make named-checkconf able to check dns64 module parameters

- restored the checkconf test cases from the dns64 system test - implemented plugin_check() in the dns64 module
support dns64 modules in multiple views
2019-08-30 15:27:56 -07:00 · 2019-08-30 15:27:56 -07:00 · 2019-08-30 15:27:50 -07:00 · 2019-08-30 15:25:56 -07:00 · 2019-08-30 15:25:56 -07:00 · 2019-08-30 15:25:53 -07:00
55 changed files with 3367 additions and 2026 deletions
@@ -23,6 +23,7 @@
 #include <isc/result.h>
 #include <isc/util.h>

+#include <dns/db.h>
 #include <dns/result.h>
 #include <dns/sdb.h>

@@ -31,6 +32,14 @@
 #include <named/server.h>
 #include <named/os.h>

+#define CHECK(op)						\
+	do {							\
+		result = (op);					\
+		if (result != ISC_R_SUCCESS) {			\
+			goto cleanup;				\
+		}						\
+	} while (0)
+
 typedef struct builtin builtin_t;

 static isc_result_t do_version_lookup(dns_sdblookup_t *lookup);
@@ -38,7 +47,6 @@ static isc_result_t do_hostname_lookup(dns_sdblookup_t *lookup);
 static isc_result_t do_authors_lookup(dns_sdblookup_t *lookup);
 static isc_result_t do_id_lookup(dns_sdblookup_t *lookup);
 static isc_result_t do_empty_lookup(dns_sdblookup_t *lookup);
-static isc_result_t do_dns64_lookup(dns_sdblookup_t *lookup);

 /*
 * We can't use function pointers as the db_data directly
@@ -48,232 +56,23 @@ static isc_result_t do_dns64_lookup(dns_sdblookup_t *lookup);

 struct builtin {
 	isc_result_t (*do_lookup)(dns_sdblookup_t *lookup);
+	isc_mem_t *mctx;
 	char *server;
 	char *contact;
 };

-static builtin_t version_builtin = { do_version_lookup,  NULL, NULL };
-static builtin_t hostname_builtin = { do_hostname_lookup, NULL, NULL };
-static builtin_t authors_builtin = { do_authors_lookup, NULL, NULL };
-static builtin_t id_builtin = { do_id_lookup, NULL, NULL };
-static builtin_t empty_builtin = { do_empty_lookup, NULL, NULL };
-static builtin_t dns64_builtin = { do_dns64_lookup, NULL, NULL };
+static builtin_t version_builtin = { do_version_lookup, NULL, NULL, NULL };
+static builtin_t hostname_builtin = { do_hostname_lookup, NULL, NULL, NULL };
+static builtin_t authors_builtin = { do_authors_lookup, NULL, NULL, NULL };
+static builtin_t id_builtin = { do_id_lookup, NULL, NULL, NULL };
+static builtin_t empty_builtin = { do_empty_lookup, NULL, NULL, NULL };

 static dns_sdbimplementation_t *builtin_impl;
-static dns_sdbimplementation_t *dns64_impl;
-
-/*
- * Pre computed HEX * 16 or 1 table.
- */
-static const unsigned char hex16[256] = {
-	 1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1, /*00*/
-	 1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,	/*10*/
-	 1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1, /*20*/
-	 0, 16, 32, 48, 64, 80, 96,112,128,144,  1,  1,  1,  1,  1,  1,	/*30*/
-	 1,160,176,192,208,224,240,  1,  1,  1,  1,  1,  1,  1,  1,  1, /*40*/
-	 1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1, /*50*/
-	 1,160,176,192,208,224,240,  1,  1,  1,  1,  1,  1,  1,  1,  1, /*60*/
-	 1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1, /*70*/
-	 1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1, /*80*/
-	 1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1, /*90*/
-	 1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1, /*A0*/
-	 1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1, /*B0*/
-	 1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1, /*C0*/
-	 1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1, /*D0*/
-	 1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1, /*E0*/
-	 1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1  /*F0*/
-};
-
-const unsigned char decimal[] = "0123456789";
-
-static size_t
-dns64_rdata(unsigned char *v, size_t start, unsigned char *rdata) {
-	size_t i, j = 0;
-
-	for (i = 0; i < 4U; i++) {
-		unsigned char c = v[start++];
-		if (start == 7U)
-			start++;
-		if (c > 99) {
-			rdata[j++] = 3;
-			rdata[j++] = decimal[c/100]; c = c % 100;
-			rdata[j++] = decimal[c/10]; c = c % 10;
-			rdata[j++] = decimal[c];
-		} else if (c > 9) {
-			rdata[j++] = 2;
-			rdata[j++] = decimal[c/10]; c = c % 10;
-			rdata[j++] = decimal[c];
-		} else {
-			rdata[j++] = 1;
-			rdata[j++] = decimal[c];
-		}
-	}
-	memmove(&rdata[j], "\07in-addr\04arpa", 14);
-	return (j + 14);
-}

 static isc_result_t
-dns64_cname(const dns_name_t *zone, const dns_name_t *name,
-	    dns_sdblookup_t *lookup)
-{
-	size_t zlen, nlen, j, len;
-	unsigned char v[16], n;
-	unsigned int i;
-	unsigned char rdata[sizeof("123.123.123.123.in-addr.arpa.")];
-	unsigned char *ndata;
-
-	/*
-	 * The combined length of the zone and name is 74.
-	 *
-	 * The minimum zone length is 10 ((3)ip6(4)arpa(0)).
-	 *
-	 * The length of name should always be even as we are expecting
-	 * a series of nibbles.
-	 */
-	zlen = zone->length;
-	nlen = name->length;
-	if ((zlen + nlen) > 74U || zlen < 10U || (nlen % 2) != 0U)
-		return (ISC_R_NOTFOUND);
-
-	/*
-	 * We assume the zone name is well formed.
-	 */
-
-	/*
-	 * XXXMPA We could check the dns64 suffix here if we need to.
-	 */
-	/*
-	 * Check that name is a series of nibbles.
-	 * Compute the byte values that correspond to the nibbles as we go.
-	 *
-	 * Shift the final result 4 bits, by setting 'i' to 1, if we if we
-	 * have a odd number of nibbles so that "must be zero" tests below
-	 * are byte aligned and we correctly return ISC_R_NOTFOUND or
-	 * ISC_R_SUCCESS.  We will not generate a CNAME in this case.
-	 */
-	ndata = name->ndata;
-	i = (nlen % 4) == 2U ? 1 : 0;
-	j = nlen;
-	memset(v, 0, sizeof(v));
-	while (j != 0U) {
-		INSIST((i/2) < sizeof(v));
-		if (ndata[0] != 1)
-			return (ISC_R_NOTFOUND);
-		n = hex16[ndata[1]&0xff];
-		if (n == 1)
-			return (ISC_R_NOTFOUND);
-		v[i/2] = n | (v[i/2]>>4);
-		j -= 2;
-		ndata += 2;
-		i++;
-	}
-
-	/*
-	 * If we get here then we know name only consisted of nibbles.
-	 * Now we need to determine if the name exists or not and whether
-	 * it corresponds to a empty node in the zone or there should be
-	 * a CNAME.
-	 */
-#define ZLEN(x) (10 + (x)/2)
-	switch (zlen) {
-	case ZLEN(32):	/* prefix len 32 */
-		/*
-		 * The nibbles that map to this byte must be zero for 'name'
-		 * to exist in the zone.
-		 */
-		if (nlen > 16U && v[(nlen-1)/4 - 4] != 0)
-			return (ISC_R_NOTFOUND);
-		/*
-		 * If the total length is not 74 then this is a empty node
-		 * so return success.
-		 */
-		if (nlen + zlen != 74U)
-			return (ISC_R_SUCCESS);
-		len = dns64_rdata(v, 8, rdata);
-		break;
-	case ZLEN(40):	/* prefix len 40 */
-		/*
-		 * The nibbles that map to this byte must be zero for 'name'
-		 * to exist in the zone.
-		 */
-		if (nlen > 12U && v[(nlen-1)/4 - 3] != 0)
-			return (ISC_R_NOTFOUND);
-		/*
-		 * If the total length is not 74 then this is a empty node
-		 * so return success.
-		 */
-		if (nlen + zlen != 74U)
-			return (ISC_R_SUCCESS);
-		len = dns64_rdata(v, 6, rdata);
-		break;
-	case ZLEN(48):	/* prefix len 48 */
-		/*
-		 * The nibbles that map to this byte must be zero for 'name'
-		 * to exist in the zone.
-		 */
-		if (nlen > 8U && v[(nlen-1)/4 - 2] != 0)
-			return (ISC_R_NOTFOUND);
-		/*
-		 * If the total length is not 74 then this is a empty node
-		 * so return success.
-		 */
-		if (nlen + zlen != 74U)
-			return (ISC_R_SUCCESS);
-		len = dns64_rdata(v, 5, rdata);
-		break;
-	case ZLEN(56):	/* prefix len 56 */
-		/*
-		 * The nibbles that map to this byte must be zero for 'name'
-		 * to exist in the zone.
-		 */
-		if (nlen > 4U && v[(nlen-1)/4 - 1] != 0)
-			return (ISC_R_NOTFOUND);
-		/*
-		 * If the total length is not 74 then this is a empty node
-		 * so return success.
-		 */
-		if (nlen + zlen != 74U)
-			return (ISC_R_SUCCESS);
-		len = dns64_rdata(v, 4, rdata);
-		break;
-	case ZLEN(64):	/* prefix len 64 */
-		/*
-		 * The nibbles that map to this byte must be zero for 'name'
-		 * to exist in the zone.
-		 */
-		if (v[(nlen-1)/4] != 0)
-			return (ISC_R_NOTFOUND);
-		/*
-		 * If the total length is not 74 then this is a empty node
-		 * so return success.
-		 */
-		if (nlen + zlen != 74U)
-			return (ISC_R_SUCCESS);
-		len = dns64_rdata(v, 3, rdata);
-		break;
-	case ZLEN(96):	/* prefix len 96 */
-		/*
-		 * If the total length is not 74 then this is a empty node
-		 * so return success.
-		 */
-		if (nlen + zlen != 74U)
-			return (ISC_R_SUCCESS);
-		len = dns64_rdata(v, 0, rdata);
-		break;
-	default:
-		/*
-		 * This should never be reached unless someone adds a
-		 * zone declaration with this internal type to named.conf.
-		 */
-		return (ISC_R_NOTFOUND);
-	}
-	return (dns_sdb_putrdata(lookup, dns_rdatatype_cname, 600,
-				 rdata, (unsigned int)len));
-}
-
-static isc_result_t
-builtin_lookup(const char *zone, const char *name, void *dbdata,
-	       dns_sdblookup_t *lookup, dns_clientinfomethods_t *methods,
+builtin_lookup(const char *zone, const char *name,
+	       void *dbdata, dns_sdblookup_t *lookup,
+	       dns_clientinfomethods_t *methods,
 	       dns_clientinfo_t *clientinfo)
 {
 	builtin_t *b = (builtin_t *) dbdata;
@@ -282,34 +81,20 @@ builtin_lookup(const char *zone, const char *name, void *dbdata,
 	UNUSED(methods);
 	UNUSED(clientinfo);

-	if (strcmp(name, "@") == 0)
+	if (strcmp(name, "@") == 0) {
 		return (b->do_lookup(lookup));
-	else
+	} else {
 		return (ISC_R_NOTFOUND);
-}
-
-static isc_result_t
-dns64_lookup(const dns_name_t *zone, const dns_name_t *name, void *dbdata,
-	     dns_sdblookup_t *lookup, dns_clientinfomethods_t *methods,
-	     dns_clientinfo_t *clientinfo)
-{
-	builtin_t *b = (builtin_t *) dbdata;
-
-	UNUSED(methods);
-	UNUSED(clientinfo);
-
-	if (name->labels == 0 && name->length == 0)
-		return (b->do_lookup(lookup));
-	else
-		return (dns64_cname(zone, name, lookup));
+	}
 }

 static isc_result_t
 put_txt(dns_sdblookup_t *lookup, const char *text) {
 	unsigned char buf[256];
 	unsigned int len = strlen(text);
-	if (len > 255)
+	if (len > 255) {
 		len = 255; /* Silently truncate */
+	}
 	buf[0] = len;
 	memmove(&buf[1], text, len);
 	return (dns_sdb_putrdata(lookup, dns_rdatatype_txt, 0, buf, len + 1));
@@ -318,10 +103,11 @@ put_txt(dns_sdblookup_t *lookup, const char *text) {
 static isc_result_t
 do_version_lookup(dns_sdblookup_t *lookup) {
 	if (named_g_server->version_set) {
-		if (named_g_server->version == NULL)
+		if (named_g_server->version == NULL) {
 			return (ISC_R_SUCCESS);
-		else
+		} else {
 			return (put_txt(lookup, named_g_server->version));
+		}
 	} else {
 		return (put_txt(lookup, named_g_version));
 	}
@@ -330,15 +116,17 @@ do_version_lookup(dns_sdblookup_t *lookup) {
 static isc_result_t
 do_hostname_lookup(dns_sdblookup_t *lookup) {
 	if (named_g_server->hostname_set) {
-		if (named_g_server->hostname == NULL)
+		if (named_g_server->hostname == NULL) {
 			return (ISC_R_SUCCESS);
-		else
+		} else {
 			return (put_txt(lookup, named_g_server->hostname));
+		}
 	} else {
 		char buf[256];
 		isc_result_t result = named_os_gethostname(buf, sizeof(buf));
-		if (result != ISC_R_SUCCESS)
+		if (result != ISC_R_SUCCESS) {
 			return (result);
+		}
 		return (put_txt(lookup, buf));
 	}
 }
@@ -374,13 +162,15 @@ do_authors_lookup(dns_sdblookup_t *lookup) {
 	/*
 	 * If a version string is specified, disable the authors.bind zone.
 	 */
-	if (named_g_server->version_set)
+	if (named_g_server->version_set) {
 		return (ISC_R_SUCCESS);
+	}

 	for (p = authors; *p != NULL; p++) {
 		result = put_txt(lookup, *p);
-		if (result != ISC_R_SUCCESS)
+		if (result != ISC_R_SUCCESS) {
 			return (result);
+		}
 	}
 	return (ISC_R_SUCCESS);
 }
@@ -392,24 +182,19 @@ do_id_lookup(dns_sdblookup_t *lookup) {
 		isc_result_t result;

 		result = named_g_server->sctx->gethostname(buf, sizeof(buf));
-		if (result != ISC_R_SUCCESS)
+		if (result != ISC_R_SUCCESS) {
 			return (result);
+		}
 		return (put_txt(lookup, buf));
-	} else if (named_g_server->sctx->server_id != NULL)
+	} else if (named_g_server->sctx->server_id != NULL) {
 		return (put_txt(lookup, named_g_server->sctx->server_id));
-	else
+	} else {
 		return (ISC_R_SUCCESS);
-}
-
-static isc_result_t
-do_dns64_lookup(dns_sdblookup_t *lookup) {
-	UNUSED(lookup);
-	return (ISC_R_SUCCESS);
+	}
 }

 static isc_result_t
 do_empty_lookup(dns_sdblookup_t *lookup) {
-
 	UNUSED(lookup);
 	return (ISC_R_SUCCESS);
 }
@@ -428,48 +213,54 @@ builtin_authority(const char *zone, void *dbdata, dns_sdblookup_t *lookup) {
 		server = ".";
 		contact = ".";
 	} else {
-		if (b->server != NULL)
+		if (b->server != NULL) {
 			server = b->server;
-		if (b->contact != NULL)
+		}
+		if (b->contact != NULL) {
 			contact = b->contact;
+		}
 	}

 	result = dns_sdb_putsoa(lookup, server, contact, 0);
-	if (result != ISC_R_SUCCESS)
+	if (result != ISC_R_SUCCESS) {
 		return (ISC_R_FAILURE);
+	}

 	result = dns_sdb_putrr(lookup, "ns", 0, server);
-	if (result != ISC_R_SUCCESS)
+	if (result != ISC_R_SUCCESS) {
 		return (ISC_R_FAILURE);
+	}

 	return (ISC_R_SUCCESS);
 }

 static isc_result_t
-builtin_create(const char *zone, int argc, char **argv,
+builtin_create(const char *zone, isc_mem_t *mctx, int argc, char **argv,
 	       void *driverdata, void **dbdata)
 {
 	REQUIRE(argc >= 1);

