win32/socket should use common isc_socket

.gitignore

@@ -62,4 +62,3 @@ unit/atf-src/test-programs/sh_helpers
 .project
 .cproject
 .settings
-kyua.log

.gitlab-ci.yml

@@ -257,7 +257,6 @@ build:debian:jessie:amd64:
   variables:
     CC: gcc
     CFLAGS: "-Wall -Wextra -O2 -g"
-    EXTRA_CONFIGURE: --without-cmocka
   <<: *debian_jessie_amd64_image
   <<: *build_job
 

.gitlab/issue_templates/release.md

@@ -29,4 +29,3 @@
  - [ ] (Manager) Inform marketing of the release
 
  - [ ] (SwEng) Update DEB and RPM packages
- - [ ] (SwEng) Merge the automatically prepared `prep 9.X.Y` commit which updates `version` and documentation on the release branch into the relevant maintenance branch (`v9_X`)

CHANGES

@@ -1,70 +1,3 @@
-5072.	[bug]		Add unit tests for isc_buffer_copyregion() and fix its
-			behavior for auto-reallocated buffers. [GL #644]
-
-5071.	[bug]		Comparision of NXT records was broken. [GL #631]
-
-5070.	[bug]		Record types which support a empty rdata field were
-			not handling the empty rdata field case. [GL #638]
-
-5069.	[bug]		Fix a hang on in RPZ when named is shutdown during RPZ
-			zone update. [GL !907]
-
-5068.	[bug]		Fix a race in RPZ with min-update-interval set to 0.
-			[GL #643]
-
-5067.	[bug]		Don't minimize qname when sending the query
-			to a forwarder. [GL #361]
-
-5066.	[cleanup]	Allow unquoted strings to be used as a zone names
-			in response-policy statements. [GL #641]
-
-5065.	[bug]		Only set IPV6_USE_MIN_MTU on IPv6. [GL #553]
-
-5064.	[test]		Initalize TZ environment variable before calling
-			dns_test_begin in dnstap_test. [GL #624]
-
-5063.	[test]		In statschannel test try a few times before failing
-			when checking if the compressed output is the same as
-			uncompressed. [GL !909]
-
-5062.	[func]		Use non-crypto-secure PRNG to generate nonces for
-			cookies. [GL !887]
-
-5061.	[protocol]	Add support for EID and NIMLOC. [GL #626]
-
-5060.	[bug]		GID, UID and UINFO could not be loaded using unknown
-			record format. [GL #627]
-
-5059.	[bug]		Display a per-view list of zones in the web interface.
-			[GL #427]
-
-5058.	[func]		Replace old message digest and hmac APIs with more
-			generic isc_md and isc_hmac APIs, and convert their
-			respective tests to cmocka. [GL #305]
-
-5057.	[protocol]	Add support for ATMA. [GL #619]
-
-5056.	[placeholder]
-
-5055.	[func]		A default list of primary servers for the root zone is
-			now built into named, allowing the "masters" statement
-			to be omitted when configuring an IANA root zone
-			mirror. [GL #564]
-
-5054.	[func]		Attempts to use mirror zones with recursion disabled
-			are now considered a configuration error. [GL #564]
-
-5053.	[func]		The only valid zone-level NOTIFY settings for mirror
-			zones are now "notify no;" and "notify explicit;".
-			[GL #564]
-
-5052.	[func]		Mirror zones are now configured using "type mirror;"
-			rather than "mirror yes;". [GL #564]
-
-5051.	[doc]		Documentation incorrectly stated that the
-			"server-addresses" static-stub zone option accepts
-			custom port numbers. [GL #582]
-
 5050.	[bug]		The libirs version of getaddrinfo() was unable to parse
 			scoped IPv6 addresses present in /etc/resolv.conf.
 			[GL #187]
@@ -248,7 +181,7 @@
 5000.	[bug]		named_server_servestale() could leave the server in
 			exclusive mode if an error occured. [GL #441]
 
-4999.	[cleanup]	Remove custom printf implementation in lib/isc/print.c.
+4999.	[cleanup]	Remove custom printf implementaion in lib/isc/print.c.
 			[GL #261]
 
 4998.	[test]		Make resolver and cacheclean tests more civilized.

bin/dnssec/dnssec-keyfromlabel.c

@@ -64,8 +64,8 @@ usage(void) {
 	fprintf(stderr, "    name: owner of the key\n");
 	fprintf(stderr, "Other options:\n");
 	fprintf(stderr, "    -a algorithm: \n"
-			"        RSA | RSAMD5 | DH | RSASHA1 |\n"
-			"        NSEC3RSASHA1 |\n"
+			"        RSA | RSAMD5 | DH | DSA | RSASHA1 |\n"
+			"        NSEC3DSA | NSEC3RSASHA1 |\n"
 			"        RSASHA256 | RSASHA512 |\n"
 			"        ECDSAP256SHA256 | ECDSAP384SHA384\n");
 	fprintf(stderr, "    -3: use NSEC3-capable algorithm\n");
@@ -402,9 +402,13 @@ main(int argc, char **argv) {
 
 		if (use_nsec3) {
 			switch (alg) {
+			case DST_ALG_DSA:
+				alg = DST_ALG_NSEC3DSA;
+				break;
 			case DST_ALG_RSASHA1:
 				alg = DST_ALG_NSEC3RSASHA1;
 				break;
+			case DST_ALG_NSEC3DSA:
 			case DST_ALG_NSEC3RSASHA1:
 			case DST_ALG_RSASHA256:
 			case DST_ALG_RSASHA512:

bin/dnssec/dnssec-keyfromlabel.docbook

@@ -106,7 +106,7 @@
 	  <para>
 	    Selects the cryptographic algorithm.  The value of
 	    <option>algorithm</option> must be one of RSAMD5, RSASHA1,
-	    NSEC3RSASHA1, RSASHA256, RSASHA512,
+	    DSA, NSEC3RSASHA1, NSEC3DSA, RSASHA256, RSASHA512,
 	    ECDSAP256SHA256, ECDSAP384SHA384, ED25519 or ED448.
 	  </para>
 	  <para>
@@ -119,9 +119,9 @@
 	  <para>
 	    These values are case insensitive. In some cases, abbreviations
 	    are supported, such as ECDSA256 for ECDSAP256SHA256 and
-	    ECDSA384 for ECDSAP384SHA384. If RSASHA1 is specified
+	    ECDSA384 for ECDSAP384SHA384. If RSASHA1 or DSA is specified
 	    along with the <option>-3</option> option, then NSEC3RSASHA1
-	    will be used instead.
+	    or NSEC3DSA will be used instead.
 	  </para>
 	  <para>
 	    As of BIND 9.12.0, this option is mandatory except when using

bin/dnssec/dnssec-keygen.c

@@ -79,8 +79,8 @@ usage(void) {
 	fprintf(stderr, "Options:\n");
 	fprintf(stderr, "    -K <directory>: write keys into directory\n");
 	fprintf(stderr, "    -a <algorithm>:\n");
-	fprintf(stderr, "        RSA | RSAMD5 | RSASHA1 | NSEC3RSASHA1"
-				" |\n");
+	fprintf(stderr, "        RSA | RSAMD5 | DSA | RSASHA1 | NSEC3RSASHA1"
+				" | NSEC3DSA |\n");
 	fprintf(stderr, "        RSASHA256 | RSASHA512 |\n");
 	fprintf(stderr, "        ECDSAP256SHA256 | ECDSAP384SHA384 |\n");
 	fprintf(stderr, "        ED25519 | ED448 | DH\n");
@@ -92,6 +92,10 @@ usage(void) {
 	fprintf(stderr, "        RSASHA256:\t[1024..%d]\n", MAX_RSA);
 	fprintf(stderr, "        RSASHA512:\t[1024..%d]\n", MAX_RSA);
 	fprintf(stderr, "        DH:\t\t[128..4096]\n");
+	fprintf(stderr, "        DSA:\t\t[512..1024] and divisible by 64\n");
+	fprintf(stderr, "        NSEC3DSA:\t[512..1024] and divisible "
+				"by 64\n");
+	fprintf(stderr, "        ECCGOST:\tignored\n");
 	fprintf(stderr, "        ECDSAP256SHA256:\tignored\n");
 	fprintf(stderr, "        ECDSAP384SHA384:\tignored\n");
 	fprintf(stderr, "        ED25519:\tignored\n");
@@ -157,6 +161,11 @@ usage(void) {
 	exit (-1);
 }
 
+static bool
+dsa_size_ok(int size) {
+	return (size >= 512 && size <= 1024 && size % 64 == 0);
+}
+
 static void
 progress(int p)
 {
@@ -533,12 +542,17 @@ main(int argc, char **argv) {
 
 		if (use_nsec3) {
 			switch (alg) {
+			case DST_ALG_DSA:
+				alg = DST_ALG_NSEC3DSA;
+				break;
 			case DST_ALG_RSASHA1:
 				alg = DST_ALG_NSEC3RSASHA1;
 				break;
+			case DST_ALG_NSEC3DSA:
 			case DST_ALG_NSEC3RSASHA1:
 			case DST_ALG_RSASHA256:
 			case DST_ALG_RSASHA512:
+			case DST_ALG_ECCGOST:
 			case DST_ALG_ECDSA256:
 			case DST_ALG_ECDSA384:
 			case DST_ALG_ED25519:
@@ -584,6 +598,7 @@ main(int argc, char **argv) {
 							" to %d\n", size);
 				}
 				break;
+			case DST_ALG_ECCGOST:
 			case DST_ALG_ECDSA256:
 			case DST_ALG_ECDSA384:
 			case DST_ALG_ED25519:
@@ -713,6 +728,14 @@ main(int argc, char **argv) {
 		if (size != 0 && (size < 128 || size > 4096))
 			fatal("DH key size %d out of range", size);
 		break;
+	case DNS_KEYALG_DSA:
+	case DNS_KEYALG_NSEC3DSA:
+		if (size != 0 && !dsa_size_ok(size))
+			fatal("invalid DSS key size: %d", size);
+		break;
+	case DST_ALG_ECCGOST:
+		size = 256;
+		break;
 	case DST_ALG_ECDSA256:
 		size = 256;
 		break;
@@ -792,6 +815,9 @@ main(int argc, char **argv) {
 		param = generator;
 		break;
 
+	case DNS_KEYALG_DSA:
+	case DNS_KEYALG_NSEC3DSA:
+	case DST_ALG_ECCGOST:
 	case DST_ALG_ECDSA256:
 	case DST_ALG_ECDSA384:
 	case DST_ALG_ED25519:

bin/dnssec/dnssec-keygen.docbook

@@ -123,7 +123,7 @@
 	  <para>
 	    Selects the cryptographic algorithm.  For DNSSEC keys, the value
 	    of <option>algorithm</option> must be one of RSAMD5, RSASHA1,
-	    NSEC3RSASHA1, RSASHA256, RSASHA512,
+	    DSA, NSEC3RSASHA1, NSEC3DSA, RSASHA256, RSASHA512,
 	    ECDSAP256SHA256, ECDSAP384SHA384, ED25519 or ED448.  For
 	    TKEY, the value must be DH (Diffie Hellman); specifying
 	    his value will automatically set the <option>-T KEY</option>
@@ -132,9 +132,9 @@
 	  <para>
 	    These values are case insensitive. In some cases, abbreviations
 	    are supported, such as ECDSA256 for ECDSAP256SHA256 and
-	    ECDSA384 for ECDSAP384SHA384. If RSASHA1 is specified
+	    ECDSA384 for ECDSAP384SHA384. If RSASHA1 or DSA is specified
 	    along with the <option>-3</option> option, then NSEC3RSASHA1
-	    will be used instead.
+	    or NSEC3DSA will be used instead.
 	  </para>
 	  <para>
 	    This parameter <emphasis>must</emphasis> be specified except

bin/dnssec/dnssec-signzone.c

@@ -40,7 +40,6 @@
 #include <isc/file.h>
 #include <isc/hash.h>
 #include <isc/hex.h>
-#include <isc/md.h>
 #include <isc/mem.h>
 #include <isc/mutex.h>
 #include <isc/os.h>

bin/named/bind9.xsl

@@ -198,25 +198,6 @@
       background-color: #99ddff;
      }
 
-     table.zones {
-      border: 1px solid grey;
-      width: 500px;
-     }
-     table.zones th {
-      text-align: center;
-      border: 1px solid grey;
-     }
-     table.zones td {
-      text-align: center;
-      font-family: monospace;
-     }
-     table.zones td:nth-child(1) {
-      text-align: right;
-     }
-     table.zones td:nth-child(4) {
-      text-align: right;
-     }
-
      .totals {
       background-color: rgb(1,169,206);
       color: #ffffff;
@@ -724,35 +705,6 @@
           </table>
           <br/>
         </xsl:if>
-        <xsl:for-each select="views/view">
-	  <xsl:if test="zones/zone">
-            <h3>Zones for View <xsl:value-of select="@name"/></h3>
-            <table class="zones">
-              <tr>
-                <th>Name</th>
-                <th>Class</th>
-                <th>Type</th>
-                <th>Serial</th>
-              </tr>
-              <xsl:for-each select="zones/zone">
-                <tr>
-                  <td>
-                    <xsl:value-of select="@name"/>
-                  </td>
-                  <td>
-                    <xsl:value-of select="@rdataclass"/>
-                  </td>
-                  <td>
-                    <xsl:value-of select="type"/>
-                  </td>
-                  <td>
-                    <xsl:value-of select="serial"/>
-                  </td>
-                </tr>
-              </xsl:for-each>
-            </table>
-	  </xsl:if>
-        </xsl:for-each>
         <xsl:if test="views/view[zones/zone/counters[@type=&quot;qtype&quot;]/counter &gt;0]">
           <h2>Received QTYPES per view/zone</h2>
           <xsl:for-each select="views/view[zones/zone/counters[@type=&quot;qtype&quot;]/counter &gt;0]">

bin/named/bind9.xsl.h

@@ -203,25 +203,6 @@ static char xslmsg[] =
 	" background-color: #99ddff;\n"
 	" }\n"
 	"\n"
-	" table.zones {\n"
-	" border: 1px solid grey;\n"
-	" width: 500px;\n"
-	" }\n"
-	" table.zones th {\n"
-	" text-align: center;\n"
-	" border: 1px solid grey;\n"
-	" }\n"
-	" table.zones td {\n"
-	" text-align: center;\n"
-	" font-family: monospace;\n"
-	" }\n"
-	" table.zones td:nth-child(1) {\n"
-	" text-align: right;\n"
-	" }\n"
-	" table.zones td:nth-child(4) {\n"
-	" text-align: right;\n"
-	" }\n"
-	"\n"
 	" .totals {\n"
 	" background-color: rgb(1,169,206);\n"
 	" color: #ffffff;\n"
@@ -729,35 +710,6 @@ static char xslmsg[] =
 	" </table>\n"
 	" <br/>\n"
 	" </xsl:if>\n"
-	" <xsl:for-each select=\"views/view\">\n"
-	" <xsl:if test=\"zones/zone\">\n"
-	" <h3>Zones for View <xsl:value-of select=\"@name\"/></h3>\n"
-	" <table class=\"zones\">\n"
-	" <tr>\n"
-	" <th>Name</th>\n"
-	" <th>Class</th>\n"
-	" <th>Type</th>\n"
-	" <th>Serial</th>\n"
-	" </tr>\n"
-	" <xsl:for-each select=\"zones/zone\">\n"
-	" <tr>\n"
-	" <td>\n"
-	" <xsl:value-of select=\"@name\"/>\n"
-	" </td>\n"
-	" <td>\n"
-	" <xsl:value-of select=\"@rdataclass\"/>\n"
-	" </td>\n"
-	" <td>\n"
-	" <xsl:value-of select=\"type\"/>\n"
-	" </td>\n"
-	" <td>\n"
-	" <xsl:value-of select=\"serial\"/>\n"
-	" </td>\n"
-	" </tr>\n"
-	" </xsl:for-each>\n"
-	" </table>\n"
-	" </xsl:if>\n"
-	" </xsl:for-each>\n"
 	" <xsl:if test=\"views/view[zones/zone/counters[@type=&quot;qtype&quot;]/counter &gt;0]\">\n"
 	" <h2>Received QTYPES per view/zone</h2>\n"
 	" <xsl:for-each select=\"views/view[zones/zone/counters[@type=&quot;qtype&quot;]/counter &gt;0]\">\n"

bin/named/config.c

@@ -301,21 +301,6 @@ view \"_bind\" chaos {\n\
 MANAGED_KEYS
 
 "# END MANAGED KEYS\n\
-\n\
-masters " DEFAULT_IANA_ROOT_ZONE_MASTERS " {\n\
-	2001:500:84::b;		# b.root-servers.net\n\
-	2001:500:2f::f;		# f.root-servers.net\n\
-	2001:7fd::1;		# k.root-servers.net\n\
-	2620:0:2830:202::132;	# xfr.cjr.dns.icann.org\n\
-	2620:0:2d0:202::132;	# xfr.lax.dns.icann.org\n\
-	192.228.79.201;		# b.root-servers.net\n\
-	192.33.4.12;		# c.root-servers.net\n\
-	192.5.5.241;		# f.root-servers.net\n\
-	192.112.36.4;		# g.root-servers.net\n\
-	193.0.14.129;		# k.root-servers.net\n\
-	192.0.47.132;		# xfr.cjr.dns.icann.org\n\
-	192.0.32.132;		# xfr.lax.dns.icann.org\n\
-};\n\
 ";
 
 isc_result_t
@@ -447,8 +432,6 @@ named_config_getzonetype(const cfg_obj_t *zonetypeobj) {
 		   strcasecmp(str, "slave") == 0)
 	{
 		ztype = dns_zone_slave;
-	} else if (strcasecmp(str, "mirror") == 0) {
-		ztype = dns_zone_mirror;
 	} else if (strcasecmp(str, "stub") == 0) {
 		ztype = dns_zone_stub;
 	} else if (strcasecmp(str, "static-stub") == 0) {
@@ -570,9 +553,9 @@ named_config_putiplist(isc_mem_t *mctx, isc_sockaddr_t **addrsp,
 	}
 }
 
-isc_result_t
-named_config_getmastersdef(const cfg_obj_t *cctx, const char *name,
-			   const cfg_obj_t **ret)
+static isc_result_t
+get_masters_def(const cfg_obj_t *cctx, const char *name,
+		const cfg_obj_t **ret)
 {
 	isc_result_t result;
 	const cfg_obj_t *masters = NULL;
@@ -714,8 +697,7 @@ named_config_getipandkeylist(const cfg_obj_t *config, const cfg_obj_t *list,
 					break;
 			if (j < l)
 				continue;
-			tresult = named_config_getmastersdef(config, listname,
-							     &list);
+			tresult = get_masters_def(config, listname, &list);
 			if (tresult == ISC_R_NOTFOUND) {
 				cfg_obj_log(addr, named_g_lctx, ISC_LOG_ERROR,
 				    "masters \"%s\" not found", listname);

bin/named/include/named/config.h

@@ -22,8 +22,6 @@
 #include <dns/types.h>
 #include <dns/zone.h>
 
-#define DEFAULT_IANA_ROOT_ZONE_MASTERS "_default_iana_root_zone_masters"
-
 isc_result_t
 named_config_parsedefaults(cfg_parser_t *parser, cfg_obj_t **conf);
 
@@ -59,10 +57,6 @@ void
 named_config_putiplist(isc_mem_t *mctx, isc_sockaddr_t **addrsp,
 		    isc_dscp_t **dscpsp, uint32_t count);
 
-isc_result_t
-named_config_getmastersdef(const cfg_obj_t *cctx, const char *name,
-			   const cfg_obj_t **ret);
-
 isc_result_t
 named_config_getipandkeylist(const cfg_obj_t *config, const cfg_obj_t *list,
 			  isc_mem_t *mctx, dns_ipkeylist_t *ipkl);

bin/named/main.c

@@ -793,10 +793,7 @@ create_managers(void) {
 	named_g_udpdisp = 1;
 #else
 	if (named_g_udpdisp == 0) {
-		if (named_g_cpus_detected == 1)
-			named_g_udpdisp = 1;
-		else
-			named_g_udpdisp = named_g_cpus_detected - 1;
+		named_g_udpdisp = named_g_cpus_detected;
 	}
 	if (named_g_udpdisp > named_g_cpus)
 		named_g_udpdisp = named_g_cpus;
@@ -824,7 +821,7 @@ create_managers(void) {
 	}
 
 	result = isc_socketmgr_create2(named_g_mctx, &named_g_socketmgr,
-				       maxsocks);
+				       maxsocks, named_g_udpdisp);
 	if (result != ISC_R_SUCCESS) {
 		UNEXPECTED_ERROR(__FILE__, __LINE__,
 				 "isc_socketmgr_create() failed: %s",
@@ -1335,6 +1332,9 @@ main(int argc, char *argv[]) {
 	if (result != ISC_R_SUCCESS)
 		named_main_earlyfatal("program name too long");
 
+	if (result != ISC_R_SUCCESS)
+		named_main_earlyfatal("failed to build internal symbol table");
+
 	isc_assertion_setcallback(assertion_failed);
 	isc_error_setfatal(library_fatal_error);
 	isc_error_setunexpected(library_unexpected_error);

bin/named/named.conf.5

@@ -884,6 +884,7 @@ view \fIstring\fR [ \fIclass\fR ] {
 		max\-zone\-ttl ( unlimited | \fIttlval\fR );
 		min\-refresh\-time \fIinteger\fR;
 		min\-retry\-time \fIinteger\fR;
+		mirror \fIboolean\fR;
 		multi\-master \fIboolean\fR;
 		notify ( explicit | master\-only | \fIboolean\fR );
 		notify\-delay \fIinteger\fR;
@@ -898,7 +899,8 @@ view \fIstring\fR [ \fIclass\fR ] {
 		request\-expire \fIboolean\fR;
 		request\-ixfr \fIboolean\fR;
 		serial\-update\-method ( date | increment | unixtime );
-		server\-addresses { ( \fIipv4_address\fR | \fIipv6_address\fR ); \&.\&.\&. };
+		server\-addresses { ( \fIipv4_address\fR | \fIipv6_address\fR ) [
+		    port \fIinteger\fR ]; \&.\&.\&. };
 		server\-names { \fIstring\fR; \&.\&.\&. };
 		sig\-signing\-nodes \fIinteger\fR;
 		sig\-signing\-signatures \fIinteger\fR;
@@ -909,7 +911,7 @@ view \fIstring\fR [ \fIclass\fR ] {
 		transfer\-source\-v6 ( \fIipv6_address\fR | * ) [ port (
 		    \fIinteger\fR | * ) ] [ dscp \fIinteger\fR ];
 		try\-tcp\-refresh \fIboolean\fR;
-		type ( primary | master | secondary | slave | mirror |
+		type ( primary | master | secondary | slave |
 		    delegation\-only | forward | hint | redirect |
 		    static\-stub | stub );
 		update\-check\-ksk \fIboolean\fR;
@@ -992,6 +994,7 @@ zone \fIstring\fR [ \fIclass\fR ] {
 	max\-zone\-ttl ( unlimited | \fIttlval\fR );
 	min\-refresh\-time \fIinteger\fR;
 	min\-retry\-time \fIinteger\fR;
+	mirror \fIboolean\fR;
 	multi\-master \fIboolean\fR;
 	notify ( explicit | master\-only | \fIboolean\fR );
 	notify\-delay \fIinteger\fR;
@@ -1004,7 +1007,8 @@ zone \fIstring\fR [ \fIclass\fR ] {
 	request\-expire \fIboolean\fR;
 	request\-ixfr \fIboolean\fR;
 	serial\-update\-method ( date | increment | unixtime );
-	server\-addresses { ( \fIipv4_address\fR | \fIipv6_address\fR ); \&.\&.\&. };
+	server\-addresses { ( \fIipv4_address\fR | \fIipv6_address\fR ) [ port
+	    \fIinteger\fR ]; \&.\&.\&. };
 	server\-names { \fIstring\fR; \&.\&.\&. };
 	sig\-signing\-nodes \fIinteger\fR;
 	sig\-signing\-signatures \fIinteger\fR;
@@ -1015,9 +1019,8 @@ zone \fIstring\fR [ \fIclass\fR ] {
 	transfer\-source\-v6 ( \fIipv6_address\fR | * ) [ port ( \fIinteger\fR | * )
 	    ] [ dscp \fIinteger\fR ];
 	try\-tcp\-refresh \fIboolean\fR;
-	type ( primary | master | secondary | slave | mirror |
-	    delegation\-only | forward | hint | redirect | static\-stub |
-	    stub );
+	type ( primary | master | secondary | slave | delegation\-only |
+	    forward | hint | redirect | static\-stub | stub );
 	update\-check\-ksk \fIboolean\fR;
 	update\-policy ( local | { ( deny | grant ) \fIstring\fR ( 6to4\-self |
 	    external | krb5\-self | krb5\-subdomain | ms\-self | ms\-subdomain

bin/named/named.conf.docbook

@@ -13,7 +13,7 @@
 
 <refentry xmlns:db="http://docbook.org/ns/docbook" version="5.0" xml:id="man.named.conf">
   <info>
-    <date>2018-10-23</date>
+    <date>2018-09-04</date>
   </info>
   <refentryinfo>
     <corpname>ISC</corpname>
@@ -341,6 +341,7 @@ options {
 	min-retry-time <replaceable>integer</replaceable>;
 	minimal-any <replaceable>boolean</replaceable>;
 	minimal-responses ( no-auth | no-auth-recursive | <replaceable>boolean</replaceable> );
+	mirror <replaceable>boolean</replaceable>;
 	multi-master <replaceable>boolean</replaceable>;
 	new-zones-directory <replaceable>quoted_string</replaceable>;
 	no-case-compress { <replaceable>address_match_element</replaceable>; ... };
@@ -672,6 +673,7 @@ view <replaceable>string</replaceable> [ <replaceable>class</replaceable> ] {
 	min-retry-time <replaceable>integer</replaceable>;
 	minimal-any <replaceable>boolean</replaceable>;
 	minimal-responses ( no-auth | no-auth-recursive | <replaceable>boolean</replaceable> );
+	mirror <replaceable>boolean</replaceable>;
 	multi-master <replaceable>boolean</replaceable>;
 	new-zones-directory <replaceable>quoted_string</replaceable>;
 	no-case-compress { <replaceable>address_match_element</replaceable>; ... };
@@ -862,6 +864,7 @@ view <replaceable>string</replaceable> [ <replaceable>class</replaceable> ] {
 		max-zone-ttl ( unlimited | <replaceable>ttlval</replaceable> );
 		min-refresh-time <replaceable>integer</replaceable>;
 		min-retry-time <replaceable>integer</replaceable>;
+		mirror <replaceable>boolean</replaceable>;
 		multi-master <replaceable>boolean</replaceable>;
 		notify ( explicit | master-only | <replaceable>boolean</replaceable> );
 		notify-delay <replaceable>integer</replaceable>;
@@ -876,7 +879,8 @@ view <replaceable>string</replaceable> [ <replaceable>class</replaceable> ] {
 		request-expire <replaceable>boolean</replaceable>;
 		request-ixfr <replaceable>boolean</replaceable>;
 		serial-update-method ( date | increment | unixtime );
-		server-addresses { ( <replaceable>ipv4_address</replaceable> | <replaceable>ipv6_address</replaceable> ); ... };
+		server-addresses { ( <replaceable>ipv4_address</replaceable> | <replaceable>ipv6_address</replaceable> ) [
+		    port <replaceable>integer</replaceable> ]; ... };
 		server-names { <replaceable>string</replaceable>; ... };
 		sig-signing-nodes <replaceable>integer</replaceable>;
 		sig-signing-signatures <replaceable>integer</replaceable>;
@@ -887,7 +891,7 @@ view <replaceable>string</replaceable> [ <replaceable>class</replaceable> ] {
 		transfer-source-v6 ( <replaceable>ipv6_address</replaceable> | * ) [ port (
 		    <replaceable>integer</replaceable> | * ) ] [ dscp <replaceable>integer</replaceable> ];
 		try-tcp-refresh <replaceable>boolean</replaceable>;
-		type ( primary | master | secondary | slave | mirror |
+		type ( primary | master | secondary | slave |
 		    delegation-only | forward | hint | redirect |
 		    static-stub | stub );
 		update-check-ksk <replaceable>boolean</replaceable>;
@@ -966,6 +970,7 @@ zone <replaceable>string</replaceable> [ <replaceable>class</replaceable> ] {
 	max-zone-ttl ( unlimited | <replaceable>ttlval</replaceable> );
 	min-refresh-time <replaceable>integer</replaceable>;
 	min-retry-time <replaceable>integer</replaceable>;
+	mirror <replaceable>boolean</replaceable>;
 	multi-master <replaceable>boolean</replaceable>;
 	notify ( explicit | master-only | <replaceable>boolean</replaceable> );
 	notify-delay <replaceable>integer</replaceable>;
@@ -978,7 +983,8 @@ zone <replaceable>string</replaceable> [ <replaceable>class</replaceable> ] {
 	request-expire <replaceable>boolean</replaceable>;
 	request-ixfr <replaceable>boolean</replaceable>;
 	serial-update-method ( date | increment | unixtime );
-	server-addresses { ( <replaceable>ipv4_address</replaceable> | <replaceable>ipv6_address</replaceable> ); ... };
+	server-addresses { ( <replaceable>ipv4_address</replaceable> | <replaceable>ipv6_address</replaceable> ) [ port
+	    <replaceable>integer</replaceable> ]; ... };
 	server-names { <replaceable>string</replaceable>; ... };
 	sig-signing-nodes <replaceable>integer</replaceable>;
 	sig-signing-signatures <replaceable>integer</replaceable>;
@@ -989,9 +995,8 @@ zone <replaceable>string</replaceable> [ <replaceable>class</replaceable> ] {
 	transfer-source-v6 ( <replaceable>ipv6_address</replaceable> | * ) [ port ( <replaceable>integer</replaceable> | * )
 	    ] [ dscp <replaceable>integer</replaceable> ];
 	try-tcp-refresh <replaceable>boolean</replaceable>;
-	type ( primary | master | secondary | slave | mirror |
-	    delegation-only | forward | hint | redirect | static-stub |
-	    stub );
+	type ( primary | master | secondary | slave | delegation-only |
+	    forward | hint | redirect | static-stub | stub );
 	update-check-ksk <replaceable>boolean</replaceable>;
 	update-policy ( local | { ( deny | grant ) <replaceable>string</replaceable> ( 6to4-self |
 	    external | krb5-self | krb5-selfsub | krb5-subdomain | ms-self

