set "multi-master" automatically with multiple primaries

By default, named logs a message at level info if a secondary zone receives an update indicating that the serial number has gone backwards. The "multi-master" option was provided to allow this message to be suppressed if a zone was configured with multiple primary servers. That option has now been marked obsolete. The message is now logged at debug level 1 when there are multiple primary server addresses configured for the zone. It is still logged at level info if there is only address.
2024-12-11 11:15:04 -08:00
330 changed files with 2757 additions and 2127 deletions
@@ -564,13 +564,7 @@ clang-format:
    when: on_failure

 coccinelle:
-  ######################################################################
-  # Revert to using the "precheck_job" anchor after the "base" image is
-  # upgraded to Debian trixie, which has Coccinelle 1.2.
-  <<: *default_triggering_rules
-  <<: *debian_sid_amd64_image
-  stage: precheck
-  ######################################################################
+  <<: *precheck_job
  needs: []
  script:
    - util/check-cocci
@@ -908,8 +902,7 @@ gcc:bookworm:amd64:
  variables:
    CC: gcc
    CFLAGS: "${CFLAGS_COMMON} --coverage -O0"
-    # Tracing needs to be disabled otherwise gcovr fails
-    EXTRA_CONFIGURE: "--with-libidn2 ${WITH_READLINE_LIBEDIT} --disable-tracing"
+    EXTRA_CONFIGURE: "--with-libidn2 ${WITH_READLINE_LIBEDIT}"
    RUN_MAKE_INSTALL: 1
  <<: *debian_bookworm_amd64_image
  <<: *build_job
@@ -1668,14 +1661,6 @@ shotgun:dot:
  when: delayed
  start_in: 5 minutes

-shotgun:doh-get:
-  <<: *shotgun_job
-  variables:
-    SHOTGUN_SCENARIO: doh-get
-    SHOTGUN_TRAFFIC_MULTIPLIER: 3
-  when: delayed
-  start_in: 5 minutes
-
 .stress-test: &stress_test
  stage: performance
  script:
@@ -11,7 +11,7 @@ See the COPYRIGHT file distributed with this work for additional
 information regarding copyright ownership.
 -->
 ## BIND 9 Source Access and Contributor Guidelines
-*Nov 26, 2024*
+*May 28, 2020*

 ### Contents

@@ -72,13 +72,13 @@ To clone the repository, use:
 >       $ git clone https://gitlab.isc.org/isc-projects/bind9.git

 Release branch names are of the form `bind-9.X`, where X represents the second
-number in the BIND 9 version number.  So, to check out the BIND 9.20
+number in the BIND 9 version number.  So, to check out the BIND 9.18
 branch, use:

->       $ git checkout bind-9.20
+>       $ git checkout bind-9.18

 Whenever a branch is ready for publication, a tag is placed of the
-form `v9.X.Y`.  The 9.20.0 release, for instance, is tagged as `v9.20.0`.
+form `v9.X.Y`.  The 9.18.0 release, for instance, is tagged as `v9.18.0`.

 The branch in which the next major release is being developed is called
 `main`.
@@ -121,9 +121,8 @@ patch will be applied.
 #### <a name="bind"></a>BIND code

 Patches for BIND may be submitted directly via merge requests in
-[ISC's GitLab](https://gitlab.isc.org/isc-projects/bind9/) source repository for
-BIND. Please contact ISC and provide your GitLab username in order to be allowed
-to fork the project and submit merge requests.
+[ISC's GitLab](https://gitlab.isc.org/isc-projects/bind9/) source
+repository for BIND.

 Patches can also be submitted as diffs against a specific version of
 BIND -- preferably the current top of the `main` branch.  Diffs may
@@ -145,8 +144,8 @@ we're busy with other work, it may take us a long time to get to it.
 To ensure your patch is acted on as promptly as possible, please:

 * Try to adhere to the [BIND 9 coding style](doc/dev/style.md).
-* Run unit and system tests to ensure your change hasn't caused any
-  functional regressions (these can be checked in the CI pipeline).
+* Run `make check` to ensure your change hasn't caused any
+  functional regressions.
 * Document your work, both in the patch itself and in the
  accompanying email.
 * In patches that make non-trivial functional changes, include system
@@ -157,12 +156,12 @@ To ensure your patch is acted on as promptly as possible, please:
 ##### Changes to `configure`

 If you need to make changes to `configure`, you should not edit it
-directly; instead, edit `configure.ac`, then run `autoconf`.  Similarly,
-instead of editing `config.h.in` directly, edit `configure.ac` and run
+directly; instead, edit `configure.in`, then run `autoconf`.  Similarly,
+instead of editing `config.h.in` directly, edit `configure.in` and run
 `autoheader`.

 When submitting a patch as a diff, it's fine to omit the `configure`
-diffs to save space.  Just send the `configure.ac` diffs and we'll
+diffs to save space.  Just send the `configure.in` diffs and we'll
 generate the new `configure` during the review process.

 ##### Documentation
@@ -144,97 +144,12 @@ logged(char *key, int value) {
 	return false;
 }

-static bool
-checkisservedby(dns_zone_t *zone, dns_rdatatype_t type,
-		const dns_name_t *name) {
-	char namebuf[DNS_NAME_FORMATSIZE + 1];
-	char ownerbuf[DNS_NAME_FORMATSIZE + 1];
-	/*
-	 * Not all getaddrinfo implementations distinguish NODATA
-	 * from NXDOMAIN with PF_INET6 so use PF_UNSPEC and look at
-	 * the returned ai_family values.
-	 */
-	struct addrinfo hints = {
-		.ai_flags = AI_CANONNAME,
-		.ai_family = PF_UNSPEC,
-		.ai_socktype = SOCK_STREAM,
-		.ai_protocol = IPPROTO_TCP,
-	};
-	struct addrinfo *ai = NULL, *cur;
-	bool has_type = false;
-	int eai;
-
-	dns_name_format(name, namebuf, sizeof(namebuf) - 1);
-	/*
-	 * Turn off search.
-	 */
-	if (dns_name_countlabels(name) > 1U) {
-		strlcat(namebuf, ".", sizeof(namebuf));
-	}
-	eai = getaddrinfo(namebuf, NULL, &hints, &ai);
-
-	switch (eai) {
-	case 0:
-		cur = ai;
-		while (cur != NULL) {
-			if (cur->ai_family == AF_INET &&
-			    type == dns_rdatatype_a)
-			{
-				has_type = true;
-				break;
-			}
-			if (cur->ai_family == AF_INET6 &&
-			    type == dns_rdatatype_aaaa)
-			{
-				has_type = true;
-				break;
-			}
-			cur = cur->ai_next;
-		}
-		freeaddrinfo(ai);
-		return has_type;
-#if defined(EAI_NODATA) && (EAI_NODATA != EAI_NONAME)
-	case EAI_NODATA:
-#endif /* if defined(EAI_NODATA) && (EAI_NODATA != EAI_NONAME) */
-	case EAI_NONAME:
-		if (!logged(namebuf, ERR_NO_ADDRESSES)) {
-			dns_name_format(dns_zone_getorigin(zone), ownerbuf,
-					sizeof(ownerbuf));
-			dns_name_format(name, namebuf, sizeof(namebuf) - 1);
-			dns_zone_log(zone, ISC_LOG_ERROR,
-				     "%s/NS '%s' (out of zone) "
-				     "has no addresses records (A or AAAA)",
-				     ownerbuf, namebuf);
-			add(namebuf, ERR_NO_ADDRESSES);
-		}
-		return false;
-	default:
-		if (!logged(namebuf, ERR_LOOKUP_FAILURE)) {
-			dns_name_format(dns_zone_getorigin(zone), ownerbuf,
-					sizeof(ownerbuf));
-			dns_name_format(name, namebuf, sizeof(namebuf) - 1);
-			dns_zone_log(zone, ISC_LOG_WARNING,
-				     "getaddrinfo(%s) failed: %s", namebuf,
-				     gai_strerror(eai));
-			add(namebuf, ERR_LOOKUP_FAILURE);
-		}
-		return true;
-	}
-}
-
 static bool
 checkns(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner,
 	dns_rdataset_t *a, dns_rdataset_t *aaaa) {
 	dns_rdataset_t *rdataset;
 	dns_rdata_t rdata = DNS_RDATA_INIT;
-	isc_result_t result;
-	struct addrinfo hints = {
-		.ai_flags = AI_CANONNAME,
-		.ai_family = PF_UNSPEC,
-		.ai_socktype = SOCK_STREAM,
-		.ai_protocol = IPPROTO_TCP,
-	};
-	struct addrinfo *ai = NULL, *cur;
+	struct addrinfo hints, *ai, *cur;
 	char namebuf[DNS_NAME_FORMATSIZE + 1];
 	char ownerbuf[DNS_NAME_FORMATSIZE];
 	char addrbuf[sizeof("xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:123.123.123.123")];
@@ -242,7 +157,7 @@ checkns(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner,
 	bool match;
 	const char *type;
 	void *ptr = NULL;
-	int eai;
+	int result;

 	REQUIRE(a == NULL || !dns_rdataset_isassociated(a) ||
 		a->type == dns_rdatatype_a);
@@ -253,6 +168,12 @@ checkns(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner,
 		return answer;
 	}

+	memset(&hints, 0, sizeof(hints));
+	hints.ai_flags = AI_CANONNAME;
+	hints.ai_family = PF_UNSPEC;
+	hints.ai_socktype = SOCK_STREAM;
+	hints.ai_protocol = IPPROTO_TCP;
+
 	dns_name_format(name, namebuf, sizeof(namebuf) - 1);
 	/*
 	 * Turn off search.
@@ -262,9 +183,9 @@ checkns(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner,
 	}
 	dns_name_format(owner, ownerbuf, sizeof(ownerbuf));

-	eai = getaddrinfo(namebuf, NULL, &hints, &ai);
+	result = getaddrinfo(namebuf, NULL, &hints, &ai);
 	dns_name_format(name, namebuf, sizeof(namebuf) - 1);
-	switch (eai) {
+	switch (result) {
 	case 0:
 		/*
 		 * Work around broken getaddrinfo() implementations that
@@ -307,7 +228,7 @@ checkns(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner,
 		if (!logged(namebuf, ERR_LOOKUP_FAILURE)) {
 			dns_zone_log(zone, ISC_LOG_WARNING,
 				     "getaddrinfo(%s) failed: %s", namebuf,
-				     gai_strerror(eai));
+				     gai_strerror(result));
 			add(namebuf, ERR_LOOKUP_FAILURE);
 		}
 		return true;
@@ -437,27 +358,25 @@ checkmissing:
 			add(namebuf, ERR_MISSING_GLUE);
 		}
 	}
-	if (ai != NULL) {
-		freeaddrinfo(ai);
-	}
+	freeaddrinfo(ai);
 	return answer;
 }

 static bool
 checkmx(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner) {
-	struct addrinfo hints = {
-		.ai_flags = AI_CANONNAME,
-		.ai_family = PF_UNSPEC,
-		.ai_socktype = SOCK_STREAM,
-		.ai_protocol = IPPROTO_TCP,
-	};
-	struct addrinfo *ai = NULL, *cur;
+	struct addrinfo hints, *ai, *cur;
 	char namebuf[DNS_NAME_FORMATSIZE + 1];
 	char ownerbuf[DNS_NAME_FORMATSIZE];
-	int eai;
+	int result;
 	int level = ISC_LOG_ERROR;
 	bool answer = true;

+	memset(&hints, 0, sizeof(hints));
+	hints.ai_flags = AI_CANONNAME;
+	hints.ai_family = PF_UNSPEC;
+	hints.ai_socktype = SOCK_STREAM;
+	hints.ai_protocol = IPPROTO_TCP;
+
 	dns_name_format(name, namebuf, sizeof(namebuf) - 1);
 	/*
 	 * Turn off search.
@@ -467,9 +386,9 @@ checkmx(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner) {
 	}
 	dns_name_format(owner, ownerbuf, sizeof(ownerbuf));

-	eai = getaddrinfo(namebuf, NULL, &hints, &ai);
+	result = getaddrinfo(namebuf, NULL, &hints, &ai);
 	dns_name_format(name, namebuf, sizeof(namebuf) - 1);
-	switch (eai) {
+	switch (result) {
 	case 0:
 		/*
 		 * Work around broken getaddrinfo() implementations that
@@ -502,9 +421,7 @@ checkmx(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner) {
 				}
 			}
 		}
-		if (ai != NULL) {
-			freeaddrinfo(ai);
-		}
+		freeaddrinfo(ai);
 		return answer;

 	case EAI_NONAME:
@@ -525,7 +442,7 @@ checkmx(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner) {
 		if (!logged(namebuf, ERR_LOOKUP_FAILURE)) {
 			dns_zone_log(zone, ISC_LOG_WARNING,
 				     "getaddrinfo(%s) failed: %s", namebuf,
-				     gai_strerror(eai));
+				     gai_strerror(result));
 			add(namebuf, ERR_LOOKUP_FAILURE);
 		}
 		return true;
@@ -534,19 +451,19 @@ checkmx(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner) {

 static bool
 checksrv(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner) {
-	struct addrinfo hints = {
-		.ai_flags = AI_CANONNAME,
-		.ai_family = PF_UNSPEC,
-		.ai_socktype = SOCK_STREAM,
-		.ai_protocol = IPPROTO_TCP,
-	};
-	struct addrinfo *ai = NULL, *cur;
+	struct addrinfo hints, *ai, *cur;
 	char namebuf[DNS_NAME_FORMATSIZE + 1];
 	char ownerbuf[DNS_NAME_FORMATSIZE];
-	int eai;
+	int result;
 	int level = ISC_LOG_ERROR;
 	bool answer = true;

+	memset(&hints, 0, sizeof(hints));
+	hints.ai_flags = AI_CANONNAME;
+	hints.ai_family = PF_UNSPEC;
+	hints.ai_socktype = SOCK_STREAM;
+	hints.ai_protocol = IPPROTO_TCP;
+
 	dns_name_format(name, namebuf, sizeof(namebuf) - 1);
 	/*
 	 * Turn off search.
@@ -556,9 +473,9 @@ checksrv(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner) {
 	}
 	dns_name_format(owner, ownerbuf, sizeof(ownerbuf));

-	eai = getaddrinfo(namebuf, NULL, &hints, &ai);
+	result = getaddrinfo(namebuf, NULL, &hints, &ai);
 	dns_name_format(name, namebuf, sizeof(namebuf) - 1);
-	switch (eai) {
+	switch (result) {
 	case 0:
 		/*
 		 * Work around broken getaddrinfo() implementations that
@@ -591,9 +508,7 @@ checksrv(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner) {
 				}
 			}
 		}
-		if (ai != NULL) {
-			freeaddrinfo(ai);
-		}
+		freeaddrinfo(ai);
 		return answer;

 	case EAI_NONAME:
@@ -614,7 +529,7 @@ checksrv(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner) {
 		if (!logged(namebuf, ERR_LOOKUP_FAILURE)) {
 			dns_zone_log(zone, ISC_LOG_WARNING,
 				     "getaddrinfo(%s) failed: %s", namebuf,
-				     gai_strerror(eai));
+				     gai_strerror(result));
 			add(namebuf, ERR_LOOKUP_FAILURE);
 		}
 		return true;
@@ -688,7 +603,6 @@ load_zone(isc_mem_t *mctx, const char *zonename, const char *filename,
 	}
 	if (docheckns) {
 		dns_zone_setcheckns(zone, checkns);
-		dns_zone_setcheckisservedby(zone, checkisservedby);
 	}
 	if (dochecksrv) {
 		dns_zone_setchecksrv(zone, checksrv);
@@ -18,6 +18,7 @@
 #include <inttypes.h>
 #include <stdbool.h>

+#include <isc/lang.h>
 #include <isc/stdio.h>
 #include <isc/types.h>

@@ -25,6 +26,8 @@
 #include <dns/types.h>
 #include <dns/zone.h>

+ISC_LANG_BEGINDECLS
+
 isc_result_t
 setup_logging(FILE *errout);

@@ -45,3 +48,5 @@ extern bool docheckmx;
 extern bool docheckns;
 extern bool dochecksrv;
 extern dns_zoneopt_t zone_options;
+
+ISC_LANG_ENDDECLS
@@ -91,13 +91,9 @@ Options
   (both in-zone and out-of-zone hostnames). Mode ``local`` only
   checks SRV records which refer to in-zone hostnames.