 	UNUSED(zone);
+	UNUSED(mctx);
 	UNUSED(driverdata);

-	if (strcmp(argv[0], "empty") == 0 || strcmp(argv[0], "dns64") == 0) {
-		if (argc != 3)
+	if (strcmp(argv[0], "empty") == 0) {
+		if (argc != 3) {
 			return (DNS_R_SYNTAX);
-	} else if (argc != 1)
+		}
+	} else if (argc != 1) {
 		return (DNS_R_SYNTAX);
+	}

-	if (strcmp(argv[0], "version") == 0)
+	if (strcmp(argv[0], "version") == 0) {
 		*dbdata = &version_builtin;
-	else if (strcmp(argv[0], "hostname") == 0)
+	} else if (strcmp(argv[0], "hostname") == 0) {
 		*dbdata = &hostname_builtin;
-	else if (strcmp(argv[0], "authors") == 0)
+	} else if (strcmp(argv[0], "authors") == 0) {
 		*dbdata = &authors_builtin;
-	else if (strcmp(argv[0], "id") == 0)
+	} else if (strcmp(argv[0], "id") == 0) {
 		*dbdata = &id_builtin;
-	else if (strcmp(argv[0], "empty") == 0 ||
-		 strcmp(argv[0], "dns64") == 0) {
+	} else if (strcmp(argv[0], "empty") == 0) {
 		builtin_t *empty;
 		char *server;
 		char *contact;
@@ -481,30 +272,26 @@ builtin_create(const char *zone, int argc, char **argv,
 		server = isc_mem_strdup(named_g_mctx, argv[1]);
 		contact = isc_mem_strdup(named_g_mctx, argv[2]);
 		if (empty == NULL || server == NULL || contact == NULL) {
-			if (strcmp(argv[0], "empty") == 0)
-				*dbdata = &empty_builtin;
-			else
-				*dbdata = &dns64_builtin;
-			if (server != NULL)
+			*dbdata = &empty_builtin;
+			if (server != NULL) {
 				isc_mem_free(named_g_mctx, server);
-			if (contact != NULL)
+			}
+			if (contact != NULL) {
 				isc_mem_free(named_g_mctx, contact);
-			if (empty != NULL)
+			}
+			if (empty != NULL) {
 				isc_mem_put(named_g_mctx, empty,
 					    sizeof (*empty));
+			}
 		} else {
-			if (strcmp(argv[0], "empty") == 0)
-				memmove(empty, &empty_builtin,
-					sizeof (empty_builtin));
-			else
-				memmove(empty, &dns64_builtin,
-					sizeof (empty_builtin));
+			memmove(empty, &empty_builtin, sizeof (empty_builtin));
 			empty->server = server;
 			empty->contact = contact;
 			*dbdata = empty;
 		}
-	} else
+	} else {
 		return (ISC_R_NOTIMPLEMENTED);
+	}
 	return (ISC_R_SUCCESS);
 }

@@ -520,8 +307,10 @@ builtin_destroy(const char *zone, void *driverdata, void **dbdata) {
 	 */
 	if (*dbdata == &version_builtin || *dbdata == &hostname_builtin ||
 	    *dbdata == &authors_builtin || *dbdata == &id_builtin ||
-	    *dbdata == &empty_builtin || *dbdata == &dns64_builtin)
+	    *dbdata == &empty_builtin)
+	{
 		return;
+	}

 	isc_mem_free(named_g_mctx, b->server);
 	isc_mem_free(named_g_mctx, b->contact);
@@ -531,21 +320,12 @@ builtin_destroy(const char *zone, void *driverdata, void **dbdata) {
 static dns_sdbmethods_t builtin_methods = {
 	builtin_lookup,
 	builtin_authority,
-	NULL,		/* allnodes */
+	NULL,           /* allnodes */
 	builtin_create,
 	builtin_destroy,
 	NULL
 };

-static dns_sdbmethods_t dns64_methods = {
-	NULL,
-	builtin_authority,
-	NULL,		/* allnodes */
-	builtin_create,
-	builtin_destroy,
-	dns64_lookup,
-};
-
 isc_result_t
 named_builtin_init(void) {
 	RUNTIME_CHECK(dns_sdb_register("_builtin", &builtin_methods, NULL,
@@ -553,17 +333,10 @@ named_builtin_init(void) {
 				       DNS_SDBFLAG_RELATIVERDATA,
 				       named_g_mctx, &builtin_impl)
 		      == ISC_R_SUCCESS);
-	RUNTIME_CHECK(dns_sdb_register("_dns64", &dns64_methods, NULL,
-				       DNS_SDBFLAG_RELATIVEOWNER |
-				       DNS_SDBFLAG_RELATIVERDATA |
-				       DNS_SDBFLAG_DNS64,
-				       named_g_mctx, &dns64_impl)
-		      == ISC_R_SUCCESS);
 	return (ISC_R_SUCCESS);
 }

 void
 named_builtin_deinit(void) {
 	dns_sdb_unregister(&builtin_impl);
-	dns_sdb_unregister(&dns64_impl);
 }
@@ -161,8 +161,6 @@ EXTERN dns_geoip_databases_t	*named_g_geoip		INIT(NULL);
 EXTERN const char *		named_g_fuzz_addr	INIT(NULL);
 EXTERN isc_fuzztype_t		named_g_fuzz_type	INIT(isc_fuzz_none);

-EXTERN dns_acl_t *		named_g_mapped		INIT(NULL);
-
 #undef EXTERN
 #undef INIT

@@ -1267,9 +1267,6 @@ static void
 cleanup(void) {
 	destroy_managers();

-	if (named_g_mapped != NULL)
-		dns_acl_detach(&named_g_mapped);
-
 	named_server_destroy(&named_g_server);

 	named_builtin_deinit();
@@ -62,7 +62,6 @@
 #include <dns/dispatch.h>
 #include <dns/dlz.h>
 #include <dns/dnsrps.h>
-#include <dns/dns64.h>
 #include <dns/dyndb.h>
 #include <dns/events.h>
 #include <dns/forward.h>
@@ -86,6 +85,7 @@
 #include <dns/resolver.h>
 #include <dns/rootns.h>
 #include <dns/rriterator.h>
+#include <dns/sdb.h>
 #include <dns/secalg.h>
 #include <dns/soa.h>
 #include <dns/stats.h>
@@ -1848,83 +1848,6 @@ dlzconfigure_callback(dns_view_t *view, dns_dlzdb_t *dlzdb, dns_zone_t *zone) {
 						   zclass, origin));
 }

-static isc_result_t
-dns64_reverse(dns_view_t *view, isc_mem_t *mctx, isc_netaddr_t *na,
-	      unsigned int prefixlen, const char *server,
-	      const char *contact)
-{
-	char reverse[48+sizeof("ip6.arpa.")] = { 0 };
-	char buf[sizeof("x.x.")];
-	const char *dns64_dbtype[4] = { "_dns64", "dns64", ".", "." };
-	const char *sep = ": view ";
-	const char *viewname = view->name;
-	const unsigned char *s6;
-	dns_fixedname_t fixed;
-	dns_name_t *name;
-	dns_zone_t *zone = NULL;
-	int dns64_dbtypec = 4;
-	isc_buffer_t b;
-	isc_result_t result;
-
-	REQUIRE(prefixlen == 32 || prefixlen == 40 || prefixlen == 48 ||
-		prefixlen == 56 || prefixlen == 64 || prefixlen == 96);
-
-	if (!strcmp(viewname, "_default")) {
-		sep = "";
-		viewname = "";
-	}
-
-	/*
-	 * Construct the reverse name of the zone.
-	 */
-	s6 = na->type.in6.s6_addr;
-	while (prefixlen > 0) {
-		prefixlen -= 8;
-		snprintf(buf, sizeof(buf), "%x.%x.", s6[prefixlen/8] & 0xf,
-			 (s6[prefixlen/8] >> 4) & 0xf);
-		strlcat(reverse, buf, sizeof(reverse));
-	}
-	strlcat(reverse, "ip6.arpa.", sizeof(reverse));
-
-	/*
-	 * Create the actual zone.
-	 */
-	if (server != NULL)
-		dns64_dbtype[2] = server;
-	if (contact != NULL)
-		dns64_dbtype[3] = contact;
-	name = dns_fixedname_initname(&fixed);
-	isc_buffer_constinit(&b, reverse, strlen(reverse));
-	isc_buffer_add(&b, strlen(reverse));
-	CHECK(dns_name_fromtext(name, &b, dns_rootname, 0, NULL));
-	CHECK(dns_zone_create(&zone, mctx));
-	CHECK(dns_zone_setorigin(zone, name));
-	dns_zone_setview(zone, view);
-	CHECK(dns_zonemgr_managezone(named_g_server->zonemgr, zone));
-	dns_zone_setclass(zone, view->rdclass);
-	dns_zone_settype(zone, dns_zone_master);
-	dns_zone_setstats(zone, named_g_server->zonestats);
-	dns_zone_setdbtype(zone, dns64_dbtypec, dns64_dbtype);
-	if (view->queryacl != NULL)
-		dns_zone_setqueryacl(zone, view->queryacl);
-	if (view->queryonacl != NULL)
-		dns_zone_setqueryonacl(zone, view->queryonacl);
-	dns_zone_setdialup(zone, dns_dialuptype_no);
-	dns_zone_setnotifytype(zone, dns_notifytype_no);
-	dns_zone_setoption(zone, DNS_ZONEOPT_NOCHECKNS, true);
-	CHECK(setquerystats(zone, mctx, dns_zonestat_none));	/* XXXMPA */
-	CHECK(dns_view_addzone(view, zone));
-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-		      NAMED_LOGMODULE_SERVER, ISC_LOG_INFO,
-		      "dns64 reverse zone%s%s: %s", sep,
-		      viewname, reverse);
-
-cleanup:
-	if (zone != NULL)
-		dns_zone_detach(&zone);
-	return (result);
-}
-
 #ifdef USE_DNSRPS
 typedef struct conf_dnsrps_ctx conf_dnsrps_ctx_t;
 struct conf_dnsrps_ctx {
@@ -3695,26 +3618,6 @@ configure_dnstap(const cfg_obj_t **maps, dns_view_t *view) {
 }
 #endif /* HAVE_DNSTAP */

-static isc_result_t
-create_mapped_acl(void) {
-	isc_result_t result;
-	dns_acl_t *acl = NULL;
-	struct in6_addr in6 = IN6ADDR_V4MAPPED_INIT;
-	isc_netaddr_t addr;
-
-	isc_netaddr_fromin6(&addr, &in6);
-
-	result = dns_acl_create(named_g_mctx, 1, &acl);
-	if (result != ISC_R_SUCCESS)
-		return (result);
-
-	result = dns_iptable_addprefix(acl->iptable, &addr, 96, true);
-	if (result == ISC_R_SUCCESS)
-		dns_acl_attach(acl, &named_g_mapped);
-	dns_acl_detach(&acl);
-	return (result);
-}
-
 #ifdef HAVE_DLOPEN
 /*%
 * A callback for the cfg_pluginlist_foreach() call in configure_view() below.
@@ -3818,7 +3721,6 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
 	bool auto_root = false;
 	named_cache_t *nsc;
 	bool zero_no_soattl;
-	dns_acl_t *clients = NULL, *mapped = NULL, *excluded = NULL;
 	unsigned int query_timeout, ndisp;
 	bool old_rpz_ok = false;
 	isc_dscp_t dscp4 = -1, dscp6 = -1;
@@ -3855,6 +3757,11 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
 		cfgmaps[k++] = config;
 	cfgmaps[k] = NULL;

+	/*
+	 * Set the view's zone manager.
+	 */
+	dns_view_setzonemgr(view, named_g_server->zonemgr);
+
 	/*
 	 * Set the view's port number for outgoing queries.
 	 */
@@ -4077,115 +3984,6 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
 	INSIST(result == ISC_R_SUCCESS);
 	zero_no_soattl = cfg_obj_asboolean(obj);

