Bump the maximum TCP timeout to 65535 [RT #44710 ]

[master] check new-zones-directory
4789. [cleanup] Check writability of new-zones-directory. [RT #46308]
2017-10-25 14:15:04 +04:00 · 2017-10-25 01:19:46 -07:00 · 2017-10-25 00:58:11 -07:00 · 2017-10-25 09:46:18 +02:00 · 2017-10-25 00:33:51 -07:00 · 2017-10-25 15:02:36 +11:00
66 changed files with 1069 additions and 473 deletions
@@ -1,3 +1,52 @@
+4789.	[cleanup]	Check writability of new-zones-directory. [RT #46308]
+
+4788.	[cleanup]	When using "update-policy local", log a warning
+			when an update matching the session key is received
+			from a remote host. [RT #46213]
+
+4787.	[cleanup]	Turn nsec3param_salt_totext() into a public function,
+			dns_nsec3param_salttotext(), and add unit tests for it.
+			[RT #46289]
+
+4786.	[func]		The "filter-aaaa-on-v4" and "filter-aaaa-on-v6"
+			options are no longer conditionally compiled.
+			[RT #46340]
+
+4785.	[func]		The hmac-md5 algorithm is no longer recommended for
+			use with RNDC keys. For compatibility reasons, it
+			it is still the default algorithm in rndc-confgen,
+			but this will be changed to hmac-sha256 in a future
+			release. [RT #42272]
+
+4784.	[func]		The use of dnssec-keygen to generate HMAC keys is
+			deprecated in favor of tsig-keygen.  dnssec-keygen
+			will print a warning when used for this purpose.
+			All HMAC algorithms will be removed from
+			dnssec-keygen in a future release. [RT #42272]
+
+4783.	[test]		dnssec: 'check that NOTIFY is sent at the end of
+			NSEC3 chain generation failed' required more time
+			on some machines for the IXFR to complete. [RT #46388]
+
+4782.	[test]		dnssec: 'checking positive and negative validation
+			with negative trust anchors' required more time to
+			complete on some machines. [RT #46386]
+
+4781.	[maint]		B.ROOT-SERVERS.NET is now 199.9.14.201. [RT #45889]
+
+4780.	[bug]		When answering ANY queries, don't include the NS
+			RRset in the authority section if it was already
+			in the answer section. [RT #44543]
+
+4779.	[bug]		Expire NTA at the start of the second. Don't update
+			the expiry value if the record has already expired
+			after a successful check. [RT #46368]
+
+4778.	[test]		Improve synth-from-dnssec testing. [RT #46352]
+
+4777.	[cleanup]	Removed a redundant call to configure_view_acl().
+			[RT #46369]
+
 4776.	[bug]		Improve portability of ht_test. [RT #46333]

 4775.	[bug]		Address Coverity warnings in ht_test.c and mem_test.c
@@ -1,4 +1,4 @@
-.\" Copyright (C) 2001, 2003-2005, 2007, 2009, 2013-2016 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2001, 2003-2005, 2007, 2009, 2013-2017 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" This Source Code Form is subject to the terms of the Mozilla Public
 .\" License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -111,7 +111,9 @@ as directed\&.
 .PP
 \-A \fIalgorithm\fR
 .RS 4
-Specifies the algorithm to use for the TSIG key\&. Available choices are: hmac\-md5, hmac\-sha1, hmac\-sha224, hmac\-sha256, hmac\-sha384 and hmac\-sha512\&. The default is hmac\-md5 or if MD5 was disabled hmac\-sha256\&.
+Specifies the algorithm to use for the TSIG key\&. Available choices are: hmac\-md5, hmac\-sha1, hmac\-sha224, hmac\-sha256, hmac\-sha384 and hmac\-sha512\&. The default is hmac\-md5, or if MD5 was disabled at compile time, hmac\-sha256\&.
+.sp
+Note: Use of hmac\-md5 is no longer recommended, and the default value will be changed to hmac\-sha256 in a future release\&.
 .RE
 .PP
 \-b \fIkeysize\fR
@@ -217,5 +219,5 @@ BIND 9 Administrator Reference Manual\&.
 \fBInternet Systems Consortium, Inc\&.\fR
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2001, 2003-2005, 2007, 2009, 2013-2016 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2001, 2003-2005, 2007, 2009, 2013-2017 Internet Systems Consortium, Inc. ("ISC")
 .br
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2001, 2003-2005, 2007-2009, 2011, 2013, 2014, 2016  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2001, 2003-2005, 2007-2009, 2011, 2013, 2014, 2016, 2017  Internet Systems Consortium, Inc. ("ISC")
 *
 * This Source Code Form is subject to the terms of the Mozilla Public
 * License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -73,7 +73,7 @@ Usage:\n\
 %s [-a] [-b bits] [-c keyfile] [-k keyname] [-p port] [-r randomfile] \
 [-s addr] [-t chrootdir] [-u user]\n\
  -a:		 generate just the key clause and write it to keyfile (%s)\n\
-  -A alg:	 algorithm (default hmac-md5)\n\
+  -A alg:	 algorithm (default hmac-md5 (deprecated and will change))\n\
  -b bits:	 from 1 through 512, default 256; total length of the secret\n\
  -c keyfile:	 specify an alternate key file (requires -a)\n\
  -k keyname:	 the name as it will be used  in named.conf and rndc.conf\n\
@@ -115,6 +115,7 @@ main(int argc, char **argv) {
 	const char *randomfile = NULL;
 	const char *serveraddr = NULL;
 	dns_secalg_t alg;
+	isc_boolean_t algset = ISC_FALSE;
 	const char *algname;
 	char *p;
 	int ch;
@@ -153,6 +154,7 @@ main(int argc, char **argv) {
 			keyonly = ISC_TRUE;
 			break;
 		case 'A':
+			algset = ISC_TRUE;
 			algname = isc_commandline_argument;
 			alg = alg_fromtext(algname);
 			if (alg == DST_ALG_UNKNOWN)
@@ -225,6 +227,20 @@ main(int argc, char **argv) {
 	if (argc > 0)
 		usage(1);

+	if (alg == DST_ALG_HMACMD5) {
+		if (algset) {
+			fprintf(stderr,
+				"warning: use of hmac-md5 for RNDC keys "
+				"is deprecated; hmac-sha256 is now "
+				"recommended.\n");
+		} else {
+			fprintf(stderr,
+				"warning: the default algorithm hmac-md5 "
+				"is deprecated and will be\n"
+				"changed to hmac-sha256 in a future release\n");
+		}
+	}
+
 	if (keysize < 0)
 		keysize = alg_bits(alg);
 	algname = alg_totext(alg);
@@ -1,5 +1,5 @@
 <!--
- - Copyright (C) 2001, 2003-2005, 2007, 2009, 2013-2016  Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2001, 2003-2005, 2007, 2009, 2013-2017  Internet Systems Consortium, Inc. ("ISC")
 -
 - This Source Code Form is subject to the terms of the Mozilla Public
 - License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -39,6 +39,7 @@
      <year>2014</year>
      <year>2015</year>
      <year>2016</year>
+      <year>2017</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
  </docinfo>
@@ -128,8 +129,12 @@
          <para>
            Specifies the algorithm to use for the TSIG key.  Available
            choices are: hmac-md5, hmac-sha1, hmac-sha224, hmac-sha256,
-            hmac-sha384 and hmac-sha512.  The default is hmac-md5 or
-            if MD5 was disabled hmac-sha256.
+            hmac-sha384 and hmac-sha512.  The default is hmac-md5, or
+            if MD5 was disabled at compile time, hmac-sha256.
+          </para>
+          <para>
+            Note: Use of hmac-md5 is no longer recommended, and the default
+            value will be changed to hmac-sha256 in a future release.
          </para>
        </listitem>
      </varlistentry>
@@ -1,6 +1,6 @@
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2001, 2003-2005, 2007, 2009, 2013-2016 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2001, 2003-2005, 2007, 2009, 2013-2017 Internet Systems Consortium, Inc. ("ISC")
 - 
 - This Source Code Form is subject to the terms of the Mozilla Public
 - License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -113,8 +113,12 @@
          <p>
            Specifies the algorithm to use for the TSIG key.  Available
            choices are: hmac-md5, hmac-sha1, hmac-sha224, hmac-sha256,
-            hmac-sha384 and hmac-sha512.  The default is hmac-md5 or
-            if MD5 was disabled hmac-sha256.
+            hmac-sha384 and hmac-sha512.  The default is hmac-md5, or
+            if MD5 was disabled at compile time, hmac-sha256.
+          </p>
+          <p>
+            Note: Use of hmac-md5 is no longer recommended, and the default
+            value will be changed to hmac-sha256 in a future release.
          </p>
        </dd>
 <dt><span class="term">-b <em class="replaceable"><code>keysize</code></em></span></dt>
@@ -62,12 +62,15 @@ may be preferable to direct use of
 .RS 4
 Selects the cryptographic algorithm\&. For DNSSEC keys, the value of
 \fBalgorithm\fR
-must be one of RSAMD5, RSASHA1, DSA, NSEC3RSASHA1, NSEC3DSA, RSASHA256, RSASHA512, ECCGOST, ECDSAP256SHA256, ECDSAP384SHA384, ED25519 or ED448\&. For TSIG/TKEY keys, the value must be one of DH (Diffie Hellman), HMAC\-MD5, HMAC\-SHA1, HMAC\-SHA224, HMAC\-SHA256, HMAC\-SHA384, or HMAC\-SHA512; specifying any of these algorithms will automatically set the
+must be one of RSAMD5, RSASHA1, DSA, NSEC3RSASHA1, NSEC3DSA, RSASHA256, RSASHA512, ECCGOST, ECDSAP256SHA256, ECDSAP384SHA384, ED25519 or ED448\&. For TKEY and SIG(0) keys, the value must be DH (Diffie Hellman); specifying this value will automatically set the
 \fB\-T KEY\fR
-option as well\&. (Note:
+option as well\&.
+.sp
+TSIG keys can also by generated by setting the value to one of HMAC\-MD5, HMAC\-SHA1, HMAC\-SHA224, HMAC\-SHA256, HMAC\-SHA384, or HMAC\-SHA512\&. As with DH, specifying these values will automatically set
+\fB\-T KEY\fR\&. Note, however, that
 \fBtsig\-keygen\fR
-produces TSIG keys in a more useful format than
-\fBdnssec\-keygen\fR\&.)
+produces TSIG keys in a more useful format\&. These algorithms have been deprecated in
+\fBdnssec\-keygen\fR, and will be removed in a future release\&.
 .sp
 These values are case insensitive\&. In some cases, abbreviations are supported, such as ECDSA256 for ECDSAP256SHA256 and ECDSA384 for ECDSAP384SHA384\&. If RSASHA1 or DSA is specified along with the
 \fB\-3\fR
@@ -75,7 +78,7 @@ option, then NSEC3RSASHA1 or NSEC3DSA will be used instead\&.
 .sp
 As of BIND 9\&.12\&.0, this option is mandatory except when using the
 \fB\-S\fR
-option (which copies the algorithm from the predecessor key)\&. Previously, the default for newly generated keys was RSASHA1\&.
+option, which copies the algorithm from the predecessor key\&. Previously, the default for newly generated keys was RSASHA1\&.
 .RE
 .PP
 \-b \fIkeysize\fR
@@ -582,6 +582,16 @@ main(int argc, char **argv) {
 		INSIST((alg != DNS_KEYALG_RSAMD5) && (alg != DST_ALG_HMACMD5));
 #endif

+
+		if (alg == DST_ALG_HMACMD5 || alg == DST_ALG_HMACSHA1 ||
+		    alg == DST_ALG_HMACSHA224 || alg == DST_ALG_HMACSHA256 ||
+		    alg == DST_ALG_HMACSHA384 || alg == DST_ALG_HMACSHA512)
+		{
+			fprintf(stderr,
+				"Use of dnssec-keygen for HMAC keys is "
+				"deprecated: use tsig-keygen\n");
+		}
+
 		if (!dst_algorithm_supported(alg))
 			fatal("unsupported algorithm: %d", alg);

@@ -122,12 +122,19 @@
 	    of <option>algorithm</option> must be one of RSAMD5, RSASHA1,
 	    DSA, NSEC3RSASHA1, NSEC3DSA, RSASHA256, RSASHA512, ECCGOST,
 	    ECDSAP256SHA256, ECDSAP384SHA384, ED25519 or ED448.  For
-            TSIG/TKEY keys, the value must be one of DH (Diffie Hellman),
-            HMAC-MD5, HMAC-SHA1, HMAC-SHA224, HMAC-SHA256, HMAC-SHA384,
-            or HMAC-SHA512; specifying any of these algorithms will
-            automatically set the <option>-T KEY</option> option as well.
-            (Note: <command>tsig-keygen</command> produces TSIG keys in a
-            more useful format than <command>dnssec-keygen</command>.)
+	    TKEY and SIG(0) keys, the value must be DH (Diffie Hellman);
+	    specifying this value will automatically set the
+	    <option>-T KEY</option> option as well.
+	  </para>
+	  <para>
+	    TSIG keys can also by generated by setting the value to
+	    one of HMAC-MD5, HMAC-SHA1, HMAC-SHA224, HMAC-SHA256,
+	    HMAC-SHA384, or HMAC-SHA512.  As with DH, specifying these
+	    values will automatically set <option>-T KEY</option>. Note,
+	    however, that <command>tsig-keygen</command> produces TSIG keys
+	    in a more useful format. These algorithms have been deprecated
+	    in <command>dnssec-keygen</command>, and will be removed in a
+	    future release.
 	  </para>
 	  <para>
 	    These values are case insensitive. In some cases, abbreviations
@@ -138,8 +145,8 @@
 	  </para>
 	  <para>
 	    As of BIND 9.12.0, this option is mandatory except when using
-	    the <option>-S</option> option (which copies the algorithm from
-	    the predecessor key).  Previously, the default for newly
+	    the <option>-S</option> option, which copies the algorithm from
+	    the predecessor key.  Previously, the default for newly
 	    generated keys was RSASHA1.
 	  </para>
 	</listitem>
@@ -103,12 +103,19 @@
 	    of <code class="option">algorithm</code> must be one of RSAMD5, RSASHA1,
 	    DSA, NSEC3RSASHA1, NSEC3DSA, RSASHA256, RSASHA512, ECCGOST,
 	    ECDSAP256SHA256, ECDSAP384SHA384, ED25519 or ED448.  For
-            TSIG/TKEY keys, the value must be one of DH (Diffie Hellman),
-            HMAC-MD5, HMAC-SHA1, HMAC-SHA224, HMAC-SHA256, HMAC-SHA384,
-            or HMAC-SHA512; specifying any of these algorithms will
-            automatically set the <code class="option">-T KEY</code> option as well.
-            (Note: <span class="command"><strong>tsig-keygen</strong></span> produces TSIG keys in a
-            more useful format than <span class="command"><strong>dnssec-keygen</strong></span>.)
+	    TKEY and SIG(0) keys, the value must be DH (Diffie Hellman);
+	    specifying this value will automatically set the
+	    <code class="option">-T KEY</code> option as well.
+	  </p>
+	  <p>
+	    TSIG keys can also by generated by setting the value to
+	    one of HMAC-MD5, HMAC-SHA1, HMAC-SHA224, HMAC-SHA256,
+	    HMAC-SHA384, or HMAC-SHA512.  As with DH, specifying these
+	    values will automatically set <code class="option">-T KEY</code>. Note,
+	    however, that <span class="command"><strong>tsig-keygen</strong></span> produces TSIG keys
+	    in a more useful format. These algorithms have been deprecated
+	    in <span class="command"><strong>dnssec-keygen</strong></span>, and will be removed in a
+	    future release.
 	  </p>
 	  <p>
 	    These values are case insensitive. In some cases, abbreviations
@@ -119,8 +126,8 @@
 	  </p>
 	  <p>
 	    As of BIND 9.12.0, this option is mandatory except when using
-	    the <code class="option">-S</code> option (which copies the algorithm from
-	    the predecessor key).  Previously, the default for newly
+	    the <code class="option">-S</code> option, which copies the algorithm from
+	    the predecessor key.  Previously, the default for newly
 	    generated keys was RSASHA1.
 	  </p>
 	</dd>
@@ -156,12 +156,10 @@ options {\n\
 #	fetch-glue <obsolete>;\n\
 	fetch-quota-params 100 0.1 0.3 0.7;\n\
 	fetches-per-server 0;\n\
-	fetches-per-zone 0;\n"
-#ifdef ALLOW_FILTER_AAAA
-"	filter-aaaa-on-v4 no;\n\
+	fetches-per-zone 0;\n\
+	filter-aaaa-on-v4 no;\n\
 	filter-aaaa-on-v6 no;\n\
 	filter-aaaa { any; };\n"
-#endif
 #ifdef HAVE_GEOIP
 "	geoip-use-ecs yes;\n"
 #endif
@@ -160,6 +160,8 @@
 #define DIR_PERM_OK W_OK|X_OK
 #endif