-   Mode ``full`` checks that a zone that has A or AAAA records it is served
-   by a server with the same type of address records.
-
   Mode ``full`` checks that delegation NS records refer to A or AAAA
   records (both in-zone and out-of-zone hostnames). It also checks that
   glue address records in the zone match those advertised by the child.
-
   Mode ``local`` only checks NS records which refer to in-zone
   hostnames or verifies that some required glue exists, i.e., when the
   name server is in a child zone.
@@ -17,6 +17,10 @@

 #include <stdio.h>

+#include <isc/lang.h>
+
+ISC_LANG_BEGINDECLS
+
 int
 set_user(FILE *fd, const char *user);
 /*%<
@@ -25,3 +29,5 @@ set_user(FILE *fd, const char *user);
 *   0 		success
 *   -1 	insufficient permissions, or 'user' does not exist.
 */
+
+ISC_LANG_ENDDECLS
@@ -16,10 +16,13 @@
 /*! \file */

 #include <isc/buffer.h>
+#include <isc/lang.h>
 #include <isc/mem.h>

 #include <dns/secalg.h>

+ISC_LANG_BEGINDECLS
+
 void
 generate_key(isc_mem_t *mctx, dns_secalg_t alg, int keysize,
 	     isc_buffer_t *key_txtbuffer);
@@ -34,3 +37,5 @@ dns_secalg_t
 alg_fromtext(const char *name);
 int
 alg_bits(dns_secalg_t alg);
+
+ISC_LANG_ENDDECLS
@@ -17,6 +17,7 @@

 #include <isc/attributes.h>
 #include <isc/formatcheck.h>
+#include <isc/lang.h>

 #define NS_CONTROL_PORT 953

@@ -30,8 +31,12 @@
 			notify("%s", name);                               \
 	} while (0)

+ISC_LANG_BEGINDECLS
+
 void
 notify(const char *fmt, ...) ISC_FORMAT_PRINTF(1, 2);

 ISC_NORETURN void
 fatal(const char *format, ...) ISC_FORMAT_PRINTF(1, 2);
+
+ISC_LANG_ENDDECLS
@@ -228,6 +228,7 @@ usage(void) {
 		"                 +[no]crypto         (Control display of "
 		"cryptographic\n"
 		"                                      fields in records)\n"
+		"                 +[no]dlv            (Obsolete)\n"
 		"                 +[no]dnssec         (Display DNSSEC "
 		"records)\n"
 		"                 +[no]mtrace         (Trace messages "
@@ -1124,6 +1125,14 @@ plus_option(char *option) {
 		break;
 	case 'd':
 		switch (cmd[1]) {
+		case 'l': /* dlv */
+			FULLCHECK("dlv");
+			if (state) {
+				fprintf(stderr, "Invalid option: "
+						"+dlv is obsolete\n");
+				exit(EXIT_FAILURE);
+			}
+			break;
 		case 'n': /* dnssec */
 			FULLCHECK("dnssec");
 			showdnssec = state;
@@ -40,6 +40,7 @@
 #include <isc/file.h>
 #include <isc/getaddresses.h>
 #include <isc/hex.h>
+#include <isc/lang.h>
 #include <isc/log.h>
 #include <isc/loop.h>
 #include <isc/managers.h>
@@ -2778,12 +2779,6 @@ _cancel_lookup(dig_lookup_t *lookup, const char *file, unsigned int line) {
 	check_if_done();
 }

-static inline const char *
-get_tls_sni_hostname(dig_query_t *query) {
-	return query->lookup->tls_hostname_set ? query->lookup->tls_hostname
-					       : query->userarg;
-}
-
 static isc_tlsctx_t *
 get_create_tls_context(dig_query_t *query, const bool is_https,
 		       isc_tlsctx_client_session_cache_t **psess_cache) {
@@ -2830,7 +2825,10 @@ get_create_tls_context(dig_query_t *query, const bool is_https,
 		}

 		if (store != NULL) {
-			const char *hostname = get_tls_sni_hostname(query);
+			const char *hostname =
+				query->lookup->tls_hostname_set
+					? query->lookup->tls_hostname
+					: query->userarg;
 			/*
 			 * According to RFC 8310, Subject field MUST NOT be
 			 * inspected when verifying hostname for DoT. Only
@@ -3044,8 +3042,7 @@ start_tcp(dig_query_t *query) {
 		}
 		isc_nm_streamdnsconnect(netmgr, &localaddr, &query->sockaddr,
 					tcp_connected, connectquery,
-					local_timeout, tlsctx,
-					get_tls_sni_hostname(query), sess_cache,
+					local_timeout, tlsctx, sess_cache,
 					proxy_type, ppi);
 #if HAVE_LIBNGHTTP2
 	} else if (query->lookup->https_mode) {
@@ -3065,15 +3062,14 @@ start_tcp(dig_query_t *query) {

 		isc_nm_httpconnect(netmgr, &localaddr, &query->sockaddr, uri,
 				   !query->lookup->https_get, tcp_connected,
-				   connectquery, tlsctx,
-				   get_tls_sni_hostname(query), sess_cache,
+				   connectquery, tlsctx, sess_cache,
 				   local_timeout, proxy_type, ppi);
 #endif
 	} else {
 		isc_nm_streamdnsconnect(netmgr, &localaddr, &query->sockaddr,
 					tcp_connected, connectquery,
-					local_timeout, NULL, NULL, NULL,
-					proxy_type, ppi);
+					local_timeout, NULL, NULL, proxy_type,
+					ppi);
 	}

 	return;
@@ -21,6 +21,7 @@
 #include <isc/attributes.h>
 #include <isc/buffer.h>
 #include <isc/formatcheck.h>
+#include <isc/lang.h>
 #include <isc/list.h>
 #include <isc/loop.h>
 #include <isc/magic.h>
@@ -84,6 +85,8 @@
 * in a tight loop of constant lookups.  It's value is arbitrary.
 */

+ISC_LANG_BEGINDECLS
+
 typedef struct dig_lookup dig_lookup_t;
 typedef struct dig_query dig_query_t;
 typedef struct dig_server dig_server_t;
@@ -463,3 +466,5 @@ dig_shutdown(void);

 bool
 dig_lookup_is_tls(const dig_lookup_t *lookup);
+
+ISC_LANG_ENDDECLS
@@ -381,7 +381,7 @@ main(int argc, char **argv) {

 	isc_commandline_errprint = false;

-#define OPTIONS "12Aa:Cc:d:Ff:K:sT:v:whV"
+#define OPTIONS "12Aa:Cc:d:Ff:K:l:sT:v:whV"
 	while ((ch = isc_commandline_parse(argc, argv, OPTIONS)) != -1) {
 		switch (ch) {
 		case '1':
@@ -417,6 +417,9 @@ main(int argc, char **argv) {
 		case 'f':
 			filename = isc_commandline_argument;
 			break;
+		case 'l':
+			fatal("-l option (DLV lookaside) is obsolete");
+			break;
 		case 's':
 			usekeyset = true;
 			break;
@@ -3372,12 +3372,9 @@ main(int argc, char *argv[]) {
 	atomic_init(&shuttingdown, false);
 	atomic_init(&finished, false);

-	/*
-	 * Unused letters: Bb G J l q Yy (and F is reserved).
-	 * l was previously used for DLV lookaside.
-	 */
-#define CMDLINE_FLAGS                                                        \
-	"3:AaCc:Dd:E:e:f:FgG:hH:i:I:j:J:K:k:L:m:M:n:N:o:O:PpQqRr:s:ST:tuUv:" \
+	/* Unused letters: Bb G J q Yy (and F is reserved). */
+#define CMDLINE_FLAGS                                                          \
+	"3:AaCc:Dd:E:e:f:FgG:hH:i:I:j:J:K:k:L:l:m:M:n:N:o:O:PpQqRr:s:ST:tuUv:" \
 	"VX:xzZ:"

 	/*
@@ -3551,6 +3548,10 @@ main(int argc, char *argv[]) {
 			}
 			break;

+		case 'l':
+			fatal("-l option (DLV lookaside) is obsolete");
+			break;
+
 		case 'M':
 			endp = NULL;
 			set_maxttl = true;
@@ -460,7 +460,9 @@ key_collision(dst_key_t *dstkey, dns_name_t *name, const char *dir,
 	dns_secalg_t alg;
 	isc_stdtime_t now = isc_stdtime_now();

-	SET_IF_NOT_NULL(exact, false);
+	if (exact != NULL) {
+		*exact = false;
+	}

 	id = dst_key_id(dstkey);
 	rid = dst_key_rid(dstkey);
@@ -193,6 +193,7 @@ options {\n\
 	require-server-cookie no;\n\
 	root-key-sentinel yes;\n\
 	servfail-ttl 1;\n\
+#	sortlist <none>\n\
 	stale-answer-client-timeout off;\n\
 	stale-answer-enable false;\n\
 	stale-answer-ttl 30; /* 30 seconds */\n\
@@ -331,7 +332,7 @@ dnssec-policy \"insecure\" {\n\

 			    "# END TRUST ANCHORS\n\
 \n\
-remote-servers " DEFAULT_IANA_ROOT_ZONE_PRIMARIES " {\n\
+primaries " DEFAULT_IANA_ROOT_ZONE_PRIMARIES " {\n\
 	2801:1b8:10::b;		# b.root-servers.net\n\
 	2001:500:2::c;		# c.root-servers.net\n\
 	2001:500:2f::f;		# f.root-servers.net\n\
@@ -503,9 +504,9 @@ named_config_getzonetype(const cfg_obj_t *zonetypeobj) {
 	return ztype;
 }

-isc_result_t
-named_config_getremotesdef(const cfg_obj_t *cctx, const char *list,
-			   const char *name, const cfg_obj_t **ret) {
+static isc_result_t
+getremotesdef(const cfg_obj_t *cctx, const char *list, const char *name,
+	      const cfg_obj_t **ret) {
 	isc_result_t result;
 	const cfg_obj_t *obj = NULL;
 	const cfg_listelt_t *elt;
@@ -532,6 +533,23 @@ named_config_getremotesdef(const cfg_obj_t *cctx, const char *list,
 	return ISC_R_NOTFOUND;
 }

+isc_result_t
+named_config_getremotesdef(const cfg_obj_t *cctx, const char *list,
+			   const char *name, const cfg_obj_t **ret) {
+	isc_result_t result;
+
+	if (strcmp(list, "parental-agents") == 0) {
+		return getremotesdef(cctx, list, name, ret);
+	} else if (strcmp(list, "primaries") == 0) {
+		result = getremotesdef(cctx, list, name, ret);
+		if (result != ISC_R_SUCCESS) {
+			result = getremotesdef(cctx, "masters", name, ret);
+		}
+		return result;
+	}
+	return ISC_R_NOTFOUND;
+}
+
 static isc_result_t
 named_config_getname(isc_mem_t *mctx, const cfg_obj_t *obj,
 		     dns_name_t **namep) {
@@ -580,12 +598,10 @@ named_config_getname(isc_mem_t *mctx, const cfg_obj_t *obj,
 		oldlen = newlen;                                    \
 	}

-static const char *remotesnames[4] = { "remote-servers", "parental-agents",
-				       "primaries", "masters" };
-
 isc_result_t
-named_config_getipandkeylist(const cfg_obj_t *config, const cfg_obj_t *list,
-			     isc_mem_t *mctx, dns_ipkeylist_t *ipkl) {
+named_config_getipandkeylist(const cfg_obj_t *config, const char *listtype,
+			     const cfg_obj_t *list, isc_mem_t *mctx,
+			     dns_ipkeylist_t *ipkl) {
 	uint32_t addrcount = 0, srccount = 0;
 	uint32_t keycount = 0, tlscount = 0;
 	uint32_t listcount = 0, l = 0, i = 0;
@@ -668,6 +684,8 @@ newlist:
 		isc_sockaddr_any6(&src6);
 	}

+	result = ISC_R_NOMEMORY;
+
 	element = cfg_list_first(addrlist);
 resume:
 	for (; element != NULL; element = cfg_list_next(element)) {
@@ -698,22 +716,17 @@ resume:
 				continue;
 			}
 			list = NULL;
-			tresult = ISC_R_NOTFOUND;
-			for (size_t n = 0; n < ARRAY_SIZE(remotesnames); n++) {
-				tresult = named_config_getremotesdef(
-					config, remotesnames[n], listname,
-					&list);
-				if (tresult == ISC_R_SUCCESS) {
-					break;
-				}
-			}
+			tresult = named_config_getremotesdef(config, listtype,
+							     listname, &list);
 			if (tresult == ISC_R_NOTFOUND) {
 				cfg_obj_log(addr, ISC_LOG_ERROR,
-					    "remote-servers \"%s\" not found",
+					    "%s \"%s\" not found", listtype,
 					    listname);
+
+				result = tresult;
+				goto cleanup;
 			}
 			if (tresult != ISC_R_SUCCESS) {
-				result = tresult;
 				goto cleanup;
 			}
 			lists[l++].name = listname;
@@ -17,6 +17,7 @@

 #include <inttypes.h>

+#include <isc/lang.h>
 #include <isc/types.h>

 #include <dns/clientinfo.h>
@@ -57,8 +57,9 @@ named_config_getremotesdef(const cfg_obj_t *cctx, const char *list,
 			   const char *name, const cfg_obj_t **ret);

 isc_result_t
-named_config_getipandkeylist(const cfg_obj_t *config, const cfg_obj_t *list,
-			     isc_mem_t *mctx, dns_ipkeylist_t *ipkl);
+named_config_getipandkeylist(const cfg_obj_t *config, const char *listtype,
+			     const cfg_obj_t *list, isc_mem_t *mctx,
+			     dns_ipkeylist_t *ipkl);

 isc_result_t
 named_config_getport(const cfg_obj_t *config, const char *type,
@@ -15,10 +15,13 @@

 /*! \file */

+#include <isc/lang.h>
 #include <isc/types.h>

 #include <isccfg/cfg.h>

+ISC_LANG_BEGINDECLS
+
 isc_result_t
 named_tkeyctx_fromconfig(const cfg_obj_t *options, isc_mem_t *mctx,
 			 dns_tkeyctx_t **tctxp);
@@ -36,3 +39,5 @@ named_tkeyctx_fromconfig(const cfg_obj_t *options, isc_mem_t *mctx,
 *\li		ISC_R_SUCCESS
 *\li		ISC_R_NOMEMORY
 */
+
+ISC_LANG_ENDDECLS
@@ -15,12 +15,15 @@

 /*! \file */

+#include <isc/lang.h>
 #include <isc/types.h>

 #include <dns/transport.h>

 #include <isccfg/cfg.h>

+ISC_LANG_BEGINDECLS
+
 isc_result_t
 named_transports_fromconfig(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 			    isc_mem_t *mctx, dns_transport_list_t **listp);
@@ -36,3 +39,5 @@ named_transports_fromconfig(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 *	\li	'listp' is not NULL, and '*listp' is NULL
 *
 */
+
+ISC_LANG_ENDDECLS
@@ -15,8 +15,11 @@

 /*! \file */

+#include <isc/lang.h>
 #include <isc/types.h>

+ISC_LANG_BEGINDECLS
+
 isc_result_t
 named_tsigkeyring_fromconfig(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 			     isc_mem_t *mctx, dns_tsigkeyring_t **ringp);
@@ -34,3 +37,5 @@ named_tsigkeyring_fromconfig(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 *	\li	ISC_R_SUCCESS
 *	\li	ISC_R_NOMEMORY
 */
+
+ISC_LANG_ENDDECLS
@@ -17,11 +17,14 @@

 #include <stdbool.h>

+#include <isc/lang.h>
 #include <isc/types.h>

 #include <isccfg/aclconf.h>
 #include <isccfg/cfg.h>

+ISC_LANG_BEGINDECLS
+
 isc_result_t
 named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 		     const cfg_obj_t *zconfig, cfg_aclconfctx_t *ac,
@@ -73,3 +76,5 @@ named_zone_configure_writeable_dlz(dns_dlzdb_t *dlzdatabase, dns_zone_t *zone,
 * \li	'rdclass' to be a valid rdataclass
 * \li	'name' to be a valid zone origin name
 */
+
+ISC_LANG_ENDDECLS
@@ -584,6 +584,51 @@ configure_view_acl(const cfg_obj_t *vconfig, const cfg_obj_t *config,
 	return result;
 }

+/*%
+ * Configure a sortlist at '*aclp'.  Essentially the same as
+ * configure_view_acl() except it calls cfg_acl_fromconfig with a
+ * nest_level value of 2.
+ */
+static isc_result_t
+configure_view_sortlist(const cfg_obj_t *vconfig, const cfg_obj_t *config,
+			cfg_aclconfctx_t *actx, isc_mem_t *mctx,
+			dns_acl_t **aclp) {
+	isc_result_t result;
+	const cfg_obj_t *maps[3];
+	const cfg_obj_t *aclobj = NULL;
+	int i = 0;
+
+	if (*aclp != NULL) {
+		dns_acl_detach(aclp);
+	}
+	if (vconfig != NULL) {
+		maps[i++] = cfg_tuple_get(vconfig, "options");
+	}
+	if (config != NULL) {
+		const cfg_obj_t *options = NULL;
+		(void)cfg_map_get(config, "options", &options);
+		if (options != NULL) {
+			maps[i++] = options;
+		}
+	}
+	maps[i] = NULL;
+
+	(void)named_config_get(maps, "sortlist", &aclobj);
+	if (aclobj == NULL) {
+		return ISC_R_SUCCESS;
+	}
+
+	/*
+	 * Use a nest level of 3 for the "top level" of the sortlist;
+	 * this means each entry in the top three levels will be stored
+	 * as lists of separate, nested ACLs, rather than merged together
+	 * into IP tables as is usually done with ACLs.
+	 */
+	result = cfg_acl_fromconfig(aclobj, config, actx, mctx, 3, aclp);
+
+	return result;
+}
+
 static isc_result_t
 configure_view_nametable(const cfg_obj_t *vconfig, const cfg_obj_t *config,
 			 const char *confname, const char *conftuplename,
@@ -2779,8 +2824,8 @@ configure_catz_zone(dns_view_t *view, dns_view_t *pview,
 		obj = cfg_tuple_get(catz_obj, "default-primaries");
 	}
 	if (obj != NULL && cfg_obj_istuple(obj)) {
-		result = named_config_getipandkeylist(config, obj, view->mctx,
-						      &opts->masters);
+		result = named_config_getipandkeylist(
+			config, "primaries", obj, view->mctx, &opts->masters);
 	}

 	obj = cfg_tuple_get(catz_obj, "in-memory");
@@ -5076,6 +5121,12 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist, cfg_obj_t *config,
 				       "except-from", named_g_mctx,
 				       &view->answernames_exclude));

+	/*
+	 * Configure sortlist, if set
+	 */
+	CHECK(configure_view_sortlist(vconfig, config, actx, named_g_mctx,
+				      &view->sortlist));
+
 	/*
 	 * Configure default allow-update and allow-update-forwarding ACLs,
 	 * so they can be inherited by zones. (XXX: These are not
@@ -897,7 +897,6 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 	const char *dupcheck;
 	dns_checkdstype_t checkdstype = dns_checkdstype_yes;
 	dns_notifytype_t notifytype = dns_notifytype_yes;
-	uint32_t count;
 	unsigned int dbargc;
 	char **dbargv;
 	static char default_dbtype[] = ZONEDB_DEFAULT;
@@ -907,7 +906,6 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 	dns_zonetype_t ztype;
 	int i;
 	int32_t journal_size;
-	bool multi;
 	dns_kasp_t *kasp = NULL;
 	bool check = false, fail = false;
 	bool warn = false, ignore = false;
@@ -1273,8 +1271,8 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 			dns_ipkeylist_t ipkl;
 			dns_ipkeylist_init(&ipkl);

