Add and use isc_rng_randombytes()

4799.	[cleanup]	Improve clarity of keytable unit tests. [RT #46407]

CHANGES

@@ -1,3 +1,40 @@
+4800.	[bug]		When processing delzone, write one zone config per
+			line to the NZF. [RT #46323]
+
+4799.	[cleanup]	Improve clarity of keytable unit tests. [RT #46407]
+
+4798.	[func]		Keys specified in "managed-keys" statements
+			are tagged as "initializing" until they have been
+			updated by a key refresh query. If initialization
+			fails it will be visible from "rndc secroots".
+			[RT #46267]
+
+4797.	[func]		Removed "isc-hmac-fixup", as the versions of BIND that
+			had the bug it worked around are long past end of
+			life. [RT #46411]
+
+4796.	[bug]		Increase the maximum configurable TCP keepalive
+			timeout to 65535. [RT #44710]
+
+4795.	[func]		A new statistics counter has been added to track
+			priming queries. [RT #46313]
+
+4794.	[func]		"dnssec-checkds -s" specifies a file from which
+			to read a DS set rather than querying the parent.
+			[RT #44667]
+
+4793.	[bug]		nsupdate -[46] could overflow the array of server
+			addresses. [RT #46402]
+
+4792.	[bug]		Fix map file header correctness check. [RT #38418]
+
+4791.	[doc]		Fixed outdated documentation about export libraries.
+			[RT #46341]
+
+4790.	[bug]		nsupdate could trigger a require when sending a
+			update to the second address of the server.
+			[RT #45731]
+
 4789.	[cleanup]	Check writability of new-zones-directory. [RT #46308]
 
 4788.	[cleanup]	When using "update-policy local", log a warning
@@ -13,10 +50,8 @@
 			[RT #46340]
 
 4785.	[func]		The hmac-md5 algorithm is no longer recommended for
-			use with RNDC keys. For compatibility reasons, it
+			use with RNDC keys.  The default in rndc-confgen
-			it is still the default algorithm in rndc-confgen,
+			is now hmac-sha256. [RT #42272]
-			but this will be changed to hmac-sha256 in a future
-			release. [RT #42272]
 
 4784.	[func]		The use of dnssec-keygen to generate HMAC keys is
 			deprecated in favor of tsig-keygen.  dnssec-keygen
@@ -305,8 +340,8 @@
 4713.	[func]		Added support for the DNS Response Policy Service
 			(DNSRPS) API, which allows named to use an external
 			response policy daemon when built with
-			"configure --enable-dnsrps".  Thanks to Vernon
+			"configure --enable-dnsrps". Thanks to Farsight
-			Schryver and Farsight Security. [RT #43376]
+			Security. [RT #43376]
 
 4712.	[bug]		"dig +domain" and "dig +search" didn't retain the
 			search domain when retrying with TCP. [RT #45547]

OPTIONS

@@ -22,4 +22,7 @@ Setting                   Description
                           Increase the maximum number of configurable
 -DNS_RPZ_MAX_ZONES=64     response policy zones from 32 to 64; this is the
                           highest possible setting
+                          Disable the use of inline functions to implement
+-DISC_BUFFER_USEINLINE=0  the isc_buffer API: this reduces performance but
+                          may be useful when debugging
 

OPTIONS.md

@@ -21,3 +21,4 @@ Some of these settings are:
 |`-DCHECK_LOCAL=0`|Don't check out-of-zone addresses in `named-checkzone`|
 |`-DNS_RUN_PID_DIR=0`|Create default PID files in `${localstatedir}/run` rather than `${localstatedir}/run/named/`|
 |`-DNS_RPZ_MAX_ZONES=64`|Increase the maximum number of configurable response policy zones from 32 to 64; this is the highest possible setting|
+|`-DISC_BUFFER_USEINLINE=0`|Disable the use of inline functions to implement the `isc_buffer` API: this reduces performance but may be useful when debugging |

bin/confgen/rndc-confgen.8

@@ -111,9 +111,7 @@ as directed\&.
 .PP
 \-A \fIalgorithm\fR
 .RS 4
-Specifies the algorithm to use for the TSIG key\&. Available choices are: hmac\-md5, hmac\-sha1, hmac\-sha224, hmac\-sha256, hmac\-sha384 and hmac\-sha512\&. The default is hmac\-md5, or if MD5 was disabled at compile time, hmac\-sha256\&.
+Specifies the algorithm to use for the TSIG key\&. Available choices are: hmac\-md5, hmac\-sha1, hmac\-sha224, hmac\-sha256, hmac\-sha384 and hmac\-sha512\&. The default is hmac\-sha256\&.
-.sp
-Note: Use of hmac\-md5 is no longer recommended, and the default value will be changed to hmac\-sha256 in a future release\&.
 .RE
 .PP
 \-b \fIkeysize\fR

bin/confgen/rndc-confgen.c

@@ -6,8 +6,6 @@
  * file, You can obtain one at http://mozilla.org/MPL/2.0/.
  */
 
-/* $Id: rndc-confgen.c,v 1.7 2011/03/12 04:59:46 tbox Exp $ */
-
 /*! \file */
 
 /**
@@ -67,23 +65,6 @@ usage(int status) ISC_PLATFORM_NORETURN_POST;
 static void
 usage(int status) {
 
-#ifndef PK11_MD5_DISABLE
-	fprintf(stderr, "\
-Usage:\n\
- %s [-a] [-b bits] [-c keyfile] [-k keyname] [-p port] [-r randomfile] \
-[-s addr] [-t chrootdir] [-u user]\n\
-  -a:		 generate just the key clause and write it to keyfile (%s)\n\
-  -A alg:	 algorithm (default hmac-md5 (deprecated and will change))\n\
-  -b bits:	 from 1 through 512, default 256; total length of the secret\n\
-  -c keyfile:	 specify an alternate key file (requires -a)\n\
-  -k keyname:	 the name as it will be used  in named.conf and rndc.conf\n\
-  -p port:	 the port named will listen on and rndc will connect to\n\
-  -r randomfile: source of random data (use \"keyboard\" for key timing)\n\
-  -s addr:	 the address to which rndc should connect\n\
-  -t chrootdir:	 write a keyfile in chrootdir as well (requires -a)\n\
-  -u user:	 set the keyfile owner to \"user\" (requires -a)\n",
-		 progname, keydef);
-#else
 	fprintf(stderr, "\
 Usage:\n\
  %s [-a] [-b bits] [-c keyfile] [-k keyname] [-p port] [-r randomfile] \
@@ -99,7 +80,6 @@ Usage:\n\
   -t chrootdir:	 write a keyfile in chrootdir as well (requires -a)\n\
   -u user:	 set the keyfile owner to \"user\" (requires -a)\n",
 		 progname, keydef);
-#endif
 
 	exit (status);
 }
@@ -115,7 +95,6 @@ main(int argc, char **argv) {
 	const char *randomfile = NULL;
 	const char *serveraddr = NULL;
 	dns_secalg_t alg;
-	isc_boolean_t algset = ISC_FALSE;
 	const char *algname;
 	char *p;
 	int ch;
@@ -136,11 +115,7 @@ main(int argc, char **argv) {
 	progname = program;
 
 	keyname = DEFAULT_KEYNAME;
-#ifndef PK11_MD5_DISABLE
-	alg = DST_ALG_HMACMD5;
-#else
 	alg = DST_ALG_HMACSHA256;
-#endif
 	serveraddr = DEFAULT_SERVER;
 	port = DEFAULT_PORT;
 
@@ -154,7 +129,6 @@ main(int argc, char **argv) {
 			keyonly = ISC_TRUE;
 			break;
 		case 'A':
-			algset = ISC_TRUE;
 			algname = isc_commandline_argument;
 			alg = alg_fromtext(algname);
 			if (alg == DST_ALG_UNKNOWN)
@@ -228,17 +202,9 @@ main(int argc, char **argv) {
 		usage(1);
 
 	if (alg == DST_ALG_HMACMD5) {
-		if (algset) {
+		fprintf(stderr,
-			fprintf(stderr,
+			"warning: use of hmac-md5 for RNDC keys "
-				"warning: use of hmac-md5 for RNDC keys "
+			"is deprecated; hmac-sha256 is now recommended.\n");
-				"is deprecated; hmac-sha256 is now "
-				"recommended.\n");
-		} else {
-			fprintf(stderr,
-				"warning: the default algorithm hmac-md5 "
-				"is deprecated and will be\n"
-				"changed to hmac-sha256 in a future release\n");
-		}
 	}
 
 	if (keysize < 0)

bin/confgen/rndc-confgen.docbook

@@ -129,12 +129,7 @@
           <para>
             Specifies the algorithm to use for the TSIG key.  Available
             choices are: hmac-md5, hmac-sha1, hmac-sha224, hmac-sha256,
-            hmac-sha384 and hmac-sha512.  The default is hmac-md5, or
+            hmac-sha384 and hmac-sha512.  The default is hmac-sha256.
-            if MD5 was disabled at compile time, hmac-sha256.
-          </para>
-          <para>
-            Note: Use of hmac-md5 is no longer recommended, and the default
-            value will be changed to hmac-sha256 in a future release.
           </para>
         </listitem>
       </varlistentry>

bin/confgen/rndc-confgen.html

@@ -113,12 +113,7 @@
           <p>
             Specifies the algorithm to use for the TSIG key.  Available
             choices are: hmac-md5, hmac-sha1, hmac-sha224, hmac-sha256,
-            hmac-sha384 and hmac-sha512.  The default is hmac-md5, or
+            hmac-sha384 and hmac-sha512.  The default is hmac-sha256.
-            if MD5 was disabled at compile time, hmac-sha256.
-          </p>
-          <p>
-            Note: Use of hmac-md5 is no longer recommended, and the default
-            value will be changed to hmac-sha256 in a future release.
           </p>
         </dd>
 <dt><span class="term">-b <em class="replaceable"><code>keysize</code></em></span></dt>

bin/named/bind9.xsl

@@ -9,7 +9,7 @@
 
 <xsl:stylesheet xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns="http://www.w3.org/1999/xhtml" version="1.0">
   <xsl:output method="html" indent="yes" version="4.0"/>
-  <xsl:template match="statistics[@version=&quot;3.10&quot;]">
+  <xsl:template match="statistics[@version=&quot;3.11&quot;]">
     <html>
       <head>
         <xsl:if test="system-property('xsl:vendor')!='Transformiix'">

