experiment

retry fix
slight refactoring in validated()
2025-02-26 16:01:01 -08:00 · 2025-02-26 16:01:01 -08:00 · 2025-02-26 15:28:57 -08:00 · 2025-02-26 15:28:57 -08:00
175 changed files with 2385 additions and 3894 deletions
@@ -56,16 +56,6 @@ variables:
  # Some jobs may clean up the build artifacts unless this is set to 0.
  CLEAN_BUILD_ARTIFACTS_ON_SUCCESS: 1

-  # DNS Shotgun performance testing defaults
-  SHOTGUN_ROUNDS: 1
-  SHOTGUN_DURATION: 120
-  # allow unlimited improvements against baseline
-  SHOTGUN_EVAL_THRESHOLD_CPU_MIN: '-inf'
-  SHOTGUN_EVAL_THRESHOLD_MEMORY_MIN: '-inf'
-  SHOTGUN_EVAL_THRESHOLD_RCODE_MAX: '+inf'
-  SHOTGUN_EVAL_THRESHOLD_LATENCY_PCTL_MIN: '-inf'
-  SHOTGUN_EVAL_THRESHOLD_LATENCY_PCTL_DRIFT_MIN: '-inf'
-
 default:
  # Allow all running CI jobs to be automatically canceled when a new
  # version of a branch is pushed.
@@ -117,55 +107,16 @@ stages:
    - runner-manager
    - aarch64

-.freebsd-autoscaler-13-amd64-tags: &freebsd_autoscaler_13_amd64_tags
+# Autoscaling GitLab Runner on AWS EC2 (FreeBSD)
+
+.freebsd-stress-amd64: &freebsd_stress_amd64
  tags:
-    - amd64
-    - autoscaler
+    - bsd-stress-test
    - aws
-    - bsd-stress-test-1
+    - autoscaler
    - shell
    - stress-test
-
-.freebsd-autoscaler-14-amd64-tags: &freebsd_autoscaler_14_amd64_tags
-  tags:
    - amd64
-    - autoscaler
-    - aws
-    - bsd-stress-test-2
-    - shell
-    - stress-test
-
-.freebsd-autoscaler-amd64: &freebsd_autoscaler_amd64
-  variables:
-    CC: clang
-    CFLAGS: "${CFLAGS_COMMON} -Og"
-    # Even though there's only one job per runtime environment, the GitLab
-    # "instance" executor insists on cloning the Git repository to a path that
-    # contains a variable number from zero to the "maximum concurrent instances
-    # count" allowed on the GitLab Runner. See the "0" directory in this
-    # example path: /home/ec2-user/builds/t1_4FZzvz/0/isc-projects/bind9/.git/.
-    #
-    # This is not a problem for isolated jobs like "stress" tests that depend
-    # on no other jobs. However, it is a problem for jobs that need other jobs'
-    # artifacts. For example, a system test job that has its Git repo cloned to
-    # the "/1/" sub-path will fail if it downloads build job artifacts that
-    # have ./configure output files with "/0/" in its sub-path recorded.
-    GIT_CLONE_PATH: "/home/ec2-user/builds/${CI_PROJECT_PATH}/"
-    # Use MIT Kerberos5 for BIND 9 GSS-API support because of FreeBSD Heimdal
-    # incompatibility; see https://bugs.freebsd.org/275241.
-    EXTRA_CONFIGURE: "${WITH_READLINE_EDITLINE} --with-gssapi=/usr/local/bin/krb5-config"
-
-# Autoscaling GitLab Runner on AWS EC2 (FreeBSD 13)
-
-.freebsd-autoscaler-13-amd64: &freebsd_autoscaler_13_amd64
-  <<: *freebsd_autoscaler_amd64
-  <<: *freebsd_autoscaler_13_amd64_tags
-
-# Autoscaling GitLab Runner on AWS EC2 (FreeBSD 14)
-
-.freebsd-autoscaler-14-amd64: &freebsd_autoscaler_14_amd64
-  <<: *freebsd_autoscaler_amd64
-  <<: *freebsd_autoscaler_14_amd64_tags

 ### Docker Image Templates

@@ -253,6 +204,14 @@ stages:

 ### QCOW2 Image Templates

+.freebsd-13-amd64: &freebsd_13_amd64_image
+  image: "freebsd-13.4-x86_64"
+  <<: *libvirt_amd64
+
+.freebsd-14-amd64: &freebsd_14_amd64_image
+  image: "freebsd-14.2-x86_64"
+  <<: *libvirt_amd64
+
 .openbsd-amd64: &openbsd_amd64_image
  image: "openbsd-7.6-x86_64"
  <<: *libvirt_amd64
@@ -260,18 +219,31 @@ stages:
 ### Job Templates

 .api-pipelines-schedules-tags-triggers-web-triggering-rules: &api_pipelines_schedules_tags_triggers_web_triggering_rules
-  rules:
-    - if: '$CI_PIPELINE_SOURCE =~ /^(api|pipeline|schedule|trigger|web)$/'
-    - if: '$CI_COMMIT_TAG != null'
+  only:
+    - api
+    - pipelines
+    - schedules
+    - tags
+    - triggers
+    - web

 .api-pipelines-schedules-triggers-web-triggering-rules: &api_pipelines_schedules_triggers_web_triggering_rules
-  rules:
-    - if: '$CI_PIPELINE_SOURCE =~ /^(api|pipeline|schedule|trigger|web)$/'
+  only:
+    - api
+    - pipelines
+    - schedules
+    - triggers
+    - web

 .default-triggering-rules: &default_triggering_rules
-  rules:
-    - if: '$CI_PIPELINE_SOURCE =~ /^(api|merge_request_event|pipeline|schedule|trigger|web)$/'
-    - if: '$CI_COMMIT_TAG != null'
+  only:
+    - api
+    - merge_requests
+    - pipelines
+    - schedules
+    - tags
+    - triggers
+    - web

 .precheck: &precheck_job
  <<: *default_triggering_rules
@@ -371,38 +343,18 @@ stages:

 .shotgun: &shotgun_job
  <<: *base_image
+  <<: *api_pipelines_schedules_tags_triggers_web_triggering_rules
  stage: performance
-  rules:
-    - &shotgun_rule_mr
-      if: '$CI_MERGE_REQUEST_DIFF_BASE_SHA != null'
-      variables:
-        BASELINE: '$CI_MERGE_REQUEST_DIFF_BASE_SHA'
-    - &shotgun_rule_tag
-      if: '$CI_COMMIT_TAG != null'
-      variables:
-        SHOTGUN_ROUNDS: 3
-    - &shotgun_rule_other
-      if: '$CI_PIPELINE_SOURCE =~ /^(api|pipeline|schedule|trigger|web)$/'
  script:
-    - if [ -z "$BASELINE" ]; then export BASELINE=$BIND_BASELINE_VERSION; fi  # this dotenv variable can't be set in the rules section, because rules are evaluated before any jobs run
+    - if [ -z "$CI_COMMIT_TAG" ]; then export SHOTGUN_ROUNDS=1; else export SHOTGUN_ROUNDS=3; fi
    - PIPELINE_ID=$(curl -s -X POST --fail
        -F "token=$CI_JOB_TOKEN"
        -F ref=main
-        -F "variables[SHOTGUN_TEST_VERSION]=['$CI_COMMIT_REF_NAME', '$BASELINE']"
+        -F "variables[SHOTGUN_TEST_VERSION]=['$CI_COMMIT_REF_NAME', '$BIND_BASELINE_VERSION']"
        -F "variables[SHOTGUN_DURATION]=300"
        -F "variables[SHOTGUN_ROUNDS]=$SHOTGUN_ROUNDS"
        -F "variables[SHOTGUN_TRAFFIC_MULTIPLIER]=$SHOTGUN_TRAFFIC_MULTIPLIER"
        -F "variables[SHOTGUN_SCENARIO]=$SHOTGUN_SCENARIO"
-        -F "variables[SHOTGUN_EVAL_THRESHOLD_CPU_MIN]=$SHOTGUN_EVAL_THRESHOLD_CPU_MIN"
-        -F "variables[SHOTGUN_EVAL_THRESHOLD_CPU_MAX]=$SHOTGUN_EVAL_THRESHOLD_CPU_MAX"
-        -F "variables[SHOTGUN_EVAL_THRESHOLD_MEMORY_MIN]=$SHOTGUN_EVAL_THRESHOLD_MEMORY_MIN"
-        -F "variables[SHOTGUN_EVAL_THRESHOLD_MEMORY_MAX]=$SHOTGUN_EVAL_THRESHOLD_MEMORY_MAX"
-        -F "variables[SHOTGUN_EVAL_THRESHOLD_RCODE_MIN]=$SHOTGUN_EVAL_THRESHOLD_RCODE_MIN"
-        -F "variables[SHOTGUN_EVAL_THRESHOLD_RCODE_MAX]=$SHOTGUN_EVAL_THRESHOLD_RCODE_MAX"
-        -F "variables[SHOTGUN_EVAL_THRESHOLD_LATENCY_PCTL_MIN]=$SHOTGUN_EVAL_THRESHOLD_LATENCY_PCTL_MIN"
-        -F "variables[SHOTGUN_EVAL_THRESHOLD_LATENCY_PCTL_MAX]=$SHOTGUN_EVAL_THRESHOLD_LATENCY_PCTL_MAX"
-        -F "variables[SHOTGUN_EVAL_THRESHOLD_LATENCY_PCTL_DRIFT_MIN]=$SHOTGUN_EVAL_THRESHOLD_LATENCY_PCTL_DRIFT_MIN"
-        -F "variables[SHOTGUN_EVAL_THRESHOLD_LATENCY_PCTL_DRIFT_MAX]=$SHOTGUN_EVAL_THRESHOLD_LATENCY_PCTL_DRIFT_MAX"
        https://gitlab.isc.org/api/v4/projects/188/trigger/pipeline | jq .id)
    - util/ci-wait-shotgun.py $PIPELINE_ID
  needs:
@@ -559,8 +511,6 @@ misc:
    - if git grep SYSTEMTESTTOP -- ':!.gitlab-ci.yml'; then echo 'Please use relative paths instead of $SYSTEMTESTTOP.'; exit 1; fi
    - bash util/unused-headers.sh
    - bash util/xmllint-html.sh
-    # Check dangling symlinks in the repository
-    - if find . -xtype l | grep .; then exit 1; fi
  needs: []
  artifacts:
    paths:
@@ -669,8 +619,9 @@ danger:
  script:
    - pip install git+https://gitlab.isc.org/isc-projects/hazard.git
    - hazard
-  rules:
-    - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
+  only:
+    refs:
+      - merge_requests

 checkbashisms:
  <<: *precheck_job
@@ -1338,7 +1289,7 @@ gcc:tsan:
  variables:
    CC: gcc
    CFLAGS: "${CFLAGS_COMMON} -Wno-stringop-overread -ggdb -O2 -fsanitize=thread"
-    LDFLAGS: "-fsanitize=thread -Wl,--disable-new-dtags"
+    LDFLAGS: "-fsanitize=thread"
    EXTRA_CONFIGURE: "--with-libidn2 --enable-pthread-rwlock --without-jemalloc PKG_CONFIG_PATH=/opt/tsan/lib/pkgconfig"
  <<: *tsan_fedora_41_amd64_image
  <<: *build_job
@@ -1367,8 +1318,7 @@ clang:tsan:
  variables:
    CC: "${CLANG}"
    CFLAGS: "${CFLAGS_COMMON} -ggdb -O2 -fsanitize=thread"
-    # -Wl,--disable-new-dtags ensures that Clang creates valid TSAN reports
-    LDFLAGS: "-fsanitize=thread -Wl,--disable-new-dtags"
+    LDFLAGS: "-fsanitize=thread"
    EXTRA_CONFIGURE: "--with-libidn2 --enable-pthread-rwlock --without-jemalloc PKG_CONFIG_PATH=/opt/tsan/lib/pkgconfig"

 system:clang:tsan:
@@ -1447,19 +1397,27 @@ unit:clang:bookworm:amd64:
 # Jobs for Clang builds on FreeBSD 13 (amd64)

 clang:freebsd13:amd64:
+  variables:
+    CFLAGS: "${CFLAGS_COMMON}"
+    # Use MIT Kerberos5 for BIND 9 GSS-API support because of FreeBSD Heimdal
+    # incompatibility; see https://bugs.freebsd.org/275241.
+    EXTRA_CONFIGURE: "${WITH_READLINE_LIBEDIT} --with-gssapi=/usr/local/bin/krb5-config"
+    USER: gitlab-runner
+  <<: *freebsd_13_amd64_image
  <<: *build_job
-  <<: *freebsd_autoscaler_13_amd64

 system:clang:freebsd13:amd64:
+  <<: *freebsd_13_amd64_image
  <<: *system_test_job
-  <<: *freebsd_autoscaler_13_amd64
+  variables:
+    USER: gitlab-runner
  needs:
    - job: clang:freebsd13:amd64
      artifacts: true

 unit:clang:freebsd13:amd64:
+  <<: *freebsd_13_amd64_image
  <<: *unit_test_job
-  <<: *freebsd_autoscaler_13_amd64
  needs:
    - job: clang:freebsd13:amd64
      artifacts: true
@@ -1467,19 +1425,27 @@ unit:clang:freebsd13:amd64:
 # Jobs for Clang builds on FreeBSD 14 (amd64)

 clang:freebsd14:amd64:
+  variables:
+    CFLAGS: "${CFLAGS_COMMON}"
+    # Use MIT Kerberos5 for BIND 9 GSS-API support because of FreeBSD Heimdal
+    # incompatibility; see https://bugs.freebsd.org/275241.
+    EXTRA_CONFIGURE: "${WITH_READLINE_EDITLINE} --with-gssapi=/usr/local/bin/krb5-config"
+    USER: gitlab-runner
+  <<: *freebsd_14_amd64_image
  <<: *build_job
-  <<: *freebsd_autoscaler_14_amd64

 system:clang:freebsd14:amd64:
+  <<: *freebsd_14_amd64_image
  <<: *system_test_job
-  <<: *freebsd_autoscaler_14_amd64
+  variables:
+    USER: gitlab-runner
  needs:
    - job: clang:freebsd14:amd64
      artifacts: true

 unit:clang:freebsd14:amd64:
+  <<: *freebsd_14_amd64_image
  <<: *unit_test_job
-  <<: *freebsd_autoscaler_14_amd64
  needs:
    - job: clang:freebsd14:amd64
      artifacts: true
@@ -1528,8 +1494,8 @@ release:
      artifacts: true
    - job: docs
      artifacts: true
-  rules:
-    - if: '$CI_COMMIT_TAG != null'
+  only:
+    - tags
  artifacts:
    paths:
      - "*-release"
@@ -1572,8 +1538,8 @@ sign:
  needs:
    - job: release
      artifacts: true
-  rules:
-    - if: '$CI_COMMIT_TAG != null'
+  only:
+    - tags
  when: manual
  allow_failure: false

@@ -1625,8 +1591,10 @@ coverity:
      - cov-int.tar.gz
    expire_in: "1 week"
    when: on_failure
-  rules:
-    - if: '$COVERITY_SCAN_PROJECT_NAME != null && $COVERITY_SCAN_TOKEN != null'
+  only:
+    variables:
+      - $COVERITY_SCAN_PROJECT_NAME
+      - $COVERITY_SCAN_TOKEN

 # Respdiff tests

@@ -1661,9 +1629,9 @@ respdiff:tsan:
  <<: *default_triggering_rules
  <<: *tsan_debian_bookworm_amd64_image
  variables:
-    CC: "${CLANG}"
-    CFLAGS: "${CFLAGS_COMMON} -ggdb -O2 -fsanitize=thread"
-    LDFLAGS: "-fsanitize=thread -Wl,--disable-new-dtags"
+    CC: gcc
+    CFLAGS: "${CFLAGS_COMMON} -Og -fsanitize=thread"
+    LDFLAGS: "-fsanitize=thread"
    EXTRA_CONFIGURE: "--enable-pthread-rwlock --without-jemalloc PKG_CONFIG_PATH=/opt/tsan/lib/pkgconfig"
    MAX_DISAGREEMENTS_PERCENTAGE: "0.15"
    TSAN_OPTIONS: "${TSAN_OPTIONS_DEBIAN}"
@@ -1702,28 +1670,24 @@ shotgun:tcp:
  variables:
    SHOTGUN_SCENARIO: tcp
    SHOTGUN_TRAFFIC_MULTIPLIER: 13
+  when: delayed
+  start_in: 5 minutes

 shotgun:dot:
  <<: *shotgun_job
  variables:
    SHOTGUN_SCENARIO: dot
    SHOTGUN_TRAFFIC_MULTIPLIER: 6
-  rules: &shotgun_rules_manual_mr
-    - if: '$CI_MERGE_REQUEST_DIFF_BASE_SHA != null'
-      variables:
-        BASELINE: '$CI_MERGE_REQUEST_DIFF_BASE_SHA'
-      when: manual  # don't run on each MR unless requested
-      allow_failure: true
-    - *shotgun_rule_tag
-    - *shotgun_rule_other
+  when: delayed
+  start_in: 5 minutes

 shotgun:doh-get:
  <<: *shotgun_job
  variables:
    SHOTGUN_SCENARIO: doh-get
    SHOTGUN_TRAFFIC_MULTIPLIER: 3
-    SHOTGUN_EVAL_THRESHOLD_LATENCY_PCTL_MAX: 0.3  # bump from the default due to increased tail-end jitter
-  rules: *shotgun_rules_manual_mr
+  when: delayed
+  start_in: 5 minutes

 .stress-test: &stress_test
  stage: performance
@@ -1762,8 +1726,8 @@ fsck:
    - git clone https://gitlab.isc.org/isc-projects/bind9.git bind9-full-clone
    - cd bind9-full-clone/
    - git fsck
-  rules:
-    - if: '$CI_PIPELINE_SOURCE == "schedule"'
+  only:
+    - schedules
  needs: []

 gcov:
@@ -1815,8 +1779,9 @@ pairwise:
      - pairwise-model.txt
      - pairwise-output.*.txt
    when: on_failure
-  rules:
-    - if: '$PAIRWISE_TESTING != null'
+  only:
+    variables:
+      - $PAIRWISE_TESTING

 .post_merge_template: &post_merge
  <<: *base_image
@@ -1 +1 @@
-doc/arm/changelog.rst
+CHANGES
@@ -2,7 +2,11 @@ include $(top_srcdir)/Makefile.top

 SUBDIRS = . lib doc

-SUBDIRS += bin
+# build libtest before fuzz/* and bin/tests
+SUBDIRS += tests
+
+# run fuzz tests before system tests
+SUBDIRS += fuzz bin

 BUILT_SOURCES += bind.keys.h
 CLEANFILES += bind.keys.h
@@ -761,7 +761,7 @@ cleanup:
 	}

 	if (mctx != NULL) {
-		isc_mem_detach(&mctx);
+		isc_mem_destroy(&mctx);
 	}

 	return result == ISC_R_SUCCESS ? 0 : 1;
@@ -577,7 +577,7 @@ main(int argc, char **argv) {
 		fprintf(errout, "OK\n");
 	}
 	destroy();
-	isc_mem_detach(&mctx);
+	isc_mem_destroy(&mctx);

 	return (result == ISC_R_SUCCESS) ? 0 : 1;
 }
@@ -290,7 +290,7 @@ options {\n\
 		isc_mem_stats(mctx, stderr);
 	}

-	isc_mem_detach(&mctx);
+	isc_mem_destroy(&mctx);

 	return 0;
 }
@@ -296,7 +296,7 @@ nsupdate -k <keyfile>\n");
 		isc_mem_stats(mctx, stderr);
 	}

-	isc_mem_detach(&mctx);
+	isc_mem_destroy(&mctx);

 	return 0;
 }
@@ -26,12 +26,16 @@
 #include <unistd.h>

 #include <openssl/opensslv.h>
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
+#include <openssl/err.h>
+#include <openssl/provider.h>
+#endif

 #include <isc/async.h>
 #include <isc/attributes.h>
 #include <isc/base64.h>
 #include <isc/buffer.h>
-#include <isc/crypto.h>
+#include <isc/fips.h>
 #include <isc/hex.h>
 #include <isc/lib.h>
 #include <isc/log.h>
@@ -163,6 +167,10 @@ static dns_fixedname_t qfn;
 /* Default trust anchors */
 static char anchortext[] = TRUST_ANCHORS;

+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
+static OSSL_PROVIDER *fips = NULL, *base = NULL;
+#endif
+
 /*
 * Static function prototypes
 */
@@ -1611,7 +1619,24 @@ preparse_args(int argc, char **argv) {
 		while (strpbrk(option, single_dash_opts) == &option[0]) {
 			switch (option[0]) {
 			case 'F':
-				if (isc_crypto_fips_enable() != ISC_R_SUCCESS) {
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
+				fips = OSSL_PROVIDER_load(NULL, "fips");
+				if (fips == NULL) {
+					ERR_clear_error();
+					fatal("Failed to load FIPS provider");
+				}
+				base = OSSL_PROVIDER_load(NULL, "base");
+				if (base == NULL) {
+					OSSL_PROVIDER_unload(fips);
+					ERR_clear_error();
+					fatal("Failed to load base provider");
+				}
+#endif
+				/* Already in FIPS mode?  */
+				if (isc_fips_mode()) {
+					break;
+				}
+				if (isc_fips_set_mode(1) != ISC_R_SUCCESS) {
 					fatal("setting FIPS mode failed");
 				}
 				break;
@@ -2284,5 +2309,14 @@ cleanup:

 	isc_managers_destroy(&mctx, &loopmgr, &netmgr);

+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
+	if (base != NULL) {
+		OSSL_PROVIDER_unload(base);
+	}
+	if (fips != NULL) {
+		OSSL_PROVIDER_unload(fips);
+	}
+#endif
+
 	return 0;
 }
@@ -20,8 +20,8 @@
 #include <time.h>

 #include <isc/attributes.h>
-#include <isc/crypto.h>
 #include <isc/dir.h>
+#include <isc/fips.h>
 #include <isc/lib.h>
 #include <isc/loop.h>
 #include <isc/netaddr.h>
@@ -73,6 +73,14 @@ static bool short_form = false, printcmd = true, plusquest = false,
 static uint32_t splitwidth = 0xffffffff;

 #include <openssl/opensslv.h>
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
+#include <openssl/err.h>
+#include <openssl/provider.h>
+#endif
+
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
+static OSSL_PROVIDER *fips = NULL, *base = NULL;
+#endif

 /*% opcode text */
 static const char *const opcodetext[] = {
@@ -289,7 +297,6 @@ help(void) {
 	       "                                      form of answers - global "
 	       "option)\n"
 	       "                 +[no]showbadcookie  (Show BADCOOKIE message)\n"
-	       "                 +[no]showbadvers    (Show BADVERS message)\n"
 	       "                 +[no]showsearch     (Search with intermediate "
 	       "results)\n"
 	       "                 +[no]split=##       (Split hex/base64 fields "
@@ -1773,8 +1780,6 @@ plus_option(char *option, bool is_batchfile, bool *need_clone,
 						FULLCHECK("edns");
 						if (!state) {
 							lookup->edns = -1;
-							lookup->original_edns =
-								-1;
 							break;
 						}
 						if (value == NULL) {
@@ -1791,7 +1796,6 @@ plus_option(char *option, bool is_batchfile, bool *need_clone,
 							goto exit_or_usage;
 						}
 						lookup->edns = num;
-						lookup->original_edns = num;
 						break;
 					case 'f':
 						FULLCHECK("ednsflags");
@@ -2310,18 +2314,8 @@ plus_option(char *option, bool is_batchfile, bool *need_clone,
 			case 'w': /* showsearch */
 				switch (cmd[4]) {
 				case 'b':
-					switch (cmd[7]) {
-					case 'c':
-						FULLCHECK("showbadcookie");
-						lookup->showbadcookie = state;
-						break;
-					case 'v':
-						FULLCHECK("showbadvers");
-						lookup->showbadvers = state;
-						break;
-					default:
-						goto invalid_option;
-					}
+					FULLCHECK("showbadcookie");
+					lookup->showbadcookie = state;
 					break;
 				case 's':
 					FULLCHECK("showsearch");
@@ -2937,7 +2931,24 @@ preparse_args(int argc, char **argv) {
 				debugging = true;
 				break;
 			case 'F':
-				if (isc_crypto_fips_enable() != ISC_R_SUCCESS) {
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
+				fips = OSSL_PROVIDER_load(NULL, "fips");
+				if (fips == NULL) {
+					ERR_clear_error();
+					fatal("Failed to load FIPS provider");
+				}
+				base = OSSL_PROVIDER_load(NULL, "base");
+				if (base == NULL) {
+					OSSL_PROVIDER_unload(fips);
+					ERR_clear_error();
+					fatal("Failed to load base provider");
+				}
+#endif
+				/* Already in FIPS mode?  */
+				if (isc_fips_mode()) {
+					break;
+				}
+				if (isc_fips_set_mode(1) != ISC_R_SUCCESS) {
 					fatal("setting FIPS mode failed");
 				}
 				break;
@@ -3465,5 +3476,14 @@ main(int argc, char **argv) {
 	dig_startup();
 	dig_shutdown();

+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
+	if (base != NULL) {
+		OSSL_PROVIDER_unload(base);
+	}
+	if (fips != NULL) {
+		OSSL_PROVIDER_unload(fips);
+	}
+#endif
+
 	return exitcode;
 }
@@ -614,12 +614,6 @@ abbreviation is unambiguous; for example, :option:`+cd` is equivalent to
   BADCOOKIE rcode before retrying the request or not. The default
   is to not show the messages.