-			CHECK(named_config_getipandkeylist(config, obj, mctx,
-							   &ipkl));
+			CHECK(named_config_getipandkeylist(config, "primaries",
+							   obj, mctx, &ipkl));
 			dns_zone_setalsonotify(zone, ipkl.addrs, ipkl.sources,
 					       ipkl.keys, ipkl.tlss,
 					       ipkl.count);
@@ -1679,8 +1677,9 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 		if (parentals != NULL) {
 			dns_ipkeylist_t ipkl;
 			dns_ipkeylist_init(&ipkl);
-			CHECK(named_config_getipandkeylist(config, parentals,
-							   mctx, &ipkl));
+			CHECK(named_config_getipandkeylist(
+				config, "parental-agents", parentals, mctx,
+				&ipkl));
 			dns_zone_setparentals(zone, ipkl.addrs, ipkl.sources,
 					      ipkl.keys, ipkl.tlss, ipkl.count);
 			dns_ipkeylist_clear(mctx, &ipkl);
@@ -1837,7 +1836,6 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 	case dns_zone_secondary:
 	case dns_zone_stub:
 	case dns_zone_redirect:
-		count = 0;
 		obj = NULL;
 		(void)cfg_map_get(zoptions, "primaries", &obj);
 		if (obj == NULL) {
@@ -1852,7 +1850,7 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 		    dns_name_equal(dns_zone_getorigin(zone), dns_rootname))
 		{
 			result = named_config_getremotesdef(
-				named_g_config, "remote-servers",
+				named_g_config, "primaries",
 				DEFAULT_IANA_ROOT_ZONE_PRIMARIES, &obj);
 			CHECK(result);
 		}
@@ -1860,27 +1858,17 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 			dns_ipkeylist_t ipkl;
 			dns_ipkeylist_init(&ipkl);

-			CHECK(named_config_getipandkeylist(config, obj, mctx,
-							   &ipkl));
+			CHECK(named_config_getipandkeylist(config, "primaries",
+							   obj, mctx, &ipkl));
 			dns_zone_setprimaries(mayberaw, ipkl.addrs,
 					      ipkl.sources, ipkl.keys,
 					      ipkl.tlss, ipkl.count);
-			count = ipkl.count;
 			dns_ipkeylist_clear(mctx, &ipkl);
 		} else {
 			dns_zone_setprimaries(mayberaw, NULL, NULL, NULL, NULL,
 					      0);
 		}

-		multi = false;
-		if (count > 1) {
-			obj = NULL;
-			result = named_config_get(maps, "multi-master", &obj);
-			INSIST(result == ISC_R_SUCCESS && obj != NULL);
-			multi = cfg_obj_asboolean(obj);
-		}
-		dns_zone_setoption(mayberaw, DNS_ZONEOPT_MULTIMASTER, multi);
-
 		obj = NULL;
 		result = named_config_get(maps, "max-transfer-time-in", &obj);
 		INSIST(result == ISC_R_SUCCESS && obj != NULL);
@@ -17,6 +17,7 @@

 #include <isc/attributes.h>
 #include <isc/formatcheck.h>
+#include <isc/lang.h>

 #define NS_CONTROL_PORT 953

@@ -30,8 +31,12 @@
 			notify("%s", name);                               \
 	} while (0)

+ISC_LANG_BEGINDECLS
+
 void
 notify(const char *fmt, ...) ISC_FORMAT_PRINTF(1, 2);

 ISC_NORETURN void
 fatal(const char *format, ...) ISC_FORMAT_PRINTF(1, 2);
+
+ISC_LANG_ENDDECLS
@@ -150,6 +150,7 @@ TESTS =				\
 	sfcache			\
 	shutdown		\
 	smartsign		\
+	sortlist		\
 	spf			\
 	staticstub		\
 	statistics		\
@@ -34,6 +34,6 @@ zone "." {
 	file "redirect.db";
 };

-remote-servers "test" {
+primaries "test" {
 	10.53.0.99;
 };
@@ -11,5 +11,5 @@
 * information regarding copyright ownership.
 */

-remote-servers duplicate { 1.2.3.4; };
+primaries duplicate { 1.2.3.4; };
 primaries duplicate { 4.3.2.1; };
@@ -11,5 +11,5 @@
 * information regarding copyright ownership.
 */

-remote-servers duplicate { 1.2.3.4; };
-remote-servers duplicate { 4.3.2.1; };
+masters duplicate { 1.2.3.4; };
+primaries duplicate { 4.3.2.1; };
@@ -12,7 +12,7 @@
 */

 view "test" {
-	remote-servers "net" {
+	parental-agents "net" {
 		192.168.1.2;
 	 };
 	zone "example.net" {
@@ -11,11 +11,11 @@
 * information regarding copyright ownership.
 */

-remote-servers "net" {
+parental-agents "net" {
 	192.168.1.1;
 };

-remote-servers "net" {
+parental-agents "net" {
 	192.168.1.2;
 };

@@ -11,7 +11,7 @@
 * information regarding copyright ownership.
 */

-remote-servers "net" { };
+parental-agents "net" { };

 zone "example.net" {
 	type primary;
@@ -11,7 +11,7 @@
 * information regarding copyright ownership.
 */

-remote-servers "com" {
+parental-agents "com" {
 	192.168.1.2;
 };

@@ -11,7 +11,7 @@
 * information regarding copyright ownership.
 */

-remote-servers "net" {
+primaries "net" {
 	 192.168.1.2;
 };

@@ -14,6 +14,8 @@
 options {
 	dnssec-validation yes;
 	max-zone-ttl 600;
+
+	sortlist { };
 };

 trust-anchors {
@@ -11,5 +11,5 @@
 * information regarding copyright ownership.
 */

-remote-servers a { 1.2.3.4; };
-remote-servers b { 1.2.3.4; };
+masters a { 1.2.3.4; };
+primaries b { 1.2.3.4; };
@@ -86,7 +86,7 @@ options {
 	transfer-source 0.0.0.0;
 	zone-statistics none;
 };
-remote-servers "parents" port 5353 source 10.10.10.10 source-v6 2001:db8::10 {
+parental-agents "parents" port 5353 source 10.10.10.10 source-v6 2001:db8::10 {
 	10.10.10.11;
 	2001:db8::11;
 };
@@ -12,8 +12,8 @@
 */

 acl "transferees" {};
-remote-servers "stealthPrimaries" {127.0.0.1;};
-remote-servers "publicSecondaries" {127.0.0.1;};
+primaries "stealthPrimaries" {127.0.0.1;};
+primaries "publicSecondaries" {127.0.0.1;};
 zone "example.net" {
 	type secondary;
 	key-directory "/var/lib/bind/example.net";
@@ -12,8 +12,8 @@
 */

 acl "transferees" {};
-remote-servers "stealthPrimaries" {127.0.0.1;};
-remote-servers "publicSecondaries" {127.0.0.1;};
+primaries "stealthPrimaries" {127.0.0.1;};
+primaries "publicSecondaries" {127.0.0.1;};
 zone "example.net" {
 	type secondary;
 	file "/var/cache/bind/example.net.db";
@@ -12,8 +12,8 @@
 */

 acl "transferees" {};
-remote-servers "stealthPrimaries" {127.0.0.1;};
-remote-servers "publicSecondaries" {127.0.0.1;};
+primaries "stealthPrimaries" {127.0.0.1;};
+primaries "publicSecondaries" {127.0.0.1;};
 zone "example.net" {
 	type secondary;
 	key-directory "/var/lib/bind/example.net";
@@ -184,6 +184,7 @@ echo_i "checking named-checkconf deprecate warnings ($n)"
 ret=0
 $CHECKCONF deprecated.conf >checkconf.out$n.1 2>&1 || ret=1
 grep "option 'max-zone-ttl' is deprecated" <checkconf.out$n.1 >/dev/null || ret=1
+grep "option 'sortlist' is deprecated" <checkconf.out$n.1 >/dev/null || ret=1
 if [ $ret -ne 0 ]; then echo_i "failed"; fi
 status=$((status + ret))
 # set -i to ignore deprecate warnings
@@ -735,5 +736,16 @@ if [ $ret != 0 ]; then
 fi
 status=$((status + ret))

+n=$((n + 1))
+echo_i "check for obsolete option warnings ($n)"
+ret=0
+$CHECKCONF warn-obsolete.conf >checkconf.out$n 2>&1 || ret=1
+grep -F "option 'multi-master' is obsolete and should be removed" checkconf.out$n >/dev/null || ret=1
+if [ $ret != 0 ]; then
+  echo_i "failed"
+  ret=1
+fi
+status=$((status + ret))
+
 echo_i "exit status: $status"
 [ $status -eq 0 ] || exit 1
@@ -11,18 +11,8 @@
 * information regarding copyright ownership.
 */

-remote-servers "one" {
-	1.2.3.4;
-};
-
-parental-agents "two" {
-	1.2.3.5;
-};
-
-primaries "three" {
-	1.2.3.6;
-};
-
-masters "four" {
-	1.2.3.7;
+zone . {
+	type secondary;
+	primaries { 10.53.0.1; 10.53.0.2; };
+	multi-master yes;
 };
@@ -37,7 +37,7 @@ controls {
 	inet 10.53.0.9 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
 };

-remote-servers "ns8" port @PORT@ {
+parental-agents "ns8" port @PORT@ {
 	10.53.0.8;
 };

@@ -218,41 +218,5 @@ echo $lines
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status + ret))

-echo_i "Checking for 'zone has A records but is not served by IPv4 servers' warning ($n)"
-ret=0
-$CHECKZONE example zones/warn.no-a.server.db >test.out1.$n 2>&1 || ret=1
-grep "zone has A records but is not served by IPv4 servers" test.out1.$n >/dev/null || ret=1
-grep "zone has AAAA records but is not served by IPv6 servers" test.out1.$n >/dev/null && ret=1
-n=$((n + 1))
-if [ $ret != 0 ]; then echo_i "failed"; fi
-status=$((status + ret))
-
-echo_i "Checking for 'zone has AAAA records but is not served by IPv6 servers' warning ($n)"
-ret=0
-$CHECKZONE example zones/warn.no-aaaa.server.db >test.out1.$n 2>&1 || ret=1
-grep "zone has AAAA records but is not served by IPv6 servers" test.out1.$n >/dev/null || ret=1
-grep "zone has A records but is not served by IPv4 servers" test.out1.$n >/dev/null && ret=1
-n=$((n + 1))
-if [ $ret != 0 ]; then echo_i "failed"; fi
-status=$((status + ret))
-
-echo_i "Checking for 'zone has A records but is not served by IPv4 servers' warning for glue ($n)"
-ret=0
-$CHECKZONE example zones/warn.no-a.server.glue.db >test.out1.$n 2>&1 || ret=1
-grep "zone has A records but is not served by IPv4 servers" test.out1.$n >/dev/null || ret=1
-grep "zone has AAAA records but is not served by IPv6 servers" test.out1.$n >/dev/null && ret=1
-n=$((n + 1))
-if [ $ret != 0 ]; then echo_i "failed"; fi
-status=$((status + ret))
-
-echo_i "Checking for 'zone has AAAA records but is not served by IPv6 servers' warning for glue ($n)"
-ret=0
-$CHECKZONE example zones/warn.no-aaaa.server.glue.db >test.out1.$n 2>&1 || ret=1
-grep "zone has AAAA records but is not served by IPv6 servers" test.out1.$n >/dev/null || ret=1
-grep "zone has A records but is not served by IPv4 servers" test.out1.$n >/dev/null && ret=1
-n=$((n + 1))
-if [ $ret != 0 ]; then echo_i "failed"; fi
-status=$((status + ret))
-
 echo_i "exit status: $status"
 [ $status -eq 0 ] || exit 1
@@ -1,22 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; SPDX-License-Identifier: MPL-2.0
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0.  If a copy of the MPL was not distributed with this
-; file, you can obtain one at https://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-@		30	IN	SOA	ns1 hostmaster 2017052201 3600 600 604800 30
-@		7200	IN	NS	ns1
-@		7200	IN	NS	ns2
-@		7200	IN	NS	ns3
-@		7200	IN	NS	ns4
-ns1		3600	IN	AAAA	fd92:7065:b8e:ffff::1
-ns2		3600	IN	AAAA	fd92:7065:b8e:ffff::2
-ns3		3600	IN	AAAA	fd92:7065:b8e:ffff::4
-ns4		3600	IN	AAAA	fd92:7065:b8e:ffff::4
-dualstack	300	IN	AAAA	2001:db8::1
-dualstack	300	IN	A	10.53.0.5
@@ -1,23 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; SPDX-License-Identifier: MPL-2.0
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0.  If a copy of the MPL was not distributed with this
-; file, you can obtain one at https://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-@		30	IN	SOA	ns1 hostmaster 2017052201 3600 600 604800 30
-@		7200	IN	NS	ns1
-@		7200	IN	NS	ns2
-@		7200	IN	NS	ns3
-@		7200	IN	NS	ns4
-ns1		3600	IN	AAAA	fd92:7065:b8e:ffff::1
-ns2		3600	IN	AAAA	fd92:7065:b8e:ffff::2
-ns3		3600	IN	AAAA	fd92:7065:b8e:ffff::4
-ns4		3600	IN	AAAA	fd92:7065:b8e:ffff::4
-child		3600	IN	NS	ns1.child
-ns1.child	300	IN	AAAA	2001:db8::1
-ns1.child	300	IN	A	10.53.0.5
@@ -1,23 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; SPDX-License-Identifier: MPL-2.0
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0.  If a copy of the MPL was not distributed with this
-; file, you can obtain one at https://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-@		30	IN	SOA	ns1 hostmaster 2017052201 3600 600 604800 30
-@		7200	IN	NS	ns1
-@		7200	IN	NS	ns2
-@		7200	IN	NS	ns3
-@		7200	IN	NS	ns4
-ns1		3600	IN	A	10.53.0.1
-ns2		3600	IN	A	10.53.0.2
-ns3		3600	IN	A	10.53.0.4
-ns4		3600	IN	A	10.53.0.4
-child		3600	IN	NS	ns1.child
-ns1.child	300	IN	AAAA	2001:db8::1
-ns1.child	300	IN	A	10.53.0.5
@@ -28,9 +28,7 @@ def test_database(servers, templates):
    )

    templates.render("ns1/named.conf", {"rname": "marka.isc.org."})
-    with servers["ns1"].watch_log_from_here() as watcher:
-        servers["ns1"].rndc("reload")
-        watcher.wait_for_line("all zones loaded")
+    servers["ns1"].rndc("reload")

    # checking post reload zone
    res = isctest.query.tcp(msg, "10.53.0.1")
@@ -268,7 +268,7 @@ echo "//" | sendcmd 10.53.0.6
 nextpart ns3/named.run >/dev/null
 dig_with_opts txt.example7. txt @$f1 >dig.out.$n.f1 || ret=1
 # The forwarder for the "example7" zone should only be queried once.
-start_pattern="sending packet from [^ ]* to 10\.53\.0\.6"
+start_pattern="sending packet to 10\.53\.0\.6"
 retry_quiet 5 wait_for_log ns3/named.run "$start_pattern"
 check_sent 1 ns3/named.run "$start_pattern" ";txt\.example7\.[[:space:]]*IN[[:space:]]*TXT$" || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
@@ -280,7 +280,7 @@ ret=0
 nextpart ns7/named.run >/dev/null
 dig_with_opts +noadd +noauth txt.example1. txt @10.53.0.7 >dig.out.$n.f7 || ret=1
 received_pattern="received packet from 10\.53\.0\.1"
-start_pattern="sending packet from [^ ]* to 10\.53\.0\.1"
+start_pattern="sending packet to 10\.53\.0\.1"
 retry_quiet 5 wait_for_log ns7/named.run "$received_pattern" || ret=1
 check_sent 1 ns7/named.run "$start_pattern" ";\.[[:space:]]*IN[[:space:]]*NS$" || ret=1
 sent=$(grep -c "10.53.0.7#.* (.): query '\./NS/IN' approved" ns4/named.run || true)
@@ -241,7 +241,7 @@ status=$((status + ret))
 n=$((n + 1))
 echo_i "checking recursive lookup to edns 512 + no tcp server does not cause query loops ($n)"
 ret=0
-sent=$(grep -c "sending packet from [^ ]* to 10\.53\.0\.7" ns1/named.run)
+sent=$(grep -c -F "sending packet to 10.53.0.7" ns1/named.run)
 if [ $sent -ge 10 ]; then
  echo_i "ns1 sent $sent queries to ns7, expected less than 10"
  ret=1
@@ -51,8 +51,10 @@ zone "example" {
 	also-notify { /* empty */ };
 };

-remote-servers noport { 10.53.0.4; };
-remote-servers x21 port @EXTRAPORT1@ { noport; };
+# use both 'primaries' and 'masters' to test that they
+# can work correctly together.
+primaries noport { 10.53.0.4; };
+masters x21 port @EXTRAPORT1@ { noport; };

 zone x1 {
 	type primary;
@@ -46,7 +46,7 @@ for i in 1 2 3 4 5 6 7 8 9 10; do
  grep "status: NOERROR" dig.out.ns3.test$n >/dev/null || ret=1
  grep "flags:.* aa[ ;]" dig.out.ns3.test$n >/dev/null || ret=1
  nr=$(grep -c 'x[0-9].*sending notify to' ns2/named.run)
-  [ "$nr" -ge 23 ] || ret=1
+  [ "$nr" -eq 20 ] || ret=1
  [ $ret = 0 ] && break
  sleep 1
 done
@@ -95,7 +95,7 @@ END {
 	print "count:", count;
 	print "average:", average;
 	if (average < 0.180) exit(1);
-	if (count < 23) exit(1);
+	if (count < 20) exit(1);
 }' ns2/named.run >awk.out.ns2.test$n || ret=1
 test_end

