file, this option tells :iscman:`named` to read the journal from the given file, if
-   it exists. This implies :option:`-j`.
-
-.. option:: -c class
-
-   This option specifies the class of the zone. If not specified, ``IN`` is assumed.
-
-.. option:: -C mode
-
-   This option controls check mode on zone files when loading.
-   Possible modes are ``check-svcb:fail`` and ``check-svcb:ignore``.
-
-   ``check-svcb:fail`` turns on additional checks on ``_dns`` SVCB
-   records and ``check-svcb:ignore`` disables these checks.  The
-   default is ``check-svcb:ignore``.
-
-.. option:: -i mode
-
-   This option performs post-load zone integrity checks. Possible modes are
-   ``full``, ``full-sibling``, ``local``,
-   ``local-sibling``, and ``none`` (the default).
-
-   Mode ``full`` checks that MX records refer to A or AAAA records
-   (both in-zone and out-of-zone hostnames). Mode ``local`` only
-   checks MX records which refer to in-zone hostnames.
-
-   Mode ``full`` checks that SRV records refer to A or AAAA records
-   (both in-zone and out-of-zone hostnames). Mode ``local`` only
-   checks SRV records which refer to in-zone hostnames.
-
-   Mode ``full`` checks that delegation NS records refer to A or AAAA
-   records (both in-zone and out-of-zone hostnames). It also checks that
-   glue address records in the zone match those advertised by the child.
-   Mode ``local`` only checks NS records which refer to in-zone
-   hostnames or verifies that some required glue exists, i.e., when the
-   name server is in a child zone.
-
-   Modes ``full-sibling`` and ``local-sibling`` disable sibling glue
-   checks, but are otherwise the same as ``full`` and ``local``,
-   respectively.
-
-   Mode ``none`` disables the checks.
-
-.. option:: -f format
-
-   This option specifies the format of the zone file. Possible formats are
-   ``text`` (the default), and ``raw``.
-
-.. option:: -F format
-
-   This option specifies the format of the output file specified. For
-   :iscman:`named-checkzone`, this does not have any effect unless it dumps
-   the zone contents.
-
-   Possible formats are ``text`` (the default), which is the standard
-   textual representation of the zone, and ``raw`` and ``raw=N``, which
-   store the zone in a binary format for rapid loading by :iscman:`named`.
-   ``raw=N`` specifies the format version of the raw zone file: if ``N`` is
-   0, the raw file can be read by any version of :iscman:`named`; if N is 1, the
-   file can only be read by release 9.9.0 or higher. The default is 1.
-
-.. option:: -k mode
-
-   This option performs ``check-names`` checks with the specified failure mode.
-   Possible modes are ``fail``, ``warn``, and ``ignore`` (the default).
-
-.. option:: -l ttl
-
-   This option sets a maximum permissible TTL for the input file. Any record with a
-   TTL higher than this value causes the zone to be rejected. This
-   is similar to using the ``max-zone-ttl`` option in :iscman:`named.conf`.
-
-.. option:: -L serial
-
-   When compiling a zone to ``raw`` format, this option sets the "source
-   serial" value in the header to the specified serial number. This is
-   expected to be used primarily for testing purposes.
-
-.. option:: -m mode
-
-   This option specifies whether MX records should be checked to see if they are
-   addresses. Possible modes are ``fail``, ``warn``, and
-   ``ignore`` (the default).
-
-.. option:: -M mode
-
-   This option checks whether a MX record refers to a CNAME. Possible modes are
-   ``fail``, ``warn``, and ``ignore`` (the default).
-
-.. option:: -n mode
-
-   This option specifies whether NS records should be checked to see if they are
-   addresses. Possible modes are ``fail``, ``warn``,  and
-   ``ignore`` (the default).
-
-.. option:: -o filename
-
-   This option writes the zone output to ``filename``. If ``filename`` is ``-``, then
-   the zone output is written to standard output. This is mandatory for :program:`named-compilezone`.
-
-.. option:: -r mode
-
-   This option checks for records that are treated as different by DNSSEC but are
-   semantically equal in plain DNS. Possible modes are ``fail``,
-   ``warn``, and ``ignore`` (the default).
-
-.. option:: -s style
-
-   This option specifies the style of the dumped zone file. Possible styles are
-   ``full`` (the default) and ``relative``. The ``full`` format is most
-   suitable for processing automatically by a separate script.
-   The relative format is more human-readable and is thus
-   suitable for editing by hand.
-
-.. option:: -S mode
-
-   This option checks whether an SRV record refers to a CNAME. Possible modes are
-   ``fail``, ``warn``, and ``ignore`` (the default).
-
-.. option:: -t directory
-
-   This option tells :iscman:`named` to chroot to ``directory``, so that ``include`` directives in the
-   configuration file are processed as if run by a similarly chrooted
-   :iscman:`named`.
-
-.. option:: -T mode
-
-   This option checks whether Sender Policy Framework (SPF) records exist and issues a
-   warning if an SPF-formatted TXT record is not also present. Possible
-   modes are ``warn`` and ``ignore`` (the default).
-
-.. option:: -w directory
-
-   This option instructs :iscman:`named` to chdir to ``directory``, so that relative filenames in master file
-   ``$INCLUDE`` directives work. This is similar to the directory clause in
-   :iscman:`named.conf`.
-
-.. option:: -D
-
-   This option dumps the zone file in canonical format. This is always enabled for
-   :program:`named-compilezone`.
-
-.. option:: -W mode
-
-   This option specifies whether to check for non-terminal wildcards. Non-terminal
-   wildcards are almost always the result of a failure to understand the
-   wildcard matching algorithm (:rfc:`4592`). Possible modes are ``warn``
-   and ``ignore`` (the default).
-
-.. option:: zonename
-
-   This indicates the domain name of the zone being checked.
-
-.. option:: filename
-
-   This is the name of the zone file.
-
-Return Values
-~~~~~~~~~~~~~
-
-:program:`named-compilezone` returns an exit status of 1 if errors were detected
-and 0 otherwise.
-
-See Also
-~~~~~~~~
-
-:iscman:`named(8) <named>`, :iscman:`named-checkconf(8) <named-checkconf>`, :iscman:`named-checkzone(8) <named-checkzone>`, :rfc:`1035`,
-BIND 9 Administrator Reference Manual.

bin/confgen/ddns-confgen.rst

@@ -1,96 +0,0 @@
-.. Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-..
-.. SPDX-License-Identifier: MPL-2.0
-..
-.. This Source Code Form is subject to the terms of the Mozilla Public
-.. License, v. 2.0.  If a copy of the MPL was not distributed with this
-.. file, you can obtain one at https://mozilla.org/MPL/2.0/.
-..
-.. See the COPYRIGHT file distributed with this work for additional
-.. information regarding copyright ownership.
-
-.. highlight: console
-
-.. BEWARE: Do not forget to edit also tsig-keygen.rst!
-
-.. iscman:: ddns-confgen
-.. program:: ddns-confgen
-.. _man_ddns-confgen:
-
-ddns-confgen - TSIG key generation tool
----------------------------------------
-
-Synopsis
-~~~~~~~~
-:program:`ddns-confgen` [**-a** algorithm] [**-h**] [**-k** keyname] [**-q**] [**-s** name] [**-z** zone]
-
-Description
-~~~~~~~~~~~
-
-:program:`ddns-confgen` is an utility that generates keys for use in TSIG signing.
-The resulting keys can be used, for example, to secure dynamic DNS updates
-to a zone, or for the :iscman:`rndc` command channel.
-
-The key name can specified using :option:`-k` parameter and defaults to ``ddns-key``.
-The generated key is accompanied by configuration text and instructions that
-can be used with :iscman:`nsupdate` and :iscman:`named` when setting up dynamic DNS,
-including an example ``update-policy`` statement.
-(This usage is similar to the :iscman:`rndc-confgen` command for setting up
-command-channel security.)
-
-Note that :iscman:`named` itself can configure a local DDNS key for use with
-:option:`nsupdate -l`; it does this when a zone is configured with
-``update-policy local;``. :program:`ddns-confgen` is only needed when a more
-elaborate configuration is required: for instance, if :iscman:`nsupdate` is to
-be used from a remote system.
-
-Options
-~~~~~~~
-
-.. option:: -a algorithm
-
-   This option specifies the algorithm to use for the TSIG key. Available
-   choices are: hmac-md5, hmac-sha1, hmac-sha224, hmac-sha256, hmac-sha384,
-   and hmac-sha512. The default is hmac-sha256. Options are
-   case-insensitive, and the "hmac-" prefix may be omitted.
-
-.. option:: -h
-
-   This option prints a short summary of options and arguments.
-
-.. option:: -k keyname
-
-   This option specifies the key name of the DDNS authentication key. The
-   default is ``ddns-key`` when neither the :option:`-s` nor :option:`-z` option is
-   specified; otherwise, the default is ``ddns-key`` as a separate label
-   followed by the argument of the option, e.g., ``ddns-key.example.com.``
-   The key name must have the format of a valid domain name, consisting of
-   letters, digits, hyphens, and periods.
-
-.. option:: -q
-
-   This option enables quiet mode, which prints only the key, with no
-   explanatory text or usage examples. This is essentially identical to
-   :iscman:`tsig-keygen`.
-
-.. option:: -s name
-
-   This option generates a configuration example to allow dynamic updates
-   of a single hostname. The example :iscman:`named.conf` text shows how to set
-   an update policy for the specified name using the "name" nametype. The
-   default key name is ``ddns-key.name``. Note that the "self" nametype
-   cannot be used, since the name to be updated may differ from the key
-   name. This option cannot be used with the :option:`-z` option.
-
-.. option:: -z zone
-
-   This option generates a configuration example to allow
-   dynamic updates of a zone. The example :iscman:`named.conf` text shows how
-   to set an update policy for the specified zone using the "zonesub"
-   nametype, allowing updates to all subdomain names within that zone.
-   This option cannot be used with the :option:`-s` option.
-
-See Also
-~~~~~~~~
-
-:iscman:`nsupdate(1) <nsupdate>`, :iscman:`named.conf(5) <named.conf>`, :iscman:`named(8) <named>`, BIND 9 Administrator Reference Manual.

bin/confgen/keygen.c

@@ -21,6 +21,7 @@
 #include <isc/buffer.h>
 #include <isc/file.h>
 #include <isc/mem.h>
+#include <isc/print.h>
 #include <isc/result.h>
 #include <isc/string.h>
 
@@ -33,6 +34,29 @@
 
 #include "util.h"
 
+/*%
+ * Convert algorithm type to string.
+ */
+const char *
+alg_totext(dns_secalg_t alg) {
+	switch (alg) {
+	case DST_ALG_HMACMD5:
+		return ("hmac-md5");
+	case DST_ALG_HMACSHA1:
+		return ("hmac-sha1");
+	case DST_ALG_HMACSHA224:
+		return ("hmac-sha224");
+	case DST_ALG_HMACSHA256:
+		return ("hmac-sha256");
+	case DST_ALG_HMACSHA384:
+		return ("hmac-sha384");
+	case DST_ALG_HMACSHA512:
+		return ("hmac-sha512");
+	default:
+		return ("(unknown)");
+	}
+}
+
 /*%
  * Convert string to algorithm type.
  */
@@ -124,7 +148,7 @@ generate_key(isc_mem_t *mctx, dns_secalg_t alg, int keysize,
 
 	DO("generate key",
 	   dst_key_generate(dns_rootname, alg, keysize, 0, 0, DNS_KEYPROTO_ANY,
-			    dns_rdataclass_in, NULL, mctx, &key, NULL));
+			    dns_rdataclass_in, mctx, &key, NULL));
 
 	isc_buffer_init(&key_rawbuffer, &key_rawsecret, sizeof(key_rawsecret));
 
@@ -151,7 +175,7 @@ void
 write_key_file(const char *keyfile, const char *user, const char *keyname,
 	       isc_buffer_t *secret, dns_secalg_t alg) {
 	isc_result_t result;
-	const char *algname = dst_hmac_algorithm_totext(alg);
+	const char *algname = alg_totext(alg);
 	FILE *fd = NULL;
 
 	DO("create keyfile", isc_file_safecreate(keyfile, &fd));

bin/confgen/rndc-confgen.c

@@ -34,6 +34,7 @@
 #include <isc/file.h>
 #include <isc/mem.h>
 #include <isc/net.h>
+#include <isc/print.h>
 #include <isc/result.h>
 #include <isc/string.h>
 #include <isc/time.h>
@@ -60,7 +61,7 @@ bool verbose = false;
 
 const char *keyfile, *keydef;
 
-noreturn static void
+ISC_NORETURN static void
 usage(int status);
 
 static void
@@ -146,8 +147,7 @@ main(int argc, char **argv) {
 			keyfile = isc_commandline_argument;
 			break;
 		case 'h':
-			usage(EXIT_SUCCESS);
-			break;
+			usage(0);
 		case 'k':
 		case 'y': /* Compatible with rndc -y. */
 			keyname = isc_commandline_argument;
@@ -193,15 +193,15 @@ main(int argc, char **argv) {
 			if (isc_commandline_option != '?') {
 				fprintf(stderr, "%s: invalid argument -%c\n",
 					program, isc_commandline_option);
-				usage(EXIT_FAILURE);
+				usage(1);
 			} else {
-				usage(EXIT_SUCCESS);
+				usage(0);
 			}
 			break;
 		default:
 			fprintf(stderr, "%s: unhandled option -%c\n", program,
 				isc_commandline_option);
-			exit(EXIT_FAILURE);
+			exit(1);
 		}
 	}
 
@@ -210,7 +210,7 @@ main(int argc, char **argv) {
 	POST(argv);
 
 	if (argc > 0) {
-		usage(EXIT_FAILURE);
+		usage(1);
 	}
 
 	if (alg == DST_ALG_HMACMD5) {
@@ -222,7 +222,7 @@ main(int argc, char **argv) {
 	if (keysize < 0) {
 		keysize = alg_bits(alg);
 	}
-	algname = dst_hmac_algorithm_totext(alg);
+	algname = alg_totext(alg);
 
 	isc_mem_create(&mctx);
 	isc_buffer_init(&key_txtbuffer, &key_txtsecret, sizeof(key_txtsecret));

bin/confgen/rndc-confgen.rst

@@ -11,8 +11,6 @@
 
 .. highlight: console
 
-.. iscman:: rndc-confgen
-.. program:: rndc-confgen
 .. _man_rndc-confgen:
 
 rndc-confgen - rndc key generation tool
@@ -26,96 +24,85 @@ Synopsis
 Description
 ~~~~~~~~~~~
 
-:program:`rndc-confgen` generates configuration files for :iscman:`rndc`. It can be
-used as a convenient alternative to writing the :iscman:`rndc.conf` file and
-the corresponding ``controls`` and ``key`` statements in :iscman:`named.conf`
-by hand. Alternatively, it can be run with the :option:`-a` option to set up a
-``rndc.key`` file and avoid the need for a :iscman:`rndc.conf` file and a
+``rndc-confgen`` generates configuration files for ``rndc``. It can be
+used as a convenient alternative to writing the ``rndc.conf`` file and
+the corresponding ``controls`` and ``key`` statements in ``named.conf``
+by hand. Alternatively, it can be run with the ``-a`` option to set up a
+``rndc.key`` file and avoid the need for a ``rndc.conf`` file and a
 ``controls`` statement altogether.
 
 Options
 ~~~~~~~
 
-.. option:: -a
-
-   This option sets automatic :iscman:`rndc` configuration, which creates a file
-   |rndc_key| that is read by both :iscman:`rndc` and :iscman:`named` on startup.
+``-a``
+   This option sets automatic ``rndc`` configuration, which creates a file
+   |rndc_key| that is read by both ``rndc`` and ``named`` on startup.
    The ``rndc.key`` file defines a default command channel and
-   authentication key allowing :iscman:`rndc` to communicate with :iscman:`named` on
+   authentication key allowing ``rndc`` to communicate with ``named`` on
    the local host with no further configuration.
 
    If a more elaborate configuration than that generated by
-   :option:`rndc-confgen -a` is required, for example if rndc is to be used
-   remotely, run :program:`rndc-confgen` without the :option:`-a` option
-   and set up :iscman:`rndc.conf` and :iscman:`named.conf` as directed.
-
-.. option:: -A algorithm
+   ``rndc-confgen -a`` is required, for example if rndc is to be used
+   remotely, run ``rndc-confgen`` without the ``-a`` option
+   and set up ``rndc.conf`` and ``named.conf`` as directed.
 
+``-A algorithm``
    This option specifies the algorithm to use for the TSIG key. Available choices
    are: hmac-md5, hmac-sha1, hmac-sha224, hmac-sha256, hmac-sha384, and
    hmac-sha512. The default is hmac-sha256.
 
-.. option:: -b keysize
-
+``-b keysize``
    This option specifies the size of the authentication key in bits. The size must be between
    1 and 512 bits; the default is the hash size.
 
-.. option:: -c keyfile
-
-   This option is used with the :option:`-a` option to specify an alternate location for
+``-c keyfile``
+   This option is used with the ``-a`` option to specify an alternate location for
    ``rndc.key``.
 
-.. option:: -h
-
+``-h``
    This option prints a short summary of the options and arguments to
-   :program:`rndc-confgen`.
+   ``rndc-confgen``.
 
-.. option:: -k keyname
-
-   This option specifies the key name of the :iscman:`rndc` authentication key. This must be a
+``-k keyname``
+   This option specifies the key name of the ``rndc`` authentication key. This must be a
    valid domain name. The default is ``rndc-key``.
 
-.. option:: -p port
-
-   This option specifies the command channel port where :iscman:`named` listens for
-   connections from :iscman:`rndc`. The default is 953.
-
-.. option:: -q
+``-p port``
+   This option specifies the command channel port where ``named`` listens for
+   connections from ``rndc``. The default is 953.
 
+``-q``
    This option prevets printing the written path in automatic configuration mode.
 
-.. option:: -s address
-
-   This option specifies the IP address where :iscman:`named` listens for command-channel
-   connections from :iscman:`rndc`. The default is the loopback address
+``-s address``
+   This option specifies the IP address where ``named`` listens for command-channel
+   connections from ``rndc``. The default is the loopback address
    127.0.0.1.
 
-.. option:: -t chrootdir
-
-   This option is used with the :option:`-a` option to specify a directory where :iscman:`named`
+``-t chrootdir``
+   This option is used with the ``-a`` option to specify a directory where ``named``
    runs chrooted. An additional copy of the ``rndc.key`` is
    written relative to this directory, so that it is found by the
-   chrooted :iscman:`named`.
+   chrooted ``named``.
 
-.. option:: -u user
-
-   This option is used with the :option:`-a` option to set the owner of the generated ``rndc.key`` file.
-   If :option:`-t` is also specified, only the file in the chroot
+``-u user``
+   This option is used with the ``-a`` option to set the owner of the generated ``rndc.key`` file.
+   If ``-t`` is also specified, only the file in the chroot
    area has its owner changed.
 
 Examples
 ~~~~~~~~
 
-To allow :iscman:`rndc` to be used with no manual configuration, run:
+To allow ``rndc`` to be used with no manual configuration, run:
 
 ``rndc-confgen -a``
 
-To print a sample :iscman:`rndc.conf` file and the corresponding ``controls`` and
-``key`` statements to be manually inserted into :iscman:`named.conf`, run:
+To print a sample ``rndc.conf`` file and the corresponding ``controls`` and
+``key`` statements to be manually inserted into ``named.conf``, run:
 
-:program:`rndc-confgen`
+``rndc-confgen``
 
 See Also
 ~~~~~~~~
 
-:iscman:`rndc(8) <rndc>`, :iscman:`rndc.conf(5) <rndc.conf>`, :iscman:`named(8) <named>`, BIND 9 Administrator Reference Manual.
+:manpage:`rndc(8)`, :manpage:`rndc.conf(5)`, :manpage:`named(8)`, BIND 9 Administrator Reference Manual.

bin/confgen/tsig-keygen.c

@@ -30,6 +30,7 @@
 #include <isc/file.h>
 #include <isc/mem.h>
 #include <isc/net.h>
+#include <isc/print.h>
 #include <isc/result.h>
 #include <isc/string.h>
 #include <isc/time.h>
@@ -53,7 +54,7 @@ const char *progname;
 static enum { progmode_keygen, progmode_confgen } progmode;
 bool verbose = false; /* needed by util.c but not used here */
 
-noreturn static void
+ISC_NORETURN static void
 usage(int status);
 
 static void
@@ -120,14 +121,14 @@ main(int argc, char **argv) {
 	} else if (PROGCMP("ddns-confgen")) {
 		progmode = progmode_confgen;
 	} else {
-		UNREACHABLE();
+		INSIST(0);
+		ISC_UNREACHABLE();
 	}
 
 	isc_commandline_errprint = false;
 
 	while ((ch = isc_commandline_parse(argc, argv, "a:hk:Mmr:qs:y:z:")) !=
-	       -1)
-	{
+	       -1) {
 		switch (ch) {
 		case 'a':
 			algname = isc_commandline_argument;
@@ -138,13 +139,13 @@ main(int argc, char **argv) {
 			keysize = alg_bits(alg);
 			break;
 		case 'h':
-			usage(EXIT_SUCCESS);
+			usage(0);
 		case 'k':
 		case 'y':
 			if (progmode == progmode_confgen) {
 				keyname = isc_commandline_argument;
 			} else {
-				usage(EXIT_FAILURE);
+				usage(1);
 			}
 			break;
 		case 'M':
@@ -157,7 +158,7 @@ main(int argc, char **argv) {
 			if (progmode == progmode_confgen) {
 				quiet = true;
 			} else {
-				usage(EXIT_FAILURE);
+				usage(1);
 			}
 			break;
 		case 'r':
@@ -167,29 +168,29 @@ main(int argc, char **argv) {
 			if (progmode == progmode_confgen) {
 				self_domain = isc_commandline_argument;
 			} else {
-				usage(EXIT_FAILURE);
+				usage(1);
 			}
 			break;
 		case 'z':
 			if (progmode == progmode_confgen) {
 				zone = isc_commandline_argument;
 			} else {
-				usage(EXIT_FAILURE);
+				usage(1);
 			}
 			break;
 		case '?':
 			if (isc_commandline_option != '?') {
 				fprintf(stderr, "%s: invalid argument -%c\n",
 					program, isc_commandline_option);
-				usage(EXIT_FAILURE);
+				usage(1);
 			} else {
-				usage(EXIT_SUCCESS);
+				usage(0);
 			}
 			break;
 		default:
 			fprintf(stderr, "%s: unhandled option -%c\n", program,
 				isc_commandline_option);
-			exit(EXIT_FAILURE);
+			exit(1);
 		}
 	}
 
@@ -200,15 +201,15 @@ main(int argc, char **argv) {
 	POST(argv);
 
 	if (self_domain != NULL && zone != NULL) {
-		usage(EXIT_FAILURE); /* -s and -z cannot coexist */
+		usage(1); /* -s and -z cannot coexist */
 	}
 
 	if (argc > isc_commandline_index) {
-		usage(EXIT_FAILURE);
+		usage(1);
 	}
 
 	/* Use canonical algorithm name */
-	algname = dst_hmac_algorithm_totext(alg);
+	algname = alg_totext(alg);
 
 	isc_mem_create(&mctx);
 

bin/confgen/tsig-keygen.rst

@@ -11,45 +11,81 @@
 
 .. highlight: console
 
-.. BEWARE: Do not forget to edit also ddns-confgen.rst!
-
-.. iscman:: tsig-keygen
-.. program:: tsig-keygen
-.. _man_tsig-keygen:
-
-tsig-keygen - TSIG key generation tool
---------------------------------------
+tsig-keygen, ddns-confgen - TSIG key generation tool
+----------------------------------------------------
 
 Synopsis
 ~~~~~~~~
-:program:`tsig-keygen` [**-a** algorithm] [**-h**] [name]
+:program:`tsig-keygen` [**-a** algorithm] [**-h**] [**-r** randomfile] [name]
+
+:program:`ddns-confgen` [**-a** algorithm] [**-h**] [**-k** keyname] [**-q**] [**-r** randomfile] [**-s** name] [**-z** zone]
 
 Description
 ~~~~~~~~~~~
 
-:program:`tsig-keygen` is an utility that generates keys for use with TSIG
-(Transaction Signatures) as defined in :rfc:`2845`. The resulting keys can be used,
-for example, to secure dynamic DNS updates to a zone, or for the :iscman:`rndc`
-command channel.
+``tsig-keygen`` and ``ddns-confgen`` are invocation methods for a
+utility that generates keys for use in TSIG signing. The resulting keys
+can be used, for example, to secure dynamic DNS updates to a zone, or for
+the ``rndc`` command channel.
 
-A domain name can be specified on the command line to be used as the name
-of the generated key. If no name is specified, the default is ``tsig-key``.
+When run as ``tsig-keygen``, a domain name can be specified on the
+command line to be used as the name of the generated key. If no
+name is specified, the default is ``tsig-key``.
+
+When run as ``ddns-confgen``, the key name can specified using ``-k``
+parameter and defaults to ``ddns-key``. The generated key is accompanied
+by configuration text and instructions that can be used with ``nsupdate``
+and ``named`` when setting up dynamic DNS, including an example
+``update-policy`` statement. (This usage is similar to the ``rndc-confgen``
+command for setting up command-channel security.)
+
+Note that ``named`` itself can configure a local DDNS key for use with
+``nsupdate -l``; it does this when a zone is configured with
+``update-policy local;``. ``ddns-confgen`` is only needed when a more
+elaborate configuration is required: for instance, if ``nsupdate`` is to
+be used from a remote system.
 
 Options
 ~~~~~~~
 
-.. option:: -a algorithm
-
+``-a algorithm``
    This option specifies the algorithm to use for the TSIG key. Available
    choices are: hmac-md5, hmac-sha1, hmac-sha224, hmac-sha256, hmac-sha384,
    and hmac-sha512. The default is hmac-sha256. Options are
    case-insensitive, and the "hmac-" prefix may be omitted.
 
-.. option:: -h
-
+``-h``
    This option prints a short summary of options and arguments.
 
+``-k keyname``
+   This option specifies the key name of the DDNS authentication key. The
+   default is ``ddns-key`` when neither the ``-s`` nor ``-z`` option is
+   specified; otherwise, the default is ``ddns-key`` as a separate label
+   followed by the argument of the option, e.g., ``ddns-key.example.com.``
+   The key name must have the format of a valid domain name, consisting of
+   letters, digits, hyphens, and periods.
+
+``-q`` (``ddns-confgen`` only)
+   This option enables quiet mode, which prints only the key, with no
+   explanatory text or usage examples. This is essentially identical to
+   ``tsig-keygen``.
+
+``-s name`` (``ddns-confgen`` only)
+   This option generates a configuration example to allow dynamic updates
+   of a single hostname. The example ``named.conf`` text shows how to set
+   an update policy for the specified name using the "name" nametype. The
+   default key name is ``ddns-key.name``. Note that the "self" nametype
+   cannot be used, since the name to be updated may differ from the key
+   name. This option cannot be used with the ``-z`` option.
+
+``-z zone`` (``ddns-confgen`` only)
+   This option generates a configuration example to allow
+   dynamic updates of a zone. The example ``named.conf`` text shows how
+   to set an update policy for the specified zone using the "zonesub"
+   nametype, allowing updates to all subdomain names within that zone.
+   This option cannot be used with the ``-s`` option.
+
 See Also
 ~~~~~~~~
 
-:iscman:`nsupdate(1) <nsupdate>`, :iscman:`named.conf(5) <named.conf>`, :iscman:`named(8) <named>`, BIND 9 Administrator Reference Manual.
+:manpage:`nsupdate(1)`, :manpage:`named.conf(5)`, :manpage:`named(8)`, BIND 9 Administrator Reference Manual.

bin/confgen/util.c

@@ -13,15 +13,13 @@
 
 /*! \file */
 
+#include "util.h"
 #include <stdarg.h>
 #include <stdbool.h>
 #include <stdio.h>
 #include <stdlib.h>
-#include <unistd.h>
 
-#include <isc/tls.h>
-
-#include "util.h"
+#include <isc/print.h>
 
 extern bool verbose;
 extern const char *progname;
@@ -47,5 +45,5 @@ fatal(const char *format, ...) {
 	vfprintf(stderr, format, args);
 	va_end(args);
 	fprintf(stderr, "\n");
-	_exit(EXIT_FAILURE);
+	exit(1);
 }

bin/confgen/util.h

@@ -36,7 +36,7 @@ ISC_LANG_BEGINDECLS
 void
 notify(const char *fmt, ...) ISC_FORMAT_PRINTF(1, 2);
 
-noreturn void
+ISC_NORETURN void
 fatal(const char *format, ...) ISC_FORMAT_PRINTF(1, 2);
 
 ISC_LANG_ENDDECLS

bin/delv/Makefile.am

@@ -4,8 +4,8 @@ AM_CPPFLAGS +=				\
 	-I$(top_builddir)/include	\
 	$(LIBISC_CFLAGS)		\
 	$(LIBDNS_CFLAGS)		\
-	$(LIBNS_CFLAGS)			\
-	$(LIBISCCFG_CFLAGS)
+	$(LIBISCCFG_CFLAGS)		\
+	$(LIBIRS_CFLAGS)
 
 AM_CPPFLAGS +=				\
 	-DSYSCONFDIR=\"${sysconfdir}\"
@@ -14,9 +14,8 @@ bin_PROGRAMS = delv
 
 delv_SOURCES =				\
 	delv.c
-
 delv_LDADD =				\
 	$(LIBISC_LIBS)			\
 	$(LIBDNS_LIBS)			\
-	$(LIBNS_LIBS)			\
-	$(LIBISCCFG_LIBS)
+	$(LIBISCCFG_LIBS)		\
+	$(LIBIRS_LIBS)

bin/delv/delv.rst

@@ -11,8 +11,6 @@
 
 .. highlight: console
 
-.. iscman:: delv
-.. program:: delv
 .. _man_delv:
 
 delv - DNS lookup and validation utility
@@ -32,10 +30,10 @@ Synopsis
 Description
 ~~~~~~~~~~~
 
-:program:`delv` is a tool for sending DNS queries and validating the results,
-using the same internal resolver and validator logic as :iscman:`named`.
+``delv`` is a tool for sending DNS queries and validating the results,
+using the same internal resolver and validator logic as ``named``.
 
-:program:`delv` sends to a specified name server all queries needed to
+``delv`` sends to a specified name server all queries needed to
 fetch and validate the requested data; this includes the original
 requested query, subsequent queries to follow CNAME or DNAME chains,
 queries for DNSKEY, and DS records to establish a chain of trust for
@@ -44,25 +42,25 @@ simulates the behavior of a name server configured for DNSSEC validating
 and forwarding.
 
 By default, responses are validated using the built-in DNSSEC trust anchor
-for the root zone ("."). Records returned by :program:`delv` are either fully
+for the root zone ("."). Records returned by ``delv`` are either fully
 validated or were not signed. If validation fails, an explanation of the
 failure is included in the output; the validation process can be traced
-in detail. Because :program:`delv` does not rely on an external server to carry
+in detail. Because ``delv`` does not rely on an external server to carry
 out validation, it can be used to check the validity of DNS responses in
 environments where local name servers may not be trustworthy.
 
-Unless it is told to query a specific name server, :program:`delv` tries
+Unless it is told to query a specific name server, ``delv`` tries
 each of the servers listed in ``/etc/resolv.conf``. If no usable server
-addresses are found, :program:`delv` sends queries to the localhost
+addresses are found, ``delv`` sends queries to the localhost
 addresses (127.0.0.1 for IPv4, ::1 for IPv6).
 
-When no command-line arguments or options are given, :program:`delv`
+When no command-line arguments or options are given, ``delv``
 performs an NS query for "." (the root zone).
 
 Simple Usage
 ~~~~~~~~~~~~
 
-A typical invocation of :program:`delv` looks like:
+A typical invocation of ``delv`` looks like:
 
 ::
 
@@ -70,143 +68,125 @@ A typical invocation of :program:`delv` looks like:
 
 where:
 
-.. option:: server
-
+``server``
    is the name or IP address of the name server to query. This can be an
    IPv4 address in dotted-decimal notation or an IPv6 address in
    colon-delimited notation. When the supplied ``server`` argument is a
-   hostname, :program:`delv` resolves that name before querying that name
+   hostname, ``delv`` resolves that name before querying that name
    server (note, however, that this initial lookup is *not* validated by
    DNSSEC).
 
-   If no ``server`` argument is provided, :program:`delv` consults
+   If no ``server`` argument is provided, ``delv`` consults
    ``/etc/resolv.conf``; if an address is found there, it queries the
-   name server at that address. If either of the :option:`-4` or :option:`-6`
+   name server at that address. If either of the ``-4`` or ``-6``
    options is in use, then only addresses for the corresponding
-   transport are tried. If no usable addresses are found, :program:`delv`
+   transport are tried. If no usable addresses are found, ``delv``
    sends queries to the localhost addresses (127.0.0.1 for IPv4, ::1
    for IPv6).
 
-.. option:: name
-
+``name``
    is the domain name to be looked up.
 
-.. option:: type
-
+``type``
    indicates what type of query is required - ANY, A, MX, etc.
    ``type`` can be any valid query type. If no ``type`` argument is
-   supplied, :program:`delv` performs a lookup for an A record.
+   supplied, ``delv`` performs a lookup for an A record.
 
 Options
 ~~~~~~~
 
-.. option:: -a anchor-file
+``-a anchor-file``
+   This option specifies a file from which to read DNSSEC trust anchors. The default
+   is |bind_keys|, which is included with BIND 9 and contains one
+   or more trust anchors for the root zone (".").
 
-   This option specifies a file from which to read an alternate
-   DNSSEC root zone trust anchor.
+   Keys that do not match the root zone name are ignored. An alternate
+   key name can be specified using the ``+root=NAME`` options.
 
-   By default, keys that do not match the root zone name (`.`) are
-   ignored. If an alternate key name is desired, it can be
-   specified using the :option:`+root` option.
-
-   Note: When reading trust anchors, :program:`delv` treats
-   ``trust-anchors``, ``initial-key``, and ``static-key`` identically. That
-   is, for a managed key, it is the *initial* key that is trusted;
-   :rfc:`5011` key management is not supported. :program:`delv` does not
-   consult the managed-keys database maintained by :iscman:`named`. This
-   means that if the default key built in to :program:`delv` is revoked,
-   :program:`delv` must be updated to a newer version in order to continue
-   validating.
-
-.. option:: -b address
+   Note: When reading the trust anchor file, ``delv`` treats ``trust-anchors``,
+   ``initial-key``, and ``static-key`` identically. That is, for a managed key,
+   it is the *initial* key that is trusted; :rfc:`5011` key management is not
+   supported. ``delv`` does not consult the managed-keys database maintained by
+   ``named``, which means that if either of the keys in |bind_keys| is
+   revoked and rolled over, |bind_keys| must be updated to
+   use DNSSEC validation in ``delv``.
 
+``-b address``
    This option sets the source IP address of the query to ``address``. This must be
    a valid address on one of the host's network interfaces, or ``0.0.0.0``,
    or ``::``. An optional source port may be specified by appending
    ``#<port>``
 
-.. option:: -c class
-
+``-c class``
    This option sets the query class for the requested data. Currently, only class
-   "IN" is supported in :program:`delv` and any other value is ignored.
-
-.. option:: -d level
+   "IN" is supported in ``delv`` and any other value is ignored.
 
+``-d level``
    This option sets the systemwide debug level to ``level``. The allowed range is
    from 0 to 99. The default is 0 (no debugging). Debugging traces from
-   :program:`delv` become more verbose as the debug level increases. See the
-   :option:`+mtrace`, :option:`+rtrace`, and :option:`+vtrace` options below for
+   ``delv`` become more verbose as the debug level increases. See the
+   ``+mtrace``, ``+rtrace``, and ``+vtrace`` options below for
    additional debugging details.
 
-.. option:: -h
-
-   This option displays the :program:`delv` help usage output and exits.
-
-.. option:: -i
+``-h``
+   This option displays the ``delv`` help usage output and exits.
 
+``-i``
    This option sets insecure mode, which disables internal DNSSEC validation. (Note,
    however, that this does not set the CD bit on upstream queries. If the
    server being queried is performing DNSSEC validation, then it does
-   not return invalid data; this can cause :program:`delv` to time out. When it
+   not return invalid data; this can cause ``delv`` to time out. When it
    is necessary to examine invalid data to debug a DNSSEC problem, use
-   :option:`dig +cd`.)
-
-.. option:: -m
+   ``dig +cd``.)
 
+``-m``
    This option enables memory usage debugging.
 
-.. option:: -p port#
-
+``-p port#``
    This option specifies a destination port to use for queries, instead of the
    standard DNS port number 53. This option is used with a name
    server that has been configured to listen for queries on a
    non-standard port number.
 
-.. option:: -q name
-
+``-q name``
    This option sets the query name to ``name``. While the query name can be
-   specified without using the :option:`-q` option, it is sometimes necessary to
+   specified without using the ``-q`` option, it is sometimes necessary to
    disambiguate names from types or classes (for example, when looking
    up the name "ns", which could be misinterpreted as the type NS, or
    "ch", which could be misinterpreted as class CH).
 
-.. option:: -t type
-
+``-t type``
    This option sets the query type to ``type``, which can be any valid query type
    supported in BIND 9 except for zone transfer types AXFR and IXFR. As
-   with :option:`-q`, this is useful to distinguish query-name types or classes
+   with ``-q``, this is useful to distinguish query-name types or classes
    when they are ambiguous. It is sometimes necessary to disambiguate
    names from types.
 
-   The default query type is "A", unless the :option:`-x` option is supplied
+   The default query type is "A", unless the ``-x`` option is supplied
    to indicate a reverse lookup, in which case it is "PTR".
 
-.. option:: -v
-
-   This option prints the :program:`delv` version and exits.
-
-.. option:: -x addr
+``-v``
+   This option prints the ``delv`` version and exits.
 
+``-x addr``
    This option performs a reverse lookup, mapping an address to a name. ``addr``
    is an IPv4 address in dotted-decimal notation, or a colon-delimited
-   IPv6 address. When :option:`-x` is used, there is no need to provide the
-   ``name`` or ``type`` arguments; :program:`delv` automatically performs a
+   IPv6 address. When ``-x`` is used, there is no need to provide the
+   ``name`` or ``type`` arguments; ``delv`` automatically performs a
    lookup for a name like ``11.12.13.10.in-addr.arpa`` and sets the
    query type to PTR. IPv6 addresses are looked up using nibble format
    under the IP6.ARPA domain.
 
-.. option:: -4
+``-4``
+   This option forces ``delv`` to only use IPv4.
 
-   This option forces :program:`delv` to only use IPv4.
-
-.. option:: -6
-
-   This option forces :program:`delv` to only use IPv6.
+``-6``
+   This option forces ``delv`` to only use IPv6.
 
 Query Options
 ~~~~~~~~~~~~~
 
-:program:`delv` provides a number of query options which affect the way results
+``delv`` provides a number of query options which affect the way results
 are displayed, and in some cases the way lookups are performed.
 
 Each query option is identified by a keyword preceded by a plus sign
@@ -215,121 +195,69 @@ the string ``no`` to negate the meaning of that keyword. Other keywords
 assign values to options like the timeout interval. They have the form
 ``+keyword=value``. The query options are:
 
-.. option:: +cdflag, +nocdflag
-
+``+[no]cdflag``
    This option controls whether to set the CD (checking disabled) bit in queries
-   sent by :program:`delv`. This may be useful when troubleshooting DNSSEC
+   sent by ``delv``. This may be useful when troubleshooting DNSSEC
    problems from behind a validating resolver. A validating resolver
    blocks invalid responses, making it difficult to retrieve them
    for analysis. Setting the CD flag on queries causes the resolver
-   to return invalid responses, which :program:`delv` can then validate
+   to return invalid responses, which ``delv`` can then validate
    internally and report the errors in detail.
 
-.. option:: +class, +noclass
-
+``+[no]class``
    This option controls whether to display the CLASS when printing a record. The
    default is to display the CLASS.
 
-.. option:: +hint=FILE, +nohint
-
-   This option specifies a filename from which to load root hints;
-   this will be used to find the root name servers when name server
-   mode (``delv +ns``) is in use. If the option is not specified,
-   built-in root hints will be used.
-
-.. option:: +ns, +nons
-
-   This option toggles name server mode. When this option is in use,
-   the ``delv`` process instantiates a full recursive resolver, and uses
-   that to look up the requested query name and type. Turning on this
-   option also activates ``+mtrace``, ``+strace`` and ``+rtrace``, so that
-   every iterative query will be logged, including the full response messages
-   from each authoritatve server.  These logged messages will be written
-   to ``stdout`` rather than ``stderr`` as usual, so that the full trace
-   can be captured more easily.
-
-   This is intended to be similar to the behavior of ``dig +trace``, but
-   because it uses the same code as ``named``, it much more accurately
-   replicates the behavior of a recursive name server with a cold cache
-   that is processing a recursive query.
-
-.. option:: +qmin[=MODE], +noqmin
-
-   When used with ``+ns``, this option enables QNAME minimization mode.
-   Valid options of MODE are ``relaxed`` and ``strict``. By default,
-   QNAME minimization is disabled.  If ``+qmin`` is specified but MODE
-   is omitted, then ``relaxed`` mode will be used.
-
-.. option:: +ttl, +nottl
-
+``+[no]ttl``
    This option controls whether to display the TTL when printing a record. The
    default is to display the TTL.
 
-.. option:: +rtrace, +nortrace
-
-   This option toggles resolver fetch logging. This reports the name and
-   type of each query sent by :program:`delv` in the process of carrying
-   out the resolution and validation process, including the original query
-   and all subsequent queries to follow CNAMEs and to establish a chain of
-   trust for DNSSEC validation.
+``+[no]rtrace``
+   This option toggles resolver fetch logging. This reports the name and type of each
+   query sent by ``delv`` in the process of carrying out the resolution
+   and validation process, including the original query
+   and all subsequent queries to follow CNAMEs and to establish a chain
+   of trust for DNSSEC validation.
 
    This is equivalent to setting the debug level to 1 in the "resolver"
    logging category. Setting the systemwide debug level to 1 using the
-   :option:`-d` option produces the same output, but affects other
+   ``-d`` option produces the same output, but affects other
    logging categories as well.
 
-.. option:: +mtrace, +nomtrace
-
-   This option toggles logging of messages received. This produces
-   a detailed dump of the responses received by :program:`delv` in the
-   process of carrying out the resolution and validation process.
+``+[no]mtrace``
+   This option toggles message logging. This produces a detailed dump of the
+   responses received by ``delv`` in the process of carrying out the
+   resolution and validation process.
 
    This is equivalent to setting the debug level to 10 for the "packets"
    module of the "resolver" logging category. Setting the systemwide
-   debug level to 10 using the :option:`-d` option produces the same
+   debug level to 10 using the ``-d`` option produces the same
    output, but affects other logging categories as well.
 
-.. option:: +strace, +nostrace
-
-   This option toggles logging of messages sent. This produces a detailed
-   dump of the queries sent by :program:`delv` in the process of carrying
-   out the resolution and validation process. Turning on this option
-   also activates ``+mtrace``.
-
-   This is equivalent to setting the debug level to 11 for the "packets"
-   module of the "resolver" logging category. Setting the systemwide
-   debug level to 11 using the :option:`-d` option produces the same
-   output, but affects other logging categories as well.
-
-.. option:: +vtrace, +novtrace
-
+``+[no]vtrace``
    This option toggles validation logging. This shows the internal process of the
    validator as it determines whether an answer is validly signed,
    unsigned, or invalid.
 
    This is equivalent to setting the debug level to 3 for the
    "validator" module of the "dnssec" logging category. Setting the
-   systemwide debug level to 3 using the :option:`-d` option produces the
+   systemwide debug level to 3 using the ``-d`` option produces the
    same output, but affects other logging categories as well.
 
-.. option:: +short, +noshort
-
+``+[no]short``
    This option toggles between verbose and terse answers. The default is to print the answer in a
    verbose form.
 
-.. option:: +comments, +nocomments
-
+``+[no]comments``
    This option toggles the display of comment lines in the output. The default is to
    print comments.
 
-.. option:: +rrcomments, +norrcomments
-
+``+[no]rrcomments``
    This option toggles the display of per-record comments in the output (for example,
    human-readable key information about DNSKEY records). The default is
    to print per-record comments.
 
-.. option:: +crypto, +nocrypto
-
+``+[no]crypto``
    This option toggles the display of cryptographic fields in DNSSEC records. The
    contents of these fields are unnecessary to debug most DNSSEC
    validation failures and removing them makes it easier to see the
@@ -337,69 +265,62 @@ assign values to options like the timeout interval. They have the form
    they are replaced by the string ``[omitted]`` or, in the DNSKEY case, the
    key ID is displayed as the replacement, e.g. ``[ key id = value ]``.
 
-.. option:: +trust, +notrust
-
+``+[no]trust``
    This option controls whether to display the trust level when printing a record.
    The default is to display the trust level.
 
-.. option:: +split[=W], +nosplit
-
+``+[no]split[=W]``
    This option splits long hex- or base64-formatted fields in resource records into
    chunks of ``W`` characters (where ``W`` is rounded up to the nearest
    multiple of 4). ``+nosplit`` or ``+split=0`` causes fields not to be
    split at all. The default is 56 characters, or 44 characters when
    multiline mode is active.
 
-.. option:: +all, +noall
-
-   This option sets or clears the display options :option:`+comments`,
-   :option:`+rrcomments`, and :option:`+trust` as a group.
-
-.. option:: +multiline, +nomultiline
+``+[no]all``
+   This option sets or clears the display options ``+[no]comments``,
+   ``+[no]rrcomments``, and ``+[no]trust`` as a group.
 
+``+[no]multiline``
    This option prints long records (such as RRSIG, DNSKEY, and SOA records) in a
    verbose multi-line format with human-readable comments. The default
    is to print each record on a single line, to facilitate machine
-   parsing of the :program:`delv` output.
+   parsing of the ``delv`` output.
 
-.. option:: +dnssec, +nodnssec
-
-   This option indicates whether to display RRSIG records in the :program:`delv` output.
-   The default is to do so. Note that (unlike in :iscman:`dig`) this does
+``+[no]dnssec``
+   This option indicates whether to display RRSIG records in the ``delv`` output.
+   The default is to do so. Note that (unlike in ``dig``) this does
    *not* control whether to request DNSSEC records or to
    validate them. DNSSEC records are always requested, and validation
-   always occurs unless suppressed by the use of :option:`-i` or
-   :option:`+noroot`.
-
-.. option:: +root[=ROOT], +noroot
+   always occurs unless suppressed by the use of ``-i`` or
+   ``+noroot``.
 
+``+[no]root[=ROOT]``
    This option indicates whether to perform conventional DNSSEC validation, and if so,
    specifies the name of a trust anchor. The default is to validate using a
    trust anchor of "." (the root zone), for which there is a built-in key. If
-   specifying a different trust anchor, then :option:`-a` must be used to specify a
+   specifying a different trust anchor, then ``-a`` must be used to specify a
    file containing the key.
 
-.. option:: +tcp, +notcp
-
+``+[no]tcp``
    This option controls whether to use TCP when sending queries. The default is to
    use UDP unless a truncated response has been received.
 
-.. option:: +unknownformat, +nounknownformat
-
+``+[no]unknownformat``
    This option prints all RDATA in unknown RR-type presentation format (:rfc:`3597`).
    The default is to print RDATA for known types in the type's
    presentation format.
 
-.. option:: +yaml, +noyaml
-
+``+[no]yaml``
    This option prints response data in YAML format.
 