-.. option:: +showbadvers, +noshowbadvers
-
-   This option toggles whether to show the message containing the
-   BADVERS rcode before retrying the request or not. The default
-   is to not show the messages.
-
 .. option:: +showsearch, +noshowsearch

   This option performs [or does not perform] a search showing intermediate results.
@@ -605,7 +605,6 @@ make_empty_lookup(void) {
 		.idnout = idnout,
 		.udpsize = -1,
 		.edns = -1,
-		.original_edns = -1,
 		.recurse = true,
 		.retries = tries,
 		.comments = true,
@@ -739,7 +738,6 @@ clone_lookup(dig_lookup_t *lookold, bool servers) {
 	}

 	looknew->showbadcookie = lookold->showbadcookie;
-	looknew->showbadvers = lookold->showbadvers;
 	looknew->sendcookie = lookold->sendcookie;
 	looknew->seenbadcookie = lookold->seenbadcookie;
 	looknew->badcookie = lookold->badcookie;
@@ -766,7 +764,6 @@ clone_lookup(dig_lookup_t *lookold, bool servers) {
 	looknew->idnout = lookold->idnout;
 	looknew->udpsize = lookold->udpsize;
 	looknew->edns = lookold->edns;
-	looknew->original_edns = lookold->original_edns;
 	looknew->recurse = lookold->recurse;
 	looknew->aaonly = lookold->aaonly;
 	looknew->adflag = lookold->adflag;
@@ -1941,7 +1938,6 @@ followup_lookup(dns_message_t *msg, dig_query_t *query, dns_section_t section) {
 				}
 				domain = dns_fixedname_name(&lookup->fdomain);
 				dns_name_copy(name, domain);
-				lookup->edns = lookup->original_edns;
 			}
 			debug("adding server %s", namestr);
 			num = getaddresses(lookup, namestr, &lresult);
@@ -2460,8 +2456,7 @@ setup_lookup(dig_lookup_t *lookup) {
 			lookup->udpsize = DEFAULT_EDNS_BUFSIZE;
 		}
 		if (lookup->edns < 0) {
-			lookup->original_edns = lookup->edns =
-				DEFAULT_EDNS_VERSION;
+			lookup->edns = DEFAULT_EDNS_VERSION;
 		}

 		if (lookup->nsid) {
@@ -4305,11 +4300,6 @@ recv_done(isc_nmhandle_t *handle, isc_result_t eresult, isc_region_t *region,
 	if (msg->rcode == dns_rcode_badvers && msg->opt != NULL &&
 	    (newedns = ednsvers(msg->opt)) < l->edns && l->ednsneg)
 	{
-		if (l->showbadvers) {
-			dighost_printmessage(query, &b, msg, true);
-			dighost_received(isc_buffer_usedlength(&b), &peer,
-					 query);
-		}
 		/*
 		 * Add minimum EDNS version required checks here if needed.
 		 */
@@ -117,9 +117,9 @@ struct dig_lookup {
 		section_answer, section_authority, section_question,
 		seenbadcookie, sendcookie, servfail_stops,
 		setqid, /*% use a speciied query ID */
-		showbadcookie, showbadvers, stats, tcflag, tcp_keepalive,
-		tcp_mode, tcp_mode_set, tls_mode, /*% connect using TLS */
-		trace,				  /*% dig +trace */
+		showbadcookie, stats, tcflag, tcp_keepalive, tcp_mode,
+		tcp_mode_set, tls_mode, /*% connect using TLS */
+		trace,			/*% dig +trace */
 		trace_root, /*% initial query for either +trace or +nssearch */
 		ttlunits, use_usec, waiting_connect, zflag;
 	char textname[MXNAME]; /*% Name we're going to be looking up */
@@ -148,7 +148,6 @@ struct dig_lookup {
 	int nsfound;
 	int16_t udpsize;
 	int16_t edns;
-	int16_t original_edns;
 	int16_t padding;
 	uint32_t ixfr_serial;
 	isc_buffer_t rdatabuf;
@@ -246,7 +246,8 @@ printsection(dns_message_t *msg, dns_section_t sectionid,
 			       (list_type == dns_rdatatype_any ||
 				rdataset->type == list_type)) ||
 			      (list_addresses &&
-			       (dns_rdatatype_isaddr(rdataset->type) ||
+			       (rdataset->type == dns_rdatatype_a ||
+				rdataset->type == dns_rdatatype_aaaa ||
 				rdataset->type == dns_rdatatype_ns ||
 				rdataset->type == dns_rdatatype_ptr))))
 			{
@@ -20,6 +20,7 @@
 #include <isc/attributes.h>
 #include <isc/buffer.h>
 #include <isc/commandline.h>
+#include <isc/condition.h>
 #include <isc/lib.h>
 #include <isc/loop.h>
 #include <isc/netaddr.h>
@@ -41,14 +41,6 @@ dnssec_keygen_LDADD =		\
 	$(LDADD)		\
 	$(OPENSSL_LIBS)

-dnssec_ksr_CPPFLAGS=		\
-	$(AM_CPPFLAGS)		\
-	$(OPENSSL_CFLAGS)
-
-dnssec_ksr_LDADD =		\
-	$(LDADD)		\
-	$(OPENSSL_LIBS)
-
 dnssec_signzone_CPPFLAGS =	\
 	$(AM_CPPFLAGS)		\
 	$(OPENSSL_CFLAGS)
@@ -1075,7 +1075,7 @@ cleanup(void) {
 		if (print_mem_stats && verbose > 10) {
 			isc_mem_stats(mctx, stdout);
 		}
-		isc_mem_detach(&mctx);
+		isc_mem_destroy(&mctx);
 	}
 }

@@ -543,7 +543,7 @@ main(int argc, char **argv) {
 	if (verbose > 10) {
 		isc_mem_stats(mctx, stdout);
 	}
-	isc_mem_detach(&mctx);
+	isc_mem_destroy(&mctx);

 	fflush(stdout);
 	if (ferror(stdout)) {
@@ -456,7 +456,7 @@ main(int argc, char **argv) {
 	if (verbose > 10) {
 		isc_mem_stats(mctx, stdout);
 	}
-	isc_mem_detach(&mctx);
+	isc_mem_destroy(&mctx);

 	fflush(stdout);
 	if (ferror(stdout)) {
@@ -746,7 +746,7 @@ main(int argc, char **argv) {
 		isc_mem_stats(mctx, stdout);
 	}
 	isc_mem_free(mctx, label);
-	isc_mem_detach(&mctx);
+	isc_mem_destroy(&mctx);

 	if (freeit != NULL) {
 		free(freeit);
@@ -43,7 +43,7 @@ Options

   This option selects the cryptographic algorithm. The value of ``algorithm`` must
   be one of RSASHA1, NSEC3RSASHA1, RSASHA256, RSASHA512,
-   ECDSAP256SHA256, ECDSAP384SHA384, ED25519, ED448, or SQISIGN.
+   ECDSAP256SHA256, ECDSAP384SHA384, ED25519, or ED448.

   These values are case-insensitive. In some cases, abbreviations are
   supported, such as ECDSA256 for ECDSAP256SHA256 and ECDSA384 for
@@ -38,7 +38,7 @@
 #include <isc/attributes.h>
 #include <isc/buffer.h>
 #include <isc/commandline.h>
-#include <isc/crypto.h>
+#include <isc/fips.h>
 #include <isc/lib.h>
 #include <isc/log.h>
 #include <isc/mem.h>
@@ -58,6 +58,11 @@

 #include <dst/dst.h>

+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
+#include <openssl/err.h>
+#include <openssl/provider.h>
+#endif
+
 #include "dnssectool.h"

 const char *program = "dnssec-keygen";
@@ -146,16 +151,15 @@ usage(void) {
 	fprintf(stderr, "    -l <file>: configuration file with dnssec-policy "
 			"statement\n");
 	fprintf(stderr, "    -a <algorithm>:\n");
-	if (!isc_crypto_fips_mode()) {
+	if (!isc_fips_mode()) {
 		fprintf(stderr, "        RSASHA1 | NSEC3RSASHA1 |\n");
 	}
 	fprintf(stderr, "        RSASHA256 | RSASHA512 |\n");
 	fprintf(stderr, "        ECDSAP256SHA256 | ECDSAP384SHA384 |\n");
 	fprintf(stderr, "        ED25519 | ED448\n");
-	fprintf(stderr, "        SQISIGN\n");
 	fprintf(stderr, "    -3: use NSEC3-capable algorithm\n");
 	fprintf(stderr, "    -b <key size in bits>:\n");
-	if (!isc_crypto_fips_mode()) {
+	if (!isc_fips_mode()) {
 		fprintf(stderr, "        RSASHA1:\t[%d..%d]\n", min_rsa,
 			MAX_RSA);
 		fprintf(stderr, "        NSEC3RSASHA1:\t[%d..%d]\n", min_rsa,
@@ -167,7 +171,6 @@ usage(void) {
 	fprintf(stderr, "        ECDSAP384SHA384:\tignored\n");
 	fprintf(stderr, "        ED25519:\tignored\n");
 	fprintf(stderr, "        ED448:\tignored\n");
-	fprintf(stderr, "        SQISIGN:\tignored\n");
 	fprintf(stderr, "        (key size defaults are set according to\n"
 			"        algorithm and usage (ZSK or KSK)\n");
 	fprintf(stderr, "    -n <nametype>: ZONE | HOST | ENTITY | "
@@ -285,7 +288,7 @@ keygen(keygen_ctx_t *ctx, isc_mem_t *mctx, int argc, char **argv) {
 			fatal("unsupported algorithm: %s", algstr);
 		}

-		if (isc_crypto_fips_mode()) {
+		if (isc_fips_mode()) {
 			/* verify only in FIPS mode */
 			switch (ctx->alg) {
 			case DST_ALG_RSASHA1:
@@ -308,7 +311,6 @@ keygen(keygen_ctx_t *ctx, isc_mem_t *mctx, int argc, char **argv) {
 			case DST_ALG_ECDSA384:
 			case DST_ALG_ED25519:
 			case DST_ALG_ED448:
-			case DST_ALG_SQISIGN:
 				break;
 			default:
 				fatal("algorithm %s is incompatible with NSEC3"
@@ -339,7 +341,7 @@ keygen(keygen_ctx_t *ctx, isc_mem_t *mctx, int argc, char **argv) {
 			switch (ctx->alg) {
 			case DST_ALG_RSASHA1:
 			case DST_ALG_NSEC3RSASHA1:
-				if (isc_crypto_fips_mode()) {
+				if (isc_fips_mode()) {
 					fatal("key size not specified (-b "
 					      "option)");
 				}
@@ -359,7 +361,6 @@ keygen(keygen_ctx_t *ctx, isc_mem_t *mctx, int argc, char **argv) {
 			case DST_ALG_ECDSA384:
 			case DST_ALG_ED25519:
 			case DST_ALG_ED448:
-			case DST_ALG_SQISIGN:
 				break;
 			default:
 				fatal("key size not specified (-b option)");
@@ -500,7 +501,7 @@ keygen(keygen_ctx_t *ctx, isc_mem_t *mctx, int argc, char **argv) {
 	switch (ctx->alg) {
 	case DNS_KEYALG_RSASHA1:
 	case DNS_KEYALG_NSEC3RSASHA1:
-		if (isc_crypto_fips_mode()) {
+		if (isc_fips_mode()) {
 			fatal("SHA1 based keys not supported in FIPS mode");
 		}
 		FALLTHROUGH;
@@ -524,9 +525,6 @@ keygen(keygen_ctx_t *ctx, isc_mem_t *mctx, int argc, char **argv) {
 	case DST_ALG_ED448:
 		ctx->size = 456;
 		break;
-	case DST_ALG_SQISIGN:
-		ctx->size = 512;
-		break;
 	}

 	if (ctx->nametype == NULL) {
@@ -594,7 +592,6 @@ keygen(keygen_ctx_t *ctx, isc_mem_t *mctx, int argc, char **argv) {
 	case DST_ALG_ECDSA384:
 	case DST_ALG_ED25519:
 	case DST_ALG_ED448:
-	case DST_ALG_SQISIGN:
 		show_progress = true;
 		break;
 	}
@@ -850,6 +847,10 @@ main(int argc, char **argv) {
 	isc_textregion_t r;
 	unsigned char c;
 	int ch;
+	bool set_fips_mode = false;
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
+	OSSL_PROVIDER *fips = NULL, *base = NULL;
+#endif

 	keygen_ctx_t ctx = {
 		.options = DST_TYPE_PRIVATE | DST_TYPE_PUBLIC,
@@ -1108,9 +1109,7 @@ main(int argc, char **argv) {
 			ctx.prepub = strtottl(isc_commandline_argument);
 			break;
 		case 'F':
-			if (isc_crypto_fips_enable() != ISC_R_SUCCESS) {
-				fatal("setting FIPS mode failed");
-			}
+			set_fips_mode = true;
 			break;
 		case '?':
 			if (isc_commandline_option != '?') {
@@ -1137,11 +1136,32 @@ main(int argc, char **argv) {
 		ctx.quiet = true;
 	}

+	if (set_fips_mode) {
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
+		fips = OSSL_PROVIDER_load(NULL, "fips");
+		if (fips == NULL) {
+			ERR_clear_error();
+			fatal("Failed to load FIPS provider");
+		}
+		base = OSSL_PROVIDER_load(NULL, "base");
+		if (base == NULL) {
+			OSSL_PROVIDER_unload(fips);
+			ERR_clear_error();
+			fatal("Failed to load base provider");
+		}
+#endif
+		if (!isc_fips_mode()) {
+			if (isc_fips_set_mode(1) != ISC_R_SUCCESS) {
+				fatal("setting FIPS mode failed");
+			}
+		}
+	}
+
 	/*
 	 * The DST subsystem will set FIPS mode if requested at build time.
 	 * The minimum sizes are both raised to 2048.
 	 */
-	if (isc_crypto_fips_mode()) {
+	if (isc_fips_mode()) {
 		min_rsa = min_dh = 2048;
 	}

@@ -1288,8 +1308,16 @@ main(int argc, char **argv) {
 	if (verbose > 10) {
 		isc_mem_stats(mctx, stdout);
 	}
-	isc_mem_detach(&mctx);
+	isc_mem_destroy(&mctx);

+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
+	if (base != NULL) {
+		OSSL_PROVIDER_unload(base);
+	}
+	if (fips != NULL) {
+		OSSL_PROVIDER_unload(fips);
+	}
+#endif
 	if (freeit != NULL) {
 		free(freeit);
 	}
@@ -47,7 +47,7 @@ Options

   This option selects the cryptographic algorithm. For DNSSEC keys, the value of
   ``algorithm`` must be one of RSASHA1, NSEC3RSASHA1, RSASHA256,
-   RSASHA512, ECDSAP256SHA256, ECDSAP384SHA384, ED25519, ED448, or SQISIGN.
+   RSASHA512, ECDSAP256SHA256, ECDSAP384SHA384, ED25519, or ED448.

   These values are case-insensitive. In some cases, abbreviations are
   supported, such as ECDSA256 for ECDSAP256SHA256 and ECDSA384 for
@@ -92,7 +92,7 @@ Options
   This option specifies the key size in bits. For the algorithms RSASHA1, NSEC3RSASA1, RSASHA256, and
   RSASHA512 the key size must be between 1024 and 4096 bits; DH size is between 128
   and 4096 bits. This option is ignored for algorithms ECDSAP256SHA256,
-   ECDSAP384SHA384, ED25519, ED448, and SQISIGN.
+   ECDSAP384SHA384, ED25519, and ED448.

 .. option:: -f flag

@@ -18,7 +18,7 @@

 #include <isc/buffer.h>
 #include <isc/commandline.h>
-#include <isc/crypto.h>
+#include <isc/fips.h>
 #include <isc/lex.h>
 #include <isc/lib.h>
 #include <isc/mem.h>
@@ -362,7 +362,7 @@ create_key(ksr_ctx_t *ksr, dns_kasp_t *kasp, dns_kasp_key_t *kaspkey,
 	switch (ksr->alg) {
 	case DST_ALG_RSASHA1:
 	case DST_ALG_NSEC3RSASHA1:
-		if (isc_crypto_fips_mode()) {
+		if (isc_fips_mode()) {
 			/* verify-only in FIPS mode */
 			fatal("unsupported algorithm: %s", algstr);
 		}
@@ -387,9 +387,6 @@ create_key(ksr_ctx_t *ksr, dns_kasp_t *kasp, dns_kasp_key_t *kaspkey,
 	case DST_ALG_ED448:
 		ksr->size = 456;
 		break;
-	case DST_ALG_SQISIGN:
-		ksr->size = 512;
-		break;
 	default:
 		show_progress = false;
 		break;
@@ -1351,6 +1348,10 @@ main(int argc, char *argv[]) {
 	isc_buffer_t buf;
 	int ch;
 	char *endp;
+	bool set_fips_mode = false;
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
+	OSSL_PROVIDER *fips = NULL, *base = NULL;
+#endif
 	ksr_ctx_t ksr = {
 		.now = isc_stdtime_now(),
 	};
@@ -1370,9 +1371,7 @@ main(int argc, char *argv[]) {
 					    ksr.now, &ksr.setend);
 			break;
 		case 'F':
-			if (isc_crypto_fips_enable() != ISC_R_SUCCESS) {
-				fatal("setting FIPS mode failed");
-			}
+			set_fips_mode = true;
 			break;
 		case 'f':
 			ksr.file = isc_commandline_argument;
@@ -1426,12 +1425,31 @@ main(int argc, char *argv[]) {
 	 * The DST subsystem will set FIPS mode if requested at build time.
 	 * The minimum sizes are both raised to 2048.
 	 */
-	if (isc_crypto_fips_mode()) {
+	if (isc_fips_mode()) {
 		min_rsa = min_dh = 2048;
 	}

 	setup_logging();

+	if (set_fips_mode) {
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
+		fips = OSSL_PROVIDER_load(NULL, "fips");
+		if (fips == NULL) {
+			fatal("Failed to load FIPS provider");
+		}
+		base = OSSL_PROVIDER_load(NULL, "base");
+		if (base == NULL) {
+			OSSL_PROVIDER_unload(fips);
+			fatal("Failed to load base provider");
+		}
+#endif
+		if (!isc_fips_mode()) {
+			if (isc_fips_set_mode(1) != ISC_R_SUCCESS) {
+				fatal("setting FIPS mode failed");
+			}
+		}
+	}
+
 	/* zone */
 	namestr = argv[1];
 	name = dns_fixedname_initname(&fname);
@@ -248,7 +248,7 @@ cleanup:
 	if (dir != NULL) {
 		isc_mem_free(mctx, dir);
 	}
-	isc_mem_detach(&mctx);
+	isc_mem_destroy(&mctx);

 	return 0;
 }
@@ -949,7 +949,7 @@ main(int argc, char **argv) {
 		isc_mem_stats(mctx, stdout);
 	}
 	isc_mem_free(mctx, directory);
-	isc_mem_detach(&mctx);
+	isc_mem_destroy(&mctx);

 	return 0;
 }
@@ -42,6 +42,7 @@
 #include <isc/commandline.h>
 #include <isc/dir.h>
 #include <isc/file.h>
+#include <isc/fips.h>
 #include <isc/hash.h>
 #include <isc/hex.h>
 #include <isc/lib.h>
@@ -89,6 +90,10 @@
 #include <dns/zoneverify.h>

 #include <dst/dst.h>
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
+#include <openssl/err.h>
+#include <openssl/provider.h>
+#endif

 #include "dnssectool.h"

@@ -3375,6 +3380,10 @@ main(int argc, char *argv[]) {
 	bool set_optout = false;
 	bool set_iter = false;
 	bool nonsecify = false;
+	bool set_fips_mode = false;
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
+	OSSL_PROVIDER *fips = NULL, *base = NULL;
+#endif

 	atomic_init(&shuttingdown, false);
 	atomic_init(&finished, false);
@@ -3663,9 +3672,7 @@ main(int argc, char *argv[]) {
 			break;

 		case 'F':
-			if (isc_crypto_fips_enable() != ISC_R_SUCCESS) {
-				fatal("setting FIPS mode failed");
-			}
+			set_fips_mode = true;
 			break;

 		case '?':
@@ -3736,6 +3743,27 @@ main(int argc, char *argv[]) {

 	isc_managers_create(&mctx, nloops, &loopmgr, &netmgr);

+	if (set_fips_mode) {
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
+		fips = OSSL_PROVIDER_load(NULL, "fips");
+		if (fips == NULL) {
+			ERR_clear_error();
+			fatal("Failed to load FIPS provider");
+		}
+		base = OSSL_PROVIDER_load(NULL, "base");
+		if (base == NULL) {
+			OSSL_PROVIDER_unload(fips);
+			ERR_clear_error();
+			fatal("Failed to load base provider");
+		}
+#endif
+		if (!isc_fips_mode()) {
+			if (isc_fips_set_mode(1) != ISC_R_SUCCESS) {
+				fatal("setting FIPS mode failed");
+			}
+		}
+	}
+
 	setup_logging();

 	argc -= isc_commandline_index;
@@ -4107,6 +4135,15 @@ main(int argc, char *argv[]) {
 		isc_mem_stats(mctx, stdout);
 	}

+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
+	if (base != NULL) {
+		OSSL_PROVIDER_unload(base);
+	}
+	if (fips != NULL) {
+		OSSL_PROVIDER_unload(fips);
+	}
+#endif
+
 	isc_managers_destroy(&mctx, &loopmgr, &netmgr);

 	if (printstats) {
@@ -330,7 +330,7 @@ main(int argc, char *argv[]) {
 	if (verbose > 10) {
 		isc_mem_stats(mctx, stdout);
 	}
-	isc_mem_detach(&mctx);
+	isc_mem_destroy(&mctx);

 	return result == ISC_R_SUCCESS ? 0 : 1;
 }
@@ -736,6 +736,7 @@ controlkeylist_fromcfg(const cfg_obj_t *keylist, isc_mem_t *mctx,
 		key->secret.length = 0;
 		ISC_LINK_INIT(key, link);
 		ISC_LIST_APPEND(*keyids, key, link);
+		newstr = NULL;
 	}
 }