+#define MAX_TCP_TIMEOUT 65535
+
 /*%
 * Check an operation for failure.  Assumes that the function
 * using it has a 'result' variable and a 'cleanup' label.
@@ -4681,20 +4683,19 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
 	 * "allow-recursion" inherits from "allow-query-cache" if set,
 	 * otherwise from "allow-query" if set.
 	 */
-	if (view->cacheacl == NULL && view->recursionacl != NULL)
+	if (view->cacheacl == NULL && view->recursionacl != NULL) {
 		dns_acl_attach(view->recursionacl, &view->cacheacl);
-	/*
-	 * XXXEACH: This call to configure_view_acl() is redundant.  We
-	 * are leaving it as it is because we are making a minimal change
-	 * for a patch release.  In the future this should be changed to
-	 * dns_acl_attach(view->queryacl, &view->cacheacl).
-	 */
-	if (view->cacheacl == NULL && view->recursion)
-		CHECK(configure_view_acl(vconfig, config, "allow-query", NULL,
-					 actx, named_g_mctx, &view->cacheacl));
+	}
+
+	if (view->cacheacl == NULL && view->recursion) {
+		dns_acl_attach(view->queryacl, &view->cacheacl);
+	}
+
 	if (view->recursion &&
 	    view->recursionacl == NULL && view->cacheacl != NULL)
+	{
 		dns_acl_attach(view->cacheacl, &view->recursionacl);
+	}

 	/*
 	 * Set default "allow-recursion", "allow-recursion-on" and
@@ -4875,7 +4876,6 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
 					      dns_quotatype_zone, r);
 	}

-#ifdef ALLOW_FILTER_AAAA
 	obj = NULL;
 	result = named_config_get(maps, "filter-aaaa-on-v4", &obj);
 	INSIST(result == ISC_R_SUCCESS);
@@ -4910,7 +4910,7 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,

 	CHECK(configure_view_acl(vconfig, config, "filter-aaaa", NULL,
 				 actx, named_g_mctx, &view->aaaa_acl));
-#endif
+
 	obj = NULL;
 	result = named_config_get(maps, "prefetch", &obj);
 	if (result == ISC_R_SUCCESS) {
@@ -7053,6 +7053,13 @@ setup_newzones(dns_view_t *view, cfg_obj_t *config, cfg_obj_t *vconfig,
 				      dir, isc_result_totext(result));
 			return (result);
 		}
+		if (access(dir, DIR_PERM_OK) != 0) {
+			isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+				      NAMED_LOGMODULE_SERVER, ISC_LOG_ERROR,
+				      "new-zones-directory '%s' "
+				      "is not writable", dir);
+			return (ISC_R_NOPERM);
+		}

 		dns_view_setnewzonedir(view, dir);
 	}
@@ -7881,11 +7888,11 @@ load_configuration(const char *filename, named_server_t *server,
 	result = named_config_get(maps, "tcp-keepalive-timeout", &obj);
 	INSIST(result == ISC_R_SUCCESS);
 	keepalive = cfg_obj_asuint32(obj);
-	if (keepalive > 1200) {
+	if (keepalive > MAX_TCP_TIMEOUT) {
 		cfg_obj_log(obj, named_g_lctx, ISC_LOG_WARNING,
 			    "tcp-keepalive-timeout value is out of range: "
-			    "lowering to 1200");
-		keepalive = 1200;
+			    "lowering to %u", MAX_TCP_TIMEOUT);
+		keepalive = MAX_TCP_TIMEOUT;
 	} else if (keepalive < 1) {
 		cfg_obj_log(obj, named_g_lctx, ISC_LOG_WARNING,
 			    "tcp-keepalive-timeout value is out of range: "
@@ -7897,11 +7904,11 @@ load_configuration(const char *filename, named_server_t *server,
 	result = named_config_get(maps, "tcp-advertised-timeout", &obj);
 	INSIST(result == ISC_R_SUCCESS);
 	advertised = cfg_obj_asuint32(obj);
-	if (advertised > 1200) {
+	if (advertised > MAX_TCP_TIMEOUT) {
 		cfg_obj_log(obj, named_g_lctx, ISC_LOG_WARNING,
 			    "tcp-advertized-timeout value is out of range: "
-			    "lowering to 1200");
-		advertised = 1200;
+			    "lowering to %u", MAX_TCP_TIMEOUT);
+		advertised = MAX_TCP_TIMEOUT;
 	}

 	ns_server_settimeouts(named_g_server->sctx,
@@ -14695,7 +14702,7 @@ named_server_tcptimeouts(isc_lex_t *lex, isc_buffer_t **text) {
 		if (ptr == NULL)
 			return (ISC_R_UNEXPECTEDEND);
 		CHECK(isc_parse_uint32(&keepalive, ptr, 10));
-		if (keepalive > 1200)
+		if (keepalive > MAX_TCP_TIMEOUT)
 			CHECK(ISC_R_RANGE);
 		if (keepalive < 1)
 			CHECK(ISC_R_RANGE);
@@ -14704,7 +14711,7 @@ named_server_tcptimeouts(isc_lex_t *lex, isc_buffer_t **text) {
 		if (ptr == NULL)
 			return (ISC_R_UNEXPECTEDEND);
 		CHECK(isc_parse_uint32(&advertised, ptr, 10));
-		if (advertised > 1200)
+		if (advertised > MAX_TCP_TIMEOUT)
 			CHECK(ISC_R_RANGE);

 		result = isc_task_beginexclusive(named_g_server->task);
@@ -1,19 +1,17 @@
 #!/bin/sh
 #
-# Copyright (C) 2013, 2014, 2016  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2013, 2014, 2016, 2017  Internet Systems Consortium, Inc. ("ISC")
 #
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.

-# $Id: clean.sh,v 1.6 2007/09/26 03:22:44 marka Exp $
-
 #
 # Clean up after tests.
 #

 rm -f dig.out.*
 rm -f */named.memstats
-rm -f */named.conf
+rm -f ns1/named.conf
 rm -f */named.run
 rm -f ns*/named.lock
@@ -0,0 +1,25 @@
+/*
+ * Copyright (C) 2017  Internet Systems Consortium, Inc. ("ISC")
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ */
+
+controls { /* empty */ };
+
+options {
+	query-source address 10.53.0.3;
+	notify-source 10.53.0.3;
+	transfer-source 10.53.0.3;
+	port 5300;
+	pid-file "named.pid";
+	listen-on { 10.53.0.3; };
+	listen-on-v6 { none; };
+	recursion yes;
+};
+
+zone "." {
+	type hint;
+	file "root.hint";
+};
@@ -0,0 +1,8 @@
+; Copyright (C) 2017  Internet Systems Consortium, Inc. ("ISC")
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0. If a copy of the MPL was not distributed with this
+; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+. NS ns1.
+ns1. A 10.53.0.1
@@ -212,7 +212,7 @@ echo "I:testing with 'minimal-responses yes;'"
 minimal=yes
 dotests

-echo "I:reconfiguring server"
+echo "I:reconfiguring server: minimal-responses no"
 cp ns1/named2.conf ns1/named.conf
 $RNDC -c ../common/rndc.conf -s 10.53.0.1 -p 9953 reconfig 2>&1 | sed 's/^/I:ns1 /'
 sleep 2
@@ -230,7 +230,7 @@ if [ $ret -eq 1 ] ; then
    echo "I: failed"; status=1
 fi

-echo "I:reconfiguring server"
+echo "I:reconfiguring server: minimal-any yes"
 cp ns1/named3.conf ns1/named.conf
 $RNDC -c ../common/rndc.conf -s 10.53.0.1 -p 9953 reconfig 2>&1 | sed 's/^/I:ns1 /'
 sleep 2
@@ -266,7 +266,7 @@ echo "I:testing with 'minimal-responses no-auth;'"
 minimal=no-auth
 dotests

-echo "I:reconfiguring server"
+echo "I:reconfiguring server: minimal-responses no-auth-recursive"
 cp ns1/named4.conf ns1/named.conf
 $RNDC -c ../common/rndc.conf -s 10.53.0.1 -p 9953 reconfig 2>&1 | sed 's/^/I:ns1 /'
 sleep 2
@@ -297,5 +297,30 @@ if [ $ret -eq 1 ] ; then
    echo "I: failed"; status=1
 fi

+echo "I:reconfiguring server: minimal-responses no"
+cp ns1/named2.conf ns1/named.conf
+$RNDC -c ../common/rndc.conf -s 10.53.0.1 -p 9953 reconfig 2>&1 | sed 's/^/I:ns1 /'
+sleep 2
+
+n=`expr $n + 1`
+echo "I:testing NS handling in ANY responses (authoritative) ($n)"
+ret=0
+$DIG -t ANY rt.example @10.53.0.1 -p 5300 > dig.out.$n || ret=1
+grep "AUTHORITY: 0" dig.out.$n  > /dev/null || ret=1
+grep "NS[ 	]*ns" dig.out.$n  > /dev/null || ret=1
+if [ $ret -eq 1 ] ; then
+    echo "I: failed"; status=1
+fi
+
+n=`expr $n + 1`
+echo "I:testing NS handling in ANY responses (recursive) ($n)"
+ret=0
+$DIG -t ANY rt.example @10.53.0.3 -p 5300 > dig.out.$n || ret=1
+grep "AUTHORITY: 0" dig.out.$n  > /dev/null || ret=1
+grep "NS[ 	]*ns" dig.out.$n  > /dev/null || ret=1
+if [ $ret -eq 1 ] ; then
+    echo "I: failed"; status=1
+fi
+
 echo "I:exit status: $status"
 [ $status -eq 0 ] || exit 1
@@ -24,8 +24,8 @@ options {
 	dnssec-must-be-secure mustbesecure.example yes;
 	minimal-responses no;

-	nta-lifetime 10s;
-	nta-recheck 7s;
+	nta-lifetime 12s;
+	nta-recheck 9s;

 	# Note: We only reference the bind.keys file here to confirm that it
 	# is *not* being used.  It contains the real root key, and we're
@@ -1722,7 +1722,7 @@ echo "I: waiting for NTA rechecks/expirations"
 # fakenode.secure.example should both be lifted, but badds.example
 # should still be going.
 #
-$PERL -e 'my $delay =  '$start' + 8 - time(); select(undef, undef, undef, $delay) if ($delay > 0);'
+$PERL -e 'my $delay =  '$start' + 10 - time(); select(undef, undef, undef, $delay) if ($delay > 0);'
 $DIG $DIGOPTS b.secure.example. a @10.53.0.4 > dig.out.ns4.test$n.8 || ret=1
 grep "status: SERVFAIL" dig.out.ns4.test$n.8 > /dev/null && ret=1
 grep "flags:[^;]* ad[^;]*;" dig.out.ns4.test$n.8 > /dev/null || ret=1
@@ -1742,7 +1742,7 @@ ret=0
 # it should still be NTA'd, but badds.example used the default
 # lifetime of 10s, so it should revert to SERVFAIL now.
 #
-$PERL -e 'my $delay = '$start' + 11 - time(); select(undef, undef, undef, $delay) if ($delay > 0);'
+$PERL -e 'my $delay = '$start' + 13 - time(); select(undef, undef, undef, $delay) if ($delay > 0);'
 # check nta table
 $RNDC -c ../common/rndc.conf -s 10.53.0.4 -p 9953 nta -d > rndc.out.ns4.test$n._11
 lines=`grep " expiry " rndc.out.ns4.test$n._11 | wc -l`
@@ -2501,9 +2501,15 @@ do
 done;
 grep "ANSWER: 3," dig.out.ns2.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo "I:nsec3 chain generation not complete"; fi
-sleep 3
 $DIG $DIGOPTS +noauth +nodnssec soa nsec3chain-test @10.53.0.2 > dig.out.ns2.test$n || ret=1
-$DIG $DIGOPTS +noauth +nodnssec soa nsec3chain-test @10.53.0.3 > dig.out.ns3.test$n || ret=1
+s2=`awk '$4 == "SOA" { print $7}' dig.out.ns2.test$n`
+for i in 1 2 3 4 5 6 7 8 9 10
+do
+	$DIG $DIGOPTS +noauth +nodnssec soa nsec3chain-test @10.53.0.3 > dig.out.ns3.test$n || ret=1
+	s3=`awk '$4 == "SOA" { print $7}' dig.out.ns3.test$n`
+	test "$s2" = "$s3" && break
+	sleep 1
+done
 $PERL ../digcomp.pl dig.out.ns2.test$n dig.out.ns3.test$n || ret=1
 n=`expr $n + 1`
 if [ $ret != 0 ]; then echo "I:failed"; fi
@@ -36,7 +36,6 @@ usage() {
 	fprintf(stderr, "args:\n");
 	fprintf(stderr, "	--edns-version\n");
 	fprintf(stderr, "	--enable-dnsrps\n");
-	fprintf(stderr, "	--enable-filter-aaaa\n");
 	fprintf(stderr, "	--gethostname\n");
 	fprintf(stderr, "	--gssapi\n");
 	fprintf(stderr, "	--have-dlopen\n");
@@ -63,14 +62,6 @@ main(int argc, char **argv) {
 #endif
 	}

-	if (strcmp(argv[1], "--enable-filter-aaaa") == 0) {
-#ifdef ALLOW_FILTER_AAAA
-		return (0);
-#else
-		return (1);
-#endif
-	}
-
 	if (strcmp(argv[1], "--edns-version") == 0) {
 #ifdef DNS_EDNS_VERSION
 		printf("%d\n", DNS_EDNS_VERSION);
@@ -1,16 +0,0 @@
-#!/bin/sh
-#
-# Copyright (C) 2010, 2012, 2014, 2016  Internet Systems Consortium, Inc. ("ISC")
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, You can obtain one at http://mozilla.org/MPL/2.0/.
-
-SYSTEMTESTTOP=..
-. $SYSTEMTESTTOP/conf.sh
-
-$FEATURETEST --enable-filter-aaaa || {
-    echo "I:This test requires --enable-filter-aaaa at compile time." >&2
-    exit 255
-}
-exit 0
@@ -486,6 +486,7 @@ fi
 n=`expr $n + 1`
 ret=0
 echo "I:check that 'update-policy local' fails from non-localhost address ($n)"
+grep 'match on session key not from localhost' ns5/named.run > /dev/null && ret=1
 $NSUPDATE -p 5300 -k ns5/session.key > nsupdate.out.$n 2>&1 << END && ret=1
 server 10.53.0.5 5300
 local 10.53.0.1
@@ -493,6 +494,7 @@ update add nonlocal.local.nil. 600 A 4.3.2.1
 send
 END
 grep REFUSED nsupdate.out.$n > /dev/null 2>&1 || ret=1
+grep 'match on session key not from localhost' ns5/named.run > /dev/null || ret=1
 $DIG @10.53.0.5 -p 5300 \
        +tcp +noadd +nosea +nostat +noquest +nocomm +nocmd \
        nonlocal.local.nil. > dig.out.ns5.$n || ret=1
@@ -100,26 +100,27 @@ $PERL stop.pl $test
 status=`expr $status + $?`

 if [ $status != 0 ]; then
-	echofail "R:FAIL"
-	# Don't clean up - we need the evidence.
-	find . -name core -exec chmod 0644 '{}' \;
+    echofail "R:FAIL"
+    # Don't clean up - we need the evidence.
+    find . -name core -exec chmod 0644 '{}' \;
 else
-	echopass "R:PASS"
+    echopass "R:PASS"

-	if $clean
+    if $clean
+    then
+	rm -f $SYSTEMTESTTOP/random.data
+	if test -f $test/clean.sh
 	then
-		rm -f $SYSTEMTESTTOP/random.data
-		if test -f $test/clean.sh
-		then
-			( cd $test && $SHELL clean.sh "$@" )
-		fi
-		if test -d ../../../.git
-		then
-			git status -su $test |
-			sed -n 's/^?? \(.*\)/I:file \1 not removed/p'
-		fi
-
+	    ( cd $test && $SHELL clean.sh "$@" )
 	fi
+	if test -d ../../../.git
+	then
+	    git status -su --ignored $test |
+	    sed -n -e 's|^?? \(.*\)|I:file \1 not removed|p' \
+		-e 's|^!! \(.*/named.run\)$|I:file \1 not removed|p' \
+		-e 's|^!! \(.*/named.memstats\)$|I:file \1 not removed|p'
+	fi
+    fi
 fi

 echoinfo "E:$test:`date`"
@@ -0,0 +1,16 @@
+/*
+ * Copyright (C) 2017  Internet Systems Consortium, Inc. ("ISC")
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ */
+
+options {
+	new-zones-directory "./nope";
+	port 5300;
+	pid-file "../named.pid";
+	listen-on { 127.0.0.1; };
+	listen-on-v6 { none; };
+	recursion no;
+};
@@ -73,6 +73,17 @@ grep "managed-keys-directory './nope' is not writable" ns2/named.run > /dev/null
 if [ $ret != 0 ]; then echo "I:failed"; fi
 status=`expr $status + $ret`

+n=`expr $n + 1`
+echo "I: checking that named refuses to reconfigure if new-zones-directory is not writable ($n)"
+ret=0
+cp -f ns2/named-alt6.conf ns2/named.conf
+$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 reconfig > rndc.out.$n 2>&1
+grep "failed: permission denied" rndc.out.$n > /dev/null 2>&1 || ret=1
+sleep 1
+grep "new-zones-directory './nope' is not writable" ns2/named.run > /dev/null 2>&1 || ret=1
+if [ $ret != 0 ]; then echo "I:failed"; fi
+status=`expr $status + $ret`
+
 n=`expr $n + 1`
 echo "I: checking that named refuses to start if working directory is not writable ($n)"
 ret=0
@@ -4,6 +4,8 @@
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.