-	obj = NULL;
-	result = named_config_get(maps, "dns64", &obj);
-	if (result == ISC_R_SUCCESS && strcmp(view->name, "_bind") &&
-	    strcmp(view->name, "_meta")) {
-		isc_netaddr_t na, suffix, *sp;
-		unsigned int prefixlen;
-		const char *server, *contact;
-		const cfg_obj_t *myobj;
-
-		myobj = NULL;
-		result = named_config_get(maps, "dns64-server", &myobj);
-		if (result == ISC_R_SUCCESS)
-			server = cfg_obj_asstring(myobj);
-		else
-			server = NULL;
-
-		myobj = NULL;
-		result = named_config_get(maps, "dns64-contact", &myobj);
-		if (result == ISC_R_SUCCESS)
-			contact = cfg_obj_asstring(myobj);
-		else
-			contact = NULL;
-
-		for (element = cfg_list_first(obj);
-		     element != NULL;
-		     element = cfg_list_next(element))
-		{
-			const cfg_obj_t *map = cfg_listelt_value(element);
-			dns_dns64_t *dns64 = NULL;
-			unsigned int dns64options = 0;
-
-			cfg_obj_asnetprefix(cfg_map_getname(map), &na,
-					    &prefixlen);
-
-			obj = NULL;
-			(void)cfg_map_get(map, "suffix", &obj);
-			if (obj != NULL) {
-				sp = &suffix;
-				isc_netaddr_fromsockaddr(sp,
-						      cfg_obj_assockaddr(obj));
-			} else
-				sp = NULL;
-
-			clients = mapped = excluded = NULL;
-			obj = NULL;
-			(void)cfg_map_get(map, "clients", &obj);
-			if (obj != NULL) {
-				result = cfg_acl_fromconfig(obj, config,
-							    named_g_lctx, actx,
-							    mctx, 0, &clients);
-				if (result != ISC_R_SUCCESS)
-					goto cleanup;
-			}
-			obj = NULL;
-			(void)cfg_map_get(map, "mapped", &obj);
-			if (obj != NULL) {
-				result = cfg_acl_fromconfig(obj, config,
-							    named_g_lctx, actx,
-							    mctx, 0, &mapped);
-				if (result != ISC_R_SUCCESS)
-					goto cleanup;
-			}
-			obj = NULL;
-			(void)cfg_map_get(map, "exclude", &obj);
-			if (obj != NULL) {
-				result = cfg_acl_fromconfig(obj, config,
-							    named_g_lctx, actx,
-							    mctx, 0, &excluded);
-				if (result != ISC_R_SUCCESS)
-					goto cleanup;
-			} else {
-				if (named_g_mapped == NULL) {
-					result = create_mapped_acl();
-					if (result != ISC_R_SUCCESS)
-						goto cleanup;
-				}
-				dns_acl_attach(named_g_mapped, &excluded);
-			}
-
-			obj = NULL;
-			(void)cfg_map_get(map, "recursive-only", &obj);
-			if (obj != NULL && cfg_obj_asboolean(obj))
-				dns64options |= DNS_DNS64_RECURSIVE_ONLY;
-
-			obj = NULL;
-			(void)cfg_map_get(map, "break-dnssec", &obj);
-			if (obj != NULL && cfg_obj_asboolean(obj))
-				dns64options |= DNS_DNS64_BREAK_DNSSEC;
-
-			result = dns_dns64_create(mctx, &na, prefixlen, sp,
-						  clients, mapped, excluded,
-						  dns64options, &dns64);
-			if (result != ISC_R_SUCCESS)
-				goto cleanup;
-			dns_dns64_append(&view->dns64, dns64);
-			view->dns64cnt++;
-			result = dns64_reverse(view, mctx, &na, prefixlen,
-					       server, contact);
-			if (result != ISC_R_SUCCESS)
-				goto cleanup;
-			if (clients != NULL)
-				dns_acl_detach(&clients);
-			if (mapped != NULL)
-				dns_acl_detach(&mapped);
-			if (excluded != NULL)
-				dns_acl_detach(&excluded);
-		}
-	}
-
 	obj = NULL;
 	result = named_config_get(maps, "dnssec-accept-expired", &obj);
 	INSIST(result == ISC_R_SUCCESS);
@@ -4400,9 +4198,9 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
 	 * XXXRTH  Hardwired number of tasks.
 	 */
 	CHECK(get_view_querysource_dispatch(maps, AF_INET, &dispatch4, &dscp4,
-					    (ISC_LIST_PREV(view, link) == NULL)));
+				    (ISC_LIST_PREV(view, link) == NULL)));
 	CHECK(get_view_querysource_dispatch(maps, AF_INET6, &dispatch6, &dscp6,
-					    (ISC_LIST_PREV(view, link) == NULL)));
+				    (ISC_LIST_PREV(view, link) == NULL)));
 	if (dispatch4 == NULL && dispatch6 == NULL) {
 		UNEXPECTED_ERROR(__FILE__, __LINE__,
 				 "unable to obtain neither an IPv4 nor"
@@ -5523,15 +5321,6 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
 	if (ntatable != NULL) {
 		dns_ntatable_detach(&ntatable);
 	}
-	if (clients != NULL) {
-		dns_acl_detach(&clients);
-	}
-	if (mapped != NULL) {
-		dns_acl_detach(&mapped);
-	}
-	if (excluded != NULL) {
-		dns_acl_detach(&excluded);
-	}
 	if (ring != NULL) {
 		dns_tsigkeyring_detach(&ring);
 	}
@@ -24,24 +24,32 @@ NSLIBS =	../../lib/ns/libns.@A@

 LIBS =

-SO_TARGETS =	lib/filter-aaaa.@SO@
-SO_INSTALL =	filter-aaaa.@SO@
+SO_TARGETS =	lib/dns64.@SO@ lib/filter-aaaa.@SO@
+SO_INSTALL =	dns64.@SO@ filter-aaaa.@SO@
 TARGETS =	@SO_TARGETS@

-SO_OBJS =	filter-aaaa.@O@
-SO_SRCS =	filter-aaaa.c
+SO_OBJS =	dns64.@O@ filter-aaaa.@O@
+SO_SRCS =	dns64.c filter-aaaa.c

 CFLAGS =	@CFLAGS@ @SO_CFLAGS@
 SO_LDFLAGS =	@LDFLAGS@ @SO_LDFLAGS@

-MANPAGES =	filter-aaaa.8
+MANPAGES =	dns64.8 filter-aaaa.8

-HTMLPAGES =	filter-aaaa.html
+HTMLPAGES =	dns64.html filter-aaaa.html

 MANOBJS =	${MANPAGES} ${HTMLPAGES}

@BIND9_MAKE_RULES@

+lib/dns64.@SO@: dns64.@SO@
+	$(SHELL) ${top_srcdir}/mkinstalldirs `pwd`/lib
+	${LIBTOOL_MODE_INSTALL} ${INSTALL} dns64.@SO@ `pwd`/lib
+
+dns64.@SO@: dns64.@O@
+	${LIBTOOL_MODE_LINK} @SO_LD@ ${SO_LDFLAGS} -o $@ \
+		dns64.@O@ ${LIBS}
+
 lib/filter-aaaa.@SO@: filter-aaaa.@SO@
 	$(SHELL) ${top_srcdir}/mkinstalldirs `pwd`/lib
 	${LIBTOOL_MODE_INSTALL} ${INSTALL} filter-aaaa.@SO@ `pwd`/lib
@@ -56,7 +64,7 @@ docclean manclean maintainer-clean::
 	rm -f ${MANOBJS}

 clean distclean::
-	rm -f filter-aaaa.so
+	rm -f dns64.@SO@ filter-aaaa.@SO@
 	rm -f ${TARGETS} ${OBJS}

 installdirs:
@@ -73,7 +81,10 @@ install:: @SO_TARGETS@ installdirs
 		fi \
 	done
 	${INSTALL_DATA} ${srcdir}/filter-aaaa.8 ${DESTDIR}${mandir}/man8
+	${INSTALL_DATA} ${srcdir}/dns64.8 ${DESTDIR}${mandir}/man8

 uninstall::
+	${LIBTOOL_MODE_UNINSTALL} rm -f ${DESTDIR}${plugindir}/dns64.@SO@
 	${LIBTOOL_MODE_UNINSTALL} rm -f ${DESTDIR}${plugindir}/filter-aaaa.@SO@
+	rm -f ${DESTDIR}${mandir}/man8/dns64.8
 	rm -f ${DESTDIR}${mandir}/man8/filter-aaaa.8
@@ -0,0 +1,144 @@
+.\" Copyright (C) 2018 Internet Systems Consortium, Inc. ("ISC")
+.\" 
+.\" This Source Code Form is subject to the terms of the Mozilla Public
+.\" License, v. 2.0. If a copy of the MPL was not distributed with this
+.\" file, You can obtain one at http://mozilla.org/MPL/2.0/.
+.\"
+.hy 0
+.ad l
+'\" t
+.\"     Title: dns64.so
+.\"    Author: 
+.\" Generator: DocBook XSL Stylesheets v1.79.1 <http://docbook.sf.net/>
+.\"      Date: 2018-11-30
+.\"    Manual: BIND9
+.\"    Source: ISC
+.\"  Language: English
+.\"
+.TH "DNS64\&.SO" "8" "2018\-11\-30" "ISC" "BIND9"
+.\" -----------------------------------------------------------------
+.\" * Define some portability stuff
+.\" -----------------------------------------------------------------
+.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+.\" http://bugs.debian.org/507673
+.\" http://lists.gnu.org/archive/html/groff/2009-02/msg00013.html
+.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+.ie \n(.g .ds Aq \(aq
+.el       .ds Aq '
+.\" -----------------------------------------------------------------
+.\" * set default formatting
+.\" -----------------------------------------------------------------
+.\" disable hyphenation
+.nh
+.\" disable justification (adjust text to left margin only)
+.ad l
+.\" -----------------------------------------------------------------
+.\" * MAIN CONTENT STARTS HERE *
+.\" -----------------------------------------------------------------
+.SH "NAME"
+dns64.so \- perform DNS64 synthesis
+.SH "SYNOPSIS"
+.HP 24
+\fBplugin query "dns64\&.so"\fR [\fI{\ parameters\ }\fR];
+.SH "DESCRIPTION"
+.PP
+\fBdns64\&.so\fR
+is a query plugin module for
+\fBnamed\fR, enabling
+\fBnamed\fR
+to perform DNS64 address synthesis\&.
+.PP
+Until BIND 9\&.12, this feature was implemented natively in
+\fBnamed\fR
+and enabled with the
+\fBdns64\fR
+option\&. This option is now deprecated in
+named\&.conf, but can be passed as parameters to the
+\fBdns64\&.so\fR
+plugin, for example:
+.sp
+.if n \{\
+.RS 4
+.\}
+.nf
+	acl rfc1918 { 10/8; 192\&.168/16; 172\&.16/12; };
+	plugin query "/usr/local/lib/dns64\&.so" {
+		dns64 64:FF9B::/96 {
+			clients { any; };
+			mapped { !rfc1918; any; };
+			exclude { 64:FF9B::/96; ::ffff:0000:0000/96; };
+			suffix ::;
+		};
+		dns64\-server "dns64\&.example\&.net\&.";
+		dns64\-contact "hostmaster\&.example\&.net\&.";
+	};
+.fi
+.if n \{\
+.RE
+.\}
+.PP
+This plugin enables
+\fBnamed\fR
+to return mapped IPv4 addresses to AAAA queries when there are no AAAA records\&. It is intended to be used in conjunction with NAT64\&.
+.PP
+Each
+\fBdns64\fR
+option defined in the plugin parameters defines one DNS64 prefix\&. Multiple DNS64 prefixes can be defined\&.
+.PP
+Compatible IPv6 prefixes have lengths of 32, 40, 48, 56, 64 and 96 as per RFC 6052\&.
+.PP
+Additionally a reverse IP6\&.ARPA zone will be created for the prefix to provide a mapping from the IP6\&.ARPA names to the corresponding IN\-ADDR\&.ARPA names using synthesized CNAMEs\&.
+\fBdns64\-server\fR
+and
+\fBdns64\-contact\fR
+can be used to specify the name of the server and contact for the zones\&. These are not settable on a per\-prefix basis\&.
+.PP
+Each
+\fBdns64\fR
+supports an optional
+\fBclients\fR
+ACL that determines which clients are affected by this directive\&. If not defined, it defaults to
+\fBany;\fR\&.
+.PP
+Each
+\fBdns64\fR
+supports an optional
+\fBmapped\fR
+ACL that selects which IPv4 addresses are to be mapped in the corresponding A RRset\&. If not defined it defaults to
+\fBany;\fR\&.
+.PP
+Normally, DNS64 won\*(Aqt apply to a domain name that owns one or more AAAA records; these records will simply be returned\&. The optional
+\fBexclude\fR
+ACL allows specification of a list of IPv6 addresses that will be ignored if they appear in a domain name\*(Aqs AAAA records, and DNS64 will be applied to any A records the domain name owns\&. If not defined,
+\fBexclude\fR
+defaults to ::ffff:0\&.0\&.0\&.0/96\&.
+.PP
+A optional
+\fBsuffix\fR
+can also be defined to set the bits trailing the mapped IPv4 address bits\&. By default these bits are set to
+\fB::\fR\&. The bits matching the prefix and mapped IPv4 address must be zero\&.
+.PP
+If
+\fBrecursive\-only\fR
+is set to
+\fByes\fR
+the DNS64 synthesis will only happen for recursive queries\&. The default is
+\fBno\fR\&.
+.PP
+If
+\fBbreak\-dnssec\fR
+is set to
+\fByes\fR
+the DNS64 synthesis will happen even if the result, if validated, would cause a DNSSEC validation failure\&. If this option is set to
+\fBno\fR
+(the default), the DO is set on the incoming query, and there are RRSIGs on the applicable records, then synthesis will not happen\&.
+.SH "SEE ALSO"
+.PP
+BIND 9 Administrator Reference Manual\&.
+.SH "AUTHOR"
+.PP
+\fBInternet Systems Consortium, Inc\&.\fR
+.SH "COPYRIGHT"
+.br
+Copyright \(co 2018 Internet Systems Consortium, Inc. ("ISC")
+.br
@@ -0,0 +1,154 @@
+<!--
+ - Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ -
+ - This Source Code Form is subject to the terms of the Mozilla Public
+ - License, v. 2.0. If a copy of the MPL was not distributed with this
+ - file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ -
+ - See the COPYRIGHT file distributed with this work for additional
+ - information regarding copyright ownership.
+-->
+
+<!-- Converted by db4-upgrade version 1.0 -->
+<refentry xmlns:db="http://docbook.org/ns/docbook" version="5.0" xml:id="man.dns64">
+  <info>
+    <date>2018-11-30</date>
+  </info>
+  <refentryinfo>
+    <corpname>ISC</corpname>
+    <corpauthor>Internet Systems Consortium, Inc.</corpauthor>
+  </refentryinfo>
+  <refmeta>
+    <refentrytitle><application>dns64.so</application></refentrytitle>
+    <manvolnum>8</manvolnum>
+    <refmiscinfo>BIND9</refmiscinfo>
+  </refmeta>
+
+  <refnamediv>
+    <refname><application>dns64.so</application></refname>
+    <refpurpose>perform DNS64 synthesis</refpurpose>
+  </refnamediv>
+
+  <docinfo>
+    <copyright>
+      <year>2019</year>
+      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
+    </copyright>
+  </docinfo>
+
+  <refsynopsisdiv>
+    <cmdsynopsis sepchar=" ">
+      <command>plugin query "dns64.so"</command>
+      <arg choice="opt" rep="norepeat"><replaceable class="parameter">{ parameters }</replaceable></arg>;
+    </cmdsynopsis>
+  </refsynopsisdiv>
+
+  <refsection><info><title>DESCRIPTION</title></info>
+    <para>
+      <command>dns64.so</command> is a query plugin module for
+      <command>named</command>, enabling <command>named</command>
+      to perform DNS64 address synthesis.
+    </para>
+    <para>
+      Until BIND 9.12, this feature was implemented natively in
+      <command>named</command> and enabled with the
+      <command>dns64</command> option.
+      This option is now deprecated in <filename>named.conf</filename>,
+      but can be passed as parameters to the
+      <command>dns64.so</command> plugin, for example:
+    </para>
+    <programlisting>
+	acl rfc1918 { 10/8; 192.168/16; 172.16/12; };
+
+	plugin query "/usr/local/lib/dns64.so" {
+		dns64 64:FF9B::/96 {
+			clients { any; };
+			mapped { !rfc1918; any; };
+			exclude { 64:FF9B::/96; ::ffff:0000:0000/96; };
+			suffix ::;
+		};
+
+		dns64-server "dns64.example.net.";
+		dns64-contact "hostmaster.example.net.";
+	};
+</programlisting>
+    <para>
+      This plugin enables <command>named</command> to
+      return mapped IPv4 addresses to AAAA queries when
+      there are no AAAA records.  It is intended to be
+      used in conjunction with NAT64.
+    </para>
+    <para>
+      Each <command>dns64</command> option defined in the plugin
+      parameters defines one DNS64 prefix. Multiple DNS64 prefixes
+      can be defined.
+    </para>
+    <para>
+      Compatible IPv6 prefixes have lengths of 32, 40, 48, 56,
+      64 and 96 as per RFC 6052.
+    </para>
+    <para>
+      Additionally a reverse IP6.ARPA zone will be created for
+      the prefix to provide a mapping from the IP6.ARPA names
+      to the corresponding IN-ADDR.ARPA names using synthesized
+      CNAMEs.  <command>dns64-server</command> and
+      <command>dns64-contact</command> can be used to specify
+      the name of the server and contact for the zones.
+      These are not settable on a per-prefix basis.
+    </para>
+    <para>
+      Each <command>dns64</command> supports an optional
+      <command>clients</command> ACL that determines which
+      clients are affected by this directive.  If not defined,
+      it defaults to <userinput>any;</userinput>.
+    </para>
+    <para>
+      Each <command>dns64</command> supports an optional
+      <command>mapped</command> ACL that selects which
+      IPv4 addresses are to be mapped in the corresponding
+      A RRset.  If not defined it defaults to
+      <userinput>any;</userinput>.
+    </para>
+    <para>
+      Normally, DNS64 won't apply to a domain name that
+      owns one or more AAAA records; these records will
+      simply be returned.  The optional
+      <command>exclude</command> ACL allows specification
+      of a list of IPv6 addresses that will be ignored
+      if they appear in a domain name's AAAA records, and
+      DNS64 will be applied to any A records the domain
+      name owns.  If not defined, <command>exclude</command>
+      defaults to ::ffff:0.0.0.0/96.
+    </para>
+    <para>
+      A optional <command>suffix</command> can also
+      be defined to set the bits trailing the mapped
+      IPv4 address bits.  By default these bits are
+      set to <userinput>::</userinput>.  The bits
+      matching the prefix and mapped IPv4 address
+      must be zero.
+    </para>
+    <para>
+      If <command>recursive-only</command> is set to
+      <command>yes</command> the DNS64 synthesis will
+      only happen for recursive queries.  The default
+      is <command>no</command>.
+    </para>
+    <para>
+      If <command>break-dnssec</command> is set to
+      <command>yes</command> the DNS64 synthesis will
+      happen even if the result, if validated, would
+      cause a DNSSEC validation failure.  If this option
+      is set to <command>no</command> (the default), the DO
+      is set on the incoming query, and there are RRSIGs on
+      the applicable records, then synthesis will not happen.
+    </para>
+  </refsection>
+
+  <refsection><info><title>SEE ALSO</title></info>
+    <para>
+      <citetitle>BIND 9 Administrator Reference Manual</citetitle>.
+    </para>
+  </refsection>
+
+</refentry>
@@ -0,0 +1,135 @@
+<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
+<!--
+ - Copyright (C) 2018 Internet Systems Consortium, Inc. ("ISC")
+ - 
+ - This Source Code Form is subject to the terms of the Mozilla Public
+ - License, v. 2.0. If a copy of the MPL was not distributed with this
+ - file, You can obtain one at http://mozilla.org/MPL/2.0/.
+-->
+<html lang="en">
+<head>
+<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
+<title>dns64.so</title>
+<meta name="generator" content="DocBook XSL Stylesheets V1.79.1">
+</head>
+<body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="refentry">
+<a name="man.dns64"></a><div class="titlepage"></div>
+<div class="refnamediv">
+<h2>Name</h2>
+<p><span class="application">dns64.so</span> &#8212; perform DNS64 synthesis</p>
+</div>
+<div class="refsynopsisdiv">
+<h2>Synopsis</h2>
+<div class="cmdsynopsis"><p><code class="command">plugin query "dns64.so"</code>  [<em class="replaceable"><code>{ parameters }</code></em>];
+    </p></div>
+</div>
+<div class="refsection">
+<a name="id-1.7"></a><h2>DESCRIPTION</h2>
+<p>
+      <span class="command"><strong>dns64.so</strong></span> is a query plugin module for
+      <span class="command"><strong>named</strong></span>, enabling <span class="command"><strong>named</strong></span>
+      to perform DNS64 address synthesis.
+    </p>
+<p>
+      Until BIND 9.12, this feature was implemented natively in
+      <span class="command"><strong>named</strong></span> and enabled with the
+      <span class="command"><strong>dns64</strong></span> option.
+      This option is now deprecated in <code class="filename">named.conf</code>,
+      but can be passed as parameters to the
+      <span class="command"><strong>dns64.so</strong></span> plugin, for example:
+    </p>
+<pre class="programlisting">
+	acl rfc1918 { 10/8; 192.168/16; 172.16/12; };
+
+	plugin query "/usr/local/lib/dns64.so" {
+		dns64 64:FF9B::/96 {
+			clients { any; };
+			mapped { !rfc1918; any; };
+			exclude { 64:FF9B::/96; ::ffff:0000:0000/96; };
+			suffix ::;
+		};
+
+		dns64-server "dns64.example.net.";
+		dns64-contact "hostmaster.example.net.";
+	};
+</pre>
+<p>
+      This plugin enables <span class="command"><strong>named</strong></span> to
+      return mapped IPv4 addresses to AAAA queries when
+      there are no AAAA records.  It is intended to be
+      used in conjunction with NAT64.
+    </p>
+<p>
+      Each <span class="command"><strong>dns64</strong></span> option defined in the plugin
+      parameters defines one DNS64 prefix. Multiple DNS64 prefixes
+      can be defined.
+    </p>
+<p>
+      Compatible IPv6 prefixes have lengths of 32, 40, 48, 56,
+      64 and 96 as per RFC 6052.
+    </p>
+<p>
+      Additionally a reverse IP6.ARPA zone will be created for
+      the prefix to provide a mapping from the IP6.ARPA names
+      to the corresponding IN-ADDR.ARPA names using synthesized
+      CNAMEs.  <span class="command"><strong>dns64-server</strong></span> and
+      <span class="command"><strong>dns64-contact</strong></span> can be used to specify
+      the name of the server and contact for the zones.
+      These are not settable on a per-prefix basis.
+    </p>
+<p>
+      Each <span class="command"><strong>dns64</strong></span> supports an optional
+      <span class="command"><strong>clients</strong></span> ACL that determines which
+      clients are affected by this directive.  If not defined,
+      it defaults to <strong class="userinput"><code>any;</code></strong>.
+    </p>
+<p>
+      Each <span class="command"><strong>dns64</strong></span> supports an optional
+      <span class="command"><strong>mapped</strong></span> ACL that selects which
+      IPv4 addresses are to be mapped in the corresponding
+      A RRset.  If not defined it defaults to
+      <strong class="userinput"><code>any;</code></strong>.
+    </p>
+<p>
+      Normally, DNS64 won't apply to a domain name that
+      owns one or more AAAA records; these records will
+      simply be returned.  The optional
+      <span class="command"><strong>exclude</strong></span> ACL allows specification
+      of a list of IPv6 addresses that will be ignored
+      if they appear in a domain name's AAAA records, and
+      DNS64 will be applied to any A records the domain
+      name owns.  If not defined, <span class="command"><strong>exclude</strong></span>
+      defaults to ::ffff:0.0.0.0/96.
+    </p>
+<p>
+      A optional <span class="command"><strong>suffix</strong></span> can also
+      be defined to set the bits trailing the mapped
+      IPv4 address bits.  By default these bits are
+      set to <strong class="userinput"><code>::</code></strong>.  The bits
+      matching the prefix and mapped IPv4 address
+      must be zero.
+    </p>
+<p>
+      If <span class="command"><strong>recursive-only</strong></span> is set to
+      <span class="command"><strong>yes</strong></span> the DNS64 synthesis will
+      only happen for recursive queries.  The default
+      is <span class="command"><strong>no</strong></span>.
+    </p>
+<p>
+      If <span class="command"><strong>break-dnssec</strong></span> is set to
+      <span class="command"><strong>yes</strong></span> the DNS64 synthesis will
+      happen even if the result, if validated, would
+      cause a DNSSEC validation failure.  If this option
+      is set to <span class="command"><strong>no</strong></span> (the default), the DO
+      is set on the incoming query, and there are RRSIGs on
+      the applicable records, then synthesis will not happen.
+    </p>
+</div>
+<div class="refsection">
+<a name="id-1.8"></a><h2>SEE ALSO</h2>
+<p>
+      <em class="citetitle">BIND 9 Administrator Reference Manual</em>.
+    </p>
+</div>
+</div></body>
+</html>
@@ -76,7 +76,6 @@ typedef struct filter_data {
 } filter_data_t;