bin/named/bind9.xsl.h

@@ -14,7 +14,7 @@ static char xslmsg[] =
 	"\n"
 	"<xsl:stylesheet xmlns:xsl=\"http://www.w3.org/1999/XSL/Transform\" xmlns=\"http://www.w3.org/1999/xhtml\" version=\"1.0\">\n"
 	" <xsl:output method=\"html\" indent=\"yes\" version=\"4.0\"/>\n"
-	" <xsl:template match=\"statistics[@version=&quot;3.10&quot;]\">\n"
+	" <xsl:template match=\"statistics[@version=&quot;3.11&quot;]\">\n"
 	" <html>\n"
 	" <head>\n"
 	" <xsl:if test=\"system-property('xsl:vendor')!='Transformiix'\">\n"

bin/named/controlconf.c

@@ -456,9 +456,8 @@ control_recvmessage(isc_task_t *task, isc_event_t *event) {
 	 */
 	if (conn->nonce == 0) {
 		while (conn->nonce == 0) {
-			isc_uint16_t r1 = isc_rng_random(server->sctx->rngctx);
+			isc_rng_randombytes(server->sctx->rngctx, &conn->nonce,
-			isc_uint16_t r2 = isc_rng_random(server->sctx->rngctx);
+					    sizeof(conn->nonce));
-			conn->nonce = (r1 << 16) | r2;
 		}
 		eresult = ISC_R_SUCCESS;
 	} else

bin/named/server.c

@@ -160,6 +160,8 @@
 #define DIR_PERM_OK W_OK|X_OK
 #endif
 
+#define MAX_TCP_TIMEOUT 65535
+
 /*%
  * Check an operation for failure.  Assumes that the function
  * using it has a 'result' variable and a 'cleanup' label.
@@ -803,6 +805,11 @@ dstkey_fromconfig(const cfg_obj_t *vconfig, const cfg_obj_t *key,
 	return (result);
 }
 
+/*
+ * Load keys from configuration into key table. If 'keyname' is specified,
+ * only load keys matching that name. If 'managed' is true, load the key as
+ * an initializing key.
+ */
 static isc_result_t
 load_view_keys(const cfg_obj_t *keys, const cfg_obj_t *vconfig,
 	       dns_view_t *view, isc_boolean_t managed,
@@ -818,12 +825,14 @@ load_view_keys(const cfg_obj_t *keys, const cfg_obj_t *vconfig,
 
 	for (elt = cfg_list_first(keys);
 	     elt != NULL;
-	     elt = cfg_list_next(elt)) {
+	     elt = cfg_list_next(elt))
+	{
 		keylist = cfg_listelt_value(elt);
 
 		for (elt2 = cfg_list_first(keylist);
 		     elt2 != NULL;
-		     elt2 = cfg_list_next(elt2)) {
+		     elt2 = cfg_list_next(elt2))
+		{
 			key = cfg_listelt_value(elt2);
 			result = dstkey_fromconfig(vconfig, key, managed,
 						   &dstkey, mctx);
@@ -831,8 +840,9 @@ load_view_keys(const cfg_obj_t *keys, const cfg_obj_t *vconfig,
 				result = ISC_R_SUCCESS;
 				continue;
 			}
-			if (result != ISC_R_SUCCESS)
+			if (result != ISC_R_SUCCESS) {
 				goto cleanup;
+			}
 
 			/*
 			 * If keyname was specified, we only add that key.
@@ -844,17 +854,27 @@ load_view_keys(const cfg_obj_t *keys, const cfg_obj_t *vconfig,
 				continue;
 			}
 
-			CHECK(dns_keytable_add(secroots, managed, &dstkey));
+			/*
+			 * This key is taken from the configuration, so
+			 * if it's a managed key then it's an
+			 * initializing key; that's why 'managed'
+			 * is duplicated below.
+			 */
+			CHECK(dns_keytable_add2(secroots, managed,
+						managed, &dstkey));
 		}
 	}
 
  cleanup:
-	if (dstkey != NULL)
+	if (dstkey != NULL) {
 		dst_key_free(&dstkey);
-	if (secroots != NULL)
+	}
+	if (secroots != NULL) {
 		dns_keytable_detach(&secroots);
-	if (result == DST_R_NOCRYPTO)
+	}
+	if (result == DST_R_NOCRYPTO) {
 		result = ISC_R_SUCCESS;
+	}
 	return (result);
 }
 
@@ -1024,7 +1044,7 @@ configure_view_dnsseckeys(dns_view_t *view, const cfg_obj_t *vconfig,
 	}
 
 	/*
-	 * Add key zone for managed-keys.
+	 * Add key zone for managed keys.
 	 */
 	obj = NULL;
 	(void)named_config_get(maps, "managed-keys-directory", &obj);
@@ -1048,6 +1068,7 @@ configure_view_dnsseckeys(dns_view_t *view, const cfg_obj_t *vconfig,
 			goto cleanup;
 		}
 	}
+
 	CHECK(add_keydata_zone(view, directory, named_g_mctx));
 
   cleanup:
@@ -6441,16 +6462,19 @@ dotat(dns_keytable_t *keytable, dns_keynode_t *keynode, void *arg) {
 		}
 		nextnode = NULL;
 		(void)dns_keytable_nextkeynode(keytable, keynode, &nextnode);
-		if (keynode != firstnode)
+		if (keynode != firstnode) {
 			dns_keytable_detachkeynode(keytable, &keynode);
+		}
 		keynode = nextnode;
 	} while (keynode != NULL);
 
-	if (n == 0)
+	if (n == 0) {
 		return;
+	}
 
-	if (n > 1)
+	if (n > 1) {
 		qsort(ids, n, sizeof(ids[0]), cid);
+	}
 
 	/*
 	 * Encoded as "_ta-xxxx\(-xxxx\)*" where xxxx is the hex version of
@@ -6458,22 +6482,25 @@ dotat(dns_keytable_t *keytable, dns_keynode_t *keynode, void *arg) {
 	 */
 	label[0] = 0;
 	r.base = label;
-	r.length = sizeof(label);;
+	r.length = sizeof(label);
 	m = snprintf(r.base, r.length, "_ta");
-	if (m < 0 || (unsigned)m > r.length)
+	if (m < 0 || (unsigned)m > r.length) {
 		return;
+	}
 	isc_textregion_consume(&r, m);
 	for (i = 0; i < n; i++) {
 		m = snprintf(r.base, r.length, "-%04x", ids[i]);
-		if (m < 0 || (unsigned)m > r.length)
+		if (m < 0 || (unsigned)m > r.length) {
 			return;
+		}
 		isc_textregion_consume(&r, m);
 	}
 	dns_fixedname_init(&fixed);
 	tatname = dns_fixedname_name(&fixed);
 	result = dns_name_fromstring2(tatname, label, name, 0, NULL);
-	if (result != ISC_R_SUCCESS)
+	if (result != ISC_R_SUCCESS) {
 		return;
+	}
 
 	dns_name_format(tatname, namebuf, sizeof(namebuf));
 	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
@@ -6482,8 +6509,9 @@ dotat(dns_keytable_t *keytable, dns_keynode_t *keynode, void *arg) {
 		     view->name, namebuf);
 
 	tat = isc_mem_get(dotat_arg->view->mctx, sizeof(*tat));
-	if (tat == NULL)
+	if (tat == NULL) {
 		return;
+	}
 
 	tat->mctx = NULL;
 	tat->task = NULL;
@@ -7886,11 +7914,11 @@ load_configuration(const char *filename, named_server_t *server,
 	result = named_config_get(maps, "tcp-keepalive-timeout", &obj);
 	INSIST(result == ISC_R_SUCCESS);
 	keepalive = cfg_obj_asuint32(obj);
-	if (keepalive > 1200) {
+	if (keepalive > MAX_TCP_TIMEOUT) {
 		cfg_obj_log(obj, named_g_lctx, ISC_LOG_WARNING,
 			    "tcp-keepalive-timeout value is out of range: "
-			    "lowering to 1200");
+			    "lowering to %u", MAX_TCP_TIMEOUT);
-		keepalive = 1200;
+		keepalive = MAX_TCP_TIMEOUT;
 	} else if (keepalive < 1) {
 		cfg_obj_log(obj, named_g_lctx, ISC_LOG_WARNING,
 			    "tcp-keepalive-timeout value is out of range: "
@@ -7902,11 +7930,11 @@ load_configuration(const char *filename, named_server_t *server,
 	result = named_config_get(maps, "tcp-advertised-timeout", &obj);
 	INSIST(result == ISC_R_SUCCESS);
 	advertised = cfg_obj_asuint32(obj);
-	if (advertised > 1200) {
+	if (advertised > MAX_TCP_TIMEOUT) {
 		cfg_obj_log(obj, named_g_lctx, ISC_LOG_WARNING,
 			    "tcp-advertized-timeout value is out of range: "
-			    "lowering to 1200");
+			    "lowering to %u", MAX_TCP_TIMEOUT);
-		advertised = 1200;
+		advertised = MAX_TCP_TIMEOUT;
 	}
 
 	ns_server_settimeouts(named_g_server->sctx,
@@ -11744,6 +11772,10 @@ nzf_append(dns_view_t *view, const cfg_obj_t *zconfig) {
 
 static isc_result_t
 nzf_writeconf(const cfg_obj_t *config, dns_view_t *view) {
+	const cfg_obj_t *zl = NULL;
+	cfg_list_t *list;
+	const cfg_listelt_t *elt;
+
 	FILE *fp = NULL;
 	char tmp[1024];
 	isc_result_t result;
@@ -11755,9 +11787,24 @@ nzf_writeconf(const cfg_obj_t *config, dns_view_t *view) {
 	if (result != ISC_R_SUCCESS)
 		return (result);
 
+	cfg_map_get(config, "zone", &zl);
+	if (!cfg_obj_islist(zl))
+		CHECK(ISC_R_FAILURE);
+
+	DE_CONST(&zl->value.list, list);
+
 	CHECK(add_comment(fp, view->name));	/* force a comment */
 
-	cfg_printx(config, CFG_PRINTER_ONELINE, dumpzone, fp);
+	for (elt = ISC_LIST_HEAD(*list);
+	     elt != NULL;
+	     elt = ISC_LIST_NEXT(elt, link))
+	{
+		const cfg_obj_t *zconfig = cfg_listelt_value(elt);
+
+		CHECK(isc_stdio_write("zone ", 5, 1, fp, NULL));
+		cfg_printx(zconfig, CFG_PRINTER_ONELINE, dumpzone, fp);
+		CHECK(isc_stdio_write(";\n", 2, 1, fp, NULL));
+	}
 
