Return raw zone serial for inline zones

The option provide-zoneversion controls whether ZONEVERSION is
returned.  This applies to primary, secondary and mirror zones.

.gitlab-ci.yml

@@ -383,6 +383,9 @@ stages:
         SHOTGUN_ROUNDS: 3
     - &shotgun_rule_other
       if: '$CI_PIPELINE_SOURCE =~ /^(api|pipeline|schedule|trigger|web)$/'
+  # when using data from a single run, the overall instability of the results
+  # causes quite high false positive rate, rerun the test to attemp to reduce those
+  retry: 1
   script:
     - if [ -z "$BASELINE" ]; then export BASELINE=$BIND_BASELINE_VERSION; fi  # this dotenv variable can't be set in the rules section, because rules are evaluated before any jobs run
     - PIPELINE_ID=$(curl -s -X POST --fail
@@ -584,7 +587,7 @@ vulture:
   <<: *precheck_job
   needs: []
   script:
-    - vulture --exclude "*/ans*/ans.py,conftest.py,isctest" --ignore-names "pytestmark" bin/tests/system/
+    - vulture --exclude "*ans.py,conftest.py,isctest" --ignore-names "pytestmark" bin/tests/system/
 
 ci-variables:
   stage: precheck
@@ -1688,9 +1691,6 @@ respdiff-third-party:
 
 # Performance tests
 
-# Run shotgun:udp right away, but delay other shotgun jobs sligthly in order to
-# allow re-use of the built container image. Otherwise, the jobs would do the
-# same builds in parallel rather than re-use the already built image.
 shotgun:udp:
   <<: *shotgun_job
   variables:
@@ -1701,7 +1701,7 @@ shotgun:tcp:
   <<: *shotgun_job
   variables:
     SHOTGUN_SCENARIO: tcp
-    SHOTGUN_TRAFFIC_MULTIPLIER: 13
+    SHOTGUN_TRAFFIC_MULTIPLIER: 12
 
 shotgun:dot:
   <<: *shotgun_job
@@ -1722,7 +1722,7 @@ shotgun:doh-get:
   variables:
     SHOTGUN_SCENARIO: doh-get
     SHOTGUN_TRAFFIC_MULTIPLIER: 3
-    SHOTGUN_EVAL_THRESHOLD_LATENCY_PCTL_MAX: 0.3  # bump from the default due to increased tail-end jitter
+    SHOTGUN_EVAL_THRESHOLD_LATENCY_PCTL_MAX: 0.4  # bump from the default due to increased tail-end jitter
   rules: *shotgun_rules_manual_mr
 
 .stress-test: &stress_test

Makefile.am

@@ -2,7 +2,11 @@ include $(top_srcdir)/Makefile.top
 
 SUBDIRS = . lib doc
 
-SUBDIRS += bin
+# build libtest before fuzz/* and bin/tests
+SUBDIRS += tests
+
+# run fuzz tests before system tests
+SUBDIRS += fuzz bin
 
 BUILT_SOURCES += bind.keys.h
 CLEANFILES += bind.keys.h

bin/dig/dig.c

@@ -328,6 +328,7 @@ help(void) {
 	       "                 +[no]yaml           (Present the results as "
 	       "YAML)\n"
 	       "                 +[no]zflag          (Set Z flag in query)\n"
+	       "                 +[no]zoneversion    (Request zone version)\n"
 	       "        global d-opts and servers (before host name) affect "
 	       "all "
 	       "queries.\n"
@@ -2574,9 +2575,22 @@ plus_option(char *option, bool is_batchfile, bool *need_clone,
 			lookup->rrcomments = -1;
 		}
 		break;
-	case 'z': /* zflag */
-		FULLCHECK("zflag");
-		lookup->zflag = state;
+	case 'z':
+		switch (cmd[1]) {
+		case 'f': /* zflag */
+			FULLCHECK("zflag");
+			lookup->zflag = state;
+			break;
+		case 'o': /* zoneversion */
+			FULLCHECK("zoneversion");
+			if (state && lookup->edns == -1) {
+				lookup->edns = DEFAULT_EDNS_VERSION;
+			}
+			lookup->zoneversion = state;
+			break;
+		default:
+			goto invalid_option;
+		}
 		break;
 	default:
 	invalid_option:

bin/dig/dig.rst

@@ -757,6 +757,10 @@ abbreviation is unambiguous; for example, :option:`+cd` is equivalent to
    This option sets [or does not set] the last unassigned DNS header flag in a DNS query.
    This flag is off by default.
 