bin/named/named.conf.html

@@ -853,6 +853,7 @@ view
 		max-zone-ttl ( unlimited | <em class="replaceable"><code>ttlval</code></em> );<br>
 		min-refresh-time <em class="replaceable"><code>integer</code></em>;<br>
 		min-retry-time <em class="replaceable"><code>integer</code></em>;<br>
+		mirror <em class="replaceable"><code>boolean</code></em>;<br>
 		multi-master <em class="replaceable"><code>boolean</code></em>;<br>
 		notify ( explicit | master-only | <em class="replaceable"><code>boolean</code></em> );<br>
 		notify-delay <em class="replaceable"><code>integer</code></em>;<br>
@@ -867,7 +868,8 @@ view
 		request-expire <em class="replaceable"><code>boolean</code></em>;<br>
 		request-ixfr <em class="replaceable"><code>boolean</code></em>;<br>
 		serial-update-method ( date | increment | unixtime );<br>
-		server-addresses { ( <em class="replaceable"><code>ipv4_address</code></em> | <em class="replaceable"><code>ipv6_address</code></em> ); ... };<br>
+		server-addresses { ( <em class="replaceable"><code>ipv4_address</code></em> | <em class="replaceable"><code>ipv6_address</code></em> ) [<br>
+		    port <em class="replaceable"><code>integer</code></em> ]; ... };<br>
 		server-names { <em class="replaceable"><code>string</code></em>; ... };<br>
 		sig-signing-nodes <em class="replaceable"><code>integer</code></em>;<br>
 		sig-signing-signatures <em class="replaceable"><code>integer</code></em>;<br>
@@ -878,7 +880,7 @@ view
 		transfer-source-v6 ( <em class="replaceable"><code>ipv6_address</code></em> | * ) [ port (<br>
 		    <em class="replaceable"><code>integer</code></em> | * ) ] [ dscp <em class="replaceable"><code>integer</code></em> ];<br>
 		try-tcp-refresh <em class="replaceable"><code>boolean</code></em>;<br>
-		type ( primary | master | secondary | slave | mirror |<br>
+		type ( primary | master | secondary | slave |<br>
 		    delegation-only | forward | hint | redirect |<br>
 		    static-stub | stub );<br>
 		update-check-ksk <em class="replaceable"><code>boolean</code></em>;<br>
@@ -958,6 +960,7 @@ zone
 	max-zone-ttl ( unlimited | <em class="replaceable"><code>ttlval</code></em> );<br>
 	min-refresh-time <em class="replaceable"><code>integer</code></em>;<br>
 	min-retry-time <em class="replaceable"><code>integer</code></em>;<br>
+	mirror <em class="replaceable"><code>boolean</code></em>;<br>
 	multi-master <em class="replaceable"><code>boolean</code></em>;<br>
 	notify ( explicit | master-only | <em class="replaceable"><code>boolean</code></em> );<br>
 	notify-delay <em class="replaceable"><code>integer</code></em>;<br>
@@ -970,7 +973,8 @@ zone
 	request-expire <em class="replaceable"><code>boolean</code></em>;<br>
 	request-ixfr <em class="replaceable"><code>boolean</code></em>;<br>
 	serial-update-method ( date | increment | unixtime );<br>
-	server-addresses { ( <em class="replaceable"><code>ipv4_address</code></em> | <em class="replaceable"><code>ipv6_address</code></em> ); ... };<br>
+	server-addresses { ( <em class="replaceable"><code>ipv4_address</code></em> | <em class="replaceable"><code>ipv6_address</code></em> ) [ port<br>
+	    <em class="replaceable"><code>integer</code></em> ]; ... };<br>
 	server-names { <em class="replaceable"><code>string</code></em>; ... };<br>
 	sig-signing-nodes <em class="replaceable"><code>integer</code></em>;<br>
 	sig-signing-signatures <em class="replaceable"><code>integer</code></em>;<br>
@@ -981,9 +985,8 @@ zone
 	transfer-source-v6 ( <em class="replaceable"><code>ipv6_address</code></em> | * ) [ port ( <em class="replaceable"><code>integer</code></em> | * )<br>
 	    ] [ dscp <em class="replaceable"><code>integer</code></em> ];<br>
 	try-tcp-refresh <em class="replaceable"><code>boolean</code></em>;<br>
-	type ( primary | master | secondary | slave | mirror |<br>
-	    delegation-only | forward | hint | redirect | static-stub |<br>
-	    stub );<br>
+	type ( primary | master | secondary | slave | delegation-only |<br>
+	    forward | hint | redirect | static-stub | stub );<br>
 	update-check-ksk <em class="replaceable"><code>boolean</code></em>;<br>
 	update-policy ( local | { ( deny | grant ) <em class="replaceable"><code>string</code></em> ( 6to4-self |<br>
 	    external | krb5-self | krb5-subdomain | ms-self | ms-subdomain<br>

bin/named/server.c

@@ -30,7 +30,7 @@
 #include <isc/file.h>
 #include <isc/hash.h>
 #include <isc/hex.h>
-#include <isc/hmac.h>
+#include <isc/hmacsha.h>
 #include <isc/httpd.h>
 #include <isc/lex.h>
 #include <isc/meminfo.h>
@@ -41,6 +41,7 @@
 #include <isc/print.h>
 #include <isc/refcount.h>
 #include <isc/resource.h>
+#include <isc/sha2.h>
 #include <isc/socket.h>
 #include <isc/stat.h>
 #include <isc/stats.h>
@@ -6977,9 +6978,6 @@ removed(dns_zone_t *zone, void *uap) {
 	case dns_zone_slave:
 		type = "slave";
 		break;
-	case dns_zone_mirror:
-		type = "mirror";
-		break;
 	case dns_zone_stub:
 		type = "stub";
 		break;
@@ -9010,7 +9008,6 @@ load_configuration(const char *filename, named_server_t *server,
 		bool first = true;
 		isc_buffer_t b;
 		unsigned int usedlength;
-		unsigned int expectedlength;
 
 		for (element = cfg_list_first(obj);
 		     element != NULL;
@@ -9056,26 +9053,21 @@ load_configuration(const char *filename, named_server_t *server,
 			usedlength = isc_buffer_usedlength(&b);
 			switch (server->sctx->cookiealg) {
 			case ns_cookiealg_aes:
-				expectedlength = ISC_AES128_KEYLENGTH;
-				if (usedlength != expectedlength) {
+				if (usedlength != ISC_AES128_KEYLENGTH) {
 					CHECKM(ISC_R_RANGE,
 					       "AES cookie-secret must be "
 					       "128 bits");
 				}
 				break;
 			case ns_cookiealg_sha1:
-				expectedlength =
-					isc_md_type_get_size(ISC_MD_SHA1);
-				if (usedlength != expectedlength) {
+				if (usedlength != ISC_SHA1_DIGESTLENGTH) {
 					CHECKM(ISC_R_RANGE,
 					       "SHA1 cookie-secret must be "
 					       "160 bits");
 				}
 				break;
 			case ns_cookiealg_sha256:
-				expectedlength =
-					isc_md_type_get_size(ISC_MD_SHA256);
-				if (usedlength != expectedlength) {
+				if (usedlength != ISC_SHA256_DIGESTLENGTH) {
 					CHECKM(ISC_R_RANGE,
 					       "SHA256 cookie-secret must be "
 					       "256 bits");
@@ -9327,8 +9319,7 @@ load_zones(named_server_t *server, bool init, bool reconfig) {
 		 * the initial server setup; it isn't necessary during
 		 * a reload.)
 		 */
-		isc_taskmgr_setmode(named_g_taskmgr,
-				    isc_taskmgrmode_privileged);
+		isc_taskmgr_setprivilegedmode(named_g_taskmgr);
 	}
 
 	isc_task_endexclusive(server->task);
@@ -10170,8 +10161,7 @@ named_server_retransfercommand(named_server_t *server, isc_lex_t *lex,
 		dns_zone_detach(&raw);
 	}
 	type = dns_zone_gettype(zone);
-	if (type == dns_zone_slave || type == dns_zone_mirror ||
-	    type == dns_zone_stub ||
+	if (type == dns_zone_slave || type == dns_zone_stub ||
 	    (type == dns_zone_redirect &&
 	     dns_zone_getredirecttype(zone) == dns_zone_slave))
 		dns_zone_forcereload(zone);
@@ -10203,9 +10193,7 @@ named_server_reloadcommand(named_server_t *server, isc_lex_t *lex,
 			msg = "server reload successful";
 	} else {
 		type = dns_zone_gettype(zone);
-		if (type == dns_zone_slave || type == dns_zone_mirror ||
-		    type == dns_zone_stub)
-		{
+		if (type == dns_zone_slave || type == dns_zone_stub) {
 			dns_zone_refresh(zone);
 			dns_zone_detach(&zone);
 			msg = "zone refresh queued";
@@ -10296,7 +10284,7 @@ named_server_refreshcommand(named_server_t *server, isc_lex_t *lex,
 	isc_result_t result;
 	dns_zone_t *zone = NULL, *raw = NULL;
 	const char msg1[] = "zone refresh queued";
-	const char msg2[] = "not a slave, mirror, or stub zone";
+	const char msg2[] = "not a slave or stub zone";
 	dns_zonetype_t type;
 
 	result = zone_from_args(server, lex, NULL, &zone, NULL,
@@ -10314,9 +10302,7 @@ named_server_refreshcommand(named_server_t *server, isc_lex_t *lex,
 	}
 
 	type = dns_zone_gettype(zone);
-	if (type == dns_zone_slave || type == dns_zone_mirror ||
-	    type == dns_zone_stub)
-	{
+	if (type == dns_zone_slave || type == dns_zone_stub) {
 		dns_zone_refresh(zone);
 		dns_zone_detach(&zone);
 		(void) putstr(text, msg1);
@@ -13508,7 +13494,6 @@ named_server_delzone(named_server_t *server, isc_lex_t *lex,
 		TCHECK(putstr(text, zonename));
 		TCHECK(putstr(text, "' and associated files will be deleted."));
 	} else if (dns_zone_gettype(mayberaw) == dns_zone_slave ||
-		   dns_zone_gettype(mayberaw) == dns_zone_mirror ||
 		   dns_zone_gettype(mayberaw) == dns_zone_stub)
 	{
 		bool first;
@@ -14051,10 +14036,7 @@ named_server_zonestatus(named_server_t *server, isc_lex_t *lex,
 		type = "master";
 		break;
 	case dns_zone_slave:
-		type = "slave";
-		break;
-	case dns_zone_mirror:
-		type = "mirror";
+		type = dns_zone_ismirror(zone) ? "mirror" : "slave";
 		break;
 	case dns_zone_stub:
 		type = "stub";
@@ -14110,7 +14092,6 @@ named_server_zonestatus(named_server_t *server, isc_lex_t *lex,
 
 	/* Refresh/expire times */
 	if (zonetype == dns_zone_slave ||
-	    zonetype == dns_zone_mirror ||
 	    zonetype == dns_zone_stub ||
 	    zonetype == dns_zone_redirect)
 	{

bin/named/statschannel.c

@@ -94,7 +94,6 @@ user_zonetype( dns_zone_t *zone ) {
 		{ dns_zone_none, "none" },
 		{ dns_zone_master, "master" },
 		{ dns_zone_slave, "slave" },
-		{ dns_zone_mirror, "mirror" },
 		{ dns_zone_stub, "stub" },
 		{ dns_zone_staticstub, "static-stub" },
 		{ dns_zone_key, "key" },

bin/named/zoneconf.c

@@ -755,13 +755,8 @@ checknames(dns_zonetype_t ztype, const cfg_obj_t **maps,
 	isc_result_t result;
 
 	switch (ztype) {
-	case dns_zone_slave:
-	case dns_zone_mirror:
-		zone = "slave";
-		break;
-	case dns_zone_master:
-		zone = "master";
-		break;
+	case dns_zone_slave: zone = "slave"; break;
+	case dns_zone_master: zone = "master"; break;
 	default:
 		INSIST(0);
 	}
@@ -833,37 +828,6 @@ isself(dns_view_t *myview, dns_tsigkey_t *mykey,
 	return (view == myview);
 }
 
-/*%
- * For mirror zones, change "notify yes;" to "notify explicit;", informing the
- * user only if "notify" was explicitly configured rather than inherited from
- * default configuration.
- */
-static dns_notifytype_t
-process_notifytype(dns_notifytype_t ntype, dns_zonetype_t ztype,
-		   const char *zname, const cfg_obj_t **maps)
-{
-	const cfg_obj_t *obj = NULL;
-
-	/*
-	 * Return the original setting if this is not a mirror zone or if the
-	 * zone is configured with something else than "notify yes;".
-	 */
-	if (ztype != dns_zone_mirror || ntype != dns_notifytype_yes) {
-		return (ntype);
-	}
-
-	/*
-	 * Only log a message if "notify" was set in the configuration
-	 * hierarchy supplied in 'maps'.
-	 */
-	if (named_config_get(maps, "notify", &obj) == ISC_R_SUCCESS) {
-		cfg_obj_log(obj, named_g_lctx, ISC_LOG_INFO,
-			    "'notify explicit;' will be used for mirror zone "
-			    "'%s'", zname);
-	}
-
-	return (dns_notifytype_explicit);
-}
 
 isc_result_t
 named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
@@ -1018,7 +982,7 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 		return (ISC_R_FAILURE);
 	}
 
-	if (ztype == dns_zone_slave || ztype == dns_zone_mirror)
+	if (ztype == dns_zone_slave)
 		masterformat = dns_masterformat_raw;
 	else
 		masterformat = dns_masterformat_text;
@@ -1112,7 +1076,7 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 	/*
 	 * Notify messages are processed by the raw zone if it exists.
 	 */
-	if (ztype == dns_zone_slave || ztype == dns_zone_mirror)
+	if (ztype == dns_zone_slave)
 		RETERR(configure_zone_acl(zconfig, vconfig, config,
 					  allow_notify, ac, mayberaw,
 					  dns_zone_setnotifyacl,
@@ -1218,8 +1182,6 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 			else
 				INSIST(0);
 		}
-		notifytype = process_notifytype(notifytype, ztype, zname,
-						nodefault);
 		if (raw != NULL)
 			dns_zone_setnotifytype(raw, dns_notifytype_no);
 		dns_zone_setnotifytype(zone, notifytype);
@@ -1575,7 +1537,7 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 		}
 	}
 
-	if (ztype == dns_zone_slave || ztype == dns_zone_mirror) {
+	if (ztype == dns_zone_slave) {
 		RETERR(configure_zone_acl(zconfig, vconfig, config,
 					  allow_update_forwarding, ac,
 					  mayberaw, dns_zone_setforwardacl,
@@ -1733,38 +1695,12 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 	 * Configure slave functionality.
 	 */
 	switch (ztype) {
-	case dns_zone_mirror:
-		/*
-		 * Disable outgoing zone transfers for mirror zones unless they
-		 * are explicitly enabled by zone configuration.
-		 */
-		obj = NULL;
-		(void)cfg_map_get(zoptions, "allow-transfer", &obj);
-		if (obj == NULL) {
-			dns_acl_t *none;
-			RETERR(dns_acl_none(mctx, &none));
-			dns_zone_setxfracl(zone, none);
-			dns_acl_detach(&none);
-		}
-		/* FALLTHROUGH */
 	case dns_zone_slave:
 	case dns_zone_stub:
 	case dns_zone_redirect:
 		count = 0;
 		obj = NULL;
 		(void)cfg_map_get(zoptions, "masters", &obj);
-		/*
-		 * Use the built-in master server list if one was not
-		 * explicitly specified and this is a root zone mirror.
-		 */
-		if (obj == NULL && ztype == dns_zone_mirror &&
-		    dns_name_equal(dns_zone_getorigin(zone), dns_rootname))
-		{
-			result = named_config_getmastersdef(named_g_config,
-						DEFAULT_IANA_ROOT_ZONE_MASTERS,
-						&obj);
-			RETERR(result);
-		}
 		if (obj != NULL) {
 			dns_ipkeylist_t ipkl;
 			dns_ipkeylist_init(&ipkl);
@@ -1791,6 +1727,35 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 		}
 		dns_zone_setoption(mayberaw, DNS_ZONEOPT_MULTIMASTER, multi);
 
+		obj = NULL;
+		(void)cfg_map_get(zoptions, "mirror", &obj);
+		if (obj != NULL) {
+			bool mirror = cfg_obj_asboolean(obj);
+			dns_zone_setoption(mayberaw, DNS_ZONEOPT_MIRROR,
+					   mirror);
+			if (mirror) {
+				/*
+				 * Disable outgoing zone transfers unless they
+				 * are explicitly enabled by zone
+				 * configuration.
+				 */
+				obj = NULL;
+				(void)cfg_map_get(zoptions, "allow-transfer",
+						  &obj);
+				if (obj == NULL) {
+					dns_acl_t *none;
+					RETERR(dns_acl_none(mctx, &none));
+					dns_zone_setxfracl(zone, none);
+					dns_acl_detach(&none);
+				}
+				/*
+				 * Only allow "also-notify".
+				 */
+				notifytype = dns_notifytype_explicit;
+				dns_zone_setnotifytype(zone, notifytype);
+			}
+		}
+
 		obj = NULL;
 		result = named_config_get(maps, "max-transfer-time-in", &obj);
 		INSIST(result == ISC_R_SUCCESS && obj != NULL);
@@ -1930,7 +1895,7 @@ named_zone_reusable(dns_zone_t *zone, const cfg_obj_t *zconfig) {
 	const char *cfilename;
 	const char *zfilename;
 	dns_zone_t *raw = NULL;
-	bool has_raw;
+	bool has_raw, mirror;
 	dns_zonetype_t ztype;
 
 	zoptions = cfg_tuple_get(zconfig, "options");
@@ -1970,6 +1935,21 @@ named_zone_reusable(dns_zone_t *zone, const cfg_obj_t *zconfig) {
 		return (false);
 	}
 
+	/*
+	 * Do not reuse a zone whose "mirror" setting was changed.
+	 */
+	obj = NULL;
+	mirror = false;
+	(void)cfg_map_get(zoptions, "mirror", &obj);
+	if (obj != NULL) {
+		mirror = cfg_obj_asboolean(obj);
+	}
+	if (dns_zone_ismirror(zone) != mirror) {
+		dns_zone_log(zone, ISC_LOG_DEBUG(1),
+			     "not reusable: mirror setting changed");
+		return (false);
+	}
+
 	if (zonetype_fromconfig(zoptions) != ztype) {
 		dns_zone_log(zone, ISC_LOG_DEBUG(1),
 			     "not reusable: type mismatch");

bin/pkcs11/pkcs11-keygen.c

@@ -43,7 +43,7 @@
  * Create a key in the keystore of an HSM
  *
  * The calculation of key tag is left to the script
- * that converts the key into a DNSKEY RR and inserts
+ * that converts the key into a DNSKEY RR and inserts 
  * it into a zone file.
  *
  * usage:
@@ -71,6 +71,7 @@
 
 #include <pk11/pk11.h>
 #include <pk11/result.h>
+#define WANT_DH_PRIMES
 #include <pk11/constants.h>
 #include <pkcs11/eddsa.h>
 
@@ -78,10 +79,12 @@
 static CK_BBOOL truevalue = TRUE;
 static CK_BBOOL falsevalue = FALSE;
 
-/* Key class: RSA, ECC, ECX, or unknown */
+/* Key class: RSA, ECC, ECX, DSA, DH, or unknown */
 typedef enum {
 	key_unknown,
 	key_rsa,
+	key_dsa,
+	key_dh,
 	key_ecc,
 	key_ecx
 } key_class_t;
@@ -149,6 +152,78 @@ static CK_ATTRIBUTE ecc_template[] = {
 	{CKA_ID, NULL_PTR, 0}
 };
 
+/*
+ * Public key template for DSA keys
+ */
+#define DSA_LABEL 0
+#define DSA_VERIFY 1
+#define DSA_TOKEN 2
+#define DSA_PRIVATE 3
+#define DSA_PRIME 4
+#define DSA_SUBPRIME 5
+#define DSA_BASE 6
+#define DSA_ID 7
+#define DSA_ATTRS 8
+static CK_ATTRIBUTE dsa_template[] = {
+	{CKA_LABEL, NULL_PTR, 0},
+	{CKA_VERIFY, &truevalue, sizeof(truevalue)},
+	{CKA_TOKEN, &truevalue, sizeof(truevalue)},
+	{CKA_PRIVATE, &falsevalue, sizeof(falsevalue)},
+	{CKA_PRIME, NULL_PTR, 0},
+	{CKA_SUBPRIME, NULL_PTR, 0},
+	{CKA_BASE, NULL_PTR, 0},
+	{CKA_ID, NULL_PTR, 0}
+};
+#define DSA_PARAM_PRIME 0
+#define DSA_PARAM_SUBPRIME 1
+#define DSA_PARAM_BASE 2
+#define DSA_PARAM_ATTRS 3
+static CK_ATTRIBUTE dsa_param_template[] = {
+	{CKA_PRIME, NULL_PTR, 0},
+	{CKA_SUBPRIME, NULL_PTR, 0},
+	{CKA_BASE, NULL_PTR, 0},
+};
+#define DSA_DOMAIN_PRIMEBITS 0
+#define DSA_DOMAIN_PRIVATE 1
+#define DSA_DOMAIN_ATTRS 2
+static CK_ATTRIBUTE dsa_domain_template[] = {
+	{CKA_PRIME_BITS, NULL_PTR, 0},
+	{CKA_PRIVATE, &falsevalue, sizeof(falsevalue)},
+};
+
+/*
+ * Public key template for DH keys
+ */
+#define DH_LABEL 0
+#define DH_VERIFY 1
+#define DH_TOKEN 2
+#define DH_PRIVATE 3
+#define DH_PRIME 4
+#define DH_BASE 5
+#define DH_ID 6
+#define DH_ATTRS 7
+static CK_ATTRIBUTE dh_template[] = {
+	{CKA_LABEL, NULL_PTR, 0},
+	{CKA_VERIFY, &truevalue, sizeof(truevalue)},
+	{CKA_TOKEN, &truevalue, sizeof(truevalue)},
+	{CKA_PRIVATE, &falsevalue, sizeof(falsevalue)},
+	{CKA_PRIME, NULL_PTR, 0},
+	{CKA_BASE, NULL_PTR, 0},
+	{CKA_ID, NULL_PTR, 0}
+};
+#define DH_PARAM_PRIME 0
+#define DH_PARAM_BASE 1
+#define DH_PARAM_ATTRS 2
+static CK_ATTRIBUTE dh_param_template[] = {
+	{CKA_PRIME, NULL_PTR, 0},
+	{CKA_BASE, NULL_PTR, 0},
+};
+#define DH_DOMAIN_PRIMEBITS 0
+#define DH_DOMAIN_ATTRS 1
+static CK_ATTRIBUTE dh_domain_template[] = {
+	{CKA_PRIME_BITS, NULL_PTR, 0},
+};
+
 /*
  * Convert from text to key class.  Accepts the names of DNSSEC
  * signing algorithms, so e.g., ECDSAP256SHA256 maps to ECC and
@@ -162,6 +237,11 @@ keyclass_fromtext(const char *name) {
 	if (strncasecmp(name, "rsa", 3) == 0 ||
 	    strncasecmp(name, "nsec3rsa", 8) == 0)
 		return (key_rsa);
+	else if (strncasecmp(name, "dsa", 3) == 0 ||
+		 strncasecmp(name, "nsec3dsa", 8) == 0)
+		return (key_dsa);
+	else if (strcasecmp(name, "dh") == 0)
+		return (key_dh);
 	else if (strncasecmp(name, "ecc", 3) == 0 ||
 		 strncasecmp(name, "ecdsa", 5) == 0)
 		return (key_ecc);
@@ -199,7 +279,7 @@ main(int argc, char *argv[]) {
 	pk11_context_t pctx;
 	int error = 0;
 	int c, errflg = 0;
-	int hide = 1, quiet = 0;
+	int hide = 1, special = 0, quiet = 0;
 	int idlen = 0, id_offset = 0;
 	unsigned int i;
 	unsigned long id = 0;
@@ -251,6 +331,9 @@ main(int argc, char *argv[]) {
 		case 'q':
 			quiet = 1;
 			break;
+		case 'S':
+			special = 1;
+			break;
 		case ':':
 			fprintf(stderr,
 				"Option -%c requires an operand\n",
@@ -277,6 +360,12 @@ main(int argc, char *argv[]) {
 		exit(2);
 	}
 
+	if (special != 0 && keyclass != key_dh) {
+		fprintf(stderr, "The -S option is only compatible "
+				"with Diffie-Hellman key generation\n");
+		exit(2);
+	}
+
 	switch (keyclass) {
 	case key_rsa:
 		op_type = OP_RSA;
@@ -372,10 +461,70 @@ main(int argc, char *argv[]) {
 
 #endif
 		break;
+	case key_dsa:
+		op_type = OP_DSA;
+		if (bits == 0)
+			usage();
+
+		dpmech.mechanism = CKM_DSA_PARAMETER_GEN;
+		dpmech.pParameter = NULL;
+		dpmech.ulParameterLen = 0;
+		mech.mechanism = CKM_DSA_KEY_PAIR_GEN;
+		mech.pParameter = NULL;
+		mech.ulParameterLen = 0;
+
+		public_template = dsa_template;
+		public_attrcnt = DSA_ATTRS;
+		id_offset = DSA_ID;
+
+		domain_template = dsa_domain_template;
+		domain_attrcnt = DSA_DOMAIN_ATTRS;
+		param_template = dsa_param_template;
+		param_attrcnt = DSA_PARAM_ATTRS;
+
+		domain_template[DSA_DOMAIN_PRIMEBITS].pValue = &bits;
+		domain_template[DSA_DOMAIN_PRIMEBITS].ulValueLen = sizeof(bits);
+		break;
+	case key_dh:
+		op_type = OP_DH;
+		if (special && bits == 0)
+			bits = 1024;
+		else if (special &&
+			 bits != 768 && bits != 1024 && bits != 1536)
+		{
+			fprintf(stderr, "When using the special prime (-S) "
+				"option, only key sizes of\n"
+				"768, 1024 or 1536 are supported.\n");
+			exit(2);
+		} else if (bits == 0)
+			usage();
+
+		dpmech.mechanism = CKM_DH_PKCS_PARAMETER_GEN;
+		dpmech.pParameter = NULL;
+		dpmech.ulParameterLen = 0;
+		mech.mechanism = CKM_DH_PKCS_KEY_PAIR_GEN;
+		mech.pParameter = NULL;
+		mech.ulParameterLen = 0;
+
+		/* Override CKA_SIGN attribute */
+		private_template[PRIVATE_DERIVE].type = CKA_DERIVE;
+
+		public_template = dh_template;
+		public_attrcnt = DH_ATTRS;
+		id_offset = DH_ID;
+
+		domain_template = dh_domain_template;
+		domain_attrcnt = DH_DOMAIN_ATTRS;
+		param_template = dh_param_template;
+		param_attrcnt = DH_PARAM_ATTRS;
+
+		domain_template[DH_DOMAIN_PRIMEBITS].pValue = &bits;
+		domain_template[DH_DOMAIN_PRIMEBITS].ulValueLen = sizeof(bits);
+		break;
 	case key_unknown:
 		usage();
 	}
-
+	
 	search_template[0].pValue = label;
 	search_template[0].ulValueLen = strlen((char *)label);
 	public_template[0].pValue = label;
@@ -433,7 +582,7 @@ main(int argc, char *argv[]) {
 	hSession = pctx.session;
 
 	/* check if a key with the same id already exists */
-	rv = pkcs_C_FindObjectsInit(hSession, search_template, 1);
+	rv = pkcs_C_FindObjectsInit(hSession, search_template, 1); 
 	if (rv != CKR_OK) {
 		fprintf(stderr, "C_FindObjectsInit: Error = 0x%.8lX\n", rv);
 		error = 1;
@@ -460,6 +609,29 @@ main(int argc, char *argv[]) {
 	if (keyclass == key_rsa || keyclass == key_ecc || keyclass == key_ecx)
 		goto generate_keys;
 
+	/*
+	 * Special setup for Diffie-Hellman keys
+	 */
+	if (special != 0) {
+		public_template[DH_BASE].pValue = pk11_dh_bn2;
+		public_template[DH_BASE].ulValueLen = sizeof(pk11_dh_bn2);
+		if (bits == 768) {
+			public_template[DH_PRIME].pValue = pk11_dh_bn768;
+			public_template[DH_PRIME].ulValueLen =
+				sizeof(pk11_dh_bn768);
+		} else if (bits == 1024) {
+			public_template[DH_PRIME].pValue = pk11_dh_bn1024;
+			public_template[DH_PRIME].ulValueLen =
+				sizeof(pk11_dh_bn1024);
+		} else {
+			public_template[DH_PRIME].pValue = pk11_dh_bn1536;
+			public_template[DH_PRIME].ulValueLen =
+				sizeof(pk11_dh_bn1536);
+		}
+		param_attrcnt = 0;
+		goto generate_keys;
+	}
+
 	/* Generate Domain parameters */
 	rv = pkcs_C_GenerateKey(hSession, &dpmech, domain_template,
 			   domain_attrcnt, &domainparams);
@@ -479,7 +651,7 @@ main(int argc, char *argv[]) {
 		fprintf(stderr,
 			"C_GetAttributeValue0: Error = 0x%.8lX\n", rv);
 		error = 1;
-		goto exit_search;
+		goto exit_domain;
 	}
 
 	/* Allocate space for parameter attributes */
@@ -492,22 +664,81 @@ main(int argc, char *argv[]) {
 		if (param_template[i].pValue == NULL) {
 			fprintf(stderr, "malloc failed\n");
 			error = 1;
-			goto exit_search;
+			goto exit_params;
 		}
 	}
 