 	CHECK(isc_stdio_flush(fp));
 	result = isc_stdio_close(fp);
@@ -13447,11 +13494,6 @@ newzone_cfgctx_destroy(void **cfgp) {
 
 static isc_result_t
 generate_salt(unsigned char *salt, size_t saltlen) {
-	size_t i, n;
-	union {
-		unsigned char rnd[256];
-		isc_uint16_t rnd16[128];
-	} rnd;
 	unsigned char text[512 + 1];
 	isc_region_t r;
 	isc_buffer_t buf;
@@ -13460,14 +13502,9 @@ generate_salt(unsigned char *salt, size_t saltlen) {
 	if (saltlen > 256U)
 		return (ISC_R_RANGE);
 
-	n = (saltlen + sizeof(isc_uint16_t) - 1) / sizeof(isc_uint16_t);
+	isc_rng_randombytes(named_g_server->sctx->rngctx, salt, saltlen);
-	for (i = 0; i < n; i++) {
-		rnd.rnd16[i] = isc_rng_random(named_g_server->sctx->rngctx);
-	}
 
-	memmove(salt, rnd.rnd, saltlen);
+	r.base = salt;
-
-	r.base = rnd.rnd;
 	r.length = (unsigned int) saltlen;
 
 	isc_buffer_init(&buf, text, sizeof(text));
@@ -14700,7 +14737,7 @@ named_server_tcptimeouts(isc_lex_t *lex, isc_buffer_t **text) {
 		if (ptr == NULL)
 			return (ISC_R_UNEXPECTEDEND);
 		CHECK(isc_parse_uint32(&keepalive, ptr, 10));
-		if (keepalive > 1200)
+		if (keepalive > MAX_TCP_TIMEOUT)
 			CHECK(ISC_R_RANGE);
 		if (keepalive < 1)
 			CHECK(ISC_R_RANGE);
@@ -14709,7 +14746,7 @@ named_server_tcptimeouts(isc_lex_t *lex, isc_buffer_t **text) {
 		if (ptr == NULL)
 			return (ISC_R_UNEXPECTEDEND);
 		CHECK(isc_parse_uint32(&advertised, ptr, 10));
-		if (advertised > 1200)
+		if (advertised > MAX_TCP_TIMEOUT)
 			CHECK(ISC_R_RANGE);
 
 		result = isc_task_beginexclusive(named_g_server->task);

bin/named/statschannel.c

@@ -395,6 +395,7 @@ init_desc(void) {
 	SET_RESSTATDESC(serverquota, "spilled due to server quota",
 			"ServerQuota");
 	SET_RESSTATDESC(nextitem, "waited for next item", "NextItem");
+	SET_RESSTATDESC(priming, "priming queries", "Priming");
 
 	INSIST(i == dns_resstatscounter_max);
 
@@ -1615,7 +1616,7 @@ generatexml(named_server_t *server, isc_uint32_t flags,
 			ISC_XMLCHAR "type=\"text/xsl\" href=\"/bind9.xsl\""));
 	TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "statistics"));
 	TRY0(xmlTextWriterWriteAttribute(writer, ISC_XMLCHAR "version",
-					 ISC_XMLCHAR "3.10"));
+					 ISC_XMLCHAR "3.11"));
 
 	/* Set common fields for statistics dump */
 	dumparg.type = isc_statsformat_xml;
@@ -2411,7 +2412,7 @@ generatejson(named_server_t *server, size_t *msglen,
 	/*
 	 * These statistics are included no matter which URL we use.
 	 */
-	obj = json_object_new_string("1.4");
+	obj = json_object_new_string("1.5");
 	CHECKMEM(obj);
 	json_object_object_add(bindstats, "json-stats-version", obj);
 

bin/nsupdate/nsupdate.c

@@ -150,6 +150,7 @@ static dns_dispatch_t *dispatchv4 = NULL;
 static dns_dispatch_t *dispatchv6 = NULL;
 static dns_message_t *updatemsg = NULL;
 static dns_fixedname_t fuserzone;
+static dns_fixedname_t fzname;
 static dns_name_t *userzone = NULL;
 static dns_name_t *zname = NULL;
 static dns_name_t tmpzonename;
@@ -943,16 +944,21 @@ setup_system(void) {
 			case AF_INET:
 				if (have_ipv4) {
 					sa->type.sin.sin_port = htons(dnsport);
+				} else {
+					continue;
 				}
 				break;
 			case AF_INET6:
 				if (have_ipv6) {
 					sa->type.sin6.sin6_port = htons(dnsport);
+				} else {
+					continue;
 				}
 				break;
 			default:
 				fatal("bad family");
 			}
+			INSIST(i < ns_alloc);
 			servers[i++] = *sa;
 		}
 	}
@@ -2390,7 +2396,6 @@ update_completed(isc_task_t *task, isc_event_t *event) {
 		dns_request_destroy(&request);
 		dns_message_renderreset(updatemsg);
 		dns_message_settsigkey(updatemsg, NULL);
-		/* XXX MPA fix zonename is freed already */
 		send_update(zname, &master_servers[master_inuse]);
 		isc_event_free(&event);
 		return;
@@ -2693,13 +2698,17 @@ recvsoa(isc_task_t *task, isc_event_t *event) {
 	dns_name_init(&master, NULL);
 	dns_name_clone(&soa.origin, &master);
 
-	/*
+	if (userzone != NULL) {
-	 * XXXMPA
-	 */
-	if (userzone != NULL)
 		zname = userzone;
-	else
+	} else {
-		zname = name;
+		/*
+		 * Save the zone name in case we need to try a second
+		 * address.
+		 */
+		dns_fixedname_init(&fzname);
+		zname = dns_fixedname_name(&fzname);
+		dns_name_copy(name, zname, NULL);
+	}
 
 	if (debugging) {
 		char namestr[DNS_NAME_FORMATSIZE];

bin/python/dnssec-checkds.8

@@ -39,9 +39,7 @@
 dnssec-checkds \- DNSSEC delegation consistency checking tool
 .SH "SYNOPSIS"
 .HP \w'\fBdnssec\-checkds\fR\ 'u
-\fBdnssec\-checkds\fR [\fB\-l\ \fR\fB\fIdomain\fR\fR] [\fB\-f\ \fR\fB\fIfile\fR\fR] [\fB\-d\ \fR\fB\fIdig\ path\fR\fR] [\fB\-D\ \fR\fB\fIdsfromkey\ path\fR\fR] {zone}
+\fBdnssec\-checkds\fR [\fB\-d\ \fR\fB\fIdig\ path\fR\fR] [\fB\-D\ \fR\fB\fIdsfromkey\ path\fR\fR] [\fB\-f\ \fR\fB\fIfile\fR\fR] [\fB\-l\ \fR\fB\fIdomain\fR\fR] [\fB\-s\ \fR\fB\fIfile\fR\fR] {zone}
-.HP \w'\fBdnssec\-dsfromkey\fR\ 'u
-\fBdnssec\-dsfromkey\fR [\fB\-l\ \fR\fB\fIdomain\fR\fR] [\fB\-f\ \fR\fB\fIfile\fR\fR] [\fB\-d\ \fR\fB\fIdig\ path\fR\fR] [\fB\-D\ \fR\fB\fIdsfromkey\ path\fR\fR] {zone}
 .SH "DESCRIPTION"
 .PP
 \fBdnssec\-checkds\fR
@@ -60,6 +58,12 @@ is specified, then the zone is read from that file to find the DNSKEY records\&.
 Check for a DLV record in the specified lookaside domain, instead of checking for a DS record in the zone\*(Aqs parent\&.
 .RE
 .PP
+\-s \fIfile\fR
+.RS 4
+Specifies a prepared dsset file, such as would be generated by
+\fBdnssec\-signzone\fR, to use as a source for the DS RRset instead of querying the parent\&.
+.RE
+.PP
 \-d \fIdig path\fR
 .RS 4
 Specifies a path to a

bin/python/dnssec-checkds.docbook

@@ -42,20 +42,13 @@
   <refsynopsisdiv>
     <cmdsynopsis sepchar=" ">
       <command>dnssec-checkds</command>
-      <arg choice="opt" rep="norepeat"><option>-l <replaceable class="parameter">domain</replaceable></option></arg>
-      <arg choice="opt" rep="norepeat"><option>-f <replaceable class="parameter">file</replaceable></option></arg>
       <arg choice="opt" rep="norepeat"><option>-d <replaceable class="parameter">dig path</replaceable></option></arg>
       <arg choice="opt" rep="norepeat"><option>-D <replaceable class="parameter">dsfromkey path</replaceable></option></arg>
+      <arg choice="opt" rep="norepeat"><option>-f <replaceable class="parameter">file</replaceable></option></arg>
+      <arg choice="opt" rep="norepeat"><option>-l <replaceable class="parameter">domain</replaceable></option></arg>
+      <arg choice="opt" rep="norepeat"><option>-s <replaceable class="parameter">file</replaceable></option></arg>
       <arg choice="req" rep="norepeat">zone</arg>
     </cmdsynopsis>
-    <cmdsynopsis sepchar=" ">
-      <command>dnssec-dsfromkey</command>
-      <arg choice="opt" rep="norepeat"><option>-l <replaceable class="parameter">domain</replaceable></option></arg>
-      <arg choice="opt" rep="norepeat"><option>-f <replaceable class="parameter">file</replaceable></option></arg>
-      <arg choice="opt" rep="norepeat"><option>-d <replaceable class="parameter">dig path</replaceable></option></arg>
-      <arg choice="opt" rep="norepeat"><option>-D <replaceable class="parameter">dsfromkey path</replaceable></option></arg>
-      <arg choice="req" rep="norepeat">zone</arg>
-   </cmdsynopsis>
   </refsynopsisdiv>
 
   <refsection><info><title>DESCRIPTION</title></info>
@@ -92,6 +85,17 @@
         </listitem>
       </varlistentry>
 