 Files
 ~~~~~
 
+|bind_keys|
+
 ``/etc/resolv.conf``
 
 See Also
 ~~~~~~~~
 
-:iscman:`dig(1) <dig>`, :iscman:`named(8) <named>`, :rfc:`4034`, :rfc:`4035`, :rfc:`4431`, :rfc:`5074`, :rfc:`5155`.
+:manpage:`dig(1)`, :manpage:`named(8)`, :rfc:`4034`, :rfc:`4035`, :rfc:`4431`, :rfc:`5074`, :rfc:`5155`.

bin/dig/Makefile.am

@@ -4,14 +4,17 @@ AM_CPPFLAGS +=			\
 	$(LIBISC_CFLAGS)	\
 	$(LIBDNS_CFLAGS)	\
 	$(LIBISCCFG_CFLAGS)	\
-	$(LIBIDN2_CFLAGS)	\
-	$(LIBUV_CFLAGS)
+	$(LIBIRS_CFLAGS)	\
+	$(LIBBIND9_CFLAGS)	\
+	$(LIBIDN2_CFLAGS)
 
 LDADD +=			\
 	libdighost.la		\
 	$(LIBISC_LIBS)		\
 	$(LIBDNS_LIBS)		\
 	$(LIBISCCFG_LIBS)	\
+	$(LIBIRS_LIBS)		\
+	$(LIBBIND9_LIBS)	\
 	$(LIBIDN2_LIBS)
 
 noinst_LTLIBRARIES = libdighost.la

bin/dig/dig.rst

@@ -11,8 +11,6 @@
 
 .. highlight: console
 
-.. iscman:: dig
-.. program:: dig
 .. _man_dig:
 
 dig - DNS lookup utility
@@ -29,41 +27,41 @@ Synopsis
 Description
 ~~~~~~~~~~~
 
-:program:`dig` is a flexible tool for interrogating DNS name servers. It
+``dig`` is a flexible tool for interrogating DNS name servers. It
 performs DNS lookups and displays the answers that are returned from the
-name server(s) that were queried. Most DNS administrators use :program:`dig` to
+name server(s) that were queried. Most DNS administrators use ``dig`` to
 troubleshoot DNS problems because of its flexibility, ease of use, and
 clarity of output. Other lookup tools tend to have less functionality
-than :program:`dig`.
+than ``dig``.
 
-Although :program:`dig` is normally used with command-line arguments, it also
+Although ``dig`` is normally used with command-line arguments, it also
 has a batch mode of operation for reading lookup requests from a file. A
 brief summary of its command-line arguments and options is printed when
-the :option:`-h` option is given. The BIND 9
-implementation of :program:`dig` allows multiple lookups to be issued from the
+the ``-h`` option is given. The BIND 9
+implementation of ``dig`` allows multiple lookups to be issued from the
 command line.
 
-Unless it is told to query a specific name server, :program:`dig` tries each
+Unless it is told to query a specific name server, ``dig`` tries each
 of the servers listed in ``/etc/resolv.conf``. If no usable server
-addresses are found, :program:`dig` sends the query to the local host.
+addresses are found, ``dig`` sends the query to the local host.
 
-When no command-line arguments or options are given, :program:`dig`
+When no command-line arguments or options are given, ``dig``
 performs an NS query for "." (the root).
 
-It is possible to set per-user defaults for :program:`dig` via
+It is possible to set per-user defaults for ``dig`` via
 ``${HOME}/.digrc``. This file is read and any options in it are applied
-before the command-line arguments. The :option:`-r` option disables this
+before the command-line arguments. The ``-r`` option disables this
 feature, for scripts that need predictable behavior.
 
 The IN and CH class names overlap with the IN and CH top-level domain
-names. Either use the :option:`-t` and :option:`-c` options to specify the type and
-class, use the :option:`-q` to specify the domain name, or use "IN." and
+names. Either use the ``-t`` and ``-c`` options to specify the type and
+class, use the ``-q`` to specify the domain name, or use "IN." and
 "CH." when looking up these top-level domains.
 
 Simple Usage
 ~~~~~~~~~~~~
 
-A typical invocation of :program:`dig` looks like:
+A typical invocation of ``dig`` looks like:
 
 ::
 
@@ -71,103 +69,83 @@ A typical invocation of :program:`dig` looks like:
 
 where:
 
-.. option:: server
-
+``server``
    is the name or IP address of the name server to query. This can be an
    IPv4 address in dotted-decimal notation or an IPv6 address in
    colon-delimited notation. When the supplied ``server`` argument is a
-   hostname, :program:`dig` resolves that name before querying that name
+   hostname, ``dig`` resolves that name before querying that name
    server.
 
-   If no ``server`` argument is provided, :program:`dig` consults
+   If no ``server`` argument is provided, ``dig`` consults
    ``/etc/resolv.conf``; if an address is found there, it queries the
-   name server at that address. If either of the :option:`-4` or :option:`-6`
+   name server at that address. If either of the ``-4`` or ``-6``
    options are in use, then only addresses for the corresponding
-   transport are tried. If no usable addresses are found, :program:`dig`
+   transport are tried. If no usable addresses are found, ``dig``
    sends the query to the local host. The reply from the name server
    that responds is displayed.
 
-.. option:: name
-
+``name``
    is the name of the resource record that is to be looked up.
 
-.. option:: type
-
+``type``
    indicates what type of query is required - ANY, A, MX, SIG, etc.
    ``type`` can be any valid query type. If no ``type`` argument is
-   supplied, :program:`dig` performs a lookup for an A record.
+   supplied, ``dig`` performs a lookup for an A record.
 
 Options
 ~~~~~~~
 
-.. option:: -4
-
+``-4``
    This option indicates that only IPv4 should be used.
 
-.. option:: -6
-
+``-6``
    This option indicates that only IPv6 should be used.
 
-.. option:: -b address[#port]
-
+``-b address[#port]``
    This option sets the source IP address of the query. The ``address`` must be a
    valid address on one of the host's network interfaces, or "0.0.0.0"
    or "::". An optional port may be specified by appending ``#port``.
 
-.. option:: -c class
-
+``-c class``
    This option sets the query class. The default ``class`` is IN; other classes are
    HS for Hesiod records or CH for Chaosnet records.
 
-.. option:: -f file
-
-   This option sets batch mode, in which :program:`dig` reads a list of lookup requests to process from
+``-f file``
+   This option sets batch mode, in which ``dig`` reads a list of lookup requests to process from
    the given ``file``. Each line in the file should be organized in the
-   same way it would be presented as a query to :program:`dig` using the
+   same way it would be presented as a query to ``dig`` using the
    command-line interface.
 
-.. option:: -h
-
-   Print a usage summary.
-
-.. option:: -k keyfile
-
-   This option tells :program:`dig` to sign queries using TSIG or
-   SIG(0) using a key read from the given file. Key files can be
-   generated using :iscman:`tsig-keygen`. When using TSIG authentication
-   with :program:`dig`, the name server that is queried needs to
-   know the key and algorithm that is being used. In BIND, this is
-   done by providing appropriate ``key`` and ``server`` statements
-   in :iscman:`named.conf` for TSIG and by looking up the KEY record
-   in zone data for SIG(0).
-
-.. option:: -m
+``-k keyfile``
+   This option tells ``named`` to sign queries using TSIG using a key read from the given file. Key
+   files can be generated using ``tsig-keygen``. When using TSIG
+   authentication with ``dig``, the name server that is queried needs to
+   know the key and algorithm that is being used. In BIND, this is done
+   by providing appropriate ``key`` and ``server`` statements in
+   ``named.conf``.
 
+``-m``
    This option enables memory usage debugging.
 
-.. option:: -p port
-
+``-p port``
    This option sends the query to a non-standard port on the server, instead of the
    default port 53. This option is used to test a name server that
    has been configured to listen for queries on a non-standard port
    number.
 
-.. option:: -q name
-
+``-q name``
    This option specifies the domain name to query. This is useful to distinguish the ``name``
    from other arguments.
 
-.. option:: -r
-
+``-r``
    This option indicates that options from ``${HOME}/.digrc`` should not be read. This is useful for
    scripts that need predictable behavior.
 
-.. option:: -t type
-
+``-t type``
    This option indicates the resource record type to query, which can be any valid query type. If
    it is a resource record type supported in BIND 9, it can be given by
    the type mnemonic (such as ``NS`` or ``AAAA``). The default query type is
-   ``A``, unless the :option:`-x` option is supplied to indicate a reverse
+   ``A``, unless the ``-x`` option is supplied to indicate a reverse
    lookup. A zone transfer can be requested by specifying a type of
    AXFR. When an incremental zone transfer (IXFR) is required, set the
    ``type`` to ``ixfr=N``. The incremental zone transfer contains
@@ -178,27 +156,23 @@ Options
    the number of the type. If the resource record type is not supported
    in BIND 9, the result is displayed as described in :rfc:`3597`.
 
-.. option:: -u
-
+``-u``
    This option indicates that print query times should be provided in microseconds instead of milliseconds.
 
-.. option:: -v
-
+``-v``
    This option prints the version number and exits.
 
-.. option:: -x addr
-
+``-x addr``
    This option sets simplified reverse lookups, for mapping addresses to names. The
    ``addr`` is an IPv4 address in dotted-decimal notation, or a
-   colon-delimited IPv6 address. When the :option:`-x` option is used, there is no
+   colon-delimited IPv6 address. When the ``-x`` option is used, there is no
    need to provide the ``name``, ``class``, and ``type`` arguments.
-   :program:`dig` automatically performs a lookup for a name like
+   ``dig`` automatically performs a lookup for a name like
    ``94.2.0.192.in-addr.arpa`` and sets the query type and class to PTR
    and IN respectively. IPv6 addresses are looked up using nibble format
    under the IP6.ARPA domain.
 
-.. option:: -y [hmac:]keyname:secret
-
+``-y [hmac:]keyname:secret``
    This option signs queries using TSIG with the given authentication key.
    ``keyname`` is the name of the key, and ``secret`` is the
    base64-encoded shared secret. ``hmac`` is the name of the key algorithm;
@@ -207,15 +181,15 @@ Options
    not specified, the default is ``hmac-md5``; if MD5 was disabled, the default is
    ``hmac-sha256``.
 
-.. note:: Only the :option:`-k` option should be used, rather than the :option:`-y` option,
-   because with :option:`-y` the shared secret is supplied as a command-line
+.. note:: Only the ``-k`` option should be used, rather than the ``-y`` option,
+   because with ``-y`` the shared secret is supplied as a command-line
    argument in clear text. This may be visible in the output from ``ps1`` or
    in a history file maintained by the user's shell.
 
 Query Options
 ~~~~~~~~~~~~~
 
-:program:`dig` provides a number of query options which affect the way in which
+``dig`` provides a number of query options which affect the way in which
 lookups are made and the results displayed. Some of these set or reset
 flag bits in the query header, some determine which sections of the
 answer get printed, and others determine the timeout and retry
@@ -226,24 +200,20 @@ Each query option is identified by a keyword preceded by a plus sign
 the string ``no`` to negate the meaning of that keyword. Other keywords
 assign values to options, like the timeout interval. They have the form
 ``+keyword=value``. Keywords may be abbreviated, provided the
-abbreviation is unambiguous; for example, :option:`+cd` is equivalent to
-:option:`+cdflag`. The query options are:
+abbreviation is unambiguous; for example, ``+cd`` is equivalent to
+``+cdflag``. The query options are:
 
-.. option:: +aaflag, +noaaflag
-
-   This option is a synonym for :option:`+aaonly`, :option:`+noaaonly`.
-
-.. option:: +aaonly, +noaaonly
+``+[no]aaflag``
+   This option is a synonym for ``+[no]aaonly``.
 
+``+[no]aaonly``
    This option sets the ``aa`` flag in the query.
 
-.. option:: +additional, +noadditional
-
+``+[no]additional``
    This option displays [or does not display] the additional section of a reply. The
    default is to display it.
 
-.. option:: +adflag, +noadflag
-
+``+[no]adflag``
    This option sets [or does not set] the AD (authentic data) bit in the query. This
    requests the server to return whether all of the answer and authority
    sections have been validated as secure, according to the security
@@ -252,73 +222,61 @@ abbreviation is unambiguous; for example, :option:`+cd` is equivalent to
    indicates that some part of the answer was insecure or not validated.
    This bit is set by default.
 
-.. option:: +all, +noall
-
+``+[no]all``
    This option sets or clears all display flags.
 
-.. option:: +answer, +noanswer
-
+``+[no]answer``
    This option displays [or does not display] the answer section of a reply. The default
    is to display it.
 
-.. option:: +authority, +noauthority
-
+``+[no]authority``
    This option displays [or does not display] the authority section of a reply. The
    default is to display it.
 
-.. option:: +badcookie, +nobadcookie
-
+``+[no]badcookie``
    This option retries the lookup with a new server cookie if a BADCOOKIE response is
    received.
 
-.. option:: +besteffort, +nobesteffort
-
+``+[no]besteffort``
    This option attempts to display the contents of messages which are malformed. The
    default is to not display malformed answers.
 
-.. option:: +bufsize[=B]
-
+``+bufsize[=B]``
    This option sets the UDP message buffer size advertised using EDNS0 to
    ``B`` bytes.  The maximum and minimum sizes of this buffer are 65535 and
    0, respectively.  ``+bufsize`` restores the default buffer size.
 
-.. option:: +cd, +cdflag, +nocdflag
-
+``+[no]cdflag``
    This option sets [or does not set] the CD (checking disabled) bit in the query. This
    requests the server to not perform DNSSEC validation of responses.
 
-.. option:: +class, +noclass
-
+``+[no]class``
    This option displays [or does not display] the CLASS when printing the record.
 
-.. option:: +cmd, +nocmd
-
+``+[no]cmd``
    This option toggles the printing of the initial comment in the output, identifying the
-   version of :program:`dig` and the query options that have been applied. This option
+   version of ``dig`` and the query options that have been applied. This option
    always has a global effect; it cannot be set globally and then overridden on a
    per-lookup basis. The default is to print this comment.
 
-.. option:: +comments, +nocomments
-
+``+[no]comments``
    This option toggles the display of some comment lines in the output, with
    information about the packet header and OPT pseudosection, and the names of
    the response section. The default is to print these comments.
 
    Other types of comments in the output are not affected by this option, but
    can be controlled using other command-line switches. These include
-   :option:`+cmd`, :option:`+question`, :option:`+stats`, and :option:`+rrcomments`.
-
-.. option:: +cookie=####, +nocookie
+   ``+[no]cmd``, ``+[no]question``, ``+[no]stats``, and ``+[no]rrcomments``.
 
+``+[no]cookie=####``
    This option sends [or does not send] a COOKIE EDNS option, with an optional value. Replaying a COOKIE
    from a previous response allows the server to identify a previous
    client. The default is ``+cookie``.
 
-   ``+cookie`` is also set when :option:`+trace` is set to better emulate the
+   ``+cookie`` is also set when ``+trace`` is set to better emulate the
    default queries from a nameserver.
 
-.. option:: +crypto, +nocrypto
-
+``+[no]crypto``
    This option toggles the display of cryptographic fields in DNSSEC records. The
    contents of these fields are unnecessary for debugging most DNSSEC
    validation failures and removing them makes it easier to see the
@@ -326,78 +284,62 @@ abbreviation is unambiguous; for example, :option:`+cd` is equivalent to
    they are replaced by the string ``[omitted]`` or, in the DNSKEY case, the
    key ID is displayed as the replacement, e.g. ``[ key id = value ]``.
 
-.. option:: +defname, +nodefname
-
-   This option, which is deprecated, is treated as a synonym for
-   :option:`+search`, :option:`+nosearch`.
-
-.. option:: +dns64prefix, +nodns64prefix
+``+[no]defname``
+   This option, which is deprecated, is treated as a synonym for ``+[no]search``.
 
+``+[no]dns64prefix``
    Lookup IPV4ONLY.ARPA AAAA and print any DNS64 prefixes found.
 
-.. option:: +dnssec, +do, +nodnssec, +nodo
-
+``+[no]dnssec``
    This option requests that DNSSEC records be sent by setting the DNSSEC OK (DO) bit in
    the OPT record in the additional section of the query.
 
-.. option:: +domain=somename
-
+``+domain=somename``
    This option sets the search list to contain the single domain ``somename``, as if
    specified in a ``domain`` directive in ``/etc/resolv.conf``, and
-   enables search list processing as if the :option:`+search` option were
+   enables search list processing as if the ``+search`` option were
    given.
 
-.. option:: +edns[=#], +noedns
+``+dscp=value``
+   This option sets the DSCP code point to be used when sending the query. Valid DSCP
+   code points are in the range [0...63]. By default no code point is
+   explicitly set.
 
+``+[no]edns[=#]``
    This option specifies the EDNS version to query with. Valid values are 0 to 255.
    Setting the EDNS version causes an EDNS query to be sent.
    ``+noedns`` clears the remembered EDNS version. EDNS is set to 0 by
    default.
 
-.. option:: +ednsflags[=#], +noednsflags
-
+``+[no]ednsflags[=#]``
    This option sets the must-be-zero EDNS flags bits (Z bits) to the specified value.
    Decimal, hex, and octal encodings are accepted. Setting a named flag
    (e.g., DO) is silently ignored. By default, no Z bits are set.
 
-.. option:: +ednsnegotiation, +noednsnegotiation
-
+``+[no]ednsnegotiation``
    This option enables/disables EDNS version negotiation. By default, EDNS version
    negotiation is enabled.
 
-.. option:: +ednsopt[=code[:value]], +noednsopt
-
+``+[no]ednsopt[=code[:value]]``
    This option specifies the EDNS option with code point ``code`` and an optional payload
    of ``value`` as a hexadecimal string. ``code`` can be either an EDNS
    option name (for example, ``NSID`` or ``ECS``) or an arbitrary
    numeric value. ``+noednsopt`` clears the EDNS options to be sent.
 
-.. option:: +expire, +noexpire
-
+``+[no]expire``
    This option sends an EDNS Expire option.
 
-.. option:: +fail, +nofail
-
-   This option indicates that :iscman:`named` should try [or not try] the next server if a SERVFAIL is received. The default is
+``+[no]fail``
+   This option indicates that ``named`` should try [or not try] the next server if a SERVFAIL is received. The default is
    to not try the next server, which is the reverse of normal stub
    resolver behavior.
 
-.. option:: +fuzztime[=value], +nofuzztime
-
-   This option allows the signing time to be specified when generating
-   signed messages.  If a value is specified it is the seconds since
-   00:00:00 January 1, 1970 UTC ignoring leap seconds.  If no value
-   is specified 1646972129 (Fri 11 Mar 2022 04:15:29 UTC) is used.
-   The default is ``+nofuzztime`` and the current time is used.
-
-.. option:: +header-only, +noheader-only
-
+``+[no]header-only``
    This option sends a query with a DNS header without a question section. The
    default is to add a question section. The query type and query name
    are ignored when this is set.
 
-.. option:: +https[=value], +nohttps
-
+``+[no]https[=value]``
    This option indicates whether to use DNS over HTTPS (DoH) when querying
    name servers.  When this option is in use, the port number defaults to 443.
    The HTTP POST request mode is used when sending the query.
@@ -406,99 +348,90 @@ abbreviation is unambiguous; for example, :option:`+cd` is equivalent to
    query URI; the default is ``/dns-query``. So, for example, ``dig
    @example.com +https`` will use the URI ``https://example.com/dns-query``.
 
-.. option:: +https-get[=value], +nohttps-get
-
-   Similar to :option:`+https`, except that the HTTP GET request mode is used
+``+[no]https-get[=value]``
+   Similar to ``+https``, except that the HTTP GET request mode is used
    when sending the query.
 
-.. option:: +https-post[=value], +nohttps-post
+``+[no]https-post[=value]``
+   Same as ``+https``.
 
-   Same as :option:`+https`.
-
-.. option:: +http-plain[=value], +nohttp-plain
-
-   Similar to :option:`+https`, except that HTTP queries will be sent over a
+``+[no]http-plain[=value]``
+   Similar to ``+https``, except that HTTP queries will be sent over a
    non-encrypted channel. When this option is in use, the port number
    defaults to 80 and the HTTP request mode is POST.
 
-.. option:: +http-plain-get[=value], +nohttp-plain-get
+``+[no]http-plain-get[=value]``
+   Similar to ``+http-plain``, except that the HTTP request mode is GET.
 
-   Similar to :option:`+http-plain`, except that the HTTP request mode is GET.
-
-.. option:: +http-plain-post[=value], +nohttp-plain-post
-
-   Same as :option:`+http-plain`.
-
-.. option:: +identify, +noidentify
+``+[no]http-plain-post[=value]``
+   Same as ``+http-plain``.
 
+``+[no]identify``
    This option shows [or does not show] the IP address and port number that
-   supplied the answer, when the :option:`+short` option is enabled. If short
+   supplied the answer, when the ``+short`` option is enabled. If short
    form answers are requested, the default is not to show the source
    address and port number of the server that provided the answer.
 
-.. option:: +idn, +noidn
+``+[no]idnin``
+   This option processes [or does not process] IDN domain names on input. This requires
+   ``IDN SUPPORT`` to have been enabled at compile time.
 
-   Enable or disable IDN processing. By default IDN is enabled for
-   input query names, and for display when the output is a terminal.
+   The default is to process IDN input when standard output is a tty.
+   The IDN processing on input is disabled when ``dig`` output is redirected
+   to files, pipes, and other non-tty file descriptors.
 
-   You can also turn off :program:`dig`'s IDN processing by setting
-   the ``IDN_DISABLE`` environment variable.
+``+[no]idnout``
+   This option converts [or does not convert] puny code on output. This requires
+   ``IDN SUPPORT`` to have been enabled at compile time.
 
-.. option:: +ignore, +noignore
+   The default is to process puny code on output when standard output is
+   a tty. The puny code processing on output is disabled when ``dig`` output
+   is redirected to files, pipes, and other non-tty file descriptors.
 
-   This option ignores [or does not ignore] truncation in UDP
-   responses instead of retrying with TCP. By default, TCP retries are
-   performed.
-
-.. option:: +keepalive, +nokeepalive
+``+[no]ignore``
+   This option ignores [or does not ignore] truncation in UDP responses instead of retrying with TCP. By
+   default, TCP retries are performed.
 
+``+[no]keepalive``
    This option sends [or does not send] an EDNS Keepalive option.
 
-.. option:: +keepopen, +nokeepopen
-
+``+[no]keepopen``
    This option keeps [or does not keep] the TCP socket open between queries, and reuses it rather than
    creating a new TCP socket for each lookup. The default is
    ``+nokeepopen``.
 
-.. option:: +multiline, +nomultiline
-
+``+[no]multiline``
    This option prints [or does not print] records, like the SOA records, in a verbose multi-line format
    with human-readable comments. The default is to print each record on
-   a single line to facilitate machine parsing of the :program:`dig` output.
-
-.. option:: +ndots=D
+   a single line to facilitate machine parsing of the ``dig`` output.
 
+``+ndots=D``
    This option sets the number of dots (``D``) that must appear in ``name`` for
    it to be considered absolute. The default value is that defined using
    the ``ndots`` statement in ``/etc/resolv.conf``, or 1 if no ``ndots``
    statement is present. Names with fewer dots are interpreted as
    relative names, and are searched for in the domains listed in the
    ``search`` or ``domain`` directive in ``/etc/resolv.conf`` if
-   :option:`+search` is set.
-
-.. option:: +nsid, +nonsid
+   ``+search`` is set.
 
+``+[no]nsid``
    When enabled, this option includes an EDNS name server ID request when sending a query.
 
-.. option:: +nssearch, +nonssearch
-
-   When this option is set, :program:`dig` attempts to find the authoritative
+``+[no]nssearch``
+   When this option is set, ``dig`` attempts to find the authoritative
    name servers for the zone containing the name being looked up, and
    display the SOA record that each name server has for the zone.
    Addresses of servers that did not respond are also printed.
 
-.. option:: +onesoa, +noonesoa
-
+``+[no]onesoa``
    When enabled, this option prints only one (starting) SOA record when performing an AXFR. The
    default is to print both the starting and ending SOA records.
 
-.. option:: +opcode=value, +noopcode
-
+``+[no]opcode=value``
    When enabled, this option sets (restores) the DNS message opcode to the specified value. The
    default value is QUERY (0).
 
-.. option:: +padding=value
-
+``+padding=value``
    This option pads the size of the query packet using the EDNS Padding option to
    blocks of ``value`` bytes. For example, ``+padding=32`` causes a
    48-byte query to be padded to 64 bytes. The default block size is 0,
@@ -507,129 +440,80 @@ abbreviation is unambiguous; for example, :option:`+cd` is equivalent to
    mandatory. Responses to padded queries may also be padded, but only
    if the query uses TCP or DNS COOKIE.
 
-.. option:: +proxy[=src_addr[#src_port]-dst_addr[#dst_port]], +noproxy
-
-   When this option is set, :program:`dig` adds PROXYv2 headers to the
-   queries. When source and destination addresses are specified, the
-   headers contain them and use the ``PROXY`` command. It means for
-   the remote peer that the queries were sent on behalf of another
-   node and that the PROXYv2 header reflects the original connection
-   endpoints. The default source port is ``0`` and destination port is
-   `53`.
-
-   For encrypted DNS transports, to prevent accidental information
-   leakage, encryption is applied to the PROXYv2 headers: the headers
-   are sent right after the handshake process has been completed.
-
-   For plain DNS transports, no encryption is applied to the PROXYv2
-   headers.
-
-   If the addressees are omitted, PROXYv2 headers, that use the
-   ``LOCAL`` command set, are added instead. For the remote peer, that
-   means that the queries were sent on purpose without being relayed,
-   so the real connection endpoint addresses must be used.
-
-.. option:: +proxy-plain[=src_addr[#src_port]-dst_addr[#dst_port], +noproxy-plain
-
-   The same as ``+[no]proxy``, but instructs ``dig`` to send PROXYv2
-   headers ahead of any encryption, before any handshake messages are
-   sent. That makes :program:`dig` behave exactly how it is described
-   in the PROXY protocol specification, but not all software expects
-   such behaviour.
-
-   Please consult the software documentation to find out if you need
-   this option. (for example, ``dnsdist`` expects encrypted PROXYv2
-   headers sent over TLS when encryption is used, while ``HAProxy``
-   and many other software packages expect plain ones).
-
-   For plain DNS transports the option is effectively an alias for the
-   ``+[no]proxy`` described above.
-
-.. option:: +qid=value
-
+``+qid=value``
    This option specifies the query ID to use when sending queries.
 
-.. option:: +qr, +noqr
-
+``+[no]qr``
    This option toggles the display of the query message as it is sent. By default, the query
    is not printed.
 
-.. option:: +question, +noquestion
-
+``+[no]question``
    This option toggles the display of the question section of a query when an answer is
    returned. The default is to print the question section as a comment.
 
-.. option:: +raflag, +noraflag
-
+``+[no]raflag``
    This option sets [or does not set] the RA (Recursion Available) bit in the query. The
    default is ``+noraflag``. This bit is ignored by the server for
    QUERY.
 
-.. option:: +rdflag, +nordflag
-
-   This option is a synonym for :option:`+recurse`, :option:`+norecurse`.
-
-.. option:: +recurse, +norecurse
+``+[no]rdflag``
+   This option is a synonym for ``+[no]recurse``.
 
+``+[no]recurse``
    This option toggles the setting of the RD (recursion desired) bit in the query.
-   This bit is set by default, which means :program:`dig` normally sends
+   This bit is set by default, which means ``dig`` normally sends
    recursive queries. Recursion is automatically disabled when the
-   :option:`+nssearch` or :option:`+trace` query option is used.
-
-.. option:: +retry=T
+   ``+nssearch`` or ``+trace`` query option is used.
 
+``+retry=T``
    This option sets the number of times to retry UDP and TCP queries to server to ``T``
-   instead of the default, 2.  Unlike :option:`+tries`, this does not include
+   instead of the default, 2.  Unlike ``+tries``, this does not include
    the initial query.
 
-.. option:: +rrcomments, +norrcomments
-
+``+[no]rrcomments``
    This option toggles the display of per-record comments in the output (for example,
    human-readable key information about DNSKEY records). The default is
    not to print record comments unless multiline mode is active.
 
-.. option:: +search, +nosearch
-
+``+[no]search``
    This option uses [or does not use] the search list defined by the searchlist or domain
    directive in ``resolv.conf``, if any. The search list is not used by
    default.
 
    ``ndots`` from ``resolv.conf`` (default 1), which may be overridden by
-   :option:`+ndots`, determines whether the name is treated as relative
+   ``+ndots``, determines whether the name is treated as relative
    and hence whether a search is eventually performed.
 
-.. option:: +short, +noshort
-
+``+[no]short``
    This option toggles whether a terse answer is provided. The default is to print the answer in a verbose
    form. This option always has a global effect; it cannot be set globally and
    then overridden on a per-lookup basis.
 
-.. option:: +showbadcookie, +noshowbadcookie
-
+``+[no]showbadcookie``
    This option toggles whether to show the message containing the
    BADCOOKIE rcode before retrying the request or not. The default
    is to not show the messages.
 
-.. option:: +showsearch, +noshowsearch
-
+``+[no]showsearch``
    This option performs [or does not perform] a search showing intermediate results.
 
-.. option:: +split=W
+``+[no]sigchase``
+   This feature is now obsolete and has been removed; use ``delv``
+   instead.
 
+``+split=W``
    This option splits long hex- or base64-formatted fields in resource records into
    chunks of ``W`` characters (where ``W`` is rounded up to the nearest
    multiple of 4). ``+nosplit`` or ``+split=0`` causes fields not to be
    split at all. The default is 56 characters, or 44 characters when
    multiline mode is active.
 
-.. option:: +stats, +nostats
-
+``+[no]stats``
    This option toggles the printing of statistics: when the query was made, the size of the
    reply, etc. The default behavior is to print the query statistics as a
    comment after each lookup.
 
-.. option:: +subnet=addr[/prefix-length], +nosubnet
-
+``+[no]subnet=addr[/prefix-length]``
    This option sends [or does not send] an EDNS CLIENT-SUBNET option with the specified IP
    address or network prefix.
 
@@ -638,112 +522,83 @@ abbreviation is unambiguous; for example, :option:`+cd` is equivalent to
    prefix-length of zero, which signals a resolver that the client's
    address information must *not* be used when resolving this query.
 
-.. option:: +tcflag, +notcflag
-
+``+[no]tcflag``
    This option sets [or does not set] the TC (TrunCation) bit in the query. The default is
    ``+notcflag``. This bit is ignored by the server for QUERY.
 
-.. option:: +tcp, +notcp
-
-   This option indicates whether to use TCP when querying name
-   servers.  The default behavior is to use UDP unless a type ``any``
-   or ``ixfr=N`` query is requested, in which case the default is
-   TCP. AXFR queries always use TCP. To prevent retry over TCP when
-   TC=1 is returned from a UDP query, use ``+ignore``.
-
-.. option:: +timeout=T
+``+[no]tcp``
+   This option indicates whether to use TCP when querying name servers.
+   The default behavior is to use UDP unless a type ``any`` or ``ixfr=N``
+   query is requested, in which case the default is TCP. AXFR queries
+   always use TCP.
 
+``+timeout=T``
    This option sets the timeout for a query to ``T`` seconds. The default timeout is
    5 seconds. An attempt to set ``T`` to less than 1 is silently set to 1.
 
-.. option:: +tls, +notls
-
+``+[no]tls``
    This option indicates whether to use DNS over TLS (DoT) when querying
    name servers. When this option is in use, the port number defaults
    to 853.
 
-.. option:: +tls-ca[=file-name], +notls-ca
+``+[no]topdown``
+   This feature is related to ``dig +sigchase``, which is obsolete and
+   has been removed. Use ``delv`` instead.
 
-   This option enables remote server TLS certificate validation for
-   DNS transports, relying on TLS. Certificate authorities
-   certificates are loaded from the specified PEM file
-   (``file-name``). If the file is not specified, the default
-   certificates from the global certificates store are used.
-
-.. option:: +tls-certfile=file-name, +tls-keyfile=file-name, +notls-certfile, +notls-keyfile
-
-   These options set the state of certificate-based client
-   authentication for DNS transports, relying on TLS. Both certificate
-   chain file and private key file are expected to be in PEM format.
-   Both options must be specified at the same time.
-
-.. option:: +tls-hostname=hostname, +notls-hostname
-
-   This option makes :program:`dig` use the provided hostname during remote
-   server TLS certificate verification. Otherwise, the DNS server name
-   is used. This option has no effect if :option:`+tls-ca` is not specified.
-
-.. option:: +trace, +notrace
-
-   This option toggles tracing of the delegation path from the root name
-   servers for the name being looked up. Tracing is disabled by default.
-   When tracing is enabled, :program:`dig` makes iterative queries to
-   resolve the name being looked up. It follows referrals from the root
-   servers, showing the answer from each server that was used to resolve
-   the lookup.
+``+[no]trace``
+   This option toggles tracing of the delegation path from the root name servers for
+   the name being looked up. Tracing is disabled by default. When
+   tracing is enabled, ``dig`` makes iterative queries to resolve the
+   name being looked up. It follows referrals from the root servers,
+   showing the answer from each server that was used to resolve the
+   lookup.
 
    If ``@server`` is also specified, it affects only the initial query for
    the root zone name servers.
 
-   :option:`+dnssec` is set when :option:`+trace` is set, to better
-   emulate the default queries from a name server.
-
-   Note that the ``delv +ns`` option can also be used for tracing the
-   resolution of a name from the root (see :iscman:`delv`).
-
-.. option:: +tries=T
+   ``+dnssec`` is also set when ``+trace`` is set, to better emulate the
+   default queries from a name server.
 
+``+tries=T``
    This option sets the number of times to try UDP and TCP queries to server to ``T``
    instead of the default, 3. If ``T`` is less than or equal to zero,
    the number of tries is silently rounded up to 1.
 
-.. option:: +ttlid, +nottlid
+``+trusted-key=####``
+   This option formerly specified trusted keys for use with ``dig +sigchase``. This
+   feature is now obsolete and has been removed; use ``delv`` instead.
 
+``+[no]ttlid``
    This option displays [or does not display] the TTL when printing the record.
 
-.. option:: +ttlunits, +nottlunits
-
+``+[no]ttlunits``
    This option displays [or does not display] the TTL in friendly human-readable time
    units of ``s``, ``m``, ``h``, ``d``, and ``w``, representing seconds, minutes,
-   hours, days, and weeks. This implies :option:`+ttlid`.
-
-.. option:: +unknownformat, +nounknownformat
+   hours, days, and weeks. This implies ``+ttlid``.
 
+``+[no]unknownformat``
    This option prints all RDATA in unknown RR type presentation format (:rfc:`3597`).
    The default is to print RDATA for known types in the type's
    presentation format.
 
-.. option:: +vc, +novc
-
+``+[no]vc``
    This option uses [or does not use] TCP when querying name servers. This alternate
-   syntax to :option:`+tcp` is provided for backwards compatibility. The
+   syntax to ``+[no]tcp`` is provided for backwards compatibility. The
    ``vc`` stands for "virtual circuit."
 
-.. option:: +yaml, +noyaml
-
-   When enabled, this option prints the responses (and, if :option:`+qr` is in use, also the
+``+[no]yaml``
+   When enabled, this option prints the responses (and, if ``+qr`` is in use, also the
    outgoing queries) in a detailed YAML format.
 
-.. option:: +zflag, +nozflag
-
+``+[no]zflag``
    This option sets [or does not set] the last unassigned DNS header flag in a DNS query.
    This flag is off by default.
 
 Multiple Queries
 ~~~~~~~~~~~~~~~~
 
-The BIND 9 implementation of :program:`dig` supports specifying multiple
-queries on the command line (in addition to supporting the :option:`-f` batch
+The BIND 9 implementation of ``dig`` supports specifying multiple
+queries on the command line (in addition to supporting the ``-f`` batch
 file option). Each of those queries can be supplied with its own set of
 flags, options, and query options.
 
@@ -756,26 +611,37 @@ query.
 A global set of query options, which should be applied to all queries,
 can also be supplied. These global query options must precede the first
 tuple of name, class, type, options, flags, and query options supplied
-on the command line. Any global query options (except :option:`+cmd` and
-:option:`+short` options) can be overridden by a query-specific set of
+on the command line. Any global query options (except ``+[no]cmd`` and
+``+[no]short`` options) can be overridden by a query-specific set of
 query options. For example:
 
 ::
 
    dig +qr www.isc.org any -x 127.0.0.1 isc.org ns +noqr
 
-shows how :program:`dig` can be used from the command line to make three
+shows how ``dig`` can be used from the command line to make three
 lookups: an ANY query for ``www.isc.org``, a reverse lookup of 127.0.0.1,
 and a query for the NS records of ``isc.org``. A global query option of
-:option:`+qr` is applied, so that :program:`dig` shows the initial query it made for
-each lookup. The final query has a local query option of :option:`+noqr` which
-means that :program:`dig` does not print the initial query when it looks up the
+``+qr`` is applied, so that ``dig`` shows the initial query it made for
+each lookup. The final query has a local query option of ``+noqr`` which
+means that ``dig`` does not print the initial query when it looks up the
 NS records for ``isc.org``.
 
+IDN Support
+~~~~~~~~~~~
+
+If ``dig`` has been built with IDN (internationalized domain name)
+support, it can accept and display non-ASCII domain names. ``dig``
+appropriately converts character encoding of a domain name before sending
+a request to a DNS server or displaying a reply from the server.
+To turn off IDN support, use the parameters
+``+noidnin`` and ``+noidnout``, or define the ``IDN_DISABLE`` environment
+variable.
+
 Return Codes
 ~~~~~~~~~~~~
 
-:program:`dig` return codes are:
+``dig`` return codes are:
 
 ``0``
    DNS response received, including NXDOMAIN status
@@ -802,7 +668,7 @@ Files
 See Also
 ~~~~~~~~
 
-:iscman:`delv(1) <delv>`, :iscman:`host(1) <host>`, :iscman:`named(8) <named>`, :iscman:`dnssec-keygen(8) <dnssec-keygen>`, :rfc:`1035`.
+:manpage:`delv(1)`, :manpage:`host(1)`, :manpage:`named(8)`, :manpage:`dnssec-keygen(8)`, :rfc:`1035`.
 
 Bugs
 ~~~~

bin/dig/dighost.h

@@ -23,10 +23,10 @@
 #include <isc/formatcheck.h>
 #include <isc/lang.h>
 #include <isc/list.h>
-#include <isc/loop.h>
 #include <isc/magic.h>
 #include <isc/mem.h>
 #include <isc/netmgr.h>
+#include <isc/print.h>
 #include <isc/refcount.h>
 #include <isc/sockaddr.h>
 #include <isc/time.h>
@@ -105,18 +105,17 @@ typedef struct dig_searchlist dig_searchlist_t;
 struct dig_lookup {
 	unsigned int magic;
 	isc_refcount_t references;
-	bool aaonly, adflag, badcookie, besteffort, cdflag, cleared, comments,
+	bool aaonly, adflag, badcookie, besteffort, cdflag, comments,
 		dns64prefix, dnssec, doing_xfr, done_as_is, ednsneg, expandaaaa,
-		expire, fuzzing, header_only, identify, /*%< Append an "on
-							   server <foo>" message
-							 */
-		identify_previous_line, /*% Prepend a "Nameserver <foo>:"
-					   message, with newline and tab */
+		expire, header_only, identify, /*%< Append an "on server <foo>"
+						  message */
+		identify_previous_line,	       /*% Prepend a "Nameserver <foo>:"
+						  message, with newline and tab */
 		idnin, idnout, ignore, multiline, need_search, new_search,
 		noclass, nocrypto, nottl, ns_search_only, /*%< dig +nssearch,
 							     host -C */
-		ns_search_success, nsid, /*% Name Server ID (RFC 5001) */
-		onesoa, pending,	 /*%< Pending a successful answer */
+		nsid,		 /*% Name Server ID (RFC 5001) */
+		onesoa, pending, /*%< Pending a successful answer */
 		print_unknown_format, qr, raflag, recurse, section_additional,
 		section_answer, section_authority, section_question,
 		seenbadcookie, sendcookie, servfail_stops,
@@ -166,9 +165,11 @@ struct dig_lookup {
 	char *cookie;
 	dns_ednsopt_t *ednsopts;
 	unsigned int ednsoptscnt;
+	isc_dscp_t dscp;
 	unsigned int ednsflags;
 	dns_opcode_t opcode;
 	int rrcomments;
+	unsigned int eoferr;
 	uint16_t qid;
 	struct {
 		bool http_plain;
@@ -176,37 +177,17 @@ struct dig_lookup {
 		bool https_get;
 		char *https_path;
 	};
-	struct {
-		bool tls_ca_set;
-		char *tls_ca_file;
-		bool tls_hostname_set;
-		char *tls_hostname;
-		bool tls_cert_file_set;
-		char *tls_cert_file;
-		bool tls_key_file_set;
-		char *tls_key_file;
-		isc_tlsctx_cache_t *tls_ctx_cache;
-	};
-	struct {
-		bool proxy_mode;
-		bool proxy_plain;
-		bool proxy_local;
-		isc_sockaddr_t proxy_src_addr;
-		isc_sockaddr_t proxy_dst_addr;
-	};
-	isc_stdtime_t fuzztime;
 };
 
 /*% The dig_query structure */
 struct dig_query {
 	unsigned int magic;
 	dig_lookup_t *lookup;
-	bool started;
+	bool first_pass;
 	bool first_soa_rcvd;
 	bool second_rr_rcvd;
 	bool first_repeat_rcvd;
 	bool warn_id;
-	bool canceled;
 	uint32_t first_rr_serial;
 	uint32_t second_rr_serial;
 	uint32_t msg_count;
@@ -227,6 +208,7 @@ struct dig_query {
 	isc_time_t time_recv;
 	uint64_t byte_count;
 	isc_timer_t *timer;
+	isc_tlsctx_t *tlsctx;
 };
 
 struct dig_server {
@@ -266,12 +248,12 @@ extern isc_sockaddr_t localaddr;
 extern char keynametext[MXNAME];
 extern char keyfile[MXNAME];
 extern char keysecret[MXNAME];
-extern dst_algorithm_t hmac_alg;
+extern const dns_name_t *hmacname;
 extern unsigned int digestbits;
 extern dns_tsigkey_t *tsigkey;
 extern bool validated;
-extern isc_loopmgr_t *loopmgr;
-extern isc_loop_t *mainloop;
+extern isc_taskmgr_t *taskmgr;
+extern isc_task_t *global_task;
 extern bool free_now;
 extern bool debugging, debugtiming, memdebugging;
 extern bool keep_open;
@@ -293,18 +275,15 @@ getaddresses(dig_lookup_t *lookup, const char *host, isc_result_t *resultp);
 isc_result_t
 get_reverse(char *reverse, size_t len, char *value, bool strict);
 
-noreturn void
+ISC_NORETURN void
 fatal(const char *format, ...) ISC_FORMAT_PRINTF(1, 2);
 
 void
 warn(const char *format, ...) ISC_FORMAT_PRINTF(1, 2);
 
-noreturn void
+ISC_NORETURN void
 digexit(void);
 
-void
-cleanup_openssl_refs(void);
-
 void
 debug(const char *format, ...) ISC_FORMAT_PRINTF(1, 2);
 
@@ -324,10 +303,7 @@ void
 start_lookup(void);
 
 void
-onrun_callback(void *arg);
-
-void
-run_loop(void *arg);
+onrun_callback(isc_task_t *task, isc_event_t *event);
 
 int
 dhmain(int argc, char **argv);
@@ -348,7 +324,7 @@ isc_result_t
 parse_netprefix(isc_sockaddr_t **sap, const char *value);
 
 void
-parse_hmac(const char *algname);
+parse_hmac(const char *hmacstr);
 
 dig_lookup_t *
 requeue_lookup(dig_lookup_t *lookold, bool servers);
@@ -452,6 +428,12 @@ dig_query_setup(bool, bool, int argc, char **argv);
 void
 dig_startup(void);
 
+/*%
+ * Initiates the next lookup cycle
+ */
+void
+dig_query_start(void);
+
 /*%
  * Activate/deactivate IDN filtering of output.
  */
@@ -464,7 +446,4 @@ dig_idnsetup(dig_lookup_t *lookup, bool active);
 void
 dig_shutdown(void);
 
-bool
-dig_lookup_is_tls(const dig_lookup_t *lookup);
-
 ISC_LANG_ENDDECLS

bin/dig/host.c

@@ -19,11 +19,13 @@
 #include <stdbool.h>
 #include <stdlib.h>
 
+#include <isc/app.h>
 #include <isc/attributes.h>
 #include <isc/commandline.h>
-#include <isc/loop.h>
 #include <isc/netaddr.h>
+#include <isc/print.h>
 #include <isc/string.h>
+#include <isc/task.h>
 #include <isc/util.h>
 
 #include <dns/byaddr.h>
@@ -99,7 +101,7 @@ rcode_totext(dns_rcode_t rcode) {
 	return (totext.deconsttext);
 }
 
-noreturn static void
+ISC_NORETURN static void
 show_usage(void);
 
 static void
@@ -132,12 +134,12 @@ show_usage(void) {
 		"       -W specifies how long to wait for a reply\n"
 		"       -4 use IPv4 query transport only\n"
 		"       -6 use IPv6 query transport only\n");
-	exit(EXIT_FAILURE);
+	exit(1);
 }
 
 static void
 host_shutdown(void) {
-	isc_loopmgr_shutdown(loopmgr);
+	(void)isc_app_shutdown();
 }
 
 static void
@@ -149,9 +151,9 @@ received(unsigned int bytes, isc_sockaddr_t *from, dig_query_t *query) {
 		char fromtext[ISC_SOCKADDR_FORMATSIZE];
 		isc_sockaddr_format(from, fromtext, sizeof(fromtext));
 		if (query->lookup->use_usec) {
-			now = isc_time_now_hires();
+			TIME_NOW_HIRES(&now);
 		} else {
-			now = isc_time_now();
+			TIME_NOW(&now);
 		}
 		diff = (int)isc_time_microdiff(&now, &query->time_sent);
 		printf("Received %u bytes from %s in %d ms\n", bytes, fromtext,
@@ -209,9 +211,15 @@ printsection(dns_message_t *msg, dns_section_t sectionid,
 	isc_result_t result, loopresult;
 	isc_region_t r;
 	dns_name_t empty_name;
-	char tbuf[4096] = { 0 };
+	char tbuf[4096];
 	bool first;
-	bool no_rdata = (sectionid == DNS_SECTION_QUESTION);
+	bool no_rdata;
+
+	if (sectionid == DNS_SECTION_QUESTION) {
+		no_rdata = true;
+	} else {
+		no_rdata = false;
+	}
 
 	if (headers) {
 		printf(";; %s SECTION:\n", section_name);
@@ -531,8 +539,7 @@ printmessage(dig_query_t *query, const isc_buffer_t *msgbuf, dns_message_t *msg,
 	}
 
 	if (!ISC_LIST_EMPTY(msg->sections[DNS_SECTION_AUTHORITY]) &&
-	    !short_form)
-	{
+	    !short_form) {
 		printf("\n");
 		result = printsection(msg, DNS_SECTION_AUTHORITY, "AUTHORITY",
 				      true, query);
@@ -541,8 +548,7 @@ printmessage(dig_query_t *query, const isc_buffer_t *msgbuf, dns_message_t *msg,
 		}
 	}
 	if (!ISC_LIST_EMPTY(msg->sections[DNS_SECTION_ADDITIONAL]) &&
-	    !short_form)
-	{
+	    !short_form) {
 		printf("\n");
 		result = printsection(msg, DNS_SECTION_ADDITIONAL, "ADDITIONAL",
 				      true, query);
@@ -578,6 +584,12 @@ printmessage(dig_query_t *query, const isc_buffer_t *msgbuf, dns_message_t *msg,
 
 static const char *optstring = "46aAc:dilnm:p:rst:vVwCDN:R:TUW:";
 
+/*% version */
+static void
+version(void) {
+	fprintf(stderr, "host %s\n", PACKAGE_VERSION);
+}
+
 static void
 pre_parse_args(int argc, char **argv) {
 	int c;
@@ -590,12 +602,10 @@ pre_parse_args(int argc, char **argv) {
 			{
 				isc_mem_debugging |= ISC_MEM_DEBUGTRACE;
 			} else if (strcasecmp("record",
-					      isc_commandline_argument) == 0)
-			{
+					      isc_commandline_argument) == 0) {
 				isc_mem_debugging |= ISC_MEM_DEBUGRECORD;
 			} else if (strcasecmp("usage",
-					      isc_commandline_argument) == 0)
-			{
+					      isc_commandline_argument) == 0) {
 				isc_mem_debugging |= ISC_MEM_DEBUGUSAGE;
 			}
 			break;
@@ -653,8 +663,8 @@ pre_parse_args(int argc, char **argv) {
 		case 'v':
 			break;
 		case 'V':
-			printf("host %s\n", PACKAGE_VERSION);
-			exit(EXIT_SUCCESS);
+			version();
+			exit(0);
 			break;
 		case 'w':
 			break;
@@ -706,8 +716,7 @@ parse_args(bool is_batchfile, int argc, char **argv) {
 			break;
 		case 't':
 			if (strncasecmp(isc_commandline_argument, "ixfr=", 5) ==
-			    0)
-			{
+			    0) {
 				rdtype = dns_rdatatype_ixfr;
 				/* XXXMPA add error checking */
 				serial = strtoul(isc_commandline_argument + 5,
@@ -726,8 +735,7 @@ parse_args(bool is_batchfile, int argc, char **argv) {
 				      isc_commandline_argument);
 			}
 			if (!lookup->rdtypeset ||
-			    lookup->rdtype != dns_rdatatype_axfr)
-			{
+			    lookup->rdtype != dns_rdatatype_axfr) {
 				lookup->rdtype = rdtype;
 			}
 			lookup->rdtypeset = true;
@@ -768,11 +776,10 @@ parse_args(bool is_batchfile, int argc, char **argv) {
 			break;
 		case 'A':
 			list_almost_all = true;
-			FALLTHROUGH;
+		/* FALL THROUGH */
 		case 'a':
 			if (!lookup->rdtypeset ||
-			    lookup->rdtype != dns_rdatatype_axfr)
-			{
+			    lookup->rdtype != dns_rdatatype_axfr) {
 				lookup->rdtype = dns_rdatatype_any;
 			}
 			list_type = dns_rdatatype_any;
@@ -846,7 +853,6 @@ parse_args(bool is_batchfile, int argc, char **argv) {
 			break;
 		case 'p':
 			port = atoi(isc_commandline_argument);
-			port_set = true;
 			break;
 		}
 	}
@@ -884,6 +890,8 @@ parse_args(bool is_batchfile, int argc, char **argv) {
 
 int
 main(int argc, char **argv) {
+	isc_result_t result;
+
 	tries = 2;
 
 	ISC_LIST_INIT(lookup_list);
@@ -901,6 +909,8 @@ main(int argc, char **argv) {
 	debug("main()");
 	progname = argv[0];
 	pre_parse_args(argc, argv);
+	result = isc_app_start();
+	check_result(result, "isc_app_start");
 	setup_libs();
 	setup_system(ipv4only, ipv6only);
 	parse_args(false, argc, argv);
@@ -909,12 +919,11 @@ main(int argc, char **argv) {
 	} else if (keysecret[0] != 0) {
 		setup_text_key();
 	}
-
-	isc_loopmgr_setup(loopmgr, run_loop, NULL);
-	isc_loopmgr_run(loopmgr);
-
+	result = isc_app_onrun(mctx, global_task, onrun_callback, NULL);
+	check_result(result, "isc_app_onrun");
+	isc_app_run();
 	cancel_all();
 	destroy_libs();
-
+	isc_app_finish();
 	return ((seen_error == 0) ? 0 : 1);
 }

bin/dig/host.rst

@@ -11,8 +11,6 @@
 
 .. highlight: console
 
-.. iscman:: host
-.. program:: host
 .. _man_host:
 
 host - DNS lookup utility
@@ -26,64 +24,55 @@ Synopsis
 Description
 ~~~~~~~~~~~
 
-:program:`host` is a simple utility for performing DNS lookups. It is normally
+``host`` is a simple utility for performing DNS lookups. It is normally
 used to convert names to IP addresses and vice versa. When no arguments
-or options are given, :program:`host` prints a short summary of its
+or options are given, ``host`` prints a short summary of its
 command-line arguments and options.
 
 ``name`` is the domain name that is to be looked up. It can also be a
 dotted-decimal IPv4 address or a colon-delimited IPv6 address, in which
-case :program:`host` by default performs a reverse lookup for that address.
+case ``host`` by default performs a reverse lookup for that address.
 ``server`` is an optional argument which is either the name or IP
-address of the name server that :program:`host` should query instead of the
+address of the name server that ``host`` should query instead of the
 server or servers listed in ``/etc/resolv.conf``.
 
 Options
 ~~~~~~~
 
-.. option:: -4
+``-4``
+   This option specifies that only IPv4 should be used for query transport. See also the ``-6`` option.
 