+.. option:: +zoneversion, +nozoneversion
+
+   When enabled, this option includes an EDNS Zone Version request when sending a query.
+
 Multiple Queries
 ~~~~~~~~~~~~~~~~
 

bin/dig/dighost.c

@@ -705,6 +705,7 @@ clone_lookup(dig_lookup_t *lookold, bool servers) {
 	looknew->opcode = lookold->opcode;
 	looknew->expire = lookold->expire;
 	looknew->nsid = lookold->nsid;
+	looknew->zoneversion = lookold->zoneversion;
 	looknew->tcp_keepalive = lookold->tcp_keepalive;
 	looknew->header_only = lookold->header_only;
 	looknew->https_mode = lookold->https_mode;
@@ -2591,6 +2592,14 @@ setup_lookup(dig_lookup_t *lookup) {
 			i++;
 		}
 
+		if (lookup->zoneversion) {
+			INSIST(i < MAXOPTS);
+			opts[i].code = DNS_OPT_ZONEVERSION;
+			opts[i].length = 0;
+			opts[i].value = NULL;
+			i++;
+		}
+
 		if (lookup->ednsoptscnt != 0) {
 			INSIST(i + lookup->ednsoptscnt <= MAXOPTS);
 			memmove(&opts[i], lookup->ednsopts,

bin/dig/dighost.h

@@ -121,7 +121,7 @@ struct dig_lookup {
 		tcp_mode, tcp_mode_set, tls_mode, /*% connect using TLS */
 		trace,				  /*% dig +trace */
 		trace_root, /*% initial query for either +trace or +nssearch */
-		ttlunits, use_usec, waiting_connect, zflag;
+		ttlunits, use_usec, waiting_connect, zflag, zoneversion;
 	char textname[MXNAME]; /*% Name we're going to be looking up */
 	char cmdline[MXNAME];
 	dns_rdatatype_t rdtype;

bin/dnssec/dnssec-keyfromlabel.rst

@@ -43,7 +43,7 @@ Options
 
    This option selects the cryptographic algorithm. The value of ``algorithm`` must
    be one of RSASHA1, NSEC3RSASHA1, RSASHA256, RSASHA512,
-   ECDSAP256SHA256, ECDSAP384SHA384, ED25519, ED448, or SQISIGN.
+   ECDSAP256SHA256, ECDSAP384SHA384, ED25519, or ED448.
 
    These values are case-insensitive. In some cases, abbreviations are
    supported, such as ECDSA256 for ECDSAP256SHA256 and ECDSA384 for

bin/dnssec/dnssec-keygen.c

@@ -152,7 +152,6 @@ usage(void) {
 	fprintf(stderr, "        RSASHA256 | RSASHA512 |\n");
 	fprintf(stderr, "        ECDSAP256SHA256 | ECDSAP384SHA384 |\n");
 	fprintf(stderr, "        ED25519 | ED448\n");
-	fprintf(stderr, "        SQISIGN\n");
 	fprintf(stderr, "    -3: use NSEC3-capable algorithm\n");
 	fprintf(stderr, "    -b <key size in bits>:\n");
 	if (!isc_crypto_fips_mode()) {
@@ -167,7 +166,6 @@ usage(void) {
 	fprintf(stderr, "        ECDSAP384SHA384:\tignored\n");
 	fprintf(stderr, "        ED25519:\tignored\n");
 	fprintf(stderr, "        ED448:\tignored\n");
-	fprintf(stderr, "        SQISIGN:\tignored\n");
 	fprintf(stderr, "        (key size defaults are set according to\n"
 			"        algorithm and usage (ZSK or KSK)\n");
 	fprintf(stderr, "    -n <nametype>: ZONE | HOST | ENTITY | "
@@ -308,7 +306,6 @@ keygen(keygen_ctx_t *ctx, isc_mem_t *mctx, int argc, char **argv) {
 			case DST_ALG_ECDSA384:
 			case DST_ALG_ED25519:
 			case DST_ALG_ED448:
-			case DST_ALG_SQISIGN:
 				break;
 			default:
 				fatal("algorithm %s is incompatible with NSEC3"
@@ -359,7 +356,6 @@ keygen(keygen_ctx_t *ctx, isc_mem_t *mctx, int argc, char **argv) {
 			case DST_ALG_ECDSA384:
 			case DST_ALG_ED25519:
 			case DST_ALG_ED448:
-			case DST_ALG_SQISIGN:
 				break;
 			default:
 				fatal("key size not specified (-b option)");
@@ -524,9 +520,6 @@ keygen(keygen_ctx_t *ctx, isc_mem_t *mctx, int argc, char **argv) {
 	case DST_ALG_ED448:
 		ctx->size = 456;
 		break;
-	case DST_ALG_SQISIGN:
-		ctx->size = 512;
-		break;
 	}
 
 	if (ctx->nametype == NULL) {
@@ -594,7 +587,6 @@ keygen(keygen_ctx_t *ctx, isc_mem_t *mctx, int argc, char **argv) {
 	case DST_ALG_ECDSA384:
 	case DST_ALG_ED25519:
 	case DST_ALG_ED448:
-	case DST_ALG_SQISIGN:
 		show_progress = true;
 		break;
 	}

bin/dnssec/dnssec-keygen.rst

@@ -47,7 +47,7 @@ Options
 
    This option selects the cryptographic algorithm. For DNSSEC keys, the value of
    ``algorithm`` must be one of RSASHA1, NSEC3RSASHA1, RSASHA256,
-   RSASHA512, ECDSAP256SHA256, ECDSAP384SHA384, ED25519, ED448, or SQISIGN.
+   RSASHA512, ECDSAP256SHA256, ECDSAP384SHA384, ED25519, or ED448.
 
    These values are case-insensitive. In some cases, abbreviations are
    supported, such as ECDSA256 for ECDSAP256SHA256 and ECDSA384 for
@@ -92,7 +92,7 @@ Options
    This option specifies the key size in bits. For the algorithms RSASHA1, NSEC3RSASA1, RSASHA256, and
    RSASHA512 the key size must be between 1024 and 4096 bits; DH size is between 128
    and 4096 bits. This option is ignored for algorithms ECDSAP256SHA256,
-   ECDSAP384SHA384, ED25519, ED448, and SQISIGN.
+   ECDSAP384SHA384, ED25519, and ED448.
 
 .. option:: -f flag
 

bin/dnssec/dnssec-ksr.c

@@ -387,9 +387,6 @@ create_key(ksr_ctx_t *ksr, dns_kasp_t *kasp, dns_kasp_key_t *kaspkey,
 	case DST_ALG_ED448:
 		ksr->size = 456;
 		break;
-	case DST_ALG_SQISIGN:
-		ksr->size = 512;
-		break;
 	default:
 		show_progress = false;
 		break;

bin/named/config.c

@@ -99,6 +99,7 @@ options {\n\
 	recursing-file \"named.recursing\";\n\
 	recursive-clients 1000;\n\
 	request-nsid false;\n\
+	request-zoneversion false;\n\
 	resolver-query-timeout 10;\n\
 #	responselog <boolean>;\n\
 	rrset-order { order random; };\n\
@@ -239,6 +240,7 @@ options {\n\
 	notify yes;\n\
 	notify-delay 5;\n\
 	notify-to-soa no;\n\
+	provide-zoneversion yes;\n\
 	send-report-channel .;\n\
 	serial-update-method increment;\n\
 	sig-signing-nodes 100;\n\
@@ -260,6 +262,7 @@ view \"_bind\" chaos {\n\
 	notify no;\n\
 	allow-new-zones no;\n\
 	max-cache-size 2M;\n\
+	provide-zoneversion no;\n\
 \n\
 	# Prevent use of this zone in DNS amplified reflection DoS attacks\n\
 	rate-limit {\n\

bin/named/main.c

@@ -129,6 +129,7 @@ static int maxudp = 0;
 /*
  * -T options:
  */
+static bool cookiealwaysvalid = false;
 static bool dropedns = false;
 static bool ednsformerr = false;
 static bool ednsnotimp = false;
@@ -652,7 +653,9 @@ parse_T_opt(char *option) {
 	 * force the server to behave (or misbehave) in
 	 * specified ways for testing purposes.
 	 */
-	if (!strcmp(option, "dropedns")) {
+	if (!strcmp(option, "cookiealwaysvalid")) {
+		cookiealwaysvalid = true;
+	} else if (!strcmp(option, "dropedns")) {
 		dropedns = true;
 	} else if (!strcmp(option, "ednsformerr")) {
 		ednsformerr = true;
@@ -1220,6 +1223,9 @@ setup(void) {
 	/*
 	 * Modify server context according to command line options
 	 */
+	if (cookiealwaysvalid) {
+		ns_server_setoption(sctx, NS_SERVER_COOKIEALWAYSVALID, true);
+	}
 	if (disable4) {
 		ns_server_setoption(sctx, NS_SERVER_DISABLE4, true);
 	}

bin/named/server.c

@@ -1391,6 +1391,13 @@ configure_peer(const cfg_obj_t *cpeer, isc_mem_t *mctx, dns_peer_t **peerp) {
 		CHECK(dns_peer_setrequestnsid(peer, cfg_obj_asboolean(obj)));
 	}
 
+	obj = NULL;
+	(void)cfg_map_get(cpeer, "request-zoneversion", &obj);
+	if (obj != NULL) {
+		CHECK(dns_peer_setrequestzoneversion(peer,
+						     cfg_obj_asboolean(obj)));
+	}
+
 	obj = NULL;
 	(void)cfg_map_get(cpeer, "send-cookie", &obj);
 	if (obj != NULL) {
@@ -3246,6 +3253,7 @@ create_empty_zone(dns_zone_t *pzone, dns_name_t *name, dns_view_t *view,
 
 	dns_zone_setoption(zone, ~DNS_ZONEOPT_NOCHECKNS, false);
 	dns_zone_setoption(zone, DNS_ZONEOPT_NOCHECKNS, true);
+	dns_zone_setoption(zone, DNS_ZONEOPT_ZONEVERSION, false);
 	dns_zone_setcheckdstype(zone, dns_checkdstype_no);
 	dns_zone_setnotifytype(zone, dns_notifytype_no);
 	dns_zone_setautomatic(zone, true);
@@ -5132,6 +5140,11 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist, cfg_obj_t *config,
 	INSIST(result == ISC_R_SUCCESS);
 	view->requestnsid = cfg_obj_asboolean(obj);
 
+	obj = NULL;
+	result = named_config_get(maps, "request-zoneversion", &obj);
+	INSIST(result == ISC_R_SUCCESS);
+	view->requestzoneversion = cfg_obj_asboolean(obj);
+
 	obj = NULL;
 	result = named_config_get(maps, "send-cookie", &obj);
 	INSIST(result == ISC_R_SUCCESS);

bin/named/statschannel.c

@@ -358,6 +358,8 @@ init_desc(void) {
 	SET_NSSTATDESC(expireopt, "Expire option received", "ExpireOpt");
 	SET_NSSTATDESC(keepaliveopt, "EDNS TCP keepalive option received",
 		       "KeepAliveOpt");
+	SET_NSSTATDESC(zoneversionopt, "ZONEVERSION option received",
+		       "ZoneVersionOpt");
 	SET_NSSTATDESC(padopt, "EDNS padding option received", "PadOpt");
 	SET_NSSTATDESC(otheropt, "Other EDNS option received", "OtherOpt");
 	SET_NSSTATDESC(cookiein, "COOKIE option received", "CookieIn");

bin/named/zoneconf.c

@@ -1227,6 +1227,12 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 			dns_zone_setkasp(zone, NULL);
 		}
 
+		obj = NULL;
+		result = named_config_get(maps, "provide-zoneversion", &obj);
+		INSIST(result == ISC_R_SUCCESS && obj != NULL);
+		dns_zone_setoption(zone, DNS_ZONEOPT_ZONEVERSION,
+				   cfg_obj_asboolean(obj));
+
 		obj = NULL;
 		result = named_config_get(maps, "notify", &obj);
 		INSIST(result == ISC_R_SUCCESS && obj != NULL);

bin/tests/system/checkconf/good-server-christmas-tree.conf.in

@@ -31,6 +31,7 @@ server 0.0.0.0 {
 	request-ixfr no;
 	request-ixfr-max-diffs 0;
 	request-nsid no;
+	request-zoneversion no;
 	require-cookie no;
 	send-cookie no;
 	tcp-keepalive no;
@@ -55,6 +56,7 @@ server :: {
 	request-ixfr no;
 	request-ixfr-max-diffs 0;
 	request-nsid no;
+	request-zoneversion no;
 	require-cookie no;
 	send-cookie no;
 	tcp-keepalive no;

bin/tests/system/checkzone/tests.sh

@@ -131,11 +131,13 @@ status=$((status + ret))
 echo_i "checking that log-report-channel zones fail if '*._er/TXT' is missing ($n)"
 ret=0
 $CHECKZONE -R fail example zones/er.db >test.out2.$n 2>&1 || ret=1
-grep -F "no '*._er/TXT' wildcard found" test.out4.$n >/dev/null && ret=1
+grep -F "no '*._er/TXT' wildcard found" test.out2.$n >/dev/null && ret=1
 $CHECKZONE example zones/er-missing.db >test.out3.$n 2>&1 || ret=1
-grep -F "no '*._er/TXT' wildcard found" test.out4.$n >/dev/null && ret=1
+grep -F "no '*._er/TXT' wildcard found" test.out3.$n >/dev/null && ret=1
 $CHECKZONE -R fail example zones/er-missing.db >test.out4.$n 2>&1 && ret=1
 grep -F "no '*._er/TXT' wildcard found" test.out4.$n >/dev/null || ret=1
+n=$((n + 1))
+if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status + ret))
 
 echo_i "checking that raw zone with bad class is handled ($n)"

bin/tests/system/conftest.py

@@ -308,6 +308,7 @@ def logger(request, system_test_name):
 @pytest.fixture(scope="module")
 def expected_artifacts(request):
     common_artifacts = [
+        "*/.hypothesis",  # drop after Ubuntu 20.04 Focal Fossa gets removed from CI
         ".libs/*",  # possible build artifacts, see GL #5055
         "ns*/named.conf",
         "ns*/named.memstats",

bin/tests/system/cookie/tests.sh

@@ -361,6 +361,23 @@ grep "status: NOERROR," dig.out.test$n >/dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status + ret))
 
+n=$((n + 1))
+echo_i "Restart NS4 with -T cookiealwaysvalid ($n)"
+stop_server ns4
+touch ns4/named.cookiealwaysvalid
+start_server --noclean --restart --port ${PORT} ns4 || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status + ret))
+
+n=$((n + 1))
+echo_i "test NS6 cookie on NS4 with -T cookiealwaysvalid (expect success) ($n)"
+ret=0
+$DIG $DIGOPTS +cookie=$ns6cookie -b 10.53.0.4 +nobadcookie soa . @10.53.0.4 >dig.out.test$n || ret=1
+grep "; COOKIE:.*(good)" dig.out.test$n >/dev/null || ret=1
+grep "status: NOERROR," dig.out.test$n >/dev/null || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status + ret))
+
 n=$((n + 1))
 echo_i "check that test server is correctly configured ($n)"
 ret=0

bin/tests/system/cookie/tests_sh_cookie.py

@@ -19,6 +19,7 @@ pytestmark = pytest.mark.extra_artifacts(
         "ans*/ans.run",
         "ans*/query.log",
         "ns1/named_dump.db*",
+        "ns4/named.cookiealwaysvalid",
     ]
 )
 

bin/tests/system/digdelv/ns2/named.conf.in

@@ -36,4 +36,5 @@ zone "example" {
 zone "example.tld" {
 	type primary;
 	file "example.tld.db";
+	provide-zoneversion no;
 };

bin/tests/system/digdelv/tests.sh

@@ -801,6 +801,73 @@ if [ -x "$DIG" ]; then
   if [ $ret -ne 0 ]; then echo_i "failed"; fi
   status=$((status + ret))
 
+  n=$((n + 1))
+  echo_i "checking dig +zoneversion to a authoritative server ($n)"
+  ret=0
+  dig_with_opts @10.53.0.2 +zoneversion a.example >dig.out.test$n 2>&1 || ret=1
+  pat="; ZONEVERSION: ZONE: example, SOA-SERIAL: 2000042407"
+  grep "$pat" dig.out.test$n >/dev/null || ret=1
+  if [ $ret -ne 0 ]; then echo_i "failed"; fi
+  status=$((status + ret))
+
+  n=$((n + 1))
+  echo_i "checking dig +zoneversion to a authoritative server with zoneversion disabled ($n)"
+  ret=0
+  dig_with_opts @10.53.0.2 +zoneversion a.example.tld >dig.out.test$n 2>&1 || ret=1
+  grep "status: NOERROR" dig.out.test$n >/dev/null || ret=1
+  grep "; ZONEVERSION:" dig.out.test$n >/dev/null && ret=1
+  if [ $ret -ne 0 ]; then echo_i "failed"; fi
+  status=$((status + ret))
+
+  if [ $HAS_PYYAML -ne 0 ]; then
+    n=$((n + 1))
+    echo_i "checking dig +yaml +zoneversion to a authoritative server ($n)"
+    ret=0
+    dig_with_opts @10.53.0.2 +yaml +zoneversion a.example >dig.out.test$n 2>&1 || ret=1
+    $PYTHON yamlget.py dig.out.test$n 0 message response_message_data OPT_PSEUDOSECTION EDNS ZONEVERSION >yamlget.out.test$n 2>&1 || ret=1
+    read -r value <yamlget.out.test$n
+    expected="{'ZONE': 'example', 'SOA-SERIAL': 2000042407}"
+    [ "$value" = "$expected" ] || ret=1
+    if [ $ret -ne 0 ]; then echo_i "failed"; fi
+    status=$((status + ret))
+  fi
+
+  n=$((n + 1))
+  echo_i "checking dig +ednsopt=ZONEVERSION:<answer> to a authoritative server ($n)"
+  ret=0
+  dig_with_opts @10.53.0.2 +ednsopt=ZONEVERSION:0100000007DA a.example >dig.out.test$n 2>&1 || ret=1
+  grep "status: FORMERR" dig.out.test$n >/dev/null || ret=1
+  grep "; ZONEVERSION:" dig.out.test$n >/dev/null && ret=1
+  if [ $ret -ne 0 ]; then echo_i "failed"; fi
+  status=$((status + ret))
+
+  n=$((n + 1))
+  echo_i "checking dig +zoneversion to a recursive server ($n)"
+  ret=0
+  dig_with_opts @10.53.0.3 +zoneversion a.example >dig.out.test$n 2>&1 || ret=1
+  grep '; ZONEVERSION:' dig.out.test$n >/dev/null && ret=1
+  if [ $ret -ne 0 ]; then echo_i "failed"; fi
+  status=$((status + ret))
+
+  n=$((n + 1))
+  echo_i "checking display of non serial type zoneversion ($n)"
+  ret=0
+  dig_with_opts @10.53.0.2 +qr +ednsopt=ZONEVERSION:0100000007DA a.example >dig.out.test$n 2>&1 || ret=1
+  grep '; ZONEVERSION: LABELS: 1, TYPE: 0, VALUE: 000007da ("....")' dig.out.test$n >/dev/null && ret=1
+  if [ $ret -ne 0 ]; then echo_i "failed"; fi
+  status=$((status + ret))
+
+  if [ $HAS_PYYAML -ne 0 ]; then
+    n=$((n + 1))
+    echo_i "checking display of non serial type zoneversion +yaml ($n)"
+    ret=0
+    dig_with_opts @10.53.0.2 +qr +ednsopt=ZONEVERSION:0100000007DA a.example +yaml >dig.out.test$n 2>&1 || ret=1
+    $PYTHON yamlget.py dig.out.test$n 0 message query_message_data OPT_PSEUDOSECTION EDNS ZONEVERSION >yamlget.out.test$n 2>&1 || ret=1
+    expected="{'ZONE': 'example', 'TYPE': 1, 'VALUE': 000007da, PVALUE: '....'}"
+    if [ $ret -ne 0 ]; then echo_i "failed"; fi
+    status=$((status + ret))
+  fi
+
   n=$((n + 1))
   echo_i "check that dig gracefully handles bad escape in domain name ($n)"
   ret=0

bin/tests/system/dnssec/tests.sh

@@ -2191,7 +2191,7 @@ echo_i "checking RRSIG query from cache ($n)"
 ret=0
 dig_with_opts normalthenrrsig.secure.example. @10.53.0.4 a >/dev/null || ret=1
 ans=$(dig_with_opts +short normalthenrrsig.secure.example. @10.53.0.4 rrsig) || ret=1
-expect=$(dig_with_opts +short normalthenrrsig.secure.example. @10.53.0.3 rrsig | grep '^\(A\|NSEC\)') || ret=1
+expect=$(dig_with_opts +short normalthenrrsig.secure.example. @10.53.0.3 rrsig | grep -E '^(A|NSEC)') || ret=1
 test "$ans" = "$expect" || ret=1
 # also check that RA is set
 dig_with_opts normalthenrrsig.secure.example. @10.53.0.4 rrsig >dig.out.ns4.test$n || ret=1

bin/tests/system/isctest/asyncserver.py

@@ -224,6 +224,20 @@ class DnsProtocol(enum.Enum):
     TCP = enum.auto()
 
 
+@dataclass(frozen=True)
+class Peer:
+    """
+    Pretty-printed connection endpoint.
+    """
+
+    host: str
+    port: int
+
+    def __str__(self) -> str:
+        host = f"[{self.host}]" if ":" in self.host else self.host
+        return f"{host}:{self.port}"
+
+
 @dataclass
 class QueryContext:
     """
@@ -232,7 +246,7 @@ class QueryContext:
 
     query: dns.message.Message
     response: dns.message.Message
-    peer: Tuple[str, int]
+    peer: Peer
     protocol: DnsProtocol
     zone: Optional[dns.zone.Zone] = None
     soa: Optional[dns.rrset.RRset] = None
@@ -513,56 +527,110 @@ class AsyncDnsServer(AsyncServer):
             self._zone_tree.add(zone)
 
     async def _handle_udp(
-        self, wire: bytes, peer: Tuple[str, int], transport: asyncio.DatagramTransport
+        self, wire: bytes, addr: Tuple[str, int], transport: asyncio.DatagramTransport
     ) -> None:
         logging.debug("Received UDP message: %s", wire.hex())
+        peer = Peer(addr[0], addr[1])
         responses = self._handle_query(wire, peer, DnsProtocol.UDP)
         async for response in responses:
-            transport.sendto(response, peer)
+            transport.sendto(response, addr)
 
     async def _handle_tcp(
         self, reader: asyncio.StreamReader, writer: asyncio.StreamWriter
     ) -> None:
-        wire_length_bytes = await reader.read(2)
-        (wire_length,) = struct.unpack("!H", wire_length_bytes)
-        logging.debug("Receiving TCP message (%d octets)...", wire_length)
+        peer_info = writer.get_extra_info("peername")
+        peer = Peer(peer_info[0], peer_info[1])
+        logging.debug("Accepted TCP connection from %s", peer)
 
-        wire = await reader.read(wire_length)
-        full_message = wire_length_bytes + wire
-        logging.debug("Received complete TCP message: %s", full_message.hex())
-
-        peer = writer.get_extra_info("peername")
-        responses = self._handle_query(wire, peer, DnsProtocol.TCP)
-        async for response in responses:
-            writer.write(response)
+        while True:
             try:
-                await writer.drain()
+                wire = await self._read_tcp_query(reader, peer)
+                if not wire:
+                    break
+                await self._send_tcp_response(writer, peer, wire)
             except ConnectionResetError:
-                logging.error(
-                    "TCP connection from %s reset by peer", self._format_peer(peer)
-                )
+                logging.error("TCP connection from %s reset by peer", peer)
                 return
 
+        logging.debug("Closing TCP connection from %s", peer)
         writer.close()
         await writer.wait_closed()
 
-    def _format_peer(self, peer: Tuple[str, int]) -> str:
-        host = peer[0]
-        port = peer[1]
-        if "::" in host:
-            host = f"[{host}]"
-        return f"{host}:{port}"
+    async def _read_tcp_query(
+        self, reader: asyncio.StreamReader, peer: Peer
+    ) -> Optional[bytes]:
+        wire_length = await self._read_tcp_query_wire_length(reader, peer)
+        if not wire_length:
+            return None
 
-    def _log_query(
-        self, qctx: QueryContext, peer: Tuple[str, int], protocol: DnsProtocol
+        return await self._read_tcp_query_wire(reader, peer, wire_length)
+
+    async def _read_tcp_query_wire_length(
+        self, reader: asyncio.StreamReader, peer: Peer
+    ) -> Optional[int]:
+        logging.debug("Receiving TCP message length from %s...", peer)
+
+        wire_length_bytes = await self._read_tcp_octets(reader, peer, 2)
+        if not wire_length_bytes:
+            return None
+
+        (wire_length,) = struct.unpack("!H", wire_length_bytes)
+
+        return wire_length
+
+    async def _read_tcp_query_wire(
+        self, reader: asyncio.StreamReader, peer: Peer, wire_length: int
+    ) -> Optional[bytes]:
+        logging.debug("Receiving TCP message (%d octets) from %s...", wire_length, peer)
+
+        wire = await self._read_tcp_octets(reader, peer, wire_length)
+        if not wire:
+            return None
+
+        logging.debug("Received complete TCP message from %s: %s", peer, wire.hex())
+
+        return wire
+
+    async def _read_tcp_octets(
+        self, reader: asyncio.StreamReader, peer: Peer, expected: int
+    ) -> Optional[bytes]:
+        buffer = b""
+
+        while len(buffer) < expected:
+            chunk = await reader.read(expected - len(buffer))
+            if not chunk:
+                if buffer:
+                    logging.debug(
+                        "Received short TCP message (%d octets) from %s: %s",
+                        len(buffer),
+                        peer,
+                        buffer.hex(),
+                    )
+                else:
+                    logging.debug("Received disconnect from %s", peer)
+                return None
+
+            logging.debug("Received %d TCP octets from %s", len(chunk), peer)
+            buffer += chunk
+
+        return buffer
+
+    async def _send_tcp_response(
+        self, writer: asyncio.StreamWriter, peer: Peer, wire: bytes
     ) -> None:
+        responses = self._handle_query(wire, peer, DnsProtocol.TCP)
+        async for response in responses:
+            writer.write(response)
+            await writer.drain()
+
+    def _log_query(self, qctx: QueryContext, peer: Peer, protocol: DnsProtocol) -> None:
         logging.info(
             "Received %s/%s/%s (ID=%d) query from %s (%s)",
             qctx.qname.to_text(omit_final_dot=True),
             dns.rdataclass.to_text(qctx.qclass),
             dns.rdatatype.to_text(qctx.qtype),
             qctx.query.id,
-            self._format_peer(peer),
+            peer,
             protocol.name,
         )
         logging.debug(
@@ -573,14 +641,14 @@ class AsyncDnsServer(AsyncServer):
         self,
         qctx: QueryContext,
         response: Optional[Union[dns.message.Message, bytes]],
-        peer: Tuple[str, int],
+        peer: Peer,
         protocol: DnsProtocol,
     ) -> None:
         if not response:
             logging.info(
                 "Not sending a response to query (ID=%d) from %s (%s)",
                 qctx.query.id,
-                self._format_peer(peer),
+                peer,
                 protocol.name,
             )
             return
@@ -606,7 +674,7 @@ class AsyncDnsServer(AsyncServer):
                 len(response.authority),
                 len(response.additional),
                 qctx.query.id,
-                self._format_peer(peer),
+                peer,
                 protocol.name,
             )
             logging.debug(
@@ -618,13 +686,13 @@ class AsyncDnsServer(AsyncServer):
             "Sending response (%d bytes) to a query (ID=%d) from %s (%s)",
             len(response),
             qctx.query.id,
-            self._format_peer(peer),
+            peer,
             protocol.name,
         )
         logging.debug("[OUT] %s", response.hex())
 
     async def _handle_query(
-        self, wire: bytes, peer: Tuple[str, int], protocol: DnsProtocol
+        self, wire: bytes, peer: Peer, protocol: DnsProtocol
     ) -> AsyncGenerator[bytes, None]:
         """
         Yield wire data to send as a response over the established transport.

bin/tests/system/kasp/ns3/setup.sh

@@ -130,7 +130,7 @@ $KEYGEN -G -k rsasha256 -l policies/kasp.conf $zone >keygen.out.$zone.2 2>&1
 zone="multisigner-model2.kasp"
 echo_i "setting up zone: $zone"
 KSK=$($KEYGEN -a $DEFAULT_ALGORITHM -f KSK -L 3600 -M 32768:65535 $zone 2>keygen.out.$zone.1)
-ZSK=$($KEYGEN -a $DEFAULT_ALGORITHM -L 3600 $zone -M 32768:65535 2>keygen.out.$zone.2)
+ZSK=$($KEYGEN -a $DEFAULT_ALGORITHM -L 3600 -M 32768:65535 $zone 2>keygen.out.$zone.2)
 cat "${KSK}.key" | grep -v ";.*" >>"${zone}.db"
 cat "${ZSK}.key" | grep -v ";.*" >>"${zone}.db"
 # Import the ZSK sets of the other providers into their DNSKEY RRset.
@@ -350,10 +350,9 @@ setup step2.enable-dnssec.autosign
 TpubN="now-900s"
 # RRSIG TTL:              12 hour (43200 seconds)
 # zone-propagation-delay: 5 minutes (300 seconds)
-# retire-safety:          20 minutes (1200 seconds)
 # Already passed time:    -900 seconds
-# Total:                  43800 seconds
-TsbmN="now+43800s"
+# Total:                  42600 seconds
+TsbmN="now+42600s"
 keytimes="-P ${TpubN} -P sync ${TsbmN} -A ${TpubN}"
 CSK=$($KEYGEN -k enable-dnssec -l policies/autosign.conf $keytimes $zone 2>keygen.out.$zone.1)
 $SETTIME -s -g $O -k $R $TpubN -r $R $TpubN -d $H $TpubN -z $R $TpubN "$CSK" >settime.out.$zone.1 2>&1
@@ -365,10 +364,10 @@ $SIGNER -S -z -x -s now-1h -e now+30d -o $zone -O raw -f "${zonefile}.signed" $i
 # Step 3:
 # The zone signatures have been published long enough to become OMNIPRESENT.
 setup step3.enable-dnssec.autosign
-# Passed time since publications: 43800 + 900 = 44700 seconds.
-TpubN="now-44700s"
+# Passed time since publications: 42600 + 900 = 43500 seconds.
+TpubN="now-43500s"
 # The key is secure for using in chain of trust when the DNSKEY is OMNIPRESENT.
-TcotN="now-43800s"
+TcotN="now-42600s"
 # We can submit the DS now.
 TsbmN="now"
 keytimes="-P ${TpubN} -P sync ${TsbmN} -A ${TpubN}"

bin/tests/system/kasp/ns6/setup.sh

@@ -127,9 +127,9 @@ setup step2.algorithm-roll.kasp
 # The time passed since the new algorithm keys have been introduced is 3 hours.
 TactN="now-3h"
 TpubN1="now-3h"
-# Tsbm(N+1) = TpubN1 + Ipub = now + TTLsig + Dprp + publish-safety =
-# now - 3h + 6h + 1h + 1h = now + 5h
-TsbmN1="now+5h"
+# Tsbm(N+1) = TpubN1 + Ipub = now + TTLsig + Dprp =
+# now - 3h + 6h + 1h = now + 4h
+TsbmN1="now+4h"
 ksk1times="-P ${TactN}  -A ${TactN}  -P sync ${TactN}  -I now"
 zsk1times="-P ${TactN}  -A ${TactN}                    -I now"
 ksk2times="-P ${TpubN1} -A ${TpubN1} -P sync ${TsbmN1}"
@@ -156,11 +156,11 @@ $SIGNER -S -x -s now-1h -e now+2w -o $zone -O raw -f "${zonefile}.signed" $infil
 # Step 3:
 # The zone signatures are also OMNIPRESENT.
 setup step3.algorithm-roll.kasp
-# The time passed since the new algorithm keys have been introduced is 9 hours.
-TactN="now-9h"
-TretN="now-6h"
-TpubN1="now-9h"
-TsbmN1="now-1h"
+# The time passed since the new algorithm keys have been introduced is 7 hours.
+TactN="now-7h"
+TretN="now-3h"
+TpubN1="now-7h"
+TsbmN1="now"
 ksk1times="-P ${TactN}  -A ${TactN}  -P sync ${TactN}  -I ${TretN}"
 zsk1times="-P ${TactN}  -A ${TactN}                    -I ${TretN}"
 ksk2times="-P ${TpubN1} -A ${TpubN1} -P sync ${TsbmN1}"
@@ -188,11 +188,11 @@ $SIGNER -S -x -s now-1h -e now+2w -o $zone -O raw -f "${zonefile}.signed" $infil
 # The DS is swapped and can become OMNIPRESENT.
 setup step4.algorithm-roll.kasp
 # The time passed since the DS has been swapped is 29 hours.
-TactN="now-38h"
-TretN="now-35h"
-TpubN1="now-38h"
-TsbmN1="now-30h"
-TactN1="now-29h"
+TactN="now-36h"
+TretN="now-33h"
+TpubN1="now-36h"
+TsbmN1="now-29h"
+TactN1="now-27h"
 ksk1times="-P ${TactN}  -A ${TactN}  -P sync ${TactN}  -I ${TretN}"
 zsk1times="-P ${TactN}  -A ${TactN}                    -I ${TretN}"
 ksk2times="-P ${TpubN1} -A ${TpubN1} -P sync ${TsbmN1}"
@@ -220,12 +220,12 @@ $SIGNER -S -x -s now-1h -e now+2w -o $zone -O raw -f "${zonefile}.signed" $infil
 # The DNSKEY is removed long enough to be HIDDEN.
 setup step5.algorithm-roll.kasp
 # The time passed since the DNSKEY has been removed is 2 hours.
-TactN="now-40h"
-TretN="now-37h"
+TactN="now-38h"
+TretN="now-35h"
 TremN="now-2h"
-TpubN1="now-40h"
-TsbmN1="now-32h"
-TactN1="now-31h"
+TpubN1="now-38h"
+TsbmN1="now-31h"
+TactN1="now-29h"
 ksk1times="-P ${TactN}  -A ${TactN}  -P sync ${TactN}  -I ${TretN}"
 zsk1times="-P ${TactN}  -A ${TactN}                    -I ${TretN}"
 ksk2times="-P ${TpubN1} -A ${TpubN1} -P sync ${TsbmN1}"
@@ -253,13 +253,13 @@ $SIGNER -S -x -s now-1h -e now+2w -o $zone -O raw -f "${zonefile}.signed" $infil
 # The RRSIGs have been removed long enough to be HIDDEN.
 setup step6.algorithm-roll.kasp
 # Additional time passed: 7h.
-TactN="now-47h"
-TretN="now-44h"
+TactN="now-45h"
+TretN="now-42h"
 TremN="now-7h"
-TpubN1="now-47h"
-TsbmN1="now-39h"
-TactN1="now-38h"
-TdeaN="now-9h"
+TpubN1="now-45h"
+TsbmN1="now-38h"
+TactN1="now-36h"
+TdeaN="now-7h"
 ksk1times="-P ${TactN}  -A ${TactN}  -P sync ${TactN}  -I ${TretN}"
 zsk1times="-P ${TactN}  -A ${TactN}                    -I ${TretN}"
 ksk2times="-P ${TpubN1} -A ${TpubN1} -P sync ${TsbmN1}"
@@ -324,11 +324,11 @@ $SIGNER -S -x -z -s now-1h -e now+2w -o $zone -O raw -f "${zonefile}.signed" $in
 # Step 3:
 # The zone signatures are also OMNIPRESENT.
 setup step3.csk-algorithm-roll.kasp
-# The time passed since the new algorithm keys have been introduced is 9 hours.
-TactN="now-9h"
-TretN="now-6h"
-TpubN1="now-9h"
-TactN1="now-6h"
+# The time passed since the new algorithm keys have been introduced is 7 hours.
+TactN="now-7h"
+TretN="now-3h"
+TpubN1="now-7h"
+TactN1="now-3h"
 csktimes="-P ${TactN}  -A ${TactN} -P sync ${TactN} -I ${TretN}"
 newtimes="-P ${TpubN1} -A ${TpubN1}"
 CSK1=$($KEYGEN -k csk-algoroll -l policies/csk1.conf $csktimes $zone 2>keygen.out.$zone.1)
@@ -347,10 +347,10 @@ $SIGNER -S -x -z -s now-1h -e now+2w -o $zone -O raw -f "${zonefile}.signed" $in
 # The DS is swapped and can become OMNIPRESENT.
 setup step4.csk-algorithm-roll.kasp
 # The time passed since the DS has been swapped is 29 hours.
-TactN="now-38h"
-TretN="now-35h"
-TpubN1="now-38h"
-TactN1="now-35h"
+TactN="now-36h"
+TretN="now-33h"
+TpubN1="now-36h"
+TactN1="now-33h"
 TsubN1="now-29h"
 csktimes="-P ${TactN}  -A ${TactN} -P sync ${TactN} -I ${TretN}"
 newtimes="-P ${TpubN1} -A ${TpubN1}"