+      <varlistentry>
+        <term>-s <replaceable class="parameter">file</replaceable></term>
+        <listitem>
+          <para>
+            Specifies a prepared dsset file, such as would be generated
+            by <command>dnssec-signzone</command>, to use as a source for
+            the DS RRset instead of querying the parent.
+          </para>
+        </listitem>
+      </varlistentry>
+
       <varlistentry>
         <term>-d <replaceable class="parameter">dig path</replaceable></term>
         <listitem>

bin/python/dnssec-checkds.html

@@ -33,20 +33,13 @@
 <h2>Synopsis</h2>
     <div class="cmdsynopsis"><p>
       <code class="command">dnssec-checkds</code> 
-       [<code class="option">-l <em class="replaceable"><code>domain</code></em></code>]
-       [<code class="option">-f <em class="replaceable"><code>file</code></em></code>]
        [<code class="option">-d <em class="replaceable"><code>dig path</code></em></code>]
        [<code class="option">-D <em class="replaceable"><code>dsfromkey path</code></em></code>]
+       [<code class="option">-f <em class="replaceable"><code>file</code></em></code>]
+       [<code class="option">-l <em class="replaceable"><code>domain</code></em></code>]
+       [<code class="option">-s <em class="replaceable"><code>file</code></em></code>]
        {zone}
     </p></div>
-    <div class="cmdsynopsis"><p>
-      <code class="command">dnssec-dsfromkey</code> 
-       [<code class="option">-l <em class="replaceable"><code>domain</code></em></code>]
-       [<code class="option">-f <em class="replaceable"><code>file</code></em></code>]
-       [<code class="option">-d <em class="replaceable"><code>dig path</code></em></code>]
-       [<code class="option">-D <em class="replaceable"><code>dsfromkey path</code></em></code>]
-       {zone}
-   </p></div>
   </div>
 
   <div class="refsection">
@@ -79,6 +72,14 @@
             instead of checking for a DS record in the zone's parent.
           </p>
         </dd>
+<dt><span class="term">-s <em class="replaceable"><code>file</code></em></span></dt>
+<dd>
+          <p>
+            Specifies a prepared dsset file, such as would be generated
+            by <span class="command"><strong>dnssec-signzone</strong></span>, to use as a source for
+            the DS RRset instead of querying the parent.
+          </p>
+        </dd>
 <dt><span class="term">-d <em class="replaceable"><code>dig path</code></em></span></dt>
 <dd>
           <p>

bin/python/isc/checkds.py.in

@@ -1,5 +1,5 @@
 ############################################################################
-# Copyright (C) 2012-2016  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2012-2017  Internet Systems Consortium, Inc. ("ISC")
 #
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -34,7 +34,11 @@ class SECRR:
         if not rrtext:
             raise Exception
 
-        fields = rrtext.decode('ascii').split()
+        # 'str' does not have decode method in python3
+        if type(rrtext) is not str:
+            fields = rrtext.decode('ascii').split()
+        else:
+            fields = rrtext.split()
         if len(fields) < 7:
             raise Exception
 
@@ -89,35 +93,39 @@ class SECRR:
 # Generate a set of expected DS/DLV records from the DNSKEY RRset,
 # and report on congruency.
 ############################################################################
-def check(zone, args, masterfile=None, lookaside=None):
+def check(zone, args):
     rrlist = []
-    cmd = [args.dig, "+noall", "+answer", "-t", "dlv" if lookaside else "ds",
+    if args.dssetfile:
-           "-q", zone + "." + lookaside if lookaside else zone]
+        fp = open(args.dssetfile).read()
-    fp, _ = Popen(cmd, stdout=PIPE).communicate()
+    else:
+        cmd = [args.dig, "+noall", "+answer", "-t",
+                "dlv" if args.lookaside else "ds", "-q",
+                zone + "." + args.lookaside if args.lookaside else zone]
+        fp, _ = Popen(cmd, stdout=PIPE).communicate()
 
     for line in fp.splitlines():
-        rrlist.append(SECRR(line, lookaside))
+        rrlist.append(SECRR(line, args.lookaside))
     rrlist = sorted(rrlist, key=lambda rr: (rr.keyid, rr.keyalg, rr.hashalg))
 
     klist = []
 
-    if masterfile:
+    if args.masterfile:
-        cmd = [args.dsfromkey, "-f", masterfile]
+        cmd = [args.dsfromkey, "-f", args.masterfile]
-        if lookaside:
+        if args.lookaside:
-            cmd += ["-l", lookaside]
+            cmd += ["-l", args.lookaside]
         cmd.append(zone)
         fp, _ = Popen(cmd, stdout=PIPE).communicate()
     else:
         intods, _ = Popen([args.dig, "+noall", "+answer", "-t", "dnskey",
                            "-q", zone], stdout=PIPE).communicate()
         cmd = [args.dsfromkey, "-f", "-"]
-        if lookaside:
+        if args.lookaside:
-            cmd += ["-l", lookaside]
+            cmd += ["-l", args.lookaside]
         cmd.append(zone)
         fp, _ = Popen(cmd, stdin=PIPE, stdout=PIPE).communicate(intods)
 
     for line in fp.splitlines():
-        klist.append(SECRR(line, lookaside))
+        klist.append(SECRR(line, args.lookaside))
 
     if len(klist) < 1:
         print("No DNSKEY records found in zone apex")
@@ -136,7 +144,8 @@ def check(zone, args, masterfile=None, lookaside=None):
                    rr.keyid, SECRR.hashalgs[rr.hashalg]))
 
     if not found:
-        print("No %s records were found for any DNSKEY" % ("DLV" if lookaside else "DS"))
+        print("No %s records were found for any DNSKEY" %
+                ("DLV" if args.lookaside else "DS"))
 
     return found
 
@@ -151,10 +160,6 @@ def parse_args():
     sbindir = 'bin' if os.name == 'nt' else 'sbin'
 
     parser.add_argument('zone', type=str, help='zone to check')
-    parser.add_argument('-f', '--file', dest='masterfile', type=str,
-                        help='zone master file')
-    parser.add_argument('-l', '--lookaside', dest='lookaside', type=str,
-                        help='DLV lookaside zone')
     parser.add_argument('-d', '--dig', dest='dig',
                         default=os.path.join(prefix(bindir), 'dig'),
                         type=str, help='path to \'dig\'')
@@ -162,6 +167,12 @@ def parse_args():
                         default=os.path.join(prefix(sbindir),
                                              'dnssec-dsfromkey'),
                         type=str, help='path to \'dig\'')
+    parser.add_argument('-f', '--file', dest='masterfile', type=str,
+                        help='zone master file')
+    parser.add_argument('-l', '--lookaside', dest='lookaside', type=str,
+                        help='DLV lookaside zone')
+    parser.add_argument('-s', '--dsset', dest='dssetfile', type=str,
+                        help='prepared DSset file')
     parser.add_argument('-v', '--version', action='version',
                         version=version)
     args = parser.parse_args()
@@ -178,5 +189,5 @@ def parse_args():
 ############################################################################
 def main():
     args = parse_args()
-    found = check(args.zone, args, args.masterfile, args.lookaside)
+    found = check(args.zone, args)
     exit(0 if found else 1)

bin/tests/system/cds/tests.sh

@@ -43,7 +43,7 @@ check_stderr() {
 		[ -s err.$n ] || return 0
 	fi
 	echo "D:stderr did not match '$err'"
-	sed 's/^/D:/' err
+	sed 's/^/D:/' err.$n
 	fail
 }
 

bin/tests/system/checkds/clean.sh

@@ -1,12 +1,10 @@
 #!/bin/sh
 #
-# Copyright (C) 2012-2014, 2016  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2012-2014, 2016, 2017  Internet Systems Consortium, Inc. ("ISC")
 #
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
 
-# $Id$
-
 rm -f checkds.*
 rm -f ns*/named.lock

bin/tests/system/checkds/dig.pl

@@ -1,13 +1,11 @@
 #!/usr/bin/perl
 #
-# Copyright (C) 2014, 2016  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2014, 2016, 2017  Internet Systems Consortium, Inc. ("ISC")
 #
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
 
-# $Id$
-
 my $arg;
 my $ext;
 my $file;

bin/tests/system/checkds/dig.sh

@@ -1,14 +1,11 @@
 #!/bin/sh
 #
-# Copyright (C) 2012, 2013, 2016  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2012, 2013, 2016, 2017  Internet Systems Consortium, Inc. ("ISC")
 #
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
 
-# $Id$
-
-
 while [ "$#" != 0 ]; do
     case $1 in
     +*) shift ;;