 typedef struct filter_instance {
-	ns_plugin_t *module;
 	isc_mem_t *mctx;

 	/*
@@ -168,7 +167,7 @@ install_hooks(ns_hooktable_t *hooktable, isc_mem_t *mctx,
 		.action_data = inst,
 	};

-	ns_hook_add(hooktable, mctx, -
+	ns_hook_add(hooktable, mctx,
 		    NS_QUERY_QCTX_INITIALIZED, &filter_init);
 	ns_hook_add(hooktable, mctx,
 		    NS_QUERY_RESPOND_BEGIN, &filter_respbegin);
@@ -353,7 +352,7 @@ isc_result_t
 plugin_register(const char *parameters,
 		const void *cfg, const char *cfg_file, unsigned long cfg_line,
 		isc_mem_t *mctx, isc_log_t *lctx, void *actx,
-		ns_hooktable_t *hooktable, void **instp)
+		dns_view_t *view, void **instp)
 {
 	filter_instance_t *inst = NULL;
 	isc_result_t result;
@@ -397,7 +396,7 @@ plugin_register(const char *parameters,
 	/*
 	 * Set hook points in the view's hooktable.
 	 */
-	install_hooks(hooktable, mctx, inst);
+	install_hooks(view->hooktable, mctx, inst);

 	*instp = inst;

@@ -838,7 +837,6 @@ filter_respond_begin(void *arg, void *cbdata, isc_result_t *resp) {
 		result = ns_query_done(qctx);

 		*resp = result;
-
 		return (NS_HOOK_RETURN);
 	}

@@ -9,6 +9,6 @@
 * information regarding copyright ownership.
 */

-options {
+plugin query "../../../plugins/lib/dns64.so" {
 	dns64 ::/0 { };
 };
@@ -9,6 +9,6 @@
 * information regarding copyright ownership.
 */

-options {
+plugin query "../../../plugins/lib/dns64.so" {
 	dns64 ::/96 { suffix ::1; };
 };
@@ -9,6 +9,6 @@
 * information regarding copyright ownership.
 */

-options {
+plugin query "../../../plugins/lib/dns64.so" {
 	dns64 ::/96 { suffix 127.0.0.1; };
 };
@@ -9,6 +9,6 @@
 * information regarding copyright ownership.
 */

-options {
+plugin query "../../../plugins/lib/dns64.so" {
 	dns64 ::/129 { };
 };
@@ -9,6 +9,6 @@
 * information regarding copyright ownership.
 */

-options {
+plugin query "../../../plugins/lib/dns64.so" {
 	dns64 ::/129 { };
 };
@@ -9,6 +9,6 @@
 * information regarding copyright ownership.
 */

-options {
+plugin query "../../../plugins/lib/dns64.so" {
 	dns64 :: { };
 };
@@ -9,7 +9,7 @@
 * information regarding copyright ownership.
 */

-options {
+plugin query "../../../plugins/lib/dns64.so" {
 	dns64 FC36:EAFE:F993::/64 {
 		exclude { bogusacl; };
 	};
@@ -9,7 +9,7 @@
 * information regarding copyright ownership.
 */

-options {
+plugin query "../../../plugins/lib/dns64.so" {
 	dns64 FC36:EAFE:F993::/64 {
 		clients { bogusacl; };
 	};
@@ -9,7 +9,7 @@
 * information regarding copyright ownership.
 */

-options {
+plugin query "../../../plugins/lib/dns64.so" {
 	dns64 FC36:EAFE:F993::/64 {
 		mapped { bogusacl; };
 	};
@@ -10,7 +10,7 @@
 */

 acl rfc1918 { 10/8; 192.168/16; 172.16/12; };
-options {
+plugin query "../../../plugins/lib/dns64.so" {
 	/* Well Known Prefix */
 	dns64 64:FF9B::/96 {
 		clients { any; };
@@ -10,7 +10,7 @@
 */

 acl rfc1918 { 10/8; 192.168/16; 172.16/12; };
-options {
+plugin query "../../../plugins/lib/dns64.so" {
 	/* Well Known Prefix */
 	dns64 64:FF9B::/96 {
 		mapped { !rfc1918; any; };
@@ -10,7 +10,7 @@
 */

 acl rfc1918 { 10/8; 192.168/16; 172.16/12; };
-options {
+plugin query "../../../plugins/lib/dns64.so" {
 	/* Well Known Prefix */
 	dns64 64:FF9B::/96 {
 		clients { any; };
@@ -10,7 +10,7 @@
 */

 acl rfc1918 { 10/8; 192.168/16; 172.16/12; };
-options {
+plugin query "../../../plugins/lib/dns64.so" {
 	/* Well Known Prefix */
 	dns64 64:FF9B::/96 {
 		clients { any; };
@@ -10,7 +10,7 @@
 */

 acl rfc1918 { 10/8; 192.168/16; 172.16/12; };
-options {
+plugin query "../../../plugins/lib/dns64.so" {
 	/* Well Known Prefix */
 	dns64 64:FF9B::/96 { };
 };
@@ -24,7 +24,9 @@ options {
 	allow-recursion { 10.53.0.1; };
 	notify yes;
 	dnssec-validation yes;
+};

+plugin query "../../../../plugins/lib/dns64.so" {
 	dns64 2001:bbbb::/96 {
 		clients { any; };
 		mapped { !rfc1918; any; };
@@ -24,7 +24,10 @@ options {
 	recursion yes;
 	notify yes;
 	dnssec-validation yes;
+	response-policy { zone "rpz"; };
+};

+plugin query "../../../../plugins/lib/dns64.so" {
 	dns64 2001:aaaa::/96 {
 		clients { 10.53.0.2; };
 		mapped { !rfc1918; any; };
@@ -54,8 +57,6 @@ options {
 	dns64 2001:64::/64 { clients { 10.53.0.6; }; };

 	dns64 2001:96::/96 { clients { 10.53.0.7; }; };
-
-	response-policy { zone "rpz"; };
 };

 zone "." {
@@ -0,0 +1,22 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0. If a copy of the MPL was not distributed with this
+; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 86400      ; 1 day
+@               SOA	example. noc.example. (
+                                1         ; serial
+                                86400      ; refresh (1 day)
+                                3600       ; retry (1 hour)
+                                2592000    ; expire (4 weeks 2 days)
+                                25200      ; minimum (7 hours)
+                                )
+                        NS      @
+                        IN A    10.53.0.3
+
+a		A	1.2.3.4
+noa		TXT	there is no A record here
@@ -0,0 +1,58 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+// NS3
+
+controls { /* empty */ };
+
+acl rfc1918 { 10/8; 192.168/16; 172.16/12; };
+
+options {
+	query-source address 10.53.0.3;
+	notify-source 10.53.0.3;
+	transfer-source 10.53.0.3;
+	port @PORT@;
+	pid-file "named.pid";
+	listen-on { 10.53.0.3; };
+	listen-on-v6 { none; };
+	recursion yes;
+	notify yes;
+	dnssec-enable yes;
+	dnssec-validation yes;
+	response-policy { zone "rpz"; };
+};
+
+plugin query "../../../../plugins/lib/dns64.so" {
+	dns64 2001:aaaa::/96 {
+		clients { none; };
+		mapped { !rfc1918; any; };
+		exclude { 2001:eeee::/32; 64:FF9B::/96; ::ffff:0000:0000/96; };
+		suffix ::;
+	};
+
+	dns64-server "dns64.example.net.";
+	dns64-contact "hostmaster.example.net.";
+};
+
+zone "." {
+	type hint;
+	file "../../common/root.hint";
+};
+
+zone "rpz" {
+	type master;
+	file "rpz.db";
+};
+
+zone "example" {
+	type master;
+	file "example.db";
+};
@@ -0,0 +1,21 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0. If a copy of the MPL was not distributed with this
+; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 86400      ; 1 day
+@               SOA	rpz. noc.rpz. (
+                                1         ; serial
+                                86400      ; refresh (1 day)
+                                3600       ; retry (1 hour)
+                                2592000    ; expire (4 weeks 2 days)
+                                25200      ; minimum (7 hours)
+                                )
+                        NS      @
+                        IN A    10.53.0.3
+a.example 	CNAME	a.example.
+noa.example 	CNAME	noa.example.
@@ -0,0 +1,21 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0. If a copy of the MPL was not distributed with this
+; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 86400      ; 1 day
+@               SOA	example. noc.example. (
+                                1         ; serial
+                                86400      ; refresh (1 day)
+                                3600       ; retry (1 hour)
+                                2592000    ; expire (4 weeks 2 days)
+                                25200      ; minimum (7 hours)
+                                )
+                        NS      @
+                        IN A    10.53.0.4
+
+a-only		A	1.2.3.4
@@ -0,0 +1,57 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+// NS4
+
+controls { /* empty */ };
+
+options {
+	query-source address 10.53.0.4;
+	notify-source 10.53.0.4;
+	transfer-source 10.53.0.4;
+	port @PORT@;
+	pid-file "named.pid";
+	listen-on { 10.53.0.4; };
+	listen-on-v6 { none; };
+	dnssec-enable yes;
+	dnssec-validation yes;
+};
+
+view us {
+	match-clients { 10.53.0.1; };
+	recursion yes;
+
+	plugin query "../../../../plugins/lib/dns64.so" {
+		dns64 2001:cccc::/96 {
+			clients { any; };
+		};
+	};
+
+	zone "." {
+		type hint;
+		file "../../common/root.hint";
+	};
+};
+
+view them {
+	recursion no;
+
+	plugin query "../../../../plugins/lib/dns64.so" {
+		dns64 2001:dddd::/96 {
+			clients { any; };
+		};
+	};
+
+	zone "example" {
+		type master;
+		file "example.db";
+	};
+};
@@ -16,5 +16,7 @@ $SHELL clean.sh