-   This option specifies that only IPv4 should be used for query transport. See also the :option:`-6` option.
+``-6``
+   This option specifies that only IPv6 should be used for query transport. See also the ``-4`` option.
 
-.. option:: -6
+``-a``
+   The ``-a`` ("all") option is normally equivalent to ``-v -t ANY``. It
+   also affects the behavior of the ``-l`` list zone option.
 
-   This option specifies that only IPv6 should be used for query transport. See also the :option:`-4` option.
-
-.. option:: -a
-
-   The :option:`-a` ("all") option is normally equivalent to :option:`-v` :option:`-t ANY <-t>`. It
-   also affects the behavior of the :option:`-l` list zone option.
-
-.. option:: -A
-
-   The :option:`-A` ("almost all") option is equivalent to :option:`-a`, except that RRSIG,
+``-A``
+   The ``-A`` ("almost all") option is equivalent to ``-a``, except that RRSIG,
    NSEC, and NSEC3 records are omitted from the output.
 
-.. option:: -c class
-
+``-c class``
    This option specifies the query class, which can be used to lookup HS (Hesiod) or CH (Chaosnet)
    class resource records. The default class is IN (Internet).
 
-.. option:: -C
-
-   This option indicates that :iscman:`named` should check consistency, meaning that :program:`host` queries the SOA records for zone
+``-C``
+   This option indicates that ``named`` should check consistency, meaning that ``host`` queries the SOA records for zone
    ``name`` from all the listed authoritative name servers for that
    zone. The list of name servers is defined by the NS records that are
    found for the zone.
 
-.. option:: -d
+``-d``
+   This option prints debugging traces, and is equivalent to the ``-v`` verbose option.
 
-   This option prints debugging traces, and is equivalent to the :option:`-v` verbose option.
-
-.. option:: -l
-
-   This option tells :iscman:`named` to list the zone, meaning the :program:`host` command performs a zone transfer of zone
+``-l``
+   This option tells ``named`` to list the zone, meaning the ``host`` command performs a zone transfer of zone
    ``name`` and prints out the NS, PTR, and address records (A/AAAA).
 
-   Together, the :option:`-l` :option:`-a` options print all records in the zone.
-
-.. option:: -N ndots
+   Together, the ``-l -a`` options print all records in the zone.
 
+``-N ndots``
    This option specifies the number of dots (``ndots``) that have to be in ``name`` for it to be
    considered absolute. The default value is that defined using the
    ``ndots`` statement in ``/etc/resolv.conf``, or 1 if no ``ndots`` statement
@@ -91,96 +80,85 @@ Options
    and are searched for in the domains listed in the ``search`` or
    ``domain`` directive in ``/etc/resolv.conf``.
 
-.. option:: -p port
-
+``-p port``
    This option specifies the port to query on the server. The default is 53.
 
-.. option:: -r
-
+``-r``
    This option specifies a non-recursive query; setting this option clears the RD (recursion
    desired) bit in the query. This means that the name server
-   receiving the query does not attempt to resolve ``name``. The :option:`-r`
-   option enables :program:`host` to mimic the behavior of a name server by
+   receiving the query does not attempt to resolve ``name``. The ``-r``
+   option enables ``host`` to mimic the behavior of a name server by
    making non-recursive queries, and expecting to receive answers to
    those queries that can be referrals to other name servers.
 
-.. option:: -R number
-
+``-R number``
    This option specifies the number of retries for UDP queries. If ``number`` is negative or zero,
    the number of retries is silently set to 1. The default value is 1, or
    the value of the ``attempts`` option in ``/etc/resolv.conf``, if set.
 
-.. option:: -s
-
-   This option tells :iscman:`named` *not* to send the query to the next nameserver if any server responds
+``-s``
+   This option tells ``named`` *not* to send the query to the next nameserver if any server responds
    with a SERVFAIL response, which is the reverse of normal stub
    resolver behavior.
 
-.. option:: -t type
-
+``-t type``
    This option specifies the query type. The ``type`` argument can be any recognized query type:
    CNAME, NS, SOA, TXT, DNSKEY, AXFR, etc.
 
-   When no query type is specified, :program:`host` automatically selects an
+   When no query type is specified, ``host`` automatically selects an
    appropriate query type. By default, it looks for A, AAAA, and MX
-   records. If the :option:`-C` option is given, queries are made for SOA
+   records. If the ``-C`` option is given, queries are made for SOA
    records. If ``name`` is a dotted-decimal IPv4 address or
-   colon-delimited IPv6 address, :program:`host` queries for PTR records.
+   colon-delimited IPv6 address, ``host`` queries for PTR records.
 
    If a query type of IXFR is chosen, the starting serial number can be
    specified by appending an equals sign (=), followed by the starting serial
-   number, e.g., :option:`-t IXFR=12345678 <-t>`.
+   number, e.g., ``-t IXFR=12345678``.
 
-.. option:: -T, -U
-
-   This option specifies TCP or UDP. By default, :program:`host` uses UDP when making queries; the
-   :option:`-T` option makes it use a TCP connection when querying the name
+``-T``; ``-U``
+   This option specifies TCP or UDP. By default, ``host`` uses UDP when making queries; the
+   ``-T`` option makes it use a TCP connection when querying the name
    server. TCP is automatically selected for queries that require
    it, such as zone transfer (AXFR) requests. Type ``ANY`` queries default
-   to TCP, but can be forced to use UDP initially via :option:`-U`.
-
-.. option:: -m flag
+   to TCP, but can be forced to use UDP initially via ``-U``.
 
+``-m flag``
    This option sets memory usage debugging: the flag can be ``record``, ``usage``, or
-   ``trace``. The :option:`-m` option can be specified more than once to set
+   ``trace``. The ``-m`` option can be specified more than once to set
    multiple flags.
 
-.. option:: -v
-
-   This option sets verbose output, and is equivalent to the :option:`-d` debug option. Verbose output
+``-v``
+   This option sets verbose output, and is equivalent to the ``-d`` debug option. Verbose output
    can also be enabled by setting the ``debug`` option in
    ``/etc/resolv.conf``.
 
-.. option:: -V
-
+``-V``
    This option prints the version number and exits.
 
-.. option:: -w
-
+``-w``
    This option sets "wait forever": the query timeout is set to the maximum possible. See
-   also the :option:`-W` option.
+   also the ``-W`` option.
 
-.. option:: -W wait
-
-   This options sets the length of the wait timeout, indicating that :iscman:`named` should wait for up to ``wait`` seconds for a reply. If ``wait`` is
+``-W wait``
+   This options sets the length of the wait timeout, indicating that ``named`` should wait for up to ``wait`` seconds for a reply. If ``wait`` is
    less than 1, the wait interval is set to 1 second.
 
-   By default, :program:`host` waits for 5 seconds for UDP responses and 10
+   By default, ``host`` waits for 5 seconds for UDP responses and 10
    seconds for TCP connections. These defaults can be overridden by the
    ``timeout`` option in ``/etc/resolv.conf``.
 
-   See also the :option:`-w` option.
+   See also the ``-w`` option.
 
 IDN Support
 ~~~~~~~~~~~
 
-If :program:`host` has been built with IDN (internationalized domain name)
-support, it can accept and display non-ASCII domain names. :program:`host`
+If ``host`` has been built with IDN (internationalized domain name)
+support, it can accept and display non-ASCII domain names. ``host``
 appropriately converts character encoding of a domain name before sending
 a request to a DNS server or displaying a reply from the server.
 To turn off IDN support, define the ``IDN_DISABLE``
 environment variable. IDN support is disabled if the variable is set
-when :program:`host` runs.
+when ``host`` runs.
 
 Files
 ~~~~~
@@ -190,4 +168,4 @@ Files
 See Also
 ~~~~~~~~
 
-:iscman:`dig(1) <dig>`, :iscman:`named(8) <named>`.
+:manpage:`dig(1)`, :manpage:`named(8)`.

bin/dig/nslookup.c

@@ -16,17 +16,17 @@
 #include <stdlib.h>
 #include <unistd.h>
 
-#include <isc/async.h>
+#include <isc/app.h>
 #include <isc/attributes.h>
 #include <isc/buffer.h>
 #include <isc/commandline.h>
-#include <isc/condition.h>
-#include <isc/loop.h>
+#include <isc/event.h>
 #include <isc/netaddr.h>
 #include <isc/parseint.h>
+#include <isc/print.h>
 #include <isc/string.h>
+#include <isc/task.h>
 #include <isc/util.h>
-#include <isc/work.h>
 
 #include <dns/byaddr.h>
 #include <dns/fixedname.h>
@@ -41,9 +41,6 @@
 #include "dighost.h"
 #include "readline.h"
 
-static char cmdlinebuf[COMMSIZE];
-static char *cmdline = NULL;
-
 static bool short_form = true, tcpmode = false, tcpmode_set = false,
 	    identify = false, stats = true, comments = true,
 	    section_question = true, section_answer = true,
@@ -56,6 +53,7 @@ static bool interactive;
 static bool in_use = false;
 static char defclass[MXRD] = "IN";
 static char deftype[MXRD] = "A";
+static isc_event_t *global_event = NULL;
 static int query_error = 1, print_error = 0;
 
 static char domainopt[DNS_NAME_MAXTEXT];
@@ -114,6 +112,9 @@ static const char *rtypetext[] = {
 
 #define N_KNOWN_RRTYPES (sizeof(rtypetext) / sizeof(rtypetext[0]))
 
+static void
+getinput(isc_task_t *task, isc_event_t *event);
+
 static char *
 rcode_totext(dns_rcode_t rcode) {
 	static char buf[sizeof("?65535")];
@@ -131,6 +132,20 @@ rcode_totext(dns_rcode_t rcode) {
 	return (totext.deconsttext);
 }
 
+static void
+query_finished(void) {
+	isc_event_t *event = global_event;
+
+	debug("dighost_shutdown()");
+
+	if (!in_use) {
+		isc_app_shutdown();
+		return;
+	}
+
+	isc_task_send(global_task, &event);
+}
+
 static void
 printsoa(dns_rdata_t *rdata) {
 	dns_rdata_soa_t soa;
@@ -386,6 +401,8 @@ chase_cnamechain(dns_message_t *msg, dns_name_t *qname) {
 static isc_result_t
 printmessage(dig_query_t *query, const isc_buffer_t *msgbuf, dns_message_t *msg,
 	     bool headers) {
+	char servtext[ISC_SOCKADDR_FORMATSIZE];
+
 	UNUSED(msgbuf);
 
 	/* I've we've gotten this far, we've reached a server. */
@@ -394,7 +411,6 @@ printmessage(dig_query_t *query, const isc_buffer_t *msgbuf, dns_message_t *msg,
 	debug("printmessage()");
 
 	if (!default_lookups || query->lookup->rdtype == dns_rdatatype_a) {
-		char servtext[ISC_SOCKADDR_FORMATSIZE];
 		isc_sockaddr_format(&query->sockaddr, servtext,
 				    sizeof(servtext));
 		printf("Server:\t\t%s\n", query->userarg);
@@ -566,7 +582,6 @@ set_port(const char *value) {
 	isc_result_t result = parse_uint(&n, value, 65535, "port");
 	if (result == ISC_R_SUCCESS) {
 		port = (uint16_t)n;
-		port_set = true;
 	}
 }
 
@@ -597,6 +612,11 @@ set_ndots(const char *value) {
 	}
 }
 
+static void
+version(void) {
+	fprintf(stderr, "nslookup %s\n", PACKAGE_VERSION);
+}
+
 static void
 setoption(char *opt) {
 	size_t l = strlen(opt);
@@ -790,8 +810,10 @@ do_next_command(char *input) {
 	} else if ((strcasecmp(ptr, "server") == 0) ||
 		   (strcasecmp(ptr, "lserver") == 0))
 	{
+		isc_app_block();
 		set_nameserver(arg);
 		check_ra = false;
+		isc_app_unblock();
 		show_settings(true, true);
 	} else if (strcasecmp(ptr, "exit") == 0) {
 		in_use = false;
@@ -808,34 +830,31 @@ do_next_command(char *input) {
 }
 
 static void
-readline_next_command(void *arg) {
-	char *ptr = NULL;
+get_next_command(void) {
+	char cmdlinebuf[COMMSIZE];
+	char *cmdline, *ptr = NULL;
 
-	UNUSED(arg);
-
-	isc_loopmgr_blocking(loopmgr);
-	ptr = readline("> ");
-	isc_loopmgr_nonblocking(loopmgr);
-	if (ptr == NULL) {
-		return;
+	isc_app_block();
+	if (interactive) {
+		cmdline = ptr = readline("> ");
+		if (ptr != NULL && *ptr != 0) {
+			add_history(ptr);
+		}
+	} else {
+		cmdline = fgets(cmdlinebuf, COMMSIZE, stdin);
 	}
-
-	if (*ptr != 0) {
-		add_history(ptr);
-		strlcpy(cmdlinebuf, ptr, COMMSIZE);
-		cmdline = cmdlinebuf;
+	isc_app_unblock();
+	if (cmdline == NULL) {
+		in_use = false;
+	} else {
+		do_next_command(cmdline);
+	}
+	if (ptr != NULL) {
+		free(ptr);
 	}
-	free(ptr);
 }
 
-static void
-fgets_next_command(void *arg) {
-	UNUSED(arg);
-
-	cmdline = fgets(cmdlinebuf, COMMSIZE, stdin);
-}
-
-noreturn static void
+ISC_NORETURN static void
 usage(void);
 
 static void
@@ -849,7 +868,7 @@ usage(void) {
 			"'host' using default server\n");
 	fprintf(stderr, "   nslookup [-opt ...] host server # just look up "
 			"'host' using 'server'\n");
-	exit(EXIT_FAILURE);
+	exit(1);
 }
 
 static void
@@ -861,8 +880,8 @@ parse_args(int argc, char **argv) {
 		debug("main parsing %s", argv[0]);
 		if (argv[0][0] == '-') {
 			if (strncasecmp(argv[0], "-ver", 4) == 0) {
-				printf("nslookup %s\n", PACKAGE_VERSION);
-				exit(EXIT_SUCCESS);
+				version();
+				exit(0);
 			} else if (argv[0][1] != 0) {
 				setoption(&argv[0][1]);
 			} else {
@@ -885,54 +904,25 @@ parse_args(int argc, char **argv) {
 }
 
 static void
-start_next_command(void);
-
-static void
-process_next_command(void *arg ISC_ATTR_UNUSED) {
-	isc_loop_t *loop = isc_loop_main(loopmgr);
-	if (cmdline == NULL) {
-		in_use = false;
-	} else {
-		do_next_command(cmdline);
+getinput(isc_task_t *task, isc_event_t *event) {
+	UNUSED(task);
+	if (global_event == NULL) {
+		global_event = event;
+	}
+	while (in_use) {
+		get_next_command();
 		if (ISC_LIST_HEAD(lookup_list) != NULL) {
-			isc_async_run(loop, run_loop, NULL);
+			start_lookup();
 			return;
 		}
 	}
-
-	start_next_command();
-}
-
-static void
-start_next_command(void) {
-	isc_loop_t *loop = isc_loop_main(loopmgr);
-	if (!in_use) {
-		isc_loopmgr_shutdown(loopmgr);
-		return;
-	}
-
-	cmdline = NULL;
-
-	isc_loopmgr_pause(loopmgr);
-	if (interactive) {
-		isc_work_enqueue(loop, readline_next_command,
-				 process_next_command, loop);
-	} else {
-		isc_work_enqueue(loop, fgets_next_command, process_next_command,
-				 loop);
-	}
-	isc_loopmgr_resume(loopmgr);
-}
-
-static void
-read_loop(void *arg) {
-	UNUSED(arg);
-
-	start_next_command();
+	isc_app_shutdown();
 }
 
 int
 main(int argc, char **argv) {
+	isc_result_t result;
+
 	interactive = isatty(0);
 
 	ISC_LIST_INIT(lookup_list);
@@ -945,7 +935,10 @@ main(int argc, char **argv) {
 	dighost_printmessage = printmessage;
 	dighost_received = received;
 	dighost_trying = trying;
-	dighost_shutdown = start_next_command;
+	dighost_shutdown = query_finished;
+
+	result = isc_app_start();
+	check_result(result, "isc_app_start");
 
 	setup_libs();
 	progname = argv[0];
@@ -961,18 +954,23 @@ main(int argc, char **argv) {
 		set_search_domain(domainopt);
 	}
 	if (in_use) {
-		isc_loopmgr_setup(loopmgr, run_loop, NULL);
+		result = isc_app_onrun(mctx, global_task, onrun_callback, NULL);
 	} else {
-		isc_loopmgr_setup(loopmgr, read_loop, NULL);
+		result = isc_app_onrun(mctx, global_task, getinput, NULL);
 	}
+	check_result(result, "isc_app_onrun");
 	in_use = !in_use;
 
-	isc_loopmgr_run(loopmgr);
+	(void)isc_app_run();
 
 	puts("");
 	debug("done, and starting to shut down");
+	if (global_event != NULL) {
+		isc_event_free(&global_event);
+	}
 	cancel_all();
 	destroy_libs();
+	isc_app_finish();
 
 	return (query_error | print_error);
 }

bin/dig/nslookup.rst

@@ -11,8 +11,6 @@
 
 .. highlight: console
 
-.. iscman:: nslookup
-.. program:: nslookup
 .. _man_nslookup:
 
 nslookup - query Internet name servers interactively
@@ -26,8 +24,8 @@ Synopsis
 Description
 ~~~~~~~~~~~
 
-:program:`nslookup` is a program to query Internet domain name servers.
-:program:`nslookup` has two modes: interactive and non-interactive. Interactive
+``nslookup`` is a program to query Internet domain name servers.
+``nslookup`` has two modes: interactive and non-interactive. Interactive
 mode allows the user to query name servers for information about various
 hosts and domains or to print a list of hosts in a domain.
 Non-interactive mode prints just the name and requested
@@ -56,16 +54,16 @@ seconds, type:
 
    nslookup -query=hinfo  -timeout=10
 
-The ``-version`` option causes :program:`nslookup` to print the version number
+The ``-version`` option causes ``nslookup`` to print the version number
 and immediately exit.
 
 Interactive Commands
 ~~~~~~~~~~~~~~~~~~~~
 
 ``host [server]``
-   This command looks up information for :iscman:`host` using the current default server or
-   using ``server``, if specified. If :iscman:`host` is an Internet address and the
-   query type is A or PTR, the name of the host is returned. If :iscman:`host` is
+   This command looks up information for ``host`` using the current default server or
+   using ``server``, if specified. If ``host`` is an Internet address and the
+   query type is A or PTR, the name of the host is returned. If ``host`` is
    a name and does not have a trailing period (``.``), the search list is used
    to qualify the name.
 
@@ -183,19 +181,19 @@ Interactive Commands
 Return Values
 ~~~~~~~~~~~~~
 
-:program:`nslookup` returns with an exit status of 1 if any query failed, and 0
+``nslookup`` returns with an exit status of 1 if any query failed, and 0
 otherwise.
 
 IDN Support
 ~~~~~~~~~~~
 
-If :program:`nslookup` has been built with IDN (internationalized domain name)
-support, it can accept and display non-ASCII domain names. :program:`nslookup`
+If ``nslookup`` has been built with IDN (internationalized domain name)
+support, it can accept and display non-ASCII domain names. ``nslookup``
 appropriately converts character encoding of a domain name before sending
 a request to a DNS server or displaying a reply from the server.
 To turn off IDN support, define the ``IDN_DISABLE``
 environment variable. IDN support is disabled if the variable is set
-when :program:`nslookup` runs, or when the standard output is not a tty.
+when ``nslookup`` runs, or when the standard output is not a tty.
 
 Files
 ~~~~~
@@ -205,4 +203,4 @@ Files
 See Also
 ~~~~~~~~
 
-:iscman:`dig(1) <dig>`, :iscman:`host(1) <host>`, :iscman:`named(8) <named>`.
+:manpage:`dig(1)`, :manpage:`host(1)`, :manpage:`named(8)`.

bin/dnssec/Makefile.am

@@ -12,8 +12,7 @@ noinst_LTLIBRARIES = libdnssectool.la
 LDADD +=			\
 	libdnssectool.la	\
 	$(LIBISC_LIBS)		\
-	$(LIBDNS_LIBS)		\
-	$(OPENSSL_LIBS)
+	$(LIBDNS_LIBS)
 
 bin_PROGRAMS = \
 	dnssec-cds		\
@@ -32,20 +31,8 @@ libdnssectool_la_SOURCES =	\
 
 dnssec_keygen_CPPFLAGS =	\
 	$(AM_CPPFLAGS)		\
-	$(LIBISCCFG_CFLAGS)	\
-	$(OPENSSL_CFLAGS)
+	$(LIBISCCFG_CFLAGS)
 
 dnssec_keygen_LDADD =		\
 	$(LDADD)		\
-	$(LIBISCCFG_LIBS)	\
-	$(OPENSSL_LIBS)
-
-dnssec_signzone_CPPFLAGS =	\
-	$(AM_CPPFLAGS)		\
-	$(LIBISCCFG_CFLAGS)	\
-	$(OPENSSL_CFLAGS)
-
-dnssec_signzone_LDADD =		\
-	$(LDADD)		\
-	$(LIBISCCFG_LIBS)	\
-	$(OPENSSL_LIBS)
+	$(LIBISCCFG_LIBS)

bin/dnssec/dnssec-cds.c

@@ -30,6 +30,7 @@
 #include <isc/file.h>
 #include <isc/hash.h>
 #include <isc/mem.h>
+#include <isc/print.h>
 #include <isc/result.h>
 #include <isc/serial.h>
 #include <isc/string.h>
@@ -124,29 +125,15 @@ typedef isc_result_t
 ds_maker_func_t(isc_buffer_t *buf, dns_rdata_t *ds, dns_dsdigest_t dt,
 		dns_rdata_t *crdata);
 
-static dns_rdataset_t cdnskey_set = DNS_RDATASET_INIT;
-static dns_rdataset_t cdnskey_sig = DNS_RDATASET_INIT;
-static dns_rdataset_t cds_set = DNS_RDATASET_INIT;
-static dns_rdataset_t cds_sig = DNS_RDATASET_INIT;
-static dns_rdataset_t dnskey_set = DNS_RDATASET_INIT;
-static dns_rdataset_t dnskey_sig = DNS_RDATASET_INIT;
-static dns_rdataset_t old_ds_set = DNS_RDATASET_INIT;
-static dns_rdataset_t new_ds_set = DNS_RDATASET_INIT;
+static dns_rdataset_t cdnskey_set, cdnskey_sig;
+static dns_rdataset_t cds_set, cds_sig;
+static dns_rdataset_t dnskey_set, dnskey_sig;
+static dns_rdataset_t old_ds_set, new_ds_set;
 
-static keyinfo_t *old_key_tbl = NULL, *new_key_tbl = NULL;
+static keyinfo_t *old_key_tbl, *new_key_tbl;
 
 isc_buffer_t *new_ds_buf = NULL; /* backing store for new_ds_set */
 
-static dns_db_t *child_db = NULL;
-static dns_dbnode_t *child_node = NULL;
-static dns_db_t *parent_db = NULL;
-static dns_dbnode_t *parent_node = NULL;
-static dns_db_t *update_db = NULL;
-static dns_dbnode_t *update_node = NULL;
-static dns_dbversion_t *update_version = NULL;
-static bool cleanup_dst = false;
-static bool print_mem_stats = false;
-
 static void
 verbose_time(int level, const char *msg, isc_stdtime_t time) {
 	isc_result_t result;
@@ -247,8 +234,8 @@ static void
 load_db(const char *filename, dns_db_t **dbp, dns_dbnode_t **nodep) {
 	isc_result_t result;
 
-	result = dns_db_create(mctx, ZONEDB_DEFAULT, name, dns_dbtype_zone,
-			       rdclass, 0, NULL, dbp);
+	result = dns_db_create(mctx, "rbt", name, dns_dbtype_zone, rdclass, 0,
+			       NULL, dbp);
 	check_result(result, "dns_db_create()");
 
 	result = dns_db_load(*dbp, filename, dns_masterformat_text,
@@ -264,27 +251,21 @@ load_db(const char *filename, dns_db_t **dbp, dns_dbnode_t **nodep) {
 }
 
 static void
-free_db(dns_db_t **dbp, dns_dbnode_t **nodep, dns_dbversion_t **versionp) {
-	if (*dbp != NULL) {
-		if (*nodep != NULL) {
-			dns_db_detachnode(*dbp, nodep);
-		}
-		if (versionp != NULL && *versionp != NULL) {
-			dns_db_closeversion(*dbp, versionp, false);
-		}
-		dns_db_detach(dbp);
-	}
+free_db(dns_db_t **dbp, dns_dbnode_t **nodep) {
+	dns_db_detachnode(*dbp, nodep);
+	dns_db_detach(dbp);
 }
 
 static void
 load_child_sets(const char *file) {
-	load_db(file, &child_db, &child_node);
-	findset(child_db, child_node, dns_rdatatype_dnskey, &dnskey_set,
-		&dnskey_sig);
-	findset(child_db, child_node, dns_rdatatype_cdnskey, &cdnskey_set,
-		&cdnskey_sig);
-	findset(child_db, child_node, dns_rdatatype_cds, &cds_set, &cds_sig);
-	free_db(&child_db, &child_node, NULL);
+	dns_db_t *db = NULL;
+	dns_dbnode_t *node = NULL;
+
+	load_db(file, &db, &node);
+	findset(db, node, dns_rdatatype_dnskey, &dnskey_set, &dnskey_sig);
+	findset(db, node, dns_rdatatype_cdnskey, &cdnskey_set, &cdnskey_sig);
+	findset(db, node, dns_rdatatype_cds, &cds_set, &cds_sig);
+	free_db(&db, &node);
 }
 
 static void
@@ -333,6 +314,8 @@ get_dsset_name(char *filename, size_t size, const char *path,
 static void
 load_parent_set(const char *path) {
 	isc_result_t result;
+	dns_db_t *db = NULL;
+	dns_dbnode_t *node = NULL;
 	isc_time_t modtime;
 	char filename[PATH_MAX + 1];
 
@@ -345,20 +328,21 @@ load_parent_set(const char *path) {
 	}
 	notbefore = isc_time_seconds(&modtime);
 	if (startstr != NULL) {
-		isc_stdtime_t now = isc_stdtime_now();
+		isc_stdtime_t now;
+		isc_stdtime_get(&now);
 		notbefore = strtotime(startstr, now, notbefore, NULL);
 	}
 	verbose_time(1, "child records must not be signed before", notbefore);
 
-	load_db(filename, &parent_db, &parent_node);
-	findset(parent_db, parent_node, dns_rdatatype_ds, &old_ds_set, NULL);
+	load_db(filename, &db, &node);
+	findset(db, node, dns_rdatatype_ds, &old_ds_set, NULL);
 
 	if (!dns_rdataset_isassociated(&old_ds_set)) {
 		fatal("could not find DS records for %s in %s", namestr,
 		      filename);
 	}
 
-	free_db(&parent_db, &parent_node, NULL);
+	free_db(&db, &node);
 }
 
 #define MAX_CDS_RDATA_TEXT_SIZE DNS_RDATA_MAXLENGTH * 2
@@ -383,18 +367,17 @@ formatset(dns_rdataset_t *rdataset) {
 
 	isc_buffer_allocate(mctx, &buf, MAX_CDS_RDATA_TEXT_SIZE);
 	result = dns_master_rdatasettotext(name, rdataset, style, NULL, buf);
-	dns_master_styledestroy(&style, mctx);
 
 	if ((result == ISC_R_SUCCESS) && isc_buffer_availablelength(buf) < 1) {
 		result = ISC_R_NOSPACE;
 	}
 
-	if (result != ISC_R_SUCCESS) {
-		isc_buffer_free(&buf);
-		check_result(result, "dns_rdataset_totext()");
-	}
+	check_result(result, "dns_rdataset_totext()");
 
 	isc_buffer_putuint8(buf, 0);
+
+	dns_master_styledestroy(&style, mctx);
+
 	return (buf);
 }
 
@@ -437,7 +420,6 @@ write_parent_set(const char *path, const char *inplace, bool nsupdate,
 
 	result = isc_file_openunique(tmpname, &fp);
 	if (result != ISC_R_SUCCESS) {
-		isc_buffer_free(&buf);
 		fatal("open %s: %s", tmpname, isc_result_totext(result));
 	}
 	fprintf(fp, "%s", (char *)r.base);
@@ -532,22 +514,23 @@ static keyinfo_t *
 match_keyset_dsset(dns_rdataset_t *keyset, dns_rdataset_t *dsset,
 		   strictness_t strictness) {
 	isc_result_t result;
-	keyinfo_t *keytable, *ki;
+	keyinfo_t *keytable;
 	int i;
 
 	nkey = dns_rdataset_count(keyset);
 
-	keytable = isc_mem_cget(mctx, nkey, sizeof(keytable[0]));
+	keytable = isc_mem_get(mctx, sizeof(keyinfo_t) * nkey);
 
-	for (result = dns_rdataset_first(keyset), i = 0, ki = keytable;
-	     result == ISC_R_SUCCESS;
-	     result = dns_rdataset_next(keyset), i++, ki++)
+	for (result = dns_rdataset_first(keyset), i = 0;
+	     result == ISC_R_SUCCESS; result = dns_rdataset_next(keyset), i++)
 	{
+		keyinfo_t *ki;
 		dns_rdata_dnskey_t dnskey;
 		dns_rdata_t *keyrdata;
 		isc_region_t r;
 
 		INSIST(i < nkey);
+		ki = &keytable[i];
 		keyrdata = &ki->rdata;
 
 		dns_rdata_init(keyrdata);
@@ -585,15 +568,14 @@ free_keytable(keyinfo_t **keytable_p) {
 	keyinfo_t *ki;
 	int i;
 
-	REQUIRE(keytable != NULL);
-
-	for (i = 0, ki = keytable; i < nkey; i++, ki++) {
+	for (i = 0; i < nkey; i++) {
+		ki = &keytable[i];
 		if (ki->dst != NULL) {
 			dst_key_free(&ki->dst);
 		}
 	}
 
-	isc_mem_cput(mctx, keytable, nkey, sizeof(keytable[0]));
+	isc_mem_put(mctx, keytable, sizeof(keyinfo_t) * nkey);
 }
 
 /*
@@ -612,9 +594,8 @@ matching_sigs(keyinfo_t *keytbl, dns_rdataset_t *rdataset,
 	dns_secalg_t *algo;
 	int i;
 
-	REQUIRE(keytbl != NULL);
-
-	algo = isc_mem_cget(mctx, nkey, sizeof(algo[0]));
+	algo = isc_mem_get(mctx, nkey);
+	memset(algo, 0, nkey);
 
 	for (result = dns_rdataset_first(sigset); result == ISC_R_SUCCESS;
 	     result = dns_rdataset_next(sigset))
@@ -655,8 +636,7 @@ matching_sigs(keyinfo_t *keytbl, dns_rdataset_t *rdataset,
 						   NULL);
 
 			if (result != ISC_R_SUCCESS &&
-			    result != DNS_R_FROMWILDCARD)
-			{
+			    result != DNS_R_FROMWILDCARD) {
 				vbprintf(1,
 					 "skip RRSIG by key %d:"
 					 " verification failed: %s\n",
@@ -697,7 +677,7 @@ signed_loose(dns_secalg_t *algo) {
 			ok = true;
 		}
 	}
-	isc_mem_cput(mctx, algo, nkey, sizeof(algo[0]));
+	isc_mem_put(mctx, algo, nkey);
 	return (ok);
 }
 
@@ -739,7 +719,7 @@ signed_strict(dns_rdataset_t *dsset, dns_secalg_t *algo) {
 		}
 	}
 
-	isc_mem_cput(mctx, algo, nkey, sizeof(algo[0]));
+	isc_mem_put(mctx, algo, nkey);
 	return (all_ok);
 }
 
@@ -818,7 +798,6 @@ append_new_ds_set(ds_maker_func_t *ds_from_rdata, isc_buffer_t *buf,
 			isc_mem_put(mctx, ds, sizeof(*ds));
 			return (result);
 		default:
-			isc_mem_put(mctx, ds, sizeof(*ds));
 			check_result(result, "ds_from_rdata()");
 		}
 	}
@@ -829,13 +808,12 @@ append_new_ds_set(ds_maker_func_t *ds_from_rdata, isc_buffer_t *buf,
 static void
 make_new_ds_set(ds_maker_func_t *ds_from_rdata, uint32_t ttl,
 		dns_rdataset_t *crdset) {
+	isc_result_t result;
+	dns_rdatalist_t *dslist;
 	unsigned int size = 16;
+	unsigned i, n;
 
 	for (;;) {
-		isc_result_t result = ISC_R_SUCCESS;
-		dns_rdatalist_t *dslist = NULL;
-		size_t n;
-
 		dslist = isc_mem_get(mctx, sizeof(*dslist));
 		dns_rdatalist_init(dslist);
 		dslist->rdclass = rdclass;
@@ -843,12 +821,13 @@ make_new_ds_set(ds_maker_func_t *ds_from_rdata, uint32_t ttl,
 		dslist->ttl = ttl;
 
 		dns_rdataset_init(&new_ds_set);
-		dns_rdatalist_tordataset(dslist, &new_ds_set);
+		result = dns_rdatalist_tordataset(dslist, &new_ds_set);
+		check_result(result, "dns_rdatalist_tordataset(dslist)");
 
 		isc_buffer_allocate(mctx, &new_ds_buf, size);
 
 		n = sizeof(dtype) / sizeof(dtype[0]);
-		for (size_t i = 0; i < n && dtype[i] != 0; i++) {
+		for (i = 0; i < n && dtype[i] != 0; i++) {
 			result = append_new_ds_set(ds_from_rdata, new_ds_buf,
 						   dslist, dtype[i], crdset);
 			if (result != ISC_R_SUCCESS) {
@@ -866,7 +845,7 @@ make_new_ds_set(ds_maker_func_t *ds_from_rdata, uint32_t ttl,
 	}
 }
 
-static int
+static inline int
 rdata_cmp(const void *rdata1, const void *rdata2) {
 	return (dns_rdata_compare((const dns_rdata_t *)rdata1,
 				  (const dns_rdata_t *)rdata2));
@@ -894,7 +873,7 @@ consistent_digests(dns_rdataset_t *dsset) {
 
 	n = dns_rdataset_count(dsset);
 
-	arrdata = isc_mem_cget(mctx, n, sizeof(dns_rdata_t));
+	arrdata = isc_mem_get(mctx, n * sizeof(dns_rdata_t));
 
 	for (result = dns_rdataset_first(dsset), i = 0; result == ISC_R_SUCCESS;
 	     result = dns_rdataset_next(dsset), i++)
@@ -908,7 +887,7 @@ consistent_digests(dns_rdataset_t *dsset) {
 	/*
 	 * Convert sorted arrdata to more accessible format
 	 */
-	ds = isc_mem_cget(mctx, n, sizeof(dns_rdata_ds_t));
+	ds = isc_mem_get(mctx, n * sizeof(dns_rdata_ds_t));
 
 	for (i = 0; i < n; i++) {
 		result = dns_rdata_tostruct(&arrdata[i], &ds[i], NULL);
@@ -947,8 +926,8 @@ consistent_digests(dns_rdataset_t *dsset) {
 	/*
 	 * Done!
 	 */
-	isc_mem_cput(mctx, ds, n, sizeof(dns_rdata_ds_t));
-	isc_mem_cput(mctx, arrdata, n, sizeof(dns_rdata_t));
+	isc_mem_put(mctx, ds, n * sizeof(dns_rdata_ds_t));
+	isc_mem_put(mctx, arrdata, n * sizeof(dns_rdata_t));
 
 	return (match);
 }
@@ -976,27 +955,32 @@ static void
 update_diff(const char *cmd, uint32_t ttl, dns_rdataset_t *addset,
 	    dns_rdataset_t *delset) {
 	isc_result_t result;
+	dns_db_t *db;
+	dns_dbnode_t *node;
+	dns_dbversion_t *ver;
 	dns_rdataset_t diffset;
 	uint32_t save;
 
-	result = dns_db_create(mctx, ZONEDB_DEFAULT, name, dns_dbtype_zone,
-			       rdclass, 0, NULL, &update_db);
+	db = NULL;
+	result = dns_db_create(mctx, "rbt", name, dns_dbtype_zone, rdclass, 0,
+			       NULL, &db);
 	check_result(result, "dns_db_create()");
 
-	result = dns_db_newversion(update_db, &update_version);
+	ver = NULL;
+	result = dns_db_newversion(db, &ver);
 	check_result(result, "dns_db_newversion()");
 
-	result = dns_db_findnode(update_db, name, true, &update_node);
+	node = NULL;
+	result = dns_db_findnode(db, name, true, &node);
 	check_result(result, "dns_db_findnode()");
 
 	dns_rdataset_init(&diffset);
 
-	result = dns_db_addrdataset(update_db, update_node, update_version, 0,
-				    addset, DNS_DBADD_MERGE, NULL);
+	result = dns_db_addrdataset(db, node, ver, 0, addset, DNS_DBADD_MERGE,
+				    NULL);
 	check_result(result, "dns_db_addrdataset()");
 
-	result = dns_db_subtractrdataset(update_db, update_node, update_version,
-					 delset, 0, &diffset);
+	result = dns_db_subtractrdataset(db, node, ver, delset, 0, &diffset);
 	if (result == DNS_R_UNCHANGED) {
 		save = addset->ttl;
 		addset->ttl = ttl;
@@ -1009,7 +993,9 @@ update_diff(const char *cmd, uint32_t ttl, dns_rdataset_t *addset,
 		dns_rdataset_disassociate(&diffset);
 	}
 
-	free_db(&update_db, &update_node, &update_version);
+	dns_db_detachnode(db, &node);
+	dns_db_closeversion(db, &ver, false);
+	dns_db_detach(&db);
 }
 
 static void
@@ -1029,7 +1015,7 @@ nsdiff(uint32_t ttl, dns_rdataset_t *oldset, dns_rdataset_t *newset) {
 	}
 }
 
-noreturn static void
+ISC_NORETURN static void
 usage(void);
 
 static void
@@ -1056,33 +1042,7 @@ usage(void) {
 			"    -T <ttl>           TTL of DS records\n"
 			"    -V                 print version\n"
 			"    -v <verbosity>\n");
-	exit(EXIT_FAILURE);
-}
-
-static void
-cleanup(void) {
-	free_db(&child_db, &child_node, NULL);
-	free_db(&parent_db, &parent_node, NULL);
-	free_db(&update_db, &update_node, &update_version);
-	if (old_key_tbl != NULL) {
-		free_keytable(&old_key_tbl);
-	}
-	if (new_key_tbl != NULL) {
-		free_keytable(&new_key_tbl);
-	}
-	free_all_sets();
-	if (lctx != NULL) {
-		cleanup_logging(&lctx);
-	}
-	if (cleanup_dst) {
-		dst_lib_destroy();
-	}
-	if (mctx != NULL) {
-		if (print_mem_stats && verbose > 10) {
-			isc_mem_stats(mctx, stdout);
-		}
-		isc_mem_destroy(&mctx);
-	}
+	exit(1);
 }
 
 int
@@ -1097,8 +1057,6 @@ main(int argc, char *argv[]) {
 	int ch;
 	char *endp;
 
-	setfatalcallback(cleanup);
-
 	isc_mem_create(&mctx);
 
 	isc_commandline_errprint = false;
@@ -1127,8 +1085,7 @@ main(int argc, char *argv[]) {
 			 * optional, so that it works just like sed(1).
 			 */
 			if (isc_commandline_argument ==
-			    argv[isc_commandline_index - 1])
-			{
+			    argv[isc_commandline_index - 1]) {
 				isc_commandline_index--;
 				inplace = "";
 			} else {
@@ -1185,7 +1142,6 @@ main(int argc, char *argv[]) {
 		fatal("could not initialize dst: %s",
 		      isc_result_totext(result));
 	}
-	cleanup_dst = true;
 
 	if (ds_path == NULL) {
 		fatal("missing -d DS pathname");
@@ -1221,8 +1177,7 @@ main(int argc, char *argv[]) {
 		fatal("missing RRSIG CDNSKEY records for %s", namestr);
 	}
 	if (dns_rdataset_isassociated(&cds_set) &&
-	    !dns_rdataset_isassociated(&cds_sig))
-	{
+	    !dns_rdataset_isassociated(&cds_sig)) {
 		fatal("missing RRSIG CDS records for %s", namestr);
 	}
 
@@ -1245,8 +1200,7 @@ main(int argc, char *argv[]) {
 	if (dns_rdataset_isassociated(&cdnskey_set)) {
 		vbprintf(1, "verify CDNSKEY signature(s)\n");
 		if (!signed_loose(matching_sigs(old_key_tbl, &cdnskey_set,
-						&cdnskey_sig)))
-		{
+						&cdnskey_sig))) {
 			fatal("could not validate child CDNSKEY RRset for %s",
 			      namestr);
 		}
@@ -1254,8 +1208,7 @@ main(int argc, char *argv[]) {
 	if (dns_rdataset_isassociated(&cds_set)) {
 		vbprintf(1, "verify CDS signature(s)\n");
 		if (!signed_loose(
-			    matching_sigs(old_key_tbl, &cds_set, &cds_sig)))
-		{
+			    matching_sigs(old_key_tbl, &cds_set, &cds_sig))) {
 			fatal("could not validate child CDS RRset for %s",
 			      namestr);
 		}
@@ -1285,7 +1238,7 @@ main(int argc, char *argv[]) {
 		vbprintf(1, "%s has neither CDS nor CDNSKEY records\n",
 			 namestr);
 		write_parent_set(ds_path, inplace, nsupdate, &old_ds_set);
-		goto cleanup;
+		exit(0);
 	}
 
 	/*
@@ -1351,9 +1304,13 @@ main(int argc, char *argv[]) {
 
 	write_parent_set(ds_path, inplace, nsupdate, &new_ds_set);
 
-cleanup:
-	print_mem_stats = true;
-	cleanup();
+	free_all_sets();
+	cleanup_logging(&lctx);
+	dst_lib_destroy();
+	if (verbose > 10) {
+		isc_mem_stats(mctx, stdout);
+	}
+	isc_mem_destroy(&mctx);
 
-	return (0);
+	exit(0);
 }

bin/dnssec/dnssec-cds.rst

@@ -11,8 +11,6 @@
 
 .. highlight: console
 
-.. iscman:: dnssec-cds
-.. program:: dnssec-cds
 .. _man_dnssec-cds:
 
 dnssec-cds - change DS records for a child zone based on CDS/CDNSKEY
@@ -26,60 +24,59 @@ Synopsis
 Description
 ~~~~~~~~~~~
 
-The :program:`dnssec-cds` command changes DS records at a delegation point
+The ``dnssec-cds`` command changes DS records at a delegation point
 based on CDS or CDNSKEY records published in the child zone. If both CDS
 and CDNSKEY records are present in the child zone, the CDS is preferred.
 This enables a child zone to inform its parent of upcoming changes to
-its key-signing keys (KSKs); by polling periodically with :program:`dnssec-cds`, the
+its key-signing keys (KSKs); by polling periodically with ``dnssec-cds``, the
 parent can keep the DS records up-to-date and enable automatic rolling
 of KSKs.
 
-Two input files are required. The :option:`-f child-file <-f>` option specifies a
+Two input files are required. The ``-f child-file`` option specifies a
 file containing the child's CDS and/or CDNSKEY records, plus RRSIG and
-DNSKEY records so that they can be authenticated. The :option:`-d path <-d>` option
+DNSKEY records so that they can be authenticated. The ``-d path`` option
 specifies the location of a file containing the current DS records. For
 example, this could be a ``dsset-`` file generated by
-:iscman:`dnssec-signzone`, or the output of :iscman:`dnssec-dsfromkey`, or the
-output of a previous run of :program:`dnssec-cds`.
+``dnssec-signzone``, or the output of ``dnssec-dsfromkey``, or the
+output of a previous run of ``dnssec-cds``.
 
-The :program:`dnssec-cds` command uses special DNSSEC validation logic
+The ``dnssec-cds`` command uses special DNSSEC validation logic
 specified by :rfc:`7344`. It requires that the CDS and/or CDNSKEY records
 be validly signed by a key represented in the existing DS records. This
 is typically the pre-existing KSK.
 
 For protection against replay attacks, the signatures on the child
 records must not be older than they were on a previous run of
-:program:`dnssec-cds`. Their age is obtained from the modification time of the
-``dsset-`` file, or from the :option:`-s` option.
+``dnssec-cds``. Their age is obtained from the modification time of the
+``dsset-`` file, or from the ``-s`` option.
 
-To protect against breaking the delegation, :program:`dnssec-cds` ensures that
+To protect against breaking the delegation, ``dnssec-cds`` ensures that
 the DNSKEY RRset can be verified by every key algorithm in the new DS
 RRset, and that the same set of keys are covered by every DS digest
 type.
 
 By default, replacement DS records are written to the standard output;
-with the :option:`-i` option the input file is overwritten in place. The
+with the ``-i`` option the input file is overwritten in place. The
 replacement DS records are the same as the existing records, when no
 change is required. The output can be empty if the CDS/CDNSKEY records
 specify that the child zone wants to be insecure.
 
 .. warning::
 
-   Be careful not to delete the DS records when :program:`dnssec-cds` fails!
+   Be careful not to delete the DS records when ``dnssec-cds`` fails!
 