bin/tests/system/checkds/prep.example.db

@@ -0,0 +1,121 @@
+; File written on Thu Oct  5 23:44:34 2017
+; dnssec_signzone version 9.12.0a1
+prep.example.		300	IN SOA	ns1.prep.example. hostmaster.prep.example. (
+					1          ; serial
+					2000       ; refresh (33 minutes 20 seconds)
+					2000       ; retry (33 minutes 20 seconds)
+					1814400    ; expire (3 weeks)
+					3600       ; minimum (1 hour)
+					)
+			300	RRSIG	SOA 8 2 300 (
+					20171105054434 20171006054434 19260 prep.example.
+					1fX0z7Swu4gMPews/ZE8bzNg+JXNedFBDGIH
+					PTSfVQtVLIvRWpME+PylX7MdVMZE/PST+x4/
+					mWyveyjetEOo7/7aQL236FfI0y6TxQFy7HwC
+					FMieqoQCUluuKOvToxg4vUp4GOdlUGbqC63h
+					DbX5Z37VptJXLkt4niF4Kl2iD+U9/bk7HAEU
+					4zDiKroYnusGKfVB9xAWddzoHdLxhVuPi7ut
+					328suPdgX0bfs7uB+y4cikhGzAmPpNMlGHju
+					qYG74NcFGQNutLB7ayx/m87t7mTty7jbNKm3
+					QWJSPf5IR8/kmzAi8HMnapY5vUmm+hX8JOfU
+					UtH7i0iEsUqRbEwu5A== )
+			300	NS	ns1.prep.example.
+			300	RRSIG	NS 8 2 300 (
+					20171105054434 20171006054434 19260 prep.example.
+					u5sU2cfqNqIyCLw18ZNnFw28/GyRt0EOiPYS
+					dygmpfMDrvDaxjiiai8zWYjnl/E3qzVH9Zku
+					07lEDORZdVb0uCDe1NynjAyw4AHps85cAwVc
+					8HTSbzdVZsQTELpunYFJffh24PDr9unw7KOY
+					jzTP6qNedJ1uM54TOr177zfmBh7N2fkAoGyV
+					NjvTKrlgDYGNIn8/YMgHb4sNgyfe54MYY00f
+					kehVxfKnRCgDsbJ0Pk6jhBMCQWvOh8jG8WyV
+					ElAa/eMqlxUC1idF8ydWefjsI/7lPcjSalw9
+					qZw4CDCLHHZy0TOSmCYRRZuIeVXzBfDPJyi4
+					2A3iLntKFJ4AOLFMJg== )
+			3600	NSEC	ns1.prep.example. NS SOA RRSIG NSEC DNSKEY
+			3600	RRSIG	NSEC 8 2 3600 (
+					20171105054434 20171006054434 19260 prep.example.
+					Aed99/jdG82YAkKVWjoKOsAGtB3JnyKkCaAq
+					zgMrYkXU41y3KDCAmGzooGPQY7NN+WxX7FJ2
+					1nXkgljma/azgpsbi9ssneFtv7PPFClVmN+u
+					j+mM4MK/ZR7eJOsMqETg4PAO5VAh6c/GVmyA
+					RD/m6EhJVZEjPfLWbDoC4hVAgem7DP/NMjyI
+					GfztpDjMmyLQyv6tL+UEXSJHGp3ZEa5Z5i7X
+					Nl/bRTUlZs7L4rTgoqHv6LEmsXKAf9rZYq4b
+					eP6GF9I1Ry41MfHLc7lPUmtR38ErEsM5uGzw
+					trCQYEFhuRWUBxZ8OSL2EZK9rUBXZX+cwK/8
+					ZP7mIfDfljkXPQcmow== )
+			3600	DNSKEY	256 3 8 (
+					AwEAAfMzj6aZIgZDVcpH1pKOtq998E85+nEY
+					YJa0lLS8+QTCC1Efke8GLwsXT0IPTuwnOuXM
+					RjySirab0NuEr69T8KP/43YxcRdmCg89mjjN
+					szoVPPstC9xBKVOc0pRMDF7sfsTrSye3RY7+
+					Z6uZEH5FOAkz2hNbJJHOn4HpNUhLPJGRauhf
+					0evamwUmQ/mlhkVW5q4WmqPCDMNY3K6XtkEm
+					cvm8n9ZCXC9Z5AX6KpynujzLdKyxpdGqUk6r
+					lavp9ILPpRKoTZDX+2q1pDgP5cDndwtgNSvU
+					DBQZoD0psS2cyB3PHo+dPwwpEyM//ZSKsH9m
+					e85Ti0413TOWFyFd/jUOUA8=
+					) ; ZSK; alg = RSASHA256 ; key id = 19260
+			3600	DNSKEY	257 3 8 (
+					AwEAAbV8X06Qvk350aZ6eZ1d7WbT1H/Y0Sv7
+					qAdbk5fbYIKpMvZ8D9xqoTHgD0z0uCgWWIcm
+					/xyKBfmax76oLwMBpR/kdtuJz0irgFITnJCH
+					pEfR9AJ/Mfm7NyMglq+/39I03E1/LXvpXQLG
+					tg+Mo/2CUE5sbG31jmPNK/2J8RMESkIi87fW
+					azZU/oyUEtECE5PGbdyw+4PacAsXNjnwl30T
+					aatL277wX4pt+IUPdE6EIph3t+dxXJ7OpHgW
+					8g+YSHLlCImLVapdg3oD/cs6ncaBq9z7la5Y
+					dHNw2QAIAvQ11EsonrkonPqO6zNVZAVdT2VB
+					X5YzGAoCFUvbCvlnl2a7SxM=
+					) ; KSK; alg = RSASHA256 ; key id = 65482
+			3600	RRSIG	DNSKEY 8 2 3600 (
+					20171105054434 20171006054434 19260 prep.example.
+					pPw81pJ3PeF+tqEswTul9N8Qsl9JKgK4v8SV
+					lPfP0pnlMBMbtMFFkx5ZmhQg3Z3U8SdE64Bt
+					C5St3qItyyKdTQ0Rbm9mfV6twxDB8lVry8F7
+					Pv7gJmmcWzBcbLGcrXIrVNSZhigkemQXTElj
+					P8y1j7kaNFWBWbDMn7KesiZ9BiC6sqvuKa3R
+					wSofjwXTESspWZP0NtXr5ymaBIMR9UtNj5Wh
+					jm1+tg6BxNBKxhCHlSC0ltPS/qq9J1ZUmtJz
+					sj/EAFfPVJVuEveebMvi1oDWPTgajO9+EHl4
+					ELrgnQHCgaybMzbpd/A5+Tr1hQkv48I8Mb0/
+					8LJ2/6xrvJm64yRteg== )
+			3600	RRSIG	DNSKEY 8 2 3600 (
+					20171105054434 20171006054434 65482 prep.example.
+					WeIWiC9SnBe2+UocVjpap62O8Rz+iljwJiu9
+					VlGUwct3Vydq4/4FVAKdPklXV5cYbBLhO2MB
+					3R4toX8RNU/0Ny8DnugQzLKvVfg0xoyU/UAJ
+					k4aWa/vPivSLGouLQPiNp71bdXN4LB/2xmzu
+					cPYXzS9ePpwCOp/9JLoNjBSMQkfjfWAcaNtj
+					1DKDmHHL1sPMizninxSJLQOAKb+JwUAjAkOM
+					O1JqwkB12/IZuzxN5hly+uNsbFFxPzQkcnJ4
+					5bhzxuh5D/JRXW0nF5aO4aR+9X+lSUpDJQZ1
+					5fOt1cybZCn/ag68RA92zrnisdbrggJGS003
+					wn/VKbLVfFj3eQrfNA== )
+ns1.prep.example.	300	IN A	1.1.1.1
+			300	RRSIG	A 8 3 300 (
+					20171105054434 20171006054434 19260 prep.example.
+					QUyDyJVk3JGEq+VTZtY3firzsRqOA0LUm3Tf
+					/fnemQBeOlMda2ErA7DqYVriIGfM8jph416E
+					YX8SKAZXGEAlsEbC9cWBVyc5TYH6tZ43sV51
+					55kGTiUY92NnrH10Q+m2SLAEEaKCA/cgBwOR
+					tN2Wb1meHgiLbGYN2LbANfDQzoEk4AYAgT6r
+					wDKVVg/V9Ed7JnCnBQc9MN9+LQ3h4NBGUiEY
+					mr7HX2w+yzqcGFNLI1aFPe2IwFt120QPLyyl
+					cZgc6FUBX4YCnWoCb0aFyyOT76AQkKF5YBRn
+					gAv6S8q1pZ/0B5w4gjaLEGlts3LG0bxZ1GJd
+					gCQMEhgYgyXUchTtZA== )
+			3600	NSEC	prep.example. A RRSIG NSEC
+			3600	RRSIG	NSEC 8 3 3600 (
+					20171105054434 20171006054434 19260 prep.example.
+					rDWN40u1a3DSzWOrS+4YR2XOxaem0BAQ/glN
+					QkXNDew1WsZo3fe0IHIhDKlJ/5MJAfAHq8Xs
+					A5UGUw2efoNAN/0LuWsI/9IPm4dwQOXiTCly
+					uxugXf5islPYyvn1Z14ay/7/2P3W6HZknXzo
+					lZFpwqfFZQCxz7c/1aH+2ntAMeqx8LHuewSr
+					Rz/sLsSiCcZQ6NMWnZdoC5SGy4CTcIIPPS8z
+					9dQ6QYTC5iq4MKRfyJUyvODyU9be4e6jbo5b
+					mjRcov4ttbImhD5jrLAZIfjO6DSazGNVFf/x
+					6rjxjrc8SISPkt2xYwcOlYch9OZuoH86wcZu
+					3Don6yAnLDYDrZylAA== )

bin/tests/system/checkds/prep.example.ds.db

@@ -0,0 +1,8 @@
+; Copyright (C) 2017  Internet Systems Consortium, Inc. ("ISC")
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0. If a copy of the MPL was not distributed with this
+; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+prep.example.		IN DS 65482 8 1 F3673708FBADDEC3EB55933E2E393ACE85EAC2BB
+prep.example.		IN DS 65482 8 2 51A7C97AAC42803DA515D1CAFEE28031A5018F6345F12F4B6C1B6D20 02B59820

bin/tests/system/checkds/tests.sh

@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# Copyright (C) 2012-2014, 2016  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2012-2014, 2016, 2017  Internet Systems Consortium, Inc. ("ISC")
 #
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -171,6 +171,15 @@ n=`expr $n + 1`
 if [ $ret != 0 ]; then echo "I:failed"; fi
 status=`expr $status + $ret`
 
+echo "I:checking with prepared dsset file ($n)"
+ret=0
+$CHECKDS -f prep.example.db -s prep.example.ds.db prep.example > checkds.out.$n || ret=1
+grep 'SHA-1.*found' checkds.out.$n > /dev/null 2>&1 || ret=1
+grep 'SHA-256.*found' checkds.out.$n > /dev/null 2>&1 || ret=1
+n=`expr $n + 1`
+if [ $ret != 0 ]; then echo "I:failed"; fi
+status=`expr $status + $ret`
+
 if [ $status = 0 ]; then $SHELL clean.sh; fi
 echo "I:exit status: $status"
 [ $status -eq 0 ] || exit 1

bin/tests/system/masterformat/tests.sh

@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# Copyright (C) 2005, 2007, 2011-2014, 2016  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2005, 2007, 2011-2014, 2016, 2017  Internet Systems Consortium, Inc. ("ISC")
 #
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -238,6 +238,16 @@ done
 [ $ret -eq 0 ] || echo "I:failed"
 status=`expr $status + $ret`
 
+# stomp on the file header
+echo "I:checking corrupt map files fail to load (bad file header)"
+ret=0
+./named-compilezone -D -f text -F map -o map.5 example.nil baseline.txt > /dev/null
+cp map.5 badmap
+stomp badmap 0 32 99
+./named-compilezone -D -f map -F text -o text.5 example.nil badmap > /dev/null
+[ $? = 1 ] || ret=1
+[ $ret -eq 0 ] || echo "I:failed"
+status=`expr $status + $ret`
 # stomp on the file data so it hashes differently.
 # these are small and subtle changes, so that the resulting file
 # would appear to be a legitimate map file and would not trigger an
@@ -245,7 +255,6 @@ status=`expr $status + $ret`
 # load because of a SHA1 hash mismatch.
 echo "I:checking corrupt map files fail to load (bad node header)"
 ret=0
-./named-compilezone -D -f text -F map -o map.5 example.nil baseline.txt > /dev/null
 cp map.5 badmap
 stomp badmap 2754 2 99
 ./named-compilezone -D -f map -F text -o text.5 example.nil badmap > /dev/null

bin/tests/system/mkeys/README

@@ -16,16 +16,8 @@ is used so it will send TAT queries once per second.
 
 ns3 is a validator with a broken key in managed-keys.
 
-Tests TODO:
+ns4 is a validator with a deliberately broken managed-keys.bind and
+managed-keys.jnl, causing RFC 5011 initialization to fail.
 