@@ -145,13 +145,3 @@ zone "nsec3-inline-to-dynamic.kasp" {
       dnssec-policy "nsec3";
       allow-update { any; };
 };
-
-/*
- * This zone will have an empty nonterminal node added and a node deleted.
- */
-zone "nsec3-ent.kasp" {
-	type primary;
-	file "nsec3-ent.kasp.db";
-	dnssec-policy "nsec3";
-	inline-signing yes;
-};
@@ -20,14 +20,14 @@ setup() {
  zone="$1"
  echo_i "setting up zone: $zone"
  zonefile="${zone}.db"
+  infile="${zone}.db.infile"
  cp template.db.in "$zonefile"
 }

 for zn in nsec-to-nsec3 nsec3 nsec3-other nsec3-change nsec3-to-nsec \
  nsec3-to-optout nsec3-from-optout nsec3-dynamic \
  nsec3-dynamic-change nsec3-dynamic-to-inline \
-  nsec3-inline-to-dynamic nsec3-dynamic-update-inline \
-  nsec3-ent; do
+  nsec3-inline-to-dynamic nsec3-dynamic-update-inline; do
  setup "${zn}.kasp"
 done

@@ -27,7 +27,7 @@ if [ $RSASHA1_SUPPORTED = 0 ]; then
 else
  copy_setports ns3/named-fips.conf.in ns3/named-fips.conf
  # includes named-fips.conf
-  cp ns3/named1.conf.in ns3/named.conf
+  cp ns3/named.conf.in ns3/named.conf
 fi
 (
  cd ns3
@@ -584,39 +584,5 @@ set_key_default_values "KEY1"
 echo_i "check zone ${ZONE} after reload"
 check_nsec3

-# Zone: nsec3-ent.kasp (regression test for #5108)
-n=$((n + 1))
-echo_i "check query for newly empty name does not crash ($n)"
-set_zone_policy "nsec3-ent.kasp"
-set_server "ns3" "10.53.0.3"
-# confirm the pre-existing name still exists
-dig_with_opts +noquestion "@${SERVER}" c.$ZONE >"dig.out.$ZONE.test$n.1" || ret=1
-grep "c\.nsec3-ent\.kasp\..*IN.*A.*10\.0\.0\.3" "dig.out.$ZONE.test$n.1" >/dev/null || ret=1
-# remove a name, bump the SOA, and reload
-sed -e 's/1 *; serial/2/' -e '/^c/d' ns3/template.db.in >ns3/nsec3-ent.kasp.db
-rndc_reload ns3 10.53.0.3
-# try the query again
-dig_with_opts +noquestion "@${SERVER}" c.$ZONE >"dig.out.$ZONE.test$n.2" || ret=1
-grep "status: NXDOMAIN" "dig.out.$ZONE.test$n.2" >/dev/null || ret=1
-if [ "$ret" -ne 0 ]; then echo_i "failed"; fi
-status=$((status + ret))
-
-n=$((n + 1))
-echo_i "check queries for new names below ENT do not crash ($n)"
-set_zone_policy "nsec3-ent.kasp"
-set_server "ns3" "10.53.0.3"
-# confirm the ENT name does not exist yet
-dig_with_opts +noquestion "@${SERVER}" x.y.z.$ZONE >"dig.out.$ZONE.test$n.1" || ret=1
-grep "status: NXDOMAIN" "dig.out.$ZONE.test$n.1" >/dev/null || ret=1
-# add a name with an ENT, bump the SOA, and reload
-sed -e 's/1 *; serial/3/' ns3/template.db.in >ns3/nsec3-ent.kasp.db
-echo "x.y.z A 10.0.0.4" >>ns3/nsec3-ent.kasp.db
-rndc_reload ns3 10.53.0.3
-# try the query again
-dig_with_opts +noquestion "@${SERVER}" x.y.z.$ZONE >"dig.out.$ZONE.test$n.2" || ret=1
-grep "x\.y\.z\.nsec3-ent\.kasp\..*IN.*A.*10\.0\.0\.4" "dig.out.$ZONE.test$n.2" >/dev/null || ret=1
-if [ "$ret" -ne 0 ]; then echo_i "failed"; fi
-status=$((status + ret))
-
 echo_i "exit status: $status"
 [ $status -eq 0 ] || exit 1
@@ -94,7 +94,7 @@ zone "other.nil" {
 	allow-transfer { any; };
 };

-remote-servers others {
+primaries others {
 	10.53.0.2 port @PORT@;
 	10.53.0.2 port @PORT@ key altkey;
 };
@@ -0,0 +1,37 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 300	; 5 minutes
+@			IN SOA	ns1.example. hostmaster.example. (
+				2000042795 ; serial
+				20         ; refresh (20 seconds)
+				20         ; retry (20 seconds)
+				1814400    ; expire (3 weeks)
+				3600       ; minimum (1 hour)
+				)
+example.		NS	ns1.example.
+ns1.example.		A	10.53.0.1
+
+; Let's see what the sortlist picks out of this...
+a			A	1.1.1.1
+a			A	1.1.1.5
+a			A	1.1.1.2
+a			A	192.168.3.1
+a			A	1.1.1.3
+a			A	192.168.1.1
+a			A	1.1.1.4
+
+b			A	10.53.0.1
+b			A	10.53.0.2
+b			A	10.53.0.3
+b			A	10.53.0.4
+b			A	10.53.0.5
+
@@ -0,0 +1,46 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+options {
+	query-source address 10.53.0.1;
+	notify-source 10.53.0.1;
+	transfer-source 10.53.0.1;
+	port @PORT@;
+	pid-file "named.pid";
+	listen-on { 10.53.0.1; };
+	listen-on-v6 { none; };
+	recursion no;
+	dnssec-validation no;
+	notify yes;
+
+	sortlist {
+	    { 10.53.0.1;				   // IF 10.53.0.1
+		{
+		    !1.1.1.4; !1.1.1.2; !1.1.1.3; !1.1.1.1; // sort these last,
+		    192.168.3/24;			    // this first
+		    { 192.168.2/24; 192.168.1/24; }; }; };  // and these next
+	    { { 10.53.0.2; 10.53.0.3; }; };		    // Prefer self
+	    10.53.0.4;					    // BIND 8 compat
+	    { 10.53.0.5; 10.53.0.5; };    		    // BIND 8 compat
+	};
+};
+
+zone "." {
+	type primary;
+	file "root.db";
+};
+
+zone "example" {
+	type primary;
+	file "example.db";
+};
@@ -9,14 +9,16 @@
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.

-@		30	IN	SOA	ns1 hostmaster 2017052201 3600 600 604800 30
-@		7200	IN	NS	ns1
-@		7200	IN	NS	ns2
-@		7200	IN	NS	ns3
-@		7200	IN	NS	ns4
-ns1		3600	IN	A	10.53.0.1
-ns2		3600	IN	A	10.53.0.2
-ns3		3600	IN	A	10.53.0.4
-ns4		3600	IN	A	10.53.0.4
-dualstack	300	IN	AAAA	2001:db8::1
-dualstack	300	IN	A	10.53.0.5
+$TTL 300
+. 			IN SOA	gson.nominum.com. a.root.servers.nil. (
+				2000042100   	; serial
+				600         	; refresh
+				600         	; retry
+				1200    	; expire
+				600       	; minimum
+				)
+.			NS	a.root-servers.nil.
+a.root-servers.nil.	A	10.53.0.1
+
+example.		NS	ns2.example.
+ns2.example.		A	10.53.0.2
@@ -0,0 +1,16 @@
+#!/bin/sh
+
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+. ../conf.sh
+
+copy_setports ns1/named.conf.in ns1/named.conf
@@ -0,0 +1,53 @@
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+import dns.message
+
+import pytest
+
+import isctest
+
+
+def test_sortlist():
+    """Test two-element sortlist statement"""
+    msg = dns.message.make_query("a.example.", "A")
+    resp = isctest.query.tcp(msg, "10.53.0.1", source="10.53.0.1")
+    sortlist = [
+        "192.168.3.1",
+        "192.168.1.1",
+        "1.1.1.5",
+        "1.1.1.1",
+        "1.1.1.3",
+        "1.1.1.2",
+        "1.1.1.4",
+    ]
+    rrset = dns.rrset.from_text_list("a.example.", 300, "IN", "A", sortlist)
+    assert len(resp.answer) == 1
+    assert resp.answer[0] == rrset
+    assert list(resp.answer[0].items) == list(rrset.items)
+
+
+@pytest.mark.parametrize(
+    "source_ip,possible_results",
+    [
+        ("10.53.0.2", ["10.53.0.2", "10.53.0.3"]),
+        ("10.53.0.3", ["10.53.0.2", "10.53.0.3"]),
+        ("10.53.0.4", ["10.53.0.4"]),
+        ("10.53.0.5", ["10.53.0.5"]),
+    ],
+)
+def test_sortlist_compat(possible_results, source_ip):
+    """Test one-element sortlist statement and undocumented BIND 8 features"""
+    msg = dns.message.make_query("b.example.", "A")
+    resp = isctest.query.tcp(msg, "10.53.0.1", source=source_ip)
+    assert (
+        resp.answer[0][0].to_text() in possible_results
+    ), f"{possible_results} not found"
@@ -61,7 +61,7 @@ zone "tsigzone" {
 	allow-transfer { tzkey; };
 };

-remote-servers "ns1" port @PORT@ source 10.53.0.2 {
+primaries "ns1" port @PORT@ source 10.53.0.2 {
 	10.53.0.1;
 };

@@ -378,18 +378,16 @@ run(void) {
 				  connect_cb, NULL, timeout);
 		break;
 	case TCP:
-		isc_nm_streamdnsconnect(netmgr, &sockaddr_local,
-					&sockaddr_remote, connect_cb, NULL,
-					timeout, NULL, NULL, NULL,
-					ISC_NM_PROXY_NONE, NULL);
+		isc_nm_streamdnsconnect(
+			netmgr, &sockaddr_local, &sockaddr_remote, connect_cb,
+			NULL, timeout, NULL, NULL, ISC_NM_PROXY_NONE, NULL);
 		break;
 	case DOT: {
 		isc_tlsctx_createclient(&tls_ctx);

-		isc_nm_streamdnsconnect(netmgr, &sockaddr_local,
-					&sockaddr_remote, connect_cb, NULL,
-					timeout, tls_ctx, NULL, NULL,
-					ISC_NM_PROXY_NONE, NULL);
+		isc_nm_streamdnsconnect(
+			netmgr, &sockaddr_local, &sockaddr_remote, connect_cb,
+			NULL, timeout, tls_ctx, NULL, ISC_NM_PROXY_NONE, NULL);
 		break;
 	}
 #if HAVE_LIBNGHTTP2
@@ -410,8 +408,7 @@ run(void) {
 		}
 		isc_nm_httpconnect(netmgr, &sockaddr_local, &sockaddr_remote,
 				   req_url, is_post, connect_cb, NULL, tls_ctx,
-				   NULL, NULL, timeout, ISC_NM_PROXY_NONE,
-				   NULL);
+				   NULL, timeout, ISC_NM_PROXY_NONE, NULL);
 	} break;
 #endif
 	default:
@@ -1,4 +1,4 @@
-@depends on !(file in "util/models.c") && !(file in "lib/dns/sdlz.c")@
+@@
@@

 - unsigned
@@ -142,13 +142,6 @@ TEST_CFLAGS="-Wno-vla"
 # the compiler has a different built-in setting)
 STD_CPPFLAGS="-U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=2"

-#
-# Define constexpr if it is missing from the compiler
-#
-AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[]], [[constexpr int foo = 0;]])],
-		  [],
-		  [AC_DEFINE([constexpr],[static const],[Define compatibility shim for non-C23 compilers.])])
-
 #
 # Additional compiler settings.
 #
@@ -178,7 +171,7 @@ AC_ARG_ENABLE([developer],

 AS_IF([test "$enable_developer" = "yes"],
      [DEVELOPER_MODE=yes
-       STD_CPPFLAGS="$STD_CPPFLAGS -DISC_MEM_DEFAULTFILL=1 -DISC_MEM_TRACKLINES=1 -DISC_LIST_CHECKINIT=1 -DISC_STATS_CHECKUNDERFLOW=1 -DISC_MUTEX_ERROR_CHECK=1 -DISC_SOCKET_DETAILS=1"
+       STD_CPPFLAGS="$STD_CPPFLAGS -DISC_MEM_DEFAULTFILL=1 -DISC_MEM_TRACKLINES=1 -DISC_LIST_CHECKINIT=1 -DISC_STATS_CHECKUNDERFLOW=1 -DISC_MUTEX_ERROR_CHECK=1"
       test "${enable_querytrace+set}" = set || enable_querytrace=yes
       test "${with_cmocka+set}" = set || with_cmocka=yes
       test "${with_zlib+set}" = set || with_zlib=yes
@@ -1444,6 +1437,7 @@ AC_CONFIG_FILES([tests/Makefile
 		 tests/isc/Makefile
 		 tests/dns/Makefile
 		 tests/ns/Makefile
+		 tests/irs/Makefile
 		 tests/isccfg/Makefile
 		 tests/libtest/Makefile])

@@ -18,7 +18,6 @@ Changelog
   development. Regular users should refer to :ref:`Release Notes <relnotes>`
   for changes relevant to them.

-.. include:: ../changelog/changelog-9.21.3.rst
 .. include:: ../changelog/changelog-9.21.2.rst
 .. include:: ../changelog/changelog-9.21.1.rst
 .. include:: ../changelog/changelog-9.21.0.rst
@@ -47,7 +47,6 @@ The list of known issues affecting the latest version in the 9.21 branch can be
 found at
 https://gitlab.isc.org/isc-projects/bind9/-/wikis/Known-Issues-in-BIND-9.21

-.. include:: ../notes/notes-9.21.3.rst
 .. include:: ../notes/notes-9.21.2.rst
 .. include:: ../notes/notes-9.21.1.rst
 .. include:: ../notes/notes-9.21.0.rst
@@ -240,7 +240,7 @@ Definition and Usage

 Address match lists are primarily used to determine access control for
 various server operations. They are also used in the :any:`listen-on` and
-:any:`listen-on-v6` statements. The elements which constitute an address match
+:any:`sortlist` statements. The elements which constitute an address match
 list can be any of the following:

 - :term:`ip_address`: an IP address (IPv4 or IPv6)
@@ -269,8 +269,8 @@ comparisons require that the list of keys be traversed until a matching
 key is found, and therefore may be somewhat slower.

 The interpretation of a match depends on whether the list is being used
-for access control or for defining :any:`listen-on` ports, and whether
-the element was negated.
+for access control, defining :any:`listen-on` ports, or in a :any:`sortlist`,
+and whether the element was negated.

 When used as an access control list, a non-negated match allows access
 and a negated match denies access. If there is no match, access is
@@ -364,8 +364,8 @@ file documentation:
    ``portrange``
        A list of a :term:`port` or a port range. A port range is specified in the form of ``range`` followed by two :term:`port` s, ``port_low`` and ``port_high``, which represents port numbers from ``port_low`` through ``port_high``, inclusive. ``port_low`` must not be larger than ``port_high``. For example, ``range 1024 65535`` represents ports from 1024 through 65535. The asterisk (``*``) character is not allowed as a valid :term:`port` or as a port range boundary.

-    ``server-list``
-        A named list of one or more :term:`ip_address` es with optional :term:`tls_id`, :term:`server_key`, and/or :term:`port`. A ``server-list`` list may include other ``server-list`` lists.
+    ``remote-servers``
+        A named list of one or more :term:`ip_address` es with optional :term:`tls_id`, :term:`server_key`, and/or :term:`port`. A ``remote-servers`` list may include other ``remote-servers`` lists. See :any:`primaries` block.

    ``server_key``
        A :term:`domain_name` representing the name of a shared key, to be used for
@@ -413,11 +413,17 @@ The following blocks are supported:
    :any:`logging`
        Specifies what information the server logs and where the log messages are sent.

+    ``masters``
+        Synonym for :any:`primaries`.
+
    :namedconf:ref:`options`
        Controls global server configuration options and sets defaults for other statements.

-    :namedconf:ref:`remote-servers`
-        Defines a named list of servers for inclusion in various zone statements such as :any:`parental-agents`, :any:`primaries` or :any:`also-notify` lists.
+    :any:`parental-agents`
+        Defines a named list of servers for inclusion in primary and secondary zones' :any:`parental-agents` lists.
+
+    :any:`primaries`
+        Defines a named list of servers for inclusion in stub and secondary zones' :any:`primaries` or :any:`also-notify` lists. (Note: this is a synonym for the original keyword ``masters``, which can still be used, but is no longer the preferred terminology.)

    :namedconf:ref:`server`
        Sets certain configuration options on a per-server basis.
@@ -1042,20 +1048,34 @@ At ``debug`` level 4 or higher, the detailed context information logged at
 ``debug`` level 2 is logged for errors other than SERVFAIL and for negative
 responses such as NXDOMAIN.

-``remote-servers`` Block Grammar
+:any:`parental-agents` Block Grammar
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-.. namedconf:statement:: remote-servers
-   :tags: server
-   :short: Defines a list of servers to be used by primary and secondary zones.
+.. namedconf:statement:: parental-agents
+   :tags: zone
+   :short: Defines a list of delegation agents to be used by primary and secondary zones.

-This specifies a list that allows for a common set of servers to be easily used
-by multiple zones. The following options may reference to a list of
-remote servers: :any:`parental-agents`, :any:`primaries`, and :any:`also-notify`.
+:any:`parental-agents` Block Definition and Usage
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

-A "parental agent" is a trusted DNS server that is queried to check whether DS
-records for a given zones are up-to-date.
+:any:`parental-agents` lists allow for a common set of parental agents to be
+easily used by multiple primary and secondary zones. A "parental agent" is a
+trusted DNS server that is queried to check whether DS records for a given zones
+are up-to-date.

-A "primary server" is where a secondary server can request zone transfers from.
+:any:`primaries` Block Grammar
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+.. namedconf:statement:: primaries
+   :tags: zone
+   :short: Defines one or more primary servers for a zone.
+
+:any:`primaries` Block Definition and Usage
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+:any:`primaries` lists allow for a common set of primary servers to be easily
+used by multiple stub and secondary zones in their :any:`primaries` or
+:any:`also-notify` lists. (Note: :any:`primaries` is a synonym for the original
+keyword ``masters``, which can still be used, but is no longer the
+preferred terminology.)