-Alternatively, :option`dnssec-cds -u` writes an :iscman:`nsupdate` script to the
-standard output. The :option:`-u` and :option:`-i` options can be used together to
-maintain a ``dsset-`` file as well as emit an :iscman:`nsupdate` script.
+Alternatively, ``dnssec-cds -u`` writes an ``nsupdate`` script to the
+standard output. The ``-u`` and ``-i`` options can be used together to
+maintain a ``dsset-`` file as well as emit an ``nsupdate`` script.
 
 Options
 ~~~~~~~
 
-.. option:: -a algorithm
-
+``-a algorithm``
    When converting CDS records to DS records, this option specifies
    the acceptable digest algorithms. This option can be repeated, so
    that multiple digest types are allowed. If none of the CDS records
-   use an acceptable digest type, :program:`dnssec-cds` will try to use CDNSKEY
+   use an acceptable digest type, ``dnssec-cds`` will try to use CDNSKEY
    records instead; if there are no CDNSKEY records, it reports an error.
 
    When converting CDNSKEY records to DS records, this option specifies the
@@ -90,40 +87,35 @@ Options
    are case-insensitive, and the hyphen may be omitted. If no algorithm
    is specified, the default is SHA-256 only.
 
-.. option:: -c class
-
+``-c class``
    This option specifies the DNS class of the zones.
 
-.. option:: -D
-
+``-D``
    This option generates DS records from CDNSKEY records if both CDS and CDNSKEY
    records are present in the child zone. By default CDS records are
    preferred.
 
-.. option:: -d path
-
+``-d path``
    This specifies the location of the parent DS records. The path can be the name of a file
-   containing the DS records; if it is a directory, :program:`dnssec-cds`
+   containing the DS records; if it is a directory, ``dnssec-cds``
    looks for a ``dsset-`` file for the domain inside the directory.
 
    To protect against replay attacks, child records are rejected if they
    were signed earlier than the modification time of the ``dsset-``
-   file. This can be adjusted with the :option:`-s` option.
-
-.. option:: -f child-file
+   file. This can be adjusted with the ``-s`` option.
 
+``-f child-file``
    This option specifies the file containing the child's CDS and/or CDNSKEY records, plus its
    DNSKEY records and the covering RRSIG records, so that they can be
    authenticated.
 
    The examples below describe how to generate this file.
 
-.. option:: -i extension
-
+``-iextension``
    This option updates the ``dsset-`` file in place, instead of writing DS records to
    the standard output.
 
-   There must be no space between the :option:`-i` and the extension. If
+   There must be no space between the ``-i`` and the extension. If
    no extension is provided, the old ``dsset-`` is discarded. If an
    extension is present, a backup of the old ``dsset-`` file is kept
    with the extension appended to its filename.
@@ -133,8 +125,7 @@ Options
    child records, provided that it is later than the file's current
    modification time.
 
-.. option:: -s start-time
-
+``-s start-time``
    This option specifies the date and time after which RRSIG records become
    acceptable. This can be either an absolute or a relative time. An
    absolute start time is indicated by a number in YYYYMMDDHHMMSS
@@ -146,28 +137,24 @@ Options
    If no start-time is specified, the modification time of the
    ``dsset-`` file is used.
 
-.. option:: -T ttl
-
+``-T ttl``
    This option specifies a TTL to be used for new DS records. If not specified, the
    default is the TTL of the old DS records. If they had no explicit TTL,
    the new DS records also have no explicit TTL.
 
-.. option:: -u
-
-   This option writes an :iscman:`nsupdate` script to the standard output, instead of
+``-u``
+   This option writes an ``nsupdate`` script to the standard output, instead of
    printing the new DS reords. The output is empty if no change is
    needed.
 
    Note: The TTL of new records needs to be specified: it can be done in the
-   original ``dsset-`` file, with the :option:`-T` option, or using the
-   :iscman:`nsupdate` ``ttl`` command.
-
-.. option:: -V
+   original ``dsset-`` file, with the ``-T`` option, or using the
+   ``nsupdate`` ``ttl`` command.
 
+``-V``
    This option prints version information.
 
-.. option:: -v level
-
+``-v level``
    This option sets the debugging level. Level 1 is intended to be usefully verbose
    for general users; higher levels are intended for developers.
 
@@ -177,7 +164,7 @@ Options
 Exit Status
 ~~~~~~~~~~~
 
-The :program:`dnssec-cds` command exits 0 on success, or non-zero if an error
+The ``dnssec-cds`` command exits 0 on success, or non-zero if an error
 occurred.
 
 If successful, the DS records may or may not need to be
@@ -186,12 +173,12 @@ changed.
 Examples
 ~~~~~~~~
 
-Before running :iscman:`dnssec-signzone`, ensure that the delegations
-are up-to-date by running :program:`dnssec-cds` on every ``dsset-`` file.
+Before running ``dnssec-signzone``, ensure that the delegations
+are up-to-date by running ``dnssec-cds`` on every ``dsset-`` file.
 
-To fetch the child records required by :program:`dnssec-cds`, invoke
-:iscman:`dig` as in the script below. It is acceptable if the :iscman:`dig` fails, since
-:program:`dnssec-cds` performs all the necessary checking.
+To fetch the child records required by ``dnssec-cds``, invoke
+``dig`` as in the script below. It is acceptable if the ``dig`` fails, since
+``dnssec-cds`` performs all the necessary checking.
 
 ::
 
@@ -202,8 +189,8 @@ To fetch the child records required by :program:`dnssec-cds`, invoke
        dnssec-cds -i -f /dev/stdin -d $f $d
    done
 
-When the parent zone is automatically signed by :iscman:`named`,
-:program:`dnssec-cds` can be used with :iscman:`nsupdate` to maintain a delegation as follows.
+When the parent zone is automatically signed by ``named``,
+``dnssec-cds`` can be used with ``nsupdate`` to maintain a delegation as follows.
 The ``dsset-`` file allows the script to avoid having to fetch and
 validate the parent DS records, and it maintains the replay attack
 protection time.
@@ -217,5 +204,5 @@ protection time.
 See Also
 ~~~~~~~~
 
-:iscman:`dig(1) <dig>`, :iscman:`dnssec-settime(8) <dnssec-settime>`, :iscman:`dnssec-signzone(8) <dnssec-signzone>`, :iscman:`nsupdate(1) <nsupdate>`, BIND 9 Administrator
+:manpage:`dig(1)`, :manpage:`dnssec-settime(8)`, :manpage:`dnssec-signzone(8)`, :manpage:`nsupdate(1)`, BIND 9 Administrator
 Reference Manual, :rfc:`7344`.

bin/dnssec/dnssec-dsfromkey.c

@@ -23,6 +23,7 @@
 #include <isc/dir.h>
 #include <isc/hash.h>
 #include <isc/mem.h>
+#include <isc/print.h>
 #include <isc/result.h>
 #include <isc/string.h>
 #include <isc/util.h>
@@ -100,8 +101,8 @@ loadset(const char *filename, dns_rdataset_t *rdataset) {
 
 	dns_name_format(name, setname, sizeof(setname));
 
-	result = dns_db_create(mctx, ZONEDB_DEFAULT, name, dns_dbtype_zone,
-			       rdclass, 0, NULL, &db);
+	result = dns_db_create(mctx, "rbt", name, dns_dbtype_zone, rdclass, 0,
+			       NULL, &db);
 	if (result != ISC_R_SUCCESS) {
 		fatal("can't create database");
 	}
@@ -274,7 +275,7 @@ emit(dns_dsdigest_t dt, bool showall, bool cds, dns_rdata_t *rdata) {
 		fatal("can't build record");
 	}
 
-	result = dns_name_totext(name, 0, &nameb);
+	result = dns_name_totext(name, false, &nameb);
 	if (result != ISC_R_SUCCESS) {
 		fatal("can't print name");
 	}
@@ -313,7 +314,7 @@ emit(dns_dsdigest_t dt, bool showall, bool cds, dns_rdata_t *rdata) {
 
 static void
 emits(bool showall, bool cds, dns_rdata_t *rdata) {
-	unsigned int i, n;
+	unsigned i, n;
 
 	n = sizeof(dtype) / sizeof(dtype[0]);
 	for (i = 0; i < n; i++) {
@@ -323,7 +324,7 @@ emits(bool showall, bool cds, dns_rdata_t *rdata) {
 	}
 }
 
-noreturn static void
+ISC_NORETURN static void
 usage(void);
 
 static void
@@ -353,7 +354,7 @@ usage(void) {
 			"    -V: print version information\n");
 	fprintf(stderr, "Output: DS or CDS RRs\n");
 
-	exit(EXIT_FAILURE);
+	exit(-1);
 }
 
 int
@@ -433,14 +434,14 @@ main(int argc, char **argv) {
 			}
 			break;
 		case 'F':
-			/* Reserved for FIPS mode */
-			FALLTHROUGH;
+		/* Reserved for FIPS mode */
+		/* FALLTHROUGH */
 		case '?':
 			if (isc_commandline_option != '?') {
 				fprintf(stderr, "%s: invalid argument -%c\n",
 					program, isc_commandline_option);
 			}
-			FALLTHROUGH;
+		/* FALLTHROUGH */
 		case 'h':
 			/* Does not return. */
 			usage();
@@ -452,7 +453,7 @@ main(int argc, char **argv) {
 		default:
 			fprintf(stderr, "%s: unhandled option -%c\n", program,
 				isc_commandline_option);
-			exit(EXIT_FAILURE);
+			exit(1);
 		}
 	}
 

bin/dnssec/dnssec-dsfromkey.rst

@@ -11,8 +11,6 @@
 
 .. highlight: console
 
-.. iscman:: dnssec-dsfromkey
-.. program:: dnssec-dsfromkey
 .. _man_dnssec-dsfromkey:
 
 dnssec-dsfromkey - DNSSEC DS RR generation tool
@@ -32,37 +30,34 @@ Synopsis
 Description
 ~~~~~~~~~~~
 
-The :program:`dnssec-dsfromkey` command outputs DS (Delegation Signer) resource records
-(RRs), or CDS (Child DS) RRs with the :option:`-C` option.
+The ``dnssec-dsfromkey`` command outputs DS (Delegation Signer) resource records
+(RRs), or CDS (Child DS) RRs with the ``-C`` option.
 
 By default, only KSKs are converted (keys with flags = 257).  The
-:option:`-A` option includes ZSKs (flags = 256).  Revoked keys are never
+``-A`` option includes ZSKs (flags = 256).  Revoked keys are never
 included.
 
 The input keys can be specified in a number of ways:
 
-By default, :program:`dnssec-dsfromkey` reads a key file named in the format
-``Knnnn.+aaa+iiiii.key``, as generated by :iscman:`dnssec-keygen`.
+By default, ``dnssec-dsfromkey`` reads a key file named in the format
+``Knnnn.+aaa+iiiii.key``, as generated by ``dnssec-keygen``.
 
-With the :option:`-f file <-f>` option, :program:`dnssec-dsfromkey` reads keys from a zone
+With the ``-f file`` option, ``dnssec-dsfromkey`` reads keys from a zone
 file or partial zone file (which can contain just the DNSKEY records).
 
-With the :option:`-s` option, :program:`dnssec-dsfromkey` reads a ``keyset-`` file,
-as generated by :iscman:`dnssec-keygen` :option:`-C`.
+With the ``-s`` option, ``dnssec-dsfromkey`` reads a ``keyset-`` file,
+as generated by ``dnssec-keygen`` ``-C``.
 
 Options
 ~~~~~~~
 
-.. option:: -1
+``-1``
+   This option is an abbreviation for ``-a SHA1``.
 
-   This option is an abbreviation for :option:`-a SHA1 <-a>`.
-
-.. option:: -2
-
-   This option is an abbreviation for :option:`-a SHA-256 <-a>`.
-
-.. option:: -a algorithm
+``-2``
+   This option is an abbreviation for ``-a SHA-256``.
 
+``-a algorithm``
    This option specifies a digest algorithm to use when converting DNSKEY records to
    DS records. This option can be repeated, so that multiple DS records
    are created for each DNSKEY record.
@@ -71,57 +66,47 @@ Options
    are case-insensitive, and the hyphen may be omitted. If no algorithm
    is specified, the default is SHA-256.
 
-.. option:: -A
-
+``-A``
    This option indicates that ZSKs are to be included when generating DS records. Without this option, only
    keys which have the KSK flag set are converted to DS records and
-   printed. This option is only useful in :option:`-f` zone file mode.
+   printed. This option is only useful in ``-f`` zone file mode.
 
-.. option:: -c class
-
-   This option specifies the DNS class; the default is IN. This option is only useful in :option:`-s` keyset
-   or :option:`-f` zone file mode.
-
-.. option:: -C
+``-c class``
+   This option specifies the DNS class; the default is IN. This option is only useful in ``-s`` keyset
+   or ``-f`` zone file mode.
 
+``-C``
    This option generates CDS records rather than DS records.
 
-.. option:: -f file
-
-   This option sets zone file mode, in which the final dnsname argument of :program:`dnssec-dsfromkey` is the
+``-f file``
+   This option sets zone file mode, in which the final dnsname argument of ``dnssec-dsfromkey`` is the
    DNS domain name of a zone whose master file can be read from
    ``file``. If the zone name is the same as ``file``, then it may be
    omitted.
 
    If ``file`` is ``-``, then the zone data is read from the standard
-   input. This makes it possible to use the output of the :iscman:`dig`
+   input. This makes it possible to use the output of the ``dig``
    command as input, as in:
 
    ``dig dnskey example.com | dnssec-dsfromkey -f - example.com``
 
-.. option:: -h
-
+``-h``
    This option prints usage information.
 
-.. option:: -K directory
-
+``-K directory``
    This option tells BIND 9 to look for key files or ``keyset-`` files in ``directory``.
 
-.. option:: -s
-
-   This option enables keyset mode, in which the final dnsname argument from :program:`dnssec-dsfromkey` is the DNS
+``-s``
+   This option enables keyset mode, in which the final dnsname argument from ``dnssec-dsfromkey`` is the DNS
    domain name used to locate a ``keyset-`` file.
 
-.. option:: -T TTL
-
+``-T TTL``
    This option specifies the TTL of the DS records. By default the TTL is omitted.
 
-.. option:: -v level
-
+``-v level``
    This option sets the debugging level.
 
-.. option:: -V
-
+``-V``
    This option prints version information.
 
 Example
@@ -141,7 +126,7 @@ Files
 
 The keyfile can be designated by the key identification
 ``Knnnn.+aaa+iiiii`` or the full file name ``Knnnn.+aaa+iiiii.key``, as
-generated by :iscman:`dnssec-keygen`.
+generated by ``dnssec-keygen``.
 
 The keyset file name is built from the ``directory``, the string
 ``keyset-``, and the ``dnsname``.
@@ -154,6 +139,6 @@ A keyfile error may return "file not found," even if the file exists.
 See Also
 ~~~~~~~~
 
-:iscman:`dnssec-keygen(8) <dnssec-keygen>`, :iscman:`dnssec-signzone(8) <dnssec-signzone>`, BIND 9 Administrator Reference Manual,
+:manpage:`dnssec-keygen(8)`, :manpage:`dnssec-signzone(8)`, BIND 9 Administrator Reference Manual,
 :rfc:`3658` (DS RRs), :rfc:`4509` (SHA-256 for DS RRs),
 :rfc:`6605` (SHA-384 for DS RRs), :rfc:`7344` (CDS and CDNSKEY RRs).

bin/dnssec/dnssec-importkey.c

@@ -21,6 +21,7 @@
 #include <isc/commandline.h>
 #include <isc/hash.h>
 #include <isc/mem.h>
+#include <isc/print.h>
 #include <isc/result.h>
 #include <isc/string.h>
 #include <isc/util.h>
@@ -103,8 +104,8 @@ loadset(const char *filename, dns_rdataset_t *rdataset) {
 
 	dns_name_format(name, setname, sizeof(setname));
 
-	result = dns_db_create(mctx, ZONEDB_DEFAULT, name, dns_dbtype_zone,
-			       rdclass, 0, NULL, &db);
+	result = dns_db_create(mctx, "rbt", name, dns_dbtype_zone, rdclass, 0,
+			       NULL, &db);
 	if (result != ISC_R_SUCCESS) {
 		fatal("can't create database");
 	}
@@ -262,7 +263,7 @@ emit(const char *dir, dns_rdata_t *rdata) {
 	dst_key_free(&key);
 }
 
-noreturn static void
+ISC_NORETURN static void
 usage(void);
 
 static void
@@ -289,7 +290,7 @@ usage(void) {
 	fprintf(stderr, "    -D sync date/[+-]offset/none: set/unset "
 			"CDS and CDNSKEY deletion date\n");
 
-	exit(EXIT_FAILURE);
+	exit(-1);
 }
 
 int
@@ -302,9 +303,10 @@ main(int argc, char **argv) {
 	isc_log_t *log = NULL;
 	dns_rdataset_t rdataset;
 	dns_rdata_t rdata;
-	isc_stdtime_t now = isc_stdtime_now();
+	isc_stdtime_t now;
 
 	dns_rdata_init(&rdata);
+	isc_stdtime_get(&now);
 
 	if (argc == 1) {
 		usage();
@@ -383,7 +385,7 @@ main(int argc, char **argv) {
 				fprintf(stderr, "%s: invalid argument -%c\n",
 					program, isc_commandline_option);
 			}
-			FALLTHROUGH;
+		/* FALLTHROUGH */
 		case 'h':
 			/* Does not return. */
 			usage();
@@ -395,7 +397,7 @@ main(int argc, char **argv) {
 		default:
 			fprintf(stderr, "%s: unhandled option -%c\n", program,
 				isc_commandline_option);
-			exit(EXIT_FAILURE);
+			exit(1);
 		}
 	}
 

bin/dnssec/dnssec-importkey.rst

@@ -11,8 +11,6 @@
 
 .. highlight: console
 
-.. iscman:: dnssec-importkey
-.. program:: dnssec-importkey
 .. _man_dnssec-importkey:
 
 dnssec-importkey - import DNSKEY records from external systems so they can be managed
@@ -28,7 +26,7 @@ Synopsis
 Description
 ~~~~~~~~~~~
 
-:program:`dnssec-importkey` reads a public DNSKEY record and generates a pair
+``dnssec-importkey`` reads a public DNSKEY record and generates a pair
 of .key/.private files. The DNSKEY record may be read from an
 existing .key file, in which case a corresponding .private file is
 generated, or it may be read from any other file or from the standard
@@ -36,15 +34,14 @@ input, in which case both .key and .private files are generated.
 
 The newly created .private file does *not* contain private key data, and
 cannot be used for signing. However, having a .private file makes it
-possible to set publication (:option:`-P`) and deletion (:option:`-D`) times for the
+possible to set publication (``-P``) and deletion (``-D``) times for the
 key, which means the public key can be added to and removed from the
 DNSKEY RRset on schedule even if the true private key is stored offline.
 
 Options
 ~~~~~~~
 
-.. option:: -f filename
-
+``-f filename``
    This option indicates the zone file mode. Instead of a public keyfile name, the argument is the
    DNS domain name of a zone master file, which can be read from
    ``filename``. If the domain name is the same as ``filename``, then it may be
@@ -53,90 +50,64 @@ Options
    If ``filename`` is set to ``"-"``, then the zone data is read from the
    standard input.
 
-.. option:: -K directory
-
+``-K directory``
    This option sets the directory in which the key files are to reside.
 
-.. option:: -L ttl
-
+``-L ttl``
    This option sets the default TTL to use for this key when it is converted into a
    DNSKEY RR. This is the TTL used when the key is imported into a zone,
    unless there was already a DNSKEY RRset in
    place, in which case the existing TTL takes precedence. Setting the default TTL to ``0`` or ``none``
    removes it from the key.
 
-.. option:: -h
-
+``-h``
    This option emits a usage message and exits.
 
-.. option:: -v level
-
+``-v level``
    This option sets the debugging level.
 
-.. option:: -V
-
+``-V``
    This option prints version information.
 
 Timing Options
 ~~~~~~~~~~~~~~
 
-Dates can be expressed in the format YYYYMMDD or YYYYMMDDHHMMSS.
-(which is the format used inside key files),
-or 'Day Mon DD HH:MM:SS YYYY' (as printed by ``dnssec-settime -p``),
-or UNIX epoch time (as printed by ``dnssec-settime -up``),
-or the literal ``now``.
-
-The argument can be followed by ``+`` or ``-`` and an offset from the
-given time. The literal ``now`` can be omitted before an offset. The
-offset can be followed by one of the suffixes ``y``, ``mo``, ``w``,
-``d``, ``h``, or ``mi``, so that it is computed in years (defined as
-365 24-hour days, ignoring leap years), months (defined as 30 24-hour
-days), weeks, days, hours, or minutes, respectively. Without a suffix,
-the offset is computed in seconds.
-
-To explicitly prevent a date from being set, use ``none``, ``never``,
-or ``unset``.
-
-All these formats are case-insensitive.
-
-.. option:: -P date/offset
+Dates can be expressed in the format YYYYMMDD or YYYYMMDDHHMMSS. If the
+argument begins with a ``+`` or ``-``, it is interpreted as an offset from
+the present time. For convenience, if such an offset is followed by one
+of the suffixes ``y``, ``mo``, ``w``, ``d``, ``h``, or ``mi``, then the offset is
+computed in years (defined as 365 24-hour days, ignoring leap years),
+months (defined as 30 24-hour days), weeks, days, hours, or minutes,
+respectively. Without a suffix, the offset is computed in seconds. To
+explicitly prevent a date from being set, use ``none`` or ``never``.
 
+``-P date/offset``
    This option sets the date on which a key is to be published to the zone. After
    that date, the key is included in the zone but is not used
    to sign it.
 
-   .. program:: dnssec-importkey -P
-   .. option:: sync date/offset
-
-      This option sets the date on which CDS and CDNSKEY records that match this key
-      are to be published to the zone.
-
-.. program:: dnssec-importkey
-
-.. option:: -D date/offset
+``-P sync date/offset``
+   This option sets the date on which CDS and CDNSKEY records that match this key
+   are to be published to the zone.
 
+``-D date/offset``
    This option sets the date on which the key is to be deleted. After that date, the
    key is no longer included in the zone. (However, it may remain in the key
    repository.)
 
-   .. program:: dnssec-importkey -D
-   .. option:: sync date/offset
-
-      This option sets the date on which the CDS and CDNSKEY records that match this
-      key are to be deleted.
-
-.. program:: dnssec-importkey
-
+``-D sync date/offset``
+   This option sets the date on which the CDS and CDNSKEY records that match this
+   key are to be deleted.
 
 Files
 ~~~~~
 
 A keyfile can be designed by the key identification ``Knnnn.+aaa+iiiii``
 or the full file name ``Knnnn.+aaa+iiiii.key``, as generated by
-:iscman:`dnssec-keygen`.
+``dnssec-keygen``.
 
 See Also
 ~~~~~~~~
 
-:iscman:`dnssec-keygen(8) <dnssec-keygen>`, :iscman:`dnssec-signzone(8) <dnssec-signzone>`, BIND 9 Administrator Reference Manual,
+:manpage:`dnssec-keygen(8)`, :manpage:`dnssec-signzone(8)`, BIND 9 Administrator Reference Manual,
 :rfc:`5011`.

bin/dnssec/dnssec-keyfromlabel.c

@@ -22,6 +22,7 @@
 #include <isc/buffer.h>
 #include <isc/commandline.h>
 #include <isc/mem.h>
+#include <isc/print.h>
 #include <isc/region.h>
 #include <isc/result.h>
 #include <isc/string.h>
@@ -43,7 +44,7 @@
 
 const char *program = "dnssec-keyfromlabel";
 
-noreturn static void
+ISC_NORETURN static void
 usage(void);
 
 static void
@@ -56,7 +57,7 @@ usage(void) {
 	fprintf(stderr, "    name: owner of the key\n");
 	fprintf(stderr, "Other options:\n");
 	fprintf(stderr, "    -a algorithm: \n"
-			"        RSASHA1 |\n"
+			"        DH | RSASHA1 |\n"
 			"        NSEC3RSASHA1 |\n"
 			"        RSASHA256 | RSASHA512 |\n"
 			"        ECDSAP256SHA256 | ECDSAP384SHA384 |\n"
@@ -102,7 +103,7 @@ usage(void) {
 	fprintf(stderr, "     K<name>+<alg>+<id>.key, "
 			"K<name>+<alg>+<id>.private\n");
 
-	exit(EXIT_FAILURE);
+	exit(-1);
 }
 
 int
@@ -135,6 +136,7 @@ main(int argc, char **argv) {
 	dns_ttl_t ttl = 0;
 	isc_stdtime_t publish = 0, activate = 0, revoke = 0;
 	isc_stdtime_t inactive = 0, deltime = 0;
+	isc_stdtime_t now;
 	int prepub = -1;
 	bool setpub = false, setact = false;
 	bool setrev = false, setinact = false;
@@ -150,7 +152,6 @@ main(int argc, char **argv) {
 	isc_stdtime_t syncadd = 0, syncdel = 0;
 	bool unsetsyncadd = false, setsyncadd = false;
 	bool unsetsyncdel = false, setsyncdel = false;
-	isc_stdtime_t now = isc_stdtime_now();
 
 	if (argc == 1) {
 		usage();
@@ -160,6 +161,8 @@ main(int argc, char **argv) {
 
 	isc_commandline_errprint = false;
 
+	isc_stdtime_get(&now);
+
 #define CMDLINE_FLAGS "3A:a:Cc:D:E:Ff:GhI:i:kK:L:l:n:P:p:R:S:t:v:Vy"
 	while ((ch = isc_commandline_parse(argc, argv, CMDLINE_FLAGS)) != -1) {
 		switch (ch) {
@@ -312,14 +315,14 @@ main(int argc, char **argv) {
 			prepub = strtottl(isc_commandline_argument);
 			break;
 		case 'F':
-			/* Reserved for FIPS mode */
-			FALLTHROUGH;
+		/* Reserved for FIPS mode */
+		/* FALLTHROUGH */
 		case '?':
 			if (isc_commandline_option != '?') {
 				fprintf(stderr, "%s: invalid argument -%c\n",
 					program, isc_commandline_option);
 			}
-			FALLTHROUGH;
+		/* FALLTHROUGH */
 		case 'h':
 			/* Does not return. */
 			usage();
@@ -331,7 +334,7 @@ main(int argc, char **argv) {
 		default:
 			fprintf(stderr, "%s: unhandled option -%c\n", program,
 				isc_commandline_option);
-			exit(EXIT_FAILURE);
+			exit(1);
 		}
 	}
 
@@ -385,6 +388,9 @@ main(int argc, char **argv) {
 		if (ret != ISC_R_SUCCESS) {
 			fatal("unknown algorithm %s", algname);
 		}
+		if (alg == DST_ALG_DH) {
+			options |= DST_TYPE_KEY;
+		}
 
 		if (use_nsec3) {
 			switch (alg) {
@@ -553,8 +559,7 @@ main(int argc, char **argv) {
 		flags |= DNS_KEYOWNER_ZONE;
 	} else if ((options & DST_TYPE_KEY) != 0) { /* KEY */
 		if (strcasecmp(nametype, "host") == 0 ||
-		    strcasecmp(nametype, "entity") == 0)
-		{
+		    strcasecmp(nametype, "entity") == 0) {
 			flags |= DNS_KEYOWNER_ENTITY;
 		} else if (strcasecmp(nametype, "user") == 0) {
 			flags |= DNS_KEYOWNER_USER;
@@ -581,8 +586,7 @@ main(int argc, char **argv) {
 	if (protocol == -1) {
 		protocol = DNS_KEYPROTO_DNSSEC;
 	} else if ((options & DST_TYPE_KEY) == 0 &&
-		   protocol != DNS_KEYPROTO_DNSSEC)
-	{
+		   protocol != DNS_KEYPROTO_DNSSEC) {
 		fatal("invalid DNSKEY protocol: %d", protocol);
 	}
 
@@ -592,6 +596,13 @@ main(int argc, char **argv) {
 		}
 	}
 
+	if ((flags & DNS_KEYFLAG_OWNERMASK) == DNS_KEYOWNER_ZONE &&
+	    alg == DNS_KEYALG_DH)
+	{
+		fatal("a key with algorithm '%s' cannot be a zone key",
+		      algname);
+	}
+
 	isc_buffer_init(&buf, filename, sizeof(filename) - 1);
 
 	/* associate the key */
@@ -605,8 +616,8 @@ main(int argc, char **argv) {
 		dns_secalg_format(alg, algstr, sizeof(algstr));
 		fatal("failed to get key %s/%s: %s", namestr, algstr,
 		      isc_result_totext(ret));
-		UNREACHABLE();
-		exit(EXIT_FAILURE);
+		/* NOTREACHED */
+		exit(-1);
 	}
 
 	/*

bin/dnssec/dnssec-keyfromlabel.rst

@@ -11,8 +11,6 @@
 
 .. highlight: console
 
-.. iscman:: dnssec-keyfromlabel
-.. program:: dnssec-keyfromlabel
 .. _man_dnssec-keyfromlabel:
 
 dnssec-keyfromlabel - DNSSEC key generation tool
@@ -26,10 +24,10 @@ Synopsis
 Description
 ~~~~~~~~~~~
 
-:program:`dnssec-keyfromlabel` generates a pair of key files that reference a
+``dnssec-keyfromlabel`` generates a pair of key files that reference a
 key object stored in a cryptographic hardware service module (HSM). The
 private key file can be used for DNSSEC signing of zone data as if it
-were a conventional signing key created by :iscman:`dnssec-keygen`, but the
+were a conventional signing key created by ``dnssec-keygen``, but the
 key material is stored within the HSM and the actual signing takes
 place there.
 
@@ -39,40 +37,40 @@ match the name of the zone for which the key is being generated.
 Options
 ~~~~~~~
 
-.. option:: -a algorithm
-
+``-a algorithm``
    This option selects the cryptographic algorithm. The value of ``algorithm`` must
    be one of RSASHA1, NSEC3RSASHA1, RSASHA256, RSASHA512,
    ECDSAP256SHA256, ECDSAP384SHA384, ED25519, or ED448.
 
+   If no algorithm is specified, RSASHA1 is used by default
+   unless the ``-3`` option is specified, in which case NSEC3RSASHA1
+   is used instead. (If ``-3`` is used and an algorithm is
+   specified, that algorithm is checked for compatibility with
+   NSEC3.)
+
    These values are case-insensitive. In some cases, abbreviations are
    supported, such as ECDSA256 for ECDSAP256SHA256 and ECDSA384 for
-   ECDSAP384SHA384. If RSASHA1 is specified along with the :option:`-3`
+   ECDSAP384SHA384. If RSASHA1 is specified along with the ``-3``
    option, then NSEC3RSASHA1 is used instead.
 
-   This option is mandatory except when using the
-   :option:`-S` option, which copies the algorithm from the predecessory key.
-
-   .. versionchanged:: 9.12.0
-      The default value RSASHA1 for newly generated keys was removed.
-
-.. option:: -3
+   Since BIND 9.12.0, this option is mandatory except when using the
+   ``-S`` option, which copies the algorithm from the predecessory key.
+   Previously, the default for newly generated keys was RSASHA1.
 
+``-3``
    This option uses an NSEC3-capable algorithm to generate a DNSSEC key. If this
    option is used with an algorithm that has both NSEC and NSEC3
    versions, then the NSEC3 version is used; for example,
    ``dnssec-keygen -3a RSASHA1`` specifies the NSEC3RSASHA1 algorithm.
 
-.. option:: -E engine
-
+``-E engine``
    This option specifies the cryptographic hardware to use.
 
    When BIND 9 is built with OpenSSL, this needs to be set to the OpenSSL
    engine identifier that drives the cryptographic accelerator or
    hardware service module (usually ``pkcs11``).
 
-.. option:: -l label
-
+``-l label``
    This option specifies the label for a key pair in the crypto hardware.
 
    When BIND 9 is built with OpenSSL-based PKCS#11 support, the label is
@@ -80,67 +78,56 @@ Options
    preceded by an optional OpenSSL engine name, followed by a colon, as
    in ``pkcs11:keylabel``.
 
-.. option:: -n nametype
-
+``-n nametype``
    This option specifies the owner type of the key. The value of ``nametype`` must
    either be ZONE (for a DNSSEC zone key (KEY/DNSKEY)), HOST or ENTITY
    (for a key associated with a host (KEY)), USER (for a key associated
    with a user (KEY)), or OTHER (DNSKEY). These values are
    case-insensitive.
 
-.. option:: -C
-
+``-C``
    This option enables compatibility mode, which generates an old-style key, without any metadata.
-   By default, :program:`dnssec-keyfromlabel` includes the key's creation
+   By default, ``dnssec-keyfromlabel`` includes the key's creation
    date in the metadata stored with the private key; other dates may
    be set there as well, including publication date, activation date, etc. Keys
    that include this data may be incompatible with older versions of
-   BIND; the :option:`-C` option suppresses them.
-
-.. option:: -c class
+   BIND; the ``-C`` option suppresses them.
 
+``-c class``
    This option indicates that the DNS record containing the key should have the
    specified class. If not specified, class IN is used.
 
-.. option:: -f flag
-
+``-f flag``
    This option sets the specified flag in the ``flag`` field of the KEY/DNSKEY record.
    The only recognized flags are KSK (Key-Signing Key) and REVOKE.
 
-.. option:: -G
-
+``-G``
    This option generates a key, but does not publish it or sign with it. This option is
-   incompatible with :option:`-P` and :option:`-A`.
-
-.. option:: -h
+   incompatible with ``-P`` and ``-A``.
 
+``-h``
    This option prints a short summary of the options and arguments to
-   :program:`dnssec-keyfromlabel`.
-
-.. option:: -K directory
+   ``dnssec-keyfromlabel``.
 
+``-K directory``
    This option sets the directory in which the key files are to be written.
 
-.. option:: -k
-
+``-k``
    This option generates KEY records rather than DNSKEY records.
 
-.. option:: -L ttl
-
+``-L`` ttl
    This option sets the default TTL to use for this key when it is converted into a
    DNSKEY RR. This is the TTL used when the key is imported into a zone,
    unless there was already a DNSKEY RRset in
    place, in which case the existing TTL would take precedence. Setting
    the default TTL to ``0`` or ``none`` removes it.
 
-.. option:: -p protocol
-
+``-p protocol``
    This option sets the protocol value for the key. The protocol is a number between
    0 and 255. The default is 3 (DNSSEC). Other possible values for this
    argument are listed in :rfc:`2535` and its successors.
 
-.. option:: -S key
-
+``-S key``
    This option generates a key as an explicit successor to an existing key. The name,
    algorithm, size, and type of the key are set to match the
    predecessor. The activation date of the new key is set to the
@@ -148,23 +135,19 @@ Options
    set to the activation date minus the prepublication interval, which
    defaults to 30 days.
 
-.. option:: -t type
-
+``-t type``
    This option indicates the type of the key. ``type`` must be one of AUTHCONF,
    NOAUTHCONF, NOAUTH, or NOCONF. The default is AUTHCONF. AUTH refers
    to the ability to authenticate data, and CONF to the ability to encrypt
    data.
 
-.. option:: -v level
-
+``-v level``
    This option sets the debugging level.
 
-.. option:: -V
-
+``-V``
    This option prints version information.
 
-.. option:: -y
-
+``-y``
    This option allows DNSSEC key files to be generated even if the key ID would
    collide with that of an existing key, in the event of either key
    being revoked. (This is only safe to enable if
@@ -174,74 +157,50 @@ Options
 Timing Options
 ~~~~~~~~~~~~~~
 
-Dates can be expressed in the format YYYYMMDD or YYYYMMDDHHMMSS
-(which is the format used inside key files),
-or 'Day Mon DD HH:MM:SS YYYY' (as printed by ``dnssec-settime -p``),
-or UNIX epoch time (as printed by ``dnssec-settime -up``),
-or the literal ``now``.
-
-The argument can be followed by ``+`` or ``-`` and an offset from the
-given time. The literal ``now`` can be omitted before an offset. The
-offset can be followed by one of the suffixes ``y``, ``mo``, ``w``,
-``d``, ``h``, or ``mi``, so that it is computed in years (defined as
-365 24-hour days, ignoring leap years), months (defined as 30 24-hour
-days), weeks, days, hours, or minutes, respectively. Without a suffix,
-the offset is computed in seconds.
-
-To explicitly prevent a date from being set, use ``none``, ``never``,
-or ``unset``.
-
-All these formats are case-insensitive.
-
-.. option:: -P date/offset
+Dates can be expressed in the format YYYYMMDD or YYYYMMDDHHMMSS. If the
+argument begins with a ``+`` or ``-``, it is interpreted as an offset from
+the present time. For convenience, if such an offset is followed by one
+of the suffixes ``y``, ``mo``, ``w``, ``d``, ``h``, or ``mi``, then the offset is
+computed in years (defined as 365 24-hour days, ignoring leap years),
+months (defined as 30 24-hour days), weeks, days, hours, or minutes,
+respectively. Without a suffix, the offset is computed in seconds. To
+explicitly prevent a date from being set, use ``none`` or ``never``.
 
+``-P date/offset``
    This option sets the date on which a key is to be published to the zone. After
    that date, the key is included in the zone but is not used
-   to sign it. If not set, and if the :option:`-G` option has not been used, the
+   to sign it. If not set, and if the ``-G`` option has not been used, the
    default is the current date.
 
-   .. program:: dnssec-keyfromlabel -P
-   .. option:: sync date/offset
-
-      This option sets the date on which CDS and CDNSKEY records that match this key
-      are to be published to the zone.
-
-.. program:: dnssec-keyfromlabel
-
-.. option:: -A date/offset
+``-P sync date/offset``
+   This option sets the date on which CDS and CDNSKEY records that match this key
+   are to be published to the zone.
 
+``-A date/offset``
    This option sets the date on which the key is to be activated. After that date,
    the key is included in the zone and used to sign it. If not set,
-   and if the :option:`-G` option has not been used, the default is the current date.
-
-.. option:: -R date/offset
+   and if the ``-G`` option has not been used, the default is the current date.
 
+``-R date/offset``
    This option sets the date on which the key is to be revoked. After that date, the
    key is flagged as revoked. It is included in the zone and
    is used to sign it.
 
-.. option:: -I date/offset
-
+``-I date/offset``
    This option sets the date on which the key is to be retired. After that date, the
    key is still included in the zone, but it is not used to
    sign it.
 
-.. option:: -D date/offset
-
+``-D date/offset``
    This option sets the date on which the key is to be deleted. After that date, the
    key is no longer included in the zone. (However, it may remain in the key
    repository.)
 
-   .. program:: dnssec-keyfromlabel -D
-   .. option:: sync date/offset
-
-      This option sets the date on which the CDS and CDNSKEY records that match this
-      key are to be deleted.
-
-.. program:: dnssec-keyfromlabel
-
-.. option:: -i interval
+``-D sync date/offset``
+   This option sets the date on which the CDS and CDNSKEY records that match this
+   key are to be deleted.
 
+``-i interval``
    This option sets the prepublication interval for a key. If set, then the
    publication and activation dates must be separated by at least this
    much time. If the activation date is specified but the publication
@@ -262,7 +221,7 @@ All these formats are case-insensitive.
 Generated Key Files
 ~~~~~~~~~~~~~~~~~~~
 
-When :program:`dnssec-keyfromlabel` completes successfully, it prints a string
+When ``dnssec-keyfromlabel`` completes successfully, it prints a string
 of the form ``Knnnn.+aaa+iiiii`` to the standard output. This is an
 identification string for the key files it has generated.
 
@@ -272,7 +231,7 @@ identification string for the key files it has generated.
 
 -  ``iiiii`` is the key identifier (or footprint).
 
-:program:`dnssec-keyfromlabel` creates two files, with names based on the
+``dnssec-keyfromlabel`` creates two files, with names based on the
 printed string. ``Knnnn.+aaa+iiiii.key`` contains the public key, and
 ``Knnnn.+aaa+iiiii.private`` contains the private key.
 