@@ -25,6 +25,7 @@
 #include <string.h>
 #include <unistd.h>

+#include <isc/condition.h>
 #include <isc/log.h>
 #include <isc/loop.h>
 #include <isc/mutex.h>
@@ -86,6 +86,7 @@ EXTERN named_server_t *named_g_server INIT(NULL);
 /*
 * Logging.
 */
+EXTERN bool named_g_logging	       INIT(false);
 EXTERN unsigned int named_g_debuglevel INIT(0);

 /*
@@ -52,6 +52,8 @@ named_log_init(bool safe) {
 	named_log_setdefaultsslkeylogfile(lcfg);
 	rcu_read_unlock();

+	named_g_logging = true;
+
 	return ISC_R_SUCCESS;

 cleanup:
@@ -30,6 +30,7 @@
 #include <isc/crypto.h>
 #include <isc/dir.h>
 #include <isc/file.h>
+#include <isc/fips.h>
 #include <isc/hash.h>
 #include <isc/httpd.h>
 #include <isc/lib.h>
@@ -90,6 +91,10 @@
 #include <openssl/crypto.h>
 #include <openssl/evp.h>
 #include <openssl/opensslv.h>
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
+#include <openssl/err.h>
+#include <openssl/provider.h>
+#endif
 #ifdef HAVE_LIBXML2
 #include <libxml/parser.h>
 #include <libxml/xmlversion.h>
@@ -150,13 +155,24 @@ static bool transferstuck = false;
 static bool disable6 = false;
 static bool disable4 = false;

+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
+static OSSL_PROVIDER *fips = NULL, *base = NULL;
+#endif
+
 void
 named_main_earlywarning(const char *format, ...) {
 	va_list args;

 	va_start(args, format);
-	isc_log_vwrite(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-		       ISC_LOG_WARNING, format, args);
+	if (named_g_logging) {
+		isc_log_vwrite(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
+			       ISC_LOG_WARNING, format, args);
+	} else {
+		fprintf(stderr, "%s: ", program_name);
+		vfprintf(stderr, format, args);
+		fprintf(stderr, "\n");
+		fflush(stderr);
+	}
 	va_end(args);
 }

@@ -165,10 +181,18 @@ named_main_earlyfatal(const char *format, ...) {
 	va_list args;

 	va_start(args, format);
-	isc_log_vwrite(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-		       ISC_LOG_CRITICAL, format, args);
-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-		      ISC_LOG_CRITICAL, "exiting (due to early fatal error)");
+	if (named_g_logging) {
+		isc_log_vwrite(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
+			       ISC_LOG_CRITICAL, format, args);
+		isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
+			      ISC_LOG_CRITICAL,
+			      "exiting (due to early fatal error)");
+	} else {
+		fprintf(stderr, "%s: ", program_name);
+		vfprintf(stderr, format, args);
+		fprintf(stderr, "\n");
+		fflush(stderr);
+	}
 	va_end(args);

 	_exit(EXIT_FAILURE);
@@ -185,19 +209,26 @@ assertion_failed(const char *file, int line, isc_assertiontype_t type,
 	 * Handle assertion failures.
 	 */

-	/*
-	 * Reset the assertion callback in case it is the log
-	 * routines causing the assertion.
-	 */
-	isc_assertion_setcallback(NULL);
+	if (named_g_logging) {
+		/*
+		 * Reset the assertion callback in case it is the log
+		 * routines causing the assertion.
+		 */
+		isc_assertion_setcallback(NULL);

-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-		      ISC_LOG_CRITICAL, "%s:%d: %s(%s) failed", file, line,
-		      isc_assertion_typetotext(type), cond);
-	isc_backtrace_log(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-			  ISC_LOG_CRITICAL);
-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-		      ISC_LOG_CRITICAL, "exiting (due to assertion failure)");
+		isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
+			      ISC_LOG_CRITICAL, "%s:%d: %s(%s) failed", file,
+			      line, isc_assertion_typetotext(type), cond);
+		isc_backtrace_log(NAMED_LOGCATEGORY_GENERAL,
+				  NAMED_LOGMODULE_MAIN, ISC_LOG_CRITICAL);
+		isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
+			      ISC_LOG_CRITICAL,
+			      "exiting (due to assertion failure)");
+	} else {
+		fprintf(stderr, "%s:%d: %s(%s) failed\n", file, line,
+			isc_assertion_typetotext(type), cond);
+		fflush(stderr);
+	}

 	if (named_g_coreok) {
 		abort();
@@ -216,20 +247,27 @@ library_fatal_error(const char *file, int line, const char *func,
 	 * Handle isc_error_fatal() calls from our libraries.
 	 */

-	/*
-	 * Reset the error callback in case it is the log
-	 * routines causing the assertion.
-	 */
-	isc_error_setfatal(NULL);
+	if (named_g_logging) {
+		/*
+		 * Reset the error callback in case it is the log
+		 * routines causing the assertion.
+		 */
+		isc_error_setfatal(NULL);

-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-		      ISC_LOG_CRITICAL, "%s:%d:%s(): fatal error: ", file, line,
-		      func);
-	isc_log_vwrite(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-		       ISC_LOG_CRITICAL, format, args);
-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-		      ISC_LOG_CRITICAL,
-		      "exiting (due to fatal error in library)");
+		isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
+			      ISC_LOG_CRITICAL,
+			      "%s:%d:%s(): fatal error: ", file, line, func);
+		isc_log_vwrite(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
+			       ISC_LOG_CRITICAL, format, args);
+		isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
+			      ISC_LOG_CRITICAL,
+			      "exiting (due to fatal error in library)");
+	} else {
+		fprintf(stderr, "%s:%d:%s(): fatal error: ", file, line, func);
+		vfprintf(stderr, format, args);
+		fprintf(stderr, "\n");
+		fflush(stderr);
+	}

 	if (named_g_coreok) {
 		abort();
@@ -249,11 +287,19 @@ library_unexpected_error(const char *file, int line, const char *func,
 	 * Handle isc_error_unexpected() calls from our libraries.
 	 */

-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-		      ISC_LOG_ERROR, "%s:%d:%s(): unexpected error: ", file,
-		      line, func);
-	isc_log_vwrite(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-		       ISC_LOG_ERROR, format, args);
+	if (named_g_logging) {
+		isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
+			      ISC_LOG_ERROR,
+			      "%s:%d:%s(): unexpected error: ", file, line,
+			      func);
+		isc_log_vwrite(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
+			       ISC_LOG_ERROR, format, args);
+	} else {
+		fprintf(stderr, "%s:%d:%s(): fatal error: ", file, line, func);
+		vfprintf(stderr, format, args);
+		fprintf(stderr, "\n");
+		fflush(stderr);
+	}
 }

 static void
@@ -906,7 +952,25 @@ parse_command_line(int argc, char *argv[]) {
 			named_main_earlyfatal("option '-X' has been removed");
 			break;
 		case 'F':
-			if (isc_crypto_fips_enable() != ISC_R_SUCCESS) {
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
+			fips = OSSL_PROVIDER_load(NULL, "fips");
+			if (fips == NULL) {
+				ERR_clear_error();
+				named_main_earlyfatal(
+					"Failed to load FIPS provider");
+			}
+			base = OSSL_PROVIDER_load(NULL, "base");
+			if (base == NULL) {
+				OSSL_PROVIDER_unload(fips);
+				ERR_clear_error();
+				named_main_earlyfatal(
+					"Failed to load base provider");
+			}
+#endif
+			if (isc_fips_mode()) { /* Already in FIPS mode. */
+				break;
+			}
+			if (isc_fips_set_mode(1) != ISC_R_SUCCESS) {
 				named_main_earlyfatal(
 					"setting FIPS mode failed");
 			}
@@ -1510,6 +1574,15 @@ main(int argc, char *argv[]) {

 	named_os_shutdown();

+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
+	if (base != NULL) {
+		OSSL_PROVIDER_unload(base);
+	}
+	if (fips != NULL) {
+		OSSL_PROVIDER_unload(fips);
+	}
+#endif
+
 #ifdef HAVE_GPERFTOOLS_PROFILER
 	ProfilerStop();
 #endif /* ifdef HAVE_GPERFTOOLS_PROFILER */
@@ -38,6 +38,7 @@
 #include <isc/commandline.h>
 #include <isc/dir.h>
 #include <isc/file.h>
+#include <isc/fips.h>
 #include <isc/hash.h>
 #include <isc/hex.h>
 #include <isc/hmac.h>
@@ -3762,7 +3763,7 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist, cfg_obj_t *config,
 	uint32_t maxbits;
 	unsigned int resopts = 0;
 	dns_zone_t *zone = NULL;
-	uint32_t clients_per_query, max_clients_per_query;
+	uint32_t max_clients_per_query;
 	bool empty_zones_enable;
 	const cfg_obj_t *disablelist = NULL;
 	isc_stats_t *resstats = NULL;
@@ -5168,26 +5169,15 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist, cfg_obj_t *config,
 	INSIST(result == ISC_R_SUCCESS);
 	view->v6bias = cfg_obj_asuint32(obj) * 1000;

-	obj = NULL;
-	result = named_config_get(maps, "clients-per-query", &obj);
-	INSIST(result == ISC_R_SUCCESS);
-	clients_per_query = cfg_obj_asuint32(obj);
-
 	obj = NULL;
 	result = named_config_get(maps, "max-clients-per-query", &obj);
 	INSIST(result == ISC_R_SUCCESS);
 	max_clients_per_query = cfg_obj_asuint32(obj);

-	if (max_clients_per_query < clients_per_query) {
-		cfg_obj_log(obj, ISC_LOG_WARNING,
-			    "configured clients-per-query (%u) exceeds "
-			    "max-clients-per-query (%u); automatically "
-			    "adjusting max-clients-per-query to (%u)",
-			    clients_per_query, max_clients_per_query,
-			    clients_per_query);
-		max_clients_per_query = clients_per_query;
-	}
-	dns_resolver_setclientsperquery(view->resolver, clients_per_query,
+	obj = NULL;
+	result = named_config_get(maps, "clients-per-query", &obj);
+	INSIST(result == ISC_R_SUCCESS);
+	dns_resolver_setclientsperquery(view->resolver, cfg_obj_asuint32(obj),
 					max_clients_per_query);

 	/*
@@ -9387,7 +9377,7 @@ view_loaded(void *arg) {

 		isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_SERVER,
 			      ISC_LOG_NOTICE, "FIPS mode is %s",
-			      isc_crypto_fips_mode() ? "enabled" : "disabled");
+			      isc_fips_mode() ? "enabled" : "disabled");

 #if HAVE_LIBSYSTEMD
 		sd_notifyf(0,
@@ -1603,7 +1603,7 @@ xfrin_xmlrender(dns_zone_t *zone, void *arg) {
 		isc_sockaddr_format(addrp, addr_buf, sizeof(addr_buf));
 		TRY0(xmlTextWriterWriteString(writer, ISC_XMLCHAR addr_buf));
 	} else if (is_presoa) {
-		dns_zone_getsourceaddr(zone, &addr);
+		addr = dns_zone_getsourceaddr(zone);
 		isc_sockaddr_format(&addr, addr_buf, sizeof(addr_buf));
 		TRY0(xmlTextWriterWriteString(writer, ISC_XMLCHAR addr_buf));
 	} else {
@@ -1617,13 +1617,9 @@ xfrin_xmlrender(dns_zone_t *zone, void *arg) {
 		isc_sockaddr_format(addrp, addr_buf, sizeof(addr_buf));
 		TRY0(xmlTextWriterWriteString(writer, ISC_XMLCHAR addr_buf));
 	} else if (is_presoa) {
-		if (dns_zone_getprimaryaddr(zone, &addr) == ISC_R_SUCCESS) {
-			isc_sockaddr_format(&addr, addr_buf, sizeof(addr_buf));
-			TRY0(xmlTextWriterWriteString(writer,
-						      ISC_XMLCHAR addr_buf));
-		} else {
-			TRY0(xmlTextWriterWriteString(writer, ISC_XMLCHAR "-"));
-		}
+		addr = dns_zone_getprimaryaddr(zone);
+		isc_sockaddr_format(&addr, addr_buf, sizeof(addr_buf));
+		TRY0(xmlTextWriterWriteString(writer, ISC_XMLCHAR addr_buf));
 	} else {
 		TRY0(xmlTextWriterWriteString(writer, ISC_XMLCHAR "-"));
 	}
@@ -2660,7 +2656,7 @@ xfrin_jsonrender(dns_zone_t *zone, void *arg) {
 		json_object_object_add(xfrinobj, "localaddr",
 				       json_object_new_string(addr_buf));
 	} else if (is_presoa) {
-		dns_zone_getsourceaddr(zone, &addr);
+		addr = dns_zone_getsourceaddr(zone);
 		isc_sockaddr_format(&addr, addr_buf, sizeof(addr_buf));
 		json_object_object_add(xfrinobj, "localaddr",
 				       json_object_new_string(addr_buf));
@@ -2675,15 +2671,10 @@ xfrin_jsonrender(dns_zone_t *zone, void *arg) {
 		json_object_object_add(xfrinobj, "remoteaddr",
 				       json_object_new_string(addr_buf));
 	} else if (is_presoa) {
-		if (dns_zone_getprimaryaddr(zone, &addr) == ISC_R_SUCCESS) {
-			isc_sockaddr_format(&addr, addr_buf, sizeof(addr_buf));
-			json_object_object_add(
-				xfrinobj, "remoteaddr",
-				json_object_new_string(addr_buf));
-		} else {
-			json_object_object_add(xfrinobj, "remoteaddr",
-					       json_object_new_string("-"));
-		}
+		addr = dns_zone_getprimaryaddr(zone);
+		isc_sockaddr_format(&addr, addr_buf, sizeof(addr_buf));
+		json_object_object_add(xfrinobj, "remoteaddr",
+				       json_object_new_string(addr_buf));
 	} else {
 		json_object_object_add(xfrinobj, "remoteaddr",
 				       json_object_new_string("-"));
@@ -1279,22 +1279,22 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 		obj = NULL;
 		result = named_config_get(maps, "parental-source", &obj);
 		INSIST(result == ISC_R_SUCCESS && obj != NULL);
-		dns_zone_setparentalsrc4(zone, cfg_obj_assockaddr(obj));
+		CHECK(dns_zone_setparentalsrc4(zone, cfg_obj_assockaddr(obj)));

 		obj = NULL;
 		result = named_config_get(maps, "parental-source-v6", &obj);
 		INSIST(result == ISC_R_SUCCESS && obj != NULL);
-		dns_zone_setparentalsrc6(zone, cfg_obj_assockaddr(obj));
+		CHECK(dns_zone_setparentalsrc6(zone, cfg_obj_assockaddr(obj)));

 		obj = NULL;
 		result = named_config_get(maps, "notify-source", &obj);
 		INSIST(result == ISC_R_SUCCESS && obj != NULL);
-		dns_zone_setnotifysrc4(zone, cfg_obj_assockaddr(obj));
+		CHECK(dns_zone_setnotifysrc4(zone, cfg_obj_assockaddr(obj)));

 		obj = NULL;
 		result = named_config_get(maps, "notify-source-v6", &obj);
 		INSIST(result == ISC_R_SUCCESS && obj != NULL);
-		dns_zone_setnotifysrc6(zone, cfg_obj_assockaddr(obj));
+		CHECK(dns_zone_setnotifysrc6(zone, cfg_obj_assockaddr(obj)));

 		obj = NULL;
 		result = named_config_get(maps, "notify-to-soa", &obj);
@@ -1938,12 +1938,14 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 		obj = NULL;
 		result = named_config_get(maps, "transfer-source", &obj);
 		INSIST(result == ISC_R_SUCCESS && obj != NULL);
-		dns_zone_setxfrsource4(mayberaw, cfg_obj_assockaddr(obj));
+		CHECK(dns_zone_setxfrsource4(mayberaw,
+					     cfg_obj_assockaddr(obj)));

 		obj = NULL;
 		result = named_config_get(maps, "transfer-source-v6", &obj);
 		INSIST(result == ISC_R_SUCCESS && obj != NULL);
-		dns_zone_setxfrsource6(mayberaw, cfg_obj_assockaddr(obj));
+		CHECK(dns_zone_setxfrsource6(mayberaw,
+					     cfg_obj_assockaddr(obj)));

 		obj = NULL;
 		(void)named_config_get(maps, "try-tcp-refresh", &obj);
@@ -28,7 +28,6 @@ options {
 	} except-from {
 		"example";
 	};
-	qname-minimization disabled;  // Regression test for GL #4652
 };

 trust-anchors { };
@@ -552,21 +552,16 @@ sys.exit(1)'; then
  $DIG $DIGOPTS @10.53.0.1 tsig. >dig.out.test$n.1 || ret=1
  grep "status: NOERROR" dig.out.test$n.1 >/dev/null || ret=1
  rndc_dumpdb ns1
-  # prime cache with NS response for QNAME minimisation
  grep "$pat" ns1/named_dump.db.test$n >/dev/null || ret=1
-  $DIG $DIGOPTS @10.53.0.1 NS nocookie.tsig >dig.out.test$n.2 || ret=1
-  grep "status: NOERROR" dig.out.test$n.2 >/dev/null || ret=1
  # check the disabled server response
  nextpart ns1/named.run >/dev/null
-  $DIG $DIGOPTS @10.53.0.1 nocookie.tsig >dig.out.test$n.3 || ret=1
-  grep "status: NOERROR" dig.out.test$n.3 >/dev/null || ret=1
-  grep 'A.10\.53\.0\.9' dig.out.test$n.3 >/dev/null || ret=1
-  grep 'A.10\.53\.0\.10' dig.out.test$n.3 >/dev/null || ret=1
+  $DIG $DIGOPTS @10.53.0.1 nocookie.tsig >dig.out.test$n.2 || ret=1
+  grep "status: NOERROR" dig.out.test$n.2 >/dev/null || ret=1
+  grep 'A.10\.53\.0\.9' dig.out.test$n.2 >/dev/null || ret=1
+  grep 'A.10\.53\.0\.10' dig.out.test$n.2 >/dev/null || ret=1
  nextpart ns1/named.run >named.run.test$n
  count=$(grep -c ') [0-9][0-9]* NOERROR 0' named.run.test$n)
  test $count -eq 2 || ret=1
-  count=$(grep -c '^; COOKIE: ................................' named.run.test$n)
-  test $count -eq 1 || ret=1
  if [ $ret != 0 ]; then echo_i "failed"; fi
  status=$((status + ret))
 fi
@@ -1135,16 +1135,6 @@ if [ -x "$DIG" ]; then
  grep "; EDNS: version: 0, flags:; udp: 1232" dig.out.test$n >/dev/null || ret=1
  if [ $ret -ne 0 ]; then echo_i "failed"; fi
  status=$((status + ret))
-
-  n=$((n + 1))
-  echo_i "check that dig +showbadvers works ($n)"
-  dig_with_opts @10.53.0.3 +edns=1 +qr +showbadvers a.example >dig.out.test$n 2>&1 || ret=1
-  grep "; EDNS: version: 1, flags:; udp: 1232" dig.out.test$n >/dev/null || ret=1
-  grep "; EDNS: version: 0, flags:; udp: 1232" dig.out.test$n >/dev/null || ret=1
-  grep -F "status: BADVERS" dig.out.test$n >/dev/null || ret=1
-  grep -F "status: NOERROR" dig.out.test$n >/dev/null || ret=1
-  if [ $ret -ne 0 ]; then echo_i "failed"; fi
-  status=$((status + ret))
 else
  echo_i "$DIG is needed, so skipping these dig tests"
 fi
@@ -64,7 +64,7 @@ for subdomain in digest-alg-unsupported ds-unsupported secure badds \
  kskonly update-nsec3 auto-nsec auto-nsec3 secure.below-cname \
  ttlpatch split-dnssec split-smart expired expiring upper lower \
  dnskey-unknown dnskey-unsupported dnskey-unsupported-2 \
-  dnskey-nsec3-unknown managed-future future revkey \
+  dnskey-nsec3-unknown managed-future revkey \
  dname-at-apex-nsec3 occluded rsasha1 rsasha1-1024; do
  cp "../ns3/dsset-$subdomain.example." .
 done
@@ -1,6 +0,0 @@
-; This is a key-signing key, keyid 23640, for .
-; Created: 20250310185208 (Mon Mar 10 18:52:08 2025)
-; Publish: 20250310185208 (Mon Mar 10 18:52:08 2025)
-; Activate: 20250310185208 (Mon Mar 10 18:52:08 2025)
-; Revoke: 20250310185208 (Mon Mar 10 18:52:08 2025)
-. IN DNSKEY 257 3 13 uKwpRtMH+9iuUk/Xj6LciIP5ZckaBtXaUqxUxzJYexXjvxGZGX4470Jv hq2NCI3HBZQNaCCP/h9sluhIzRGPTA==
@@ -1,7 +0,0 @@
-Private-key-format: v1.3
-Algorithm: 13 (ECDSAP256SHA256)
-PrivateKey: m5udfGNSijISQ8Tfp4kx09O1em4PErLUw/mCj3SKmqw=
-Created: 20250310185208
-Publish: 20250310185208
-Activate: 20250310185208
-Revoke: 20250310185208
@@ -1,5 +0,0 @@
-; This is a zone-signing key, keyid 23768, for .
-; Created: 20250310185208 (Mon Mar 10 18:52:08 2025)
-; Publish: 20250310185208 (Mon Mar 10 18:52:08 2025)
-; Activate: 20250310185208 (Mon Mar 10 18:52:08 2025)
-. IN DNSKEY 256 3 13 TFelYtTRBWeA9A307vvuWIcaNwW4txW4RgSELtsi46ZQs24ncRxmxtFf uJuPyVXePNiE4HNI9CIowGUsn5WuBw==
@@ -1,37 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; SPDX-License-Identifier: MPL-2.0
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0.  If a copy of the MPL was not distributed with this
-; file, you can obtain one at https://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-;	This is a zone which has two DNSKEY records, both of which have
-; existing private key files available.  They should be loaded automatically
-; and the zone correctly signed.
-;
-$TTL 30	; 30 seconds
-.			IN SOA	a.root.servers.nil. each.isc.org. (
-				2000042101 ; serial
-				600        ; refresh (10 minutes)
-				600        ; retry (10 minutes)
-				1200       ; expire (20 minutes)
-				600        ; minimum (10 minutes)
-				)
-			NS	a.root-servers.nil.
-			DNSKEY	256 3 13 (
-				TFelYtTRBWeA9A307vvuWIcaNwW4txW4RgSELtsi46ZQ
-				s24ncRxmxtFfuJuPyVXePNiE4HNI9CIowGUsn5WuBw==
-				) ; ZSK; alg = ECDSAP256SHA256 ; key id = 23768
-			DNSKEY	257 3 13 (
-				OSmhpULEDCUzHCBeDU5uJXzkCcGuW2qrkQznKRPGhRZN
-				j7ZUIGInGzM5Um5m02ULWt8tKbi55NJUeifKWegQ0g==
-				) ; KSK; alg = ECDSAP256SHA256 ; key id = 22255
-			DNSKEY	385 3 13 (
-				uKwpRtMH+9iuUk/Xj6LciIP5ZckaBtXaUqxUxzJYexXj
-				vxGZGX4470Jvhq2NCI3HBZQNaCCP/h9sluhIzRGPTA==
-				) ; revoked KSK; alg = ECDSAP256SHA256 ; key id = 23768
-a.root-servers.nil.	A	10.53.0.1
@@ -1564,18 +1564,6 @@ n=$((n + 1))
 test "$ret" -eq 0 || echo_i "failed"
 status=$((status + ret))