+	rv = pkcs_C_GetAttributeValue(hSession, domainparams,
+				 dsa_param_template, DSA_PARAM_ATTRS);
+
+	if (rv != CKR_OK) {
+		fprintf(stderr,
+			"C_GetAttributeValue1: Error = 0x%.8lX\n", rv);
+		error = 1;
+		goto exit_params;
+	}
+
+	switch (keyclass) {
+	case key_dsa:
+		public_template[DSA_PRIME].pValue =
+			param_template[DSA_PARAM_PRIME].pValue;
+		public_template[DSA_PRIME].ulValueLen =
+			param_template[DSA_PARAM_PRIME].ulValueLen;
+		public_template[DSA_SUBPRIME].pValue =
+			param_template[DSA_PARAM_SUBPRIME].pValue;
+		public_template[DSA_SUBPRIME].ulValueLen =
+			param_template[DSA_PARAM_SUBPRIME].ulValueLen;
+		public_template[DSA_BASE].pValue =
+			param_template[DSA_PARAM_BASE].pValue;
+		public_template[DSA_BASE].ulValueLen =
+			param_template[DSA_PARAM_BASE].ulValueLen;
+		break;
+	case key_dh:
+		public_template[DH_PRIME].pValue =
+			param_template[DH_PARAM_PRIME].pValue;
+		public_template[DH_PRIME].ulValueLen =
+			param_template[DH_PARAM_PRIME].ulValueLen;
+		public_template[DH_BASE].pValue =
+			param_template[DH_PARAM_BASE].pValue;
+		public_template[DH_BASE].ulValueLen =
+			param_template[DH_PARAM_BASE].ulValueLen;
+	default:
+		break;
+	}
+
  generate_keys:
 	/* Generate Key pair for signing/verifying */
 	rv = pkcs_C_GenerateKeyPair(hSession, &mech,
 			       public_template, public_attrcnt,
 			       private_template, private_attrcnt,
 			       &publickey, &privatekey);
-
+	
 	if (rv != CKR_OK) {
 		fprintf(stderr, "C_GenerateKeyPair: Error = 0x%.8lX\n", rv);
 		error = 1;
 	 } else if (!quiet)
 		printf("Key pair generation complete.\n");
+	
+ exit_params:
+	/* Free parameter attributes */
+	if (keyclass == key_dsa || keyclass == key_dh) {
+		for (i = 0; i < param_attrcnt; i++) {
+			if (param_template[i].pValue != NULL) {
+				free(param_template[i].pValue);
+			}
+		}
+	}
+
+ exit_domain:
+	/* Destroy domain parameters */
+	if (keyclass == key_dsa || (keyclass == key_dh && !special)) {
+		rv = pkcs_C_DestroyObject(hSession, domainparams);
+		if (rv != CKR_OK) {
+			fprintf(stderr,
+				"C_DestroyObject: Error = 0x%.8lX\n", rv);
+			error = 1;
+		}
+	}
 
  exit_search:
 	rv = pkcs_C_FindObjectsFinal(hSession);

bin/python/isc/dnskey.py.in

@@ -30,7 +30,7 @@ class dnskey:
               'Revoke', 'DSPublish', 'SyncPublish', 'SyncDelete')
     _OPTS = (None, '-P', '-A', '-I', '-D', '-R', None, '-Psync', '-Dsync')
 
-    _ALGNAMES = (None, 'RSAMD5', 'DH', 'DSA', None, 'RSASHA1',
+    _ALGNAMES = (None, 'RSAMD5', 'DH', 'DSA', 'ECC', 'RSASHA1',
                  'NSEC3DSA', 'NSEC3RSASHA1', 'RSASHA256', None,
                  'RSASHA512', None, 'ECCGOST', 'ECDSAP256SHA256',
                  'ECDSAP384SHA384', 'ED25519', 'ED448')

bin/tests/cfg_test.c

@@ -115,8 +115,6 @@ main(int argc, char **argv) {
 				   strcmp(argv[1], "seconary") == 0)
 			{
 				zonetype = CFG_ZONE_SLAVE;
-			} else if (strcmp(argv[1], "mirror") == 0) {
-				zonetype = CFG_ZONE_MIRROR;
 			} else if (strcmp(argv[1], "stub") == 0) {
 				zonetype = CFG_ZONE_STUB;
 			} else if (strcmp(argv[1], "static-stub") == 0) {

bin/tests/optional/Kchild.example.+003+04017.key

@@ -0,0 +1 @@
+child.example. IN KEY 256 3 3 ALeiYGFXbil6PgHnkm5ZE67ygEVDvGT/gqZmLH7tGboofcPSfyhh1hpw dxZgJ26d/gynWMGVSYzaXfzsxpPoNeYn+qeevQoJOaxXXlfcy8Ik52Rm eW0J9mWlf9hsD7ShIhh1+0kRYGCOCaU25wIe3SLVkN3HgqiCBDYnBY0u nMkqRadiUnoEa3Tcvc9kJx9r9gDstR2A9A5sBhFLI/XQ0gViHHLVpQ4x hz+rTLb/xrBoAb5sQJT3xUjhhdNo9HuL6kwdLdSu//PCl1QnY9NpYPVV SKUo

bin/tests/optional/Kchild.example.+003+04017.private

@@ -0,0 +1,7 @@
+Private-key-format: v1.2
+Algorithm: 3 (DSA)
+Prime(p): vGT/gqZmLH7tGboofcPSfyhh1hpwdxZgJ26d/gynWMGVSYzaXfzsxpPoNeYn+qeevQoJOaxXXlfcy8Ik52RmeQ==
+Subprime(q): t6JgYVduKXo+AeeSblkTrvKARUM=
+Base(g): bQn2ZaV/2GwPtKEiGHX7SRFgYI4JpTbnAh7dItWQ3ceCqIIENicFjS6cySpFp2JSegRrdNy9z2QnH2v2AOy1HQ==
+Private_value(x): J1Ctez8+w1PTR56Hze3pGoe0Wag=
+Public_value(y): gPQObAYRSyP10NIFYhxy1aUOMYc/q0y2/8awaAG+bECU98VI4YXTaPR7i+pMHS3Urv/zwpdUJ2PTaWD1VUilKA==

bin/tests/optional/Kchild.example.+005+33180.key

@@ -1,5 +0,0 @@
-; This is a zone-signing key, keyid 33180, for child.example.
-; Created: 20181025104746 (Thu Oct 25 12:47:46 2018)
-; Publish: 20181025104746 (Thu Oct 25 12:47:46 2018)
-; Activate: 20181025104746 (Thu Oct 25 12:47:46 2018)
-child.example. IN DNSKEY 256 3 5 AwEAAb9eatC8ASzDnRApcZuxyBrvJRANRQjCXQ1FWK+8vEyXV5NIE9Km hKIV2wbq2tLBPfjNQz4BTJ9RmDINf1RayDlt6L+IQV1JCaDaMjd1zU3n SQK18Y7fMu0ww4AMKOnoVRbkIxa3zlA0chImXcfPE0q2AvKBYLzPfkPO cfplAuRkLcGUxdADCipNzCOakpcd5gfm9Sa2HlaXcw3gyI1WcE8=

bin/tests/optional/Kchild.example.+005+33180.private

@@ -1,13 +0,0 @@
-Private-key-format: v1.3
-Algorithm: 5 (RSASHA1)
-Modulus: v15q0LwBLMOdEClxm7HIGu8lEA1FCMJdDUVYr7y8TJdXk0gT0qaEohXbBura0sE9+M1DPgFMn1GYMg1/VFrIOW3ov4hBXUkJoNoyN3XNTedJArXxjt8y7TDDgAwo6ehVFuQjFrfOUDRyEiZdx88TSrYC8oFgvM9+Q85x+mUC5GQtwZTF0AMKKk3MI5qSlx3mB+b1JrYeVpdzDeDIjVZwTw==
-PublicExponent: AQAB
-PrivateExponent: WDsn9GU6BXGLENCK2MX3BLQN2oDDu24hiOTYJu5VwtpkPjuVKCIuNKzu9xmBGnqOIBBDWGsw8KOmEC247yOL/S53iRdBS8lI7yiqznc52RhlmrdPKXbNpVnPwil8wocw+oQYa7uvdPYxI2Yy3B/tRgUxlxSlc/LW/dr0BX2L7qr/aeOBeGSRUlCpc7tYU9a2RUaLpVxF6SlqicCpC91MAQ==
-Prime1: 466f+JL66Bl4qYnkj0s9+1N3pYmdcM9Ja1AN66X4VLslA9Cm1JEaC5V9HOptfcXUk0XYEVnKeKM2lIQnvcLG0yuQHIa+pGi7P8vgQfdaRUE=
-Prime2: 1yuUkTVRSbUWeUreEcHgeeBBJ61UshX7t07gnGgIr3artGdo2CVEb5//+2Mvj5bgjCQBvjBbmHNZrR0jKDRBTIGtqbBerOuhEN4AXdAEgY8=
-Exponent1: KzUXbJ/P973ltR7S/hKEV66WVRbRhvf/cdsGWULs5n+BXcD59/r1W19qF9OxJZ4mYjBt+ZT1pIEsuXB+7jcJbkelGJTFlwO9DTVOgJZFTkE=
-Exponent2: FTPsLertGbBIiKdB/sn2Dsx0Xy6LXAkihsu1AnSV9oRhIyPVhwcVGVLQ7Lq3YxThB648pbsqK3miapamcj3D+YAF1uTUT4Hgm0LlEll/OC0=
-Coefficient: Vulw9kmmjKc+wmOukLdzheoA2hNPDVtgiynfzHybyXdqvapCoK+ZVmNFzjO0M41ATcpvya3iX0bekMQqYnBhLURNZUIyqz2nGskOjV8I5Jg=
-Created: 20181025104746
-Publish: 20181025104746
-Activate: 20181025104746

bin/tests/optional/Makefile.in

@@ -49,6 +49,7 @@ XTARGETS =	adb_test@EXEEXT@ \
 		db_test@EXEEXT@ \
 		dst_test@EXEEXT@ \
 		gsstest@EXEEXT@ \
+		hash_test@EXEEXT@ \
 		fsaccess_test@EXEEXT@ \
 		inter_test@EXEEXT@ \
 		lex_test@EXEEXT@ \
@@ -77,6 +78,7 @@ XSRCS =		adb_test.c \
 		byname_test.c \
 		db_test.c \
 		dst_test.c \
+		hash_test.c \
 		fsaccess_test.c \
 		gsstest.c \
 		inter_test.c \
@@ -165,6 +167,10 @@ name_test@EXEEXT@: name_test.@O@ ${ISCDEPLIBS} ${DNSDEPLIBS}
 	${LIBTOOL_MODE_LINK} ${PURIFY} ${CC} ${CFLAGS} ${LDFLAGS} -o $@ name_test.@O@ \
 		${DNSLIBS} ${ISCLIBS} ${LIBS}
 
+hash_test@EXEEXT@: hash_test.@O@ ${ISCDEPLIBS}
+	${LIBTOOL_MODE_LINK} ${PURIFY} ${CC} ${CFLAGS} ${LDFLAGS} -o $@ hash_test.@O@ \
+		${ISCLIBS} ${LIBS}
+
 entropy_test@EXEEXT@: entropy_test.@O@ ${ISCDEPLIBS}
 	${LIBTOOL_MODE_LINK} ${PURIFY} ${CC} ${CFLAGS} ${LDFLAGS} -o $@ entropy_test.@O@ \
 		${ISCLIBS} ${LIBS}

bin/tests/optional/dst_test.c

@@ -254,9 +254,11 @@ main(void) {
 	result = dns_name_fromtext(name, &b, NULL, 0, NULL);
 	if (result != ISC_R_SUCCESS)
 		return (1);
+	io(name, 23616, DST_ALG_DSA, DST_TYPE_PRIVATE|DST_TYPE_PUBLIC, mctx);
 	io(name, 54622, DST_ALG_RSAMD5, DST_TYPE_PRIVATE|DST_TYPE_PUBLIC,
 	   mctx);
 
+	io(name, 49667, DST_ALG_DSA, DST_TYPE_PRIVATE|DST_TYPE_PUBLIC, mctx);
 	io(name, 2, DST_ALG_RSAMD5, DST_TYPE_PRIVATE|DST_TYPE_PUBLIC, mctx);
 
 	isc_buffer_constinit(&b, "dh.", 3);
@@ -268,6 +270,7 @@ main(void) {
 
 	generate(DST_ALG_RSAMD5, mctx);
 	generate(DST_ALG_DH, mctx);
+	generate(DST_ALG_DSA, mctx);
 	generate(DST_ALG_HMACMD5, mctx);
 
 	dst_lib_destroy();

bin/tests/optional/hash_test.c

@@ -0,0 +1,284 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+/*! \file */
+#include <config.h>
+
+#include <stdio.h>
+#include <string.h>
+
+#include <isc/hmacmd5.h>
+#include <isc/hmacsha.h>
+#include <isc/md5.h>
+#include <isc/sha1.h>
+#include <isc/util.h>
+#include <isc/print.h>
+#include <isc/string.h>
+
+#include <pk11/site.h>
+
+static void
+print_digest(const char *s, const char *hash, unsigned char *d,
+	     unsigned int words)
+{
+	unsigned int i, j;
+
+	printf("hash (%s) %s:\n\t", hash, s);
+	for (i = 0; i < words; i++) {
+		printf(" ");
+		for (j = 0; j < 4; j++)
+			printf("%02x", d[i * 4 + j]);
+	}
+	printf("\n");
+}
+
+int
+main(int argc, char **argv) {
+	isc_sha1_t sha1;
+	isc_sha224_t sha224;
+	isc_md5_t md5;
+	isc_hmacmd5_t hmacmd5;
+	isc_hmacsha1_t hmacsha1;
+	isc_hmacsha224_t hmacsha224;
+	isc_hmacsha256_t hmacsha256;
+	isc_hmacsha384_t hmacsha384;
+	isc_hmacsha512_t hmacsha512;
+	unsigned char digest[ISC_SHA512_DIGESTLENGTH];
+	unsigned char buffer[1024];
+	const char *s;
+	unsigned char key[20];
+
+	UNUSED(argc);
+	UNUSED(argv);
+
+	s = "abc";
+	isc_sha1_init(&sha1);
+	memmove(buffer, s, strlen(s));
+	isc_sha1_update(&sha1, buffer, strlen(s));
+	isc_sha1_final(&sha1, digest);
+	print_digest(s, "sha1", digest, ISC_SHA1_DIGESTLENGTH/4);
+
+	s = "abcdbcdecdefdefgefghfghighijhijkijkljklmklmnlmnomnopnopq";
+	isc_sha1_init(&sha1);
+	memmove(buffer, s, strlen(s));
+	isc_sha1_update(&sha1, buffer, strlen(s));
+	isc_sha1_final(&sha1, digest);
+	print_digest(s, "sha1", digest, ISC_SHA1_DIGESTLENGTH/4);
+
+	s = "abc";
+	isc_sha224_init(&sha224);
+	memmove(buffer, s, strlen(s));
+	isc_sha224_update(&sha224, buffer, strlen(s));
+	isc_sha224_final(digest, &sha224);
+	print_digest(s, "sha224", digest, ISC_SHA224_DIGESTLENGTH/4);
+
+	s = "abcdbcdecdefdefgefghfghighijhijkijkljklmklmnlmnomnopnopq";
+	isc_sha224_init(&sha224);
+	memmove(buffer, s, strlen(s));
+	isc_sha224_update(&sha224, buffer, strlen(s));
+	isc_sha224_final(digest, &sha224);
+	print_digest(s, "sha224", digest, ISC_SHA224_DIGESTLENGTH/4);
+
+	s = "abc";
+	isc_md5_init(&md5);
+	memmove(buffer, s, strlen(s));
+	isc_md5_update(&md5, buffer, strlen(s));
+	isc_md5_final(&md5, digest);
+	print_digest(s, "md5", digest, 4);
+
+	/*
+	 * The 3 HMAC-MD5 examples from RFC2104
+	 */
+	s = "Hi There";
+	memset(key, 0x0b, 16);
+	isc_hmacmd5_init(&hmacmd5, key, 16);
+	memmove(buffer, s, strlen(s));
+	isc_hmacmd5_update(&hmacmd5, buffer, strlen(s));
+	isc_hmacmd5_sign(&hmacmd5, digest);
+	print_digest(s, "hmacmd5", digest, 4);
+
+	s = "what do ya want for nothing?";
+	strlcpy((char *)key, "Jefe", sizeof(key));
+	isc_hmacmd5_init(&hmacmd5, key, 4);
+	memmove(buffer, s, strlen(s));
+	isc_hmacmd5_update(&hmacmd5, buffer, strlen(s));
+	isc_hmacmd5_sign(&hmacmd5, digest);
+	print_digest(s, "hmacmd5", digest, 4);
+
+	s = "\335\335\335\335\335\335\335\335\335\335"
+	    "\335\335\335\335\335\335\335\335\335\335"
+	    "\335\335\335\335\335\335\335\335\335\335"
+	    "\335\335\335\335\335\335\335\335\335\335"
+	    "\335\335\335\335\335\335\335\335\335\335";
+	memset(key, 0xaa, 16);
+	isc_hmacmd5_init(&hmacmd5, key, 16);
+	memmove(buffer, s, strlen(s));
+	isc_hmacmd5_update(&hmacmd5, buffer, strlen(s));
+	isc_hmacmd5_sign(&hmacmd5, digest);
+	print_digest(s, "hmacmd5", digest, 4);
+
+	/*
+	 * The 3 HMAC-SHA1 examples from RFC4634.
+	 */
+	s = "Hi There";
+	memset(key, 0x0b, 20);
+	isc_hmacsha1_init(&hmacsha1, key, 20);
+	memmove(buffer, s, strlen(s));
+	isc_hmacsha1_update(&hmacsha1, buffer, strlen(s));
+	isc_hmacsha1_sign(&hmacsha1, digest, ISC_SHA1_DIGESTLENGTH);
+	print_digest(s, "hmacsha1", digest, ISC_SHA1_DIGESTLENGTH/4);
+
+	s = "what do ya want for nothing?";
+	strlcpy((char *)key, "Jefe", sizeof(key));
+	isc_hmacsha1_init(&hmacsha1, key, 4);
+	memmove(buffer, s, strlen(s));
+	isc_hmacsha1_update(&hmacsha1, buffer, strlen(s));
+	isc_hmacsha1_sign(&hmacsha1, digest, ISC_SHA1_DIGESTLENGTH);
+	print_digest(s, "hmacsha1", digest, ISC_SHA1_DIGESTLENGTH/4);
+
+	s = "\335\335\335\335\335\335\335\335\335\335"
+	    "\335\335\335\335\335\335\335\335\335\335"
+	    "\335\335\335\335\335\335\335\335\335\335"
+	    "\335\335\335\335\335\335\335\335\335\335"
+	    "\335\335\335\335\335\335\335\335\335\335";
+	memset(key, 0xaa, 20);
+	isc_hmacsha1_init(&hmacsha1, key, 20);
+	memmove(buffer, s, strlen(s));
+	isc_hmacsha1_update(&hmacsha1, buffer, strlen(s));
+	isc_hmacsha1_sign(&hmacsha1, digest, ISC_SHA1_DIGESTLENGTH);
+	print_digest(s, "hmacsha1", digest, ISC_SHA1_DIGESTLENGTH/4);
+
+	/*
+	 * The 3 HMAC-SHA224 examples from RFC4634.
+	 */
+	s = "Hi There";
+	memset(key, 0x0b, 20);
+	isc_hmacsha224_init(&hmacsha224, key, 20);
+	memmove(buffer, s, strlen(s));
+	isc_hmacsha224_update(&hmacsha224, buffer, strlen(s));
+	isc_hmacsha224_sign(&hmacsha224, digest, ISC_SHA224_DIGESTLENGTH);
+	print_digest(s, "hmacsha224", digest, ISC_SHA224_DIGESTLENGTH/4);
+
+	s = "what do ya want for nothing?";
+	strlcpy((char *)key, "Jefe", sizeof(key));
+	isc_hmacsha224_init(&hmacsha224, key, 4);
+	memmove(buffer, s, strlen(s));
+	isc_hmacsha224_update(&hmacsha224, buffer, strlen(s));
+	isc_hmacsha224_sign(&hmacsha224, digest, ISC_SHA224_DIGESTLENGTH);
+	print_digest(s, "hmacsha224", digest, ISC_SHA224_DIGESTLENGTH/4);
+
+	s = "\335\335\335\335\335\335\335\335\335\335"
+	    "\335\335\335\335\335\335\335\335\335\335"
+	    "\335\335\335\335\335\335\335\335\335\335"
+	    "\335\335\335\335\335\335\335\335\335\335"
+	    "\335\335\335\335\335\335\335\335\335\335";
+	memset(key, 0xaa, 20);
+	isc_hmacsha224_init(&hmacsha224, key, 20);
+	memmove(buffer, s, strlen(s));
+	isc_hmacsha224_update(&hmacsha224, buffer, strlen(s));
+	isc_hmacsha224_sign(&hmacsha224, digest, ISC_SHA224_DIGESTLENGTH);
+	print_digest(s, "hmacsha224", digest, ISC_SHA224_DIGESTLENGTH/4);
+
+	/*
+	 * The 3 HMAC-SHA256 examples from RFC4634.
+	 */
+	s = "Hi There";
+	memset(key, 0x0b, 20);
+	isc_hmacsha256_init(&hmacsha256, key, 20);
+	memmove(buffer, s, strlen(s));
+	isc_hmacsha256_update(&hmacsha256, buffer, strlen(s));
+	isc_hmacsha256_sign(&hmacsha256, digest, ISC_SHA256_DIGESTLENGTH);
+	print_digest(s, "hmacsha256", digest, ISC_SHA256_DIGESTLENGTH/4);
+
+	s = "what do ya want for nothing?";
+	strlcpy((char *)key, "Jefe", sizeof(key));
+	isc_hmacsha256_init(&hmacsha256, key, 4);
+	memmove(buffer, s, strlen(s));
+	isc_hmacsha256_update(&hmacsha256, buffer, strlen(s));
+	isc_hmacsha256_sign(&hmacsha256, digest, ISC_SHA256_DIGESTLENGTH);
+	print_digest(s, "hmacsha256", digest, ISC_SHA256_DIGESTLENGTH/4);
+
+	s = "\335\335\335\335\335\335\335\335\335\335"
+	    "\335\335\335\335\335\335\335\335\335\335"
+	    "\335\335\335\335\335\335\335\335\335\335"
+	    "\335\335\335\335\335\335\335\335\335\335"
+	    "\335\335\335\335\335\335\335\335\335\335";
+	memset(key, 0xaa, 20);
+	isc_hmacsha256_init(&hmacsha256, key, 20);
+	memmove(buffer, s, strlen(s));
+	isc_hmacsha256_update(&hmacsha256, buffer, strlen(s));
+	isc_hmacsha256_sign(&hmacsha256, digest, ISC_SHA256_DIGESTLENGTH);
+	print_digest(s, "hmacsha256", digest, ISC_SHA256_DIGESTLENGTH/4);
+
+	/*
+	 * The 3 HMAC-SHA384 examples from RFC4634.
+	 */
+	s = "Hi There";
+	memset(key, 0x0b, 20);
+	isc_hmacsha384_init(&hmacsha384, key, 20);
+	memmove(buffer, s, strlen(s));
+	isc_hmacsha384_update(&hmacsha384, buffer, strlen(s));
+	isc_hmacsha384_sign(&hmacsha384, digest, ISC_SHA384_DIGESTLENGTH);
+	print_digest(s, "hmacsha384", digest, ISC_SHA384_DIGESTLENGTH/4);
+
+	s = "what do ya want for nothing?";
+	strlcpy((char *)key, "Jefe", sizeof(key));
+	isc_hmacsha384_init(&hmacsha384, key, 4);
+	memmove(buffer, s, strlen(s));
+	isc_hmacsha384_update(&hmacsha384, buffer, strlen(s));
+	isc_hmacsha384_sign(&hmacsha384, digest, ISC_SHA384_DIGESTLENGTH);
+	print_digest(s, "hmacsha384", digest, ISC_SHA384_DIGESTLENGTH/4);
+
+	s = "\335\335\335\335\335\335\335\335\335\335"
+	    "\335\335\335\335\335\335\335\335\335\335"
+	    "\335\335\335\335\335\335\335\335\335\335"
+	    "\335\335\335\335\335\335\335\335\335\335"
+	    "\335\335\335\335\335\335\335\335\335\335";
+	memset(key, 0xaa, 20);
+	isc_hmacsha384_init(&hmacsha384, key, 20);
+	memmove(buffer, s, strlen(s));
+	isc_hmacsha384_update(&hmacsha384, buffer, strlen(s));
+	isc_hmacsha384_sign(&hmacsha384, digest, ISC_SHA384_DIGESTLENGTH);
+	print_digest(s, "hmacsha384", digest, ISC_SHA384_DIGESTLENGTH/4);
+
+	/*
+	 * The 3 HMAC-SHA512 examples from RFC4634.
+	 */
+	s = "Hi There";
+	memset(key, 0x0b, 20);
+	isc_hmacsha512_init(&hmacsha512, key, 20);
+	memmove(buffer, s, strlen(s));
+	isc_hmacsha512_update(&hmacsha512, buffer, strlen(s));
+	isc_hmacsha512_sign(&hmacsha512, digest, ISC_SHA512_DIGESTLENGTH);
+	print_digest(s, "hmacsha512", digest, ISC_SHA512_DIGESTLENGTH/4);
+
+	s = "what do ya want for nothing?";
+	strlcpy((char *)key, "Jefe", sizeof(key));
+	isc_hmacsha512_init(&hmacsha512, key, 4);
+	memmove(buffer, s, strlen(s));
+	isc_hmacsha512_update(&hmacsha512, buffer, strlen(s));
+	isc_hmacsha512_sign(&hmacsha512, digest, ISC_SHA512_DIGESTLENGTH);
+	print_digest(s, "hmacsha512", digest, ISC_SHA512_DIGESTLENGTH/4);
+
+	s = "\335\335\335\335\335\335\335\335\335\335"
+	    "\335\335\335\335\335\335\335\335\335\335"
+	    "\335\335\335\335\335\335\335\335\335\335"
+	    "\335\335\335\335\335\335\335\335\335\335"
+	    "\335\335\335\335\335\335\335\335\335\335";
+	memset(key, 0xaa, 20);
+	isc_hmacsha512_init(&hmacsha512, key, 20);
+	memmove(buffer, s, strlen(s));
+	isc_hmacsha512_update(&hmacsha512, buffer, strlen(s));
+	isc_hmacsha512_sign(&hmacsha512, digest, ISC_SHA512_DIGESTLENGTH);
+	print_digest(s, "hmacsha512", digest, ISC_SHA512_DIGESTLENGTH/4);
+
+	return (0);
+}

bin/tests/optional/sig0_test.c

@@ -255,7 +255,7 @@ main(int argc, char *argv[]) {
 	CHECK("dns_name_fromtext", result);
 
 	key = NULL;
-	result = dst_key_fromfile(name, 33180, DNS_KEYALG_RSASHA1,
+	result = dst_key_fromfile(name, 4017, DNS_KEYALG_DSA,
 				  DST_TYPE_PUBLIC | DST_TYPE_PRIVATE,
 				  NULL, mctx, &key);
 	CHECK("dst_key_fromfile", result);

bin/tests/system/checkconf/bad-mirror-allow-recursion-none.conf

@@ -1,20 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-options {
-	recursion yes;
-	allow-recursion { none; };
-};
-
-zone "." {
-	type mirror;
-	masters { 127.0.0.1; };
-};

bin/tests/system/checkconf/bad-mirror-explicit-notify-yes.conf

@@ -1,15 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-zone "." {
-	type mirror;
-	notify yes;
-};

bin/tests/system/checkconf/bad-mirror-non-root-zone-without-masters.conf

@@ -1,14 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-zone "foo." {
-	type mirror;
-};

bin/tests/system/checkconf/bad-mirror-recursion-no.conf

@@ -1,18 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-options {
-	recursion no;
-};
-
-zone "." {
-	type mirror;
-};

bin/tests/system/checkconf/good-mirror-inherited-notify-yes.conf

@@ -1,18 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-options {
-	notify yes;
-};
-
-zone "." {
-	type mirror;
-};

bin/tests/system/checkconf/good-mirror-root-zone-without-masters.conf

@@ -1,14 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-zone "." {
-	type mirror;
-};

bin/tests/system/digcomp.pl

@@ -57,28 +57,6 @@ while (<FILE1>) {
 		} else {
 			$entry{"$name ; $class.$type ; $value"} = $_;
 		}
-	} elsif (/^(\S+)\s+\S+\s+(\S+)\s+(\S+)\s*$/) {
-		$name = $1;
-		$class = $2;
-		$type = $3;
-		$value = "";
-		if ($lc) {
-			$name = lc($name);
-			$value = lc($value);
-		}
-		if ($type eq "SOA") {
-			$firstname = $name if ($firstname eq "");
-			if ($name eq $firstname) {
-				$name = "$name$count";
-				$count++;
-			}
-		}
-		if ($entry{"$name ; $class.$type ; $value"} ne "") {
-			$line = $entry{"$name ; $class.$type ; $value"};
-			print("Duplicate entry in $file1:\n> $_\n< $line\n");
-		} else {
-			$entry{"$name ; $class.$type ; $value"} = $_;
-		}
 	}
 }
 close(FILE1);
@@ -115,28 +93,6 @@ while (<FILE2>) {
 			$printed++;
 			$status = 1;
 		}
-	} elsif (/^(\S+)\s+\S+\s+(\S+)\s+(\S+)\s*$/) {
-		$name = $1;
-		$class = $2;
-		$type = $3;
-		$value = "";
-		if ($lc) {
-			$name = lc($name);
-			$value = lc($value);
-		}
-		if (($name eq $firstname) && ($type eq "SOA")) {
-			$count--;
-			$name = "$name$count";
-		}
-		if ($entry{"$name ; $class.$type ; $value"} ne "") {
-			$entry{"$name ; $class.$type ; $value"} = "";
-		} else {
-			print("Only in $file2 (missing from $file1):\n")
-			    if ($printed == 0);
-			print("> $_\n");
-			$printed++;
-			$status = 1;
-		}
 	}
 }
 close(FILE2);

bin/tests/system/fetchlimit/tests.sh

@@ -157,7 +157,7 @@ status=`expr $status + $ret`
 copy_setports ns3/named3.conf.in ns3/named.conf
 $RNDCCMD reconfig 2>&1 | sed 's/^/ns3 /' | cat_i
 
-echo_i "checking lame server clients are dropped at the soft limit"
+echo_i "checking lame server clients are dropped near the soft limit"
 ret=0
 fail=0
 exceeded=0
@@ -166,7 +166,7 @@ touch ans4/norespond
 for try in 1 2 3 4 5; do
     burst b $try 400
     $DIG @10.53.0.3 -p ${PORT}  a ${try}.example > dig.out.ns3.$try
-    stat 360 || exceeded=`expr $exceeded + 1`
+    stat 370 || exceeded=`expr $exceeded + 1`
     grep "status: NOERROR" dig.out.ns3.$try > /dev/null 2>&1 && \
             success=`expr $success + 1`
     grep "status: SERVFAIL" dig.out.ns3.$try > /dev/null 2>&1 && \
@@ -177,7 +177,7 @@ echo_i "$success successful valid queries (expected 5)"
 [ "$success" -eq 5 ] || { echo_i "failed"; ret=1; }
 echo_i "$fail SERVFAIL responses (expected 0)"
 [ "$fail" -eq 0 ] || { echo_i "failed"; ret=1; }
-echo_i "clients count exceeded 360 on $exceeded trials (expected 0)"
+echo_i "clients count exceeded 370 on $exceeded trials (expected 0)"
 [ "$exceeded" -eq 0 ] || { echo_i "failed"; ret=1; }
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`

bin/tests/system/genzone.sh

@@ -186,21 +186,14 @@ loc02			LOC 	60 09 00.000 N 24 39 00.000 E 10.00m 20.00m (
 ;nxt03			NXT	. 1
 ;nxt04			NXT	. 127
 
-; type 31
-eid01			EID	12 89 AB
-
-; type 32
-nimloc01		NIMLOC	12 89 AB
+; type 31 (EID - not implemented by BIND)
+; type 32 (NIMLOC - not implemented by BIND)
 
 ; type 33
-srv01			SRV	0 0 0 .
-srv02			SRV	65535 65535 65535  old-slow-box
+srv01			SRV 0 0 0 .
+srv02			SRV 65535 65535 65535  old-slow-box
 