-- initial working KSK
+ns5 is a validator which is prevented from getting a response from the
-
+root server, causing key refresh queries to fail.
-TODO: test using delv with new trusted key too
-
-- introduce a REVOKE bit
-
-- later remove a signature
-
-- corrupt a signature
-
-TODO: also same things with dlv auto updates of trust anchor

bin/tests/system/mkeys/clean.sh

@@ -10,8 +10,10 @@ rm -f */K* */*.signed */trusted.conf */*.jnl */*.bk
 rm -f dsset-. ns1/dsset-.
 rm -f ns*/named.lock
 rm -f */managed-keys.bind* */named.secroots
-rm -f */managed.conf ns1/managed.key ns1/managed.key.id
+rm -f */managed*.conf ns1/managed.key ns1/managed.key.id
 rm -f */named.memstats */named.run
 rm -f dig.out* delv.out* rndc.out* signer.out*
 rm -f ns1/named.secroots ns1/root.db.signed* ns1/root.db.tmp
 rm -f ns1/named.conf
+rm -rf ns4/nope
+rm -f ns5/named.args

bin/tests/system/mkeys/ns1/named1.conf

@@ -10,6 +10,11 @@
 
 controls { /* empty */ };
 
+acl allowed {
+	! 10.53.0.5;
+	any;
+};
+
 options {
 	query-source address 10.53.0.1;
 	notify-source 10.53.0.1;
@@ -22,6 +27,7 @@ options {
 	notify no;
 	dnssec-enable yes;
 	dnssec-validation yes;
+	allow-query { allowed; };
 };
 
 key rndc_key {

bin/tests/system/mkeys/ns1/named2.conf

@@ -10,6 +10,11 @@
 
 controls { /* empty */ };
 
+acl allowed {
+	! 10.53.0.5;
+	any;
+};
+
 options {
 	query-source address 10.53.0.1;
 	notify-source 10.53.0.1;
@@ -22,6 +27,7 @@ options {
 	notify no;
 	dnssec-enable yes;
 	dnssec-validation yes;
+	allow-query { allowed; };
 };
 
 key rndc_key {

bin/tests/system/mkeys/ns1/named3.conf

@@ -0,0 +1,39 @@
+/*
+ * Copyright (C) 2017  Internet Systems Consortium, Inc. ("ISC")
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ */
+
+// NS1
+
+controls { /* empty */ };
+
+options {
+	query-source address 10.53.0.1;
+	notify-source 10.53.0.1;
+	transfer-source 10.53.0.1;
+	port 5300;
+	pid-file "named.pid";
+	listen-on { 10.53.0.1; };
+	listen-on-v6 { none; };
+	recursion no;
+	notify no;
+	dnssec-enable yes;
+	dnssec-validation yes;
+};
+
+key rndc_key {
+	secret "1234abcd8765";
+	algorithm hmac-sha256;
+};
+
+controls {
+	inet 10.53.0.1 port 9953 allow { any; } keys { rndc_key; };
+};
+
+zone "." {
+	type master;
+	file "root.db.signed";
+};

bin/tests/system/mkeys/ns1/sign.sh

@@ -28,6 +28,8 @@ managed-keys {
 EOF
 ' > managed.conf
 cp managed.conf ../ns2/managed.conf
+cp managed.conf ../ns4/managed.conf
+cp managed.conf ../ns5/managed.conf
 
 # Configure a trusted key statement (used by delve)
 cat $keyname.key | grep -v '^; ' | $PERL -n -e '

bin/tests/system/mkeys/ns2/named.args

@@ -1 +1 @@
--m record,size,mctx -T clienttest -c named.conf -d 99 -X named.lock -g -T mkeytimers=2/20/40
+-m record,size,mctx -T clienttest -c named.conf -d 99 -X named.lock -g -T mkeytimers=2/20/40 -T tat=1

bin/tests/system/mkeys/ns4/named.conf

@@ -0,0 +1,41 @@
+/*
+ * Copyright (C) 2017  Internet Systems Consortium, Inc. ("ISC")
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ */
+
+// NS4
+
+controls { /* empty */ };
+
+options {
+	query-source address 10.53.0.4;
+	notify-source 10.53.0.4;
+	transfer-source 10.53.0.4;
+	port 5300;
+	pid-file "named.pid";
+	listen-on { 10.53.0.4; };
+	listen-on-v6 { none; };
+	recursion yes;
+	notify no;
+	dnssec-enable yes;
+	dnssec-validation auto;
+	bindkeys-file "managed.conf";
+	managed-keys-directory "nope";
+};
+
+key rndc_key {
+	secret "1234abcd8765";
+	algorithm hmac-sha256;
+};
+
+controls {
+	inet 10.53.0.4 port 9953 allow { any; } keys { rndc_key; };
+};
+
+zone "." {
+	type hint;
+	file "../../common/root.hint";
+};

bin/tests/system/mkeys/ns5/named.conf

@@ -0,0 +1,38 @@
+/*
+ * Copyright (C) 2017  Internet Systems Consortium, Inc. ("ISC")
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ */
+
+// NS5
+
+options {
+	query-source address 10.53.0.5;
+	notify-source 10.53.0.5;
+	transfer-source 10.53.0.5;
+	port 5300;
+	pid-file "named.pid";
+	listen-on { 10.53.0.5; };
+	listen-on-v6 { none; };
+	recursion yes;
+	notify no;
+	dnssec-enable yes;
+	dnssec-validation auto;
+	bindkeys-file "managed.conf";
+};
+
+key rndc_key {
+	secret "1234abcd8765";
+	algorithm hmac-sha256;
+};
+
+controls {
+	inet 10.53.0.5 port 9953 allow { any; } keys { rndc_key; };
+};
+
+zone "." {
+	type hint;
+	file "../../common/root.hint";
+};

bin/tests/system/mkeys/ns5/named1.args

@@ -0,0 +1 @@
+-m record,size,mctx -T clienttest -c named.conf -d 99 -X named.lock -g

bin/tests/system/mkeys/ns5/named2.args

@@ -0,0 +1 @@
+-m record,size,mctx -T clienttest -c named.conf -d 99 -X named.lock -g -T mkeytimers=2/20/40

bin/tests/system/mkeys/setup.sh

@@ -14,5 +14,14 @@ $SHELL clean.sh
 test -r $RANDFILE || $GENRANDOM 800 $RANDFILE
 
 cp ns1/named1.conf ns1/named.conf
+cp ns5/named1.args ns5/named.args
 
-cd ns1 && $SHELL sign.sh
+( cd ns1 && $SHELL sign.sh )
+
+cp ns2/managed.conf ns2/managed1.conf
+
+cd ns4
+mkdir nope
+touch nope/managed-keys.bind
+touch nope/managed.keys.bind.jnl
+chmod 444 nope/*

bin/tests/system/mkeys/tests.sh

@@ -215,9 +215,36 @@ t2=`grep "trust pending" ns2/managed-keys.bind`
 if [ $ret != 0 ]; then echo "I:failed"; fi
 status=`expr $status + $ret`
 
-echo "I: reinitialize trust anchors"
+echo "I: reinitialize trust anchors, add second key to bind.keys"
 $PERL $SYSTEMTESTTOP/stop.pl --use-rndc . ns2
 rm -f ns2/managed-keys.bind*
+cat ns1/$standby1.key | grep -v '^; ' | $PERL -n -e '
+local ($dn, $class, $type, $flags, $proto, $alg, @rest) = split;
+local $key = join("", @rest);
+local $originalkey = `grep initial-key ns2/managed1.conf`;
+print <<EOF
+managed-keys {
+    $originalkey
+    "$dn" initial-key $flags $proto $alg "$key";
+};
+EOF
+' > ns2/managed.conf
+$PERL $SYSTEMTESTTOP/start.pl --noclean --restart . ns2
+
+n=`expr $n + 1`
+echo "I: check that no key from bind.keys is marked as an initializing key ($n)"
+ret=0
+sleep 3
+$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 secroots | sed 's/^/I: ns2 /'
+sleep 1
+grep '; initializing' ns2/named.secroots > /dev/null 2>&1 && ret=1
+if [ $ret != 0 ]; then echo "I:failed"; fi
+status=`expr $status + $ret`
+
+echo "I: reinitialize trust anchors, revert to one key in bind.keys"
+$PERL $SYSTEMTESTTOP/stop.pl --use-rndc . ns2
+rm -f ns2/managed-keys.bind*
+mv ns2/managed1.conf ns2/managed.conf
 $PERL $SYSTEMTESTTOP/start.pl --noclean --restart . ns2
 
 n=`expr $n + 1`
@@ -446,7 +473,6 @@ rm -f ${revoked}.key ${revoked}.private
 $SETTIME -D none -R none -K ns1 `cat ns1/managed.key` > /dev/null
 $SETTIME -D now -K ns1 $standby1 > /dev/null
 $SETTIME -D now -K ns1 $standby2 > /dev/null
-$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 flush | sed 's/^/I: ns1 /'
 sleep 1
 $SIGNER -Sg -K ns1 -N unixtime -r $RANDFILE -o . ns1/root.db > /dev/null 2>&-
 $RNDC -c ../common/rndc.conf -s 10.53.0.1 -p 9953 reload . | sed 's/^/I: ns1 /'
@@ -454,6 +480,7 @@ sleep 3
 $RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys refresh | sed 's/^/I: ns2 /'
 sleep 1
 $RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys status > rndc.out.$n 2>&1
+$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 flush | sed 's/^/I: ns1 /'
 $DIG $DIGOPTS +noauth example. @10.53.0.2 txt > dig.out.ns2.test$n || ret=1
 grep "flags:.*ad.*QUERY" dig.out.ns2.test$n > /dev/null || ret=1
 grep "example..*.RRSIG..*TXT" dig.out.ns2.test$n > /dev/null || ret=1
@@ -537,14 +564,14 @@ status=`expr $status + $ret`
 n=`expr $n + 1`
 echo "I: check that trust-anchor-telemetry queries are logged ($n)"
 ret=0
-grep "sending trust-anchor-telemetry query '_ta-[0-9a-f]*/NULL" ns3/named.run > /dev/null || ret=1
+grep "sending trust-anchor-telemetry query '_ta-[0-9a-f]*/NULL" ns2/named.run > /dev/null || ret=1
 if [ $ret != 0 ]; then echo "I:failed"; fi
 status=`expr $status + $ret`
 
 n=`expr $n + 1`
 echo "I: check that trust-anchor-telemetry queries are received ($n)"
 ret=0
-grep "query '_ta-[0-9a-f]*/NULL/IN' approved" ns1/named.run > /dev/null || ret=1
+grep "query '_ta-[0-9a-f][0-9a-f]*/NULL/IN' approved" ns1/named.run > /dev/null || ret=1
 if [ $ret != 0 ]; then echo "I:failed"; fi
 status=`expr $status + $ret`
 