 copy_setports ns1/named.conf.in ns1/named.conf
 copy_setports ns2/named.conf.in ns2/named.conf
+copy_setports ns3/named.conf.in ns3/named.conf
+copy_setports ns4/named.conf.in ns4/named.conf

 cd ns1 && $SHELL sign.sh
@@ -21,22 +21,22 @@ DIGOPTS="+tcp +noadd +nosea +nostat +nocmd -p ${PORT}"

 for conf in conf/good*.conf
 do
-        echo_i "checking that $conf is accepted ($n)"
-        ret=0
-        $CHECKCONF "$conf" || ret=1
-        n=`expr $n + 1`
-        if [ $ret != 0 ]; then echo_i "failed"; fi
-        status=`expr $status + $ret`
+	n=`expr $n + 1`
+	echo_i "checking that $conf is accepted ($n)"
+	ret=0
+	$CHECKCONF "$conf" || ret=1
+	if [ $ret != 0 ]; then echo_i "failed"; fi
+	status=`expr $status + $ret`
 done

 for conf in conf/bad*.conf
 do
-        echo_i "checking that $conf is rejected ($n)"
-        ret=0
-        $CHECKCONF "$conf" >/dev/null && ret=1
 	n=`expr $n + 1`
-        if [ $ret != 0 ]; then echo_i "failed"; fi
-        status=`expr $status + $ret`
+	echo_i "checking that $conf is rejected ($n)"
+	ret=0
+	$CHECKCONF "$conf" >/dev/null && ret=1
+	if [ $ret != 0 ]; then echo_i "failed"; fi
+	status=`expr $status + $ret`
 done

 # Check the example. domain
@@ -1400,5 +1400,34 @@ n=`expr $n + 1`
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`

+echo_i "checking dns64 client resume after rpz match with A ($n)"
+ret=0
+$DIG $DIGOPTS aaaa a.example +rec @10.53.0.3 > dig.out.ns3.test$n || ret=1
+grep "status: NOERROR" dig.out.ns3.test$n >/dev/null || ret=1
+n=`expr $n + 1`
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=`expr $status + $ret`
+
+echo_i "checking dns64 client resume after rpz match without A ($n)"
+ret=0
+$DIG $DIGOPTS aaaa noa.example +rec @10.53.0.3 > dig.out.ns3.test$n || ret=1
+grep "status: NOERROR" dig.out.ns3.test$n >/dev/null || ret=1
+n=`expr $n + 1`
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=`expr $status + $ret`
+
+echo_i "checking dns64 configured in separate views($n)"
+ret=0
+# recursive view
+$DIG $DIGOPTS aaaa a-only.example +rec @10.53.0.4 -b 10.53.0.1 > dig.out.ns4.test$n.1 || ret=1
+grep "flags:.* ra;" dig.out.ns4.test$n.1 > /dev/null || ret=1
+grep "2001:cccc::102:305" dig.out.ns4.test$n.1 > /dev/null || ret=1
+$DIG $DIGOPTS aaaa a-only.example +rec @10.53.0.4 -b 10.53.0.2 > dig.out.ns4.test$n.2 || ret=1
+grep "flags:.* rd;" dig.out.ns4.test$n.2 > /dev/null || ret=1
+grep "2001:dddd::102:304" dig.out.ns4.test$n.2 > /dev/null || ret=1
+n=`expr $n + 1`
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=`expr $status + $ret`
+
 echo_i "exit status: $status"
 [ $status -eq 0 ] || exit 1
@@ -20,11 +20,6 @@ options {
 	recursion yes;
 	dnssec-validation no;
 	notify yes;
-	dns64 64:ff9b::/96 {
-			    clients { any; };
-			    exclude { any; };
-			    mapped { any; };
-	};
 	minimal-responses no;
 };

@@ -33,6 +28,14 @@ plugin query "../../../../plugins/lib/filter-aaaa.so" {
 	filter-aaaa { any; };
 };

+plugin query "../../../../plugins/lib/dns64.so" {
+	dns64 64:ff9b::/96 {
+		clients { any; };
+		exclude { any; };
+		mapped { any; };
+	};
+};
+
 key rndc_key {
 	secret "1234abcd8765";
 	algorithm hmac-sha256;
@@ -18106,6 +18106,7 @@ allow-query { !{ !10/8; any; }; key example; };
      <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="../../bin/dnssec/dnssec-verify.docbook"/>
      <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="../../bin/tools/dnstap-read.docbook"/>
      <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="../../bin/plugins/filter-aaaa.docbook"/>
+      <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="../../bin/plugins/dns64.docbook"/>
      <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="../../bin/dig/host.docbook"/>
      <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="../../bin/tools/mdig.docbook"/>
      <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="../../bin/check/named-checkconf.docbook"/>
@@ -0,0 +1,173 @@
+<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
+<!--
+ - Copyright (C) 2000-2018 Internet Systems Consortium, Inc. ("ISC")
+ - 
+ - This Source Code Form is subject to the terms of the Mozilla Public
+ - License, v. 2.0. If a copy of the MPL was not distributed with this
+ - file, You can obtain one at http://mozilla.org/MPL/2.0/.
+-->
+<html lang="en">
+<head>
+<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
+<title>dns64.so</title>
+<meta name="generator" content="DocBook XSL Stylesheets V1.79.1">
+<link rel="home" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
+<link rel="up" href="Bv9ARM.ch12.html" title="Manual pages">
+<link rel="prev" href="man.filter-aaaa.html" title="filter-aaaa.so">
+<link rel="next" href="man.host.html" title="host">
+</head>
+<body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF">
+<div class="navheader">
+<table width="100%" summary="Navigation header">
+<tr><th colspan="3" align="center"><span class="application">dns64.so</span></th></tr>
+<tr>
+<td width="20%" align="left">
+<a accesskey="p" href="man.filter-aaaa.html">Prev</a> </td>
+<th width="60%" align="center">Manual pages</th>
+<td width="20%" align="right"> <a accesskey="n" href="man.host.html">Next</a>
+</td>
+</tr>
+</table>
+<hr>
+</div>
+<div class="refentry">
+<a name="man.dns64"></a><div class="titlepage"></div>
+<div class="refnamediv">
+<h2>Name</h2>
+<p><span class="application">dns64.so</span> &#8212; perform DNS64 synthesis</p>
+</div>
+<div class="refsynopsisdiv">
+<h2>Synopsis</h2>
+<div class="cmdsynopsis"><p><code class="command">hook query "dns64.so"</code>  [<em class="replaceable"><code>{ parameters }</code></em>];
+    </p></div>
+</div>
+<div class="refsection">
+<a name="id-1.13.20.7"></a><h2>DESCRIPTION</h2>
+<p>
+      <span class="command"><strong>dns64.so</strong></span> is a query hook module for
+      <span class="command"><strong>named</strong></span>, enabling <span class="command"><strong>named</strong></span>
+      to perform DNS64 address synthesis.
+    </p>
+<p>
+      Until BIND 9.12, this feature was implemented natively in
+      <span class="command"><strong>named</strong></span> and enabled with the
+      <span class="command"><strong>dns64</strong></span> option.
+      This option is now deprecated in <code class="filename">named.conf</code>,
+      but can be passed as parameters to the
+      <span class="command"><strong>dns64.so</strong></span> module, for example:
+    </p>
+<pre class="programlisting">
+	acl rfc1918 { 10/8; 192.168/16; 172.16/12; };
+
+	plugin query "/usr/local/lib/dns64.so" {
+		dns64 64:FF9B::/96 {
+			clients { any; };
+			mapped { !rfc1918; any; };
+			exclude { 64:FF9B::/96; ::ffff:0000:0000/96; };
+			suffix ::;
+		};
+
+		dns64-server "dns64.example.net.";
+		dns64-contact "hostmaster.example.net.";
+	};
+</pre>
+<p>
+      This plugin enables <span class="command"><strong>named</strong></span> to
+      return mapped IPv4 addresses to AAAA queries when
+      there are no AAAA records.  It is intended to be
+      used in conjunction with NAT64.
+    </p>
+<p>
+      Each <span class="command"><strong>dns64</strong></span> option defined in the plugin
+      parameters defines one DNS64 prefix. Multiple DNS64 prefixes
+      can be defined.
+    </p>
+<p>
+      Compatible IPv6 prefixes have lengths of 32, 40, 48, 56,
+      64 and 96 as per RFC 6052.
+    </p>
+<p>
+      Additionally a reverse IP6.ARPA zone will be created for
+      the prefix to provide a mapping from the IP6.ARPA names
+      to the corresponding IN-ADDR.ARPA names using synthesized
+      CNAMEs.  <span class="command"><strong>dns64-server</strong></span> and
+      <span class="command"><strong>dns64-contact</strong></span> can be used to specify
+      the name of the server and contact for the zones.
+      These are not settable on a per-prefix basis.
+    </p>
+<p>
+      Each <span class="command"><strong>dns64</strong></span> supports an optional
+      <span class="command"><strong>clients</strong></span> ACL that determines which
+      clients are affected by this directive.  If not defined,
+      it defaults to <strong class="userinput"><code>any;</code></strong>.
+    </p>
+<p>
+      Each <span class="command"><strong>dns64</strong></span> supports an optional
+      <span class="command"><strong>mapped</strong></span> ACL that selects which
+      IPv4 addresses are to be mapped in the corresponding
+      A RRset.  If not defined it defaults to
+      <strong class="userinput"><code>any;</code></strong>.
+    </p>
+<p>
+      Normally, DNS64 won't apply to a domain name that
+      owns one or more AAAA records; these records will
+      simply be returned.  The optional
+      <span class="command"><strong>exclude</strong></span> ACL allows specification
+      of a list of IPv6 addresses that will be ignored
+      if they appear in a domain name's AAAA records, and
+      DNS64 will be applied to any A records the domain
+      name owns.  If not defined, <span class="command"><strong>exclude</strong></span>
+      defaults to ::ffff:0.0.0.0/96.
+    </p>
+<p>
+      A optional <span class="command"><strong>suffix</strong></span> can also
+      be defined to set the bits trailing the mapped
+      IPv4 address bits.  By default these bits are
+      set to <strong class="userinput"><code>::</code></strong>.  The bits
+      matching the prefix and mapped IPv4 address
+      must be zero.
+    </p>
+<p>
+      If <span class="command"><strong>recursive-only</strong></span> is set to
+      <span class="command"><strong>yes</strong></span> the DNS64 synthesis will
+      only happen for recursive queries.  The default
+      is <span class="command"><strong>no</strong></span>.
+    </p>
+<p>
+      If <span class="command"><strong>break-dnssec</strong></span> is set to
+      <span class="command"><strong>yes</strong></span> the DNS64 synthesis will
+      happen even if the result, if validated, would
+      cause a DNSSEC validation failure.  If this option
+      is set to <span class="command"><strong>no</strong></span> (the default), the DO
+      is set on the incoming query, and there are RRSIGs on
+      the applicable records, then synthesis will not happen.
+    </p>
+</div>
+<div class="refsection">
+<a name="id-1.13.20.8"></a><h2>SEE ALSO</h2>
+<p>
+      <em class="citetitle">BIND 9 Administrator Reference Manual</em>.
+    </p>
+</div>
+</div>
+<div class="navfooter">
+<hr>
+<table width="100%" summary="Navigation footer">
+<tr>
+<td width="40%" align="left">
+<a accesskey="p" href="man.filter-aaaa.html">Prev</a> </td>
+<td width="20%" align="center"><a accesskey="u" href="Bv9ARM.ch12.html">Up</a></td>
+<td width="40%" align="right"> <a accesskey="n" href="man.host.html">Next</a>
+</td>
+</tr>
+<tr>
+<td width="40%" align="left" valign="top">
+<span class="application">filter-aaaa.so</span> </td>
+<td width="20%" align="center"><a accesskey="h" href="Bv9ARM.html">Home</a></td>
+<td width="40%" align="right" valign="top"> host</td>
+</tr>
+</table>
+</div>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.13.4 (Development Release)</p>
+</body>
+</html>
@@ -26,15 +26,16 @@
    in the future.
  </para>
  <para>
-    The only plugin currently included in BIND is
-    <filename>filter-aaaa.so</filename>, which replaces the
-    <command>filter-aaaa</command> feature that previously existed natively
+    The only plugins currently included in BIND are
+    <filename>filter-aaaa.so</filename> and <filename>dns64.so</filename>,
+    which replace the <command>filter-aaaa</command> and
+    <command>dns64</command> features that previously existed natively
    as part of <command>named</command>.
-    The code for this feature has been removed from <command>named</command>,
-    and can no longer be configured using standard
+    The code for these features has been removed from <command>named</command>,
+    and they can no longer be configured using standard
    <filename>named.conf</filename> syntax, but linking in the
-    <filename>filter-aaaa.so</filename> plugin provides identical
-    functionality.
+    <filename>filter-aaaa.so</filename> or <filename>dns64.so</filename>
+    plugins provides identical functionality.
  </para>

  <section><info><title>Configuring Plugins</title></info>
@@ -477,112 +477,6 @@ check_viewacls(cfg_aclconfctx_t *actx, const cfg_obj_t *voptions,
 	return (result);
 }