-; type 34
-atma01			ATMA	+61200000000
-atma02			ATMA	+61.2.0000.0000
-atma03			ATMA	1234567890abcdef
-atma04			ATMA	f.e.d.c.b.a.0.9.8.7.6.5.4.3.2.1
+; type 34 (ATMA - not implemented by BIND)
 
 ; type 35
 naptr01			NAPTR   0 0 "" "" "" . 
@@ -236,7 +229,6 @@ sink02			SINK	8 0 2 l4ik
 
 ; type 42
 apl01			APL	!1:10.0.0.1/32 1:10.0.0.0/24
-apl02			APL
 
 ; type 43
 ds01			DS	12892 5 2 26584835CA80C81C91999F31CFAF2A0E89D4FF1C8FAFD0DDB31A85C7 19277C13
@@ -374,14 +366,9 @@ csync02			CSYNC	0 0
 spf01			SPF	"v=spf1 -all"
 spf02			SPF	"v=spf1" " -all"
 
-; type 100 (UINFO - not implemented by BIND - unknown record format only)
-uinfo01			UINFO	\# 1 01
-
-; type 101 (UID - not implemented by BIND - unknown record format only)
-uid01			UID	\# 1 02
-
-; type 102 (GID - not implemented by BIND - unknown record format only)
-gid01			GID	\# 1 03
+; type 100 (UINFO - not implemented by BIND)
+; type 101 (UID - not implemented by BIND)
+; type 102 (GID - not implemented by BIND)
 
 ; type 103 (UNSPEC - XXXMUKS TODO - this has some weird encoding - see btoa_totext())
 

bin/tests/system/mirror/README

@@ -1,17 +0,0 @@
-Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-
-See COPYRIGHT in the source root or http://isc.org/copyright.html for terms.
-
-This test checks whether zones configured with "type mirror;" behave as
-expected.
-
-ns1 is an authoritative-only server.  It only serves the root zone, which is
-mirrored by ns3.
-
-ns2 is an authoritative-only server.  It serves a number of zones, some of which
-are delegated to it by ns1 and used in recursive resolution tests aimed at ns3
-while others are only served so that ns3 has a primary server to mirror zones
-from during various tests of the mirror zone implementation.
-
-ns3 is a recursive resolver.  It has a number of mirror zones configured.  This
-is the only server whose behavior is being examined by this system test.

bin/tests/system/mirror/clean.sh

@@ -11,7 +11,6 @@ rm -f */*.conf
 rm -f */*.db
 rm -f */*.jnl
 rm -f */*.mirror
-rm -f */*.nzd*
 rm -f */*.prev
 rm -f */*.signed
 rm -f */K*

bin/tests/system/mirror/ns2/named.conf.in

@@ -45,11 +45,6 @@ zone "initially-unavailable" {
 	allow-transfer { 10.53.0.254; };
 };
 
-zone "verify-addzone" {
-	type master;
-	file "verify-addzone.db.original.signed";
-};
-
 zone "verify-axfr" {
 	type master;
 	file "verify-axfr.db.signed";

bin/tests/system/mirror/ns2/sign.sh

@@ -36,7 +36,7 @@ ORIGINAL_SERIAL=`awk '$2 == "SOA" {print $5}' verify.db.in`
 UPDATED_SERIAL_BAD=`expr ${ORIGINAL_SERIAL} + 1`
 UPDATED_SERIAL_GOOD=`expr ${ORIGINAL_SERIAL} + 2`
 
-for variant in addzone axfr ixfr load reconfig untrusted; do
+for variant in axfr ixfr load reconfig untrusted; do
 	zone=verify-$variant
 	infile=verify.db.in
 	zonefile=verify-$variant.db

bin/tests/system/mirror/ns3/named.conf.in

@@ -29,7 +29,6 @@ options {
 	recursion yes;
 	allow-query-cache { 10.53.0.1; };
 	trust-anchor-telemetry yes;
-	allow-new-zones yes;
 };
 
 zone "." {
@@ -38,54 +37,62 @@ zone "." {
 };
 
 zone "." {
-	type mirror;
+	type slave;
 	masters { 10.53.0.1; };
+	mirror yes;
 	file "root.db.mirror";
 };
 
 zone "initially-unavailable" {
-	type mirror;
+	type slave;
 	masters { 10.53.0.2; };
+	mirror yes;
 	file "initially-unavailable.db.mirror";
 	use-alt-transfer-source no;
 };
 
 zone "verify-axfr" {
-	type mirror;
+	type slave;
 	masters { 10.53.0.2; };
+	mirror yes;
 	file "verify-axfr.db.mirror";
 };
 
 zone "verify-ixfr" {
-	type mirror;
+	type slave;
 	masters { 10.53.0.2; };
+	mirror yes;
 	file "verify-ixfr.db.mirror";
 	masterfile-format text;
 };
 
 zone "verify-load" {
-	type mirror;
+	type slave;
 	masters { 10.53.0.2; };
+	mirror yes;
 	file "verify-load.db.mirror";
 	masterfile-format text;
 };
 
 zone "verify-reconfig" {
-	type mirror;
+	type slave;
 	masters { 10.53.0.2; };
+	mirror yes;
 	file "verify-reconfig.db.mirror";
 	masterfile-format text;
 };
 
 zone "verify-unsigned" {
-	type mirror;
+	type slave;
 	masters { 10.53.0.2; };
+	mirror yes;
 	file "verify-unsigned.db.mirror";
 };
 
 zone "verify-untrusted" {
-	type mirror;
+	type slave;
 	masters { 10.53.0.2; };
+	mirror yes;
 	file "verify-untrusted.db.mirror";
 };
 

bin/tests/system/mirror/setup.sh

@@ -21,4 +21,6 @@ copy_setports ns3/named.conf.in ns3/named.conf
 ( cd ns1 && $SHELL -e sign.sh )
 
 cat ns2/verify-axfr.db.bad.signed > ns2/verify-axfr.db.signed
+cat ns2/verify-ixfr.db.original.signed > ns2/verify-ixfr.db.signed
 cat ns2/verify-load.db.bad.signed > ns3/verify-load.db.mirror
+cat ns2/verify-untrusted.db.original.signed > ns2/verify-untrusted.db.signed

bin/tests/system/mirror/tests.sh

@@ -380,7 +380,7 @@ if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
 
 n=`expr $n + 1`
-echo_i "checking that \"rndc reconfig\" properly handles a mirror -> slave zone type change ($n)"
+echo_i "checking that \"rndc reconfig\" properly handles a yes -> no \"mirror\" setting change ($n)"
 ret=0
 # Sanity check before we start.
 $DIG $DIGOPTS @10.53.0.3 +norec verify-reconfig SOA > dig.out.ns3.test$n.1 2>&1 || ret=1
@@ -390,13 +390,13 @@ grep "flags:.* ad" dig.out.ns3.test$n.1 > /dev/null || ret=1
 # Reconfigure the zone so that it is no longer a mirror zone.
 # (NOTE: Keep the embedded newline in the sed function list below.)
 sed '/^zone "verify-reconfig" {$/,/^};$/ {
-	s/type mirror;/type slave;/
+	s/mirror yes;/mirror no;/
 }' ns3/named.conf > ns3/named.conf.modified
 mv ns3/named.conf.modified ns3/named.conf
 nextpart ns3/named.run > /dev/null
 $RNDCCMD 10.53.0.3 reconfig > /dev/null 2>&1
-# Zones whose type was changed should not be reusable, which means the tested
-# zone should have been reloaded from disk.
+# Zones whose "mirror" setting was changed should not be reusable, which means
+# the tested zone should have been reloaded from disk.
 wait_for_load verify-reconfig ${ORIGINAL_SERIAL} ns3/named.run
 # Ensure responses sourced from the reconfigured zone have AA=1 and AD=0.
 $DIG $DIGOPTS @10.53.0.3 +norec verify-reconfig SOA > dig.out.ns3.test$n.2 2>&1 || ret=1
@@ -407,7 +407,7 @@ if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
 
 n=`expr $n + 1`
-echo_i "checking that \"rndc reconfig\" properly handles a slave -> mirror zone type change ($n)"
+echo_i "checking that \"rndc reconfig\" properly handles a no -> yes \"mirror\" setting change ($n)"
 ret=0
 # Put an incorrectly signed version of the zone in the zone file used by ns3.
 nextpart ns3/named.run > /dev/null
@@ -415,7 +415,7 @@ cat ns2/verify-reconfig.db.bad.signed > ns3/verify-reconfig.db.mirror
 # Reconfigure the zone so that it is a mirror zone again.
 # (NOTE: Keep the embedded newline in the sed function list below.)
 sed '/^zone "verify-reconfig" {$/,/^};$/ {
-	s/type slave;/type mirror;/
+	s/mirror no;/mirror yes;/
 }' ns3/named.conf > ns3/named.conf.modified
 mv ns3/named.conf.modified ns3/named.conf
 $RNDCCMD 10.53.0.3 reconfig > /dev/null 2>&1
@@ -427,39 +427,6 @@ nextpart ns3/named.run | grep "No correct RSASHA256 signature for verify-reconfi
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
 
-n=`expr $n + 1`
-echo_i "checking that a mirror zone can be added using rndc ($n)"
-ret=0
-# Sanity check: the zone should not exist in the root zone.
-$DIG $DIGOPTS @10.53.0.3 +norec verify-addzone SOA > dig.out.ns3.test$n.1 2>&1 || ret=1
-grep "NXDOMAIN" dig.out.ns3.test$n.1 > /dev/null || ret=1
-grep "flags:.* aa" dig.out.ns3.test$n.1 > /dev/null && ret=1
-grep "flags:.* ad" dig.out.ns3.test$n.1 > /dev/null || ret=1
-# Mirror a zone which does not exist in the root zone.
-nextpart ns3/named.run > /dev/null
-$RNDCCMD 10.53.0.3 addzone verify-addzone '{ type mirror; masters { 10.53.0.2; }; };' > rndc.out.ns3.test$n 2>&1 || ret=1
-wait_for_transfer verify-addzone
-# Check whether the mirror zone was added and whether it behaves as expected.
-$DIG $DIGOPTS @10.53.0.3 +norec verify-addzone SOA > dig.out.ns3.test$n.2 2>&1 || ret=1
-grep "NOERROR" dig.out.ns3.test$n.2 > /dev/null || ret=1
-grep "flags:.* aa" dig.out.ns3.test$n.2 > /dev/null && ret=1
-grep "flags:.* ad" dig.out.ns3.test$n.2 > /dev/null || ret=1
-if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
-
-n=`expr $n + 1`
-echo_i "checking that a mirror zone can be deleted using rndc ($n)"
-ret=0
-# Remove the mirror zone added in the previous test.
-$RNDCCMD 10.53.0.3 delzone verify-addzone > rndc.out.ns3.test$n 2>&1 || ret=1
-# Check whether the mirror zone was removed.
-$DIG $DIGOPTS @10.53.0.3 +norec verify-addzone SOA > dig.out.ns3.test$n 2>&1 || ret=1
-grep "NXDOMAIN" dig.out.ns3.test$n > /dev/null || ret=1
-grep "flags:.* aa" dig.out.ns3.test$n > /dev/null && ret=1
-grep "flags:.* ad" dig.out.ns3.test$n > /dev/null || ret=1
-if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
-
 n=`expr $n + 1`
 echo_i "ensuring trust anchor telemetry queries are sent upstream for a mirror zone ($n)"
 ret=0

bin/tests/system/qmin/ans2/ans.py

@@ -120,9 +120,6 @@ def create_response(msg):
         slow = True
         suffix = "slow."
         lqname = lqname[:-5]
-    elif lqname.endswith("fwd."):
-        suffix = "fwd."
-        lqname = lqname[:-4]
     else:
         r.set_rcode(REFUSED)
         return r

bin/tests/system/qmin/clean.sh

@@ -14,5 +14,5 @@ rm -f */named.memstats
 rm -f */named.run
 rm -f dig.out.*
 rm -f ns*/named.lock
-rm -f ans*/query.log*
+rm -f ans*/query.log
 rm -f query*.log

bin/tests/system/qmin/ns1/root.db

@@ -30,6 +30,3 @@ ns2.slow.		A	10.53.0.2
 
 ugly.			NS	ns2.ugly.
 ns2.ugly.		A	10.53.0.2
-
-fwd.			NS	ns2.fwd.
-ns2.fwd.		A	10.53.0.2

bin/tests/system/qmin/ns7/named.conf.in

@@ -39,11 +39,3 @@ zone "." {
 	type hint;
 	file "../../common/root.hint";
 };
-
-zone "fwd." IN {
-	type forward;
-	forwarders {
-		10.53.0.2;
-	};
-	forward only;
-};

bin/tests/system/qmin/tests.sh

@@ -117,16 +117,14 @@ $DIG $DIGOPTS icky.icky.icky.ptang.zoop.boing.good. @10.53.0.6 > dig.out.test$n
 grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
 grep "icky.icky.icky.ptang.zoop.boing.good. 1	IN A	192.0.2.1" dig.out.test$n > /dev/null || ret=1
 sleep 1
-sort ans2/query.log > ans2/query.log.sorted
-cat << __EOF | diff ans2/query.log.sorted - > /dev/null || ret=1
-ADDR a.bit.longer.ns.name.good.
-ADDR a.bit.longer.ns.name.good.
-ADDR ns2.good.
-ADDR ns3.good.
-ADDR ns3.good.
-NS boing.good.
+cat << __EOF | diff ans2/query.log - > /dev/null || ret=1
 NS good.
+NS boing.good.
 NS zoop.boing.good.
+ADDR ns3.good.
+ADDR ns3.good.
+ADDR a.bit.longer.ns.name.good.
+ADDR a.bit.longer.ns.name.good.
 __EOF
 cat << __EOF | diff ans3/query.log - > /dev/null || ret=1
 NS zoop.boing.good.
@@ -153,7 +151,6 @@ sleep 1
 cat << __EOF | diff ans2/query.log - > /dev/null || ret=1
 NS bad.
 NS boing.bad.
-ADDR ns2.bad.
 __EOF
 for ans in ans2 ans3 ans4; do mv -f $ans/query.log query-$ans-$n.log 2>/dev/null || true; done
 if [ $ret != 0 ]; then echo_i "failed"; fi
@@ -168,16 +165,14 @@ $DIG $DIGOPTS icky.icky.icky.ptang.zoop.boing.bad. @10.53.0.7 > dig.out.test$n
 grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
 grep "icky.icky.icky.ptang.zoop.boing.bad. 1 IN A	192.0.2.1" dig.out.test$n > /dev/null || ret=1
 sleep 1
-sort ans2/query.log > ans2/query.log.sorted
-cat << __EOF | diff ans2/query.log.sorted - > /dev/null || ret=1
-ADDR a.bit.longer.ns.name.bad.
-ADDR a.bit.longer.ns.name.bad.
-ADDR icky.icky.icky.ptang.zoop.boing.bad.
-ADDR ns2.bad.
-ADDR ns3.bad.
-ADDR ns3.bad.
+cat << __EOF | diff ans2/query.log - > /dev/null || ret=1
 NS bad.
 NS boing.bad.
+ADDR icky.icky.icky.ptang.zoop.boing.bad.
+ADDR ns3.bad.
+ADDR ns3.bad.
+ADDR a.bit.longer.ns.name.bad.
+ADDR a.bit.longer.ns.name.bad.
 __EOF
 echo "ADDR icky.icky.icky.ptang.zoop.boing.bad." | diff ans3/query.log - > /dev/null || ret=1
 echo "ADDR icky.icky.icky.ptang.zoop.boing.bad." | diff ans4/query.log - > /dev/null || ret=1
@@ -193,12 +188,10 @@ $RNDCCMD 10.53.0.6 flush
 $DIG $DIGOPTS icky.icky.icky.ptang.zoop.boing.ugly. @10.53.0.6 > dig.out.test$n
 grep "status: SERVFAIL" dig.out.test$n > /dev/null || ret=1
 sleep 1
-sort ans2/query.log > ans2/query.log.sorted
-cat << __EOF | diff ans2/query.log.sorted - > /dev/null || ret=1
-ADDR ns2.ugly.
-NS boing.ugly.
-NS boing.ugly.
+cat << __EOF | diff ans2/query.log - > /dev/null || ret=1
 NS ugly.
+NS boing.ugly.
+NS boing.ugly.
 __EOF
 for ans in ans2 ans3 ans4; do mv -f $ans/query.log query-$ans-$n.log 2>/dev/null || true; done
 if [ $ret != 0 ]; then echo_i "failed"; fi
@@ -214,17 +207,15 @@ $DIG $DIGOPTS icky.icky.icky.ptang.zoop.boing.ugly. @10.53.0.7 > dig.out.test$n
 grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
 grep "icky.icky.icky.ptang.zoop.boing.ugly. 1	IN A	192.0.2.1" dig.out.test$n > /dev/null || ret=1
 sleep 1
-sort ans2/query.log > ans2/query.log.sorted
-cat << __EOF | diff ans2/query.log.sorted - > /dev/null || ret=1
-ADDR a.bit.longer.ns.name.ugly.
-ADDR a.bit.longer.ns.name.ugly.
-ADDR icky.icky.icky.ptang.zoop.boing.ugly.
-ADDR ns2.ugly.
-ADDR ns3.ugly.
-ADDR ns3.ugly.
-NS boing.ugly.
-NS boing.ugly.
+cat << __EOF | diff ans2/query.log - > /dev/null || ret=1
 NS ugly.
+NS boing.ugly.
+NS boing.ugly.
+ADDR icky.icky.icky.ptang.zoop.boing.ugly.
+ADDR ns3.ugly.
+ADDR ns3.ugly.
+ADDR a.bit.longer.ns.name.ugly.
+ADDR a.bit.longer.ns.name.ugly.
 __EOF
 echo "ADDR icky.icky.icky.ptang.zoop.boing.ugly." | diff ans3/query.log - > /dev/null || ret=1
 echo "ADDR icky.icky.icky.ptang.zoop.boing.ugly." | diff ans4/query.log - > /dev/null || ret=1
@@ -242,16 +233,14 @@ $DIG $DIGOPTS icky.icky.icky.ptang.zoop.boing.slow. @10.53.0.6 > dig.out.test$n
 sleep 5
 grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
 grep "icky.icky.icky.ptang.zoop.boing.slow. 1	IN A	192.0.2.1" dig.out.test$n > /dev/null || ret=1
-sort ans2/query.log > ans2/query.log.sorted
-cat << __EOF | diff ans2/query.log.sorted - > /dev/null || ret=1
-ADDR a.bit.longer.ns.name.slow.
-ADDR a.bit.longer.ns.name.slow.
-ADDR ns2.slow.
-ADDR ns3.slow.
-ADDR ns3.slow.
-NS boing.slow.
+cat << __EOF | diff ans2/query.log - > /dev/null || ret=1
 NS slow.
+NS boing.slow.
 NS zoop.boing.slow.
+ADDR ns3.slow.
+ADDR ns3.slow.
+ADDR a.bit.longer.ns.name.slow.
+ADDR a.bit.longer.ns.name.slow.
 __EOF
 cat << __EOF | diff ans3/query.log - > /dev/null || ret=1
 NS zoop.boing.slow.
@@ -276,8 +265,7 @@ $DIG $DIGOPTS -x 2001:4f8::1 @10.53.0.6 > dig.out.test$n
 grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
 grep "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.8.f.4.0.1.0.0.2.ip6.arpa. 1 IN PTR nee.com." dig.out.test$n > /dev/null || ret=1
 sleep 1
-grep -v ADDR ans2/query.log > ans2/query.log.trimmed
-cat << __EOF | diff ans2/query.log.trimmed - > /dev/null || ret=1
+cat << __EOF | diff ans2/query.log - > /dev/null || ret=1
 NS 1.0.0.2.ip6.arpa.
 NS 8.f.4.0.1.0.0.2.ip6.arpa.
 NS 0.0.0.0.8.f.4.0.1.0.0.2.ip6.arpa.
@@ -298,16 +286,14 @@ $DIG $DIGOPTS more.icky.icky.icky.ptang.zoop.boing.good. @10.53.0.6 > dig.out.te
 grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
 grep "more.icky.icky.icky.ptang.zoop.boing.good. 1 IN	A 192.0.2.2" dig.out.test$n > /dev/null || ret=1
 sleep 1
-sort ans2/query.log > ans2/query.log.sorted
-cat << __EOF | diff ans2/query.log.sorted - > /dev/null || ret=1
-ADDR a.bit.longer.ns.name.good.
-ADDR a.bit.longer.ns.name.good.
-ADDR ns2.good.
-ADDR ns3.good.
-ADDR ns3.good.
-NS boing.good.
+cat << __EOF | diff ans2/query.log - > /dev/null || ret=1
 NS good.
+NS boing.good.
 NS zoop.boing.good.
+ADDR ns3.good.
+ADDR ns3.good.
+ADDR a.bit.longer.ns.name.good.
+ADDR a.bit.longer.ns.name.good.
 __EOF
 cat << __EOF | diff ans3/query.log - > /dev/null || ret=1
 NS zoop.boing.good.
@@ -324,21 +310,5 @@ for ans in ans2 ans3 ans4; do mv -f $ans/query.log query-$ans-$n.log 2>/dev/null
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
 
-n=`expr $n + 1`
-echo_i "qname minimization is disabled when forwarding ($n)"
-ret=0
-$CLEANQL
-$RNDCCMD 10.53.0.7 flush
-$DIG $DIGOPTS a.bit.longer.ns.name.fwd. @10.53.0.7 > dig.out.test$n
-grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
-grep "a.bit.longer.ns.name.fwd. 1	IN	A	10.53.0.4" dig.out.test$n >/dev/null || ret=1
-sleep 1
-cat << __EOF | diff ans2/query.log - > /dev/null || ret=1
-ADDR a.bit.longer.ns.name.fwd.
-__EOF
-for ans in ans2; do mv -f $ans/query.log query-$ans-$n.log 2>/dev/null || true; done
-if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
-
 echo_i "exit status: $status"
 [ $status -eq 0 ] || exit 1

bin/tests/system/rpzrecurse/setup.sh

@@ -1,4 +1,4 @@
-#!/bin/sh
+#!/bin/sh -x
 #
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #

bin/tests/system/rpzrecurse/tests.sh

@@ -1,4 +1,4 @@
-#!/bin/sh
+#!/bin/sh -x
 #
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #

bin/tests/system/runtime/tests.sh

@@ -24,28 +24,6 @@ grep "another named process" ns2/named.run > /dev/null && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
 
-if [ ! "$CYGWIN" ]; then
-    n=`expr $n + 1`
-    echo_i "verifying that named checks for conflicting listeners ($n)"
-    ret=0
-    (cd ns2; $NAMED -c named-alt1.conf -D ns2-extra-1 -X other.lock -m record,size,mctx -d 99 -g -U 4 >> named2.run 2>&1 & )
-    for i in 1 2 3 4 5 6 7 8 9
-    do
-        grep "unable to listen on any configured interface" ns2/named2.run > /dev/null && break
-        sleep 1
-    done
-    grep "unable to listen on any configured interface" ns2/named2.run > /dev/null || ret=1
-    for i in 1 2 3 4 5 6 7 8 9
-    do
-	grep "exiting (due to fatal error)" ns2/named2.run > /dev/null && break
-	sleep 1
-    done
-    pid=`cat ns2/named2.pid 2>/dev/null`
-    test "${pid:+set}" = set && $KILL -15 ${pid} >/dev/null 2>&1
-    if [ $ret != 0 ]; then echo_i "failed"; fi
-    status=`expr $status + $ret`
-fi
-
 n=`expr $n + 1`
 echo_i "verifying that named checks for conflicting named processes ($n)"
 ret=0

bin/tests/system/statschannel/tests.sh

@@ -197,28 +197,20 @@ if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
 n=`expr $n + 1`
 
+ret=0
 echo_i "checking consistency between regular and compressed output ($n)"
-for i in 1 2 3 4 5; do
-	ret=0
-	if [ "$HAVEXMLSTATS" ];
-	then
-		URL=http://10.53.0.2:${EXTRAPORT1}/xml/v3/server
-	else
-		URL=http://10.53.0.2:${EXTRAPORT1}/json/v1/server
-	fi
-	$CURL -D regular.headers $URL 2>/dev/null | \
-		sed -e "s#<current-time>.*</current-time>##g" > regular.out
-	$CURL -D compressed.headers --compressed $URL 2>/dev/null | \
-		sed -e "s#<current-time>.*</current-time>##g" > compressed.out
-	diff regular.out compressed.out >/dev/null || ret=1
-	if [ $ret != 0 ]; then
-		echo_i "failed on try $i, probably a timing issue, trying again"
-		sleep 1
-	else
-		break
-	fi
-done
-
+if [ "$HAVEXMLSTATS" ];
+then
+	URL=http://10.53.0.2:${EXTRAPORT1}/xml/v3/server
+else
+	URL=http://10.53.0.2:${EXTRAPORT1}/json/v1/server
+fi
+$CURL -D regular.headers $URL 2>/dev/null | \
+	sed -e "s#<current-time>.*</current-time>##g" > regular.out
+$CURL -D compressed.headers --compressed $URL 2>/dev/null | \
+	sed -e "s#<current-time>.*</current-time>##g" > compressed.out
+diff regular.out compressed.out >/dev/null || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
 n=`expr $n + 1`
 

bin/tests/system/xfer/dig1.good

@@ -12,11 +12,6 @@ aaaa02.example.		3600	IN	AAAA	fd92:7065:b8e:ffff::5
 afsdb01.example.	3600	IN	AFSDB	0 hostname.example.
 afsdb02.example.	3600	IN	AFSDB	65535 .
 apl01.example.		3600	IN	APL	!1:10.0.0.1/32 1:10.0.0.0/24
-apl02.example.		3600	IN	APL
-atma01.example.		3600	IN	ATMA	+61200000000
-atma02.example.		3600	IN	ATMA	+61200000000
-atma03.example.		3600	IN	ATMA	1234567890abcdef
-atma04.example.		3600	IN	ATMA	fedcba0987654321
 avc.example.		3600	IN	AVC	"foo:bar"
 caa01.example.		3600	IN	CAA	0 issue "ca.example.net; policy=ev"
 caa02.example.		3600	IN	CAA	128 tbs "Unknown"
@@ -42,10 +37,8 @@ ds01.example.		3600	IN	NS	ns42.example.
 ds01.example.		3600	IN	DS	12892 5 2 26584835CA80C81C91999F31CFAF2A0E89D4FF1C8FAFD0DDB31A85C7 19277C13
 ds02.example.		3600	IN	NS	ns43.example.
 ds02.example.		3600	IN	DS	12892 5 1 7AA4A3F416C2F2391FB7AB0D434F762CD62D1390
-eid01.example.		3600	IN	EID	1289AB
 eui48.example.		3600	IN	EUI48	01-23-45-67-89-ab
 eui64.example.		3600	IN	EUI64	01-23-45-67-89-ab-cd-ef
-gid01.example.		3600	IN	GID	\# 1 03
 gpos01.example.		3600	IN	GPOS	"-22.6882" "116.8652" "250.0"
 gpos02.example.		3600	IN	GPOS	"" "" ""
 hinfo01.example.	3600	IN	HINFO	"Generic PC clone" "NetBSD-1.4"
@@ -85,7 +78,6 @@ mx01.example.		3600	IN	MX	10 mail.example.
 mx02.example.		3600	IN	MX	10 .
 naptr01.example.	3600	IN	NAPTR	0 0 "" "" "" .
 naptr02.example.	3600	IN	NAPTR	65535 65535 "blurgh" "blorf" "blllbb" foo.
-nimloc01.example.	3600	IN	NIMLOC	1289AB
 ninfo01.example.	3600	IN	NINFO	"foo"
 ninfo02.example.	3600	IN	NINFO	"foo" "bar"
 ninfo03.example.	3600	IN	NINFO	"foo"
@@ -150,8 +142,6 @@ txt12.example.		3600	IN	TXT	"\"foo\""
 txt13.example.		3600	IN	TXT	"foo;"
 txt14.example.		3600	IN	TXT	"foo;"
 txt15.example.		3600	IN	TXT	"bar\\;"
-uid01.example.		3600	IN	UID	\# 1 02
-uinfo01.example.	3600	IN	UINFO	\# 1 01
 uri01.example.		3600	IN	URI	10 20 "https://www.isc.org/"
 uri02.example.		3600	IN	URI	30 40 "https://www.isc.org/HolyCowThisSureIsAVeryLongURIRecordIDontEvenKnowWhatSomeoneWouldEverWantWithSuchAThingButTheSpecificationRequiresThatWesupportItSoHereWeGoTestingItLaLaLaLaLaLaLaSeriouslyThoughWhyWouldYouEvenConsiderUsingAURIThisLongItSeemsLikeASillyIdeaButEnhWhatAreYouGonnaDo/"
 uri03.example.		3600	IN	URI	30 40 ""

bin/tests/system/xfer/dig2.good

@@ -12,11 +12,6 @@ aaaa02.example.		3600	IN	AAAA	fd92:7065:b8e:ffff::5
 afsdb01.example.	3600	IN	AFSDB	0 hostname.example.
 afsdb02.example.	3600	IN	AFSDB	65535 .
 apl01.example.		3600	IN	APL	!1:10.0.0.1/32 1:10.0.0.1/24
-apl02.example.		3600	IN	APL
-atma01.example.		3600	IN	ATMA	+61200000000
-atma02.example.		3600	IN	ATMA	+61200000000
-atma03.example.		3600	IN	ATMA	1234567890abcdef
-atma04.example.		3600	IN	ATMA	fedcba0987654321
 avc.example.		3600	IN	AVC	"foo:bar"
 caa01.example.		3600	IN	CAA	0 issue "ca.example.net; policy=ev"
 caa02.example.		3600	IN	CAA	128 tbs "Unknown"
@@ -42,10 +37,8 @@ ds01.example.		3600	IN	NS	ns42.example.
 ds01.example.		3600	IN	DS	12892 5 2 26584835CA80C81C91999F31CFAF2A0E89D4FF1C8FAFD0DDB31A85C7 19277C13
 ds02.example.		3600	IN	NS	ns43.example.
 ds02.example.		3600	IN	DS	12892 5 1 7AA4A3F416C2F2391FB7AB0D434F762CD62D1390
-eid01.example.		3600	IN	EID	1289AB
 eui48.example.		3600	IN	EUI48   01-23-45-67-89-ab
 eui64.example.		3600	IN	EUI64	01-23-45-67-89-ab-cd-ef
-gid01.example.		3600	IN	GID	\# 1 03
 gpos01.example.		3600	IN	GPOS	"-22.6882" "116.8652" "250.0"
 gpos02.example.		3600	IN	GPOS	"" "" ""
 hinfo01.example.	3600	IN	HINFO	"Generic PC clone" "NetBSD-1.4"
@@ -85,7 +78,6 @@ mx01.example.		3600	IN	MX	10 mail.example.
 mx02.example.		3600	IN	MX	10 .
 naptr01.example.	3600	IN	NAPTR	0 0 "" "" "" .
 naptr02.example.	3600	IN	NAPTR	65535 65535 "blurgh" "blorf" "blllbb" foo.
-nimloc01.example.	3600	IN	NIMLOC	1289AB
 ninfo01.example.	3600	IN	NINFO	"foo"
 ninfo02.example.	3600	IN	NINFO	"foo" "bar"
 ninfo03.example.	3600	IN	NINFO	"foo"
@@ -150,8 +142,6 @@ txt12.example.		3600	IN	TXT	"\"foo\""
 txt13.example.		3600	IN	TXT	"foo;"
 txt14.example.		3600	IN	TXT	"foo;"
 txt15.example.		3600	IN	TXT	"bar\\;"
-uid01.example.		3600	IN	UID	\# 1 02
-uinfo01.example.	3600	IN	UINFO	\# 1 01
 uri01.example.		3600	IN	URI	10 20 "https://www.isc.org/"
 uri02.example.		3600	IN	URI	30 40 "https://www.isc.org/HolyCowThisSureIsAVeryLongURIRecordIDontEvenKnowWhatSomeoneWouldEverWantWithSuchAThingButTheSpecificationRequiresThatWesupportItSoHereWeGoTestingItLaLaLaLaLaLaLaSeriouslyThoughWhyWouldYouEvenConsiderUsingAURIThisLongItSeemsLikeASillyIdeaButEnhWhatAreYouGonnaDo/"
 uri03.example.		3600	IN	URI	30 40 ""

config.h.in

@@ -69,14 +69,11 @@
 /* Define if clock_gettime is available. */
 #undef HAVE_CLOCK_GETTIME
 
