netmgr: add isc_nm_shutdown function which shuts down all active TCP connection but does not destroy netmgr

add functions from netmgr-int.h to libisc.def.in
fixup! fixup! WiP: shutdown active sockets when shutting down netmgr
2019-11-22 23:26:42 +01:00 · 2019-11-22 11:18:00 -08:00 · 2019-11-22 11:17:35 -08:00 · 2019-11-22 10:56:14 -08:00 · 2019-11-22 15:04:49 +01:00 · 2019-11-22 14:41:22 +01:00
170 changed files with 3361 additions and 2518 deletions
@@ -205,6 +205,7 @@ stages:
 .system_test: &system_test_job
  <<: *default_triggering_rules
  stage: system
+  retry: 2
  before_script:
    - *setup_interfaces
    - *setup_softhsm
@@ -677,6 +678,7 @@ unit:gcc:bionic:amd64:
 asan:sid:amd64:
  variables:
    CC: gcc
+    ASAN_OPTIONS: "detect_leaks=0"
    CFLAGS: "${CFLAGS_COMMON} -fsanitize=address,undefined -DISC_MEM_USE_INTERNAL_MALLOC=0"
    LDFLAGS: "-fsanitize=address,undefined"
    EXTRA_CONFIGURE: "--with-libidn2"
@@ -1,35 +1,3 @@
-5332.	[func]		Renamed "dnssec-keys" configuration statement
-			to the more descriptive "trust-anchors".
-
-5331.	[func]		Use compiler-provided mechanisms for thread local
-			storage, and make the requirement for such mechanisms
-			explicit in configure. [GL #1444]
-
-5330.	[bug]		'configure --without-python' was ineffective if
-			PYTHON was set in the environment. [GL #1434]
-
-5329.	[bug]		Reconfiguring named caused memory to be leaked when any
-			GeoIP2 database was in use. [GL #1445]
-
-5328.	[bug]		rbtdb.c:rdataset_{get,set}ownercase failed to obtain
-			a node lock. [GL #1417]
-
-5327.	[func]		Added a statistics counter to track queries
-			dropped because the recursive-clients quota was
-			exceeded. [GL #1399]
-
-5326.	[bug]		Add python dependancy on 'distutils.core' to configure.
-			'distutils.core' is required for installation.
-			[GL #1397]
-
-5325.	[bug]		Addressed several issues with TCP connections in
-			the netmgr: restored support for TCP connection
-			timeouts, restored TCP backlog support, actively
-			close all open sockets during shutdown. [GL #1312]
-
-5324.	[bug]		Change the category of some log messages from general
-			to the more appopriate catergory of xfer-in. [GL #1394]
-
 5323.	[bug]		Fix a bug in DNSSEC trust anchor verification.
 			[GL !2609]

@@ -5,28 +5,16 @@ Supported platforms
 In general, this version of BIND will build and run on any POSIX-compliant
 system with a C11-compliant C compiler, BSD-style sockets with
 RFC-compliant IPv6 support, POSIX-compliant threads, the libuv
-asynchronous I/O library, and the OpenSSL cryptography library.
+asynchronous I/O library, and the OpenSSL cryptography library. Atomic
+operations support from the compiler is needed, either in the form of
+builtin operations, C11 atomics, or the Interlocked family of functions on
+Windows.

-The following C11 features are used in BIND 9:
-
-  * Atomic operations support from the compiler is needed, either in the
-    form of builtin operations, C11 atomics, or the Interlocked family of
-    functions on Windows.
-
-  * Thread Local Storage support from the compiler is needed, either in
-    the form of C11 _Thread_local/thread_local, the __thread GCC
-    extension, or the __declspec(thread) MSVC extension on Windows.
-
-BIND 9.15 requires a fairly recent version of libuv (at least 1.x). For
-some of the older systems listed below, you will have to install an
-updated libuv package from sources such as EPEL, PPA, or other native
-sources for updated packages. The other option is to build and install
-libuv from source.
-
-Certain optional BIND features have additional library dependencies. These
-include libxml2 and libjson-c for statistics, libmaxminddb for
-geolocation, libfstrm and libprotobuf-c for DNSTAP, and libidn2 for
-internationalized domain name conversion.
+BIND 9.15 requires fairly recent version of libuv library to run (>= 1.x).
+For some of the older systems listed below, you will have to install
+updated libuv package from sources such as EPEL, PPA and other native
+sources for updated packages. The other option is to install libuv from
+sources.

 ISC regularly tests BIND on many operating systems and architectures, but
 lacks the resources to test all of them. Consequently, ISC is only able to
@@ -70,10 +58,10 @@ Server 2012 R2, none of these are tested regularly by ISC.

 Community maintained

-These systems may not all have the required dependencies for building BIND
-easily available, although it will be possible in many cases to compile
+These systems may not all have easily available the required dependencies
+for building BIND although it will be possible in many cases to compile
 those directly from source. The community and interested parties may wish
-to help with maintenance, and we welcome patch contributions, although we
+to help with maintenance and we welcome patch contributions, although we
 cannot guarantee that we will accept them. All contributions will be
 assessed against the risk of adverse effect on officially supported
 platforms.
@@ -96,4 +84,6 @@ These are platforms on which BIND 9.15 is known not to build or run:
  * Platforms that don't support atomic operations (via compiler or
    library)
  * Linux without NPTL (Native POSIX Thread Library)
-  * Platforms on which libuv cannot be compiled
+  * Platforms where libuv cannot be compiled
+
+Platform quirks
@@ -13,28 +13,14 @@
 In general, this version of BIND will build and run on any POSIX-compliant
 system with a C11-compliant C compiler, BSD-style sockets with RFC-compliant
 IPv6 support, POSIX-compliant threads, the `libuv` asynchronous I/O library,
-and the OpenSSL cryptography library.
+and the OpenSSL cryptography library.  Atomic operations support from the
+compiler is needed, either in the form of builtin operations, C11 atomics,
+or the `Interlocked` family of functions on Windows.

-The following C11 features are used in BIND 9:
-
-* Atomic operations support from the compiler is needed, either in the form of
-  builtin operations, C11 atomics, or the `Interlocked` family of functions on
-  Windows.
-
-* Thread Local Storage support from the compiler is needed, either in the form
-  of C11 `_Thread_local`/`thread_local`, the `__thread` GCC extension, or
-  the `__declspec(thread)` MSVC extension on Windows.
-
-BIND 9.15 requires a fairly recent version of `libuv` (at least 1.x).  For
-some of the older systems listed below, you will have to install an updated
-`libuv` package from sources such as EPEL, PPA, or other native sources for
-updated packages. The other option is to build and install `libuv` from
-source.
-
-Certain optional BIND features have additional library dependencies.
-These include `libxml2` and `libjson-c` for statistics, `libmaxminddb` for
-geolocation, `libfstrm` and `libprotobuf-c` for DNSTAP, and `libidn2` for
-internationalized domain name conversion.
+BIND 9.15 requires fairly recent version of libuv library to run (>= 1.x).  For
+some of the older systems listed below, you will have to install updated libuv
+package from sources such as EPEL, PPA and other native sources for updated
+packages.  The other option is to install libuv from sources.

 ISC regularly tests BIND on many operating systems and architectures, but
 lacks the resources to test all of them. Consequently, ISC is only able to
@@ -77,13 +63,12 @@ Server 2012 R2, none of these are tested regularly by ISC.

 ### Community maintained

-These systems may not all have the required dependencies for building BIND
-easily available, although it will be possible in many cases to compile
-those directly from source. The community and interested parties may wish
-to help with maintenance, and we welcome patch contributions, although we
-cannot guarantee that we will accept them.  All contributions will be
-assessed against the risk of adverse effect on officially supported
-platforms.
+These systems may not all have easily available the required dependencies for
+building BIND although it will be possible in many cases to compile those
+directly from source. The community and interested parties may wish to help with
+maintenance and we welcome patch contributions, although we cannot guarantee
+that we will accept them.  All contributions will be assessed against the risk
+of adverse effect on officially supported platforms.

 * Platforms past or close to their respective EOL dates, such as:
    * Ubuntu 14.04, 18.10
@@ -102,4 +87,6 @@ These are platforms on which BIND 9.15 is known *not* to build or run:
 * Platforms that don't support IPv6 Advanced Socket API (RFC 3542)
 * Platforms that don't support atomic operations (via compiler or library)
 * Linux without NPTL (Native POSIX Thread Library)
-* Platforms on which `libuv` cannot be compiled
+* Platforms where libuv cannot be compiled
+
+## Platform quirks
@@ -131,8 +131,8 @@ include:
  for zones, enabling automatic key regeneration and rollover.
 * New new network manager based on libuv.
 * Support for the new GeoIP2 geolocation API
-* Improved DNSSEC trust anchor configuration using the `trust-anchors`
-  statement, permitting configuration of trust anchors in DS as well as
+* Improved DNSSEC trust anchor configuration using `dnssec-keys`,
+  permitting configuration of trust anchors in DS as well as
  DNSKEY format.
 * YAML output for `dig`, `mdig`, and `delv`.

@@ -191,11 +191,9 @@ or if you have Xcode already installed you can run `xcode-select --install`.

 Portions of BIND that are written in Python, including
 `dnssec-keymgr`, `dnssec-coverage`, `dnssec-checkds`, and some of the
-system tests, require the `argparse`, `ply` and `distutils.core` modules
-to be available.
+system tests, require the `argparse` and `ply` modules to be available.
 `argparse` is a standard module as of Python 2.7 and Python 3.2.
 `ply` is available from [https://pypi.python.org/pypi/ply](https://pypi.python.org/pypi/ply).
-`distutils.core` is required for installation.

 #### <a name="opts"/> Compile-time options

@@ -709,6 +709,8 @@ main(int argc, char **argv) {

 	cfg_parser_destroy(&parser);

+	dns_name_destroy();
+
 	isc_log_destroy(&logc);

 	isc_mem_destroy(&mctx);
@@ -85,9 +85,9 @@ usage(void) {

 static void
 destroy(void) {
-	if (zone != NULL) {
+	if (zone != NULL)
 		dns_zone_detach(&zone);
-	}
+	dns_name_destroy();
 }

 /*% main processing routine */
@@ -140,7 +140,7 @@ static dns_fixedname_t afn;
 static dns_name_t *anchor_name = NULL;

 /* Default bind.keys contents */
-static char anchortext[] = TRUST_ANCHORS;
+static char anchortext[] = DNSSEC_KEYS;

 /*
 * Static function prototypes
@@ -160,44 +160,43 @@ usage(void) {
 "        q-class  is one of (in,hs,ch,...) [default: in]\n"
 "        q-type   is one of (a,any,mx,ns,soa,hinfo,axfr,txt,...) [default:a]\n"
 "        q-opt    is one of:\n"
-"                 -4                  (use IPv4 query transport only)\n"
-"                 -6                  (use IPv6 query transport only)\n"
+"                 -x dot-notation     (shortcut for reverse lookups)\n"
+"                 -d level            (set debugging level)\n"
 "                 -a anchor-file      (specify root trust anchor)\n"
 "                 -b address[#port]   (bind to source address/port)\n"
-"                 -c class            (option included for compatibility;\n"
-"                 -d level            (set debugging level)\n"
-"                 -h                  (print help and exit)\n"
-"                 -i                  (disable DNSSEC validation)\n"
-"                 -m                  (enable memory usage debugging)\n"
 "                 -p port             (specify port number)\n"
 "                 -q name             (specify query name)\n"
 "                 -t type             (specify query type)\n"
+"                 -c class            (option included for compatibility;\n"
 "                                      only IN is supported)\n"
-"                 -v                  (print version and exit)\n"
-"                 -x dot-notation     (shortcut for reverse lookups)\n"
+"                 -4                  (use IPv4 query transport only)\n"
+"                 -6                  (use IPv6 query transport only)\n"
+"                 -i                  (disable DNSSEC validation)\n"
+"                 -m                  (enable memory usage debugging)\n"
 "        d-opt    is of the form +keyword[=value], where keyword is:\n"
 "                 +[no]all            (Set or clear all display flags)\n"
 "                 +[no]class          (Control display of class)\n"
-"                 +[no]comments       (Control display of comment lines)\n"
 "                 +[no]crypto         (Control display of cryptographic\n"
 "                                      fields in records)\n"
-"                 +[no]dlv            (Obsolete)\n"
-"                 +[no]dnssec         (Display DNSSEC records)\n"
-"                 +[no]mtrace         (Trace messages received)\n"
 "                 +[no]multiline      (Print records in an expanded format)\n"
-"                 +[no]root           (DNSSEC validation trust anchor)\n"
+"                 +[no]comments       (Control display of comment lines)\n"
 "                 +[no]rrcomments     (Control display of per-record "
 				       "comments)\n"
-"                 +[no]rtrace         (Trace resolver fetches)\n"
+"                 +[no]unknownformat  (Print RDATA in RFC 3597 "
+					"\"unknown\" format)\n"
 "                 +[no]short          (Short form answer)\n"
 "                 +[no]split=##       (Split hex/base64 fields into chunks)\n"
 "                 +[no]tcp            (TCP mode)\n"
 "                 +[no]ttl            (Control display of ttls in records)\n"
 "                 +[no]trust          (Control display of trust level)\n"
-"                 +[no]unknownformat  (Print RDATA in RFC 3597 "
-					"\"unknown\" format)\n"
+"                 +[no]rtrace         (Trace resolver fetches)\n"
+"                 +[no]mtrace         (Trace messages received)\n"
 "                 +[no]vtrace         (Trace validation process)\n"
-"                 +[no]yaml           (Present the results as YAML)\n",
+"                 +[no]dlv            (Obsolete)\n"
+"                 +[no]root           (DNSSEC validation trust anchor)\n"
+"                 +[no]dnssec         (Display DNSSEC records)\n"
+"        -h                           (print help and exit)\n"
+"        -v                           (print version and exit)\n",
 	stderr);
 	exit(1);
 }
@@ -498,17 +497,14 @@ printdata(dns_rdataset_t *rdataset, dns_name_t *owner,
 				dns_rdata_reset(&rdata);
 			}
 		} else {
-			dns_indent_t indent = { "  ", 2 };
 			if (!yaml && (rdataset->attributes &
 				      DNS_RDATASETATTR_NEGATIVE) != 0)
 			{
 				isc_buffer_putstr(&target, "; ");
 			}
+
 			result = dns_master_rdatasettotext(owner, rdataset,
-							   style,
-							   yaml ? &indent :
-								  NULL,
-							   &target);
+							   style, &target);
 		}

 		if (result == ISC_R_NOSPACE) {
@@ -540,6 +536,8 @@ setup_style(dns_master_style_t **stylep) {
 	styleflags |= DNS_STYLEFLAG_REL_OWNER;
 	if (yaml) {
 		styleflags |= DNS_STYLEFLAG_YAML;
+		dns_master_indentstr = "  ";
+		dns_master_indent = 2;
 	} else {
 		if (showcomments) {
 			styleflags |= DNS_STYLEFLAG_COMMENT;
@@ -614,7 +612,7 @@ static isc_result_t
 key_fromconfig(const cfg_obj_t *key, dns_client_t *client) {
 	dns_rdata_dnskey_t dnskey;
 	dns_rdata_ds_t ds;
-	uint32_t rdata1, rdata2, rdata3;
+	uint32_t n1, n2, n3;
 	const char *datastr = NULL, *keynamestr = NULL, *atstr = NULL;
 	unsigned char data[4096];
 	isc_buffer_t databuf;
@@ -655,13 +653,13 @@ key_fromconfig(const cfg_obj_t *key, dns_client_t *client) {
 	delv_log(ISC_LOG_DEBUG(3), "adding trust anchor %s", trust_anchor);

 	/* if DNSKEY, flags; if DS, key tag */
-	rdata1 = cfg_obj_asuint32(cfg_tuple_get(key, "rdata1"));
+	n1 = cfg_obj_asuint32(cfg_tuple_get(key, "n1"));

 	/* if DNSKEY, protocol; if DS, algorithm */
-	rdata2 = cfg_obj_asuint32(cfg_tuple_get(key, "rdata2"));
+	n2 = cfg_obj_asuint32(cfg_tuple_get(key, "n2"));

 	/* if DNSKEY, algorithm; if DS, digest type */
-	rdata3 = cfg_obj_asuint32(cfg_tuple_get(key, "rdata3"));
+	n3 = cfg_obj_asuint32(cfg_tuple_get(key, "n3"));

 	/* What type of trust anchor is this? */
 	atstr = cfg_obj_asstring(cfg_tuple_get(key, "anchortype"));
@@ -684,13 +682,13 @@ key_fromconfig(const cfg_obj_t *key, dns_client_t *client) {
 	isc_buffer_init(&databuf, data, sizeof(data));
 	isc_buffer_init(&rrdatabuf, rrdata, sizeof(rrdata));

-	if (rdata1 > 0xffff) {
+	if (n1 > 0xffff) {
 		CHECK(ISC_R_RANGE);
 	}
-	if (rdata2 > 0xff) {
+	if (n2 > 0xff) {
 		CHECK(ISC_R_RANGE);
 	}
-	if (rdata3 > 0xff) {
+	if (n3 > 0xff) {
 		CHECK(ISC_R_RANGE);
 	}

@@ -704,9 +702,9 @@ key_fromconfig(const cfg_obj_t *key, dns_client_t *client) {

 		ISC_LINK_INIT(&dnskey.common, link);