+rm -f */named.memstats
+rm -f */named.run
 rm -f dig.out.*
 rm -f ns1/K*+*+*.key
 rm -f ns1/K*+*+*.private
@@ -0,0 +1,34 @@
+/*
+ * Copyright (C) 2017  Internet Systems Consortium, Inc. ("ISC")
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ */
+
+// NS4
+
+controls { /* empty */ };
+
+options {
+	query-source address 10.53.0.4;
+	notify-source 10.53.0.4;
+	transfer-source 10.53.0.4;
+	port 5300;
+	pid-file "named.pid";
+	listen-on { 10.53.0.4; };
+	listen-on-v6 { none; };
+	recursion yes;
+	notify no;
+	dnssec-enable yes;
+	dnssec-validation yes;
+	synth-from-dnssec no;
+};
+
+zone "." {
+	type hint;
+	file "root.hints";
+};
+
+include "../ns1/trusted.conf";
+// include "../../common/controls.conf";
@@ -0,0 +1,8 @@
+; Copyright (C) 2017  Internet Systems Consortium, Inc. ("ISC")
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0. If a copy of the MPL was not distributed with this
+; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+.	NS	ns1
+ns1	A	10.53.0.1
@@ -0,0 +1,33 @@
+/*
+ * Copyright (C) 2017  Internet Systems Consortium, Inc. ("ISC")
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ */
+
+// NS5
+
+controls { /* empty */ };
+
+options {
+	query-source address 10.53.0.5;
+	notify-source 10.53.0.5;
+	transfer-source 10.53.0.5;
+	port 5300;
+	pid-file "named.pid";
+	listen-on { 10.53.0.5; };
+	listen-on-v6 { none; };
+	recursion yes;
+	notify no;
+	dnssec-enable yes;
+	dnssec-validation yes;
+	synth-from-dnssec yes;
+};
+
+zone "." {
+	type hint;
+	file "root.hints";
+};
+
+include "../ns1/trusted.conf";
@@ -0,0 +1,8 @@
+; Copyright (C) 2017  Internet Systems Consortium, Inc. ("ISC")
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0. If a copy of the MPL was not distributed with this
+; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+.	NS	ns1
+ns1	A	10.53.0.1
@@ -17,49 +17,58 @@ rm -f dig.out.*
 DIGOPTS="+tcp +noadd +nosea +nostat +nocmd +dnssec -p 5300"
 DELVOPTS="-a ns1/trusted.conf -p 5300"

-echo "I:prime negative NXDOMAIN response ($n)"
-ret=0
-$DIG $DIGOPTS a.example. @10.53.0.2 a > dig.out.ns2.test$n || ret=1
-grep "flags:[^;]* ad[ ;]" dig.out.ns2.test$n > /dev/null || ret=1
-grep "status: NXDOMAIN," dig.out.ns2.test$n > /dev/null || ret=1
-grep "example.*3600.IN.SOA" dig.out.ns2.test$n > /dev/null || ret=1
-nxdomain=dig.out.ns2.test$n
-n=`expr $n + 1`
-if [ $ret != 0 ]; then echo "I:failed"; fi
-status=`expr $status + $ret`
+for ns in 2 4 5
+do
+    case $ns in
+    2) description="<default>";;
+    4) description="no";;
+    5) description="yes";;
+    *) exit 1;;
+    esac
+    echo "I:prime negative NXDOMAIN response (synth-from-dnssec ${description};) ($n)"
+    ret=0
+    $DIG $DIGOPTS a.example. @10.53.0.${ns} a > dig.out.ns${ns}.test$n || ret=1
+    grep "flags:[^;]* ad[ ;]" dig.out.ns${ns}.test$n > /dev/null || ret=1
+    grep "status: NXDOMAIN," dig.out.ns${ns}.test$n > /dev/null || ret=1
+    grep "example.*3600.IN.SOA" dig.out.ns${ns}.test$n > /dev/null || ret=1
+    [ $ns -eq ${ns} ] && nxdomain=dig.out.ns${ns}.test$n
+    n=`expr $n + 1`
+    if [ $ret != 0 ]; then echo "I:failed"; fi
+    status=`expr $status + $ret`

-echo "I:prime negative NODATA response ($n)"
-ret=0
-$DIG $DIGOPTS nodata.example. @10.53.0.2 a > dig.out.ns2.test$n || ret=1
-grep "flags:[^;]* ad[ ;]" dig.out.ns2.test$n > /dev/null || ret=1
-grep "status: NOERROR," dig.out.ns2.test$n > /dev/null || ret=1
-grep "example.*3600.IN.SOA" dig.out.ns2.test$n > /dev/null || ret=1
-nodata=dig.out.ns2.test$n
-n=`expr $n + 1`
-if [ $ret != 0 ]; then echo "I:failed"; fi
-status=`expr $status + $ret`
+    echo "I:prime negative NODATA response (synth-from-dnssec ${description};) ($n)"
+    ret=0
+    $DIG $DIGOPTS nodata.example. @10.53.0.${ns} a > dig.out.ns${ns}.test$n || ret=1
+    grep "flags:[^;]* ad[ ;]" dig.out.ns${ns}.test$n > /dev/null || ret=1
+    grep "status: NOERROR," dig.out.ns${ns}.test$n > /dev/null || ret=1
+    grep "example.*3600.IN.SOA" dig.out.ns${ns}.test$n > /dev/null || ret=1
+    [ $ns -eq 2 ] && nodata=dig.out.ns${ns}.test$n
+    n=`expr $n + 1`
+    if [ $ret != 0 ]; then echo "I:failed"; fi
+    status=`expr $status + $ret`

-echo "I:prime wildcard response ($n)"
-ret=0
-$DIG $DIGOPTS a.wild-a.example. @10.53.0.2 a > dig.out.ns2.test$n || ret=1
-grep "flags:[^;]* ad[ ;]" dig.out.ns2.test$n > /dev/null || ret=1
-grep "status: NOERROR," dig.out.ns2.test$n > /dev/null || ret=1
-grep "a.wild-a.example.*3600.IN.A" dig.out.ns2.test$n > /dev/null || ret=1
-n=`expr $n + 1`
-if [ $ret != 0 ]; then echo "I:failed"; fi
-status=`expr $status + $ret`
+    echo "I:prime wildcard response (synth-from-dnssec ${description};) ($n)"
+    ret=0
+    $DIG $DIGOPTS a.wild-a.example. @10.53.0.${ns} a > dig.out.ns${ns}.test$n || ret=1
+    grep "flags:[^;]* ad[ ;]" dig.out.ns${ns}.test$n > /dev/null || ret=1
+    grep "status: NOERROR," dig.out.ns${ns}.test$n > /dev/null || ret=1
+    grep "a.wild-a.example.*3600.IN.A" dig.out.ns${ns}.test$n > /dev/null || ret=1
+    n=`expr $n + 1`
+    if [ $ret != 0 ]; then echo "I:failed"; fi
+    status=`expr $status + $ret`

-echo "I:prime wildcard CNAME response ($n)"
-ret=0
-$DIG $DIGOPTS a.wild-cname.example. @10.53.0.2 a > dig.out.ns2.test$n || ret=1
-grep "flags:[^;]* ad[ ;]" dig.out.ns2.test$n > /dev/null || ret=1
-grep "status: NOERROR," dig.out.ns2.test$n > /dev/null || ret=1
-grep "a.wild-cname.example.*3600.IN.CNAME" dig.out.ns2.test$n > /dev/null || ret=1
-n=`expr $n + 1`
-if [ $ret != 0 ]; then echo "I:failed"; fi
-status=`expr $status + $ret`
+    echo "I:prime wildcard CNAME response (synth-from-dnssec ${description};) ($n)"
+    ret=0
+    $DIG $DIGOPTS a.wild-cname.example. @10.53.0.${ns} a > dig.out.ns${ns}.test$n || ret=1
+    grep "flags:[^;]* ad[ ;]" dig.out.ns${ns}.test$n > /dev/null || ret=1
+    grep "status: NOERROR," dig.out.ns${ns}.test$n > /dev/null || ret=1
+    grep "a.wild-cname.example.*3600.IN.CNAME" dig.out.ns${ns}.test$n > /dev/null || ret=1
+    n=`expr $n + 1`
+    if [ $ret != 0 ]; then echo "I:failed"; fi
+    status=`expr $status + $ret`
+done

-echo "I:prime redirect response (+nodnssec) ($n)"
+echo "I:prime redirect response (+nodnssec) (synth-from-dnssec <default>;) ($n)"
 ret=0
 $DIG $DIGOPTS +nodnssec a.redirect. @10.53.0.3 a > dig.out.ns2.test$n || ret=1
 grep "flags:[^;]* ad[ ;]" dig.out.ns2.test$n > /dev/null && ret=1
@@ -69,54 +78,88 @@ n=`expr $n + 1`
 if [ $ret != 0 ]; then echo "I:failed"; fi
 status=`expr $status + $ret`

+#
+# ensure TTL of synthesised answers differs from direct answers.
+#
 sleep 1

-$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 dumpdb
+for ns in 2 4 5
+do
+    case $ns in
+    2) synth=yes description="<default>";;
+    4) synth=no  description="no";;
+    5) synth=yes description="yes";;
+    *) exit 1;;
+    esac
+    echo "I:check synthesized NXDOMAIN response (synth-from-dnssec ${description};) ($n)"
+    ret=0
+    $DIG $DIGOPTS b.example. @10.53.0.${ns} a > dig.out.ns${ns}.test$n || ret=1
+    grep "flags:[^;]* ad[ ;]" dig.out.ns${ns}.test$n > /dev/null || ret=1
+    grep "status: NXDOMAIN," dig.out.ns${ns}.test$n > /dev/null || ret=1
+    if [ ${synth} = yes ]
+    then
+	grep "example.*IN.SOA" dig.out.ns${ns}.test$n > /dev/null || ret=1
+	grep "example.*3600.IN.SOA" dig.out.ns${ns}.test$n > /dev/null && ret=1
+    else
+	grep "example.*3600.IN.SOA" dig.out.ns${ns}.test$n > /dev/null || ret=1
+    fi
+    $PERL ../digcomp.pl $nxdomain dig.out.ns${ns}.test$n || ret=1
+    n=`expr $n + 1`
+    if [ $ret != 0 ]; then echo "I:failed"; fi
+    status=`expr $status + $ret`

-echo "I:check synthesized NXDOMAIN response ($n)"
-ret=0
-$DIG $DIGOPTS b.example. @10.53.0.2 a > dig.out.ns2.test$n || ret=1
-grep "flags:[^;]* ad[ ;]" dig.out.ns2.test$n > /dev/null || ret=1
-grep "status: NXDOMAIN," dig.out.ns2.test$n > /dev/null || ret=1
-grep "example.*3600.IN.SOA" dig.out.ns2.test$n > /dev/null && ret=1
-$PERL ../digcomp.pl $nxdomain dig.out.ns2.test$n || ret=1
-n=`expr $n + 1`
-if [ $ret != 0 ]; then echo "I:failed"; fi
-status=`expr $status + $ret`
+    echo "I:check synthesized NODATA response (synth-from-dnssec ${description};) ($n)"
+    ret=0
+    $DIG $DIGOPTS nodata.example. @10.53.0.${ns} aaaa > dig.out.ns${ns}.test$n || ret=1
+    grep "flags:[^;]* ad[ ;]" dig.out.ns${ns}.test$n > /dev/null || ret=1
+    grep "status: NOERROR," dig.out.ns${ns}.test$n > /dev/null || ret=1
+    if [ ${synth} = yes ]
+    then
+	grep "example.*IN.SOA" dig.out.ns${ns}.test$n > /dev/null || ret=1
+	grep "example.*3600.IN.SOA" dig.out.ns${ns}.test$n > /dev/null && ret=1
+    else
+	grep "example.*3600.IN.SOA" dig.out.ns${ns}.test$n > /dev/null || ret=1
+    fi
+    $PERL ../digcomp.pl $nodata dig.out.ns${ns}.test$n || ret=1
+    n=`expr $n + 1`
+    if [ $ret != 0 ]; then echo "I:failed"; fi
+    status=`expr $status + $ret`

-echo "I:check synthesized NODATA response ($n)"
-ret=0
-$DIG $DIGOPTS nodata.example. @10.53.0.2 aaaa > dig.out.ns2.test$n || ret=1
-grep "flags:[^;]* ad[ ;]" dig.out.ns2.test$n > /dev/null || ret=1
-grep "status: NOERROR," dig.out.ns2.test$n > /dev/null || ret=1
-grep "example.*3600.IN.SOA" dig.out.ns2.test$n > /dev/null && ret=1
-$PERL ../digcomp.pl $nodata dig.out.ns2.test$n || ret=1
-n=`expr $n + 1`
-if [ $ret != 0 ]; then echo "I:failed"; fi
-status=`expr $status + $ret`
+    echo "I:check synthesized wildcard response (synth-from-dnssec ${description};) ($n)"
+    ret=0
+    $DIG $DIGOPTS b.wild-a.example. @10.53.0.${ns} a > dig.out.ns${ns}.test$n || ret=1
+    grep "flags:[^;]* ad[ ;]" dig.out.ns${ns}.test$n > /dev/null || ret=1
+    grep "status: NOERROR," dig.out.ns${ns}.test$n > /dev/null || ret=1
+    if [ ${synth} = yes ]
+    then
+	    grep "b\.wild-a\.example\..*IN.A" dig.out.ns${ns}.test$n > /dev/null || ret=1
+	    grep "b\.wild-a\.example\..*3600.IN.A" dig.out.ns${ns}.test$n > /dev/null && ret=1
+    else
+	    grep "b\.wild-a\.example\..*3600.IN.A" dig.out.ns${ns}.test$n > /dev/null || ret=1
+    fi
+    n=`expr $n + 1`
+    if [ $ret != 0 ]; then echo "I:failed"; fi
+    status=`expr $status + $ret`

-echo "I:check synthesized wildcard response ($n)"
-ret=0
-$DIG $DIGOPTS b.wild-a.example. @10.53.0.2 a > dig.out.ns2.test$n || ret=1
-grep "flags:[^;]* ad[ ;]" dig.out.ns2.test$n > /dev/null || ret=1
-grep "status: NOERROR," dig.out.ns2.test$n > /dev/null || ret=1
-grep "b\.wild-a\.example\..*3600.IN.A" dig.out.ns2.test$n > /dev/null && ret=1
-n=`expr $n + 1`
-if [ $ret != 0 ]; then echo "I:failed"; fi
-status=`expr $status + $ret`
+    echo "I:check synthesized wildcard CNAME response (synth-from-dnssec ${description};) ($n)"
+    ret=0
+    $DIG $DIGOPTS b.wild-cname.example. @10.53.0.${ns} a > dig.out.ns${ns}.test$n || ret=1
+    grep "flags:[^;]* ad[ ;]" dig.out.ns${ns}.test$n > /dev/null || ret=1
+    grep "status: NOERROR," dig.out.ns${ns}.test$n > /dev/null || ret=1
+    if [ ${synth} = yes ]
+    then
+	grep "b.wild-cname.example.*IN.CNAME" dig.out.ns${ns}.test$n > /dev/null || ret=1
+	grep "b.wild-cname.example.*3600.IN.CNAME" dig.out.ns${ns}.test$n > /dev/null && ret=1
+    else
+	grep "b.wild-cname.example.*3600.IN.CNAME" dig.out.ns${ns}.test$n > /dev/null || ret=1
+    fi
+    grep "ns1.example.*.IN.A" dig.out.ns${ns}.test$n > /dev/null || ret=1
+    n=`expr $n + 1`
+    if [ $ret != 0 ]; then echo "I:failed"; fi
+    status=`expr $status + $ret`
+done

-echo "I:check synthesized wildcard CNAME response ($n)"
-ret=0
-$DIG $DIGOPTS b.wild-cname.example. @10.53.0.2 a > dig.out.ns2.test$n || ret=1
-grep "flags:[^;]* ad[ ;]" dig.out.ns2.test$n > /dev/null || ret=1
-grep "status: NOERROR," dig.out.ns2.test$n > /dev/null || ret=1
-grep "b.wild-cname.example.*3600.IN.CNAME" dig.out.ns2.test$n > /dev/null && ret=1
-grep "ns1.example.*.IN.A" dig.out.ns2.test$n > /dev/null || ret=1
-n=`expr $n + 1`
-if [ $ret != 0 ]; then echo "I:failed"; fi
-status=`expr $status + $ret`
-
-echo "I:check redirect response (+dnssec) ($n)"
+echo "I:check redirect response (+dnssec) (synth-from-dnssec <default>;) ($n)"
 ret=0
 $DIG $DIGOPTS b.redirect. @10.53.0.3 a > dig.out.ns2.test$n || ret=1
 grep "flags:[^;]* ad[ ;]" dig.out.ns2.test$n > /dev/null || ret=1
@@ -126,7 +169,7 @@ n=`expr $n + 1`
 if [ $ret != 0 ]; then echo "I:failed"; fi
 status=`expr $status + $ret`