-static const unsigned char zeros[16];
-
-static isc_result_t
-check_dns64(cfg_aclconfctx_t *actx, const cfg_obj_t *voptions,
-	    const cfg_obj_t *config, isc_log_t *logctx, isc_mem_t *mctx)
-{
-	isc_result_t result = ISC_R_SUCCESS;
-	const cfg_obj_t *dns64 = NULL;
-	const cfg_obj_t *options;
-	const cfg_listelt_t *element;
-	const cfg_obj_t *map, *obj;
-	isc_netaddr_t na, sa;
-	unsigned int prefixlen;
-	int nbytes;
-	int i;
-
-	static const char *acls[] = { "clients", "exclude", "mapped", NULL};
-
-	if (voptions != NULL)
-		cfg_map_get(voptions, "dns64", &dns64);
-	if (config != NULL && dns64 == NULL) {
-		options = NULL;
-		cfg_map_get(config, "options", &options);
-		if (options != NULL)
-			cfg_map_get(options, "dns64", &dns64);
-	}
-	if (dns64 == NULL)
-		return (ISC_R_SUCCESS);
-
-	for (element = cfg_list_first(dns64);
-	     element != NULL;
-	     element = cfg_list_next(element))
-	{
-		map = cfg_listelt_value(element);
-		obj = cfg_map_getname(map);
-
-		cfg_obj_asnetprefix(obj, &na, &prefixlen);
-		if (na.family != AF_INET6) {
-			cfg_obj_log(map, logctx, ISC_LOG_ERROR,
-				    "dns64 requires a IPv6 prefix");
-			result = ISC_R_FAILURE;
-			continue;
-		}
-
-		if (na.type.in6.s6_addr[8] != 0) {
-			cfg_obj_log(map, logctx, ISC_LOG_ERROR,
-				 "invalid prefix, bits [64..71] must be zero");
-			result = ISC_R_FAILURE;
-			continue;
-		}
-
-		if (prefixlen != 32 && prefixlen != 40 && prefixlen != 48 &&
-		    prefixlen != 56 && prefixlen != 64 && prefixlen != 96) {
-			cfg_obj_log(map, logctx, ISC_LOG_ERROR,
-				    "bad prefix length %u [32/40/48/56/64/96]",
-				    prefixlen);
-			result = ISC_R_FAILURE;
-			continue;
-		}
-
-		for (i = 0; acls[i] != NULL; i++) {
-			obj = NULL;
-			(void)cfg_map_get(map, acls[i], &obj);
-			if (obj != NULL) {
-				dns_acl_t *acl = NULL;
-				isc_result_t tresult;
-
-				tresult = cfg_acl_fromconfig(obj, config,
-							     logctx, actx,
-							     mctx, 0, &acl);
-				if (acl != NULL)
-					dns_acl_detach(&acl);
-				if (tresult != ISC_R_SUCCESS)
-					result = tresult;
-			}
-		}
-
-		obj = NULL;
-		(void)cfg_map_get(map, "suffix", &obj);
-		if (obj != NULL) {
-			isc_netaddr_fromsockaddr(&sa, cfg_obj_assockaddr(obj));
-			if (sa.family != AF_INET6) {
-				cfg_obj_log(map, logctx, ISC_LOG_ERROR,
-					    "dns64 requires a IPv6 suffix");
-				result = ISC_R_FAILURE;
-				continue;
-			}
-			nbytes = prefixlen / 8 + 4;
-			if (prefixlen <= 64)
-				nbytes++;
-			if (memcmp(sa.type.in6.s6_addr, zeros, nbytes) != 0) {
-				char netaddrbuf[ISC_NETADDR_FORMATSIZE];
-				isc_netaddr_format(&sa, netaddrbuf,
-						   sizeof(netaddrbuf));
-				cfg_obj_log(obj, logctx, ISC_LOG_ERROR,
-					    "bad suffix '%s' leading "
-					    "%u octets not zeros",
-					    netaddrbuf, nbytes);
-				result = ISC_R_FAILURE;
-			}
-		}
-	}
-
-	return (result);
-}
-
 #define CHECK_RRL(cond, pat, val1, val2)				\
 	do {								\
 		if (!(cond)) {						\
@@ -880,7 +774,6 @@ check_options(const cfg_obj_t *options, isc_log_t *logctx, isc_mem_t *mctx,

 	static const char *server_contact[] = {
 		"empty-server", "empty-contact",
-		"dns64-server", "dns64-contact",
 		NULL
 	};

@@ -3845,11 +3738,6 @@ check_viewconf(const cfg_obj_t *config, const cfg_obj_t *voptions,
 		result = tresult;
 	}

-	tresult = check_dns64(actx, voptions, config, logctx, mctx);
-	if (tresult != ISC_R_SUCCESS) {
-		result = tresult;
-	}
-
 	tresult = check_ratelimit(actx, voptions, config, logctx, mctx);
 	if (tresult != ISC_R_SUCCESS) {
 		result = tresult;
@@ -62,7 +62,7 @@ DNSTAPOBJS = dnstap.@O@ dnstap.pb-c.@O@
 DNSOBJS =	acl.@O@ adb.@O@ badcache.@O@ byaddr.@O@ \
 		cache.@O@ callbacks.@O@ catz.@O@ clientinfo.@O@ compress.@O@ \
 		db.@O@ dbiterator.@O@ dbtable.@O@ diff.@O@ dispatch.@O@ \
-		dlz.@O@ dns64.@O@ dnsrps.@O@ dnssec.@O@ ds.@O@ dyndb.@O@ \
+		dlz.@O@ dnsrps.@O@ dnssec.@O@ ds.@O@ dyndb.@O@ \
 		ecs.@O@ fixedname.@O@ forward.@O@ \
 		ipkeylist.@O@ iptable.@O@ journal.@O@ keydata.@O@ \
 		keytable.@O@ lib.@O@ log.@O@ lookup.@O@ \
@@ -99,7 +99,7 @@ DNSTAPSRCS = dnstap.c dnstap.pb-c.c
 DNSSRCS =	acl.c adb.c badcache. byaddr.c \
 		cache.c callbacks.c clientinfo.c compress.c \
 		db.c dbiterator.c dbtable.c diff.c dispatch.c \
-		dlz.c dns64.c dnsrps.c dnssec.c ds.c dyndb.c \
+		dlz.c dnsrps.c dnssec.c ds.c dyndb.c \
 		ecs.c fixedname.c forward.c \
 		ipkeylist.c iptable.c journal.c keydata.c keytable.c lib.c \
 		log.c lookup.c master.c masterdump.c message.c \
@@ -1,293 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-#include <stdbool.h>
-
-#include <isc/list.h>
-#include <isc/mem.h>
-#include <isc/netaddr.h>
-#include <isc/string.h>
-#include <isc/util.h>
-
-#include <dns/acl.h>
-#include <dns/dns64.h>
-#include <dns/rdata.h>
-#include <dns/rdataset.h>
-#include <dns/result.h>
-#include <string.h>
-
-struct dns_dns64 {
-	unsigned char		bits[16];	/*
-						 * Prefix + suffix bits.
-						 */
-	dns_acl_t *		clients;	/*
-						 * Which clients get mapped
-						 * addresses.
-						 */
-	dns_acl_t *		mapped;		/*
-						 * IPv4 addresses to be mapped.
-						 */
-	dns_acl_t *		excluded;	/*
-						 * IPv6 addresses that are
-						 * treated as not existing.
-						 */
-	unsigned int		prefixlen;	/*
-						 * Start of mapped address.
-						 */
-	unsigned int		flags;
-	isc_mem_t *		mctx;
-	ISC_LINK(dns_dns64_t)	link;
-};
-
-isc_result_t
-dns_dns64_create(isc_mem_t *mctx, const isc_netaddr_t *prefix,
-		 unsigned int prefixlen, const isc_netaddr_t *suffix,
-		 dns_acl_t *clients, dns_acl_t *mapped, dns_acl_t *excluded,
-		 unsigned int flags, dns_dns64_t **dns64p)
-{
-	dns_dns64_t *dns64;
-	unsigned int nbytes = 16;
-
-	REQUIRE(prefix != NULL && prefix->family == AF_INET6);
-	/* Legal prefix lengths from rfc6052.txt. */
-	REQUIRE(prefixlen == 32 || prefixlen == 40 || prefixlen == 48 ||
-		prefixlen == 56 || prefixlen == 64 || prefixlen == 96);
-	REQUIRE(isc_netaddr_prefixok(prefix, prefixlen) == ISC_R_SUCCESS);
-	REQUIRE(dns64p != NULL && *dns64p == NULL);
-
-	if (suffix != NULL) {
-		static const unsigned char zeros[16];
-		REQUIRE(prefix->family == AF_INET6);
-		nbytes = prefixlen / 8 + 4;
-		/* Bits 64-71 are zeros. rfc6052.txt */
-		if (prefixlen >= 32 && prefixlen <= 64)
-			nbytes++;
-		REQUIRE(memcmp(suffix->type.in6.s6_addr, zeros, nbytes) == 0);
-	}
-
-	dns64 = isc_mem_get(mctx, sizeof(dns_dns64_t));
-	memset(dns64->bits, 0, sizeof(dns64->bits));
-	memmove(dns64->bits, prefix->type.in6.s6_addr, prefixlen / 8);
-	if (suffix != NULL)
-		memmove(dns64->bits + nbytes, suffix->type.in6.s6_addr + nbytes,
-			16 - nbytes);
-	dns64->clients = NULL;
-	if (clients != NULL)
-		dns_acl_attach(clients, &dns64->clients);
-	dns64->mapped = NULL;
-	if (mapped != NULL)
-		dns_acl_attach(mapped, &dns64->mapped);
-	dns64->excluded = NULL;
-	if (excluded != NULL)
-		dns_acl_attach(excluded, &dns64->excluded);
-	dns64->prefixlen = prefixlen;
-	dns64->flags = flags;
-	ISC_LINK_INIT(dns64, link);
-	dns64->mctx = NULL;
-	isc_mem_attach(mctx, &dns64->mctx);
-	*dns64p = dns64;
-	return (ISC_R_SUCCESS);
-}
-
-void
-dns_dns64_destroy(dns_dns64_t **dns64p) {
-	dns_dns64_t *dns64;
-
-	REQUIRE(dns64p != NULL && *dns64p != NULL);
-
-	dns64 = *dns64p;
-	*dns64p = NULL;
-
-	REQUIRE(!ISC_LINK_LINKED(dns64, link));
-
-	if (dns64->clients != NULL)
-		dns_acl_detach(&dns64->clients);
-	if (dns64->mapped != NULL)
-		dns_acl_detach(&dns64->mapped);
-	if (dns64->excluded != NULL)
-		dns_acl_detach(&dns64->excluded);
-	isc_mem_putanddetach(&dns64->mctx, dns64, sizeof(*dns64));
-}
-
-isc_result_t
-dns_dns64_aaaafroma(const dns_dns64_t *dns64, const isc_netaddr_t *reqaddr,
-		    const dns_name_t *reqsigner, const dns_aclenv_t *env,
-		    unsigned int flags, unsigned char *a, unsigned char *aaaa)
-{
-	unsigned int nbytes, i;
-	isc_result_t result;
-	int match;
-
-	if ((dns64->flags & DNS_DNS64_RECURSIVE_ONLY) != 0 &&
-	    (flags & DNS_DNS64_RECURSIVE) == 0)
-		return (DNS_R_DISALLOWED);
-
-	if ((dns64->flags & DNS_DNS64_BREAK_DNSSEC) == 0 &&
-	    (flags & DNS_DNS64_DNSSEC) != 0)
-		return (DNS_R_DISALLOWED);
-
-	if (dns64->clients != NULL) {
-		result = dns_acl_match(reqaddr, reqsigner, dns64->clients,
-				       env, &match, NULL);
-		if (result != ISC_R_SUCCESS)
-			return (result);
-		if (match <= 0)
-			return (DNS_R_DISALLOWED);
-	}
-
-	if (dns64->mapped != NULL) {
-		struct in_addr ina;
-		isc_netaddr_t netaddr;
-
-		memmove(&ina.s_addr, a, 4);
-		isc_netaddr_fromin(&netaddr, &ina);
-		result = dns_acl_match(&netaddr, NULL, dns64->mapped,
-				       env, &match, NULL);
-		if (result != ISC_R_SUCCESS)
-			return (result);
-		if (match <= 0)
-			return (DNS_R_DISALLOWED);
-	}
-
-	nbytes = dns64->prefixlen / 8;
-	INSIST(nbytes <= 12);
-	/* Copy prefix. */
-	memmove(aaaa, dns64->bits, nbytes);
-	/* Bits 64-71 are zeros. rfc6052.txt */
-	if (nbytes == 8)
-		aaaa[nbytes++] = 0;
-	/* Copy mapped address. */
-	for (i = 0; i < 4U; i++) {
-		aaaa[nbytes++] = a[i];
-		/* Bits 64-71 are zeros. rfc6052.txt */
-		if (nbytes == 8)
-			aaaa[nbytes++] = 0;
-	}
-	/* Copy suffix. */
-	memmove(aaaa + nbytes, dns64->bits + nbytes, 16 - nbytes);
-	return (ISC_R_SUCCESS);
-}
-
-dns_dns64_t *
-dns_dns64_next(dns_dns64_t *dns64) {
-	dns64 = ISC_LIST_NEXT(dns64, link);
-	return (dns64);
-}
-
-void
-dns_dns64_append(dns_dns64list_t *list, dns_dns64_t *dns64) {
-	ISC_LIST_APPEND(*list, dns64, link);
-}
-
-void
-dns_dns64_unlink(dns_dns64list_t *list, dns_dns64_t *dns64) {
-	ISC_LIST_UNLINK(*list, dns64, link);
-}
-
-bool
-dns_dns64_aaaaok(const dns_dns64_t *dns64, const isc_netaddr_t *reqaddr,
-		 const dns_name_t *reqsigner, const dns_aclenv_t *env,
-		 unsigned int flags, dns_rdataset_t *rdataset,
-		 bool *aaaaok, size_t aaaaoklen)
-{
-	struct in6_addr in6;
-	isc_netaddr_t netaddr;
-	isc_result_t result;
-	int match;
-	bool answer = false;
-	bool found = false;
-	unsigned int i, ok;
-
-	REQUIRE(rdataset != NULL);
-	REQUIRE(rdataset->type == dns_rdatatype_aaaa);
-	REQUIRE(rdataset->rdclass == dns_rdataclass_in);
-	if (aaaaok != NULL)
-		REQUIRE(aaaaoklen == dns_rdataset_count(rdataset));
-
-	for (;dns64 != NULL; dns64 = ISC_LIST_NEXT(dns64, link)) {
-		if ((dns64->flags & DNS_DNS64_RECURSIVE_ONLY) != 0 &&
-		    (flags & DNS_DNS64_RECURSIVE) == 0)
-			continue;
-
-		if ((dns64->flags & DNS_DNS64_BREAK_DNSSEC) == 0 &&
-		    (flags & DNS_DNS64_DNSSEC) != 0)
-			continue;
-		/*
-		 * Work out if this dns64 structure applies to this client.
-		 */
-		if (dns64->clients != NULL) {
-			result = dns_acl_match(reqaddr, reqsigner,
-					       dns64->clients, env,
-					       &match, NULL);
-			if (result != ISC_R_SUCCESS)
-				continue;
-			if (match <= 0)
-				continue;
-		}
-
-		if (!found && aaaaok != NULL) {
-			for (i = 0; i < aaaaoklen; i++)
-				aaaaok[i] = false;
-		}
-		found = true;
-
-		/*
-		 * If we are not excluding any addresses then any AAAA
-		 * will do.
-		 */
-		if (dns64->excluded == NULL) {
-			answer = true;
-			if (aaaaok == NULL)
-				goto done;
-			for (i = 0; i < aaaaoklen; i++)
-				aaaaok[i] = true;
-			goto done;
-		}
-
-		i = 0; ok = 0;
-		for (result = dns_rdataset_first(rdataset);
-		     result == ISC_R_SUCCESS;
-		     result = dns_rdataset_next(rdataset)) {
-			dns_rdata_t rdata = DNS_RDATA_INIT;
-			if (aaaaok == NULL || !aaaaok[i]) {
-
-				dns_rdataset_current(rdataset, &rdata);
-				memmove(&in6.s6_addr, rdata.data, 16);
-				isc_netaddr_fromin6(&netaddr, &in6);
-
-				result = dns_acl_match(&netaddr, NULL,
-						       dns64->excluded, env,
-						       &match, NULL);
-				if (result == ISC_R_SUCCESS && match <= 0) {
-					answer = true;
-					if (aaaaok == NULL)
-						goto done;
-					aaaaok[i] = true;
-					ok++;
-				}
-			} else
-				ok++;
-			i++;
-		}
-		/*
-		 * Are all addresses ok?
-		 */
-		if (aaaaok != NULL && ok == aaaaoklen)
-			goto done;
-	}
-
- done:
-	if (!found && aaaaok != NULL) {
-		for (i = 0; i < aaaaoklen; i++)
-			aaaaok[i] = true;
-	}
-	return (found ? answer : true);
-}
@@ -17,7 +17,7 @@ HEADERS =	acl.h adb.h badcache.h bit.h byaddr.h \
 		cache.h callbacks.h catz.h cert.h \
 		client.h clientinfo.h compress.h \
 		db.h dbiterator.h dbtable.h diff.h dispatch.h \
-		dlz.h dlz_dlopen.h dns64.h dnsrps.h dnssec.h ds.h dsdigest.h \
+		dlz.h dlz_dlopen.h dnsrps.h dnssec.h ds.h dsdigest.h \
 		dnstap.h dyndb.h ecs.h \
 		edns.h ecdb.h events.h fixedname.h forward.h geoip.h \
 		ipkeylist.h iptable.h \
@@ -1,171 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-
-#ifndef DNS_DNS64_H
-#define DNS_DNS64_H 1
-
-#include <stdbool.h>
-
-#include <isc/lang.h>
-
-#include <dns/types.h>
-
-ISC_LANG_BEGINDECLS
-
-/*
- * dns_dns64_create() flags.
- */
-#define DNS_DNS64_RECURSIVE_ONLY	0x01	/* If set then this record
-						 * only applies to recursive
-						 * queries.
-						 */
-#define DNS_DNS64_BREAK_DNSSEC		0x02	/* If set then still perform
-						 * DNSSEC synthesis even
-						 * though the result would
-						 * fail validation.
-						 */
-
-/*
- * dns_dns64_aaaaok() and dns_dns64_aaaafroma() flags.
- */
-#define DNS_DNS64_RECURSIVE		0x01	/* Recursive query. */
-#define DNS_DNS64_DNSSEC		0x02	/* DNSSEC sensitive query. */
-
-isc_result_t
-dns_dns64_create(isc_mem_t *mctx, const isc_netaddr_t *prefix,
-		 unsigned int prefixlen, const isc_netaddr_t *suffix,
-		 dns_acl_t *client, dns_acl_t *mapped, dns_acl_t *excluded,
-		 unsigned int flags, dns_dns64_t **dns64);
-/*
- * Create a dns64 record which is used to identify the set of clients
- * it applies to and how to perform the DNS64 synthesis.
- *
- * 'prefix' and 'prefixlen' defined the leading bits of the AAAA records
- * to be synthesised.  'suffix' defines the bits after the A records bits.
- * If suffix is NULL zeros will be used for these bits.  'client' defines
- * for which clients this record applies.  If 'client' is NULL then all
- * clients apply.  'mapped' defines which A records are candidated for
- * mapping.  If 'mapped' is NULL then all A records will be mapped.
- * 'excluded' defines which AAAA are to be treated as non-existent for the
- * purposed of determining whether to perform syntesis.  If 'excluded' is
- * NULL then no AAAA records prevent synthesis.
- *
- * If DNS_DNS64_RECURSIVE_ONLY is set then the record will only match if
- * DNS_DNS64_RECURSIVE is set when calling  dns_dns64_aaaaok() and
- * dns_dns64_aaaafroma().
- *
- * If DNS_DNS64_BREAK_DNSSEC is set then the record will still apply if
- * DNS_DNS64_DNSSEC is set when calling  dns_dns64_aaaaok() and
- * dns_dns64_aaaafroma() otherwise the record will be ignored.
- *
- * Requires:
- *      'mctx'          to be valid.
- *      'prefix'        to be valid and the address family to AF_INET6.
- *      'prefixlen'     to be one of 32, 40, 48, 56, 72 and 96.
- *                      the bits not covered by prefixlen in prefix to
- *                      be zero.
- *      'suffix'        to be NULL or the address family be set to AF_INET6
- *                      and the leading 'prefixlen' + 32 bits of the 'suffix'
- *                      to be zero.  If 'prefixlen' is 40, 48 or 56 then the
- *                      the leading 'prefixlen' + 40 bits of 'suffix' must be
- *                      zero.
- *	'client'	to be NULL or a valid acl.
- *	'mapped'	to be NULL or a valid acl.
- *	'excluded'	to be NULL or a valid acl.
- *
- * Returns:
- *	ISC_R_SUCCESS
- *	ISC_R_NOMEMORY
- */
-
-void
-dns_dns64_destroy(dns_dns64_t **dns64p);
-/*
- * Destroys a dns64 record.
- *
- * Requires the record to not be linked.
- */
-
-isc_result_t
-dns_dns64_aaaafroma(const dns_dns64_t *dns64, const isc_netaddr_t *reqaddr,
-		    const dns_name_t *reqsigner, const dns_aclenv_t *env,
-		    unsigned int flags, unsigned char *a, unsigned char *aaaa);
-/*
- * dns_dns64_aaaafroma() determines whether to perform a DNS64 address
- * synthesis from 'a' based on 'dns64', 'reqaddr', 'reqsigner', 'env',
- * 'flags' and 'aaaa'.  If synthesis is performed then the result is
- * written to '*aaaa'.
- *
- * The synthesised address will be of the form:
- *
- *	 <prefix bits><a bits><suffix bits>
- *
- * If <a bits> straddle bits 64-71 of the AAAA record, then 8 zero bits will
- * be inserted at bits 64-71.
- *
- * Requires:
- *	'dns64'		to be valid.
- *	'reqaddr'	to be valid.
- *	'reqsigner'	to be NULL or valid.
- *	'env'		to be valid.
- *	'a'		to point to a IPv4 address in network order.
- *	'aaaa'		to point to a IPv6 address buffer in network order.
- *
- * Returns:
- *	ISC_R_SUCCESS		if synthesis was performed.
- *	DNS_R_DISALLOWED	if there is no match.
- */
-
-dns_dns64_t *
-dns_dns64_next(dns_dns64_t *dns64);
-/*
- * Return the next dns64 record in the list.
- */
-
-void
-dns_dns64_append(dns_dns64list_t *list, dns_dns64_t *dns64);
-/*
- * Append the dns64 record to the list.
- */
-
-void
-dns_dns64_unlink(dns_dns64list_t *list, dns_dns64_t *dns64);
-/*
- * Unlink the dns64 record from the list.
- */
-
-bool
-dns_dns64_aaaaok(const dns_dns64_t *dns64, const isc_netaddr_t *reqaddr,
-		 const dns_name_t *reqsigner, const dns_aclenv_t *env,
-		 unsigned int flags, dns_rdataset_t *rdataset,
-		 bool *aaaaok, size_t aaaaoklen);
-/*
- * Determine if there are any non-excluded AAAA records in from the
- * matching dns64 records in the list starting at 'dns64'.  If there
- * is a non-exluded address return true.  If all addresses are
- * excluded in the matched records return false.   If no records
- * match then return true.
- *
- * If aaaaok is defined then dns_dns64_aaaaok() return a array of which
- * addresses in 'rdataset' were deemed to not be exclude by any matching
- * record.  If there are no matching records then all entries are set
- * to true.
- *
- * Requires
- * 	'rdataset'	to be valid and to be for type AAAA and class IN.
- *	'aaaaoklen'	must match the number of records in 'rdataset'
- *			if 'aaaaok' in non NULL.
- */
-
-ISC_LANG_ENDDECLS
-
-#endif /* DNS_DNS64_H */
@@ -71,7 +71,8 @@ typedef isc_result_t
 			 dns_sdballnodes_t *allnodes);