-echo_ic "revoked KSK ID collides with ZSK ($n)"
-ret=0
-# signing should fail, but should not coredump
-(
-  cd signer/general || exit 0
-  rm -f signed.zone
-  $SIGNER -S -f signed.zone -o . test12.zone >signer.out.$n
-) && ret=1
-n=$((n + 1))
-test "$ret" -eq 0 || echo_i "failed"
-status=$((status + ret))
-
 echo_ic "check that dnssec-signzone rejects excessive NSEC3 iterations ($n)"
 ret=0
 (
@@ -2191,7 +2179,7 @@ echo_i "checking RRSIG query from cache ($n)"
 ret=0
 dig_with_opts normalthenrrsig.secure.example. @10.53.0.4 a >/dev/null || ret=1
 ans=$(dig_with_opts +short normalthenrrsig.secure.example. @10.53.0.4 rrsig) || ret=1
-expect=$(dig_with_opts +short normalthenrrsig.secure.example. @10.53.0.3 rrsig | grep '^\(A\|NSEC\)') || ret=1
+expect=$(dig_with_opts +short normalthenrrsig.secure.example. @10.53.0.3 rrsig | grep '^A') || ret=1
 test "$ans" = "$expect" || ret=1
 # also check that RA is set
 dig_with_opts normalthenrrsig.secure.example. @10.53.0.4 rrsig >dig.out.ns4.test$n || ret=1
@@ -2871,19 +2859,6 @@ dig_with_opts +noauth expired.example. +dnssec @10.53.0.4 soa >dig.out.ns4.test$
 grep "SERVFAIL" dig.out.ns4.test$n >/dev/null || ret=1
 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n >/dev/null && ret=1
 grep "expired.example/.*: RRSIG has expired" ns4/named.run >/dev/null || ret=1
-grep "; EDE: 7 (Signature Expired): (expired.example/DNSKEY)" dig.out.ns4.test$n >/dev/null || ret=1
-n=$((n + 1))
-test "$ret" -eq 0 || echo_i "failed"
-status=$((status + ret))
-
-status=$((status + ret))
-echo_i "checking signatures in the future do not validate ($n)"
-ret=0
-dig_with_opts +noauth future.example. +dnssec @10.53.0.4 soa >dig.out.ns4.test$n || ret=1
-grep "SERVFAIL" dig.out.ns4.test$n >/dev/null || ret=1
-grep "flags:.*ad.*QUERY" dig.out.ns4.test$n >/dev/null && ret=1
-grep "future.example/.*: RRSIG validity period has not begun" ns4/named.run >/dev/null || ret=1
-grep "; EDE: 8 (Signature Not Yet Valid): (future.example/DNSKEY)" dig.out.ns4.test$n >/dev/null || ret=1
 n=$((n + 1))
 test "$ret" -eq 0 || echo_i "failed"
 status=$((status + ret))
@@ -3780,7 +3755,7 @@ status=$((status + ret))
 echo_i "checking EDE code 1 for bad alg mnemonic ($n)"
 ret=0
 dig_with_opts @10.53.0.4 badalg.secure.example >dig.out.ns4.test$n || ret=1
-grep "; EDE: 1 (Unsupported DNSKEY Algorithm): (ECDSAP256SHA256 badalg.secure.example/NSEC)" dig.out.ns4.test$n >/dev/null || ret=1
+grep "; EDE: 1 (Unsupported DNSKEY Algorithm): (ECDSAP256SHA256 badalg.secure.example/A)" dig.out.ns4.test$n >/dev/null || ret=1
 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n >/dev/null && ret=1
 n=$((n + 1))
 test "$ret" -eq 0 || echo_i "failed"
@@ -232,7 +232,9 @@ addrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
 	dns_fixedname_init(&name);
 	CHECK(dns__db_addrdataset(sampledb->db, node, version, now, rdataset,
 				  options, addedrdataset DNS__DB_FLARG_PASS));
-	if (dns_rdatatype_isaddr(rdataset->type)) {
+	if (rdataset->type == dns_rdatatype_a ||
+	    rdataset->type == dns_rdatatype_aaaa)
+	{
 		CHECK(dns_db_nodefullname(sampledb->db, node,
 					  dns_fixedname_name(&name)));
 		CHECK(syncptrs(sampledb->inst, dns_fixedname_name(&name),
@@ -261,7 +263,9 @@ subtractrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
 		goto cleanup;
 	}

-	if (dns_rdatatype_isaddr(rdataset->type)) {
+	if (rdataset->type == dns_rdatatype_a ||
+	    rdataset->type == dns_rdatatype_aaaa)
+	{
 		CHECK(dns_db_nodefullname(sampledb->db, node,
 					  dns_fixedname_name(&name)));
 		CHECK(syncptrs(sampledb->inst, dns_fixedname_name(&name),
@@ -23,7 +23,7 @@
 #include <openssl/provider.h>
 #endif

-#include <isc/crypto.h>
+#include <isc/fips.h>
 #include <isc/lib.h>
 #include <isc/md.h>
 #include <isc/mem.h>
@@ -134,7 +134,7 @@ main(int argc, char **argv) {
 		return 1;
 #endif
 #else
-		if (isc_crypto_fips_mode()) {
+		if (isc_fips_mode()) {
 #if OPENSSL_VERSION_NUMBER >= 0x30000000L
 			return 0;
 #else
@@ -149,7 +149,7 @@ main(int argc, char **argv) {
 #if defined(ENABLE_FIPS_MODE)
 		return 0;
 #else
-		return isc_crypto_fips_mode() ? 0 : 1;
+		return isc_fips_mode() ? 0 : 1;
 #endif
 	}

@@ -1,52 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * SPDX-License-Identifier: MPL-2.0
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0.  If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-options {
-	query-source address 10.53.0.5;
-	notify-source 10.53.0.5;
-	transfer-source 10.53.0.5;
-	port @PORT@;
-	directory ".";
-	pid-file "named.pid";
-	listen-on { 10.53.0.5; };
-	listen-on-v6 { none; };
-	recursion yes;
-	dnssec-validation yes;
-	notify yes;
-	stale-answer-enable yes;
-	stale-cache-enable yes;
-	stale-answer-client-timeout 0;
-	/* max-clients-per-query < clients-per-query */
-	clients-per-query 10;
-	max-clients-per-query 5;
-};
-
-trust-anchors { };
-
-server 10.53.0.4 {
-	edns no;
-};
-
-key rndc_key {
-	secret "1234abcd8765";
-	algorithm @DEFAULT_HMAC@;
-};
-
-controls {
-	inet 10.53.0.5 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
-};
-
-zone "." {
-	type hint;
-	file "root.hint";
-};
@@ -328,14 +328,5 @@ echo_i "$zspill clients spilled (expected $expected)"
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status + ret))

-n=$((n + 1))
-echo_i "checking a warning is logged if max-clients-per-query < clients-per-query ($n)"
-ret=0
-copy_setports ns5/named3.conf.in ns5/named.conf
-rndc_reconfig ns5 10.53.0.5
-wait_for_message ns5/named.run "configured clients-per-query (10) exceeds max-clients-per-query (5); automatically adjusting max-clients-per-query to (10)" || ret=1
-if [ $ret != 0 ]; then echo_i "failed"; fi
-status=$((status + ret))
-
 echo_i "exit status: $status"
 [ $status -eq 0 ] || exit 1
@@ -597,10 +597,6 @@ def test_ksr_common(servers):
            selected += 1
        if "Generating" in output:
            generated += 1
-        # Subtract if there was a key collision.
-        if "collide" in output:
-            generated -= 1
-
    assert selected == 2
    assert generated == 2
    for index, key in enumerate(overlapping_zsks):
@@ -111,7 +111,7 @@ cleanup:
 	}

 	if (mctx != NULL) {
-		isc_mem_detach(&mctx);
+		isc_mem_destroy(&mctx);
 	}

 	return result != ISC_R_SUCCESS ? 1 : 0;
@@ -385,7 +385,7 @@ $DIG $DIGOPTS @10.53.0.3 foo.initially-unavailable. A >dig.out.ns3.test$n.1 2>&1
 grep "NOERROR" dig.out.ns3.test$n.1 >/dev/null || ret=1
 grep "flags:.* ad" dig.out.ns3.test$n.1 >/dev/null || ret=1
 # Sanity check: the authoritative server should have been queried.
-nextpart ns2/named.run | grep "query 'foo.initially-unavailable/NS/IN'" >/dev/null || ret=1
+nextpart ns2/named.run | grep "query 'foo.initially-unavailable/A/IN'" >/dev/null || ret=1
 # Reconfigure ns2 so that the zone can be mirrored on ns3.
 sed '/^zone "initially-unavailable" {$/,/^};$/ {
 	s/10.53.0.254/10.53.0.3/
@@ -403,7 +403,7 @@ $DIG $DIGOPTS @10.53.0.3 foo.initially-unavailable. A >dig.out.ns3.test$n.2 2>&1
 grep "NOERROR" dig.out.ns3.test$n.2 >/dev/null || ret=1
 grep "flags:.* ad" dig.out.ns3.test$n.2 >/dev/null || ret=1
 # Ensure the authoritative server was not queried.
-nextpart ns2/named.run | grep "query 'foo.initially-unavailable/NS/IN'" >/dev/null && ret=1
+nextpart ns2/named.run | grep "query 'foo.initially-unavailable/A/IN'" >/dev/null && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status + ret))

@@ -434,7 +434,7 @@ $DIG $DIGOPTS @10.53.0.3 foo.initially-unavailable. A >dig.out.ns3.test$n 2>&1 |
 grep "NOERROR" dig.out.ns3.test$n >/dev/null || ret=1
 grep "flags:.* ad" dig.out.ns3.test$n >/dev/null || ret=1
 # Sanity check: the authoritative server should have been queried.
-nextpart ns2/named.run | grep "query 'foo.initially-unavailable/NS/IN'" >/dev/null || ret=1
+nextpart ns2/named.run | grep "query 'foo.initially-unavailable/A/IN'" >/dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status + ret))

@@ -104,10 +104,9 @@ def create_response(msg):
                r.answer.append(dns.rrset.from_text(lqname, 1, IN, TXT, "hooray"))
            elif rrtype == NS:
                # NS a.b.
-                # This is only returned if a query for b.stale/NS has been made
                r.answer.append(dns.rrset.from_text(lqname, 1, IN, NS, "ns.a.b.stale."))
                r.additional.append(
-                    dns.rrset.from_text("ns.a.b.stale.", 1, IN, A, "10.53.0.4")
+                    dns.rrset.from_text("ns.a.b.stale.", 1, IN, A, "10.53.0.3")
                )
            elif rrtype == SOA:
                # SOA a.b.
@@ -127,7 +126,7 @@ def create_response(msg):
            r.flags |= dns.flags.AA
            if rrtype == A:
                r.answer.append(
-                    dns.rrset.from_text("ns.a.b.stale.", 1, IN, A, "10.53.0.4")
+                    dns.rrset.from_text("ns.a.b.stale.", 1, IN, A, "10.53.0.3")
                )
            else:
                # NODATA.
@@ -127,14 +127,12 @@ ADDR a.bit.longer.ns.name.good.
 ADDR ns2.good.
 ADDR ns3.good.
 ADDR ns3.good.
-NS a.bit.longer.ns.name.good.
 NS bit.longer.ns.name.good.
 NS boing.good.
 NS good.
 NS longer.ns.name.good.
 NS name.good.
 NS ns.name.good.
-NS ns3.good.
 NS zoop.boing.good.
 __EOF
 cat <<__EOF | diff ans3/query.log - >/dev/null || ret=1
@@ -167,13 +165,11 @@ ADDR a.bit.longer.ns.name.good.
 ADDR ns2.good.
 ADDR ns3.good.
 ADDR ns3.good.
-NS a.bit.longer.ns.name.good.
 NS bit.longer.ns.name.good.
 NS boing.good.
 NS longer.ns.name.good.
 NS name.good.
 NS ns.name.good.
-NS ns3.good.
 NS zoop.boing.good.
 __EOF
 cat <<__EOF | diff ans3/query.log - >/dev/null || ret=1
@@ -225,7 +221,6 @@ ADDR ns3.bad.
 ADDR ns3.bad.
 NS boing.bad.
 NS name.bad.
-NS ns3.bad.
 __EOF
 cat <<__EOF | diff ans3/query.log - >/dev/null || ret=1
 ADDR icky.icky.icky.ptang.zoop.boing.bad.
@@ -276,7 +271,6 @@ ADDR ns3.ugly.
 NS boing.ugly.
 NS name.ugly.
 NS name.ugly.
-NS ns3.ugly.
 __EOF
 echo "ADDR icky.icky.icky.ptang.zoop.boing.ugly." | diff ans3/query.log - >/dev/null || ret=1
 echo "ADDR icky.icky.icky.ptang.zoop.boing.ugly." | diff ans4/query.log - >/dev/null || ret=1
@@ -308,13 +302,11 @@ ADDR a.bit.longer.ns.name.slow.
 ADDR ns2.slow.
 ADDR ns3.slow.
 ADDR ns3.slow.
-NS a.bit.longer.ns.name.slow.
 NS bit.longer.ns.name.slow.
 NS boing.slow.
 NS longer.ns.name.slow.
 NS name.slow.
 NS ns.name.slow.
-NS ns3.slow.
 NS slow.
 NS zoop.boing.slow.
 __EOF
@@ -348,7 +340,6 @@ NS 8.f.4.0.1.0.0.2.ip6.arpa.
 NS 0.0.0.0.8.f.4.0.1.0.0.2.ip6.arpa.
 NS 0.0.0.0.0.0.8.f.4.0.1.0.0.2.ip6.arpa.
 NS 0.0.0.0.0.0.0.0.8.f.4.0.1.0.0.2.ip6.arpa.
-NS 1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.8.f.4.0.1.0.0.2.ip6.arpa.
 PTR 1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.8.f.4.0.1.0.0.2.ip6.arpa.
 __EOF
 for ans in ans2 ans3 ans4; do mv -f $ans/query.log query-$ans-$n.log 2>/dev/null || true; done
@@ -371,14 +362,12 @@ ADDR a.bit.longer.ns.name.good.
 ADDR ns2.good.
 ADDR ns3.good.
 ADDR ns3.good.
-NS a.bit.longer.ns.name.good.
 NS bit.longer.ns.name.good.
 NS boing.good.
 NS good.
 NS longer.ns.name.good.
 NS name.good.
 NS ns.name.good.
-NS ns3.good.
 NS zoop.boing.good.
 __EOF
 cat <<__EOF | diff ans3/query.log - >/dev/null || ret=1
@@ -460,7 +449,6 @@ grep "a\.b\.stale\..*1.*IN.*TXT.*hooray" dig.out.test$n >/dev/null || ret=1
 sleep 1
 sort ans2/query.log >ans2/query.log.sorted
 cat <<__EOF | diff ans2/query.log.sorted - >/dev/null || ret=1
-ADDR ns.a.b.stale.
 ADDR ns.b.stale.
 ADDR ns2.stale.
 NS b.stale.
@@ -469,9 +457,7 @@ __EOF
 test -f ans3/query.log && ret=1
 sort ans4/query.log >ans4/query.log.sorted
 cat <<__EOF | diff ans4/query.log.sorted - >/dev/null || ret=1
-ADDR ns.a.b.stale.
 ADDR ns.b.stale.
-NS a.b.stale.
 NS b.stale.
 TXT a.b.stale.
 __EOF
@@ -490,7 +476,6 @@ grep "a\.b\.stale\..*1.*IN.*TXT.*hooray" dig.out.test$n >/dev/null || ret=1
 sleep 1
 sort ans2/query.log >ans2/query.log.sorted
 cat <<__EOF | diff ans2/query.log.sorted - >/dev/null || ret=1
-ADDR ns.a.b.stale.
 ADDR ns.b.stale.
 ADDR ns2.stale.
 NS b.stale.
@@ -498,9 +483,7 @@ __EOF
 test -f ans3/query.log && ret=1
 sort ans4/query.log >ans4/query.log.sorted
 cat <<__EOF | diff ans4/query.log.sorted - >/dev/null || ret=1
-ADDR ns.a.b.stale.
 ADDR ns.b.stale.
-NS a.b.stale.
 TXT a.b.stale.
 __EOF
 for ans in ans2 ans3 ans4; do mv -f $ans/query.log query-$ans-$n.log 2>/dev/null || true; done
@@ -536,7 +519,6 @@ grep "a\.b\.stale\..*1.*IN.*TXT.*hooray" dig.out.test$n >/dev/null || ret=1
 sleep 1
 sort ans2/query.log >ans2/query.log.sorted
 cat <<__EOF | diff ans2/query.log.sorted - >/dev/null || ret=1
-ADDR ns.a.b.stale.
 ADDR ns.b.stale.
 ADDR ns2.stale.
 NS b.stale.
@@ -545,9 +527,7 @@ __EOF
 test -f ans3/query.log && ret=1
 sort ans4/query.log >ans4/query.log.sorted
 cat <<__EOF | diff ans4/query.log.sorted - >/dev/null || ret=1
-ADDR ns.a.b.stale.
 ADDR ns.b.stale.
-NS a.b.stale.
 NS b.stale.
 TXT a.b.stale.
 __EOF
@@ -566,7 +546,6 @@ grep "a\.b\.stale\..*1.*IN.*TXT.*hooray" dig.out.test$n >/dev/null || ret=1
 sleep 1
 sort ans2/query.log >ans2/query.log.sorted
 cat <<__EOF | diff ans2/query.log.sorted - >/dev/null || ret=1
-ADDR ns.a.b.stale.
 ADDR ns.b.stale.
 ADDR ns2.stale.
 NS b.stale.
@@ -574,9 +553,7 @@ __EOF
 test -f ans3/query.log && ret=1
 sort ans4/query.log >ans4/query.log.sorted
 cat <<__EOF | diff ans4/query.log.sorted - >/dev/null || ret=1
-ADDR ns.a.b.stale.
 ADDR ns.b.stale.
-NS a.b.stale.
 TXT a.b.stale.
 __EOF
 for ans in ans2 ans3 ans4; do mv -f $ans/query.log query-$ans-$n.log 2>/dev/null || true; done
@@ -9,9 +9,9 @@
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.

-$TTL 120
+$TTL 60

-big.		IN	SOA	ns.big. hostmaster.ns.big. 1 0 0 0 120
+big.		IN	SOA	ns.big. hostmaster.ns.big. 1 0 0 0 60
 big.		IN	NS	ns.big.
 ns.big.		IN	A	10.53.0.1

@@ -280,11 +280,11 @@ echo_i "checking that priority names under the max-types-per-name limit get cach

 # Query for NXDOMAIN for items on our priority list - these should get cached
 for rrtype in AAAA MX NS; do
-  check_manytypes 1 manytypes.big "${rrtype}" NOERROR big SOA 120 || ret=1
+  check_manytypes 1 manytypes.big "${rrtype}" NOERROR big SOA 60 || ret=1
 done
 # Wait at least 1 second
 for rrtype in AAAA MX NS; do
-  check_manytypes 2 manytypes.big "${rrtype}" NOERROR big SOA "" 120 || ret=1
+  check_manytypes 2 manytypes.big "${rrtype}" NOERROR big SOA "" 60 || ret=1
 done

 if [ $ret -ne 0 ]; then echo_i "failed"; fi
@@ -299,13 +299,13 @@ echo_i "checking that NXDOMAIN names under the max-types-per-name limit get cach

 # Query for 10 NXDOMAIN types
 for ntype in $(seq 65270 65279); do
-  check_manytypes 1 manytypes.big "TYPE${ntype}" NOERROR big SOA 120 || ret=1
+  check_manytypes 1 manytypes.big "TYPE${ntype}" NOERROR big SOA 60 || ret=1
 done
 # Wait at least 1 second
 sleep 1
 # Query for 10 NXDOMAIN types again - these should be cached
 for ntype in $(seq 65270 65279); do
-  check_manytypes 2 manytypes.big "TYPE${ntype}" NOERROR big SOA "" 120 || ret=1
+  check_manytypes 2 manytypes.big "TYPE${ntype}" NOERROR big SOA "" 60 || ret=1
 done

 if [ $ret -ne 0 ]; then echo_i "failed"; fi
@@ -318,13 +318,13 @@ echo_i "checking that existing names under the max-types-per-name limit get cach

 # Limited to 10 types - these should be cached and the previous record should be evicted
 for ntype in $(seq 65280 65289); do
-  check_manytypes 1 manytypes.big "TYPE${ntype}" NOERROR manytypes.big "TYPE${ntype}" 120 || ret=1
+  check_manytypes 1 manytypes.big "TYPE${ntype}" NOERROR manytypes.big "TYPE${ntype}" 60 || ret=1
 done
 # Wait at least one second
 sleep 1
 # Limited to 10 types - these should be cached
 for ntype in $(seq 65280 65289); do
-  check_manytypes 2 manytypes.big "TYPE${ntype}" NOERROR manytypes.big "TYPE${ntype}" "" 120 || ret=1
+  check_manytypes 2 manytypes.big "TYPE${ntype}" NOERROR manytypes.big "TYPE${ntype}" "" 60 || ret=1
 done

 if [ $ret -ne 0 ]; then echo_i "failed"; fi
@@ -356,11 +356,11 @@ echo_i "checking that priority NXDOMAIN names over the max-types-per-name limit

 # Query for NXDOMAIN for items on our priority list - these should get cached
 for rrtype in AAAA MX NS; do
-  check_manytypes 1 manytypes.big "${rrtype}" NOERROR big SOA 120 || ret=1
+  check_manytypes 1 manytypes.big "${rrtype}" NOERROR big SOA 60 || ret=1
 done
 # Wait at least 1 second
 for rrtype in AAAA MX NS; do
-  check_manytypes 2 manytypes.big "${rrtype}" NOERROR big SOA "" 120 || ret=1
+  check_manytypes 2 manytypes.big "${rrtype}" NOERROR big SOA "" 60 || ret=1
 done

 if [ $ret -ne 0 ]; then echo_i "failed"; fi
@@ -372,11 +372,11 @@ ret=0
 echo_i "checking that priority name over the max-types-per-name get cached ($n)"

 # Query for an item on our priority list - it should get cached
-check_manytypes 1 manytypes.big "A" NOERROR manytypes.big A 120 || ret=1
+check_manytypes 1 manytypes.big "A" NOERROR manytypes.big A 60 || ret=1
 # Wait at least 1 second
 sleep 1
 # Query the same name again - it should be in the cache
-check_manytypes 2 manytypes.big "A" NOERROR big manytypes.A "" 120 || ret=1
+check_manytypes 2 manytypes.big "A" NOERROR big manytypes.A "" 60 || ret=1

 if [ $ret -ne 0 ]; then echo_i "failed"; fi
 status=$((status + ret))
@@ -389,7 +389,7 @@ ret=0
 echo_i "checking that priority name over the max-types-per-name don't get evicted ($n)"

 # Query for an item on our priority list - it should get cached
-check_manytypes 1 manytypes.big "A" NOERROR manytypes.big A 120 || ret=1
+check_manytypes 1 manytypes.big "A" NOERROR manytypes.big A 60 || ret=1
 # Query for 10 more types - this should not evict A record
 for ntype in $(seq 65280 65289); do
  check_manytypes 1 manytypes.big "TYPE${ntype}" NOERROR manytypes.big || ret=1
@@ -397,9 +397,9 @@ done
 # Wait at least 1 second
 sleep 1
 # Query the same name again - it should be in the cache
-check_manytypes 2 manytypes.big "A" NOERROR manytypes.big A "" 120 || ret=1
+check_manytypes 2 manytypes.big "A" NOERROR manytypes.big A "" 60 || ret=1
 # This one was first in the list and should have been evicted
-check_manytypes 2 manytypes.big "TYPE65280" NOERROR manytypes.big TYPE65280 120 || ret=1
+check_manytypes 2 manytypes.big "TYPE65280" NOERROR manytypes.big TYPE65280 60 || ret=1

 if [ $ret -ne 0 ]; then echo_i "failed"; fi
 status=$((status + ret))
@@ -413,21 +413,21 @@ echo_i "checking that non-priority types cause eviction ($n)"