-echo "I:check redirect response (+nodnssec) ($n)"
+echo "I:check redirect response (+nodnssec) (synth-from-dnssec <default>;) ($n)"
 ret=0
 $DIG $DIGOPTS +nodnssec b.redirect. @10.53.0.3 a > dig.out.ns2.test$n || ret=1
 grep "flags:[^;]* ad[ ;]" dig.out.ns2.test$n > /dev/null && ret=1
@@ -141,10 +141,6 @@ int sigwait(const unsigned int *set, int *sig);
 /* Use AES for Client Cookie generation */
 #undef AES_CC

-/* Define to enable the "filter-aaaa-on-v4" and "filter-aaaa-on-v6" options.
-   */
-#undef ALLOW_FILTER_AAAA
-
 /* define if ATF unit tests are to be built. */
 #undef ATF_TEST

@@ -306,10 +306,6 @@ typedef __int64 off_t;
 /* Define to the sockaddr length type used by getnameinfo(3). */
 #define IRS_GETNAMEINFO_SOCKLEN_T socklen_t

-/* Define to enable the "filter-aaaa-on-v4" and "filter-aaaa-on-v6" options.
-   */
-@ALLOW_FILTER_AAAA@
-
 /* Define to enable "rrset-order fixed" syntax. */
@DNS_RDATASET_FIXED@

@@ -940,6 +940,7 @@ infodir
 docdir
 oldincludedir
 includedir
+runstatedir
 localstatedir
 sharedstatedir
 sysconfdir
@@ -1033,7 +1034,6 @@ enable_dnsrps_dl
 with_dnsrps_libname
 with_dnsrps_dir
 enable_dnsrps
-enable_filter_aaaa
 enable_dnstap
 with_protobuf_c
 with_libfstrm
@@ -1103,6 +1103,7 @@ datadir='${datarootdir}'
 sysconfdir='${prefix}/etc'
 sharedstatedir='${prefix}/com'
 localstatedir='${prefix}/var'
+runstatedir='${localstatedir}/run'
 includedir='${prefix}/include'
 oldincludedir='/usr/include'
 docdir='${datarootdir}/doc/${PACKAGE_TARNAME}'
@@ -1355,6 +1356,15 @@ do
  | -silent | --silent | --silen | --sile | --sil)
    silent=yes ;;

+  -runstatedir | --runstatedir | --runstatedi | --runstated \
+  | --runstate | --runstat | --runsta | --runst | --runs \
+  | --run | --ru | --r)
+    ac_prev=runstatedir ;;
+  -runstatedir=* | --runstatedir=* | --runstatedi=* | --runstated=* \
+  | --runstate=* | --runstat=* | --runsta=* | --runst=* | --runs=* \
+  | --run=* | --ru=* | --r=*)
+    runstatedir=$ac_optarg ;;
+
  -sbindir | --sbindir | --sbindi | --sbind | --sbin | --sbi | --sb)
    ac_prev=sbindir ;;
  -sbindir=* | --sbindir=* | --sbindi=* | --sbind=* | --sbin=* \
@@ -1492,7 +1502,7 @@ fi
 for ac_var in	exec_prefix prefix bindir sbindir libexecdir datarootdir \
 		datadir sysconfdir sharedstatedir localstatedir includedir \
 		oldincludedir docdir infodir htmldir dvidir pdfdir psdir \
-		libdir localedir mandir
+		libdir localedir mandir runstatedir
 do
  eval ac_val=\$$ac_var
  # Remove trailing slashes.
@@ -1645,6 +1655,7 @@ Fine tuning of the installation directories:
  --sysconfdir=DIR        read-only single-machine data [PREFIX/etc]
  --sharedstatedir=DIR    modifiable architecture-independent data [PREFIX/com]
  --localstatedir=DIR     modifiable single-machine data [PREFIX/var]
+  --runstatedir=DIR       modifiable per-process data [LOCALSTATEDIR/run]
  --libdir=DIR            object code libraries [EPREFIX/lib]
  --includedir=DIR        C header files [PREFIX/include]
  --oldincludedir=DIR     C header files for non-gcc [/usr/include]
@@ -1719,7 +1730,6 @@ Optional Features:
  --disable-rpz-nsdname	  disable rpz nsdname rules [default=enabled]
  --enable-dnsrps-dl	  DNS Response Policy Service delayed link [default=$librpz_dl]
  --enable-dnsrps         enable DNS Response Policy Service API
-  --enable-filter-aaaa    enable filtering of AAAA records [default=no]
  --enable-dnstap         enable dnstap support (requires fstrm, protobuf-c)
  --enable-querytrace     enable very verbose query trace logging [default=no]
  --enable-full-report	  report values of all configure options
@@ -11470,7 +11480,6 @@ yes)
 	test "${enable_fixed_rrset+set}" = set || enable_fixed_rrset=yes
 	test "${enable_querytrace+set}" = set || enable_querytrace=yes
 	test "${with_atf+set}" = set || with_atf=yes
-	test "${enable_filter_aaaa+set}" = set || enable_filter_aaaa=yes
 	test "${with_dlz_filesystem+set}" = set || with_dlz_filesystem=yes
 	test "${enable_symtable+set}" = set || enable_symtable=all
 	test "${enable_warn_error+set}" = set || enable_warn_error=yes
@@ -20944,28 +20953,6 @@ $as_echo "#define USE_DNSRPS 1" >>confdefs.h

 fi

-#
-# Activate "filter-aaaa-on-v4/v6" or not?
-#
-# Check whether --enable-filter-aaaa was given.
-if test "${enable_filter_aaaa+set}" = set; then :
-  enableval=$enable_filter_aaaa; enable_filter="$enableval"
-else
-  enable_filter="no"
-fi
-
-case "$enable_filter" in
-	yes)
-
-$as_echo "#define ALLOW_FILTER_AAAA 1" >>confdefs.h
-
-		;;
-	no)
-		;;
-	*)
-		;;
-esac
-
 #
 # Activate dnstap?
 #
@@ -26238,8 +26225,6 @@ report() {
        echo "    DNS Response Policy Service interface (--enable-dnsrps)"
    test "yes" = "$enable_fixed" && \
        echo "    Allow 'fixed' rrset-order (--enable-fixed-rrset)"
-    test "yes" = "$enable_filter" && \
-        echo "    AAAA filtering (--enable-filter-aaaa)"
    test "yes" = "$enable_seccomp" && \
        echo "    Use libseccomp system call filtering (--enable-seccomp)"
    test "yes" = "$want_backtrace" && \
@@ -66,7 +66,6 @@ yes)
 	test "${enable_fixed_rrset+set}" = set || enable_fixed_rrset=yes
 	test "${enable_querytrace+set}" = set || enable_querytrace=yes
 	test "${with_atf+set}" = set || with_atf=yes
-	test "${enable_filter_aaaa+set}" = set || enable_filter_aaaa=yes
 	test "${with_dlz_filesystem+set}" = set || with_dlz_filesystem=yes
 	test "${enable_symtable+set}" = set || enable_symtable=all
 	test "${enable_warn_error+set}" = set || enable_warn_error=yes
@@ -4413,24 +4412,6 @@ if test "x$enable_dnsrps" != "xno"; then
 	AC_DEFINE([USE_DNSRPS], [1], [Enable DNS Response Policy Service API])
 fi

-#
-# Activate "filter-aaaa-on-v4/v6" or not?
-#
-AC_ARG_ENABLE(filter-aaaa,
-	[  --enable-filter-aaaa    enable filtering of AAAA records [[default=no]]],
-			enable_filter="$enableval",
-			enable_filter="no")
-case "$enable_filter" in
-	yes)
-		AC_DEFINE(ALLOW_FILTER_AAAA, 1,
-			  [Define to enable the "filter-aaaa-on-v4" and "filter-aaaa-on-v6" options.])
-		;;
-	no)
-		;;
-	*)
-		;;
-esac
-
 #
 # Activate dnstap?
 #
@@ -5481,8 +5462,6 @@ report() {
        echo "    DNS Response Policy Service interface (--enable-dnsrps)"
    test "yes" = "$enable_fixed" && \
        echo "    Allow 'fixed' rrset-order (--enable-fixed-rrset)"
-    test "yes" = "$enable_filter" && \
-        echo "    AAAA filtering (--enable-filter-aaaa)"
    test "yes" = "$enable_seccomp" && \
        echo "    Use libseccomp system call filtering (--enable-seccomp)"
    test "yes" = "$want_backtrace" && \
@@ -4988,7 +4988,9 @@ badresp:1,adberr:0,findfail:0,valfail:0]
 		Specifies the directory in which to store the configuration
 		parameters for zones added via <command>rndc addzone</command>.
 		By default, this is the working directory. If set to a relative
-		path, it will be relative to the working directory.
+		path, it will be relative to the working directory. The
+		directory <emphasis>must</emphasis> be writable by the
+		effective user ID of the <command>named</command> process.
 	      </para>
 	    </listitem>
 	  </varlistentry>
@@ -6714,10 +6716,7 @@ options {
 	      <term><command>filter-aaaa-on-v4</command></term>
 	      <listitem>
 		<para>
-		  This option is only available when
-		  <acronym>BIND</acronym> 9 is compiled with the
-		  <userinput>--enable-filter-aaaa</userinput> option on the
-		  "configure" command line.  It is intended to help the
+		  This option is intended to help the
 		  transition from IPv4 to IPv6 by not giving IPv6 addresses
 		  to DNS clients unless they have connections to the IPv6
 		  Internet.  This is not recommended unless absolutely
@@ -8831,7 +8830,7 @@ avoid-v6-udp-ports { 40000; range 50000 60000; };
 		  server waits on an idle TCP connection before closing
 		  it when the client is using the EDNS TCP keepalive
 		  option.  The default is 300 (30 seconds), the maximum
-		  is 1200 (two minutes), and the minimum is 1 (one tenth
+		  is 65535 (about 1.8 hours), and the minimum is 1 (one tenth
 		  of a second). Values above the maximum or below the minimum
 		  will be adjusted with a logged warning.
 		  This value may be greater than
@@ -8853,7 +8852,7 @@ avoid-v6-udp-ports { 40000; range 50000 60000; };
 		  keepalive option. This informs a client of the
 		  amount of time it may keep the session open.
 		  The default is 300 (30 seconds), the maximum is
-		  1200 (two minutes), and the minimum is 0, which
+		  65535 (about 1.8 hours), and the minimum is 0, which
 		  signals that the clients must close TCP connections
 		  immediately.  Ordinarily this should be set to the
 		  same value as <command>tcp-keepalive-timeout</command>.
@@ -12510,6 +12509,23 @@ view "external" {
 		</listitem>
 	      </varlistentry>

+	      <varlistentry>
+		<term><command>file</command></term>
+		<listitem>
+		  <para>
+		    Set the zone's filename. In <command>master</command>,
+		    <command>hint</command>, and <command>redirect</command>
+		    zones which do not have <command>masters</command>
+		    defined, zone data is loaded from this file. In
+		    <command>slave</command>, <command>stub</command>, and
+		    <command>redirect</command> zones which do have
+		    <command>masters</command> defined, zone data is
+		    retrieved from another server and saved in this file.
+		    This option is not applicable to other zone types.
+		  </para>
+		</listitem>
+	      </varlistentry>
+
 	      <varlistentry>
 		<term><command>forward</command></term>
 		<listitem>
@@ -9988,6 +9988,20 @@ view "external" {
                    See caveats in <a class="xref" href="Bv9ARM.ch06.html#root_delegation_only"><span class="command"><strong>root-delegation-only</strong></span></a>.
                  </p>
                </dd>
+<dt><span class="term"><span class="command"><strong>file</strong></span></span></dt>
+<dd>
+                  <p>
+                    Set the zone's filename. In <span class="command"><strong>master</strong></span>,
+                    <span class="command"><strong>hint</strong></span>, and <span class="command"><strong>redirect</strong></span>
+                    zones which do not have <span class="command"><strong>masters</strong></span>
+                    defined, zone data is loaded from this file. In
+                    <span class="command"><strong>slave</strong></span>, <span class="command"><strong>stub</strong></span>, and
+                    <span class="command"><strong>redirect</strong></span> zones which do have
+                    <span class="command"><strong>masters</strong></span> defined, zone data is
+                    retrieved from another server and saved in this file.
+                    This option is not applicable to other zone types.
+                  </p>
+                </dd>
 <dt><span class="term"><span class="command"><strong>forward</strong></span></span></dt>
 <dd>
                  <p>
@@ -528,6 +528,28 @@
 	  they are set.
 	</p>
      </li>
+<li class="listitem">
+	<p>
+	  The use of <span class="command"><strong>dnssec-keygen</strong></span> to generate
+	  HMAC keys for TSIG authentication has been deprecated in favor
+	  of <span class="command"><strong>tsig-keygen</strong></span>. If the algorithms HMAC-MD5,
+	  HMAC-SHA1, HMAC-SHA224, HMAC-SHA256, HMAC-SHA384, or
+	  HMAC-SHA512 are specified, <span class="command"><strong>dnssec-keygen</strong></span>
+	  will print a warning message. These algorithms will be
+	  removed from <span class="command"><strong>dnssec-keygen</strong></span> entirely in
+	  a future release. [RT #42272]
+	</p>
+      </li>
+<li class="listitem">
+	<p>
+	  The use of HMAC-MD5 for RNDC keys is no longer recommended.
+	  For compatibility, this is still the default algorithm generated
+	  by <span class="command"><strong>rndc-confgen</strong></span>, but it will print a
+	  warning message. The default algorithm in
+	  <span class="command"><strong>rndc-confgen</strong></span> will be changed to HMAC-SHA256
+	  in a future release. [RT #42272]
+	</p>
+      </li>
 </ul></div>
  </div>

@@ -121,12 +121,19 @@
 	    of <code class="option">algorithm</code> must be one of RSAMD5, RSASHA1,
 	    DSA, NSEC3RSASHA1, NSEC3DSA, RSASHA256, RSASHA512, ECCGOST,
 	    ECDSAP256SHA256, ECDSAP384SHA384, ED25519 or ED448.  For
-            TSIG/TKEY keys, the value must be one of DH (Diffie Hellman),
-            HMAC-MD5, HMAC-SHA1, HMAC-SHA224, HMAC-SHA256, HMAC-SHA384,
-            or HMAC-SHA512; specifying any of these algorithms will
-            automatically set the <code class="option">-T KEY</code> option as well.
-            (Note: <span class="command"><strong>tsig-keygen</strong></span> produces TSIG keys in a
-            more useful format than <span class="command"><strong>dnssec-keygen</strong></span>.)
+	    TKEY and SIG(0) keys, the value must be DH (Diffie Hellman);
+	    specifying this value will automatically set the
+	    <code class="option">-T KEY</code> option as well.
+	  </p>
+	  <p>
+	    TSIG keys can also by generated by setting the value to
+	    one of HMAC-MD5, HMAC-SHA1, HMAC-SHA224, HMAC-SHA256,
+	    HMAC-SHA384, or HMAC-SHA512.  As with DH, specifying these
+	    values will automatically set <code class="option">-T KEY</code>. Note,
+	    however, that <span class="command"><strong>tsig-keygen</strong></span> produces TSIG keys
+	    in a more useful format. These algorithms have been deprecated
+	    in <span class="command"><strong>dnssec-keygen</strong></span>, and will be removed in a
+	    future release.
 	  </p>
 	  <p>
 	    These values are case insensitive. In some cases, abbreviations
@@ -137,8 +144,8 @@
 	  </p>
 	  <p>
 	    As of BIND 9.12.0, this option is mandatory except when using
-	    the <code class="option">-S</code> option (which copies the algorithm from
-	    the predecessor key).  Previously, the default for newly
+	    the <code class="option">-S</code> option, which copies the algorithm from
+	    the predecessor key.  Previously, the default for newly
 	    generated keys was RSASHA1.
 	  </p>
 	</dd>
@@ -131,8 +131,12 @@
          <p>
            Specifies the algorithm to use for the TSIG key.  Available
            choices are: hmac-md5, hmac-sha1, hmac-sha224, hmac-sha256,
-            hmac-sha384 and hmac-sha512.  The default is hmac-md5 or
-            if MD5 was disabled hmac-sha256.
+            hmac-sha384 and hmac-sha512.  The default is hmac-md5, or
+            if MD5 was disabled at compile time, hmac-sha256.
+          </p>
+          <p>
+            Note: Use of hmac-md5 is no longer recommended, and the default
+            value will be changed to hmac-sha256 in a future release.
          </p>
        </dd>
 <dt><span class="term">-b <em class="replaceable"><code>keysize</code></em></span></dt>
@@ -488,6 +488,28 @@
 	  they are set.
 	</p>
      </li>
+<li class="listitem">
+	<p>
+	  The use of <span class="command"><strong>dnssec-keygen</strong></span> to generate
+	  HMAC keys for TSIG authentication has been deprecated in favor
+	  of <span class="command"><strong>tsig-keygen</strong></span>. If the algorithms HMAC-MD5,
+	  HMAC-SHA1, HMAC-SHA224, HMAC-SHA256, HMAC-SHA384, or
+	  HMAC-SHA512 are specified, <span class="command"><strong>dnssec-keygen</strong></span>
+	  will print a warning message. These algorithms will be
+	  removed from <span class="command"><strong>dnssec-keygen</strong></span> entirely in
+	  a future release. [RT #42272]
+	</p>
+      </li>
+<li class="listitem">
+	<p>
+	  The use of HMAC-MD5 for RNDC keys is no longer recommended.
+	  For compatibility, this is still the default algorithm generated
+	  by <span class="command"><strong>rndc-confgen</strong></span>, but it will print a
+	  warning message. The default algorithm in
+	  <span class="command"><strong>rndc-confgen</strong></span> will be changed to HMAC-SHA256
+	  in a future release. [RT #42272]
+	</p>
+      </li>
 </ul></div>
  </div>