@@ -285,5 +244,5 @@ security reasons, this file does not have general read permission.
 See Also
 ~~~~~~~~
 
-:iscman:`dnssec-keygen(8) <dnssec-keygen>`, :iscman:`dnssec-signzone(8) <dnssec-signzone>`, BIND 9 Administrator Reference Manual,
+:manpage:`dnssec-keygen(8)`, :manpage:`dnssec-signzone(8)`, BIND 9 Administrator Reference Manual,
 :rfc:`4034`, :rfc:`7512`.

bin/dnssec/dnssec-keygen.c

@@ -33,13 +33,11 @@
 #include <stdlib.h>
 #include <unistd.h>
 
-#include <openssl/opensslv.h>
-
 #include <isc/attributes.h>
 #include <isc/buffer.h>
 #include <isc/commandline.h>
-#include <isc/fips.h>
 #include <isc/mem.h>
+#include <isc/print.h>
 #include <isc/region.h>
 #include <isc/result.h>
 #include <isc/string.h>
@@ -60,28 +58,16 @@
 #include <isccfg/grammar.h>
 #include <isccfg/kaspconf.h>
 #include <isccfg/namedconf.h>
-#if OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_API_LEVEL >= 30000
-#include <openssl/err.h>
-#include <openssl/provider.h>
-#endif
 
 #include "dnssectool.h"
 
 #define MAX_RSA 4096 /* should be long enough... */
-#define MAX_DH	4096 /* should be long enough... */
 
 const char *program = "dnssec-keygen";
 
-/*
- * These are are set here for backwards compatibility.  They are
- * raised to 2048 in FIPS mode.
- */
-static int min_rsa = 1024;
-static int min_dh = 128;
-
 isc_log_t *lctx = NULL;
 
-noreturn static void
+ISC_NORETURN static void
 usage(void);
 
 static void
@@ -92,10 +78,10 @@ struct keygen_ctx {
 	const char *policy;
 	const char *configfile;
 	const char *directory;
-	dns_keystore_t *keystore;
 	char *algname;
 	char *nametype;
 	char *type;
+	int generator;
 	int protocol;
 	int size;
 	int signatory;
@@ -155,22 +141,17 @@ usage(void) {
 	fprintf(stderr, "    -l <file>: configuration file with dnssec-policy "
 			"statement\n");
 	fprintf(stderr, "    -a <algorithm>:\n");
-	if (!isc_fips_mode()) {
-		fprintf(stderr, "        RSASHA1 | NSEC3RSASHA1 |\n");
-	}
+	fprintf(stderr, "        RSASHA1 | NSEC3RSASHA1 |\n");
 	fprintf(stderr, "        RSASHA256 | RSASHA512 |\n");
 	fprintf(stderr, "        ECDSAP256SHA256 | ECDSAP384SHA384 |\n");
-	fprintf(stderr, "        ED25519 | ED448\n");
+	fprintf(stderr, "        ED25519 | ED448 | DH\n");
 	fprintf(stderr, "    -3: use NSEC3-capable algorithm\n");
 	fprintf(stderr, "    -b <key size in bits>:\n");
-	if (!isc_fips_mode()) {
-		fprintf(stderr, "        RSASHA1:\t[%d..%d]\n", min_rsa,
-			MAX_RSA);
-		fprintf(stderr, "        NSEC3RSASHA1:\t[%d..%d]\n", min_rsa,
-			MAX_RSA);
-	}
-	fprintf(stderr, "        RSASHA256:\t[%d..%d]\n", min_rsa, MAX_RSA);
-	fprintf(stderr, "        RSASHA512:\t[%d..%d]\n", min_rsa, MAX_RSA);
+	fprintf(stderr, "        RSASHA1:\t[1024..%d]\n", MAX_RSA);
+	fprintf(stderr, "        NSEC3RSASHA1:\t[1024..%d]\n", MAX_RSA);
+	fprintf(stderr, "        RSASHA256:\t[1024..%d]\n", MAX_RSA);
+	fprintf(stderr, "        RSASHA512:\t[1024..%d]\n", MAX_RSA);
+	fprintf(stderr, "        DH:\t\t[128..4096]\n");
 	fprintf(stderr, "        ECDSAP256SHA256:\tignored\n");
 	fprintf(stderr, "        ECDSAP384SHA384:\tignored\n");
 	fprintf(stderr, "        ED25519:\tignored\n");
@@ -185,7 +166,8 @@ usage(void) {
 	fprintf(stderr, "    -E <engine>:\n");
 	fprintf(stderr, "        name of an OpenSSL engine to use\n");
 	fprintf(stderr, "    -f <keyflag>: KSK | REVOKE\n");
-	fprintf(stderr, "    -F: FIPS mode\n");
+	fprintf(stderr, "    -g <generator>: use specified generator "
+			"(DH only)\n");
 	fprintf(stderr, "    -L <ttl>: default key TTL\n");
 	fprintf(stderr, "    -p <protocol>: (default: 3 [dnssec])\n");
 	fprintf(stderr, "    -s <strength>: strength value this key signs DNS "
@@ -227,7 +209,7 @@ usage(void) {
 	fprintf(stderr, "     K<name>+<alg>+<id>.key, "
 			"K<name>+<alg>+<id>.private\n");
 
-	exit(EXIT_FAILURE);
+	exit(-1);
 }
 
 static void
@@ -256,42 +238,14 @@ progress(int p) {
 
 static void
 kasp_from_conf(cfg_obj_t *config, isc_mem_t *mctx, const char *name,
-	       const char *keydir, const char *engine, dns_kasp_t **kaspp) {
-	isc_result_t result = ISC_R_NOTFOUND;
+	       dns_kasp_t **kaspp) {
 	const cfg_listelt_t *element;
 	const cfg_obj_t *kasps = NULL;
 	dns_kasp_t *kasp = NULL, *kasp_next;
+	isc_result_t result = ISC_R_NOTFOUND;
 	dns_kasplist_t kasplist;
-	const cfg_obj_t *keystores = NULL;
-	dns_keystore_t *ks = NULL, *ks_next;
-	dns_keystorelist_t kslist;
 
 	ISC_LIST_INIT(kasplist);
-	ISC_LIST_INIT(kslist);
-
-	(void)cfg_map_get(config, "key-store", &keystores);
-	for (element = cfg_list_first(keystores); element != NULL;
-	     element = cfg_list_next(element))
-	{
-		cfg_obj_t *kconfig = cfg_listelt_value(element);
-		ks = NULL;
-		result = cfg_keystore_fromconfig(kconfig, mctx, lctx, engine,
-						 &kslist, NULL);
-		if (result != ISC_R_SUCCESS) {
-			fatal("failed to configure key-store '%s': %s",
-			      cfg_obj_asstring(cfg_tuple_get(kconfig, "name")),
-			      isc_result_totext(result));
-		}
-	}
-	/* Default key-directory key store. */
-	ks = NULL;
-	(void)cfg_keystore_fromconfig(NULL, mctx, lctx, engine, &kslist, &ks);
-	INSIST(ks != NULL);
-	if (keydir != NULL) {
-		/* '-K keydir' takes priority */
-		dns_keystore_setdirectory(ks, keydir);
-	}
-	dns_keystore_detach(&ks);
 
 	(void)cfg_map_get(config, "dnssec-policy", &kasps);
 	for (element = cfg_list_first(kasps); element != NULL;
@@ -300,13 +254,12 @@ kasp_from_conf(cfg_obj_t *config, isc_mem_t *mctx, const char *name,
 		cfg_obj_t *kconfig = cfg_listelt_value(element);
 		kasp = NULL;
 		if (strcmp(cfg_obj_asstring(cfg_tuple_get(kconfig, "name")),
-			   name) != 0)
-		{
+			   name) != 0) {
 			continue;
 		}
 
-		result = cfg_kasp_fromconfig(kconfig, NULL, true, mctx, lctx,
-					     &kslist, &kasplist, &kasp);
+		result = cfg_kasp_fromconfig(kconfig, NULL, mctx, lctx,
+					     &kasplist, &kasp);
 		if (result != ISC_R_SUCCESS) {
 			fatal("failed to configure dnssec-policy '%s': %s",
 			      cfg_obj_asstring(cfg_tuple_get(kconfig, "name")),
@@ -327,15 +280,6 @@ kasp_from_conf(cfg_obj_t *config, isc_mem_t *mctx, const char *name,
 		ISC_LIST_UNLINK(kasplist, kasp, link);
 		dns_kasp_detach(&kasp);
 	}
-
-	/*
-	 * Cleanup keystore list.
-	 */
-	for (ks = ISC_LIST_HEAD(kslist); ks != NULL; ks = ks_next) {
-		ks_next = ISC_LIST_NEXT(ks, link);
-		ISC_LIST_UNLINK(kslist, ks, link);
-		dns_keystore_detach(&ks);
-	}
 }
 
 static void
@@ -378,15 +322,8 @@ keygen(keygen_ctx_t *ctx, isc_mem_t *mctx, int argc, char **argv) {
 			fatal("unsupported algorithm: %s", algstr);
 		}
 
-		if (isc_fips_mode()) {
-			/* verify only in FIPS mode */
-			switch (ctx->alg) {
-			case DST_ALG_RSASHA1:
-			case DST_ALG_NSEC3RSASHA1:
-				fatal("unsupported algorithm: %s", algstr);
-			default:
-				break;
-			}
+		if (ctx->alg == DST_ALG_DH) {
+			ctx->options |= DST_TYPE_KEY;
 		}
 
 		if (ctx->use_nsec3) {
@@ -431,11 +368,6 @@ keygen(keygen_ctx_t *ctx, isc_mem_t *mctx, int argc, char **argv) {
 			switch (ctx->alg) {
 			case DST_ALG_RSASHA1:
 			case DST_ALG_NSEC3RSASHA1:
-				if (isc_fips_mode()) {
-					fatal("key size not specified (-b "
-					      "option)");
-				}
-				FALLTHROUGH;
 			case DST_ALG_RSASHA256:
 			case DST_ALG_RSASHA512:
 				ctx->size = 2048;
@@ -459,8 +391,7 @@ keygen(keygen_ctx_t *ctx, isc_mem_t *mctx, int argc, char **argv) {
 
 		if (!ctx->oldstyle && ctx->prepub > 0) {
 			if (ctx->setpub && ctx->setact &&
-			    (ctx->activate - ctx->prepub) < ctx->publish)
-			{
+			    (ctx->activate - ctx->prepub) < ctx->publish) {
 				fatal("Activation and publication dates "
 				      "are closer together than the\n\t"
 				      "prepublication interval.");
@@ -591,18 +522,23 @@ keygen(keygen_ctx_t *ctx, isc_mem_t *mctx, int argc, char **argv) {
 	switch (ctx->alg) {
 	case DNS_KEYALG_RSASHA1:
 	case DNS_KEYALG_NSEC3RSASHA1:
-		if (isc_fips_mode()) {
-			fatal("SHA1 based keys not supported in FIPS mode");
-		}
-		FALLTHROUGH;
 	case DNS_KEYALG_RSASHA256:
-	case DNS_KEYALG_RSASHA512:
-		if (ctx->size != 0 &&
-		    (ctx->size < min_rsa || ctx->size > MAX_RSA))
+		if (ctx->size != 0 && (ctx->size < 1024 || ctx->size > MAX_RSA))
 		{
 			fatal("RSA key size %d out of range", ctx->size);
 		}
 		break;
+	case DNS_KEYALG_RSASHA512:
+		if (ctx->size != 0 && (ctx->size < 1024 || ctx->size > MAX_RSA))
+		{
+			fatal("RSA key size %d out of range", ctx->size);
+		}
+		break;
+	case DNS_KEYALG_DH:
+		if (ctx->size != 0 && (ctx->size < 128 || ctx->size > 4096)) {
+			fatal("DH key size %d out of range", ctx->size);
+		}
+		break;
 	case DST_ALG_ECDSA256:
 		ctx->size = 256;
 		break;
@@ -617,6 +553,10 @@ keygen(keygen_ctx_t *ctx, isc_mem_t *mctx, int argc, char **argv) {
 		break;
 	}
 
+	if (ctx->alg != DNS_KEYALG_DH && ctx->generator != 0) {
+		fatal("specified DH generator for a non-DH key");
+	}
+
 	if (ctx->nametype == NULL) {
 		if ((ctx->options & DST_TYPE_KEY) != 0) { /* KEY */
 			fatal("no nametype specified");
@@ -666,6 +606,12 @@ keygen(keygen_ctx_t *ctx, isc_mem_t *mctx, int argc, char **argv) {
 		}
 	}
 
+	if ((flags & DNS_KEYFLAG_OWNERMASK) == DNS_KEYOWNER_ZONE &&
+	    ctx->alg == DNS_KEYALG_DH)
+	{
+		fatal("a key with algorithm %s cannot be a zone key", algstr);
+	}
+
 	switch (ctx->alg) {
 	case DNS_KEYALG_RSASHA1:
 	case DNS_KEYALG_NSEC3RSASHA1:
@@ -674,6 +620,10 @@ keygen(keygen_ctx_t *ctx, isc_mem_t *mctx, int argc, char **argv) {
 		show_progress = true;
 		break;
 
+	case DNS_KEYALG_DH:
+		param = ctx->generator;
+		break;
+
 	case DST_ALG_ECDSA256:
 	case DST_ALG_ECDSA384:
 	case DST_ALG_ED25519:
@@ -693,27 +643,16 @@ keygen(keygen_ctx_t *ctx, isc_mem_t *mctx, int argc, char **argv) {
 
 		if (!ctx->quiet && show_progress) {
 			fprintf(stderr, "Generating key pair.");
-		}
-
-		if (ctx->keystore != NULL && ctx->policy != NULL) {
-			ret = dns_keystore_keygen(
-				ctx->keystore, name, ctx->policy, ctx->rdclass,
-				mctx, ctx->alg, ctx->size, flags, &key);
-		} else if (!ctx->quiet && show_progress) {
 			ret = dst_key_generate(name, ctx->alg, ctx->size, param,
 					       flags, ctx->protocol,
-					       ctx->rdclass, NULL, mctx, &key,
+					       ctx->rdclass, mctx, &key,
 					       &progress);
+			putc('\n', stderr);
+			fflush(stderr);
 		} else {
 			ret = dst_key_generate(name, ctx->alg, ctx->size, param,
 					       flags, ctx->protocol,
-					       ctx->rdclass, NULL, mctx, &key,
-					       NULL);
-		}
-
-		if (!ctx->quiet && show_progress) {
-			putc('\n', stderr);
-			fflush(stderr);
+					       ctx->rdclass, mctx, &key, NULL);
 		}
 
 		if (ret != ISC_R_SUCCESS) {
@@ -788,8 +727,7 @@ keygen(keygen_ctx_t *ctx, isc_mem_t *mctx, int argc, char **argv) {
 
 			if (ctx->setdel) {
 				if (ctx->setinact &&
-				    ctx->deltime < ctx->inactive)
-				{
+				    ctx->deltime < ctx->inactive) {
 					fprintf(stderr,
 						"%s: warning: Key is "
 						"scheduled to be deleted "
@@ -909,18 +847,6 @@ keygen(keygen_ctx_t *ctx, isc_mem_t *mctx, int argc, char **argv) {
 	}
 }
 
-static void
-check_keystore_options(keygen_ctx_t *ctx) {
-	ctx->directory = dns_keystore_directory(ctx->keystore, NULL);
-	if (ctx->directory != NULL) {
-		isc_result_t ret = try_dir(ctx->directory);
-		if (ret != ISC_R_SUCCESS) {
-			fatal("cannot open directory %s: %s", ctx->directory,
-			      isc_result_totext(ret));
-		}
-	}
-}
-
 int
 main(int argc, char **argv) {
 	char *algname = NULL, *freeit = NULL;
@@ -932,17 +858,12 @@ main(int argc, char **argv) {
 	const char *engine = NULL;
 	unsigned char c;
 	int ch;
-	bool set_fips_mode = false;
-#if OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_API_LEVEL >= 30000
-	OSSL_PROVIDER *fips = NULL, *base = NULL;
-#endif
 
 	keygen_ctx_t ctx = {
 		.options = DST_TYPE_PRIVATE | DST_TYPE_PUBLIC,
 		.prepub = -1,
 		.protocol = -1,
 		.size = -1,
-		.now = isc_stdtime_now(),
 	};
 
 	if (argc == 1) {
@@ -954,8 +875,8 @@ main(int argc, char **argv) {
 	/*
 	 * Process memory debugging argument first.
 	 */
-#define CMDLINE_FLAGS                                        \
-	"3A:a:b:Cc:D:d:E:Ff:GhI:i:K:k:L:l:m:n:P:p:qR:r:S:s:" \
+#define CMDLINE_FLAGS                                           \
+	"3A:a:b:Cc:D:d:E:eFf:Gg:hI:i:K:k:L:l:m:n:P:p:qR:r:S:s:" \
 	"T:t:v:V"
 	while ((ch = isc_commandline_parse(argc, argv, CMDLINE_FLAGS)) != -1) {
 		switch (ch) {
@@ -980,6 +901,7 @@ main(int argc, char **argv) {
 	isc_commandline_reset = true;
 
 	isc_mem_create(&mctx);
+	isc_stdtime_get(&ctx.now);
 
 	while ((ch = isc_commandline_parse(argc, argv, CMDLINE_FLAGS)) != -1) {
 		switch (ch) {
@@ -1010,6 +932,10 @@ main(int argc, char **argv) {
 		case 'E':
 			engine = isc_commandline_argument;
 			break;
+		case 'e':
+			fprintf(stderr, "phased-out option -e "
+					"(was 'use (RSA) large exponent')\n");
+			break;
 		case 'f':
 			c = (unsigned char)(isc_commandline_argument[0]);
 			if (toupper(c) == 'K') {
@@ -1021,6 +947,13 @@ main(int argc, char **argv) {
 				      isc_commandline_argument);
 			}
 			break;
+		case 'g':
+			ctx.generator = strtol(isc_commandline_argument, &endp,
+					       10);
+			if (*endp != '\0' || ctx.generator <= 0) {
+				fatal("-g requires a positive number");
+			}
+			break;
 		case 'K':
 			ctx.directory = isc_commandline_argument;
 			ret = try_dir(ctx.directory);
@@ -1048,8 +981,7 @@ main(int argc, char **argv) {
 			ctx.protocol = strtol(isc_commandline_argument, &endp,
 					      10);
 			if (*endp != '\0' || ctx.protocol < 0 ||
-			    ctx.protocol > 255)
-			{
+			    ctx.protocol > 255) {
 				fatal("-p must be followed by a number "
 				      "[0..255]");
 			}
@@ -1065,8 +997,7 @@ main(int argc, char **argv) {
 			ctx.signatory = strtol(isc_commandline_argument, &endp,
 					       10);
 			if (*endp != '\0' || ctx.signatory < 0 ||
-			    ctx.signatory > 15)
-			{
+			    ctx.signatory > 15) {
 				fatal("-s must be followed by a number "
 				      "[0..15]");
 			}
@@ -1177,14 +1108,14 @@ main(int argc, char **argv) {
 			ctx.prepub = strtottl(isc_commandline_argument);
 			break;
 		case 'F':
-			set_fips_mode = true;
-			break;
+		/* Reserved for FIPS mode */
+		/* FALLTHROUGH */
 		case '?':
 			if (isc_commandline_option != '?') {
 				fprintf(stderr, "%s: invalid argument -%c\n",
 					program, isc_commandline_option);
 			}
-			FALLTHROUGH;
+		/* FALLTHROUGH */
 		case 'h':
 			/* Does not return. */
 			usage();
@@ -1196,7 +1127,7 @@ main(int argc, char **argv) {
 		default:
 			fprintf(stderr, "%s: unhandled option -%c\n", program,
 				isc_commandline_option);
-			exit(EXIT_FAILURE);
+			exit(1);
 		}
 	}
 
@@ -1204,40 +1135,11 @@ main(int argc, char **argv) {
 		ctx.quiet = true;
 	}
 
-	if (set_fips_mode) {
-#if OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_API_LEVEL >= 30000
-		fips = OSSL_PROVIDER_load(NULL, "fips");
-		if (fips == NULL) {
-			ERR_clear_error();
-			fatal("Failed to load FIPS provider");
-		}
-		base = OSSL_PROVIDER_load(NULL, "base");
-		if (base == NULL) {
-			OSSL_PROVIDER_unload(fips);
-			ERR_clear_error();
-			fatal("Failed to load base provider");
-		}
-#endif
-		if (!isc_fips_mode()) {
-			if (isc_fips_set_mode(1) != ISC_R_SUCCESS) {
-				fatal("setting FIPS mode failed");
-			}
-		}
-	}
-
 	ret = dst_lib_init(mctx, engine);
 	if (ret != ISC_R_SUCCESS) {
 		fatal("could not initialize dst: %s", isc_result_totext(ret));
 	}
 
-	/*
-	 * After dst_lib_init which will set FIPS mode if requested
-	 * at build time.  The minumums are both raised to 2048.
-	 */
-	if (isc_fips_mode()) {
-		min_rsa = min_dh = 2048;
-	}
-
 	setup_logging(mctx, &lctx);
 
 	ctx.rdclass = strtoclass(classname);
@@ -1330,8 +1232,7 @@ main(int argc, char **argv) {
 				      ctx.policy, ctx.configfile);
 			}
 
-			kasp_from_conf(config, mctx, ctx.policy, ctx.directory,
-				       engine, &kasp);
+			kasp_from_conf(config, mctx, ctx.policy, &kasp);
 			if (kasp == NULL) {
 				fatal("failed to load dnssec-policy '%s'",
 				      ctx.policy);
@@ -1357,10 +1258,7 @@ main(int argc, char **argv) {
 				ctx.ksk = dns_kasp_key_ksk(kaspkey);
 				ctx.zsk = dns_kasp_key_zsk(kaspkey);
 				ctx.lifetime = dns_kasp_key_lifetime(kaspkey);
-				ctx.keystore = dns_kasp_key_keystore(kaspkey);
-				if (ctx.keystore != NULL) {
-					check_keystore_options(&ctx);
-				}
+
 				keygen(&ctx, mctx, argc, argv);
 
 				kaspkey = ISC_LIST_NEXT(kaspkey, link);
@@ -1381,14 +1279,6 @@ main(int argc, char **argv) {
 	}
 	isc_mem_destroy(&mctx);
 
-#if OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_API_LEVEL >= 30000
-	if (base != NULL) {
-		OSSL_PROVIDER_unload(base);
-	}
-	if (fips != NULL) {
-		OSSL_PROVIDER_unload(fips);
-	}
-#endif
 	if (freeit != NULL) {
 		free(freeit);
 	}

bin/dnssec/dnssec-keygen.rst

@@ -11,8 +11,6 @@
 
 .. highlight: console
 
-.. iscman:: dnssec-keygen
-.. program:: dnssec-keygen
 .. _man_dnssec-keygen:
 
 dnssec-keygen: DNSSEC key generation tool
@@ -21,13 +19,15 @@ dnssec-keygen: DNSSEC key generation tool
 Synopsis
 ~~~~~~~~
 
-:program:`dnssec-keygen` [**-3**] [**-A** date/offset] [**-a** algorithm] [**-b** keysize] [**-C**] [**-c** class] [**-D** date/offset] [**-d** bits] [**-D** sync date/offset] [**-E** engine] [**-f** flag] [**-F**] [**-G**] [**-h**] [**-I** date/offset] [**-i** interval] [**-K** directory] [**-k** policy] [**-L** ttl] [**-l** file] [**-n** nametype] [**-P** date/offset] [**-P** sync date/offset] [**-p** protocol] [**-q**] [**-R** date/offset] [**-S** key] [**-s** strength] [**-T** rrtype] [**-t** type] [**-V**] [**-v** level] {name}
+:program:`dnssec-keygen` [**-3**] [**-A** date/offset] [**-a** algorithm] [**-b** keysize] [**-C**] [**-c** class] [**-D** date/offset] [**-d** bits] [**-D** sync date/offset] [**-E** engine] [**-f** flag] [**-G**] [**-g** generator] [**-h**] [**-I** date/offset] [**-i** interval] [**-K** directory] [**-k** policy] [**-L** ttl] [**-l** file] [**-n** nametype] [**-P** date/offset] [**-P** sync date/offset] [**-p** protocol] [**-q**] [**-R** date/offset] [**-S** key] [**-s** strength] [**-T** rrtype] [**-t** type] [**-V**] [**-v** level] {name}
 
 Description
 ~~~~~~~~~~~
 
-:program:`dnssec-keygen` generates keys for DNSSEC (Secure DNS), as defined in
-:rfc:`2535` and :rfc:`4034`.
+``dnssec-keygen`` generates keys for DNSSEC (Secure DNS), as defined in
+:rfc:`2535` and :rfc:`4034`. It can also generate keys for use with TSIG
+(Transaction Signatures) as defined in :rfc:`2845`, or TKEY (Transaction
+Key) as defined in :rfc:`2930`.
 
 The ``name`` of the key is specified on the command line. For DNSSEC
 keys, this must match the name of the zone for which the key is being
@@ -36,33 +36,32 @@ generated.
 Options
 ~~~~~~~
 
-.. option:: -3
-
+``-3``
    This option uses an NSEC3-capable algorithm to generate a DNSSEC key. If this
    option is used with an algorithm that has both NSEC and NSEC3
    versions, then the NSEC3 version is selected; for example,
-   ``dnssec-keygen -3 -a RSASHA1`` specifies the NSEC3RSASHA1 algorithm.
-
-.. option:: -a algorithm
+   ``dnssec-keygen -3a RSASHA1`` specifies the NSEC3RSASHA1 algorithm.
 
+``-a algorithm``
    This option selects the cryptographic algorithm. For DNSSEC keys, the value of
    ``algorithm`` must be one of RSASHA1, NSEC3RSASHA1, RSASHA256,
-   RSASHA512, ECDSAP256SHA256, ECDSAP384SHA384, ED25519, or ED448.
+   RSASHA512, ECDSAP256SHA256, ECDSAP384SHA384, ED25519, or ED448. For
+   TKEY, the value must be DH (Diffie-Hellman); specifying this value
+   automatically sets the ``-T KEY`` option as well.
 
    These values are case-insensitive. In some cases, abbreviations are
    supported, such as ECDSA256 for ECDSAP256SHA256 and ECDSA384 for
-   ECDSAP384SHA384. If RSASHA1 is specified along with the :option:`-3`
+   ECDSAP384SHA384. If RSASHA1 is specified along with the ``-3``
    option, NSEC3RSASHA1 is used instead.
 
-   This parameter *must* be specified except when using the :option:`-S`
+   This parameter *must* be specified except when using the ``-S``
    option, which copies the algorithm from the predecessor key.
 
    In prior releases, HMAC algorithms could be generated for use as TSIG
    keys, but that feature was removed in BIND 9.13.0. Use
-   :iscman:`tsig-keygen` to generate TSIG keys.
-
-.. option:: -b keysize
+   ``tsig-keygen`` to generate TSIG keys.
 
+``-b keysize``
    This option specifies the number of bits in the key. The choice of key size
    depends on the algorithm used: RSA keys must be between 1024 and 4096
    bits; Diffie-Hellman keys must be between 128 and 4096 bits. Elliptic
@@ -71,74 +70,63 @@ Options
    If the key size is not specified, some algorithms have pre-defined
    defaults. For example, RSA keys for use as DNSSEC zone-signing keys
    have a default size of 1024 bits; RSA keys for use as key-signing
-   keys (KSKs, generated with :option:`-f KSK <-f>`) default to 2048 bits.
-
-.. option:: -C
+   keys (KSKs, generated with ``-f KSK``) default to 2048 bits.
 
+``-C``
    This option enables compatibility mode, which generates an old-style key, without any timing
-   metadata. By default, :program:`dnssec-keygen` includes the key's
+   metadata. By default, ``dnssec-keygen`` includes the key's
    creation date in the metadata stored with the private key; other
    dates may be set there as well, including publication date, activation date,
    etc. Keys that include this data may be incompatible with older
-   versions of BIND; the :option:`-C` option suppresses them.
-
-.. option:: -c class
+   versions of BIND; the ``-C`` option suppresses them.
 
+``-c class``
    This option indicates that the DNS record containing the key should have the
    specified class. If not specified, class IN is used.
 
-.. option:: -d bits
-
+``-d bits``
    This option specifies the key size in bits. For the algorithms RSASHA1, NSEC3RSASA1, RSASHA256, and
    RSASHA512 the key size must be between 1024 and 4096 bits; DH size is between 128
    and 4096 bits. This option is ignored for algorithms ECDSAP256SHA256,
    ECDSAP384SHA384, ED25519, and ED448.
 
-.. option:: -E engine
-
+``-E engine``
    This option specifies the cryptographic hardware to use, when applicable.
 
    When BIND 9 is built with OpenSSL, this needs to be set to the OpenSSL
    engine identifier that drives the cryptographic accelerator or
    hardware service module (usually ``pkcs11``).
 
-.. option:: -f flag
-
+``-f flag``
    This option sets the specified flag in the flag field of the KEY/DNSKEY record.
    The only recognized flags are KSK (Key-Signing Key) and REVOKE.
 
-.. option:: -F
-
-   This options turns on FIPS (US Federal Information Processing Standards)
-   mode if the underlying crytographic library supports running in FIPS
-   mode.
-
-.. option:: -G
-
+``-G``
    This option generates a key, but does not publish it or sign with it. This option is
-   incompatible with :option:`-P` and :option:`-A`.
+   incompatible with ``-P`` and ``-A``.
 
-.. option:: -h
+``-g generator``
+   This option indicates the generator to use if generating a Diffie-Hellman key. Allowed
+   values are 2 and 5. If no generator is specified, a known prime from
+   :rfc:`2539` is used if possible; otherwise the default is 2.
 
+``-h``
    This option prints a short summary of the options and arguments to
-   :program:`dnssec-keygen`.
-
-.. option:: -K directory
+   ``dnssec-keygen``.
 
+``-K directory``
    This option sets the directory in which the key files are to be written.
 
-.. option:: -k policy
-
+``-k policy``
    This option creates keys for a specific ``dnssec-policy``. If a policy uses multiple keys,
-   :program:`dnssec-keygen` generates multiple keys. This also
+   ``dnssec-keygen`` generates multiple keys. This also
    creates a ".state" file to keep track of the key state.
 
    This option creates keys according to the ``dnssec-policy`` configuration, hence
    it cannot be used at the same time as many of the other options that
-   :program:`dnssec-keygen` provides.
-
-.. option:: -L ttl
+   ``dnssec-keygen`` provides.
 
+``-L ttl``
    This option sets the default TTL to use for this key when it is converted into a
    DNSKEY RR. This is the TTL used when the key is imported into a zone,
    unless there was already a DNSKEY RRset in
@@ -147,30 +135,26 @@ Options
    defaults to the SOA TTL. Setting the default TTL to ``0`` or ``none``
    is the same as leaving it unset.
 
-.. option:: -l file
-
+``-l file``
    This option provides a configuration file that contains a ``dnssec-policy`` statement
-   (matching the policy set with :option:`-k`).
-
-.. option:: -n nametype
+   (matching the policy set with ``-k``).
 
+``-n nametype``
    This option specifies the owner type of the key. The value of ``nametype`` must
    either be ZONE (for a DNSSEC zone key (KEY/DNSKEY)), HOST or ENTITY
    (for a key associated with a host (KEY)), USER (for a key associated
    with a user (KEY)), or OTHER (DNSKEY). These values are
    case-insensitive. The default is ZONE for DNSKEY generation.
 
-.. option:: -p protocol
-
+``-p protocol``
    This option sets the protocol value for the generated key, for use with
-   :option:`-T KEY <-T>`. The protocol is a number between 0 and 255. The default
+   ``-T KEY``. The protocol is a number between 0 and 255. The default
    is 3 (DNSSEC). Other possible values for this argument are listed in
    :rfc:`2535` and its successors.
 
-.. option:: -q
-
+``-q``
    This option sets quiet mode, which suppresses unnecessary output, including progress
-   indication. Without this option, when :program:`dnssec-keygen` is run
+   indication. Without this option, when ``dnssec-keygen`` is run
    interactively to generate an RSA or DSA key pair, it prints a
    string of symbols to ``stderr`` indicating the progress of the key
    generation. A ``.`` indicates that a random number has been found which
@@ -178,8 +162,7 @@ Options
    round of the Miller-Rabin primality test; and a space ( ) means that the
    number has passed all the tests and is a satisfactory key.
 
-.. option:: -S key
-
+``-S key``
    This option creates a new key which is an explicit successor to an existing key.
    The name, algorithm, size, and type of the key are set to match
    the existing key. The activation date of the new key is set to
@@ -187,104 +170,77 @@ Options
    set to the activation date minus the prepublication interval,
    which defaults to 30 days.
 
-.. option:: -s strength
-
+``-s strength``
    This option specifies the strength value of the key. The strength is a number
    between 0 and 15, and currently has no defined purpose in DNSSEC.
 
-.. option:: -T rrtype
-
+``-T rrtype``
    This option specifies the resource record type to use for the key. ``rrtype``
    must be either DNSKEY or KEY. The default is DNSKEY when using a
    DNSSEC algorithm, but it can be overridden to KEY for use with
    SIG(0).
 
-.. option:: -t type
-
-   This option indicates the type of the key for use with :option:`-T KEY <-T>`. ``type``
+``-t type``
+   This option indicates the type of the key for use with ``-T KEY``. ``type``
    must be one of AUTHCONF, NOAUTHCONF, NOAUTH, or NOCONF. The default
    is AUTHCONF. AUTH refers to the ability to authenticate data, and
    CONF to the ability to encrypt data.
 
-.. option:: -V
-
+``-V``
    This option prints version information.
 
-.. option:: -v level
-
+``-v level``
    This option sets the debugging level.
 
 Timing Options
 ~~~~~~~~~~~~~~
 
-Dates can be expressed in the format YYYYMMDD or YYYYMMDDHHMMSS
-(which is the format used inside key files),
-or 'Day Mon DD HH:MM:SS YYYY' (as printed by ``dnssec-settime -p``),
-or UNIX epoch time (as printed by ``dnssec-settime -up``),
-or the literal ``now``.
-
-The argument can be followed by ``+`` or ``-`` and an offset from the
-given time. The literal ``now`` can be omitted before an offset. The
-offset can be followed by one of the suffixes ``y``, ``mo``, ``w``,
-``d``, ``h``, or ``mi``, so that it is computed in years (defined as
-365 24-hour days, ignoring leap years), months (defined as 30 24-hour
-days), weeks, days, hours, or minutes, respectively. Without a suffix,
-the offset is computed in seconds.
-
-To unset a date, use ``none``, ``never``, or ``unset``.
-
-.. option:: -P date/offset
+Dates can be expressed in the format YYYYMMDD or YYYYMMDDHHMMSS. If the
+argument begins with a ``+`` or ``-``, it is interpreted as an offset from
+the present time. For convenience, if such an offset is followed by one
+of the suffixes ``y``, ``mo``, ``w``, ``d``, ``h``, or ``mi``, then the offset is
+computed in years (defined as 365 24-hour days, ignoring leap years),
+months (defined as 30 24-hour days), weeks, days, hours, or minutes,
+respectively. Without a suffix, the offset is computed in seconds. To
+explicitly prevent a date from being set, use ``none`` or ``never``.
 
+``-P date/offset``
    This option sets the date on which a key is to be published to the zone. After
    that date, the key is included in the zone but is not used
-   to sign it. If not set, and if the :option:`-G` option has not been used, the
+   to sign it. If not set, and if the ``-G`` option has not been used, the
    default is the current date.
 
-   .. program:: dnssec-keygen -P
-   .. option:: sync date/offset
-
-      This option sets the date on which CDS and CDNSKEY records that match this key
-      are to be published to the zone.
-
-.. program:: dnssec-keygen
-
-.. option:: -A date/offset
+``-P sync date/offset``
+   This option sets the date on which CDS and CDNSKEY records that match this key
+   are to be published to the zone.
 
+``-A date/offset``
    This option sets the date on which the key is to be activated. After that date,
    the key is included in the zone and used to sign it. If not set,
-   and if the :option:`-G` option has not been used, the default is the current date. If set,
-   and :option:`-P` is not set, the publication date is set to the
+   and if the ``-G`` option has not been used, the default is the current date. If set,
+   and ``-P`` is not set, the publication date is set to the
    activation date minus the prepublication interval.
 
-.. option:: -R date/offset
-
+``-R date/offset``
    This option sets the date on which the key is to be revoked. After that date, the
    key is flagged as revoked. It is included in the zone and
    is used to sign it.
 
-.. option:: -I date/offset
-
+``-I date/offset``
    This option sets the date on which the key is to be retired. After that date, the
    key is still included in the zone, but it is not used to
    sign it.
 
-
-.. option:: -D date/offset
-
+``-D date/offset``
    This option sets the date on which the key is to be deleted. After that date, the
    key is no longer included in the zone. (However, it may remain in the key
    repository.)
 
-   .. program:: dnssec-keygen -D
-   .. option:: sync date/offset
-
-      This option sets the date on which the CDS and CDNSKEY records that match this
-      key are to be deleted.
-
-.. program:: dnssec-keygen
-
-.. option:: -i interval
+``-D sync date/offset``
+   This option sets the date on which the CDS and CDNSKEY records that match this
+   key are to be deleted.
 
+``-i interval``
    This option sets the prepublication interval for a key. If set, then the
    publication and activation dates must be separated by at least this
    much time. If the activation date is specified but the publication
@@ -305,7 +261,7 @@ To unset a date, use ``none``, ``never``, or ``unset``.
 Generated Keys
 ~~~~~~~~~~~~~~
 
-When :program:`dnssec-keygen` completes successfully, it prints a string of the
+When ``dnssec-keygen`` completes successfully, it prints a string of the
 form ``Knnnn.+aaa+iiiii`` to the standard output. This is an
 identification string for the key it has generated.
 
@@ -315,12 +271,12 @@ identification string for the key it has generated.
 
 -  ``iiiii`` is the key identifier (or footprint).
 
-:program:`dnssec-keygen` creates two files, with names based on the printed
+``dnssec-keygen`` creates two files, with names based on the printed
 string. ``Knnnn.+aaa+iiiii.key`` contains the public key, and
 ``Knnnn.+aaa+iiiii.private`` contains the private key.
 
 The ``.key`` file contains a DNSKEY or KEY record. When a zone is being
-signed by :iscman:`named` or :option:`dnssec-signzone -S`, DNSKEY records are
+signed by ``named`` or ``dnssec-signzone -S``, DNSKEY records are
 included automatically. In other cases, the ``.key`` file can be
 inserted into a zone file manually or with an ``$INCLUDE`` statement.
 
@@ -339,7 +295,7 @@ The command prints a string of the form:
 
 ``Kexample.com.+013+26160``
 
-In this example, :program:`dnssec-keygen` creates the files
+In this example, ``dnssec-keygen`` creates the files
 ``Kexample.com.+013+26160.key`` and ``Kexample.com.+013+26160.private``.
 
 To generate a matching key-signing key, issue the command:
@@ -349,5 +305,5 @@ To generate a matching key-signing key, issue the command:
 See Also
 ~~~~~~~~
 
-:iscman:`dnssec-signzone(8) <dnssec-signzone>`, BIND 9 Administrator Reference Manual, :rfc:`2539`,
+:manpage:`dnssec-signzone(8)`, BIND 9 Administrator Reference Manual, :rfc:`2539`,
 :rfc:`2845`, :rfc:`4034`.

bin/dnssec/dnssec-revoke.c

@@ -24,6 +24,7 @@
 #include <isc/file.h>
 #include <isc/hash.h>
 #include <isc/mem.h>
+#include <isc/print.h>
 #include <isc/result.h>
 #include <isc/string.h>
 #include <isc/util.h>
@@ -38,7 +39,7 @@ const char *program = "dnssec-revoke";
 
 static isc_mem_t *mctx = NULL;
 
-noreturn static void
+ISC_NORETURN static void
 usage(void);
 
 static void
@@ -58,7 +59,7 @@ usage(void) {
 	fprintf(stderr, "     K<name>+<alg>+<new id>.key, "
 			"K<name>+<alg>+<new id>.private\n");
 
-	exit(EXIT_FAILURE);
+	exit(-1);
 }
 
 int
@@ -118,7 +119,7 @@ main(int argc, char **argv) {
 				fprintf(stderr, "%s: invalid argument -%c\n",
 					program, isc_commandline_option);
 			}
-			FALLTHROUGH;
+		/* FALLTHROUGH */
 		case 'h':
 			/* Does not return. */
 			usage();
@@ -130,13 +131,12 @@ main(int argc, char **argv) {
 		default:
 			fprintf(stderr, "%s: unhandled option -%c\n", program,
 				isc_commandline_option);
-			exit(EXIT_FAILURE);
+			exit(1);
 		}
 	}
 
 	if (argc < isc_commandline_index + 1 ||
-	    argv[isc_commandline_index] == NULL)
-	{
+	    argv[isc_commandline_index] == NULL) {
 		fatal("The key file name was not specified");
 	}
 	if (argc > isc_commandline_index + 1) {
@@ -190,7 +190,7 @@ main(int argc, char **argv) {
 
 	flags = dst_key_flags(key);
 	if ((flags & DNS_KEYFLAG_REVOKE) == 0) {
-		isc_stdtime_t now = isc_stdtime_now();
+		isc_stdtime_t now;
 
 		if ((flags & DNS_KEYFLAG_KSK) == 0) {
 			fprintf(stderr,
@@ -200,6 +200,7 @@ main(int argc, char **argv) {
 				program);
 		}
 
+		isc_stdtime_get(&now);
 		dst_key_settime(key, DST_TIME_REVOKE, now);
 
 		dst_key_setflags(key, flags | DNS_KEYFLAG_REVOKE);

bin/dnssec/dnssec-revoke.rst

@@ -11,8 +11,6 @@
 
 .. highlight: console
 
-.. iscman:: dnssec-revoke
-.. program:: dnssec-revoke
 .. _man_dnssec-revoke:
 
 dnssec-revoke - set the REVOKED bit on a DNSSEC key
@@ -26,53 +24,45 @@ Synopsis
 Description
 ~~~~~~~~~~~
 
-:program:`dnssec-revoke` reads a DNSSEC key file, sets the REVOKED bit on the
+``dnssec-revoke`` reads a DNSSEC key file, sets the REVOKED bit on the
 key as defined in :rfc:`5011`, and creates a new pair of key files
 containing the now-revoked key.
 
 Options
 ~~~~~~~
 
-.. option:: -h
-
+``-h``
    This option emits a usage message and exits.
 
-.. option:: -K directory
-
+``-K directory``
    This option sets the directory in which the key files are to reside.
 
-.. option:: -r
-
+``-r``
    This option indicates to remove the original keyset files after writing the new keyset files.
 
-.. option:: -v level
-
+``-v level``
    This option sets the debugging level.
 
-.. option:: -V
-
+``-V``
    This option prints version information.
 
-.. option:: -E engine
-
+``-E engine``
    This option specifies the cryptographic hardware to use, when applicable.
 
    When BIND 9 is built with OpenSSL, this needs to be set to the OpenSSL
    engine identifier that drives the cryptographic accelerator or
    hardware service module (usually ``pkcs11``).
 
-.. option:: -f
-
-   This option indicates a forced overwrite and causes :program:`dnssec-revoke` to write the new key pair,
+``-f``
+   This option indicates a forced overwrite and causes ``dnssec-revoke`` to write the new key pair,
    even if a file already exists matching the algorithm and key ID of
    the revoked key.
 
-.. option:: -R
-
+``-R``
    This option prints the key tag of the key with the REVOKE bit set, but does not
    revoke the key.
 
 See Also
 ~~~~~~~~
 
-:iscman:`dnssec-keygen(8) <dnssec-keygen>`, BIND 9 Administrator Reference Manual, :rfc:`5011`.
+:manpage:`dnssec-keygen(8)`, BIND 9 Administrator Reference Manual, :rfc:`5011`.

bin/dnssec/dnssec-settime.c

@@ -26,6 +26,7 @@
 #include <isc/file.h>
 #include <isc/hash.h>
 #include <isc/mem.h>
+#include <isc/print.h>
 #include <isc/result.h>
 #include <isc/string.h>
 #include <isc/time.h>
@@ -42,7 +43,7 @@ const char *program = "dnssec-settime";
 
 static isc_mem_t *mctx = NULL;
 
-noreturn static void
+ISC_NORETURN static void
 usage(void);
 
 static void
@@ -101,7 +102,7 @@ usage(void) {
 	fprintf(stderr, "     K<name>+<alg>+<new id>.key, "
 			"K<name>+<alg>+<new id>.private\n");
 
-	exit(EXIT_FAILURE);
+	exit(-1);
 }
 
 static void
@@ -202,6 +203,7 @@ main(int argc, char **argv) {
 	int prepub = -1;
 	int options;
 	dns_ttl_t ttl = 0;
+	isc_stdtime_t now;
 	isc_stdtime_t dstime = 0, dnskeytime = 0;
 	isc_stdtime_t krrsigtime = 0, zrrsigtime = 0;
 	isc_stdtime_t pub = 0, act = 0, rev = 0, inact = 0, del = 0;
@@ -237,7 +239,6 @@ main(int argc, char **argv) {
 	bool unsetdsadd = false, setdsadd = false;
 	bool unsetdsdel = false, setdsdel = false;
 	bool printdsadd = false, printdsdel = false;
-	isc_stdtime_t now = isc_stdtime_now();
 
 	options = DST_TYPE_PUBLIC | DST_TYPE_PRIVATE | DST_TYPE_STATE;
 
@@ -251,6 +252,8 @@ main(int argc, char **argv) {
 
 	isc_commandline_errprint = false;
 
+	isc_stdtime_get(&now);
+
 #define CMDLINE_FLAGS "A:D:d:E:fg:hI:i:K:k:L:P:p:R:r:S:suv:Vz:"
 	while ((ch = isc_commandline_parse(argc, argv, CMDLINE_FLAGS)) != -1) {
 		switch (ch) {
@@ -339,7 +342,7 @@ main(int argc, char **argv) {
 				fprintf(stderr, "%s: invalid argument -%c\n",
 					program, isc_commandline_option);
 			}
-			FALLTHROUGH;
+		/* FALLTHROUGH */
 		case 'h':
 			/* Does not return. */
 			usage();
@@ -536,13 +539,12 @@ main(int argc, char **argv) {
 		default:
 			fprintf(stderr, "%s: unhandled option -%c\n", program,
 				isc_commandline_option);
-			exit(EXIT_FAILURE);
+			exit(1);
 		}
 	}
 
 	if (argc < isc_commandline_index + 1 ||
-	    argv[isc_commandline_index] == NULL)
-	{
+	    argv[isc_commandline_index] == NULL) {
 		fatal("The key file name was not specified");
 	}
 	if (argc > isc_commandline_index + 1) {
@@ -550,8 +552,7 @@ main(int argc, char **argv) {
 	}
 
 	if ((setgoal || setds || setdnskey || setkrrsig || setzrrsig) &&
-	    !write_state)
-	{
+	    !write_state) {
 		fatal("Options -g, -d, -k, -r and -z require -s to be set");
 	}
 

bin/dnssec/dnssec-settime.rst

@@ -11,8 +11,6 @@
 
 .. highlight: console
 
-.. iscman:: dnssec-settime
-.. program:: dnssec-settime
 .. _man_dnssec-settime:
 
 dnssec-settime: set the key timing metadata for a DNSSEC key
@@ -26,14 +24,14 @@ Synopsis
 Description
 ~~~~~~~~~~~
 
-:program:`dnssec-settime` reads a DNSSEC private key file and sets the key
-timing metadata as specified by the :option:`-P`, :option:`-A`, :option:`-R`,
-:option:`-I`, and :option:`-D` options. The metadata can then be used by
-:iscman:`dnssec-signzone` or other signing software to determine when a key is
-to be published, whether it should be used for signing a zone, etc.
+``dnssec-settime`` reads a DNSSEC private key file and sets the key
+timing metadata as specified by the ``-P``, ``-A``, ``-R``, ``-I``, and
+``-D`` options. The metadata can then be used by ``dnssec-signzone`` or
+other signing software to determine when a key is to be published,
+whether it should be used for signing a zone, etc.
 
 If none of these options is set on the command line,
-:program:`dnssec-settime` simply prints the key timing metadata already stored
+``dnssec-settime`` simply prints the key timing metadata already stored
 in the key.
 
 When key metadata fields are changed, both files of a key pair
@@ -46,12 +44,12 @@ the key file. The private file's permissions are always set to be
 inaccessible to anyone other than the owner (mode 0600).
 
 When working with state files, it is possible to update the timing metadata in
-those files as well with :option:`-s`.  With this option, it is also possible
-to update key states with :option:`-d` (DS), :option:`-k` (DNSKEY), :option:`-r`
-(RRSIG of KSK), or :option:`-z` (RRSIG of ZSK). Allowed states are HIDDEN,
-RUMOURED, OMNIPRESENT, and UNRETENTIVE.
+those files as well with ``-s``.  With this option, it is also possible to update key
+states with ``-d`` (DS), ``-k`` (DNSKEY), ``-r`` (RRSIG of KSK), or ``-z``
+(RRSIG of ZSK). Allowed states are HIDDEN, RUMOURED, OMNIPRESENT, and
+UNRETENTIVE.
 
-The goal state of the key can also be set with :option:`-g`. This should be either
+The goal state of the key can also be set with ``-g``. This should be either
 HIDDEN or OMNIPRESENT, representing whether the key should be removed from the
 zone or published.
 
@@ -61,22 +59,19 @@ purposes.
 Options
 ~~~~~~~
 
-.. option:: -f
-
+``-f``
    This option forces an update of an old-format key with no metadata fields. Without
-   this option, :program:`dnssec-settime` fails when attempting to update a
+   this option, ``dnssec-settime`` fails when attempting to update a
    legacy key. With this option, the key is recreated in the new
    format, but with the original key data retained. The key's creation
    date is set to the present time. If no other values are
    specified, then the key's publication and activation dates are also
    set to the present time.
 
-.. option:: -K directory
-
+``-K directory``
    This option sets the directory in which the key files are to reside.
 
-.. option:: -L ttl
-
+``-L ttl``
    This option sets the default TTL to use for this key when it is converted into a
    DNSKEY RR. This is the TTL used when the key is imported into a zone,
    unless there was already a DNSKEY RRset in
@@ -85,20 +80,16 @@ Options
    defaults to the SOA TTL. Setting the default TTL to ``0`` or ``none``
    removes it from the key.
 
-.. option:: -h
-
+``-h``
    This option emits a usage message and exits.
 
-.. option:: -V
-
+``-V``
    This option prints version information.
 
-.. option:: -v level
-
+``-v level``
    This option sets the debugging level.
 
-.. option:: -E engine
-
+``-E engine``
    This option specifies the cryptographic hardware to use, when applicable.
 
    When BIND 9 is built with OpenSSL, this needs to be set to the OpenSSL
@@ -108,81 +99,56 @@ Options
 Timing Options
 ~~~~~~~~~~~~~~
 
-Dates can be expressed in the format YYYYMMDD or YYYYMMDDHHMMSS
-(which is the format used inside key files),
-or 'Day Mon DD HH:MM:SS YYYY' (as printed by ``dnssec-settime -p``),
-or UNIX epoch time (as printed by ``dnssec-settime -up``),
-or the literal ``now``.
-
-The argument can be followed by ``+`` or ``-`` and an offset from the
-given time. The literal ``now`` can be omitted before an offset. The
-offset can be followed by one of the suffixes ``y``, ``mo``, ``w``,
-``d``, ``h``, or ``mi``, so that it is computed in years (defined as
-365 24-hour days, ignoring leap years), months (defined as 30 24-hour
-days), weeks, days, hours, or minutes, respectively. Without a suffix,
-the offset is computed in seconds.
-
-To unset a date, use ``none``, ``never``, or ``unset``.
-
-All these formats are case-insensitive.
-
-.. option:: -P date/offset
+Dates can be expressed in the format YYYYMMDD or YYYYMMDDHHMMSS. If the
+argument begins with a ``+`` or ``-``, it is interpreted as an offset from
+the present time. For convenience, if such an offset is followed by one
+of the suffixes ``y``, ``mo``, ``w``, ``d``, ``h``, or ``mi``, then the offset is
+computed in years (defined as 365 24-hour days, ignoring leap years),
+months (defined as 30 24-hour days), weeks, days, hours, or minutes,
+respectively. Without a suffix, the offset is computed in seconds. To
+explicitly prevent a date from being set, use ``none`` or ``never``.
 
+``-P date/offset``
    This option sets the date on which a key is to be published to the zone. After
    that date, the key is included in the zone but is not used
    to sign it.
 
-   .. program:: dnssec-settime -P
-   .. option:: ds date/offset
+``-P ds date/offset``
+   This option sets the date on which DS records that match this key have been
+   seen in the parent zone.
 
-      This option sets the date on which DS records that match this key have been
-      seen in the parent zone.
-
-   .. option:: sync date/offset
-
-      This option sets the date on which CDS and CDNSKEY records that match this key
-      are to be published to the zone.
-
-.. program:: dnssec-settime
-
-.. option:: -A date/offset
+``-P sync date/offset``
+   This option sets the date on which CDS and CDNSKEY records that match this key
+   are to be published to the zone.
 
+``-A date/offset``
    This option sets the date on which the key is to be activated. After that date,
-   the key is included in the zone and used to sign it.
-
-.. option:: -R date/offset
+   the key is included in the zone and used to sign it. 
 
+``-R date/offset``
    This option sets the date on which the key is to be revoked. After that date, the
    key is flagged as revoked. It is included in the zone and
    is used to sign it.
 
-.. option:: -I date/offset
-
+``-I date/offset``
    This option sets the date on which the key is to be retired. After that date, the
    key is still included in the zone, but it is not used to
    sign it.
 
-.. option:: -D date/offset
-
+``-D date/offset``
    This option sets the date on which the key is to be deleted. After that date, the
    key is no longer included in the zone. (However, it may remain in the key
    repository.)
 
-   .. program:: dnssec-settime -D
-   .. option:: ds date/offset
+``-D ds date/offset``
+   This option sets the date on which the DS records that match this key have
+   been seen removed from the parent zone.
 
-      This option sets the date on which the DS records that match this key have
-      been seen removed from the parent zone.
-
-   .. option:: sync date/offset
-
-      This option sets the date on which the CDS and CDNSKEY records that match this
-      key are to be deleted.
-
-.. program:: dnssec-settime
-
-.. option:: -S predecessor key
+``-D sync date/offset``
+   This option sets the date on which the CDS and CDNSKEY records that match this
+   key are to be deleted.
 
+``-S predecessor key``
    This option selects a key for which the key being modified is an explicit
    successor. The name, algorithm, size, and type of the predecessor key
    must exactly match those of the key being modified. The activation
@@ -190,8 +156,7 @@ All these formats are case-insensitive.
    predecessor. The publication date is set to the activation date
    minus the prepublication interval, which defaults to 30 days.
 
-.. option:: -i interval
-
+``-i interval``
    This option sets the prepublication interval for a key. If set, then the
    publication and activation dates must be separated by at least this
    much time. If the activation date is specified but the publication
@@ -218,44 +183,36 @@ purpose, but should never be used in production.
 
 Known key states are HIDDEN, RUMOURED, OMNIPRESENT, and UNRETENTIVE.
 
-.. option:: -s
-
+``-s``
    This option indicates that when setting key timing data, the state file should also be updated.
 
-.. option:: -g state
-
+``-g state``
    This option sets the goal state for this key. Must be HIDDEN or OMNIPRESENT.
 
-.. option:: -d state date/offset
-
+``-d state date/offset``
    This option sets the DS state for this key as of the specified date, offset from the current date.
 
-.. option:: -k state date/offset
-
+``-k state date/offset``
    This option sets the DNSKEY state for this key as of the specified date, offset from the current date.
 
-.. option:: -r state date/offset
-
+``-r state date/offset``
    This option sets the RRSIG (KSK) state for this key as of the specified date, offset from the current date.
 
-.. option:: -z state date/offset
-
+``-z state date/offset``
    This option sets the RRSIG (ZSK) state for this key as of the specified date, offset from the current date.
 
 Printing Options
 ~~~~~~~~~~~~~~~~
 
-:program:`dnssec-settime` can also be used to print the timing metadata
+``dnssec-settime`` can also be used to print the timing metadata
 associated with a key.
 
-.. option:: -u
-
+``-u``
    This option indicates that times should be printed in Unix epoch format.
 