@@ -562,5 +589,82 @@ grep "name: \." rndc.out.$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo "I:failed"; fi
 status=`expr $status + $ret`
 
+n=`expr $n + 1`
+echo "I: check that trust-anchor-telemetry queries contain the correct key ($n)"
+ret=0
+# convert the hexadecimal key from the TAT query into decimal and
+# compare against the known key.
+tathex=`grep "query '_ta-[0-9a-f][0-9a-f]*/NULL/IN' approved" ns1/named.run | awk '{print $6; exit 0}' | sed -e 's/(_ta-\([0-9a-f][0-9a-f]*\)):/\1/'`
+tatkey=`$PERL -e 'printf("%d\n", hex(@ARGV[0]));' $tathex`
+realkey=`$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 secroots - | grep '; managed' | sed 's#.*SHA256/\([0-9][0-9]*\) ; managed.*#\1#'`
+[ "$tatkey" -eq "$realkey" ] || ret=1
+if [ $ret != 0 ]; then echo "I:failed"; fi
+status=`expr $status + $ret`
+
+n=`expr $n + 1`
+echo "I: check initialization fails if managed-keys can't be created ($n)"
+ret=0
+$RNDC -c ../common/rndc.conf -s 10.53.0.4 -p 9953 secroots | sed 's/^/I: ns4 /'
+grep '; initializing managed' ns4/named.secroots > /dev/null 2>&1 || ret=1
+grep '; managed' ns4/named.secroots > /dev/null 2>&1 && ret=1
+grep '; trusted' ns4/named.secroots > /dev/null 2>&1 && ret=1
+if [ $ret != 0 ]; then echo "I:failed"; fi
+status=`expr $status + $ret`
+
+n=`expr $n + 1`
+echo "I: check failure to contact root servers does not prevent key refreshes after restart ($n)"
+ret=0
+# By the time we get here, ns5 should have attempted refreshing its managed
+# keys.  These attempts should fail as ns1 is configured to REFUSE all queries
+# from ns5.  Note that named1.args does not contain "-T mkeytimers"; this is to
+# ensure key refresh retry will be scheduled to one actual hour after the first
+# key refresh failure instead of just a few seconds, in order to prevent races
+# between the next scheduled key refresh time and startup time of restarted ns5.
+$PERL $SYSTEMTESTTOP/stop.pl --use-rndc . ns5
+$PERL $SYSTEMTESTTOP/start.pl --noclean --restart . ns5
+sleep 2
+# ns5/named.run will contain logs from both the old instance and the new
+# instance.  In order for the test to pass, both must attempt a fetch.
+count=`grep -c "Creating key fetch" ns5/named.run`
+[ $count -lt 2 ] && ret=1
+if [ $ret != 0 ]; then echo "I:failed"; fi
+status=`expr $status + $ret`
+
+n=`expr $n + 1`
+echo "I: check key refreshes are resumed after root servers become available ($n)"
+ret=0
+$PERL $SYSTEMTESTTOP/stop.pl --use-rndc . ns5
+# Prevent previous check from affecting this one
+rm -f ns2/managed-keys.bind*
+# named2.args adds "-T mkeytimers=2/20/40" to named1.args as we need to wait for
+# an "hour" until keys are refreshed again after initial failure
+cp ns5/named2.args ns5/named.args
+$PERL $SYSTEMTESTTOP/start.pl --noclean --restart . ns5
+sleep 2
+$RNDC -c ../common/rndc.conf -s 10.53.0.5 -p 9953 secroots | sed 's/^/I: ns4 /'
+sleep 1
+grep '; initializing managed' ns5/named.secroots > /dev/null 2>&1 || ret=1
+# ns1 should still REFUSE queries from ns5, so resolving should be impossible
+$DIG $DIGOPTS +noauth example. @10.53.0.5 txt > dig.out.ns5.a.test$n || ret=1
+grep "flags:.*ad.*QUERY" dig.out.ns5.a.test$n > /dev/null && ret=1
+grep "example..*.RRSIG..*TXT" dig.out.ns5.a.test$n > /dev/null && ret=1
+grep "status: SERVFAIL" dig.out.ns5.a.test$n > /dev/null || ret=1
+# Allow queries from ns5 to ns1
+cp ns1/named3.conf ns1/named.conf
+rm -f ns1/root.db.signed.jnl
+$RNDC -c ../common/rndc.conf -s 10.53.0.1 -p 9953 reconfig
+sleep 3
+$RNDC -c ../common/rndc.conf -s 10.53.0.5 -p 9953 secroots | sed 's/^/I: ns4 /'
+sleep 1
+grep '; managed' ns5/named.secroots > /dev/null 2>&1 || ret=1
+# ns1 should not longer REFUSE queries from ns5, so managed keys should be
+# correctly refreshed and resolving should succeed
+$DIG $DIGOPTS +noauth example. @10.53.0.5 txt > dig.out.ns5.b.test$n || ret=1
+grep "flags:.*ad.*QUERY" dig.out.ns5.b.test$n > /dev/null || ret=1
+grep "example..*.RRSIG..*TXT" dig.out.ns5.b.test$n > /dev/null || ret=1
+grep "status: NOERROR" dig.out.ns5.b.test$n > /dev/null || ret=1
+if [ $ret != 0 ]; then echo "I:failed"; fi
+status=`expr $status + $ret`
+
 echo "I:exit status: $status"
 [ $status -eq 0 ] || exit 1

bin/tests/system/smartsign/tests.sh

@@ -342,8 +342,8 @@ status=`expr $status + $ret`
 
 echo "I:checking sync record publication"
 ret=0
-grep CDNSKEY $cfile.signed > /dev/null || ret=1
+grep -w CDNSKEY $cfile.signed > /dev/null || ret=1
-grep CDS $cfile.signed > /dev/null || ret=1
+grep -w CDS $cfile.signed > /dev/null || ret=1
 if [ $ret != 0 ]; then echo "I:failed"; fi
 status=`expr $status + $ret`
 
@@ -352,8 +352,8 @@ ret=0
 $SETTIME -P now -A now -Dsync now ${cksk5} > /dev/null
 $SIGNER -Sg -r $RANDFILE -o $czone -f $cfile.new $cfile.signed > /dev/null 2>&1
 mv $cfile.new $cfile.signed
-grep CDNSKEY $cfile.signed > /dev/null && ret=1
+grep -w CDNSKEY $cfile.signed > /dev/null && ret=1
-grep CDS $cfile.signed > /dev/null && ret=1
+grep -w CDS $cfile.signed > /dev/null && ret=1
 if [ $ret != 0 ]; then echo "I:failed"; fi
 status=`expr $status + $ret`
 

bin/tests/system/statistics/tests.sh

@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# Copyright (C) 2012, 2015, 2016  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2012, 2015-2017  Internet Systems Consortium, Inc. ("ISC")
 #
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -137,5 +137,12 @@ fi
 if [ $ret != 0 ]; then echo "I:failed"; fi
 status=`expr $status + $ret`
 
+ret=0
+n=`expr $n + 1`
+echo "I:checking priming queries are counted ($n)"
+grep "1 priming queries" ns3/named.stats
+if [ $ret != 0 ]; then echo "I:failed"; fi
+status=`expr $status + $ret`
+
 echo "I:exit status: $status"
 [ $status -eq 0 ] || exit 1

bin/tools/.gitignore

@@ -1,7 +1,6 @@
 arpaname
 dnstap-read
 genrandom
-isc-hmac-fixup
 mdig
 named-journalprint
 named-nzd2nzf

bin/tools/Makefile.in

@@ -38,21 +38,21 @@ DNSTAPTARGETS =	dnstap-read@EXEEXT@
 NZDTARGETS =	named-nzd2nzf@EXEEXT@
 TARGETS =	arpaname@EXEEXT@ named-journalprint@EXEEXT@ \
 		named-rrchecker@EXEEXT@ nsec3hash@EXEEXT@ \
-		genrandom@EXEEXT@ isc-hmac-fixup@EXEEXT@ mdig@EXEEXT@ \
+		genrandom@EXEEXT@ mdig@EXEEXT@ \
 		@DNSTAPTARGETS@ @NZDTARGETS@
 
 DNSTAPSRCS  =	dnstap-read.c
 NZDSRCS  =	named-nzd2nzf.c
 SRCS =		arpaname.c named-journalprint.c named-rrchecker.c \
-		nsec3hash.c genrandom.c isc-hmac-fixup.c mdig.c \
+		nsec3hash.c genrandom.c mdig.c \
 		@DNSTAPSRCS@ @NZDSRCS@
 
 MANPAGES =	arpaname.1 dnstap-read.1 genrandom.8 \
-		isc-hmac-fixup.8 mdig.1 named-journalprint.8 \
+		mdig.1 named-journalprint.8 \
 		named-nzd2nzf.8 named-rrchecker.1 nsec3hash.8
 
 HTMLPAGES =	arpaname.html dnstap-read.html genrandom.html \
-		isc-hmac-fixup.html mdig.html named-journalprint.html \
+		mdig.html named-journalprint.html \
 		named-nzd2nzf.html named-rrchecker.html nsec3hash.html
 
 MANOBJS =	${MANPAGES} ${HTMLPAGES}
@@ -78,11 +78,6 @@ nsec3hash@EXEEXT@: nsec3hash.@O@ ${ISCDEPLIBS} ${DNSDEPLIBS}
 	export LIBS0="${DNSLIBS} ${ISCLIBS}"; \
 	${FINALBUILDCMD}
 