@@ -477,6 +477,28 @@
 	  they are set.
 	</para>
      </listitem>
+      <listitem>
+	<para>
+	  The use of <command>dnssec-keygen</command> to generate
+	  HMAC keys for TSIG authentication has been deprecated in favor
+	  of <command>tsig-keygen</command>. If the algorithms HMAC-MD5,
+	  HMAC-SHA1, HMAC-SHA224, HMAC-SHA256, HMAC-SHA384, or
+	  HMAC-SHA512 are specified, <command>dnssec-keygen</command>
+	  will print a warning message. These algorithms will be
+	  removed from <command>dnssec-keygen</command> entirely in
+	  a future release. [RT #42272]
+	</para>
+      </listitem>
+      <listitem>
+	<para>
+	  The use of HMAC-MD5 for RNDC keys is no longer recommended.
+	  For compatibility, this is still the default algorithm generated
+	  by <command>rndc-confgen</command>, but it will print a
+	  warning message. The default algorithm in
+	  <command>rndc-confgen</command> will be changed to HMAC-SHA256
+	  in a future release. [RT #42272]
+	</para>
+      </listitem>
    </itemizedlist>
  </section>

@@ -671,6 +693,13 @@
 	  catagory.
 	</para>
      </listitem>
+      <listitem>
+	<para>
+	  The <command>filter-aaaa-on-v4</command> and
+	  <command>filter-aaaa-on-v6</command> options are no longer
+	  conditionally compiled in <command>named</command>. [RT #46340]
+	</para>
+      </listitem>
    </itemizedlist>
  </section>

@@ -3718,7 +3718,6 @@ dns_dispatch_importrecv(dns_dispatch_t *disp, isc_event_t *event) {
 	isc_socketevent_t *sevent, *newsevent;

 	REQUIRE(VALID_DISPATCH(disp));
-	REQUIRE((disp->attributes & DNS_DISPATCHATTR_NOLISTEN) != 0);
 	REQUIRE(event != NULL);

 	if ((disp->attributes & DNS_DISPATCHATTR_NOLISTEN) == 0)
@@ -73,6 +73,7 @@ LIBDNS_EXTERNAL_DATA extern isc_logmodule_t dns_modules[];
 #define DNS_LOGMODULE_NTA		(&dns_modules[30])
 #define DNS_LOGMODULE_DYNDB		(&dns_modules[31])
 #define DNS_LOGMODULE_DNSTAP		(&dns_modules[32])
+#define DNS_LOGMODULE_SSU		(&dns_modules[33])

 ISC_LANG_BEGINDECLS

@@ -176,9 +176,7 @@ typedef int dns_messagetextflag_t;
 						      additional section. */
 #define DNS_MESSAGERENDER_PREFER_AAAA	0x0010	/*%< prefer AAAA records in
 						  additional section. */
-#ifdef ALLOW_FILTER_AAAA
 #define DNS_MESSAGERENDER_FILTER_AAAA	0x0020	/*%< filter AAAA records */
-#endif

 typedef struct dns_msgblock dns_msgblock_t;

@@ -235,6 +235,19 @@ dns_nsec3param_toprivate(dns_rdata_t *src, dns_rdata_t *target,
 * 'buf' should be at least src->length + 1 in size.
 */

+isc_result_t
+dns_nsec3param_salttotext(dns_rdata_nsec3param_t *nsec3param, char *dst,
+			  size_t dstlen);
+/*%<
+ * Convert the salt of given NSEC3PARAM RDATA into hex-encoded, NULL-terminated
+ * text stored at "dst".
+ *
+ * Requires:
+ *
+ *\li 	"dst" to have enough space (as indicated by "dstlen") to hold the
+ * 	resulting text and its NULL-terminating byte.
+ */
+
 isc_result_t
 dns_nsec3param_deletechains(dns_db_t *db, dns_dbversion_t *ver,
 			    dns_zone_t *zone, isc_boolean_t nonsec,
@@ -79,6 +79,7 @@ LIBDNS_EXTERNAL_DATA isc_logmodule_t dns_modules[] = {
 	{ "dns/nta",		0 },
 	{ "dns/dyndb",		0 },
 	{ "dns/dnstap",		0 },
+	{ "dns/ssu",		0 },
 	{ NULL, 		0 }
 };

@@ -1897,7 +1897,6 @@ wrong_priority(dns_rdataset_t *rds, int pass, dns_rdatatype_t preferred_glue) {
 	return (ISC_TRUE);
 }

-#ifdef ALLOW_FILTER_AAAA
 /*
 * Decide whether to not answer with an AAAA record and its RRSIG
 */
@@ -1939,7 +1938,6 @@ norender_rdataset(const dns_rdataset_t *rdataset, unsigned int options,

 	return (ISC_TRUE);
 }
-#endif

 static isc_result_t
 renderset(dns_rdataset_t *rdataset, const dns_name_t *owner_name,
@@ -2100,13 +2098,14 @@ dns_message_rendersection(dns_message_t *msg, dns_section_t sectionid,
 						      preferred_glue))
 					goto next;

-#ifdef ALLOW_FILTER_AAAA
 				/*
 				 * Suppress AAAAs if asked and we are
 				 * not doing DNSSEC or are breaking DNSSEC.
 				 * Say so in the AD bit if we break DNSSEC.
 				 */
-				if (norender_rdataset(rdataset, options, sectionid)) {
+				if (norender_rdataset(rdataset, options,
+						      sectionid))
+				{
 					if (sectionid == DNS_SECTION_ANSWER ||
 					    sectionid == DNS_SECTION_AUTHORITY)
 					    msg->flags &= ~DNS_MESSAGEFLAG_AD;
@@ -2115,7 +2114,6 @@ dns_message_rendersection(dns_message_t *msg, dns_section_t sectionid,
 					goto next;
 				}

-#endif
 				st = *(msg->buffer);

 				count = 0;
@@ -1009,6 +1009,42 @@ rr_exists(dns_db_t *db, dns_dbversion_t *ver, const dns_name_t *name,
 	return (result);
 }

+isc_result_t
+dns_nsec3param_salttotext(dns_rdata_nsec3param_t *nsec3param, char *dst,
+			  size_t dstlen)
+{
+	isc_result_t result;
+	isc_region_t r;
+	isc_buffer_t b;
+
+	REQUIRE(nsec3param != NULL);
+	REQUIRE(dst != NULL);
+
+	if (nsec3param->salt_length == 0) {
+		if (dstlen < 2U) {
+			return (ISC_R_NOSPACE);
+		}
+		strlcpy(dst, "-", dstlen);
+		return (ISC_R_SUCCESS);
+	}
+
+	r.base = nsec3param->salt;
+	r.length = nsec3param->salt_length;
+	isc_buffer_init(&b, dst, (unsigned int)dstlen);
+
+	result = isc_hex_totext(&r, 2, "", &b);
+	if (result != ISC_R_SUCCESS) {
+		return (result);
+	}
+
+	if (isc_buffer_availablelength(&b) < 1) {
+		return (ISC_R_NOSPACE);
+	}
+	isc_buffer_putuint8(&b, 0);
+
+	return (ISC_R_SUCCESS);
+}
+
 isc_result_t
 dns_nsec3param_deletechains(dns_db_t *db, dns_dbversion_t *ver,
 			    dns_zone_t *zone, isc_boolean_t nonsec,
@@ -227,7 +227,8 @@ fetch_done(isc_task_t *task, isc_event_t *event) {
 	case DNS_R_NXDOMAIN:
 	case DNS_R_NCACHENXRRSET:
 	case DNS_R_NXRRSET:
-		nta->expiry = now;
+		if (nta->expiry > now)
+			nta->expiry = now;
 		break;
 	default:
 		break;
@@ -458,7 +459,7 @@ dns_ntatable_covered(dns_ntatable_t *ntatable, isc_stdtime_t now,
 	}
 	if (result == ISC_R_SUCCESS) {
 		nta = (dns_nta_t *) node->data;
-		answer = ISC_TF(nta->expiry >= now);
+		answer = ISC_TF(nta->expiry > now);
 	}

 	/* Deal with expired NTA */
@@ -551,7 +552,7 @@ dns_ntatable_totext(dns_ntatable_t *ntatable, isc_buffer_t **buf) {

 			snprintf(obuf, sizeof(obuf), "%s%s: %s %s",
 				 first ? "" : "\n", nbuf,
-				 n->expiry < now ? "expired" : "expiry",
+				 n->expiry <= now ? "expired" : "expiry",
 				 tbuf);
 			first = ISC_FALSE;
 			result = putstr(buf, obuf);
@@ -605,7 +606,7 @@ dns_ntatable_dump(dns_ntatable_t *ntatable, FILE *fp) {
 			isc_time_set(&t, n->expiry, 0);
 			isc_time_formattimestamp(&t, tbuf, sizeof(tbuf));
 			fprintf(fp, "%s: %s %s\n", nbuf,
-				n->expiry < now ? "expired" : "expiry",
+				n->expiry <= now ? "expired" : "expiry",
 				tbuf);
 		}
 		result = dns_rbtnodechain_next(&chain, NULL, NULL);
@@ -672,7 +673,7 @@ dns_ntatable_save(dns_ntatable_t *ntatable, FILE *fp) {
 		dns_rbtnodechain_current(&chain, NULL, NULL, &node);
 		if (node->data != NULL) {
 			dns_nta_t *n = (dns_nta_t *) node->data;
-			if (now <= n->expiry) {
+			if (n->expiry > now) {
 				isc_buffer_t b;
 				char nbuf[DNS_NAME_FORMATSIZE + 1], tbuf[80];
 				dns_fixedname_t fn;
@@ -52,7 +52,7 @@ static char root_ns[] =
 ".                       518400  IN      NS      M.ROOT-SERVERS.NET.\n"
 "A.ROOT-SERVERS.NET.     3600000 IN      A       198.41.0.4\n"
 "A.ROOT-SERVERS.NET.     3600000 IN      AAAA    2001:503:BA3E::2:30\n"
-"B.ROOT-SERVERS.NET.     3600000 IN      A       192.228.79.201\n"
+"B.ROOT-SERVERS.NET.     3600000 IN      A       199.9.14.201\n"
 "B.ROOT-SERVERS.NET.     3600000 IN      AAAA    2001:500:200::b\n"
 "C.ROOT-SERVERS.NET.     3600000 IN      A       192.33.4.12\n"
 "C.ROOT-SERVERS.NET.     3600000 IN      AAAA    2001:500:2::c\n"
@@ -425,12 +425,21 @@ dns_ssutable_checkrules2(dns_ssutable_t *table, const dns_name_t *signer,
 				continue;
 			}
 			if (!dns_name_issubdomain(name, rule->name)) {
-
 				continue;
 			}
 			dns_acl_match(addr, NULL, env->localhost,
 				      NULL, &match, NULL);
 			if (match == 0) {
+				if (signer != NULL) {
+					isc_log_write(dns_lctx,
+						      DNS_LOGCATEGORY_GENERAL,
+						      DNS_LOGMODULE_SSU,
+						      ISC_LOG_WARNING,
+						      "update-policy local: "
+						      "match on session "
+						      "key not from "
+						      "localhost");
+				}
 				continue;
 			}
 			break;
@@ -22,6 +22,7 @@
 #include <isc/file.h>
 #include <isc/hash.h>
 #include <isc/hex.h>
+#include <isc/lex.h>
 #include <isc/mem.h>
 #include <isc/os.h>
 #include <isc/print.h>
@@ -100,7 +101,7 @@ create_managers(void) {
 	CHECK(isc_task_create(taskmgr, 0, &maintask));
 	return (ISC_R_SUCCESS);

-  cleanup:
+ cleanup:
 	cleanup_managers();
 	return (result);
 }
@@ -158,7 +159,7 @@ dns_test_begin(FILE *logfile, isc_boolean_t start_managers) {

 	return (ISC_R_SUCCESS);

-  cleanup:
+ cleanup:
 	dns_test_end();
 	return (result);
 }
@@ -434,3 +435,58 @@ dns_test_getdata(const char *file, unsigned char *buf,
 	isc_stdio_close(f);
 	return (result);
 }
+
+isc_result_t
+dns_test_rdata_fromstring(dns_rdata_t *rdata, dns_rdataclass_t rdclass,
+			  dns_rdatatype_t rdtype, unsigned char *dst,
+			  size_t dstlen, const char *src)
+{
+	isc_buffer_t source, target;
+	isc_lex_t *lex = NULL;
+	isc_result_t result;
+	size_t length;
+
+	REQUIRE(rdata != NULL);
+	REQUIRE(DNS_RDATA_INITIALIZED(rdata));
+	REQUIRE(dst != NULL);
+	REQUIRE(src != NULL);
+
+	/*
+	 * Set up source to hold the input string.
+	 */
+	length = strlen(src);
+	isc_buffer_constinit(&source, src, length);
+	isc_buffer_add(&source, length);
+
+	/*
+	 * Create a lexer as one is required by dns_rdata_fromtext().
+	 */
+	result = isc_lex_create(mctx, 64, &lex);
+	if (result != ISC_R_SUCCESS) {
+		return (result);
+	}
+
+	/*
+	 * Point lexer at source.
+	 */
+	result = isc_lex_openbuffer(lex, &source);
+	if (result != ISC_R_SUCCESS) {
+		goto destroy_lexer;
+	}
+
+	/*
+	 * Set up target for storing uncompressed wire form of provided RDATA.
+	 */
+	isc_buffer_init(&target, dst, dstlen);
+
+	/*
+	 * Parse input string, determining result.
+	 */
+	result = dns_rdata_fromtext(rdata, rdclass, rdtype, lex, dns_rootname,
+				    0, NULL, &target, NULL);
+
+ destroy_lexer:
+	isc_lex_destroy(&lex);
+
+	return (result);
+}
@@ -80,3 +80,13 @@ dns_test_getdata(const char *file, unsigned char *buf,

 char *
 dns_test_tohex(const unsigned char *data, size_t len, char *buf, size_t buflen);
+
+/*%
+ * Try parsing text form RDATA in "src" (of class "rdclass" and type "rdtype")
+ * into a structure representing that RDATA at "rdata", storing the
+ * uncompressed wire form of that RDATA at "dst", which is "dstlen" bytes long.
+ */
+isc_result_t
+dns_test_rdata_fromstring(dns_rdata_t *rdata, dns_rdataclass_t rdclass,
+                          dns_rdatatype_t rdtype, unsigned char *dst,
+                          size_t dstlen, const char *src);
@@ -43,6 +43,82 @@ iteration_test(const char *file, unsigned int expected) {
 	dns_db_detach(&db);
 }