-		dnskey.flags = (uint16_t)rdata1;
-		dnskey.protocol = (uint8_t)rdata2;
-		dnskey.algorithm = (uint8_t)rdata3;
+		dnskey.flags = (uint16_t)n1;
+		dnskey.protocol = (uint8_t)n2;
+		dnskey.algorithm = (uint8_t)n3;

 		datastr = cfg_obj_asstring(cfg_tuple_get(key, "data"));
 		CHECK(isc_base64_decodestring(datastr, &databuf));
@@ -729,9 +727,9 @@ key_fromconfig(const cfg_obj_t *key, dns_client_t *client) {

 		ISC_LINK_INIT(&ds.common, link);

-		ds.key_tag = (uint16_t)rdata1;
-		ds.algorithm = (uint8_t)rdata2;
-		ds.digest_type = (uint8_t)rdata3;
+		ds.key_tag = (uint16_t)n1;
+		ds.algorithm = (uint8_t)n2;
+		ds.digest_type = (uint8_t)n3;

 		datastr = cfg_obj_asstring(cfg_tuple_get(key, "data"));
 		CHECK(isc_hex_decodestring(datastr, &databuf));
@@ -819,7 +817,7 @@ setup_dnsseckeys(dns_client_t *client) {
 	cfg_parser_t *parser = NULL;
 	const cfg_obj_t *trusted_keys = NULL;
 	const cfg_obj_t *managed_keys = NULL;
-	const cfg_obj_t *trust_anchors = NULL;
+	const cfg_obj_t *dnssec_keys = NULL;
 	cfg_obj_t *bindkeys = NULL;
 	const char *filename = anchorfile;

@@ -878,7 +876,7 @@ setup_dnsseckeys(dns_client_t *client) {
 	INSIST(bindkeys != NULL);
 	cfg_map_get(bindkeys, "trusted-keys", &trusted_keys);
 	cfg_map_get(bindkeys, "managed-keys", &managed_keys);
-	cfg_map_get(bindkeys, "trust-anchors", &trust_anchors);
+	cfg_map_get(bindkeys, "dnssec-keys", &dnssec_keys);

 	if (trusted_keys != NULL) {
 		CHECK(load_keys(trusted_keys, client));
@@ -886,8 +884,8 @@ setup_dnsseckeys(dns_client_t *client) {
 	if (managed_keys != NULL) {
 		CHECK(load_keys(managed_keys, client));
 	}
-	if (trust_anchors != NULL) {
-		CHECK(load_keys(trust_anchors, client));
+	if (dnssec_keys != NULL) {
+		CHECK(load_keys(dnssec_keys, client));
 	}
 	result = ISC_R_SUCCESS;

@@ -215,7 +215,7 @@
 	  </para>
 	  <para>
 	    Note: When reading the trust anchor file,
-	    <command>delv</command> treats <option>trust-anchors</option>
+	    <command>delv</command> treats <option>dnssec-keys</option>
 	    <option>initial-key</option> and <option>static-key</option>
 	    entries identically.  That is, even if a key is configured
 	    with <command>initial-key</command>, indicating that it is
@@ -239,7 +239,6 @@ help(void) {
 "                 +[no]unknownformat  (Print RDATA in RFC 3597 \"unknown\" "
 					"format)\n"
 "                 +[no]vc             (TCP mode (+[no]tcp))\n"
-"                 +[no]yaml           (Present the results as YAML)\n"
 "                 +[no]zflag          (Set Z flag in query)\n"
 "        global d-opts and servers (before host name) affect all queries.\n"
 "        local d-opts and servers (after host name) affect only that lookup.\n"
@@ -487,8 +486,8 @@ printmessage(dig_query_t *query, const isc_buffer_t *msgbuf,

 	styleflags |= DNS_STYLEFLAG_REL_OWNER;
 	if (yaml) {
-		msg->indent.string = "  ";
-		msg->indent.count = 3;
+		dns_master_indentstr = "  ";
+		dns_master_indent = 3;
 		styleflags |= DNS_STYLEFLAG_YAML;
 	} else {
 		if (query->lookup->comments) {
@@ -4252,6 +4252,7 @@ destroy_libs(void) {
 	result = dns_name_settotextfilter(NULL);
 	check_result(result, "dns_name_settotextfilter");
 #endif /* HAVE_LIBIDN2 */
+	dns_name_destroy();

 	if (commctx != NULL) {
 		debug("freeing commctx");
@@ -372,7 +372,7 @@ formatset(dns_rdataset_t *rdataset) {

 	result = isc_buffer_allocate(mctx, &buf, MAX_CDS_RDATA_TEXT_SIZE);
 	check_result(result, "printing DS records");
-	result = dns_master_rdatasettotext(name, rdataset, style, NULL, buf);
+	result = dns_master_rdatasettotext(name, rdataset, style, buf);

 	if ((result == ISC_R_SUCCESS) && isc_buffer_availablelength(buf) < 1) {
 		result = ISC_R_NOSPACE;
@@ -517,6 +517,7 @@ main(int argc, char **argv) {
 	}
 	cleanup_logging(&log);
 	dst_lib_destroy();
+	dns_name_destroy();
 	if (verbose > 10) {
 		isc_mem_stats(mctx, stdout);
 	}
@@ -439,6 +439,7 @@ main(int argc, char **argv) {
 		dns_rdataset_disassociate(&rdataset);
 	cleanup_logging(&log);
 	dst_lib_destroy();
+	dns_name_destroy();
 	if (verbose > 10)
 		isc_mem_stats(mctx, stdout);
 	isc_mem_destroy(&mctx);
@@ -694,6 +694,7 @@ main(int argc, char **argv) {

 	cleanup_logging(&log);
 	dst_lib_destroy();
+	dns_name_destroy();
 	if (verbose > 10)
 		isc_mem_stats(mctx, stdout);
 	isc_mem_free(mctx, label);
@@ -1222,6 +1222,7 @@ main(int argc, char **argv) {

 	cleanup_logging(&log);
 	dst_lib_destroy();
+	dns_name_destroy();
 	if (verbose > 10)
 		isc_mem_stats(mctx, stdout);
 	isc_mem_destroy(&mctx);
@@ -246,8 +246,7 @@ dumpnode(dns_name_t *name, dns_dbnode_t *node) {

 		for (;;) {
 			result = dns_master_rdatasettotext(name, &rds,
-							   masterstyle, NULL,
-							   buffer);
+							   masterstyle, buffer);
 			if (result != ISC_R_NOSPACE)
 				break;

@@ -3922,6 +3921,7 @@ main(int argc, char *argv[]) {

 	cleanup_logging(&log);
 	dst_lib_destroy();
+	dns_name_destroy();
 	if (verbose > 10)
 		isc_mem_stats(mctx, stdout);
 	isc_mem_destroy(&mctx);
@@ -335,6 +335,7 @@ main(int argc, char *argv[]) {

 	cleanup_logging(&log);
 	dst_lib_destroy();
+	dns_name_destroy();
 	if (verbose > 10)
 		isc_mem_stats(mctx, stdout);
 	isc_mem_destroy(&mctx);
@@ -296,7 +296,7 @@ view \"_bind\" chaos {\n\
 # BEGIN DNSSEC KEYS\n"

 /* Imported from bind.keys.h: */
-TRUST_ANCHORS
+DNSSEC_KEYS

 "# END MANAGED KEYS\n\
 \n\
@@ -800,7 +800,10 @@ named_config_getipandkeylist(const cfg_obj_t *config, const cfg_obj_t *list,
 					   dns_rootname, 0, NULL);
 		if (result != ISC_R_SUCCESS)
 			goto cleanup;
-		dns_name_dup(dns_fixedname_name(&fname), mctx, keys[i - 1]);
+		result = dns_name_dup(dns_fixedname_name(&fname), mctx,
+				      keys[i - 1]);
+		if (result != ISC_R_SUCCESS)
+			goto cleanup;
 	}
 	if (pushed != 0) {
 		pushed--;
@@ -113,7 +113,8 @@ named_geoip_load(char *dir) {
 #endif
 }

-void named_geoip_unload(void) {
+void
+named_geoip_shutdown(void) {
 #ifdef HAVE_GEOIP2
 	if (named_g_geoip->country != NULL) {
 		MMDB_close(named_g_geoip->country);
@@ -135,12 +136,7 @@ void named_geoip_unload(void) {
 		MMDB_close(named_g_geoip->domain);
 		named_g_geoip->domain = NULL;
 	}
-#endif
-}
-
-void
-named_geoip_shutdown(void) {
-#ifdef HAVE_GEOIP2
-	named_geoip_unload();
 #endif /* HAVE_GEOIP2 */
+
+	dns_geoip_shutdown();
 }
@@ -19,8 +19,5 @@ named_geoip_init(void);
 void
 named_geoip_load(char *dir);

-void
-named_geoip_unload(void);
-
 void
 named_geoip_shutdown(void);
@@ -116,7 +116,7 @@ LIBDNS_EXTERNAL_DATA extern unsigned int dns_zone_mkey_month;
 static bool	want_stats = false;
 static char		program_name[NAME_MAX] = "named";
 static char		absolute_conffile[PATH_MAX];
-static char		saved_command_line[4096] = { 0 };
+static char		saved_command_line[8192] =  { 0 };
 static char		ellipsis[5] = { 0 };
 static char		version[512];
 static unsigned int	maxsocks = 0;
@@ -939,23 +939,17 @@ create_managers(void) {
 static void
 destroy_managers(void) {
 	/*
-	 * isc_nm_closedown() closes all active connections, freeing
-	 * attached clients and other resources and preventing new
-	 * connections from being established, but it not does not
-	 * stop all processing or destroy the netmgr yet.
+	 * isc_nm_shutdown closes all active connections, freeing attached
+	 * clients and all other resources - but not does not shutdown the
+	 * processing yet.
 	 */
-	isc_nm_closedown(named_g_nm);
-
+	isc_nm_shutdown(named_g_nm);
 	/*
-	 * isc_taskmgr_destroy() will block until all tasks have exited.
+	 * isc_taskmgr_destroy() will block until all tasks have exited,
 	 */
 	isc_taskmgr_destroy(&named_g_taskmgr);
 	isc_timermgr_destroy(&named_g_timermgr);
 	isc_socketmgr_destroy(&named_g_socketmgr);
-
-	/*
-	 * At this point is safe to destroy the netmgr.
-	 */
 	isc_nm_destroy(&named_g_nm);
 }

@@ -1329,6 +1323,8 @@ cleanup(void) {
 	dlz_dlopen_clear();
 #endif

+	dns_name_destroy();
+
 	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 		      NAMED_LOGMODULE_MAIN,
 		      ISC_LOG_NOTICE, "exiting");
@@ -1441,10 +1437,6 @@ main(int argc, char *argv[]) {
 	setvbuf(stderr, NULL, _IOFBF, BUFSIZ);
 #endif

-#ifdef HAVE_LIBXML2
-	xmlInitThreads();
-#endif /* HAVE_LIBXML2 */
-
 	/*
 	 * Record version in core image.
 	 * strings named.core | grep "named version:"
@@ -1577,10 +1569,6 @@ main(int argc, char *argv[]) {

 	named_os_shutdown();

-#ifdef HAVE_LIBXML2
-	xmlCleanupThreads();
-#endif /* HAVE_LIBXML2 */
-
 #ifdef HAVE_GPERFTOOLS_PROFILER
 	ProfilerStop();
 #endif
@@ -110,6 +110,15 @@ dlz <replaceable>string</replaceable> {
 </literallayout>
  </refsection>

+  <refsection><info><title>DNSSEC-KEYS</title></info>
+    <literallayout class="normal">
+dnssec-keys { <replaceable>string</replaceable> ( static-key |
+    initial-key | static-ds | initial-ds )
+    <replaceable>integer</replaceable> <replaceable>integer</replaceable> <replaceable>integer</replaceable>
+    <replaceable>quoted_string</replaceable>; ... };
+</literallayout>
+  </refsection>
+
  <refsection><info><title>DYNDB</title></info>
    <literallayout class="normal">
 dyndb <replaceable>string</replaceable> <replaceable>quoted_string</replaceable> {
@@ -147,7 +156,7 @@ logging {
  </refsection>

  <refsection><info><title>MANAGED-KEYS</title></info>
-  <para>Deprecated - see TRUST-ANCHORS.</para>
+  <para>Deprecated - see DNSSEC-KEYS.</para>
    <literallayout class="normal">
 managed-keys { <replaceable>string</replaceable> ( static-key
    | initial-key | static-ds |
@@ -518,17 +527,8 @@ statistics-channels {
 </literallayout>
  </refsection>

-  <refsection><info><title>TRUST-ANCHORS</title></info>
-    <literallayout class="normal">
-trust-anchors { <replaceable>string</replaceable> ( static-key |
-    initial-key | static-ds | initial-ds )
-    <replaceable>integer</replaceable> <replaceable>integer</replaceable> <replaceable>integer</replaceable>
-    <replaceable>quoted_string</replaceable>; ... };
-</literallayout>
-  </refsection>
-
  <refsection><info><title>TRUSTED-KEYS</title></info>
-  <para>Deprecated - see TRUST-ANCHORS.</para>
+  <para>Deprecated - see DNSSEC-KEYS.</para>
    <literallayout class="normal">
 trusted-keys { <replaceable>string</replaceable> <replaceable>integer</replaceable>
    <replaceable>integer</replaceable> <replaceable>integer</replaceable>
@@ -607,6 +607,10 @@ view <replaceable>string</replaceable> [ <replaceable>class</replaceable> ] {
 	dnsrps-options { <replaceable>unspecified-text</replaceable> };
 	dnssec-accept-expired <replaceable>boolean</replaceable>;
 	dnssec-dnskey-kskonly <replaceable>boolean</replaceable>;
+	dnssec-keys { <replaceable>string</replaceable> ( static-key |
+	    initial-key | static-ds | initial-ds
+	    ) <replaceable>integer</replaceable> <replaceable>integer</replaceable> <replaceable>integer</replaceable>
+	    <replaceable>quoted_string</replaceable>; ... };
 	dnssec-loadkeys-interval <replaceable>integer</replaceable>;
 	dnssec-must-be-secure <replaceable>string</replaceable> <replaceable>boolean</replaceable>;
 	dnssec-secure-to-insecure <replaceable>boolean</replaceable>;
@@ -797,10 +801,6 @@ view <replaceable>string</replaceable> [ <replaceable>class</replaceable> ] {
 	transfer-source-v6 ( <replaceable>ipv6_address</replaceable> | * ) [ port ( <replaceable>integer</replaceable> | * )
 	    ] [ dscp <replaceable>integer</replaceable> ];
 	trust-anchor-telemetry <replaceable>boolean</replaceable>; // experimental
-	trust-anchors { <replaceable>string</replaceable> ( static-key |
-	    initial-key | static-ds | initial-ds
-	    ) <replaceable>integer</replaceable> <replaceable>integer</replaceable> <replaceable>integer</replaceable>
-	    <replaceable>quoted_string</replaceable>; ... };
 	trusted-keys { <replaceable>string</replaceable>
 	    <replaceable>integer</replaceable> <replaceable>integer</replaceable>
 	    <replaceable>integer</replaceable>
@@ -68,7 +68,6 @@
 #include <dns/events.h>
 #include <dns/forward.h>
 #include <dns/fixedname.h>
-#include <dns/geoip.h>
 #include <dns/journal.h>
 #include <dns/kasp.h>
 #include <dns/keytable.h>
@@ -202,8 +201,8 @@

 #define CHECKFATAL(op, msg) \
 	do { result = (op);					  \
-		if (result != ISC_R_SUCCESS)			  \
-			fatal(server, msg, result);		  \
+	       if (result != ISC_R_SUCCESS)			  \
+			fatal(msg, result);			  \
 	} while (0)						  \

 /*%
@@ -432,8 +431,7 @@ const char *empty_zones[] = {
 };

 ISC_PLATFORM_NORETURN_PRE static void
-fatal(named_server_t *server,const char *msg, isc_result_t result)
-ISC_PLATFORM_NORETURN_POST;
+fatal(const char *msg, isc_result_t result) ISC_PLATFORM_NORETURN_POST;

 static void
 named_server_reload(isc_task_t *task, isc_event_t *event);
@@ -705,7 +703,7 @@ ta_fromconfig(const cfg_obj_t *key, bool *initialp, dst_key_t **keyp,
 {
 	dns_rdata_dnskey_t keystruct;
 	dns_rdata_ds_t *ds = NULL;
-	uint32_t rdata1, rdata2, rdata3;
+	uint32_t n1, n2, n3;
 	const char *datastr = NULL, *namestr = NULL;
 	unsigned char data[4096];
 	isc_buffer_t databuf;
@@ -731,13 +729,13 @@ ta_fromconfig(const cfg_obj_t *key, bool *initialp, dst_key_t **keyp,
 	REQUIRE(namestrp != NULL && *namestrp == NULL);

 	/* if DNSKEY, flags; if DS, key tag */
-	rdata1 = cfg_obj_asuint32(cfg_tuple_get(key, "rdata1"));
+	n1 = cfg_obj_asuint32(cfg_tuple_get(key, "n1"));

 	/* if DNSKEY, protocol; if DS, algorithm */
-	rdata2 = cfg_obj_asuint32(cfg_tuple_get(key, "rdata2"));
+	n2 = cfg_obj_asuint32(cfg_tuple_get(key, "n2"));