-/* Use cmocka */
-#undef HAVE_CMOCKA
-
 /* Define to 1 if you have the <cmocka.h> header file. */
 #undef HAVE_CMOCKA_H
 
-/* Define to 1 if you have the `CRYPTO_zalloc' function. */
-#undef HAVE_CRYPTO_ZALLOC
+/* Define to 1 if you have the `cpuset_setaffinty' function. */
+#undef HAVE_CPUSET_SETAFFINITY
 
 /* Define to 1 if you have the <devpoll.h> header file. */
 #undef HAVE_DEVPOLL_H
@@ -99,6 +96,9 @@
 /* Define to 1 to enable dnstap support */
 #undef HAVE_DNSTAP
 
+/* Define to 1 if you have the `DSA_get0_pqg' function. */
+#undef HAVE_DSA_GET0_PQG
+
 /* Define to 1 if you have the `ECDSA_sign' function. */
 #undef HAVE_ECDSA_SIGN
 
@@ -129,21 +129,6 @@
 /* Define to 1 if you have the `EVP_aes_256_ecb' function. */
 #undef HAVE_EVP_AES_256_ECB
 
-/* Define to 1 if you have the `EVP_CIPHER_CTX_free' function. */
-#undef HAVE_EVP_CIPHER_CTX_FREE
-
-/* Define to 1 if you have the `EVP_CIPHER_CTX_new' function. */
-#undef HAVE_EVP_CIPHER_CTX_NEW
-
-/* Define to 1 if you have the `EVP_MD_CTX_free' function. */
-#undef HAVE_EVP_MD_CTX_FREE
-
-/* Define to 1 if you have the `EVP_MD_CTX_new' function. */
-#undef HAVE_EVP_MD_CTX_NEW
-
-/* Define to 1 if you have the `EVP_MD_CTX_reset' function. */
-#undef HAVE_EVP_MD_CTX_RESET
-
 /* Define to 1 if you have the `EVP_sha1' function. */
 #undef HAVE_EVP_SHA1
 
@@ -198,18 +183,6 @@
 /* Define to 1 if you have the <gssapi_krb5.h> header file. */
 #undef HAVE_GSSAPI_KRB5_H
 
-/* Define to 1 if you have the `HMAC_CTX_free' function. */
-#undef HAVE_HMAC_CTX_FREE
-
-/* Define to 1 if you have the `HMAC_CTX_get_md' function. */
-#undef HAVE_HMAC_CTX_GET_MD
-
-/* Define to 1 if you have the `HMAC_CTX_new' function. */
-#undef HAVE_HMAC_CTX_NEW
-
-/* Define to 1 if you have the `HMAC_CTX_reset' function. */
-#undef HAVE_HMAC_CTX_RESET
-
 /* Define to 1 if you have the <idn2.h> header file. */
 #undef HAVE_IDN2_H
 
@@ -285,6 +258,9 @@
 /* define if OpenSSL supports Ed25519 */
 #undef HAVE_OPENSSL_ED25519
 
+/* Define to 1 if you have the `processor_bind' function. */
+#undef HAVE_PROCESSOR_BIND
+
 /* Define if you have POSIX threads libraries and header files. */
 #undef HAVE_PTHREAD
 
@@ -303,6 +279,9 @@
 /* Have PTHREAD_PRIO_INHERIT. */
 #undef HAVE_PTHREAD_PRIO_INHERIT
 
+/* Define to 1 if you have the `pthread_setaffinity_np' function. */
+#undef HAVE_PTHREAD_SETAFFINITY_NP
+
 /* Define to 1 if you have the `pthread_setname_np' function. */
 #undef HAVE_PTHREAD_SETNAME_NP
 
@@ -333,6 +312,9 @@
 /* Define to 1 if you have the <sched.h> header file. */
 #undef HAVE_SCHED_H
 
+/* Define to 1 if you have the `sched_setaffinity' function. */
+#undef HAVE_SCHED_SETAFFINITY
+
 /* Define to 1 if you have the `sched_yield' function. */
 #undef HAVE_SCHED_YIELD
 
@@ -387,6 +369,9 @@
 /* Define to 1 if you have the <sys/capability.h> header file. */
 #undef HAVE_SYS_CAPABILITY_H
 
+/* Define to 1 if you have the <sys/cpuset.h> header file. */
+#undef HAVE_SYS_CPUSET_H
+
 /* Define to 1 if you have the <sys/devpoll.h> header file. */
 #undef HAVE_SYS_DEVPOLL_H
 
@@ -396,6 +381,12 @@
 /* Define to 1 if you have the <sys/param.h> header file. */
 #undef HAVE_SYS_PARAM_H
 
+/* Define to 1 if you have the <sys/prctl.h> header file. */
+#undef HAVE_SYS_PRCTL_H
+
+/* Define to 1 if you have the <sys/procset.h> header file. */
+#undef HAVE_SYS_PROCSET_H
+
 /* Define to 1 if you have the <sys/select.h> header file. */
 #undef HAVE_SYS_SELECT_H
 

config.h.win32

@@ -111,6 +111,15 @@
 /* Define if you have h_errno */
 #define HAVE_H_ERRNO
 
+/* Define if you have RSA_generate_key(). */
+#define HAVE_RSA_GENERATE_KEY
+
+/* Define if you have DSA_generate_parameters(). */
+#define HAVE_DSA_GENERATE_PARAMETERS
+
+/* Define if you have DH_generate_parameters(). */
+#define HAVE_DH_GENERATE_PARAMETERS
+
 /* Define if you have getpassphrase in the C library. */
 #define HAVE_GETPASSPHRASE
 
@@ -271,6 +280,9 @@ typedef __int64 off_t;
 /* Define to enable "rrset-order fixed" syntax. */
 @DNS_RDATASET_FIXED@
 
+/* Define if OpenSSL provides FIPS_mode() */
+@HAVE_FIPS_MODE@
+
 /* Define if OpenSSL includes Ed25519 support */
 @HAVE_OPENSSL_ED25519@
 
@@ -280,6 +292,9 @@ typedef __int64 off_t;
 /* Define if your OpenSSL version supports DH functions. */
 @HAVE_DH_GET0_KEY@
 
+/* Define if your OpenSSL version supports DSA functions. */
+@HAVE_DSA_GET0_PQG@
+
 /* Define if your OpenSSL version supports ECDSA functions. */
 @HAVE_ECDSA_SIG_GET0@
 

configure

@@ -15249,6 +15249,114 @@ fi
 done
 
 
+for ac_header in sys/cpuset.h
+do :
+  ac_fn_c_check_header_mongrel "$LINENO" "sys/cpuset.h" "ac_cv_header_sys_cpuset_h" "$ac_includes_default"
+if test "x$ac_cv_header_sys_cpuset_h" = xyes; then :
+  cat >>confdefs.h <<_ACEOF
+#define HAVE_SYS_CPUSET_H 1
+_ACEOF
+
+fi
+
+done
+
+for ac_header in sys/procset.h
+do :
+  ac_fn_c_check_header_mongrel "$LINENO" "sys/procset.h" "ac_cv_header_sys_procset_h" "$ac_includes_default"
+if test "x$ac_cv_header_sys_procset_h" = xyes; then :
+  cat >>confdefs.h <<_ACEOF
+#define HAVE_SYS_PROCSET_H 1
+_ACEOF
+
+fi
+
+done
+
+for ac_func in pthread_setaffinity_np cpuset_setaffinity processor_bind sched_setaffinity
+do :
+  as_ac_var=`$as_echo "ac_cv_func_$ac_func" | $as_tr_sh`
+ac_fn_c_check_func "$LINENO" "$ac_func" "$as_ac_var"
+if eval test \"x\$"$as_ac_var"\" = x"yes"; then :
+  cat >>confdefs.h <<_ACEOF
+#define `$as_echo "HAVE_$ac_func" | $as_tr_cpp` 1
+_ACEOF
+
+fi
+done
+
+
+#
+# Additional OS-specific issues related to pthreads and sigwait.
+#
+case "$host" in
+	#
+	# One more place to look for sigwait.
+	#
+	*-freebsd*)
+		{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for sigwait in -lc_r" >&5
+$as_echo_n "checking for sigwait in -lc_r... " >&6; }
+if ${ac_cv_lib_c_r_sigwait+:} false; then :
+  $as_echo_n "(cached) " >&6
+else
+  ac_check_lib_save_LIBS=$LIBS
+LIBS="-lc_r  $LIBS"
+cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+/* end confdefs.h.  */
+
+/* Override any GCC internal prototype to avoid an error.
+   Use char because int might match the return type of a GCC
+   builtin and then its argument prototype would still apply.  */
+#ifdef __cplusplus
+extern "C"
+#endif
+char sigwait ();
+int
+main ()
+{
+return sigwait ();
+  ;
+  return 0;
+}
+_ACEOF
+if ac_fn_c_try_link "$LINENO"; then :
+  ac_cv_lib_c_r_sigwait=yes
+else
+  ac_cv_lib_c_r_sigwait=no
+fi
+rm -f core conftest.err conftest.$ac_objext \
+    conftest$ac_exeext conftest.$ac_ext
+LIBS=$ac_check_lib_save_LIBS
+fi
+{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_c_r_sigwait" >&5
+$as_echo "$ac_cv_lib_c_r_sigwait" >&6; }
+if test "x$ac_cv_lib_c_r_sigwait" = xyes; then :
+  $as_echo "#define HAVE_SIGWAIT 1" >>confdefs.h
+
+fi
+
+		case $host in
+		*-freebsd5.[012]|*-freebsd5.[012].*);;
+		*-freebsd5.[3456789]|*-freebsd5.[3456789].*)
+			$as_echo "#define NEED_PTHREAD_SCOPE_SYSTEM 1" >>confdefs.h
+
+			;;
+		*-freebsd6.*)
+			$as_echo "#define NEED_PTHREAD_SCOPE_SYSTEM 1" >>confdefs.h
+
+			;;
+		esac
+		;;
+	#
+	# LinuxThreads requires some changes to the way we
+	# deal with signals.
+	#
+	*-linux*)
+		$as_echo "#define HAVE_LINUXTHREADS 1" >>confdefs.h
+
+		;;
+esac
+
 # Look for functions relating to thread naming
 for ac_func in pthread_setname_np pthread_set_name_np
 do :
@@ -15564,58 +15672,6 @@ See \`config.log' for more details" "$LINENO" 5; }
 fi
 rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
 
-#
-# Check for functions added in OpenSSL or LibreSSL
-#
-
-for ac_func in CRYPTO_zalloc
-do :
-  ac_fn_c_check_func "$LINENO" "CRYPTO_zalloc" "ac_cv_func_CRYPTO_zalloc"
-if test "x$ac_cv_func_CRYPTO_zalloc" = xyes; then :
-  cat >>confdefs.h <<_ACEOF
-#define HAVE_CRYPTO_ZALLOC 1
-_ACEOF
-
-fi
-done
-
-for ac_func in EVP_CIPHER_CTX_new EVP_CIPHER_CTX_free
-do :
-  as_ac_var=`$as_echo "ac_cv_func_$ac_func" | $as_tr_sh`
-ac_fn_c_check_func "$LINENO" "$ac_func" "$as_ac_var"
-if eval test \"x\$"$as_ac_var"\" = x"yes"; then :
-  cat >>confdefs.h <<_ACEOF
-#define `$as_echo "HAVE_$ac_func" | $as_tr_cpp` 1
-_ACEOF
-
-fi
-done
-
-for ac_func in EVP_MD_CTX_new EVP_MD_CTX_free EVP_MD_CTX_reset
-do :
-  as_ac_var=`$as_echo "ac_cv_func_$ac_func" | $as_tr_sh`
-ac_fn_c_check_func "$LINENO" "$ac_func" "$as_ac_var"
-if eval test \"x\$"$as_ac_var"\" = x"yes"; then :
-  cat >>confdefs.h <<_ACEOF
-#define `$as_echo "HAVE_$ac_func" | $as_tr_cpp` 1
-_ACEOF
-
-fi
-done
-
-for ac_func in HMAC_CTX_new HMAC_CTX_free HMAC_CTX_reset HMAC_CTX_get_md
-do :
-  as_ac_var=`$as_echo "ac_cv_func_$ac_func" | $as_tr_sh`
-ac_fn_c_check_func "$LINENO" "$ac_func" "$as_ac_var"
-if eval test \"x\$"$as_ac_var"\" = x"yes"; then :
-  cat >>confdefs.h <<_ACEOF
-#define `$as_echo "HAVE_$ac_func" | $as_tr_cpp` 1
-_ACEOF
-
-fi
-done
-
-
 #
 # Check for algorithm support in OpenSSL
 #
@@ -15787,7 +15843,7 @@ done
 #
 # Check for OpenSSL 1.1.x/LibreSSL functions
 #
-for ac_func in DH_get0_key ECDSA_SIG_get0 RSA_set0_key
+for ac_func in DH_get0_key ECDSA_SIG_get0 RSA_set0_key DSA_get0_pqg
 do :
   as_ac_var=`$as_echo "ac_cv_func_$ac_func" | $as_tr_sh`
 ac_fn_c_check_func "$LINENO" "$ac_func" "$as_ac_var"
@@ -19593,19 +19649,19 @@ case $with_cmocka in #(
   yes) :
 
 pkg_failed=no
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for cmocka >= 1.0.0" >&5
-$as_echo_n "checking for cmocka >= 1.0.0... " >&6; }
+{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for cmocka" >&5
+$as_echo_n "checking for cmocka... " >&6; }
 
 if test -n "$CMOCKA_CFLAGS"; then
     pkg_cv_CMOCKA_CFLAGS="$CMOCKA_CFLAGS"
  elif test -n "$PKG_CONFIG"; then
     if test -n "$PKG_CONFIG" && \
-    { { $as_echo "$as_me:${as_lineno-$LINENO}: \$PKG_CONFIG --exists --print-errors \"cmocka >= 1.0.0\""; } >&5
-  ($PKG_CONFIG --exists --print-errors "cmocka >= 1.0.0") 2>&5
+    { { $as_echo "$as_me:${as_lineno-$LINENO}: \$PKG_CONFIG --exists --print-errors \"cmocka\""; } >&5
+  ($PKG_CONFIG --exists --print-errors "cmocka") 2>&5
   ac_status=$?
   $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
   test $ac_status = 0; }; then
-  pkg_cv_CMOCKA_CFLAGS=`$PKG_CONFIG --cflags "cmocka >= 1.0.0" 2>/dev/null`
+  pkg_cv_CMOCKA_CFLAGS=`$PKG_CONFIG --cflags "cmocka" 2>/dev/null`
 		      test "x$?" != "x0" && pkg_failed=yes
 else
   pkg_failed=yes
@@ -19617,12 +19673,12 @@ if test -n "$CMOCKA_LIBS"; then
     pkg_cv_CMOCKA_LIBS="$CMOCKA_LIBS"
  elif test -n "$PKG_CONFIG"; then
     if test -n "$PKG_CONFIG" && \
-    { { $as_echo "$as_me:${as_lineno-$LINENO}: \$PKG_CONFIG --exists --print-errors \"cmocka >= 1.0.0\""; } >&5
-  ($PKG_CONFIG --exists --print-errors "cmocka >= 1.0.0") 2>&5
+    { { $as_echo "$as_me:${as_lineno-$LINENO}: \$PKG_CONFIG --exists --print-errors \"cmocka\""; } >&5
+  ($PKG_CONFIG --exists --print-errors "cmocka") 2>&5
   ac_status=$?
   $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
   test $ac_status = 0; }; then
-  pkg_cv_CMOCKA_LIBS=`$PKG_CONFIG --libs "cmocka >= 1.0.0" 2>/dev/null`
+  pkg_cv_CMOCKA_LIBS=`$PKG_CONFIG --libs "cmocka" 2>/dev/null`
 		      test "x$?" != "x0" && pkg_failed=yes
 else
   pkg_failed=yes
@@ -19643,14 +19699,14 @@ else
         _pkg_short_errors_supported=no
 fi
         if test $_pkg_short_errors_supported = yes; then
-	        CMOCKA_PKG_ERRORS=`$PKG_CONFIG --short-errors --print-errors --cflags --libs "cmocka >= 1.0.0" 2>&1`
+	        CMOCKA_PKG_ERRORS=`$PKG_CONFIG --short-errors --print-errors --cflags --libs "cmocka" 2>&1`
         else
-	        CMOCKA_PKG_ERRORS=`$PKG_CONFIG --print-errors --cflags --libs "cmocka >= 1.0.0" 2>&1`
+	        CMOCKA_PKG_ERRORS=`$PKG_CONFIG --print-errors --cflags --libs "cmocka" 2>&1`
         fi
 	# Put the nasty error message in config.log where it belongs
 	echo "$CMOCKA_PKG_ERRORS" >&5
 
-	as_fn_error $? "Package requirements (cmocka >= 1.0.0) were not met:
+	as_fn_error $? "Package requirements (cmocka) were not met:
 
 $CMOCKA_PKG_ERRORS
 
@@ -19681,8 +19737,6 @@ else
         { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
 $as_echo "yes" >&6; }
 
-$as_echo "#define HAVE_CMOCKA 1" >>confdefs.h
-
 fi ;; #(
   *) :
 
@@ -19765,9 +19819,6 @@ if test "$ac_res" != no; then :
 			       CMOCKA_CFLAGS="-I$with_cmocka/include"
 			       CMOCKA_LIBS="-L$with_cmocka/lib -lcmocka"
 
-$as_echo "#define HAVE_CMOCKA 1" >>confdefs.h
-
-
 else
   as_fn_error $? "cmocka unit testing framework not found in $with_cmocka path" "$LINENO" 5
 fi
@@ -19818,47 +19869,6 @@ rm -f core conftest.err conftest.$ac_objext \
 # AM_CONDITIONAL([LD_WRAP], [test $enable_ld_wrap = yes])
 
 
-LDFLAGS=$save_LDFLAGS
-
-#
-# Check for -Wl,--wrap= support
-#
-
-save_LDFLAGS=$LDFLAGS
-LDFLAGS="--wrap=printf"
-
-LD_WRAP_TESTS=false
-enable_ld_wrap=no
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for linker support for --wrap option" >&5
-$as_echo_n "checking for linker support for --wrap option... " >&6; }
-cat confdefs.h - <<_ACEOF >conftest.$ac_ext
-/* end confdefs.h.  */
-#include <stdio.h>
-int
-main ()
-{
-__wrap_printf("success"); return (0);
-  ;
-  return 0;
-}
-_ACEOF
-if ac_fn_c_try_link "$LINENO"; then :
-  enable_ld_wrap=yes
-     LD_WRAP_TESTS=true
-
-$as_echo "#define LD_WRAP 1" >>confdefs.h
-
-     { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
-$as_echo "yes" >&6; }
-else
-  { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
-fi
-rm -f core conftest.err conftest.$ac_objext \
-    conftest$ac_exeext conftest.$ac_ext
-# AM_CONDITIONAL([LD_WRAP], [test $enable_ld_wrap = yes])
-
-
 LDFLAGS=$save_LDFLAGS
 
 #

configure.ac

@@ -715,6 +715,38 @@ AC_CHECK_HEADERS([sched.h])
 AC_SEARCH_LIBS([sched_yield],[rt])
 AC_CHECK_FUNCS([sched_yield pthread_yield pthread_yield_np])
 
+AC_CHECK_HEADERS([sys/cpuset.h])
+AC_CHECK_HEADERS([sys/procset.h])
+AC_CHECK_FUNCS([pthread_setaffinity_np cpuset_setaffinity processor_bind sched_setaffinity])
+
+#
+# Additional OS-specific issues related to pthreads and sigwait.
+#
+case "$host" in
+	#
+	# One more place to look for sigwait.
+	#
+	*-freebsd*)
+		AC_CHECK_LIB(c_r, sigwait, AC_DEFINE(HAVE_SIGWAIT),)
+		case $host in
+		*-freebsd5.[[012]]|*-freebsd5.[[012]].*);;
+		*-freebsd5.[[3456789]]|*-freebsd5.[[3456789]].*)
+			AC_DEFINE(NEED_PTHREAD_SCOPE_SYSTEM)
+			;;
+		*-freebsd6.*)
+			AC_DEFINE(NEED_PTHREAD_SCOPE_SYSTEM)
+			;;
+		esac
+		;;
+	#
+	# LinuxThreads requires some changes to the way we
+	# deal with signals.
+	#
+	*-linux*)
+		AC_DEFINE(HAVE_LINUXTHREADS)
+		;;
+esac
+
 # Look for functions relating to thread naming
 AC_CHECK_FUNCS([pthread_setname_np pthread_set_name_np])
 AC_CHECK_HEADERS([pthread_np.h], [], [], [#include <pthread.h>])
@@ -789,15 +821,6 @@ AC_COMPILE_IFELSE(
     [AC_MSG_RESULT([yes])],
     [AC_MSG_FAILURE([not found])])
 
-#
-# Check for functions added in OpenSSL or LibreSSL
-#
-
-AC_CHECK_FUNCS([CRYPTO_zalloc])
-AC_CHECK_FUNCS([EVP_CIPHER_CTX_new EVP_CIPHER_CTX_free])
-AC_CHECK_FUNCS([EVP_MD_CTX_new EVP_MD_CTX_free EVP_MD_CTX_reset])
-AC_CHECK_FUNCS([HMAC_CTX_new HMAC_CTX_free HMAC_CTX_reset HMAC_CTX_get_md])
-
 #
 # Check for algorithm support in OpenSSL
 #
@@ -857,7 +880,7 @@ AC_CHECK_FUNCS([EVP_aes_128_ecb EVP_aes_192_ecb EVP_aes_256_ecb], [:],
 #
 # Check for OpenSSL 1.1.x/LibreSSL functions
 #
-AC_CHECK_FUNCS([DH_get0_key ECDSA_SIG_get0 RSA_set0_key])
+AC_CHECK_FUNCS([DH_get0_key ECDSA_SIG_get0 RSA_set0_key DSA_get0_pqg])
 
 #
 # Check whether FIPS mode is available and whether we should enable it
@@ -2399,8 +2422,7 @@ AC_ARG_WITH([cmocka],
 
 AS_CASE([$with_cmocka],
 	[no],[:],
-	[yes],[PKG_CHECK_MODULES([CMOCKA], [cmocka >= 1.0.0],
-				 [AC_DEFINE([HAVE_CMOCKA], [1], [Use cmocka])])],
+	[yes],[PKG_CHECK_MODULES([CMOCKA], [cmocka])],
 	[*],[
 	    save_CFLAGS="$CFLAGS"
 	    save_LIBS="$LIBS"
@@ -2418,7 +2440,6 @@ AS_CASE([$with_cmocka],
 			   [
 			       CMOCKA_CFLAGS="-I$with_cmocka/include"
 			       CMOCKA_LIBS="-L$with_cmocka/lib -lcmocka"
-			       AC_DEFINE([HAVE_CMOCKA], [1], [Use cmocka])
 			   ],
 			   [AC_MSG_ERROR([cmocka unit testing framework not found in $with_cmocka path])])
 	    ])
@@ -2447,28 +2468,6 @@ AC_SUBST([LD_WRAP_TESTS])
 
 LDFLAGS=$save_LDFLAGS
 
-#
-# Check for -Wl,--wrap= support
-#
-
-save_LDFLAGS=$LDFLAGS
-LDFLAGS="--wrap=printf"
-
-LD_WRAP_TESTS=false
-enable_ld_wrap=no
-AC_MSG_CHECKING([for linker support for --wrap option])
-AC_LINK_IFELSE(
-    [AC_LANG_PROGRAM([#include <stdio.h>], [__wrap_printf("success"); return (0);])],
-    [enable_ld_wrap=yes
-     LD_WRAP_TESTS=true
-     AC_DEFINE([LD_WRAP], [1], [define if the linker supports --wrap option])
-     AC_MSG_RESULT([yes])],
-    [AC_MSG_RESULT([no])])
-# AM_CONDITIONAL([LD_WRAP], [test $enable_ld_wrap = yes])
-AC_SUBST([LD_WRAP_TESTS])
-
-LDFLAGS=$save_LDFLAGS
-
 #
 # Check whether to build Automated Test Framework unit tests
 #

doc/arm/Bv9ARM-book.xml

@@ -7317,8 +7317,8 @@ options {
 	      </listitem>
 	    </varlistentry>
 
-	    <varlistentry xml:id="allow_transfer">
-	      <term xml:id="allow_transfer_term"><command>allow-transfer</command></term>
+	    <varlistentry>
+	      <term><command>allow-transfer</command></term>
 	      <listitem>
 		<para>
 		  Specifies which hosts are allowed to
@@ -11410,7 +11410,6 @@ view "external" {
 
 <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="master.zoneopt.xml"/>
 <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="slave.zoneopt.xml"/>
-<xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="mirror.zoneopt.xml"/>
 <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="hint.zoneopt.xml"/>
 <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="stub.zoneopt.xml"/>
 <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="static-stub.zoneopt.xml"/>
@@ -11430,7 +11429,6 @@ view "external" {
 	      acceptable values include:
 	      <varname>master</varname> (or <varname>primary</varname>),
 	      <varname>slave</varname> (or <varname>secondary</varname>),
-	      <varname>mirror</varname>,
 	      <varname>delegation-only</varname>,
 	      <varname>forward</varname>,
 	      <varname>hint</varname>,
@@ -11567,97 +11565,6 @@ view "external" {
 		      </para>
 		    </entry>
 		  </row>
-		  <row rowsep="0">
-		    <entry colname="1">
-		      <para>
-			<varname>mirror</varname>
-		      </para>
-		    </entry>
-		    <entry colname="2">
-		      <para>
-		      </para>
-		      <para>
-			A mirror zone acts like a zone of type
-			<userinput>secondary</userinput> whose data is
-			subject to DNSSEC validation before being used
-			in answers.  Validation is performed during the
-			zone transfer process, and again when the zone
-			file is loaded from disk when
-			<command>named</command> is restarted.  If
-			validation fails, a retransfer of the zone is
-			scheduled; if the mirror zone had not previously
-			been loaded or if the previous version has
-			expired, traditional DNS recursion will be used
-			to look up the answers instead.
-		      </para>
-		      <para>
-			For validation to succeed, a key-signing key
-			(KSK) for the zone must be configured as a trust
-			anchor in <filename>named.conf</filename>: that
-			is, a key for the zone must either be specified
-			in <command>managed-keys</command> or
-			<command>trusted-keys</command>, or in the case
-			of the root zone,
-			<command>dnssec-validation</command> must be set
-			to <userinput>auto</userinput>.  Answers coming
-			from a mirror zone look almost exactly like
-			answers from a zone of type
-			<userinput>secondary</userinput>, with the
-			notable exceptions that the AA bit
-			("authoritative answer") is not set, and the AD
-			bit ("authenticated data") is.
-		      </para>
-		      <para>
-			Since mirror zones are intended to be used by
-			recursive resolvers, adding one to a view with
-			recursion disabled is considered to be a
-			configuration error.
-		      </para>
-		      <para>
-			When configuring NOTIFY for a mirror zone, only
-			<userinput>notify no;</userinput> and
-			<userinput>notify explicit;</userinput> can be
-			used.  Using any other
-			<userinput>notify</userinput> setting at the
-			zone level is a configuration error.  Using any
-			other <userinput>notify</userinput> setting at
-			the <userinput>options</userinput> or
-			<userinput>view</userinput> level will cause
-			that setting to be overridden with
-			<userinput>notify explicit;</userinput> for the
-			mirror zone in question.
-		      </para>
-		      <para>
-			Outgoing transfers of mirror zones are disabled
-			by default but may be enabled using
-			<xref endterm="allow_transfer_term" linkend="allow_transfer"/>.
-		      </para>
-		      <para>
-			While any zone may be configured with this type,
-			it is intended to be used to set up a fast local
-			copy of the root zone, similar to the one
-			described in RFC 7706.  Note, however, that
-			mirror zones are not supposed to augment the
-			example configuration provided by RFC 7706 but
-			rather to replace it altogether.
-		      </para>
-		      <para>
-			A default list of primary servers for the root
-			zone is built into <command>named</command> and
-			thus IANA root zone mirroring can be enabled
-			using the following configuration:
-		      </para>
-<programlisting>zone "." {
-	type mirror;
-};</programlisting>
-		      <para>
-			To make mirror zone contents persist between
-			<command>named</command> restarts, use the
-			<xref endterm="file_option_term" linkend="file_option"/>
-			option.
-		      </para>
-		    </entry>
-		  </row>
 		  <row rowsep="0">
 		    <entry colname="1">
 		      <para>
@@ -12160,20 +12067,19 @@ view "external" {
 		</listitem>
 	      </varlistentry>
 
-	      <varlistentry xml:id="file_option">
-		<term xml:id="file_option_term"><command>file</command></term>
+	      <varlistentry>
+		<term><command>file</command></term>
 		<listitem>
 		  <para>
 		    Set the zone's filename. In <command>master</command>,
 		    <command>hint</command>, and <command>redirect</command>
 		    zones which do not have <command>masters</command>
 		    defined, zone data is loaded from this file. In
-		    <command>slave</command>, <command>mirror</command>,
-		    <command>stub</command>, and <command>redirect</command>
-		    zones which do have <command>masters</command>
-		    defined, zone data is retrieved from another server
-		    and saved in this file.  This option is not
-		    applicable to other zone types.
+		    <command>slave</command>, <command>stub</command>, and
+		    <command>redirect</command> zones which do have
+		    <command>masters</command> defined, zone data is
+		    retrieved from another server and saved in this file.
+		    This option is not applicable to other zone types.
 		  </para>
 		</listitem>
 	      </varlistentry>
@@ -12618,6 +12524,68 @@ example.com. NS ns2.example.net.
 		</listitem>
 	      </varlistentry>
 