+/*%
+ * Structure containing parameters for nsec3param_salttotext_test().
+ */
+typedef struct {
+	const char *nsec3param_text;	/* NSEC3PARAM RDATA in text form */
+	const char *expected_salt;	/* string expected in target buffer */
+} nsec3param_salttotext_test_params_t;
+
+/*%
+ * Check whether dns_nsec3param_salttotext() handles supplied text form
+ * NSEC3PARAM RDATA correctly: test whether the result of calling the former is
+ * as expected and whether it properly checks available buffer space.
+ *
+ * Assumes supplied text form NSEC3PARAM RDATA is valid as testing handling of
+ * invalid NSEC3PARAM RDATA is out of scope of this unit test.
+ */
+static void
+nsec3param_salttotext_test(const nsec3param_salttotext_test_params_t *params) {
+	dns_rdata_t rdata = DNS_RDATA_INIT;
+	dns_rdata_nsec3param_t nsec3param;
+	unsigned char buf[1024];
+	isc_result_t result;
+	char salt[64];
+	size_t length;
+
+	/*
+	 * Prepare a dns_rdata_nsec3param_t structure for testing.
+	 */
+	result = dns_test_rdata_fromstring(&rdata, dns_rdataclass_in,
+					   dns_rdatatype_nsec3param, buf,
+					   sizeof(buf),
+					   params->nsec3param_text);
+	ATF_REQUIRE_EQ(result, ISC_R_SUCCESS);
+	result = dns_rdata_tostruct(&rdata, &nsec3param, NULL);
+	ATF_REQUIRE_EQ(result, ISC_R_SUCCESS);
+
+	/*
+	 * Check typical use.
+	 */
+	result = dns_nsec3param_salttotext(&nsec3param, salt, sizeof(salt));
+	ATF_CHECK_EQ_MSG(result, ISC_R_SUCCESS,
+			 "\"%s\": expected success, got %s\n",
+			 params->nsec3param_text, isc_result_totext(result));
+	ATF_CHECK_EQ_MSG(strcmp(salt, params->expected_salt), 0,
+			 "\"%s\": expected salt \"%s\", got \"%s\"",
+			 params->nsec3param_text, params->expected_salt, salt);
+
+	/*
+	 * Ensure available space in the buffer is checked before the salt is
+	 * printed to it and that the amount of space checked for includes the
+	 * terminating NULL byte.
+	 */
+	length = strlen(params->expected_salt);
+	ATF_REQUIRE(length < sizeof(salt) - 1);	/* prevent buffer overwrite */
+	ATF_REQUIRE(length > 0U);		/* prevent length underflow */
+
+	result = dns_nsec3param_salttotext(&nsec3param, salt, length - 1);
+	ATF_CHECK_EQ_MSG(result, ISC_R_NOSPACE,
+			 "\"%s\": expected a %lu-byte target buffer to be "
+			 "rejected, got %s\n",
+			 params->nsec3param_text, length - 1,
+			 isc_result_totext(result));
+	result = dns_nsec3param_salttotext(&nsec3param, salt, length);
+	ATF_CHECK_EQ_MSG(result, ISC_R_NOSPACE,
+			 "\"%s\": expected a %lu-byte target buffer to be "
+			 "rejected, got %s\n",
+			 params->nsec3param_text, length,
+			 isc_result_totext(result));
+	result = dns_nsec3param_salttotext(&nsec3param, salt, length + 1);
+	ATF_CHECK_EQ_MSG(result, ISC_R_SUCCESS,
+			 "\"%s\": expected a %lu-byte target buffer to be "
+			 "accepted, got %s\n",
+			 params->nsec3param_text, length + 1,
+			 isc_result_totext(result));
+}
+
 /*
 * Individual unit tests
 */
@@ -68,6 +144,40 @@ ATF_TC_BODY(max_iterations, tc) {

 	dns_test_end();
 }
+
+ATF_TC(nsec3param_salttotext);
+ATF_TC_HEAD(nsec3param_salttotext, tc) {
+	atf_tc_set_md_var(tc, "descr", "check dns_nsec3param_salttotext()");
+}
+ATF_TC_BODY(nsec3param_salttotext, tc) {
+	isc_result_t result;
+	size_t i;
+
+	const nsec3param_salttotext_test_params_t tests[] = {
+		/*
+		 * Tests with non-empty salts.
+		 */
+		{ "0 0 10 0123456789abcdef", "0123456789ABCDEF" },
+		{ "0 1 11 0123456789abcdef", "0123456789ABCDEF" },
+		{ "1 0 12 42", "42" },
+		{ "1 1 13 42", "42" },
+		/*
+		 * Test with empty salt.
+		 */
+		{ "0 0 0 -", "-" },
+	};
+
+	UNUSED(tc);
+
+	result = dns_test_begin(NULL, ISC_FALSE);
+	ATF_REQUIRE_EQ(result, ISC_R_SUCCESS);
+
+	for (i = 0; i < sizeof(tests) / sizeof(tests[0]); i++) {
+		nsec3param_salttotext_test(&tests[i]);
+	}
+
+	dns_test_end();
+}
 #else
 ATF_TC(untested);
 ATF_TC_HEAD(untested, tc) {
@@ -85,6 +195,7 @@ ATF_TC_BODY(untested, tc) {
 ATF_TP_ADD_TCS(tp) {
 #if defined(OPENSSL) || defined(PKCS11CRYPTO)
 	ATF_TP_ADD_TC(tp, max_iterations);
+	ATF_TP_ADD_TC(tp, nsec3param_salttotext);
 #else
 	ATF_TP_ADD_TC(tp, untested);
 #endif
@@ -141,38 +141,18 @@ static void
 check_text_ok_single(const text_ok_t *text_ok, dns_rdataclass_t rdclass,
 		     dns_rdatatype_t type, size_t structsize)
 {
-	isc_buffer_t source, target;
+	dns_rdata_t rdata = DNS_RDATA_INIT;
 	unsigned char buf_fromtext[1024];
 	char buf_totext[1024] = { 0 };
-	isc_lex_t *lex = NULL;
+	isc_buffer_t target;
 	isc_result_t result;
-	dns_rdata_t rdata;
-	size_t length;

-	/*
-	 * Set up lexer to read data.
-	 */
-	result = isc_lex_create(mctx, 64, &lex);
-	ATF_REQUIRE_EQ(result, ISC_R_SUCCESS);
-	length = strlen(text_ok->text_in);
-	isc_buffer_constinit(&source, text_ok->text_in, length);
-	isc_buffer_add(&source, length);
-	result = isc_lex_openbuffer(lex, &source);
-	ATF_REQUIRE_EQ(result, ISC_R_SUCCESS);
-	/*
-	 * Initialize target structures.
-	 */
-	isc_buffer_init(&target, buf_fromtext, sizeof(buf_fromtext));
-	dns_rdata_init(&rdata);
 	/*
 	 * Try converting text form RDATA into uncompressed wire form.
 	 */
-	result = dns_rdata_fromtext(&rdata, rdclass, type, lex, dns_rootname,
-				    0, NULL, &target, NULL);
-	/*
-	 * Destroy lexer now to simplify error handling below.
-	 */
-	isc_lex_destroy(&lex);
+	result = dns_test_rdata_fromstring(&rdata, rdclass, type, buf_fromtext,
+					   sizeof(buf_fromtext),
+					   text_ok->text_in);
 	/*
 	 * Check whether result is as expected.
 	 */
@@ -637,6 +637,7 @@ dns_nsec3_supportedhash
 dns_nsec3_typepresent
 dns_nsec3param_deletechains
 dns_nsec3param_fromprivate
+dns_nsec3param_salttotext
 dns_nsec3param_toprivate
 dns_nsec_build
 dns_nsec_buildrdata
@@ -3303,50 +3303,6 @@ resume_signingwithkey(dns_zone_t *zone) {
 	}
 }

-/*
- * Convert the salt of given NSEC3PARAM RDATA into hex-encoded, NULL-terminated
- * text stored at "dst".
- *
- * Requires:
- * 	"dst" to have enough space (as indicated by "dstlen") to hold the
- * 	resulting text and its NULL-terminating byte.
- */
-static isc_result_t
-nsec3param_salt_totext(dns_rdata_nsec3param_t *nsec3param, char *dst,
-		       size_t dstlen)
-{
-	isc_result_t result;
-	isc_region_t r;
-	isc_buffer_t b;
-
-	REQUIRE(nsec3param != NULL);
-	REQUIRE(dst != NULL);
-
-	if (nsec3param->salt_length == 0) {
-		if (dstlen < 2U) {
-			return (ISC_R_NOSPACE);
-		}
-		strlcpy(dst, "-", dstlen);
-		return (ISC_R_SUCCESS);
-	}
-
-	r.base = nsec3param->salt;
-	r.length = nsec3param->salt_length;
-	isc_buffer_init(&b, dst, (unsigned int)dstlen);
-
-	result = isc_hex_totext(&r, 2, "", &b);
-	if (result != ISC_R_SUCCESS) {
-		return (result);
-	}
-
-	if (isc_buffer_availablelength(&b) < 1) {
-		return (ISC_R_NOSPACE);
-	}
-	isc_buffer_putuint8(&b, 0);
-
-	return (ISC_R_SUCCESS);
-}
-
 /*
 * Initiate adding/removing NSEC3 records belonging to the chain defined by the
 * supplied NSEC3PARAM RDATA.
@@ -3450,7 +3406,8 @@ zone_addnsec3chain(dns_zone_t *zone, dns_rdata_nsec3param_t *nsec3param) {
 				strlcat(flags, "|OPTOUT", sizeof(flags));
 		}
 	}
-	result = nsec3param_salt_totext(nsec3param, saltbuf, sizeof(saltbuf));
+	result = dns_nsec3param_salttotext(nsec3param, saltbuf,
+					   sizeof(saltbuf));
 	RUNTIME_CHECK(result == ISC_R_SUCCESS);
 	dns_zone_log(zone, ISC_LOG_INFO,
 		     "zone_addnsec3chain(%u,%s,%u,%s)",
@@ -17258,7 +17215,7 @@ dns_zone_addnsec3chain(dns_zone_t *zone, dns_rdata_nsec3param_t *nsec3param) {

 	REQUIRE(DNS_ZONE_VALID(zone));

-	result = nsec3param_salt_totext(nsec3param, salt, sizeof(salt));
+	result = dns_nsec3param_salttotext(nsec3param, salt, sizeof(salt));
 	RUNTIME_CHECK(result == ISC_R_SUCCESS);
 	dns_zone_log(zone, ISC_LOG_NOTICE,
 		     "dns_zone_addnsec3chain(hash=%u, iterations=%u, salt=%s)",
@@ -1895,18 +1895,9 @@ view_clauses[] = {
 	{ "fetch-quota-params", &cfg_type_fetchquota, 0 },
 	{ "fetches-per-server", &cfg_type_fetchesper, 0 },
 	{ "fetches-per-zone", &cfg_type_fetchesper, 0 },
-#ifdef ALLOW_FILTER_AAAA
 	{ "filter-aaaa", &cfg_type_bracketed_aml, 0 },
 	{ "filter-aaaa-on-v4", &cfg_type_filter_aaaa, 0 },
 	{ "filter-aaaa-on-v6", &cfg_type_filter_aaaa, 0 },
-#else
-	{ "filter-aaaa", &cfg_type_bracketed_aml,
-	   CFG_CLAUSEFLAG_NOTCONFIGURED },
-	{ "filter-aaaa-on-v4", &cfg_type_filter_aaaa,
-	   CFG_CLAUSEFLAG_NOTCONFIGURED },
-	{ "filter-aaaa-on-v6", &cfg_type_filter_aaaa,
-	   CFG_CLAUSEFLAG_NOTCONFIGURED },
-#endif
 	{ "glue-cache", &cfg_type_boolean, 0 },
 	{ "ixfr-from-differences", &cfg_type_ixfrdifftype, 0 },
 	{ "lame-ttl", &cfg_type_ttlval, 0 },
@@ -1096,7 +1096,6 @@ client_send(ns_client_t *client) {
 			preferred_glue = DNS_MESSAGERENDER_PREFER_AAAA;
 	}

-#ifdef ALLOW_FILTER_AAAA
 	/*
 	 * filter-aaaa-on-v4 yes or break-dnssec option to suppress
 	 * AAAA records.
@@ -1113,7 +1112,6 @@ client_send(ns_client_t *client) {
 		if (preferred_glue == DNS_MESSAGERENDER_PREFER_AAAA)
 			preferred_glue = DNS_MESSAGERENDER_PREFER_A;
 	}
-#endif

 	/*
 	 * Create an OPT for our reply.
@@ -3033,9 +3031,7 @@ client_create(ns_clientmgr_t *manager, ns_client_t **clientp) {
 	client->interface = NULL;
 	client->peeraddr_valid = ISC_FALSE;
 	dns_ecs_init(&client->ecs);
-#ifdef ALLOW_FILTER_AAAA
 	client->filter_aaaa = dns_aaaa_ok;
-#endif
 	client->needshutdown = ISC_TF((client->sctx->options &
 				       NS_SERVER_CLIENTTEST) != 0);

@@ -20,21 +20,19 @@
 * code is reached.  Current use is limited to libns unit tests and thus:
 *
 *   - hook-related types and macros are not placed in libns header files,
- *   - hook-related code is compiled away unless --enable-developer is used,
+ *   - hook-related code is compiled away unless --with-atf is used,
 *   - hook-related macro names are prefixed with "NS_".
 *
 * However, the implementation is pretty generic and could be repurposed for
 * general use, e.g. as part of libisc, after some further customization.
 *
 * Hooks are created by inserting a macro into any function returning
- * isc_result_t (NS_PROCESS_HOOK()) or void (NS_PROCESS_HOOK_VOID()).  Each
- * hook has an identifier, which is an integer that is an index into the hook
- * table.  In an attempt to keep things as simple as possible, current
- * implementation:
- *
- *   - uses hook tables which are statically-sized arrays only allowing a
- *     single callback to be invoked for each hook identifier,
- *   - only supports replacing whole hook tables.
+ * isc_result_t (NS_PROCESS_HOOK()) or void (NS_PROCESS_HOOK_VOID()).  As both
+ * of these macros contain a return statement which is inlined into the
+ * function into which the hook is inserted, a hook callback is able to cause
+ * that function to return at hook insertion point.  For functions returning
+ * isc_result_t, if a hook callback intends to cause a return at hook insertion
+ * point, it also has to set the value to be returned by the function.
 *
 * Hook callbacks are functions which:
 *
@@ -50,21 +48,33 @@
 *       - a pointer to isc_result_t which will be returned by the function
 *         into which the hook is inserted if the callback returns ISC_TRUE.
 *
+ * Hook tables are arrays which consist of a number of tuples (one tuple per
+ * hook identifier), each of which determines the callback to be invoked when a
+ * given hook is processed and the data to be passed to that callback.  In an
+ * attempt to keep things as simple as possible, current implementation uses
+ * hook tables which are statically-sized arrays only allowing a single
+ * callback to be invoked for each hook identifier.
+ *
 * In order for a hook callback to be called for a given hook, a pointer to
 * that callback (along with an optional pointer to callback-specific data) has
- * to be inserted into the hook table entry for that hook.
+ * to be inserted into the relevant hook table entry for that hook.  Replacing
+ * whole hook tables is also possible.
 *
 * Consider the following sample code:
 *
 * ----------------------------------------------------------------------------
- * const ns_hook_t *foo_hook_table = NULL;
+ * ns_hook_t *foo_hook_table = NULL;
 *
 * isc_result_t
 * foo_bar(void) {
 *     int val = 42;
+ *
 *     ...
+ *
 *     NS_PROCESS_HOOK(foo_hook_table, FOO_EXTRACT_VAL, &val);
+ *
 *     ...
+ *
 *     printf("This message may not be printed due to use of hooks.");
 *
 *     return (ISC_R_SUCCESS);
@@ -72,35 +82,75 @@
 *
 * isc_boolean_t
 * cause_failure(void *hook_data, void *callback_data, isc_result_t *resultp) {
+ *     int *valp = (int *)hook_data;
+ *     isc_boolean_t *calledp = (isc_boolean_t *)callback_data;
+ *
 *     ...
+ *
 *     *resultp = ISC_R_FAILURE;
 *
 *     return (ISC_TRUE);
 * }
 *
+ * isc_boolean_t
+ * examine_val(void *hook_data, void *callback_data, isc_result_t *resultp) {
+ *     int *valp = (int *)hook_data;
+ *     int *valcopyp = (int *)callback_data;
+ *
+ *     UNUSED(resultp);
+ *
+ *     ...
+ *
+ *     return (ISC_FALSE);
+ * }
+ *
 * void
 * test_foo_bar(void) {
- *     isc_boolean_t foo_bar_called = ISC_FALSE;
- *     const ns_hook_t my_hooks[FOO_HOOKS_COUNT] = {
+ *     isc_boolean_t called = ISC_FALSE;
+ *     int valcopy;
+ *
+ *     ns_hook_t my_hooks[FOO_HOOKS_COUNT] = {
 *         [FOO_EXTRACT_VAL] = {
 *             .callback = cause_failure,
- *             .callback_data = &foo_bar_called,
+ *             .callback_data = &called,
 *         },
 *     };
 *
 *     foo_hook_table = my_hooks;
- *
 *     foo_bar();
+ *
+ *     {
+ *         const ns_hook_t examine_hook = {
+ *             .callback = examine_val,
+ *             .callback_data = &valcopy,
+ *         };
+ *
+ *         my_hooks[FOO_EXTRACT_VAL] = examine_hook;
+ *     }
+ *     foo_bar();
+ *
 * }
 * ----------------------------------------------------------------------------
 *
- * When test_foo_bar() is called, the hook table is first replaced.  Then
+ * When test_foo_bar() is called, "foo_hook_table" is set to "my_hooks".  Then
 * foo_bar() gets invoked.  Once execution reaches the insertion point for hook
- * FOO_EXTRACT_VAL, cause_failure() will be called with &val as hook_data and
- * &foo_bar_called as callback_data.  It can do whatever it pleases with these
- * two values.  Eventually, cause_failure() sets *resultp to ISC_R_FAILURE and
+ * FOO_EXTRACT_VAL, cause_failure() will be called with &val as "hook_data" and
+ * &called as "callback_data".  It can do whatever it pleases with these two
+ * values.  Eventually, cause_failure() sets *resultp to ISC_R_FAILURE and
 * returns ISC_TRUE, which causes foo_bar() to return ISC_R_FAILURE and never
 * execute the printf() call below hook insertion point.
+ *
+ * Execution then returns to test_foo_bar().  Unlike before the first call to
+ * foo_bar(), this time only a single hook ("examine_hook") is defined instead
+ * of a complete hook table.  This hook is then subsequently inserted at index
+ * FOO_EXTRACT_VAL into the "my_hook" hook table.  This causes the hook
+ * previously set at that index (the one calling cause_failure()) to be
+ * replaced with "examine_hook".  Thus, when the second call to foo_bar() is
+ * subsequently made, examine_val() will be called with &val as "hook_data" and
+ * &valcopy as "callback_data".  Contrary to cause_failure(), extract_val()
+ * returns ISC_FALSE, which means it does not access "resultp" and does not
+ * cause foo_bar() to return at hook insertion point.  Thus, printf() will be
+ * called this time and foo_bar() will return ISC_R_SUCCESS.
 */

 enum {
@@ -136,7 +186,7 @@ typedef struct ns_hook {
 #define NS_PROCESS_HOOK_VOID(table, id, data) \
 	_NS_PROCESS_HOOK(table, id, data)