 To force the zone transfer requests to be sent over TLS, use :any:`tls` keyword,
 e.g. ``primaries { 192.0.2.1 tls tls-configuration-name; };``,
@@ -1214,11 +1234,7 @@ default is used.
      :ref:`query source address <query_address>` is explicitly set,
      these sockets are bound to wildcard IP addresses and determining
      the specific IP address used by each of them requires issuing a
-      system call (i.e. incurring a performance penalty). If the highest
-      possible logging accuracy is required, BIND 9 can be built with
-      ``-DISC_SOCKET_DETAILS=1`` added to ``CFLAGS`` at compile-time;
-      this enables exact socket addresses to be logged, although at the
-      cost of lowering the server's performance.
+      system call (i.e. incurring a performance penalty).

   Logged :any:`dnstap` messages can be parsed using the :iscman:`dnstap-read`
   utility (see :ref:`man_dnstap-read` for details).
@@ -2509,13 +2525,9 @@ Boolean Options
   :any:`ixfr-from-differences` setting is ignored for that zone.

 .. namedconf:statement:: multi-master
-   :tags: transfer
-   :short: Controls whether serial number mismatch errors are logged.
+   :tags: obsolete

-   This should be set when there are multiple primary servers for a zone and the
-   addresses refer to different machines. If ``yes``, :iscman:`named` does not
-   log when the serial number on the primary is less than what :iscman:`named`
-   currently has. The default is ``no``.
+   This option no longer has any effect.

 .. namedconf:statement:: dnssec-validation
   :tags: dnssec
@@ -3372,19 +3384,6 @@ options apply to zone transfers.
   per second. The lowest possible rate is one per second; when set to
   zero, it is silently raised to one.

-.. namedconf:statement:: primaries
-   :tags: transfer, zone
-   :short: Defines one or more servers that zone transfer can be requested from.
-
-   This specifies a list of one or more IP addresses of primary servers that
-   the secondary contacts to update its copy of the zone. Primaries list
-   elements can also be names of :any:`remote-servers` blocks.
-
-   By default, transfers are made from port 53 on the servers; this can be
-   changed for all servers by specifying a port number before the list of IP
-   addresses, or on a per-server basis after the IP address. Authentication to
-   the primary can also be done with per-server TSIG keys.
-
 .. namedconf:statement:: startup-notify-rate
   :tags: transfer, zone
   :short: Specifies the rate at which NOTIFY requests are sent when the name server is first starting, or when new zones have been added.
@@ -3945,6 +3944,94 @@ Periodic Task Intervals
   gone away. For convenience, TTL-style time-unit suffixes may be used to
   specify the value. It also accepts ISO 8601 duration formats.

+The :any:`sortlist` Statement
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+The response to a DNS query may consist of multiple resource records
+(RRs) forming a resource record set (RRset). The name server
+normally returns the RRs within the RRset in an indeterminate order (but
+see the :any:`rrset-order` statement in :ref:`rrset_ordering`). The client resolver code should
+rearrange the RRs as appropriate: that is, using any addresses on the
+local net in preference to other addresses. However, not all resolvers
+can do this or are correctly configured. When a client is using a local
+server, the sorting can be performed in the server, based on the
+client's address. This only requires configuring the name servers, not
+all the clients.
+
+.. namedconf:statement:: sortlist
+   :tags: query, deprecated
+   :short: Controls the ordering of RRs returned to the client, based on the client's IP address.
+
+   This option is deprecated and will be removed in a future release.
+
+   The :any:`sortlist` statement (see below) takes an :term:`address_match_list` and
+   interprets it in a special way. Each top-level statement in the :any:`sortlist`
+   must itself be an explicit :term:`address_match_list` with one or two elements. The
+   first element (which may be an IP address, an IP prefix, an ACL name, or a nested
+   :term:`address_match_list`) of each top-level list is checked against the source
+   address of the query until a match is found. When the addresses in the first
+   element overlap, the first rule to match is selected.
+
+   Once the source address of the query has been matched, if the top-level
+   statement contains only one element, the actual primitive element that
+   matched the source address is used to select the address in the response
+   to move to the beginning of the response. If the statement is a list of
+   two elements, then the second element is interpreted as a topology
+   preference list. Each top-level element is assigned a distance, and the
+   address in the response with the minimum distance is moved to the
+   beginning of the response.
+
+   In the following example, any queries received from any of the addresses
+   of the host itself get responses preferring addresses on any of the
+   locally connected networks. Next most preferred are addresses on the
+   192.168.1/24 network, and after that either the 192.168.2/24 or
+   192.168.3/24 network, with no preference shown between these two
+   networks. Queries received from a host on the 192.168.1/24 network
+   prefer other addresses on that network to the 192.168.2/24 and
+   192.168.3/24 networks. Queries received from a host on the 192.168.4/24
+   or the 192.168.5/24 network only prefer other addresses on their
+   directly connected networks.
+
+::
+
+   sortlist {
+       // IF the local host
+       // THEN first fit on the following nets
+       { localhost;
+       { localnets;
+           192.168.1/24;
+           { 192.168.2/24; 192.168.3/24; }; }; };
+       // IF on class C 192.168.1 THEN use .1, or .2 or .3
+       { 192.168.1/24;
+       { 192.168.1/24;
+           { 192.168.2/24; 192.168.3/24; }; }; };
+       // IF on class C 192.168.2 THEN use .2, or .1 or .3
+       { 192.168.2/24;
+       { 192.168.2/24;
+           { 192.168.1/24; 192.168.3/24; }; }; };
+       // IF on class C 192.168.3 THEN use .3, or .1 or .2
+       { 192.168.3/24;
+       { 192.168.3/24;
+           { 192.168.1/24; 192.168.2/24; }; }; };
+       // IF .4 or .5 THEN prefer that net
+       { { 192.168.4/24; 192.168.5/24; };
+       };
+   };
+
+The following example illustrates reasonable behavior for the local host
+and hosts on directly connected networks. Responses sent to queries from the
+local host favor any of the directly connected networks. Responses
+sent to queries from any other hosts on a directly connected network
+prefer addresses on that same network. Responses to other queries
+are not sorted.
+
+::
+
+   sortlist {
+          { localhost; localnets; };
+          { localnets; };
+   };
+
 .. _rrset_ordering:

 RRset Ordering
@@ -3962,7 +4049,8 @@ RRset Ordering
   :short: Defines the order in which equal RRs (RRsets) are returned.

   The :any:`rrset-order` statement permits configuration of the ordering of
-   the records in a multiple-record response.
+   the records in a multiple-record response. See also:
+   :any:`sortlist`.

   Each rule in an :any:`rrset-order` statement is defined as follows:

@@ -6473,18 +6561,6 @@ old DNSSEC key.
      trust relationship with the parental agent. For example, use TSIG to
      authenticate the parental agent, or point to a validating resolver.

-.. namedconf:statement:: parental-agents
-   :tags: dnssec
-
-   This specifies a list of one or more IP addresses of parental agents that
-   are used to query the zone's DS records during a KSK rollover. The list of
-   parental agents can also contain the names of :any:`remote-servers` blocks.
-
-   By default, DS queries are sent from port 53 on the servers; this can be
-   changed for all servers by specifying a port number before the list of IP
-   addresses, or on a per-server basis after the IP address. Authentication to
-   the primary can also be done with per-server TSIG keys.
-
 The following options apply to DS queries sent to :any:`parental-agents`:

 .. namedconf:statement:: checkds
@@ -6671,22 +6747,33 @@ Zone Types
   :tags: zone
   :short: Contains a duplicate of the data for a zone that has been transferred from a primary server.

-   A secondary zone is a replica of a primary zone. Type ``slave`` is a
-   synonym for :any:`secondary <type secondary>`. The :any:`primaries` list
-   specifies one or more IP addresses of primary servers that the secondary
-   contacts to update its copy of the zone.
-
-   If a file is
-   specified, then the replica is written to this file whenever the zone
-   is changed, and reloaded from this file on a server restart. Use of a file
-   is recommended, since it often speeds server startup and eliminates a
-   needless waste of bandwidth. Note that for large numbers (in the tens or
-   hundreds of thousands) of zones per server, it is best to use a two-level
-   naming scheme for zone filenames. For example, a secondary server for the
-   zone ``example.com`` might place the zone contents into a file called
-   ``ex/example.com``, where ``ex/`` is just the first two letters of the zone
-   name. (Most operating systems behave very slowly if there are 100,000 files
-   in a single directory.)
+    A secondary zone is a replica of a primary zone. Type ``slave`` is a
+    synonym for :any:`secondary <type secondary>`. The :any:`primaries` list specifies one or more IP
+    addresses of primary servers that the secondary contacts to update
+    its copy of the zone. Primaries list elements can
+    also be names of other primaries lists. By default,
+    transfers are made from port 53 on the servers;
+    this can be changed for all servers by specifying
+    a port number before the list of IP addresses,
+    or on a per-server basis after the IP address.
+    Authentication to the primary can also be done with
+    per-server TSIG keys.  If a file is specified, then the
+    replica is written to this file
+    whenever the zone
+    is changed, and reloaded from this file on a server
+    restart. Use of a file is recommended, since it
+    often speeds server startup and eliminates a
+    needless waste of bandwidth. Note that for large
+    numbers (in the tens or hundreds of thousands) of
+    zones per server, it is best to use a two-level
+    naming scheme for zone filenames. For example,
+    a secondary server for the zone
+    ``example.com`` might place
+    the zone contents into a file called
+    ``ex/example.com``, where
+    ``ex/`` is just the first two
+    letters of the zone name. (Most operating systems
+    behave very slowly if there are 100,000 files in a single directory.)

 .. namedconf:statement:: type mirror
   :tags: zone
@@ -7054,15 +7141,6 @@ Zone Options
 :any:`notify-to-soa`
   See the description of :any:`notify-to-soa` in :ref:`boolean_options`.

-:any:`parental-agents`
-   This option is only meaningful if the zone is DNSSEC signed. When performing
-   a key rollover, BIND will query the parental agents to see if the new DS is
-   actually published before withdrawing the old DNSSEC key.
-
-:any:`primaries`
-   For secondary zones, these are the name servers to request zone transfers
-   from.
-
 :any:`zone-statistics`
   See the description of :any:`zone-statistics` in :namedconf:ref:`options`.

@@ -29,7 +29,7 @@ of RRs in a set is not significant and need not be preserved by name
 servers, resolvers, or other parts of the DNS. However, sorting of
 multiple RRs is permitted for optimization purposes: for example, to
 specify that a particular nearby server be tried first. See
-:ref:`rrset_ordering`.
+:any:`sortlist` and :ref:`rrset_ordering`.

 The components of a Resource Record are:

@@ -1,434 +0,0 @@
-.. Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-..
-.. SPDX-License-Identifier: MPL-2.0
-..
-.. This Source Code Form is subject to the terms of the Mozilla Public
-.. License, v. 2.0.  If a copy of the MPL was not distributed with this
-.. file, you can obtain one at https://mozilla.org/MPL/2.0/.
-..
-.. See the COPYRIGHT file distributed with this work for additional
-.. information regarding copyright ownership.
-
-BIND 9.21.3
-----------
-
-New Features
-~~~~~~~~~~~~
-
- Add separate query counters for new protocols. ``419aa3264e``
-
-  Add query counters for DoT, DoH, unencrypted DoH and their proxied
-  counterparts. The new protocols do not update their respective TCP/UDP
-  transport counter and is now for TCP/UDP over plain 53 only.
-  :gl:`#598` :gl:`!9585`
-
- Implement RFC 9567: EDNS Report-Channel option. ``e1588022c1``
-
-  Add new `send-report-channel` and `log-report-channel` options.
-  `send-report-channel` specifies an agent domain, to which error
-  reports can be sent by querying a specially constructed name within
-  the agent domain. EDNS Report-Channel options will be added to
-  outgoing authoritative responses, to inform clients where to send such
-  queries in the event of a problem.
-
-  If a zone is configured which matches the agent domain and has
-  `log-report-channel` set to `yes`, error-reporting queries will be
-  logged at level `info` to the `dns-reporting-agent` logging channel.
-  :gl:`#3659` :gl:`!7036`
-
- Add detailed debugging of update-policy rule matching. ``80f611afe6``
-
-  This logs how named determines if an update request is granted or
-  denied when using update-policy. :gl:`#4751` :gl:`!9074`
-
- Update bind.keys with the new 2025 IANA root key. ``63ee8979a7``
-
-  Add an 'initial-ds' entry to bind.keys for the new root key, ID 38696,
-  which is scheduled for publication in January 2025. :gl:`#4896`
-  :gl:`!9422`
-
- Support jinja2 templates in pytest runner. ``04bdaf6efb``
-
-  Configuration files in system tests which require some variables (e.g.
-  port numbers) filled in during test setup, can now use jinja2
-  templates when `jinja2` python package is available.
-
-  Any `*.j2` file found within the system test directory will be
-  automatically rendered with the environment variables into a file
-  without the `.j2` extension by the pytest runner. E.g.
-  `ns1/named.conf.j2` will become `ns1/named.conf` during test setup. To
-  avoid automatic rendering, use `.j2.manual` extension and render the
-  files manually at test time.
-
-  New `templates` pytest fixture has been added. Its `render()` function
-  can be used to render a template with custom test variables. This can
-  be useful to fill in different config options during the test. With
-  advanced jinja2 template syntax, it can also be used to include/omit
-  entire sections of the config file rather than using `named1.conf.in`,
-  `named2.conf.in` etc. :gl:`#4938` :gl:`!9587`
-
- Enable runtime selection of FIPS mode in dig and delv. ``2c1fb7e5eb``
-
-  'dig -F' and 'delv -F' can now be used to select FIPS mode at runtime.
-  :gl:`#5046` :gl:`!9754`
-
- Extended TCP accept() logging. ``cd312298ea``
-
-  Add extra log messages about TCP connection management. :gl:`!9089`
-
-Removed Features
-~~~~~~~~~~~~~~~~
-
- Move contributed DLZ modules into a separate repository.
-  ``0fa2807d2b``
-
-  The DLZ modules are poorly maintained as we only ensure they can still
-  be compiled, the DLZ interface is blocking, so anything that blocks
-  the query to the database blocks the whole server and they should not
-  be used except in testing.  The DLZ interface itself is going to be
-  scheduled for removal.
-
-  The DLZ modules now live in
-  https://gitlab.isc.org/isc-projects/dlz-modules repository.
-  :gl:`#4865` :gl:`!9349`
-
- Remove RBTDB implementation. ``a10d78db55``
-
-  Remove the RBTDB database implementation, and only leave the QPDB
-  based implementations of zone and cache databases.  This means it's no
-  longer possible to choose the RBTDB to be default at the compilation
-  time and it's not possible to configure RBTDB as the database backend
-  in the configuration file. :gl:`#5027` :gl:`!9733`
-
- Remove namedconf port/tls deprecated check on `*-source[-v6]` options.
-  ``29f1d4bb6f``
-
-  The usage of port and tls arguments in `*-source` and `*-source-v6` named
-  configuration options has been previously removed. Remove various
-  configuration check deprecating usage of those arguments. :gl:`!9738`
-
- Remove unused <openssl/hmac.h> headers from OpenSSL shims.
-  ``a1fed2d8e7``
-
-  The <openssl/hmac.h> header was unused and including the header might
-  cause build failure when OpenSSL doesn't have Engines support enabled.
-
-  See https://fedoraproject.org/wiki/Changes/OpensslDeprecateEngine
-
-  Removes unused hmac includes after Remove OpenSSL Engine support
-  (commit ef7aba70) removed engine support. :gl:`!9228`
-
-Feature Changes
-~~~~~~~~~~~~~~~
-
- Use default listening rules from config.c string. ``f6148f66d4``
-
-  Remove special code which creates default listeners, and use the
-  normal named.conf configuration parser instead. This removes unneeded
-  code and makes the built-in configuration text provide a true primary
-  source of defaults. This change should be transparent to end-users and
-  should not cause any visible change. :gl:`#1424` :gl:`!2663`
-
- Use lists of expected artifacts in system tests. ``32cc143da0``
-
-  ``clean.sh`` scripts have been replaced by lists of expected artifacts
-  for each system test module. The list is defined using the custom
-  ``pytest.mark.extra_artifacts`` mark, which can use both filenames and
-  globs. :gl:`#4261` :gl:`!9426`
-
- Dnssec-ksr now supports KSK rollovers. ``675a7f0166``
-
-  The tool 'dnssec-ksr' now allows for KSK generation, as well as
-  planned KSK rollovers. When signing a bundle from a Key Signing
-  Request (KSR), only the key that is active in that time frame is being
-  used for signing. Also, the CDS and CDNSKEY records are now added and
-  removed at the correct time. :gl:`#4697`  :gl:`#4705` :gl:`!9452`
-
- Unify parsing of query-source and other X-source options.
-  ``ff94eb9e31``
-
-  The query-source option currently allows the address to be specified
-  in two ways, either as every other X-source option, or as an "address"
-  key-value pair. This merge request extends the `parse_sockaddrsub`
-  config parsing function so that it can parse the query-source option.
-  It also removes the separate config parsing function for
-  `query-source`. :gl:`#4961` :gl:`!9551`
-
- Add none parameter to query-source and query-source-v6 to disable IPv4
-  or IPv6 upstream queries. ``001272127f``
-
-  Add a none parameter to named configuration option `query-source`
-  (respectively `query-source-v6`) which forbid usage of IPv4
-  (respectively IPv6) addresses when named is doing an upstream query.
-  :gl:`#4981` Turning-off upstream IPv6 queries while still listening to
-  downstream queries on IPv6. :gl:`!9727`
-
- Incrementally apply AXFR transfer. ``a3e03b52e2``
-
-  Reintroduce logic to apply diffs when the number of pending tuples is
-  above 128. The previous strategy of accumulating all the tuples and
-  pushing them at the end leads to excessive memory consumption during
-  transfer.
-
-  This effectively reverts half of e3892805d6 :gl:`#4986` :gl:`!9740`
-
- Print expire option in transfer summary. ``d0900b7edf``
-
-  The zone transfer summary will now print the expire option value in
-  the zone transfer summary. :gl:`#5013` :gl:`!9694`
-
- Optimize memory layout of core structs. ``d94e88220c``
-
-  Reduce memory footprint by: - Reordering struct fields to minimize
-  padding. - Using exact-sized atomic types instead of
-  `*_least`/`*_fast` variants - Downsizing integer fields where possible
-
-  Affected structs: - dns_name_t - dns_slabheader_t  - dns_rdata_t -
-  qpcnode_t - qpznode_t :gl:`#5022` :gl:`!9721`
-
- Add missing EDNS option mnemonics. ``887b04571b``
-
-  The `Report-Channel` and `ZONEVERSION` EDNS options can now be sent
-  using `dig +ednsopt=report-channel` (or `dig +ednsopt=rc` for short),
-  and `dig +ednsopt=zoneversion`.
-
-  Several other EDNS option names, including `DAU`, `DHU`, `N3U`, and
-  `CHAIN`, are now displayed correctly in text and YAML formats. Also,
-  an inconsistency has been corrected: the `TCP-KEEPALIVE` option is now
-  spelled with a hyphen in both text and YAML formats; previously, text
-  format used a space. :gl:`!9691`
-
- Add new logging module for logging crypto errors in libisc.
-  ``cf930c23d0``
-
-  Add a new 'crypto' log module that will be used for a low-level
-  cryptographic operations.  The DNS related cryptography logs are still
-  logged in the 'dns/crypto' module. :gl:`!9287`
-
- Add two new clang-format options that help with code formatting.
-  ``94b65f5eb0``
-
-  * Add new clang-format option to remove redundant semicolons
-  * Add new clang-format option to remove redundant parentheses
-
-  :gl:`!9749`
-
- Assume IPv6 is universally available (on the kernel level)
-  ``b72a2300b9``
-
-  Instead of various probing, just assume that IPv6 is universally
-  available and cleanup the various checks and defines that we have
-  accumulated over the years. :gl:`!9360`
-
- Emit more helpful log for exceeding max-records-per-type.
-  ``b2ffa5845b``
-
-  The new log message is emitted when adding or updating an RRset fails
-  due to exceeding the max-records-per-type limit. The log includes the
-  owner name and type, corresponding zone name, and the limit value. It
-  will be emitted on loading a zone file, inbound zone transfer (both
-  AXFR and IXFR), handling a DDNS update, or updating a cache DB. It's
-  especially helpful in the case of zone transfer, since the secondary
-  side doesn't have direct access to the offending zone data.
-
-  It could also be used for max-types-per-name, but this change doesn't
-  implement it yet as it's much less likely to happen in practice.
-  :gl:`!9509`
-
- Enforce type checking for dns_dbversion_t. ``4b47c96a89``
-
-  Originally, the dns_dbversion_t was typedef'ed to void type.  This
-  allowed some flexibility, but using `(void *)` just removes any
-  type-checking that C might have.  Instead of using:
-
-  typedef void dns_dbversion_t;
-
-  use a trick to define the type to non-existing structure:
-
-  typedef struct dns_dbversion dns_dbversion_t;
-
-  This allows the C compilers to employ the type-checking while the
-  structure itself doesn't have to be ever defined because the actual
-  'storage' is never accessed using dns_dbversion_t type. :gl:`!9724`
-
- Harden key management when key files have become unavailabe.
-  ``7a416693bb``
-
-  Prior to doing key management, BIND 9 will check if the key files on
-  disk match the expected keys. If key files for previously observed
-  keys have become unavailable, this will prevent the internal key
-  manager from running. :gl:`!9337`
-
- Unify explicit fetching and libcrypto handling. ``94e5061151``
-
-  Unify libcrypto initialization and explicit digest fetching in a
-  single place.
-
-  It will remove the remaining implicit fetching and deduplicate
-  explicit fetching inside the codebase. Initialization has been moved
-  in to ensure OpenSSL cleanup is done only after fetched contextes are
-  destroyed. :gl:`!9288`
-
-Bug Fixes
-~~~~~~~~~
-
- Use TLS for notifies if configured to do so. ``4c882e4c0b``
-
-  Notifies configured to use TLS will now be sent over TLS, instead of
-  plaintext UDP or TCP. Also, failing to load the TLS configuration for
-  notify now also results in an error. :gl:`#4821` :gl:`!9407`
-
- '{&dns}' is as valid as '{?dns}' in a SVCB's dohpath. ``8e0ec3fe0a``
-
-  `dig` fails to parse a valid (as far as I can tell, and accepted by
-  `kdig` and `Wireshark`) `SVCB` record with a `dohpath` URI template
-  containing a `{&dns}`, like `dohpath=/some/path?key=value{&dns}"`. If
-  the URI template contains a `{?dns}` instead `dig` is happy, but my
-  understanding of rfc9461 and section 1.2. "Levels and Expression
-  Types" of rfc6570 is that `{&dns}` is valid. See for example section
-  1.2. "Levels and Expression Types" of rfc6570.
-
-  Note that Peter van Dijk suggested that `{dns}` and
-  `{dns,someothervar}` might be valid forms as well, so my patch might
-  be too restrictive, although it's anyone's guess how DoH clients would
-  handle complex templates. :gl:`#4922` :gl:`!9455`
-
- Make dns_validator_cancel() respect the data ownership. ``4c0e69ff01``
-
-  There was a data race dns_validator_cancel() was called when the
-  offloaded operations were in progress.  Make dns_validator_cancel()
-  respect the data ownership and only set new .canceling variable when
-  the offloaded operations are in progress.  The cancel operation would
-  then finish when the offloaded work passes the ownership back to the
-  respective thread. :gl:`#4926` :gl:`!9470`
-
- Fix NSEC3 closest encloser lookup for names with empty non-terminals.
-  ``a33528fe99``
-
-  The performance improvement for finding the NSEC3 closest encloser
-  when generating authoritative responses could cause servers to return
-  incorrect NSEC3 records in some cases. This has been fixed.
-  :gl:`#4950` :gl:`!9610`
-
- Revert "Improve performance when looking for the closest encloser"
-  ``3a321ec661``
-
-  Revert "fix: chg: Improve performance when looking for the closest
-  encloser when returning NSEC3 proofs"
-
-  This reverts merge request !9436 :gl:`#4950` :gl:`!9611`
-
- Report client transport in 'rndc recursing' ``87ec2ce498``
-
-  When `rndc recursing` is used to dump the list of recursing clients,
-  it now indicates whether a query was sent via UDP, TCP, TLS, or HTTP.
-  :gl:`#4971` :gl:`!9590`
-
- Fix a data race in dns_zone_getxfrintime() ``84eac93bfd``
-
-  The dns_zone_getxfrintime() function fails to lock the zone before
-  accessing its 'xfrintime' structure member, which can cause a data
-  race between soa_query() and the statistics channel. Add the missing
-  locking/unlocking pair, like it's done in numerous other similar
-  functions. :gl:`#4976` :gl:`!9591`
-
- 'Recursive-clients 0;' triggers an assertion. ``d7fab54393``
-
-  BIND 9.20.0 broke `recursive-clients 0;`.  This has now been fixed.
-  :gl:`#4987` :gl:`!9621`
-
- Transport needs to be a selector when looking for an existing
-  dispatch. ``a7df51b706``
-
-  This allows for dispatch to use existing TCP/HTTPS/TLS etc. streams
-  without accidentally using an unexpected transport. :gl:`#4989`
-  :gl:`!9633`
-
- Parsing of hostnames in rndc.conf was broken. ``6ea2ac5f94``
-
-  When DSCP support was removed, parsing of hostnames in rndc.conf was
-  accidentally broken, resulting in an assertion failure.  This has been
-  fixed. :gl:`#4991` :gl:`!9669`
-
- Restore values when dig prints command line. ``8467449407``
-
-  Options of the form `[+-]option=<value>` failed to display the value
-  on the printed command line. This has been fixed. :gl:`#4993`
-  :gl:`!9653`
-
- Provide more visibility into configuration errors. ``54889fd2af``
-
-  by logging SSL_CTX_use_certificate_chain_file and
-  SSL_CTX_use_PrivateKey_file errors individually. :gl:`#5008`
-  :gl:`!9683`
-
- Fix a data race between dns_zone_getxfr() and dns_xfrin_create()
-  ``60ec9ef507``
-
-  There is a data race between the statistics channel, which uses
-  `dns_zone_getxfr()` to get a reference to `zone->xfr`, and the
-  creation of `zone->xfr`, because the latter happens outside of a zone
-  lock.
-
-  Split the `dns_xfrin_create()` function into two parts to separate the
-  zone transfer starting part from the zone transfer object creation
-  part. This allows us to attach the new object to a local variable
-  first, then attach it to `zone->xfr` under a lock, and only then start
-  the transfer. :gl:`#5011` :gl:`!9716`
-
- Fix race condition when canceling ADB find. ``75f1587aed``
-
-  When canceling the ADB find, the lock on the find gets released for a
-  brief period of time to be locked again inside adbname lock.  During
-  the brief period that the ADB find is unlocked, it can get canceled by
-  other means removing it from the adbname list which in turn causes
-  assertion failure due to a double removal from the adbname list. This
-  has been fixed. :gl:`#5024` :gl:`!9722`
-
- Improve the memory cleaning in the SERVFAIL cache. ``5b96cbea01``
-
-  The SERVFAIL cache doesn't have a memory bound and the cleaning of the
-  old SERVFAIL cache entries was implemented only in opportunistic
-  manner.  Improve the memory cleaning of the SERVFAIL cache to be more
-  aggressive, so it doesn't consume a lot of memory in the case the
-  server encounters many SERVFAILs at once. :gl:`#5025` :gl:`!9760`
-
- Fix trying the next primary server when the preivous one was marked as
-  unreachable. ``025677943d``
-
-  In some cases (there is evidence only when XoT was used) `named`
-  failed to try the next primary server in the list when the previous
-  one was marked as unreachable. This has been fixed. :gl:`#5038`
-  :gl:`!9781`
-
- Clean up 'nodetach' in ns_client. ``617381f115``
-
-  The 'nodetach' member is a leftover from the times when non-zero
-  'stale-answer-client-timeout' values were supported, and currently is
-  always 'false'. Clean up the member and its usage. :gl:`!9592`
-
- Enforce type checking for dns_dbnode_t. ``4b47c4f628``
-
-  Originally, the dns_dbnode_t was typedef'ed to void type.  This
-  allowed some flexibility, but using `(void *)` just removes any
-  type-checking that C might have.  Instead of using:
-
-  typedef void dns_dbnode_t;
-
-  use a trick to define the type to non-existing structure:
-
-  typedef struct dns_dbnode dns_dbnode_t;
-
-  This allows the C compilers to employ the type-checking while the
-  structure itself doesn't have to be ever defined because the actual
-  'storage' is never accessed using dns_dbnode_t type. :gl:`!9719`
-
- Fix error path bugs in the manager's "recursing-clients" list
-  management. ``508f7007e8``
-
-  In two places, after linking the client to the manager's
-  "recursing-clients" list using the check_recursionquota() function,
-  the query.c module fails to unlink it on error paths. Fix the bugs by
-  unlinking the client from the list. :gl:`!9586`
-
-
@@ -62,7 +62,8 @@ BIND 9 also does not allow unsupported algorithms to be used with `auto-dnssec`:
 A validator has more possible interactions with unsupported algorithms:

  * a key using one of these algorithms may be configured as a trust anchor,
-  * upstream answers may contain signatures using such algorithms.
+  * a DLV record for such a key may be placed in a DLV zone.
+  * upstream answers may contain signatures using such algorithms,

 ### Disabled algorithms

@@ -98,6 +99,38 @@ This behavior has changed to be more consistent with unsupported algorithms:
 BIND 9 will ignore such trust anchors, and responses for those domains will
 now be treated as insecure.

+### DLV
+
+If a DLV record in a DLV zone points to a DNSKEY using an unsupported algorithm
+or an algorithm which has been disabled for the relevant part of the tree using
+a `disable-algorithms` clause in `named.conf`, the corresponding zone will be
+treated as insecure.
+
+However, if the trust anchor specified for the DLV zone itself uses an
+unsupported or disabled algorithm, no DLV record in that DLV zone can be
+treated as secure and thus attempts to resolve names in the domains pointed to
+by the records in that DLV zone will yield SERVFAIL responses.  Consider the
+following example:
+
+    trust-anchors {
+        "dlv.example." static-key 257 3 1 ...;
+    };
+
+    options {
+        ...
+        dnssec-lookaside "foo." trust-anchor "dlv.example";
+    };
+
+The example above specifies a DLV trust anchor using the RSAMD5 algorithm
+(algorithm number 1), which effectively prevents resolution of data in any zone
+at and below `foo.` that is listed in `dlv.example` (and does not have a valid,
+non-DLV chain of trust established otherwise).  This outcome is different than
+for a trust anchor which uses an unsupported or disabled algorithm and is not
+associated with a `dnssec-lookaside` clause; the reason for this is that in the
+case of a DLV-referenced, unusable key, the trust point is still defined, but
+has no keys associated with it, whereas non-DLV-referenced, unusable keys are
+ignored altogether and do not cause an associated trust point to be defined.
+
 ### Algorithm rollover

 A zone for which BIND 9 has a trust anchor configured may decide to do an
@@ -43,8 +43,8 @@ The code review process is a dialog between the original author and the
 reviewer.  Code inspection, including documentation and tests, is part of
 this.  Compiling and running the resulting code should be done in most
 cases, even for trivial changes, to ensure that it works as intended. In
-particular, all checks in the CI pipeline must pass run for every modification
-so that unexpected side-effects are identified.
+particular, a full regression test (`make` `check`) must be run for every
+modification so that unexpected side-effects are identified.

 When a problem or concern is found by the reviewer, these comments are
 placed on the merge request in GitLab so the author can respond.
@@ -78,25 +78,18 @@ Documentation is also reviewed. This includes all user-facing text,
 including log messages, manual pages, user manuals and sometimes even
 comments; they must be clearly written and consistent with existing style.

-#### GitLab development workflow
-
-Every change is ultimately submitted as a GitLab merge request (MR) and reviewed
-there. The specifics of the workflow are documented in [BIND development
-workflow](https://gitlab.isc.org/isc-projects/bind9/-/wikis/BIND-development-workflow).
-Take note of the section about MR title and description, which are used to
-generate changelog entries and release notes. These are also subject to the
-review process.
-
 #### Steps in code review:

 * Read the diff
 * Read accompanying notes in the ticket
+* Apply the diff to the appropriate branch
+* Run `configure` (using at least `--enable-developer`)
+* Build
 * Read the documentation, if any
 * Read the tests
-* Ensure the CI passes
+* Run the tests
  <br>(In some cases it may be appropriate to run tests against code
  from before the change to ensure that they fail as expected.)
-* Review the MR description and title (refer to GitLab development workflow)

 #### Things we look for

@@ -135,16 +128,73 @@ tests and documentation will reduce delay.

 ### <a name="testing"></a> Testing

-When you submit a merge request, it triggers a CI pipeline which executes unit
-and system tests on various platforms. You should pay attention to any failures,
-as some can only occur in specific environments. Getting the CI to pass is a
-good start when preparing the merge request for the review.
+#### <a name="systest"></a> Running system tests

-#### <a name="systest"></a> System tests
+To enable system tests to work, we first need to create the test loopback
+interfaces (as root):

-If you want to run the system tests locally, please refer to [BIND9 System Test
-Framework](bin/tests/system/README.md) for information about running and writing
-system tests.
+        $ cd bin/tests/system
+        $ sudo sh ifconfig.sh up
+        $ cd ../../..
+
+To run the tests, build BIND (be sure to use --with-cmocka to run unit
+tests), then run `make` `check`.  An easy way to check the results:
+
+        $ make check 2>&1 | tee /tmp/check.out
+        $ grep -A 10 'Testsuite summary' /tmp/check.out
+
+This will show all of the test results. One or two "R:SKIPPED" is okay; if
+there are a lot of them, then you probably forgot to create the loopback
+interfaces in the previous step. (NOTE: the summary of tests that appears at
+the end of `make` `check` only summarizes the system test results, not the
+unit tests, so you can't rely on it to catch everything.)
+
+To run only the system tests, omitting unit tests:
+
+	$ make test
+
+To run an individual system test:
+
+        $ make -C bin/tests/system/ check TESTS=<testname> V=1
+
+Or:
+
+        $ TESTS= make -e all check
+        $ cd bin/tests/system
+        $ sh run.sh <testname>
+
+System tests are in separate directories under `bin/tests/system`.
+For example, the "dnssec" test is in `bin/tests/system/dnssec`.
+
+#### Writing system tests
+
+The following standard files are found in system test directories:
+
+- `prereq.sh`: run at the beginning to determine whether the test can be run at all; if not, we see R:SKIPPED
+
+- `setup.sh`: sets up the preconditions for the tests
+
+- `tests.sh`: runs all the test cases. A non-zero return value results in R:FAIL
+
+- `ns[X]`: these subdirectories contain test name servers that can be
+  queried or can interact with each other. (For example, `ns1` might be
+  running as a root server, `ns2` as a TLD server, and `ns3` as a recursive
+  resolver.)  The value of X indicates the address the server listens on:
+  for example, `ns2` listens on 10.53.0.2, and ns4 on 10.53.0.4. All test
+  servers use port 5300 so they don't need to run as root. All servers
+  log at the highest debug level, and the logs are captured in the file
+  `nsX/named.run`.
+
+- `ans[X]`: like `ns[X]`, but these are simple mock name servers
+  implemented in perl; they are generally programmed to misbehave in ways
+  `named` wouldn't, so as to exercise `named`'s ability to interoperate with
+  badly behaved name servers.  Logs, if any, are captured in `ansX/ans.run`.
+
+All test scripts source the file `bin/tests/system/conf.sh` (which is
+generated by `configure` from `conf.sh.in`).  This script provides
+functions and variables pointing to the binaries under test; for example,
+`DIG` contains the path to `dig` in the build tree being tested, `RNDC`
+points to `rndc`, `SIGNZONE` to `dnssec-signzone`, etc.

 #### <a name="unittest"></a> Building unit tests

@@ -180,6 +180,14 @@ within a library but not for public use, are kept in the source tree at the
 same level as their related C files, and often have `"_p"` in their names,
 e.g. `lib/isc/mem_p.h`.