+	      <varlistentry>
+		<term><command>mirror</command></term>
+		<listitem>
+		  <para>
+		    If set to <userinput>yes</userinput>, this causes the
+		    zone to become a mirror zone.  A mirror zone is a
+		    <userinput>secondary</userinput> zone whose data
+		    is subject to DNSSEC validation before being
+		    used in answers.  The default is
+		    <userinput>no</userinput>.
+		  </para>
+		  <para>
+		    A mirror zone's contents are validated during the transfer
+		    process, and again when the zone file is loaded from disk
+		    when <command>named</command> is restarted.  If validation
+		    fails, a retransfer of the zone is scheduled; if the mirror
+		    zone had not previously been loaded or if the previous
+		    version has expired, traditional DNS recursion will be used
+		    to look up the answers instead.
+		  </para>
+		  <para>
+		    For validation to succeed, a key-signing key (KSK) for
+		    the zone must be configured as a trust anchor in
+		    <filename>named.conf</filename>:
+		    that is, a key for the zone must either be specified in
+		    <command>managed-keys</command> or
+		    <command>trusted-keys</command>, or in the case of
+		    the root zone, <command>dnssec-validation</command>
+		    must be set to <userinput>auto</userinput>.
+		    Answers coming from a mirror zone look almost exactly like
+		    answers from a normal slave zone, with the notable
+		    exceptions that the AA bit ("authoritative answer") is
+		    not set, and the AD bit ("authenticated data") is.
+		  </para>
+		  <para>
+		    Though this option can be used for other zones, it
+		    is intended to be used to set up a fast local copy of
+		    the root zone, as described in RFC 7706.
+		    This can be done by using the following configuration:
+		  </para>
+<programlisting>zone "." {
+	type slave;
+	mirror yes;
+	file "root.mirror";
+	masters {
+		192.228.79.201;       # b.root-servers.net
+		192.33.4.12;          # c.root-servers.net
+		192.5.5.241;          # f.root-servers.net
+		192.112.36.4;         # g.root-servers.net
+		193.0.14.129;         # k.root-servers.net
+		192.0.47.132;         # xfr.cjr.dns.icann.org
+		192.0.32.132;         # xfr.lax.dns.icann.org
+		2001:500:84::b;       # b.root-servers.net
+		2001:500:2f::f;       # f.root-servers.net
+		2001:7fd::1;          # k.root-servers.net
+		2620:0:2830:202::132; # xfr.cjr.dns.icann.org
+		2620:0:2d0:202::132;  # xfr.lax.dns.icann.org
+	};
+};</programlisting>
+		</listitem>
+	      </varlistentry>
+
 	      <varlistentry>
 		<term><command>multi-master</command></term>
 		<listitem>

doc/arm/Bv9ARM.ch05.html

@@ -2531,6 +2531,7 @@ badresp:1,adberr:0,findfail:0,valfail:0]
 	<span class="command"><strong>min-retry-time</strong></span> <em class="replaceable"><code>integer</code></em>;
 	<span class="command"><strong>minimal-any</strong></span> <em class="replaceable"><code>boolean</code></em>;
 	<span class="command"><strong>minimal-responses</strong></span> ( no-auth | no-auth-recursive | <em class="replaceable"><code>boolean</code></em> );
+	<span class="command"><strong>mirror</strong></span> <em class="replaceable"><code>boolean</code></em>;
 	<span class="command"><strong>multi-master</strong></span> <em class="replaceable"><code>boolean</code></em>;
 	<span class="command"><strong>new-zones-directory</strong></span> <em class="replaceable"><code>quoted_string</code></em>;
 	<span class="command"><strong>no-case-compress</strong></span> { <em class="replaceable"><code>address_match_element</code></em>; ... };
@@ -5368,9 +5369,7 @@ options {
                   It is now ignored with some warning messages.
                 </p>
               </dd>
-<dt>
-<a name="allow_transfer"></a><span class="term"><a name="allow_transfer_term"></a><span class="command"><strong>allow-transfer</strong></span></span>
-</dt>
+<dt><span class="term"><span class="command"><strong>allow-transfer</strong></span></span></dt>
 <dd>
                 <p>
                   Specifies which hosts are allowed to
@@ -9399,6 +9398,7 @@ view "external" {
 	<span class="command"><strong>max-transfer-time-out</strong></span> <em class="replaceable"><code>integer</code></em>;
 	<span class="command"><strong>min-refresh-time</strong></span> <em class="replaceable"><code>integer</code></em>;
 	<span class="command"><strong>min-retry-time</strong></span> <em class="replaceable"><code>integer</code></em>;
+	<span class="command"><strong>mirror</strong></span> <em class="replaceable"><code>boolean</code></em>;
 	<span class="command"><strong>multi-master</strong></span> <em class="replaceable"><code>boolean</code></em>;
 	<span class="command"><strong>notify</strong></span> ( explicit | master-only | <em class="replaceable"><code>boolean</code></em> );
 	<span class="command"><strong>notify-delay</strong></span> <em class="replaceable"><code>integer</code></em>;
@@ -9421,50 +9421,6 @@ view "external" {
 };
 </pre>
 <pre class="programlisting">
-<span class="command"><strong>zone</strong></span> <em class="replaceable"><code>string</code></em> [ <em class="replaceable"><code>class</code></em> ] {
-	<span class="command"><strong>type</strong></span> mirror;
-	<span class="command"><strong>allow-notify</strong></span> { <em class="replaceable"><code>address_match_element</code></em>; ... };
-	<span class="command"><strong>allow-query</strong></span> { <em class="replaceable"><code>address_match_element</code></em>; ... };
-	<span class="command"><strong>allow-query-on</strong></span> { <em class="replaceable"><code>address_match_element</code></em>; ... };
-	<span class="command"><strong>allow-transfer</strong></span> { <em class="replaceable"><code>address_match_element</code></em>; ... };
-	<span class="command"><strong>allow-update-forwarding</strong></span> { <em class="replaceable"><code>address_match_element</code></em>; ... };
-	<span class="command"><strong>also-notify</strong></span> [ port <em class="replaceable"><code>integer</code></em> ] [ dscp <em class="replaceable"><code>integer</code></em> ] { ( <em class="replaceable"><code>masters</code></em> | <em class="replaceable"><code>ipv4_address</code></em> [ port <em class="replaceable"><code>integer</code></em> ] | <em class="replaceable"><code>ipv6_address</code></em> [ port <em class="replaceable"><code>integer</code></em> ] ) [ key <em class="replaceable"><code>string</code></em> ]; ... };
-	<span class="command"><strong>alt-transfer-source</strong></span> ( <em class="replaceable"><code>ipv4_address</code></em> | * ) [ port ( <em class="replaceable"><code>integer</code></em> | * ) ] [ dscp <em class="replaceable"><code>integer</code></em> ];
-	<span class="command"><strong>alt-transfer-source-v6</strong></span> ( <em class="replaceable"><code>ipv6_address</code></em> | * ) [ port ( <em class="replaceable"><code>integer</code></em> | * ) ] [ dscp <em class="replaceable"><code>integer</code></em> ];
-	<span class="command"><strong>check-names</strong></span> ( fail | warn | ignore );
-	<span class="command"><strong>database</strong></span> <em class="replaceable"><code>string</code></em>;
-	<span class="command"><strong>file</strong></span> <em class="replaceable"><code>quoted_string</code></em>;
-	<span class="command"><strong>ixfr-from-differences</strong></span> <em class="replaceable"><code>boolean</code></em>;
-	<span class="command"><strong>journal</strong></span> <em class="replaceable"><code>quoted_string</code></em>;
-	<span class="command"><strong>masterfile-format</strong></span> ( map | raw | text );
-	<span class="command"><strong>masterfile-style</strong></span> ( full | relative );
-	<span class="command"><strong>masters</strong></span> [ port <em class="replaceable"><code>integer</code></em> ] [ dscp <em class="replaceable"><code>integer</code></em> ] { ( <em class="replaceable"><code>masters</code></em> | <em class="replaceable"><code>ipv4_address</code></em> [ port <em class="replaceable"><code>integer</code></em> ] | <em class="replaceable"><code>ipv6_address</code></em> [ port <em class="replaceable"><code>integer</code></em> ] ) [ key <em class="replaceable"><code>string</code></em> ]; ... };
-	<span class="command"><strong>max-journal-size</strong></span> ( default | unlimited | <em class="replaceable"><code>sizeval</code></em> );
-	<span class="command"><strong>max-records</strong></span> <em class="replaceable"><code>integer</code></em>;
-	<span class="command"><strong>max-refresh-time</strong></span> <em class="replaceable"><code>integer</code></em>;
-	<span class="command"><strong>max-retry-time</strong></span> <em class="replaceable"><code>integer</code></em>;
-	<span class="command"><strong>max-transfer-idle-in</strong></span> <em class="replaceable"><code>integer</code></em>;
-	<span class="command"><strong>max-transfer-idle-out</strong></span> <em class="replaceable"><code>integer</code></em>;
-	<span class="command"><strong>max-transfer-time-in</strong></span> <em class="replaceable"><code>integer</code></em>;
-	<span class="command"><strong>max-transfer-time-out</strong></span> <em class="replaceable"><code>integer</code></em>;
-	<span class="command"><strong>min-refresh-time</strong></span> <em class="replaceable"><code>integer</code></em>;
-	<span class="command"><strong>min-retry-time</strong></span> <em class="replaceable"><code>integer</code></em>;
-	<span class="command"><strong>multi-master</strong></span> <em class="replaceable"><code>boolean</code></em>;
-	<span class="command"><strong>notify</strong></span> ( explicit | master-only | <em class="replaceable"><code>boolean</code></em> );
-	<span class="command"><strong>notify-delay</strong></span> <em class="replaceable"><code>integer</code></em>;
-	<span class="command"><strong>notify-source</strong></span> ( <em class="replaceable"><code>ipv4_address</code></em> | * ) [ port ( <em class="replaceable"><code>integer</code></em> | * ) ] [ dscp <em class="replaceable"><code>integer</code></em> ];
-	<span class="command"><strong>notify-source-v6</strong></span> ( <em class="replaceable"><code>ipv6_address</code></em> | * ) [ port ( <em class="replaceable"><code>integer</code></em> | * ) ] [ dscp <em class="replaceable"><code>integer</code></em> ];
-	<span class="command"><strong>request-expire</strong></span> <em class="replaceable"><code>boolean</code></em>;
-	<span class="command"><strong>request-ixfr</strong></span> <em class="replaceable"><code>boolean</code></em>;
-	<span class="command"><strong>transfer-source</strong></span> ( <em class="replaceable"><code>ipv4_address</code></em> | * ) [ port ( <em class="replaceable"><code>integer</code></em> | * ) ] [ dscp <em class="replaceable"><code>integer</code></em> ];
-	<span class="command"><strong>transfer-source-v6</strong></span> ( <em class="replaceable"><code>ipv6_address</code></em> | * ) [ port ( <em class="replaceable"><code>integer</code></em> | * ) ] [ dscp <em class="replaceable"><code>integer</code></em> ];
-	<span class="command"><strong>try-tcp-refresh</strong></span> <em class="replaceable"><code>boolean</code></em>;
-	<span class="command"><strong>use-alt-transfer-source</strong></span> <em class="replaceable"><code>boolean</code></em>;
-	<span class="command"><strong>zero-no-soa-ttl</strong></span> <em class="replaceable"><code>boolean</code></em>;
-	<span class="command"><strong>zone-statistics</strong></span> ( full | terse | none | <em class="replaceable"><code>boolean</code></em> );
-};
-</pre>
-<pre class="programlisting">
 <span class="command"><strong>zone</strong></span> <em class="replaceable"><code>string</code></em> [ <em class="replaceable"><code>class</code></em> ] {
 	<span class="command"><strong>type</strong></span> hint;
 	<span class="command"><strong>check-names</strong></span> ( fail | warn | ignore );
@@ -9509,7 +9465,7 @@ view "external" {
 	<span class="command"><strong>forward</strong></span> ( first | only );
 	<span class="command"><strong>forwarders</strong></span> [ port <em class="replaceable"><code>integer</code></em> ] [ dscp <em class="replaceable"><code>integer</code></em> ] { ( <em class="replaceable"><code>ipv4_address</code></em> | <em class="replaceable"><code>ipv6_address</code></em> ) [ port <em class="replaceable"><code>integer</code></em> ] [ dscp <em class="replaceable"><code>integer</code></em> ]; ... };
 	<span class="command"><strong>max-records</strong></span> <em class="replaceable"><code>integer</code></em>;
-	<span class="command"><strong>server-addresses</strong></span> { ( <em class="replaceable"><code>ipv4_address</code></em> | <em class="replaceable"><code>ipv6_address</code></em> ); ... };
+	<span class="command"><strong>server-addresses</strong></span> { ( <em class="replaceable"><code>ipv4_address</code></em> | <em class="replaceable"><code>ipv6_address</code></em> ) [ port <em class="replaceable"><code>integer</code></em> ]; ... };
 	<span class="command"><strong>server-names</strong></span> { <em class="replaceable"><code>string</code></em>; ... };
 	<span class="command"><strong>zone-statistics</strong></span> ( full | terse | none | <em class="replaceable"><code>boolean</code></em> );
 };
@@ -9563,7 +9519,6 @@ view "external" {
               acceptable values include:
               <code class="varname">master</code> (or <code class="varname">primary</code>),
               <code class="varname">slave</code> (or <code class="varname">secondary</code>),
-              <code class="varname">mirror</code>,
               <code class="varname">delegation-only</code>,
               <code class="varname">forward</code>,
               <code class="varname">hint</code>,
@@ -9701,97 +9656,6 @@ view "external" {
                     </td>
 </tr>
 <tr>
-<td>
-                      <p>
-                        <code class="varname">mirror</code>
-                      </p>
-                    </td>
-<td>
-                      <p>
-                      </p>
-                      <p>
-                        A mirror zone acts like a zone of type
-                        <strong class="userinput"><code>secondary</code></strong> whose data is
-                        subject to DNSSEC validation before being used
-                        in answers.  Validation is performed during the
-                        zone transfer process, and again when the zone
-                        file is loaded from disk when
-                        <span class="command"><strong>named</strong></span> is restarted.  If
-                        validation fails, a retransfer of the zone is
-                        scheduled; if the mirror zone had not previously
-                        been loaded or if the previous version has
-                        expired, traditional DNS recursion will be used
-                        to look up the answers instead.
-                      </p>
-                      <p>
-                        For validation to succeed, a key-signing key
-                        (KSK) for the zone must be configured as a trust
-                        anchor in <code class="filename">named.conf</code>: that
-                        is, a key for the zone must either be specified
-                        in <span class="command"><strong>managed-keys</strong></span> or
-                        <span class="command"><strong>trusted-keys</strong></span>, or in the case
-                        of the root zone,
-                        <span class="command"><strong>dnssec-validation</strong></span> must be set
-                        to <strong class="userinput"><code>auto</code></strong>.  Answers coming
-                        from a mirror zone look almost exactly like
-                        answers from a zone of type
-                        <strong class="userinput"><code>secondary</code></strong>, with the
-                        notable exceptions that the AA bit
-                        ("authoritative answer") is not set, and the AD
-                        bit ("authenticated data") is.
-                      </p>
-                      <p>
-                        Since mirror zones are intended to be used by
-                        recursive resolvers, adding one to a view with
-                        recursion disabled is considered to be a
-                        configuration error.
-                      </p>
-                      <p>
-                        When configuring NOTIFY for a mirror zone, only
-                        <strong class="userinput"><code>notify no;</code></strong> and
-                        <strong class="userinput"><code>notify explicit;</code></strong> can be
-                        used.  Using any other
-                        <strong class="userinput"><code>notify</code></strong> setting at the
-                        zone level is a configuration error.  Using any
-                        other <strong class="userinput"><code>notify</code></strong> setting at
-                        the <strong class="userinput"><code>options</code></strong> or
-                        <strong class="userinput"><code>view</code></strong> level will cause
-                        that setting to be overridden with
-                        <strong class="userinput"><code>notify explicit;</code></strong> for the
-                        mirror zone in question.
-                      </p>
-                      <p>
-                        Outgoing transfers of mirror zones are disabled
-                        by default but may be enabled using
-                        <a class="xref" href="Bv9ARM.ch05.html#allow_transfer"><span class="command"><strong>allow-transfer</strong></span></a>.
-                      </p>
-                      <p>
-                        While any zone may be configured with this type,
-                        it is intended to be used to set up a fast local
-                        copy of the root zone, similar to the one
-                        described in RFC 7706.  Note, however, that
-                        mirror zones are not supposed to augment the
-                        example configuration provided by RFC 7706 but
-                        rather to replace it altogether.
-                      </p>
-                      <p>
-                        A default list of primary servers for the root
-                        zone is built into <span class="command"><strong>named</strong></span> and
-                        thus IANA root zone mirroring can be enabled
-                        using the following configuration:
-                      </p>
-<pre class="programlisting">zone "." {
-        type mirror;
-};</pre>
-                      <p>
-                        To make mirror zone contents persist between
-                        <span class="command"><strong>named</strong></span> restarts, use the
-                        <a class="xref" href="Bv9ARM.ch05.html#file_option"><span class="command"><strong>file</strong></span></a>
-                        option.
-                      </p>
-                    </td>
-</tr>
-<tr>
 <td>
                       <p>
                         <code class="varname">static-stub</code>
@@ -10229,21 +10093,18 @@ view "external" {
                     See caveats in <a class="xref" href="Bv9ARM.ch05.html#root_delegation_only"><span class="command"><strong>root-delegation-only</strong></span></a>.
                   </p>
                 </dd>
-<dt>
-<a name="file_option"></a><span class="term"><a name="file_option_term"></a><span class="command"><strong>file</strong></span></span>
-</dt>
+<dt><span class="term"><span class="command"><strong>file</strong></span></span></dt>
 <dd>
                   <p>
                     Set the zone's filename. In <span class="command"><strong>master</strong></span>,
                     <span class="command"><strong>hint</strong></span>, and <span class="command"><strong>redirect</strong></span>
                     zones which do not have <span class="command"><strong>masters</strong></span>
                     defined, zone data is loaded from this file. In
-                    <span class="command"><strong>slave</strong></span>, <span class="command"><strong>mirror</strong></span>,
-                    <span class="command"><strong>stub</strong></span>, and <span class="command"><strong>redirect</strong></span>
-                    zones which do have <span class="command"><strong>masters</strong></span>
-                    defined, zone data is retrieved from another server
-                    and saved in this file.  This option is not
-                    applicable to other zone types.
+                    <span class="command"><strong>slave</strong></span>, <span class="command"><strong>stub</strong></span>, and
+                    <span class="command"><strong>redirect</strong></span> zones which do have
+                    <span class="command"><strong>masters</strong></span> defined, zone data is
+                    retrieved from another server and saved in this file.
+                    This option is not applicable to other zone types.
                   </p>
                 </dd>
 <dt><span class="term"><span class="command"><strong>forward</strong></span></span></dt>
@@ -10583,6 +10444,65 @@ example.com. NS ns2.example.net.
                     behavior is disabled by default.
                   </p>
                 </dd>
+<dt><span class="term"><span class="command"><strong>mirror</strong></span></span></dt>
+<dd>
+                  <p>
+                    If set to <strong class="userinput"><code>yes</code></strong>, this causes the
+                    zone to become a mirror zone.  A mirror zone is a
+                    <strong class="userinput"><code>secondary</code></strong> zone whose data
+                    is subject to DNSSEC validation before being
+                    used in answers.  The default is
+                    <strong class="userinput"><code>no</code></strong>.
+                  </p>
+                  <p>
+                    A mirror zone's contents are validated during the transfer
+                    process, and again when the zone file is loaded from disk
+                    when <span class="command"><strong>named</strong></span> is restarted.  If validation
+                    fails, a retransfer of the zone is scheduled; if the mirror
+                    zone had not previously been loaded or if the previous
+                    version has expired, traditional DNS recursion will be used
+                    to look up the answers instead.
+                  </p>
+                  <p>
+                    For validation to succeed, a key-signing key (KSK) for
+                    the zone must be configured as a trust anchor in
+                    <code class="filename">named.conf</code>:
+                    that is, a key for the zone must either be specified in
+                    <span class="command"><strong>managed-keys</strong></span> or
+                    <span class="command"><strong>trusted-keys</strong></span>, or in the case of
+                    the root zone, <span class="command"><strong>dnssec-validation</strong></span>
+                    must be set to <strong class="userinput"><code>auto</code></strong>.
+                    Answers coming from a mirror zone look almost exactly like
+                    answers from a normal slave zone, with the notable
+                    exceptions that the AA bit ("authoritative answer") is
+                    not set, and the AD bit ("authenticated data") is.
+                  </p>
+                  <p>
+                    Though this option can be used for other zones, it
+                    is intended to be used to set up a fast local copy of
+                    the root zone, as described in RFC 7706.
+                    This can be done by using the following configuration:
+                  </p>
+<pre class="programlisting">zone "." {
+        type slave;
+        mirror yes;
+        file "root.mirror";
+        masters {
+                192.228.79.201;       # b.root-servers.net
+                192.33.4.12;          # c.root-servers.net
+                192.5.5.241;          # f.root-servers.net
+                192.112.36.4;         # g.root-servers.net
+                193.0.14.129;         # k.root-servers.net
+                192.0.47.132;         # xfr.cjr.dns.icann.org
+                192.0.32.132;         # xfr.lax.dns.icann.org
+                2001:500:84::b;       # b.root-servers.net
+                2001:500:2f::f;       # f.root-servers.net
+                2001:7fd::1;          # k.root-servers.net
+                2620:0:2830:202::132; # xfr.cjr.dns.icann.org
+                2620:0:2d0:202::132;  # xfr.lax.dns.icann.org
+        };
+};</pre>
+                </dd>
 <dt><span class="term"><span class="command"><strong>multi-master</strong></span></span></dt>
 <dd>
                   <p>

doc/arm/man.named.conf.html

@@ -871,6 +871,7 @@ view
 		max-zone-ttl ( unlimited | <em class="replaceable"><code>ttlval</code></em> );<br>
 		min-refresh-time <em class="replaceable"><code>integer</code></em>;<br>
 		min-retry-time <em class="replaceable"><code>integer</code></em>;<br>
+		mirror <em class="replaceable"><code>boolean</code></em>;<br>
 		multi-master <em class="replaceable"><code>boolean</code></em>;<br>
 		notify ( explicit | master-only | <em class="replaceable"><code>boolean</code></em> );<br>
 		notify-delay <em class="replaceable"><code>integer</code></em>;<br>
@@ -885,7 +886,8 @@ view
 		request-expire <em class="replaceable"><code>boolean</code></em>;<br>
 		request-ixfr <em class="replaceable"><code>boolean</code></em>;<br>
 		serial-update-method ( date | increment | unixtime );<br>
-		server-addresses { ( <em class="replaceable"><code>ipv4_address</code></em> | <em class="replaceable"><code>ipv6_address</code></em> ); ... };<br>
+		server-addresses { ( <em class="replaceable"><code>ipv4_address</code></em> | <em class="replaceable"><code>ipv6_address</code></em> ) [<br>
+		    port <em class="replaceable"><code>integer</code></em> ]; ... };<br>
 		server-names { <em class="replaceable"><code>string</code></em>; ... };<br>
 		sig-signing-nodes <em class="replaceable"><code>integer</code></em>;<br>
 		sig-signing-signatures <em class="replaceable"><code>integer</code></em>;<br>
@@ -896,7 +898,7 @@ view
 		transfer-source-v6 ( <em class="replaceable"><code>ipv6_address</code></em> | * ) [ port (<br>
 		    <em class="replaceable"><code>integer</code></em> | * ) ] [ dscp <em class="replaceable"><code>integer</code></em> ];<br>
 		try-tcp-refresh <em class="replaceable"><code>boolean</code></em>;<br>
-		type ( primary | master | secondary | slave | mirror |<br>
+		type ( primary | master | secondary | slave |<br>
 		    delegation-only | forward | hint | redirect |<br>
 		    static-stub | stub );<br>
 		update-check-ksk <em class="replaceable"><code>boolean</code></em>;<br>
@@ -976,6 +978,7 @@ zone
 	max-zone-ttl ( unlimited | <em class="replaceable"><code>ttlval</code></em> );<br>
 	min-refresh-time <em class="replaceable"><code>integer</code></em>;<br>
 	min-retry-time <em class="replaceable"><code>integer</code></em>;<br>
+	mirror <em class="replaceable"><code>boolean</code></em>;<br>
 	multi-master <em class="replaceable"><code>boolean</code></em>;<br>
 	notify ( explicit | master-only | <em class="replaceable"><code>boolean</code></em> );<br>
 	notify-delay <em class="replaceable"><code>integer</code></em>;<br>
@@ -988,7 +991,8 @@ zone
 	request-expire <em class="replaceable"><code>boolean</code></em>;<br>
 	request-ixfr <em class="replaceable"><code>boolean</code></em>;<br>
 	serial-update-method ( date | increment | unixtime );<br>
-	server-addresses { ( <em class="replaceable"><code>ipv4_address</code></em> | <em class="replaceable"><code>ipv6_address</code></em> ); ... };<br>
+	server-addresses { ( <em class="replaceable"><code>ipv4_address</code></em> | <em class="replaceable"><code>ipv6_address</code></em> ) [ port<br>
+	    <em class="replaceable"><code>integer</code></em> ]; ... };<br>
 	server-names { <em class="replaceable"><code>string</code></em>; ... };<br>
 	sig-signing-nodes <em class="replaceable"><code>integer</code></em>;<br>
 	sig-signing-signatures <em class="replaceable"><code>integer</code></em>;<br>
@@ -999,9 +1003,8 @@ zone
 	transfer-source-v6 ( <em class="replaceable"><code>ipv6_address</code></em> | * ) [ port ( <em class="replaceable"><code>integer</code></em> | * )<br>
 	    ] [ dscp <em class="replaceable"><code>integer</code></em> ];<br>
 	try-tcp-refresh <em class="replaceable"><code>boolean</code></em>;<br>
-	type ( primary | master | secondary | slave | mirror |<br>
-	    delegation-only | forward | hint | redirect | static-stub |<br>
-	    stub );<br>
+	type ( primary | master | secondary | slave | delegation-only |<br>
+	    forward | hint | redirect | static-stub | stub );<br>
 	update-check-ksk <em class="replaceable"><code>boolean</code></em>;<br>
 	update-policy ( local | { ( deny | grant ) <em class="replaceable"><code>string</code></em> ( 6to4-self |<br>
 	    external | krb5-self | krb5-subdomain | ms-self | ms-subdomain<br>

doc/arm/mirror.zoneopt.xml

@@ -1,56 +0,0 @@
-<!--
- - Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- -
- - This Source Code Form is subject to the terms of the Mozilla Public
- - License, v. 2.0. If a copy of the MPL was not distributed with this
- - file, You can obtain one at http://mozilla.org/MPL/2.0/.
- -
- - See the COPYRIGHT file distributed with this work for additional
- - information regarding copyright ownership.
--->
-
-<!-- Generated by doc/misc/docbook-zoneopt.pl -->
-<programlisting>
-<command>zone</command> <replaceable>string</replaceable> [ <replaceable>class</replaceable> ] {
-	<command>type</command> mirror;
-	<command>allow-notify</command> { <replaceable>address_match_element</replaceable>; ... };
-	<command>allow-query</command> { <replaceable>address_match_element</replaceable>; ... };
-	<command>allow-query-on</command> { <replaceable>address_match_element</replaceable>; ... };
-	<command>allow-transfer</command> { <replaceable>address_match_element</replaceable>; ... };
-	<command>allow-update-forwarding</command> { <replaceable>address_match_element</replaceable>; ... };
-	<command>also-notify</command> [ port <replaceable>integer</replaceable> ] [ dscp <replaceable>integer</replaceable> ] { ( <replaceable>masters</replaceable> | <replaceable>ipv4_address</replaceable> [ port <replaceable>integer</replaceable> ] | <replaceable>ipv6_address</replaceable> [ port <replaceable>integer</replaceable> ] ) [ key <replaceable>string</replaceable> ]; ... };
-	<command>alt-transfer-source</command> ( <replaceable>ipv4_address</replaceable> | * ) [ port ( <replaceable>integer</replaceable> | * ) ] [ dscp <replaceable>integer</replaceable> ];
-	<command>alt-transfer-source-v6</command> ( <replaceable>ipv6_address</replaceable> | * ) [ port ( <replaceable>integer</replaceable> | * ) ] [ dscp <replaceable>integer</replaceable> ];
-	<command>check-names</command> ( fail | warn | ignore );
-	<command>database</command> <replaceable>string</replaceable>;
-	<command>file</command> <replaceable>quoted_string</replaceable>;
-	<command>ixfr-from-differences</command> <replaceable>boolean</replaceable>;
-	<command>journal</command> <replaceable>quoted_string</replaceable>;
-	<command>masterfile-format</command> ( map | raw | text );
-	<command>masterfile-style</command> ( full | relative );
-	<command>masters</command> [ port <replaceable>integer</replaceable> ] [ dscp <replaceable>integer</replaceable> ] { ( <replaceable>masters</replaceable> | <replaceable>ipv4_address</replaceable> [ port <replaceable>integer</replaceable> ] | <replaceable>ipv6_address</replaceable> [ port <replaceable>integer</replaceable> ] ) [ key <replaceable>string</replaceable> ]; ... };
-	<command>max-journal-size</command> ( default | unlimited | <replaceable>sizeval</replaceable> );
-	<command>max-records</command> <replaceable>integer</replaceable>;
-	<command>max-refresh-time</command> <replaceable>integer</replaceable>;
-	<command>max-retry-time</command> <replaceable>integer</replaceable>;
-	<command>max-transfer-idle-in</command> <replaceable>integer</replaceable>;
-	<command>max-transfer-idle-out</command> <replaceable>integer</replaceable>;
-	<command>max-transfer-time-in</command> <replaceable>integer</replaceable>;
-	<command>max-transfer-time-out</command> <replaceable>integer</replaceable>;
-	<command>min-refresh-time</command> <replaceable>integer</replaceable>;
-	<command>min-retry-time</command> <replaceable>integer</replaceable>;
-	<command>multi-master</command> <replaceable>boolean</replaceable>;
-	<command>notify</command> ( explicit | master-only | <replaceable>boolean</replaceable> );
-	<command>notify-delay</command> <replaceable>integer</replaceable>;
-	<command>notify-source</command> ( <replaceable>ipv4_address</replaceable> | * ) [ port ( <replaceable>integer</replaceable> | * ) ] [ dscp <replaceable>integer</replaceable> ];
-	<command>notify-source-v6</command> ( <replaceable>ipv6_address</replaceable> | * ) [ port ( <replaceable>integer</replaceable> | * ) ] [ dscp <replaceable>integer</replaceable> ];
-	<command>request-expire</command> <replaceable>boolean</replaceable>;
-	<command>request-ixfr</command> <replaceable>boolean</replaceable>;
-	<command>transfer-source</command> ( <replaceable>ipv4_address</replaceable> | * ) [ port ( <replaceable>integer</replaceable> | * ) ] [ dscp <replaceable>integer</replaceable> ];
-	<command>transfer-source-v6</command> ( <replaceable>ipv6_address</replaceable> | * ) [ port ( <replaceable>integer</replaceable> | * ) ] [ dscp <replaceable>integer</replaceable> ];
-	<command>try-tcp-refresh</command> <replaceable>boolean</replaceable>;
-	<command>use-alt-transfer-source</command> <replaceable>boolean</replaceable>;
-	<command>zero-no-soa-ttl</command> <replaceable>boolean</replaceable>;
-	<command>zone-statistics</command> ( full | terse | none | <replaceable>boolean</replaceable> );
-};
-</programlisting>