@@ -370,11 +370,11 @@ $SIGNER -S -x -z -s now-1h -e now+2w -o $zone -O raw -f "${zonefile}.signed" $in
 # The DNSKEY is removed long enough to be HIDDEN.
 setup step5.csk-algorithm-roll.kasp
 # The time passed since the DNSKEY has been removed is 2 hours.
-TactN="now-40h"
-TretN="now-37h"
+TactN="now-38h"
+TretN="now-35h"
 TremN="now-2h"
-TpubN1="now-40h"
-TactN1="now-37h"
+TpubN1="now-38h"
+TactN1="now-35h"
 TsubN1="now-31h"
 csktimes="-P ${TactN}  -A ${TactN} -P sync ${TactN} -I ${TretN}"
 newtimes="-P ${TpubN1} -A ${TpubN1}"
@@ -394,12 +394,12 @@ $SIGNER -S -x -z -s now-1h -e now+2w -o $zone -O raw -f "${zonefile}.signed" $in
 # The RRSIGs have been removed long enough to be HIDDEN.
 setup step6.csk-algorithm-roll.kasp
 # Additional time passed: 7h.
-TactN="now-47h"
-TretN="now-44h"
+TactN="now-45h"
+TretN="now-42h"
 TdeaN="now-9h"
 TremN="now-7h"
-TpubN1="now-47h"
-TactN1="now-44h"
+TpubN1="now-45h"
+TactN1="now-42h"
 TsubN1="now-38h"
 csktimes="-P ${TactN}  -A ${TactN} -P sync ${TactN} -I ${TretN}"
 newtimes="-P ${TpubN1} -A ${TpubN1}"

bin/tests/system/kasp/tests.sh

@@ -275,9 +275,8 @@ set_keytimes_csk_policy() {
   set_keytime "KEY1" "ACTIVE" "${created}"
   # The DS can be published if the DNSKEY and RRSIG records are
   # OMNIPRESENT.  This happens after max-zone-ttl (1d) plus
-  # publish-safety (1h) plus zone-propagation-delay (300s) =
-  # 86400 + 3600 + 300 = 90300.
-  set_addkeytime "KEY1" "SYNCPUBLISH" "${created}" 90300
+  # zone-propagation-delay (300s) = 86400 + 300 = 86700.
+  set_addkeytime "KEY1" "SYNCPUBLISH" "${created}" 86700
   # Key lifetime is unlimited, so not setting RETIRED and REMOVED.
 }
 
@@ -769,9 +768,8 @@ set_keytimes_algorithm_policy() {
 
   # The DS can be published if the DNSKEY and RRSIG records are
   # OMNIPRESENT.  This happens after max-zone-ttl (1d) plus
-  # publish-safety (1h) plus zone-propagation-delay (300s) =
-  # 86400 + 3600 + 300 = 90300.
-  set_addkeytime "KEY1" "SYNCPUBLISH" "${published}" 90300
+  # zone-propagation-delay (300s) = 86400 + 300 = 86700.
+  set_addkeytime "KEY1" "SYNCPUBLISH" "${published}" 86700
   # Key lifetime is 10 years, 315360000 seconds.
   set_addkeytime "KEY1" "RETIRED" "${published}" 315360000
   # The key is removed after the retire time plus DS TTL (1d),
@@ -1720,10 +1718,10 @@ published=$(awk '{print $3}' <published.test${n}.key1)
 set_keytime "KEY1" "PUBLISHED" "${published}"
 set_keytime "KEY1" "ACTIVE" "${published}"
 published=$(key_get KEY1 PUBLISHED)
-# The DS can be published if the DNSKEY and RRSIG records are OMNIPRESENT.
-#  This happens after max-zone-ttl (1d) plus publish-safety (1h) plus
-# zone-propagation-delay (300s) = 86400 + 3600 + 300 = 90300.
-set_addkeytime "KEY1" "SYNCPUBLISH" "${published}" 90300
+# The DS can be published if the zone is fully signed.
+# This happens after max-zone-ttl (1d) plus
+# zone-propagation-delay (300s) = 86400 + 300 = 86700.
+set_addkeytime "KEY1" "SYNCPUBLISH" "${published}" 86700
 # Key lifetime is 6 months, 315360000 seconds.
 set_addkeytime "KEY1" "RETIRED" "${published}" 16070400
 # The key is removed after the retire time plus DS TTL (1d), parent
@@ -2486,9 +2484,9 @@ set_keytime "KEY1" "PUBLISHED" "${created}"
 set_keytime "KEY1" "ACTIVE" "${created}"
 # - The DS can be published if the DNSKEY and RRSIG records are
 #   OMNIPRESENT.  This happens after max-zone-ttl (12h) plus
-#   publish-safety (5m) plus zone-propagation-delay (5m) =
-#   43200 + 300 + 300 = 43800.
-set_addkeytime "KEY1" "SYNCPUBLISH" "${created}" 43800
+#   plus zone-propagation-delay (5m) =
+#   43200 + 300 = 43500.
+set_addkeytime "KEY1" "SYNCPUBLISH" "${created}" 43500
 # - Key lifetime is unlimited, so not setting RETIRED and REMOVED.
 
 # Various signing policy checks.
@@ -2556,7 +2554,7 @@ check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
 created=$(key_get KEY1 CREATED)
 set_addkeytime "KEY1" "PUBLISHED" "${created}" -900
 set_addkeytime "KEY1" "ACTIVE" "${created}" -900
-set_addkeytime "KEY1" "SYNCPUBLISH" "${created}" 43800
+set_addkeytime "KEY1" "SYNCPUBLISH" "${created}" 42600
 
 # Continue signing policy checks.
 check_keytimes
@@ -2566,8 +2564,8 @@ dnssec_verify
 
 # Next key event is when the zone signatures become OMNIPRESENT: max-zone-ttl
 # plus zone propagation delay plus retire safety minus the already elapsed
-# 900 seconds: 12h + 300s + 20m - 900 = 44700 - 900 = 43800 seconds
-check_next_key_event 43800
+# 900 seconds: 12h + 300s + 20m - 900 = 43500 - 900 = 42600 seconds
+check_next_key_event 42600
 
 #
 # Zone: step3.enable-dnssec.autosign.
@@ -2584,10 +2582,10 @@ check_keys
 check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
 
 # Set expected key times:
-# - The key was published and activated 44700 seconds ago (with settime).
+# - The key was published and activated 43500 seconds ago (with settime).
 created=$(key_get KEY1 CREATED)
-set_addkeytime "KEY1" "PUBLISHED" "${created}" -44700
-set_addkeytime "KEY1" "ACTIVE" "${created}" -44700
+set_addkeytime "KEY1" "PUBLISHED" "${created}" -43500
+set_addkeytime "KEY1" "ACTIVE" "${created}" -43500
 set_keytime "KEY1" "SYNCPUBLISH" "${created}"
 
 # Continue signing policy checks.
@@ -2603,8 +2601,8 @@ check_cdslog "$DIR" "$ZONE" KEY1
 rndc_checkds "$SERVER" "$DIR" KEY1 "now" "published" "$ZONE"
 # Next key event is when the DS can move to the OMNIPRESENT state.  This occurs
 # when the parent propagation delay have passed, plus the DS TTL and retire
-# safety delay:  1h + 2h + 20m = 3h20m = 12000 seconds
-check_next_key_event 12000
+# safety delay:  1h + 2h = 3h = 10800 seconds
+check_next_key_event 10800
 
 #
 # Zone: step4.enable-dnssec.autosign.
@@ -4388,9 +4386,9 @@ check_subdomain
 dnssec_verify
 
 # Next key event is when the DS becomes HIDDEN. This happens after the
-# parent propagation delay, retire safety delay, and DS TTL:
-# 1h + 1h + 1d = 26h = 93600 seconds.
-check_next_key_event 93600
+# parent propagation delay, and DS TTL:
+# 1h + 1d = 25h = 90000 seconds.
+check_next_key_event 90000
 
 #
 # Zone: step2.going-insecure.kasp
@@ -4456,8 +4454,8 @@ dnssec_verify
 
 # Next key event is when the DS becomes HIDDEN. This happens after the
 # parent propagation delay, retire safety delay, and DS TTL:
-# 1h + 1h + 1d = 26h = 93600 seconds.
-check_next_key_event 93600
+# 1h + 1d = 25h = 90000 seconds.
+check_next_key_event 90000
 
 #
 # Zone: step2.going-insecure-dynamic.kasp
@@ -4651,12 +4649,11 @@ set_addkeytime "KEY2" "REMOVED" "${retired}" "${IretZSK}"
 created=$(key_get KEY3 CREATED)
 set_keytime "KEY3" "PUBLISHED" "${created}"
 set_keytime "KEY3" "ACTIVE" "${created}"
-# - It takes TTLsig + Dprp + publish-safety hours to propagate the zone.
+# - It takes TTLsig + Dprp to propagate the zone.
 #   TTLsig:         6h (39600 seconds)
 #   Dprp:           1h (3600 seconds)
-#   publish-safety: 1h (3600 seconds)
-#   Ipub:           8h (28800 seconds)
-Ipub=28800
+#   Ipub:           7h (25200 seconds)
+Ipub=25200
 set_addkeytime "KEY3" "SYNCPUBLISH" "${created}" "${Ipub}"
 # - The new ZSK is published and activated.
 created=$(key_get KEY4 CREATED)
@@ -4725,12 +4722,12 @@ dnssec_verify
 
 # Next key event is when all zone signatures are signed with the new
 # algorithm.  This is the max-zone-ttl plus zone propagation delay
-# plus retire safety: 6h + 1h + 2h.  But three hours have already passed
-# (the time it took to make the DNSKEY omnipresent), so the next event
-# should be scheduled in 6 hour: 21600 seconds.  Prevent intermittent
+# 6h + 1h.  But three hours have already passed (the time it took to
+# make the DNSKEY omnipresent), so the next event should be scheduled
+# in 4 hour: 14400 seconds.  Prevent intermittent
 # false positives on slow platforms by subtracting the number of seconds
 # which passed between key creation and invoking 'rndc reconfig'.
-next_time=$((21600 - time_passed))
+next_time=$((14400 - time_passed))
 check_next_key_event $next_time
 
 #
@@ -4753,28 +4750,28 @@ check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
 check_cdslog "$DIR" "$ZONE" KEY3
 
 # Set expected key times:
-# - The old keys were activated 9 hours ago (32400 seconds).
-rollover_predecessor_keytimes -32400
-# - And retired 6 hours ago (21600 seconds).
+# - The old keys were activated 7 hours ago (25200 seconds).
+rollover_predecessor_keytimes -25200
+# - And retired 3 hours ago (10800 seconds).
 created=$(key_get KEY1 CREATED)
-set_addkeytime "KEY1" "RETIRED" "${created}" -21600
+set_addkeytime "KEY1" "RETIRED" "${created}" -10800
 retired=$(key_get KEY1 RETIRED)
 set_addkeytime "KEY1" "REMOVED" "${retired}" "${IretKSK}"
 
 created=$(key_get KEY2 CREATED)
-set_addkeytime "KEY2" "RETIRED" "${created}" -21600
+set_addkeytime "KEY2" "RETIRED" "${created}" -10800
 retired=$(key_get KEY2 RETIRED)
 set_addkeytime "KEY2" "REMOVED" "${retired}" "${IretZSK}"
-# - The new keys are published 9 hours ago.
+# - The new keys are published 7 hours ago.
 created=$(key_get KEY3 CREATED)
-set_addkeytime "KEY3" "PUBLISHED" "${created}" -32400
-set_addkeytime "KEY3" "ACTIVE" "${created}" -32400
+set_addkeytime "KEY3" "PUBLISHED" "${created}" -25200
+set_addkeytime "KEY3" "ACTIVE" "${created}" -25200
 published=$(key_get KEY3 PUBLISHED)
 set_addkeytime "KEY3" "SYNCPUBLISH" "${published}" ${Ipub}
 
 created=$(key_get KEY4 CREATED)
-set_addkeytime "KEY4" "PUBLISHED" "${created}" -32400
-set_addkeytime "KEY4" "ACTIVE" "${created}" -32400
+set_addkeytime "KEY4" "PUBLISHED" "${created}" -25200
+set_addkeytime "KEY4" "ACTIVE" "${created}" -25200
 
 # Continue signing policy checks.
 check_keytimes
@@ -4787,9 +4784,9 @@ dnssec_verify
 rndc_checkds "$SERVER" "$DIR" KEY1 "now" "withdrawn" "$ZONE"
 rndc_checkds "$SERVER" "$DIR" KEY3 "now" "published" "$ZONE"
 # Next key event is when the DS becomes OMNIPRESENT. This happens after the
-# parent propagation delay, retire safety delay, and DS TTL:
-# 1h + 2h + 2h = 5h = 18000 seconds.
-check_next_key_event 18000
+# parent propagation delay, and DS TTL:
+# 1h + 2h = 3h = 10800 seconds.
+check_next_key_event 10800
 
 #
 # Zone: step4.algorithm-roll.kasp
@@ -4816,29 +4813,29 @@ wait_for_done_signing
 check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
 
 # Set expected key times:
-# - The old keys were activated 38 hours ago (136800 seconds).
-rollover_predecessor_keytimes -136800
-# - And retired 35 hours ago (126000 seconds).
+# - The old keys were activated 36 hours ago (129600 seconds).
+rollover_predecessor_keytimes -129600
+# - And retired 33 hours ago (118800 seconds).
 created=$(key_get KEY1 CREATED)
-set_addkeytime "KEY1" "RETIRED" "${created}" -126000
+set_addkeytime "KEY1" "RETIRED" "${created}" -118800
 retired=$(key_get KEY1 RETIRED)
 set_addkeytime "KEY1" "REMOVED" "${retired}" "${IretKSK}"
 
 created=$(key_get KEY2 CREATED)
-set_addkeytime "KEY2" "RETIRED" "${created}" -126000
+set_addkeytime "KEY2" "RETIRED" "${created}" -118800
 retired=$(key_get KEY2 RETIRED)
 set_addkeytime "KEY2" "REMOVED" "${retired}" "${IretZSK}"
 
-# - The new keys are published 38 hours ago.
+# - The new keys are published 36 hours ago.
 created=$(key_get KEY3 CREATED)
-set_addkeytime "KEY3" "PUBLISHED" "${created}" -136800
-set_addkeytime "KEY3" "ACTIVE" "${created}" -136800
+set_addkeytime "KEY3" "PUBLISHED" "${created}" -129600
+set_addkeytime "KEY3" "ACTIVE" "${created}" -129600
 published=$(key_get KEY3 PUBLISHED)
 set_addkeytime "KEY3" "SYNCPUBLISH" "${published}" ${Ipub}
 
 created=$(key_get KEY4 CREATED)
-set_addkeytime "KEY4" "PUBLISHED" "${created}" -136800
-set_addkeytime "KEY4" "ACTIVE" "${created}" -136800
+set_addkeytime "KEY4" "PUBLISHED" "${created}" -129600
+set_addkeytime "KEY4" "ACTIVE" "${created}" -129600
 
 # Continue signing policy checks.
 check_keytimes
@@ -4867,29 +4864,29 @@ wait_for_done_signing
 check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
 
 # Set expected key times:
-# - The old keys were activated 40 hours ago (144000 seconds)
-rollover_predecessor_keytimes -144000
-# - And retired 37 hours ago (133200 seconds).
+# - The old keys were activated 38 hours ago (136800 seconds)
+rollover_predecessor_keytimes -136800
+# - And retired 35 hours ago (126000 seconds).
 created=$(key_get KEY1 CREATED)
-set_addkeytime "KEY1" "RETIRED" "${created}" -133200
+set_addkeytime "KEY1" "RETIRED" "${created}" -126000
 retired=$(key_get KEY1 RETIRED)
 set_addkeytime "KEY1" "REMOVED" "${retired}" "${IretKSK}"
 
 created=$(key_get KEY2 CREATED)
-set_addkeytime "KEY2" "RETIRED" "${created}" -133200
+set_addkeytime "KEY2" "RETIRED" "${created}" -126000
 retired=$(key_get KEY2 RETIRED)
 set_addkeytime "KEY2" "REMOVED" "${retired}" "${IretZSK}"
 
 # The new keys are published 40 hours ago.
 created=$(key_get KEY3 CREATED)
-set_addkeytime "KEY3" "PUBLISHED" "${created}" -144000
-set_addkeytime "KEY3" "ACTIVE" "${created}" -144000
+set_addkeytime "KEY3" "PUBLISHED" "${created}" -136800
+set_addkeytime "KEY3" "ACTIVE" "${created}" -136800
 published=$(key_get KEY3 PUBLISHED)
 set_addkeytime "KEY3" "SYNCPUBLISH" "${published}" ${Ipub}
 
 created=$(key_get KEY4 CREATED)
-set_addkeytime "KEY4" "PUBLISHED" "${created}" -144000
-set_addkeytime "KEY4" "ACTIVE" "${created}" -144000
+set_addkeytime "KEY4" "PUBLISHED" "${created}" -136800
+set_addkeytime "KEY4" "ACTIVE" "${created}" -136800
 
 # Continue signing policy checks.
 check_keytimes
@@ -4898,12 +4895,12 @@ check_subdomain
 dnssec_verify
 
 # Next key event is when the RSASHA1 signatures become HIDDEN.  This happens
-# after the max-zone-ttl plus zone propagation delay plus retire safety
-# (6h + 1h + 2h) minus the time already passed since the UNRETENTIVE state has
-# been reached (2h): 9h - 2h = 7h = 25200 seconds. Prevent intermittent
+# after the max-zone-ttl plus zone propagation delay (6h + 1h)
+# minus the time already passed since the UNRETENTIVE state has
+# been reached (2h): 7h - 2h = 5h = 18000 seconds. Prevent intermittent
 # false positives on slow platforms by subtracting the number of seconds
 # which passed between key creation and invoking 'rndc reconfig'.
-next_time=$((25200 - time_passed))
+next_time=$((18000 - time_passed))
 check_next_key_event $next_time
 
 #
@@ -4921,29 +4918,29 @@ wait_for_done_signing
 check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
 
 # Set expected key times:
-# - The old keys were activated 47 hours ago (169200 seconds)
-rollover_predecessor_keytimes -169200
-# - And retired 44 hours ago (158400 seconds).
+# - The old keys were activated 45 hours ago (162000 seconds)
+rollover_predecessor_keytimes -162000
+# - And retired 42 hours ago (151200 seconds).
 created=$(key_get KEY1 CREATED)
-set_addkeytime "KEY1" "RETIRED" "${created}" -158400
+set_addkeytime "KEY1" "RETIRED" "${created}" -151200
 retired=$(key_get KEY1 RETIRED)
 set_addkeytime "KEY1" "REMOVED" "${retired}" "${IretKSK}"
 
 created=$(key_get KEY2 CREATED)
-set_addkeytime "KEY2" "RETIRED" "${created}" -158400
+set_addkeytime "KEY2" "RETIRED" "${created}" -151200
 retired=$(key_get KEY2 RETIRED)
 set_addkeytime "KEY2" "REMOVED" "${retired}" "${IretZSK}"
 
 # The new keys are published 47 hours ago.
 created=$(key_get KEY3 CREATED)
-set_addkeytime "KEY3" "PUBLISHED" "${created}" -169200
-set_addkeytime "KEY3" "ACTIVE" "${created}" -169200
+set_addkeytime "KEY3" "PUBLISHED" "${created}" -162000
+set_addkeytime "KEY3" "ACTIVE" "${created}" -162000
 published=$(key_get KEY3 PUBLISHED)
 set_addkeytime "KEY3" "SYNCPUBLISH" "${published}" ${Ipub}
 
 created=$(key_get KEY4 CREATED)
-set_addkeytime "KEY4" "PUBLISHED" "${created}" -169200
-set_addkeytime "KEY4" "ACTIVE" "${created}" -169200
+set_addkeytime "KEY4" "PUBLISHED" "${created}" -162000
+set_addkeytime "KEY4" "ACTIVE" "${created}" -162000
 
 # Continue signing policy checks.
 check_keytimes
@@ -5026,9 +5023,8 @@ set_keytime "KEY2" "ACTIVE" "${created}"
 # - It takes TTLsig + Dprp + publish-safety hours to propagate the zone.
 #   TTLsig:         6h (39600 seconds)
 #   Dprp:           1h (3600 seconds)
-#   publish-safety: 1h (3600 seconds)
-#   Ipub:           8h (28800 seconds)
-Ipub=28800
+#   Ipub:           7h (25200 seconds)
+Ipub=25200
 set_addkeytime "KEY2" "SYNCPUBLISH" "${created}" "${Ipub}"
 
 # Continue signing policy checks.
@@ -5082,14 +5078,13 @@ check_apex
 check_subdomain
 dnssec_verify
 
-# Next key event is when all zone signatures are signed with the new
-# algorithm.  This is the max-zone-ttl plus zone propagation delay
-# plus retire safety: 6h + 1h + 2h.  But three hours have already passed
-# (the time it took to make the DNSKEY omnipresent), so the next event
-# should be scheduled in 6 hour: 21600 seconds.  Prevent intermittent
-# false positives on slow platforms by subtracting the number of seconds
-# which passed between key creation and invoking 'rndc reconfig'.
-next_time=$((21600 - time_passed))
+# Next key event is when all zone signatures are signed with the new algorithm.
+# This is the max-zone-ttl plus zone propagation delay: 6h + 1h.  But three
+# hours have already passed (the time it took to make the DNSKEY omnipresent),
+# so the next event should be scheduled in 4 hour: 14400 seconds.  Prevent
+# intermittent false positives on slow platforms by subtracting the number of
+# seconds which passed between key creation and invoking 'rndc reconfig'.
+next_time=$((14400 - time_passed))
 check_next_key_event $next_time
 
 #
@@ -5114,17 +5109,17 @@ check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
 check_cdslog "$DIR" "$ZONE" KEY2
 
 # Set expected key times:
-# - The old key was activated 9 hours ago (32400 seconds).
-csk_rollover_predecessor_keytimes -32400
-# - And was retired 6 hours ago (21600 seconds).
+# - The old key was activated 7 hours ago (25200 seconds).
+csk_rollover_predecessor_keytimes -25200
+# - And was retired 3 hours ago (10800 seconds).
 created=$(key_get KEY1 CREATED)
-set_addkeytime "KEY1" "RETIRED" "${created}" -21600
+set_addkeytime "KEY1" "RETIRED" "${created}" -10800
 retired=$(key_get KEY1 RETIRED)
 set_addkeytime "KEY1" "REMOVED" "${retired}" "${IretCSK}"
 # - The new key was published 9 hours ago.
 created=$(key_get KEY2 CREATED)
-set_addkeytime "KEY2" "PUBLISHED" "${created}" -32400
-set_addkeytime "KEY2" "ACTIVE" "${created}" -32400
+set_addkeytime "KEY2" "PUBLISHED" "${created}" -25200
+set_addkeytime "KEY2" "ACTIVE" "${created}" -25200
 published=$(key_get KEY2 PUBLISHED)
 set_addkeytime "KEY2" "SYNCPUBLISH" "${published}" "${Ipub}"
 
@@ -5138,9 +5133,9 @@ dnssec_verify
 rndc_checkds "$SERVER" "$DIR" KEY1 "now" "withdrawn" "$ZONE"
 rndc_checkds "$SERVER" "$DIR" KEY2 "now" "published" "$ZONE"
 # Next key event is when the DS becomes OMNIPRESENT. This happens after the
-# parent propagation delay, retire safety delay, and DS TTL:
-# 1h + 2h + 2h = 5h = 18000 seconds.
-check_next_key_event 18000
+# parent propagation delay, and DS TTL:
+# 1h + 2h = 3h = 10800 seconds.
+check_next_key_event 10800
 
 #
 # Zone: step4.csk-algorithm-roll.kasp
@@ -5164,17 +5159,17 @@ wait_for_done_signing
 check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
 
 # Set expected key times:
-# - The old key was activated 38 hours ago (136800 seconds)
-csk_rollover_predecessor_keytimes -136800
-# - And retired 35 hours ago (126000 seconds).
+# - The old keys were activated 36 hours ago (129600 seconds).
+csk_rollover_predecessor_keytimes -129600
+# - And retired 33 hours ago (118800 seconds).
 created=$(key_get KEY1 CREATED)
-set_addkeytime "KEY1" "RETIRED" "${created}" -126000
+set_addkeytime "KEY1" "RETIRED" "${created}" -118800
 retired=$(key_get KEY1 RETIRED)
 set_addkeytime "KEY1" "REMOVED" "${retired}" "${IretCSK}"
-# - The new key was published 38 hours ago.
+# - The new key was published 36 hours ago.
 created=$(key_get KEY2 CREATED)
-set_addkeytime "KEY2" "PUBLISHED" "${created}" -136800
-set_addkeytime "KEY2" "ACTIVE" "${created}" -136800
+set_addkeytime "KEY2" "PUBLISHED" "${created}" -129600
+set_addkeytime "KEY2" "ACTIVE" "${created}" -129600
 published=$(key_get KEY2 PUBLISHED)
 set_addkeytime "KEY2" "SYNCPUBLISH" "${published}" ${Ipub}
 
@@ -5204,17 +5199,17 @@ wait_for_done_signing
 check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
 
 # Set expected key times:
-# - The old key was activated 40 hours ago (144000 seconds)
-csk_rollover_predecessor_keytimes -144000
-# - And retired 37 hours ago (133200 seconds).
+# - The old key was activated 38 hours ago (136800 seconds)
+csk_rollover_predecessor_keytimes -136800
+# - And retired 35 hours ago (126000 seconds).
 created=$(key_get KEY1 CREATED)
-set_addkeytime "KEY1" "RETIRED" "${created}" -133200
+set_addkeytime "KEY1" "RETIRED" "${created}" -126000
 retired=$(key_get KEY1 RETIRED)
 set_addkeytime "KEY1" "REMOVED" "${retired}" "${IretCSK}"
-# - The new key was published 40 hours ago.
+# - The new key was published 38 hours ago.
 created=$(key_get KEY2 CREATED)
-set_addkeytime "KEY2" "PUBLISHED" "${created}" -144000
-set_addkeytime "KEY2" "ACTIVE" "${created}" -144000
+set_addkeytime "KEY2" "PUBLISHED" "${created}" -136800
+set_addkeytime "KEY2" "ACTIVE" "${created}" -136800
 published=$(key_get KEY2 PUBLISHED)
 set_addkeytime "KEY2" "SYNCPUBLISH" "${published}" ${Ipub}
 
@@ -5225,12 +5220,12 @@ check_subdomain
 dnssec_verify
 
 # Next key event is when the RSASHA1 signatures become HIDDEN.  This happens
-# after the max-zone-ttl plus zone propagation delay plus retire safety
-# (6h + 1h + 2h) minus the time already passed since the UNRETENTIVE state has
-# been reached (2h): 9h - 2h = 7h = 25200 seconds.  Prevent intermittent
-# false positives on slow platforms by subtracting the number of seconds
-# which passed between key creation and invoking 'rndc reconfig'.
-next_time=$((25200 - time_passed))
+# after the max-zone-ttl plus zone propagation delay (6h + 1h) minus the
+# time already passed since the UNRETENTIVE state has been reached (2h):
+# 7h - 2h = 5h = 18000 seconds.  Prevent intermittent false positives on slow
+# platforms by subtracting the number of seconds which passed between key
+# creation and invoking 'rndc reconfig'.
+next_time=$((18000 - time_passed))
 check_next_key_event $next_time
 
 #
@@ -5248,17 +5243,17 @@ wait_for_done_signing
 check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
 
 # Set expected key times:
-# - The old keys were activated 47 hours ago (169200 seconds)
-csk_rollover_predecessor_keytimes -169200
-# - And retired 44 hours ago (158400 seconds).
+# - The old keys were activated 45 hours ago (162000 seconds)
+csk_rollover_predecessor_keytimes -162000
+# - And retired 42 hours ago (151200 seconds).
 created=$(key_get KEY1 CREATED)
-set_addkeytime "KEY1" "RETIRED" "${created}" -158400
+set_addkeytime "KEY1" "RETIRED" "${created}" -151200
 retired=$(key_get KEY1 RETIRED)
 set_addkeytime "KEY1" "REMOVED" "${retired}" "${IretCSK}"
 # - The new key was published 47 hours ago.
 created=$(key_get KEY2 CREATED)
-set_addkeytime "KEY2" "PUBLISHED" "${created}" -169200
-set_addkeytime "KEY2" "ACTIVE" "${created}" -169200
+set_addkeytime "KEY2" "PUBLISHED" "${created}" -162000
+set_addkeytime "KEY2" "ACTIVE" "${created}" -162000
 published=$(key_get KEY2 PUBLISHED)
 set_addkeytime "KEY2" "SYNCPUBLISH" "${published}" ${Ipub}
 

bin/tests/system/qmin/ans2/1.0.0.2.ip6.arpa.db

@@ -0,0 +1,17 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+@		30	SOA	ns2.good. hostmaster.arpa. 2018050100 1 1 1 1
+@		30	NS	ns2.good.
+
+8.2.6.0		60	NS	ns3.good.
+
+1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.8.f.4.0 1 PTR nee.com.

bin/tests/system/qmin/ans2/ans.py

@@ -1,456 +1,111 @@
-# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-#
-# SPDX-License-Identifier: MPL-2.0
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0.  If a copy of the MPL was not distributed with this
-# file, you can obtain one at https://mozilla.org/MPL/2.0/.
-#
-# See the COPYRIGHT file distributed with this work for additional
-# information regarding copyright ownership.
+"""
+Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 
-from __future__ import print_function
-import os
-import sys
-import signal
-import socket
-import select
-from datetime import datetime, timedelta
-import time
-import functools
+SPDX-License-Identifier: MPL-2.0
 
-import dns, dns.message, dns.query, dns.flags
-from dns.rdatatype import *
-from dns.rdataclass import *
-from dns.rcode import *
-from dns.name import *
+This Source Code Form is subject to the terms of the Mozilla Public
+License, v. 2.0.  If a copy of the MPL was not distributed with this
+file, you can obtain one at https://mozilla.org/MPL/2.0/.
+
+See the COPYRIGHT file distributed with this work for additional
+information regarding copyright ownership.
+"""
+
+from typing import AsyncGenerator
+
+import dns.message
+import dns.name
+import dns.rcode
+import dns.rdataclass
+import dns.rdatatype
+
+from isctest.asyncserver import (
+    AsyncDnsServer,
+    DnsResponseSend,
+    DomainHandler,
+    QueryContext,
+    ResponseAction,
+)
+
+from qmin_ans import (
+    DelayedResponseHandler,
+    EntRcodeChanger,
+    QueryLogHandler,
+    log_query,
+)
 
 
-# Log query to file
-def logquery(type, qname):
-    with open("qlog", "a") as f:
-        f.write("%s %s\n", type, qname)
+class QueryLogger(QueryLogHandler):
+    domains = ["1.0.0.2.ip6.arpa.", "fwd.", "good."]
 
 
-def endswith(domain, labels):
-    return domain.endswith("." + labels) or domain == labels
+class BadHandler(EntRcodeChanger):
+    domains = ["bad."]
+    rcode = dns.rcode.NXDOMAIN
 
 
-############################################################################
-# Respond to a DNS query.
-# For good. it serves:
-# ns2.good. IN A 10.53.0.2
-# zoop.boing.good. NS ns3.good.
-# ns3.good. IN A 10.53.0.3
-# too.many.labels.a.b.c.d.e.f.g.h.i.j.k.l.m.n.o.p.q.r.s.t.u.v.w.x.y.z.good. A 192.0.2.2
-# it responds properly (with NODATA empty response) to non-empty terminals
-#
-# For slow. it works the same as for good., but each response is delayed by 400 milliseconds
-#
-# For bad. it works the same as for good., but returns NXDOMAIN to non-empty terminals
-#
-# For ugly. it works the same as for good., but returns garbage to non-empty terminals
-#
-# For 1.0.0.2.ip6.arpa it serves
-# 1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.8.f.4.0.1.0.0.2.ip6.arpa. IN PTR nee.com.
-# 8.2.6.0.1.0.0.2.ip6.arpa IN NS ns3.good
-# 1.0.0.2.ip6.arpa. IN NS ns2.good
-# ip6.arpa. IN NS ns2.good
-#
-# For stale. it serves:
-# a.b. NS ns.a.b.stale.
-# ns.a.b.stale. IN A 10.53.0.3
-# b. NS ns.b.stale.
-# ns.b.stale. IN A 10.53.0.4
-############################################################################
-def create_response(msg):
-    m = dns.message.from_wire(msg)
-    qname = m.question[0].name.to_text()
-    lqname = qname.lower()
-    labels = lqname.split(".")
-
-    # get qtype
-    rrtype = m.question[0].rdtype
-    typename = dns.rdatatype.to_text(rrtype)
-    if typename == "A" or typename == "AAAA":
-        typename = "ADDR"
-    bad = False
-    ugly = False
-    slow = False
-
-    # log this query
-    with open("query.log", "a") as f:
-        f.write("%s %s\n" % (typename, lqname))
-        print("%s %s" % (typename, lqname), end=" ")
-
-    r = dns.message.make_response(m)
-    r.set_rcode(NOERROR)
-
-    if endswith(lqname, "1.0.0.2.ip6.arpa."):
-        # Direct query - give direct answer
-        if endswith(lqname, "8.2.6.0.1.0.0.2.ip6.arpa."):
-            # Delegate to ns3
-            r.authority.append(
-                dns.rrset.from_text(
-                    "8.2.6.0.1.0.0.2.ip6.arpa.", 60, IN, NS, "ns3.good."
-                )
-            )
-            r.additional.append(
-                dns.rrset.from_text("ns3.good.", 60, IN, A, "10.53.0.3")
-            )
-        elif (
-            lqname
-            == "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.8.f.4.0.1.0.0.2.ip6.arpa."
-            and rrtype == PTR
-        ):
-            # Direct query - give direct answer
-            r.answer.append(
-                dns.rrset.from_text(
-                    "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.8.f.4.0.1.0.0.2.ip6.arpa.",
-                    1,
-                    IN,
-                    PTR,
-                    "nee.com.",
-                )
-            )
-            r.flags |= dns.flags.AA
-        elif lqname == "1.0.0.2.ip6.arpa." and rrtype == NS:
-            # NS query at the apex
-            r.answer.append(
-                dns.rrset.from_text("1.0.0.2.ip6.arpa.", 30, IN, NS, "ns2.good.")
-            )
-            r.flags |= dns.flags.AA
-        elif endswith(
-            "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.8.f.4.0.1.0.0.2.ip6.arpa.",
-            lqname,
-        ):
-            # NODATA answer
-            r.authority.append(
-                dns.rrset.from_text(
-                    "1.0.0.2.ip6.arpa.",
-                    30,
-                    IN,
-                    SOA,
-                    "ns2.good. hostmaster.arpa. 2018050100 1 1 1 1",
-                )
-            )
-        else:
-            # NXDOMAIN
-            r.authority.append(
-                dns.rrset.from_text(
-                    "1.0.0.2.ip6.arpa.",
-                    30,
-                    IN,
-                    SOA,
-                    "ns2.good. hostmaster.arpa. 2018050100 1 1 1 1",
-                )
-            )
-            r.set_rcode(NXDOMAIN)
-        return r
-    elif endswith(lqname, "ip6.arpa."):
-        if lqname == "ip6.arpa." and rrtype == NS:
-            # NS query at the apex
-            r.answer.append(dns.rrset.from_text("ip6.arpa.", 30, IN, NS, "ns2.good."))
-            r.flags |= dns.flags.AA
-        elif endswith("1.0.0.2.ip6.arpa.", lqname):
-            # NODATA answer
-            r.authority.append(
-                dns.rrset.from_text(
-                    "ip6.arpa.",
-                    30,
-                    IN,
-                    SOA,
-                    "ns2.good. hostmaster.arpa. 2018050100 1 1 1 1",
-                )
-            )
-        else:
-            # NXDOMAIN
-            r.authority.append(
-                dns.rrset.from_text(
-                    "ip6.arpa.",
-                    30,
-                    IN,
-                    SOA,
-                    "ns2.good. hostmaster.arpa. 2018050100 1 1 1 1",
-                )
-            )
-            r.set_rcode(NXDOMAIN)
-        return r
-    elif endswith(lqname, "stale."):
-        if endswith(lqname, "a.b.stale."):
-            # Delegate to ns.a.b.stale.
-            r.authority.append(
-                dns.rrset.from_text("a.b.stale.", 2, IN, NS, "ns.a.b.stale.")
-            )
-            r.additional.append(
-                dns.rrset.from_text("ns.a.b.stale.", 2, IN, A, "10.53.0.3")
-            )
-        elif endswith(lqname, "b.stale."):
-            # Delegate to ns.b.stale.
-            r.authority.append(
-                dns.rrset.from_text("b.stale.", 2, IN, NS, "ns.b.stale.")
-            )
-            r.additional.append(
-                dns.rrset.from_text("ns.b.stale.", 2, IN, A, "10.53.0.4")
-            )
-        elif lqname == "stale." and rrtype == NS:
-            # NS query at the apex.
-            r.answer.append(dns.rrset.from_text("stale.", 2, IN, NS, "ns2.stale."))
-            r.flags |= dns.flags.AA
-        elif lqname == "stale." and rrtype == SOA:
-            # SOA query at the apex.
-            r.answer.append(
-                dns.rrset.from_text(
-                    "stale.", 2, IN, SOA, "ns2.stale. hostmaster.stale. 1 2 3 4 5"
-                )
-            )
-            r.flags |= dns.flags.AA
-        elif lqname == "stale.":
-            # NODATA answer
-            r.authority.append(
-                dns.rrset.from_text(
-                    "stale.", 2, IN, SOA, "ns2.stale. hostmaster.arpa. 1 2 3 4 5"
-                )
-            )
-            r.flags |= dns.flags.AA
-        elif lqname == "ns2.stale.":
-            if rrtype == A:
-                r.additional.append(
-                    dns.rrset.from_text("ns.b.stale.", 2, IN, A, "10.53.0.2")
-                )
-            else:
-                r.authority.append(
-                    dns.rrset.from_text(
-                        "stale.", 2, IN, SOA, "ns2.stale. hostmaster.arpa. 1 2 3 4 5"
-                    )
-                )
-            r.flags |= dns.flags.AA
-        else:
-            # NXDOMAIN
-            r.authority.append(
-                dns.rrset.from_text(
-                    "stale.", 2, IN, SOA, "ns2.stale. hostmaster.arpa. 1 2 3 4 5"
-                )
-            )
-            r.set_rcode(NXDOMAIN)
-        return r
-    elif endswith(lqname, "bad."):
-        bad = True
-        suffix = "bad."
-        lqname = lqname[:-4]
-    elif endswith(lqname, "ugly."):
-        ugly = True
-        suffix = "ugly."
-        lqname = lqname[:-5]
-    elif endswith(lqname, "good."):
-        suffix = "good."
-        lqname = lqname[:-5]
-    elif endswith(lqname, "slow."):
-        slow = True
-        suffix = "slow."
-        lqname = lqname[:-5]
-    elif endswith(lqname, "fwd."):
-        suffix = "fwd."
-        lqname = lqname[:-4]
-    else:
-        r.set_rcode(REFUSED)
-        return r
-
-    # Good/bad/ugly differs only in how we treat non-empty terminals
-    if endswith(lqname, "zoop.boing."):
-        r.authority.append(
-            dns.rrset.from_text("zoop.boing." + suffix, 1, IN, NS, "ns3." + suffix)
-        )
-    elif (
-        lqname == "many.labels.a.b.c.d.e.f.g.h.i.j.k.l.m.n.o.p.q.r.s.t.u.v.w.x.y.z."
-        and rrtype == A
-    ):
-        r.answer.append(dns.rrset.from_text(lqname + suffix, 1, IN, A, "192.0.2.2"))
-        r.flags |= dns.flags.AA
-    elif lqname == "" and rrtype == NS:
-        r.answer.append(dns.rrset.from_text(suffix, 30, IN, NS, "ns2." + suffix))
-        r.flags |= dns.flags.AA
-    elif lqname == "ns2.":
-        r.flags |= dns.flags.AA
-        if rrtype == A:
-            r.answer.append(
-                dns.rrset.from_text("ns2." + suffix, 30, IN, A, "10.53.0.2")
-            )
-        elif rrtype == AAAA:
-            r.answer.append(
-                dns.rrset.from_text(
-                    "ns2." + suffix, 30, IN, AAAA, "fd92:7065:b8e:ffff::2"
-                )
-            )
-        else:
-            r.authority.append(
-                dns.rrset.from_text(
-                    suffix,
-                    30,
-                    IN,
-                    SOA,
-                    "ns2." + suffix + " hostmaster.arpa. 2018050100 1 1 1 1",
-                )
-            )
-    elif lqname == "ns3.":
-        r.flags |= dns.flags.AA
-        if rrtype == A:
-            r.answer.append(
-                dns.rrset.from_text("ns3." + suffix, 30, IN, A, "10.53.0.3")
-            )
-        elif lqname == "ns3." and rrtype == AAAA:
-            r.answer.append(
-                dns.rrset.from_text(
-                    "ns3." + suffix, 30, IN, AAAA, "fd92:7065:b8e:ffff::3"
-                )
-            )
-        else:
-            r.authority.append(
-                dns.rrset.from_text(
-                    suffix,
-                    30,
-                    IN,
-                    SOA,
-                    "ns2." + suffix + " hostmaster.arpa. 2018050100 1 1 1 1",
-                )
-            )
-    elif lqname == "ns4.":
-        r.flags |= dns.flags.AA
-        if rrtype == A:
-            r.answer.append(
-                dns.rrset.from_text("ns4." + suffix, 30, IN, A, "10.53.0.4")
-            )
-        elif rrtype == AAAA:
-            r.answer.append(
-                dns.rrset.from_text(
-                    "ns4." + suffix, 30, IN, AAAA, "fd92:7065:b8e:ffff::4"
-                )
-            )
-        else:
-            r.authority.append(
-                dns.rrset.from_text(
-                    suffix,
-                    30,
-                    IN,
-                    SOA,
-                    "ns2." + suffix + " hostmaster.arpa. 2018050100 1 1 1 1",
-                )
-            )
-    elif lqname == "a.bit.longer.ns.name." and rrtype == A:
-        r.answer.append(
-            dns.rrset.from_text("a.bit.longer.ns.name." + suffix, 1, IN, A, "10.53.0.4")
-        )
-        r.flags |= dns.flags.AA
-    elif lqname == "a.bit.longer.ns.name." and rrtype == AAAA:
-        r.answer.append(
-            dns.rrset.from_text(
-                "a.bit.longer.ns.name." + suffix, 1, IN, AAAA, "fd92:7065:b8e:ffff::4"
-            )
-        )
-        r.flags |= dns.flags.AA
-    else:
-        r.authority.append(
-            dns.rrset.from_text(
-                suffix,
-                1,
-                IN,
-                SOA,
-                "ns2." + suffix + " hostmaster.arpa. 2018050100 1 1 1 1",
-            )
-        )
-        if bad or not (
-            endswith("icky.icky.icky.ptang.zoop.boing.", lqname)
-            or endswith(
-                "many.labels.a.b.c.d.e.f.g.h.i.j.k.l.m.n.o.p.q.r.s.t.u.v.w.x.y.z.",
-                lqname,
-            )
-            or endswith("a.bit.longer.ns.name.", lqname)
-        ):
-            r.set_rcode(NXDOMAIN)
-        if ugly:
-            r.set_rcode(FORMERR)
-    if slow:
-        time.sleep(0.2)
-    return r
+class UglyHandler(EntRcodeChanger):
+    domains = ["ugly."]
+    rcode = dns.rcode.FORMERR
 
 
-def sigterm(signum, frame):
-    print("Shutting down now...")
-    os.remove("ans.pid")
-    running = False
-    sys.exit(0)
+class SlowHandler(DelayedResponseHandler):
+    domains = ["slow."]
+    delay = 0.2
 
 
-############################################################################
-# Main
-#
-# Set up responder and control channel, open the pid file, and start
-# the main loop, listening for queries on the query channel or commands
-# on the control channel and acting on them.
-############################################################################
-ip4 = "10.53.0.2"
-ip6 = "fd92:7065:b8e:ffff::2"
+def send_delegation(
+    qctx: QueryContext, zone_cut: dns.name.Name, target_addr: str
+) -> ResponseAction:
+    """
+    Delegate `zone_cut` to a single in-bailiwick name server, `ns.<zone_cut>`,
+    with a single IPv4 glue record (provided in `target_addr`) included in the
+    ADDITIONAL section.
+    """
+    ns_name = "ns." + zone_cut.to_text()
+    ns_rrset = dns.rrset.from_text(
+        zone_cut, 2, dns.rdataclass.IN, dns.rdatatype.NS, ns_name
+    )
+    a_rrset = dns.rrset.from_text(
+        ns_name, 2, dns.rdataclass.IN, dns.rdatatype.A, target_addr
+    )
 
-try:
-    port = int(os.environ["PORT"])
-except:
-    port = 5300
+    response = dns.message.make_response(qctx.query)
+    response.set_rcode(dns.rcode.NOERROR)
+    response.authority.append(ns_rrset)
+    response.additional.append(a_rrset)
 
-query4_socket = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
-query4_socket.bind((ip4, port))
+    return DnsResponseSend(response, authoritative=False)
 
-havev6 = True
-try:
-    query6_socket = socket.socket(socket.AF_INET6, socket.SOCK_DGRAM)
-    try:
-        query6_socket.bind((ip6, port))
-    except:
-        query6_socket.close()
-        havev6 = False
-except:
-    havev6 = False
 
-signal.signal(signal.SIGTERM, sigterm)
+class StaleHandler(DomainHandler):
+    """
+    `a.b.stale` is a subdomain of `b.stale` and these two subdomains need to be
+    delegated to different name servers.  Therefore, their delegations cannot
+    be placed in the zone file because the zone cut at `b.stale` would occlude
+    the one at `a.b.stale`.  Generate these delegations dynamically depending
+    on the QNAME.
+    """
 
-f = open("ans.pid", "w")
-pid = os.getpid()
-print(pid, file=f)
-f.close()
+    domains = ["stale."]
 
-running = True
+    async def get_responses(
+        self, qctx: QueryContext
+    ) -> AsyncGenerator[ResponseAction, None]:
+        log_query(qctx)
+        a_b_stale = dns.name.from_text("a.b.stale.")
+        b_stale = dns.name.from_text("b.stale.")
+        if qctx.qname.is_subdomain(a_b_stale):
+            yield send_delegation(qctx, a_b_stale, "10.53.0.3")
+        elif qctx.qname.is_subdomain(b_stale):
+            yield send_delegation(qctx, b_stale, "10.53.0.4")
 
-print("Listening on %s port %d" % (ip4, port))
-if havev6:
-    print("Listening on %s port %d" % (ip6, port))
-print("Ctrl-c to quit")
 
-if havev6:
-    input = [query4_socket, query6_socket]
-else:
-    input = [query4_socket]
-
-while running:
-    try:
-        inputready, outputready, exceptready = select.select(input, [], [])
-    except select.error as e:
-        break
-    except socket.error as e:
-        break
-    except KeyboardInterrupt:
-        break
-
-    for s in inputready:
-        if s == query4_socket or s == query6_socket:
-            print(
-                "Query received on %s" % (ip4 if s == query4_socket else ip6), end=" "
-            )
-            # Handle incoming queries
-            msg = s.recvfrom(65535)
-            rsp = create_response(msg[0])
-            if rsp:
-                print(dns.rcode.to_text(rsp.rcode()))
-                s.sendto(rsp.to_wire(), msg[1])
-            else:
-                print("NO RESPONSE")
-    if not running:
-        break
+if __name__ == "__main__":
+    server = AsyncDnsServer()
+    server.install_response_handler(QueryLogger())
+    server.install_response_handler(BadHandler())
+    server.install_response_handler(UglyHandler())
+    server.install_response_handler(SlowHandler())
+    server.install_response_handler(StaleHandler())
+    server.run()

bin/tests/system/qmin/ans2/bad.db

@@ -0,0 +1 @@
+good.db

bin/tests/system/qmin/ans2/fwd.db

@@ -0,0 +1 @@
+good.db

bin/tests/system/qmin/ans2/good.db

@@ -0,0 +1,26 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+@			1	SOA	ns2 hostmaster.arpa. 2018050100 1 1 1 1
+
+@			30	NS	ns2
+ns2			30	A	10.53.0.2
+			30	AAAA	fd92:7065:b8e:ffff::2
+
+zoop.boing		30	NS	ns3
+ns3			30	A	10.53.0.3
+			30	AAAA	fd92:7065:b8e:ffff::3
+
+ns4			30	A	10.53.0.4
+			30	AAAA	fd92:7065:b8e:ffff::4
+
+a.bit.longer.ns.name	1	A	10.53.0.4
+			1	AAAA	fd92:7065:b8e:ffff::4

bin/tests/system/qmin/ans2/slow.db

@@ -0,0 +1 @@
+good.db

bin/tests/system/qmin/ans2/stale.db

@@ -0,0 +1,15 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+@	2	SOA	ns2 hostmaster.stale. 1 2 3 4 5
+@	2	NS	ns2
+ns2	2	A	10.53.0.2
+	2	AAAA	fd92:7065:b8e:ffff::2

bin/tests/system/qmin/ans2/ugly.db

@@ -0,0 +1 @@
+good.db

bin/tests/system/qmin/ans3/8.2.6.0.1.0.0.2.ip6.arpa.db

@@ -0,0 +1,15 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+@		30	SOA	ns3.good. hostmaster.arpa. 2018050100 1 1 1 1
+@		30	NS	ns3.good.
+
+1.1.1.1		60	NS	ns4.good.

bin/tests/system/qmin/ans3/a.b.stale.db

@@ -0,0 +1,15 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+@	1	SOA	ns hostmaster.a.b.stale. 1 2 3 4 5
+@	1	NS	ns
+@	1	TXT	"peekaboo"
+ns	1	A	10.53.0.3

bin/tests/system/qmin/ans3/ans.py

@@ -1,285 +1,46 @@
-# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-#
-# SPDX-License-Identifier: MPL-2.0
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0.  If a copy of the MPL was not distributed with this
-# file, you can obtain one at https://mozilla.org/MPL/2.0/.
-#
-# See the COPYRIGHT file distributed with this work for additional
-# information regarding copyright ownership.
+"""
+Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 
-from __future__ import print_function
-import os
-import sys
-import signal
-import socket
-import select
-from datetime import datetime, timedelta
-import time
-import functools
+SPDX-License-Identifier: MPL-2.0
 
-import dns, dns.message, dns.query, dns.flags
-from dns.rdatatype import *
-from dns.rdataclass import *
-from dns.rcode import *
-from dns.name import *
+This Source Code Form is subject to the terms of the Mozilla Public
+License, v. 2.0.  If a copy of the MPL was not distributed with this
+file, you can obtain one at https://mozilla.org/MPL/2.0/.
+
+See the COPYRIGHT file distributed with this work for additional
+information regarding copyright ownership.
+"""
+
+import dns.rcode
+
+from isctest.asyncserver import AsyncDnsServer
+
+from qmin_ans import DelayedResponseHandler, EntRcodeChanger, QueryLogHandler
 
 
-# Log query to file
-def logquery(type, qname):
-    with open("qlog", "a") as f:
-        f.write("%s %s\n", type, qname)
+class QueryLogger(QueryLogHandler):
+    domains = ["8.2.6.0.1.0.0.2.ip6.arpa.", "a.b.stale.", "zoop.boing.good."]
 
 
-def endswith(domain, labels):
-    return domain.endswith("." + labels) or domain == labels
+class ZoopBoingBadHandler(EntRcodeChanger):
+    domains = ["zoop.boing.bad."]
+    rcode = dns.rcode.NXDOMAIN
 
 
-############################################################################
-# Respond to a DNS query.
-# For good. it serves:
-# zoop.boing.good. NS ns3.good.
-# icky.ptang.zoop.boing.good. NS a.bit.longer.ns.name.good.
-# it responds properly (with NODATA empty response) to non-empty terminals
-#
-# For slow. it works the same as for good., but each response is delayed by 400 milliseconds
-#
-# For bad. it works the same as for good., but returns NXDOMAIN to non-empty terminals
-#
-# For ugly. it works the same as for good., but returns garbage to non-empty terminals
-#
-# For stale. it serves:
-# a.b.stale. IN TXT peekaboo (resolver did not do qname minimization)
-############################################################################
-def create_response(msg):
-    m = dns.message.from_wire(msg)
-    qname = m.question[0].name.to_text()
-    lqname = qname.lower()
-    labels = lqname.split(".")
-    suffix = ""
-
-    # get qtype
-    rrtype = m.question[0].rdtype
-    typename = dns.rdatatype.to_text(rrtype)
-    if typename == "A" or typename == "AAAA":
-        typename = "ADDR"
-    bad = False
-    ugly = False
-    slow = False
-
-    # log this query
-    with open("query.log", "a") as f:
-        f.write("%s %s\n" % (typename, lqname))
-        print("%s %s" % (typename, lqname), end=" ")
-
-    r = dns.message.make_response(m)
-    r.set_rcode(NOERROR)
-
-    ip6req = False
-
-    if endswith(lqname, "bad."):
-        bad = True
-        suffix = "bad."
-        lqname = lqname[:-4]
-    elif endswith(lqname, "ugly."):
-        ugly = True
-        suffix = "ugly."
-        lqname = lqname[:-5]
-    elif endswith(lqname, "good."):
-        suffix = "good."
-        lqname = lqname[:-5]
-    elif endswith(lqname, "slow."):
-        slow = True
-        suffix = "slow."
-        lqname = lqname[:-5]
-    elif endswith(lqname, "8.2.6.0.1.0.0.2.ip6.arpa."):
-        ip6req = True
-    elif endswith(lqname, "a.b.stale."):
-        if lqname == "a.b.stale.":
-            r.flags |= dns.flags.AA
-            if rrtype == TXT:
-                # Direct query.
-                r.answer.append(dns.rrset.from_text(lqname, 1, IN, TXT, "peekaboo"))
-            elif rrtype == NS:
-                # NS a.b.
-                r.answer.append(dns.rrset.from_text(lqname, 1, IN, NS, "ns.a.b.stale."))
-                r.additional.append(
-                    dns.rrset.from_text("ns.a.b.stale.", 1, IN, A, "10.53.0.3")
-                )
-            elif rrtype == SOA:
-                # SOA a.b.
-                r.answer.append(
-                    dns.rrset.from_text(
-                        lqname, 1, IN, SOA, "a.b.stale. hostmaster.a.b.stale. 1 2 3 4 5"
-                    )
-                )
-            else:
-                # NODATA.
-                r.authority.append(
-                    dns.rrset.from_text(
-                        lqname, 1, IN, SOA, "a.b.stale. hostmaster.a.b.stale. 1 2 3 4 5"
-                    )
-                )
-        elif lqname == "ns.a.b.stale.":
-            r.flags |= dns.flags.AA
-            if rrtype == A:
-                r.answer.append(
-                    dns.rrset.from_text("ns.a.b.stale.", 1, IN, A, "10.53.0.3")
-                )
-            else:
-                r.authority.append(
-                    dns.rrset.from_text(
-                        lqname, 1, IN, SOA, "a.b.stale. hostmaster.a.b.stale. 1 2 3 4 5"
-                    )
-                )
-        else:
-            r.flags |= dns.flags.AA
-            r.authority.append(
-                dns.rrset.from_text(
-                    lqname, 1, IN, SOA, "a.b.stale. hostmaster.a.b.stale. 1 2 3 4 5"
-                )
-            )
-            r.set_rcode(NXDOMAIN)
-            # NXDOMAIN.
-        return r
-    else:
-        r.set_rcode(REFUSED)
-        return r
-
-    # Good/bad differs only in how we treat non-empty terminals
-    if lqname == "zoop.boing." and rrtype == NS:
-        r.answer.append(
-            dns.rrset.from_text(lqname + suffix, 1, IN, NS, "ns3." + suffix)
-        )
-        r.flags |= dns.flags.AA
-    elif endswith(lqname, "icky.ptang.zoop.boing."):
-        r.authority.append(
-            dns.rrset.from_text(
-                "icky.ptang.zoop.boing." + suffix,
-                1,
-                IN,
-                NS,
-                "a.bit.longer.ns.name." + suffix,
-            )
-        )
-    elif endswith("icky.ptang.zoop.boing.", lqname):
-        r.authority.append(
-            dns.rrset.from_text(
-                "zoop.boing." + suffix,
-                1,
-                IN,
-                SOA,
-                "ns3." + suffix + " hostmaster.arpa. 2018050100 1 1 1 1",
-            )
-        )
-        if bad:
-            r.set_rcode(NXDOMAIN)
-        if ugly:
-            r.set_rcode(FORMERR)
-    elif endswith(lqname, "zoop.boing."):
-        r.authority.append(
-            dns.rrset.from_text(
-                "zoop.boing." + suffix,
-                1,
-                IN,
-                SOA,
-                "ns3." + suffix + " hostmaster.arpa. 2018050100 1 1 1 1",
-            )
-        )
-        r.set_rcode(NXDOMAIN)
-    elif ip6req:
-        r.authority.append(
-            dns.rrset.from_text(
-                "1.1.1.1.8.2.6.0.1.0.0.2.ip6.arpa.", 60, IN, NS, "ns4.good."
-            )
-        )
-        r.additional.append(dns.rrset.from_text("ns4.good.", 60, IN, A, "10.53.0.4"))
-    else:
-        r.set_rcode(REFUSED)
-
-    if slow:
-        time.sleep(0.4)
-    return r
+class ZoopBoingUglyHandler(EntRcodeChanger):
+    domains = ["zoop.boing.ugly."]
+    rcode = dns.rcode.FORMERR
 
 
-def sigterm(signum, frame):
-    print("Shutting down now...")
-    os.remove("ans.pid")
-    running = False
-    sys.exit(0)
+class ZoopBoingSlowHandler(DelayedResponseHandler):
+    domains = ["zoop.boing.slow."]
+    delay = 0.4
 
 
-############################################################################
-# Main
-#
-# Set up responder and control channel, open the pid file, and start
-# the main loop, listening for queries on the query channel or commands
-# on the control channel and acting on them.
-############################################################################
-ip4 = "10.53.0.3"
-ip6 = "fd92:7065:b8e:ffff::3"
-
-try:
-    port = int(os.environ["PORT"])
-except:
-    port = 5300
-
-query4_socket = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
-query4_socket.bind((ip4, port))
-
-havev6 = True
-try:
-    query6_socket = socket.socket(socket.AF_INET6, socket.SOCK_DGRAM)
-    try:
-        query6_socket.bind((ip6, port))
-    except:
-        query6_socket.close()
-        havev6 = False
-except:
-    havev6 = False
-
-signal.signal(signal.SIGTERM, sigterm)
-
-f = open("ans.pid", "w")
-pid = os.getpid()
-print(pid, file=f)
-f.close()
-
-running = True
-
-print("Listening on %s port %d" % (ip4, port))
-if havev6:
-    print("Listening on %s port %d" % (ip6, port))
-print("Ctrl-c to quit")
-
-if havev6:
-    input = [query4_socket, query6_socket]
-else:
-    input = [query4_socket]
-
-while running:
-    try:
-        inputready, outputready, exceptready = select.select(input, [], [])
-    except select.error as e:
-        break
-    except socket.error as e:
-        break
-    except KeyboardInterrupt:
-        break
-
-    for s in inputready:
-        if s == query4_socket or s == query6_socket:
-            print(
-                "Query received on %s" % (ip4 if s == query4_socket else ip6), end=" "
-            )
-            # Handle incoming queries
-            msg = s.recvfrom(65535)
-            rsp = create_response(msg[0])
-            if rsp:
-                print(dns.rcode.to_text(rsp.rcode()))
-                s.sendto(rsp.to_wire(), msg[1])
-            else:
-                print("NO RESPONSE")
-    if not running:
-        break
+if __name__ == "__main__":
+    server = AsyncDnsServer()
+    server.install_response_handler(QueryLogger())
+    server.install_response_handler(ZoopBoingBadHandler())
+    server.install_response_handler(ZoopBoingUglyHandler())
+    server.install_response_handler(ZoopBoingSlowHandler())
+    server.run()

bin/tests/system/qmin/ans3/zoop.boing.bad.db

@@ -0,0 +1,14 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+@			1	SOA	ns3.bad. hostmaster.arpa. 2018050100 1 1 1 1
+@			1	NS	ns3.bad.
+icky.ptang		1	NS	a.bit.longer.ns.name.bad.

bin/tests/system/qmin/ans3/zoop.boing.good.db

@@ -0,0 +1,14 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+@			1	SOA	ns3.good. hostmaster.arpa. 2018050100 1 1 1 1
+@			1	NS	ns3.good.
+icky.ptang		1	NS	a.bit.longer.ns.name.good.

bin/tests/system/qmin/ans3/zoop.boing.slow.db

@@ -0,0 +1,14 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+@			1	SOA	ns3.slow. hostmaster.arpa. 2018050100 1 1 1 1
+@			1	NS	ns3.slow.
+icky.ptang		1	NS	a.bit.longer.ns.name.slow.

bin/tests/system/qmin/ans3/zoop.boing.ugly.db

@@ -0,0 +1,14 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+@			1	SOA	ns3.ugly. hostmaster.arpa. 2018050100 1 1 1 1
+@			1	NS	ns3.ugly.
+icky.ptang		1	NS	a.bit.longer.ns.name.ugly.

bin/tests/system/qmin/ans4/1.1.1.1.8.2.6.0.1.0.0.2.ip6.arpa.db

@@ -0,0 +1,15 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+@		30	SOA	ns4.good. hostmaster.arpa. 2018050100 1 1 1 1
+@		30	NS	ns4.good.
+
+test1.test2.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.9.0.9.4 1 TXT "long_ip6_name"

bin/tests/system/qmin/ans4/a.b.stale.db

@@ -0,0 +1,15 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+@	1	SOA	ns hostmaster.a.b.stale. 1 2 3 4 5
+@	1	NS	ns
+ns	1	A	10.53.0.4
+@	1	TXT	"hooray"

bin/tests/system/qmin/ans4/ans.py

@@ -1,345 +1,93 @@
-# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-#
-# SPDX-License-Identifier: MPL-2.0
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0.  If a copy of the MPL was not distributed with this
-# file, you can obtain one at https://mozilla.org/MPL/2.0/.
-#
-# See the COPYRIGHT file distributed with this work for additional
-# information regarding copyright ownership.
+"""
+Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 
-from __future__ import print_function
-import os
-import sys
-import signal
-import socket
-import select
-from datetime import datetime, timedelta
-import time
-import functools
+SPDX-License-Identifier: MPL-2.0
 
-import dns, dns.message, dns.query, dns.flags
-from dns.rdatatype import *
-from dns.rdataclass import *
-from dns.rcode import *
-from dns.name import *
+This Source Code Form is subject to the terms of the Mozilla Public
+License, v. 2.0.  If a copy of the MPL was not distributed with this
+file, you can obtain one at https://mozilla.org/MPL/2.0/.
+
+See the COPYRIGHT file distributed with this work for additional
+information regarding copyright ownership.
+"""
+
+from typing import AsyncGenerator
+
+import dns.rcode
+
+from isctest.asyncserver import (
+    AsyncDnsServer,
+    DnsResponseSend,
+    DomainHandler,
+    QueryContext,
+    ResponseAction,
+)
+
+from qmin_ans import DelayedResponseHandler, EntRcodeChanger, QueryLogHandler, log_query
 
 
-# Log query to file
-def logquery(type, qname):
-    with open("qlog", "a") as f:
-        f.write("%s %s\n", type, qname)
+class QueryLogger(QueryLogHandler):
+    domains = [
+        "1.1.1.1.8.2.6.0.1.0.0.2.ip6.arpa.",
+        "icky.ptang.zoop.boing.good.",
+    ]
 
 
-def endswith(domain, labels):
-    return domain.endswith("." + labels) or domain == labels
+class StaleHandler(DomainHandler):
+    """
+    The test code relies on this server returning non-minimal (i.e. including
+    address records in the ADDITIONAL section) responses to NS queries for
+    `b.stale` and `a.b.stale`.  While this logic (returning non-minimal
+    responses to NS queries) could be implemented in AsyncDnsServer itself,
+    doing so breaks a lot of other checks in this system test.  Therefore, only
+    these two zones behave in this particular way, thanks to a custom response
+    handler implemented below.
+    """
+
+    domains = ["b.stale", "a.b.stale"]
+
+    async def get_responses(
+        self, qctx: QueryContext
+    ) -> AsyncGenerator[ResponseAction, None]:
+        log_query(qctx)
+
+        if qctx.qtype == dns.rdatatype.NS:
+            assert qctx.zone
+            assert qctx.response.answer[0]
+
+            for nameserver in qctx.response.answer[0]:
+                if not nameserver.target.is_subdomain(qctx.response.answer[0].name):
+                    continue
+                glue_a = qctx.zone.get_rrset(nameserver.target, dns.rdatatype.A)
+                if glue_a:
+                    qctx.response.additional.append(glue_a)
+                glue_aaaa = qctx.zone.get_rrset(nameserver.target, dns.rdatatype.AAAA)
+                if glue_aaaa:
+                    qctx.response.additional.append(glue_aaaa)
+
+        yield DnsResponseSend(qctx.response)
 
 
-############################################################################
-# Respond to a DNS query.
-# For good. it serves:
-# icky.ptang.zoop.boing.good. NS a.bit.longer.ns.name.
-# icky.icky.icky.ptang.zoop.boing.good. A 192.0.2.1
-# more.icky.icky.icky.ptang.zoop.boing.good. A 192.0.2.2
-# it responds properly (with NODATA empty response) to non-empty terminals
-#
-# For slow. it works the same as for good., but each response is delayed by 400 milliseconds
-#
-# For bad. it works the same as for good., but returns NXDOMAIN to non-empty terminals
-#
-# For ugly. it works the same as for good., but returns garbage to non-empty terminals
-#
-# For stale. it serves:
-# a.b.stale. IN TXT hooray (resolver did do qname minimization)
-############################################################################
-def create_response(msg):
-    m = dns.message.from_wire(msg)
-    qname = m.question[0].name.to_text()
-    lqname = qname.lower()
-    labels = lqname.split(".")
-    suffix = ""
-
-    # get qtype
-    rrtype = m.question[0].rdtype
-    typename = dns.rdatatype.to_text(rrtype)
-    if typename == "A" or typename == "AAAA":
-        typename = "ADDR"
-    bad = False
-    slow = False
-    ugly = False
-
-    # log this query
-    with open("query.log", "a") as f:
-        f.write("%s %s\n" % (typename, lqname))
-        print("%s %s" % (typename, lqname), end=" ")
-
-    r = dns.message.make_response(m)
-    r.set_rcode(NOERROR)
-
-    ip6req = False
-
-    if endswith(lqname, "bad."):
-        bad = True
-        suffix = "bad."
-        lqname = lqname[:-4]
-    elif endswith(lqname, "ugly."):
-        ugly = True
-        suffix = "ugly."
-        lqname = lqname[:-5]
-    elif endswith(lqname, "good."):
-        suffix = "good."
-        lqname = lqname[:-5]
-    elif endswith(lqname, "slow."):
-        slow = True
-        suffix = "slow."
-        lqname = lqname[:-5]
-    elif endswith(lqname, "1.1.1.1.8.2.6.0.1.0.0.2.ip6.arpa."):
-        ip6req = True
-    elif endswith(lqname, "b.stale."):
-        if lqname == "a.b.stale.":
-            r.flags |= dns.flags.AA
-            if rrtype == TXT:
-                # Direct query.
-                r.answer.append(dns.rrset.from_text(lqname, 1, IN, TXT, "hooray"))
-            elif rrtype == NS:
-                # NS a.b.
-                # This is only returned if a query for b.stale/NS has been made
-                r.answer.append(dns.rrset.from_text(lqname, 1, IN, NS, "ns.a.b.stale."))
-                r.additional.append(
-                    dns.rrset.from_text("ns.a.b.stale.", 1, IN, A, "10.53.0.4")
-                )
-            elif rrtype == SOA:
-                # SOA a.b.
-                r.answer.append(
-                    dns.rrset.from_text(
-                        lqname, 1, IN, SOA, "a.b.stale. hostmaster.a.b.stale. 1 2 3 4 5"
-                    )
-                )
-            else:
-                # NODATA.
-                r.authority.append(
-                    dns.rrset.from_text(
-                        lqname, 1, IN, SOA, "a.b.stale. hostmaster.a.b.stale. 1 2 3 4 5"
-                    )
-                )
-        elif lqname == "ns.a.b.stale.":
-            r.flags |= dns.flags.AA
-            if rrtype == A:
-                r.answer.append(
-                    dns.rrset.from_text("ns.a.b.stale.", 1, IN, A, "10.53.0.4")
-                )
-            else:
-                # NODATA.
-                r.authority.append(
-                    dns.rrset.from_text(
-                        lqname, 1, IN, SOA, "a.b.stale. hostmaster.a.b.stale. 1 2 3 4 5"
-                    )
-                )
-        elif lqname == "b.stale.":
-            r.flags |= dns.flags.AA
-            if rrtype == NS:
-                # NS b.
-                r.answer.append(dns.rrset.from_text(lqname, 1, IN, NS, "ns.b.stale."))
-                r.additional.append(
-                    dns.rrset.from_text("ns.b.stale.", 1, IN, A, "10.53.0.4")
-                )
-            elif rrtype == SOA:
-                # SOA b.
-                r.answer.append(
-                    dns.rrset.from_text(
-                        lqname, 1, IN, SOA, "b.stale. hostmaster.b.stale. 1 2 3 4 5"
-                    )
-                )
-            else:
-                # NODATA.
-                r.authority.append(
-                    dns.rrset.from_text(
-                        lqname, 1, IN, SOA, "b.stale. hostmaster.b.stale. 1 2 3 4 5"
-                    )
-                )
-        elif lqname == "ns.b.stale.":
-            r.flags |= dns.flags.AA
-            if rrtype == A:
-                # SOA a.b.
-                r.answer.append(
-                    dns.rrset.from_text("ns.a.b.stale.", 1, IN, A, "10.53.0.4")
-                )
-            else:
-                # NODATA.
-                r.authority.append(
-                    dns.rrset.from_text(
-                        lqname, 1, IN, SOA, "b.stale. hostmaster.b.stale. 1 2 3 4 5"
-                    )
-                )
-        else:
-            r.authority.append(
-                dns.rrset.from_text(
-                    lqname, 1, IN, SOA, "b.stale. hostmaster.b.stale. 1 2 3 4 5"
-                )
-            )
-            r.set_rcode(NXDOMAIN)
-            # NXDOMAIN.
-        return r
-    else:
-        r.set_rcode(REFUSED)
-        return r
-
-    # Good/bad differs only in how we treat non-empty terminals
-    if lqname == "icky.icky.icky.ptang.zoop.boing." and rrtype == A:
-        r.answer.append(dns.rrset.from_text(lqname + suffix, 1, IN, A, "192.0.2.1"))
-        r.flags |= dns.flags.AA
-    elif lqname == "more.icky.icky.icky.ptang.zoop.boing." and rrtype == A:
-        r.answer.append(dns.rrset.from_text(lqname + suffix, 1, IN, A, "192.0.2.2"))
-        r.flags |= dns.flags.AA
-    elif lqname == "icky.ptang.zoop.boing." and rrtype == NS:
-        r.answer.append(
-            dns.rrset.from_text(
-                lqname + suffix, 1, IN, NS, "a.bit.longer.ns.name." + suffix
-            )
-        )
-        r.flags |= dns.flags.AA
-    elif endswith(lqname, "icky.ptang.zoop.boing."):
-        r.authority.append(
-            dns.rrset.from_text(
-                "icky.ptang.zoop.boing." + suffix,
-                1,
-                IN,
-                SOA,
-                "ns2." + suffix + " hostmaster.arpa. 2018050100 1 1 1 1",
-            )
-        )
-        if bad or not endswith("more.icky.icky.icky.ptang.zoop.boing.", lqname):
-            r.set_rcode(NXDOMAIN)
-        if ugly:
-            r.set_rcode(FORMERR)
-    elif ip6req:
-        r.flags |= dns.flags.AA
-        if (
-            lqname
-            == "test1.test2.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.9.0.9.4.1.1.1.1.8.2.6.0.1.0.0.2.ip6.arpa."
-            and rrtype == TXT
-        ):
-            r.answer.append(
-                dns.rrset.from_text(
-                    "test1.test2.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.9.0.9.4.1.1.1.1.8.2.6.0.1.0.0.2.ip6.arpa.",
-                    1,
-                    IN,
-                    TXT,
-                    "long_ip6_name",
-                )
-            )
-        elif endswith(
-            "0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.9.0.9.4.1.1.1.1.8.2.6.0.1.0.0.2.ip6.arpa.",
-            lqname,
-        ):
-            # NODATA answer
-            r.authority.append(
-                dns.rrset.from_text(
-                    "1.1.1.1.8.2.6.0.1.0.0.2.ip6.arpa.",
-                    60,
-                    IN,
-                    SOA,
-                    "ns4.good. hostmaster.arpa. 2018050100 120 30 320 16",
-                )
-            )
-        else:
-            # NXDOMAIN
-            r.authority.append(
-                dns.rrset.from_text(
-                    "1.1.1.1.8.2.6.0.1.0.0.2.ip6.arpa.",
-                    60,
-                    IN,
-                    SOA,
-                    "ns4.good. hostmaster.arpa. 2018050100 120 30 320 16",
-                )
-            )
-            r.set_rcode(NXDOMAIN)
-    else:
-        r.set_rcode(REFUSED)
-
-    if slow:
-        time.sleep(0.4)
-    return r
+class IckyPtangZoopBoingBadHandler(EntRcodeChanger):
+    domains = ["icky.ptang.zoop.boing.bad."]
+    rcode = dns.rcode.NXDOMAIN
 
 
-def sigterm(signum, frame):
-    print("Shutting down now...")
-    os.remove("ans.pid")
-    running = False
-    sys.exit(0)
+class IckyPtangZoopBoingUglyHandler(EntRcodeChanger):
+    domains = ["icky.ptang.zoop.boing.ugly."]
+    rcode = dns.rcode.FORMERR
 
 
-############################################################################
-# Main
-#
-# Set up responder and control channel, open the pid file, and start
-# the main loop, listening for queries on the query channel or commands
-# on the control channel and acting on them.
-############################################################################
-ip4 = "10.53.0.4"
-ip6 = "fd92:7065:b8e:ffff::4"
+class IckyPtangZoopBoingSlowHandler(DelayedResponseHandler):
+    domains = ["icky.ptang.zoop.boing.slow."]
+    delay = 0.4
 
-try:
-    port = int(os.environ["PORT"])
-except:
-    port = 5300
 
-query4_socket = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
-query4_socket.bind((ip4, port))
-
-havev6 = True
-try:
-    query6_socket = socket.socket(socket.AF_INET6, socket.SOCK_DGRAM)
-    try:
-        query6_socket.bind((ip6, port))
-    except:
-        query6_socket.close()
-        havev6 = False
-except:
-    havev6 = False
-
-signal.signal(signal.SIGTERM, sigterm)
-
-f = open("ans.pid", "w")
-pid = os.getpid()
-print(pid, file=f)
-f.close()
-
-running = True
-
-print("Listening on %s port %d" % (ip4, port))
-if havev6:
-    print("Listening on %s port %d" % (ip6, port))
-print("Ctrl-c to quit")
-
-if havev6:
-    input = [query4_socket, query6_socket]
-else:
-    input = [query4_socket]
-
-while running:
-    try:
-        inputready, outputready, exceptready = select.select(input, [], [])
-    except select.error as e:
-        break
-    except socket.error as e:
-        break
-    except KeyboardInterrupt:
-        break
-
-    for s in inputready:
-        if s == query4_socket or s == query6_socket:
-            print(
-                "Query received on %s" % (ip4 if s == query4_socket else ip6), end=" "
-            )
-            # Handle incoming queries
-            msg = s.recvfrom(65535)
-            rsp = create_response(msg[0])
-            if rsp:
-                print(dns.rcode.to_text(rsp.rcode()))
-                s.sendto(rsp.to_wire(), msg[1])
-            else:
-                print("NO RESPONSE")
-    if not running:
-        break
+if __name__ == "__main__":
+    server = AsyncDnsServer()
+    server.install_response_handler(QueryLogger())
+    server.install_response_handler(StaleHandler())
+    server.install_response_handler(IckyPtangZoopBoingBadHandler())
+    server.install_response_handler(IckyPtangZoopBoingUglyHandler())
+    server.install_response_handler(IckyPtangZoopBoingSlowHandler())
+    server.run()

bin/tests/system/qmin/ans4/b.stale.db

@@ -0,0 +1,16 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+@	1	SOA	ns hostmaster.b.stale. 1 2 3 4 5
+@	1	NS	ns
+ns	1	A	10.53.0.4
+a	1	NS	ns.a
+ns.a	1	A	10.53.0.4

bin/tests/system/qmin/ans4/icky.ptang.zoop.boing.bad.db

@@ -0,0 +1,15 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+@			1	SOA	ns4.bad. hostmaster.arpa. 2018050100 1 1 1 1
+@			1	NS	a.bit.longer.ns.name.bad.
+icky.icky		1	A	192.0.2.1
+more.icky.icky		1	A	192.0.2.2

bin/tests/system/qmin/ans4/icky.ptang.zoop.boing.good.db

@@ -0,0 +1,15 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+@			1	SOA	ns4.good. hostmaster.arpa. 2018050100 1 1 1 1
+@			1	NS	a.bit.longer.ns.name.good.
+icky.icky		1	A	192.0.2.1
+more.icky.icky		1	A	192.0.2.2

bin/tests/system/qmin/ans4/icky.ptang.zoop.boing.slow.db

@@ -0,0 +1,15 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+@			1	SOA	ns4.slow. hostmaster.arpa. 2018050100 1 1 1 1
+@			1	NS	a.bit.longer.ns.name.slow.
+icky.icky		1	A	192.0.2.1
+more.icky.icky		1	A	192.0.2.2

bin/tests/system/qmin/ans4/icky.ptang.zoop.boing.ugly.db

@@ -0,0 +1,15 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+@			1	SOA	ns4.ugly. hostmaster.arpa. 2018050100 1 1 1 1
+@			1	NS	a.bit.longer.ns.name.ugly.
+icky.icky		1	A	192.0.2.1
+more.icky.icky		1	A	192.0.2.2

bin/tests/system/qmin/qmin_ans.py

@@ -0,0 +1,107 @@
+"""
+Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+
+SPDX-License-Identifier: MPL-2.0
+
+This Source Code Form is subject to the terms of the Mozilla Public
+License, v. 2.0.  If a copy of the MPL was not distributed with this
+file, you can obtain one at https://mozilla.org/MPL/2.0/.
+
+See the COPYRIGHT file distributed with this work for additional
+information regarding copyright ownership.
+"""
+
+from typing import AsyncGenerator
+
+import abc
+
+import dns.rcode
+import dns.rdataclass
+import dns.rdatatype
+
+from isctest.asyncserver import (
+    DnsResponseSend,
+    DomainHandler,
+    QueryContext,
+    ResponseAction,
+)
+
+from isctest.compat import dns_rcode
+
+
+def log_query(qctx: QueryContext) -> None:
+    """
+    Log a received DNS query to a text file inspected by `tests.sh`.  AAAA and
+    A queries are logged identically because the relative order in which they
+    are received does not matter.
+    """
+    qname = qctx.qname.to_text()
+    qtype = dns.rdatatype.to_text(qctx.qtype)
+    if qtype in ("A", "AAAA"):
+        qtype = "ADDR"
+
+    with open("query.log", "a", encoding="utf-8") as query_log:
+        print(f"{qtype} {qname}", file=query_log)
+
+
+class QueryLogHandler(DomainHandler):
+    """
+    Log all received DNS queries to a text file.  Use the zone file for
+    preparing responses.
+    """
+
+    async def get_responses(
+        self, qctx: QueryContext
+    ) -> AsyncGenerator[ResponseAction, None]:
+        log_query(qctx)
+        yield DnsResponseSend(qctx.response)
+
+
+class EntRcodeChanger(DomainHandler):
+    """
+    Log all received DNS queries to a text file.  Use the zone file for
+    preparing responses, but override the RCODE returned for empty
+    non-terminals (ENTs) to the value specified by the child class.  This
+    emulates broken authoritative servers.
+    """
+
+    @property
+    @abc.abstractmethod
+    def rcode(self) -> dns_rcode:
+        raise NotImplementedError
+
+    async def get_responses(
+        self, qctx: QueryContext
+    ) -> AsyncGenerator[ResponseAction, None]:
+        assert qctx.zone
+
+        log_query(qctx)
+
+        if (
+            qctx.response.rcode() == dns.rcode.NOERROR
+            and not qctx.response.answer
+            and qctx.response.authority
+            and qctx.response.authority[0].rdtype == dns.rdatatype.SOA
+            and not qctx.zone.get_node(qctx.qname)
+        ):
+            qctx.response.set_rcode(self.rcode)
+            yield DnsResponseSend(qctx.response)
+
+
+class DelayedResponseHandler(DomainHandler):
+    """
+    Log all received DNS queries to a text file.  Use the zone file for
+    preparing responses, but delay sending every answer by the amount of time
+    specified (in seconds) by the child class.  This emulates network delays.
+    """
+
+    @property
+    @abc.abstractmethod
+    def delay(self) -> float:
+        raise NotImplementedError
+
+    async def get_responses(
+        self, qctx: QueryContext
+    ) -> AsyncGenerator[ResponseAction, None]:
+        log_query(qctx)
+        yield DnsResponseSend(qctx.response, delay=self.delay)

bin/tests/system/resolver/ans2/ans.pl

@@ -20,6 +20,8 @@ use IO::Socket;
 use Net::DNS;
 use Net::DNS::Packet;
 
+print "Using Net::DNS $Net::DNS::VERSION\n";
+
 my $localport = int($ENV{'PORT'});
 if (!$localport) { $localport = 5300; }
 
@@ -170,6 +172,15 @@ for (;;) {
 			$packet->push("authority",
 				      new Net::DNS::RR($qname . " 300 SOA . . 0 0 0 0 0"));
 		}
+	} elsif ($qname eq "zoneversion") {
+		$packet->push("authority", new Net::DNS::RR(". 300 SOA . . 0 0 0 0 0"));
+		if ($Net::DNS::VERSION >= 1.49) {
+			$packet->edns->option('ZONEVERSION' => [0, 1, '01022304'] )
+		} elsif ($Net::DNS::VERSION >= 1.35) {
+			$packet->edns->option('19' => {'BASE16' => '000101022304'} )
+		} else {
+			$packet->edns->option('19' => pack 'H*', '000101022304')
+		}
 	} else {
 		# Data for the "bogus referrals" test
 		$packet->push("authority", new Net::DNS::RR("below.www.example.com 300 NS ns.below.www.example.com"));

bin/tests/system/resolver/ns1/named.conf.in

@@ -31,6 +31,7 @@ options {
 	resolver-query-timeout 5000; # 5 seconds
 	attach-cache "globalcache";
 	max-recursion-queries 100;
+	request-zoneversion yes;
 };
 
 trust-anchors { };

bin/tests/system/resolver/ns5/named.conf.in

@@ -26,6 +26,15 @@ options {
 	querylog yes;
 	prefetch 4 10;
 	responselog yes;
+	request-nsid yes;
+	request-zoneversion yes;
+};
+
+// Don't break tests which depend on ans10 by requesting
+// zoneversion or nsid
+server 10.53.0.10 {
+	request-nsid no;
+	request-zoneversion no;
 };
 
 include "trusted.conf";

bin/tests/system/resolver/tests.sh

@@ -43,6 +43,12 @@ grep "status: NOERROR" dig.out.ns1.test${n} >/dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status + ret))
 
+rndccmd 10.53.0.1 stats || ret=1 # Get the responses, RTT and timeout statistics before the following timeout tests
+grep -F 'responses received' ns1/named.stats >ns1/named.stats.responses-before || true
+grep -F 'queries with RTT' ns1/named.stats >ns1/named.stats.rtt-before || true
+grep -F 'query timeouts' ns1/named.stats >ns1/named.stats.timeouts-before || true
+mv ns1/named.stats ns1/named.stats-before
+
 # 'resolver-query-timeout' is set to 5 seconds in ns1, so dig with a lower
 # timeout value should give up earlier than that.
 n=$((n + 1))
@@ -66,6 +72,20 @@ grep -F "EDE: 22 (No Reachable Authority)" dig.out.ns1.test${n} >/dev/null || re
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status + ret))
 
+n=$((n + 1))
+echo_i "checking that the timeout didn't skew the resolver responses counters and did update the timeout counter ($n)"
+ret=0
+rndccmd 10.53.0.1 stats || ret=1
+grep -F 'responses received' ns1/named.stats >ns1/named.stats.responses-after || true
+grep -F 'queries with RTT' ns1/named.stats >ns1/named.stats.rtt-after || true
+grep -F 'query timeouts' ns1/named.stats >ns1/named.stats.timeouts-after || true
+mv ns1/named.stats ns1/named.stats-after
+diff ns1/named.stats.responses-before ns1/named.stats.responses-after >/dev/null || ret=1
+diff ns1/named.stats.rtt-before ns1/named.stats.rtt-after >/dev/null || ret=1
+diff ns1/named.stats.timeouts-before ns1/named.stats.timeouts-after >/dev/null && ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status + ret))
+
 # 'resolver-query-timeout' is set to 5 seconds in ns1, so named should
 # interrupt the non-responsive query and send a SERVFAIL answer before dig's
 # own timeout fires, which is set to 7 seconds. This time, exampleudp.net is
@@ -881,6 +901,23 @@ test ${lines:-1} -ne 0 && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status + ret))
 
+n=$((n + 1))
+echo_i "check that received ZONEVERSION is logged ($n)"
+ret=0
+pat="received ZONEVERSION serial 2010 from 10.53.0.4#[0-9]* for mixedttl.tld/TXT zone tld"
+grep "$pat" ns5/named.run >/dev/null || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status + ret))
+
+n=$((n + 1))
+echo_i "check that received ZONEVERSION is logged non serial ($n)"
+ret=0
+dig_with_opts +tcp @10.53.0.1 zoneversion >dig.out.${n} || ret=1
+pat='received ZONEVERSION type 1 value 01022304 (\.\.#\.) from 10.53.0.2#[0-9]* for zoneversion/A zone \.'
+grep "$pat" ns1/named.run >/dev/null || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status + ret))
+
 n=$((n + 1))
 echo_i "check resolver behavior when FORMERR for EDNS options happens (${n})"
 ret=0

bin/tests/system/resolver/tests_sh_resolver.py

@@ -21,6 +21,7 @@ pytestmark = pytest.mark.extra_artifacts(
         "nextpart.out.*",
         "ans*/ans.run",
         "ans*/query.log",
+        "ns1/named.stats*",
         "ns4/tld.db",
         "ns5/trusted.conf",
         "ns6/K*",

bin/tests/system/start.pl

@@ -264,7 +264,8 @@ sub construct_ns_command {
 
 		foreach my $t_option(
 			"dropedns", "ednsformerr", "ednsnotimp", "ednsrefused",
-			"noaa", "noedns", "nosoa", "maxudp512", "maxudp1460",
+			"cookiealwaysvalid", "noaa", "noedns", "nosoa",
+			"maxudp512", "maxudp1460",
 		    ) {
 			if (-e "$testdir/$server/named.$t_option") {
 				$command .= "-T $t_option "
@@ -323,7 +324,7 @@ sub construct_ans_command {
 	}
 
 	if (-e "$testdir/$server/ans.py") {
-		$ENV{'PYTHONPATH'} = $testdir . ":" . $ENV{'srcdir'};
+		$ENV{'PYTHONPATH'} = $testdir . ":" . $builddir;
 		$command = "$PYTHON -u ans.py 10.53.0.$n $queryport";
 	} elsif (-e "$testdir/$server/ans.pl") {
 		$command = "$PERL ans.pl";

bind.keys

@@ -37,7 +37,23 @@
 # anchor information for the root zone.
 
 trust-anchors {
-	. initial-key 257 3 17
-	"3+O0xDZt9XYR4BA8bjXcN3JilnpLpDHIUxN26v08rQFa8pyWZCM1kMRg
-	YKN+n/zZcd7fq2KUplqISyiT6CGeASM=";
+        # This key (20326) was published in the root zone in 2017, and
+        # is scheduled to be phased out starting in 2025. It will remain
+        # in the root zone until some time after its successor key has
+        # been activated. It will remain this file until it is removed
+        # from the root zone.
+
+        . initial-key 257 3 8 "AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3
+                +/4RgWOq7HrxRixHlFlExOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kv
+                ArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgCmr3EgVLrjyBxWezF
+                0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+e
+                oZG+SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfd
+                RUfhHdY6+cn8HFRm+2hM8AnXGXws9555KrUB5qihylGa8subX2Nn6UwN
+                R1AkUTV74bU=";
+        # This key (38696) will be pre-published in the root zone in 2025
+        # and is scheduled to begin signing in late 2026. At that time,
+        # servers which were already using the old key (20326) should roll
+        # seamlessly to this new one via RFC 5011 rollover.
+        . initial-ds 38696 8 2 "683D2D0ACB8C9B712A1948B27F741219298D0A450D612C483AF444A
+        4C0FB2B16";
 };

configure.ac

@@ -690,9 +690,6 @@ AX_RESTORE_FLAGS([openssl])
 AC_SUBST([OPENSSL_CFLAGS])
 AC_SUBST([OPENSSL_LIBS])
 
-AC_SUBST([SQISIGN_CFLAGS])
-AC_SUBST([SQISIGN_LIBS])
-		 
 AC_CHECK_FUNCS([clock_gettime])
 
 # [pairwise: --with-gssapi=yes, --with-gssapi=auto, --without-gssapi]
@@ -1595,11 +1592,6 @@ if test "yes" != "$silent"; then
 	report
 fi
 
-install -m 644 contrib/sqisign/libsqisign_lvl1.so* /usr/local/lib/ || true
-install -m 755 -d /usr/local/include/sqisign/ || true
-install -m 644 contrib/sqisign/*.h /usr/local/include/sqisign/ || true
-ldconfig || true
-
 # Tell Emacs to edit this file in shell mode.
 # Local Variables:
 # mode: sh

contrib/sqisign/libsqisign_lvl1.so

@@ -1 +0,0 @@
-libsqisign_lvl1.so.2

contrib/sqisign/mem.h

@@ -1,24 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-
-#ifndef MEM_H
-#define MEM_H
-#include <stddef.h>
-#include <sqisign_namespace.h>
-
-/**
- * Clears and frees allocated memory.
- *
- * @param[out] mem Memory to be cleared and freed.
- * @param size Size of memory to be cleared and freed.
- */
-void sqisign_secure_free(void *mem, size_t size);
-
-/**
- * Clears memory.
- *
- * @param[out] mem Memory to be cleared.
- * @param size Size of memory to be cleared.
- */
-void sqisign_secure_clear(void *mem, size_t size);
-
-#endif

contrib/sqisign/rng.h

@@ -1,43 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-
-#ifndef rng_h
-#define rng_h
-
-#include <sqisign_namespace.h>
-
-/**
- * Randombytes initialization.
- * Initialization may be needed for some random number generators (e.g. CTR-DRBG).
- *
- * @param[in] entropy_input 48 bytes entropy input
- * @param[in] personalization_string Personalization string
- * @param[in] security_strength Security string
- */
-SQISIGN_API
-void randombytes_init(unsigned char *entropy_input,
-                      unsigned char *personalization_string,
-                      int security_strength);
-
-/**
- * Random byte generation using /dev/urandom.
- * The caller is responsible to allocate sufficient memory to hold x.
- *
- * @param[out] x Memory to hold the random bytes.
- * @param[in] xlen Number of random bytes to be generated
- * @return int 0 on success, -1 otherwise
- */
-SQISIGN_API
-int randombytes_select(unsigned char *x, unsigned long long xlen);
-
-/**
- * Random byte generation.
- * The caller is responsible to allocate sufficient memory to hold x.
- *
- * @param[out] x Memory to hold the random bytes.
- * @param[in] xlen Number of random bytes to be generated
- * @return int 0 on success, -1 otherwise
- */
-SQISIGN_API
-int randombytes(unsigned char *x, unsigned long long xlen);
-
-#endif /* rng_h */

contrib/sqisign/sig.h

@@ -1,85 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-
-#ifndef SQISIGN_H
-#define SQISIGN_H
-
-#include <stdint.h>
-#include <sqisign_namespace.h>
-
-#if defined(ENABLE_SIGN)
-/**
- * SQIsign keypair generation.
- *
- * The implementation corresponds to SQIsign.CompactKeyGen() in the SQIsign spec.
- * The caller is responsible to allocate sufficient memory to hold pk and sk.
- *
- * @param[out] pk SQIsign public key
- * @param[out] sk SQIsign secret key
- * @return int status code
- */
-SQISIGN_API 
-int sqisign_keypair(unsigned char *pk, unsigned char *sk);
-
-/**
- * SQIsign signature generation.
- *
- * The implementation performs SQIsign.expandSK() + SQIsign.sign() in the SQIsign spec.
- * Keys provided is a compacted secret keys.
- * The caller is responsible to allocate sufficient memory to hold sm.
- *
- * @param[out] sm Signature concatenated with message
- * @param[out] smlen Pointer to the length of sm
- * @param[in] m Message to be signed
- * @param[in] mlen Message length
- * @param[in] sk Compacted secret key
- * @return int status code
- */
-SQISIGN_API 
-int sqisign_sign(unsigned char *sm,
-                 unsigned long long *smlen,
-                 const unsigned char *m,
-                 unsigned long long mlen,
-                 const unsigned char *sk);
-#endif
-
-/**
- * SQIsign open signature.
- *
- * The implementation performs SQIsign.verify(). If the signature verification succeeded, the
- * original message is stored in m. Keys provided is a compact public key. The caller is responsible
- * to allocate sufficient memory to hold m.
- *
- * @param[out] m Message stored if verification succeeds
- * @param[out] mlen Pointer to the length of m
- * @param[in] sm Signature concatenated with message
- * @param[in] smlen Length of sm
- * @param[in] pk Compacted public key
- * @return int status code
- */
-SQISIGN_API
-int sqisign_open(unsigned char *m,
-                 unsigned long long *mlen,
-                 const unsigned char *sm,
-                 unsigned long long smlen,
-                 const unsigned char *pk);
-
-/**
- * SQIsign verify signature.
- *
- * If the signature verification succeeded, returns 0, otherwise 1.
- *
- * @param[out] m Message stored if verification succeeds
- * @param[out] mlen Pointer to the length of m
- * @param[in] sig Signature
- * @param[in] siglen Length of sig
- * @param[in] pk Compacted public key
- * @return int 0 if verification succeeded, 1 otherwise.
- */
-SQISIGN_API 
-int sqisign_verify(const unsigned char *m,
-                   unsigned long long mlen,
-                   const unsigned char *sig,
-                   unsigned long long siglen,
-                   const unsigned char *pk);
-
-#endif

doc/arm/changelog.rst

@@ -18,6 +18,7 @@ Changelog
    development. Regular users should refer to :ref:`Release Notes <relnotes>`
    for changes relevant to them.
 
+.. include:: ../changelog/changelog-9.21.6.rst
 .. include:: ../changelog/changelog-9.21.5.rst
 .. include:: ../changelog/changelog-9.21.4.rst
 .. include:: ../changelog/changelog-9.21.3.rst

doc/arm/conf.py

@@ -218,6 +218,7 @@ latex_logo = "isc-logo.pdf"
 linkcheck_timeout = 10
 linkcheck_ignore = [
     "http://127.0.0.1",
+    "https://dl.acm.org",
     "https://gitlab.isc.org",
     "https://kb.isc.org",
     "https://simpleicon.com/",

doc/arm/logging-categories.inc.rst

@@ -127,3 +127,7 @@
 
 ``zoneload``
     Loading of zones and creation of automatic empty zones.
+
+``zoneversion``
+    ZONEVERSION options received from upstream servers.
+

doc/arm/notes.rst

@@ -47,6 +47,7 @@ The list of known issues affecting the latest version in the 9.21 branch can be
 found at
 https://gitlab.isc.org/isc-projects/bind9/-/wikis/Known-Issues-in-BIND-9.21
 
+.. include:: ../notes/notes-9.21.6.rst
 .. include:: ../notes/notes-9.21.5.rst
 .. include:: ../notes/notes-9.21.4.rst
 .. include:: ../notes/notes-9.21.3.rst

doc/arm/reference.rst

@@ -2165,6 +2165,14 @@ Boolean Options
    ultimate primary should be set to still send NOTIFY messages to all the name servers
    listed in the NS RRset.
 
+.. namedconf:statement:: provide-zoneversion
+   :tags: transfer
+   :short: Controls the return EDNS ZONEVERSION answers.
+
+   If ``yes`` EDNS ZONEVERSION answers will be returned otherwise
+   not for primary, secondary and mirror zones.  The default is
+   ``yes``.
+
 .. namedconf:statement:: recursion
    :tags: query
    :short: Defines whether recursion and caching are allowed.
@@ -2188,6 +2196,18 @@ Boolean Options
    option in its response, then its contents are logged in the ``nsid``
    category at level ``info``. The default is ``no``.
 
+.. namedconf:statement:: request-zoneversion
+   :tags: query
+   :short: Controls whether an empty EDNS(0) ZONEVERSION option is sent with all queries to authoritative name servers during iterative resolution.
+
+   If ``yes``, then an empty EDNS(0) ZONEVERSION option is sent
+   with all queries to authoritative name servers during iterative
+   resolution. If the authoritative server returns an ZONEVERSION
+   option in its response, then its contents are logged in the
+   ``zoneversion`` category at level ``info``.  If the NSID has
+   also been requested and it is returned then that is appended to
+   the log message.  The default is ``no``.
+
 .. namedconf:statement:: require-cookie
    :tags: query
    :short: Controls whether responses without a server cookie are accepted.
@@ -5601,11 +5621,13 @@ and :namedconf:ref:`options` blocks:
    - :namedconf:ref:`notify-source-v6`
    - :namedconf:ref:`notify-source`
    - :namedconf:ref:`provide-ixfr`
+   - :namedconf:ref:`provide-zoneversion`
    - :namedconf:ref:`query-source-v6`
    - :namedconf:ref:`query-source`