 	/* if DNSKEY, algorithm; if DS, digest type */
-	rdata3 = cfg_obj_asuint32(cfg_tuple_get(key, "rdata3"));
+	n3 = cfg_obj_asuint32(cfg_tuple_get(key, "n3"));

 	namestr = cfg_obj_asstring(cfg_tuple_get(key, "name"));
 	*namestrp = namestr;
@@ -793,22 +791,22 @@ ta_fromconfig(const cfg_obj_t *key, bool *initialp, dst_key_t **keyp,

 		ISC_LINK_INIT(&keystruct.common, link);

-		if (rdata1 > 0xffff) {
+		if (n1 > 0xffff) {
 			CHECKM(ISC_R_RANGE, "key flags");
 		}
-		if (rdata1 & DNS_KEYFLAG_REVOKE) {
+		if (n1 & DNS_KEYFLAG_REVOKE) {
 			CHECKM(DST_R_BADKEYTYPE, "key flags revoke bit set");
 		}
-		if (rdata2 > 0xff) {
+		if (n2 > 0xff) {
 			CHECKM(ISC_R_RANGE, "key protocol");
 		}
-		if (rdata3> 0xff) {
+		if (n3> 0xff) {
 			CHECKM(ISC_R_RANGE, "key algorithm");
 		}

-		keystruct.flags = (uint16_t)rdata1;
-		keystruct.protocol = (uint8_t)rdata2;
-		keystruct.algorithm = (uint8_t)rdata3;
+		keystruct.flags = (uint16_t)n1;
+		keystruct.protocol = (uint8_t)n2;
+		keystruct.algorithm = (uint8_t)n3;

 		datastr = cfg_obj_asstring(cfg_tuple_get(key, "data"));
 		CHECK(isc_base64_decodestring(datastr, &databuf));
@@ -834,19 +832,19 @@ ta_fromconfig(const cfg_obj_t *key, bool *initialp, dst_key_t **keyp,

 		ISC_LINK_INIT(&ds->common, link);

-		if (rdata1 > 0xffff) {
+		if (n1 > 0xffff) {
 			CHECKM(ISC_R_RANGE, "key tag");
 		}
-		if (rdata2 > 0xff) {
+		if (n2 > 0xff) {
 			CHECKM(ISC_R_RANGE, "key algorithm");
 		}
-		if (rdata3 > 0xff) {
+		if (n3 > 0xff) {
 			CHECKM(ISC_R_RANGE, "digest type");
 		}

-		ds->key_tag = (uint16_t)rdata1;
-		ds->algorithm = (uint8_t)rdata2;
-		ds->digest_type = (uint8_t)rdata3;
+		ds->key_tag = (uint16_t)n1;
+		ds->algorithm = (uint8_t)n2;
+		ds->digest_type = (uint8_t)n3;

 		datastr = cfg_obj_asstring(cfg_tuple_get(key, "data"));
 		CHECK(isc_hex_decodestring(datastr, &databuf));
@@ -868,14 +866,6 @@ ta_fromconfig(const cfg_obj_t *key, bool *initialp, dst_key_t **keyp,
 				CHECK(ISC_R_UNEXPECTEDEND);
 			}
 			break;
-		default:
-			cfg_obj_log(key, named_g_lctx, ISC_LOG_ERROR,
-				    "key '%s': "
-				    "unknown ds digest type %u",
-				    namestr, ds->digest_type);
-			result = ISC_R_FAILURE;
-			goto cleanup;
-			break;
 		}

 		ds->mctx = mctx;
@@ -1020,7 +1010,7 @@ process_key(const cfg_obj_t *key, dns_keytable_t *secroots,
 	}

 	/*
-	 * Add the key to 'secroots'.  Keys from a "trust-anchors" or
+	 * Add the key to 'secroots'.  Keys from a "dnssec-keys" or
 	 * "managed-keys" statement may be either static or initializing
 	 * keys. If it's not initializing, we don't want to treat it as
 	 * managed, so we use 'initializing' twice here, for both the
@@ -1132,9 +1122,9 @@ configure_view_dnsseckeys(dns_view_t *view, const cfg_obj_t *vconfig,
 	const cfg_obj_t *view_keys = NULL;
 	const cfg_obj_t *global_keys = NULL;
 	const cfg_obj_t *view_managed_keys = NULL;
-	const cfg_obj_t *view_trust_anchors = NULL;
+	const cfg_obj_t *view_dnssec_keys = NULL;
 	const cfg_obj_t *global_managed_keys = NULL;
-	const cfg_obj_t *global_trust_anchors = NULL;
+	const cfg_obj_t *global_dnssec_keys = NULL;
 	const cfg_obj_t *maps[4];
 	const cfg_obj_t *voptions = NULL;
 	const cfg_obj_t *options = NULL;
@@ -1155,11 +1145,11 @@ configure_view_dnsseckeys(dns_view_t *view, const cfg_obj_t *vconfig,
 			(void) cfg_map_get(voptions, "trusted-keys",
 					   &view_keys);

-			/* managed-keys and trust-anchors are synonyms. */
+			/* managed-keys and dnssec-keys are synonyms. */
 			(void) cfg_map_get(voptions, "managed-keys",
 					   &view_managed_keys);
-			(void) cfg_map_get(voptions, "trust-anchors",
-					   &view_trust_anchors);
+			(void) cfg_map_get(voptions, "dnssec-keys",
+					   &view_dnssec_keys);

 			maps[i++] = voptions;
 		}
@@ -1168,10 +1158,9 @@ configure_view_dnsseckeys(dns_view_t *view, const cfg_obj_t *vconfig,
 	if (config != NULL) {
 		(void)cfg_map_get(config, "trusted-keys", &global_keys);

-		/* managed-keys and trust-anchors are synonyms. */
+		/* managed-keys and dnssec-keys are synonyms. */
 		(void)cfg_map_get(config, "managed-keys", &global_managed_keys);
-		(void)cfg_map_get(config, "trust-anchors",
-				  &global_trust_anchors);
+		(void)cfg_map_get(config, "dnssec-keys", &global_dnssec_keys);

 		(void)cfg_map_get(config, "options", &options);
 		if (options != NULL) {
@@ -1203,7 +1192,7 @@ configure_view_dnsseckeys(dns_view_t *view, const cfg_obj_t *vconfig,

 		/*
 		 * If bind.keys exists and is populated, it overrides
-		 * the trust-anchors clause hard-coded in named_g_config.
+		 * the dnssec-keys clause hard-coded in named_g_config.
 		 */
 		if (bindkeys != NULL) {
 			isc_log_write(named_g_lctx, DNS_LOGCATEGORY_SECURITY,
@@ -1212,7 +1201,7 @@ configure_view_dnsseckeys(dns_view_t *view, const cfg_obj_t *vconfig,
 				      "from '%s'",
 				      view->name, named_g_server->bindkeysfile);

-			(void)cfg_map_get(bindkeys, "trust-anchors",
+			(void)cfg_map_get(bindkeys, "dnssec-keys",
 					  &builtin_keys);

 			if (builtin_keys == NULL) {
@@ -1232,7 +1221,7 @@ configure_view_dnsseckeys(dns_view_t *view, const cfg_obj_t *vconfig,
 				      "using built-in root key for view %s",
 				      view->name);

-			(void)cfg_map_get(named_g_config, "trust-anchors",
+			(void)cfg_map_get(named_g_config, "dnssec-keys",
 					  &builtin_keys);
 		}

@@ -1252,13 +1241,13 @@ configure_view_dnsseckeys(dns_view_t *view, const cfg_obj_t *vconfig,

 	if (view->rdclass == dns_rdataclass_in) {
 		CHECK(load_view_keys(view_keys, view, false, NULL, mctx));
-		CHECK(load_view_keys(view_trust_anchors, view, true, NULL,
+		CHECK(load_view_keys(view_dnssec_keys, view, true, NULL,
 				     mctx));
 		CHECK(load_view_keys(view_managed_keys, view, true, NULL,
 				     mctx));

 		CHECK(load_view_keys(global_keys, view, false, NULL, mctx));
-		CHECK(load_view_keys(global_trust_anchors, view, true,
+		CHECK(load_view_keys(global_dnssec_keys, view, true,
 				     NULL, mctx));
 		CHECK(load_view_keys(global_managed_keys, view, true,
 				     NULL, mctx));
@@ -7413,7 +7402,7 @@ configure_session_key(const cfg_obj_t **maps, named_server_t *server,
 		server->session_keyname = isc_mem_get(mctx,
 						      sizeof(dns_name_t));
 		dns_name_init(server->session_keyname, NULL);
-		dns_name_dup(keyname, mctx, server->session_keyname);
+		CHECK(dns_name_dup(keyname, mctx, server->session_keyname));

 		server->session_keyfile = isc_mem_strdup(mctx, keyfile);

@@ -8348,11 +8337,6 @@ load_configuration(const char *filename, named_server_t *server,
 	isc_socketmgr_setreserved(named_g_socketmgr, reserved);

 #if defined(HAVE_GEOIP2)
-	/*
-	 * Release any previously opened GeoIP2 databases.
-	 */
-	named_geoip_unload();
-
 	/*
 	 * Initialize GeoIP databases from the configured location.
 	 * This should happen before configuring any ACLs, so that we
@@ -9752,6 +9736,9 @@ shutdown_server(isc_task_t *task, isc_event_t *event) {
 		dns_tsigkey_detach(&named_g_sessionkey);
 		dns_name_free(&named_g_sessionkeyname, server->mctx);
 	}
+#ifdef HAVE_DNSTAP
+	dns_dt_shutdown();
+#endif
 #if defined(HAVE_GEOIP2)
 	named_geoip_shutdown();
 #endif /* HAVE_GEOIP2 */
@@ -9818,7 +9805,7 @@ named_server_create(isc_mem_t *mctx, named_server_t **serverp) {
 	named_server_t *server = isc_mem_get(mctx, sizeof(*server));

 	if (server == NULL)
-		fatal(server, "allocating server object", ISC_R_NOMEMORY);
+		fatal("allocating server object", ISC_R_NOMEMORY);

 	server->mctx = mctx;
 	server->task = NULL;
@@ -9875,7 +9862,7 @@ named_server_create(isc_mem_t *mctx, named_server_t **serverp) {
 	/*
 	 * GeoIP must be initialized before the interface
 	 * manager (which includes the ACL environment)
-	 * is created.
+	 * is created
 	 */
 	named_geoip_init();
 #endif /* HAVE_GEOIP2 */
@@ -10029,15 +10016,7 @@ named_server_destroy(named_server_t **serverp) {
 }

 static void
-fatal(named_server_t *server, const char *msg, isc_result_t result) {
-	if (server != NULL) {
-		/*
-		 * Prevent races between the OpenSSL on_exit registered
-		 * function and any other OpenSSL calls from other tasks
-		 * by requesting exclusive access to the task manager.
-		 */
-		(void)isc_task_beginexclusive(server->task);
-	}
+fatal(const char *msg, isc_result_t result) {
 	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 		      NAMED_LOGMODULE_SERVER, ISC_LOG_CRITICAL,
 		      "%s: %s", msg, isc_result_totext(result));
@@ -324,9 +324,6 @@ init_desc(void) {
 		       "QryUsedStale");
 	SET_NSSTATDESC(prefetch, "queries triggered prefetch", "Prefetch");
 	SET_NSSTATDESC(keytagopt, "Keytag option received", "KeyTagOpt");
-	SET_NSSTATDESC(reclimitdropped,
-		       "queries dropped due to recursive client limit",
-		       "RecLimitDropped");

 	INSIST(i == ns_statscounter_max);

@@ -3593,6 +3590,10 @@ named_statschannels_configure(named_server_t *server, const cfg_obj_t *config,

 	ISC_LIST_INIT(new_listeners);

+#ifdef HAVE_LIBXML2
+	xmlInitThreads();
+#endif /* HAVE_LIBXML2 */
+
 	/*
 	 * Get the list of named.conf 'statistics-channels' statements.
 	 */
@@ -3725,6 +3726,10 @@ named_statschannels_shutdown(named_server_t *server) {
 		ISC_LIST_UNLINK(server->statschannels, listener, link);
 		shutdown_listener(listener);
 	}
+
+#ifdef HAVE_LIBXML2
+	xmlCleanupThreads();
+#endif /* HAVE_LIBXML2 */
 }

 isc_result_t
@@ -85,7 +85,7 @@ named_tkeyctx_fromconfig(const cfg_obj_t *options, isc_mem_t *mctx,
 		RETERR(dns_name_fromtext(name, &b, dns_rootname, 0, NULL));
 		tctx->domain = isc_mem_get(mctx, sizeof(dns_name_t));
 		dns_name_init(tctx->domain, NULL);
-		dns_name_dup(name, mctx, tctx->domain);
+		RETERR(dns_name_dup(name, mctx, tctx->domain));
 	}

 	obj = NULL;
@@ -114,3 +114,4 @@ named_tkeyctx_fromconfig(const cfg_obj_t *options, isc_mem_t *mctx,
 	dns_tkeyctx_destroy(&tctx);
 	return (result);
 }
+
@@ -3210,6 +3210,9 @@ cleanup(void) {
 	ddebug("Shutting down timer manager");
 	isc_timermgr_destroy(&timermgr);

+	ddebug("Destroying name state");
+	dns_name_destroy();
+
 	ddebug("Removing log context");
 	isc_log_destroy(&glctx);

@@ -1022,6 +1022,8 @@ main(int argc, char **argv) {
 	isc_mem_put(rndc_mctx, args, argslen);
 	isccc_ccmsg_invalidate(&ccmsg);

+	dns_name_destroy();
+
 	isc_buffer_free(&databuf);

 	if (show_final_mem)
@@ -773,7 +773,7 @@
 	<listitem>
 	  <para>
 	    Dump the security roots (i.e., trust anchors
-	    configured via <command>trust-anchors</command> statements, or the
+	    configured via <command>dnssec-keys</command> statements, or the
 	    managed-keys or trusted-keys statements (both deprecated), or
 	    via <command>dnssec-validation auto</command>) and negative trust
 	    anchors for the specified views.  If no view is specified, all
@@ -244,7 +244,8 @@ lookup(const char *target) {
 	result = dns_name_fromtext(&name, &t, dns_rootname, 0, &namebuf);
 	check_result(result, "dns_name_fromtext %s", target);

-	dns_name_dup(&name, mctx, &client->name);
+	result = dns_name_dup(&name, mctx, &client->name);
+	check_result(result, "dns_name_dup %s", target);

 	options = 0;
 	options |= DNS_ADBFIND_INET;
@@ -225,12 +225,9 @@ ret=0
 sleep 1
 cp -f ns1/redirect.db.2 ns1/redirect.db
 $RNDCCMD 10.53.0.1 reload -redirect > rndc.out.ns1.$n
-_check_zonestatus() {
-    $RNDCCMD 10.53.0.1 zonestatus -redirect > zonestatus.out.ns1.$n || return 1
-    grep "type: redirect" zonestatus.out.ns1.$n > /dev/null || return 1
-    grep "serial: 1" zonestatus.out.ns1.$n > /dev/null || return 1
-}
-retry 5 _check_zonestatus || ret=1
+$RNDCCMD 10.53.0.1 zonestatus -redirect > zonestatus.out.ns1.$n
+grep "type: redirect" zonestatus.out.ns1.$n > /dev/null || ret=1
+grep "serial: 1" zonestatus.out.ns1.$n > /dev/null || ret=1
 n=`expr $n + 1`
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
@@ -101,8 +101,6 @@ zone "jitter.nsec3.example" {
 	allow-update { any; };
 	auto-dnssec maintain;
 	sig-validity-interval 10 2;
-	sig-signing-nodes 1000;
-	sig-signing-signatures 100;
 };

 zone "secure.nsec3.example" {
@@ -189,8 +187,6 @@ zone "oldsigs.example" {
 	allow-update { any; };
 	auto-dnssec maintain;
 	sig-validity-interval 10 2;
-	sig-signing-nodes 1000;
-	sig-signing-signatures 100;
 };

 zone "prepub.example" {
@@ -72,16 +72,12 @@ checkjitter () {
 	_expiretimes=$(freq "$_file" | awk '{print $1}')

 	_count=0
-	# Check if we have at least 5 days
-	# This number has been tuned for `sig-validity-interval 10 2`, as
-	# 1. 1. signature expiration dates should be spread out across at most 8 (10-2) days
-	# 2. we remove first and last day to remove frequency outlier, we are left with 6 (8-2) days
-	# 3. we substract one more day to allow test pass on day boundaries, etc. leaving us with 5 (6-1) days
+	# Check if we have at least 8 days
 	for _num in $_expiretimes
 	do
 		_count=$((_count+1))
 	done
-	if [ "$_count" -lt 5 ]; then
+	if [ "$_count" -lt 8 ]; then
 		echo_i "error: not enough categories"
 		return 1
 	fi
@@ -107,7 +103,7 @@ checkjitter () {
 	_low=$((_mean-_limit))
 	_high=$((_mean+_limit))
 	# Find outliers.
-	echo_i "checking whether all frequencies fall into <$_low;$_high> range"
+	echo_i "checking whether all frequencies falls into <$_low;$_high> interval"
 	for _num in $_expiretimes
 	do
 		if [ $_num -gt $_high ] || [ $_num -lt $_low ]; then
@@ -391,26 +387,20 @@ $RNDCCMD 10.53.0.1 sync 2>&1 | sed 's/^/ns1 /' | cat_i
 $RNDCCMD 10.53.0.2 sync 2>&1 | sed 's/^/ns2 /' | cat_i
 $RNDCCMD 10.53.0.3 sync 2>&1 | sed 's/^/ns3 /' | cat_i