 # Everything on top of that will cause the cache eviction
 for ntype in $(seq 65280 65299); do
-  check_manytypes 1 manytypes.big "TYPE${ntype}" NOERROR manytypes.big "TYPE${ntype}" 120 || ret=1
+  check_manytypes 1 manytypes.big "TYPE${ntype}" NOERROR manytypes.big "TYPE${ntype}" 60 || ret=1
 done
 # Wait at least one second
 sleep 1
-# These should have TTL != 120 now
+# These should have TTL != 60 now
 for ntype in $(seq 65290 65299); do
-  check_manytypes 2 manytypes.big "TYPE${ntype}" NOERROR manytypes.big "TYPE${ntype}" "" 120 || ret=1
+  check_manytypes 2 manytypes.big "TYPE${ntype}" NOERROR manytypes.big "TYPE${ntype}" "" 60 || ret=1
 done
 # These should have been evicted
 for ntype in $(seq 65280 65289); do
-  check_manytypes 3 manytypes.big "TYPE${ntype}" NOERROR manytypes.big "TYPE${ntype}" 120 || ret=1
+  check_manytypes 3 manytypes.big "TYPE${ntype}" NOERROR manytypes.big "TYPE${ntype}" 60 || ret=1
 done
 # These should have been evicted by the previous block
 for ntype in $(seq 65290 65299); do
-  check_manytypes 4 manytypes.big "TYPE${ntype}" NOERROR manytypes.big "TYPE${ntype}" 120 || ret=1
+  check_manytypes 4 manytypes.big "TYPE${ntype}" NOERROR manytypes.big "TYPE${ntype}" 60 || ret=1
 done

 if [ $ret -ne 0 ]; then echo_i "failed"; fi
@@ -442,25 +442,25 @@ echo_i "checking that signed names under the max-types-per-name limit get cached

 # Go through the 10 items, this should result in 20 items (type + rrsig(type))
 for ntype in $(seq 65280 65289); do
-  check_manytypes 1 manytypes.signed "TYPE${ntype}" NOERROR manytypes.signed "TYPE${ntype}" 120 || ret=1
+  check_manytypes 1 manytypes.signed "TYPE${ntype}" NOERROR manytypes.signed "TYPE${ntype}" 60 || ret=1
 done

 # Wait at least one second
 sleep 1

-# These should have TTL != 120 now
+# These should have TTL != 60 now
 for ntype in $(seq 65285 65289); do
-  check_manytypes 2 manytypes.signed "TYPE${ntype}" NOERROR manytypes.signed "TYPE${ntype}" "" 120 || ret=1
+  check_manytypes 2 manytypes.signed "TYPE${ntype}" NOERROR manytypes.signed "TYPE${ntype}" "" 60 || ret=1
 done

 # These should have been evicted
 for ntype in $(seq 65280 65284); do
-  check_manytypes 3 manytypes.signed "TYPE${ntype}" NOERROR manytypes.signed "TYPE${ntype}" 120 || ret=1
+  check_manytypes 3 manytypes.signed "TYPE${ntype}" NOERROR manytypes.signed "TYPE${ntype}" 60 || ret=1
 done

 # These should have been evicted by the previous block
 for ntype in $(seq 65285 65289); do
-  check_manytypes 4 manytypes.signed "TYPE${ntype}" NOERROR manytypes.signed "TYPE${ntype}" 120 || ret=1
+  check_manytypes 4 manytypes.signed "TYPE${ntype}" NOERROR manytypes.signed "TYPE${ntype}" 60 || ret=1
 done

 if [ $ret -ne 0 ]; then echo_i "failed"; fi
@@ -475,12 +475,12 @@ echo_i "checking that lifting the limit will allow everything to get cached ($n)
 ns3_reset ns3/named6.conf.in

 for ntype in $(seq 65280 65534); do
-  check_manytypes 1 manytypes.big "TYPE${ntype}" NOERROR manytypes.big "TYPE${ntype}" 120 || ret=1
+  check_manytypes 1 manytypes.big "TYPE${ntype}" NOERROR manytypes.big "TYPE${ntype}" 60 || ret=1
 done
 # Wait at least one second
 sleep 1
 for ntype in $(seq 65280 65534); do
-  check_manytypes 2 manytypes.big "TYPE${ntype}" NOERROR manytypes.big "TYPE${ntype}" "" 120 || ret=1
+  check_manytypes 2 manytypes.big "TYPE${ntype}" NOERROR manytypes.big "TYPE${ntype}" "" 60 || ret=1
 done

 if [ $ret -ne 0 ]; then echo_i "failed"; fi
@@ -24,6 +24,5 @@ copy_setports ns5/named.conf.in ns5/named.conf
 copy_setports ns6/named.conf.in ns6/named.conf
 copy_setports ns7/named1.conf.in ns7/named.conf
 copy_setports ns9/named.conf.in ns9/named.conf
-copy_setports ns11/named.conf.in ns11/named.conf

 (cd ns6 && $SHELL keygen.sh)
@@ -729,10 +729,10 @@ if ${FEATURETEST} --enable-querytrace; then
  grep "status: SERVFAIL" dig.ns5.out.${n} >/dev/null || ret=1
  check_namedrun() {
    nextpartpeek ns5/named.run >nextpart.out.${n}
-    grep 'resolving tcpalso.no-questions/NS for [^:]*: empty question section, accepting it anyway as TC=1' nextpart.out.${n} >/dev/null || return 1
-    grep '(tcpalso.no-questions/NS): connecting via TCP' nextpart.out.${n} >/dev/null || return 1
-    grep 'resolving tcpalso.no-questions/NS for [^:]*: empty question section$' nextpart.out.${n} >/dev/null || return 1
-    grep '(tcpalso.no-questions/NS): nextitem' nextpart.out.${n} >/dev/null || return 1
+    grep 'resolving tcpalso.no-questions/A for [^:]*: empty question section, accepting it anyway as TC=1' nextpart.out.${n} >/dev/null || return 1
+    grep '(tcpalso.no-questions/A): connecting via TCP' nextpart.out.${n} >/dev/null || return 1
+    grep 'resolving tcpalso.no-questions/A for [^:]*: empty question section$' nextpart.out.${n} >/dev/null || return 1
+    grep '(tcpalso.no-questions/A): nextitem' nextpart.out.${n} >/dev/null || return 1
    return 0
  }
  retry_quiet 12 check_namedrun || ret=1
@@ -1015,14 +1015,5 @@ ttl=$(awk '{print $2}' dig.ns1.out.${n})
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status + ret))

-n=$((n + 1))
-echo_i "client requests recursion but it is disabled - expect EDE 20 code with REFUSED($n)"
-ret=0
-dig_with_opts +recurse www.isc.org @10.53.0.11 a >dig.out.ns11.test${n} || ret=1
-grep "status: REFUSED" dig.out.ns11.test${n} >/dev/null || ret=1
-grep -F "EDE: 20 (Not Authoritative)" dig.out.ns11.test${n} >/dev/null || ret=1
-if [ $ret != 0 ]; then echo_i "failed"; fi
-status=$((status + ret))
-
 echo_i "exit status: $status"
 [ $status -eq 0 ] || exit 1
@@ -102,23 +102,6 @@ def test_rpz_passthru_logging():
        dns.rrset.from_text("allowed.", 300, "IN", "A", "10.53.0.2")
    ]

-    # Should also generate a log entry into rpz_passthru.txt
-    msg_allowed_any = dns.message.make_query("allowed.", "ANY")
-    res_allowed_any = isctest.query.udp(
-        msg_allowed_any,
-        resolver_ip,
-        source="10.53.0.1",
-        expected_rcode=dns.rcode.NOERROR,
-    )
-    assert res_allowed_any.answer == [
-        dns.rrset.from_text("allowed.", 300, "IN", "A", "10.53.0.2"),
-        dns.rrset.from_text("allowed.", 300, "IN", "NS", "ns1.allowed."),
-    ]
-    # The comparison above doesn't compare the TTL values, and we want to
-    # make sure that the "passthru" rpz doesn't cap the TTL with max-policy-ttl.
-    assert res_allowed_any.answer[0].ttl > 200
-    assert res_allowed_any.answer[1].ttl > 200
-
    # baddomain.com isn't allowed (CNAME .), should return NXDOMAIN
    # Should generate a log entry into rpz.txt
    msg_not_allowed = dns.message.make_query("baddomain.", "A")
@@ -140,7 +140,7 @@ main(int argc, char **argv) {
 	printf("%s\n", filename);
 	dst_key_free(&key);

-	isc_mem_detach(&mctx);
+	isc_mem_destroy(&mctx);
 	return 0;
 }

@@ -115,12 +115,10 @@ sleep 2
 # stale for somewhere between 3500-3599 seconds.
 echo_i "check rndc dump stale data.example ($n)"
 rndc_dumpdb ns1 || ret=1
-# add in inherited owner names
-awk '$1 ~ /^[0-9][0-9]*$/ { $0 = last " " $0 } $1 != ";" { last = $1 } { print }' ns1/named_dump.db.test$n >named_dump.db.test$n
-awk '/; stale since [0-9]*/ { x=$0; getline; print x, $0}' named_dump.db.test$n \
+awk '/; stale since [0-9]*/ { x=$0; getline; print x, $0}' ns1/named_dump.db.test$n \
  | grep "; stale since [0-9]* data\.example.*3[56]...*TXT.*A text record with a 2 second ttl" >/dev/null 2>&1 || ret=1
 # Also make sure the not expired data does not have a stale comment.
-awk '/; authanswer/ { x=$0; getline; print x, $0}' named_dump.db.test$n \
+awk '/; authanswer/ { x=$0; getline; print x, $0}' ns1/named_dump.db.test$n \
  | grep "; authanswer longttl\.example.*[56]...*TXT.*A text record with a 600 second ttl" >/dev/null 2>&1 || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status + ret))
@@ -1666,15 +1664,16 @@ status=$((status + ret))
 # Check that expired records are dumped.
 echo_i "check rndc dump expired data.example ($n)"
 ret=0
-# add in inherited owner names
-awk '$1 ~ /^[0-9][0-9]*$/ { $0 = last " " $0 } $1 != ";" { last = $1 } { print }' ns5/named_dump.db.test$n >named_dump.db.test$n
-# extract expired records
-awk '/; expired/ { x=$0; getline; print x, $0}' named_dump.db.test$n >expired.test$n
-grep "; expired (awaiting cleanup) data\.example\..*A text record with a 2 second ttl" expired.test$n >/dev/null 2>&1 || ret=1
-grep "; expired (awaiting cleanup) nodata\.example\." expired.test$n >/dev/null 2>&1 || ret=1
-grep "; expired (awaiting cleanup) nxdomain\.example\." expired.test$n >/dev/null 2>&1 || ret=1
+awk '/; expired/ { x=$0; getline; print x, $0}' ns5/named_dump.db.test$n \
+  | grep "; expired (awaiting cleanup) data\.example\..*A text record with a 2 second ttl" >/dev/null 2>&1 || ret=1
+awk '/; expired/ { x=$0; getline; print x, $0}' ns5/named_dump.db.test$n \
+  | grep "; expired (awaiting cleanup) nodata\.example\." >/dev/null 2>&1 || ret=1
+awk '/; expired/ { x=$0; getline; print x, $0}' ns5/named_dump.db.test$n \
+  | grep "; expired (awaiting cleanup) nxdomain\.example\." >/dev/null 2>&1 || ret=1
+awk '/; expired/ { x=$0; getline; print x, $0}' ns5/named_dump.db.test$n \
+  | grep "; expired (awaiting cleanup) othertype\.example\." >/dev/null 2>&1 || ret=1
 # Also make sure the not expired data does not have an expired comment.
-awk '/; authanswer/ { x=$0; getline; print x, $0}' named_dump.db.test$n \
+awk '/; authanswer/ { x=$0; getline; print x, $0}' ns5/named_dump.db.test$n \
  | grep "; authanswer longttl\.example.*A text record with a 600 second ttl" >/dev/null 2>&1 || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status + ret))
@@ -14,8 +14,6 @@ import pytest
 pytestmark = pytest.mark.extra_artifacts(
    [
        "dig.out.*",
-        "expired.test*",
-        "named_dump.db.test*",
        "rndc.out.*",
        "ans*/ans.run",
        "ns*/named.stats*",
@@ -234,7 +234,7 @@ sub construct_ns_command {
 		$command = "taskset $taskset $NAMED ";
 	} elsif ($ENV{'USE_RR'}) {
 		$ENV{'_RR_TRACE_DIR'} = ".";
-		$command = "$ENV{'TOP_BUILDDIR'}/libtool --mode=execute rr record --chaos $NAMED ";
+		$command = "rr record --chaos $NAMED ";
 	} else {
 		$command = "$NAMED ";
 	}
@@ -414,10 +414,10 @@ for ns in 2 4 5 6; do
  check_status NOERROR dig.out.ns${ns}.test$n || ret=1
  if [ ${synth} = yes ]; then
    check_synth_cname b.wild-cname.example. dig.out.ns${ns}.test$n || ret=1
-    nextpart ns1/named.run | grep b.wild-cname.example/NS >/dev/null && ret=1
+    nextpart ns1/named.run | grep b.wild-cname.example/A >/dev/null && ret=1
  else
    check_nosynth_cname b.wild-cname.example. dig.out.ns${ns}.test$n || ret=1
-    nextpart ns1/named.run | grep b.wild-cname.example/NS >/dev/null || ret=1
+    nextpart ns1/named.run | grep b.wild-cname.example/A >/dev/null || ret=1
  fi
  grep "ns1.example.*.IN.A" dig.out.ns${ns}.test$n >/dev/null || ret=1
  digcomp wildcname.out dig.out.ns${ns}.test$n || ret=1
@@ -470,7 +470,6 @@ for ns in 2 4 5 6; do
  check_nosynth_aaaa b.wild-2-nsec-afterdata.example. dig.out.a.ns${ns}.test$n || ret=1
  #
  nextpart ns1/named.run >/dev/null
-  sleep 1
  dig_with_opts b.wild-2-nsec-afterdata.example. @10.53.0.${ns} TLSA >dig.out.ns${ns}.test$n || ret=1
  check_ad_flag $ad dig.out.ns${ns}.test$n || ret=1
  check_status NOERROR dig.out.ns${ns}.test$n || ret=1
@@ -532,7 +531,7 @@ for ns in 2 4 5 6; do
  check_ad_flag no dig.out.ns${ns}.test$n || ret=1
  check_status NOERROR dig.out.ns${ns}.test$n || ret=1
  check_nosynth_cname b.wild-cname.insecure.example dig.out.ns${ns}.test$n || ret=1
-  nextpart ns1/named.run | grep b.wild-cname.insecure.example/NS >/dev/null || ret=1
+  nextpart ns1/named.run | grep b.wild-cname.insecure.example/A >/dev/null || ret=1
  grep "ns1.insecure.example.*.IN.A" dig.out.ns${ns}.test$n >/dev/null || ret=1
  digcomp insecure.wildcname.out dig.out.ns${ns}.test$n || ret=1
  n=$((n + 1))
@@ -260,7 +260,7 @@ main(int argc, char *argv[]) {
 	if (printmemstats) {
 		isc_mem_stats(mctx, stdout);
 	}
-	isc_mem_detach(&mctx);
+	isc_mem_destroy(&mctx);

 	return 0;
 }
@@ -425,7 +425,7 @@ cleanup:
 	if (message != NULL) {
 		dns_message_detach(&message);
 	}
-	isc_mem_detach(&mctx);
+	isc_mem_destroy(&mctx);

 	exit(rv);
 }
@@ -61,7 +61,7 @@ cleanup(void) {
 		isc_lex_destroy(&lex);
 	}
 	if (mctx != NULL) {
-		isc_mem_detach(&mctx);
+		isc_mem_destroy(&mctx);
 	}
 }

@@ -37,7 +37,23 @@
 # anchor information for the root zone.

 trust-anchors {
-	. initial-key 257 3 17
-	"3+O0xDZt9XYR4BA8bjXcN3JilnpLpDHIUxN26v08rQFa8pyWZCM1kMRg
-	YKN+n/zZcd7fq2KUplqISyiT6CGeASM=";
+        # This key (20326) was published in the root zone in 2017, and
+        # is scheduled to be phased out starting in 2025. It will remain
+        # in the root zone until some time after its successor key has
+        # been activated. It will remain this file until it is removed
+        # from the root zone.
+
+        . initial-key 257 3 8 "AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3
+                +/4RgWOq7HrxRixHlFlExOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kv
+                ArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgCmr3EgVLrjyBxWezF
+                0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+e
+                oZG+SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfd
+                RUfhHdY6+cn8HFRm+2hM8AnXGXws9555KrUB5qihylGa8subX2Nn6UwN
+                R1AkUTV74bU=";
+        # This key (38696) will be pre-published in the root zone in 2025
+        # and is scheduled to begin signing in late 2026. At that time,
+        # servers which were already using the old key (20326) should roll
+        # seamlessly to this new one via RFC 5011 rollover.
+        . initial-ds 38696 8 2 "683D2D0ACB8C9B712A1948B27F741219298D0A450D612C483AF444A
+        4C0FB2B16";
 };
@@ -16,7 +16,7 @@
 #
 m4_define([bind_VERSION_MAJOR], 9)dnl
 m4_define([bind_VERSION_MINOR], 21)dnl
-m4_define([bind_VERSION_PATCH], 7)dnl
+m4_define([bind_VERSION_PATCH], 6)dnl
 m4_define([bind_VERSION_EXTRA], -dev)dnl
 m4_define([bind_DESCRIPTION], [(Development Release)])dnl
 m4_define([bind_SRCID], [m4_esyscmd_s([git rev-parse --short HEAD | cut -b1-7])])dnl
@@ -690,9 +690,6 @@ AX_RESTORE_FLAGS([openssl])
 AC_SUBST([OPENSSL_CFLAGS])
 AC_SUBST([OPENSSL_LIBS])

-AC_SUBST([SQISIGN_CFLAGS])
-AC_SUBST([SQISIGN_LIBS])
-		 
 AC_CHECK_FUNCS([clock_gettime])

 # [pairwise: --with-gssapi=yes, --with-gssapi=auto, --without-gssapi]
@@ -889,6 +886,31 @@ AC_CHECK_HEADERS([execinfo.h],
 		 [AC_SEARCH_LIBS([backtrace_symbols], [execinfo],
 				 [AC_CHECK_FUNCS([backtrace_symbols])])])

+#
+# We do the IPv6 compilation checking after libtool so that we can put
+# the right suffix on the files.
+#
+AC_MSG_CHECKING([for IPv6 structures])
+AC_COMPILE_IFELSE(
+  [AC_LANG_PROGRAM(
+     [[
+       #include <sys/types.h>
+       #include <sys/socket.h>
+       #include <netinet/in.h>
+     ]],
+     [[
+       struct sockaddr_in6 sin6;
+       struct in6_addr in6;
+       struct in6_pktinfo in6_pi;
+       struct sockaddr_storage storage;
+       in6 = in6addr_any;
+       in6 = in6addr_loopback;
+       sin6.sin6_scope_id = 0;
+       return (0);
+     ]])],
+  [AC_MSG_RESULT([yes])],
+  [AC_MSG_FAILURE([IPv6 support is mandatory])])
+
 #
 # Allow forcibly disabling TCP Fast Open support as autodetection might yield
 # confusing results on some systems (e.g. FreeBSD; see set_tcp_fastopen()
@@ -1595,11 +1617,6 @@ if test "yes" != "$silent"; then
 	report
 fi

-install -m 644 contrib/sqisign/libsqisign_lvl1.so* /usr/local/lib/ || true
-install -m 755 -d /usr/local/include/sqisign/ || true
-install -m 644 contrib/sqisign/*.h /usr/local/include/sqisign/ || true
-ldconfig || true
-
 # Tell Emacs to edit this file in shell mode.
 # Local Variables:
 # mode: sh
@@ -1 +0,0 @@
-libsqisign_lvl1.so.2
@@ -1,24 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-
-#ifndef MEM_H
-#define MEM_H
-#include <stddef.h>
-#include <sqisign_namespace.h>
-
-/**
- * Clears and frees allocated memory.
- *
- * @param[out] mem Memory to be cleared and freed.
- * @param size Size of memory to be cleared and freed.
- */
-void sqisign_secure_free(void *mem, size_t size);
-
-/**
- * Clears memory.
- *
- * @param[out] mem Memory to be cleared.
- * @param size Size of memory to be cleared.
- */
-void sqisign_secure_clear(void *mem, size_t size);
-
-#endif
@@ -1,43 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-
-#ifndef rng_h
-#define rng_h
-
-#include <sqisign_namespace.h>
-
-/**
- * Randombytes initialization.
- * Initialization may be needed for some random number generators (e.g. CTR-DRBG).
- *
- * @param[in] entropy_input 48 bytes entropy input
- * @param[in] personalization_string Personalization string
- * @param[in] security_strength Security string
- */
-SQISIGN_API
-void randombytes_init(unsigned char *entropy_input,
-                      unsigned char *personalization_string,
-                      int security_strength);
-
-/**
- * Random byte generation using /dev/urandom.
- * The caller is responsible to allocate sufficient memory to hold x.
- *
- * @param[out] x Memory to hold the random bytes.
- * @param[in] xlen Number of random bytes to be generated
- * @return int 0 on success, -1 otherwise
- */
-SQISIGN_API
-int randombytes_select(unsigned char *x, unsigned long long xlen);
-
-/**
- * Random byte generation.
- * The caller is responsible to allocate sufficient memory to hold x.
- *
- * @param[out] x Memory to hold the random bytes.
- * @param[in] xlen Number of random bytes to be generated
- * @return int 0 on success, -1 otherwise
- */
-SQISIGN_API
-int randombytes(unsigned char *x, unsigned long long xlen);
-
-#endif /* rng_h */
@@ -1,85 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-
-#ifndef SQISIGN_H
-#define SQISIGN_H
-
-#include <stdint.h>
-#include <sqisign_namespace.h>
-
-#if defined(ENABLE_SIGN)
-/**
- * SQIsign keypair generation.
- *
- * The implementation corresponds to SQIsign.CompactKeyGen() in the SQIsign spec.
- * The caller is responsible to allocate sufficient memory to hold pk and sk.
- *
- * @param[out] pk SQIsign public key
- * @param[out] sk SQIsign secret key
- * @return int status code
- */
-SQISIGN_API 
-int sqisign_keypair(unsigned char *pk, unsigned char *sk);
-
-/**
- * SQIsign signature generation.
- *
- * The implementation performs SQIsign.expandSK() + SQIsign.sign() in the SQIsign spec.
- * Keys provided is a compacted secret keys.
- * The caller is responsible to allocate sufficient memory to hold sm.
- *
- * @param[out] sm Signature concatenated with message
- * @param[out] smlen Pointer to the length of sm
- * @param[in] m Message to be signed
- * @param[in] mlen Message length
- * @param[in] sk Compacted secret key
- * @return int status code
- */
-SQISIGN_API 
-int sqisign_sign(unsigned char *sm,
-                 unsigned long long *smlen,
-                 const unsigned char *m,
-                 unsigned long long mlen,
-                 const unsigned char *sk);
-#endif
-
-/**
- * SQIsign open signature.
- *
- * The implementation performs SQIsign.verify(). If the signature verification succeeded, the
- * original message is stored in m. Keys provided is a compact public key. The caller is responsible
- * to allocate sufficient memory to hold m.
- *
- * @param[out] m Message stored if verification succeeds
- * @param[out] mlen Pointer to the length of m
- * @param[in] sm Signature concatenated with message
- * @param[in] smlen Length of sm
- * @param[in] pk Compacted public key
- * @return int status code
- */
-SQISIGN_API
-int sqisign_open(unsigned char *m,
-                 unsigned long long *mlen,
-                 const unsigned char *sm,
-                 unsigned long long smlen,
-                 const unsigned char *pk);
-
-/**
- * SQIsign verify signature.
- *
- * If the signature verification succeeded, returns 0, otherwise 1.
- *
- * @param[out] m Message stored if verification succeeds
- * @param[out] mlen Pointer to the length of m
- * @param[in] sig Signature
- * @param[in] siglen Length of sig
- * @param[in] pk Compacted public key
- * @return int 0 if verification succeeded, 1 otherwise.
- */
-SQISIGN_API 
-int sqisign_verify(const unsigned char *m,
-                   unsigned long long mlen,
-                   const unsigned char *sig,
-                   unsigned long long siglen,
-                   const unsigned char *pk);
-
-#endif
@@ -3660,13 +3660,9 @@ system.
   after 20 minutes if it has remained unchanged.