doc/arm/options.grammar.xml

@@ -180,6 +180,7 @@
 	<command>min-retry-time</command> <replaceable>integer</replaceable>;
 	<command>minimal-any</command> <replaceable>boolean</replaceable>;
 	<command>minimal-responses</command> ( no-auth | no-auth-recursive | <replaceable>boolean</replaceable> );
+	<command>mirror</command> <replaceable>boolean</replaceable>;
 	<command>multi-master</command> <replaceable>boolean</replaceable>;
 	<command>new-zones-directory</command> <replaceable>quoted_string</replaceable>;
 	<command>no-case-compress</command> { <replaceable>address_match_element</replaceable>; ... };

doc/arm/slave.zoneopt.xml

@@ -50,6 +50,7 @@
 	<command>max-transfer-time-out</command> <replaceable>integer</replaceable>;
 	<command>min-refresh-time</command> <replaceable>integer</replaceable>;
 	<command>min-retry-time</command> <replaceable>integer</replaceable>;
+	<command>mirror</command> <replaceable>boolean</replaceable>;
 	<command>multi-master</command> <replaceable>boolean</replaceable>;
 	<command>notify</command> ( explicit | master-only | <replaceable>boolean</replaceable> );
 	<command>notify-delay</command> <replaceable>integer</replaceable>;

doc/arm/static-stub.zoneopt.xml

@@ -18,7 +18,7 @@
 	<command>forward</command> ( first | only );
 	<command>forwarders</command> [ port <replaceable>integer</replaceable> ] [ dscp <replaceable>integer</replaceable> ] { ( <replaceable>ipv4_address</replaceable> | <replaceable>ipv6_address</replaceable> ) [ port <replaceable>integer</replaceable> ] [ dscp <replaceable>integer</replaceable> ]; ... };
 	<command>max-records</command> <replaceable>integer</replaceable>;
-	<command>server-addresses</command> { ( <replaceable>ipv4_address</replaceable> | <replaceable>ipv6_address</replaceable> ); ... };
+	<command>server-addresses</command> { ( <replaceable>ipv4_address</replaceable> | <replaceable>ipv6_address</replaceable> ) [ port <replaceable>integer</replaceable> ]; ... };
 	<command>server-names</command> { <replaceable>string</replaceable>; ... };
 	<command>zone-statistics</command> ( full | terse | none | <replaceable>boolean</replaceable> );
 };

doc/design/zone

@@ -111,7 +111,6 @@ Types:
 		dns_zone_none = 0,
 		dns_zone_master,
 		dns_zone_slave,
-		dns_zone_mirror,
 		dns_zone_stub,
 		dns_zone_hint,
 		dns_zone_cache,

doc/misc/Makefile.in

@@ -35,7 +35,6 @@ options: FORCE
 		${CFG_TEST} --named --grammar > $@.raw ; \
 		${CFG_TEST} --zonegrammar master > master.zoneopt ; \
 		${CFG_TEST} --zonegrammar slave > slave.zoneopt ; \
-		${CFG_TEST} --zonegrammar mirror > mirror.zoneopt ; \
 		${CFG_TEST} --zonegrammar forward > forward.zoneopt ; \
 		${CFG_TEST} --zonegrammar hint > hint.zoneopt ; \
 		${CFG_TEST} --zonegrammar stub > stub.zoneopt ; \
@@ -55,7 +54,6 @@ docbook: options
 	${PERL} docbook-options.pl options > ${top_srcdir}/bin/named/named.conf.docbook
 	${PERL} docbook-zoneopt.pl master.zoneopt > ${top_srcdir}/doc/arm/master.zoneopt.xml
 	${PERL} docbook-zoneopt.pl slave.zoneopt > ${top_srcdir}/doc/arm/slave.zoneopt.xml
-	${PERL} docbook-zoneopt.pl mirror.zoneopt > ${top_srcdir}/doc/arm/mirror.zoneopt.xml
 	${PERL} docbook-zoneopt.pl forward.zoneopt > ${top_srcdir}/doc/arm/forward.zoneopt.xml
 	${PERL} docbook-zoneopt.pl hint.zoneopt > ${top_srcdir}/doc/arm/hint.zoneopt.xml
 	${PERL} docbook-zoneopt.pl stub.zoneopt > ${top_srcdir}/doc/arm/stub.zoneopt.xml

doc/misc/mirror.zoneopt

@@ -1,42 +0,0 @@
-zone <string> [ <class> ] {
-	type mirror;
-	allow-notify { <address_match_element>; ... };
-	allow-query { <address_match_element>; ... };
-	allow-query-on { <address_match_element>; ... };
-	allow-transfer { <address_match_element>; ... };
-	allow-update-forwarding { <address_match_element>; ... };
-	also-notify [ port <integer> ] [ dscp <integer> ] { ( <masters> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ]; ... };
-	alt-transfer-source ( <ipv4_address> | * ) [ port ( <integer> | * ) ] [ dscp <integer> ];
-	alt-transfer-source-v6 ( <ipv6_address> | * ) [ port ( <integer> | * ) ] [ dscp <integer> ];
-	check-names ( fail | warn | ignore );
-	database <string>;
-	file <quoted_string>;
-	ixfr-from-differences <boolean>;
-	journal <quoted_string>;
-	masterfile-format ( map | raw | text );
-	masterfile-style ( full | relative );
-	masters [ port <integer> ] [ dscp <integer> ] { ( <masters> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ]; ... };
-	max-journal-size ( default | unlimited | <sizeval> );
-	max-records <integer>;
-	max-refresh-time <integer>;
-	max-retry-time <integer>;
-	max-transfer-idle-in <integer>;
-	max-transfer-idle-out <integer>;
-	max-transfer-time-in <integer>;
-	max-transfer-time-out <integer>;
-	min-refresh-time <integer>;
-	min-retry-time <integer>;
-	multi-master <boolean>;
-	notify ( explicit | master-only | <boolean> );
-	notify-delay <integer>;
-	notify-source ( <ipv4_address> | * ) [ port ( <integer> | * ) ] [ dscp <integer> ];
-	notify-source-v6 ( <ipv6_address> | * ) [ port ( <integer> | * ) ] [ dscp <integer> ];
-	request-expire <boolean>;
-	request-ixfr <boolean>;
-	transfer-source ( <ipv4_address> | * ) [ port ( <integer> | * ) ] [ dscp <integer> ];
-	transfer-source-v6 ( <ipv6_address> | * ) [ port ( <integer> | * ) ] [ dscp <integer> ];
-	try-tcp-refresh <boolean>;
-	use-alt-transfer-source <boolean>;
-	zero-no-soa-ttl <boolean>;
-	zone-statistics ( full | terse | none | <boolean> );
-};

doc/misc/options

@@ -239,6 +239,7 @@ options {
         min-roots <integer>; // not implemented
         minimal-any <boolean>;
         minimal-responses ( no-auth | no-auth-recursive | <boolean> );
+        mirror <boolean>;
         multi-master <boolean>;
         multiple-cnames <boolean>; // obsolete
         named-xfer <quoted_string>; // obsolete
@@ -579,6 +580,7 @@ view <string> [ <class> ] {
         min-roots <integer>; // not implemented
         minimal-any <boolean>;
         minimal-responses ( no-auth | no-auth-recursive | <boolean> );
+        mirror <boolean>;
         multi-master <boolean>;
         new-zones-directory <quoted_string>;
         no-case-compress { <address_match_element>; ... };
@@ -784,6 +786,7 @@ view <string> [ <class> ] {
                 max-zone-ttl ( unlimited | <ttlval> );
                 min-refresh-time <integer>;
                 min-retry-time <integer>;
+                mirror <boolean>;
                 multi-master <boolean>;
                 notify ( explicit | master-only | <boolean> );
                 notify-delay <integer>;
@@ -800,7 +803,8 @@ view <string> [ <class> ] {
                 request-expire <boolean>;
                 request-ixfr <boolean>;
                 serial-update-method ( date | increment | unixtime );
-                server-addresses { ( <ipv4_address> | <ipv6_address> ); ... };
+                server-addresses { ( <ipv4_address> | <ipv6_address> ) [
+                    port <integer> ]; ... };
                 server-names { <string>; ... };
                 sig-signing-nodes <integer>;
                 sig-signing-signatures <integer>;
@@ -811,7 +815,7 @@ view <string> [ <class> ] {
                 transfer-source-v6 ( <ipv6_address> | * ) [ port (
                     <integer> | * ) ] [ dscp <integer> ];
                 try-tcp-refresh <boolean>;
-                type ( primary | master | secondary | slave | mirror |
+                type ( primary | master | secondary | slave |
                     delegation-only | forward | hint | redirect |
                     static-stub | stub );
                 update-check-ksk <boolean>;
@@ -889,6 +893,7 @@ zone <string> [ <class> ] {
         max-zone-ttl ( unlimited | <ttlval> );
         min-refresh-time <integer>;
         min-retry-time <integer>;
+        mirror <boolean>;
         multi-master <boolean>;
         notify ( explicit | master-only | <boolean> );
         notify-delay <integer>;
@@ -903,7 +908,8 @@ zone <string> [ <class> ] {
         request-expire <boolean>;
         request-ixfr <boolean>;
         serial-update-method ( date | increment | unixtime );
-        server-addresses { ( <ipv4_address> | <ipv6_address> ); ... };
+        server-addresses { ( <ipv4_address> | <ipv6_address> ) [ port
+            <integer> ]; ... };
         server-names { <string>; ... };
         sig-signing-nodes <integer>;
         sig-signing-signatures <integer>;
@@ -914,9 +920,8 @@ zone <string> [ <class> ] {
         transfer-source-v6 ( <ipv6_address> | * ) [ port ( <integer> | * )
             ] [ dscp <integer> ];
         try-tcp-refresh <boolean>;
-        type ( primary | master | secondary | slave | mirror |
-            delegation-only | forward | hint | redirect | static-stub |
-            stub );
+        type ( primary | master | secondary | slave | delegation-only |
+            forward | hint | redirect | static-stub | stub );
         update-check-ksk <boolean>;
         update-policy ( local | { ( deny | grant ) <string> ( 6to4-self |
             external | krb5-self | krb5-selfsub | krb5-subdomain | ms-self

doc/misc/slave.zoneopt

@@ -37,6 +37,7 @@ zone <string> [ <class> ] {
 	max-transfer-time-out <integer>;
 	min-refresh-time <integer>;
 	min-retry-time <integer>;
+	mirror <boolean>;
 	multi-master <boolean>;
 	notify ( explicit | master-only | <boolean> );
 	notify-delay <integer>;

doc/misc/static-stub.zoneopt

@@ -5,7 +5,7 @@ zone <string> [ <class> ] {
 	forward ( first | only );
 	forwarders [ port <integer> ] [ dscp <integer> ] { ( <ipv4_address> | <ipv6_address> ) [ port <integer> ] [ dscp <integer> ]; ... };
 	max-records <integer>;
-	server-addresses { ( <ipv4_address> | <ipv6_address> ); ... };
+	server-addresses { ( <ipv4_address> | <ipv6_address> ) [ port <integer> ]; ... };
 	server-names { <string>; ... };
 	zone-statistics ( full | terse | none | <boolean> );
 };

lib/bind9/check.c

@@ -23,7 +23,6 @@
 #include <isc/file.h>
 #include <isc/hex.h>
 #include <isc/log.h>
-#include <isc/md.h>
 #include <isc/mem.h>
 #include <isc/netaddr.h>
 #include <isc/parseint.h>
@@ -31,6 +30,8 @@
 #include <isc/print.h>
 #include <isc/region.h>
 #include <isc/result.h>
+#include <isc/sha1.h>
+#include <isc/sha2.h>
 #include <isc/sockaddr.h>
 #include <isc/string.h>
 #include <isc/symtab.h>
@@ -1914,114 +1915,6 @@ check_nonzero(const cfg_obj_t *options, isc_log_t *logctx) {
 	return (result);
 }
 
-/*%
- * Check whether NOTIFY configuration at the zone level is acceptable for a
- * mirror zone.  Return true if it is; return false otherwise.
- */
-static bool
-check_mirror_zone_notify(const cfg_obj_t *zoptions, const char *znamestr,
-			 isc_log_t *logctx)
-{
-	bool notify_configuration_ok = true;
-	const cfg_obj_t *obj = NULL;
-
-	(void)cfg_map_get(zoptions, "notify", &obj);
-	if (obj == NULL) {
-		/*
-		 * "notify" not set at zone level.  This is fine.
-		 */
-		return (true);
-	}
-
-	if (cfg_obj_isboolean(obj)) {
-		if (cfg_obj_asboolean(obj)) {
-			/*
-			 * "notify yes;" set at zone level.  This is an error.
-			 */
-			notify_configuration_ok = false;
-		}
-	} else {
-		const char *notifystr = cfg_obj_asstring(obj);
-		if (strcasecmp(notifystr, "explicit") != 0) {
-			/*
-			 * Something else than "notify explicit;" set at zone
-			 * level.  This is an error.
-			 */
-			notify_configuration_ok = false;
-		}
-	}
-
-	if (!notify_configuration_ok) {
-		cfg_obj_log(zoptions, logctx, ISC_LOG_ERROR,
-			    "zone '%s': mirror zones can only be used with "
-			    "'notify no;' or 'notify explicit;'", znamestr);
-	}
-
-	return (notify_configuration_ok);
-}
-
-/*%
- * Try to determine whether recursion is available in a view without resorting
- * to extraordinary measures: just check the "recursion" and "allow-recursion"
- * settings.  The point is to prevent accidental mirror zone misuse rather than
- * to enforce some sort of policy.  Recursion is assumed to be allowed by
- * default if it is not explicitly disabled.
- */
-static bool
-check_recursion(const cfg_obj_t *config, const cfg_obj_t *voptions,
-		const cfg_obj_t *goptions, isc_log_t *logctx,
-		cfg_aclconfctx_t *actx, isc_mem_t *mctx)
-{
-	dns_acl_t *acl = NULL;
-	const cfg_obj_t *obj;
-	isc_result_t result;
-	bool retval = true;
-
-	/*
-	 * Check the "recursion" option first.
-	 */
-	obj = NULL;
-	result = ISC_R_NOTFOUND;
-	if (voptions != NULL) {
-		result = cfg_map_get(voptions, "recursion", &obj);
-	}
-	if (result != ISC_R_SUCCESS && goptions != NULL) {
-		result = cfg_map_get(goptions, "recursion", &obj);
-	}
-	if (result == ISC_R_SUCCESS && !cfg_obj_asboolean(obj)) {
-		retval = false;
-		goto cleanup;
-	}
-
-	/*
-	 * If recursion is not disabled by the "recursion" option, check
-	 * whether it is disabled by the "allow-recursion" ACL.
-	 */
-	obj = NULL;
-	result = ISC_R_NOTFOUND;
-	if (voptions != NULL) {
-		result = cfg_map_get(voptions, "allow-recursion", &obj);
-	}
-	if (result != ISC_R_SUCCESS && goptions != NULL) {
-		result = cfg_map_get(goptions, "allow-recursion", &obj);
-	}
-	if (result == ISC_R_SUCCESS) {
-		result = cfg_acl_fromconfig(obj, config, logctx, actx, mctx, 0,
-					    &acl);
-		if (result != ISC_R_SUCCESS) {
-			goto cleanup;
-		}
-		retval = !dns_acl_isnone(acl);
-	}
-
- cleanup:
-	if (acl != NULL) {
-		dns_acl_detach(&acl);
-	}
-
-	return (retval);
-}
-
 static isc_result_t
 check_zoneconf(const cfg_obj_t *zconfig, const cfg_obj_t *voptions,
 	       const cfg_obj_t *config, isc_symtab_t *symtab,
@@ -2096,8 +1989,6 @@ check_zoneconf(const cfg_obj_t *zconfig, const cfg_obj_t *voptions,
 			   strcasecmp(typestr, "secondary") == 0)
 		{
 			ztype = CFG_ZONE_SLAVE;
-		} else if (strcasecmp(typestr, "mirror") == 0) {
-			ztype = CFG_ZONE_MIRROR;
 		} else if (strcasecmp(typestr, "stub") == 0) {
 			ztype = CFG_ZONE_STUB;
 		} else if (strcasecmp(typestr, "static-stub") == 0) {
@@ -2209,7 +2100,6 @@ check_zoneconf(const cfg_obj_t *zconfig, const cfg_obj_t *voptions,
 
 		case CFG_ZONE_MASTER:
 		case CFG_ZONE_SLAVE:
-		case CFG_ZONE_MIRROR:
 		case CFG_ZONE_HINT:
 		case CFG_ZONE_STUB:
 		case CFG_ZONE_STATICSTUB:
@@ -2294,22 +2184,10 @@ check_zoneconf(const cfg_obj_t *zconfig, const cfg_obj_t *voptions,
 	}
 
 	/*
-	 * Only a limited subset of all possible "notify" settings can be used
-	 * at the zone level for mirror zones.
-	 */
-	if (ztype == CFG_ZONE_MIRROR &&
-	    !check_mirror_zone_notify(zoptions, znamestr, logctx))
-	{
-		result = ISC_R_FAILURE;
-	}
-
-	/*
-	 * Master, slave, and mirror zones may have an "also-notify" field, but
+	 * Master & slave zones may have an "also-notify" field, but
 	 * shouldn't if notify is disabled.
 	 */
-	if (ztype == CFG_ZONE_MASTER || ztype == CFG_ZONE_SLAVE ||
-	    ztype == CFG_ZONE_MIRROR)
-	{
+	if (ztype == CFG_ZONE_MASTER || ztype == CFG_ZONE_SLAVE) {
 		bool donotify = true;
 
 		obj = NULL;
@@ -2350,13 +2228,9 @@ check_zoneconf(const cfg_obj_t *zconfig, const cfg_obj_t *voptions,
 	}
 
 	/*
-	 * Slave, mirror, and stub zones must have a "masters" field, with one
-	 * exception: when mirroring the root zone, a default, built-in master
-	 * server list is used in the absence of one explicitly specified.
+	 * Slave & stub zones must have a "masters" field.
 	 */
-	if (ztype == CFG_ZONE_SLAVE || ztype == CFG_ZONE_STUB ||
-	    (ztype == CFG_ZONE_MIRROR && !dns_name_equal(zname, dns_rootname)))
-	{
+	if (ztype == CFG_ZONE_SLAVE || ztype == CFG_ZONE_STUB) {
 		obj = NULL;
 		if (cfg_map_get(zoptions, "masters", &obj) != ISC_R_SUCCESS) {
 			cfg_obj_log(zoptions, logctx, ISC_LOG_ERROR,
@@ -2378,19 +2252,6 @@ check_zoneconf(const cfg_obj_t *zconfig, const cfg_obj_t *voptions,
 		}
 	}
 
-	/*
-	 * Configuring a mirror zone and disabling recursion at the same time
-	 * contradicts the purpose of the former.
-	 */
-	if (ztype == CFG_ZONE_MIRROR &&
-	    !check_recursion(config, voptions, goptions, logctx, actx, mctx))
-	{
-		cfg_obj_log(zoptions, logctx, ISC_LOG_ERROR,
-			    "zone '%s': mirror zones cannot be used if "
-			    "recursion is disabled", znamestr);
-		result = ISC_R_FAILURE;
-	}
-
 	/*
 	 * Master zones can't have both "allow-update" and "update-policy".
 	 */
@@ -2600,6 +2461,13 @@ check_zoneconf(const cfg_obj_t *zconfig, const cfg_obj_t *voptions,
 			obj = cfg_listelt_value(element);
 			sa = *cfg_obj_assockaddr(obj);
 
+			if (isc_sockaddr_getport(&sa) != 0) {
+				result = ISC_R_FAILURE;
+				cfg_obj_log(obj, logctx, ISC_LOG_ERROR,
+					    "port is not configurable for "
+					    "static stub server-addresses");
+			}
+
 			isc_netaddr_fromsockaddr(&na, &sa);
 			if (isc_netaddr_getzone(&na) != 0) {
 				result = ISC_R_FAILURE;
@@ -2760,9 +2628,7 @@ check_zoneconf(const cfg_obj_t *zconfig, const cfg_obj_t *voptions,
 			    znamestr);
 			result = tresult;
 		} else if (tresult == ISC_R_SUCCESS &&
-			   (ztype == CFG_ZONE_SLAVE ||
-			    ztype == CFG_ZONE_MIRROR || ddns))
-		{
+			   (ztype == CFG_ZONE_SLAVE || ddns)) {
 			tresult = fileexist(fileobj, files, true, logctx);
 			if (tresult != ISC_R_SUCCESS)
 				result = tresult;

lib/bind9/win32/libbind9.vcxproj.in

@@ -53,7 +53,7 @@
       </PrecompiledHeader>
       <WarningLevel>Level3</WarningLevel>
       <Optimization>Disabled</Optimization>
-      <PreprocessorDefinitions>WIN32;_DEBUG;_WINDOWS;_USRDLL;LIBBIND9_EXPORTS;%(PreprocessorDefinitions);%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <PreprocessorDefinitions>WIN32;USE_MD5;_DEBUG;_WINDOWS;_USRDLL;LIBBIND9_EXPORTS;%(PreprocessorDefinitions);%(PreprocessorDefinitions)</PreprocessorDefinitions>
       <AdditionalIncludeDirectories>./;../../../;include;../include;../../isc/win32;../../isc/win32/include;../../isc/include;../../isccfg/include;../../dns/include;@LIBXML2_INC@@OPENSSL_INC@@GEOIP_INC@%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
       <FunctionLevelLinking>true</FunctionLevelLinking>
       <PrecompiledHeaderOutputFile>.\$(Configuration)\$(TargetName).pch</PrecompiledHeaderOutputFile>
@@ -81,7 +81,7 @@
       <Optimization>MaxSpeed</Optimization>
       <FunctionLevelLinking>true</FunctionLevelLinking>
       <IntrinsicFunctions>@INTRINSIC@</IntrinsicFunctions>
-      <PreprocessorDefinitions>WIN32;NDEBUG;_WINDOWS;_USRDLL;LIBBIND9_EXPORTS;%(PreprocessorDefinitions);%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <PreprocessorDefinitions>WIN32;USE_MD5;NDEBUG;_WINDOWS;_USRDLL;LIBBIND9_EXPORTS;%(PreprocessorDefinitions);%(PreprocessorDefinitions)</PreprocessorDefinitions>
       <AdditionalIncludeDirectories>./;../../../;include;../include;../../isc/win32;../../isc/win32/include;../../isc/include;../../isccfg/include;../../dns/include;@LIBXML2_INC@@OPENSSL_INC@@GEOIP_INC@%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
       <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
       <WholeProgramOptimization>false</WholeProgramOptimization>

lib/dns/Makefile.in

@@ -29,7 +29,7 @@ USE_ISC_SPNEGO = @USE_ISC_SPNEGO@
 CINCLUDES =	-I. -I${top_srcdir}/lib/dns -Iinclude ${DNS_INCLUDES} \
 		${ISC_INCLUDES} @OPENSSL_INCLUDES@ @DST_GSSAPI_INC@
 
-CDEFINES =	@USE_GSSAPI@ ${USE_ISC_SPNEGO}
+CDEFINES =	-DUSE_MD5 @USE_GSSAPI@ ${USE_ISC_SPNEGO}
 
 CWARNINGS =
 

lib/dns/catz.c

@@ -17,11 +17,11 @@
 #include <stdbool.h>
 
 #include <isc/hex.h>
-#include <isc/md.h>
 #include <isc/mem.h>
 #include <isc/parseint.h>
 #include <isc/print.h>
 #include <isc/result.h>
+#include <isc/sha2.h>
 #include <isc/task.h>
 #include <isc/util.h>
 
@@ -1420,27 +1420,12 @@ dns_catz_update_process(dns_catz_zones_t *catzs, dns_catz_zone_t *zone,
 	return (result);
 }
 
-static isc_result_t
-digest2hex(unsigned char *digest, unsigned int digestlen,
-	   char *hash, size_t hashlen)
-{
-	unsigned int i;
-	int ret;
-	for (i = 0; i < digestlen; i++) {
-		size_t left = hashlen - i * 2;
-		ret = snprintf(hash + i * 2, left, "%02x", digest[i]);
-		if (ret < 0 || (size_t)ret >= left) {
-			return (ISC_R_NOSPACE);
-		}
-	}
-	return (ISC_R_SUCCESS);
-}
-
 isc_result_t
 dns_catz_generate_masterfilename(dns_catz_zone_t *zone, dns_catz_entry_t *entry,
 				 isc_buffer_t **buffer)
 {
 	isc_buffer_t *tbuf = NULL;
+	isc_sha256_t sha256;
 	isc_region_t r;
 	isc_result_t result;
 	size_t rlen;
@@ -1468,7 +1453,7 @@ dns_catz_generate_masterfilename(dns_catz_zone_t *zone, dns_catz_entry_t *entry,
 		goto cleanup;
 
 	/* __catz__<digest>.db */
-	rlen = (isc_md_type_get_size(ISC_MD_SHA256) * 2 + 1) + 12;
+	rlen = ISC_SHA256_DIGESTSTRINGLENGTH + 12;
 
 	/* optionally prepend with <zonedir>/ */
 	if (entry->opts.zonedir != NULL)
@@ -1485,20 +1470,11 @@ dns_catz_generate_masterfilename(dns_catz_zone_t *zone, dns_catz_entry_t *entry,
 
 	isc_buffer_usedregion(tbuf, &r);
 	isc_buffer_putstr(*buffer, "__catz__");
-	if (tbuf->used > ISC_SHA256_DIGESTLENGTH * 2 + 1) {
-		unsigned char digest[ISC_MAX_MD_SIZE];
-		unsigned int digestlen;
+	if (tbuf->used > ISC_SHA256_DIGESTSTRINGLENGTH) {
+		isc_sha256_init(&sha256);
+		isc_sha256_update(&sha256, r.base, r.length);
 		/* we can do that because digest string < 2 * DNS_NAME */
-		result = isc_md(ISC_MD_SHA256, r.base, r.length,
-				digest, &digestlen);
-		if (result != ISC_R_SUCCESS) {
-			goto cleanup;
-		}
-		result = digest2hex(digest, digestlen, (char *)r.base,
-				    ISC_SHA256_DIGESTLENGTH * 2 + 1);
-		if (result != ISC_R_SUCCESS) {
-			goto cleanup;
-		}
+		isc_sha256_end(&sha256, (char *) r.base);
 		isc_buffer_putstr(*buffer, (char *) r.base);
 	} else {
 		isc_buffer_copyregion(*buffer, &r);

lib/dns/dispatch.c

@@ -299,7 +299,8 @@ static isc_result_t get_udpsocket(dns_dispatchmgr_t *mgr,
 				  isc_socketmgr_t *sockmgr,
 				  const isc_sockaddr_t *localaddr,
 				  isc_socket_t **sockp,
-				  isc_socket_t *dup_socket);
+				  isc_socket_t *dup_socket,
+				  bool duponly);
 static isc_result_t dispatch_createudp(dns_dispatchmgr_t *mgr,
 				       isc_socketmgr_t *sockmgr,
 				       isc_taskmgr_t *taskmgr,
@@ -317,7 +318,7 @@ static void qid_destroy(isc_mem_t *mctx, dns_qid_t **qidp);
 static isc_result_t open_socket(isc_socketmgr_t *mgr,
 				const isc_sockaddr_t *local,
 				unsigned int options, isc_socket_t **sockp,
-				isc_socket_t *dup_socket);
+				isc_socket_t *dup_socket, bool duponly);
 static bool portavailable(dns_dispatchmgr_t *mgr, isc_socket_t *sock,
 				   isc_sockaddr_t *sockaddrp);
 
@@ -728,7 +729,7 @@ get_dispsocket(dns_dispatch_t *disp, const isc_sockaddr_t *dest,
 		if (portentry != NULL)
 			bindoptions |= ISC_SOCKET_REUSEADDRESS;
 		result = open_socket(sockmgr, &localaddr, bindoptions, &sock,
-				     NULL);
+				     NULL, false);
 		if (result == ISC_R_SUCCESS) {
 			if (portentry == NULL) {
 				portentry = new_portentry(disp, port);
@@ -1668,7 +1669,7 @@ destroy_mgr(dns_dispatchmgr_t **mgrp) {
 static isc_result_t
 open_socket(isc_socketmgr_t *mgr, const isc_sockaddr_t *local,
 	    unsigned int options, isc_socket_t **sockp,
-	    isc_socket_t *dup_socket)
+	    isc_socket_t *dup_socket, bool duponly)
 {
 	isc_socket_t *sock;
 	isc_result_t result;
@@ -1678,7 +1679,7 @@ open_socket(isc_socketmgr_t *mgr, const isc_sockaddr_t *local,
 		result = isc_socket_open(sock);
 		if (result != ISC_R_SUCCESS)
 			return (result);
-	} else if (dup_socket != NULL) {
+	} else if (dup_socket != NULL && (!isc_socket_hasreuseport() || duponly)) {
 		result = isc_socket_dup(dup_socket, &sock);
 		if (result != ISC_R_SUCCESS)
 			return (result);
@@ -2758,7 +2759,7 @@ dns_dispatch_getudp(dns_dispatchmgr_t *mgr, isc_socketmgr_t *sockmgr,
 static isc_result_t
 get_udpsocket(dns_dispatchmgr_t *mgr, dns_dispatch_t *disp,
 	      isc_socketmgr_t *sockmgr, const isc_sockaddr_t *localaddr,
-	      isc_socket_t **sockp, isc_socket_t *dup_socket)
+	      isc_socket_t **sockp, isc_socket_t *dup_socket, bool duponly)
 {
 	unsigned int i, j;
 	isc_socket_t *held[DNS_DISPATCH_HELD];
@@ -2796,7 +2797,7 @@ get_udpsocket(dns_dispatchmgr_t *mgr, dns_dispatch_t *disp,
 			prt = ports[isc_random_uniform(nports)];
 			isc_sockaddr_setport(&localaddr_bound, prt);
 			result = open_socket(sockmgr, &localaddr_bound,
-					     0, &sock, NULL);
+					     0, &sock, NULL, false);
 			/*
 			 * Continue if the port choosen is already in use
 			 * or the OS has reserved it.
@@ -2817,7 +2818,7 @@ get_udpsocket(dns_dispatchmgr_t *mgr, dns_dispatch_t *disp,
 		/* Allow to reuse address for non-random ports. */
 		result = open_socket(sockmgr, localaddr,
 				     ISC_SOCKET_REUSEADDRESS, &sock,
-				     dup_socket);
+				     dup_socket, duponly);
 
 		if (result == ISC_R_SUCCESS)
 			*sockp = sock;
@@ -2829,7 +2830,7 @@ get_udpsocket(dns_dispatchmgr_t *mgr, dns_dispatch_t *disp,
 	i = 0;
 
 	for (j = 0; j < 0xffffU; j++) {
-		result = open_socket(sockmgr, localaddr, 0, &sock, NULL);
+		result = open_socket(sockmgr, localaddr, 0, &sock, NULL, false);
 		if (result != ISC_R_SUCCESS)
 			goto end;
 		else if (portavailable(mgr, sock, NULL))
@@ -2874,6 +2875,9 @@ dispatch_createudp(dns_dispatchmgr_t *mgr, isc_socketmgr_t *sockmgr,
 	isc_socket_t *sock = NULL;
 	int i = 0;
 