-now="$(TZ=UTC date +%Y%m%d%H%M%S)"
-check_expiry() (
-	$DIG $DIGOPTS AXFR oldsigs.example @10.53.0.3 > dig.out.test$n
-	nearest_expiration="$(awk '$4 == "RRSIG" { print $9 }' < dig.out.test$n | sort -n | head -1)"
-	if [ "$nearest_expiration" -le "$now" ]; then
-		echo_i "failed: $nearest_expiration <= $now"
-		return 1
-	fi
-)
-
 echo_i "checking expired signatures were updated ($n)"
-retry 10 check_expiry || ret=1
-$DIG $DIGOPTS +noauth a.oldsigs.example. @10.53.0.3 a > dig.out.ns3.test$n || ret=1
-$DIG $DIGOPTS +noauth a.oldsigs.example. @10.53.0.4 a > dig.out.ns4.test$n || ret=1
-digcomp dig.out.ns3.test$n dig.out.ns4.test$n || ret=1
-grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1
+for i in 1 2 3 4 5 6 7 8 9
+do
+	ret=0
+	$DIG $DIGOPTS +noauth a.oldsigs.example. @10.53.0.3 a > dig.out.ns3.test$n || ret=1
+	$DIG $DIGOPTS +noauth a.oldsigs.example. @10.53.0.4 a > dig.out.ns4.test$n || ret=1
+        digcomp dig.out.ns3.test$n dig.out.ns4.test$n || ret=1
+	grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1
+	[ $ret = 0 ] && break
+	sleep 1
+done
 n=`expr $n + 1`
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
-
 # Check jitter distribution.
 echo_i "checking expired signatures were jittered correctly ($n)"
 ret=0
@@ -1037,14 +1027,19 @@ $KEYGEN -a rsasha1 -3 -q -K ns3 jitter.nsec3.example > /dev/null
 # Trigger zone signing.
 $RNDCCMD 10.53.0.3 sign jitter.nsec3.example. 2>&1 | sed 's/^/ns3 /' | cat_i
 # Wait until zone has been signed.
-check_if_nsec3param_exists() {
-	$DIG $DIGOPTS NSEC3PARAM jitter.nsec3.example @10.53.0.3 > dig.out.ns3.1.test$n || return 1
-	grep -q "^jitter\.nsec3\.example\..*NSEC3PARAM" dig.out.ns3.1.test$n || return 1
-}
-retry_quiet 20 check_if_nsec3param_exists || ret=1
-$DIG $DIGOPTS AXFR jitter.nsec3.example @10.53.0.3 > dig.out.ns3.2.test$n || ret=1
+i=0
+while [ "$i" -lt 20 ]; do
+	failed=0
+	$DIG $DIGOPTS axfr jitter.nsec3.example @10.53.0.3 > dig.out.ns3.test$n || failed=1
+	grep "NSEC3PARAM" dig.out.ns3.test$n > /dev/null || failed=1
+	[ $failed -eq 0 ] && break
+	echo_i "waiting ... ($i)"
+	sleep $((i/5))
+	i=$((i+1))
+done
+[ $failed != 0 ] && echo_i "error: no NSEC3PARAM found in AXFR" && ret=1
 # Check jitter distribution.
-checkjitter dig.out.ns3.2.test$n || ret=1
+checkjitter dig.out.ns3.test$n || ret=1
 n=`expr $n + 1`
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
@@ -1359,6 +1354,7 @@ $DIG $DIGOPTS @10.53.0.3 sync.example cdnskey > dig.out.ns3.cdnskeytest$n
 grep -i "sync.example.*in.cds.*[1-9][0-9]* " dig.out.ns3.cdstest$n > /dev/null || ret=1
 grep -i "sync.example.*in.cdnskey.*257 " dig.out.ns3.cdnskeytest$n > /dev/null || ret=1
 n=`expr $n + 1`
+if [ "$lret" != 0 ]; then ret=$lret; fi
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`

@@ -1393,19 +1389,19 @@ if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`

 echo_i "setting CDS and CDNSKEY deletion times and calling 'rndc loadkeys'"
-$SETTIME -D sync now `cat sync.key` > /dev/null
+$SETTIME -D sync now+2 `cat sync.key` > /dev/null
 $RNDCCMD 10.53.0.3 loadkeys sync.example | sed 's/^/ns3 /' | cat_i
+echo_i "waiting for deletion to occur"
+sleep 3

 echo_i "checking that the CDS and CDNSKEY are deleted ($n)"
 ret=0
-ensure_cds_and_cdnskey_are_deleted() {
-	$DIG $DIGOPTS @10.53.0.3 sync.example. CDS > dig.out.ns3.cdstest$n || return 1
-	awk '$1 == "sync.example." && $4 == "CDS" { exit 1; }' dig.out.ns3.cdstest$n || return 1
-	$DIG $DIGOPTS @10.53.0.3 sync.example. CDNSKEY > dig.out.ns3.cdnskeytest$n || return 1
-	awk '$1 == "sync.example." && $4 == "CDNSKEY" { exit 1; }' dig.out.ns3.cdnskeytest$n || return 1
-}
-retry 10 ensure_cds_and_cdnskey_are_deleted || ret=1
+$DIG $DIGOPTS @10.53.0.3 sync.example cds > dig.out.ns3.cdstest$n
+$DIG $DIGOPTS @10.53.0.3 sync.example cdnskey > dig.out.ns3.cdnskeytest$n
+grep -i "sync.example.*in.cds.*[1-9][0-9]* " dig.out.ns3.cdstest$n > /dev/null && ret=1
+grep -i "sync.example.*in.cdnskey.*257 " dig.out.ns3.cdnskeytest$n > /dev/null && ret=1
 n=`expr $n + 1`
+if [ "$lret" != 0 ]; then ret=$lret; fi
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`

@@ -1414,6 +1410,7 @@ ret=0
 $SETTIME -p Dsync `cat sync.key` > settime.out.$n|| ret=0
 grep "SYNC Delete:" settime.out.$n >/dev/null || ret=0
 n=`expr $n + 1`
+if [ "$lret" != 0 ]; then ret=$lret; fi
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`

@@ -1422,6 +1419,7 @@ ret=0
 $SETTIME -p Psync `cat sync.key` > settime.out.$n|| ret=0
 grep "SYNC Publish:" settime.out.$n >/dev/null || ret=0
 n=`expr $n + 1`
+if [ "$lret" != 0 ]; then ret=$lret; fi
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`

@@ -14,7 +14,6 @@ rm -f ns*/named.lock
 rm -f ns*/named.memstats
 rm -f ns*/named.conf
 rm -f ns*/named.run
-rm -f ns*/named.run.prev
 rm -f ns1/*dom*example.db
 rm -f ns2/__catz__*db
 rm -f ns2/named.conf.tmp
@@ -9,7 +9,7 @@
 * information regarding copyright ownership.
 */

-trust-anchors {
+dnssec-keys {
 	example. initial-ds 60724 5 1 "D74CF845955A0DFE604AF215E948E67D2EA94FF3";
        example. initial-key 257 3 5 "AwEAAZtP9+RAA+W33A97e+HnnH8WTXzCWiEICyWj1B6rvZ9hd50ysbody0NLx7b3vZ1bzMLxLSRAr/n3Wi0TDZ1fvCKZhennfW8Wlc7ulCvHntSQYfKHUP0YWEo84sQAqIi850N1aiddj6CidwFo9JNW/HQ+8yarfrnGMFhX2STtkE0hNJ/R6JYKmD2EH7k1nyqJd08ibrEt55DuV4BiUjyyERdVbsuwE60jVqAwCKyVBYXb2sI+zv1yPNDBIANd6KTgnq6YWzx5ZodQP3W4K7Z/Bk3EKmVCvrTKZK/ADLAKaL0/6DD07+1jXA4BiNyoZTLTapkudkGad+Rn6zqCkwuMmrU=";
 };
@@ -9,7 +9,7 @@
 * information regarding copyright ownership.
 */

-trust-anchors {
+dnssec-keys {
 	example. static-ds 60724 5 1 "D74CF845955A0DFE604AF215E948E67D2EA94FF3";
        example. static-key 257 3 5 "AwEAAZtP9+RAA+W33A97e+HnnH8WTXzCWiEICyWj1B6rvZ9hd50ysbody0NLx7b3vZ1bzMLxLSRAr/n3Wi0TDZ1fvCKZhennfW8Wlc7ulCvHntSQYfKHUP0YWEo84sQAqIi850N1aiddj6CidwFo9JNW/HQ+8yarfrnGMFhX2STtkE0hNJ/R6JYKmD2EH7k1nyqJd08ibrEt55DuV4BiUjyyERdVbsuwE60jVqAwCKyVBYXb2sI+zv1yPNDBIANd6KTgnq6YWzx5ZodQP3W4K7Z/Bk3EKmVCvrTKZK/ADLAKaL0/6DD07+1jXA4BiNyoZTLTapkudkGad+Rn6zqCkwuMmrU=";
 };
@@ -13,7 +13,7 @@ options {
 	dnssec-validation yes;
 };

-trust-anchors {
+dnssec-keys {
 	example. initial-key 257 3 8 "AwEAAawvFp8GlBx8Qt6yaIqXkDe+nMkSk2HkTAG7qlVBo++AQwZ1j3Xl
 		25IN4jsw0VTMbKUbafw9DYsVzztIwx1sNkKRLo6qP9SSkBL8RicQaafG
 		tURtsYI3oqte5qqLve1CUpRD8J06Pg1xkOxsDlz9sQAyiQrOyvMbykJY
@@ -23,7 +23,7 @@ trust-anchors {
 		NQyrszHhWUU=";
 };

-trust-anchors {
+dnssec-keys {
 	example. static-key 257 3 8 "AwEAAZtP9+RAA+W33A97e+HnnH8WTXzCWiEICyWj1B6rvZ9hd50ysbod
 		y0NLx7b3vZ1bzMLxLSRAr/n3Wi0TDZ1fvCKZhennfW8Wlc7ulCvHntSQ
 		YfKHUP0YWEo84sQAqIi850N1aiddj6CidwFo9JNW/HQ+8yarfrnGMFhX
@@ -13,7 +13,7 @@ options {
 	dnssec-validation yes;
 };

-trust-anchors {
+dnssec-keys {
 	. initial-key 257 3 8 "AwEAAawvFp8GlBx8Qt6yaIqXkDe+nMkSk2HkTAG7qlVBo++AQwZ1j3Xl
 		25IN4jsw0VTMbKUbafw9DYsVzztIwx1sNkKRLo6qP9SSkBL8RicQaafG
 		tURtsYI3oqte5qqLve1CUpRD8J06Pg1xkOxsDlz9sQAyiQrOyvMbykJY
@@ -9,7 +9,7 @@
 * information regarding copyright ownership.
 */

-trust-anchors {
+dnssec-keys {
 	# This key (19036) is to be phased out starting in 2017. It will
 	# remain in the root zone for some time after its successor key
 	# has been added. It will remain this file until it is removed from
@@ -9,7 +9,7 @@
 * information regarding copyright ownership.
 */

-trust-anchors {
+dnssec-keys {
 	example. initial-ds 60724 5 1 "D74CF845955A0DFE604AF215E948E67D2EA94FF3";
 	example. static-ds 60724 5 2 "29E79B9064EE1A11DF3BFF19581DDFED7952C22CC204ACE17B6007EB1437E9E6";
 };
@@ -9,7 +9,7 @@
 * information regarding copyright ownership.
 */

-trust-anchors {
+dnssec-keys {
 	example. initial-ds 60724 5 1 "D74CF845955A0DFE604AF215E948E67D2EA94FF3";
        example. static-key 257 3 5 "AwEAAZtP9+RAA+W33A97e+HnnH8WTXzCWiEICyWj1B6rvZ9hd50ysbody0NLx7b3vZ1bzMLxLSRAr/n3Wi0TDZ1fvCKZhennfW8Wlc7ulCvHntSQYfKHUP0YWEo84sQAqIi850N1aiddj6CidwFo9JNW/HQ+8yarfrnGMFhX2STtkE0hNJ/R6JYKmD2EH7k1nyqJd08ibrEt55DuV4BiUjyyERdVbsuwE60jVqAwCKyVBYXb2sI+zv1yPNDBIANd6KTgnq6YWzx5ZodQP3W4K7Z/Bk3EKmVCvrTKZK/ADLAKaL0/6DD07+1jXA4BiNyoZTLTapkudkGad+Rn6zqCkwuMmrU=";
 };
@@ -9,7 +9,7 @@
 * information regarding copyright ownership.
 */

-trust-anchors {
+dnssec-keys {
 	example. static-ds 60724 5 1 "D74CF845955A0DFE604AF215E948E67D2EA94FF3";
        example. initial-key 257 3 5 "AwEAAZtP9+RAA+W33A97e+HnnH8WTXzCWiEICyWj1B6rvZ9hd50ysbody0NLx7b3vZ1bzMLxLSRAr/n3Wi0TDZ1fvCKZhennfW8Wlc7ulCvHntSQYfKHUP0YWEo84sQAqIi850N1aiddj6CidwFo9JNW/HQ+8yarfrnGMFhX2STtkE0hNJ/R6JYKmD2EH7k1nyqJd08ibrEt55DuV4BiUjyyERdVbsuwE60jVqAwCKyVBYXb2sI+zv1yPNDBIANd6KTgnq6YWzx5ZodQP3W4K7Z/Bk3EKmVCvrTKZK/ADLAKaL0/6DD07+1jXA4BiNyoZTLTapkudkGad+Rn6zqCkwuMmrU=";
 };
@@ -9,7 +9,7 @@
 * information regarding copyright ownership.
 */

-trust-anchors {
+dnssec-keys {
        example. initial-key 257 3 5 "AwEAAawvFp8GlBx8Qt6yaIqXkDe+nMkSk2HkTAG7qlVBo++AQwZ1j3Xl25IN4jsw0VTMbKUbafw9DYsVzztIwx1sNkKRLo6qP9SSkBL8RicQaafGtURtsYI3oqte5qqLve1CUpRD8J06Pg1xkOxsDlz9sQAyiQrOyvMbykJYkYrFYGLzYAgl/JtMyVVYlBl9pqxQuAPKYPOuO1axaad/wLN3+wTy/hcJfpvJpqzXlDF9bI5RmpoX/7geZ06vpcYJEoT0xkkmPlEl0ZjEDrm/WIaSWG0/CEDpHcOXFz4OEczMVpY+lnuFfKybwF1WHFn2BwVEOS6cMM6ukIjINQyrszHhWUU=";
        example. static-key 257 3 5 "AwEAAZtP9+RAA+W33A97e+HnnH8WTXzCWiEICyWj1B6rvZ9hd50ysbody0NLx7b3vZ1bzMLxLSRAr/n3Wi0TDZ1fvCKZhennfW8Wlc7ulCvHntSQYfKHUP0YWEo84sQAqIi850N1aiddj6CidwFo9JNW/HQ+8yarfrnGMFhX2STtkE0hNJ/R6JYKmD2EH7k1nyqJd08ibrEt55DuV4BiUjyyERdVbsuwE60jVqAwCKyVBYXb2sI+zv1yPNDBIANd6KTgnq6YWzx5ZodQP3W4K7Z/Bk3EKmVCvrTKZK/ADLAKaL0/6DD07+1jXA4BiNyoZTLTapkudkGad+Rn6zqCkwuMmrU=";
 };
@@ -13,7 +13,7 @@ options {
 	dnssec-validation auto;
 };

-trust-anchors {
+dnssec-keys {
 	. static-key 257 3 8 "AwEAAZtP9+RAA+W33A97e+HnnH8WTXzCWiEICyWj1B6rvZ9hd50ysbod
 		y0NLx7b3vZ1bzMLxLSRAr/n3Wi0TDZ1fvCKZhennfW8Wlc7ulCvHntSQ
 		YfKHUP0YWEo84sQAqIi850N1aiddj6CidwFo9JNW/HQ+8yarfrnGMFhX
@@ -9,7 +9,7 @@
 * information regarding copyright ownership.
 */

-trust-anchors {
+dnssec-keys {
 	# This key (19036) is to be phased out starting in 2017. It will
 	# remain in the root zone for some time after its successor key
 	# has been added. It will remain this file until it is removed from
@@ -9,7 +9,7 @@
 * information regarding copyright ownership.
 */

-trust-anchors {
+dnssec-keys {
 	# This key (19036) is to be phased out starting in 2017. It will
 	# remain in the root zone for some time after its successor key
 	# has been added. It will remain this file until it is removed from
@@ -9,7 +9,7 @@
 * information regarding copyright ownership.
 */

-trust-anchors {
+dnssec-keys {
 	# This key (20326) was published in the root zone in 2017.
 	# Servers which were already using the old key (19036) should
 	# roll seamlessly to this new one via RFC 5011 rollover. Servers
@@ -9,7 +9,7 @@
 * information regarding copyright ownership.
 */

-trust-anchors {
+dnssec-keys {
 	# This key (19036) is to be phased out starting in 2017. It will
 	# remain in the root zone for some time after its successor key
 	# has been added. It will remain this file until it is removed from
@@ -9,6 +9,6 @@
 * information regarding copyright ownership.
 */

-trust-anchors {
+dnssec-keys {
        . static-ds 20326 8 2 "E06D44B80B8F1D39A95C0B0D7C65D08458E880409BBC683457104237C7F8EC8D";
 };
@@ -9,7 +9,7 @@
 * information regarding copyright ownership.
 */