+Header files that define modules should have a structure like the
+following.  Note that `<isc/lang.h>` MUST be included by any public header
+file using the ISC_LANG_BEGINDECLS and ISC_LANG_ENDDECLS macros, so the
+correct name-mangling happens for function declarations when C++ programs
+include the file.  `<isc/lang.h>` SHOULD be included for private header files
+or for public files that do not declare any functions.
+
+
        /*
         * Copyright (C) 2016  Internet Systems Consortium, Inc. ("ISC")
         *
@@ -223,6 +231,7 @@ e.g. `lib/isc/mem_p.h`.
         ***/

        /* #includes here. */
+        #include <isc/lang.h>

        /***
         *** Types
@@ -233,7 +242,9 @@ e.g. `lib/isc/mem_p.h`.
        /***
         *** Functions
         ***/
+        ISC_LANG_BEGINDECLS
        /* (Function declarations here, with full prototypes.) */
+        ISC_LANG_ENDDECLS

 #### Including Interfaces (.h files)

@@ -898,7 +898,7 @@ presence. Let's look at the following configuration excerpt:

 ::

-   remote-servers "net" {
+   parental-agents "net" {
       10.53.0.11; 10.53.0.12;
   };

@@ -5,7 +5,7 @@ zone <string> [ <class> ] {
 	allow-query-on { <address_match_element>; ... };
 	allow-transfer [ port <integer> ] [ transport <string> ] { <address_match_element>; ... };
 	allow-update-forwarding { <address_match_element>; ... };
-	also-notify [ port <integer> ] [ source ( <ipv4_address> | * ) ] [ source-v6 ( <ipv6_address> | * ) ] { ( <server-list> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]; ... };
+	also-notify [ port <integer> ] [ source ( <ipv4_address> | * ) ] [ source-v6 ( <ipv6_address> | * ) ] { ( <remote-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]; ... };
 	check-names ( fail | warn | ignore );
 	database <string>;
 	file <quoted_string>;
@@ -26,12 +26,12 @@ zone <string> [ <class> ] {
 	max-types-per-name <integer>;
 	min-refresh-time <integer>;
 	min-retry-time <integer>;
-	multi-master <boolean>;
+	multi-master <boolean>; // obsolete
 	notify ( explicit | master-only | primary-only | <boolean> );
 	notify-delay <integer>;
 	notify-source ( <ipv4_address> | * );
 	notify-source-v6 ( <ipv6_address> | * );
-	primaries [ port <integer> ] [ source ( <ipv4_address> | * ) ] [ source-v6 ( <ipv6_address> | * ) ] { ( <server-list> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]; ... };
+	primaries [ port <integer> ] [ source ( <ipv4_address> | * ) ] [ source-v6 ( <ipv6_address> | * ) ] { ( <remote-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]; ... };
 	request-expire <boolean>;
 	request-ixfr <boolean>;
 	request-ixfr-max-diffs <integer>;
@@ -78,14 +78,14 @@ options {
 	allow-transfer [ port <integer> ] [ transport <string> ] { <address_match_element>; ... };
 	allow-update { <address_match_element>; ... };
 	allow-update-forwarding { <address_match_element>; ... };
-	also-notify [ port <integer> ] [ source ( <ipv4_address> | * ) ] [ source-v6 ( <ipv6_address> | * ) ] { ( <server-list> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]; ... };
+	also-notify [ port <integer> ] [ source ( <ipv4_address> | * ) ] [ source-v6 ( <ipv6_address> | * ) ] { ( <remote-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]; ... };
 	answer-cookie <boolean>;
 	attach-cache <string>;
 	auth-nxdomain <boolean>;
 	automatic-interface-scan <boolean>;
 	bindkeys-file <quoted_string>; // test only
 	blackhole { <address_match_element>; ... };
-	catalog-zones { zone <string> [ default-primaries [ port <integer> ] [ source ( <ipv4_address> | * ) ] [ source-v6 ( <ipv6_address> | * ) ] { ( <server-list> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]; ... } ] [ zone-directory <quoted_string> ] [ in-memory <boolean> ] [ min-update-interval <duration> ]; ... };
+	catalog-zones { zone <string> [ default-primaries [ port <integer> ] [ source ( <ipv4_address> | * ) ] [ source-v6 ( <ipv6_address> | * ) ] { ( <remote-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]; ... } ] [ zone-directory <quoted_string> ] [ in-memory <boolean> ] [ min-update-interval <duration> ]; ... };
 	check-dup-records ( fail | warn | ignore );
 	check-integrity <boolean>;
 	check-mx ( fail | warn | ignore );
@@ -204,7 +204,7 @@ options {
 	min-retry-time <integer>;
 	minimal-any <boolean>;
 	minimal-responses ( no-auth | no-auth-recursive | <boolean> );
-	multi-master <boolean>;
+	multi-master <boolean>; // obsolete
 	new-zones-directory <quoted_string>;
 	no-case-compress { <address_match_element>; ... };
 	nocookie-udp-size <integer>;
@@ -278,6 +278,7 @@ options {
 	sig-validity-interval <integer> [ <integer> ]; // obsolete
 	sig0checks-quota <integer>; // experimental
 	sig0checks-quota-exempt { <address_match_element>; ... }; // experimental
+	sortlist { <address_match_element>; ... }; // deprecated
 	stale-answer-client-timeout ( disabled | off | <integer> );
 	stale-answer-enable <boolean>;
 	stale-answer-ttl <duration>;
@@ -319,9 +320,11 @@ options {
 	zone-statistics ( full | terse | none | <boolean> );
 };

+parental-agents <string> [ port <integer> ] [ source ( <ipv4_address> | * ) ] [ source-v6 ( <ipv6_address> | * ) ] { ( <remote-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]; ... }; // may occur multiple times
+
 plugin ( query ) <string> [ { <unspecified-text> } ]; // may occur multiple times

-remote-servers <string> [ port <integer> ] [ source ( <ipv4_address> | * ) ] [ source-v6 ( <ipv6_address> | * ) ] { ( <server-list> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]; ... }; // may occur multiple times
+primaries <string> [ port <integer> ] [ source ( <ipv4_address> | * ) ] [ source-v6 ( <ipv6_address> | * ) ] { ( <remote-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]; ... }; // may occur multiple times

 server <netprefix> {
 	bogus <boolean>;
@@ -383,10 +386,10 @@ view <string> [ <class> ] {
 	allow-transfer [ port <integer> ] [ transport <string> ] { <address_match_element>; ... };
 	allow-update { <address_match_element>; ... };
 	allow-update-forwarding { <address_match_element>; ... };
-	also-notify [ port <integer> ] [ source ( <ipv4_address> | * ) ] [ source-v6 ( <ipv6_address> | * ) ] { ( <server-list> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]; ... };
+	also-notify [ port <integer> ] [ source ( <ipv4_address> | * ) ] [ source-v6 ( <ipv6_address> | * ) ] { ( <remote-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]; ... };
 	attach-cache <string>;
 	auth-nxdomain <boolean>;
-	catalog-zones { zone <string> [ default-primaries [ port <integer> ] [ source ( <ipv4_address> | * ) ] [ source-v6 ( <ipv6_address> | * ) ] { ( <server-list> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]; ... } ] [ zone-directory <quoted_string> ] [ in-memory <boolean> ] [ min-update-interval <duration> ]; ... };
+	catalog-zones { zone <string> [ default-primaries [ port <integer> ] [ source ( <ipv4_address> | * ) ] [ source-v6 ( <ipv6_address> | * ) ] { ( <remote-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]; ... } ] [ zone-directory <quoted_string> ] [ in-memory <boolean> ] [ min-update-interval <duration> ]; ... };
 	check-dup-records ( fail | warn | ignore );
 	check-integrity <boolean>;
 	check-mx ( fail | warn | ignore );
@@ -486,7 +489,7 @@ view <string> [ <class> ] {
 	min-retry-time <integer>;
 	minimal-any <boolean>;
 	minimal-responses ( no-auth | no-auth-recursive | <boolean> );
-	multi-master <boolean>;
+	multi-master <boolean>; // obsolete
 	new-zones-directory <quoted_string>;
 	no-case-compress { <address_match_element>; ... };
 	nocookie-udp-size <integer>;
@@ -571,6 +574,7 @@ view <string> [ <class> ] {
 	sig-signing-signatures <integer>;
 	sig-signing-type <integer>;
 	sig-validity-interval <integer> [ <integer> ]; // obsolete
+	sortlist { <address_match_element>; ... }; // deprecated
 	stale-answer-client-timeout ( disabled | off | <integer> );
 	stale-answer-enable <boolean>;
 	stale-answer-ttl <duration>;
@@ -4,7 +4,7 @@ zone <string> [ <class> ] {
 	allow-query-on { <address_match_element>; ... };
 	allow-transfer [ port <integer> ] [ transport <string> ] { <address_match_element>; ... };
 	allow-update { <address_match_element>; ... };
-	also-notify [ port <integer> ] [ source ( <ipv4_address> | * ) ] [ source-v6 ( <ipv6_address> | * ) ] { ( <server-list> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]; ... };
+	also-notify [ port <integer> ] [ source ( <ipv4_address> | * ) ] [ source-v6 ( <ipv6_address> | * ) ] { ( <remote-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]; ... };
 	check-dup-records ( fail | warn | ignore );
 	check-integrity <boolean>;
 	check-mx ( fail | warn | ignore );
@@ -48,7 +48,7 @@ zone <string> [ <class> ] {
 	notify-source-v6 ( <ipv6_address> | * );
 	notify-to-soa <boolean>;
 	nsec3-test-zone <boolean>; // test only
-	parental-agents [ port <integer> ] [ source ( <ipv4_address> | * ) ] [ source-v6 ( <ipv6_address> | * ) ] { ( <server-list> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]; ... };
+	parental-agents [ port <integer> ] [ source ( <ipv4_address> | * ) ] [ source-v6 ( <ipv6_address> | * ) ] { ( <remote-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]; ... };
 	parental-source ( <ipv4_address> | * );
 	parental-source-v6 ( <ipv6_address> | * );
 	send-report-channel <string>;
@@ -10,6 +10,6 @@ zone <string> [ <class> ] {
 	max-records-per-type <integer>;
 	max-types-per-name <integer>;
 	max-zone-ttl ( unlimited | <duration> ); // deprecated
-	primaries [ port <integer> ] [ source ( <ipv4_address> | * ) ] [ source-v6 ( <ipv6_address> | * ) ] { ( <server-list> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]; ... };
+	primaries [ port <integer> ] [ source ( <ipv4_address> | * ) ] [ source-v6 ( <ipv6_address> | * ) ] { ( <remote-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]; ... };
 	zone-statistics ( full | terse | none | <boolean> );
 };
@@ -5,7 +5,7 @@ zone <string> [ <class> ] {
 	allow-query-on { <address_match_element>; ... };
 	allow-transfer [ port <integer> ] [ transport <string> ] { <address_match_element>; ... };
 	allow-update-forwarding { <address_match_element>; ... };
-	also-notify [ port <integer> ] [ source ( <ipv4_address> | * ) ] [ source-v6 ( <ipv6_address> | * ) ] { ( <server-list> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]; ... };
+	also-notify [ port <integer> ] [ source ( <ipv4_address> | * ) ] [ source-v6 ( <ipv6_address> | * ) ] { ( <remote-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]; ... };
 	check-names ( fail | warn | ignore );
 	checkds ( explicit | <boolean> );
 	database <string>;
@@ -38,17 +38,17 @@ zone <string> [ <class> ] {
 	max-types-per-name <integer>;
 	min-refresh-time <integer>;
 	min-retry-time <integer>;
-	multi-master <boolean>;
+	multi-master <boolean>; // obsolete
 	notify ( explicit | master-only | primary-only | <boolean> );
 	notify-delay <integer>;
 	notify-source ( <ipv4_address> | * );
 	notify-source-v6 ( <ipv6_address> | * );
 	notify-to-soa <boolean>;
 	nsec3-test-zone <boolean>; // test only
-	parental-agents [ port <integer> ] [ source ( <ipv4_address> | * ) ] [ source-v6 ( <ipv6_address> | * ) ] { ( <server-list> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]; ... };
+	parental-agents [ port <integer> ] [ source ( <ipv4_address> | * ) ] [ source-v6 ( <ipv6_address> | * ) ] { ( <remote-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]; ... };
 	parental-source ( <ipv4_address> | * );
 	parental-source-v6 ( <ipv6_address> | * );
-	primaries [ port <integer> ] [ source ( <ipv4_address> | * ) ] [ source-v6 ( <ipv6_address> | * ) ] { ( <server-list> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]; ... };
+	primaries [ port <integer> ] [ source ( <ipv4_address> | * ) ] [ source-v6 ( <ipv6_address> | * ) ] { ( <remote-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]; ... };
 	request-expire <boolean>;
 	request-ixfr <boolean>;
 	request-ixfr-max-diffs <integer>;
@@ -18,8 +18,8 @@ zone <string> [ <class> ] {
 	max-types-per-name <integer>;
 	min-refresh-time <integer>;
 	min-retry-time <integer>;
-	multi-master <boolean>;
-	primaries [ port <integer> ] [ source ( <ipv4_address> | * ) ] [ source-v6 ( <ipv6_address> | * ) ] { ( <server-list> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]; ... };
+	multi-master <boolean>; // obsolete
+	primaries [ port <integer> ] [ source ( <ipv4_address> | * ) ] [ source-v6 ( <ipv6_address> | * ) ] { ( <remote-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]; ... };
 	transfer-source ( <ipv4_address> | * );
 	transfer-source-v6 ( <ipv6_address> | * );
 	zone-statistics ( full | terse | none | <boolean> );
@@ -1,198 +0,0 @@
-.. Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-..
-.. SPDX-License-Identifier: MPL-2.0
-..
-.. This Source Code Form is subject to the terms of the Mozilla Public
-.. License, v. 2.0.  If a copy of the MPL was not distributed with this
-.. file, you can obtain one at https://mozilla.org/MPL/2.0/.
-..
-.. See the COPYRIGHT file distributed with this work for additional
-.. information regarding copyright ownership.
-
-Notes for BIND 9.21.3
---------------------
-
-New Features
-~~~~~~~~~~~~
-
- Add separate query counters for new protocols.
-
-  Add query counters for DoT, DoH, unencrypted DoH and their proxied
-  counterparts. The new protocols do not update their respective TCP/UDP
-  transport counter. The previously existing counters are now dedicated
-  for TCP/UDP over plain port 53 only. :gl:`#598`
-
- Implement :rfc:`9567`: EDNS Report-Channel option.
-
-  Add new :namedconf:ref:`send-report-channel` and :namedconf:ref:`log-report-channel` options.
-
-  :namedconf:ref:`send-report-channel` specifies an *agent domain*, to which error
-  reports can be sent by querying a specially constructed name within
-  the agent domain. The EDNS Report-Channel option has been added to
-  outgoing authoritative responses, to inform clients where to send such
-  error reports in the event of a problem.
-
-  If a :namedconf:ref:`zone` is configured which matches the *agent domain* and has
-  :namedconf:ref:`log-report-channel` set to `yes`, error-reporting queries will be
-  logged at level `info` to the `dns-reporting-agent` logging :namedconf:ref:`channel`.
-  :gl:`#3659`
-
- Add detailed debugging of :namedconf:ref:`update-policy` rule matching.
-
-  This logs how :iscman:`named` determines whether an update request is granted or
-  denied when using update-policy. :gl:`#4751`
-
- Update built-in :file:`bind.keys` file with the new 2025 `IANA root key
-  <https://www.iana.org/dnssec/files>`_.
-
-  Add an `initial-ds` entry to :file:`bind.keys` for the new root key, ID
-  38696, which is scheduled for publication in January 2025. :gl:`#4896`
-
- Enable runtime selection of FIPS mode in :iscman:`dig` and delv.
-
-  :option:`dig -F` and :option:`delv -F` can now be used to select FIPS mode at
-  runtime. :gl:`#5046`
-
-Removed Features
-~~~~~~~~~~~~~~~~
-
- Move contributed DLZ modules into a separate repository. DLZ modules should
-  not be used except in testing.
-
-  The DLZ modules were not maintained, the DLZ interface itself is going to be
-  scheduled for removal, and the DLZ interface is blocking. Any module that
-  blocks the query to the :namedconf:ref:`database` blocks the whole server.
-
-  The DLZ modules now live in
-  https://gitlab.isc.org/isc-projects/dlz-modules repository.
-  :gl:`#4865`
-
- Remove RBTDB implementation.
-
-  Remove the RBTDB :namedconf:ref:`database` implementation, and only leave the
-  QPDB-based implementations of :namedconf:ref:`zone` and cache databases. This means it is no
-  longer possible to choose RBTDB as the default database at compilation
-  time, nor to configure RBTDB as the :namedconf:ref:`database` backend
-  in the configuration file. :gl:`#5027`
-
-Feature Changes
-~~~~~~~~~~~~~~~
-
- :iscman:`dnssec-ksr` now supports KSK rollovers.
-
-  The tool now allows for KSK generation, as well as planned KSK rollovers.
-  When signing a bundle from a Key Signing Request (KSR), only the
-  key that is active in that time frame is
-  used for signing. Also, the CDS and CDNSKEY records are now added and
-  removed at the correct time. :gl:`#4697`  :gl:`#4705`
-
- Add `none` parameter to :namedconf:ref:`query-source` and
-  :namedconf:ref:`query-source-v6` to disable IPv4 or IPv6 upstream queries but
-  allow listening to queries from clients on IPv4 or IPv6.
-
- Print :rfc:`7314`: EXPIRE option in transfer summary. :gl:`#5013`
-
- Add missing EDNS option mnemonics to :iscman:`dig`.
-
-  The `Report-Channel` and `ZONEVERSION` options can now be sent
-  using `dig +ednsopt=report-channel` (or `dig +ednsopt=rc` for short),
-  and `dig +ednsopt=zoneversion`.
-
-  Several other EDNS option names, including `DAU`, `DHU`, `N3U`, and
-  `CHAIN`, are now displayed correctly in text and YAML formats.
-
-  Also, an inconsistency has been corrected: the `TCP-KEEPALIVE` option is now
-  spelled with a hyphen in both text and YAML formats; previously, text
-  format used a space.
-
- Add new :namedconf:ref:`logging` module for crypto errors in libisc.
-
-  Add a new `crypto` log module to be used for low-level
-  cryptographic operations. The DNS-related cryptography logs are still
-  logged in the 'dns/crypto' module.
-
- Emit more helpful log messages for exceeding :namedconf:ref:`max-records-per-type`.
-
-  The new log message is emitted when adding or updating an RRset fails
-  due to exceeding the :namedconf:ref:`max-records-per-type` limit. The log includes the
-  owner name and type, corresponding zone name, and the limit value. It
-  will be emitted on loading a zone file, inbound zone transfer (both
-  AXFR and IXFR), handling a DDNS update, or updating a cache DB. It's
-  especially helpful in the case of zone transfer, since the secondary
-  side doesn't have direct access to the offending zone data.
-
-  It could also be used for :namedconf:ref:`max-types-per-name`, but this change doesn't
-  implement it yet as it's much less likely to happen in practice.
-
- Harden key management when key files have become unavailable.
-
-  Prior to doing key management, BIND 9 will check if the key files on
-  disk match the expected keys. If key files for previously observed
-  keys have become unavailable, this will prevent the internal key
-  manager from running.
-
- Reduce memory footprint by optimizing commonly-used data structures.
-  :gl:`#5022`
-
-Bug Fixes
-~~~~~~~~~
-
- Use TLS for notifies if configured to do so.
-
-  Notifies configured to use TLS will now be sent over TLS, instead of
-  plain text UDP or TCP. Also, failing to load the TLS configuration for
-  :namedconf:ref:`notify` now results in an error. :gl:`#4821`
-
- `{&dns}` is as valid as `{?dns}` in a SVCB's dohpath.
-
-  :iscman:`dig` failed to parse a valid `SVCB` record with a `dohpath` URI
-  template containing a `{&dns}`, like `dohpath=/some/path?key=value{&dns}"`.
-  :gl:`#4922`
-
- Fix NSEC3 closest encloser lookup for names with empty non-terminals.
-
-  A previous performance optimization for finding the NSEC3 closest encloser
-  when generating authoritative responses could cause servers to return
-  incorrect NSEC3 records in some cases. This has been fixed.
-  :gl:`#4950`
-
- Report client transport in :option:`rndc recursing` output
-
-  When :option:`rndc recursing` is used to dump the list of recursing
-  clients, it now indicates whether a query was sent via UDP, TCP,
-  TLS, or HTTP.
-  :gl:`#4971`
-
- :namedconf:ref:`recursive-clients` statement with value 0 triggered an assertion failure.
-
-  BIND 9.20.0 broke `recursive-clients 0;`.  This has now been fixed.
-  :gl:`#4987`
-
- Parsing of hostnames in :iscman:`rndc.conf` was broken.
-
-  When DSCP support was removed, parsing of hostnames in :iscman:`rndc.conf` was
-  accidentally broken, resulting in an assertion failure.  This has been
-  fixed. :gl:`#4991`
-
- :iscman:`dig` options of the form `[+-]option=<value>` failed to display the
-  value on the printed command line. This has been fixed. :gl:`#4993`
-
- Provide more visibility into TLS configuration errors by logging
-  `SSL_CTX_use_certificate_chain_file()` and `SSL_CTX_use_PrivateKey_file()`
-  errors individually. :gl:`#5008`
-
- Fix a race condition when canceling ADB find which could cause an assertion
-  failure. :gl:`#5024`
-
- Fix doubled memory usage during incoming zone transfer. :gl:`#4986`
-
- SERVFAIL cache memory cleaning is now more aggressive; it no longer consumes a
-  lot of memory if the server encounters many SERVFAILs at once.
-  :gl:`#5025`
-
- Fix trying the next primary XoT server when the previous one was marked as
-  unreachable.
-
-  In some cases :iscman:`named` failed to try the next primary
-  server in the :namedconf:ref:`primaries` list when the previous one was marked as
-  unreachable. This has been fixed. :gl:`#5038`
@@ -18,6 +18,7 @@
 #include <stdint.h>