+	bool duponly = ((attributes & DNS_DISPATCHATTR_CANREUSE) == 0);
+	/* This is an attribute needed only at creation time */
+	attributes &= ~DNS_DISPATCHATTR_CANREUSE;
 	/*
 	 * dispatch_allocate() checks mgr for us.
 	 */
@@ -2886,7 +2890,7 @@ dispatch_createudp(dns_dispatchmgr_t *mgr, isc_socketmgr_t *sockmgr,
 
 	if ((attributes & DNS_DISPATCHATTR_EXCLUSIVE) == 0) {
 		result = get_udpsocket(mgr, disp, sockmgr, localaddr, &sock,
-				       dup_socket);
+				       dup_socket, duponly);
 		if (result != ISC_R_SUCCESS)
 			goto deallocate_dispatch;
 
@@ -2911,7 +2915,7 @@ dispatch_createudp(dns_dispatchmgr_t *mgr, isc_socketmgr_t *sockmgr,
 		 */
 		isc_sockaddr_anyofpf(&sa_any, isc_sockaddr_pf(localaddr));
 		if (!isc_sockaddr_eqaddr(&sa_any, localaddr)) {
-			result = open_socket(sockmgr, localaddr, 0, &sock, NULL);
+			result = open_socket(sockmgr, localaddr, 0, &sock, NULL, false);
 			if (sock != NULL)
 				isc_socket_detach(&sock);
 			if (result != ISC_R_SUCCESS)

lib/dns/ds.c

@@ -18,7 +18,8 @@
 
 #include <isc/buffer.h>
 #include <isc/region.h>
-#include <isc/md.h>
+#include <isc/sha1.h>
+#include <isc/sha2.h>
 #include <isc/util.h>
 
 #include <dns/ds.h>
@@ -37,21 +38,19 @@ dns_ds_buildrdata(dns_name_t *owner, dns_rdata_t *key,
 {
 	dns_fixedname_t fname;
 	dns_name_t *name;
-	unsigned char digest[ISC_MAX_MD_SIZE];
-	unsigned int digestlen;
+	unsigned char digest[ISC_SHA384_DIGESTLENGTH];
 	isc_region_t r;
 	isc_buffer_t b;
 	dns_rdata_ds_t ds;
-	isc_md_t *md;
-	isc_md_type_t md_type = 0;
-	isc_result_t ret;
+	isc_sha1_t sha1;
+	isc_sha256_t sha256;
+	isc_sha384_t sha384;
 
 	REQUIRE(key != NULL);
 	REQUIRE(key->type == dns_rdatatype_dnskey);
 
-	if (!dst_ds_digest_supported(digest_type)) {
+	if (!dst_ds_digest_supported(digest_type))
 		return (ISC_R_NOTIMPLEMENTED);
-	}
 
 	name = dns_fixedname_initname(&fname);
 	(void)dns_name_downcase(owner, name, NULL);
@@ -59,65 +58,61 @@ dns_ds_buildrdata(dns_name_t *owner, dns_rdata_t *key,
 	memset(buffer, 0, DNS_DS_BUFFERSIZE);
 	isc_buffer_init(&b, buffer, DNS_DS_BUFFERSIZE);
 
-	md = isc_md_new();
-	if (md == NULL) {
-		return (ISC_R_NOMEMORY);
-	}
-
 	switch (digest_type) {
 	case DNS_DSDIGEST_SHA1:
-		md_type = ISC_MD_SHA1;
+		isc_sha1_init(&sha1);
+		dns_name_toregion(name, &r);
+		isc_sha1_update(&sha1, r.base, r.length);
+		dns_rdata_toregion(key, &r);
+		INSIST(r.length >= 4);
+		isc_sha1_update(&sha1, r.base, r.length);
+		isc_sha1_final(&sha1, digest);
 		break;
 
 	case DNS_DSDIGEST_SHA384:
-		md_type = ISC_MD_SHA384;
+		isc_sha384_init(&sha384);
+		dns_name_toregion(name, &r);
+		isc_sha384_update(&sha384, r.base, r.length);
+		dns_rdata_toregion(key, &r);
+		INSIST(r.length >= 4);
+		isc_sha384_update(&sha384, r.base, r.length);
+		isc_sha384_final(digest, &sha384);
 		break;
 
 	case DNS_DSDIGEST_SHA256:
 	default:
-		md_type = ISC_MD_SHA256;
+		isc_sha256_init(&sha256);
+		dns_name_toregion(name, &r);
+		isc_sha256_update(&sha256, r.base, r.length);
+		dns_rdata_toregion(key, &r);
+		INSIST(r.length >= 4);
+		isc_sha256_update(&sha256, r.base, r.length);
+		isc_sha256_final(digest, &sha256);
 		break;
 	}
 
-	ret = isc_md_init(md, md_type);
-	if (ret != ISC_R_SUCCESS) {
-		goto end;
-	}
-
-	dns_name_toregion(name, &r);
-
-	ret = isc_md_update(md, r.base, r.length);
-	if (ret != ISC_R_SUCCESS) {
-		goto end;
-	}
-
-	dns_rdata_toregion(key, &r);
-	INSIST(r.length >= 4);
-
-	ret = isc_md_update(md, r.base, r.length);
-	if (ret != ISC_R_SUCCESS) {
-		goto end;
-	}
-
-	ret = isc_md_final(md, digest, &digestlen);
-	if (ret != ISC_R_SUCCESS) {
-		goto end;
-	}
-
 	ds.mctx = NULL;
 	ds.common.rdclass = key->rdclass;
 	ds.common.rdtype = dns_rdatatype_ds;
 	ds.algorithm = r.base[3];
 	ds.key_tag = dst_region_computeid(&r, ds.algorithm);
 	ds.digest_type = digest_type;
-	ds.digest = digest;
-	ds.length = digestlen;
+	switch (digest_type) {
+	case DNS_DSDIGEST_SHA1:
+		ds.length = ISC_SHA1_DIGESTLENGTH;
+		break;
 
-	ret = dns_rdata_fromstruct(rdata, key->rdclass, dns_rdatatype_ds,
-				   &ds, &b);
-end:
-	if (md != NULL) {
-		isc_md_free(md);
+	case DNS_DSDIGEST_SHA384:
+		ds.length = ISC_SHA384_DIGESTLENGTH;
+		break;
+
+	case DNS_DSDIGEST_SHA256:
+	default:
+		ds.length = ISC_SHA256_DIGESTLENGTH;
+		break;
 	}
-	return (ret);
+	ds.digest = digest;
+
+	return (dns_rdata_fromstruct(rdata, key->rdclass, dns_rdatatype_ds,
+				     &ds, &b));
 }

lib/dns/dst_api.c

@@ -35,6 +35,7 @@
 #include <isc/buffer.h>
 #include <isc/dir.h>
 #include <isc/fsaccess.h>
+#include <isc/hmacsha.h>
 #include <isc/lex.h>
 #include <isc/mem.h>
 #include <isc/once.h>
@@ -72,6 +73,8 @@ static bool dst_initialized = false;
 
 void gss_log(int level, const char *fmt, ...) ISC_FORMAT_PRINTF(2, 3);
 
+LIBDNS_EXTERNAL_DATA isc_mem_t *dst__memory_pool = NULL;
+
 /*
  * Static functions.
  */
@@ -122,6 +125,20 @@ static isc_result_t	addsuffix(char *filename, int len,
 			return (_r);		\
 	} while (0);				\
 
+static void *
+default_memalloc(void *arg, size_t size) {
+	UNUSED(arg);
+	if (size == 0U)
+		size = 1;
+	return (malloc(size));
+}
+
+static void
+default_memfree(void *arg, void *ptr) {
+	UNUSED(arg);
+	free(ptr);
+}
+
 isc_result_t
 dst_lib_init(isc_mem_t *mctx, const char *engine) {
 	isc_result_t result;
@@ -131,6 +148,26 @@ dst_lib_init(isc_mem_t *mctx, const char *engine) {
 
 	UNUSED(engine);
 
+	dst__memory_pool = NULL;
+
+	UNUSED(mctx);
+	/*
+	 * When using --with-openssl, there seems to be no good way of not
+	 * leaking memory due to the openssl error handling mechanism.
+	 * Avoid assertions by using a local memory context and not checking
+	 * for leaks on exit.  Note: as there are leaks we cannot use
+	 * ISC_MEMFLAG_INTERNAL as it will free up memory still being used
+	 * by libcrypto.
+	 */
+	result = isc_mem_createx(0, 0, default_memalloc, default_memfree,
+				 NULL, &dst__memory_pool, 0);
+	if (result != ISC_R_SUCCESS)
+		return (result);
+	isc_mem_setname(dst__memory_pool, "dst", NULL);
+#ifndef OPENSSL_LEAKS
+	isc_mem_setdestroycheck(dst__memory_pool, false);
+#endif
+
 	dst_result_register();
 
 	memset(dst_t_func, 0, sizeof(dst_t_func));
@@ -140,7 +177,7 @@ dst_lib_init(isc_mem_t *mctx, const char *engine) {
 	RETERR(dst__hmacsha256_init(&dst_t_func[DST_ALG_HMACSHA256]));
 	RETERR(dst__hmacsha384_init(&dst_t_func[DST_ALG_HMACSHA384]));
 	RETERR(dst__hmacsha512_init(&dst_t_func[DST_ALG_HMACSHA512]));
-	RETERR(dst__openssl_init(mctx, engine));
+	RETERR(dst__openssl_init(engine));
 	RETERR(dst__openssldh_init(&dst_t_func[DST_ALG_DH]));
 #if USE_OPENSSL
 	RETERR(dst__opensslrsa_init(&dst_t_func[DST_ALG_RSAMD5],
@@ -206,6 +243,8 @@ dst_lib_destroy(void) {
 #if USE_PKCS11
 	(void) dst__pkcs11_destroy();
 #endif /* USE_PKCS11 */
+	if (dst__memory_pool != NULL)
+		isc_mem_detach(&dst__memory_pool);
 }
 
 bool
@@ -1163,22 +1202,22 @@ dst_key_sigsize(const dst_key_t *key, unsigned int *n) {
 		*n = DNS_SIG_ED448SIZE;
 		break;
 	case DST_ALG_HMACMD5:
-		*n = isc_md_type_get_size(ISC_MD_MD5);
+		*n = 16;
 		break;
 	case DST_ALG_HMACSHA1:
-		*n = isc_md_type_get_size(ISC_MD_SHA1);
+		*n = ISC_SHA1_DIGESTLENGTH;
 		break;
 	case DST_ALG_HMACSHA224:
-		*n = isc_md_type_get_size(ISC_MD_SHA224);
+		*n = ISC_SHA224_DIGESTLENGTH;
 		break;
 	case DST_ALG_HMACSHA256:
-		*n = isc_md_type_get_size(ISC_MD_SHA256);
+		*n = ISC_SHA256_DIGESTLENGTH;
 		break;
 	case DST_ALG_HMACSHA384:
-		*n = isc_md_type_get_size(ISC_MD_SHA384);
+		*n = ISC_SHA384_DIGESTLENGTH;
 		break;
 	case DST_ALG_HMACSHA512:
-		*n = isc_md_type_get_size(ISC_MD_SHA512);
+		*n = ISC_SHA512_DIGESTLENGTH;
 		break;
 	case DST_ALG_GSSAPI:
 		*n = 128; /*%< XXX */

lib/dns/dst_internal.h

@@ -33,12 +33,15 @@
 #include <isc/lang.h>
 #include <isc/buffer.h>
 #include <isc/magic.h>
-#include <isc/md.h>
 #include <isc/region.h>
 #include <isc/types.h>
+#include <isc/md5.h>
 #include <isc/refcount.h>
+#include <isc/sha1.h>
+#include <isc/sha2.h>
 #include <isc/stdtime.h>
-#include <isc/hmac.h>
+#include <isc/hmacmd5.h>
+#include <isc/hmacsha.h>
 
 #if USE_PKCS11
 #include <pk11/pk11.h>
@@ -63,13 +66,20 @@ ISC_LANG_BEGINDECLS
 #define VALID_KEY(x) ISC_MAGIC_VALID(x, KEY_MAGIC)
 #define VALID_CTX(x) ISC_MAGIC_VALID(x, CTX_MAGIC)
 
+LIBDNS_EXTERNAL_DATA extern isc_mem_t *dst__memory_pool;
+
 /***
  *** Types
  ***/
 
 typedef struct dst_func dst_func_t;
 
-typedef struct dst_hmac_key	  dst_hmac_key_t;
+typedef struct dst_hmacmd5_key	  dst_hmacmd5_key_t;
+typedef struct dst_hmacsha1_key   dst_hmacsha1_key_t;
+typedef struct dst_hmacsha224_key dst_hmacsha224_key_t;
+typedef struct dst_hmacsha256_key dst_hmacsha256_key_t;
+typedef struct dst_hmacsha384_key dst_hmacsha384_key_t;
+typedef struct dst_hmacsha512_key dst_hmacsha512_key_t;
 
 /*%
  * Indicate whether a DST context will be used for signing
@@ -105,7 +115,13 @@ struct dst_key {
 #if USE_PKCS11
 		pk11_object_t *pkey;
 #endif
-		dst_hmac_key_t *hmac_key;
+		dst_hmacmd5_key_t *hmacmd5;
+		dst_hmacsha1_key_t *hmacsha1;
+		dst_hmacsha224_key_t *hmacsha224;
+		dst_hmacsha256_key_t *hmacsha256;
+		dst_hmacsha384_key_t *hmacsha384;
+		dst_hmacsha512_key_t *hmacsha512;
+
 	} keydata;			/*%< pointer to key in crypto pkg fmt */
 
 	isc_stdtime_t	times[DST_MAX_TIMES + 1];    /*%< timing metadata */
@@ -132,7 +148,16 @@ struct dst_context {
 	union {
 		void *generic;
 		dst_gssapi_signverifyctx_t *gssctx;
-		isc_hmac_t *hmac_ctx;
+		isc_md5_t *md5ctx;
+		isc_sha1_t *sha1ctx;
+		isc_sha256_t *sha256ctx;
+		isc_sha512_t *sha512ctx;
+		isc_hmacmd5_t *hmacmd5ctx;
+		isc_hmacsha1_t *hmacsha1ctx;
+		isc_hmacsha224_t *hmacsha224ctx;
+		isc_hmacsha256_t *hmacsha256ctx;
+		isc_hmacsha384_t *hmacsha384ctx;
+		isc_hmacsha512_t *hmacsha512ctx;
 		EVP_MD_CTX *evp_md_ctx;
 #if USE_PKCS11
 		pk11_context_t *pk11_ctx;
@@ -189,7 +214,7 @@ struct dst_func {
 /*%
  * Initializers
  */
-isc_result_t dst__openssl_init(isc_mem_t *, const char *engine);
+isc_result_t dst__openssl_init(const char *engine);
 #define dst__pkcs11_init pk11_initialize
 
 isc_result_t dst__hmacmd5_init(struct dst_func **funcp);

lib/dns/dst_parse.h

@@ -63,6 +63,13 @@
 #define TAG_DH_PRIVATE		((DST_ALG_DH << TAG_SHIFT) + 2)
 #define TAG_DH_PUBLIC		((DST_ALG_DH << TAG_SHIFT) + 3)
 
+#define DSA_NTAGS		5
+#define TAG_DSA_PRIME		((DST_ALG_DSA << TAG_SHIFT) + 0)
+#define TAG_DSA_SUBPRIME	((DST_ALG_DSA << TAG_SHIFT) + 1)
+#define TAG_DSA_BASE		((DST_ALG_DSA << TAG_SHIFT) + 2)
+#define TAG_DSA_PRIVATE		((DST_ALG_DSA << TAG_SHIFT) + 3)
+#define TAG_DSA_PUBLIC		((DST_ALG_DSA << TAG_SHIFT) + 4)
+
 #define ECDSA_NTAGS		4
 #define TAG_ECDSA_PRIVATEKEY	((DST_ALG_ECDSA256 << TAG_SHIFT) + 0)
 #define TAG_ECDSA_ENGINE	((DST_ALG_ECDSA256 << TAG_SHIFT) + 1)

lib/dns/gen.c

@@ -689,17 +689,19 @@ main(int argc, char **argv) {
 			 "DNS_RDATATYPEATTR_NOTQUESTION"
 #define METAQUESTIONONLY "DNS_RDATATYPEATTR_META | " \
 			 "DNS_RDATATYPEATTR_QUESTIONONLY"
-#define RESERVEDNAME	 "0"
-#define RESERVED	 "DNS_RDATATYPEATTR_RESERVED"
+#define RESERVED "DNS_RDATATYPEATTR_RESERVED"
 
 		/*
 		 * Add in reserved/special types.  This will let us
 		 * sort them without special cases.
 		 */
 		insert_into_typenames(0, "reserved0", RESERVED);
-		insert_into_typenames(100, "uinfo", RESERVEDNAME);
-		insert_into_typenames(101, "uid", RESERVEDNAME);
-		insert_into_typenames(102, "gid", RESERVEDNAME);
+		insert_into_typenames(31, "eid", RESERVED);
+		insert_into_typenames(32, "nimloc", RESERVED);
+		insert_into_typenames(34, "atma", RESERVED);
+		insert_into_typenames(100, "uinfo", RESERVED);
+		insert_into_typenames(101, "uid", RESERVED);
+		insert_into_typenames(102, "gid", RESERVED);
 		insert_into_typenames(251, "ixfr", METAQUESTIONONLY);
 		insert_into_typenames(252, "axfr", METAQUESTIONONLY);
 		insert_into_typenames(253, "mailb", METAQUESTIONONLY);

lib/dns/gssapi_link.c

@@ -190,7 +190,7 @@ gssapi_verify(dst_context_t *dctx, const isc_region_t *sig) {
 	gss_buffer_desc gmessage, gsig;
 	OM_uint32 minor, gret;
 	gss_ctx_id_t gssctx = dctx->key->keydata.gssctx;
-	unsigned char buf[sig->length];
+	unsigned char *buf;
 	char err[1024];
 
 	/*
@@ -200,6 +200,15 @@ gssapi_verify(dst_context_t *dctx, const isc_region_t *sig) {
 	isc_buffer_usedregion(ctx->buffer, &message);
 	REGION_TO_GBUFFER(message, gmessage);
 
+	/*
+	 * XXXMLG
+	 * It seem that gss_verify_mic() modifies the signature buffer,
+	 * at least on Heimdal's implementation.  Copy it here to an allocated
+	 * buffer.
+	 */
+	buf = isc_mem_allocate(dst__memory_pool, sig->length);
+	if (buf == NULL)
+		return (ISC_R_FAILURE);
 	memmove(buf, sig->base, sig->length);
 	r.base = buf;
 	r.length = sig->length;
@@ -210,6 +219,8 @@ gssapi_verify(dst_context_t *dctx, const isc_region_t *sig) {
 	 */
 	gret = gss_verify_mic(&minor, gssctx, &gmessage, &gsig, NULL);
 
+	isc_mem_free(dst__memory_pool, buf);
+
 	/*
 	 * Convert return codes into something useful to us.
 	 */

lib/dns/include/dns/dispatch.h

@@ -140,6 +140,7 @@ struct dns_dispatchset {
 #define DNS_DISPATCHATTR_CONNECTED	0x00000080U
 #define DNS_DISPATCHATTR_FIXEDID	0x00000100U
 #define DNS_DISPATCHATTR_EXCLUSIVE	0x00000200U
+#define DNS_DISPATCHATTR_CANREUSE	0x00000400U
 /*@}*/
 
 /*

lib/dns/include/dns/keyvalues.h

@@ -90,6 +90,12 @@
 #define DNS_SIG_RSAMINSIZE	((DNS_SIG_RSAMINBITS+7)/8)
 #define DNS_SIG_RSAMAXSIZE	((DNS_SIG_RSAMAXBITS+7)/8)
 
+#define DNS_SIG_DSASIGSIZE	41
+#define DNS_SIG_DSAMINBITS	512
+#define DNS_SIG_DSAMAXBITS	1024
+#define DNS_SIG_DSAMINBYTES	213
+#define DNS_SIG_DSAMAXBYTES	405
+
 #define DNS_SIG_ECDSA256SIZE	64
 #define DNS_SIG_ECDSA384SIZE	96
 

lib/dns/include/dns/zone.h

@@ -38,7 +38,6 @@ typedef enum {
 	dns_zone_none,
 	dns_zone_master,
 	dns_zone_slave,
-	dns_zone_mirror,
 	dns_zone_stub,
 	dns_zone_staticstub,
 	dns_zone_key,
@@ -83,6 +82,7 @@ typedef enum {
 	DNS_ZONEOPT_CHECKSPF         = 1<<27, /*%< check SPF records */
 	DNS_ZONEOPT_CHECKTTL         = 1<<28, /*%< check max-zone-ttl */
 	DNS_ZONEOPT_AUTOEMPTY        = 1<<29, /*%< automatic empty zone */
+	DNS_ZONEOPT_MIRROR           = 1<<30, /*%< mirror zone */
 } dns_zoneopt_t;
 
 /*
@@ -2485,6 +2485,12 @@ dns_zone_isloaded(const dns_zone_t *zone);
  * false otherwise.
  */
 
+bool
+dns_zone_ismirror(const dns_zone_t *zone);
+/*%<
+ * Return true if 'zone' is a mirror zone, return false otherwise.
+ */
+
 isc_result_t
 dns_zone_verifydb(dns_zone_t *zone, dns_db_t *db, dns_dbversion_t *ver);
 /*%<

lib/dns/nsec.c

@@ -274,7 +274,9 @@ dns_nsec_nseconly(dns_db_t *db, dns_dbversion_t *version,
 		RUNTIME_CHECK(result == ISC_R_SUCCESS);
 
 		if (dnskey.algorithm == DST_ALG_RSAMD5 ||
-		    dnskey.algorithm == DST_ALG_RSASHA1)
+		    dnskey.algorithm == DST_ALG_RSASHA1 ||
+		    dnskey.algorithm == DST_ALG_DSA ||
+		    dnskey.algorithm == DST_ALG_ECC)
 			break;
 	}
 	dns_rdataset_disassociate(&rdataset);

lib/dns/nsec3.c

@@ -20,7 +20,6 @@
 #include <isc/hex.h>
 #include <isc/iterated_hash.h>
 #include <isc/log.h>
-#include <isc/md.h>
 #include <isc/string.h>
 #include <isc/util.h>
 #include <isc/safe.h>

lib/dns/openssl_link.c

@@ -40,8 +40,6 @@
 #include "dst_internal.h"
 #include "dst_openssl.h"
 
-static isc_mem_t *dst__mctx = NULL;
-
 #if !defined(OPENSSL_NO_ENGINE)
 #include <openssl/engine.h>
 #endif
@@ -91,6 +89,63 @@ id_callback(void) {
 }
 #endif
 
+#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER)
+
+#define FLARG
+#define FILELINE
+#if ISC_MEM_TRACKLINES
+#define FLARG_PASS      , __FILE__, __LINE__
+#else
+#define FLARG_PASS
+#endif
+
+#else
+
+#define FLARG           , const char *file, int line
+#define FILELINE	, __FILE__, __LINE__
+#if ISC_MEM_TRACKLINES
+#define FLARG_PASS      , file, line
+#else
+#define FLARG_PASS
+#endif
+
+#endif
+
+static void *
+mem_alloc(size_t size FLARG) {
+#ifdef OPENSSL_LEAKS
+	void *ptr;
+
+	INSIST(dst__memory_pool != NULL);
+	ptr = isc__mem_allocate(dst__memory_pool, size FLARG_PASS);
+	return (ptr);
+#else
+	INSIST(dst__memory_pool != NULL);
+	return (isc__mem_allocate(dst__memory_pool, size FLARG_PASS));
+#endif
+}
+
+static void
+mem_free(void *ptr FLARG) {
+	INSIST(dst__memory_pool != NULL);
+	if (ptr != NULL)
+		isc__mem_free(dst__memory_pool, ptr FLARG_PASS);
+}
+
+static void *
+mem_realloc(void *ptr, size_t size FLARG) {
+#ifdef OPENSSL_LEAKS
+	void *rptr;
+
+	INSIST(dst__memory_pool != NULL);
+	rptr = isc__mem_reallocate(dst__memory_pool, ptr, size FLARG_PASS);
+	return (rptr);
+#else
+	INSIST(dst__memory_pool != NULL);
+	return (isc__mem_reallocate(dst__memory_pool, ptr, size FLARG_PASS));
+#endif
+}
+
 #if OPENSSL_VERSION_NUMBER < 0x10100000L
 static void
 _set_thread_id(CRYPTO_THREADID *id)
@@ -100,21 +155,24 @@ _set_thread_id(CRYPTO_THREADID *id)
 #endif
 
 isc_result_t
-dst__openssl_init(isc_mem_t *mctx, const char *engine) {
+dst__openssl_init(const char *engine) {
 	isc_result_t result;
 
-	REQUIRE(dst__mctx == NULL);
-	isc_mem_attach(mctx, &dst__mctx);
-
 #if defined(OPENSSL_NO_ENGINE)
 	UNUSED(engine);
 #endif
 
 	enable_fips_mode();
 
+#ifdef  DNS_CRYPTO_LEAKS
+	CRYPTO_malloc_debug_init();
+	CRYPTO_set_mem_debug_options(V_CRYPTO_MDEBUG_ALL);
+	CRYPTO_mem_ctrl(CRYPTO_MEM_CHECK_ON);
+#endif
+	CRYPTO_set_mem_functions(mem_alloc, mem_realloc, mem_free);
 #if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER)
 	nlocks = CRYPTO_num_locks();
-	locks = isc_mem_allocate(dst__mctx, sizeof(isc_mutex_t) * nlocks);
+	locks = mem_alloc(sizeof(isc_mutex_t) * nlocks FILELINE);
 	if (locks == NULL)
 		return (ISC_R_NOMEMORY);
 	result = isc_mutexblock_init(locks, nlocks);
@@ -183,7 +241,7 @@ dst__openssl_init(isc_mem_t *mctx, const char *engine) {
 	CRYPTO_set_locking_callback(NULL);
 	DESTROYMUTEXBLOCK(locks, nlocks);
  cleanup_mutexalloc:
-	isc_mem_free(dst__mctx, locks);
+	mem_free(locks FILELINE);
 	locks = NULL;
 #endif
 	return (result);
@@ -220,13 +278,12 @@ dst__openssl_destroy(void) {
 	if (locks != NULL) {
 		CRYPTO_set_locking_callback(NULL);
 		DESTROYMUTEXBLOCK(locks, nlocks);
-		isc_mem_free(dst__mctx, locks);
+		mem_free(locks FILELINE);
 		locks = NULL;
 	}
 #else
 	OPENSSL_cleanup();
 #endif
-	isc_mem_detach(&dst__mctx);
 }
 
 static isc_result_t

lib/dns/opensslecdsa_link.c

@@ -19,6 +19,7 @@
 
 #include <isc/mem.h>
 #include <isc/safe.h>
+#include <isc/sha2.h>
 #include <isc/string.h>
 #include <isc/util.h>
 

lib/dns/openssleddsa_link.c

@@ -19,6 +19,7 @@
 
 #include <isc/mem.h>
 #include <isc/safe.h>
+#include <isc/sha2.h>
 #include <isc/result.h>
 #include <isc/string.h>
 #include <isc/util.h>

lib/dns/opensslrsa_link.c

@@ -16,8 +16,11 @@
 #include <inttypes.h>
 #include <stdbool.h>
 
+#include <isc/md5.h>
 #include <isc/mem.h>
 #include <isc/safe.h>
+#include <isc/sha1.h>
+#include <isc/sha2.h>
 #include <isc/string.h>
 #include <isc/util.h>
 

lib/dns/pkcs11ecdsa_link.c

@@ -19,6 +19,7 @@
 
 #include <isc/mem.h>
 #include <isc/safe.h>
+#include <isc/sha2.h>
 #include <isc/string.h>
 #include <isc/util.h>
 

lib/dns/pkcs11eddsa_link.c

@@ -20,6 +20,7 @@
 
 #include <isc/mem.h>
 #include <isc/safe.h>
+#include <isc/sha2.h>
 #include <isc/string.h>
 #include <isc/util.h>
 

lib/dns/pkcs11rsa_link.c

@@ -18,6 +18,9 @@
 #include <inttypes.h>
 #include <stdbool.h>
 
+#include <isc/md5.h>
+#include <isc/sha1.h>
+#include <isc/sha2.h>
 #include <isc/mem.h>
 #include <isc/safe.h>
 #include <isc/string.h>

lib/dns/rcode.c

@@ -108,9 +108,8 @@
 	{ DNS_KEYALG_RSAMD5, "RSAMD5", 0 }, \
 	{ DNS_KEYALG_RSAMD5, "RSA", 0 }, \
 	{ DNS_KEYALG_DH, "DH", 0 }, \
-	{ DNS_KEYALG_DSA, "DSA", 0 }, \
+	{ DNS_KEYALG_ECC, "ECC", 0 }, \
 	{ DNS_KEYALG_RSASHA1, "RSASHA1", 0 }, \
-	{ DNS_KEYALG_NSEC3DSA, "NSEC3DSA", 0 }, \
 	{ DNS_KEYALG_NSEC3RSASHA1, "NSEC3RSASHA1", 0 }, \
 	{ DNS_KEYALG_RSASHA256, "RSASHA256", 0 }, \
 	{ DNS_KEYALG_RSASHA512, "RSASHA512", 0 }, \