-trust-anchors {
+dnssec-keys {
 	# This key (20326) was published in the root zone in 2017.
 	# Servers which were already using the old key (19036) should
 	# roll seamlessly to this new one via RFC 5011 rollover. Servers
@@ -13,7 +13,7 @@ options {
 	dnssec-validation yes;
 };

-trust-anchors {
+dnssec-keys {
 	example. initial-key 257 3 8 "AwEAAawvFp8GlBx8Qt6yaIqXkDe+nMkSk2HkTAG7qlVBo++AQwZ1j3Xl
 		25IN4jsw0VTMbKUbafw9DYsVzztIwx1sNkKRLo6qP9SSkBL8RicQaafG
 		tURtsYI3oqte5qqLve1CUpRD8J06Pg1xkOxsDlz9sQAyiQrOyvMbykJY
@@ -9,6 +9,6 @@
 * information regarding copyright ownership.
 */

-trust-anchors {
+dnssec-keys {
 	example. initial-ds 60724 5 2 "29E79B9064EE1A11DF3BFF19581DDFED7952C22CC204ACE17B6007EB1437E9E6";
 };
@@ -9,6 +9,6 @@
 * information regarding copyright ownership.
 */

-trust-anchors {
+dnssec-keys {
 	example. static-ds 60724 5 2 "29E79B9064EE1A11DF3BFF19581DDFED7952C22CC204ACE17B6007EB1437E9E6";
 };
@@ -458,7 +458,7 @@ if [ $ret != 0 ]; then echo_i "failed"; ret=1; fi
 status=`expr $status + $ret`

 n=`expr $n + 1`
-echo_i "check that using trust-anchors and managed-keys generates an error ($n)"
+echo_i "check that using dnssec-keys and managed-keys generates an error ($n)"
 ret=0
 $CHECKCONF check-mixed-keys.conf > checkconf.out$n 2>/dev/null && ret=1
 grep "use of managed-keys is not allowed" checkconf.out$n > /dev/null || ret=1
@@ -264,31 +264,31 @@ keyfile_to_dskeys() {
 }

 # keyfile_to_static_keys: convert key data contained in the keyfile(s)
-# provided to a *static-key* "trust-anchors" section suitable for including in
-# a resolver's configuration file
+# provided to a *static-key* "dnssec-keys" section suitable for including in a
+# resolver's configuration file
 keyfile_to_static_keys() {
-    keyfile_to_keys "trust-anchors" "static-key" $*
+    keyfile_to_keys "dnssec-keys" "static-key" $*
 }

 # keyfile_to_initial_keys: convert key data contained in the keyfile(s)
-# provided to an *initial-key* "trust-anchors" section suitable for including
+# provided to an *initial-key* "dnssec-keys" section suitable for including
 # in a resolver's configuration file
 keyfile_to_initial_keys() {
-    keyfile_to_keys "trust-anchors" "initial-key" $*
+    keyfile_to_keys "dnssec-keys" "initial-key" $*
 }

 # keyfile_to_static_ds_keys: convert key data contained in the keyfile(s)
-# provided to a *static-ds* "trust-anchors" section suitable for including in a
+# provided to a *static-ds* "dnssec-keys" section suitable for including in a
 # resolver's configuration file
 keyfile_to_static_ds() {
-    keyfile_to_dskeys "trust-anchors" "static-ds" $*
+    keyfile_to_dskeys "dnssec-keys" "static-ds" $*
 }

 # keyfile_to_initial_ds_keys: convert key data contained in the keyfile(s)
-# provided to an *initial-ds* "trust-anchors" section suitable for including
+# provided to an *initial-ds* "dnssec-keys" section suitable for including
 # in a resolver's configuration file
 keyfile_to_initial_ds() {
-    keyfile_to_dskeys "trust-anchors" "initial-ds" $*
+    keyfile_to_dskeys "dnssec-keys" "initial-ds" $*
 }

 # keyfile_to_key_id: convert a key file name to a key ID
@@ -374,9 +374,9 @@ nextpartpeek() {
 	nextpartread $1 2> /dev/null
 }

-# _retry: keep running a command until it succeeds, up to $1 times, with
-# one-second intervals, optionally printing a message upon every attempt
-_retry() {
+# retry: keep running a command until it succeeds, up to $1 times, with
+# one-second intervals
+retry() {
 	__retries="${1}"
 	shift

@@ -386,9 +386,7 @@ _retry() {
 		fi
 		__retries=$((__retries-1))
 		if [ "${__retries}" -gt 0 ]; then
-			if [ "${__retry_quiet}" -ne 1 ]; then
-				echo_i "retrying"
-			fi
+			echo_i "retrying"
 			sleep 1
 		else
 			return 1
@@ -396,18 +394,6 @@ _retry() {
 	done
 }

-# retry: call _retry() in verbose mode
-retry() {
-	__retry_quiet=0
-	_retry "$@"
-}
-
-# retry_quiet: call _retry() in silent mode
-retry_quiet() {
-	__retry_quiet=1
-	_retry "$@"
-}
-
 rndc_reload() {
    echo_i "`$RNDC -c ../common/rndc.conf -s $2 -p ${CONTROLPORT} reload $3 2>&1 | sed 's/^/'$1' /'`"
    # reloading single zone is synchronous, if we're reloading whole server
@@ -752,7 +752,6 @@ if [ -x "$DIG" ] ; then
    status=$((status+ret))
  fi

-  n=$((n+1))
  echo_i "check that dig +unexpected works ($n)"
  ret=0
  dig_with_opts @10.53.0.6 +unexpected a a.example > dig.out.test$n || ret=1
@@ -154,7 +154,7 @@ status=`expr $status + $ret`
 copy_setports ns3/named3.conf.in ns3/named.conf
 rndc_reconfig ns3 10.53.0.3

-echo_i "checking lame server clients are dropped below the hard limit"
+echo_i "checking lame server clients are dropped near the soft limit"
 ret=0
 fail=0
 exceeded=0
@@ -163,7 +163,7 @@ touch ans4/norespond
 for try in 1 2 3 4 5; do
    burst b $try 400
    $DIGCMD a ${try}.example > dig.out.ns3.$try
-    stat 400 || exceeded=`expr $exceeded + 1`
+    stat 380 || exceeded=`expr $exceeded + 1`
    grep "status: NOERROR" dig.out.ns3.$try > /dev/null 2>&1 && \
            success=`expr $success + 1`
    grep "status: SERVFAIL" dig.out.ns3.$try > /dev/null 2>&1 && \
@@ -174,22 +174,10 @@ echo_i "$success successful valid queries (expected 5)"
 [ "$success" -eq 5 ] || { echo_i "failed"; ret=1; }
 echo_i "$fail SERVFAIL responses (expected 0)"
 [ "$fail" -eq 0 ] || { echo_i "failed"; ret=1; }
-echo_i "clients count exceeded 400 on $exceeded trials (expected 0)"
+echo_i "clients count exceeded 380 on $exceeded trials (expected 0)"
 [ "$exceeded" -eq 0 ] || { echo_i "failed"; ret=1; }
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`

-echo_i "checking drop statistics"
-rm -f ns3/named.stats
-$RNDCCMD stats
-for try in 1 2 3 4 5; do
-    [ -f ns3/named.stats ] && break
-    sleep 1
-done
-drops=`grep 'queries dropped due to recursive client limit' ns3/named.stats | sed 's/\([0-9][0-9]*\) queries.*/\1/'`
-[ "${drops:-0}" -ne 0 ] || ret=1
-if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
-
 echo_i "exit status: $status"
 [ $status -eq 0 ] || exit 1
@@ -852,19 +852,6 @@ check_signatures() {
 	fi
 }

-response_has_cds_for_key() (
-	awk -v zone="${ZONE%%.}." \
-	    -v ttl="${DNSKEY_TTL}" \
-	    -v qtype="${_qtype}" \
-	    -v keyid="$(key_get "${1}" ID)" \
-	    -v keyalg="${_key_algnum}" \
-	    -v hashalg="2" \
-	    'BEGIN { ret=1; }
-	     $1 == zone && $2 == ttl && $4 == qtype && $5 == keyid && $6 == keyalg && $7 == hashalg { ret=0; exit; }
-	     END { exit ret; }' \
-	    "$2"
-)
-
 # Test CDS and CDNSKEY publication.
 check_cds() {

@@ -878,24 +865,24 @@ check_cds() {
 	grep "status: NOERROR" "dig.out.$DIR.test$n" > /dev/null || log_error "mismatch status in DNS response"

 	if [ "$(key_get KEY1 STATE_DS)" = "rumoured" ] || [ "$(key_get KEY1 STATE_DS)" = "omnipresent" ]; then
-		response_has_cds_for_key KEY1 "dig.out.$DIR.test$n" || log_error "missing ${_qtype} record in response for key $(key_get KEY1 ID)"
+		grep "${ZONE}\..*${DNSKEY_TTL}.*IN.*${_qtype}.*$(key_get KEY1 ID).*${_key_algnum}.*2" "dig.out.$DIR.test$n" > /dev/null || log_error "missing ${_qtype} record in response for key $(key_get KEY1 ID)"
 		check_signatures $_qtype "dig.out.$DIR.test$n" "KSK"
 	elif [ "$(key_get KEY1 EXPECT)" = "yes" ]; then
-		response_has_cds_for_key KEY1 "dig.out.$DIR.test$n" && log_error "unexpected ${_qtype} record in response for key $(key_get KEY1 ID)"
+		grep "${ZONE}\..*${DNSKEY_TTL}.*IN.*${_qtype}.*$(key_get KEY1 ID).*${_key_algnum}.*2" "dig.out.$DIR.test$n" > /dev/null && log_error "unexpected ${_qtype} record in response for key $(key_get KEY1 ID)"
 	fi

 	if [ "$(key_get KEY2 STATE_DS)" = "rumoured" ] || [ "$(key_get KEY2 STATE_DS)" = "omnipresent" ]; then
-		response_has_cds_for_key KEY2 "dig.out.$DIR.test$n" || log_error "missing ${_qtype} record in response for key $(key_get KEY2 ID)"
+		grep "${ZONE}\..*${DNSKEY_TTL}.*IN.*${_qtype}.*$(key_get KEY2 ID).*${_key_algnum}.*2" "dig.out.$DIR.test$n" > /dev/null || log_error "missing ${_qtype} record in response for key $(key_get KEY2 ID)"
 		check_signatures $_qtype "dig.out.$DIR.test$n" "KSK"
 	elif [ "$(key_get KEY2 EXPECT)" = "yes" ]; then
-		response_has_cds_for_key KEY2 "dig.out.$DIR.test$n" && log_error "unexpected ${_qtype} record in response for key $(key_get KEY2 ID)"
+		grep "${ZONE}\..*${DNSKEY_TTL}.*IN.*${_qtype}.*$(key_get KEY2 ID).*${_key_algnum}.*2" "dig.out.$DIR.test$n" > /dev/null && log_error "unexpected ${_qtype} record in response for key $(key_get KEY2 ID)"
 	fi

 	if [ "$(key_get KEY3 STATE_DS)" = "rumoured" ] || [ "$(key_get KEY3 STATE_DS)" = "omnipresent" ]; then
-		response_has_cds_for_key KEY3 "dig.out.$DIR.test$n" || log_error "missing ${_qtype} record in response for key $(key_get KEY3 ID)"
+		grep "${ZONE}\..*${DNSKEY_TTL}.*IN.*${_qtype}.*$(key_get KEY3 ID).*${_key_algnum}.*2" "dig.out.$DIR.test$n" > /dev/null || log_error "missing ${_qtype} record in response for key $(key_get KEY3 ID)"
 		check_signatures $_qtype "dig.out.$DIR.test$n" "KSK"
 	elif [ "$(key_get KEY3 EXPECT)" = "yes" ]; then
-		response_has_cds_for_key KEY3 "dig.out.$DIR.test$n" && log_error "unexpected ${_qtype} record in response for key $(key_get KEY3 ID)"
+		grep "${ZONE}\..*${DNSKEY_TTL}.*IN.*${_qtype}.*$(key_get KEY3 ID).*${_key_algnum}.*2" "dig.out.$DIR.test$n" > /dev/null && log_error "unexpected ${_qtype} record in response for key $(key_get KEY3 ID)"
 	fi

 	test "$ret" -eq 0 || echo_i "failed"
@@ -1,3 +1,3 @@
-trust-anchors {
+dnssec-keys {
    "edns512-notcp." static-key 257 3 10 "AwEAAcEBkn/cuVhdRTWMHt19O7h9F4Hx2t68u1JUZg7swLLvwfljqnNYjsKYk9EzUhIaYOAHtVe7//cYwoVU4BFhY2DGbx1YE1LnKIGxfqpopFxDZC34TTl6jpoTP6kvj+XpeO0HfF2+DcyNgnQcMGgHXyLWeRUJFt1As6o9tmsBiInGIZMTE3/rANhtAGMLNzhRLN7CS/Tc5GhKaL66uebyEYenEOAyDVgsuhr8Q9D5ka6xZmxzXFVswy2KvsSxu9aoxVq4nACjIeTZ4GJy0v83zclV7hA+5jlPDXMFtIpvwux5XALrNkUUPq+Fb5sc5/u141LcvdASnlk58I77HbsnfausvDxdYYxEns7K9e9N85dwyreM/OGTmm8p4hNDngZESAea7MrSCsJpOGn9XLkVe6gZnBgB1cra+ezzTSWn+4QH17lIhFXYNjMV83df2h/gH3Gmthqnr9RgknZga8B/Czc7TeX6iy2gAOshKGyb6w12eJim1L8tS5T138V8d6SigzxZz1raiJNolVhXyA8SbbDpgBrcoEXN/WjwvWI+2ol5gzlqMeNw/F9SMoWdpGIWkkNCNWBbhLWhp6qfhpRLUFwVys54LGOIGSVRd9uJmc2hPdXoP8ephnCIeNJb8Zp6DnpssyN0JaF815dKkOHff9GEjaiRLj0xWvtZSqNFaGoB";
 };
@@ -11,7 +11,7 @@ ns2 is a validator that uses managed keys.  "-T mkeytimers=2/20/40"
 is used so it will attempt do automated updates frequently. "-T tat=1"
 is used so it will send TAT queries once per second.

-ns3 is a validator with a broken initializing key in trust-anchors.
+ns3 is a validator with a broken initializing key in dnssec-keys.

 ns4 is a validator with a deliberately broken managed-keys.bind and
 managed-keys.jnl, causing RFC 5011 initialization to fail.
@@ -41,6 +41,6 @@ zone "." {
 };

 # purposely broken key for testing
-trust-anchors {
+dnssec-keys {
    "." initial-key 257 3 5 "PURPOSELYBROKEN/xs9iVj7QekClcpzjCf0JrvXW1z07hNMqMm6Q2FtIXMbRgfvTtHF3/ZNvcewT9hpfczC+JACHsQSYYdr7UI8oe4nJfal9+2F3pz4a+HR6CqkgrR6WLWQI1Q==";
 };
@@ -22,7 +22,7 @@ options {
 	recursion yes;
 	dnssec-validation yes;
 	querylog yes;
-	prefetch 4 10;
+	prefetch 3 9;
 };

 server 10.53.0.7 {
@@ -16,6 +16,6 @@ mail	IN A	10.53.0.6
 fetch 10 IN TXT A short ttl
 non-zero 10 IN TXT A short ttl
 zero 0  IN TXT	A zero ttl
-$TTL 13
+$TTL 10
 ds 	IN NS	ns.ds
 ns.ds	IN A	10.53.0.6
@@ -18,4 +18,4 @@ $TTL 300
@			NS	ns.fetch.tld.
 ns.fetch.tld.		A	10.53.0.6