-.. option:: -p C/P/Pds/Psync/A/R/I/D/Dds/Dsync/all
-
+``-p C/P/Pds/Psync/A/R/I/D/Dds/Dsync/all``
    This option prints a specific metadata value or set of metadata values.
-   The :option:`-p` option may be followed by one or more of the following letters or
+   The ``-p`` option may be followed by one or more of the following letters or
    strings to indicate which value or values to print: ``C`` for the
    creation date, ``P`` for the publication date, ``Pds` for the DS publication
    date, ``Psync`` for the CDS and CDNSKEY publication date, ``A`` for the
@@ -267,5 +224,5 @@ associated with a key.
 See Also
 ~~~~~~~~
 
-:iscman:`dnssec-keygen(8) <dnssec-keygen>`, :iscman:`dnssec-signzone(8) <dnssec-signzone>`, BIND 9 Administrator Reference Manual,
+:manpage:`dnssec-keygen(8)`, :manpage:`dnssec-signzone(8)`, BIND 9 Administrator Reference Manual,
 :rfc:`5011`.

bin/dnssec/dnssec-signzone.rst

@@ -11,8 +11,6 @@
 
 .. highlight: console
 
-.. iscman:: dnssec-signzone
-.. program:: dnssec-signzone
 .. _man_dnssec-signzone:
 
 dnssec-signzone - DNSSEC zone signing tool
@@ -21,12 +19,12 @@ dnssec-signzone - DNSSEC zone signing tool
 Synopsis
 ~~~~~~~~
 
-:program:`dnssec-signzone` [**-a**] [**-c** class] [**-d** directory] [**-D**] [**-E** engine] [**-e** end-time] [**-f** output-file] [**-F**] [**-g**] [**-G sync-records**] [**-h**] [**-i** interval] [**-I** input-format] [**-j** jitter] [**-K** directory] [**-k** key] [**-L** serial] [**-M** maxttl] [**-N** soa-serial-format] [**-o** origin] [**-O** output-format] [**-P**] [**-Q**] [**-q**] [**-R**] [**-S**] [**-s** start-time] [**-T** ttl] [**-t**] [**-u**] [**-v** level] [**-V**] [**-X** extended end-time] [**-x**] [**-z**] [**-3** salt] [**-H** iterations] [**-A**] {zonefile} [key...]
+:program:`dnssec-signzone` [**-a**] [**-c** class] [**-d** directory] [**-D**] [**-E** engine] [**-e** end-time] [**-f** output-file] [**-g**] [**-h**] [**-i** interval] [**-I** input-format] [**-j** jitter] [**-K** directory] [**-k** key] [**-L** serial] [**-M** maxttl] [**-N** soa-serial-format] [**-o** origin] [**-O** output-format] [**-P**] [**-Q**] [**-q**] [**-R**] [**-S**] [**-s** start-time] [**-T** ttl] [**-t**] [**-u**] [**-v** level] [**-V**] [**-X** extended end-time] [**-x**] [**-z**] [**-3** salt] [**-H** iterations] [**-A**] {zonefile} [key...]
 
 Description
 ~~~~~~~~~~~
 
-:program:`dnssec-signzone` signs a zone; it generates NSEC and RRSIG records
+``dnssec-signzone`` signs a zone; it generates NSEC and RRSIG records
 and produces a signed version of the zone. The security status of
 delegations from the signed zone (that is, whether the child zones are
 secure) is determined by the presence or absence of a ``keyset``
@@ -35,35 +33,29 @@ file for each child zone.
 Options
 ~~~~~~~
 
-.. option:: -a
-
+``-a``
    This option verifies all generated signatures.
 
-.. option:: -c class
-
+``-c class``
    This option specifies the DNS class of the zone.
 
-.. option:: -C
-
+``-C``
    This option sets compatibility mode, in which a ``keyset-zonename`` file is generated in addition
    to ``dsset-zonename`` when signing a zone, for use by older versions
-   of :program:`dnssec-signzone`.
-
-.. option:: -d directory
+   of ``dnssec-signzone``.
 
+``-d directory``
    This option indicates the directory where BIND 9 should look for ``dsset-`` or ``keyset-`` files.
 
-.. option:: -D
-
+``-D``
    This option indicates that only those record types automatically managed by
-   :program:`dnssec-signzone`, i.e., RRSIG, NSEC, NSEC3 and NSEC3PARAM records, should be included in the output.
-   If smart signing (:option:`-S`) is used, DNSKEY records are also included.
+   ``dnssec-signzone``, i.e., RRSIG, NSEC, NSEC3 and NSEC3PARAM records, should be included in the output.
+   If smart signing (``-S``) is used, DNSKEY records are also included.
    The resulting file can be included in the original zone file with
-   ``$INCLUDE``. This option cannot be combined with :option:`-O raw <-O>`
+   ``$INCLUDE``. This option cannot be combined with ``-O raw``
    or serial-number updating.
 
-.. option:: -E engine
-
+``-E engine``
    This option specifies the hardware to use for cryptographic
    operations, such as a secure key store used for signing, when applicable.
 
@@ -71,36 +63,19 @@ Options
    engine identifier that drives the cryptographic accelerator or
    hardware service module (usually ``pkcs11``).
 
-.. option:: -F
-
-   This options turns on FIPS (US Federal Information Processing Standards)
-   mode if the underlying crytographic library supports running in FIPS
-   mode.
-
-.. option:: -g
-
+``-g``
    This option indicates that DS records for child zones should be generated from a ``dsset-`` or ``keyset-``
    file. Existing DS records are removed.
 
-.. option:: -G sync-records
-
-   This option indicates which CDS and CDNSKEY records should be generated. ``sync-records`` is a
-   comma-separated string with the following allowed items: ``cdnskey``, and ``cds:<digest-type>``,
-   where ``digest-type`` is an allowed algorithm such as SHA-256 (2), or SHA-384 (4).
-   Only works in combination with smart signing (``-S``).
-
-.. option:: -K directory
-
+``-K directory``
    This option specifies the directory to search for DNSSEC keys. If not
    specified, it defaults to the current directory.
 
-.. option:: -k key
-
+``-k key``
    This option tells BIND 9 to treat the specified key as a key-signing key, ignoring any key flags. This
    option may be specified multiple times.
 
-.. option:: -M maxttl
-
+``-M maxttl``
    This option sets the maximum TTL for the signed zone. Any TTL higher than ``maxttl``
    in the input zone is reduced to ``maxttl`` in the output. This
    provides certainty as to the largest possible TTL in the signed zone,
@@ -108,11 +83,10 @@ Options
    possible time before signatures that have been retrieved by resolvers
    expire from resolver caches. Zones that are signed with this
    option should be configured to use a matching ``max-zone-ttl`` in
-   :iscman:`named.conf`. (Note: This option is incompatible with :option:`-D`,
+   ``named.conf``. (Note: This option is incompatible with ``-D``,
    because it modifies non-DNSSEC data in the output zone.)
 
-.. option:: -s start-time
-
+``-s start-time``
    This option specifies the date and time when the generated RRSIG records become
    valid. This can be either an absolute or relative time. An absolute
    start time is indicated by a number in YYYYMMDDHHMMSS notation;
@@ -121,8 +95,7 @@ Options
    time. If no ``start-time`` is specified, the current time minus 1
    hour (to allow for clock skew) is used.
 
-.. option:: -e end-time
-
+``-e end-time``
    This option specifies the date and time when the generated RRSIG records expire. As
    with ``start-time``, an absolute time is indicated in YYYYMMDDHHMMSS
    notation. A time relative to the start time is indicated with ``+N``,
@@ -131,8 +104,7 @@ Options
    specified, 30 days from the start time is the default.
    ``end-time`` must be later than ``start-time``.
 
-.. option:: -X extended end-time
-
+``-X extended end-time``
    This option specifies the date and time when the generated RRSIG records for the
    DNSKEY RRset expire. This is to be used in cases when the DNSKEY
    signatures need to persist longer than signatures on other records;
@@ -147,24 +119,20 @@ Options
    as the default. (``end-time``, in turn, defaults to 30 days from the
    start time.) ``extended end-time`` must be later than ``start-time``.
 
-.. option:: -f output-file
-
+``-f output-file``
    This option indicates the name of the output file containing the signed zone. The default
    is to append ``.signed`` to the input filename. If ``output-file`` is
    set to ``-``, then the signed zone is written to the standard
    output, with a default output format of ``full``.
 
-.. option:: -h
-
+``-h``
    This option prints a short summary of the options and arguments to
-   :program:`dnssec-signzone`.
-
-.. option:: -V
+   ``dnssec-signzone``.
 
+``-V``
    This option prints version information.
 
-.. option:: -i interval
-
+``-i interval``
    This option indicates that, when a previously signed zone is passed as input, records may be
    re-signed. The ``interval`` option specifies the cycle interval as an
    offset from the current time, in seconds. If a RRSIG record expires
@@ -173,21 +141,19 @@ Options
 
    The default cycle interval is one quarter of the difference between
    the signature end and start times. So if neither ``end-time`` nor
-   ``start-time`` is specified, :program:`dnssec-signzone` generates
+   ``start-time`` is specified, ``dnssec-signzone`` generates
    signatures that are valid for 30 days, with a cycle interval of 7.5
    days. Therefore, if any existing RRSIG records are due to expire in
    less than 7.5 days, they are replaced.
 
-.. option:: -I input-format
-
+``-I input-format``
    This option sets the format of the input zone file. Possible formats are
    ``text`` (the default), and ``raw``. This option is primarily
    intended to be used for dynamic signed zones, so that the dumped zone
    file in a non-text format containing updates can be signed directly.
    This option is not useful for non-dynamic zones.
 
-.. option:: -j jitter
-
+``-j jitter``
    When signing a zone with a fixed signature lifetime, all RRSIG
    records issued at the time of signing expire simultaneously. If the
    zone is incrementally signed, i.e., a previously signed zone is passed
@@ -202,19 +168,16 @@ Options
    less congestion than if all validators need to refetch at around the
    same time.
 
-.. option:: -L serial
-
+``-L serial``
    When writing a signed zone to "raw" format, this option sets the "source
    serial" value in the header to the specified ``serial`` number. (This is
    expected to be used primarily for testing purposes.)
 
-.. option:: -n ncpus
-
+``-n ncpus``
    This option specifies the number of threads to use. By default, one thread is
    started for each detected CPU.
 
-.. option:: -N soa-serial-format
-
+``-N soa-serial-format``
    This option sets the SOA serial number format of the signed zone. Possible formats are
    ``keep`` (the default), ``increment``, ``unixtime``, and
    ``date``.
@@ -237,24 +200,21 @@ Options
       than or equal to that value, in which case it is simply
       incremented by one.
 
-.. option:: -o origin
-
+``-o origin``
    This option sets the zone origin. If not specified, the name of the zone file is
    assumed to be the origin.
 
-.. option:: -O output-format
-
+``-O output-format``
    This option sets the format of the output file containing the signed
    zone. Possible formats are ``text`` (the default), which is the standard
    textual representation of the zone; ``full``, which is text output in a
    format suitable for processing by external scripts; and ``raw`` and
    ``raw=N``, which store the zone in binary formats for rapid loading by
-   :iscman:`named`. ``raw=N`` specifies the format version of the raw zone file:
-   if N is 0, the raw file can be read by any version of :iscman:`named`; if N is
+   ``named``. ``raw=N`` specifies the format version of the raw zone file:
+   if N is 0, the raw file can be read by any version of ``named``; if N is
    1, the file can be read by release 9.9.0 or higher. The default is 1.
 
-.. option:: -P
-
+``-P``
    This option disables post-sign verification tests.
 
    The post-sign verification tests ensure that for each algorithm in
@@ -262,40 +222,36 @@ Options
    revoked KSK keys are self-signed, and that all records in the zone
    are signed by the algorithm. This option skips these tests.
 
-.. option:: -Q
-
+``-Q``
    This option removes signatures from keys that are no longer active.
 
    Normally, when a previously signed zone is passed as input to the
    signer, and a DNSKEY record has been removed and replaced with a new
    one, signatures from the old key that are still within their validity
    period are retained. This allows the zone to continue to validate
-   with cached copies of the old DNSKEY RRset. The :option:`-Q` option forces
-   :program:`dnssec-signzone` to remove signatures from keys that are no longer
+   with cached copies of the old DNSKEY RRset. The ``-Q`` option forces
+   ``dnssec-signzone`` to remove signatures from keys that are no longer
    active. This enables ZSK rollover using the procedure described in
    :rfc:`4641#4.2.1.1` ("Pre-Publish Key Rollover").
 
-.. option:: -q
-
+``-q``
    This option enables quiet mode, which suppresses unnecessary output. Without this option, when
-   :program:`dnssec-signzone` is run it prints three pieces of information to standard output: the number of
+   ``dnssec-signzone`` is run it prints three pieces of information to standard output: the number of
    keys in use; the algorithms used to verify the zone was signed correctly and
    other status information; and the filename containing the signed
    zone. With the option that output is suppressed, leaving only the filename.
 
-.. option:: -R
-
+``-R``
    This option removes signatures from keys that are no longer published.
 
-   This option is similar to :option:`-Q`, except it forces
-   :program:`dnssec-signzone` to remove signatures from keys that are no longer
+   This option is similar to ``-Q``, except it forces
+   ``dnssec-signzone`` to remove signatures from keys that are no longer
    published. This enables ZSK rollover using the procedure described in
    :rfc:`4641#4.2.1.2` ("Double Signature Zone Signing Key
    Rollover").
 
-.. option:: -S
-
-   This option enables smart signing, which instructs :program:`dnssec-signzone` to search the key
+``-S``
+   This option enables smart signing, which instructs ``dnssec-signzone`` to search the key
    repository for keys that match the zone being signed, and to include
    them in the zone if appropriate.
 
@@ -327,12 +283,11 @@ Options
       If the key's sync deletion date is set and is in the past,
       synchronization records (type CDS and/or CDNSKEY) are removed.
 
-.. option:: -T ttl
-
+``-T ttl``
    This option specifies a TTL to be used for new DNSKEY records imported into the
    zone from the key repository. If not specified, the default is the
    TTL value from the zone's SOA record. This option is ignored when
-   signing without :option:`-S`, since DNSKEY records are not imported from
+   signing without ``-S``, since DNSKEY records are not imported from
    the key repository in that case. It is also ignored if there are any
    pre-existing DNSKEY records at the zone apex, in which case new
    records' TTL values are set to match them, or if any of the
@@ -340,69 +295,51 @@ Options
    conflict between TTL values in imported keys, the shortest one is
    used.
 
-.. option:: -t
-
+``-t``
    This option prints statistics at completion.
 
-.. option:: -u
-
+``-u``
    This option updates the NSEC/NSEC3 chain when re-signing a previously signed zone.
    With this option, a zone signed with NSEC can be switched to NSEC3,
    or a zone signed with NSEC3 can be switched to NSEC or to NSEC3 with
-   different parameters. Without this option, :program:`dnssec-signzone`
+   different parameters. Without this option, ``dnssec-signzone``
    retains the existing chain when re-signing.
 
-.. option:: -v level
-
+``-v level``
    This option sets the debugging level.
 
-.. option:: -x
-
+``-x``
    This option indicates that BIND 9 should only sign the DNSKEY, CDNSKEY, and CDS RRsets with key-signing keys,
-   and should omit signatures from zone-signing keys.
-
-.. option:: -z
+   and should omit signatures from zone-signing keys. (This is similar to the
+   ``dnssec-dnskey-kskonly yes;`` zone option in ``named``.)
 
+``-z``
    This option indicates that BIND 9 should ignore the KSK flag on keys when determining what to sign. This causes
    KSK-flagged keys to sign all records, not just the DNSKEY RRset.
+   (This is similar to the ``update-check-ksk no;`` zone option in
+   ``named``.)
 
-.. option:: -3 salt
-
+``-3 salt``
    This option generates an NSEC3 chain with the given hex-encoded salt. A dash
    (-) can be used to indicate that no salt is to be used when
    generating the NSEC3 chain.
 
-   .. note::
-      ``-3 -`` is the recommended configuration. Adding salt provides no practical benefits.
-
-.. option:: -H iterations
-
+``-H iterations``
    This option indicates that, when generating an NSEC3 chain, BIND 9 should use this many iterations. The default
-   is 0.
-
-   .. warning::
-      Values greater than 0 cause interoperability issues and also increase the risk of CPU-exhausting DoS attacks.
-
-.. option:: -A
+   is 10.
 
+``-A``
    This option indicates that, when generating an NSEC3 chain, BIND 9 should set the OPTOUT flag on all NSEC3
    records and should not generate NSEC3 records for insecure delegations.
 
-   .. warning::
-      Do not use this option unless all its implications are fully understood. This option is intended only for extremely large zones (comparable to ``com.``) with sparse secure delegations.
-
-.. option:: -AA
-
-   This option turns the OPTOUT flag off for
-   all records. This is useful when using the :option:`-u` option to modify an
+   Using this option twice (i.e., ``-AA``) turns the OPTOUT flag off for
+   all records. This is useful when using the ``-u`` option to modify an
    NSEC3 chain which previously had OPTOUT set.
 
-.. option:: zonefile
-
+``zonefile``
    This option sets the file containing the zone to be signed.
 
-.. option:: key
-
+``key``
    This option specifies which keys should be used to sign the zone. If no keys are
    specified, the zone is examined for DNSKEY records at the
    zone apex. If these records are found and there are matching private keys in
@@ -412,11 +349,11 @@ Example
 ~~~~~~~
 
 The following command signs the ``example.com`` zone with the
-ECDSAP256SHA256 key generated by :iscman:`dnssec-keygen`
-(Kexample.com.+013+17247). Because the :option:`-S` option is not being used,
+ECDSAP256SHA256 key generated by ``dnssec-keygen``
+(Kexample.com.+013+17247). Because the ``-S`` option is not being used,
 the zone's keys must be in the master file (``db.example.com``). This
 invocation looks for ``dsset`` files in the current directory, so that
-DS records can be imported from them (:option:`-g`).
+DS records can be imported from them (``-g``).
 
 ::
 
@@ -425,9 +362,9 @@ DS records can be imported from them (:option:`-g`).
    db.example.com.signed
    %
 
-In the above example, :program:`dnssec-signzone` creates the file
+In the above example, ``dnssec-signzone`` creates the file
 ``db.example.com.signed``. This file should be referenced in a zone
-statement in the :iscman:`named.conf` file.
+statement in the ``named.conf`` file.
 
 This example re-signs a previously signed zone with default parameters.
 The private keys are assumed to be in the current directory.
@@ -442,5 +379,5 @@ The private keys are assumed to be in the current directory.
 See Also
 ~~~~~~~~
 
-:iscman:`dnssec-keygen(8) <dnssec-keygen>`, BIND 9 Administrator Reference Manual, :rfc:`4033`,
+:manpage:`dnssec-keygen(8)`, BIND 9 Administrator Reference Manual, :rfc:`4033`,
 :rfc:`4641`.

bin/dnssec/dnssec-verify.c

@@ -17,15 +17,18 @@
 #include <stdlib.h>
 #include <time.h>
 
+#include <isc/app.h>
 #include <isc/attributes.h>
 #include <isc/base32.h>
 #include <isc/commandline.h>
+#include <isc/event.h>
 #include <isc/file.h>
 #include <isc/hash.h>
 #include <isc/hex.h>
 #include <isc/mem.h>
 #include <isc/mutex.h>
 #include <isc/os.h>
+#include <isc/print.h>
 #include <isc/random.h>
 #include <isc/result.h>
 #include <isc/rwlock.h>
@@ -67,10 +70,10 @@ const char *program = "dnssec-verify";
 static isc_stdtime_t now;
 static isc_mem_t *mctx = NULL;
 static dns_masterformat_t inputformat = dns_masterformat_text;
-static dns_db_t *gdb = NULL;		 /* The database */
-static dns_dbversion_t *gversion = NULL; /* The database version */
-static dns_rdataclass_t gclass;		 /* The class */
-static dns_name_t *gorigin = NULL;	 /* The database origin */
+static dns_db_t *gdb;		  /* The database */
+static dns_dbversion_t *gversion; /* The database version */
+static dns_rdataclass_t gclass;	  /* The class */
+static dns_name_t *gorigin;	  /* The database origin */
 static bool ignore_kskflag = false;
 static bool keyset_kskonly = false;
 
@@ -109,8 +112,8 @@ loadzone(char *file, char *origin, dns_rdataclass_t rdclass, dns_db_t **db) {
 		      isc_result_totext(result));
 	}
 
-	result = dns_db_create(mctx, ZONEDB_DEFAULT, name, dns_dbtype_zone,
-			       rdclass, 0, NULL, db);
+	result = dns_db_create(mctx, "rbt", name, dns_dbtype_zone, rdclass, 0,
+			       NULL, db);
 	check_result(result, "dns_db_create()");
 
 	result = dns_db_load(*db, file, inputformat, 0);
@@ -129,14 +132,14 @@ loadzone(char *file, char *origin, dns_rdataclass_t rdclass, dns_db_t **db) {
 			      "use -o to specify a different zone origin",
 			      origin, file);
 		}
-		FALLTHROUGH;
+	/* FALLTHROUGH */
 	default:
 		fatal("failed loading zone from '%s': %s", file,
 		      isc_result_totext(result));
 	}
 }
 
-noreturn static void
+ISC_NORETURN static void
 usage(void);
 
 static void
@@ -162,7 +165,7 @@ usage(void) {
 	fprintf(stderr, "\t-x:\tDNSKEY record signed with KSKs only, "
 			"not ZSKs\n");
 	fprintf(stderr, "\t-z:\tAll records signed with KSKs\n");
-	exit(EXIT_SUCCESS);
+	exit(0);
 }
 
 int
@@ -177,7 +180,7 @@ main(int argc, char *argv[]) {
 	char *endp;
 	int ch;
 
-#define CMDLINE_FLAGS "c:E:hJ:m:o:I:qv:Vxz"
+#define CMDLINE_FLAGS "c:E:hm:o:I:qv:Vxz"
 
 	/*
 	 * Process memory debugging argument first.
@@ -203,6 +206,7 @@ main(int argc, char *argv[]) {
 		}
 	}
 	isc_commandline_reset = true;
+	check_result(isc_app_start(), "isc_app_start");
 
 	isc_mem_create(&mctx);
 
@@ -222,10 +226,6 @@ main(int argc, char *argv[]) {
 			inputformatstr = isc_commandline_argument;
 			break;
 
-		case 'J':
-			journal = isc_commandline_argument;
-			break;
-
 		case 'm':
 			break;
 
@@ -258,7 +258,7 @@ main(int argc, char *argv[]) {
 				fprintf(stderr, "%s: invalid argument -%c\n",
 					program, isc_commandline_option);
 			}
-			FALLTHROUGH;
+			/* FALLTHROUGH */
 
 		case 'h':
 			/* Does not return. */
@@ -271,7 +271,7 @@ main(int argc, char *argv[]) {
 		default:
 			fprintf(stderr, "%s: unhandled option -%c\n", program,
 				isc_commandline_option);
-			exit(EXIT_FAILURE);
+			exit(1);
 		}
 	}
 
@@ -281,7 +281,7 @@ main(int argc, char *argv[]) {
 		      isc_result_totext(result));
 	}
 
-	now = isc_stdtime_now();
+	isc_stdtime_get(&now);
 
 	rdclass = strtoclass(classname);
 
@@ -319,9 +319,6 @@ main(int argc, char *argv[]) {
 	gdb = NULL;
 	report("Loading zone '%s' from file '%s'\n", origin, file);
 	loadzone(file, origin, rdclass, &gdb);
-	if (journal != NULL) {
-		loadjournal(mctx, gdb, journal);
-	}
 	gorigin = dns_db_origin(gdb);
 	gclass = dns_db_class(gdb);
 
@@ -342,5 +339,7 @@ main(int argc, char *argv[]) {
 	}
 	isc_mem_destroy(&mctx);
 
+	(void)isc_app_finish();
+
 	return (result == ISC_R_SUCCESS ? 0 : 1);
 }

bin/dnssec/dnssec-verify.rst

@@ -11,8 +11,6 @@
 
 .. highlight: console
 
-.. iscman:: dnssec-verify
-.. program:: dnssec-verify
 .. _man_dnssec-verify:
 
 dnssec-verify - DNSSEC zone verification tool
@@ -26,64 +24,55 @@ Synopsis
 Description
 ~~~~~~~~~~~
 
-:program:`dnssec-verify` verifies that a zone is fully signed for each
+``dnssec-verify`` verifies that a zone is fully signed for each
 algorithm found in the DNSKEY RRset for the zone, and that the
 NSEC/NSEC3 chains are complete.
 
 Options
 ~~~~~~~
 
-.. option:: -c class
-
+``-c class``
    This option specifies the DNS class of the zone.
 
-.. option:: -E engine
-
+``-E engine``
    This option specifies the cryptographic hardware to use, when applicable.
 
    When BIND 9 is built with OpenSSL, this needs to be set to the OpenSSL
    engine identifier that drives the cryptographic accelerator or
    hardware service module (usually ``pkcs11``).
 
-.. option:: -I input-format
-
+``-I input-format``
    This option sets the format of the input zone file. Possible formats are ``text``
    (the default) and ``raw``. This option is primarily intended to be used
    for dynamic signed zones, so that the dumped zone file in a non-text
    format containing updates can be verified independently.
    This option is not useful for non-dynamic zones.
 
-.. option:: -o origin
-
+``-o origin``
    This option indicates the zone origin. If not specified, the name of the zone file is
    assumed to be the origin.
 
-.. option:: -v level
-
+``-v level``
    This option sets the debugging level.
 
-.. option:: -V
-
+``-V``
    This option prints version information.
 
-.. option:: -q
-
-   This option sets quiet mode, which suppresses output.  Without this option, when :program:`dnssec-verify`
+``-q``
+   This option sets quiet mode, which suppresses output.  Without this option, when ``dnssec-verify``
    is run it prints to standard output the number of keys in use, the
    algorithms used to verify the zone was signed correctly, and other status
    information.  With this option, all non-error output is suppressed, and only the exit
    code indicates success.
 
-.. option:: -x
-
+``-x``
    This option verifies only that the DNSKEY RRset is signed with key-signing keys.
    Without this flag, it is assumed that the DNSKEY RRset is signed
    by all active keys. When this flag is set, it is not an error if
    the DNSKEY RRset is not signed by zone-signing keys. This corresponds
-   to the :option:`-x option in dnssec-signzone <dnssec-signzone -x>`.
-
-.. option:: -z
+   to the ``-x`` option in ``dnssec-signzone``.
 
+``-z``
    This option indicates that the KSK flag on the keys should be ignored when determining whether the zone is
    correctly signed. Without this flag, it is assumed that there is
    a non-revoked, self-signed DNSKEY with the KSK flag set for each
@@ -95,13 +84,12 @@ Options
    the KSK flag state, and that other RRsets be signed by a
    non-revoked key for the same algorithm that includes the self-signed
    key; the same key may be used for both purposes. This corresponds to
-   the :option:`-z option in dnssec-signzone <dnssec-signzone -z>`.
-
-.. option:: zonefile
+   the ``-z`` option in ``dnssec-signzone``.
 
+``zonefile``
    This option indicates the file containing the zone to be signed.
 