-LIBNS_EXTERNAL_DATA extern const ns_hook_t *ns__hook_table;
+LIBNS_EXTERNAL_DATA extern ns_hook_t *ns__hook_table;

 #endif /* NS_HOOKS_ENABLE */
 #endif /* NS_HOOKS_H */
@@ -141,9 +141,7 @@ struct ns_client {
 	struct in6_pktinfo	pktinfo;
 	isc_dscp_t		dscp;
 	isc_event_t		ctlevent;
-#ifdef ALLOW_FILTER_AAAA
 	dns_aaaa_t		filter_aaaa;
-#endif
 	/*%
 	 * Information about recent FORMERR response(s), for
 	 * FORMERR loop avoidance.  This is separate for each
@@ -180,10 +178,8 @@ typedef ISC_LIST(ns_client_t) client_list_t;
 #define NS_CLIENTATTR_MULTICAST		0x00008 /*%< recv'd from multicast */
 #define NS_CLIENTATTR_WANTDNSSEC	0x00010 /*%< include dnssec records */
 #define NS_CLIENTATTR_WANTNSID		0x00020 /*%< include nameserver ID */
-#ifdef ALLOW_FILTER_AAAA
 #define NS_CLIENTATTR_FILTER_AAAA	0x00040 /*%< suppress AAAAs */
 #define NS_CLIENTATTR_FILTER_AAAA_RC	0x00080 /*%< recursing for A against AAAA */
-#endif
 #define NS_CLIENTATTR_WANTAD		0x00100 /*%< want AD in response if possible */
 #define NS_CLIENTATTR_WANTCOOKIE	0x00200 /*%< return a COOKIE */
 #define NS_CLIENTATTR_HAVECOOKIE	0x00400 /*%< has a valid COOKIE */
@@ -119,6 +119,7 @@ typedef struct query_ctx {
 	isc_boolean_t nxrewrite;		/* negative answer from RPZ */
 	isc_boolean_t findcoveringnsec;		/* lookup covering NSEC */
 	isc_boolean_t want_stale;		/* want stale records? */
+	isc_boolean_t answer_has_ns;		/* NS is in answer */
 	dns_fixedname_t wildcardname;		/* name needing wcard proof */
 	dns_fixedname_t dsname;			/* name needing DS */

@@ -247,7 +247,7 @@ log_noexistnodata(void *val, int level, const char *fmt, ...)

 #ifdef NS_HOOKS_ENABLE

-LIBNS_EXTERNAL_DATA const ns_hook_t *ns__hook_table = NULL;
+LIBNS_EXTERNAL_DATA ns_hook_t *ns__hook_table = NULL;

 #define PROCESS_HOOK(...) \
 	NS_PROCESS_HOOK(ns__hook_table, __VA_ARGS__)
@@ -1832,9 +1832,7 @@ query_addadditional(void *arg, const dns_name_t *name, dns_rdatatype_t qtype) {
 	}

 	if (qtype == dns_rdatatype_a) {
-#ifdef ALLOW_FILTER_AAAA
 		isc_boolean_t have_a = ISC_FALSE;
-#endif

 		/*
 		 * We now go looking for A and AAAA records, along with
@@ -1873,9 +1871,7 @@ query_addadditional(void *arg, const dns_name_t *name, dns_rdatatype_t qtype) {
 				dns_rdataset_disassociate(sigrdataset);
 		} else if (result == ISC_R_SUCCESS) {
 			mname = NULL;
-#ifdef ALLOW_FILTER_AAAA
 			have_a = ISC_TRUE;
-#endif
 			if (additionaltype == dns_rdatasetadditional_fromcache &&
 			    (DNS_TRUST_PENDING(rdataset->trust) ||
 			     DNS_TRUST_GLUE(rdataset->trust)) &&
@@ -1935,14 +1931,12 @@ query_addadditional(void *arg, const dns_name_t *name, dns_rdatatype_t qtype) {
 			/*
 			 * There's an A; check whether we're filtering AAAA
 			 */
-#ifdef ALLOW_FILTER_AAAA
 			if (have_a &&
 			    (client->filter_aaaa == dns_aaaa_break_dnssec ||
 			    (client->filter_aaaa == dns_aaaa_filter &&
 			     (!WANTDNSSEC(client) || sigrdataset == NULL ||
 			      !dns_rdataset_isassociated(sigrdataset)))))
 				goto addname;
-#endif
 			if (additionaltype == dns_rdatasetadditional_fromcache &&
 			    (DNS_TRUST_PENDING(rdataset->trust) ||
 			     DNS_TRUST_GLUE(rdataset->trust)) &&
@@ -2071,13 +2065,11 @@ query_addrdataset(ns_client_t *client, dns_section_t section,
 		if (dbversion == NULL)
 			goto regular;

-#ifdef ALLOW_FILTER_AAAA
 		if (client->filter_aaaa == dns_aaaa_filter ||
 		    client->filter_aaaa == dns_aaaa_break_dnssec)
 		{
 			options |= DNS_RDATASETADDGLUE_FILTERAAAA;
 		}
-#endif

 		result = dns_rdataset_addglue(rdataset, dbversion->version,
 					      options, client->message);
@@ -4553,7 +4545,6 @@ query_findclosestnsec3(dns_name_t *qname, dns_db_t *db,
 	return;
 }

-#ifdef ALLOW_FILTER_AAAA
 static isc_boolean_t
 is_v4_client(ns_client_t *client) {
 	if (isc_sockaddr_pf(&client->peeraddr) == AF_INET)
@@ -4571,7 +4562,6 @@ is_v6_client(ns_client_t *client) {
 		return (ISC_TRUE);
 	return (ISC_FALSE);
 }
-#endif

 static isc_uint32_t
 dns64_ttl(dns_db_t *db, dns_dbversion_t *version) {
@@ -4989,6 +4979,7 @@ qctx_init(ns_client_t *client, dns_fetchevent_t *event,
 	qctx->is_staticstub_zone = ISC_FALSE;
 	qctx->nxrewrite = ISC_FALSE;
 	qctx->want_stale = ISC_FALSE;
+	qctx->answer_has_ns = ISC_FALSE;
 	qctx->authoritative = ISC_FALSE;
 }

@@ -6521,7 +6512,6 @@ query_respond_any(query_ctx_t *qctx) {
 	dns_rdatasetiter_t *rdsiter = NULL;
 	isc_result_t result;
 	dns_rdatatype_t onetype = 0; 	/* type to use for minimal-any */
-#ifdef ALLOW_FILTER_AAAA
 	isc_boolean_t have_aaaa, have_a, have_sig;

 	/*
@@ -6532,7 +6522,6 @@ query_respond_any(query_ctx_t *qctx) {
 	have_aaaa = ISC_FALSE;
 	have_a = !qctx->authoritative;
 	have_sig = ISC_FALSE;
-#endif

 	result = dns_db_allrdatasets(qctx->db, qctx->node,
 				     qctx->version, 0, &rdsiter);
@@ -6560,7 +6549,6 @@ query_respond_any(query_ctx_t *qctx) {
 	result = dns_rdatasetiter_first(rdsiter);
 	while (result == ISC_R_SUCCESS) {
 		dns_rdatasetiter_current(rdsiter, qctx->rdataset);
-#ifdef ALLOW_FILTER_AAAA
 		/*
 		 * Notice the presence of A and AAAAs so
 		 * that AAAAs can be hidden from IPv4 clients.
@@ -6571,7 +6559,22 @@ query_respond_any(query_ctx_t *qctx) {
 			else if (qctx->rdataset->type == dns_rdatatype_a)
 				have_a = ISC_TRUE;
 		}
-#endif
+
+		/*
+		 * We found an NS RRset; no need to add one later.
+		 */
+		if (qctx->qtype == dns_rdatatype_any &&
+		    qctx->rdataset->type == dns_rdatatype_ns)
+		{
+			qctx->answer_has_ns = ISC_TRUE;
+		}
+
+		/*
+		 * Note: if we're in this function, then qctx->type
+		 * is guaranteed to be ANY, but qctx->qtype (i.e. the
+		 * original type requested) might have been RRSIG or
+		 * SIG; we need to check for that.
+		 */
 		if (qctx->is_zone && qctx->qtype == dns_rdatatype_any &&
 		    !dns_db_issecure(qctx->db) &&
 		    dns_rdatatype_isdnssec(qctx->rdataset->type))
@@ -6603,10 +6606,8 @@ query_respond_any(query_ctx_t *qctx) {
 			    qctx->rdataset->type == qctx->qtype) &&
 			   qctx->rdataset->type != 0)
 		{
-#ifdef ALLOW_FILTER_AAAA
 			if (dns_rdatatype_isdnssec(qctx->rdataset->type))
 				have_sig = ISC_TRUE;
-#endif

 			if (NOQNAME(qctx->rdataset) && WANTDNSSEC(qctx->client))
 			{
@@ -6669,10 +6670,10 @@ query_respond_any(query_ctx_t *qctx) {
 			 */
 			dns_rdataset_disassociate(qctx->rdataset);
 		}
+
 		result = dns_rdatasetiter_next(rdsiter);
 	}

-#ifdef ALLOW_FILTER_AAAA
 	/*
 	 * Filter AAAAs if there is an A and there is no signature
 	 * or we are supposed to break DNSSEC.
@@ -6683,7 +6684,7 @@ query_respond_any(query_ctx_t *qctx) {
 		 have_aaaa && have_a &&
 		 (!have_sig || !WANTDNSSEC(qctx->client)))
 		  qctx->client->attributes |= NS_CLIENTATTR_FILTER_AAAA;
-#endif
+
 	if (qctx->fname != NULL)
 		dns_message_puttempname(qctx->client->message, &qctx->fname);

@@ -6796,7 +6797,6 @@ query_getexpire(query_ctx_t *qctx) {
 	}
 }

-#ifdef ALLOW_FILTER_AAAA
 /*
 * Optionally hide AAAAs from IPv4 clients if there is an A.
 *
@@ -6891,7 +6891,6 @@ query_filter_aaaa(query_ctx_t *qctx) {

 	return (ISC_R_COMPLETE);
 }
-#endif

 /*%
 * Build a repsonse for a "normal" query, for a type other than ANY,
@@ -6930,11 +6929,9 @@ query_respond(query_ctx_t *qctx) {
 		return (query_done(qctx));
 	}

-#ifdef ALLOW_FILTER_AAAA
 	result = query_filter_aaaa(qctx);
 	if (result != ISC_R_COMPLETE)
 		return (result);
-#endif
 	/*
 	 * Check to see if the AAAA RRset has non-excluded addresses
 	 * in it.  If not look for a A RRset.
@@ -6971,12 +6968,26 @@ query_respond(query_ctx_t *qctx) {
 	}

 	/*
-	 * BIND 8 priming queries need the additional section.
+	 * Special case NS handling
 	 */
-	if (qctx->is_zone && qctx->qtype == dns_rdatatype_ns &&
-	    dns_name_equal(qctx->client->query.qname, dns_rootname))
-	{
-		qctx->client->query.attributes &= ~NS_QUERYATTR_NOADDITIONAL;
+	if (qctx->is_zone && qctx->qtype == dns_rdatatype_ns) {
+		/*
+		 * We've already got an NS, no need to add one in
+		 * the authority section
+		 */
+		if (dns_name_equal(qctx->client->query.qname,
+				   dns_db_origin(qctx->db)))
+		{
+			qctx->answer_has_ns = ISC_TRUE;
+		}
+
+		/*
+		 * BIND 8 priming queries need the additional section.
+		 */
+		if (dns_name_equal(qctx->client->query.qname, dns_rootname)) {
+			qctx->client->query.attributes &=
+				~NS_QUERYATTR_NOADDITIONAL;
+		}
 	}

 	/*
@@ -8338,6 +8349,38 @@ log_noexistnodata(void *val, int level, const char *fmt, ...) {
 	va_end(ap);
 }

+static dns_ttl_t
+query_synthttl(dns_rdataset_t *soardataset, dns_rdataset_t *sigsoardataset,
+	       dns_rdataset_t *p1rdataset, dns_rdataset_t *sigp1rdataset,
+	       dns_rdataset_t *p2rdataset, dns_rdataset_t *sigp2rdataset)
+{
+	dns_rdata_soa_t soa;
+	dns_rdata_t rdata = DNS_RDATA_INIT;
+	dns_ttl_t ttl;
+	isc_result_t result;
+
+	REQUIRE(soardataset != NULL);
+	REQUIRE(sigsoardataset != NULL);
+	REQUIRE(p1rdataset != NULL);
+	REQUIRE(sigp1rdataset != NULL);
+
+	result = dns_rdataset_first(soardataset);
+	RUNTIME_CHECK(result == ISC_R_SUCCESS);
+	dns_rdataset_current(soardataset, &rdata);
+	dns_rdata_tostruct(&rdata, &soa, NULL);
+
+	ttl = ISC_MIN(soa.minimum, soardataset->ttl);
+	ttl = ISC_MIN(ttl, sigsoardataset->ttl);
+	ttl = ISC_MIN(ttl, p1rdataset->ttl);
+	ttl = ISC_MIN(ttl, sigp1rdataset->ttl);
+	if (p2rdataset != NULL)
+		ttl = ISC_MIN(ttl, p2rdataset->ttl);
+	if (sigp2rdataset != NULL)
+		ttl = ISC_MIN(ttl, sigp2rdataset->ttl);
+
+	return (ttl);
+}
+
 /*
 * Synthesize a NODATA response from the SOA and covering NSEC in cache.
 */
@@ -8354,10 +8397,9 @@ query_synthnodata(query_ctx_t *qctx, const dns_name_t *signer,
 	/*
 	 * Detemine the correct TTL to use for the SOA and RRSIG
 	 */
-	ttl = ISC_MIN(qctx->rdataset->ttl, qctx->sigrdataset->ttl);
-	ttl = ISC_MIN(ttl, (*soardatasetp)->ttl);
-	ttl = ISC_MIN(ttl, (*sigsoardatasetp)->ttl);
-
+	ttl = query_synthttl(*soardatasetp, *sigsoardatasetp,
+			     qctx->rdataset, qctx->sigrdataset,
+			     NULL, NULL);
 	(*soardatasetp)->ttl = (*sigsoardatasetp)->ttl = ttl;

 	/*
@@ -8559,15 +8601,15 @@ query_synthcnamewildcard(query_ctx_t *qctx, dns_rdataset_t *rdataset,

 /*
 * Synthesize a NXDOMAIN response from qctx (which contains the
- * NODATA proof), nowild + rdataset + sigrdataset (which contains
- * the NOWILDCARD proof) and signer + soardatasetp + sigsoardatasetp
+ * NODATA proof), nowild + nowildrdataset + signowildrdataset (which
+ * contains the NOWILDCARD proof) and signer + soardatasetp + sigsoardatasetp
 * which contain the SOA record + RRSIG for the negative answer.
 */
 static isc_result_t
 query_synthnxdomain(query_ctx_t *qctx,
 		    dns_name_t *nowild,
-		    dns_rdataset_t *rdataset,
-		    dns_rdataset_t *sigrdataset,
+		    dns_rdataset_t *nowildrdataset,
+		    dns_rdataset_t *signowildrdataset,
 		    dns_name_t *signer,
 		    dns_rdataset_t **soardatasetp,
 		    dns_rdataset_t **sigsoardatasetp)
@@ -8581,12 +8623,9 @@ query_synthnxdomain(query_ctx_t *qctx,
 	/*
 	 * Detemine the correct TTL to use for the SOA and RRSIG
 	 */
-	ttl = ISC_MIN(qctx->rdataset->ttl, qctx->sigrdataset->ttl);
-	ttl = ISC_MIN(ttl, rdataset->ttl);
-	ttl = ISC_MIN(ttl, sigrdataset->ttl);
-	ttl = ISC_MIN(ttl, (*soardatasetp)->ttl);
-	ttl = ISC_MIN(ttl, (*sigsoardatasetp)->ttl);
-
+	ttl = query_synthttl(*soardatasetp, *sigsoardatasetp,
+			     qctx->rdataset, qctx->sigrdataset,
+			     nowildrdataset, signowildrdataset);
 	(*soardatasetp)->ttl = (*sigsoardatasetp)->ttl = ttl;