-@	13		TXT	A short ttl
+@	10		TXT	A short ttl
@@ -451,13 +451,10 @@ status=`expr $status + $ret`
 n=`expr $n + 1`
 echo_i "check prefetch (${n})"
 ret=0
-# read prefetch value from config.
-PREFETCH=`sed -n "s/[[:space:]]*prefetch \([0-9]\).*/\1/p" ns5/named.conf`
 $DIG $DIGOPTS @10.53.0.5 fetch.tld txt > dig.out.1.${n} || ret=1
-ttl1=`awk '/"A" "short" "ttl"/ { print $2 }' dig.out.1.${n}`
-interval=$((ttl1 - PREFETCH + 1))
+ttl1=`awk '/"A" "short" "ttl"/ { print $2 - 3 }' dig.out.1.${n}`
 # sleep so we are in prefetch range
-sleep ${interval:-0}
+sleep ${ttl1:-0}
 # trigger prefetch
 $DIG $DIGOPTS @10.53.0.5 fetch.tld txt > dig.out.2.${n} || ret=1
 ttl2=`awk '/"A" "short" "ttl"/ { print $2 }' dig.out.2.${n}`
@@ -473,10 +470,9 @@ n=`expr $n + 1`
 echo_i "check prefetch of validated DS's RRSIG TTL is updated (${n})"
 ret=0
 $DIG $DIGOPTS +dnssec @10.53.0.5 ds.example.net ds > dig.out.1.${n} || ret=1
-dsttl1=`awk '$4 == "DS" && $7 == "2" { print $2 }' dig.out.1.${n}`
-interval=$((dsttl1 - PREFETCH + 1))
+dsttl1=`awk '$4 == "DS" && $7 == "2" { print $2 - 3 }' dig.out.1.${n}`
 # sleep so we are in prefetch range
-sleep ${interval:-0}
+sleep ${dsttl1:-0}
 # trigger prefetch
 $DIG $DIGOPTS @10.53.0.5 ds.example.net ds > dig.out.2.${n} || ret=1
 dsttl2=`awk '$4 == "DS" && $7 == "2" { print $2 }' dig.out.2.${n}`
@@ -495,24 +491,25 @@ n=`expr $n + 1`
 echo_i "check prefetch disabled (${n})"
 ret=0
 $DIG $DIGOPTS @10.53.0.7 fetch.example.net txt > dig.out.1.${n} || ret=1
-ttl1=`awk '/"A" "short" "ttl"/ { print $2 }' dig.out.1.${n}`
-interval=$((ttl1 - PREFETCH + 1))
+ttl1=`awk '/"A" "short" "ttl"/ { print $2 - 2 }' dig.out.1.${n}`
 # sleep so we are in expire range
-sleep ${interval:-0}
-tmp_ttl=$ttl1
-no_prefetch() {
-	# fetch record and ensure its ttl is in range 0 < ttl < tmp_ttl.
-	# since prefetch is disabled, updated ttl must be a lower value than
-	# the previous one.
-	$DIG $DIGOPTS @10.53.0.7 fetch.example.net txt > dig.out.2.${n} || return 1
+sleep ${ttl1:-0}
+# look for ttl = 1, allow for one miss at getting zero ttl
+zerotonine="0 1 2 3 4 5 6 7 8 9"
+for i in $zerotonine $zerotonine $zerotonine $zerotonine
+do
+	$DIG $DIGOPTS @10.53.0.7 fetch.example.net txt > dig.out.2.${n} || ret=1
 	ttl2=`awk '/"A" "short" "ttl"/ { print $2 }' dig.out.2.${n}`
-        # check that prefetch has not occured
-        if [ $ttl2 -ge $tmp_ttl ]; then
-                return 1
-        fi
-        tmp_ttl=$ttl2
-}
-retry_quiet 3 no_prefetch || ret=1
+	test ${ttl2:-2} -eq 1 && break
+	$PERL -e 'select(undef, undef, undef, 0.05);'
+done
+test ${ttl2:-2} -eq 1 || ret=1
+# delay so that any prefetched record will have a lower ttl than expected
+sleep 3
+# check that prefetch has not occured
+$DIG $DIGOPTS @10.53.0.7 fetch.example.net txt > dig.out.3.${n} || ret=1
+ttl=`awk '/"A" "short" "ttl"/ { print $2 - 2 }' dig.out.3.${n}`
+test ${ttl:-0} -eq ${ttl1:-1} || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`

@@ -86,7 +86,7 @@ signzone () {
    KEYNAME=`$KEYGEN -q -a rsasha256 -K $1 $2`
    cat $1/$3 $1/$KEYNAME.key > $1/tmp
    $SIGNER -P -K $1 -o $2 -f $1/$4 $1/tmp >/dev/null
-    sed -n -e 's/\(.*\) IN DNSKEY \([0-9]\{1,\} [0-9]\{1,\} [0-9]\{1,\}\) \(.*\)/trust-anchors {"\1" static-key \2 "\3";};/p' $1/$KEYNAME.key >>trusted.conf
+    sed -n -e 's/\(.*\) IN DNSKEY \([0-9]\{1,\} [0-9]\{1,\} [0-9]\{1,\}\) \(.*\)/dnssec-keys {"\1" static-key \2 "\3";};/p' $1/$KEYNAME.key >>trusted.conf
    DSFILENAME=dsset-${2}${TP}
    rm $DSFILENAME $1/tmp
 }
@@ -145,6 +145,7 @@ main(int argc, char **argv) {
 	isc_log_setcontext(NULL);
 	dns_log_setcontext(NULL);
 	dst_lib_destroy();
+	dns_name_destroy();
 	isc_mem_destroy(&mctx);
 	return (0);
 #else /* !USE_PKCS11 */
@@ -189,14 +189,13 @@ if [ $status != 0 ]; then
    echofail "R:$systest:FAIL"
    # Do not clean up - we need the evidence.
 else
-    core_dumps="$(find $systest/ -name 'core*' -or -name '*.core' | sort | tr '\n' ' ')"
+    core_dumps="$(find $systest/ -name 'core*' | sort | tr '\n' ' ')"
    assertion_failures=$(find $systest/ -name named.run | xargs grep "assertion failure" | wc -l)
-    sanitizer_summaries=$(find $systest/ -type f | grep '^[-a-zA-Z0-9./_]*$' | xargs grep "SUMMARY: .*Sanitizer" | wc -l)
    if [ -n "$core_dumps" ]; then
        echoinfo "I:$systest:Test claims success despite crashes: $core_dumps"
        echofail "R:$systest:FAIL"
        # Do not clean up - we need the evidence.
-	find "$systest/" -name 'core*' -or -name '*.core' | while read -r coredump; do
+	find "$systest/" -name 'core*' | while read -r coredump; do
 		SYSTESTDIR="$systest"
 		echoinfo "D:$systest:backtrace from $coredump start"
 		binary=$(gdb --batch --core="$coredump" | sed -ne "s/Core was generated by \`//;s/ .*'.$//p;")
@@ -212,9 +211,6 @@ else
        echoinfo "I:$systest:Test claims success despite $assertion_failures assertion failure(s)"
        echofail "R:$systest:FAIL"
        # Do not clean up - we need the evidence.
-    elif [ $sanitizer_summaries -ne 0 ]; then
-        echoinfo "I:$systest:Test claims success despite $sanitizer_summaries sanitizer reports(s)"
-        echofail "R:$systest:FAIL"
    else
        echopass "R:$systest:PASS"
        if $clean
@@ -19,3 +19,5 @@ rm -f rndc.out*
 rm -rf ns2/nope
 rm -rf ns2/tmp.*
 rm -f ns*/managed-keys.bind*
+rm -rf "ns2/`cat ctrl-char-dir-name`"
+rm -rf "ns2/$;"
@@ -14,7 +14,7 @@
 options {
 	query-source address 10.53.0.2;
 	port @PORT@;
-	pid-file "named.pid";
+	pid-file "named2.pid";
 	listen-on { 10.53.0.2; };
 	listen-on-v6 { fd92:7065:b8e:ffff::2; };
 	recursion no;
@@ -14,7 +14,7 @@
 options {
 	query-source address 10.53.0.2;
 	port @PORT@;
-	pid-file "named.pid";
+	pid-file "named3.pid";
 	listen-on { 10.53.0.2; 10.53.0.3; };
 	listen-on-v6 { fd92:7065:b8e:ffff::2; };
 	recursion no;
@@ -14,7 +14,7 @@
 options {
 	query-source address 10.53.0.2;
 	port @PORT@;
-	pid-file "named-alt3.pid";
+	pid-file "named4.pid";
 	lock-file none;
 	listen-on { 10.53.0.2; 10.53.0.3; };
 	listen-on-v6 { fd92:7065:b8e:ffff::2; };
@@ -12,7 +12,7 @@
 options {
 	directory "./nope";
 	port @PORT@;
-	pid-file "named.pid";
+	pid-file "../named.pid";
 	listen-on { 127.0.0.1; };
 	listen-on-v6 { none; };
 	recursion no;
@@ -12,7 +12,7 @@
 options {
 	managed-keys-directory "./nope";
 	port @PORT@;
-	pid-file "named.pid";
+	pid-file "../named.pid";
 	listen-on { 127.0.0.1; };
 	listen-on-v6 { none; };
 	recursion no;
@@ -12,7 +12,7 @@
 options {
 	new-zones-directory "./nope";
 	port @PORT@;
-	pid-file "named.pid";
+	pid-file "../named.pid";
 	listen-on { 127.0.0.1; };
 	listen-on-v6 { none; };
 	recursion no;
@@ -11,7 +11,7 @@

 options {
 	port @PORT@;
-	pid-file "named.pid";
+	pid-file "named7.pid";
 	listen-on { 10.53.0.2; };
 	listen-on-v6 { fd92:7065:b8e:ffff::2; };
 };
@@ -19,10 +19,6 @@ copy_setports ns2/named1.conf.in ns2/named.conf
 copy_setports ns2/named-alt1.conf.in ns2/named-alt1.conf
 copy_setports ns2/named-alt2.conf.in ns2/named-alt2.conf
 copy_setports ns2/named-alt3.conf.in ns2/named-alt3.conf
-copy_setports ns2/named-alt4.conf.in ns2/named-alt4.conf
-copy_setports ns2/named-alt5.conf.in ns2/named-alt5.conf
-copy_setports ns2/named-alt6.conf.in ns2/named-alt6.conf
-copy_setports ns2/named-alt7.conf.in ns2/named-alt7.conf

 mkdir ns2/nope

@@ -9,215 +9,180 @@
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.

-# shellcheck source=conf.sh
 SYSTEMTESTTOP=..
-. "$SYSTEMTESTTOP/conf.sh"
-
-set -e
+. $SYSTEMTESTTOP/conf.sh

 RNDCCMD="$RNDC -c $SYSTEMTESTTOP/common/rndc.conf -p ${CONTROLPORT} -s"

-kill_named() {
-	pidfile="${1}"
-	if [ ! -r "${pidfile}" ]; then
-		return 1
-	fi
-
-	pid=$(cat "${pidfile}" 2>/dev/null)
-	if [ "${pid:+set}" = "set" ]; then
-		$KILL -15 "${pid}" >/dev/null 2>&1
-		retries=10
-		while [ "$retries" -gt 0 ]; do
-			if ! $KILL -0 "${pid}" >/dev/null 2>&1; then
-				break
-			fi
-			sleep 1
-			retries=$((retries-1))
-		done
-		# Timed-out
-		if [ "$retries" -eq 0 ]; then
-			echo_i "failed to kill named ($pidfile)"
-			return 1
-		fi
-	fi
-	rm -f "${pidfile}"
-	return 0
-}
-
-wait_for_named() {
-	retries=10
-	while [ "$retries" -gt 0 ]; do
-		if grep "$@" >/dev/null 2>&1; then
-			break
-		fi
-		sleep 1
-		retries=$((retries-1))
-	done
-	if [ "$retries" -eq 0 ]; then
-		return 1
-	fi
-	return 0
-}
-
 status=0
 n=0

-n=$((n+1))
+n=`expr $n + 1`
 echo_i "verifying that named started normally ($n)"
 ret=0
 [ -s ns2/named.pid ] || ret=1
 grep "unable to listen on any configured interface" ns2/named.run > /dev/null && ret=1
 grep "another named process" ns2/named.run > /dev/null && ret=1
-if [ $ret -ne 0 ]; then echo_i "failed"; fi
-status=$((status+ret))
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=`expr $status + $ret`

-n=$((n+1))
+n=`expr $n + 1`
 echo_i "verifying that named checks for conflicting named processes ($n)"
 ret=0
-(cd ns2 && $NAMED -c named-alt2.conf -D runtime-ns2-extra-2 -X named.lock -m record,size,mctx -d 99 -g -U 4 >> named$n.run 2>&1 & )
-wait_for_named "another named process" ns2/named$n.run || ret=1
-if [ $ret -ne 0 ]; then echo_i "failed"; fi
-status=$((status+ret))
+(cd ns2; $NAMED -c named-alt2.conf -D runtime-ns2-extra-2 -X named.lock -m record,size,mctx -d 99 -g -U 4 >> named3.run 2>&1 & )
+sleep 2
+grep "another named process" ns2/named3.run > /dev/null || ret=1
+pid=`cat ns2/named3.pid 2>/dev/null`
+test "${pid:+set}" = set && $KILL -15 ${pid} >/dev/null 2>&1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=`expr $status + $ret`

-n=$((n+1))
+n=`expr $n + 1`
 echo_i "verifying that 'lock-file none' disables process check ($n)"
 ret=0
-(cd ns2 && $NAMED -c named-alt3.conf -D runtime-ns2-extra-3 -m record,size,mctx -d 99 -g -U 4 >> named$n.run 2>&1 & )
-wait_for_named "running$" ns2/named$n.run || ret=1
-grep "another named process" ns2/named$n.run > /dev/null && ret=1
-kill_named ns2/named-alt3.pid || ret=1
-if [ $ret -ne 0 ]; then echo_i "failed"; fi
-status=$((status+ret))
+(cd ns2; $NAMED -c named-alt3.conf -D runtime-ns2-extra-3 -m record,size,mctx -d 99 -g -U 4 >> named4.run 2>&1 & )
+sleep 2
+grep "another named process" ns2/named4.run > /dev/null && ret=1
+pid=`cat ns2/named4.pid 2>/dev/null`
+test "${pid:+set}" = set && $KILL -15 ${pid} >/dev/null 2>&1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=`expr $status + $ret`

-n=$((n+1))
+n=`expr $n + 1`
 echo_i "checking that named refuses to reconfigure if working directory is not writable ($n)"
 ret=0
 copy_setports ns2/named-alt4.conf.in ns2/named.conf
-$RNDCCMD 10.53.0.2 reconfig > rndc.out.$n 2>&1 && ret=1
+$RNDCCMD 10.53.0.2 reconfig > rndc.out.$n 2>&1
 grep "failed: permission denied" rndc.out.$n > /dev/null 2>&1 || ret=1
 sleep 1
 grep "[^-]directory './nope' is not writable" ns2/named.run > /dev/null 2>&1 || ret=1
-if [ $ret -ne 0 ]; then echo_i "failed"; fi
-status=$((status+ret))
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=`expr $status + $ret`

-n=$((n+1))
+n=`expr $n + 1`
 echo_i "checking that named refuses to reconfigure if managed-keys-directory is not writable ($n)"
 ret=0
 copy_setports ns2/named-alt5.conf.in ns2/named.conf
-$RNDCCMD 10.53.0.2 reconfig > rndc.out.$n 2>&1 && ret=1
+$RNDCCMD 10.53.0.2 reconfig > rndc.out.$n 2>&1
 grep "failed: permission denied" rndc.out.$n > /dev/null 2>&1 || ret=1
 sleep 1
 grep "managed-keys-directory './nope' is not writable" ns2/named.run > /dev/null 2>&1 || ret=1
-if [ $ret -ne 0 ]; then echo_i "failed"; fi
-status=$((status+ret))
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=`expr $status + $ret`

-n=$((n+1))
+n=`expr $n + 1`
 echo_i "checking that named refuses to reconfigure if new-zones-directory is not writable ($n)"
 ret=0
 copy_setports ns2/named-alt6.conf.in ns2/named.conf
-$RNDCCMD 10.53.0.2 reconfig > rndc.out.$n 2>&1 && ret=1
+$RNDCCMD 10.53.0.2 reconfig > rndc.out.$n 2>&1
 grep "failed: permission denied" rndc.out.$n > /dev/null 2>&1 || ret=1
 sleep 1
 grep "new-zones-directory './nope' is not writable" ns2/named.run > /dev/null 2>&1 || ret=1
-if [ $ret -ne 0 ]; then echo_i "failed"; fi
-status=$((status+ret))
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=`expr $status + $ret`

-n=$((n+1))
-echo_i "checking that named recovers when configuration file is valid again ($n)"
-ret=0
-copy_setports ns2/named1.conf.in ns2/named.conf
-$RNDCCMD 10.53.0.2 reconfig > rndc.out.$n 2>&1 || ret=1
-[ -s ns2/named.pid ] || ret=1
-kill_named ns2/named.pid || ret=1
-if [ $ret -ne 0 ]; then echo_i "failed"; fi
-status=$((status+ret))
-
-n=$((n+1))
+n=`expr $n + 1`
 echo_i "checking that named refuses to start if working directory is not writable ($n)"
 ret=0
-(cd ns2 && $NAMED -c named-alt4.conf -D runtime-ns2-extra-4 -d 99 -g > named$n.run 2>&1 &)
-wait_for_named "exiting (due to fatal error)" ns2/named$n.run || ret=1
-grep "[^-]directory './nope' is not writable" ns2/named$n.run > /dev/null 2>&1 || ret=1
-kill_named ns2/named.pid && ret=1
-if [ $ret -ne 0 ]; then echo_i "failed"; fi
-status=$((status+ret))
+cd ns2
+$NAMED -c named-alt4.conf -D runtime-ns2-extra-4 -d 99 -g > named4.run 2>&1 &
+sleep 2
+grep "exiting (due to fatal error)" named4.run > /dev/null || ret=1
+# pidfile could be in either place depending on whether the directory
+# successfully changed.
+pid=`cat named.pid 2>/dev/null`
+test "${pid:+set}" = set && $KILL -15 ${pid} >/dev/null 2>&1
+pid=`cat ../named.pid 2>/dev/null`
+test "${pid:+set}" = set && $KILL -15 ${pid} >/dev/null 2>&1
+cd ..
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=`expr $status + $ret`