 See Also
 ~~~~~~~~
 
-:iscman:`dnssec-signzone(8) <dnssec-signzone>`, BIND 9 Administrator Reference Manual, :rfc:`4033`.
+:manpage:`dnssec-signzone(8)`, BIND 9 Administrator Reference Manual, :rfc:`4033`.

bin/dnssec/dnssectool.c

@@ -20,7 +20,6 @@
 #include <inttypes.h>
 #include <stdbool.h>
 #include <stdlib.h>
-#include <unistd.h>
 
 #include <isc/base32.h>
 #include <isc/buffer.h>
@@ -30,18 +29,16 @@
 #include <isc/heap.h>
 #include <isc/list.h>
 #include <isc/mem.h>
+#include <isc/print.h>
 #include <isc/result.h>
 #include <isc/string.h>
 #include <isc/time.h>
-#include <isc/tls.h>
-#include <isc/tm.h>
 #include <isc/util.h>
 
 #include <dns/db.h>
 #include <dns/dbiterator.h>
 #include <dns/dnssec.h>
 #include <dns/fixedname.h>
-#include <dns/journal.h>
 #include <dns/keyvalues.h>
 #include <dns/log.h>
 #include <dns/name.h>
@@ -67,7 +64,6 @@ static const char *keystates[KEYSTATES_NVALUES] = {
 
 int verbose = 0;
 bool quiet = false;
-const char *journal = NULL;
 dns_dsdigest_t dtype[8];
 
 static fatalcallback_t *fatalcallback = NULL;
@@ -84,7 +80,7 @@ fatal(const char *format, ...) {
 	if (fatalcallback != NULL) {
 		(*fatalcallback)();
 	}
-	_exit(EXIT_FAILURE);
+	exit(1);
 }
 
 void
@@ -113,8 +109,8 @@ vbprintf(int level, const char *fmt, ...) {
 
 void
 version(const char *name) {
-	printf("%s %s\n", name, PACKAGE_VERSION);
-	exit(EXIT_SUCCESS);
+	fprintf(stderr, "%s %s\n", name, PACKAGE_VERSION);
+	exit(0);
 }
 
 void
@@ -219,7 +215,7 @@ time_units(isc_stdtime_t offset, char *suffix, const char *str) {
 		default:
 			fatal("time value %s is invalid", str);
 		}
-		UNREACHABLE();
+		/* NOTREACHED */
 		break;
 	case 'W':
 	case 'w':
@@ -237,15 +233,14 @@ time_units(isc_stdtime_t offset, char *suffix, const char *str) {
 	default:
 		fatal("time value %s is invalid", str);
 	}
-	UNREACHABLE();
+	/* NOTREACHED */
 	return (0); /* silence compiler warning */
 }
 
-static bool
+static inline bool
 isnone(const char *str) {
 	return ((strcasecmp(str, "none") == 0) ||
-		(strcasecmp(str, "never") == 0) ||
-		(strcasecmp(str, "unset") == 0));
+		(strcasecmp(str, "never") == 0));
 }
 
 dns_ttl_t
@@ -288,14 +283,17 @@ strtotime(const char *str, int64_t now, int64_t base, bool *setp) {
 	const char *orig = str;
 	char *endp;
 	size_t n;
-	struct tm tm;
 
 	if (isnone(str)) {
-		SET_IF_NOT_NULL(setp, false);
+		if (setp != NULL) {
+			*setp = false;
+		}
 		return ((isc_stdtime_t)0);
 	}
 
-	SET_IF_NOT_NULL(setp, true);
+	if (setp != NULL) {
+		*setp = true;
+	}
 
 	if ((str[0] == '0' || str[0] == '-') && str[1] == '\0') {
 		return ((isc_stdtime_t)0);
@@ -306,14 +304,11 @@ strtotime(const char *str, int64_t now, int64_t base, bool *setp) {
 	 *   now([+-]offset)
 	 *   YYYYMMDD([+-]offset)
 	 *   YYYYMMDDhhmmss([+-]offset)
-	 *   Day Mon DD HH:MM:SS YYYY([+-]offset)
-	 *   1234567890([+-]offset)
 	 *   [+-]offset
 	 */
 	n = strspn(str, "0123456789");
 	if ((n == 8u || n == 14u) &&
-	    (str[n] == '\0' || str[n] == '-' || str[n] == '+'))
-	{
+	    (str[n] == '\0' || str[n] == '-' || str[n] == '+')) {
 		char timestr[15];
 
 		strlcpy(timestr, str, sizeof(timestr));
@@ -328,22 +323,9 @@ strtotime(const char *str, int64_t now, int64_t base, bool *setp) {
 		}
 		base = val;
 		str += n;
-	} else if (n == 10u &&
-		   (str[n] == '\0' || str[n] == '-' || str[n] == '+'))
-	{
-		base = strtoll(str, &endp, 0);
-		str += 10;
 	} else if (strncmp(str, "now", 3) == 0) {
 		base = now;
 		str += 3;
-	} else if (str[0] >= 'A' && str[0] <= 'Z') {
-		/* parse ctime() format as written by `dnssec-settime -p` */
-		endp = isc_tm_strptime(str, "%a %b %d %H:%M:%S %Y", &tm);
-		if (endp != str + 24) {
-			fatal("time value %s is invalid", orig);
-		}
-		base = mktime(&tm);
-		str += 24;
 	}
 
 	if (str[0] == '\0') {
@@ -372,7 +354,7 @@ strtoclass(const char *str) {
 	if (str == NULL) {
 		return (dns_rdataclass_in);
 	}
-	r.base = UNCONST(str);
+	DE_CONST(str, r.base);
 	r.length = strlen(str);
 	result = dns_rdataclass_fromtext(&rdclass, &r);
 	if (result != ISC_R_SUCCESS) {
@@ -387,7 +369,7 @@ strtodsdigest(const char *str) {
 	dns_dsdigest_t alg;
 	isc_result_t result;
 
-	r.base = UNCONST(str);
+	DE_CONST(str, r.base);
 	r.length = strlen(str);
 	result = dns_dsdigest_fromtext(&alg, &r);
 	if (result != ISC_R_SUCCESS) {
@@ -405,7 +387,7 @@ cmp_dtype(const void *ap, const void *bp) {
 
 void
 add_dtype(unsigned int dt) {
-	unsigned int i, n;
+	unsigned i, n;
 
 	/* ensure there is space for a zero terminator */
 	n = sizeof(dtype) / sizeof(dtype[0]) - 1;
@@ -472,7 +454,8 @@ set_keyversion(dst_key_t *key) {
 	 * set the creation date
 	 */
 	if (major < 1 || (major == 1 && minor <= 2)) {
-		isc_stdtime_t now = isc_stdtime_now();
+		isc_stdtime_t now;
+		isc_stdtime_get(&now);
 		dst_key_settime(key, DST_TIME_CREATED, now);
 	}
 }
@@ -487,7 +470,9 @@ key_collision(dst_key_t *dstkey, dns_name_t *name, const char *dir,
 	uint16_t id, oldid;
 	uint32_t rid, roldid;
 	dns_secalg_t alg;
-	isc_stdtime_t now = isc_stdtime_now();
+	char filename[NAME_MAX];
+	isc_buffer_t fileb;
+	isc_stdtime_t now;
 
 	if (exact != NULL) {
 		*exact = false;
@@ -497,9 +482,24 @@ key_collision(dst_key_t *dstkey, dns_name_t *name, const char *dir,
 	rid = dst_key_rid(dstkey);
 	alg = dst_key_alg(dstkey);
 
+	/*
+	 * For Diffie Hellman just check if there is a direct collision as
+	 * they can't be revoked.  Additionally dns_dnssec_findmatchingkeys
+	 * only handles DNSKEY which is not used for HMAC.
+	 */
+	if (alg == DST_ALG_DH) {
+		isc_buffer_init(&fileb, filename, sizeof(filename));
+		result = dst_key_buildfilename(dstkey, DST_TYPE_PRIVATE, dir,
+					       &fileb);
+		if (result != ISC_R_SUCCESS) {
+			return (true);
+		}
+		return (isc_file_exists(filename));
+	}
+
 	ISC_LIST_INIT(matchkeys);
-	result = dns_dnssec_findmatchingkeys(name, NULL, dir, NULL, now, mctx,
-					     &matchkeys);
+	isc_stdtime_get(&now);
+	result = dns_dnssec_findmatchingkeys(name, dir, now, mctx, &matchkeys);
 	if (result == ISC_R_NOTFOUND) {
 		return (false);
 	}
@@ -564,41 +564,3 @@ isoptarg(const char *arg, char **argv, void (*usage)(void)) {
 	}
 	return (false);
 }
-
-void
-loadjournal(isc_mem_t *mctx, dns_db_t *db, const char *file) {
-	dns_journal_t *jnl = NULL;
-	isc_result_t result;
-
-	result = dns_journal_open(mctx, file, DNS_JOURNAL_READ, &jnl);
-	if (result == ISC_R_NOTFOUND) {
-		fprintf(stderr, "%s: journal file %s not found\n", program,
-			file);
-		goto cleanup;
-	} else if (result != ISC_R_SUCCESS) {
-		fatal("unable to open journal %s: %s\n", file,
-		      isc_result_totext(result));
-	}
-
-	if (dns_journal_empty(jnl)) {
-		dns_journal_destroy(&jnl);
-		return;
-	}
-
-	result = dns_journal_rollforward(jnl, db, 0);
-	switch (result) {
-	case ISC_R_SUCCESS:
-	case DNS_R_UPTODATE:
-		break;
-
-	case ISC_R_NOTFOUND:
-	case ISC_R_RANGE:
-		fatal("journal %s out of sync with zone", file);
-
-	default:
-		fatal("journal %s: %s\n", file, isc_result_totext(result));
-	}
-
-cleanup:
-	dns_journal_destroy(&jnl);
-}

bin/dnssec/dnssectool.h

@@ -32,9 +32,6 @@ extern bool quiet;
 /*! program name, statically initialized in each program */
 extern const char *program;
 
-/*! journal file */
-extern const char *journal;
-
 /*!
  * List of DS digest types used by dnssec-cds and dnssec-dsfromkey,
  * defined in dnssectool.c. Filled in by add_dtype() from -a
@@ -46,7 +43,7 @@ extern uint8_t dtype[8];
 
 typedef void(fatalcallback_t)(void);
 
-noreturn void
+ISC_NORETURN void
 fatal(const char *format, ...) ISC_FORMAT_PRINTF(1, 2);
 
 void
@@ -58,7 +55,7 @@ check_result(isc_result_t result, const char *message);
 void
 vbprintf(int level, const char *fmt, ...) ISC_FORMAT_PRINTF(2, 3);
 
-noreturn void
+ISC_NORETURN void
 version(const char *program);
 
 void
@@ -105,6 +102,3 @@ key_collision(dst_key_t *key, dns_name_t *name, const char *dir,
 
 bool
 isoptarg(const char *arg, char **argv, void (*usage)(void));
-
-void
-loadjournal(isc_mem_t *mctx, dns_db_t *db, const char *journal);

bin/named/Makefile.am

@@ -7,13 +7,13 @@ AM_CPPFLAGS +=				\
 	$(LIBNS_CFLAGS)			\
 	$(LIBISCCC_CFLAGS)		\
 	$(LIBISCCFG_CFLAGS)		\
+	$(LIBBIND9_CFLAGS)		\
 	$(OPENSSL_CFLAGS)		\
 	$(LIBCAP_CFLAGS)		\
 	$(LMDB_CFLAGS)			\
 	$(MAXMINDDB_CFLAGS)		\
 	$(DNSTAP_CFLAGS)		\
 	$(LIBUV_CFLAGS)			\
-	$(LIBSYSTEMD_CFLAGS)		\
 	$(ZLIB_CFLAGS)
 
 if HAVE_JSON_C
@@ -38,8 +38,8 @@ AM_CPPFLAGS +=						\
 sbin_PROGRAMS = named
 
 nodist_named_SOURCES = xsl.c
-BUILT_SOURCES += xsl.c
-CLEANFILES += xsl.c
+BUILT_SOURCES = xsl.c
+CLEANFILES = xsl.c
 
 EXTRA_DIST = bind9.xsl
 
@@ -102,13 +102,14 @@ named_LDADD =					\
 	$(LIBNS_LIBS)				\
 	$(LIBISCCC_LIBS)			\
 	$(LIBISCCFG_LIBS)			\
+	$(LIBBIND9_LIBS)			\
 	$(OPENSSL_LIBS)				\
 	$(LIBCAP_LIBS)				\
 	$(LMDB_LIBS)				\
 	$(MAXMINDDB_LIBS)			\
 	$(DNSTAP_LIBS)				\
 	$(LIBUV_LIBS)				\
-	$(LIBSYSTEMD_LIBS)			\
+	$(LIBXML2_LIBS)				\
 	$(ZLIB_LIBS)
 
 if HAVE_JSON_C
@@ -121,7 +122,5 @@ named_LDADD +=					\
 	$(LIBNGHTTP2_LIBS)
 endif HAVE_LIBNGHTTP2
 
-if HAVE_LIBXML2
-named_LDADD +=					\
-	$(LIBXML2_LIBS)
-endif HAVE_LIBXML2
+MAINTAINERCLEANFILES =				\
+	named.conf.rst

bin/named/bind9.xsl

@@ -15,7 +15,7 @@
   <xsl:output method="html" indent="yes" version="4.0"/>
   <!-- the version number **below** must match version in bin/named/statschannel.c -->
   <!-- don't forget to update "/xml/v<STATS_XML_VERSION_MAJOR>" in the HTTP endpoints listed below -->
-  <xsl:template match="statistics[@version=&quot;3.14&quot;]">
+  <xsl:template match="statistics[@version=&quot;3.12&quot;]">
     <html>
       <head>
         <script type="text/javascript" src="https://ajax.googleapis.com/ajax/libs/jquery/3.4.1/jquery.min.js"></script>
@@ -156,6 +156,29 @@
       background-color: #99ddff;
      }
 
+     table.tasks {
+      border: 1px solid grey;
+      width: 500px;
+     }
+     table.tasks th {
+      text-align: center;
+      border: 1px solid grey;
+      width: 150px;
+     }
+     table.tasks td {
+      text-align: right;
+      font-family: monospace;
+     }
+     table.tasks td:nth-child(2) {
+      text-align: center;
+     }
+     table.tasks td:nth-child(4) {
+      text-align: center;
+     }
+     table.tasks tr:hover{
+      background-color: #99ddff;
+     }
+
      table.netstat {
       border: 1px solid grey;
       width: 500px;
@@ -303,8 +326,8 @@
 	<a href="/xml/v3/status">Status</a>,
 	<a href="/xml/v3/server">Server</a>,
 	<a href="/xml/v3/zones">Zones</a>,
-	<a href="/xml/v3/xfrins">Incoming Zone Transfers</a>,
 	<a href="/xml/v3/net">Network</a>,
+	<a href="/xml/v3/tasks">Tasks</a>,
 	<a href="/xml/v3/mem">Memory</a> and
 	<a href="/xml/v3/traffic">Traffic Size</a></p>
         <hr/>
@@ -908,62 +931,84 @@
             </xsl:for-each>
           </xsl:for-each>
         </xsl:if>
-        <xsl:if test="views/view/xfrins/xfrin">
-          <xsl:for-each select="views/view">
-            <h3>Incoming Zone Transfers for View <xsl:value-of select="@name"/></h3>
-            <table class="xfrins">
-              <thead>
-	        <tr>
-                  <th>Zone Name</th>
-                  <th>Zone Type</th>
-                  <th>Local Serial</th>
-                  <th>Remote Serial</th>
-                  <th>IXFR</th>
-                  <th>First Refresh</th>
-                  <th>State</th>
-                  <th>Additional Refresh Queued</th>
-                  <th>Local Address</th>
-                  <th>Remote Address</th>
-                  <th>SOA Transport</th>
-                  <th>Transport</th>
-                  <th>TSIG Key Name</th>
-                  <th>Duration (s)</th>
-                  <th>Messages Received</th>
-                  <th>Records Received</th>
-                  <th>Bytes Received</th>
-                </tr>
-              </thead>
-              <tbody>
-                <xsl:for-each select="xfrins/xfrin">
-                  <xsl:variable name="css-class16">
-                    <xsl:choose>
-                      <xsl:when test="position() mod 2 = 0">even</xsl:when>
-                      <xsl:otherwise>odd</xsl:otherwise>
-                    </xsl:choose>
-                  </xsl:variable>
-                  <tr class="{$css-class16}">
-                    <td><xsl:value-of select="@name"/></td>
-                    <td><xsl:value-of select="type"/></td>
-                    <td><xsl:value-of select="serial"/></td>
-                    <td><xsl:value-of select="remoteserial"/></td>
-                    <td><xsl:value-of select="ixfr"/></td>
-                    <td><xsl:value-of select="firstrefresh"/></td>
-                    <td><xsl:value-of select="state"/></td>
-                    <td><xsl:value-of select="refreshqueued"/></td>
-                    <td><xsl:value-of select="localaddr"/></td>
-                    <td><xsl:value-of select="remoteaddr"/></td>
-                    <td><xsl:value-of select="soatransport"/></td>
-                    <td><xsl:value-of select="transport"/></td>
-                    <td><xsl:value-of select="tsigkeyname"/></td>
-                    <td><xsl:value-of select="duration"/></td>
-                    <td><xsl:value-of select="nmsg"/></td>
-                    <td><xsl:value-of select="nrecs"/></td>
-                    <td><xsl:value-of select="nbytes"/></td>
-                  </tr>
-                </xsl:for-each>
-              </tbody>
-            </table>
-          </xsl:for-each>
+        <xsl:if test="taskmgr/thread-model/type">
+          <h2>Task Manager Configuration</h2>
+          <table class="counters">
+            <tr>
+              <th class="even">Thread-Model</th>
+              <td>
+                <xsl:value-of select="taskmgr/thread-model/type"/>
+              </td>
+            </tr>
+            <tr class="odd">
+              <th>Worker Threads</th>
+              <td>
+                <xsl:value-of select="taskmgr/thread-model/worker-threads"/>
+              </td>
+            </tr>
+            <tr class="even">
+              <th>Default Quantum</th>
+              <td>
+                <xsl:value-of select="taskmgr/thread-model/default-quantum"/>
+              </td>
+            </tr>
+            <tr class="odd">
+              <th>Tasks Running</th>
+              <td>
+                <xsl:value-of select="taskmgr/thread-model/tasks-running"/>
+              </td>
+            </tr>
+            <tr class="even">
+              <th>Tasks Ready</th>
+              <td>
+                <xsl:value-of select="taskmgr/thread-model/tasks-ready"/>
+              </td>
+            </tr>
+          </table>
+          <br/>
+        </xsl:if>
+        <xsl:if test="taskmgr/tasks/task">
+          <h2>Tasks</h2>
+          <table class="tasks">
+            <tr>
+              <th>ID</th>
+              <th>Name</th>
+              <th>References</th>
+              <th>State</th>
+              <th>Quantum</th>
+              <th>Events</th>
+            </tr>
+            <xsl:for-each select="taskmgr/tasks/task">
+              <xsl:sort select="name"/>
+              <xsl:variable name="css-class14">
+                <xsl:choose>
+                  <xsl:when test="position() mod 2 = 0">even</xsl:when>
+                  <xsl:otherwise>odd</xsl:otherwise>
+                </xsl:choose>
+              </xsl:variable>
+              <tr class="{$css-class14}">
+                <td>
+                  <xsl:value-of select="id"/>
+                </td>
+                <td>
+                  <xsl:value-of select="name"/>
+                </td>
+                <td>
+                  <xsl:value-of select="references"/>
+                </td>
+                <td>
+                  <xsl:value-of select="state"/>
+                </td>
+                <td>
+                  <xsl:value-of select="quantum"/>
+                </td>
+                <td>
+                  <xsl:value-of select="events"/>
+                </td>
+              </tr>
+            </xsl:for-each>
+          </table>
+          <br/>
         </xsl:if>
         <xsl:if test="memory/summary">
           <h2>Memory Usage Summary</h2>
@@ -994,7 +1039,12 @@
               <th>ID</th>
               <th>Name</th>
               <th>References</th>
+              <th>TotalUse</th>
               <th>InUse</th>
+              <th>MaxUse</th>
+              <th>Malloced</th>
+              <th>MaxMalloced</th>
+              <th>BlockSize</th>
               <th>Pools</th>
               <th>HiWater</th>
               <th>LoWater</th>
@@ -1017,9 +1067,24 @@
                 <td>
                   <xsl:value-of select="references"/>
                 </td>
+                <td>
+                  <xsl:value-of select="total"/>
+                </td>
                 <td>
                   <xsl:value-of select="inuse"/>
                 </td>
+                <td>
+                  <xsl:value-of select="maxinuse"/>
+                </td>
+                <td>
+                  <xsl:value-of select="malloced"/>
+                </td>
+                <td>
+                  <xsl:value-of select="maxmalloced"/>
+                </td>
+                <td>
+                  <xsl:value-of select="blocksize"/>
+                </td>
                 <td>
                   <xsl:value-of select="pools"/>
                 </td>

bin/named/config.c

@@ -20,7 +20,6 @@
 #include <isc/buffer.h>
 #include <isc/log.h>
 #include <isc/mem.h>
-#include <isc/netmgr.h>
 #include <isc/parseint.h>
 #include <isc/region.h>
 #include <isc/result.h>
@@ -29,7 +28,6 @@
 #include <isc/util.h>
 
 #include <dns/fixedname.h>
-#include <dns/kasp.h>
 #include <dns/name.h>
 #include <dns/rdataclass.h>
 #include <dns/rdatatype.h>
@@ -49,24 +47,31 @@ static char defaultconf[] = "\
 options {\n\
 	answer-cookie true;\n\
 	automatic-interface-scan yes;\n\
-#	blackhole {none;};\n\
-	cookie-algorithm siphash24;\n\
+	bindkeys-file \"" NAMED_SYSCONFDIR "/bind.keys\";\n\
+#	blackhole {none;};\n"
+			    "	cookie-algorithm siphash24;\n"
+			    "	coresize default;\n\
+	datasize default;\n"
+			    "\
 #	directory <none>\n\
 	dnssec-policy \"none\";\n\
 	dump-file \"named_dump.db\";\n\
-	edns-udp-size 1232;\n"
+	edns-udp-size 1232;\n\
+	files unlimited;\n"
 #if defined(HAVE_GEOIP2)
-			    "\
-	geoip-directory \"" MAXMINDDB_PREFIX "/share/GeoIP\";\n"
+			    "	geoip-directory \"" MAXMINDDB_PREFIX "/share/"
+			    "GeoIP\";"
+			    "\n"
 #elif defined(HAVE_GEOIP2)
-			    "\
-	geoip-directory \".\";\n"
+			    "	geoip-directory \".\";\n"
 #endif /* if defined(HAVE_GEOIP2) */
 			    "\
 	heartbeat-interval 60;\n\
 	interface-interval 60;\n\
+#	keep-response-order {none;};\n\
 	listen-on {any;};\n\
 	listen-on-v6 {any;};\n\
+#	lock-file \"" NAMED_LOCALSTATEDIR "/run/named/named.lock\";\n\
 	match-mapped-addresses no;\n\
 	max-ixfr-ratio 100%;\n\
 	max-rsa-exponent-size 0; /* no limit */\n\
@@ -77,28 +82,20 @@ options {\n\
 	nta-lifetime 3600;\n\
 	nta-recheck 300;\n\
 #	pid-file \"" NAMED_LOCALSTATEDIR "/run/named/named.pid\"; \n\
-	port 53;\n"
-#if HAVE_SO_REUSEPORT_LB
-			    "\
-	reuseport yes;\n"
-#else
-			    "\
-	reuseport no;\n"
-#endif
-			    "\
+	port 53;\n\
 	tls-port 853;\n"
 #if HAVE_LIBNGHTTP2
-			    "\
-	http-port 80;\n\
-	https-port 443;\n\
-	http-listener-clients 300;\n\
-	http-streams-per-connection 100;\n"
+			    "http-port 80;\n"
+			    "https-port 443;\n"
+			    "http-listener-clients 300;\n"
+			    "http-streams-per-connection 100;\n"
 #endif
 			    "\
 	prefetch 2 9;\n\
 	recursing-file \"named.recursing\";\n\
 	recursive-clients 1000;\n\
 	request-nsid false;\n\
+	reserved-sockets 512;\n\
 	resolver-query-timeout 10;\n\
 	rrset-order { order random; };\n\
 	secroots-file \"named.secroots\";\n\
@@ -108,6 +105,7 @@ options {\n\
 	session-keyalg hmac-sha256;\n\
 #	session-keyfile \"" NAMED_LOCALSTATEDIR "/run/named/session.key\";\n\
 	session-keyname local-ddns;\n\
+	stacksize default;\n\
 	startup-notify-rate 20;\n\
 	statistics-file \"named.stats\";\n\
 	tcp-advertised-timeout 300;\n\
@@ -118,6 +116,7 @@ options {\n\
 	tcp-listen-queue 10;\n\
 	tcp-receive-buffer 0;\n\
 	tcp-send-buffer 0;\n\
+#	tkey-dhkey <none>\n\
 #	tkey-domain <none>\n\
 #	tkey-gssapi-credential <none>\n\
 	transfer-message-size 20480;\n\
@@ -127,13 +126,10 @@ options {\n\
 	trust-anchor-telemetry yes;\n\
 	udp-receive-buffer 0;\n\
 	udp-send-buffer 0;\n\
-	update-quota 100;\n\
 \n\
 	/* view */\n\
 	allow-new-zones no;\n\
 	allow-notify {none;};\n\
-	allow-proxy {none;};\n\
-	allow-proxy-on {any;};\n\
 	allow-query-cache { localnets; localhost; };\n\
 	allow-query-cache-on { any; };\n\
 	allow-recursion { localnets; localhost; };\n\
@@ -146,13 +142,9 @@ options {\n\
 	check-names response ignore;\n\
 	check-names secondary warn;\n\
 	check-spf warn;\n\
-	check-svcb yes;\n\
 	clients-per-query 10;\n\
 	dnssec-accept-expired no;\n\
 	dnssec-validation " VALIDATION_DEFAULT "; \n"
-#ifdef USE_DNSRPS
-			    "	dnsrps-library \"" DNSRPS_LIBRPZ_PATH "\";\n"
-#endif /* ifdef USE_DNSRPS */
 #ifdef HAVE_DNSTAP
 			    "	dnstap-identity hostname;\n"
 #endif /* ifdef HAVE_DNSTAP */
@@ -160,6 +152,7 @@ options {\n\
 	fetch-quota-params 100 0.1 0.3 0.7;\n\
 	fetches-per-server 0;\n\
 	fetches-per-zone 0;\n\
+	glue-cache yes;\n\
 	lame-ttl 0;\n"
 #ifdef HAVE_LMDB
 			    "	lmdb-mapsize 32M;\n"
@@ -189,6 +182,8 @@ options {\n\
 	request-expire true;\n\
 	request-ixfr true;\n\
 	require-server-cookie no;\n\
+	resolver-nonbackoff-tries 3;\n\
+	resolver-retry-interval 800; /* in milliseconds */\n\
 	root-key-sentinel yes;\n\
 	servfail-ttl 1;\n\
 #	sortlist <none>\n\
@@ -200,7 +195,6 @@ options {\n\
 	synth-from-dnssec yes;\n\
 #	topology <none>\n\
 	transfer-format many-answers;\n\
-	resolver-use-dns64 false;\n\
 	v6-bias 50;\n\
 	zero-no-soa-ttl-cache no;\n\
 \n\
@@ -209,13 +203,18 @@ options {\n\
 	allow-query-on {any;};\n\
 	allow-transfer {any;};\n\
 #	also-notify <none>\n\
+	alt-transfer-source *;\n\
+	alt-transfer-source-v6 *;\n\
 	check-integrity yes;\n\
 	check-mx-cname warn;\n\
 	check-sibling yes;\n\
 	check-srv-cname warn;\n\
 	check-wildcard yes;\n\
 	dialup no;\n\
+	dnssec-dnskey-kskonly yes;\n\
 	dnssec-loadkeys-interval 60;\n\
+	dnssec-secure-to-insecure no;\n\
+	dnssec-update-mode maintain;\n\
 #	forward <none>\n\
 #	forwarders <none>\n\
 #	inline-signing no;\n\
@@ -238,9 +237,12 @@ options {\n\
 	sig-signing-nodes 100;\n\
 	sig-signing-signatures 10;\n\
 	sig-signing-type 65534;\n\
+	sig-validity-interval 30; /* days */\n\
+	dnskey-sig-validity 0; /* default: sig-validity-interval */\n\
 	transfer-source *;\n\
 	transfer-source-v6 *;\n\
 	try-tcp-refresh yes; /* BIND 8 compat */\n\
+	update-check-ksk yes;\n\
 	zero-no-soa-ttl yes;\n\
 	zone-statistics terse;\n\
 };\n\
@@ -282,37 +284,6 @@ view \"_bind\" chaos {\n\
 		database \"_builtin id\";\n\
 	};\n\
 };\n\
-"
-			    "#\n\
-#  Built-in DNSSEC key and signing policies.\n\
-#\n\
-dnssec-policy \"default\" {\n\
-	keys {\n\
-		csk key-directory lifetime unlimited algorithm 13;\n\
-	};\n\
-\n\
-	cdnskey yes;\n\
-	cds-digest-types { 2; };\n\
-	dnskey-ttl " DNS_KASP_KEY_TTL ";\n\
-	inline-signing yes;\n\
-	publish-safety " DNS_KASP_PUBLISH_SAFETY "; \n\
-	retire-safety " DNS_KASP_RETIRE_SAFETY "; \n\
-	purge-keys " DNS_KASP_PURGE_KEYS "; \n\
-	signatures-refresh " DNS_KASP_SIG_REFRESH "; \n\
-	signatures-validity " DNS_KASP_SIG_VALIDITY "; \n\
-	signatures-validity-dnskey " DNS_KASP_SIG_VALIDITY_DNSKEY "; \n\
-	max-zone-ttl " DNS_KASP_ZONE_MAXTTL "; \n\
-	zone-propagation-delay " DNS_KASP_ZONE_PROPDELAY "; \n\
-	parent-ds-ttl " DNS_KASP_DS_TTL "; \n\
-	parent-propagation-delay " DNS_KASP_PARENT_PROPDELAY "; \n\
-};\n\
-\n\
-dnssec-policy \"insecure\" {\n\
-	max-zone-ttl 0; \n\
-	keys { };\n\
-	inline-signing yes;\n\
-};\n\
-\n\
 "
 			    "#\n\
 #  Default trusted key(s), used if \n\
@@ -327,14 +298,14 @@ dnssec-policy \"insecure\" {\n\
 			    "# END TRUST ANCHORS\n\
 \n\
 primaries " DEFAULT_IANA_ROOT_ZONE_PRIMARIES " {\n\
-	2801:1b8:10::b;		# b.root-servers.net\n\
+	2001:500:200::b;	# b.root-servers.net\n\
 	2001:500:2::c;		# c.root-servers.net\n\
 	2001:500:2f::f;		# f.root-servers.net\n\
 	2001:500:12::d0d;	# g.root-servers.net\n\
 	2001:7fd::1;		# k.root-servers.net\n\
 	2620:0:2830:202::132;	# xfr.cjr.dns.icann.org\n\
 	2620:0:2d0:202::132;	# xfr.lax.dns.icann.org\n\
-	170.247.170.2;		# b.root-servers.net\n\
+	199.9.14.201;		# b.root-servers.net\n\
 	192.33.4.12;		# c.root-servers.net\n\
 	192.5.5.241;		# f.root-servers.net\n\
 	192.112.36.4;		# g.root-servers.net\n\
@@ -354,11 +325,6 @@ named_config_parsedefaults(cfg_parser_t *parser, cfg_obj_t **conf) {
 				 CFG_PCTX_NODEPRECATED, conf));
 }
 
-const char *
-named_config_getdefault(void) {
-	return (defaultconf);
-}
-
 isc_result_t
 named_config_get(cfg_obj_t const *const *maps, const char *name,
 		 const cfg_obj_t **obj) {
@@ -388,8 +354,7 @@ named_checknames_get(const cfg_obj_t **maps, const char *const names[],
 	for (i = 0; maps[i] != NULL; i++) {
 		checknames = NULL;
 		if (cfg_map_get(maps[i], "check-names", &checknames) ==
-		    ISC_R_SUCCESS)
-		{
+		    ISC_R_SUCCESS) {
 			/*
 			 * Zone map entry is not a list.
 			 */
@@ -405,8 +370,7 @@ named_checknames_get(const cfg_obj_t **maps, const char *const names[],
 
 				for (size_t j = 0; names[j] != NULL; j++) {
 					if (strcasecmp(cfg_obj_asstring(type),
-						       names[j]) == 0)
-					{
+						       names[j]) == 0) {
 						*obj = cfg_tuple_get(value,
 								     "mode");
 						return (ISC_R_SUCCESS);
@@ -440,7 +404,7 @@ named_config_getclass(const cfg_obj_t *classobj, dns_rdataclass_t defclass,
 		*classp = defclass;
 		return (ISC_R_SUCCESS);
 	}
-	r.base = UNCONST(cfg_obj_asstring(classobj));
+	DE_CONST(cfg_obj_asstring(classobj), r.base);
 	r.length = strlen(r.base);
 	result = dns_rdataclass_fromtext(classp, &r);
 	if (result != ISC_R_SUCCESS) {
@@ -460,7 +424,7 @@ named_config_gettype(const cfg_obj_t *typeobj, dns_rdatatype_t deftype,
 		*typep = deftype;
 		return (ISC_R_SUCCESS);
 	}
-	r.base = UNCONST(cfg_obj_asstring(typeobj));
+	DE_CONST(cfg_obj_asstring(typeobj), r.base);
 	r.length = strlen(r.base);
 	result = dns_rdatatype_fromtext(typep, &r);
 	if (result != ISC_R_SUCCESS) {
@@ -479,8 +443,7 @@ named_config_getzonetype(const cfg_obj_t *zonetypeobj) {
 	if (strcasecmp(str, "primary") == 0 || strcasecmp(str, "master") == 0) {
 		ztype = dns_zone_primary;
 	} else if (strcasecmp(str, "secondary") == 0 ||
-		   strcasecmp(str, "slave") == 0)
-	{
+		   strcasecmp(str, "slave") == 0) {
 		ztype = dns_zone_secondary;
 	} else if (strcasecmp(str, "mirror") == 0) {
 		ztype = dns_zone_mirror;
@@ -491,11 +454,115 @@ named_config_getzonetype(const cfg_obj_t *zonetypeobj) {
 	} else if (strcasecmp(str, "redirect") == 0) {
 		ztype = dns_zone_redirect;
 	} else {
-		UNREACHABLE();
+		INSIST(0);
+		ISC_UNREACHABLE();
 	}
 	return (ztype);
 }
 
+isc_result_t
+named_config_getiplist(const cfg_obj_t *config, const cfg_obj_t *list,
+		       in_port_t defport, isc_mem_t *mctx,
+		       isc_sockaddr_t **addrsp, isc_dscp_t **dscpsp,
+		       uint32_t *countp) {
+	int count, i = 0;
+	const cfg_obj_t *addrlist;
+	const cfg_obj_t *portobj, *dscpobj;
+	const cfg_listelt_t *element;
+	isc_sockaddr_t *addrs;
+	in_port_t port;
+	isc_dscp_t dscp = -1, *dscps = NULL;
+	isc_result_t result;
+
+	INSIST(addrsp != NULL && *addrsp == NULL);
+	INSIST(dscpsp == NULL || *dscpsp == NULL);
+	INSIST(countp != NULL);
+
+	addrlist = cfg_tuple_get(list, "addresses");
+	count = named_config_listcount(addrlist);
+
+	portobj = cfg_tuple_get(list, "port");
+	if (cfg_obj_isuint32(portobj)) {
+		uint32_t val = cfg_obj_asuint32(portobj);
+		if (val > UINT16_MAX) {
+			cfg_obj_log(portobj, named_g_lctx, ISC_LOG_ERROR,
+				    "port '%u' out of range", val);
+			return (ISC_R_RANGE);
+		}
+		port = (in_port_t)val;
+	} else if (defport != 0) {
+		port = defport;
+	} else {
+		result = named_config_getport(config, "port", &port);
+		if (result != ISC_R_SUCCESS) {
+			return (result);
+		}
+	}
+
+	if (dscpsp != NULL) {
+		dscpobj = cfg_tuple_get(list, "dscp");
+		if (dscpobj != NULL && cfg_obj_isuint32(dscpobj)) {
+			if (cfg_obj_asuint32(dscpobj) > 63) {
+				cfg_obj_log(dscpobj, named_g_lctx,
+					    ISC_LOG_ERROR,
+					    "dscp value '%u' is out of range",
+					    cfg_obj_asuint32(dscpobj));
+				return (ISC_R_RANGE);
+			}
+			dscp = (isc_dscp_t)cfg_obj_asuint32(dscpobj);
+		}
+
+		dscps = isc_mem_get(mctx, count * sizeof(isc_dscp_t));
+	}
+
+	addrs = isc_mem_get(mctx, count * sizeof(isc_sockaddr_t));
+
+	for (element = cfg_list_first(addrlist); element != NULL;
+	     element = cfg_list_next(element), i++)
+	{
+		const cfg_obj_t *addr;
+		INSIST(i < count);
+		addr = cfg_listelt_value(element);
+		addrs[i] = *cfg_obj_assockaddr(addr);
+		if (dscpsp != NULL) {
+			isc_dscp_t innerdscp;
+			innerdscp = cfg_obj_getdscp(addr);
+			if (innerdscp == -1) {
+				innerdscp = dscp;
+			}
+			dscps[i] = innerdscp;
+		}
+		if (isc_sockaddr_getport(&addrs[i]) == 0) {
+			isc_sockaddr_setport(&addrs[i], port);
+		}
+	}
+	INSIST(i == count);
+
+	*addrsp = addrs;
+	*countp = count;
+
+	if (dscpsp != NULL) {
+		*dscpsp = dscps;
+	}
+
+	return (ISC_R_SUCCESS);
+}
+
+void
+named_config_putiplist(isc_mem_t *mctx, isc_sockaddr_t **addrsp,
+		       isc_dscp_t **dscpsp, uint32_t count) {
+	INSIST(addrsp != NULL && *addrsp != NULL);
+	INSIST(dscpsp == NULL || *dscpsp != NULL);
+
+	isc_mem_put(mctx, *addrsp, count * sizeof(isc_sockaddr_t));
+	*addrsp = NULL;
+
+	if (dscpsp != NULL) {
+		isc_mem_put(mctx, *dscpsp, count * sizeof(isc_dscp_t));
+		*dscpsp = NULL;
+	}
+}
+
 static isc_result_t
 getremotesdef(const cfg_obj_t *cctx, const char *list, const char *name,
 	      const cfg_obj_t **ret) {
@@ -515,8 +582,7 @@ getremotesdef(const cfg_obj_t *cctx, const char *list, const char *name,
 	while (elt != NULL) {
 		obj = cfg_listelt_value(elt);
 		if (strcasecmp(cfg_obj_asstring(cfg_tuple_get(obj, "name")),
-			       name) == 0)
-		{
+			       name) == 0) {
 			*ret = obj;
 			return (ISC_R_SUCCESS);
 		}
@@ -576,54 +642,65 @@ named_config_getname(isc_mem_t *mctx, const cfg_obj_t *obj,
 	return (ISC_R_SUCCESS);
 }
 
-#define grow_array(mctx, array, newlen, oldlen)                          \
-	if (newlen >= oldlen) {                                          \
-		array = isc_mem_creget(mctx, array, oldlen, newlen + 16, \
-				       sizeof(array[0]));                \
-		oldlen = newlen + 16;                                    \
+#define grow_array(mctx, array, newlen, oldlen)                    \
+	if (newlen >= oldlen) {                                    \
+		size_t newsize = (newlen + 16) * sizeof(array[0]); \
+		size_t oldsize = oldlen * sizeof(array[0]);        \
+		void *tmp = isc_mem_get(mctx, newsize);            \
+		memset(tmp, 0, newsize);                           \
+		if (oldlen != 0) {                                 \
+			memmove(tmp, array, oldsize);              \
+			isc_mem_put(mctx, array, oldsize);         \
+		}                                                  \
+		array = tmp;                                       \
+		oldlen = newlen + 16;                              \
 	}
 
-#define shrink_array(mctx, array, newlen, oldlen)                   \
-	if (newlen < oldlen) {                                      \
-		array = isc_mem_creget(mctx, array, oldlen, newlen, \
-				       sizeof(array[0]));           \
-		oldlen = newlen;                                    \
+#define shrink_array(mctx, array, newlen, oldlen)           \
+	if (newlen < oldlen) {                              \
+		void *tmp = NULL;                           \
+		size_t newsize = newlen * sizeof(array[0]); \
+		size_t oldsize = oldlen * sizeof(array[0]); \
+		if (newlen != 0) {                          \
+			tmp = isc_mem_get(mctx, newsize);   \
+			memset(tmp, 0, newsize);            \
+			memmove(tmp, array, newsize);       \
+		} else {                                    \
+			tmp = NULL;                         \
+		}                                           \
+		isc_mem_put(mctx, array, oldsize);          \
+		array = tmp;                                \
+		oldlen = newlen;                            \
 	}
 
 isc_result_t
 named_config_getipandkeylist(const cfg_obj_t *config, const char *listtype,
 			     const cfg_obj_t *list, isc_mem_t *mctx,
 			     dns_ipkeylist_t *ipkl) {
-	uint32_t addrcount = 0, srccount = 0;
-	uint32_t keycount = 0, tlscount = 0;
-	uint32_t listcount = 0, l = 0, i = 0;
+	uint32_t addrcount = 0, dscpcount = 0, keycount = 0, tlscount = 0,
+		 i = 0;
+	uint32_t listcount = 0, l = 0, j;
 	uint32_t stackcount = 0, pushed = 0;
 	isc_result_t result;
 	const cfg_listelt_t *element;
 	const cfg_obj_t *addrlist;
 	const cfg_obj_t *portobj;
-	const cfg_obj_t *src4obj;
-	const cfg_obj_t *src6obj;
+	const cfg_obj_t *dscpobj;
 	in_port_t port = (in_port_t)0;
 	in_port_t def_port;
 	in_port_t def_tlsport;
-	isc_sockaddr_t src4;
-	isc_sockaddr_t src6;
+	isc_dscp_t dscp = -1;
 	isc_sockaddr_t *addrs = NULL;
-	isc_sockaddr_t *sources = NULL;
+	isc_dscp_t *dscps = NULL;
 	dns_name_t **keys = NULL;
 	dns_name_t **tlss = NULL;
 	struct {
 		const char *name;
-		in_port_t port;
-		isc_sockaddr_t *src4s;
-		isc_sockaddr_t *src6s;
 	} *lists = NULL;
 	struct {
 		const cfg_listelt_t *element;
 		in_port_t port;
-		isc_sockaddr_t src4;
-		isc_sockaddr_t src6;
+		isc_dscp_t dscp;
 	} *stack = NULL;
 
 	REQUIRE(ipkl != NULL);
@@ -631,6 +708,7 @@ named_config_getipandkeylist(const cfg_obj_t *config, const char *listtype,
 	REQUIRE(ipkl->addrs == NULL);
 	REQUIRE(ipkl->keys == NULL);
 	REQUIRE(ipkl->tlss == NULL);
+	REQUIRE(ipkl->dscps == NULL);
 	REQUIRE(ipkl->labels == NULL);
 	REQUIRE(ipkl->allocated == 0);
 
@@ -647,11 +725,15 @@ named_config_getipandkeylist(const cfg_obj_t *config, const char *listtype,
 		goto cleanup;
 	}
 
+	result = named_config_getdscp(config, &dscp);
+	if (result != ISC_R_SUCCESS) {
+		goto cleanup;
+	}
+
 newlist:
 	addrlist = cfg_tuple_get(list, "addresses");
 	portobj = cfg_tuple_get(list, "port");
-	src4obj = cfg_tuple_get(list, "source");
-	src6obj = cfg_tuple_get(list, "source-v6");
+	dscpobj = cfg_tuple_get(list, "dscp");
 
 	if (cfg_obj_isuint32(portobj)) {
 		uint32_t val = cfg_obj_asuint32(portobj);
@@ -664,16 +746,15 @@ newlist:
 		port = (in_port_t)val;
 	}
 
-	if (src4obj != NULL && cfg_obj_issockaddr(src4obj)) {
-		src4 = *cfg_obj_assockaddr(src4obj);
-	} else {
-		isc_sockaddr_any(&src4);
-	}
-
-	if (src6obj != NULL && cfg_obj_issockaddr(src6obj)) {
-		src6 = *cfg_obj_assockaddr(src6obj);
-	} else {
-		isc_sockaddr_any6(&src6);
+	if (dscpobj != NULL && cfg_obj_isuint32(dscpobj)) {
+		if (cfg_obj_asuint32(dscpobj) > 63) {
+			cfg_obj_log(dscpobj, named_g_lctx, ISC_LOG_ERROR,
+				    "dscp value '%u' is out of range",
+				    cfg_obj_asuint32(dscpobj));
+			result = ISC_R_RANGE;
+			goto cleanup;
+		}
+		dscp = (isc_dscp_t)cfg_obj_asuint32(dscpobj);
 	}
 
 	result = ISC_R_NOMEMORY;
@@ -693,7 +774,6 @@ resume:
 		if (!cfg_obj_issockaddr(addr)) {
 			const char *listname = cfg_obj_asstring(addr);
 			isc_result_t tresult;
-			uint32_t j;
 
 			/* Grow lists? */
 			grow_array(mctx, lists, l, listcount);
@@ -730,18 +810,21 @@ resume:
 			 */
 			stack[pushed].element = cfg_list_next(element);
 			stack[pushed].port = port;
-			stack[pushed].src4 = src4;
-			stack[pushed].src6 = src6;
+			stack[pushed].dscp = dscp;
 			pushed++;
 			goto newlist;
 		}
 
 		grow_array(mctx, addrs, i, addrcount);
+		grow_array(mctx, dscps, i, dscpcount);
 		grow_array(mctx, keys, i, keycount);
 		grow_array(mctx, tlss, i, tlscount);
-		grow_array(mctx, sources, i, srccount);
 
 		addrs[i] = *cfg_obj_assockaddr(addr);
+		dscps[i] = cfg_obj_getdscp(addr);
+		if (dscps[i] == -1) {
+			dscps[i] = dscp;
+		}
 
 		result = named_config_getname(mctx, key, &keys[i]);
 		if (result != ISC_R_SUCCESS) {
@@ -757,67 +840,49 @@ resume:
 			goto cleanup;
 		}
 
-		/* If the port is unset, take it from one of the upper levels */
-		if (isc_sockaddr_getport(&addrs[i]) == 0) {
-			in_port_t addr_port = port;
-
-			/* If unset, use the default port or tls-port */
-			if (addr_port == 0) {
-				if (tlss[i] != NULL) {
-					addr_port = def_tlsport;
-				} else {
-					addr_port = def_port;
-				}
+		/* Set the default port or tls-port */
+		if (port == 0) {
+			if (tlss[i] != NULL) {
+				port = def_tlsport;
+			} else {
+				port = def_port;
 			}
-
-			isc_sockaddr_setport(&addrs[i], addr_port);
 		}
 
-		switch (isc_sockaddr_pf(&addrs[i])) {
-		case PF_INET:
-			sources[i] = src4;
-			break;
-		case PF_INET6:
-			sources[i] = src6;
-			break;
-		default:
-			i++; /* Increment here so that cleanup on error works.
-			      */
-			result = ISC_R_NOTIMPLEMENTED;
-			goto cleanup;
+		if (isc_sockaddr_getport(&addrs[i]) == 0) {
+			isc_sockaddr_setport(&addrs[i], port);
 		}
-
 		i++;
 	}
 	if (pushed != 0) {
 		pushed--;
 		element = stack[pushed].element;
 		port = stack[pushed].port;
-		src4 = stack[pushed].src4;
-		src6 = stack[pushed].src6;
+		dscp = stack[pushed].dscp;
 		goto resume;
 	}
 
 	shrink_array(mctx, addrs, i, addrcount);
+	shrink_array(mctx, dscps, i, dscpcount);
 	shrink_array(mctx, keys, i, keycount);
 	shrink_array(mctx, tlss, i, tlscount);
-	shrink_array(mctx, sources, i, srccount);
 
 	if (lists != NULL) {
-		isc_mem_cput(mctx, lists, listcount, sizeof(lists[0]));
+		isc_mem_put(mctx, lists, listcount * sizeof(lists[0]));
 	}
 	if (stack != NULL) {
-		isc_mem_cput(mctx, stack, stackcount, sizeof(stack[0]));
+		isc_mem_put(mctx, stack, stackcount * sizeof(stack[0]));
 	}
 
+	INSIST(dscpcount == addrcount);
 	INSIST(keycount == addrcount);
 	INSIST(tlscount == addrcount);
-	INSIST(srccount == addrcount);
+	INSIST(keycount == dscpcount);
 
 	ipkl->addrs = addrs;
+	ipkl->dscps = dscps;
 	ipkl->keys = keys;
 	ipkl->tlss = tlss;
-	ipkl->sources = sources;
 	ipkl->count = addrcount;
 	ipkl->allocated = addrcount;
 
@@ -825,10 +890,13 @@ resume:
 
 cleanup:
 	if (addrs != NULL) {
-		isc_mem_cput(mctx, addrs, addrcount, sizeof(addrs[0]));
+		isc_mem_put(mctx, addrs, addrcount * sizeof(addrs[0]));
+	}
+	if (dscps != NULL) {
+		isc_mem_put(mctx, dscps, dscpcount * sizeof(dscps[0]));
 	}
 	if (keys != NULL) {
-		for (size_t j = 0; j < i; j++) {
+		for (j = 0; j < i; j++) {
 			if (keys[j] == NULL) {
 				continue;
 			}
@@ -837,10 +905,10 @@ cleanup:
 			}
 			isc_mem_put(mctx, keys[j], sizeof(*keys[j]));
 		}
-		isc_mem_cput(mctx, keys, keycount, sizeof(keys[0]));
+		isc_mem_put(mctx, keys, keycount * sizeof(keys[0]));
 	}
 	if (tlss != NULL) {
-		for (size_t j = 0; j < i; j++) {
+		for (j = 0; j < i; j++) {
 			if (tlss[j] == NULL) {
 				continue;
 			}
@@ -849,16 +917,13 @@ cleanup:
 			}
 			isc_mem_put(mctx, tlss[j], sizeof(*tlss[j]));
 		}
-		isc_mem_cput(mctx, tlss, tlscount, sizeof(tlss[0]));
-	}
-	if (sources != NULL) {
-		isc_mem_cput(mctx, sources, srccount, sizeof(sources[0]));
+		isc_mem_put(mctx, tlss, tlscount * sizeof(tlss[0]));
 	}
 	if (lists != NULL) {
-		isc_mem_cput(mctx, lists, listcount, sizeof(lists[0]));
+		isc_mem_put(mctx, lists, listcount * sizeof(lists[0]));
 	}
 	if (stack != NULL) {
-		isc_mem_cput(mctx, stack, stackcount, sizeof(stack[0]));
+		isc_mem_put(mctx, stack, stackcount * sizeof(stack[0]));
 	}
 	return (result);
 }
@@ -892,6 +957,32 @@ named_config_getport(const cfg_obj_t *config, const char *type,
 	return (ISC_R_SUCCESS);
 }
 
+isc_result_t
+named_config_getdscp(const cfg_obj_t *config, isc_dscp_t *dscpp) {
+	const cfg_obj_t *options = NULL;
+	const cfg_obj_t *dscpobj = NULL;
+	isc_result_t result;
+
+	(void)cfg_map_get(config, "options", &options);
+	if (options == NULL) {
+		return (ISC_R_SUCCESS);
+	}
+
+	result = cfg_map_get(options, "dscp", &dscpobj);
+	if (result != ISC_R_SUCCESS || dscpobj == NULL) {
+		*dscpp = -1;
+		return (ISC_R_SUCCESS);
+	}
+	if (cfg_obj_asuint32(dscpobj) >= 64) {
+		cfg_obj_log(dscpobj, named_g_lctx, ISC_LOG_ERROR,
+			    "dscp '%u' out of range",
+			    cfg_obj_asuint32(dscpobj));
+		return (ISC_R_RANGE);
+	}
+	*dscpp = (isc_dscp_t)cfg_obj_asuint32(dscpobj);
+	return (ISC_R_SUCCESS);
+}
+
 struct keyalgorithms {
 	const char *str;
 	enum {
@@ -916,8 +1007,14 @@ struct keyalgorithms {
 		   { NULL, hmacnone, DST_ALG_UNKNOWN, 0 } };
 
 isc_result_t
-named_config_getkeyalgorithm(const char *str, unsigned int *typep,
+named_config_getkeyalgorithm(const char *str, const dns_name_t **name,
 			     uint16_t *digestbits) {
+	return (named_config_getkeyalgorithm2(str, name, NULL, digestbits));
+}
+
+isc_result_t
+named_config_getkeyalgorithm2(const char *str, const dns_name_t **name,
+			      unsigned int *typep, uint16_t *digestbits) {
 	int i;
 	size_t len = 0;
 	uint16_t bits;
@@ -948,7 +1045,37 @@ named_config_getkeyalgorithm(const char *str, unsigned int *typep,
 	} else {
 		bits = algorithms[i].size;
 	}
-	SET_IF_NOT_NULL(typep, algorithms[i].type);
-	SET_IF_NOT_NULL(digestbits, bits);
+
+	if (name != NULL) {
+		switch (algorithms[i].hmac) {
+		case hmacmd5:
+			*name = dns_tsig_hmacmd5_name;
+			break;
+		case hmacsha1:
+			*name = dns_tsig_hmacsha1_name;
+			break;
+		case hmacsha224:
+			*name = dns_tsig_hmacsha224_name;
+			break;
+		case hmacsha256:
+			*name = dns_tsig_hmacsha256_name;
+			break;
+		case hmacsha384:
+			*name = dns_tsig_hmacsha384_name;
+			break;
+		case hmacsha512:
+			*name = dns_tsig_hmacsha512_name;
+			break;
+		default:
+			INSIST(0);
+			ISC_UNREACHABLE();
+		}
+	}
+	if (typep != NULL) {
+		*typep = algorithms[i].type;
+	}
+	if (digestbits != NULL) {
+		*digestbits = bits;
+	}
 	return (ISC_R_SUCCESS);
 }

bin/named/control.c

@@ -15,6 +15,8 @@
 
 #include <stdbool.h>
 
+#include <isc/app.h>
+#include <isc/event.h>
 #include <isc/lex.h>
 #include <isc/mem.h>
 #include <isc/result.h>
@@ -57,7 +59,7 @@ getcommand(isc_lex_t *lex, char **cmdp) {
 	return (ISC_R_SUCCESS);
 }
 
-static bool
+static inline bool
 command_compare(const char *str, const char *command) {
 	return (strcasecmp(str, command) == 0);
 }
@@ -96,7 +98,10 @@ named_control_docommand(isccc_sexpr_t *message, bool readonly,
 		return (result);
 	}
 
-	isc_lex_create(named_g_mctx, strlen(cmdline), &lex);
+	result = isc_lex_create(named_g_mctx, strlen(cmdline), &lex);
+	if (result != ISC_R_SUCCESS) {
+		return (result);
+	}
 
 	isc_buffer_init(&src, cmdline, strlen(cmdline));
 	isc_buffer_add(&src, strlen(cmdline));
@@ -170,14 +175,14 @@ named_control_docommand(isccc_sexpr_t *message, bool readonly,
 			named_smf_want_disable = 1;
 		}
 		/*
-		 * If named_smf_got_instance = 0, named_smf_chroot is
-		 * not relevant and we fall through to shutdown below.
+		 * If named_smf_got_instance = 0, named_smf_chroot
+		 * is not relevant and we fall through to
+		 * isc_app_shutdown below.
 		 */
 #endif /* ifdef HAVE_LIBSCF */
 		/* Do not flush master files */
 		named_server_flushonshutdown(named_g_server, false);
 		named_os_shutdownmsg(cmdline, *text);
-		isc_loopmgr_shutdown(named_g_loopmgr);
 		result = ISC_R_SHUTTINGDOWN;
 	} else if (command_compare(command, NAMED_COMMAND_STOP)) {
 		/*
@@ -195,7 +200,6 @@ named_control_docommand(isccc_sexpr_t *message, bool readonly,
 #endif /* ifdef HAVE_LIBSCF */
 		named_server_flushonshutdown(named_g_server, true);
 		named_os_shutdownmsg(cmdline, *text);
-		isc_loopmgr_shutdown(named_g_loopmgr);
 		result = ISC_R_SHUTTINGDOWN;
 	} else if (command_compare(command, NAMED_COMMAND_ADDZONE) ||
 		   command_compare(command, NAMED_COMMAND_MODZONE))
@@ -214,8 +218,6 @@ named_control_docommand(isccc_sexpr_t *message, bool readonly,
 		result = ISC_R_SUCCESS;
 	} else if (command_compare(command, NAMED_COMMAND_DUMPSTATS)) {
 		result = named_server_dumpstats(named_g_server);
-	} else if (command_compare(command, NAMED_COMMAND_FETCHLIMIT)) {
-		result = named_server_fetchlimit(named_g_server, lex, text);
 	} else if (command_compare(command, NAMED_COMMAND_FLUSH)) {
 		result = named_server_flushcache(named_g_server, lex);
 	} else if (command_compare(command, NAMED_COMMAND_FLUSHNAME)) {
@@ -276,8 +278,15 @@ named_control_docommand(isccc_sexpr_t *message, bool readonly,
 		   command_compare(command, NAMED_COMMAND_UNFREEZE))
 	{
 		result = named_server_freeze(named_g_server, false, lex, text);
+	} else if (command_compare(command, NAMED_COMMAND_TIMERPOKE)) {
+		isc_timermgr_poke(named_g_timermgr);
+		result = ISC_R_SUCCESS;
 	} else if (command_compare(command, NAMED_COMMAND_TRACE)) {
 		result = named_server_setdebuglevel(named_g_server, lex);
+	} else if (command_compare(command, NAMED_COMMAND_TSIGDELETE)) {
+		result = named_server_tsigdelete(named_g_server, lex, text);
+	} else if (command_compare(command, NAMED_COMMAND_TSIGLIST)) {
+		result = named_server_tsiglist(named_g_server, text);
 	} else if (command_compare(command, NAMED_COMMAND_VALIDATION)) {
 		result = named_server_validation(named_g_server, lex, text);
 	} else if (command_compare(command, NAMED_COMMAND_ZONESTATUS)) {

bin/named/controlconf.c

@@ -16,9 +16,10 @@
 #include <inttypes.h>
 #include <stdbool.h>
 
-#include <isc/async.h>
+#include <isc/app.h>
 #include <isc/base64.h>
 #include <isc/buffer.h>
+#include <isc/event.h>
 #include <isc/file.h>
 #include <isc/mem.h>
 #include <isc/mutex.h>
@@ -27,30 +28,29 @@
 #include <isc/netmgr.h>
 #include <isc/nonce.h>
 #include <isc/random.h>
-#include <isc/refcount.h>
 #include <isc/result.h>
 #include <isc/stdtime.h>
 #include <isc/string.h>
+#include <isc/task.h>
 #include <isc/util.h>
 
 #include <isccc/alist.h>
 #include <isccc/cc.h>
 #include <isccc/ccmsg.h>
+#include <isccc/events.h>
 #include <isccc/sexpr.h>
 #include <isccc/symtab.h>
 #include <isccc/util.h>
 
-#include <isccfg/check.h>
 #include <isccfg/namedconf.h>
 
+#include <bind9/check.h>
+
 #include <named/config.h>
 #include <named/control.h>
 #include <named/log.h>
-#include <named/main.h>
 #include <named/server.h>
 
-/* Add -DNAMED_CONTROLCONF_TRACE=1 to CFLAGS for detailed reference tracing */
-
 typedef struct controlkey controlkey_t;
 typedef ISC_LIST(controlkey_t) controlkeylist_t;
 
@@ -68,8 +68,12 @@ struct controlkey {
 };
 
 struct controlconnection {
-	isc_refcount_t references;
+	isc_nmhandle_t *readhandle;
+	isc_nmhandle_t *sendhandle;
+	isc_nmhandle_t *cmdhandle;
 	isccc_ccmsg_t ccmsg;
+	bool reading;
+	bool sending;
 	controllistener_t *listener;