 	/*
@@ -8651,8 +8690,8 @@ query_synthnxdomain(query_ctx_t *qctx,
 			goto cleanup;
 		}

-		dns_rdataset_clone(rdataset, clone);
-		dns_rdataset_clone(sigrdataset, sigclone);
+		dns_rdataset_clone(nowildrdataset, clone);
+		dns_rdataset_clone(signowildrdataset, sigclone);

 		/*
 		 * Add NOWILDCARD proof.
@@ -8794,14 +8833,12 @@ query_coveringnsec(query_ctx_t *qctx) {
 		if (qctx->type == dns_rdatatype_any) {	/* XXX not yet */
 			goto cleanup;
 		}
-#ifdef ALLOW_FILTER_AAAA
 		if (qctx->client->filter_aaaa != dns_aaaa_ok &&
 		    (qctx->type == dns_rdatatype_a ||
 		     qctx->type == dns_rdatatype_aaaa)) /* XXX not yet */
 		{
 			goto cleanup;
 		}
-#endif
 		if (!ISC_LIST_EMPTY(qctx->client->view->dns64) &&
 		    (qctx->type == dns_rdatatype_a ||
 		     qctx->type == dns_rdatatype_aaaa)) /* XXX not yet */
@@ -8866,14 +8903,12 @@ query_coveringnsec(query_ctx_t *qctx) {
 		if (qctx->type == dns_rdatatype_any) {	/* XXX not yet */
 			goto cleanup;
 		}
-#ifdef ALLOW_FILTER_AAAA
 		if (qctx->client->filter_aaaa != dns_aaaa_ok &&
 		    (qctx->type == dns_rdatatype_a ||
 		     qctx->type == dns_rdatatype_aaaa)) /* XXX not yet */
 		{
 			goto cleanup;
 		}
-#endif
 		if (!ISC_LIST_EMPTY(qctx->client->view->dns64) &&
 		    (qctx->type == dns_rdatatype_a ||
 		     qctx->type == dns_rdatatype_aaaa)) /* XXX not yet */
@@ -9412,7 +9447,6 @@ query_prepresponse(query_ctx_t *qctx) {
 		qctx->need_wildcardproof = ISC_TRUE;
 	}

-#ifdef ALLOW_FILTER_AAAA
 	/*
 	 * The filter-aaaa-on-v4 option should suppress AAAAs for IPv4
 	 * clients if there is an A; filter-aaaa-on-v6 option does the same
@@ -9436,7 +9470,6 @@ query_prepresponse(query_ctx_t *qctx) {
 			qctx->client->filter_aaaa = qctx->client->view->v6_aaaa;
 	}

-#endif

 	if (qctx->type == dns_rdatatype_any) {
 		return (query_respond_any(qctx));
@@ -10185,14 +10218,12 @@ query_addauth(query_ctx_t *qctx) {
 	 */
 	if (!qctx->want_restart && !NOAUTHORITY(qctx->client)) {
 		if (qctx->is_zone) {
-			if (!((qctx->qtype == dns_rdatatype_ns ||
-			       qctx->qtype == dns_rdatatype_any) &&
-			      dns_name_equal(qctx->client->query.qname,
-					     dns_db_origin(qctx->db))))
-			{
+			if (!qctx->answer_has_ns) {
 				(void)query_addns(qctx);
 			}
-		} else if (qctx->qtype != dns_rdatatype_ns) {
+		} else if (!qctx->answer_has_ns &&
+			   qctx->qtype != dns_rdatatype_ns)
+		{
 			if (qctx->fname != NULL) {
 				query_releasename(qctx->client, &qctx->fname);
 			}
@@ -679,8 +679,8 @@ extract_qctx(void *hook_data, void *callback_data, isc_result_t *resultp) {
 */
 static isc_result_t
 create_qctx_for_client(ns_client_t *client, query_ctx_t **qctxp) {
-	const ns_hook_t *saved_hook_table;
-	const ns_hook_t query_hooks[NS_QUERY_HOOKS_COUNT] = {
+	ns_hook_t *saved_hook_table;
+	ns_hook_t query_hooks[NS_QUERY_HOOKS_COUNT] = {
 		[NS_QUERY_SETUP_QCTX_INITIALIZED] = {
 			.callback = extract_qctx,
 			.callback_data = qctxp,
@@ -57,7 +57,7 @@ ns__query_sfcache_test(const ns__query_sfcache_test_params_t *test) {
 	/*
 	 * Interrupt execution if query_done() is called.
 	 */
-	const ns_hook_t query_hooks[NS_QUERY_HOOKS_COUNT] = {
+	ns_hook_t query_hooks[NS_QUERY_HOOKS_COUNT] = {
 		[NS_QUERY_DONE_BEGIN] = {
 			.callback = ns_test_hook_catch_call,
 			.callback_data = NULL,
@@ -264,7 +264,7 @@ ns__query_start_test(const ns__query_start_test_params_t *test) {
 	/*
 	 * Interrupt execution if query_lookup() or query_done() is called.
 	 */
-	const ns_hook_t query_hooks[NS_QUERY_HOOKS_COUNT] = {
+	ns_hook_t query_hooks[NS_QUERY_HOOKS_COUNT] = {
 		[NS_QUERY_LOOKUP_BEGIN] = {
 			.callback = ns_test_hook_catch_call,
 			.callback_data = NULL,
@@ -46,8 +46,8 @@
 ./bin/confgen/keygen.c				C	2009,2012,2013,2014,2015,2016,2017
 ./bin/confgen/keygen.h				C	2009,2016
 ./bin/confgen/rndc-confgen.8			MAN	DOCBOOK
-./bin/confgen/rndc-confgen.c			C	2001,2003,2004,2005,2007,2008,2009,2011,2013,2014,2016
-./bin/confgen/rndc-confgen.docbook		SGML	2001,2003,2004,2005,2007,2009,2013,2014,2015,2016
+./bin/confgen/rndc-confgen.c			C	2001,2003,2004,2005,2007,2008,2009,2011,2013,2014,2016,2017
+./bin/confgen/rndc-confgen.docbook		SGML	2001,2003,2004,2005,2007,2009,2013,2014,2015,2016,2017
 ./bin/confgen/rndc-confgen.html			HTML	DOCBOOK
 ./bin/confgen/unix/Makefile.in			MAKE	2009,2012,2016
 ./bin/confgen/unix/os.c				C	2009,2016
@@ -626,7 +626,7 @@
 ./bin/tests/system/acl/ns2/named7.conf		CONF-C	2014,2016
 ./bin/tests/system/acl/setup.sh			SH	2008,2012,2014,2016
 ./bin/tests/system/acl/tests.sh			SH	2008,2012,2013,2014,2016
-./bin/tests/system/additional/clean.sh		SH	2013,2014,2016
+./bin/tests/system/additional/clean.sh		SH	2013,2014,2016,2017
 ./bin/tests/system/additional/ns1/mx.db		ZONE	2016
 ./bin/tests/system/additional/ns1/named.args	X	2013,2014
 ./bin/tests/system/additional/ns1/named1.conf	CONF-C	2013,2016,2017
@@ -639,6 +639,8 @@
 ./bin/tests/system/additional/ns1/rt.db		ZONE	2013,2016
 ./bin/tests/system/additional/ns1/rt2.db	ZONE	2013,2016
 ./bin/tests/system/additional/ns1/srv.db	ZONE	2016
+./bin/tests/system/additional/ns3/named.conf	CONF-C	2017
+./bin/tests/system/additional/ns3/root.hint	ZONE	2017
 ./bin/tests/system/additional/setup.sh		SH	2013,2016
 ./bin/tests/system/additional/tests.sh		SH	2013,2016,2017
 ./bin/tests/system/addzone/clean.sh		SH	2010,2012,2013,2014,2015,2016,2017
@@ -2247,6 +2249,10 @@
 ./bin/tests/system/synthfromdnssec/ns3/named.conf	CONF-C	2017
 ./bin/tests/system/synthfromdnssec/ns3/redirect.db	ZONE	2017
 ./bin/tests/system/synthfromdnssec/ns3/root.hints	ZONE	2017
+./bin/tests/system/synthfromdnssec/ns4/named.conf	CONF-C	2017
+./bin/tests/system/synthfromdnssec/ns4/root.hints	ZONE	2017
+./bin/tests/system/synthfromdnssec/ns5/named.conf	CONF-C	2017
+./bin/tests/system/synthfromdnssec/ns5/root.hints	ZONE	2017
 ./bin/tests/system/synthfromdnssec/prereq.sh	SH	2017
 ./bin/tests/system/synthfromdnssec/setup.sh	SH	2017
 ./bin/tests/system/synthfromdnssec/tests.sh	SH	2017
@@ -219,7 +219,6 @@ my @projectlist = ("..\\bin\\check\\win32\\checkconf.vcxproj",
 my %configdefh;

 my @substdefh = ("AES_CC",
-                 "ALLOW_FILTER_AAAA",
                 "CONFIGARGS",
                 "DNS_RDATASET_FIXED",
                 "ENABLE_RPZ_NSDNAME",
@@ -451,7 +450,6 @@ my @help = (
 "  enable-crypto-rand    use crypto provider for random [default=yes]\n",
 "  enable-openssl-hash   use OpenSSL for hash functions [default=yes]\n",
 "  enable-isc-spnego     use SPNEGO from lib/dns [default=yes]\n",
-"  enable-filter-aaaa    enable filtering of AAAA records [default=yes]\n",
 "  enable-fixed-rrset    enable fixed rrset ordering [default=no]\n",
 "  enable-developer      enable developer build settings [default=no]\n",
 "  enable-querytrace     enable very verbose query trace [default=no]\n",
@@ -496,7 +494,6 @@ my $cryptolib = "";
 my $enable_native_pkcs11 = "no";
 my $enable_crypto_rand = "yes";
 my $enable_openssl_hash = "auto";
-my $enable_filter_aaaa = "yes";
 my $enable_isc_spnego = "yes";
 my $enable_fixed_rrset = "no";
 my $enable_developer = "no";
@@ -717,10 +714,6 @@ sub myenable {
        if ($val =~ /^no$/i) {
            $enable_isc_spnego = "no";
        }
-    } elsif ($key =~ /^filter-aaaa$/i) {
-        if ($val =~ /^no$/i) {
-            $enable_filter_aaaa = "no";
-        }
    } elsif ($key =~ /^fixed-rrset$/i) {
        if ($val =~ /^yes$/i) {
            $enable_fixed_rrset = "yes";
@@ -755,7 +748,6 @@ sub myenable {

 if ($enable_developer eq "yes") {
    $configdefh{"ISC_LIST_CHECKINIT"} = 1;
-    $enable_filter_aaaa = "yes";
    $enable_querytrace = "yes";
    # no atf on WIN32
    $enable_fixed_rrset = "yes";
@@ -1005,11 +997,6 @@ if ($verbose) {
    } else {
        print "isc-spnego: disabled\n";
    }
-    if ($enable_filter_aaaa eq "yes") {
-        print "filter-aaaa: enabled\n";
-    } else {
-        print "filter-aaaa: disabled\n";
-    }
    if ($enable_fixed_rrset eq "yes") {
        print "fixed-rrset: enabled\n";
    } else {
@@ -1409,11 +1396,6 @@ if ($enable_native_pkcs11 eq "yes") {
    }
 }

-# enable-filter-aaaa
-if ($enable_filter_aaaa eq "yes") {
-    $configdefh{"ALLOW_FILTER_AAAA"} = 1;
-}
-
 # enable-fixed-rrset
 if ($enable_fixed_rrset eq "yes") {
    $configdefh{"DNS_RDATASET_FIXED"} = 1;
@@ -3413,7 +3395,6 @@ exit 0;
 #  --enable-querytrace supported
 #  --disable-rpz-nsip supported
 #  --disable-rpz-nsdname supported
-#  --enable-filter-aaaa supported
 #  --enable-full-report supported by verbose
 #  --enable-dnstap not supported (requires libfstrm support on WIN32)
 #  --enable-seccomp not supported (Linux specific)
Author	SHA1	Message	Date
Brian ConryandOndřej Surý	740c8050b4	Bump the maximum TCP timeout to 65535 [RT #44710 ]	2017-10-25 14:15:04 +04:00
Evan Hunt	eb2ef7b53e	[master] check new-zones-directory 4789. [cleanup] Check writability of new-zones-directory. [RT #46308]	2017-10-25 01:19:46 -07:00
Evan Hunt	aebdc6cd7d	[master] log when update-policy local gets a key match from a remote host 4788. [cleanup] When using "update-policy local", log a warning when an update matching the session key is received from a remote host. [RT #46213] - this completes change #4762.	2017-10-25 00:58:11 -07:00
Michał Kępień	910a01550a	[master] Rename nsec3param_salt_totext() to dns_nsec3param_salttotext(), make it public, add unit tests 4786. [cleanup] Turn nsec3param_salt_totext() into a public function, dns_nsec3param_salttotext(), and add unit tests for it. [RT #46289]	2017-10-25 09:46:18 +02:00
Evan Hunt	65314b0fd8	[master] "enable-filter-aaaa" no longer optional 4786. [func] The "filter-aaaa-on-v4" and "filter-aaaa-on-v6" options are no longer conditionally compiled. [RT #46340]	2017-10-25 00:33:51 -07:00
Mark Andrews	80739779fc	read dig.out.ns3.test$n rather than dig.out.ns2.test$n	2017-10-25 15:02:36 +11:00
Tinderbox User	a53e03205a	regen master	2017-10-25 01:08:58 +00:00
Tinderbox User	ea055a82cd	update copyright notice / whitespace	2017-10-24 23:47:14 +00:00
Tinderbox User	89c95e7141	newcopyrights	2017-10-24 23:30:30 +00:00
Mark Andrews	79e78994d0	add missing semicolon	2017-10-25 10:29:10 +11:00
Evan Hunt	21761bfe79	[master] deprecate HMAC in dnssec-keygen, MD5 in rndc-confgen 4785. [func] The hmac-md5 algorithm is no longer recommended for use with RNDC keys. For compatibility reasons, it it is still the default algorithm in rndc-confgen, but this will be changed to hmac-sha256 in a future release. [RT #42272] 4784. [func] The use of dnssec-keygen to generate HMAC keys is deprecated in favor of tsig-keygen. dnssec-keygen will print a warning when used for this purpose. All HMAC algorithms will be removed from dnssec-keygen in a future release. [RT #42272]	2017-10-24 15:35:13 -07:00
Mark Andrews	969d923536	4783. [test] dnssec: 'check that NOTIFY is sent at the end of NSEC3 chain generation failed' required more time on some machines for the IXFR to complete. [RT #46388]	2017-10-25 09:21:14 +11:00
Mark Andrews	6b8e4d6e69	4782. [test] dnssec: 'checking positive and negative validation with negative trust anchors' required more time to complete on some machines. [RT #46386]	2017-10-25 09:13:05 +11:00
Michał Kępień	a94d68ce43	[master] Remove REQUIRE preventing change 4592 from working Change 4592 was supposed to replace a REQUIRE with a conditional return. While the latter was added, the former was not removed. Remove the relevant REQUIRE to fix RT #43822 for good.	2017-10-24 21:11:31 +02:00
Evan Hunt	7810817b71	[master] update B.ROOT-SERVERS.NET	2017-10-24 09:17:08 -07:00
Mark Andrews	b49042a6a5	report test number	2017-10-24 15:02:00 +11:00
Evan Hunt	b1042e011c	[master] zone "file" option was undocumented	2017-10-23 19:39:56 -07:00
Evan Hunt	0207f6ff9e	[master] omit NS from authority section if it was in answer 4780. [bug] When answering ANY queries, don't include the NS RRset in the authority section if it was already in the answer section. [RT #44543]	2017-10-23 19:16:27 -07:00
Mark Andrews	65f8b51893	remove named.memstats and named.run	2017-10-24 12:51:03 +11:00
Mark Andrews	5bead588b7	report if named.run or named.memstats not removed after successful test	2017-10-24 12:45:13 +11:00
Mark Andrews	3f2e5f840a	update	2017-10-24 10:41:13 +11:00
Mark Andrews	c9438ee2e0	4779. [bug] Expire NTA at the start of the second. Don't update the expiry value if the record has already expired after a successful check. [RT #46368]	2017-10-24 09:54:25 +11:00
Mark Andrews	a59d687db4	4778. [test] Improve synth-from-dnssec testing. [RT #46352 ]	2017-10-24 09:49:07 +11:00
Evan Hunt	89636d8f30	[master] clean up a redundancy 4777. [cleanup] Removed a redundant call to configure_view_acl(). [RT #46369]	2017-10-23 11:11:19 -07:00
Michał Kępień	34ee1cdb56	[master] Extend hooks documentation	2017-10-23 14:17:44 +02:00
Michał Kępień	6853af8fc5	[master] Deconstify hook tables as replacing single entries is allowed	2017-10-23 14:17:07 +02:00