 typedef isc_result_t
-(*dns_sdbcreatefunc_t)(const char *zone, int argc, char **argv,
+(*dns_sdbcreatefunc_t)(const char *zone, isc_mem_t *mctx,
+		       int argc, char **argv,
 		       void *driverdata, void **dbdata);

 typedef void
@@ -98,6 +99,13 @@ ISC_LANG_BEGINDECLS
 #define DNS_SDBFLAG_THREADSAFE 0x00000004U
 #define DNS_SDBFLAG_DNS64 0x00000008U

+typedef isc_result_t
+(*dns_sdbregister_t)(const char *drivername, const dns_sdbmethods_t *methods,
+		     void *driverdata, unsigned int flags, isc_mem_t *mctx,
+		     dns_sdbimplementation_t **sdbimp);
+typedef void
+(*dns_sdbunregister_t)(dns_sdbimplementation_t **sdbimp);
+
 isc_result_t
 dns_sdb_register(const char *drivername, const dns_sdbmethods_t *methods,
 		 void *driverdata, unsigned int flags, isc_mem_t *mctx,
@@ -176,8 +176,6 @@ struct dns_view {
 	uint16_t			padding;
 	dns_acl_t *			pad_acl;
 	unsigned int			maxbits;
-	dns_dns64list_t 		dns64;
-	unsigned int 			dns64cnt;
 	dns_rpz_zones_t			*rpzs;
 	dns_catz_zones_t		*catzs;
 	dns_dlzdblist_t 		dlz_searched;
@@ -233,6 +231,8 @@ struct dns_view {
 	dns_dtmsgtype_t			dttypes;	/* Dnstap message types
 							   to log */

+	dns_zonemgr_t			*zonemgr;
+
 	/* Registered module instances */
 	void				*plugins;
 	void				(*plugins_free)(isc_mem_t *, void **);
@@ -1360,6 +1360,14 @@ dns_view_setviewrevert(dns_view_t *view);
 *\li	'view' to be valid.
 */

+void
+dns_view_setzonemgr(dns_view_t *view, dns_zonemgr_t *zonemgr);
+/*%<
+ * Set the view's zone manager.
+ *
+ * Requires:
+ *\li	'view' to be valid.
+ */

 ISC_LANG_ENDDECLS

@@ -1367,7 +1367,7 @@ dns_sdb_create(isc_mem_t *mctx, const dns_name_t *origin, dns_dbtype_t type,
 	sdb->dbdata = NULL;
 	if (imp->methods->create != NULL) {
 		MAYBE_LOCK(sdb);
-		result = imp->methods->create(sdb->zone, argc, argv,
+		result = imp->methods->create(sdb->zone, mctx, argc, argv,
 					      imp->driverdata, &sdb->dbdata);
 		MAYBE_UNLOCK(sdb);
 		if (result != ISC_R_SUCCESS)
@@ -35,7 +35,6 @@
 #include <dns/db.h>
 #include <dns/dispatch.h>
 #include <dns/dlz.h>
-#include <dns/dns64.h>
 #include <dns/dnssec.h>
 #include <dns/events.h>
 #include <dns/forward.h>
@@ -159,8 +158,6 @@ dns_view_create(isc_mem_t *mctx, dns_rdataclass_t rdclass,
 	view->resstats = NULL;
 	view->resquerystats = NULL;
 	view->cacheshared = false;
-	ISC_LIST_INIT(view->dns64);
-	view->dns64cnt = 0;

 	/*
 	 * Initialize configuration data with default values.
@@ -249,6 +246,7 @@ dns_view_create(isc_mem_t *mctx, dns_rdataclass_t rdclass,
 	view->hooktable_free = NULL;

 	isc_mutex_init(&view->new_zone_lock);
+	view->zonemgr = NULL;

 	result = dns_order_create(view->mctx, &view->order);
 	if (result != ISC_R_SUCCESS) {
@@ -334,7 +332,6 @@ dns_view_create(isc_mem_t *mctx, dns_rdataclass_t rdclass,

 static inline void
 destroy(dns_view_t *view) {
-	dns_dns64_t *dns64;
 	dns_dlzdb_t *dlzdb;

 	REQUIRE(!ISC_LINK_LINKED(view, link));
@@ -498,12 +495,6 @@ destroy(dns_view_t *view) {
 		dns_keytable_detach(&view->secroots_priv);
 	if (view->ntatable_priv != NULL)
 		dns_ntatable_detach(&view->ntatable_priv);
-	for (dns64 = ISC_LIST_HEAD(view->dns64);
-	     dns64 != NULL;
-	     dns64 = ISC_LIST_HEAD(view->dns64)) {
-		dns_dns64_unlink(&view->dns64, dns64);
-		dns_dns64_destroy(&dns64);
-	}
 	if (view->managed_keys != NULL)
 		dns_zone_detach(&view->managed_keys);
 	if (view->redirect != NULL)
@@ -541,6 +532,9 @@ destroy(dns_view_t *view) {
 	isc_refcount_destroy(&view->weakrefs);
 	isc_mem_free(view->mctx, view->nta_file);
 	isc_mem_free(view->mctx, view->name);
+	if (view->zonemgr != NULL) {
+		dns_zonemgr_detach(&view->zonemgr);
+	}
 	if (view->hooktable != NULL && view->hooktable_free != NULL) {
 		view->hooktable_free(view->mctx, &view->hooktable);
 	}
@@ -2413,3 +2407,10 @@ dns_view_setviewrevert(dns_view_t *view) {
 		dns_zt_setviewrevert(zonetable);
 	}
 }
+
+void
+dns_view_setzonemgr(dns_view_t *view, dns_zonemgr_t *zonemgr) {
+	REQUIRE(DNS_VIEW_VALID(view));
+
+	dns_zonemgr_attach(zonemgr, &view->zonemgr);
+}
@@ -307,13 +307,6 @@ dns_dlzdestroy
 dns_dlzregister
 dns_dlzstrtoargv
 dns_dlzunregister
-dns_dns64_aaaafroma
-dns_dns64_aaaaok
-dns_dns64_append
-dns_dns64_create
-dns_dns64_destroy
-dns_dns64_next
-dns_dns64_unlink
 dns_dnssec_findmatchingkeys
 dns_dnssec_findzonekeys
 dns_dnssec_keyactive
@@ -1094,6 +1087,7 @@ dns_view_setresstats
 dns_view_setrootdelonly
 dns_view_setviewcommit
 dns_view_setviewrevert
+dns_view_setzonemgr
 dns_view_simplefind
 dns_view_thaw
 dns_view_untrust
@@ -1122,12 +1122,6 @@ zone_free(dns_zone_t *zone) {
 	if (zone->loadtask != NULL) {
 		isc_task_detach(&zone->loadtask);
 	}
-	if (zone->view != NULL) {
-		dns_view_weakdetach(&zone->view);
-	}
-	if (zone->prev_view != NULL) {
-		dns_view_weakdetach(&zone->prev_view);
-	}

 	/* Unmanaged objects */
 	while (!ISC_LIST_EMPTY(zone->setnsec3param_queue)) {
@@ -1250,6 +1244,13 @@ zone_free(dns_zone_t *zone) {
 		isc_stats_detach(&zone->gluecachestats);
 	}