   If :any:`max-clients-per-query` is set to zero, there is no upper bound, other
-   than that imposed by :any:`recursive-clients`. If the option is set to a
-   lower value than :any:`clients-per-query`, the value is adjusted to
-   :any:`clients-per-query`.
-
-   If :any:`clients-per-query` is set to zero, :any:`max-clients-per-query` no
-   longer applies and there is no upper bound, other than that imposed by
-   :any:`recursive-clients`.
+   than that imposed by :any:`recursive-clients`. If :any:`clients-per-query` is
+   set to zero, :any:`max-clients-per-query` no longer applies and there is no
+   upper bound, other than that imposed by :any:`recursive-clients`.

 .. namedconf:statement:: max-validations-per-fetch
   :tags: server
@@ -154,7 +154,7 @@ main(int argc, char **argv) {
 	if (memstats) {
 		isc_mem_stats(mctx, stderr);
 	}
-	isc_mem_detach(&mctx);
+	isc_mem_destroy(&mctx);

 	fflush(stdout);
 	if (ferror(stdout)) {
@@ -74,6 +74,6 @@ LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {

 end:
 	dns_db_detach(&db);
-	isc_mem_detach(&mctx);
+	isc_mem_destroy(&mctx);
 	return 0;
 }
@@ -211,7 +211,7 @@ LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
 	}

 	dns_qp_destroy(&qp);
-	isc_mem_detach(&mctx);
+	isc_mem_destroy(&mctx);
 	isc_mem_checkdestroyed(stderr);

 	for (size_t i = 0; i < ARRAY_SIZE(item); i++) {
@@ -145,6 +145,6 @@ LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
 cleanup:
 	isc_lex_close(lex);
 	isc_lex_destroy(&lex);
-	isc_mem_detach(&mctx);
+	isc_mem_destroy(&mctx);
 	return 0;
 }
@@ -239,7 +239,6 @@ libdns_la_SOURCES =			\
 	sdlz.c				\
 	skr.c				\
 	soa.c				\
-	sqisignhd_link.c		\
 	ssu.c				\
 	ssu_external.c			\
 	stats.c				\
@@ -275,8 +274,7 @@ libdns_la_CPPFLAGS =		\
 	$(LIBISC_CFLAGS)	\
 	$(LIBURCU_CFLAGS)	\
 	$(LIBUV_CFLAGS)		\
-	$(OPENSSL_CFLAGS)	\
-	-I/usr/local/include/sqisign
+	$(OPENSSL_CFLAGS)

 libdns_la_LDFLAGS =		\
 	$(AM_LDFLAGS)		\
@@ -286,8 +284,7 @@ libdns_la_LIBADD =		\
 	$(LIBISC_LIBS)		\
 	$(LIBURCU_LIBS)		\
 	$(LIBUV_LIBS)		\
-	$(OPENSSL_LIBS)		\
-	-L/usr/local/lib -lsqisign_lvl1
+	$(OPENSSL_LIBS)

 if HAVE_JSON_C
 libdns_la_CPPFLAGS +=		\
@@ -567,7 +567,15 @@ import_rdataset(dns_adbname_t *adbname, dns_rdataset_t *rdataset,
 		rdataset->ttl = ttlclamp(rdataset->ttl);
 	}

-	REQUIRE(dns_rdatatype_isaddr(rdtype));
+if (rdtype != dns_rdatatype_a && rdtype != dns_rdatatype_aaaa) {
+char rb[DNS_RDATATYPE_FORMATSIZE];
+char nb[DNS_NAME_FORMATSIZE];
+dns_rdatatype_format(rdtype, rb, sizeof(rb));
+dns_name_format(adbname->name, nb, sizeof(nb));
+isc_log_write(DNS_LOGCATEGORY_RESOLVER, DNS_LOGMODULE_RESOLVER, ISC_LOG_NOTICE,
+	      "%s has %s", nb, rb);
+}
+	REQUIRE(rdtype == dns_rdatatype_a || rdtype == dns_rdatatype_aaaa);

 	for (result = dns_rdataset_first(rdataset); result == ISC_R_SUCCESS;
 	     result = dns_rdataset_next(rdataset))
@@ -2557,7 +2565,7 @@ dbfind_name(dns_adbname_t *adbname, isc_stdtime_t now, dns_rdatatype_t rdtype) {
 	adb = adbname->adb;

 	REQUIRE(DNS_ADB_VALID(adb));
-	REQUIRE(dns_rdatatype_isaddr(rdtype));
+	REQUIRE(rdtype == dns_rdatatype_a || rdtype == dns_rdatatype_aaaa);

 	fname = dns_fixedname_initname(&foundname);
 	dns_rdataset_init(&rdataset);
@@ -1516,7 +1516,8 @@ catz_process_primaries(dns_catz_zone_t *catz, dns_ipkeylist_t *ipkl,
 	}
 	/* else - 'simple' case - without labels */

-	if (!dns_rdatatype_isaddr(value->type)) {
+	if (value->type != dns_rdatatype_a && value->type != dns_rdatatype_aaaa)
+	{
 		return ISC_R_FAILURE;
 	}

@@ -265,7 +265,8 @@ dns_dnssec_sign(const dns_name_t *name, dns_rdataset_t *set, dst_key_t *key,
 		goto cleanup_databuf;
 	}

-	ret = dst_context_create(key, mctx, DNS_LOGCATEGORY_DNSSEC, true, &ctx);
+	ret = dst_context_create(key, mctx, DNS_LOGCATEGORY_DNSSEC, true, 0,
+				 &ctx);
 	if (ret != ISC_R_SUCCESS) {
 		goto cleanup_databuf;
 	}
@@ -460,7 +461,7 @@ dns_dnssec_verify(const dns_name_t *name, dns_rdataset_t *set, dst_key_t *key,

 again:
 	ret = dst_context_create(key, mctx, DNS_LOGCATEGORY_DNSSEC, false,
-				 &ctx);
+				 maxbits, &ctx);
 	if (ret != ISC_R_SUCCESS) {
 		goto cleanup_struct;
 	}
@@ -553,7 +554,7 @@ again:

 	r.base = sig.signature;
 	r.length = sig.siglen;
-	ret = dst_context_verify(ctx, maxbits, &r);
+	ret = dst_context_verify2(ctx, maxbits, &r);
 	if (ret == ISC_R_SUCCESS && downcase) {
 		char namebuf[DNS_NAME_FORMATSIZE];
 		dns_name_format(&sig.signer, namebuf, sizeof(namebuf));
@@ -810,7 +811,7 @@ dns_dnssec_signmessage(dns_message_t *msg, dst_key_t *key) {

 	isc_buffer_init(&databuf, data, sizeof(data));

-	RETERR(dst_context_create(key, mctx, DNS_LOGCATEGORY_DNSSEC, true,
+	RETERR(dst_context_create(key, mctx, DNS_LOGCATEGORY_DNSSEC, true, 0,
 				  &ctx));

 	/*
@@ -962,7 +963,7 @@ dns_dnssec_verifymessage(isc_buffer_t *source, dns_message_t *msg,
 		goto failure;
 	}

-	RETERR(dst_context_create(key, mctx, DNS_LOGCATEGORY_DNSSEC, false,
+	RETERR(dst_context_create(key, mctx, DNS_LOGCATEGORY_DNSSEC, false, 0,
 				  &ctx));

 	/*
@@ -1008,7 +1009,7 @@ dns_dnssec_verifymessage(isc_buffer_t *source, dns_message_t *msg,

 	sig_r.base = sig.signature;
 	sig_r.length = sig.siglen;
-	result = dst_context_verify(ctx, 0, &sig_r);
+	result = dst_context_verify(ctx, &sig_r);
 	if (result != ISC_R_SUCCESS) {
 		msg->sig0status = dns_tsigerror_badsig;
 		goto failure;
@@ -1427,35 +1428,29 @@ addkey(dns_dnsseckeylist_t *keylist, dst_key_t **newkey, bool savekeys,

 	if (key != NULL) {
 		/*
-		 * Found a match. If we already had a private key, then
-		 * the new key can't be an improvement. If the existing
-		 * key was public-only but the new key is too, then it's
-		 * still not an improvement. Mark the old key as having
-		 * been found in the zone and stop.
+		 * Found a match.  If the old key was only public and the
+		 * new key is private, replace the old one; otherwise
+		 * leave it.  But either way, mark the key as having
+		 * been found in the zone.
 		 */
-		if (dst_key_isprivate(key->key) || !dst_key_isprivate(*newkey))
-		{
-			key->source = dns_keysource_zoneapex;
-			return;
+		if (dst_key_isprivate(key->key)) {
+			dst_key_free(newkey);
+		} else if (dst_key_isprivate(*newkey)) {
+			dst_key_free(&key->key);
+			key->key = *newkey;
 		}

-		/*
-		 * However, if the old key was public-only, and the new key
-		 * is private, then we're throwing away the old key.
-		 */
-		dst_key_free(&key->key);
-		ISC_LIST_UNLINK(*keylist, key, link);
-		dns_dnsseckey_destroy(mctx, &key);
+		key->source = dns_keysource_zoneapex;
+		return;
 	}

-	/* Store the new key. */
 	dns_dnsseckey_create(mctx, newkey, &key);
-	key->source = dns_keysource_zoneapex;
 	key->pubkey = pubkey_only;
 	if (key->legacy || savekeys) {
 		key->force_publish = true;
 		key->force_sign = dst_key_isprivate(key->key);
 	}
+	key->source = dns_keysource_zoneapex;
 	ISC_LIST_APPEND(*keylist, key, link);
 	*newkey = NULL;
 }
@@ -38,9 +38,9 @@
 #include <unistd.h>

 #include <isc/buffer.h>
-#include <isc/crypto.h>
 #include <isc/dir.h>
 #include <isc/file.h>
+#include <isc/fips.h>
 #include <isc/lex.h>
 #include <isc/mem.h>
 #include <isc/once.h>
@@ -213,8 +213,6 @@ dst__lib_initialize(void) {
 	dst__openssleddsa_init(&dst_t_func[DST_ALG_ED448], DST_ALG_ED448);
 #endif /* ifdef HAVE_OPENSSL_ED448 */

-	dst__sqisign_init(&dst_t_func[DST_ALG_SQISIGN], DST_ALG_SQISIGN);
-
 #if HAVE_GSSAPI
 	dst__gssapi_init(&dst_t_func[DST_ALG_GSSAPI]);
 #endif /* HAVE_GSSAPI */
@@ -222,7 +220,13 @@ dst__lib_initialize(void) {

 void
 dst__lib_shutdown(void) {
-	isc_mem_detach(&dst__mctx);
+	for (size_t i = 0; i < DST_MAX_ALGS; i++) {
+		if (dst_t_func[i] != NULL && dst_t_func[i]->cleanup != NULL) {
+			dst_t_func[i]->cleanup();
+		}
+	}
+
+	isc_mem_destroy(&dst__mctx);
 }

 bool
@@ -242,7 +246,7 @@ dst_ds_digest_supported(unsigned int digest_type) {

 isc_result_t
 dst_context_create(dst_key_t *key, isc_mem_t *mctx, isc_logcategory_t category,
-		   bool useforsigning, dst_context_t **dctxp) {
+		   bool useforsigning, int maxbits, dst_context_t **dctxp) {
 	dst_context_t *dctx;
 	isc_result_t result;

@@ -250,7 +254,7 @@ dst_context_create(dst_key_t *key, isc_mem_t *mctx, isc_logcategory_t category,
 	REQUIRE(mctx != NULL);
 	REQUIRE(dctxp != NULL && *dctxp == NULL);

-	if (key->func->createctx == NULL) {
+	if (key->func->createctx == NULL && key->func->createctx2 == NULL) {
 		return DST_R_UNSUPPORTEDALG;
 	}
 	if (key->keydata.generic == NULL) {
@@ -265,7 +269,11 @@ dst_context_create(dst_key_t *key, isc_mem_t *mctx, isc_logcategory_t category,

 	dst_key_attach(key, &dctx->key);
 	isc_mem_attach(mctx, &dctx->mctx);
-	result = key->func->createctx(key, dctx);
+	if (key->func->createctx2 != NULL) {
+		result = key->func->createctx2(key, maxbits, dctx);
+	} else {
+		result = key->func->createctx(key, dctx);
+	}
 	if (result != ISC_R_SUCCESS) {
 		if (dctx->key != NULL) {
 			dst_key_free(&dctx->key);
@@ -328,7 +336,7 @@ dst_context_sign(dst_context_t *dctx, isc_buffer_t *sig) {
 }

 isc_result_t
-dst_context_verify(dst_context_t *dctx, int maxbits, isc_region_t *sig) {
+dst_context_verify(dst_context_t *dctx, isc_region_t *sig) {
 	REQUIRE(VALID_CTX(dctx));
 	REQUIRE(sig != NULL);

@@ -336,12 +344,57 @@ dst_context_verify(dst_context_t *dctx, int maxbits, isc_region_t *sig) {
 	if (dctx->key->keydata.generic == NULL) {
 		return DST_R_NULLKEY;
 	}
-
 	if (dctx->key->func->verify == NULL) {
 		return DST_R_NOTPUBLICKEY;
 	}

-	return dctx->key->func->verify(dctx, maxbits, sig);
+	return dctx->key->func->verify(dctx, sig);
+}
+
+isc_result_t
+dst_context_verify2(dst_context_t *dctx, unsigned int maxbits,
+		    isc_region_t *sig) {
+	REQUIRE(VALID_CTX(dctx));
+	REQUIRE(sig != NULL);
+
+	CHECKALG(dctx->key->key_alg);
+	if (dctx->key->keydata.generic == NULL) {
+		return DST_R_NULLKEY;
+	}
+	if (dctx->key->func->verify == NULL && dctx->key->func->verify2 == NULL)
+	{
+		return DST_R_NOTPUBLICKEY;
+	}
+
+	return dctx->key->func->verify2 != NULL
+		       ? dctx->key->func->verify2(dctx, maxbits, sig)
+		       : dctx->key->func->verify(dctx, sig);
+}
+
+isc_result_t
+dst_key_computesecret(const dst_key_t *pub, const dst_key_t *priv,
+		      isc_buffer_t *secret) {
+	REQUIRE(VALID_KEY(pub) && VALID_KEY(priv));
+	REQUIRE(secret != NULL);
+
+	CHECKALG(pub->key_alg);
+	CHECKALG(priv->key_alg);
+
+	if (pub->keydata.generic == NULL || priv->keydata.generic == NULL) {
+		return DST_R_NULLKEY;
+	}
+
+	if (pub->key_alg != priv->key_alg || pub->func->computesecret == NULL ||
+	    priv->func->computesecret == NULL)
+	{
+		return DST_R_KEYCANNOTCOMPUTESECRET;
+	}
+
+	if (!dst_key_isprivate(priv)) {
+		return DST_R_NOTPRIVATEKEY;
+	}
+
+	return pub->func->computesecret(pub, priv, secret);
 }

 isc_result_t
@@ -1267,6 +1320,24 @@ dst_key_pubcompare(const dst_key_t *key1, const dst_key_t *key2,
 	return comparekeys(key1, key2, match_revoked_key, pub_compare);
 }

+bool
+dst_key_paramcompare(const dst_key_t *key1, const dst_key_t *key2) {
+	REQUIRE(VALID_KEY(key1));
+	REQUIRE(VALID_KEY(key2));
+
+	if (key1 == key2) {
+		return true;
+	}
+	if (key1->key_alg == key2->key_alg &&
+	    key1->func->paramcompare != NULL &&
+	    key1->func->paramcompare(key1, key2))
+	{
+		return true;
+	} else {
+		return false;
+	}
+}
+
 void
 dst_key_attach(dst_key_t *source, dst_key_t **target) {
 	REQUIRE(target != NULL && *target == NULL);
@@ -1349,9 +1420,6 @@ dst_key_sigsize(const dst_key_t *key, unsigned int *n) {
 	case DST_ALG_ED448:
 		*n = DNS_SIG_ED448SIZE;
 		break;
-	case DST_ALG_SQISIGN:
-		*n = DNS_SIG_SQISIGNSIZE;
-		break;
 	case DST_ALG_HMACMD5:
 		*n = isc_md_type_get_size(ISC_MD_MD5);
 		break;
@@ -1837,7 +1905,6 @@ issymmetric(const dst_key_t *key) {
 	case DST_ALG_ECDSA384:
 	case DST_ALG_ED25519:
 	case DST_ALG_ED448:
-	case DST_ALG_SQISIGN:
 		return false;
 	case DST_ALG_HMACMD5:
 	case DST_ALG_HMACSHA1:
@@ -98,10 +98,6 @@ struct dst_key {
 			EVP_PKEY *pub;
 			EVP_PKEY *priv;
 		} pkeypair;
-		struct {
-			uint8_t *pub;
-			uint8_t *priv;
-		} keypair;
 	} keydata; /*%< pointer to key in crypto pkg fmt */

 	isc_stdtime_t times[DST_MAX_TIMES + 1]; /*%< timing metadata */
@@ -154,6 +150,8 @@ struct dst_func {
 	 * Context functions
 	 */
 	isc_result_t (*createctx)(dst_key_t *key, dst_context_t *dctx);
+	isc_result_t (*createctx2)(dst_key_t *key, int maxbits,
+				   dst_context_t *dctx);
 	void (*destroyctx)(dst_context_t *dctx);
 	isc_result_t (*adddata)(dst_context_t *dctx, const isc_region_t *data);

@@ -161,9 +159,14 @@ struct dst_func {
 	 * Key operations
 	 */
 	isc_result_t (*sign)(dst_context_t *dctx, isc_buffer_t *sig);
-	isc_result_t (*verify)(dst_context_t *dctx, int maxbits,
-			       const isc_region_t *sig);
+	isc_result_t (*verify)(dst_context_t *dctx, const isc_region_t *sig);
+	isc_result_t (*verify2)(dst_context_t *dctx, int maxbits,
+				const isc_region_t *sig);
+	isc_result_t (*computesecret)(const dst_key_t *pub,
+				      const dst_key_t *priv,
+				      isc_buffer_t *secret);
 	bool (*compare)(const dst_key_t *key1, const dst_key_t *key2);
+	bool (*paramcompare)(const dst_key_t *key1, const dst_key_t *key2);
 	isc_result_t (*generate)(dst_key_t *key, int parms,
 				 void (*callback)(int));
 	bool (*isprivate)(const dst_key_t *key);
@@ -175,6 +178,9 @@ struct dst_func {
 	isc_result_t (*tofile)(const dst_key_t *key, const char *directory);
 	isc_result_t (*parse)(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub);

+	/* cleanup */
+	void (*cleanup)(void);
+
 	isc_result_t (*fromlabel)(dst_key_t *key, const char *label,
 				  const char *pin);
 	isc_result_t (*dump)(dst_key_t *key, isc_mem_t *mctx, char **buffer,
@@ -207,8 +213,6 @@ dst__openssleddsa_init(struct dst_func **funcp, unsigned char algorithm);
 void
 dst__gssapi_init(struct dst_func **funcp);
 #endif /* HAVE_GSSAPI*/
-void
-dst__sqisign_init(dst_func_t **funcp, unsigned char algorithm);

 /*%
 * Secure private file handling
@@ -90,9 +90,6 @@ static struct parse_map map[] = { { TAG_RSA_MODULUS, "Modulus:" },
 				  { TAG_EDDSA_ENGINE, "Engine:" },
 				  { TAG_EDDSA_LABEL, "Label:" },

-				  { TAG_SQISIGN_PUBLICKEY, "PublicKey:" },
-				  { TAG_SQISIGN_SECRETKEY, "SecretKey:" },
-
 				  { TAG_HMACMD5_KEY, "Key:" },
 				  { TAG_HMACMD5_BITS, "Bits:" },

@@ -163,24 +160,19 @@ find_numericdata(const char *s) {
 	return find_metadata(s, numerictags, NUMERIC_NTAGS);
 }

-static isc_result_t
-check_external(const dst_private_t *priv) {
-	if (priv->nelements == 0) {
-		return ISC_R_SUCCESS;
-	}
-
-	return DST_R_INVALIDPRIVATEKEY;
-}
-
-static isc_result_t
+static int
 check_rsa(const dst_private_t *priv, bool external) {
 	int i, j;
-	bool have[RSA_NTAGS] = { 0 };
+	bool have[RSA_NTAGS];
 	bool ok;
-	unsigned int mask = (1ULL << TAG_SHIFT) - 1;
+	unsigned int mask;

 	if (external) {
-		return check_external(priv);
+		return (priv->nelements == 0) ? 0 : -1;
+	}
+
+	for (i = 0; i < RSA_NTAGS; i++) {
+		have[i] = false;
 	}

 	for (j = 0; j < priv->nelements; j++) {
@@ -190,11 +182,13 @@ check_rsa(const dst_private_t *priv, bool external) {
 			}
 		}
 		if (i == RSA_NTAGS) {
-			return DST_R_INVALIDPRIVATEKEY;
+			return -1;
 		}
 		have[i] = true;
 	}

+	mask = (1ULL << TAG_SHIFT) - 1;
+
 	if (have[TAG_RSA_LABEL & mask]) {
 		ok = have[TAG_RSA_MODULUS & mask] &&
 		     have[TAG_RSA_PUBLICEXPONENT & mask];
@@ -208,23 +202,23 @@ check_rsa(const dst_private_t *priv, bool external) {
 		     have[TAG_RSA_EXPONENT2 & mask] &&
 		     have[TAG_RSA_COEFFICIENT & mask];
 	}
-	if (!ok) {
-		return DST_R_INVALIDPRIVATEKEY;
-	}
-
-	return ISC_R_SUCCESS;
+	return ok ? 0 : -1;
 }

 static int
 check_ecdsa(const dst_private_t *priv, bool external) {
 	int i, j;
-	bool have[ECDSA_NTAGS] = { 0 };
-	unsigned int mask = (1ULL << TAG_SHIFT) - 1;
+	bool have[ECDSA_NTAGS];
+	bool ok;
+	unsigned int mask;

 	if (external) {
-		return check_external(priv);
+		return (priv->nelements == 0) ? 0 : -1;
 	}

+	for (i = 0; i < ECDSA_NTAGS; i++) {
+		have[i] = false;
+	}
 	for (j = 0; j < priv->nelements; j++) {
 		for (i = 0; i < ECDSA_NTAGS; i++) {
 			if (priv->elements[j].tag == TAG(DST_ALG_ECDSA256, i)) {
@@ -232,26 +226,27 @@ check_ecdsa(const dst_private_t *priv, bool external) {
 			}
 		}
 		if (i == ECDSA_NTAGS) {
-			return DST_R_INVALIDPRIVATEKEY;
+			return -1;
 		}
 		have[i] = true;
 	}

-	if (have[TAG_ECDSA_LABEL & mask] || have[TAG_ECDSA_PRIVATEKEY & mask]) {
-		return ISC_R_SUCCESS;
-	}
+	mask = (1ULL << TAG_SHIFT) - 1;

-	return DST_R_INVALIDPRIVATEKEY;
+	ok = have[TAG_ECDSA_LABEL & mask] || have[TAG_ECDSA_PRIVATEKEY & mask];
+
+	return ok ? 0 : -1;
 }

 static int
 check_eddsa(const dst_private_t *priv, bool external) {
 	int i, j;
 	bool have[EDDSA_NTAGS];
+	bool ok;
 	unsigned int mask;

 	if (external) {
-		return check_external(priv);
+		return (priv->nelements == 0) ? 0 : -1;
 	}

 	for (i = 0; i < EDDSA_NTAGS; i++) {
@@ -264,51 +259,16 @@ check_eddsa(const dst_private_t *priv, bool external) {
 			}
 		}
 		if (i == EDDSA_NTAGS) {
-			return DST_R_INVALIDPRIVATEKEY;
+			return -1;
 		}
 		have[i] = true;
 	}

 	mask = (1ULL << TAG_SHIFT) - 1;