-n=$((n+1))
+n=`expr $n + 1`
 echo_i "checking that named refuses to start if managed-keys-directory is not writable ($n)"
 ret=0
-(cd ns2 && $NAMED -c named-alt5.conf -D runtime-ns2-extra-5 -d 99 -g > named$n.run 2>&1 &)
-wait_for_named "exiting (due to fatal error)" ns2/named$n.run || ret=1
-grep "managed-keys-directory './nope' is not writable" ns2/named$n.run > /dev/null 2>&1 || ret=1
-kill_named named.pid && ret=1
-if [ $ret -ne 0 ]; then echo_i "failed"; fi
-status=$((status+ret))
+cd ns2
+$NAMED -c named-alt5.conf -D runtime-ns2-extra-5 -d 99 -g > named5.run 2>&1 &
+sleep 2
+grep "exiting (due to fatal error)" named5.run > /dev/null || ret=1
+# pidfile could be in either place depending on whether the directory
+# successfully changed.
+pid=`cat named.pid 2>/dev/null`
+test "${pid:+set}" = set && $KILL -15 ${pid} >/dev/null 2>&1
+pid=`cat ../named.pid 2>/dev/null`
+test "${pid:+set}" = set && $KILL -15 ${pid} >/dev/null 2>&1
+cd ..
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=`expr $status + $ret`

-n=$((n+1))
-echo_i "checking that named refuses to start if new-zones-directory is not writable ($n)"
-ret=0
-(cd ns2 && $NAMED -c named-alt6.conf -D runtime-ns2-extra-6 -d 99 -g > named$n.run 2>&1 &)
-wait_for_named "exiting (due to fatal error)" ns2/named$n.run || ret=1
-grep "new-zones-directory './nope' is not writable" ns2/named$n.run > /dev/null 2>&1 || ret=1
-kill_named ns2/named.pid && ret=1
-if [ $ret -ne 0 ]; then echo_i "failed"; fi
-status=$((status+ret))
-
-n=$((n+1))
+n=`expr $n + 1`
 echo_i "checking that named logs control characters in octal notation ($n)"
 ret=0
-INSTANCE_NAME="runtime-ns2-extra-7-$(cat ctrl-chars)"
-(cd ns2 && $NAMED -c named-alt7.conf -D "${INSTANCE_NAME}" -d 99 -g > named$n.run 2>&1 &)
-wait_for_named "running$" ns2/named$n.run || ret=1
-grep 'running as.*\\177\\033' ns2/named$n.run > /dev/null || ret=1
-kill_named ns2/named.pid || ret=1
-if [ $ret -ne 0 ]; then echo_i "failed"; fi
-status=$((status+ret))
+SPEC_DIR=`cat ctrl-char-dir-name`
+mkdir "ns2/${SPEC_DIR}"
+copy_setports ns2/named-alt7.conf.in "ns2/${SPEC_DIR}/named.conf"
+cd ns2
+$NAMED -c "${SPEC_DIR}/named.conf" -d 99 -g > named6.run 2>&1 &
+sleep 2
+grep 'running as.*\\177\\033' named6.run > /dev/null || ret=1
+pid=`cat named7.pid 2>/dev/null`
+test "${pid:+set}" = set && $KILL -15 ${pid} >/dev/null 2>&1
+cd ..
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=`expr $status + $ret`

-n=$((n+1))
+n=`expr $n + 1`
 echo_i "checking that named escapes special characters in the logs ($n)"
 ret=0
-INSTANCE_NAME="runtime-ns2-extra-8-$;"
-(cd ns2 && $NAMED -c named-alt7.conf -D "${INSTANCE_NAME}" -d 99 -g > named$n.run 2>&1 &)
-wait_for_named "running$" ns2/named$n.run || ret=1
-grep 'running as.*\\$\\;' ns2/named$n.run > /dev/null || ret=1
-kill_named ns2/named.pid || ret=1
-if [ $ret -ne 0 ]; then echo_i "failed"; fi
-status=$((status+ret))
+SPEC_DIR="$;"
+mkdir "ns2/${SPEC_DIR}"
+copy_setports ns2/named-alt7.conf.in "ns2/${SPEC_DIR}/named.conf"
+cd ns2
+$NAMED -c "${SPEC_DIR}/named.conf" -d 99 -g > named7.run 2>&1 &
+sleep 2
+grep 'running as.*\\$\\;' named7.run > /dev/null || ret=1
+pid=`cat named7.pid 2>/dev/null`
+test "${pid:+set}" = set && $KILL -15 ${pid} >/dev/null 2>&1
+cd ..
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=`expr $status + $ret`

-n=$((n+1))
+n=`expr $n + 1`
 echo_i "checking that named logs an ellipsis when the command line is larger than 8k bytes ($n)"
 ret=0
-LONG_CMD_LINE=$(cat long-cmd-line)
-# shellcheck disable=SC2086
-(cd ns2 && $NAMED $LONG_CMD_LINE -c "named-alt7.conf" -g > named$n.run 2>&1 &)
-wait_for_named "running$" ns2/named$n.run || ret=1
-grep "running as.*\.\.\.$" ns2/named$n.run > /dev/null || ret=1
-kill_named ns2/named.pid || ret=1
-if [ $ret -ne 0 ]; then echo_i "failed"; fi
-status=$((status+ret))
+SPEC_DIR=`yes | head -10000 | tr -d '\n'`
+cd ns2
+$NAMED -c "${SPEC_DIR}/named.conf" -d 99 -g > named8.run 2>&1 &
+sleep 2
+grep "running as.*\.\.\.$" named8.run > /dev/null || ret=1
+pid=`cat named7.pid 2>/dev/null`
+test "${pid:+set}" = set && $KILL -15 ${pid} >/dev/null 2>&1
+cd ..
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=`expr $status + $ret`

-n=$((n+1))
+n=`expr $n + 1`
 echo_i "verifying that named switches UID ($n)"
-if [ "$(id -u)" -eq 0 ] && [ -z "$CYGWIN" ]; then
+if [ "`id -u`" = 0 ] && [ ! "$CYGWIN" ]; then
    ret=0
-    TEMP_NAMED_DIR=$(mktemp -d "$(pwd)/ns2/tmp.XXXXXXXX")
-    if [ "$?" -eq 0 ]; then
+    TEMP_NAMED_DIR=`mktemp -d`
+    if [ -d "${TEMP_NAMED_DIR}" ]; then
        copy_setports ns2/named-alt9.conf.in "${TEMP_NAMED_DIR}/named-alt9.conf"
-        export SOFTHSM2_CONF="${TEMP_NAMED_DIR}/softhsm2.conf"
-        sh "$TOP/util/prepare-softhsm2.sh"
-        chown -R nobody: "${TEMP_NAMED_DIR}"
+        chown -R nobody "${TEMP_NAMED_DIR}"
        chmod 0700 "${TEMP_NAMED_DIR}"
-        ( cd "${TEMP_NAMED_DIR}" && $NAMED -u nobody -c named-alt9.conf -d 99 -g -U 4 >> named$n.run 2>&1 & ) || ret=1
-        wait_for_named "running$" "${TEMP_NAMED_DIR}/named$n.run" || ret=1
+        ( cd "${TEMP_NAMED_DIR}" && $NAMED -u nobody -c named-alt9.conf -d 99 -g -U 4 >> named9.run 2>&1 & )
+        sleep 2
        [ -s "${TEMP_NAMED_DIR}/named9.pid" ] || ret=1
-        grep "loading configuration: permission denied" "${TEMP_NAMED_DIR}/named$n.run" > /dev/null && ret=1
-        kill_named "${TEMP_NAMED_DIR}/named9.pid" || ret=1
+        grep "loading configuration: permission denied" "${TEMP_NAMED_DIR}/named9.run" > /dev/null && ret=1
+        pid=`cat "${TEMP_NAMED_DIR}/named9.pid" 2>/dev/null`
+        test "${pid:+set}" = set && $KILL -15 "${pid}" >/dev/null 2>&1
+        mv "${TEMP_NAMED_DIR}" ns2/
    else
        echo_i "mktemp failed"
        ret=1
    fi
-    if [ $ret -ne 0 ]; then echo_i "failed"; fi
-    status=$((status+ret))
+    if [ $ret != 0 ]; then echo_i "failed"; fi
+    status=`expr $status + $ret`
 else
    echo_i "skipped, not running as root or running on Windows"
 fi
@@ -166,6 +166,7 @@ check_stats_limit() {
 	assert_int_equal "${TCP_HIGH}" "${TCP_LIMIT}" "TCP high-water value" || return 1
 }
 retry 2 check_stats_limit || ret=1
+#close_connections $((TCP_LIMIT + 1)) || :
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status + ret))

@@ -291,8 +291,6 @@ print_yaml(dns_dtdata_t *dt) {
 	}

 	if (dt->msg != NULL) {
-		dt->msg->indent.count = 2;
-		dt->msg->indent.string = "  ";
 		printf("  %s:\n", ((dt->type & DNS_DTTYPE_QUERY) != 0)
 				     ? "query_message_data"
 				     : "response_message_data");
@@ -329,6 +327,8 @@ main(int argc, char *argv[]) {
 				break;
 			case 'y':
 				yaml = true;
+				dns_master_indentstr = "  ";
+				dns_master_indent = 2;
 				break;
 			default:
 				usage();
@@ -248,9 +248,9 @@ recvresponse(isc_task_t *task, isc_event_t *event) {

 	styleflags |= DNS_STYLEFLAG_REL_OWNER;
 	if (yaml) {
+		dns_master_indentstr = "  ";
+		dns_master_indent = 3;
 		styleflags |= DNS_STYLEFLAG_YAML;
-		response->indent.string = "  ";
-		response->indent.count = 3;
 	} else {
 		if (display_comments) {
 			styleflags |= DNS_STYLEFLAG_COMMENT;
@@ -26,7 +26,7 @@
 # See https://data.iana.org/root-anchors/root-anchors.xml for current trust
 # anchor information for the root zone.

-trust-anchors {
+dnssec-keys {
        # This key (20326) was published in the root zone in 2017.
        . initial-key 257 3 8 "AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3
                +/4RgWOq7HrxRixHlFlExOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kv
@@ -1,6 +1,6 @@
 #ifndef BIND_KEYS_H
 #define BIND_KEYS_H 1
-#define TRUST_ANCHORS "\
+#define DNSSEC_KEYS "\
 # The bind.keys file is used to override the built-in DNSSEC trust anchors\n\
 # which are included as part of BIND 9.  The only trust anchors it contains\n\
 # are for the DNS root zone (\".\").  Trust anchors for any other zones MUST\n\
@@ -29,7 +29,7 @@
 # See https://data.iana.org/root-anchors/root-anchors.xml for current trust\n\
 # anchor information for the root zone.\n\
 \n\
-trust-anchors {\n\
+dnssec-keys {\n\
        # This key (20326) was published in the root zone in 2017.\n\
        . initial-key 257 3 8 \"AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3\n\
                +/4RgWOq7HrxRixHlFlExOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kv\n\
@@ -1,40 +0,0 @@
-@@
-expression E1, E2, E3;
-statement S;
-expression V;
-@@
-
- V = dns_name_dup(E1, E2, E3);
-+ dns_name_dup(E1, E2, E3);
- if (V != ISC_R_SUCCESS) S
-
-@@
-expression E1, E2, E3;
-statement S1, S2;
-expression V;
-@@
-
- V = dns_name_dup(E1, E2, E3);
- if (V != ISC_R_SUCCESS) S1 else { S2 }
-+ dns_name_dup(E1, E2, E3);
-+ S2
-
-@@
-expression E1, E2, E3;
-expression V;
-@@
-
- V = dns_name_dup(E1, E2, E3);
- RUNTIME_CHECK(V == ISC_R_SUCCESS);
-+ dns_name_dup(E1, E2, E3);
-
-@@
-expression E1, E2, E3;
-statement S1, S2;
-expression V;
-@@
-
- V = dns_name_dup(E1, E2, E3);
-+ dns_name_dup(E1, E2, E3);
-S1
- if (V != ISC_R_SUCCESS) S2
@@ -1,19 +0,0 @@
-@ rule1 @
-identifier f1;
-@@
-
-void f1(...)
-{
-...
-}
-
-@ rule2 @
-identifier rule1.f1;
-identifier f2;
-@@
-
-void f2(...) {
-...
-* return(f1(...));
-...
-}
@@ -968,7 +968,6 @@ LT_SYS_LIBRARY_PATH
 PKG_CONFIG
 PKG_CONFIG_PATH
 PKG_CONFIG_LIBDIR
-PYTHON
 MAXMINDDB_CFLAGS
 MAXMINDDB_LIBS
 MAXMINDDB_PREFIX
@@ -1727,7 +1726,6 @@ Some influential environment variables:
              directories to add to pkg-config's search path
  PKG_CONFIG_LIBDIR
              path overriding pkg-config's built-in search path
-  PYTHON      path to python executable
  MAXMINDDB_CFLAGS
              C compiler flags for MAXMINDDB, overriding pkg-config
  MAXMINDDB_LIBS
@@ -12487,14 +12485,9 @@ except: exit(1)'
 testply='try: import ply
 except: exit(1)'

-testsetup='try: from distutils.core import setup
-except: exit(1)'
-
 default_with_python="python python3 python3.7 python3.6 python3.5 python3.4 python3.3 python3.2 python2 python2.7"


-
-
 # Check whether --with-python was given.
 if test "${with_python+set}" = set; then :
  withval=$with_python;
@@ -12518,7 +12511,6 @@ fi
 if test "$with_python" = "no"; then :
  { $as_echo "$as_me:${as_lineno-$LINENO}: checking for Python support" >&5
 $as_echo_n "checking for Python support... " >&6; }
-       unset PYTHON
       { $as_echo "$as_me:${as_lineno-$LINENO}: result: disabled" >&5
 $as_echo "disabled" >&6; }
 else
@@ -12611,18 +12603,6 @@ $as_echo_n "checking Python module 'ply'... " >&6; }
 	 if "$PYTHON" -c "$testply" 2>/dev/null; then :
  { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
 $as_echo "yes" >&6; }
-else
-  { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
-		unset PYTHON
-		continue
-fi
-
-	 { $as_echo "$as_me:${as_lineno-$LINENO}: checking Python module 'distutils.core setup'" >&5
-$as_echo_n "checking Python module 'distutils.core setup'... " >&6; }
-	 if "$PYTHON" -c "$testsetup" 2>/dev/null; then :
-  { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
-$as_echo "yes" >&6; }
 else
  { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
 $as_echo "no" >&6; }
@@ -13616,7 +13596,8 @@ $as_echo "#define HAVE_TLS 1" >>confdefs.h

 else

-			     as_fn_error $? "Thread Local Storage support required, update your toolchain to build BIND 9" "$LINENO" 5
+			     { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
+$as_echo "no" >&6; }

 fi
 rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
@@ -13654,7 +13635,8 @@ $as_echo "#define HAVE_TLS 1" >>confdefs.h

 else

-			     as_fn_error $? "Thread Local Storage support required, update your toolchain to build BIND 9" "$LINENO" 5
+			     { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
+$as_echo "no" >&6; }

 fi
 rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
@@ -202,13 +202,8 @@ except: exit(1)'
 testply='try: import ply
 except: exit(1)'

-testsetup='try: from distutils.core import setup
-except: exit(1)'
-
 default_with_python="python python3 python3.7 python3.6 python3.5 python3.4 python3.3 python3.2 python2 python2.7"

-AC_ARG_VAR([PYTHON], [path to python executable])
-
 AC_ARG_WITH([python],
 	    AS_HELP_STRING([--with-python=PATH],
 			   [specify path to Python interpreter]),
@@ -223,7 +218,6 @@ AS_IF([test "$with_python" = "yes"],

 AS_IF([test "$with_python" = "no"],
      [AC_MSG_CHECKING([for Python support])
-       unset PYTHON
       AC_MSG_RESULT([disabled])],
      [for p in $with_python
       do
@@ -261,13 +255,6 @@ AS_IF([test "$with_python" = "no"],
 		unset PYTHON
 		continue])

-	 AC_MSG_CHECKING([Python module 'distutils.core setup'])
-	 AS_IF(["$PYTHON" -c "$testsetup" 2>/dev/null],
-	       [AC_MSG_RESULT([yes])],
-	       [AC_MSG_RESULT([no])
-		unset PYTHON
-		continue])
-
 	 # Stop looking any further once we find a Python interpreter
 	 # satisfying all requirements.
 	 break
@@ -389,7 +376,7 @@ AC_CHECK_HEADERS([threads.h],
 			     AC_DEFINE([HAVE_THREAD_LOCAL],[1],[Define if thread_local keyword is available])
 			     AC_DEFINE([HAVE_TLS],[1],[Define if Thread-Local Storage is available])
 			 ],[
-			     AC_MSG_ERROR([Thread Local Storage support required, update your toolchain to build BIND 9])
+			     AC_MSG_RESULT([no])
 			 ])
 		 ],[
 		     AC_MSG_CHECKING([for Thread-Local Storage using __thread])
@@ -405,7 +392,7 @@ AC_CHECK_HEADERS([threads.h],
 			     AC_DEFINE([HAVE___THREAD],[1],[Define if __thread keyword is available])
 			     AC_DEFINE([HAVE_TLS],[1],[Define if Thread-Local Storage is available])
 			 ],[
-			     AC_MSG_ERROR([Thread Local Storage support required, update your toolchain to build BIND 9])
+			     AC_MSG_RESULT([no])
 			 ])
 		 ])

@@ -2212,7 +2212,7 @@ allow-update { !{ !localnets; any; }; key host1-host2. ;};
 	  <userinput>yes</userinput>, DNSSEC validation will only occur
 	  if at least one trust anchor has been explicitly configured
 	  in <filename>named.conf</filename>
-	  using a <command>trust-anchors</command> statement (or the
+	  using a <command>dnssec-keys</command> statement (or the
 	  <command>managed-keys</command> and <command>trusted-keys</command>
 	  statements, both deprecated).
 	</para>
@@ -2227,7 +2227,7 @@ allow-update { !{ !localnets; any; }; key host1-host2. ;};
 	</para>