+	if (zone->view != NULL) {
+		dns_view_weakdetach(&zone->view);
+	}
+	if (zone->prev_view != NULL) {
+		dns_view_weakdetach(&zone->prev_view);
+	}
+
 	/* last stuff */
 	ZONEDB_DESTROYLOCK(&zone->dblock);
 	isc_mutex_destroy(&zone->lock);
@@ -1801,30 +1801,6 @@ static cfg_type_t cfg_type_prefetch = {
 	"prefetch", cfg_parse_tuple, cfg_print_tuple, cfg_doc_tuple,
 	&cfg_rep_tuple, prefetch_fields
 };
-/*
- * DNS64.
- */
-static cfg_clausedef_t
-dns64_clauses[] = {
-	{ "break-dnssec", &cfg_type_boolean, 0 },
-	{ "clients", &cfg_type_bracketed_aml, 0 },
-	{ "exclude", &cfg_type_bracketed_aml, 0 },
-	{ "mapped", &cfg_type_bracketed_aml, 0 },
-	{ "recursive-only", &cfg_type_boolean, 0 },
-	{ "suffix", &cfg_type_netaddr6, 0 },
-	{ NULL, NULL, 0 },
-};
-
-static cfg_clausedef_t *
-dns64_clausesets[] = {
-	dns64_clauses,
-	NULL
-};
-
-static cfg_type_t cfg_type_dns64 = {
-	"dns64", cfg_parse_netprefix_map, cfg_print_map, cfg_doc_map,
-	&cfg_rep_map, dns64_clausesets
-};

 /*%
 * Clauses that can be found within the 'view' statement,
@@ -1862,9 +1838,10 @@ view_clauses[] = {
 	{ "disable-ds-digests", &cfg_type_disabledsdigest,
 	  CFG_CLAUSEFLAG_MULTI },
 	{ "disable-empty-zone", &cfg_type_astring, CFG_CLAUSEFLAG_MULTI },
-	{ "dns64", &cfg_type_dns64, CFG_CLAUSEFLAG_MULTI },
-	{ "dns64-contact", &cfg_type_astring, 0 },
-	{ "dns64-server", &cfg_type_astring, 0 },
+	{ "dns64", &cfg_type_bracketed_text,
+	  CFG_CLAUSEFLAG_MULTI|CFG_CLAUSEFLAG_OBSOLETE },
+	{ "dns64-contact", &cfg_type_astring, CFG_CLAUSEFLAG_OBSOLETE },
+	{ "dns64-server", &cfg_type_astring, CFG_CLAUSEFLAG_OBSOLETE },
 #ifdef USE_DNSRPS
 	{ "dnsrps-enable", &cfg_type_boolean, 0 },
 	{ "dnsrps-options", &cfg_type_bracketed_text, 0 },
@@ -33,10 +33,12 @@
 #include <isc/types.h>

 #include <dns/view.h>
+#include <dns/zone.h>

 #include <ns/hooks.h>
 #include <ns/log.h>
 #include <ns/query.h>
+#include <ns/server.h>

 #define CHECK(op)						\
 	do {							\
@@ -411,7 +413,7 @@ ns_plugin_register(const char *modpath, const char *parameters,
 		      "registering plugin '%s'", modpath);

 	CHECK(plugin->register_func(parameters, cfg, cfg_file, cfg_line,
-				    mctx, lctx, actx, view->hooktable,
+				    mctx, lctx, actx, view,
 				    &plugin->inst));

 	ISC_LIST_APPEND(*(ns_plugins_t *)view->plugins, plugin, link);
@@ -21,6 +21,7 @@
 #include <isc/result.h>

 #include <dns/rdatatype.h>
+#include <dns/sdb.h>

 #include <ns/client.h>
 #include <ns/query.h>
@@ -266,7 +267,7 @@ typedef isc_result_t
 ns_plugin_register_t(const char *parameters,
 		     const void *cfg, const char *file, unsigned long line,
 		     isc_mem_t *mctx, isc_log_t *lctx, void *actx,
-		     ns_hooktable_t *hooktable, void **instp);
+		     dns_view_t *view, void **instp);
 /*%<
 * Called when registering a new plugin.
 *
@@ -70,12 +70,6 @@ struct ns_query {
 	isc_bufferlist_t		namebufs;
 	ISC_LIST(ns_dbversion_t)	activeversions;
 	ISC_LIST(ns_dbversion_t)	freeversions;
-	dns_rdataset_t *		dns64_aaaa;
-	dns_rdataset_t *		dns64_sigaaaa;
-	bool *				dns64_aaaaok;
-	unsigned int			dns64_aaaaoklen;
-	unsigned int			dns64_options;
-	unsigned int			dns64_ttl;

 	struct {
 		dns_db_t *      	db;
@@ -111,8 +105,8 @@ struct ns_query {
 #define NS_QUERYATTR_NOADDITIONAL	0x00800
 #define NS_QUERYATTR_CACHEACLOKVALID	0x01000
 #define NS_QUERYATTR_CACHEACLOK		0x02000
-#define NS_QUERYATTR_DNS64		0x04000
-#define NS_QUERYATTR_DNS64EXCLUDE	0x08000
+/* Obsolete: NS_QUERYATTR_DNS64		0x04000 */
+/* Obsolete: NS_QUERYATTR_DNS64EXCLUDE	0x08000 */
 #define NS_QUERYATTR_RRL_CHECKED	0x10000
 #define NS_QUERYATTR_REDIRECT		0x20000

@@ -138,7 +132,7 @@ struct query_ctx {
 	bool is_zone;				/* is DB a zone DB? */
 	bool is_staticstub_zone;
 	bool resuming;				/* resumed from recursion? */
-	bool dns64, dns64_exclude, rpz;
+	bool rpz;
 	bool authoritative;			/* authoritative query? */
 	bool want_restart;			/* CNAME chain or other
 						 * restart needed */
@@ -170,6 +164,8 @@ struct query_ctx {

 	dns_view_t *view;			/* client view */

+	isc_result_t nxresult;			/* NXDOMAIN/NXRRSET */
+
 	isc_result_t result;			/* query result */
 	int line;				/* line to report error */
 };
@@ -243,6 +239,43 @@ ns_query_recurse(ns_client_t *client, dns_rdatatype_t qtype, dns_name_t *qname,
 * recursion completes.
 */

+isc_result_t
+ns_query_lookup(query_ctx_t *qctx);
+/*%<
+ * Perform a local database lookup, in either an authoritative or
+ * cache database. If unable to answer, call ns_query_done(); otherwise
+ * hand off processing to query_gotanswer().
+ */
+
+isc_result_t
+ns_query_addsoa(query_ctx_t *qctx, dns_ttl_t ttl, dns_section_t section);
+/*%<
+ * Add SOA to the authority section when sending negative responses
+ * (or to the additional section if sending negative responses triggered
+ * by RPZ rewriting.)
+ */
+
+isc_result_t
+ns_query_nodata(query_ctx_t *qctx);
+/*%<
+ * Handle authoritative NOERROR/NODATA responses.
+ */
+
+isc_result_t
+ns_query_ncache(query_ctx_t *qctx);
+/*%<
+ * Handle negative cache responses, DNS_R_NCACHENXRRSET or
+ * DNS_R_NCACHENXDOMAIN. (Note: may be called with other
+ * result codes as a result of hook actions; for example,
+ * DNS64 may call with DNS_R_NXOMAIN.)
+ */
+
+void
+ns_query_setorder(ns_client_t *client, dns_name_t *name,
+		  dns_rdataset_t *rdataset);
+/*%<
+ * Set the ordering for 'rdataset'.
+ */

 isc_result_t
 ns__query_sfcache(query_ctx_t *qctx);
@@ -79,11 +79,16 @@ ns_plugin_expandpath
 ns_plugin_register
 ns_plugins_create
 ns_plugins_free
+ns_query_addsoa
 ns_query_cancel
 ns_query_done
 ns_query_free
 ns_query_init
+ns_query_lookup
+ns_query_ncache
+ns_query_nodata
 ns_query_recurse
+ns_query_setorder
 ns_query_start
 ns_server_attach
 ns_server_create
@@ -244,6 +244,10 @@
 ./bin/pkcs11/win32/pk11tokens.vcxproj.filters.in	X	2014,2015,2018,2019
 ./bin/pkcs11/win32/pk11tokens.vcxproj.in	X	2014,2015,2016,2017,2018,2019
 ./bin/pkcs11/win32/pk11tokens.vcxproj.user	X	2014,2018,2019
+./bin/plugins/dns64.8				MAN	DOCBOOK
+./bin/plugins/dns64.c				C	2019
+./bin/plugins/dns64.docbook			SGML	2019
+./bin/plugins/dns64.html			HTML	DOCBOOK
 ./bin/plugins/filter-aaaa.8			MAN	DOCBOOK
 ./bin/plugins/filter-aaaa.c			C	2018,2019
 ./bin/plugins/filter-aaaa.docbook		SGML	2018,2019
@@ -1421,6 +1425,7 @@
 ./doc/arm/man.ddns-confgen.html			X	2009,2010,2011,2012,2013,2014,2015,2016,2017,2018,2019
 ./doc/arm/man.delv.html				X	2014,2015,2016,2017,2018,2019
 ./doc/arm/man.dig.html				X	2005,2006,2007,2008,2009,2010,2011,2012,2013,2014,2015,2016,2017,2018,2019
+./doc/arm/man.dns64.html			X	2019
 ./doc/arm/man.dnssec-cds.html			X	2017,2018,2019
 ./doc/arm/man.dnssec-checkds.html		X	2013,2014,2015,2016,2017,2018,2019
 ./doc/arm/man.dnssec-coverage.html		X	2013,2014,2015,2016,2017,2018,2019
@@ -1599,7 +1604,6 @@
 ./lib/dns/diff.c				C	2000,2001,2002,2003,2004,2005,2007,2008,2009,2011,2013,2014,2015,2016,2017,2018,2019
 ./lib/dns/dispatch.c				C	1999,2000,2001,2002,2003,2004,2005,2006,2007,2008,2009,2011,2012,2013,2014,2015,2016,2017,2018,2019
 ./lib/dns/dlz.c					C.PORTION	1999,2000,2001,2005,2007,2009,2010,2011,2012,2013,2015,2016,2018,2019
-./lib/dns/dns64.c				C	2010,2011,2014,2016,2017,2018,2019
 ./lib/dns/dnsrps.c				C	2017,2018,2019
 ./lib/dns/dnssec.c				C	1999,2000,2001,2002,2003,2004,2005,2006,2007,2008,2009,2010,2011,2012,2013,2014,2015,2016,2017,2018,2019
 ./lib/dns/dnstap.c				C	2015,2016,2017,2018,2019
@@ -1643,7 +1647,6 @@
 ./lib/dns/include/dns/dispatch.h		C	1999,2000,2001,2002,2003,2004,2005,2006,2007,2008,2009,2011,2012,2013,2014,2015,2016,2017,2018,2019
 ./lib/dns/include/dns/dlz.h			C.PORTION	1999,2000,2001,2005,2006,2007,2009,2010,2011,2012,2013,2016,2018,2019
 ./lib/dns/include/dns/dlz_dlopen.h		C	2011,2012,2013,2016,2017,2018,2019
-./lib/dns/include/dns/dns64.h			C	2010,2014,2016,2018,2019
 ./lib/dns/include/dns/dnsrps.h			C	2017,2018,2019
 ./lib/dns/include/dns/dnssec.h			C	1999,2000,2001,2002,2004,2005,2006,2007,2009,2010,2011,2012,2013,2014,2015,2016,2018,2019
 ./lib/dns/include/dns/dnstap.h			C	2015,2016,2017,2018,2019
Author	SHA1	Message	Date
Evan Hunt	7fbd9b760d	make named-checkconf able to check dns64 module parameters - restored the checkconf test cases from the dns64 system test - implemented plugin_check() in the dns64 module	2019-08-30 15:27:56 -07:00
Evan Hunt	c8f36b448a	support dns64 modules in multiple views - add a test with two dns64 configurations in separate views. - set up a single SDB _dns64 implementation only once on the first load of the dns64 module, and tear it down on the last unload; this prevents a failure when attempting to register the SDB twice. - in zone_free(), detach the view after detachiing the zone database, to prevent an occasional shutdown race in which the SDB implementation was deleted before the zone was shut down.	2019-08-30 15:27:56 -07:00
Evan Hunt	9fb732f825	restore syntax checking for dns64 parameters - note: syntax is currently only checked when loading the module from named. later, this will be added to named-checkconf as well.	2019-08-30 15:27:50 -07:00
Evan Hunt	3149940dbe	allow filter-aaaa and dns64 modules to be configured in either order - this is done by having dns64 abort before ns_query_lookup() if the client is already recursing. - I'm not entirely satisfied with this solution: I would prefer the modules to be totally independent, not to be written to make allowances for each other. but, it's an effective workaround.	2019-08-30 15:25:56 -07:00
Evan Hunt	13b155e17a	move dns64 SDB zone implementation into module - remove _dns64 SDB implementation from bin/named/builtin.c and add it to the dbs64 module implementation. load and unload a copy of the implementation for each instance of the dyndb module.	2019-08-30 15:25:56 -07:00
Evan Hunt	1ded6bbe65	revise dns64 module to support multiple module instances - this enables the use of more than one dns64 block in the same named.conf. instead of having a single hash table and memory pool shared by all instances of dns64, set up unique ones for each instance and store them in an instance structure which is passed to hook functions as action_data. - also removed some hook actions from dns64 that turned out not to be needed.	2019-08-30 15:25:53 -07:00
Evan Hunt	3b02c4055c	continue migration of dns64 code into module - added a persistent-data memory pool to the module. - removed dns64 fields from ns_client_t and query_ctx_t. - removed DNS64 flags from client attributes.	2019-08-30 15:25:26 -07:00
Evan Hunt	58a463d1b8	continue with implementation of dns64 as an external module - namedconf.c now has dns64-related options flagged as obsolete. - lib/dns/dns64.c and lib/dns/include/dns/dns64.h are gone. their code has been migrated into bin/plugins/dns64.c, with corresponding nomenclature changes, and some style cleanup. - dns64-related fields have been removed from the dns_view struct. - dns64 configuration parsing code has been moved from named into the plugin module. - checkconf tests have been removed from the dns64 system test these will be restored later, when named-checkconf has been modified to be able to load plugin modules and check their configuration syntax. - dns64-related configuration checks have been removed from lib/bind9/check.c. - zonemgr is now attached to the view so that modules will be able to access it.	2019-08-30 15:25:23 -07:00
Evan Hunt	87997fdcbf	move DNS64 implementation into an external module - dns64 implementation has been moved from query.c to the dns64 module. - the code in lib/dns/dns64.c has not yet been moved. - the module does not yet parse dns64 options in named.conf; that's still done by named. - the module does not have persistent storage; we still use the client object. - made more functions globally accessible so they can be called from modules: ns_query_lookup(), ns_query_addsoa(), ns_query_nodata(), ns_query_ncache(), ns_query_setorder().	2019-08-30 15:13:38 -07:00
Evan Hunt	d5678b2898	move dns64 implementation into hook functions (still local to query.c) - this is a temporary step. refactor the dns64 implementation into hook functions declared locally, which will be moved to a module later.	2019-08-30 15:12:32 -07:00
Evan Hunt	5ed00e8132	move dns64 fields from client->query to client - this is temporary: the fields will be moved into the dns64 module later.	2019-08-30 15:11:38 -07:00
Evan Hunt	3a7bdc6e11	simplification: search on rpz_st.p_name whenever RPZ is in use - this is part of an effort to reduce interdependency between dns64 and other features, so that dns64 can more easily be compartmentalized into a module. - this change keeps us from having to know whether dns64 is in use when updating the name to be searched for in query_lookup() because of RPZ processing. it seems to have no ill effects. - also incorporated the test case from the CVE-2017-3135, which related to simultaneous use of dns64 and rpz.	2019-08-30 15:11:38 -07:00