-	if (have[TAG_EDDSA_LABEL & mask] || have[TAG_EDDSA_PRIVATEKEY & mask]) {
-		return ISC_R_SUCCESS;
-	}
+	ok = have[TAG_EDDSA_LABEL & mask] || have[TAG_EDDSA_PRIVATEKEY & mask];

-	return DST_R_INVALIDPRIVATEKEY;
-}
-
-static int
-check_sqisignhd(const dst_private_t *priv, bool external) {
-	bool have[SQISIGN_NTAGS] = { 0 };
-	unsigned int mask;
-
-	if (external) {
-		return check_external(priv);
-	}
-
-	for (size_t j = 0; j < priv->nelements; j++) {
-		size_t i;
-		for (i = 0; i < SQISIGN_NTAGS; i++) {
-			if (priv->elements[j].tag == TAG(DST_ALG_SQISIGN, i)) {
-				break;
-			}
-		}
-		if (i == SQISIGN_NTAGS) {
-			return DST_R_INVALIDPRIVATEKEY;
-		}
-		have[i] = true;
-	}
-
-	mask = (1ULL << TAG_SHIFT) - 1;
-
-	if (have[TAG_SQISIGN_PUBLICKEY & mask] &&
-	    have[TAG_SQISIGN_SECRETKEY & mask])
-	{
-		return ISC_R_SUCCESS;
-	}
-
-	return DST_R_INVALIDPRIVATEKEY;
+	return ok ? 0 : -1;
 }

 static int
@@ -323,9 +283,9 @@ check_hmac_md5(const dst_private_t *priv, bool old) {
 		if (old && priv->nelements == OLD_HMACMD5_NTAGS &&
 		    priv->elements[0].tag == TAG_HMACMD5_KEY)
 		{
-			return ISC_R_SUCCESS;
+			return 0;
 		}
-		return DST_R_INVALIDPRIVATEKEY;
+		return -1;
 	}
 	/*
 	 * We must be new format at this point.
@@ -337,10 +297,10 @@ check_hmac_md5(const dst_private_t *priv, bool old) {
 			}
 		}
 		if (j == priv->nelements) {
-			return DST_R_INVALIDPRIVATEKEY;
+			return -1;
 		}
 	}
-	return ISC_R_SUCCESS;
+	return 0;
 }

 static int
@@ -348,7 +308,7 @@ check_hmac_sha(const dst_private_t *priv, unsigned int ntags,
 	       unsigned int alg) {
 	unsigned int i, j;
 	if (priv->nelements != ntags) {
-		return DST_R_INVALIDPRIVATEKEY;
+		return -1;
 	}
 	for (i = 0; i < ntags; i++) {
 		for (j = 0; j < priv->nelements; j++) {
@@ -357,13 +317,13 @@ check_hmac_sha(const dst_private_t *priv, unsigned int ntags,
 			}
 		}
 		if (j == priv->nelements) {
-			return DST_R_INVALIDPRIVATEKEY;
+			return -1;
 		}
 	}
-	return ISC_R_SUCCESS;
+	return 0;
 }

-static isc_result_t
+static int
 check_data(const dst_private_t *priv, const unsigned int alg, bool old,
 	   bool external) {
 	switch (alg) {
@@ -379,8 +339,6 @@ check_data(const dst_private_t *priv, const unsigned int alg, bool old,
 	case DST_ALG_ED25519:
 	case DST_ALG_ED448:
 		return check_eddsa(priv, external);
-	case DST_ALG_SQISIGN:
-		return check_sqisignhd(priv, external);
 	case DST_ALG_HMACMD5:
 		return check_hmac_md5(priv, old);
 	case DST_ALG_HMACSHA1:
@@ -424,7 +382,7 @@ dst__privstruct_parse(dst_key_t *key, unsigned int alg, isc_lex_t *lex,
 	unsigned char *data = NULL;
 	unsigned int opt = ISC_LEXOPT_EOL;
 	isc_stdtime_t when;
-	isc_result_t result;
+	isc_result_t ret;
 	bool external = false;

 	REQUIRE(priv != NULL);
@@ -432,22 +390,20 @@ dst__privstruct_parse(dst_key_t *key, unsigned int alg, isc_lex_t *lex,
 	priv->nelements = 0;
 	memset(priv->elements, 0, sizeof(priv->elements));

-#define NEXTTOKEN(lex, opt, token)                          \
-	do {                                                \
-		result = isc_lex_gettoken(lex, opt, token); \
-		if (result != ISC_R_SUCCESS) {              \
-			goto fail;                          \
-		}                                           \
+#define NEXTTOKEN(lex, opt, token)                       \
+	do {                                             \
+		ret = isc_lex_gettoken(lex, opt, token); \
+		if (ret != ISC_R_SUCCESS)                \
+			goto fail;                       \
 	} while (0)

-#define READLINE(lex, opt, token)                           \
-	do {                                                \
-		result = isc_lex_gettoken(lex, opt, token); \
-		if (result == ISC_R_EOF) {                  \
-			break;                              \
-		} else if (result != ISC_R_SUCCESS) {       \
-			goto fail;                          \
-		}                                           \
+#define READLINE(lex, opt, token)                        \
+	do {                                             \
+		ret = isc_lex_gettoken(lex, opt, token); \
+		if (ret == ISC_R_EOF)                    \
+			break;                           \
+		else if (ret != ISC_R_SUCCESS)           \
+			goto fail;                       \
 	} while ((*token).type != isc_tokentype_eol)

 	/*
@@ -457,23 +413,23 @@ dst__privstruct_parse(dst_key_t *key, unsigned int alg, isc_lex_t *lex,
 	if (token.type != isc_tokentype_string ||
 	    strcmp(DST_AS_STR(token), PRIVATE_KEY_STR) != 0)
 	{
-		result = DST_R_INVALIDPRIVATEKEY;
+		ret = DST_R_INVALIDPRIVATEKEY;
 		goto fail;
 	}

 	NEXTTOKEN(lex, opt, &token);
 	if (token.type != isc_tokentype_string || (DST_AS_STR(token))[0] != 'v')
 	{
-		result = DST_R_INVALIDPRIVATEKEY;
+		ret = DST_R_INVALIDPRIVATEKEY;
 		goto fail;
 	}
 	if (sscanf(DST_AS_STR(token), "v%d.%d", &major, &minor) != 2) {
-		result = DST_R_INVALIDPRIVATEKEY;
+		ret = DST_R_INVALIDPRIVATEKEY;
 		goto fail;
 	}

 	if (major > DST_MAJOR_VERSION) {
-		result = DST_R_INVALIDPRIVATEKEY;
+		ret = DST_R_INVALIDPRIVATEKEY;
 		goto fail;
 	}

@@ -491,7 +447,7 @@ dst__privstruct_parse(dst_key_t *key, unsigned int alg, isc_lex_t *lex,
 	if (token.type != isc_tokentype_string ||
 	    strcmp(DST_AS_STR(token), ALGORITHM_STR) != 0)
 	{
-		result = DST_R_INVALIDPRIVATEKEY;
+		ret = DST_R_INVALIDPRIVATEKEY;
 		goto fail;
 	}

@@ -499,7 +455,7 @@ dst__privstruct_parse(dst_key_t *key, unsigned int alg, isc_lex_t *lex,
 	if (token.type != isc_tokentype_number ||
 	    token.value.as_ulong != (unsigned long)dst_key_alg(key))
 	{
-		result = DST_R_INVALIDPRIVATEKEY;
+		ret = DST_R_INVALIDPRIVATEKEY;
 		goto fail;
 	}

@@ -512,17 +468,17 @@ dst__privstruct_parse(dst_key_t *key, unsigned int alg, isc_lex_t *lex,
 		int tag;
 		isc_region_t r;
 		do {
-			result = isc_lex_gettoken(lex, opt, &token);
-			if (result == ISC_R_EOF) {
+			ret = isc_lex_gettoken(lex, opt, &token);
+			if (ret == ISC_R_EOF) {
 				goto done;
 			}
-			if (result != ISC_R_SUCCESS) {
+			if (ret != ISC_R_SUCCESS) {
 				goto fail;
 			}
 		} while (token.type == isc_tokentype_eol);

 		if (token.type != isc_tokentype_string) {
-			result = DST_R_INVALIDPRIVATEKEY;
+			ret = DST_R_INVALIDPRIVATEKEY;
 			goto fail;
 		}

@@ -538,7 +494,7 @@ dst__privstruct_parse(dst_key_t *key, unsigned int alg, isc_lex_t *lex,

 			NEXTTOKEN(lex, opt | ISC_LEXOPT_NUMBER, &token);
 			if (token.type != isc_tokentype_number) {
-				result = DST_R_INVALIDPRIVATEKEY;
+				ret = DST_R_INVALIDPRIVATEKEY;
 				goto fail;
 			}

@@ -553,12 +509,12 @@ dst__privstruct_parse(dst_key_t *key, unsigned int alg, isc_lex_t *lex,

 			NEXTTOKEN(lex, opt, &token);
 			if (token.type != isc_tokentype_string) {
-				result = DST_R_INVALIDPRIVATEKEY;
+				ret = DST_R_INVALIDPRIVATEKEY;
 				goto fail;
 			}

-			result = dns_time32_fromtext(DST_AS_STR(token), &when);
-			if (result != ISC_R_SUCCESS) {
+			ret = dns_time32_fromtext(DST_AS_STR(token), &when);
+			if (ret != ISC_R_SUCCESS) {
 				goto fail;
 			}

@@ -572,7 +528,7 @@ dst__privstruct_parse(dst_key_t *key, unsigned int alg, isc_lex_t *lex,
 		if (tag < 0 && minor > DST_MINOR_VERSION) {
 			goto next;
 		} else if (tag < 0) {
-			result = DST_R_INVALIDPRIVATEKEY;
+			ret = DST_R_INVALIDPRIVATEKEY;
 			goto fail;
 		}

@@ -581,8 +537,8 @@ dst__privstruct_parse(dst_key_t *key, unsigned int alg, isc_lex_t *lex,
 		data = isc_mem_get(mctx, MAXFIELDSIZE);

 		isc_buffer_init(&b, data, MAXFIELDSIZE);
-		result = isc_base64_tobuffer(lex, &b, -1);
-		if (result != ISC_R_SUCCESS) {
+		ret = isc_base64_tobuffer(lex, &b, -1);
+		if (ret != ISC_R_SUCCESS) {
 			goto fail;
 		}

@@ -598,13 +554,16 @@ dst__privstruct_parse(dst_key_t *key, unsigned int alg, isc_lex_t *lex,

 done:
 	if (external && priv->nelements != 0) {
-		result = DST_R_INVALIDPRIVATEKEY;
+		ret = DST_R_INVALIDPRIVATEKEY;
 		goto fail;
 	}

 	check = check_data(priv, alg, true, external);
-	if (check != ISC_R_SUCCESS) {
-		result = check;
+	if (check < 0) {
+		ret = DST_R_INVALIDPRIVATEKEY;
+		goto fail;
+	} else if (check != ISC_R_SUCCESS) {
+		ret = check;
 		goto fail;
 	}

@@ -618,7 +577,7 @@ fail:
 		isc_mem_put(mctx, data, MAXFIELDSIZE);
 	}

-	return result;
+	return ret;
 }

 isc_result_t
@@ -637,13 +596,15 @@ dst__privstruct_writefile(const dst_key_t *key, const dst_private_t *priv,
 	isc_region_t r;
 	int major, minor;
 	mode_t mode;
-	int i;
+	int i, ret;

 	REQUIRE(priv != NULL);

-	result = check_data(priv, dst_key_alg(key), false, key->external);
-	if (result != ISC_R_SUCCESS) {
-		return result;
+	ret = check_data(priv, dst_key_alg(key), false, key->external);
+	if (ret < 0) {
+		return DST_R_INVALIDPRIVATEKEY;
+	} else if (ret != ISC_R_SUCCESS) {
+		return ret;
 	}

 	isc_buffer_init(&fileb, filename, sizeof(filename));
@@ -715,9 +676,6 @@ dst__privstruct_writefile(const dst_key_t *key, const dst_private_t *priv,
 	case DST_ALG_ED448:
 		fprintf(fp, "(ED448)\n");
 		break;
-	case DST_ALG_SQISIGN:
-		fprintf(fp, "(SQISIGN)\n");
-		break;
 	case DST_ALG_HMACMD5:
 		fprintf(fp, "(HMAC_MD5)\n");
 		break;
@@ -32,7 +32,7 @@

 #include <dst/dst.h>

-#define MAXFIELDSIZE 1025
+#define MAXFIELDSIZE 512

 /*
 * Maximum number of fields in a private file is 18 (12 algorithm-
@@ -67,10 +67,6 @@
 #define TAG_EDDSA_ENGINE     ((DST_ALG_ED25519 << TAG_SHIFT) + 1)
 #define TAG_EDDSA_LABEL	     ((DST_ALG_ED25519 << TAG_SHIFT) + 2)

-#define SQISIGN_NTAGS	      3
-#define TAG_SQISIGN_PUBLICKEY ((DST_ALG_SQISIGN << TAG_SHIFT) + 0)
-#define TAG_SQISIGN_SECRETKEY ((DST_ALG_SQISIGN << TAG_SHIFT) + 1)
-
 #define OLD_HMACMD5_NTAGS 1
 #define HMACMD5_NTAGS	  2
 #define TAG_HMACMD5_KEY	  ((DST_ALG_HMACMD5 << TAG_SHIFT) + 0)
@@ -43,7 +43,7 @@ struct dyndb_implementation {
 	dns_dyndb_destroy_t *destroy_func;
 	char *name;
 	void *inst;
-	ISC_LINK(dyndb_implementation_t) link;
+	LINK(dyndb_implementation_t) link;
 };

 /*
@@ -52,7 +52,7 @@ struct dyndb_implementation {
 * These are stored here so they can be cleaned up on shutdown.
 * (The order in which they are stored is not important.)
 */
-static ISC_LIST(dyndb_implementation_t) dyndb_implementations;
+static LIST(dyndb_implementation_t) dyndb_implementations;

 /* Locks dyndb_implementations. */
 static isc_mutex_t dyndb_lock;
@@ -60,7 +60,7 @@ static isc_mutex_t dyndb_lock;
 void
 dns__dyndb_initialize(void) {
 	isc_mutex_init(&dyndb_lock);
-	ISC_LIST_INIT(dyndb_implementations);
+	INIT_LIST(dyndb_implementations);
 }

 void
@@ -135,7 +135,7 @@ load_library(isc_mem_t *mctx, const char *filename, const char *instname,

 	isc_mem_attach(mctx, &imp->mctx);

-	ISC_LINK_INIT(imp, link);
+	INIT_LINK(imp, link);

 	r = uv_dlopen(filename, &imp->handle);
 	if (r != 0) {
@@ -225,7 +225,7 @@ dns_dyndb_load(const char *libname, const char *name, const char *parameters,
 	CHECK(implementation->register_func(mctx, name, parameters, file, line,
 					    dctx, &implementation->inst));

-	ISC_LIST_APPEND(dyndb_implementations, implementation, link);
+	APPEND(dyndb_implementations, implementation, link);
 	result = ISC_R_SUCCESS;

 cleanup:
@@ -245,10 +245,10 @@ dns_dyndb_cleanup(void) {
 	dyndb_implementation_t *prev;

 	LOCK(&dyndb_lock);
-	elem = ISC_LIST_TAIL(dyndb_implementations);
+	elem = TAIL(dyndb_implementations);
 	while (elem != NULL) {
-		prev = ISC_LIST_PREV(elem, link);
-		ISC_LIST_UNLINK(dyndb_implementations, elem, link);
+		prev = PREV(elem, link);
+		UNLINK(dyndb_implementations, elem, link);
 		isc_log_write(DNS_LOGCATEGORY_DATABASE, DNS_LOGMODULE_DYNDB,
 			      ISC_LOG_INFO, "unloading DynDB instance '%s'",
 			      elem->name);
@@ -63,11 +63,13 @@ struct dst_gssapi_signverifyctx {
 * or verifying.
 */
 static isc_result_t
-gssapi_create_signverify_ctx(dst_key_t *key ISC_ATTR_UNUSED,
-			     dst_context_t *dctx) {
-	dst_gssapi_signverifyctx_t *ctx =
-		isc_mem_get(dctx->mctx, sizeof(dst_gssapi_signverifyctx_t));
-	*ctx = (dst_gssapi_signverifyctx_t){ 0 };
+gssapi_create_signverify_ctx(dst_key_t *key, dst_context_t *dctx) {
+	dst_gssapi_signverifyctx_t *ctx;
+
+	UNUSED(key);
+
+	ctx = isc_mem_get(dctx->mctx, sizeof(dst_gssapi_signverifyctx_t));
+	ctx->buffer = NULL;
 	isc_buffer_allocate(dctx->mctx, &ctx->buffer, INITIAL_BUFFER_SIZE);

 	dctx->ctxdata.gssctx = ctx;
@@ -184,8 +186,7 @@ gssapi_sign(dst_context_t *dctx, isc_buffer_t *sig) {
 * Verify.
 */
 static isc_result_t
-gssapi_verify(dst_context_t *dctx, int maxbits ISC_ATTR_UNUSED,
-	      const isc_region_t *sig) {
+gssapi_verify(dst_context_t *dctx, const isc_region_t *sig) {
 	dst_gssapi_signverifyctx_t *ctx = dctx->ctxdata.gssctx;
 	isc_region_t message;
 	gss_buffer_desc gmessage, gsig;
@@ -330,11 +331,15 @@ gssapi_dump(dst_key_t *key, isc_mem_t *mctx, char **buffer, int *length) {

 static dst_func_t gssapi_functions = {
 	gssapi_create_signverify_ctx,
+	NULL, /*%< createctx2 */
 	gssapi_destroy_signverify_ctx,
 	gssapi_adddata,
 	gssapi_sign,
 	gssapi_verify,
+	NULL, /*%< verify2 */
+	NULL, /*%< computesecret */
 	gssapi_compare,
+	NULL, /*%< paramcompare */
 	gssapi_generate,
 	gssapi_isprivate,
 	gssapi_destroy,
@@ -342,6 +347,7 @@ static dst_func_t gssapi_functions = {
 	NULL, /*%< fromdns */
 	NULL, /*%< tofile */
 	NULL, /*%< parse */
+	NULL, /*%< cleanup */
 	NULL, /*%< fromlabel */
 	gssapi_dump,
 	gssapi_restore,
@@ -69,7 +69,6 @@
 		return (hmac_sign(dctx, sig));                                 \
 	}                                                                      \
 	static isc_result_t hmac##alg##_verify(dst_context_t *dctx,            \
-					       int maxbits ISC_ATTR_UNUSED,    \
 					       const isc_region_t *sig) {      \
 		return (hmac_verify(dctx, sig));                               \
 	}                                                                      \
@@ -115,11 +114,15 @@
 	}                                                                      \
 	static dst_func_t hmac##alg##_functions = {                            \
 		hmac##alg##_createctx,                                         \
+		NULL, /*%< createctx2 */                                       \
 		hmac##alg##_destroyctx,                                        \
 		hmac##alg##_adddata,                                           \
 		hmac##alg##_sign,                                              \
 		hmac##alg##_verify,                                            \
+		NULL, /*%< verify2 */                                          \
+		NULL, /*%< computesecret */                                    \
 		hmac##alg##_compare,                                           \
+		NULL, /*%< paramcompare */                                     \
 		hmac##alg##_generate,                                          \
 		hmac##alg##_isprivate,                                         \
 		hmac##alg##_destroy,                                           \
@@ -127,6 +130,7 @@
 		hmac##alg##_fromdns,                                           \
 		hmac##alg##_tofile,                                            \
 		hmac##alg##_parse,                                             \
+		NULL, /*%< cleanup */                                          \
 		NULL, /*%< fromlabel */                                        \
 		NULL, /*%< dump */                                             \
 		NULL, /*%< restore */                                          \
@@ -68,7 +68,6 @@
 #define DNS_KEYALG_ECDSA384	 14
 #define DNS_KEYALG_ED25519	 15
 #define DNS_KEYALG_ED448	 16
-#define DNS_KEYALG_SQISIGN	 17
 #define DNS_KEYALG_INDIRECT	 252
 #define DNS_KEYALG_PRIVATEDNS	 253
 #define DNS_KEYALG_PRIVATEOID	 254 /*%< Key begins with OID giving alg */
@@ -103,7 +102,3 @@

 #define DNS_KEY_ED25519SIZE 32
 #define DNS_KEY_ED448SIZE   57
-
-#define DNS_SIG_SQISIGNSIZE 148
-#define DNS_KEY_SQISIGNSIZE 65
-#define DNS_SEC_SQISIGNSIZE 353
@@ -54,21 +54,16 @@
 isc_result_t
 dns_ncache_add(dns_message_t *message, dns_db_t *cache, dns_dbnode_t *node,
 	       dns_rdatatype_t covers, isc_stdtime_t now, dns_ttl_t minttl,
-	       dns_ttl_t maxttl, dns_rdataset_t *addedrdataset);
-isc_result_t
-dns_ncache_addoptout(dns_message_t *message, dns_db_t *cache,
-		     dns_dbnode_t *node, dns_rdatatype_t covers,
-		     isc_stdtime_t now, dns_ttl_t minttl, dns_ttl_t maxttl,
-		     bool optout, dns_rdataset_t *addedrdataset);
+	       dns_ttl_t maxttl, bool optout, bool secure,
+	       dns_rdataset_t *addedrdataset);
 /*%<
 * Convert the authority data from 'message' into a negative cache
 * rdataset, and store it in 'cache' at 'node' with a TTL limited to
 * 'maxttl'.
 *
- * \li dns_ncache_add produces a negative cache entry with a trust of no
- *     more than answer
- * \li dns_ncache_addoptout produces a negative cache entry which will have
- *     a trust of secure if all the records that make up the entry are secure.
+ * \li if 'secure' is true and all the records that make up the entry
+ *     are secure, then dns_ncache_add produces a negative cache entry
+ *     with trust level secure.
 *
 * The 'covers' argument is the RR type whose nonexistence we are caching,
 * or dns_rdatatype_any when caching a NXDOMAIN response.
@@ -113,36 +113,6 @@ struct dns_rdata {
 	ISC_LINK(dns_rdata_t) link;
 };

-/*%
- * Rdatatype attributes.
- */
-enum {
-	/*% only one may exist for a name */
-	DNS_RDATATYPEATTR_SINGLETON = 1 << 0,
-	/*% requires no other data be present */
-	DNS_RDATATYPEATTR_EXCLUSIVE = 1 << 1,
-	/*% Is a meta type */
-	DNS_RDATATYPEATTR_META = 1 << 2,
-	/*% Is a DNSSEC type, like RRSIG or NSEC */
-	DNS_RDATATYPEATTR_DNSSEC = 1 << 3,
-	/*% Is a zone cut authority type */
-	DNS_RDATATYPEATTR_ZONECUTAUTH = 1 << 4,
-	/*% Is reserved (unusable) */
-	DNS_RDATATYPEATTR_RESERVED = 1 << 5,
-	/*% Is an unknown type */
-	DNS_RDATATYPEATTR_UNKNOWN = 1 << 6,
-	/*% Is META, and can only be in a question section */
-	DNS_RDATATYPEATTR_QUESTIONONLY = 1 << 7,
-	/*% Is META, and can NOT be in a question section */
-	DNS_RDATATYPEATTR_NOTQUESTION = 1 << 8,
-	/*% Is present at zone cuts in the parent, not the child */
-	DNS_RDATATYPEATTR_ATPARENT = 1 << 9,
-	/*% Can exist along side a CNAME */
-	DNS_RDATATYPEATTR_ATCNAME = 1 << 10,
-	/*% Follow additional */
-	DNS_RDATATYPEATTR_FOLLOWADDITIONAL = 1 << 11,
-};
-
 #define DNS_RDATA_INIT                        \
 	{                                     \
 		.data = NULL,                 \
@@ -560,28 +530,16 @@ dns_rdata_freestruct(void *source);
 *	dns_rdata_tostruct().
 */