 	<para>
-	  The keys specified in <command>trust-anchors</command>
+	  The keys specified in <command>dnssec-keys</command>
 	  copies of DNSKEY RRs for zones that are used to form the
 	  first link in the cryptographic chain of trust.  Keys configured
 	  with the keyword <command>static-key</command> or
@@ -2241,7 +2241,7 @@ allow-update { !{ !localnets; any; }; key host1-host2. ;};
 	</para>

 	<para>
-	  <command>trust-anchors</command> is described in more detail
+	  <command>dnssec-keys</command> is described in more detail
 	  later in this document.
 	</para>

@@ -2264,7 +2264,7 @@ allow-update { !{ !localnets; any; }; key host1-host2. ;};
 	</para>

 <programlisting>
-trust-anchors {
+dnssec-keys {
 	/* Root Key */
 	"." initial-key 257 3 3 "BNY4wrWM1nCfJ+CXd0rVXyYmobt7sEEfK3clRbGaTwS
 				 JxrGkxJWoZu6I7PzJu/E9gx4UC1zGAHlXKdE4zYIpRh
@@ -3202,7 +3202,7 @@ $ORIGIN 0.0.0.0.0.0.0.0.8.b.d.0.1.0.0.2.ip6.arpa.
 	    </row>
 	    <row rowsep="0">
 	      <entry colname="1">
-		<para><command>trust-anchors</command></para>
+		<para><command>dnssec-keys</command></para>
 	      </entry>
 	      <entry colname="2">
 		<para>
@@ -3223,9 +3223,9 @@ $ORIGIN 0.0.0.0.0.0.0.0.8.b.d.0.1.0.0.2.ip6.arpa.
 	      </entry>
 	      <entry colname="2">
 		<para>
-		  is identical to <command>trust-anchors</command>;
+		  is identical to <command>dnssec-keys</command>;
 		  this option is deprecated in favor
-		  of <command>trust-anchors</command> with
+		  of <command>dnssec-keys</command> with
 		  the <command>initial-key</command> keyword,
 		  and may be removed in a future release.
 		</para>
@@ -3239,7 +3239,7 @@ $ORIGIN 0.0.0.0.0.0.0.0.8.b.d.0.1.0.0.2.ip6.arpa.
 		<para>
 		  defines permanent trusted DNSSEC keys;
 		  this option is deprecated in favor
-		  of <command>trust-anchors</command> with
+		  of <command>dnssec-keys</command> with
 		  the <command>static-key</command> keyword,
 		  and may be removed in a future release.
 		</para>
@@ -4624,7 +4624,7 @@ badresp:1,adberr:0,findfail:0,valfail:0]
 		track managed DNSSEC keys (i.e., those configured using
 		the <command>initial-key</command> or
 		<command>initial-ds</command> keywords in a
-		<command>trust-anchors</command> statement).  By default,
+		<command>dnssec-keys</command> statement).  By default,
 		this is the working directory.  The directory
 		<emphasis>must</emphasis> be writable by the effective
 		user ID of the <command>named</command> process.
@@ -5062,7 +5062,7 @@ options {
 		as insecure.
 	      </para>
 	      <para>
-		Configured trust anchors in <command>trust-anchors</command>
+		Configured trust anchors in <command>dnssec-keys</command>
 		(or <command>managed-keys</command> or
 		<command>trusted-keys</command>, both deprecated)
 		that match a disabled algorithm will be ignored and treated
@@ -5100,7 +5100,7 @@ options {
 		they are secure.  If <userinput>no</userinput>, then normal
 		DNSSEC validation applies allowing for insecure answers to
 		be accepted.  The specified domain must be defined as a
-		trust anchor, for instance in a <command>trust-anchors</command>
+		trust anchor, for instance in a <command>dnssec-keys</command>
 		statement, or <command>dnssec-validation auto</command> must
 		be active.
 	      </para>
@@ -6217,7 +6217,7 @@ options {
 		  Causes <command>named</command> to send specially-formed
 		  queries once per day to domains for which trust anchors
 		  have been configured via, e.g.,
-		  <command>trust-anchors</command> or
+		  <command>dnssec-keys</command> or
 		  <command>dnssec-validation auto</command>.
 		</para>
 		<para>
@@ -6432,7 +6432,7 @@ options {
 		<para>
 		  If set to <userinput>yes</userinput>, DNSSEC validation is
 		  enabled, but a trust anchor must be manually configured
-		  using a <command>trust-anchors</command> statement (or
+		  using a <command>dnssec-keys</command> statement (or
 		  the <command>managed-keys</command> or the
 		  <command>trusted-keys</command> statements, both deprecated).
 		  If there is no configured trust anchor, validation will
@@ -10848,14 +10848,14 @@ example.com                 CNAME   rpz-tcp-only.
 	  </para>
 	</section>

-	<section xml:id="trust_anchors"><info><title><command>trust-anchors</command> Statement Grammar</title></info>
-	<xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="trust-anchors.grammar.xml"/>
+	<section xml:id="dnssec_keys"><info><title><command>dnssec-keys</command> Statement Grammar</title></info>
+	<xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="dnssec-keys.grammar.xml"/>
 	</section>
-	<section xml:id="trust-anchors"><info><title><command>trust-anchors</command> Statement Definition
+	<section xml:id="dnssec-keys"><info><title><command>dnssec-keys</command> Statement Definition
 	    and Usage</title></info>

 	  <para>
-	    The <command>trust-anchors</command> statement defines DNSSEC
+	    The <command>dnssec-keys</command> statement defines DNSSEC
 	    trust anchors.  DNSSEC is described in <xref linkend="DNSSEC"/>.
 	  </para>
 	  <para>
@@ -10874,21 +10874,21 @@ example.com                 CNAME   rpz-tcp-only.
 	    the <command>validate-except</command> option).
 	  </para>
 	  <para>
-	    All keys listed in <command>trust-anchors</command>, and
+	    All keys listed in <command>dnssec-keys</command>, and
 	    their corresponding zones, are deemed to exist regardless
 	    of what parent zones say.  Only keys configured as trust anchors
 	    are used to validate the DNSKEY RRset for the corresponding
 	    name. The parent's DS RRset will not be used.
 	  </para>
 	  <para>
-	    <command>trust-anchors</command> may be set at the top level
+	    <command>dnssec-keys</command> may be set at the top level
 	    of <filename>named.conf</filename> or within a view.  If it is
 	    set in both places, the configurations are additive: keys
 	    defined at the top level are inherited by all views, but keys
 	    defined in a view are only used within that view.
 	  </para>
 	  <para>
-	    The <command>trust-anchors</command> statement can contain
+	    The <command>dnssec-keys</command> statement can contain
 	    multiple trust anchor entries, each consisting of a
 	    domain name, followed by an "anchor type" keyword indicating
 	    the trust anchor's format, followed by the key or digest data.
@@ -10928,7 +10928,7 @@ example.com                 CNAME   rpz-tcp-only.
 	    <command>static-ds</command> would be unable to validate
 	    this zone any longer; it would reply with a SERVFAIL response
 	    code.  This would continue until the resolver operator had
-	    updated the <command>trust-anchors</command> statement with
+	    updated the <command>dnssec-keys</command> statement with
 	    the new key.
 	  </para>
 	  <para>
@@ -10964,7 +10964,7 @@ example.com                 CNAME   rpz-tcp-only.
 	    <command>initial-key</command> or <command>initial-ds</command>
 	    configured in <filename>named.conf</filename>, it fetches the
 	    DNSKEY RRset directly from the zone apex, and validates it
-	    using the trust anchor specified in <command>trust-anchors</command>.
+	    using the trust anchor specified in <command>dnssec-keys</command>.
 	    If the DNSKEY RRset is validly signed by a key matching
 	    the trust anchor, then it is used as the basis for a new
 	    managed keys database.
@@ -10973,10 +10973,10 @@ example.com                 CNAME   rpz-tcp-only.
 	    From that point on, whenever <command>named</command> runs, it
 	    sees the <command>initial-key</command> or
 	    <command>initial-ds</command> listed in
-	    <command>trust-anchors</command>, checks to
+	    <command>dnssec-keys</command>, checks to
 	    make sure RFC 5011 key maintenance has already been initialized
 	    for the specified domain, and if so, it simply moves on.  The
-	    key specified in the <command>trust-anchors</command>
+	    key specified in the <command>dnssec-keys</command>
 	    statement is not used to validate answers; it is
 	    superseded by the key or keys stored in the managed keys
 	    database.
@@ -10985,7 +10985,7 @@ example.com                 CNAME   rpz-tcp-only.
 	    The next time <command>named</command> runs after an
 	    <command>initial-key</command> or <command>initial-ds</command>
 	    trust anchor has been <emphasis>removed</emphasis> from the
-	    <command>trust-anchors</command> statement (or changed to
+	    <command>dnssec-keys</command> statement (or changed to
 	    a <command>static-key</command> or <command>static-ds</command>),
 	    the corresponding keys will be removed from the managed keys
 	    database, and RFC 5011 key maintenance will no longer be used
@@ -11261,7 +11261,7 @@ example.com                 CNAME   rpz-tcp-only.

 	  <para>
 	    The <command>managed-keys</command> statement has been
-	    deprecated in favor of <xref linkend="trust_anchors"/>
+	    deprecated in favor of <xref linkend="dnssec_keys"/>
 	    with the <command>initial-key</command> keyword.
 	  </para>
 	</section>
@@ -11274,7 +11274,7 @@ example.com                 CNAME   rpz-tcp-only.

 	  <para>
 	    The <command>trusted-keys</command> statement has been
-	    deprecated in favor of <xref linkend="trust_anchors"/>
+	    deprecated in favor of <xref linkend="dnssec_keys"/>
 	    with the <command>static-key</command> keyword.
 	  </para>
 	</section>
@@ -11663,7 +11663,7 @@ view "external" {
 		        (KSK) for the zone must be configured as a trust
 		        anchor in <filename>named.conf</filename>: that
 		        is, a key for the zone must be specified in
-		        <command>trust-anchors</command>.  In the case
+		        <command>dnssec-keys</command>.  In the case
 		        of the root zone, you may also rely on the
 		        built-in root trust anchor, which is enabled
 			when <xref endterm="dnssec_validation_term"
@@ -12,7 +12,7 @@
 <!-- Generated by doc/misc/docbook-options.pl -->

 <programlisting>
-<command>trust-anchors</command> { <replaceable>string</replaceable> ( static-key |
+<command>dnssec-keys</command> { <replaceable>string</replaceable> ( static-key |
    <command>initial-key</command> | static-ds | initial-ds )
    <replaceable>integer</replaceable> <replaceable>integer</replaceable> <replaceable>integer</replaceable>
    <replaceable>quoted_string</replaceable>; ... };
@@ -24,10 +24,10 @@
    <!-- TODO: command tag is overloaded for configuration and executables -->
    <para>To configure a validating resolver to use RFC 5011 to
    maintain a trust anchor, configure the trust anchor using a
-    <command>trust-anchors</command> statement and the
+    <command>dnssec-keys</command> statement and the
    <command>initial-key</command> or <command>initial-ds</command>
    keyword. Information about this can be found in
-    <xref linkend="trust-anchors"/>.</para>
+    <xref linkend="dnssec-keys"/>.</para>
  </section>
  <section><info><title>Authoritative Server</title></info>

@@ -1,33 +0,0 @@
-<!--
- - Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- -
- - This Source Code Form is subject to the terms of the Mozilla Public
- - License, v. 2.0. If a copy of the MPL was not distributed with this
- - file, You can obtain one at http://mozilla.org/MPL/2.0/.
- -
- - See the COPYRIGHT file distributed with this work for additional
- - information regarding copyright ownership.
-->
-
-<section xml:id="relnotes-9.15.7"><info><title>Notes for BIND 9.15.7</title></info>
-
-  <section xml:id="relnotes-9.15.7-changes"><info><title>Feature Changes</title></info>
-    <itemizedlist>
-      <listitem>
-        <para>
-	  The <command>dnssec-keys</command> configuration statement,
-	  which was introduced in 9.15.1 and revised in 9.15.6, has now
-	  been renamed to the more descriptive
-	  <command>trust-anchors</command>.
-        </para>
-        <para>
-	  (See the sections on
-	  <xref linkend="relnotes-9.15.6" xrefstyle="template:9.15.6"/> and
-	  <xref linkend="relnotes-9.15.1" xrefstyle="template:9.15.1"/>
-	  for prior discussion of this feature.)
-        </para>
-      </listitem>
-    </itemizedlist>
-  </section>
-
-</section>
@@ -17,12 +17,11 @@
    C compiler.
  </para>
  <para>
-    The <filename>libuv</filename> asynchronous I/O library and the
-    OpenSSL cryptography library must be available for the target
-    platform.  A PKCS#11 provider can be used instead of OpenSSL for
-    Public Key cryptography (i.e., DNSSEC signing and validation),
-    but OpenSSL is still required for general cryptography operations
-    such as hashing and random number generation.
+    The OpenSSL cryptography library must be available for the target
+    platform.  A PKCS#11 provider can be used instead for Public Key
+    cryptography (i.e., DNSSEC signing and validation), but OpenSSL is
+    still required for general cryptography operations such as hashing
+    and random number generation.
  </para>
  <para>
    More information can be found in the <filename>PLATFORMS.md</filename>
@@ -12,5 +12,8 @@
 <section xml:id="relnotes_thanks"><info><title>Thank You</title></info>
  <para>
    Thank you to everyone who assisted us in making this release possible.
+    If you would like to contribute to ISC to assist us in continuing to
+    make quality open source software, please visit our donations page at
+    <link xmlns:xlink="http://www.w3.org/1999/xlink" xlink:href="https://www.isc.org/donate/">https://www.isc.org/donate/</link>.
  </para>
 </section>
@@ -75,6 +75,6 @@ docbook: options
 	${PERL} docbook-grammars.pl options.active options > ${top_srcdir}/doc/arm/options.grammar.xml
 	${PERL} docbook-grammars.pl options.active server > ${top_srcdir}/doc/arm/server.grammar.xml
 	${PERL} docbook-grammars.pl options.active statistics-channels > ${top_srcdir}/doc/arm/statistics-channels.grammar.xml
-	${PERL} docbook-grammars.pl options.active trust-anchors > ${top_srcdir}/doc/arm/trust-anchors.grammar.xml
+	${PERL} docbook-grammars.pl options.active dnssec-keys > ${top_srcdir}/doc/arm/dnssec-keys.grammar.xml
 	${PERL} docbook-grammars.pl options.active managed-keys > ${top_srcdir}/doc/arm/managed-keys.grammar.xml
 	${PERL} docbook-grammars.pl options.active trusted-keys > ${top_srcdir}/doc/arm/trusted-keys.grammar.xml
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Witold Kręcicki	f136e0c45e	netmgr: add isc_nm_shutdown function which shuts down all active TCP connection but does not destroy netmgr	2019-11-22 23:26:42 +01:00
Evan Hunt	2b05411645	add functions from netmgr-int.h to libisc.def.in	2019-11-22 11:18:00 -08:00
Evan Hunt	140a24c50e	fixup! fixup! WiP: shutdown active sockets when shutting down netmgr	2019-11-22 11:17:35 -08:00
Evan Hunt	7c91b58d40	fixup! finish moving TCP timeout values from ns_server to netmgr	2019-11-22 10:56:14 -08:00
Witold Kręcicki	21a7338b98	fixup! fixup! WiP: shutdown active sockets when shutting down netmgr	2019-11-22 15:04:49 +01:00
Witold Kręcicki	df31bdf239	fixup! WiP: shutdown active sockets when shutting down netmgr	2019-11-22 14:41:22 +01:00
Witold Kręcicki	ea4e56b89d	WiP: shutdown active sockets when shutting down netmgr	2019-11-22 14:13:19 +01:00
Witold Kręcicki	7ff5f95865	netmgr: - add support for TCP backlog, use the value provided by config - don't attach to quota for listening sockets, just assign the value	2019-11-22 13:25:36 +01:00
Witold Kręcicki	223e93d215	Test: increase prefetch test tolerance	2019-11-22 09:43:17 +01:00
Evan Hunt	4975f43e7d	finish moving TCP timeout values from ns_server to netmgr	2019-11-21 23:38:45 -08:00
Evan Hunt	83f9097612	log connection error	2019-11-21 18:38:20 -08:00
Evan Hunt	7ee7bdaec6	use memory pools for ievent and uvreq objects	2019-11-21 18:21:16 -08:00
Evan Hunt	a6a35373c1	remove unused worker memory pool	2019-11-21 17:08:06 -08:00
Witold Kręcicki	655cda9922	Revert "Disable system test retry" This reverts commit `29ab9c6ae6`.	2019-11-21 20:26:44 +01:00
Witold Kręcicki	29ab9c6ae6	Disable system test retry	2019-11-21 20:26:30 +01:00
Witold Kręcicki	a499b77759	Make all atomic reads use atomic_ functions	2019-11-21 20:26:30 +01:00
Evan HuntandWitold Kręcicki	e29980400c	Make TCP timeouts configurable.	2019-11-21 20:26:30 +01:00
Witold Kręcicki	3a102fa4df	Netmgr: - Add timeout support for TCP and TCPDNS connections (protection against slowloris) - Rework/simplify tcpdns state machine.	2019-11-21 20:26:30 +01:00