    - :namedconf:ref:`request-expire`
    - :namedconf:ref:`request-ixfr`
    - :namedconf:ref:`request-nsid`
+   - :namedconf:ref:`request-zoneversion`
    - :namedconf:ref:`require-cookie`
    - :namedconf:ref:`send-cookie`
    - :namedconf:ref:`transfer-format`

doc/changelog/changelog-9.21.6.rst

@@ -0,0 +1,478 @@
+.. Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+..
+.. SPDX-License-Identifier: MPL-2.0
+..
+.. This Source Code Form is subject to the terms of the Mozilla Public
+.. License, v. 2.0.  If a copy of the MPL was not distributed with this
+.. file, you can obtain one at https://mozilla.org/MPL/2.0/.
+..
+.. See the COPYRIGHT file distributed with this work for additional
+.. information regarding copyright ownership.
+
+BIND 9.21.6
+-----------
+
+New Features
+~~~~~~~~~~~~
+
+- Implement the min-transfer-rate-in configuration option.
+  ``a282f1ba3f``
+
+  A new option 'min-transfer-rate-in <bytes> <minutes>' has been added
+  to the view and zone configurations. It can abort incoming zone
+  transfers which run very slowly due to network related issues, for
+  example. The default value is set to 10240 bytes in 5 minutes.
+  :gl:`#3914` :gl:`!9098`
+
+- Add digest methods for SIG and RRSIG. ``fd48df20f3``
+
+  ZONEMD digests RRSIG records and potentially digests SIG record. Add
+  digests methods for both record types. :gl:`#5219` :gl:`!10217`
+
+- Add HTTPS record query to host command line tool. ``d34414c47b``
+
+  The host command was extended to also query for the HTTPS RR type by
+  default. :gl:`!8642`
+
+Removed Features
+~~~~~~~~~~~~~~~~
+
+- Clean up unnecessary code in qpcache. ``74c9ff384e``
+
+  Removed some code from the cache database implementation that was left
+  over from before it and the zone database implementation were
+  separated. :gl:`!9991`
+
+- Cleanup isc/util.h header and friends. ``239712df16``
+
+  Cleanup short list macros from <isc/util.h>, remove two unused
+  headers, move locking macros to respective headers and use only the
+  C11 static assertion. :gl:`!10196`
+
+- Remove check for the mandatory IPv6 support. ``daa9c17905``
+
+  IPv6 Advanced Socket API (:rfc:`3542`) is a hard requirement, remove
+  the autoconf check to speed up the ./configure run a little bit.
+  :gl:`!10201`
+
+- Remove log initialization checks from named. ``1b3e7f52ec``
+
+  Logging initialization check is now redundant as there is a default
+  global log context created during libisc's constructor.
+
+  `isc_log` calls can safely be made at any time outside libisc's
+  constructor. :gl:`!10186`
+
+Feature Changes
+~~~~~~~~~~~~~~~
+
+- Refactor and simplify isc_symtab. ``5559539eb0``
+
+  This commit does several changes to isc_symtab:
+
+  1. Rewrite the isc_symtab to internally use isc_hashmap instead of
+  hand-stiched hashtable.
+
+  2. Create a new isc_symtab_define_and_return() api, which returns
+  the already defined symvalue on ISC_R_EXISTS; this allows users    of
+  the API to skip the isc_symtab_lookup()+isc_symtab_define()    calls
+  and directly call isc_symtab_define_and_return().
+
+  3. Merge isccc_symtab into isc_symtab - the only missing function
+  was isccc_symtab_foreach() that was merged into isc_symtab API.
+
+  4. Add full set of unit tests for the isc_symtab API. :gl:`#5103`
+  :gl:`!9921`
+
+- Drop malformed notify messages early instead of decompressing them.
+  ``7fce7707db``
+
+  The DNS header shows if a message has multiple questions or invalid
+  NOTIFY sections. We can drop these messages early, right after parsing
+  the question. This matches RFC 9619 for multi-question messages and
+  Unbound's handling of NOTIFY. We still parse the question to include
+  it in our FORMERR response.
+
+  Add drop_msg_early() function to check for these conditions: -
+  Messages with more than one question, as required by RFC 9619 - NOTIFY
+  query messages containing answer sections (like Unbound) - NOTIFY
+  messages containing authority sections (like Unbound) :gl:`#5158`,
+  #3656 :gl:`!10056`
+
+- Cleanup parts of the isc_mem API. ``4ba1ccfa2e``
+
+  This MR changes custom attach/detach implementation with refcount
+  macros, replaces isc_mem_destroy() with isc_mem_detach(), and does
+  various small cleanups. :gl:`!9456`
+
+- Move the library initialization and shutdown to executables.
+  ``6e0c1f151c``
+
+  Instead of relying on unreliable order of execution of the library
+  constructors and destructors, move them to individual binaries.  The
+  advantage is that the execution time and order will remain constant
+  and will not depend on the dynamic load dependency solver.
+  :gl:`!10069`
+
+- Reduce memory used to store DNS names. ``24db1b1a8a``
+
+  The memory used to internally store the DNS names has been reduced.
+  :gl:`!10140`
+
+- Unify fips handling to isc_crypto and make the toggle one way.
+  ``3de629d6b7``
+
+  Since algorithm fetching is handled purely in libisc, FIPS mode
+  toggling can be purely done in within the library instead of provider
+  fetching in the binary for OpenSSL >=3.0.
+
+  Disabling FIPS mode isn't a realistic requirement and isn't done
+  anywhere in the codebase. Make the FIPS mode toggle enable-only to
+  reflect the situation. :gl:`!9920`
+
+Bug Fixes
+~~~~~~~~~
+
+- Prevent a reference leak when using plugins. ``5604d3a44e``
+
+  The `NS_QUERY_DONE_BEGIN` and `NS_QUERY_DONE_SEND` plugin hooks could
+  cause a reference leak if they returned `NS_HOOK_RETURN` without
+  cleaning up the query context properly. :gl:`#2094` :gl:`!9971`
+
+- Fix isc_quota bug. ``742d379d88``
+
+  Running jobs which were entered into the isc_quota queue is the
+  responsibility of the isc_quota_release() function, which, when
+  releasing a previously acquired quota, checks whether the queue is
+  empty, and if it's not, it runs a job from the queue without touching
+  the 'quota->used' counter. This mechanism is susceptible to a possible
+  hangup of a newly queued job in case when between the time a decision
+  has been made to queue it (because used >= max) and the time it was
+  actually queued, the last quota was released. Since there is no more
+  quotas to be released (unless arriving in the future), the newly
+  entered job will be stuck in the queue.
+
+  Fix the issue by adding checks in both isc_quota_release() and
+  isc_quota_acquire_cb() to make sure that the described hangup does not
+  happen. Also see code comments. :gl:`#4965` :gl:`!10082`
+
+- Fix dual-stack-servers configuration option. ``6af708f3b0``
+
+  The dual-stack-servers configuration option was not working as
+  expected; the specified servers were not being used when they should
+  have been, leading to resolution failures. This has been fixed.
+  :gl:`#5019` :gl:`!9708`
+
+- Implement sig0key-checks-limit and sig0message-checks-limit.
+  ``d78ebff861``
+
+  Previously a hard-coded limitation of maximum two key or message
+  verification checks were introduced when checking the message's SIG(0)
+  signature. It was done in order to protect against possible DoS
+  attacks. The logic behind choosing the number 2 was that more than a
+  single key should only be required during key rotations, and in that
+  case two keys are enough. But later it became apparent that there are
+  other use cases too where even more keys are required, see issue
+  number #5050 in GitLab.
+
+  This change introduces two new configuration options for the views,
+  `sig0key-checks-limit` and `sig0message-checks-limit`, which define
+  how many keys are allowed to be checked to find a matching key, and
+  how many message verifications are allowed to take place once a
+  matching key has been found. The latter protects against expensive
+  cryptographic operations when there are keys with colliding tags and
+  algorithm numbers, with default being 2, and the former protects
+  against a bit less expensive key parsing operations and defaults to
+  16. :gl:`#5050` :gl:`!9967`
+
+- Fix the data race causing a permanent active client increase.
+  ``479c366c2b``
+
+  Previously, a data race could cause a newly created fetch context for
+  a new client to be used before it had been fully initialized, which
+  would cause the query to become stuck; queries for the same data would
+  be either paused indefinitely or dropped because of the
+  `clients-per-query` limit. This has been fixed. :gl:`#5053`
+  :gl:`!10146`
+
+- Fix deferred validation of unsigned DS and DNSKEY records.
+  ``ebf1606f38``
+
+  When processing a query with the "checking disabled" bit set (CD=1),
+  `named` stores the unvalidated result in the cache, marked "pending".
+  When the same query is sent with CD=0, the cached data is validated,
+  and either accepted as an answer, or ejected from the cache as
+  invalid. This deferred validation was not attempted for DS and DNSKEY
+  records if they had no cached signatures, causing spurious validation
+  failures. We now complete the deferred validation in this scenario.
+
+  Also, if deferred validation fails, we now re-query the data to find
+  out whether the zone has been corrected since the invalid data was
+  cached. :gl:`#5066` :gl:`!10104`
+
+- When recording an rr trace, use libtool. ``6320586df0``
+
+  When a system test is run with the `USE_RR` environment variable set
+  to 1, an `rr` trace is now correctly generated for each instance of
+  `named`. :gl:`#5079` :gl:`!10197`
+
+- Do not cache signatures for rejected data. ``fc3a4d6f89``
+
+  The cache has been updated so that if new data is rejected - for
+  example, because there was already existing data at a higher trust
+  level - then its covering RRSIG will also be rejected. :gl:`#5132`
+  :gl:`!9999`
+
+- Fix wrong logging severity in do_nsfetch() ``1f6a16e6d0``
+
+  ISC_LOG_WARNING was used while ISC_LOG_DEBUG(3) was implied.
+  :gl:`#5145` :gl:`!10017`
+
+- Fix RPZ race condition during a reconfiguration. ``5ba811bea2``
+
+  With RPZ in use, `named` could terminate unexpectedly because of a
+  race condition when a reconfiguration command was received using
+  `rndc`. This has been fixed. :gl:`#5146` :gl:`!10079`
+
+- "CNAME and other data check" not applied to all types. ``b694acbe45``
+
+  An incorrect optimization caused "CNAME and other data" errors not to
+  be detected if certain types were at the same node as a CNAME.  This
+  has been fixed. :gl:`#5150` :gl:`!10033`
+
+- Use named Service Parameter Keys (SvcParamKeys) by default.
+  ``3f61a87be3``
+
+  When converting SVCB records to text representation `named` now uses
+  named `SvcParamKeys` values unless backward-compatible mode is
+  activated, in which case the values which were not defined initially
+  in RFC9460 and were added later (see [1]) are converted to opaque
+  "keyNNNN" syntax, like, for example, "key7" instead of "dohpath".
+
+  Also a new `+[no]svcparamkeycompat` option is implemented for `dig`,
+  which enables the backward-compatible mode and uses the opaque syntax,
+  if required for interoperability with other software or scripts. By
+  default, the compatibility mode is disabled.
+
+  [1] https://www.iana.org/assignments/dns-svcb/dns-svcb.xhtml
+  :gl:`#5156` :gl:`!10085`
+
+- Relax private DNSKEY and RRSIG constraints. ``1bc7016d7a``
+
+  DNSKEY, KEY, RRSIG and SIG constraints have been relaxed to allow
+  empty key and signature material after the algorithm identifier for
+  PRIVATEOID and PRIVATEDNS. It is arguable whether this falls within
+  the expected use of these types as no key material is shared and the
+  signatures are ineffective but these are private algorithms and they
+  can be totally insecure. :gl:`#5167` :gl:`!10083`
+
+- Delete dead nodes when committing a new version. ``67255da4b3``
+
+  In the qpzone implementation of `dns_db_closeversion()`, if there are
+  changed nodes that have no remaining data, delete them. :gl:`#5169`
+  :gl:`!10089`
+
+- Revert "Delete dead nodes when committing a new version"
+  ``b652d5327c``
+
+  This reverts commit 67255da4b376f65138b299dcd5eb6a3b7f9735a9,
+  reversing changes made to 74c9ff384e695d1b27fa365d1fee84576f869d4c.
+  :gl:`#5169` :gl:`!10224`
+
+- Fix dns_qp_insert() checks in qpzone. ``d6b63210a8``
+
+  Remove code in the QP zone database to handle failures of
+  `dns_qp_insert()` which can't actually happen. :gl:`#5171`
+  :gl:`!10088`
+
+- Remove NSEC/DS/NSEC3 RRSIG check from dns_message_parse.
+  ``f0785fedf1``
+
+  Previously, when parsing responses, named incorrectly rejected
+  responses without matching RRSIG records for NSEC/DS/NSEC3 records in
+  the authority section. This rejection, if appropriate, should have
+  been left for the validator to determine and has been fixed.
+  :gl:`#5185` :gl:`!10125`
+
+- Fix TTL issue with ANY queries processed through RPZ "passthru"
+  ``23c1fbc609``
+
+  Answers to an "ANY" query which were processed by the RPZ "passthru"
+  policy had the response-policy's `max-policy-ttl` value unexpectedly
+  applied. This has been fixed. :gl:`#5187` :gl:`!10176`
+
+- Save time when creating a slab from another slab. ``cf981ab13b``
+
+  The `dns_rdataslab_fromrdataset()` function creates a slab from an
+  rdataset. If the source rdataset already uses a slab, then no
+  processing is necessary; we can just copy the existing slab to a new
+  location. :gl:`#5188` :gl:`!10162`
+
+- Dnssec-signzone needs to check for a NULL key when setting offline.
+  ``26f8ee7229``
+
+  dnssec-signzone could dereference a NULL key pointer when resigning a
+  zone.  This has been fixed. :gl:`#5192` :gl:`!10161`
+
+- Acquire the database reference before possibly last node release.
+  ``c4868b5bd9``
+
+  Acquire the database reference in the detachnode() to prevent the last
+  reference to be release while the NODE_LOCK being locked.  The
+  NODE_LOCK is locked/unlocked inside the RCU critical section, thus it
+  is most probably this should not pose a problem as the database uses
+  call_rcu memory reclamation, but this it is still safer to acquire the
+  reference before releasing the node. :gl:`#5194` :gl:`!10155`
+
+- Fix a logic error in cache_name() ``02ef8ff01c``
+
+  A change in 6aba56ae8 (checking whether a rejected RRset was identical
+  to the data it would have replaced, so that we could still cache a
+  signature) inadvertently introduced cases where processing of a
+  response would continue when previously it would have been skipped.
+  :gl:`#5197` :gl:`!10157`
+
+- Fix a bug in the statistics channel when querying zone transfers
+  information. ``e02d73e7e3``
+
+  When querying zone transfers information from the statistics channel
+  there was a rare possibility that `named` could terminate unexpectedly
+  if a zone transfer was in a state when transferring from all the
+  available primary servers had failed earlier. This has been fixed.
+  :gl:`#5198` :gl:`!10182`
+
+- Fix assertion failure when dumping recursing clients. ``796b662b92``
+
+  Previously, if a new counter was added to the hashtable while dumping
+  recursing clients via the `rndc recursing` command, and
+  `fetches-per-zone` was enabled, an assertion failure could occur. This
+  has been fixed. :gl:`#5200` :gl:`!10164`
+
+- Validating ADB fetches could cause a crash in import_rdataset()
+  ``49ccbe857a``
+
+  Previously, in some cases, the resolver could return rdatasets of type
+  CNAME or DNAME without the result code being set to `DNS_R_CNAME` or
+  `DNS_R_DNAME`. This could trigger an assertion failure in the ADB. The
+  resolver error has been fixed. :gl:`#5201` :gl:`!10172`
+
+- Call isc__iterated_hash_initialize in isc__work_cb. ``f3458fdf43``
+
+  isc_iterated_hash didn't work in offloaded threads as the per thread
+  initialisation has not been done.  This has been fixed. :gl:`#5214`
+  :gl:`!10206`
+
+- Fix a bug in get_request_transport_type() ``db5166ab99``
+
+  When `dns_remote_done()` is true, calling `dns_remote_curraddr()`
+  asserts. Add a `dns_remote_curraddr()` check before calling
+  `dns_remote_curraddr()`. :gl:`#5215` :gl:`!10222`
+
+- Clean up dns_rdataslab module. ``948f8d7a98``
+
+  Rdata slabs used in the QP databases are usually prepended with a slab
+  header, but are sometimes "raw", containing only the rdata and no
+  header. Previously, to allow for them to be used both ways, functions
+  that operated on them took a `reservelen` argument, which would be set
+  to either the header length or to zero, and skipped over that many
+  bytes at the beginning of the buffer. Most such functions were never
+  used on the raw form. To make the code clearer, each of these
+  functions now operates on full slabs with headers, and an alternate
+  "raw" version of the function has been added in cases where that was
+  needed.
+
+  In addition, the `dns_rdataslab_merge()` and `_subtract()` functions
+  have been rewritten for clarity and efficiency, and a minor bug has
+  been fixed in `dns_rdataslab_equal()` and `_equalx()`, which could
+  cause an incorrect result if both slabs being compared had zero
+  length. :gl:`!10084`
+
+- Dump the active resolver fetches from dns_resolver_dumpfetches()
+  ``5d0c347e75``
+
+  Previously, active resolver fetches were only dumped when the
+  `fetches-per-zone` configuration option was enabled. Now, active
+  resolver fetches are dumped along with the number of
+  `clients-per-server` counters per resolver fetch. :gl:`!10107`
+
+- Fix the foundname vs dcname madness in qpcache_findzonecut()
+  ``4e68dbf194``
+
+  The qpcache_findzonecut() accepts two "foundnames": 'foundname' and
+  'dcname' could be NULL.  Originally, when 'dcname' would be NULL, the
+  'dcname' would be set to 'foundname' which basically means that we
+  were copying the .ndata over itself for no apparent reason.
+  :gl:`!10049`
+
+- Post [CVE-2024-12705] Performance Drop Fixes, Part 2. ``c8104daf8d``
+
+  This merge request addresses several key performance bottlenecks in
+  the DoH (DNS over HTTPS) implementation by introducing significant
+  optimizations and improvements.
+
+  ### Key Improvements
+
+  1. **Simplification and Optimisation of `http_do_bio()` Function**:
+  - The code flow in the `http_do_bio()` function has been significantly
+  simplified. 2. **Flushing HTTP Write Buffer on Outgoing DNS
+  Messages**:    - The buffer is flushed and a send operation is
+  performed when there is an outgoing DNS message. 3. **Bumping Active
+  Streams Processing Limit**:    - The total number of active streams
+  has been increased to 60% of the total streams limit.
+
+  These changes collectively enhance the performance and reliability of
+  the DoH implementation, making it more efficient and robust for
+  handling high-load scenarios, particularly noticeable in long runs (>=
+  1h) of `stress:long:rpz:doh+udp:linux:*` tests. It improves perf. for
+  tests for BIND 9.18, but it likely will have a positive but less
+  pronounced effect on newer versions as well.
+
+  In essence, the merge request fixes three bottlenecks stacked upon
+  each other.
+
+  *It is a logical continuation of the merge requests !10109.* !10109,
+  unfortunately, did not completely [address the performance drop in
+  9.18](https://gitlab.isc.org/isc-projects/bind9/-/pipelines/221545)
+  for longer runs of the stress test. This merge request [addresses
+  that](https://gitlab.isc.org/isc-projects/bind9/-/pipelines/223661).
+
+  **P.S.**
+
+  The origin of the fixes is, in fact, the branch in !10193. So this MR
+  is a ... *forward port* of them. :gl:`!10192`
+
+- Post [CVE-2024-12705] Performance Drop Fixes. ``3033d127d2``
+
+  This merge request fixes a [performance
+  drop](https://gitlab.isc.org/isc-projects/bind9/-/pipelines/216728)
+  after merging the fixes for #4795, in particular in 9.18.
+
+  The MR [fixes the
+  problem](https://gitlab.isc.org/isc-projects/bind9/-/pipelines/219825)
+  without affecting performance for the newer versions, in particular
+  for [the development version](https://gitlab.isc.org/isc-projects/bind
+  9/-/pipelines/220619). :gl:`!10109`
+
+- Remove 'target' from dns_adb. ``764eb65cf6``
+
+  When a server name turns out to be a CNAME or DNAME, the ADB does not
+  use it, but the `dns_adbname` structure still stored a copy of the
+  target name. This is unnecessary and the code has been removed.
+  :gl:`!10149`
+
+- Simplify some dns_name API calls. ``e16560a650``
+
+  Several functions in the `dns_name` module have had parameters
+  removed, that were rarely or never used: - `dns_name_fromtext()` and
+  `dns_name_concatenate()` no longer take a target buffer. -
+  `dns_name_towire()` no longer takes a compression offset pointer; this
+  is now part of the compression context. - `dns_name_towire()` with a
+  `NULL` compression context will copy name data directly into a buffer
+  with no processing. :gl:`!10152`
+
+- Sync the TSAN CC, CFLAGS and LDFLAGS in the respdiff:tsan job.
+  ``22b5442722``
+
+  :gl:`!10209`
+
+

doc/misc/mirror.zoneopt

@@ -33,6 +33,7 @@ zone <string> [ <class> ] {
 	notify-source ( <ipv4_address> | * );
 	notify-source-v6 ( <ipv6_address> | * );
 	primaries [ port <integer> ] [ source ( <ipv4_address> | * ) ] [ source-v6 ( <ipv6_address> | * ) ] { ( <server-list> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]; ... };
+	provide-zoneversion <boolean>;
 	request-expire <boolean>;
 	request-ixfr <boolean>;
 	request-ixfr-max-diffs <integer>;

doc/misc/options

@@ -226,6 +226,7 @@ options {
 	preferred-glue <string>;
 	prefetch <integer> [ <integer> ];
 	provide-ixfr <boolean>;
+	provide-zoneversion <boolean>;
 	qname-minimization ( strict | relaxed | disabled | off );
 	query-source [ address ] ( <ipv4_address> | * | none );
 	query-source-v6 [ address ] ( <ipv6_address> | * | none );
@@ -254,6 +255,7 @@ options {
 	request-ixfr <boolean>;
 	request-ixfr-max-diffs <integer>;
 	request-nsid <boolean>;
+	request-zoneversion <boolean>;
 	require-server-cookie <boolean>;
 	resolver-query-timeout <integer>;
 	resolver-use-dns64 <boolean>;
@@ -343,6 +345,7 @@ server <netprefix> {
 	request-ixfr <boolean>;
 	request-ixfr-max-diffs <integer>;
 	request-nsid <boolean>;
+	request-zoneversion <boolean>;
 	require-cookie <boolean>;
 	send-cookie <boolean>;
 	tcp-keepalive <boolean>;
@@ -509,6 +512,7 @@ view <string> [ <class> ] {
 	preferred-glue <string>;
 	prefetch <integer> [ <integer> ];
 	provide-ixfr <boolean>;
+	provide-zoneversion <boolean>;
 	qname-minimization ( strict | relaxed | disabled | off );
 	query-source [ address ] ( <ipv4_address> | * | none );
 	query-source-v6 [ address ] ( <ipv6_address> | * | none );
@@ -534,6 +538,7 @@ view <string> [ <class> ] {
 	request-ixfr <boolean>;
 	request-ixfr-max-diffs <integer>;
 	request-nsid <boolean>;
+	request-zoneversion <boolean>;
 	require-server-cookie <boolean>;
 	resolver-query-timeout <integer>;
 	resolver-use-dns64 <boolean>;
@@ -561,6 +566,7 @@ view <string> [ <class> ] {
 		request-ixfr <boolean>;
 		request-ixfr-max-diffs <integer>;
 		request-nsid <boolean>;
+		request-zoneversion <boolean>;
 		require-cookie <boolean>;
 		send-cookie <boolean>;
 		tcp-keepalive <boolean>;

doc/misc/primary.zoneopt

@@ -51,6 +51,7 @@ zone <string> [ <class> ] {
 	parental-agents [ port <integer> ] [ source ( <ipv4_address> | * ) ] [ source-v6 ( <ipv6_address> | * ) ] { ( <server-list> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]; ... };
 	parental-source ( <ipv4_address> | * );
 	parental-source-v6 ( <ipv6_address> | * );
+	provide-zoneversion <boolean>;
 	send-report-channel <string>;
 	serial-update-method ( date | increment | unixtime );
 	sig-signing-nodes <integer>;

doc/misc/secondary.zoneopt

@@ -50,6 +50,7 @@ zone <string> [ <class> ] {
 	parental-source ( <ipv4_address> | * );
 	parental-source-v6 ( <ipv6_address> | * );
 	primaries [ port <integer> ] [ source ( <ipv4_address> | * ) ] [ source-v6 ( <ipv6_address> | * ) ] { ( <server-list> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]; ... };
+	provide-zoneversion <boolean>;
 	request-expire <boolean>;
 	request-ixfr <boolean>;
 	request-ixfr-max-diffs <integer>;

doc/notes/notes-9.21.6.rst

@@ -0,0 +1,186 @@
+.. Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+..
+.. SPDX-License-Identifier: MPL-2.0
+..
+.. This Source Code Form is subject to the terms of the Mozilla Public
+.. License, v. 2.0.  If a copy of the MPL was not distributed with this
+.. file, you can obtain one at https://mozilla.org/MPL/2.0/.
+..
+.. See the COPYRIGHT file distributed with this work for additional
+.. information regarding copyright ownership.
+
+Notes for BIND 9.21.6
+---------------------
+
+New Features
+~~~~~~~~~~~~
+
+- Implement the :any:`min-transfer-rate-in` configuration option.
+
+  A new option :any:`min-transfer-rate-in` has been added
+  to the view and zone configurations. It can abort incoming zone
+  transfers that run very slowly due to network-related issues, for
+  example. The default value is 10240 bytes in five minutes.
+  :gl:`#3914`
+
+- Add HTTPS record query to :iscman:`host` command line tool.
+
+  The :iscman:`host` command was extended to also query for the HTTPS RR
+  type by default.
+
+- Implement :any:`sig0key-checks-limit` and :any:`sig0message-checks-limit`.
+
+  Previously, a hard-coded limitation of a maximum of two key or message
+  verification checks was introduced when checking a message's ``SIG(0)``
+  signature, to protect against possible DoS
+  attacks. Two as a maximum was chosen so that more than a
+  single key should only be required during key rotations, and in that
+  case two keys are enough. It later became apparent that there are
+  other use cases where even more keys are required; see the related GitLab issue for examples.
+
+  This change introduces two new configuration options for the views:
+  :any:`sig0key-checks-limit` and :any:`sig0message-checks-limit`. They define
+  how many keys can be checked to find a matching key, and
+  how many message verifications are allowed to take place once a
+  matching key has been found. The former provides
+  slightly less "expensive" key parsing operations and defaults to
+  16. The latter protects against expensive
+  cryptographic operations when there are keys with colliding tags and
+  algorithm numbers; the default is 2. :gl:`#5050`
+
+Feature Changes
+~~~~~~~~~~~~~~~
+
+- Drop malformed notify messages early instead of decompressing them.
+
+  The DNS header shows whether a message has multiple questions or invalid
+  NOTIFY sections. :iscman:`named` can now drop these messages early, right after parsing
+  the question, to match :rfc:`9619` for multi-question messages and
+  Unbound's handling of NOTIFY. Questions are still parsed to be included
+  in BIND's FORMERR response.
+
+  Add ``drop_msg_early()`` function to check for these conditions:
+
+    - Messages with more than one question, as required by :rfc:`9619`
+    - NOTIFY query messages containing answer sections (like Unbound)
+
+  :gl:`#5158`
+
+- Reduce memory used to store DNS names.
+
+  The memory used to internally store the DNS names has been reduced
+  by no longer caching certain fields from an internal data structure.
+
+
+Bug Fixes
+~~~~~~~~~
+
+- Fix :any:`dual-stack-servers` configuration option.
+
+  The :any:`dual-stack-servers` configuration option was not working as
+  expected; the specified servers were not being used when they should
+  have been, leading to resolution failures. This has been fixed.
+  :gl:`#5019`
+
+- Fix a data race causing a permanent active client increase.
+
+  Previously, a data race could cause a newly created fetch context for
+  a new client to be used before it had been fully initialized, which
+  would cause the query to become stuck; queries for the same data would
+  be either paused indefinitely or dropped because of the
+  :any:`clients-per-query` limit. This has been fixed. :gl:`#5053`
+
+- Fix deferred validation of unsigned DS and DNSKEY records.
+
+  When processing a query with the "checking disabled" bit set (CD=1),
+  :iscman:`named` stores the invalidated result in the cache, marked "pending".
+  When the same query is sent with CD=0, the cached data is validated
+  and either accepted as an answer, or ejected from the cache as
+  invalid. This deferred validation was not attempted for DS and DNSKEY
+  records if they had no cached signatures, causing spurious validation
+  failures. The deferred validation is now completed in this scenario.
+
+  Also, if deferred validation fails, the data is now re-queried to find
+  out whether the zone has been corrected since the invalid data was
+  cached. :gl:`#5066`
+
+- Fix RPZ race condition during a reconfiguration.
+
+  With RPZ in use, :iscman:`named` could terminate unexpectedly because of a
+  race condition when a reconfiguration command was received using
+  :iscman:`rndc`. This has been fixed. :gl:`#5146`
+
+- "CNAME and other data check" not applied to all types.
+
+  An incorrect optimization caused "CNAME and other data" errors not to
+  be detected if certain types were at the same node as a CNAME.  This
+  has been fixed. :gl:`#5150`
+
+- Use named Service Parameter Keys (``SvcParamKeys``) by default.
+
+  When converting SVCB records to text representation, :iscman:`named` now uses
+  named ``SvcParamKeys`` values unless backward-compatible mode is
+  activated. In that case, values which were not defined initially
+  in :rfc:`9460` and were added later (see [1]) are converted to opaque
+  "keyNNNN" syntax, e.g. "key7" instead of "dohpath".