-unsigned int
-dns_rdatatype_attributes(dns_rdatatype_t rdtype);
+bool
+dns_rdatatype_ismeta(dns_rdatatype_t type);
 /*%<
- * Return attributes for the given type.
- *
- * Requires:
- *\li	'rdtype' are known.
- *
- * Returns:
- *\li	a bitmask of the rdatatype attribute flags, defined above.
- */
-
-/*%
 * Return true iff the rdata type 'type' is a meta-type
 * like ANY or AXFR.
 */
-static inline bool
-dns_rdatatype_ismeta(dns_rdatatype_t type) {
-	return (dns_rdatatype_attributes(type) & DNS_RDATATYPEATTR_META) != 0;
-}

-/*%
+bool
+dns_rdatatype_issingleton(dns_rdatatype_t type);
+/*%<
 * Return true iff the rdata type 'type' is a singleton type,
 * like CNAME or SOA.
 *
@@ -589,108 +547,34 @@ dns_rdatatype_ismeta(dns_rdatatype_t type) {
 * \li	'type' is a valid rdata type.
 *
 */
-static inline bool
-dns_rdatatype_issingleton(dns_rdatatype_t type) {
-	return (dns_rdatatype_attributes(type) & DNS_RDATATYPEATTR_SINGLETON) !=
-	       0;
-}

-/*%
- * Return true iff rdata of type 'type' can not appear in the question
- * section of a properly formatted message.
- *
- * Requires:
- * \li	'type' is a valid rdata type.
- *
+bool
+dns_rdataclass_ismeta(dns_rdataclass_t rdclass);
+/*%<
+ * Return true iff the rdata class 'rdclass' is a meta-class
+ * like ANY or NONE.
 */
-static inline bool
-dns_rdatatype_notquestion(dns_rdatatype_t type) {
-	return (dns_rdatatype_attributes(type) &
-		DNS_RDATATYPEATTR_NOTQUESTION) != 0;
-}

-/*%
- * Return true iff rdata of type 'type' can only appear in the question
- * section of a properly formatted message.
- *
- * Requires:
- * \li	'type' is a valid rdata type.
- *
- */
-static inline bool
-dns_rdatatype_questiononly(dns_rdatatype_t type) {
-	return (dns_rdatatype_attributes(type) &
-		DNS_RDATATYPEATTR_QUESTIONONLY) != 0;
-}
-
-/*%
- * Return true iff rdata of type 'type' can appear beside a cname.
- *
- * Requires:
- * \li	'type' is a valid rdata type.
- *
- */
-static inline bool
-dns_rdatatype_atcname(dns_rdatatype_t type) {
-	return (dns_rdatatype_attributes(type) & DNS_RDATATYPEATTR_ATCNAME) !=
-	       0;
-}
-
-/*%
- * Return true iff rdata of type 'type' should appear at the parent of
- * a zone cut.
- *
- * Requires:
- * \li	'type' is a valid rdata type.
- *
- */
-static inline bool
-dns_rdatatype_atparent(dns_rdatatype_t type) {
-	return (dns_rdatatype_attributes(type) & DNS_RDATATYPEATTR_ATPARENT) !=
-	       0;
-}
-
-/*%
- * Return true if adding a record of type 'type' to the ADDITIONAL section
- * of a message can itself trigger the addition of still more data to the
- * additional section.
- *
- * (For example: adding SRV to the ADDITIONAL section may trigger
- * the addition of address records associated with that SRV.)
- *
- * Requires:
- * \li	'type' is a valid rdata type.
- *
- */
-static inline bool
-dns_rdatatype_followadditional(dns_rdatatype_t type) {
-	return (dns_rdatatype_attributes(type) &
-		DNS_RDATATYPEATTR_FOLLOWADDITIONAL) != 0;
-}
-
-/*%
+bool
+dns_rdatatype_isdnssec(dns_rdatatype_t type);
+/*%<
 * Return true iff 'type' is one of the DNSSEC
 * rdata types that may exist alongside a CNAME record.
 *
 * Requires:
 * \li	'type' is a valid rdata type.
 */
-static inline bool
-dns_rdatatype_isdnssec(dns_rdatatype_t type) {
-	return (dns_rdatatype_attributes(type) & DNS_RDATATYPEATTR_DNSSEC) != 0;
-}

-/*%
+bool
+dns_rdatatype_iskeymaterial(dns_rdatatype_t type);
+/*%<
 * Return true iff the rdata type 'type' is a DNSSEC key
 * related type, like DNSKEY, CDNSKEY, or CDS.
 */
-static inline bool
-dns_rdatatype_iskeymaterial(dns_rdatatype_t type) {
-	return type == dns_rdatatype_dnskey || type == dns_rdatatype_cdnskey ||
-	       type == dns_rdatatype_cds;
-}

-/*%
+bool
+dns_rdatatype_iszonecutauth(dns_rdatatype_t type);
+/*%<
 * Return true iff rdata of type 'type' is considered authoritative
 * data (not glue) in the NSEC chain when it occurs in the parent zone
 * at a zone cut.
@@ -699,68 +583,16 @@ dns_rdatatype_iskeymaterial(dns_rdatatype_t type) {
 * \li	'type' is a valid rdata type.
 *
 */
-static inline bool
-dns_rdatatype_iszonecutauth(dns_rdatatype_t type) {
-	return (dns_rdatatype_attributes(type) &
-		DNS_RDATATYPEATTR_ZONECUTAUTH) != 0;
-}

-/*%
+bool
+dns_rdatatype_isknown(dns_rdatatype_t type);
+/*%<
 * Return true iff the rdata type 'type' is known.
 *
 * Requires:
 * \li	'type' is a valid rdata type.
 *
 */
-static inline bool
-dns_rdatatype_isknown(dns_rdatatype_t type) {
-	return (dns_rdatatype_attributes(type) & DNS_RDATATYPEATTR_UNKNOWN) ==
-	       0;
-}
-
-/*%
- * Return true iff a query for the rdata type can have multiple
- * unrelated answers in a response: ANY, RRSIG, or SIG.
- */
-static inline bool
-dns_rdatatype_ismulti(dns_rdatatype_t type) {
-	return type == dns_rdatatype_any || type == dns_rdatatype_rrsig ||
-	       type == dns_rdatatype_sig;
-}
-
-/*%
- * Return true iff the rdata type is a signature: either RRSIG or SIG.
- */
-static inline bool
-dns_rdatatype_issig(dns_rdatatype_t type) {
-	return type == dns_rdatatype_rrsig || type == dns_rdatatype_sig;
-}
-
-/*%
- * Return true iff the rdata type is an address: either A or AAAA.
- */
-static inline bool
-dns_rdatatype_isaddr(dns_rdatatype_t type) {
-	return type == dns_rdatatype_a || type == dns_rdatatype_aaaa;
-}
-
-/*%
- * Return true iff the rdata type is an alias: either CNAME or DNAME.
- */
-static inline bool
-dns_rdatatype_isalias(dns_rdatatype_t type) {
-	return type == dns_rdatatype_cname || type == dns_rdatatype_dname;
-}
-
-/*%
- * Return true iff the rdata class 'rdclass' is a meta-class
- * like ANY or NONE.
- */
-static inline bool
-dns_rdataclass_ismeta(dns_rdataclass_t rdclass) {
-	return rdclass == dns_rdataclass_reserved0 ||
-	       rdclass == dns_rdataclass_none || rdclass == dns_rdataclass_any;
-}

 isc_result_t
 dns_rdata_additionaldata(dns_rdata_t *rdata, const dns_name_t *owner,
@@ -821,6 +653,101 @@ dns_rdata_digest(dns_rdata_t *rdata, dns_digestfunc_t digest, void *arg);
 *\li	Many other results are possible if not successful.
 */

+bool
+dns_rdatatype_questiononly(dns_rdatatype_t type);
+/*%<
+ * Return true iff rdata of type 'type' can only appear in the question
+ * section of a properly formatted message.
+ *
+ * Requires:
+ * \li	'type' is a valid rdata type.
+ *
+ */
+
+bool
+dns_rdatatype_notquestion(dns_rdatatype_t type);
+/*%<
+ * Return true iff rdata of type 'type' can not appear in the question
+ * section of a properly formatted message.
+ *
+ * Requires:
+ * \li	'type' is a valid rdata type.
+ *
+ */
+
+bool
+dns_rdatatype_atparent(dns_rdatatype_t type);
+/*%<
+ * Return true iff rdata of type 'type' should appear at the parent of
+ * a zone cut.
+ *
+ * Requires:
+ * \li	'type' is a valid rdata type.
+ *
+ */
+
+bool
+dns_rdatatype_atcname(dns_rdatatype_t type);
+/*%<
+ * Return true iff rdata of type 'type' can appear beside a cname.
+ *
+ * Requires:
+ * \li	'type' is a valid rdata type.
+ *
+ */
+
+bool
+dns_rdatatype_followadditional(dns_rdatatype_t type);
+/*%<
+ * Return true if adding a record of type 'type' to the ADDITIONAL section
+ * of a message can itself trigger the addition of still more data to the
+ * additional section.
+ *
+ * (For example: adding SRV to the ADDITIONAL section may trigger
+ * the addition of address records associated with that SRV.)
+ *
+ * Requires:
+ * \li	'type' is a valid rdata type.
+ *
+ */
+
+unsigned int
+dns_rdatatype_attributes(dns_rdatatype_t rdtype);
+/*%<
+ * Return attributes for the given type.
+ *
+ * Requires:
+ *\li	'rdtype' are known.
+ *
+ * Returns:
+ *\li	a bitmask consisting of the following flags.
+ */
+
+/*% only one may exist for a name */
+#define DNS_RDATATYPEATTR_SINGLETON 0x00000001U
+/*% requires no other data be present */
+#define DNS_RDATATYPEATTR_EXCLUSIVE 0x00000002U
+/*% Is a meta type */
+#define DNS_RDATATYPEATTR_META 0x00000004U
+/*% Is a DNSSEC type, like RRSIG or NSEC */
+#define DNS_RDATATYPEATTR_DNSSEC 0x00000008U
+/*% Is a zone cut authority type */
+#define DNS_RDATATYPEATTR_ZONECUTAUTH 0x00000010U
+/*% Is reserved (unusable) */
+#define DNS_RDATATYPEATTR_RESERVED 0x00000020U
+/*% Is an unknown type */
+#define DNS_RDATATYPEATTR_UNKNOWN 0x00000040U
+/*% Is META, and can only be in a question section */
+#define DNS_RDATATYPEATTR_QUESTIONONLY 0x00000080U
+/*% Is META, and can NOT be in a question section */
+#define DNS_RDATATYPEATTR_NOTQUESTION 0x00000100U
+/*% Is present at zone cuts in the parent, not the child */
+#define DNS_RDATATYPEATTR_ATPARENT 0x00000200U
+/*% Can exist along side a CNAME */
+#define DNS_RDATATYPEATTR_ATCNAME 0x00000400U
+/*% Follow additional */
+#define DNS_RDATATYPEATTR_FOLLOWADDITIONAL 0x00000800U
+
 dns_rdatatype_t
 dns_rdata_covers(dns_rdata_t *rdata);
 /*%<
@@ -129,7 +129,6 @@ enum {
 						* on ip6.arpa. */
 	DNS_FETCHOPT_NOFORWARD = 1 << 15,      /*%< Do not use forwarders if
 						* possible. */
-	DNS_FETCHOPT_QMINFETCH = 1 << 16,      /*%< Qmin fetch */

 	/*% EDNS version bits: */
 	DNS_FETCHOPT_EDNSVERSIONSET = 1 << 23,
@@ -399,7 +399,7 @@ dns_opcodestats_increment(dns_stats_t *stats, dns_opcode_t code);
 */

 void
-dns_rcodestats_increment(dns_stats_t *stats, dns_rcode_t code);
+dns_rcodestats_increment(dns_stats_t *stats, dns_opcode_t code);
 /*%<
 * Increment the statistics counter for 'code'.
 *
@@ -124,7 +124,7 @@ typedef struct dns_nametree	   dns_nametree_t;
 typedef ISC_LIST(dns_name_t) dns_namelist_t;
 typedef struct dns_ntatable	    dns_ntatable_t;
 typedef struct dns_ntnode	    dns_ntnode_t;
-typedef enum dns_opcode		    dns_opcode_t;
+typedef uint16_t		    dns_opcode_t;
 typedef struct dns_order	    dns_order_t;
 typedef struct dns_peer		    dns_peer_t;
 typedef struct dns_peerlist	    dns_peerlist_t;
@@ -308,18 +308,20 @@ enum {
 /*%
 * Opcodes.
 */
-enum dns_opcode {
+enum {
 	dns_opcode_query = 0,
+#define dns_opcode_query ((dns_opcode_t)dns_opcode_query)
 	dns_opcode_iquery = 1,
+#define dns_opcode_iquery ((dns_opcode_t)dns_opcode_iquery)
 	dns_opcode_status = 2,
+#define dns_opcode_status ((dns_opcode_t)dns_opcode_status)
 	dns_opcode_notify = 4,
+#define dns_opcode_notify ((dns_opcode_t)dns_opcode_notify)
 	dns_opcode_update = 5, /* dynamic update */
+#define dns_opcode_update ((dns_opcode_t)dns_opcode_update)
 	dns_opcode_max = 6,
-	dns__opcode_expand = UINT16_MAX,
-} __attribute__((__packed__));
-/* Absent attribute packed, the enum will be sized as an int */
-STATIC_ASSERT(sizeof(uint16_t) == sizeof(dns_opcode_t),
-	      "sizeof(dns_opecode)t) is not 16-bit");
+#define dns_opcode_max ((dns_opcode_t)dns_opcode_max)
+};

 /*%
 * Trust levels.  Must be kept in sync with trustnames[] in masterdump.c.
@@ -818,7 +818,7 @@ dns_zone_setmaxretrytime(dns_zone_t *zone, uint32_t val);
 *	val > 0.
 */

-void
+isc_result_t
 dns_zone_setxfrsource4(dns_zone_t *zone, const isc_sockaddr_t *xfrsource);
 /*%<
 * 	Set the source address to be used in IPv4 zone transfers.
@@ -826,20 +826,22 @@ dns_zone_setxfrsource4(dns_zone_t *zone, const isc_sockaddr_t *xfrsource);
 * Require:
 *\li	'zone' to be a valid zone.
 *\li	'xfrsource' to contain the address.
+ *
+ * Returns:
+ *\li	#ISC_R_SUCCESS
 */

-void
-dns_zone_getxfrsource4(dns_zone_t *zone, isc_sockaddr_t *xfrsource);
+isc_sockaddr_t *
+dns_zone_getxfrsource4(dns_zone_t *zone);
 /*%<
 *	Returns the source address set by a previous dns_zone_setxfrsource4
 *	call, or the default of inaddr_any, port 0.
 *
 * Require:
 *\li	'zone' to be a valid zone.
- *\li	'xfrsource' to not be NULL
 */

-void
+isc_result_t
 dns_zone_setxfrsource6(dns_zone_t *zone, const isc_sockaddr_t *xfrsource);
 /*%<
 * 	Set the source address to be used in IPv6 zone transfers.
@@ -847,20 +849,22 @@ dns_zone_setxfrsource6(dns_zone_t *zone, const isc_sockaddr_t *xfrsource);
 * Require:
 *\li	'zone' to be a valid zone.
 *\li	'xfrsource' to contain the address.
+ *
+ * Returns:
+ *\li	#ISC_R_SUCCESS
 */

-void
-dns_zone_getxfrsource6(dns_zone_t *zone, isc_sockaddr_t *xfrsource);
+isc_sockaddr_t *
+dns_zone_getxfrsource6(dns_zone_t *zone);
 /*%<
 *	Returns the source address set by a previous dns_zone_setxfrsource6
 *	call, or the default of in6addr_any, port 0.
 *
 * Require:
 *\li	'zone' to be a valid zone.
- *\li	'xfrsource' to not be NULL
 */

-void
+isc_result_t
 dns_zone_setparentalsrc4(dns_zone_t *zone, const isc_sockaddr_t *parentalsrc);
 /*%<
 * 	Set the source address to be used with IPv4 parental DS queries.
@@ -868,20 +872,22 @@ dns_zone_setparentalsrc4(dns_zone_t *zone, const isc_sockaddr_t *parentalsrc);
 * Require:
 *\li	'zone' to be a valid zone.
 *\li	'parentalsrc' to contain the address.
+ *
+ * Returns:
+ *\li	#ISC_R_SUCCESS
 */

-void
-dns_zone_getparentalsrc4(dns_zone_t *zone, isc_sockaddr_t *parentalsrc);
+isc_sockaddr_t *
+dns_zone_getparentalsrc4(dns_zone_t *zone);
 /*%<
 *	Returns the source address set by a previous dns_zone_setparentalsrc4
 *	call, or the default of inaddr_any, port 0.
 *
 * Require:
 *\li	'zone' to be a valid zone.
- *\li	'parentalsrc' to be non NULL.
 */

-void
+isc_result_t
 dns_zone_setparentalsrc6(dns_zone_t *zone, const isc_sockaddr_t *parentalsrc);
 /*%<
 * 	Set the source address to be used with IPv6 parental DS queries.
@@ -889,20 +895,22 @@ dns_zone_setparentalsrc6(dns_zone_t *zone, const isc_sockaddr_t *parentalsrc);
 * Require:
 *\li	'zone' to be a valid zone.
 *\li	'parentalsrc' to contain the address.
+ *
+ * Returns:
+ *\li	#ISC_R_SUCCESS
 */

-void
-dns_zone_getparentalsrc6(dns_zone_t *zone, isc_sockaddr_t *parentalsrc);
+isc_sockaddr_t *
+dns_zone_getparentalsrc6(dns_zone_t *zone);
 /*%<
 *	Returns the source address set by a previous dns_zone_setparentalsrc6
 *	call, or the default of in6addr_any, port 0.
 *
 * Require:
 *\li	'zone' to be a valid zone.
- *\li	'parentalsrc' to be non NULL.
 */

-void
+isc_result_t
 dns_zone_setnotifysrc4(dns_zone_t *zone, const isc_sockaddr_t *notifysrc);
 /*%<
 * 	Set the source address to be used with IPv4 NOTIFY messages.
@@ -910,20 +918,22 @@ dns_zone_setnotifysrc4(dns_zone_t *zone, const isc_sockaddr_t *notifysrc);
 * Require:
 *\li	'zone' to be a valid zone.
 *\li	'notifysrc' to contain the address.
+ *
+ * Returns:
+ *\li	#ISC_R_SUCCESS
 */

-void
-dns_zone_getnotifysrc4(dns_zone_t *zone, isc_sockaddr_t *notifysrc);
+isc_sockaddr_t *
+dns_zone_getnotifysrc4(dns_zone_t *zone);
 /*%<
 *	Returns the source address set by a previous dns_zone_setnotifysrc4
 *	call, or the default of inaddr_any, port 0.
 *
 * Require:
 *\li	'zone' to be a valid zone.
- *\li	'notifysrc' to be non NULL.
 */

-void
+isc_result_t
 dns_zone_setnotifysrc6(dns_zone_t *zone, const isc_sockaddr_t *notifysrc);
 /*%<
 * 	Set the source address to be used with IPv6 NOTIFY messages.
@@ -931,17 +941,19 @@ dns_zone_setnotifysrc6(dns_zone_t *zone, const isc_sockaddr_t *notifysrc);
 * Require:
 *\li	'zone' to be a valid zone.
 *\li	'notifysrc' to contain the address.
+ *
+ * Returns:
+ *\li	#ISC_R_SUCCESS
 */

-void
-dns_zone_getnotifysrc6(dns_zone_t *zone, isc_sockaddr_t *notifysrc);
+isc_sockaddr_t *
+dns_zone_getnotifysrc6(dns_zone_t *zone);
 /*%<
 *	Returns the source address set by a previous dns_zone_setnotifysrc6
 *	call, or the default of in6addr_any, port 0.
 *
 * Require:
 *\li	'zone' to be a valid zone.
- *\li	'notifysrc' to be non NULL.
 */

 void
@@ -1516,8 +1528,8 @@ dns_zone_getsigresigninginterval(dns_zone_t *zone);
 * \li	'zone' to be a valid zone.
 */

-void
-dns_zone_getsourceaddr(dns_zone_t *zone, isc_sockaddr_t *sourceaddr);
+isc_sockaddr_t
+dns_zone_getsourceaddr(dns_zone_t *zone);
 /*%<
 * Get the zone's source address from which it has last contacted the current
 * primary server.
@@ -1525,22 +1537,16 @@ dns_zone_getsourceaddr(dns_zone_t *zone, isc_sockaddr_t *sourceaddr);
 * Requires:
 * \li	'zone' to be a valid zone.
 * \li	'zone' has a non-empty primaries list.
- * \li	'sourceaddr' to be non-NULL.
 */

-isc_result_t
-dns_zone_getprimaryaddr(dns_zone_t *zone, isc_sockaddr_t *primaryaddr);
+isc_sockaddr_t
+dns_zone_getprimaryaddr(dns_zone_t *zone);
 /*%<
- * Get the zone's current primary server into '*primaryaddr'.
+ * Get the zone's current primary server.
 *
 * Requires:
 * \li	'zone' to be a valid zone.
 * \li	'zone' has a non-empty primaries list.
- * \li	'primaryaddr' to be non-NULL.
- *
- * Returns:
- *\li	#ISC_R_SUCCESS if the current primary server was found
- *\li	#ISC_R_NOMORE if all the primaries were already iterated over
 */

 isc_time_t
@@ -93,7 +93,6 @@ typedef enum dst_algorithm {
 	DST_ALG_ECDSA384 = 14,
 	DST_ALG_ED25519 = 15,
 	DST_ALG_ED448 = 16,
-	DST_ALG_SQISIGN = 17, /* FIXME: should be experimental */

 	/*
 	 * Do not renumber HMAC algorithms as they are used externally to named
@@ -219,7 +218,7 @@ dst_ds_digest_supported(unsigned int digest_type);

 isc_result_t
 dst_context_create(dst_key_t *key, isc_mem_t *mctx, isc_logcategory_t category,
-		   bool useforsigning, dst_context_t **dctxp);
+		   bool useforsigning, int maxbits, dst_context_t **dctxp);
 /*%<
 * Creates a context to be used for a sign or verify operation.
 *
@@ -285,7 +284,11 @@ dst_context_sign(dst_context_t *dctx, isc_buffer_t *sig);
 */

 isc_result_t
-dst_context_verify(dst_context_t *dctx, int maxbits, isc_region_t *sig);
+dst_context_verify(dst_context_t *dctx, isc_region_t *sig);
+
+isc_result_t
+dst_context_verify2(dst_context_t *dctx, unsigned int maxbits,
+		    isc_region_t *sig);
 /*%<
 * Verifies the signature using the data and key stored in the context.
 *
@@ -470,9 +470,6 @@ dns_kasp_key_size(dns_kasp_key_t *key) {
 	case DNS_KEYALG_ED448:
 		size = 456;
 		break;
-	case DNS_KEYALG_SQISIGN:
-		size = 512;
-		break;
 	default:
 		/* unsupported */
 		break;
@@ -1914,7 +1914,7 @@ load_text(dns_loadctx_t *lctx) {
 			}
 		}

-		if (dns_rdatatype_issig(type)) {
+		if (type == dns_rdatatype_rrsig || type == dns_rdatatype_sig) {
 			covers = dns_rdata_covers(&rdata[rdcount]);
 		} else {
 			covers = 0;
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Evan Hunt	3878c145c9	experiment	2025-02-26 16:01:01 -08:00
Evan Hunt	4acbfbc2d1	retry fix	2025-02-26 16:01:01 -08:00
Evan Hunt	1ef9a32de7	slight refactoring in validated() fix some minor code redundancies.	2025-02-26 15:28:57 -08:00
Evan Hunt	6c738fe323	simplify dns_ncache_add() there's no longer any reason to have both dns_ncache_add() and dns_ncache_addoptout().	2025-02-26 15:28:57 -08:00