 #include <isc/dir.h>
+#include <isc/lang.h>
 #include <isc/mem.h>
 #include <isc/once.h>
 #include <isc/types.h>
@@ -25,6 +26,8 @@

 #include <dst/dst.h>

+ISC_LANG_BEGINDECLS
+
 extern bool debug;

 int
@@ -37,3 +40,5 @@ LLVMFuzzerTestOneInput(const uint8_t *data, size_t size);
 	if ((x) != ISC_R_SUCCESS) { \
 		return (0);         \
 	}
+
+ISC_LANG_ENDDECLS
@@ -167,6 +167,22 @@ options {
 	interface - interval 1002;
 	statistics - interval 1003;

+	topology {
+		10 / 8;
+
+		!1.2.3 / 24;
+
+		{
+			1.2 / 16;
+			3 / 8;
+		};
+	};
+
+	sortlist {
+		10 / 8;
+		11 / 8;
+	};
+
 	tkey - domain "foo.com";
 	tkey - dhkey "xyz" 666;

@@ -14,11 +14,15 @@
 #pragma once

 #include <isc/heap.h>
+#include <isc/lang.h>
 #include <isc/urcu.h>

 #include <dns/nsec3.h>
 #include <dns/types.h>

+#define GLUETABLE_INIT_SIZE 1 << 2
+#define GLUETABLE_MIN_SIZE  1 << 8
+
 #define RDATATYPE_NCACHEANY DNS_TYPEPAIR_VALUE(0, dns_rdatatype_any)

 #ifdef STRONG_RWLOCK_CHECK
@@ -114,33 +118,22 @@
 #define IS_STUB(db)  (((db)->common.attributes & DNS_DBATTR_STUB) != 0)
 #define IS_CACHE(db) (((db)->common.attributes & DNS_DBATTR_CACHE) != 0)

+ISC_LANG_BEGINDECLS
+
 struct dns_glue {
 	struct dns_glue *next;
-	dns_name_t name;
+	dns_fixedname_t fixedname;
 	dns_rdataset_t rdataset_a;
 	dns_rdataset_t sigrdataset_a;
 	dns_rdataset_t rdataset_aaaa;
 	dns_rdataset_t sigrdataset_aaaa;
 };

-struct dns_gluelist {
-	isc_mem_t *mctx;
-
-	const dns_dbversion_t *version;
-	dns_slabheader_t *header;
-
-	struct dns_glue *glue;
-
-	struct rcu_head rcu_head;
-	struct cds_wfs_node wfs_node;
-};
-
-typedef struct dns_glue_additionaldata_ctx {
+typedef struct {
+	dns_glue_t *glue_list;
 	dns_db_t *db;
 	dns_dbversion_t *version;
-	dns_dbnode_t *node;
-
-	dns_glue_t *glue;
+	dns_name_t *nodename;
 } dns_glue_additionaldata_ctx_t;

 typedef struct {
@@ -201,3 +194,5 @@ dns__db_logtoomanyrecords(dns_db_t *db, const dns_name_t *name,
 * 'maxrrperset' limit. 'op' is 'adding' or 'updating' depending on whether
 * the addition is to create a new rdataset or to merge to an existing one.
 */
+
+ISC_LANG_ENDDECLS
@@ -1152,11 +1152,20 @@ static int
 dispatch_match(struct cds_lfht_node *node, const void *key0) {
 	dns_dispatch_t *disp = caa_container_of(node, dns_dispatch_t, ht_node);
 	const struct dispatch_key *key = key0;
+	isc_sockaddr_t local;
+	isc_sockaddr_t peer;

-	return disp->transport == key->transport &&
-	       isc_sockaddr_equal(&disp->peer, key->peer) &&
-	       (key->local == NULL ||
-		isc_sockaddr_equal(&disp->local, key->local));
+	if (disp->handle != NULL) {
+		local = isc_nmhandle_localaddr(disp->handle);
+		peer = isc_nmhandle_peeraddr(disp->handle);
+	} else {
+		local = disp->local;
+		peer = disp->peer;
+	}
+
+	return isc_sockaddr_equal(&peer, key->peer) &&
+	       disp->transport == key->transport &&
+	       (key->local == NULL || isc_sockaddr_equal(&local, key->local));
 }

 isc_result_t
@@ -1996,16 +2005,10 @@ tcp_dispatch_connect(dns_dispatch_t *disp, dns_dispentry_t *resp) {
 			      "connecting from %s to %s, timeout %u", localbuf,
 			      peerbuf, resp->timeout);

-		char *hostname = NULL;
-		if (resp->transport != NULL) {
-			hostname = dns_transport_get_remote_hostname(
-				resp->transport);
-		}
-
 		isc_nm_streamdnsconnect(disp->mgr->nm, &disp->local,
 					&disp->peer, tcp_connected, disp,
-					resp->timeout, tlsctx, hostname,
-					sess_cache, ISC_NM_PROXY_NONE, NULL);
+					resp->timeout, tlsctx, sess_cache,
+					ISC_NM_PROXY_NONE, NULL);
 		break;

 	case DNS_DISPATCHSTATE_CONNECTING:
@@ -2200,7 +2203,7 @@ dns_dispentry_getlocaladdress(dns_dispentry_t *resp, isc_sockaddr_t *addrp) {

 	switch (disp->socktype) {
 	case isc_socktype_tcp:
-		*addrp = isc_nmhandle_localaddr(disp->handle);
+		*addrp = disp->local;
 		return ISC_R_SUCCESS;
 	case isc_socktype_udp:
 		*addrp = isc_nmhandle_localaddr(resp->handle);
@@ -39,6 +39,7 @@

 #include <isc/buffer.h>
 #include <isc/hmac.h>
+#include <isc/lang.h>
 #include <isc/magic.h>
 #include <isc/md.h>
 #include <isc/refcount.h>
@@ -50,6 +51,8 @@

 #include <dst/dst.h>

+ISC_LANG_BEGINDECLS
+
 #define KEY_MAGIC ISC_MAGIC('D', 'S', 'T', 'K')
 #define CTX_MAGIC ISC_MAGIC('D', 'S', 'T', 'C')

@@ -224,4 +227,6 @@ dst_key_close(char *tmpname, FILE *fp, char *filename);
 isc_result_t
 dst_key_cleanup(char *tmpname, FILE *fp);

+ISC_LANG_ENDDECLS
+
 /*! \file */
@@ -20,10 +20,13 @@
 #include <openssl/evp.h>
 #include <openssl/rand.h>

+#include <isc/lang.h>
 #include <isc/log.h>
 #include <isc/result.h>
 #include <isc/tls.h>

+ISC_LANG_BEGINDECLS
+
 #define dst__openssl_toresult(fallback)                                    \
 	isc__tlserr2result(ISC_LOGCATEGORY_INVALID, ISC_LOGMODULE_INVALID, \
 			   NULL, fallback, __FILE__, __LINE__)
@@ -46,3 +49,5 @@ dst__openssl_keypair_isprivate(const dst_key_t *key);

 void
 dst__openssl_keypair_destroy(dst_key_t *key);
+
+ISC_LANG_ENDDECLS
@@ -30,6 +30,8 @@
 /*! \file */
 #pragma once

+#include <isc/lang.h>
+
 #include <dst/dst.h>

 #define MAXFIELDSIZE 512
@@ -107,6 +109,8 @@ struct dst_private {

 typedef struct dst_private dst_private_t;

+ISC_LANG_BEGINDECLS
+
 void
 dst__privstruct_free(dst_private_t *priv, isc_mem_t *mctx);

@@ -117,3 +121,5 @@ dst__privstruct_parse(dst_key_t *key, unsigned int alg, isc_lex_t *lex,
 isc_result_t
 dst__privstruct_writefile(const dst_key_t *key, const dst_private_t *priv,
 			  const char *directory);
+
+ISC_LANG_ENDDECLS
@@ -30,6 +30,7 @@

 #include <stdbool.h>

+#include <isc/lang.h>
 #include <isc/magic.h>
 #include <isc/netaddr.h>
 #include <isc/refcount.h>
@@ -117,6 +118,8 @@ struct dns_aclenv {
 *** Functions
 ***/

+ISC_LANG_BEGINDECLS
+
 void
 dns_acl_create(isc_mem_t *mctx, int n, dns_acl_t **target);
 /*%<
@@ -230,7 +233,8 @@ dns_acl_match(const isc_netaddr_t *reqaddr, const dns_name_t *reqsigner,
 	      const dns_acl_t *acl, dns_aclenv_t *env, int *match,
 	      const dns_aclelement_t **matchelt);
 /*%<
- * General, low-level ACL matching.
+ * General, low-level ACL matching.  This is expected to
+ * be useful even for weird stuff like the topology and sortlist statements.
 *
 * Match the address 'reqaddr', and optionally the key name 'reqsigner',
 * against 'acl'.  'reqsigner' may be NULL.
@@ -309,3 +313,5 @@ dns_acl_merge_ports_transports(dns_acl_t *dest, dns_acl_t *source, bool pos);
 *\li		'dest' is a valid ACL object;
 *\li		'source' is a valid ACL object.
 */
+
+ISC_LANG_ENDDECLS
@@ -66,6 +66,7 @@
 #include <inttypes.h>
 #include <stdbool.h>

+#include <isc/lang.h>
 #include <isc/magic.h>
 #include <isc/mem.h>
 #include <isc/mutex.h>
@@ -74,6 +75,8 @@
 #include <dns/types.h>
 #include <dns/view.h>

+ISC_LANG_BEGINDECLS
+
 /***
 *** Magic number checks
 ***/
@@ -751,3 +754,4 @@ dns_adb_dumpquota(dns_adb_t *adb, isc_buffer_t **buf);
 * Requires:
 * \li 'adb' is valid.
 */
+ISC_LANG_ENDDECLS
@@ -51,6 +51,8 @@

 #include <dns/types.h>

+ISC_LANG_BEGINDECLS
+
 /***
 ***	Functions
 ***/
@@ -144,3 +146,5 @@ dns_badcache_print(dns_badcache_t *bc, const char *cachename, FILE *fp);
 * \li	cachename != NULL
 * \li	fp != NULL
 */
+
+ISC_LANG_ENDDECLS
@@ -40,8 +40,12 @@
 *\li	Drafts:	TBS
 */

+#include <isc/lang.h>
+
 #include <dns/types.h>

+ISC_LANG_BEGINDECLS
+
 isc_result_t
 dns_byaddr_createptrname(const isc_netaddr_t *address, dns_name_t *name);
 /*%<
@@ -52,3 +56,5 @@ dns_byaddr_createptrname(const isc_netaddr_t *address, dns_name_t *name);
 * \li	'address' is a valid address.
 * \li	'name' is a valid name with a dedicated buffer.
 */
+
+ISC_LANG_ENDDECLS
@@ -46,12 +46,15 @@

 #include <stdbool.h>

+#include <isc/lang.h>
 #include <isc/refcount.h>
 #include <isc/stats.h>
 #include <isc/stdtime.h>

 #include <dns/types.h>

+ISC_LANG_BEGINDECLS
+
 /***
 ***	Functions
 ***/
@@ -270,3 +273,5 @@ dns_cache_renderjson(dns_cache_t *cache, void *cstats0);
 * Render cache statistics and status in JSON
 */
 #endif /* HAVE_JSON_C */
+
+ISC_LANG_ENDDECLS
@@ -19,10 +19,13 @@
 ***	Imports
 ***/

+#include <isc/lang.h>
 #include <isc/magic.h>

 #include <dns/types.h>

+ISC_LANG_BEGINDECLS
+
 /***
 ***	Types
 ***/
@@ -97,3 +100,5 @@ dns_rdatacallbacks_init_stdio(dns_rdatacallbacks_t *callbacks);
 /*%<
 * Like dns_rdatacallbacks_init, but logs to stdio.
 */
+
+ISC_LANG_ENDDECLS
@@ -19,6 +19,7 @@
 #include <stdbool.h>

 #include <isc/ht.h>
+#include <isc/lang.h>
 #include <isc/refcount.h>
 #include <isc/rwlock.h>
 #include <isc/time.h>
@@ -30,6 +31,8 @@
 #include <dns/rdata.h>
 #include <dns/types.h>

+ISC_LANG_BEGINDECLS
+
 #define DNS_CATZ_ERROR_LEVEL  ISC_LOG_WARNING
 #define DNS_CATZ_INFO_LEVEL   ISC_LOG_INFO
 #define DNS_CATZ_DEBUG_LEVEL1 ISC_LOG_DEBUG(1)
@@ -443,3 +446,5 @@ ISC_REFCOUNT_TRACE_DECL(dns_catz_zones);
 ISC_REFCOUNT_DECL(dns_catz_zone);
 ISC_REFCOUNT_DECL(dns_catz_zones);
 #endif /* DNS_CATZ_TRACE */
+
+ISC_LANG_ENDDECLS
@@ -15,8 +15,12 @@

 /*! \file dns/cert.h */

+#include <isc/lang.h>
+
 #include <dns/types.h>

+ISC_LANG_BEGINDECLS
+
 isc_result_t
 dns_cert_fromtext(dns_cert_t *certp, isc_textregion_t *source);
 /*%<
@@ -52,3 +56,5 @@ dns_cert_totext(dns_cert_t cert, isc_buffer_t *target);
 *\li	#ISC_R_SUCCESS			on success
 *\li	#ISC_R_NOSPACE			target buffer is too small
 */
+
+ISC_LANG_ENDDECLS
@@ -48,6 +48,8 @@

 #include <dst/dst.h>

+ISC_LANG_BEGINDECLS
+
 /***
 *** Types
 ***/
@@ -290,3 +292,5 @@ dns_client_addtrustedkey(dns_client_t *client, dns_rdataclass_t rdclass,
 *
 *\li	Anything else				Failure.
 */
+
+ISC_LANG_ENDDECLS
@@ -44,6 +44,8 @@

 #include <dns/ecs.h>

+ISC_LANG_BEGINDECLS
+
 /*****
 ***** Types
 *****/
@@ -96,3 +98,5 @@ dns_clientinfo_setecs(dns_clientinfo_t *ci, dns_ecs_t *ecs);
 * Set the ECS client data associated with a clientinfo object 'ci'.
 * If 'ecs' is NULL, initialize ci->ecs to 0/0/0; otherwise copy it.
 */
+
+ISC_LANG_ENDDECLS
--- a/Show More
+++ b/Show More