 	isccc_sexpr_t *ctrl;
 	isc_buffer_t *buffer;
@@ -82,7 +86,6 @@ struct controlconnection {
 	isc_stdtime_t now;
 	isc_result_t result;
 	ISC_LINK(controlconnection_t) link;
-	bool shuttingdown;
 };
 
 struct controllistener {
@@ -91,9 +94,10 @@ struct controllistener {
 	isc_sockaddr_t address;
 	isc_nmsocket_t *sock;
 	dns_acl_t *acl;
-	bool shuttingdown;
-	isc_refcount_t references;
+	bool exiting;
+	isc_refcount_t refs;
 	controlkeylist_t keys;
+	isc_mutex_t connections_lock;
 	controlconnectionlist_t connections;
 	isc_socktype_t type;
 	uint32_t perm;
@@ -106,7 +110,7 @@ struct controllistener {
 struct named_controls {
 	named_server_t *server;
 	controllistenerlist_t listeners;
-	bool shuttingdown;
+	atomic_bool shuttingdown;
 	isc_mutex_t symtab_lock;
 	isccc_symtab_t *symtab;
 };
@@ -115,48 +119,9 @@ static isc_result_t
 control_newconn(isc_nmhandle_t *handle, isc_result_t result, void *arg);
 static void
 control_recvmessage(isc_nmhandle_t *handle, isc_result_t result, void *arg);
-static void
-conn_cleanup(controlconnection_t *conn);
-static void
-conn_free(controlconnection_t *conn);
-static void
-conn_shutdown(controlconnection_t *conn);
-
-#if NAMED_CONTROLCONF_TRACE
-#define controllistener_ref(ptr) \
-	controllistener__ref(ptr, __func__, __FILE__, __LINE__)
-#define controllistener_unref(ptr) \
-	controllistener__unref(ptr, __func__, __FILE__, __LINE__)
-#define controllistener_attach(ptr, ptrp) \
-	controllistener__attach(ptr, ptrp, __func__, __FILE__, __LINE__)
-#define controllistener_detach(ptrp) \
-	controllistener__detach(ptrp, __func__, __FILE__, __LINE__)
-ISC_REFCOUNT_TRACE_DECL(controllistener);
-
-#define controlconnection_ref(ptr) \
-	controlconnection__ref(ptr, __func__, __FILE__, __LINE__)
-#define controlconnection_unref(ptr) \
-	controlconnection__unref(ptr, __func__, __FILE__, __LINE__)
-#define controlconnection_attach(ptr, ptrp) \
-	controlconnection__attach(ptr, ptrp, __func__, __FILE__, __LINE__)
-#define controlconnection_detach(ptrp) \
-	controlconnection__detach(ptrp, __func__, __FILE__, __LINE__)
-ISC_REFCOUNT_TRACE_DECL(controlconnection);
-#else
-ISC_REFCOUNT_DECL(controllistener);
-ISC_REFCOUNT_DECL(controlconnection);
-#endif
 
 #define CLOCKSKEW 300
 
-#define CHECK(x)                               \
-	{                                      \
-		result = (x);                  \
-		if (result != ISC_R_SUCCESS) { \
-			goto cleanup;          \
-		}                              \
-	}
-
 static void
 free_controlkey(controlkey_t *key, isc_mem_t *mctx) {
 	if (key->keyname != NULL) {
@@ -179,59 +144,55 @@ free_controlkeylist(controlkeylist_t *keylist, isc_mem_t *mctx) {
 
 static void
 free_listener(controllistener_t *listener) {
-	REQUIRE(listener->shuttingdown);
-	REQUIRE(ISC_LIST_EMPTY(listener->connections));
-	REQUIRE(listener->sock == NULL);
+	INSIST(listener->exiting);
+	INSIST(ISC_LIST_EMPTY(listener->connections));
+
+	isc_refcount_destroy(&listener->refs);
+
+	if (listener->sock != NULL) {
+		isc_nmsocket_close(&listener->sock);
+	}
 
 	free_controlkeylist(&listener->keys, listener->mctx);
 
 	if (listener->acl != NULL) {
 		dns_acl_detach(&listener->acl);
 	}
+	isc_mutex_destroy(&listener->connections_lock);
 
 	isc_mem_putanddetach(&listener->mctx, listener, sizeof(*listener));
 }
 
-#if NAMED_CONTROLCONF_TRACE
-ISC_REFCOUNT_TRACE_IMPL(controllistener, free_listener);
-ISC_REFCOUNT_TRACE_IMPL(controlconnection, conn_free);
-#else
-ISC_REFCOUNT_IMPL(controllistener, free_listener);
-ISC_REFCOUNT_IMPL(controlconnection, conn_free);
-#endif
+static void
+maybe_free_listener(controllistener_t *listener) {
+	if (isc_refcount_decrement(&listener->refs) == 1) {
+		free_listener(listener);
+	}
+}
 
 static void
 shutdown_listener(controllistener_t *listener) {
-	controlconnection_t *conn = NULL;
-	controlconnection_t *next = NULL;
+	if (!listener->exiting) {
+		char socktext[ISC_SOCKADDR_FORMATSIZE];
 
-	/* Don't shutdown the same listener twice */
-	if (listener->shuttingdown) {
-		return;
+		ISC_LIST_UNLINK(listener->controls->listeners, listener, link);
+
+		isc_sockaddr_format(&listener->address, socktext,
+				    sizeof(socktext));
+		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+			      NAMED_LOGMODULE_CONTROL, ISC_LOG_NOTICE,
+			      "stopping command channel on %s", socktext);
+#if 0
+		/* XXX: no unix domain socket support */
+		if (listener->type == isc_socktype_unix) {
+			isc_socket_cleanunix(&listener->address, true);
+		}
+#endif
+		listener->exiting = true;
 	}
-	listener->shuttingdown = true;
-
-	for (conn = ISC_LIST_HEAD(listener->connections); conn != NULL;
-	     conn = next)
-	{
-		/*
-		 * 'conn' is likely to be freed by the conn_shutdown() call.
-		 */
-		next = ISC_LIST_NEXT(conn, link);
-		conn_shutdown(conn);
-	}
-
-	ISC_LIST_UNLINK(listener->controls->listeners, listener, link);
-
-	char socktext[ISC_SOCKADDR_FORMATSIZE];
-	isc_sockaddr_format(&listener->address, socktext, sizeof(socktext));
-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-		      NAMED_LOGMODULE_CONTROL, ISC_LOG_NOTICE,
-		      "stopping command channel on %s", socktext);
 
 	isc_nm_stoplistening(listener->sock);
-	isc_nmsocket_close(&listener->sock);
-	controllistener_detach(&listener);
+	maybe_free_listener(listener);
 }
 
 static bool
@@ -242,6 +203,11 @@ address_ok(isc_sockaddr_t *sockaddr, controllistener_t *listener) {
 	isc_result_t result;
 	int match;
 
+	/* ACL doesn't apply to unix domain sockets */
+	if (listener->type != isc_socktype_tcp) {
+		return (true);
+	}
+
 	isc_netaddr_fromsockaddr(&netaddr, sockaddr);
 
 	result = dns_acl_match(&netaddr, NULL, listener->acl, env, &match,
@@ -252,40 +218,46 @@ address_ok(isc_sockaddr_t *sockaddr, controllistener_t *listener) {
 static void
 control_senddone(isc_nmhandle_t *handle, isc_result_t result, void *arg) {
 	controlconnection_t *conn = (controlconnection_t *)arg;
+	controllistener_t *listener = conn->listener;
+	isc_sockaddr_t peeraddr = isc_nmhandle_peeraddr(handle);
 
-	if (conn->shuttingdown) {
-		/* The connection is shuttingdown */
-		result = ISC_R_SHUTTINGDOWN;
+	REQUIRE(conn->sending);
+
+	conn->sending = false;
+
+	if (conn->result == ISC_R_SHUTTINGDOWN) {
+		isc_app_shutdown();
+		goto cleanup_sendhandle;
 	}
 
-	if (result == ISC_R_SUCCESS) {
-		/* Everything is peachy, continue reading from the socket */
-		isccc_ccmsg_readmessage(&conn->ccmsg, control_recvmessage,
-					conn);
-		/* Detach the sending reference */
-		controlconnection_detach(&conn);
-		return;
-	}
-
-	if (result != ISC_R_SHUTTINGDOWN) {
+	if (atomic_load_acquire(&listener->controls->shuttingdown) ||
+	    result == ISC_R_SHUTTINGDOWN)
+	{
+		goto cleanup_sendhandle;
+	} else if (result != ISC_R_SUCCESS) {
 		char socktext[ISC_SOCKADDR_FORMATSIZE];
-		isc_sockaddr_t peeraddr = isc_nmhandle_peeraddr(handle);
 
 		isc_sockaddr_format(&peeraddr, socktext, sizeof(socktext));
 		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 			      NAMED_LOGMODULE_CONTROL, ISC_LOG_WARNING,
 			      "error sending command response to %s: %s",
 			      socktext, isc_result_totext(result));
+		goto cleanup_sendhandle;
 	}
 
-	/* Shutdown the reading */
-	conn_shutdown(conn);
+	isc_nmhandle_attach(handle, &conn->readhandle);
+	conn->reading = true;
 
-	/* Detach the sending reference */
-	controlconnection_detach(&conn);
+	isc_nmhandle_detach(&conn->sendhandle);
+
+	isccc_ccmsg_readmessage(&conn->ccmsg, control_recvmessage, conn);
+	return;
+
+cleanup_sendhandle:
+	isc_nmhandle_detach(&conn->sendhandle);
 }
 
-static void
+static inline void
 log_invalid(isccc_ccmsg_t *ccmsg, isc_result_t result) {
 	char socktext[ISC_SOCKADDR_FORMATSIZE];
 	isc_sockaddr_t peeraddr = isc_nmhandle_peeraddr(ccmsg->handle);
@@ -317,7 +289,7 @@ conn_cleanup(controlconnection_t *conn) {
 }
 
 static void
-control_respond(controlconnection_t *conn) {
+control_respond(isc_nmhandle_t *handle, controlconnection_t *conn) {
 	controllistener_t *listener = conn->listener;
 	isccc_sexpr_t *data = NULL;
 	isc_buffer_t b;
@@ -379,7 +351,7 @@ control_respond(controlconnection_t *conn) {
 	result = isccc_cc_towire(conn->response, &conn->buffer, conn->alg,
 				 &conn->secret);
 	if (result != ISC_R_SUCCESS) {
-		return;
+		goto cleanup;
 	}
 
 	isc_buffer_init(&b, conn->buffer->base, 4);
@@ -388,59 +360,68 @@ control_respond(controlconnection_t *conn) {
 	r.base = conn->buffer->base;
 	r.length = conn->buffer->used;
 
-	/* Attach the sending reference */
-	controlconnection_ref(conn);
-	isccc_ccmsg_sendmessage(&conn->ccmsg, &r, control_senddone, conn);
+	isc_nmhandle_attach(handle, &conn->sendhandle);
+	conn->sending = true;
+	conn_cleanup(conn);
+
+	isc_nmhandle_detach(&conn->cmdhandle);
+
+	isc_nm_send(conn->sendhandle, &r, control_senddone, conn);
+
+	return;
 
 cleanup:
 	conn_cleanup(conn);
+	isc_nmhandle_detach(&conn->cmdhandle);
 }
 
 static void
-control_command(void *arg) {
-	controlconnection_t *conn = (controlconnection_t *)arg;
+control_command(isc_task_t *task, isc_event_t *event) {
+	controlconnection_t *conn = event->ev_arg;
+	controllistener_t *listener = conn->listener;
 
-	/* Don't run the command if we already started the shutdown */
-	if (!conn->shuttingdown) {
-		conn->result = named_control_docommand(
-			conn->request, conn->listener->readonly, &conn->text);
-		control_respond(conn);
+	UNUSED(task);
+
+	if (atomic_load_acquire(&listener->controls->shuttingdown)) {
+		conn_cleanup(conn);
+		isc_nmhandle_detach(&conn->cmdhandle);
+		goto done;
 	}
 
-	/* Detach the control command reference */
-	controlconnection_detach(&conn);
+	conn->result = named_control_docommand(conn->request,
+					       listener->readonly, &conn->text);
+	control_respond(conn->cmdhandle, conn);
+
+done:
+	isc_event_free(&event);
 }
 
 static void
-conn_shutdown(controlconnection_t *conn) {
-	/* Don't shutdown the same controlconnection twice */
-	if (conn->shuttingdown) {
-		return;
-	}
-	conn->shuttingdown = true;
-
-	/*
-	 * Close the TCP connection to make sure that no read callback will be
-	 * called for it ever again.
-	 */
-	isccc_ccmsg_disconnect(&conn->ccmsg);
-
-	/* Detach the reading reference */
-	controlconnection_detach(&conn);
-}
-
-static void
-control_recvmessage(isc_nmhandle_t *handle ISC_ATTR_UNUSED, isc_result_t result,
-		    void *arg) {
+control_recvmessage(isc_nmhandle_t *handle, isc_result_t result, void *arg) {
 	controlconnection_t *conn = (controlconnection_t *)arg;
 	controllistener_t *listener = conn->listener;
 	controlkey_t *key = NULL;
+	isc_event_t *event = NULL;
 	isccc_time_t sent;
 	isccc_time_t exp;
 	uint32_t nonce;
 
+	conn->reading = false;
+
+	/* Is the server shutting down? */
+	if (atomic_load_acquire(&listener->controls->shuttingdown)) {
+		goto cleanup_readhandle;
+	}
+
 	if (result != ISC_R_SUCCESS) {
-		goto cleanup;
+		if (result == ISC_R_SHUTTINGDOWN) {
+			atomic_store_release(&listener->controls->shuttingdown,
+					     true);
+		} else if (result != ISC_R_EOF) {
+			log_invalid(&conn->ccmsg, result);
+		}
+
+		goto cleanup_readhandle;
 	}
 
 	for (key = ISC_LIST_HEAD(listener->keys); key != NULL;
@@ -448,7 +429,8 @@ control_recvmessage(isc_nmhandle_t *handle ISC_ATTR_UNUSED, isc_result_t result,
 	{
 		isccc_region_t ccregion;
 
-		isccc_ccmsg_toregion(&conn->ccmsg, &ccregion);
+		ccregion.rstart = isc_buffer_base(conn->ccmsg.buffer);
+		ccregion.rend = isc_buffer_used(conn->ccmsg.buffer);
 		conn->secret.rstart = isc_mem_get(listener->mctx,
 						  key->secret.length);
 		memmove(conn->secret.rstart, key->secret.base,
@@ -465,36 +447,35 @@ control_recvmessage(isc_nmhandle_t *handle ISC_ATTR_UNUSED, isc_result_t result,
 	}
 
 	if (key == NULL) {
-		result = ISCCC_R_BADAUTH;
+		log_invalid(&conn->ccmsg, ISCCC_R_BADAUTH);
 		goto cleanup;
 	}
 
 	/* We shouldn't be getting a reply. */
 	if (isccc_cc_isreply(conn->request)) {
-		result = ISC_R_FAILURE;
+		log_invalid(&conn->ccmsg, ISC_R_FAILURE);
 		goto cleanup;
 	}
 
-	conn->now = isc_stdtime_now();
+	isc_stdtime_get(&conn->now);
 
 	/*
 	 * Limit exposure to replay attacks.
 	 */
 	conn->ctrl = isccc_alist_lookup(conn->request, "_ctrl");
 	if (!isccc_alist_alistp(conn->ctrl)) {
-		result = ISC_R_FAILURE;
+		log_invalid(&conn->ccmsg, ISC_R_FAILURE);
 		goto cleanup;
 	}
 
 	if (isccc_cc_lookupuint32(conn->ctrl, "_tim", &sent) == ISC_R_SUCCESS) {
 		if ((sent + CLOCKSKEW) < conn->now ||
-		    (sent - CLOCKSKEW) > conn->now)
-		{
-			result = ISCCC_R_CLOCKSKEW;
+		    (sent - CLOCKSKEW) > conn->now) {
+			log_invalid(&conn->ccmsg, ISCCC_R_CLOCKSKEW);
 			goto cleanup;
 		}
 	} else {
-		result = ISC_R_FAILURE;
+		log_invalid(&conn->ccmsg, ISC_R_FAILURE);
 		goto cleanup;
 	}
 
@@ -504,7 +485,7 @@ control_recvmessage(isc_nmhandle_t *handle ISC_ATTR_UNUSED, isc_result_t result,
 	if (isccc_cc_lookupuint32(conn->ctrl, "_exp", &exp) == ISC_R_SUCCESS &&
 	    conn->now > exp)
 	{
-		result = ISCCC_R_EXPIRED;
+		log_invalid(&conn->ccmsg, ISCCC_R_EXPIRED);
 		goto cleanup;
 	}
 
@@ -520,6 +501,7 @@ control_recvmessage(isc_nmhandle_t *handle ISC_ATTR_UNUSED, isc_result_t result,
 		if (result == ISC_R_EXISTS) {
 			result = ISCCC_R_DUPLICATE;
 		}
+		log_invalid(&conn->ccmsg, result);
 		goto cleanup;
 	}
 
@@ -528,12 +510,15 @@ control_recvmessage(isc_nmhandle_t *handle ISC_ATTR_UNUSED, isc_result_t result,
 		     ISC_R_SUCCESS ||
 	     conn->nonce != nonce))
 	{
-		result = ISCCC_R_BADAUTH;
+		log_invalid(&conn->ccmsg, ISCCC_R_BADAUTH);
 		goto cleanup;
 	}
 
 	isc_buffer_allocate(listener->mctx, &conn->text, 2 * 2048);
 
+	isc_nmhandle_attach(handle, &conn->cmdhandle);
+	isc_nmhandle_detach(&conn->readhandle);
+
 	if (conn->nonce == 0) {
 		/*
 		 * Establish nonce.
@@ -542,93 +527,100 @@ control_recvmessage(isc_nmhandle_t *handle ISC_ATTR_UNUSED, isc_result_t result,
 			isc_nonce_buf(&conn->nonce, sizeof(conn->nonce));
 		}
 		conn->result = ISC_R_SUCCESS;
-		control_respond(conn);
+		control_respond(handle, conn);
 		return;
 	}
 
-	/* Attach the command reference */
-	controlconnection_ref(conn);
+	/*
+	 * Trigger the command.
+	 */
 
-	/* Trigger the command asynchronously. */
-	isc_async_run(named_g_mainloop, control_command, conn);
+	event = isc_event_allocate(listener->mctx, conn, NAMED_EVENT_COMMAND,
+				   control_command, conn, sizeof(isc_event_t));
+	isc_task_send(named_g_server->task, &event);
 
 	return;
 
 cleanup:
-	switch (result) {
-	case ISC_R_SHUTTINGDOWN:
-	case ISC_R_EOF:
-		break;
-	default:
-		log_invalid(&conn->ccmsg, result);
-	}
+	conn_cleanup(conn);
 
-	conn_shutdown(conn);
+cleanup_readhandle:
+	/*
+	 * readhandle could be NULL if we're shutting down,
+	 * but if not we need to detach it.
+	 */
+	if (conn->readhandle != NULL) {
+		isc_nmhandle_detach(&conn->readhandle);
+	}
 }
 
 static void
-conn_free(controlconnection_t *conn) {
-	/* Make sure that the connection was shutdown first */
-	REQUIRE(conn->shuttingdown);
-
+conn_reset(void *arg) {
+	controlconnection_t *conn = (controlconnection_t *)arg;
 	controllistener_t *listener = conn->listener;
 
-	isccc_ccmsg_invalidate(&conn->ccmsg);
-
-	conn_cleanup(conn);
-
 	if (conn->buffer != NULL) {
 		isc_buffer_free(&conn->buffer);
 	}
 
+	if (conn->reading) {
+		isccc_ccmsg_cancelread(&conn->ccmsg);
+		return;
+	}
+
+	LOCK(&listener->connections_lock);
 	ISC_LIST_UNLINK(listener->connections, conn, link);
+	UNLOCK(&listener->connections_lock);
 #ifdef ENABLE_AFL
 	if (named_g_fuzz_type == isc_fuzz_rndc) {
 		named_fuzz_notify();
 	}
 #endif /* ifdef ENABLE_AFL */
 
+	isccc_ccmsg_invalidate(&conn->ccmsg);
+}
+
+static void
+conn_put(void *arg) {
+	controlconnection_t *conn = (controlconnection_t *)arg;
+	controllistener_t *listener = conn->listener;
+
 	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 		      NAMED_LOGMODULE_CONTROL, ISC_LOG_DEBUG(3),
 		      "freeing control connection");
-
-	isc_mem_put(listener->mctx, conn, sizeof(*conn));
-
-	controllistener_detach(&listener);
+	maybe_free_listener(listener);
 }
 
 static void
 newconnection(controllistener_t *listener, isc_nmhandle_t *handle) {
-	/* Don't create new connection if we are shutting down */
-	if (listener->shuttingdown) {
+	controlconnection_t *conn = NULL;
+
+	conn = isc_nmhandle_getdata(handle);
+	if (conn == NULL) {
+		conn = isc_nmhandle_getextra(handle);
 		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 			      NAMED_LOGMODULE_CONTROL, ISC_LOG_DEBUG(3),
-			      "rejected new control connection: %s",
-			      isc_result_totext(ISC_R_SHUTTINGDOWN));
-		return;
+			      "allocate new control connection");
+		isc_nmhandle_setdata(handle, conn, conn_reset, conn_put);
+		isc_refcount_increment(&listener->refs);
 	}
 
-	controlconnection_t *conn = isc_mem_get(listener->mctx, sizeof(*conn));
-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-		      NAMED_LOGMODULE_CONTROL, ISC_LOG_DEBUG(3),
-		      "allocate new control connection");
+	*conn = (controlconnection_t){ .listener = listener,
+				       .reading = false,
+				       .alg = DST_ALG_UNKNOWN };
 
-	*conn = (controlconnection_t){
-		.alg = DST_ALG_UNKNOWN,
-		.references = ISC_REFCOUNT_INITIALIZER(1),
-		.listener = controllistener_ref(listener),
-		.link = ISC_LINK_INITIALIZER,
-	};
-
-	/* isccc_ccmsg_init() attaches to the handle */
 	isccc_ccmsg_init(listener->mctx, handle, &conn->ccmsg);
 
 	/* Set a 32 KiB upper limit on incoming message. */
 	isccc_ccmsg_setmaxsize(&conn->ccmsg, 32768);
 
-	ISC_LIST_APPEND(listener->connections, conn, link);
+	LOCK(&listener->connections_lock);
+	ISC_LIST_INITANDAPPEND(listener->connections, conn, link);
+	UNLOCK(&listener->connections_lock);
+
+	isc_nmhandle_attach(handle, &conn->readhandle);
+	conn->reading = true;
 
-	/* The reading reference has been initialized in the initializer */
 	isccc_ccmsg_readmessage(&conn->ccmsg, control_recvmessage, conn);
 }
 
@@ -668,7 +660,8 @@ controls_shutdown(named_controls_t *controls) {
 	     listener = next)
 	{
 		/*
-		 * As listeners shut down, they will call their callbacks.
+		 * This is asynchronous.  As listeners shut down, they will
+		 * call their callbacks.
 		 */
 		next = ISC_LIST_NEXT(listener, link);
 		shutdown_listener(listener);
@@ -677,20 +670,8 @@ controls_shutdown(named_controls_t *controls) {
 
 void
 named_controls_shutdown(named_controls_t *controls) {
-	/*
-	 * Don't ever shutdown the controls twice.
-	 *
-	 * NOTE: This functions is called when the server is shutting down, but
-	 * controls_shutdown() can and will be called multiple times - on each
-	 * reconfiguration, the listeners will be torn down and recreated again,
-	 * see named_controls_configure() for details.
-	 */
-	if (controls->shuttingdown) {
-		return;
-	}
-	controls->shuttingdown = true;
-
 	controls_shutdown(controls);
+	atomic_store_release(&controls->shuttingdown, true);
 }
 
 static isc_result_t
@@ -780,8 +761,8 @@ register_keys(const cfg_obj_t *control, const cfg_obj_t *keylist,
 			algstr = cfg_obj_asstring(algobj);
 			secretstr = cfg_obj_asstring(secretobj);
 
-			result = named_config_getkeyalgorithm(algstr, &algtype,
-							      NULL);
+			result = named_config_getkeyalgorithm2(algstr, NULL,
+							       &algtype, NULL);
 			if (result != ISC_R_SUCCESS) {
 				cfg_obj_log(control, named_g_lctx,
 					    ISC_LOG_WARNING,
@@ -819,6 +800,14 @@ register_keys(const cfg_obj_t *control, const cfg_obj_t *keylist,
 	}
 }
 
+#define CHECK(x)                               \
+	do {                                   \
+		result = (x);                  \
+		if (result != ISC_R_SUCCESS) { \
+			goto cleanup;          \
+		}                              \
+	} while (0)
+
 static isc_result_t
 get_rndckey(isc_mem_t *mctx, controlkeylist_t *keyids) {
 	isc_result_t result;
@@ -857,7 +846,7 @@ get_rndckey(isc_mem_t *mctx, controlkeylist_t *keyids) {
 		CHECK(ISC_R_NOMEMORY);
 	}
 
-	CHECK(isccfg_check_key(key, named_g_lctx));
+	CHECK(bind9_check_key(key, named_g_lctx));
 
 	(void)cfg_map_get(key, "algorithm", &algobj);
 	(void)cfg_map_get(key, "secret", &secretobj);
@@ -866,7 +855,7 @@ get_rndckey(isc_mem_t *mctx, controlkeylist_t *keyids) {
 	algstr = cfg_obj_asstring(algobj);
 	secretstr = cfg_obj_asstring(secretobj);
 
-	result = named_config_getkeyalgorithm(algstr, &algtype, NULL);
+	result = named_config_getkeyalgorithm2(algstr, NULL, &algtype, NULL);
 	if (result != ISC_R_SUCCESS) {
 		cfg_obj_log(key, named_g_lctx, ISC_LOG_WARNING,
 			    "unsupported algorithm '%s' in "
@@ -925,8 +914,7 @@ get_key_info(const cfg_obj_t *config, const cfg_obj_t *control,
 	control_keylist = cfg_tuple_get(control, "keys");
 
 	if (!cfg_obj_isvoid(control_keylist) &&
-	    cfg_list_first(control_keylist) != NULL)
-	{
+	    cfg_list_first(control_keylist) != NULL) {
 		result = cfg_map_get(config, "key", &global_keylist);
 
 		if (result == ISC_R_SUCCESS) {
@@ -1061,6 +1049,33 @@ update_listener(named_controls_t *cp, controllistener_t **listenerp,
 			      socktext, isc_result_totext(result));
 	}
 
+#if 0
+	/* XXX: no unix socket support yet */
+	if (result == ISC_R_SUCCESS && type == isc_socktype_unix) {
+		uint32_t perm, owner, group;
+		perm = cfg_obj_asuint32(cfg_tuple_get(control, "perm"));
+		owner = cfg_obj_asuint32(cfg_tuple_get(control, "owner"));
+		group = cfg_obj_asuint32(cfg_tuple_get(control, "group"));
+		result = ISC_R_SUCCESS;
+		if (listener->perm != perm || listener->owner != owner ||
+		    listener->group != group)
+		{
+			result = isc_socket_permunix(&listener->address, perm,
+						     owner, group);
+		}
+		if (result == ISC_R_SUCCESS) {
+			listener->perm = perm;
+			listener->owner = owner;
+			listener->group = group;
+		} else if (control != NULL) {
+			cfg_obj_log(control, named_g_lctx, ISC_LOG_WARNING,
+				    "couldn't update ownership/permission for "
+				    "command channel %s",
+				    socktext);
+		}
+	}
+#endif
+
 	*listenerp = listener;
 }
 
@@ -1078,21 +1093,16 @@ add_listener(named_controls_t *cp, controllistener_t **listenerp,
 	isc_result_t result = ISC_R_SUCCESS;
 	int pf;
 
-	/* Don't create new listener if we are shutting down */
-	if (cp->shuttingdown) {
-		result = ISC_R_SHUTTINGDOWN;
-		goto shuttingdown;
-	}
-
 	listener = isc_mem_get(mctx, sizeof(*listener));
 	*listener = (controllistener_t){ .controls = cp,
 					 .address = *addr,
 					 .type = type };
 	isc_mem_attach(mctx, &listener->mctx);
+	isc_mutex_init(&listener->connections_lock);
 	ISC_LINK_INIT(listener, link);
 	ISC_LIST_INIT(listener->keys);
 	ISC_LIST_INIT(listener->connections);
-	isc_refcount_init(&listener->references, 1);
+	isc_refcount_init(&listener->refs, 1);
 
 	/*
 	 * Make the ACL.
@@ -1137,14 +1147,35 @@ add_listener(named_controls_t *cp, controllistener_t **listenerp,
 
 	pf = isc_sockaddr_pf(&listener->address);
 	if ((pf == AF_INET && isc_net_probeipv4() != ISC_R_SUCCESS) ||
+	    (pf == AF_UNIX && isc_net_probeunix() != ISC_R_SUCCESS) ||
 	    (pf == AF_INET6 && isc_net_probeipv6() != ISC_R_SUCCESS))
 	{
 		CHECK(ISC_R_FAMILYNOSUPPORT);
 	}
 
-	CHECK(isc_nm_listentcp(named_g_netmgr, ISC_NM_LISTEN_ONE,
-			       &listener->address, control_newconn, listener, 5,
-			       NULL, &listener->sock));
+#if 0
+	/* XXX: no unix socket support yet */
+	if (type == isc_socktype_unix) {
+		isc_socket_cleanunix(&listener->address, false);
+	}
+#endif
+
+	CHECK(isc_nm_listentcp(
+		named_g_netmgr, &listener->address, control_newconn, listener,
+		sizeof(controlconnection_t), 5, NULL, &listener->sock));
+#if 0
+	/* XXX: no unix socket support yet */
+	if (type == isc_socktype_unix) {
+		listener->perm =
+			cfg_obj_asuint32(cfg_tuple_get(control, "perm"));
+		listener->owner =
+			cfg_obj_asuint32(cfg_tuple_get(control, "owner"));
+		listener->group =
+			cfg_obj_asuint32(cfg_tuple_get(control, "group"));
+		result = isc_socket_permunix(&listener->address, listener->perm,
+					     listener->owner, listener->group);
+	}
+#endif
 
 	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 		      NAMED_LOGMODULE_CONTROL, ISC_LOG_NOTICE,
@@ -1153,11 +1184,10 @@ add_listener(named_controls_t *cp, controllistener_t **listenerp,
 	return;
 
 cleanup:
-	isc_refcount_decrement(&listener->references);
-	listener->shuttingdown = true;
+	isc_refcount_decrement(&listener->refs);
+	listener->exiting = true;
 	free_listener(listener);
 
-shuttingdown:
 	if (control != NULL) {
 		cfg_obj_log(control, named_g_lctx, ISC_LOG_WARNING,
 			    "couldn't add command channel %s: %s", socktext,
@@ -1170,6 +1200,8 @@ shuttingdown:
 	}
 
 	*listenerp = NULL;
+
+	/* XXXDCL return error results? fail hard? */
 }
 
 isc_result_t
@@ -1202,19 +1234,8 @@ named_controls_configure(named_controls_t *cp, const cfg_obj_t *config,
 		{
 			const cfg_obj_t *controls = NULL;
 			const cfg_obj_t *inetcontrols = NULL;
-			const cfg_obj_t *unixcontrols = NULL;
 
 			controls = cfg_listelt_value(element);
-
-			(void)cfg_map_get(controls, "unix", &unixcontrols);
-			if (unixcontrols != NULL) {
-				cfg_obj_log(controls, named_g_lctx,
-					    ISC_LOG_ERROR,
-					    "UNIX domain sockets are not "
-					    "supported");
-				return (ISC_R_FAILURE);
-			}
-
 			(void)cfg_map_get(controls, "inet", &inetcontrols);
 			if (inetcontrols == NULL) {
 				continue;
@@ -1230,8 +1251,8 @@ named_controls_configure(named_controls_t *cp, const cfg_obj_t *config,
 
 				/*
 				 * The parser handles BIND 8 configuration file
-				 * syntax, so it allows inet phrases with no
-				 * keys{} clause.
+				 * syntax, so it allows unix phrases as well
+				 * inet phrases with no keys{} clause.
 				 */
 				control = cfg_listelt_value(element2);
 
@@ -1279,6 +1300,91 @@ named_controls_configure(named_controls_t *cp, const cfg_obj_t *config,
 				}
 			}
 		}
+		for (element = cfg_list_first(controlslist); element != NULL;
+		     element = cfg_list_next(element))
+		{
+			const cfg_obj_t *controls = NULL;
+			const cfg_obj_t *unixcontrols = NULL;
+
+			controls = cfg_listelt_value(element);
+			(void)cfg_map_get(controls, "unix", &unixcontrols);
+			if (unixcontrols == NULL) {
+				continue;
+			}
+
+			cfg_obj_log(controls, named_g_lctx, ISC_LOG_ERROR,
+				    "UNIX domain sockets not yet supported");
+			return (ISC_R_FAILURE);
+
+#if 0
+			/* XXX: no unix domain socket support in netmgr */
+			for (element2 = cfg_list_first(unixcontrols);
+			     element2 != NULL;
+			     element2 = cfg_list_next(element2))
+			{
+				const cfg_obj_t *control = NULL;
+				const cfg_obj_t *path = NULL;
+				isc_sockaddr_t addr;
+				isc_result_t result;
+
+				/*
+				 * The parser handles BIND 8 configuration file
+				 * syntax, so it allows unix phrases as well
+				 * inet phrases with no keys{} clause.
+				 */
+				control = cfg_listelt_value(element2);
+
+				path = cfg_tuple_get(control, "path");
+				result = isc_sockaddr_frompath(
+					&addr, cfg_obj_asstring(path));
+				if (result != ISC_R_SUCCESS) {
+					isc_log_write(
+						named_g_lctx,
+						NAMED_LOGCATEGORY_GENERAL,
+						NAMED_LOGMODULE_CONTROL,
+						ISC_LOG_DEBUG(9),
+						"control channel '%s': %s",
+						cfg_obj_asstring(path),
+						isc_result_totext(result));
+					continue;
+				}
+
+				isc_log_write(named_g_lctx,
+					      NAMED_LOGCATEGORY_GENERAL,
+					      NAMED_LOGMODULE_CONTROL,
+					      ISC_LOG_DEBUG(9),
+					      "processing control channel '%s'",
+					      cfg_obj_asstring(path));
+
+				update_listener(cp, &listener, control, config,
+						&addr, aclconfctx,
+						cfg_obj_asstring(path),
+						isc_socktype_unix);
+
+				if (listener != NULL) {
+					/*
+					 * Remove the listener from the old
+					 * list, so it won't be shut down.
+					 */
+					ISC_LIST_UNLINK(cp->listeners, listener,
+							link);
+				} else {
+					/*
+					 * This is a new listener.
+					 */
+					add_listener(cp, &listener, control,
+						     config, &addr, aclconfctx,
+						     cfg_obj_asstring(path),
+						     isc_socktype_unix);
+				}
+
+				if (listener != NULL) {
+					ISC_LIST_APPEND(new_listeners, listener,
+							link);
+				}
+			}
+#endif
+		}
 	} else {
 		int i;
 
@@ -1356,6 +1462,7 @@ named_controls_create(named_server_t *server, named_controls_t **ctrlsp) {
 
 	ISC_LIST_INIT(controls->listeners);
 
+	atomic_init(&controls->shuttingdown, false);
 	isc_mutex_init(&controls->symtab_lock);
 	LOCK(&controls->symtab_lock);
 	result = isccc_cc_createsymtab(&controls->symtab);
@@ -1375,7 +1482,6 @@ named_controls_destroy(named_controls_t **ctrlsp) {
 	named_controls_t *controls = *ctrlsp;
 	*ctrlsp = NULL;
 
-	REQUIRE(controls->shuttingdown);
 	REQUIRE(ISC_LIST_EMPTY(controls->listeners));
 
 	LOCK(&controls->symtab_lock);

bin/named/dlz_dlopen_driver.c

@@ -16,11 +16,12 @@
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
+#include <uv.h>
 
 #include <isc/mem.h>
+#include <isc/print.h>
 #include <isc/result.h>
 #include <isc/util.h>
-#include <isc/uv.h>
 
 #include <dns/dlz_dlopen.h>
 #include <dns/log.h>
@@ -224,11 +225,12 @@ dlopen_dlz_create(const char *dlzname, unsigned int argc, char *argv[],
 
 	isc_mem_create(&mctx);
 	cd = isc_mem_get(mctx, sizeof(*cd));
-	*cd = (dlopen_data_t){
-		.mctx = mctx,
-		.dl_path = isc_mem_strdup(mctx, argv[1]),
-		.dlzname = isc_mem_strdup(mctx, dlzname),
-	};
+	memset(cd, 0, sizeof(*cd));
+
+	cd->mctx = mctx;
+
+	cd->dl_path = isc_mem_strdup(cd->mctx, argv[1]);
+	cd->dlzname = isc_mem_strdup(cd->mctx, dlzname);
 
 	/* Initialize the lock */
 	isc_mutex_init(&cd->lock);
@@ -530,7 +532,8 @@ dlz_dlopen_init(isc_mem_t *mctx) {
 				  mctx, &dlz_dlopen);
 
 	if (result != ISC_R_SUCCESS) {
-		UNEXPECTED_ERROR("dns_sdlzregister() failed: %s",
+		UNEXPECTED_ERROR(__FILE__, __LINE__,
+				 "dns_sdlzregister() failed: %s",
 				 isc_result_totext(result));
 		result = ISC_R_UNEXPECTED;
 	}

bin/named/fuzz.c

@@ -25,8 +25,8 @@
 #include <string.h>
 #include <unistd.h>
 
+#include <isc/app.h>
 #include <isc/condition.h>
-#include <isc/loop.h>
 #include <isc/mutex.h>
 #include <isc/thread.h>
 #include <isc/util.h>
@@ -126,7 +126,7 @@ fuzz_thread_client(void *arg) {
 				close(sockfd);
 				named_server_flushonshutdown(named_g_server,
 							     false);
-				isc_loopmgr_shutdown(named_g_loopmgr);
+				isc_app_shutdown();
 				return (NULL);
 			}
 			raise(SIGSTOP);
@@ -159,7 +159,7 @@ fuzz_thread_client(void *arg) {
 	close(sockfd);
 
 	named_server_flushonshutdown(named_g_server, false);
-	isc_loopmgr_shutdown(named_g_loopmgr);
+	isc_app_shutdown();
 
 	return (NULL);
 }
@@ -374,7 +374,7 @@ fuzz_thread_resolver(void *arg) {
 				close(listenfd);
 				named_server_flushonshutdown(named_g_server,
 							     false);
-				isc_loopmgr_shutdown(named_g_loopmgr);
+				isc_app_shutdown();
 				return (NULL);
 			}
 			raise(SIGSTOP);
@@ -574,7 +574,7 @@ fuzz_thread_resolver(void *arg) {
 	close(sockfd);
 	close(listenfd);
 	named_server_flushonshutdown(named_g_server, false);
-	isc_loopmgr_shutdown(named_g_loopmgr);
+	isc_app_shutdown();
 
 #ifdef __AFL_LOOP
 	/*
@@ -716,7 +716,7 @@ fuzz_thread_tcp(void *arg) {
 	free(buf);
 	close(sockfd);
 	named_server_flushonshutdown(named_g_server, false);
-	isc_loopmgr_shutdown(named_g_loopmgr);
+	isc_app_shutdown();
 
 	return (NULL);
 }
@@ -733,7 +733,7 @@ named_fuzz_notify(void) {
 #ifdef ENABLE_AFL
 	if (getenv("AFL_CMIN")) {
 		named_server_flushonshutdown(named_g_server, false);
-		isc_loopmgr_shutdown(named_g_loopmgr);
+		isc_app_shutdown();
 		return;
 	}
 

bin/named/geoip.c

@@ -18,6 +18,7 @@
 #endif /* if defined(HAVE_GEOIP2) */
 
 #include <isc/dir.h>
+#include <isc/print.h>
 #include <isc/string.h>
 #include <isc/util.h>
 

bin/named/include/named/builtin.h

@@ -15,19 +15,8 @@
 
 /*! \file */
 
-#include <inttypes.h>
-
-#include <isc/lang.h>
 #include <isc/types.h>
 
-#include <dns/clientinfo.h>
-#include <dns/types.h>
-
-/***
- *** Functions
- ***/
-
-/* Initialization functions for builtin zone databases */
 isc_result_t
 named_builtin_init(void);
 

bin/named/include/named/config.h

@@ -27,9 +27,6 @@
 isc_result_t
 named_config_parsedefaults(cfg_parser_t *parser, cfg_obj_t **conf);
 
-const char *
-named_config_getdefault(void);
-
 isc_result_t
 named_config_get(cfg_obj_t const *const *maps, const char *name,
 		 const cfg_obj_t **obj);
@@ -52,6 +49,16 @@ named_config_gettype(const cfg_obj_t *typeobj, dns_rdatatype_t deftype,
 dns_zonetype_t
 named_config_getzonetype(const cfg_obj_t *zonetypeobj);
 
+isc_result_t
+named_config_getiplist(const cfg_obj_t *config, const cfg_obj_t *list,
+		       in_port_t defport, isc_mem_t *mctx,
+		       isc_sockaddr_t **addrsp, isc_dscp_t **dscpsp,
+		       uint32_t *countp);
+
+void
+named_config_putiplist(isc_mem_t *mctx, isc_sockaddr_t **addrsp,
+		       isc_dscp_t **dscpsp, uint32_t count);
+
 isc_result_t
 named_config_getremotesdef(const cfg_obj_t *cctx, const char *list,
 			   const char *name, const cfg_obj_t **ret);
@@ -66,5 +73,11 @@ named_config_getport(const cfg_obj_t *config, const char *type,
 		     in_port_t *portp);
 
 isc_result_t
-named_config_getkeyalgorithm(const char *str, unsigned int *typep,
+named_config_getkeyalgorithm(const char *str, const dns_name_t **name,
 			     uint16_t *digestbits);
+isc_result_t
+named_config_getkeyalgorithm2(const char *str, const dns_name_t **name,
+			      unsigned int *typep, uint16_t *digestbits);
+
+isc_result_t
+named_config_getdscp(const cfg_obj_t *config, isc_dscp_t *dscpp);

bin/named/include/named/control.h

@@ -20,10 +20,9 @@
 
 #include <stdbool.h>
 
-#include <isccc/types.h>
-
 #include <isccfg/aclconf.h>
 
+#include <isccc/types.h>
 #include <named/types.h>
 
 #define NAMED_CONTROL_PORT 953
@@ -44,9 +43,12 @@
 #define NAMED_COMMAND_FLUSHNAME	   "flushname"
 #define NAMED_COMMAND_FLUSHTREE	   "flushtree"
 #define NAMED_COMMAND_STATUS	   "status"
+#define NAMED_COMMAND_TSIGLIST	   "tsig-list"
+#define NAMED_COMMAND_TSIGDELETE   "tsig-delete"
 #define NAMED_COMMAND_FREEZE	   "freeze"
 #define NAMED_COMMAND_UNFREEZE	   "unfreeze"
 #define NAMED_COMMAND_THAW	   "thaw"
+#define NAMED_COMMAND_TIMERPOKE	   "timerpoke"
 #define NAMED_COMMAND_RECURSING	   "recursing"
 #define NAMED_COMMAND_NULL	   "null"
 #define NAMED_COMMAND_NOTIFY	   "notify"
@@ -69,7 +71,6 @@
 #define NAMED_COMMAND_DNSTAP	   "dnstap"
 #define NAMED_COMMAND_TCPTIMEOUTS  "tcp-timeouts"
 #define NAMED_COMMAND_SERVESTALE   "serve-stale"
-#define NAMED_COMMAND_FETCHLIMIT   "fetchlimit"
 
 isc_result_t
 named_controls_create(named_server_t *server, named_controls_t **ctrlsp);

bin/named/include/named/globals.h

@@ -18,7 +18,6 @@
 #include <stdbool.h>
 
 #include <isc/log.h>
-#include <isc/loop.h>
 #include <isc/net.h>
 #include <isc/netmgr.h>
 #include <isc/rwlock.h>
@@ -26,11 +25,10 @@
 #include <dns/acl.h>
 #include <dns/zone.h>
 
-#include <dst/dst.h>
-
 #include <isccfg/aclconf.h>
 #include <isccfg/cfg.h>
 
+#include <dst/dst.h>
 #include <named/fuzz.h>
 #include <named/types.h>
 
@@ -50,9 +48,8 @@
 
 EXTERN isc_mem_t *named_g_mctx		      INIT(NULL);
 EXTERN unsigned int named_g_cpus	      INIT(0);
-EXTERN isc_loop_t *named_g_mainloop	      INIT(NULL);
-EXTERN isc_loopmgr_t *named_g_loopmgr	      INIT(NULL);
-EXTERN bool named_g_loopmgr_running	      INIT(false);
+EXTERN unsigned int named_g_udpdisp	      INIT(0);
+EXTERN isc_taskmgr_t *named_g_taskmgr	      INIT(NULL);
 EXTERN dns_dispatchmgr_t *named_g_dispatchmgr INIT(NULL);
 EXTERN unsigned int named_g_cpus_detected     INIT(1);
 
@@ -64,19 +61,21 @@ EXTERN bool named_g_run_done INIT(false);
  *         for really short timers, another for client timers, and one
  *         for zone timers.
  */
-EXTERN isc_nm_t *named_g_netmgr	       INIT(NULL);
-EXTERN cfg_parser_t *named_g_parser    INIT(NULL);
-EXTERN cfg_parser_t *named_g_addparser INIT(NULL);
-EXTERN const char *named_g_version     INIT(PACKAGE_VERSION);
-EXTERN const char *named_g_product     INIT(PACKAGE_NAME);
-EXTERN const char *named_g_description INIT(PACKAGE_DESCRIPTION);
-EXTERN const char *named_g_srcid       INIT(PACKAGE_SRCID);
-EXTERN const char *named_g_configargs  INIT(PACKAGE_CONFIGARGS);
-EXTERN const char *named_g_builder     INIT(PACKAGE_BUILDER);
-EXTERN in_port_t named_g_port	       INIT(0);
-EXTERN in_port_t named_g_tlsport       INIT(0);
-EXTERN in_port_t named_g_httpsport     INIT(0);
-EXTERN in_port_t named_g_httpport      INIT(0);
+EXTERN isc_timermgr_t *named_g_timermgr INIT(NULL);
+EXTERN isc_nm_t *named_g_netmgr		INIT(NULL);
+EXTERN cfg_parser_t *named_g_parser	INIT(NULL);
+EXTERN cfg_parser_t *named_g_addparser	INIT(NULL);
+EXTERN const char *named_g_version	INIT(PACKAGE_VERSION);
+EXTERN const char *named_g_product	INIT(PACKAGE_NAME);
+EXTERN const char *named_g_description	INIT(PACKAGE_DESCRIPTION);
+EXTERN const char *named_g_srcid	INIT(PACKAGE_SRCID);
+EXTERN const char *named_g_configargs	INIT(PACKAGE_CONFIGARGS);
+EXTERN const char *named_g_builder	INIT(PACKAGE_BUILDER);
+EXTERN in_port_t named_g_port		INIT(0);
+EXTERN in_port_t named_g_tlsport	INIT(0);
+EXTERN in_port_t named_g_httpsport	INIT(0);
+EXTERN in_port_t named_g_httpport	INIT(0);
+EXTERN isc_dscp_t named_g_dscp		INIT(-1);
 
 EXTERN in_port_t named_g_http_listener_clients INIT(0);
 EXTERN in_port_t named_g_http_streams_per_conn INIT(0);
@@ -97,7 +96,7 @@ EXTERN unsigned int named_g_debuglevel	     INIT(0);
 EXTERN cfg_obj_t *named_g_config	   INIT(NULL);
 EXTERN const cfg_obj_t *named_g_defaults   INIT(NULL);
 EXTERN const char *named_g_conffile	   INIT(NAMED_SYSCONFDIR "/named.conf");
-EXTERN const char *named_g_defaultbindkeys INIT(NULL);
+EXTERN const char *named_g_defaultbindkeys INIT(NAMED_SYSCONFDIR "/bind.keys");
 EXTERN const char *named_g_keyfile	   INIT(NAMED_SYSCONFDIR "/rndc.key");
 
 EXTERN dns_tsigkey_t *named_g_sessionkey    INIT(NULL);
@@ -105,6 +104,14 @@ EXTERN dns_name_t			    named_g_sessionkeyname;
 EXTERN bool named_g_conffileset		    INIT(false);
 EXTERN cfg_aclconfctx_t *named_g_aclconfctx INIT(NULL);
 
+/*
+ * Initial resource limits.
+ */
+EXTERN isc_resourcevalue_t named_g_initstacksize INIT(0);
+EXTERN isc_resourcevalue_t named_g_initdatasize	 INIT(0);
+EXTERN isc_resourcevalue_t named_g_initcoresize	 INIT(0);
+EXTERN isc_resourcevalue_t named_g_initopenfiles INIT(0);
+
 /*
  * Misc.
  */
@@ -118,6 +125,11 @@ EXTERN const char *named_g_logfile   INIT(NULL);
 EXTERN const char *named_g_defaultsessionkeyfile INIT(NAMED_LOCALSTATEDIR
 						      "/run/named/"
 						      "session.key");
+EXTERN const char *named_g_defaultlockfile INIT(NAMED_LOCALSTATEDIR "/run/"
+								    "named/"
+								    "named."
+								    "lock");
+EXTERN bool named_g_forcelock		   INIT(false);
 
 #if NAMED_RUN_PID_DIR
 EXTERN const char *named_g_defaultpidfile INIT(NAMED_LOCALSTATEDIR "/run/named/"

bin/named/include/named/main.h

@@ -24,9 +24,9 @@
 /*
  * Commandline arguments for named;
  */
-#define NAMED_MAIN_ARGS "46A:c:Cd:D:E:fFgL:M:m:n:N:p:sS:t:T:U:u:vVx:X:"
+#define NAMED_MAIN_ARGS "46A:c:d:D:E:fFgL:M:m:n:N:p:sS:t:T:U:u:vVx:X:"
 
-noreturn void
+ISC_NORETURN void
 named_main_earlyfatal(const char *format, ...) ISC_FORMAT_PRINTF(1, 2);
 
 void
@@ -34,6 +34,3 @@ named_main_earlywarning(const char *format, ...) ISC_FORMAT_PRINTF(1, 2);
 
 void
 named_main_setmemstats(const char *);
-
-void
-named_main_shutdown(void *arg, int signum);

bin/named/include/named/os.h

@@ -56,9 +56,15 @@ named_os_openfile(const char *filename, mode_t mode, bool switch_user);
 void
 named_os_writepidfile(const char *filename, bool first_time);
 
+bool
+named_os_issingleton(const char *filename);
+
 void
 named_os_shutdown(void);
 
+isc_result_t
+named_os_gethostname(char *buf, size_t len);
+
 void
 named_os_shutdownmsg(char *command, isc_buffer_t *text);
 

bin/named/include/named/server.h

@@ -21,7 +21,6 @@
 #include <isc/log.h>
 #include <isc/magic.h>
 #include <isc/quota.h>
-#include <isc/signal.h>
 #include <isc/sockaddr.h>
 #include <isc/tls.h>
 #include <isc/types.h>
@@ -38,36 +37,44 @@
 
 #include <named/types.h>
 
+#define NAMED_EVENTCLASS    ISC_EVENTCLASS(0x4E43)
+#define NAMED_EVENT_RELOAD  (NAMED_EVENTCLASS + 0)
+#define NAMED_EVENT_DELZONE (NAMED_EVENTCLASS + 1)
+#define NAMED_EVENT_COMMAND (NAMED_EVENTCLASS + 2)
+#define NAMED_EVENT_TATSEND (NAMED_EVENTCLASS + 3)
+
 /*%
  * Name server state.  Better here than in lots of separate global variables.
  */
 struct named_server {
 	unsigned int magic;
-	isc_mem_t   *mctx;
+	isc_mem_t	  *mctx;
 
 	ns_server_t *sctx;
 
+	isc_task_t *task;
+
 	char *statsfile;    /*%< Statistics file name */
 	char *dumpfile;	    /*%< Dump file name */
 	char *secrootsfile; /*%< Secroots file name */
-	char *bindkeysfile; /*%< bind.keys file name */
+	char *bindkeysfile; /*%< bind.keys file name
+			     * */
 	char *recfile;	    /*%< Recursive file name */
-	bool  version_set;  /*%< User has set version */
+	bool  version_set;  /*%< User has set version
+			     * */
 	char *version;	    /*%< User-specified version */
-	bool  hostname_set; /*%< User has set hostname */
-	char *hostname;	    /*%< User-specified hostname */
-#ifdef USE_DNSRPS
-	char *dnsrpslib;
-#endif /* ifdef USE_DNSRPS */
+	bool  hostname_set; /*%< User has set hostname
+			     * */
+	char *hostname;	    /*%< User-specified hostname
+			     * */
 
 	/* Server data structures. */
-	dns_loadmgr_t	  *loadmgr;
-	dns_zonemgr_t	  *zonemgr;
+	dns_loadmgr_t     *loadmgr;
+	dns_zonemgr_t     *zonemgr;
 	dns_viewlist_t	   viewlist;
 	dns_kasplist_t	   kasplist;
-	dns_keystorelist_t keystorelist;
 	ns_interfacemgr_t *interfacemgr;
-	dns_db_t	  *in_roothints;
+	dns_db_t		 *in_roothints;
 
 	isc_timer_t *interface_timer;
 	isc_timer_t *heartbeat_timer;
@@ -87,15 +94,15 @@ struct named_server {
 	isc_stats_t *resolverstats;  /*% Resolver stats */
 	isc_stats_t *sockstats;	     /*%< Socket stats */
 
-	named_controls_t    *controls; /*%< Control channels */
+	named_controls_t	 *controls; /*%< Control channels */
 	unsigned int	     dispatchgen;
 	named_dispatchlist_t dispatches;
 
 	named_statschannellist_t statschannels;
 
-	dst_key_t     *sessionkey;
-	char	      *session_keyfile;
-	dns_name_t    *session_keyname;
+	dns_tsigkey_t *sessionkey;
+	char	     *session_keyfile;
+	dns_name_t	   *session_keyname;
 	unsigned int   session_keyalg;
 	uint16_t       session_keybits;
 	bool	       interface_auto;
@@ -104,10 +111,10 @@ struct named_server {
 
 	dns_dtenv_t *dtenv; /*%< Dnstap environment */
 
+	char *lockfile;
+
 	isc_tlsctx_cache_t *tlsctx_server_cache;
 	isc_tlsctx_cache_t *tlsctx_client_cache;
-
-	isc_signal_t *sighup;
 };
 
 #define NAMED_SERVER_MAGIC    ISC_MAGIC('S', 'V', 'E', 'R')
@@ -128,7 +135,7 @@ named_server_destroy(named_server_t **serverp);
  */
 
 void
-named_server_reloadwanted(void *arg, int signum);
+named_server_reloadwanted(named_server_t *server);
 /*%<
  * Inform a server that a reload is wanted.  This function
  * may be called asynchronously, from outside the server's task.
@@ -248,6 +255,19 @@ named_server_flushnode(named_server_t *server, isc_lex_t *lex, bool tree);
 isc_result_t
 named_server_status(named_server_t *server, isc_buffer_t **text);
 
+/*%
+ * Report a list of dynamic and static tsig keys, per view.
+ */
+isc_result_t
+named_server_tsiglist(named_server_t *server, isc_buffer_t **text);
+
+/*%
+ * Delete a specific key (with optional view).
+ */
+isc_result_t
+named_server_tsigdelete(named_server_t *server, isc_lex_t *lex,
+			isc_buffer_t **text);
+
 /*%
  * Enable or disable updates for a zone.
  */
@@ -277,6 +297,12 @@ named_server_rekey(named_server_t *server, isc_lex_t *lex, isc_buffer_t **text);
 isc_result_t
 named_server_dumprecursing(named_server_t *server);
 
+/*%
+ * Maintain a list of dispatches that require reserved ports.
+ */
+void
+named_add_reserved_dispatch(named_server_t *server, const isc_sockaddr_t *addr);
+
 /*%
  * Enable or disable dnssec validation.
  */
@@ -368,10 +394,3 @@ named_server_tcptimeouts(isc_lex_t *lex, isc_buffer_t **text);
 isc_result_t
 named_server_servestale(named_server_t *server, isc_lex_t *lex,
 			isc_buffer_t **text);
-
-/*%
- * Report fetch-limited ADB server addresses.
- */
-isc_result_t
-named_server_fetchlimit(named_server_t *server, isc_lex_t *lex,
-			isc_buffer_t **text);

bin/named/include/named/statschannel.h

@@ -18,10 +18,9 @@
  * The statistics channels built-in the name server.
  */
 
-#include <isccc/types.h>
-
 #include <isccfg/aclconf.h>
 
+#include <isccc/types.h>
 #include <named/types.h>
 
 #define NAMED_STATSCHANNEL_HTTPPORT 80

bin/named/include/named/tsigconf.h

@@ -22,7 +22,7 @@ ISC_LANG_BEGINDECLS
 
 isc_result_t
 named_tsigkeyring_fromconfig(const cfg_obj_t *config, const cfg_obj_t *vconfig,
-			     isc_mem_t *mctx, dns_tsigkeyring_t **ringp);
+			     isc_mem_t *mctx, dns_tsig_keyring_t **ringp);
 /*%<
  * Create a TSIG key ring and configure it according to the 'key'
  * statements in the global and view configuration objects.

bin/named/include/named/zoneconf.h

@@ -28,8 +28,8 @@ ISC_LANG_BEGINDECLS
 isc_result_t
 named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 		     const cfg_obj_t *zconfig, cfg_aclconfctx_t *ac,
-		     dns_kasplist_t *kasplist, dns_keystorelist_t *keystores,
-		     dns_zone_t *zone, dns_zone_t *raw);
+		     dns_kasplist_t *kasplist, dns_zone_t *zone,
+		     dns_zone_t *raw);
 /*%<
  * Configure or reconfigure a zone according to the named.conf
  * data.
@@ -46,7 +46,7 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 bool
 named_zone_reusable(dns_zone_t *zone, const cfg_obj_t *zconfig,
 		    const cfg_obj_t *vconfig, const cfg_obj_t *config,
-		    dns_kasplist_t *kasplist);
+		    cfg_aclconfctx_t *actx);
 /*%<
  * If 'zone' can be safely reconfigured according to the configuration
  * data in 'zconfig', return true.  If the configuration data is so
@@ -55,12 +55,12 @@ named_zone_reusable(dns_zone_t *zone, const cfg_obj_t *zconfig,
  */
 
 bool
-named_zone_inlinesigning(const cfg_obj_t *zconfig, const cfg_obj_t *vconfig,
-			 const cfg_obj_t *config, dns_kasplist_t *kasplist);
+named_zone_inlinesigning(dns_zone_t *zone, const cfg_obj_t *zconfig,
+			 const cfg_obj_t *vconfig, const cfg_obj_t *config,
+			 cfg_aclconfctx_t *actx);
 /*%<
  * Determine if zone uses inline-signing. This is true if inline-signing
- * is set to yes, in the zone clause or in the zone's dnssec-policy clause.
- * By default, dnssec-policy uses inline-signing.
+ * is set to yes, or if there is a dnssec-policy on a non-dynamic zone.
  */
 
 isc_result_t