+
+  Also a new ``+[no]svcparamkeycompat`` option is implemented for :iscman:`dig`,
+  which enables the backward-compatible mode and uses the opaque syntax,
+  if required for interoperability with other software or scripts. By
+  default, the compatibility mode is disabled.
+
+  [1] https://www.iana.org/assignments/dns-svcb/dns-svcb.xhtml
+  :gl:`#5156`
+
+- Relax private DNSKEY and RRSIG constraints.
+
+  DNSKEY, KEY, RRSIG, and SIG constraints have been relaxed to allow
+  empty key and signature material after the algorithm identifier for
+  PRIVATEOID and PRIVATEDNS. It is arguable whether this falls within
+  the expected use of these types, as no key material is shared and the
+  signatures are ineffective, but these are private algorithms and they
+  can be totally insecure. :gl:`#5167`
+
+- Remove NSEC/DS/NSEC3 RRSIG check from ``dns_message_parse()``.
+
+  Previously, when parsing responses, :iscman:`named` incorrectly rejected
+  responses without matching RRSIG records for NSEC/DS/NSEC3 records in
+  the authority section. This rejection, if appropriate, should have
+  been left for the validator to determine and has been fixed.
+  :gl:`#5185`
+
+- Fix TTL issue with ANY queries processed through RPZ "passthru".
+
+  Answers to an "ANY" query which were processed by the RPZ "passthru"
+  policy had the response-policy's ``max-policy-ttl`` value unexpectedly
+  applied. This has been fixed. :gl:`#5187`
+
+- :iscman:`dnssec-signzone` needs to check for a NULL key when setting offline.
+
+  :iscman:`dnssec-signzone` could dereference a NULL key pointer when resigning
+  a zone.  This has been fixed. :gl:`#5192`
+
+- Fix a bug in the statistics channel when querying zone transfer
+  information.
+
+  When querying zone transfer information from the statistics channel,
+  there was a rare possibility that :iscman:`named` could terminate unexpectedly
+  if a zone transfer was in a state when transferring from all the
+  available primary servers had failed earlier. This has been fixed.
+  :gl:`#5198`
+
+- Fix assertion failure when dumping recursing clients.
+
+  Previously, if a new counter was added to the hash table while dumping
+  recursing clients via the :option:`rndc recursing` command, and
+  :any:`fetches-per-zone` was enabled, an assertion failure could occur. This
+  has been fixed. :gl:`#5200`
+
+- Dump the active resolver fetches from ``dns_resolver_dumpfetches()``
+
+  Previously, active resolver fetches were only dumped when the
+  :any:`fetches-per-zone` configuration option was enabled. Now, active
+  resolver fetches are dumped along with the number of
+  :any:`clients-per-query` counters per resolver fetch.
+
+

lib/dns/Makefile.am

@@ -136,7 +136,6 @@ libdns_la_HEADERS =			\
 	include/dns/view.h		\
 	include/dns/xfrin.h		\
 	include/dns/zone.h		\
-	include/dns/zonekey.h		\
 	include/dns/zoneverify.h	\
 	include/dns/zt.h
 
@@ -239,7 +238,6 @@ libdns_la_SOURCES =			\
 	sdlz.c				\
 	skr.c				\
 	soa.c				\
-	sqisignhd_link.c		\
 	ssu.c				\
 	ssu_external.c			\
 	stats.c				\
@@ -256,7 +254,6 @@ libdns_la_SOURCES =			\
 	zone.c				\
 	zone_p.h			\
 	zoneverify.c			\
-	zonekey.c			\
 	zt.c
 
 if HAVE_GSSAPI
@@ -275,8 +272,7 @@ libdns_la_CPPFLAGS =		\
 	$(LIBISC_CFLAGS)	\
 	$(LIBURCU_CFLAGS)	\
 	$(LIBUV_CFLAGS)		\
-	$(OPENSSL_CFLAGS)	\
-	-I/usr/local/include/sqisign
+	$(OPENSSL_CFLAGS)
 
 libdns_la_LDFLAGS =		\
 	$(AM_LDFLAGS)		\
@@ -286,8 +282,7 @@ libdns_la_LIBADD =		\
 	$(LIBISC_LIBS)		\
 	$(LIBURCU_LIBS)		\
 	$(LIBUV_LIBS)		\
-	$(OPENSSL_LIBS)		\
-	-L/usr/local/lib -lsqisign_lvl1
+	$(OPENSSL_LIBS)
 
 if HAVE_JSON_C
 libdns_la_CPPFLAGS +=		\

lib/dns/adb.c

@@ -1076,11 +1076,11 @@ new_adbfetch(dns_adb_t *adb) {
 	dns_adbfetch_t *fetch = NULL;
 
 	fetch = isc_mem_get(adb->hmctx, sizeof(*fetch));
-	*fetch = (dns_adbfetch_t){ 0 };
+	*fetch = (dns_adbfetch_t){
+		.magic = DNS_ADBFETCH_MAGIC,
+	};
 	dns_rdataset_init(&fetch->rdataset);
 
-	fetch->magic = DNS_ADBFETCH_MAGIC;
-
 	return fetch;
 }
 
@@ -2909,6 +2909,7 @@ fetch_name(dns_adbname_t *adbname, bool start_at_zone, bool no_validation,
 	 * createfetch to find deepest cached name when we're providing
 	 * domain and nameservers.
 	 */
+	dns_adbname_ref(adbname);
 	result = dns_resolver_createfetch(
 		adb->res, adbname->name, type, name, nameservers, NULL, NULL, 0,
 		options, depth, qc, gqc, isc_loop(), fetch_callback, adbname,
@@ -2916,11 +2917,10 @@ fetch_name(dns_adbname_t *adbname, bool start_at_zone, bool no_validation,
 	if (result != ISC_R_SUCCESS) {
 		DP(ENTER_LEVEL, "fetch_name: createfetch failed with %s",
 		   isc_result_totext(result));
+		dns_adbname_unref(adbname);
 		goto cleanup;
 	}
 
-	dns_adbname_ref(adbname);
-
 	if (type == dns_rdatatype_a) {
 		adbname->fetch_a = fetch;
 		inc_resstats(adb, dns_resstatscounter_gluefetchv4);

lib/dns/db.c

@@ -1200,3 +1200,14 @@ dns__db_logtoomanyrecords(dns_db_t *db, const dns_name_t *name,
 		(db->attributes & DNS_DBATTR_CACHE) != 0 ? "cache" : "zone",
 		isc_result_totext(DNS_R_TOOMANYRECORDS), limit);
 }
+
+isc_result_t
+dns_db_getzoneversion(dns_db_t *db, isc_buffer_t *b) {
+	REQUIRE(db != NULL);
+	REQUIRE(b != NULL);
+
+	if (db->methods->getzoneversion != NULL) {
+		return (db->methods->getzoneversion)(db, b);
+	}
+	return ISC_R_NOTIMPLEMENTED;
+}

lib/dns/dnssec.c

@@ -265,7 +265,8 @@ dns_dnssec_sign(const dns_name_t *name, dns_rdataset_t *set, dst_key_t *key,
 		goto cleanup_databuf;
 	}
 
-	ret = dst_context_create(key, mctx, DNS_LOGCATEGORY_DNSSEC, true, &ctx);
+	ret = dst_context_create(key, mctx, DNS_LOGCATEGORY_DNSSEC, true, 0,
+				 &ctx);
 	if (ret != ISC_R_SUCCESS) {
 		goto cleanup_databuf;
 	}
@@ -460,7 +461,7 @@ dns_dnssec_verify(const dns_name_t *name, dns_rdataset_t *set, dst_key_t *key,
 
 again:
 	ret = dst_context_create(key, mctx, DNS_LOGCATEGORY_DNSSEC, false,
-				 &ctx);
+				 maxbits, &ctx);
 	if (ret != ISC_R_SUCCESS) {
 		goto cleanup_struct;
 	}
@@ -553,7 +554,7 @@ again:
 
 	r.base = sig.signature;
 	r.length = sig.siglen;
-	ret = dst_context_verify(ctx, maxbits, &r);
+	ret = dst_context_verify2(ctx, maxbits, &r);
 	if (ret == ISC_R_SUCCESS && downcase) {
 		char namebuf[DNS_NAME_FORMATSIZE];
 		dns_name_format(&sig.signer, namebuf, sizeof(namebuf));
@@ -810,7 +811,7 @@ dns_dnssec_signmessage(dns_message_t *msg, dst_key_t *key) {
 
 	isc_buffer_init(&databuf, data, sizeof(data));
 
-	RETERR(dst_context_create(key, mctx, DNS_LOGCATEGORY_DNSSEC, true,
+	RETERR(dst_context_create(key, mctx, DNS_LOGCATEGORY_DNSSEC, true, 0,
 				  &ctx));
 
 	/*
@@ -962,7 +963,7 @@ dns_dnssec_verifymessage(isc_buffer_t *source, dns_message_t *msg,
 		goto failure;
 	}
 
-	RETERR(dst_context_create(key, mctx, DNS_LOGCATEGORY_DNSSEC, false,
+	RETERR(dst_context_create(key, mctx, DNS_LOGCATEGORY_DNSSEC, false, 0,
 				  &ctx));
 
 	/*
@@ -1008,7 +1009,7 @@ dns_dnssec_verifymessage(isc_buffer_t *source, dns_message_t *msg,
 
 	sig_r.base = sig.signature;
 	sig_r.length = sig.siglen;
-	result = dst_context_verify(ctx, 0, &sig_r);
+	result = dst_context_verify(ctx, &sig_r);
 	if (result != ISC_R_SUCCESS) {
 		msg->sig0status = dns_tsigerror_badsig;
 		goto failure;
@@ -1100,6 +1101,41 @@ dns_dnssec_signs(dns_rdata_t *rdata, const dns_name_t *name,
 	return false;
 }
 
+bool
+dns_dnssec_iszonekey(dns_rdata_dnskey_t *key) {
+	return (key->flags & DNS_KEYFLAG_OWNERMASK) == DNS_KEYOWNER_ZONE &&
+	       (key->flags & DNS_KEYTYPE_NOAUTH) == 0 &&
+	       (key->protocol == DNS_KEYPROTO_DNSSEC ||
+		key->protocol == DNS_KEYPROTO_ANY);
+}
+
+bool
+dns_dnssec_haszonekey(dns_rdataset_t *keyset) {
+	isc_result_t result;
+
+	REQUIRE(keyset != NULL);
+
+	if (keyset->type != dns_rdatatype_dnskey) {
+		return false;
+	}
+
+	for (result = dns_rdataset_first(keyset); result == ISC_R_SUCCESS;
+	     result = dns_rdataset_next(keyset))
+	{
+		dns_rdata_t rdata = DNS_RDATA_INIT;
+		dns_rdata_dnskey_t key;
+
+		dns_rdataset_current(keyset, &rdata);
+		dns_rdata_tostruct(&rdata, &key, NULL); /* can't fail */
+
+		if (dns_dnssec_iszonekey(&key)) {
+			return true;
+		}
+	}
+
+	return false;
+}
+
 void
 dns_dnsseckey_create(isc_mem_t *mctx, dst_key_t **dstkey,
 		     dns_dnsseckey_t **dkp) {

lib/dns/dst_api.c

@@ -162,8 +162,7 @@ computeid(dst_key_t *key);
 static isc_result_t
 frombuffer(const dns_name_t *name, unsigned int alg, unsigned int flags,
 	   unsigned int protocol, dns_rdataclass_t rdclass,
-	   isc_buffer_t *source, isc_mem_t *mctx, bool no_rdata,
-	   dst_key_t **keyp);
+	   isc_buffer_t *source, isc_mem_t *mctx, dst_key_t **keyp);
 
 static isc_result_t
 algorithm_status(unsigned int alg);
@@ -213,8 +212,6 @@ dst__lib_initialize(void) {
 	dst__openssleddsa_init(&dst_t_func[DST_ALG_ED448], DST_ALG_ED448);
 #endif /* ifdef HAVE_OPENSSL_ED448 */
 
-	dst__sqisign_init(&dst_t_func[DST_ALG_SQISIGN], DST_ALG_SQISIGN);
-
 #if HAVE_GSSAPI
 	dst__gssapi_init(&dst_t_func[DST_ALG_GSSAPI]);
 #endif /* HAVE_GSSAPI */
@@ -222,6 +219,12 @@ dst__lib_initialize(void) {
 
 void
 dst__lib_shutdown(void) {
+	for (size_t i = 0; i < DST_MAX_ALGS; i++) {
+		if (dst_t_func[i] != NULL && dst_t_func[i]->cleanup != NULL) {
+			dst_t_func[i]->cleanup();
+		}
+	}
+
 	isc_mem_detach(&dst__mctx);
 }
 
@@ -242,7 +245,7 @@ dst_ds_digest_supported(unsigned int digest_type) {
 
 isc_result_t
 dst_context_create(dst_key_t *key, isc_mem_t *mctx, isc_logcategory_t category,
-		   bool useforsigning, dst_context_t **dctxp) {
+		   bool useforsigning, int maxbits, dst_context_t **dctxp) {
 	dst_context_t *dctx;
 	isc_result_t result;
 
@@ -250,7 +253,7 @@ dst_context_create(dst_key_t *key, isc_mem_t *mctx, isc_logcategory_t category,
 	REQUIRE(mctx != NULL);
 	REQUIRE(dctxp != NULL && *dctxp == NULL);
 
-	if (key->func->createctx == NULL) {
+	if (key->func->createctx == NULL && key->func->createctx2 == NULL) {
 		return DST_R_UNSUPPORTEDALG;
 	}
 	if (key->keydata.generic == NULL) {
@@ -265,7 +268,11 @@ dst_context_create(dst_key_t *key, isc_mem_t *mctx, isc_logcategory_t category,
 
 	dst_key_attach(key, &dctx->key);
 	isc_mem_attach(mctx, &dctx->mctx);
-	result = key->func->createctx(key, dctx);
+	if (key->func->createctx2 != NULL) {
+		result = key->func->createctx2(key, maxbits, dctx);
+	} else {
+		result = key->func->createctx(key, dctx);
+	}
 	if (result != ISC_R_SUCCESS) {
 		if (dctx->key != NULL) {
 			dst_key_free(&dctx->key);
@@ -328,7 +335,7 @@ dst_context_sign(dst_context_t *dctx, isc_buffer_t *sig) {
 }
 
 isc_result_t
-dst_context_verify(dst_context_t *dctx, int maxbits, isc_region_t *sig) {
+dst_context_verify(dst_context_t *dctx, isc_region_t *sig) {
 	REQUIRE(VALID_CTX(dctx));
 	REQUIRE(sig != NULL);
 
@@ -336,12 +343,57 @@ dst_context_verify(dst_context_t *dctx, int maxbits, isc_region_t *sig) {
 	if (dctx->key->keydata.generic == NULL) {
 		return DST_R_NULLKEY;
 	}
-
 	if (dctx->key->func->verify == NULL) {
 		return DST_R_NOTPUBLICKEY;
 	}
 
-	return dctx->key->func->verify(dctx, maxbits, sig);
+	return dctx->key->func->verify(dctx, sig);
+}
+
+isc_result_t
+dst_context_verify2(dst_context_t *dctx, unsigned int maxbits,
+		    isc_region_t *sig) {
+	REQUIRE(VALID_CTX(dctx));
+	REQUIRE(sig != NULL);
+
+	CHECKALG(dctx->key->key_alg);
+	if (dctx->key->keydata.generic == NULL) {
+		return DST_R_NULLKEY;
+	}
+	if (dctx->key->func->verify == NULL && dctx->key->func->verify2 == NULL)
+	{
+		return DST_R_NOTPUBLICKEY;
+	}
+
+	return dctx->key->func->verify2 != NULL
+		       ? dctx->key->func->verify2(dctx, maxbits, sig)
+		       : dctx->key->func->verify(dctx, sig);
+}
+
+isc_result_t
+dst_key_computesecret(const dst_key_t *pub, const dst_key_t *priv,
+		      isc_buffer_t *secret) {
+	REQUIRE(VALID_KEY(pub) && VALID_KEY(priv));
+	REQUIRE(secret != NULL);
+
+	CHECKALG(pub->key_alg);
+	CHECKALG(priv->key_alg);
+
+	if (pub->keydata.generic == NULL || priv->keydata.generic == NULL) {
+		return DST_R_NULLKEY;
+	}
+
+	if (pub->key_alg != priv->key_alg || pub->func->computesecret == NULL ||
+	    priv->func->computesecret == NULL)
+	{
+		return DST_R_KEYCANNOTCOMPUTESECRET;
+	}
+
+	if (!dst_key_isprivate(priv)) {
+		return DST_R_NOTPRIVATEKEY;
+	}
+
+	return pub->func->computesecret(pub, priv, secret);
 }
 
 isc_result_t
@@ -668,13 +720,6 @@ dst_key_todns(const dst_key_t *key, isc_buffer_t *target) {
 isc_result_t
 dst_key_fromdns(const dns_name_t *name, dns_rdataclass_t rdclass,
 		isc_buffer_t *source, isc_mem_t *mctx, dst_key_t **keyp) {
-	return dst_key_fromdns_ex(name, rdclass, source, mctx, false, keyp);
-}
-
-isc_result_t
-dst_key_fromdns_ex(const dns_name_t *name, dns_rdataclass_t rdclass,
-		   isc_buffer_t *source, isc_mem_t *mctx, bool no_rdata,
-		   dst_key_t **keyp) {
 	uint8_t alg, proto;
 	uint32_t flags, extflags;
 	dst_key_t *key = NULL;
@@ -703,7 +748,7 @@ dst_key_fromdns_ex(const dns_name_t *name, dns_rdataclass_t rdclass,
 	}
 
 	result = frombuffer(name, alg, flags, proto, rdclass, source, mctx,
-			    no_rdata, &key);
+			    &key);
 	if (result != ISC_R_SUCCESS) {
 		return result;
 	}
@@ -722,7 +767,7 @@ dst_key_frombuffer(const dns_name_t *name, unsigned int alg, unsigned int flags,
 	isc_result_t result;
 
 	result = frombuffer(name, alg, flags, protocol, rdclass, source, mctx,
-			    false, &key);
+			    &key);
 	if (result != ISC_R_SUCCESS) {
 		return result;
 	}
@@ -1267,6 +1312,24 @@ dst_key_pubcompare(const dst_key_t *key1, const dst_key_t *key2,
 	return comparekeys(key1, key2, match_revoked_key, pub_compare);
 }
 
+bool
+dst_key_paramcompare(const dst_key_t *key1, const dst_key_t *key2) {
+	REQUIRE(VALID_KEY(key1));
+	REQUIRE(VALID_KEY(key2));
+
+	if (key1 == key2) {
+		return true;
+	}
+	if (key1->key_alg == key2->key_alg &&
+	    key1->func->paramcompare != NULL &&
+	    key1->func->paramcompare(key1, key2))
+	{
+		return true;
+	} else {
+		return false;
+	}
+}
+
 void
 dst_key_attach(dst_key_t *source, dst_key_t **target) {
 	REQUIRE(target != NULL && *target == NULL);
@@ -1349,9 +1412,6 @@ dst_key_sigsize(const dst_key_t *key, unsigned int *n) {
 	case DST_ALG_ED448:
 		*n = DNS_SIG_ED448SIZE;
 		break;
-	case DST_ALG_SQISIGN:
-		*n = DNS_SIG_SQISIGNSIZE;
-		break;
 	case DST_ALG_HMACMD5:
 		*n = isc_md_type_get_size(ISC_MD_MD5);
 		break;
@@ -1837,7 +1897,6 @@ issymmetric(const dst_key_t *key) {
 	case DST_ALG_ECDSA384:
 	case DST_ALG_ED25519:
 	case DST_ALG_ED448:
-	case DST_ALG_SQISIGN:
 		return false;
 	case DST_ALG_HMACMD5:
 	case DST_ALG_HMACSHA1:
@@ -2200,8 +2259,7 @@ computeid(dst_key_t *key) {
 static isc_result_t
 frombuffer(const dns_name_t *name, unsigned int alg, unsigned int flags,
 	   unsigned int protocol, dns_rdataclass_t rdclass,
-	   isc_buffer_t *source, isc_mem_t *mctx, bool no_rdata,
-	   dst_key_t **keyp) {
+	   isc_buffer_t *source, isc_mem_t *mctx, dst_key_t **keyp) {
 	dst_key_t *key;
 	isc_result_t ret;
 
@@ -2223,12 +2281,10 @@ frombuffer(const dns_name_t *name, unsigned int alg, unsigned int flags,
 			return DST_R_UNSUPPORTEDALG;
 		}
 
-		if (!no_rdata) {
-			ret = key->func->fromdns(key, source);
-			if (ret != ISC_R_SUCCESS) {
-				dst_key_free(&key);
-				return ret;
-			}
+		ret = key->func->fromdns(key, source);
+		if (ret != ISC_R_SUCCESS) {
+			dst_key_free(&key);
+			return ret;
 		}
 	}
 

lib/dns/dst_internal.h

@@ -98,10 +98,6 @@ struct dst_key {
 			EVP_PKEY *pub;
 			EVP_PKEY *priv;
 		} pkeypair;
-		struct {
-			uint8_t *pub;
-			uint8_t *priv;
-		} keypair;
 	} keydata; /*%< pointer to key in crypto pkg fmt */
 
 	isc_stdtime_t times[DST_MAX_TIMES + 1]; /*%< timing metadata */
@@ -154,6 +150,8 @@ struct dst_func {
 	 * Context functions
 	 */
 	isc_result_t (*createctx)(dst_key_t *key, dst_context_t *dctx);
+	isc_result_t (*createctx2)(dst_key_t *key, int maxbits,
+				   dst_context_t *dctx);
 	void (*destroyctx)(dst_context_t *dctx);
 	isc_result_t (*adddata)(dst_context_t *dctx, const isc_region_t *data);
 
@@ -161,9 +159,14 @@ struct dst_func {
 	 * Key operations
 	 */
 	isc_result_t (*sign)(dst_context_t *dctx, isc_buffer_t *sig);
-	isc_result_t (*verify)(dst_context_t *dctx, int maxbits,
-			       const isc_region_t *sig);
+	isc_result_t (*verify)(dst_context_t *dctx, const isc_region_t *sig);
+	isc_result_t (*verify2)(dst_context_t *dctx, int maxbits,
+				const isc_region_t *sig);
+	isc_result_t (*computesecret)(const dst_key_t *pub,
+				      const dst_key_t *priv,
+				      isc_buffer_t *secret);
 	bool (*compare)(const dst_key_t *key1, const dst_key_t *key2);
+	bool (*paramcompare)(const dst_key_t *key1, const dst_key_t *key2);
 	isc_result_t (*generate)(dst_key_t *key, int parms,
 				 void (*callback)(int));
 	bool (*isprivate)(const dst_key_t *key);
@@ -175,6 +178,9 @@ struct dst_func {
 	isc_result_t (*tofile)(const dst_key_t *key, const char *directory);
 	isc_result_t (*parse)(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub);
 
+	/* cleanup */
+	void (*cleanup)(void);
+
 	isc_result_t (*fromlabel)(dst_key_t *key, const char *label,
 				  const char *pin);
 	isc_result_t (*dump)(dst_key_t *key, isc_mem_t *mctx, char **buffer,
@@ -207,8 +213,6 @@ dst__openssleddsa_init(struct dst_func **funcp, unsigned char algorithm);
 void
 dst__gssapi_init(struct dst_func **funcp);
 #endif /* HAVE_GSSAPI*/
-void
-dst__sqisign_init(dst_func_t **funcp, unsigned char algorithm);
 
 /*%
  * Secure private file handling

lib/dns/dst_parse.c

@@ -90,9 +90,6 @@ static struct parse_map map[] = { { TAG_RSA_MODULUS, "Modulus:" },
 				  { TAG_EDDSA_ENGINE, "Engine:" },
 				  { TAG_EDDSA_LABEL, "Label:" },
 
-				  { TAG_SQISIGN_PUBLICKEY, "PublicKey:" },
-				  { TAG_SQISIGN_SECRETKEY, "SecretKey:" },
-
 				  { TAG_HMACMD5_KEY, "Key:" },
 				  { TAG_HMACMD5_BITS, "Bits:" },
 
@@ -163,24 +160,19 @@ find_numericdata(const char *s) {
 	return find_metadata(s, numerictags, NUMERIC_NTAGS);
 }
 
-static isc_result_t
-check_external(const dst_private_t *priv) {
-	if (priv->nelements == 0) {
-		return ISC_R_SUCCESS;
-	}
-
-	return DST_R_INVALIDPRIVATEKEY;
-}
-
-static isc_result_t
+static int
 check_rsa(const dst_private_t *priv, bool external) {
 	int i, j;
-	bool have[RSA_NTAGS] = { 0 };
+	bool have[RSA_NTAGS];
 	bool ok;
-	unsigned int mask = (1ULL << TAG_SHIFT) - 1;
+	unsigned int mask;
 
 	if (external) {
-		return check_external(priv);
+		return (priv->nelements == 0) ? 0 : -1;
+	}
+
+	for (i = 0; i < RSA_NTAGS; i++) {
+		have[i] = false;
 	}
 
 	for (j = 0; j < priv->nelements; j++) {
@@ -190,11 +182,13 @@ check_rsa(const dst_private_t *priv, bool external) {
 			}
 		}
 		if (i == RSA_NTAGS) {
-			return DST_R_INVALIDPRIVATEKEY;
+			return -1;
 		}
 		have[i] = true;
 	}
 
+	mask = (1ULL << TAG_SHIFT) - 1;
+
 	if (have[TAG_RSA_LABEL & mask]) {
 		ok = have[TAG_RSA_MODULUS & mask] &&
 		     have[TAG_RSA_PUBLICEXPONENT & mask];
@@ -208,23 +202,23 @@ check_rsa(const dst_private_t *priv, bool external) {
 		     have[TAG_RSA_EXPONENT2 & mask] &&
 		     have[TAG_RSA_COEFFICIENT & mask];
 	}
-	if (!ok) {
-		return DST_R_INVALIDPRIVATEKEY;
-	}
-
-	return ISC_R_SUCCESS;
+	return ok ? 0 : -1;
 }
 
 static int
 check_ecdsa(const dst_private_t *priv, bool external) {
 	int i, j;
-	bool have[ECDSA_NTAGS] = { 0 };
-	unsigned int mask = (1ULL << TAG_SHIFT) - 1;
+	bool have[ECDSA_NTAGS];
+	bool ok;
+	unsigned int mask;
 
 	if (external) {
-		return check_external(priv);
+		return (priv->nelements == 0) ? 0 : -1;
 	}
 
+	for (i = 0; i < ECDSA_NTAGS; i++) {
+		have[i] = false;
+	}
 	for (j = 0; j < priv->nelements; j++) {
 		for (i = 0; i < ECDSA_NTAGS; i++) {
 			if (priv->elements[j].tag == TAG(DST_ALG_ECDSA256, i)) {
@@ -232,26 +226,27 @@ check_ecdsa(const dst_private_t *priv, bool external) {
 			}
 		}
 		if (i == ECDSA_NTAGS) {
-			return DST_R_INVALIDPRIVATEKEY;
+			return -1;
 		}
 		have[i] = true;
 	}
 
-	if (have[TAG_ECDSA_LABEL & mask] || have[TAG_ECDSA_PRIVATEKEY & mask]) {
-		return ISC_R_SUCCESS;
-	}
+	mask = (1ULL << TAG_SHIFT) - 1;
 
-	return DST_R_INVALIDPRIVATEKEY;
+	ok = have[TAG_ECDSA_LABEL & mask] || have[TAG_ECDSA_PRIVATEKEY & mask];
+
+	return ok ? 0 : -1;
 }
 
 static int
 check_eddsa(const dst_private_t *priv, bool external) {
 	int i, j;
 	bool have[EDDSA_NTAGS];
+	bool ok;
 	unsigned int mask;
 
 	if (external) {
-		return check_external(priv);
+		return (priv->nelements == 0) ? 0 : -1;
 	}
 
 	for (i = 0; i < EDDSA_NTAGS; i++) {
@@ -264,51 +259,16 @@ check_eddsa(const dst_private_t *priv, bool external) {
 			}
 		}
 		if (i == EDDSA_NTAGS) {
-			return DST_R_INVALIDPRIVATEKEY;
+			return -1;
 		}
 		have[i] = true;
 	}
 
 	mask = (1ULL << TAG_SHIFT) - 1;
 
-	if (have[TAG_EDDSA_LABEL & mask] || have[TAG_EDDSA_PRIVATEKEY & mask]) {
-		return ISC_R_SUCCESS;
-	}
+	ok = have[TAG_EDDSA_LABEL & mask] || have[TAG_EDDSA_PRIVATEKEY & mask];
 
-	return DST_R_INVALIDPRIVATEKEY;
-}
-
-static int
-check_sqisignhd(const dst_private_t *priv, bool external) {
-	bool have[SQISIGN_NTAGS] = { 0 };
-	unsigned int mask;
-
-	if (external) {
-		return check_external(priv);
-	}
-
-	for (size_t j = 0; j < priv->nelements; j++) {
-		size_t i;
-		for (i = 0; i < SQISIGN_NTAGS; i++) {
-			if (priv->elements[j].tag == TAG(DST_ALG_SQISIGN, i)) {
-				break;
-			}
-		}
-		if (i == SQISIGN_NTAGS) {
-			return DST_R_INVALIDPRIVATEKEY;
-		}
-		have[i] = true;
-	}
-
-	mask = (1ULL << TAG_SHIFT) - 1;
-
-	if (have[TAG_SQISIGN_PUBLICKEY & mask] &&
-	    have[TAG_SQISIGN_SECRETKEY & mask])
-	{
-		return ISC_R_SUCCESS;
-	}
-
-	return DST_R_INVALIDPRIVATEKEY;
+	return ok ? 0 : -1;
 }
 
 static int
@@ -323,9 +283,9 @@ check_hmac_md5(const dst_private_t *priv, bool old) {
 		if (old && priv->nelements == OLD_HMACMD5_NTAGS &&
 		    priv->elements[0].tag == TAG_HMACMD5_KEY)
 		{
-			return ISC_R_SUCCESS;
+			return 0;
 		}
-		return DST_R_INVALIDPRIVATEKEY;
+		return -1;
 	}
 	/*
 	 * We must be new format at this point.
@@ -337,10 +297,10 @@ check_hmac_md5(const dst_private_t *priv, bool old) {
 			}
 		}
 		if (j == priv->nelements) {
-			return DST_R_INVALIDPRIVATEKEY;
+			return -1;
 		}
 	}
-	return ISC_R_SUCCESS;
+	return 0;
 }
 
 static int
@@ -348,7 +308,7 @@ check_hmac_sha(const dst_private_t *priv, unsigned int ntags,
 	       unsigned int alg) {
 	unsigned int i, j;
 	if (priv->nelements != ntags) {
-		return DST_R_INVALIDPRIVATEKEY;
+		return -1;
 	}
 	for (i = 0; i < ntags; i++) {
 		for (j = 0; j < priv->nelements; j++) {
@@ -357,13 +317,13 @@ check_hmac_sha(const dst_private_t *priv, unsigned int ntags,
 			}
 		}
 		if (j == priv->nelements) {
-			return DST_R_INVALIDPRIVATEKEY;
+			return -1;
 		}
 	}
-	return ISC_R_SUCCESS;
+	return 0;
 }
 
-static isc_result_t
+static int
 check_data(const dst_private_t *priv, const unsigned int alg, bool old,
 	   bool external) {
 	switch (alg) {
@@ -379,8 +339,6 @@ check_data(const dst_private_t *priv, const unsigned int alg, bool old,
 	case DST_ALG_ED25519:
 	case DST_ALG_ED448:
 		return check_eddsa(priv, external);
-	case DST_ALG_SQISIGN:
-		return check_sqisignhd(priv, external);
 	case DST_ALG_HMACMD5:
 		return check_hmac_md5(priv, old);
 	case DST_ALG_HMACSHA1:
@@ -424,7 +382,7 @@ dst__privstruct_parse(dst_key_t *key, unsigned int alg, isc_lex_t *lex,
 	unsigned char *data = NULL;
 	unsigned int opt = ISC_LEXOPT_EOL;
 	isc_stdtime_t when;
-	isc_result_t result;
+	isc_result_t ret;
 	bool external = false;
 
 	REQUIRE(priv != NULL);
@@ -432,22 +390,20 @@ dst__privstruct_parse(dst_key_t *key, unsigned int alg, isc_lex_t *lex,
 	priv->nelements = 0;
 	memset(priv->elements, 0, sizeof(priv->elements));
 
-#define NEXTTOKEN(lex, opt, token)                          \
-	do {                                                \
-		result = isc_lex_gettoken(lex, opt, token); \
-		if (result != ISC_R_SUCCESS) {              \
-			goto fail;                          \
-		}                                           \
+#define NEXTTOKEN(lex, opt, token)                       \
+	do {                                             \
+		ret = isc_lex_gettoken(lex, opt, token); \
+		if (ret != ISC_R_SUCCESS)                \
+			goto fail;                       \
 	} while (0)
 
-#define READLINE(lex, opt, token)                           \
-	do {                                                \
-		result = isc_lex_gettoken(lex, opt, token); \
-		if (result == ISC_R_EOF) {                  \
-			break;                              \
-		} else if (result != ISC_R_SUCCESS) {       \
-			goto fail;                          \
-		}                                           \
+#define READLINE(lex, opt, token)                        \
+	do {                                             \
+		ret = isc_lex_gettoken(lex, opt, token); \
+		if (ret == ISC_R_EOF)                    \
+			break;                           \
+		else if (ret != ISC_R_SUCCESS)           \
+			goto fail;                       \
 	} while ((*token).type != isc_tokentype_eol)
 
 	/*
@@ -457,23 +413,23 @@ dst__privstruct_parse(dst_key_t *key, unsigned int alg, isc_lex_t *lex,
 	if (token.type != isc_tokentype_string ||
 	    strcmp(DST_AS_STR(token), PRIVATE_KEY_STR) != 0)
 	{
-		result = DST_R_INVALIDPRIVATEKEY;
+		ret = DST_R_INVALIDPRIVATEKEY;
 		goto fail;
 	}
 
 	NEXTTOKEN(lex, opt, &token);
 	if (token.type != isc_tokentype_string || (DST_AS_STR(token))[0] != 'v')
 	{
-		result = DST_R_INVALIDPRIVATEKEY;
+		ret = DST_R_INVALIDPRIVATEKEY;
 		goto fail;
 	}
 	if (sscanf(DST_AS_STR(token), "v%d.%d", &major, &minor) != 2) {
-		result = DST_R_INVALIDPRIVATEKEY;
+		ret = DST_R_INVALIDPRIVATEKEY;
 		goto fail;
 	}
 
 	if (major > DST_MAJOR_VERSION) {
-		result = DST_R_INVALIDPRIVATEKEY;
+		ret = DST_R_INVALIDPRIVATEKEY;
 		goto fail;
 	}
 
@@ -491,7 +447,7 @@ dst__privstruct_parse(dst_key_t *key, unsigned int alg, isc_lex_t *lex,
 	if (token.type != isc_tokentype_string ||
 	    strcmp(DST_AS_STR(token), ALGORITHM_STR) != 0)
 	{
-		result = DST_R_INVALIDPRIVATEKEY;
+		ret = DST_R_INVALIDPRIVATEKEY;
 		goto fail;
 	}
 
@@ -499,7 +455,7 @@ dst__privstruct_parse(dst_key_t *key, unsigned int alg, isc_lex_t *lex,
 	if (token.type != isc_tokentype_number ||
 	    token.value.as_ulong != (unsigned long)dst_key_alg(key))
 	{
-		result = DST_R_INVALIDPRIVATEKEY;
+		ret = DST_R_INVALIDPRIVATEKEY;
 		goto fail;
 	}
 
@@ -512,17 +468,17 @@ dst__privstruct_parse(dst_key_t *key, unsigned int alg, isc_lex_t *lex,
 		int tag;
 		isc_region_t r;
 		do {
-			result = isc_lex_gettoken(lex, opt, &token);
-			if (result == ISC_R_EOF) {
+			ret = isc_lex_gettoken(lex, opt, &token);
+			if (ret == ISC_R_EOF) {
 				goto done;
 			}
-			if (result != ISC_R_SUCCESS) {
+			if (ret != ISC_R_SUCCESS) {
 				goto fail;
 			}
 		} while (token.type == isc_tokentype_eol);
 
 		if (token.type != isc_tokentype_string) {
-			result = DST_R_INVALIDPRIVATEKEY;
+			ret = DST_R_INVALIDPRIVATEKEY;
 			goto fail;
 		}
 
@@ -538,7 +494,7 @@ dst__privstruct_parse(dst_key_t *key, unsigned int alg, isc_lex_t *lex,
 
 			NEXTTOKEN(lex, opt | ISC_LEXOPT_NUMBER, &token);
 			if (token.type != isc_tokentype_number) {
-				result = DST_R_INVALIDPRIVATEKEY;
+				ret = DST_R_INVALIDPRIVATEKEY;
 				goto fail;
 			}
 
@@ -553,12 +509,12 @@ dst__privstruct_parse(dst_key_t *key, unsigned int alg, isc_lex_t *lex,
 
 			NEXTTOKEN(lex, opt, &token);
 			if (token.type != isc_tokentype_string) {
-				result = DST_R_INVALIDPRIVATEKEY;
+				ret = DST_R_INVALIDPRIVATEKEY;
 				goto fail;
 			}
 
-			result = dns_time32_fromtext(DST_AS_STR(token), &when);
-			if (result != ISC_R_SUCCESS) {
+			ret = dns_time32_fromtext(DST_AS_STR(token), &when);
+			if (ret != ISC_R_SUCCESS) {
 				goto fail;
 			}
 
@@ -572,7 +528,7 @@ dst__privstruct_parse(dst_key_t *key, unsigned int alg, isc_lex_t *lex,
 		if (tag < 0 && minor > DST_MINOR_VERSION) {
 			goto next;
 		} else if (tag < 0) {
-			result = DST_R_INVALIDPRIVATEKEY;
+			ret = DST_R_INVALIDPRIVATEKEY;
 			goto fail;
 		}
 
@@ -581,8 +537,8 @@ dst__privstruct_parse(dst_key_t *key, unsigned int alg, isc_lex_t *lex,
 		data = isc_mem_get(mctx, MAXFIELDSIZE);
 
 		isc_buffer_init(&b, data, MAXFIELDSIZE);
-		result = isc_base64_tobuffer(lex, &b, -1);
-		if (result != ISC_R_SUCCESS) {
+		ret = isc_base64_tobuffer(lex, &b, -1);
+		if (ret != ISC_R_SUCCESS) {
 			goto fail;
 		}
 
@@ -598,13 +554,16 @@ dst__privstruct_parse(dst_key_t *key, unsigned int alg, isc_lex_t *lex,
 
 done:
 	if (external && priv->nelements != 0) {
-		result = DST_R_INVALIDPRIVATEKEY;
+		ret = DST_R_INVALIDPRIVATEKEY;
 		goto fail;
 	}
 
 	check = check_data(priv, alg, true, external);
-	if (check != ISC_R_SUCCESS) {
-		result = check;
+	if (check < 0) {
+		ret = DST_R_INVALIDPRIVATEKEY;
+		goto fail;
+	} else if (check != ISC_R_SUCCESS) {
+		ret = check;
 		goto fail;
 	}
 
@@ -618,7 +577,7 @@ fail:
 		isc_mem_put(mctx, data, MAXFIELDSIZE);
 	}
 
-	return result;
+	return ret;
 }
 
 isc_result_t
@@ -637,13 +596,15 @@ dst__privstruct_writefile(const dst_key_t *key, const dst_private_t *priv,
 	isc_region_t r;
 	int major, minor;
 	mode_t mode;
-	int i;
+	int i, ret;
 
 	REQUIRE(priv != NULL);
 
-	result = check_data(priv, dst_key_alg(key), false, key->external);
-	if (result != ISC_R_SUCCESS) {
-		return result;
+	ret = check_data(priv, dst_key_alg(key), false, key->external);
+	if (ret < 0) {
+		return DST_R_INVALIDPRIVATEKEY;
+	} else if (ret != ISC_R_SUCCESS) {
+		return ret;
 	}
 
 	isc_buffer_init(&fileb, filename, sizeof(filename));
@@ -715,9 +676,6 @@ dst__privstruct_writefile(const dst_key_t *key, const dst_private_t *priv,
 	case DST_ALG_ED448:
 		fprintf(fp, "(ED448)\n");
 		break;
-	case DST_ALG_SQISIGN:
-		fprintf(fp, "(SQISIGN)\n");
-		break;
 	case DST_ALG_HMACMD5:
 		fprintf(fp, "(HMAC_MD5)\n");
 		break;

lib/dns/dst_parse.h

@@ -32,7 +32,7 @@
 
 #include <dst/dst.h>
 
-#define MAXFIELDSIZE 1025
+#define MAXFIELDSIZE 512
 
 /*
  * Maximum number of fields in a private file is 18 (12 algorithm-
@@ -67,10 +67,6 @@
 #define TAG_EDDSA_ENGINE     ((DST_ALG_ED25519 << TAG_SHIFT) + 1)
 #define TAG_EDDSA_LABEL	     ((DST_ALG_ED25519 << TAG_SHIFT) + 2)
 
-#define SQISIGN_NTAGS	      3
-#define TAG_SQISIGN_PUBLICKEY ((DST_ALG_SQISIGN << TAG_SHIFT) + 0)
-#define TAG_SQISIGN_SECRETKEY ((DST_ALG_SQISIGN << TAG_SHIFT) + 1)
-
 #define OLD_HMACMD5_NTAGS 1
 #define HMACMD5_NTAGS	  2
 #define TAG_HMACMD5_KEY	  ((DST_ALG_HMACMD5 << TAG_SHIFT) + 0)

lib/dns/gssapi_link.c

@@ -63,11 +63,13 @@ struct dst_gssapi_signverifyctx {
  * or verifying.
  */
 static isc_result_t
-gssapi_create_signverify_ctx(dst_key_t *key ISC_ATTR_UNUSED,
-			     dst_context_t *dctx) {
-	dst_gssapi_signverifyctx_t *ctx =
-		isc_mem_get(dctx->mctx, sizeof(dst_gssapi_signverifyctx_t));
-	*ctx = (dst_gssapi_signverifyctx_t){ 0 };
+gssapi_create_signverify_ctx(dst_key_t *key, dst_context_t *dctx) {
+	dst_gssapi_signverifyctx_t *ctx;
+
+	UNUSED(key);
+
+	ctx = isc_mem_get(dctx->mctx, sizeof(dst_gssapi_signverifyctx_t));
+	ctx->buffer = NULL;
 	isc_buffer_allocate(dctx->mctx, &ctx->buffer, INITIAL_BUFFER_SIZE);
 
 	dctx->ctxdata.gssctx = ctx;
@@ -184,8 +186,7 @@ gssapi_sign(dst_context_t *dctx, isc_buffer_t *sig) {
  * Verify.
  */
 static isc_result_t
-gssapi_verify(dst_context_t *dctx, int maxbits ISC_ATTR_UNUSED,
-	      const isc_region_t *sig) {
+gssapi_verify(dst_context_t *dctx, const isc_region_t *sig) {
 	dst_gssapi_signverifyctx_t *ctx = dctx->ctxdata.gssctx;
 	isc_region_t message;
 	gss_buffer_desc gmessage, gsig;
@@ -330,11 +331,15 @@ gssapi_dump(dst_key_t *key, isc_mem_t *mctx, char **buffer, int *length) {
 
 static dst_func_t gssapi_functions = {
 	gssapi_create_signverify_ctx,
+	NULL, /*%< createctx2 */
 	gssapi_destroy_signverify_ctx,
 	gssapi_adddata,
 	gssapi_sign,
 	gssapi_verify,
+	NULL, /*%< verify2 */
+	NULL, /*%< computesecret */
 	gssapi_compare,
+	NULL, /*%< paramcompare */
 	gssapi_generate,
 	gssapi_isprivate,
 	gssapi_destroy,
@@ -342,6 +347,7 @@ static dst_func_t gssapi_functions = {
 	NULL, /*%< fromdns */
 	NULL, /*%< tofile */
 	NULL, /*%< parse */
+	NULL, /*%< cleanup */
 	NULL, /*%< fromlabel */
 	gssapi_dump,
 	gssapi_restore,

lib/dns/hmac_link.c

@@ -69,7 +69,6 @@
 		return (hmac_sign(dctx, sig));                                 \
 	}                                                                      \
 	static isc_result_t hmac##alg##_verify(dst_context_t *dctx,            \
-					       int maxbits ISC_ATTR_UNUSED,    \
 					       const isc_region_t *sig) {      \
 		return (hmac_verify(dctx, sig));                               \
 	}                                                                      \
@@ -115,11 +114,15 @@
 	}                                                                      \
 	static dst_func_t hmac##alg##_functions = {                            \
 		hmac##alg##_createctx,                                         \
+		NULL, /*%< createctx2 */                                       \
 		hmac##alg##_destroyctx,                                        \
 		hmac##alg##_adddata,                                           \
 		hmac##alg##_sign,                                              \
 		hmac##alg##_verify,                                            \
+		NULL, /*%< verify2 */                                          \
+		NULL, /*%< computesecret */                                    \
 		hmac##alg##_compare,                                           \
+		NULL, /*%< paramcompare */                                     \
 		hmac##alg##_generate,                                          \
 		hmac##alg##_isprivate,                                         \
 		hmac##alg##_destroy,                                           \
@@ -127,6 +130,7 @@
 		hmac##alg##_fromdns,                                           \
 		hmac##alg##_tofile,                                            \
 		hmac##alg##_parse,                                             \
+		NULL, /*%< cleanup */                                          \
 		NULL, /*%< fromlabel */                                        \
 		NULL, /*%< dump */                                             \
 		NULL, /*%< restore */                                          \

lib/dns/include/dns/db.h

@@ -182,6 +182,7 @@ typedef struct dns_dbmethods {
 				     dns_name_t *name);
 	void (*setmaxrrperset)(dns_db_t *db, uint32_t value);
 	void (*setmaxtypepername)(dns_db_t *db, uint32_t value);
+	isc_result_t (*getzoneversion)(dns_db_t *db, isc_buffer_t *b);
 } dns_dbmethods_t;
 
 typedef isc_result_t (*dns_dbcreatefunc_t)(isc_mem_t	    *mctx,
@@ -1805,3 +1806,21 @@ dns_db_setmaxtypepername(dns_db_t *db, uint32_t value);
  * stored at a given node, then any subsequent attempt to add an rdataset
  * with a new RR type will return ISC_R_TOOMANYRECORDS.
  */
+
+isc_result_t
+dns_db_getzoneversion(dns_db_t *db, isc_buffer_t *b);
+/*%<
+ * Provides a database specific EDNS ZONEVERSION option.
+ *
+ * Requires:
+ * \li 'db' is a valid database
+ * \li 'b' is a valid buffer
+ *
+ * Returns:
+ * \li ISC_R_SUCCESS when it has populated the buffer with the ZONEVERSION
+ *     response (maybe empty implying no ZONEVERSION to be returned).
+ * \li ISC_R_NOSPACE if the buffer is too small.
+ * \li ISC_R_NOTIMPLEMENTED if there is not a database specific
+ *     ZONEVERSION
+ * \li ISC_R_FAILURE other failures
+ */

lib/dns/include/dns/dnssec.h

@@ -242,6 +242,24 @@ dns_dnssec_signs(dns_rdata_t *rdata, const dns_name_t *name,
  * rrset.  dns_dnssec_signs() works on any rrset.
  */
 
+bool
+dns_dnssec_iszonekey(dns_rdata_dnskey_t *key);
+/*%<
+ * Verify that 'key' is a DNSSEC key with the DNS_KEYOWNER_ZONE flag set.
+ *
+ * Requires:
+ *\li		'key' is not NULL.
+ */
+
+bool
+dns_dnssec_haszonekey(dns_rdataset_t *keyset);
+/*%<
+ * Verify that 'keyset' includes at least one zone key.
+ *
+ * Requires:
+ *\li		'keyset' is not NULL.
+ */
+
 void
 dns_dnsseckey_create(isc_mem_t *mctx, dst_key_t **dstkey,
 		     dns_dnsseckey_t **dkp);

lib/dns/include/dns/keyvalues.h

@@ -68,7 +68,6 @@
 #define DNS_KEYALG_ECDSA384	 14
 #define DNS_KEYALG_ED25519	 15
 #define DNS_KEYALG_ED448	 16
-#define DNS_KEYALG_SQISIGN	 17
 #define DNS_KEYALG_INDIRECT	 252
 #define DNS_KEYALG_PRIVATEDNS	 253
 #define DNS_KEYALG_PRIVATEOID	 254 /*%< Key begins with OID giving alg */
@@ -103,7 +102,3 @@
 
 #define DNS_KEY_ED25519SIZE 32
 #define DNS_KEY_ED448SIZE   57
-
-#define DNS_SIG_SQISIGNSIZE 148
-#define DNS_KEY_SQISIGNSIZE 65
-#define DNS_SEC_SQISIGNSIZE 353

lib/dns/include/dns/message.h

@@ -102,7 +102,6 @@
 #define DNS_MESSAGEEXTFLAG_DO 0x8000U
 
 /*%< EDNS0 extended OPT codes */
-
 #define DNS_OPT_LLQ	       1  /*%< LLQ opt code */
 #define DNS_OPT_UL	       2  /*%< UL opt code */
 #define DNS_OPT_NSID	       3  /*%< NSID opt code */
@@ -129,7 +128,7 @@
  * options we know about. Extended DNS Errors may occur multiple times, see
  * DNS_EDE_MAX_ERRORS.
  */
-#define DNS_EDNSOPTIONS 8 + DNS_EDE_MAX_ERRORS
+#define DNS_EDNSOPTIONS 9 + DNS_EDE_MAX_ERRORS
 
 #define DNS_MESSAGE_REPLYPRESERVE	 (DNS_MESSAGEFLAG_RD | DNS_MESSAGEFLAG_CD)
 #define DNS_MESSAGEEXTFLAG_REPLYPRESERVE (DNS_MESSAGEEXTFLAG_DO)

lib/dns/include/dns/peer.h

@@ -115,6 +115,12 @@ dns_peer_setrequestnsid(dns_peer_t *peer, bool newval);
 isc_result_t
 dns_peer_getrequestnsid(dns_peer_t *peer, bool *retval);
 
+isc_result_t
+dns_peer_setrequestzoneversion(dns_peer_t *peer, bool newval);
+
+isc_result_t
+dns_peer_getrequestzoneversion(dns_peer_t *peer, bool *retval);
+
 isc_result_t
 dns_peer_setsendcookie(dns_peer_t *peer, bool newval);
 

lib/dns/include/dns/resolver.h

@@ -105,31 +105,32 @@ typedef enum { dns_quotatype_zone = 0, dns_quotatype_server } dns_quotatype_t;
  * Options that modify how a 'fetch' is done.
  */
 enum {
-	DNS_FETCHOPT_TCP = 1 << 0,	       /*%< Use TCP. */
-	DNS_FETCHOPT_UNSHARED = 1 << 1,	       /*%< See below. */
-	DNS_FETCHOPT_RECURSIVE = 1 << 2,       /*%< Set RD? */
-	DNS_FETCHOPT_NOEDNS0 = 1 << 3,	       /*%< Do not use EDNS. */
-	DNS_FETCHOPT_FORWARDONLY = 1 << 4,     /*%< Only use forwarders. */
-	DNS_FETCHOPT_NOVALIDATE = 1 << 5,      /*%< Disable validation. */
-	DNS_FETCHOPT_WANTNSID = 1 << 6,	       /*%< Request NSID */
-	DNS_FETCHOPT_PREFETCH = 1 << 7,	       /*%< Do prefetch */
-	DNS_FETCHOPT_NOCDFLAG = 1 << 8,	       /*%< Don't set CD flag. */
-	DNS_FETCHOPT_NONTA = 1 << 9,	       /*%< Ignore NTA table. */
-	DNS_FETCHOPT_NOCACHED = 1 << 10,       /*%< Force cache update. */
-	DNS_FETCHOPT_QMINIMIZE = 1 << 11,      /*%< Use qname minimization. */
-	DNS_FETCHOPT_NOFOLLOW = 1 << 12,       /*%< Don't retrieve the NS RRset
-						* from the child zone when a
-						* delegation is returned in
-						* response to a NS query. */
-	DNS_FETCHOPT_QMIN_STRICT = 1 << 13,    /*%< Do not work around servers
-						* that return errors on
-						* non-empty terminals. */
-	DNS_FETCHOPT_QMIN_SKIP_IP6A = 1 << 14, /*%< Skip some labels when
-						* doing qname minimization
-						* on ip6.arpa. */
-	DNS_FETCHOPT_NOFORWARD = 1 << 15,      /*%< Do not use forwarders if
-						* possible. */
-	DNS_FETCHOPT_QMINFETCH = 1 << 16,      /*%< Qmin fetch */
+	DNS_FETCHOPT_TCP = 1 << 0,		/*%< Use TCP. */
+	DNS_FETCHOPT_UNSHARED = 1 << 1,		/*%< See below. */
+	DNS_FETCHOPT_RECURSIVE = 1 << 2,	/*%< Set RD? */
+	DNS_FETCHOPT_NOEDNS0 = 1 << 3,		/*%< Do not use EDNS. */
+	DNS_FETCHOPT_FORWARDONLY = 1 << 4,	/*%< Only use forwarders. */
+	DNS_FETCHOPT_NOVALIDATE = 1 << 5,	/*%< Disable validation. */
+	DNS_FETCHOPT_WANTNSID = 1 << 6,		/*%< Request NSID */
+	DNS_FETCHOPT_PREFETCH = 1 << 7,		/*%< Do prefetch */
+	DNS_FETCHOPT_NOCDFLAG = 1 << 8,		/*%< Don't set CD flag. */
+	DNS_FETCHOPT_NONTA = 1 << 9,		/*%< Ignore NTA table. */
+	DNS_FETCHOPT_NOCACHED = 1 << 10,	/*%< Force cache update. */
+	DNS_FETCHOPT_QMINIMIZE = 1 << 11,	/*%< Use qname minimization. */
+	DNS_FETCHOPT_NOFOLLOW = 1 << 12,	/*%< Don't retrieve the NS RRset
+						 * from the child zone when a
+						 * delegation is returned in
+						 * response to a NS query. */
+	DNS_FETCHOPT_QMIN_STRICT = 1 << 13,	/*%< Do not work around servers
+						 * that return errors on
+						 * non-empty terminals. */
+	DNS_FETCHOPT_QMIN_SKIP_IP6A = 1 << 14,	/*%< Skip some labels when
+						 * doing qname minimization
+						 * on ip6.arpa. */
+	DNS_FETCHOPT_NOFORWARD = 1 << 15,	/*%< Do not use forwarders if
+						 * possible. */
+	DNS_FETCHOPT_QMINFETCH = 1 << 16,	/*%< Qmin fetch */
+	DNS_FETCHOPT_WANTZONEVERSION = 1 << 17, /*%< Request ZONEVERSION */
 
 	/*% EDNS version bits: */
 	DNS_FETCHOPT_EDNSVERSIONSET = 1 << 23,

lib/dns/include/dns/validator.h

@@ -151,8 +151,8 @@ struct dns_validator {
 	uint8_t	       unsupported_digest;
 	dns_rdata_t    rdata;
 	bool	       resume;
-	uint32_t      *nvalidations;
-	uint32_t      *nfails;
+	isc_counter_t *nvalidations;
+	isc_counter_t *nfails;
 	isc_counter_t *qc;
 	isc_counter_t *gqc;
 
@@ -172,7 +172,7 @@ dns_validator_create(dns_view_t *view, dns_name_t *name, dns_rdatatype_t type,
 		     dns_rdataset_t *rdataset, dns_rdataset_t *sigrdataset,
 		     dns_message_t *message, unsigned int options,
 		     isc_loop_t *loop, isc_job_cb cb, void *arg,
-		     uint32_t *nvalidations, uint32_t *nfails,
+		     isc_counter_t *nvalidations, isc_counter_t *nfails,
 		     isc_counter_t *qc, isc_counter_t *gqc,
 		     dns_edectx_t *edectx, dns_validator_t **validatorp);
 /*%<

lib/dns/include/dns/view.h

@@ -145,6 +145,7 @@ struct dns_view {
 	dns_rrl_t	     *rrl;
 	bool		      provideixfr;
 	bool		      requestnsid;
+	bool		      requestzoneversion;
 	bool		      sendcookie;
 	dns_ttl_t	      maxcachettl;
 	dns_ttl_t	      maxncachettl;

lib/dns/include/dns/zone.h

@@ -102,6 +102,7 @@ typedef enum {
 	DNS_ZONEOPT_CHECKTTL = 1 << 28,	      /*%< check max-zone-ttl */
 	DNS_ZONEOPT_AUTOEMPTY = 1 << 29,      /*%< automatic empty zone */
 	DNS_ZONEOPT_CHECKSVCB = 1 << 30,      /*%< check SVBC records */
+	DNS_ZONEOPT_ZONEVERSION = 1U << 31,   /*%< enable zoneversion */
 	DNS_ZONEOPT___MAX = UINT64_MAX, /* trick to make the ENUM 64-bit wide */
 } dns_zoneopt_t;
 
@@ -2785,6 +2786,24 @@ dns_zone_getrad(dns_zone_t *zone, dns_name_t *name);
  * \li	'name' is a valid name with a buffer.
  */
 
+isc_result_t
+dns_zone_getzoneversion(dns_zone_t *zone, isc_buffer_t *b);
+/**<
+ * Return the EDNS ZONEVERSION for this zone.
+ *
+ * Note: For type SERIAL a buffer of at least 6 octets is required.
+ *
+ * Requires:
+ * \li	'zone' to be a valid zone.
+ * \li	'b' to be a valid buffer.
+ *
+ * Returns
+ * \li	ISC_R_SUCCESS if the zone is loaded and supports ZONEVERSION.
+ * \li	ISC_R_NOSPACE if the buffer is too small.
+ * \li	DNS_R_NOTLOADED if the database is not loaded.
+ * \li	ISC_R_FAILURE other failure.
+ */
+
 #if DNS_ZONE_TRACE
 #define dns_zone_ref(ptr)   dns_zone__ref(ptr, __func__, __FILE__, __LINE__)
 #define dns_zone_unref(ptr) dns_zone__unref(ptr, __func__, __FILE__, __LINE__)

lib/dns/include/dns/zonekey.h

@@ -1,29 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * SPDX-License-Identifier: MPL-2.0
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-#pragma once
-
-/*! \file dns/zonekey.h */
-
-#include <stdbool.h>
-
-#include <dns/types.h>
-
-bool
-dns_zonekey_iszonekey(dns_rdata_t *keyrdata);
-/*%<
- *	Determines if the key record contained in the rdata is a zone key.
- *
- *	Requires:
- *		'keyrdata' is not NULL.
- */

lib/dns/include/dst/dst.h

@@ -93,7 +93,6 @@ typedef enum dst_algorithm {
 	DST_ALG_ECDSA384 = 14,
 	DST_ALG_ED25519 = 15,
 	DST_ALG_ED448 = 16,
-	DST_ALG_SQISIGN = 17, /* FIXME: should be experimental */
 
 	/*
 	 * Do not renumber HMAC algorithms as they are used externally to named
@@ -219,7 +218,7 @@ dst_ds_digest_supported(unsigned int digest_type);
 
 isc_result_t
 dst_context_create(dst_key_t *key, isc_mem_t *mctx, isc_logcategory_t category,
-		   bool useforsigning, dst_context_t **dctxp);
+		   bool useforsigning, int maxbits, dst_context_t **dctxp);
 /*%<
  * Creates a context to be used for a sign or verify operation.
  *
@@ -285,7 +284,11 @@ dst_context_sign(dst_context_t *dctx, isc_buffer_t *sig);
  */
 
 isc_result_t
-dst_context_verify(dst_context_t *dctx, int maxbits, isc_region_t *sig);
+dst_context_verify(dst_context_t *dctx, isc_region_t *sig);
+
+isc_result_t
+dst_context_verify2(dst_context_t *dctx, unsigned int maxbits,
+		    isc_region_t *sig);
 /*%<
  * Verifies the signature using the data and key stored in the context.
  *
@@ -457,10 +460,6 @@ dst_key_tofile(const dst_key_t *key, int type, const char *directory);
  */
 
 isc_result_t
-dst_key_fromdns_ex(const dns_name_t *name, dns_rdataclass_t rdclass,
-		   isc_buffer_t *source, isc_mem_t *mctx, bool no_rdata,
-		   dst_key_t **keyp);
-isc_result_t
 dst_key_fromdns(const dns_name_t *name, dns_rdataclass_t rdclass,
 		isc_buffer_t *source, isc_mem_t *mctx, dst_key_t **keyp);
 /*%<

lib/dns/kasp.c

@@ -470,9 +470,6 @@ dns_kasp_key_size(dns_kasp_key_t *key) {
 	case DNS_KEYALG_ED448:
 		size = 456;
 		break;
-	case DNS_KEYALG_SQISIGN:
-		size = 512;
-		break;
 	default:
 		/* unsupported */
 		break;

lib/dns/keymgr.c

@@ -189,13 +189,19 @@ dns_keymgr_settime_syncpublish(dst_key_t *key, dns_kasp_t *kasp, bool first) {
 		isc_stdtime_t zrrsig_present;
 		dns_ttl_t ttlsig = dns_kasp_zonemaxttl(kasp, true);
 		zrrsig_present = published + ttlsig +
-				 dns_kasp_zonepropagationdelay(kasp) +
-				 dns_kasp_publishsafety(kasp);
+				 dns_kasp_zonepropagationdelay(kasp);
 		if (zrrsig_present > syncpublish) {
 			syncpublish = zrrsig_present;
 		}
 	}
 	dst_key_settime(key, DST_TIME_SYNCPUBLISH, syncpublish);
+
+	uint32_t lifetime = 0;
+	ret = dst_key_getnum(key, DST_NUM_LIFETIME, &lifetime);
+	if (ret == ISC_R_SUCCESS && lifetime > 0) {
+		dst_key_settime(key, DST_TIME_SYNCDELETE,
+				(syncpublish + lifetime));
+	}
 }
 
 /*
@@ -243,6 +249,17 @@ keymgr_prepublication_time(dns_dnsseckey_t *key, dns_kasp_t *kasp,
 		pub = now;
 	}
 
+	/*
+	 * To calculate phase out times ("Retired", "Removed", ...),
+	 * the key lifetime is required.
+	 */
+	uint32_t klifetime = 0;
+	ret = dst_key_getnum(key->key, DST_NUM_LIFETIME, &klifetime);
+	if (ret != ISC_R_SUCCESS) {
+		dst_key_setnum(key->key, DST_NUM_LIFETIME, lifetime);
+		klifetime = lifetime;
+	}
+
 	/*
 	 * Calculate prepublication time.
 	 */
@@ -272,13 +289,16 @@ keymgr_prepublication_time(dns_dnsseckey_t *key, dns_kasp_t *kasp,
 				dns_ttl_t ttlsig = dns_kasp_zonemaxttl(kasp,
 								       true);
 				syncpub2 = pub + ttlsig +
-					   dns_kasp_publishsafety(kasp) +
 					   dns_kasp_zonepropagationdelay(kasp);
 			}
 
 			syncpub = ISC_MAX(syncpub1, syncpub2);
 			dst_key_settime(key->key, DST_TIME_SYNCPUBLISH,
 					syncpub);
+			if (klifetime > 0) {
+				dst_key_settime(key->key, DST_TIME_SYNCDELETE,
+						(syncpub + klifetime));
+			}
 		}
 	}
 
@@ -291,13 +311,6 @@ keymgr_prepublication_time(dns_dnsseckey_t *key, dns_kasp_t *kasp,
 
 	ret = dst_key_gettime(key->key, DST_TIME_INACTIVE, &retire);
 	if (ret != ISC_R_SUCCESS) {
-		uint32_t klifetime = 0;
-
-		ret = dst_key_getnum(key->key, DST_NUM_LIFETIME, &klifetime);
-		if (ret != ISC_R_SUCCESS) {
-			dst_key_setnum(key->key, DST_NUM_LIFETIME, lifetime);
-			klifetime = lifetime;
-		}
 		if (klifetime == 0) {
 			/*
 			 * No inactive time and no lifetime,
@@ -398,7 +411,7 @@ keymgr_key_update_lifetime(dns_dnsseckey_t *key, dns_kasp_t *kasp,
 	/* Initialize lifetime. */
 	if (r != ISC_R_SUCCESS) {
 		dst_key_setnum(key->key, DST_NUM_LIFETIME, lifetime);
-		return;
+		l = lifetime - 1;
 	}
 	/* Skip keys that are still hidden or already retiring. */
 	if (g != OMNIPRESENT) {
@@ -420,6 +433,7 @@ keymgr_key_update_lifetime(dns_dnsseckey_t *key, dns_kasp_t *kasp,
 		} else {
 			dst_key_unsettime(key->key, DST_TIME_INACTIVE);
 			dst_key_unsettime(key->key, DST_TIME_DELETE);
+			dst_key_unsettime(key->key, DST_TIME_SYNCDELETE);
 		}
 	}
 }
@@ -1286,6 +1300,7 @@ keymgr_transition_time(dns_dnsseckey_t *key, int type,
 	isc_result_t ret;
 	isc_stdtime_t lastchange, dstime, nexttime = now;
 	dns_ttl_t ttlsig = dns_kasp_zonemaxttl(kasp, true);
+	uint32_t dsstate;
 
 	/*
 	 * No need to wait if we move things into an uncertain state.
@@ -1355,15 +1370,12 @@ keymgr_transition_time(dns_dnsseckey_t *key, int type,
 			 * records.  This translates to:
 			 *
 			 *     Dsgn + zone-propagation-delay + max-zone-ttl.
-			 *
-			 * We will also add the retire-safety interval.
 			 */
 			nexttime = lastchange + ttlsig +
-				   dns_kasp_zonepropagationdelay(kasp) +
-				   dns_kasp_retiresafety(kasp);
+				   dns_kasp_zonepropagationdelay(kasp);
 			/*
-			 * Only add the sign delay Dsgn if there is an actual
-			 * predecessor or successor key.
+			 * Only add the sign delay Dsgn and retire-safety if
+			 * there is an actual predecessor or successor key.
 			 */
 			uint32_t tag;
 			ret = dst_key_getnum(key->key, DST_NUM_PREDECESSOR,
@@ -1373,7 +1385,8 @@ keymgr_transition_time(dns_dnsseckey_t *key, int type,
 						     DST_NUM_SUCCESSOR, &tag);
 			}
 			if (ret == ISC_R_SUCCESS) {
-				nexttime += dns_kasp_signdelay(kasp);
+				nexttime += dns_kasp_signdelay(kasp) +
+					    dns_kasp_retiresafety(kasp);
 			}
 			break;
 		default:
@@ -1399,35 +1412,36 @@ keymgr_transition_time(dns_dnsseckey_t *key, int type,
 		 * This translates to:
 		 *
 		 *      parent-propagation-delay + parent-ds-ttl.
-		 *
-		 * We will also add the retire-safety interval.
 		 */
 		case OMNIPRESENT:
-			/* Make sure DS has been seen in the parent. */
-			ret = dst_key_gettime(key->key, DST_TIME_DSPUBLISH,
-					      &dstime);
-			if (ret != ISC_R_SUCCESS || dstime > now) {
-				/* Not yet, try again in an hour. */
-				nexttime = now + 3600;
-			} else {
-				nexttime =
-					dstime + dns_kasp_dsttl(kasp) +
-					dns_kasp_parentpropagationdelay(kasp) +
-					dns_kasp_retiresafety(kasp);
-			}
-			break;
 		case HIDDEN:
-			/* Make sure DS has been withdrawn from the parent. */
-			ret = dst_key_gettime(key->key, DST_TIME_DSDELETE,
-					      &dstime);
+			/* Make sure DS has been seen in/withdrawn from the
+			 * parent. */
+			dsstate = next_state == HIDDEN ? DST_TIME_DSDELETE
+						       : DST_TIME_DSPUBLISH;
+			ret = dst_key_gettime(key->key, dsstate, &dstime);
 			if (ret != ISC_R_SUCCESS || dstime > now) {
 				/* Not yet, try again in an hour. */
 				nexttime = now + 3600;
 			} else {
 				nexttime =
 					dstime + dns_kasp_dsttl(kasp) +
-					dns_kasp_parentpropagationdelay(kasp) +
-					dns_kasp_retiresafety(kasp);
+					dns_kasp_parentpropagationdelay(kasp);
+				/*
+				 * Only add the retire-safety if there is an
+				 * actual predecessor or successor key.
+				 */
+				uint32_t tag;
+				ret = dst_key_getnum(key->key,
+						     DST_NUM_PREDECESSOR, &tag);
+				if (ret != ISC_R_SUCCESS) {
+					ret = dst_key_getnum(key->key,
+							     DST_NUM_SUCCESSOR,
+							     &tag);
+				}
+				if (ret == ISC_R_SUCCESS) {
+					nexttime += dns_kasp_retiresafety(kasp);
+				}
 			}
 			break;
 		default:
@@ -1763,7 +1777,9 @@ keymgr_key_rollover(dns_kasp_key_t *kaspkey, dns_dnsseckey_t *active_key,
 		if (prepub == 0 || prepub > now) {
 			/* No need to start rollover now. */
 			if (*nexttime == 0 || prepub < *nexttime) {
-				*nexttime = prepub;
+				if (prepub > 0) {
+					*nexttime = prepub;
+				}
 			}
 			return ISC_R_SUCCESS;
 		}
@@ -2022,6 +2038,20 @@ keymgr_purge_keyfile(dst_key_t *key, int type) {
 	}
 }
 
+static bool
+dst_key_doublematch(dns_dnsseckey_t *key, dns_kasp_t *kasp) {
+	int matches = 0;
+
+	for (dns_kasp_key_t *kkey = ISC_LIST_HEAD(dns_kasp_keys(kasp));
+	     kkey != NULL; kkey = ISC_LIST_NEXT(kkey, link))
+	{
+		if (dns_kasp_key_match(kkey, key)) {
+			matches++;
+		}
+	}
+	return matches > 1;
+}
+
 /*
  * Examine 'keys' and match 'kasp' policy.
  *
@@ -2161,6 +2191,7 @@ dns_keymgr_run(const dns_name_t *origin, dns_rdataclass_t rdclass,
 					 * matches the kasp policy.
 					 */
 					if (!dst_key_is_unused(dkey->key) &&
+					    !dst_key_doublematch(dkey, kasp) &&
 					    (dst_key_goal(dkey->key) ==
 					     OMNIPRESENT) &&
 					    !keymgr_dep(dkey->key, keyring,

lib/dns/message.c

@@ -3105,7 +3105,7 @@ dns_message_checksig_async(dns_message_t *msg, dns_view_t *view,
 
 isc_result_t
 dns_message_checksig(dns_message_t *msg, dns_view_t *view) {
-	isc_buffer_t b, msgb;
+	isc_buffer_t msgb;
 
 	REQUIRE(DNS_MESSAGE_VALID(msg));
 
@@ -3126,7 +3126,7 @@ dns_message_checksig(dns_message_t *msg, dns_view_t *view) {
 			return dns_tsig_verify(&msgb, msg, NULL, NULL);
 		}
 	} else {
-		dns_rdata_t rdata = DNS_RDATA_INIT;
+		dns_rdata_t sigrdata = DNS_RDATA_INIT;
 		dns_rdata_sig_t sig;
 		dns_rdataset_t keyset;
 		isc_result_t result;
@@ -3134,7 +3134,7 @@ dns_message_checksig(dns_message_t *msg, dns_view_t *view) {
 
 		result = dns_rdataset_first(msg->sig0);
 		INSIST(result == ISC_R_SUCCESS);
-		dns_rdataset_current(msg->sig0, &rdata);
+		dns_rdataset_current(msg->sig0, &sigrdata);
 
 		/*
 		 * This can occur when the message is a dynamic update, since
@@ -3143,11 +3143,11 @@ dns_message_checksig(dns_message_t *msg, dns_view_t *view) {
 		 * looked for in the additional section, and the dynamic update
 		 * meta-records are in the prerequisite and update sections.
 		 */
-		if (rdata.length == 0) {
+		if (sigrdata.length == 0) {
 			return ISC_R_UNEXPECTEDEND;
 		}
 
-		result = dns_rdata_tostruct(&rdata, &sig, NULL);
+		result = dns_rdata_tostruct(&sigrdata, &sig, NULL);
 		if (result != ISC_R_SUCCESS) {
 			return result;
 		}
@@ -3191,26 +3191,32 @@ dns_message_checksig(dns_message_t *msg, dns_view_t *view) {
 		     message_checks < max_message_checks;
 		     key_checks++, result = dns_rdataset_next(&keyset))
 		{
+			dns_rdata_t keyrdata = DNS_RDATA_INIT;
+			dns_rdata_key_t ks;
 			dst_key_t *key = NULL;
+			isc_region_t r;
 
-			dns_rdata_reset(&rdata);
-			dns_rdataset_current(&keyset, &rdata);
-			isc_buffer_init(&b, rdata.data, rdata.length);
-			isc_buffer_add(&b, rdata.length);
+			dns_rdataset_current(&keyset, &keyrdata);
+			dns_rdata_tostruct(&keyrdata, &ks, NULL);
 
-			result = dst_key_fromdns(&sig.signer, rdata.rdclass, &b,
-						 view->mctx, &key);
+			if (sig.algorithm != ks.algorithm ||
+			    (ks.protocol != DNS_KEYPROTO_DNSSEC &&
+			     ks.protocol != DNS_KEYPROTO_ANY))
+			{
+				continue;
+			}
+
+			dns_rdata_toregion(&keyrdata, &r);
+			if (dst_region_computeid(&r) != sig.keyid) {
+				continue;
+			}
+
+			result = dns_dnssec_keyfromrdata(&sig.signer, &keyrdata,
+							 view->mctx, &key);
 			if (result != ISC_R_SUCCESS) {
 				continue;
 			}
-			if (dst_key_alg(key) != sig.algorithm ||
-			    dst_key_id(key) != sig.keyid ||
-			    !(dst_key_proto(key) == DNS_KEYPROTO_DNSSEC ||
-			      dst_key_proto(key) == DNS_KEYPROTO_ANY))
-			{
-				dst_key_free(&key);
-				continue;
-			}
+
 			result = dns_dnssec_verifymessage(&msgb, msg, key);
 			dst_key_free(&key);
 			if (result == ISC_R_SUCCESS) {
@@ -3506,6 +3512,116 @@ static const char *option_names[] = {
 	[DNS_OPT_ZONEVERSION] = "ZONEVERSION",
 };
 
+static isc_result_t
+render_zoneversion(dns_message_t *msg, isc_buffer_t *optbuf,
+		   const dns_master_style_t *style, isc_buffer_t *target) {
+	isc_result_t result = ISC_R_SUCCESS;
+	unsigned int labels = isc_buffer_getuint8(optbuf);
+	unsigned int type = isc_buffer_getuint8(optbuf);
+	char buf[sizeof("4000000000")];
+	char namebuf[DNS_NAME_FORMATSIZE];
+	dns_name_t *name = ISC_LIST_HEAD(msg->sections[DNS_SECTION_QUESTION]);
+	dns_name_t suffix = DNS_NAME_INITEMPTY;
+	bool yaml = false, rawmode = false;
+	const char *sep1 = " ", *sep2 = ", ";
+
+	if ((dns_master_styleflags(style) & DNS_STYLEFLAG_YAML) != 0) {
+		msg->indent.count++;
+		sep1 = sep2 = "\n";
+		yaml = true;
+	}
+
+	ADD_STRING(target, sep1);
+
+	if (msg->counts[DNS_SECTION_QUESTION] != 1 || name == NULL ||
+	    dns_name_countlabels(name) < labels + 1)
+	{
+		rawmode = true;
+		INDENT(style);
+		ADD_STRING(target, "LABELS: ");
+		snprintf(buf, sizeof(buf), "%u", labels);
+		ADD_STRING(target, buf);
+	} else {
+		dns_name_split(name, labels + 1, NULL, &suffix);
+		dns_name_format(&suffix, namebuf, sizeof(namebuf));
+
+		INDENT(style);
+		ADD_STRING(target, "ZONE: ");
+		if (yaml) {
+			char *s = namebuf;
+			ADD_STRING(target, "\"");
+			while (*s != 0) {
+				if (*s == '\\' || *s == '"') {
+					ADD_STRING(target, "\\");
+				}
+				if (isc_buffer_availablelength(target) < 1) {
+					result = ISC_R_NOSPACE;
+					goto cleanup;
+				}
+				isc_buffer_putmem(target, (unsigned char *)s,
+						  1);
+				s++;
+			}
+			ADD_STRING(target, "\"");
+		} else {
+			ADD_STRING(target, namebuf);
+		}
+	}
+	ADD_STRING(target, sep2);
+
+	if (!rawmode && type == 0 && isc_buffer_remaininglength(optbuf) == 4) {
+		uint32_t serial = isc_buffer_getuint32(optbuf);
+		INDENT(style);
+		ADD_STRING(target, "SOA-SERIAL: ");
+		snprintf(buf, sizeof(buf), "%u", serial);
+		ADD_STRING(target, buf);
+	} else {
+		size_t len = isc_buffer_remaininglength(optbuf);
+		unsigned char *data = isc_buffer_current(optbuf);
+		INDENT(style);
+		ADD_STRING(target, "TYPE: ");
+		snprintf(buf, sizeof(buf), "%u", type);
+		ADD_STRING(target, buf);
+		ADD_STRING(target, sep2);
+		INDENT(style);
+		ADD_STRING(target, "VALUE: ");
+		for (size_t i = 0; i < len; i++) {
+			snprintf(buf, sizeof(buf), "%02x", data[i]);
+			ADD_STRING(target, buf);
+		}
+		if (yaml) {
+			ADD_STRING(target, sep2);
+			INDENT(style);
+			ADD_STRING(target, "PVALUE: \"");
+		} else {
+			ADD_STRING(target, " (\"");
+		}
+		for (size_t i = 0; i < len; i++) {
+			if (isprint(data[i])) {
+				if (yaml && (data[i] == '\\' || data[i] == '"'))
+				{
+					ADD_STRING(target, "\\");
+				}
+				if (isc_buffer_availablelength(target) < 1) {
+					result = ISC_R_NOSPACE;
+					goto cleanup;
+				}
+				isc_buffer_putmem(target, &data[i], 1);
+			} else {
+				ADD_STRING(target, ".");
+			}
+		}
+		if (yaml) {
+			ADD_STRING(target, "\"");
+		} else {
+			ADD_STRING(target, "\")");
+		}
+		isc_buffer_forward(optbuf, len);
+	}
+cleanup:
+	return result;
+}
+
 static isc_result_t
 dns_message_pseudosectiontoyaml(dns_message_t *msg, dns_pseudosection_t section,
 				const dns_master_style_t *style,
@@ -3783,6 +3899,20 @@ dns_message_pseudosectiontoyaml(dns_message_t *msg, dns_pseudosection_t section,
 					optbuf = sb;
 				}
 				break;
+			case DNS_OPT_ZONEVERSION:
+				if (optlen >= 2U) {
+					isc_buffer_t zonebuf = optbuf;
+					isc_buffer_setactive(&zonebuf, optlen);
+					result = render_zoneversion(
+						msg, &zonebuf, style, target);
+					if (result != ISC_R_SUCCESS) {
+						goto cleanup;
+					}
+					isc_buffer_forward(&optbuf, optlen);
+					ADD_STRING(target, "\n");
+					continue;
+				}
+				break;
 			default:
 				break;
 			}
@@ -4202,6 +4332,20 @@ dns_message_pseudosectiontotext(dns_message_t *msg, dns_pseudosection_t section,
 					optbuf = sb;
 				}
 				break;
+			case DNS_OPT_ZONEVERSION:
+				if (optlen >= 2U) {
+					isc_buffer_t zonebuf = optbuf;
+					isc_buffer_setactive(&zonebuf, optlen);
+					result = render_zoneversion(
+						msg, &zonebuf, style, target);
+					if (result != ISC_R_SUCCESS) {
+						goto cleanup;
+					}
+					ADD_STRING(target, "\n");
+					isc_buffer_forward(&optbuf, optlen);
+					continue;
+				}
+				break;
 			default:
 				break;
 			}