-isc-hmac-fixup@EXEEXT@: isc-hmac-fixup.@O@ ${ISCDEPLIBS}
-	export BASEOBJS="isc-hmac-fixup.@O@"; \
-	export LIBS0="${ISCLIBS}"; \
-	${FINALBUILDCMD}
-
 genrandom@EXEEXT@: genrandom.@O@
 	${LIBTOOL_MODE_LINK} ${PURIFY} ${CC} ${CFLAGS} ${LDFLAGS} \
 		-o $@ genrandom.@O@ @GENRANDOMLIB@ ${LIBS}
@@ -134,12 +129,9 @@ install:: ${TARGETS} installdirs @DNSTAP@ @NZD_TOOLS@
 		${DESTDIR}${sbindir}
 	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} genrandom@EXEEXT@ \
 		${DESTDIR}${sbindir}
-	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} isc-hmac-fixup@EXEEXT@ \
-		${DESTDIR}${sbindir}
 	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} mdig@EXEEXT@ \
 		${DESTDIR}${bindir}
 	${INSTALL_DATA} ${srcdir}/arpaname.1 ${DESTDIR}${mandir}/man1
-	${INSTALL_DATA} ${srcdir}/isc-hmac-fixup.8 ${DESTDIR}${mandir}/man8
 	${INSTALL_DATA} ${srcdir}/named-journalprint.8 ${DESTDIR}${mandir}/man8
 	${INSTALL_DATA} ${srcdir}/named-rrchecker.1 ${DESTDIR}${mandir}/man1
 	${INSTALL_DATA} ${srcdir}/nsec3hash.8 ${DESTDIR}${mandir}/man8
@@ -152,12 +144,9 @@ uninstall::
 	rm -f ${DESTDIR}${mandir}/man8/nsec3hash.8
 	rm -f ${DESTDIR}${mandir}/man1/named-rrchecker.1
 	rm -f ${DESTDIR}${mandir}/man8/named-journalprint.8
-	rm -f ${DESTDIR}${mandir}/man8/isc-hmac-fixup.8
 	rm -f ${DESTDIR}${mandir}/man1/arpaname.1
 	${LIBTOOL_MODE_UNINSTALL} rm -f \
 		${DESTDIR}${bindir}/mdig@EXEEXT@
-	${LIBTOOL_MODE_UNINSTALL} rm -f \
-		${DESTDIR}${sbindir}/isc-hmac-fixup@EXEEXT@
 	${LIBTOOL_MODE_UNINSTALL} rm -f \
 		${DESTDIR}${sbindir}/genrandom@EXEEXT@
 	${LIBTOOL_MODE_UNINSTALL} rm -f \

bin/tools/isc-hmac-fixup.8

@@ -1,69 +0,0 @@
-.\" Copyright (C) 2010, 2013-2016 Internet Systems Consortium, Inc. ("ISC")
-.\" 
-.\" This Source Code Form is subject to the terms of the Mozilla Public
-.\" License, v. 2.0. If a copy of the MPL was not distributed with this
-.\" file, You can obtain one at http://mozilla.org/MPL/2.0/.
-.\"
-.hy 0
-.ad l
-'\" t
-.\"     Title: isc-hmac-fixup
-.\"    Author: 
-.\" Generator: DocBook XSL Stylesheets v1.78.1 <http://docbook.sf.net/>
-.\"      Date: 2013-04-28
-.\"    Manual: BIND9
-.\"    Source: ISC
-.\"  Language: English
-.\"
-.TH "ISC\-HMAC\-FIXUP" "8" "2013\-04\-28" "ISC" "BIND9"
-.\" -----------------------------------------------------------------
-.\" * Define some portability stuff
-.\" -----------------------------------------------------------------
-.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-.\" http://bugs.debian.org/507673
-.\" http://lists.gnu.org/archive/html/groff/2009-02/msg00013.html
-.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-.ie \n(.g .ds Aq \(aq
-.el       .ds Aq '
-.\" -----------------------------------------------------------------
-.\" * set default formatting
-.\" -----------------------------------------------------------------
-.\" disable hyphenation
-.nh
-.\" disable justification (adjust text to left margin only)
-.ad l
-.\" -----------------------------------------------------------------
-.\" * MAIN CONTENT STARTS HERE *
-.\" -----------------------------------------------------------------
-.SH "NAME"
-isc-hmac-fixup \- fixes HMAC keys generated by older versions of BIND
-.SH "SYNOPSIS"
-.HP \w'\fBisc\-hmac\-fixup\fR\ 'u
-\fBisc\-hmac\-fixup\fR {\fIalgorithm\fR} {\fIsecret\fR}
-.SH "DESCRIPTION"
-.PP
-Versions of BIND 9 up to and including BIND 9\&.6 had a bug causing HMAC\-SHA* TSIG keys which were longer than the digest length of the hash algorithm (i\&.e\&., SHA1 keys longer than 160 bits, SHA256 keys longer than 256 bits, etc) to be used incorrectly, generating a message authentication code that was incompatible with other DNS implementations\&.
-.PP
-This bug has been fixed in BIND 9\&.7\&. However, the fix may cause incompatibility between older and newer versions of BIND, when using long keys\&.
-\fBisc\-hmac\-fixup\fR
-modifies those keys to restore compatibility\&.
-.PP
-To modify a key, run
-\fBisc\-hmac\-fixup\fR
-and specify the key\*(Aqs algorithm and secret on the command line\&. If the secret is longer than the digest length of the algorithm (64 bytes for SHA1 through SHA256, or 128 bytes for SHA384 and SHA512), then a new secret will be generated consisting of a hash digest of the old secret\&. (If the secret did not require conversion, then it will be printed without modification\&.)
-.SH "SECURITY CONSIDERATIONS"
-.PP
-Secrets that have been converted by
-\fBisc\-hmac\-fixup\fR
-are shortened, but as this is how the HMAC protocol works in operation anyway, it does not affect security\&. RFC 2104 notes, "Keys longer than [the digest length] are acceptable but the extra length would not significantly increase the function strength\&."
-.SH "SEE ALSO"
-.PP
-BIND 9 Administrator Reference Manual,
-RFC 2104\&.
-.SH "AUTHOR"
-.PP
-\fBInternet Systems Consortium, Inc\&.\fR
-.SH "COPYRIGHT"
-.br
-Copyright \(co 2010, 2013-2016 Internet Systems Consortium, Inc. ("ISC")
-.br

bin/tools/isc-hmac-fixup.c

@@ -1,139 +0,0 @@
-/*
- * Copyright (C) 2010, 2014-2016  Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- */
-
-/* $Id: isc-hmac-fixup.c,v 1.4 2010/03/10 02:17:52 marka Exp $ */
-
-#include <config.h>
-
-#include <isc/base64.h>
-#include <isc/buffer.h>
-#include <isc/md5.h>
-#include <isc/print.h>
-#include <isc/region.h>
-#include <isc/result.h>
-#include <isc/sha1.h>
-#include <isc/sha2.h>
-#include <isc/stdio.h>
-#include <isc/string.h>
-
-#include <pk11/site.h>
-
-#define HMAC_LEN	64
-
-int
-main(int argc, char **argv)  {
-	isc_buffer_t buf;
-	unsigned char key[1024];
-	char secret[1024];
-	char base64[(1024*4)/3];
-	isc_region_t r;
-	isc_result_t result;
-
-	if (argc != 3) {
-		fprintf(stderr, "Usage:\t%s algorithm secret\n", argv[0]);
-#ifndef PK11_MD5_DISABLE
-		fprintf(stderr, "\talgorithm: (MD5 | SHA1 | SHA224 | "
-				"SHA256 | SHA384 | SHA512)\n");
-#else
-		fprintf(stderr, "\talgorithm: (SHA1 | SHA224 | "
-				"SHA256 | SHA384 | SHA512)\n");
-#endif
-		return (1);
-	}
-
-	isc_buffer_init(&buf, secret, sizeof(secret));
-	result = isc_base64_decodestring(argv[2], &buf);
-	if (result != ISC_R_SUCCESS) {
-		fprintf(stderr, "error: %s\n", isc_result_totext(result));
-		return (1);
-	}
-	isc_buffer_usedregion(&buf, &r);
-
-#ifndef PK11_MD5_DISABLE
-	if (!strcasecmp(argv[1], "md5") ||
-	    !strcasecmp(argv[1], "hmac-md5")) {
-		if (r.length > HMAC_LEN) {
-			isc_md5_t md5ctx;
-			isc_md5_init(&md5ctx);
-			isc_md5_update(&md5ctx, r.base, r.length);
-			isc_md5_final(&md5ctx, key);
-
-			r.base = key;
-			r.length = ISC_MD5_DIGESTLENGTH;
-		}
-	} else
-#endif
-	if (!strcasecmp(argv[1], "sha1") ||
-		   !strcasecmp(argv[1], "hmac-sha1")) {
-		if (r.length > ISC_SHA1_DIGESTLENGTH) {
-			isc_sha1_t sha1ctx;
-			isc_sha1_init(&sha1ctx);
-			isc_sha1_update(&sha1ctx, r.base, r.length);
-			isc_sha1_final(&sha1ctx, key);
-
-			r.base = key;
-			r.length = ISC_SHA1_DIGESTLENGTH;
-		}
-	} else if (!strcasecmp(argv[1], "sha224") ||
-		   !strcasecmp(argv[1], "hmac-sha224")) {
-		if (r.length > ISC_SHA224_DIGESTLENGTH) {
-			isc_sha224_t sha224ctx;
-			isc_sha224_init(&sha224ctx);
-			isc_sha224_update(&sha224ctx, r.base, r.length);
-			isc_sha224_final(key, &sha224ctx);
-
-			r.base = key;
-			r.length = ISC_SHA224_DIGESTLENGTH;
-		}
-	} else if (!strcasecmp(argv[1], "sha256") ||
-		   !strcasecmp(argv[1], "hmac-sha256")) {
-		if (r.length > ISC_SHA256_DIGESTLENGTH) {
-			isc_sha256_t sha256ctx;
-			isc_sha256_init(&sha256ctx);
-			isc_sha256_update(&sha256ctx, r.base, r.length);
-			isc_sha256_final(key, &sha256ctx);
-
-			r.base = key;
-			r.length = ISC_SHA256_DIGESTLENGTH;
-		}
-	} else if (!strcasecmp(argv[1], "sha384") ||
-		   !strcasecmp(argv[1], "hmac-sha384")) {
-		if (r.length > ISC_SHA384_DIGESTLENGTH) {
-			isc_sha384_t sha384ctx;
-			isc_sha384_init(&sha384ctx);
-			isc_sha384_update(&sha384ctx, r.base, r.length);
-			isc_sha384_final(key, &sha384ctx);
-
-			r.base = key;
-			r.length = ISC_SHA384_DIGESTLENGTH;
-		}
-	} else if (!strcasecmp(argv[1], "sha512") ||
-		   !strcasecmp(argv[1], "hmac-sha512")) {
-		if (r.length > ISC_SHA512_DIGESTLENGTH) {
-			isc_sha512_t sha512ctx;
-			isc_sha512_init(&sha512ctx);
-			isc_sha512_update(&sha512ctx, r.base, r.length);
-			isc_sha512_final(key, &sha512ctx);
-
-			r.base = key;
-			r.length = ISC_SHA512_DIGESTLENGTH;
-		}
-	} else {
-		fprintf(stderr, "unknown hmac/digest algorithm: %s\n", argv[1]);
-		return (1);
-	}
-
-	isc_buffer_init(&buf, base64, sizeof(base64));
-	result = isc_base64_totext(&r, 0, "", &buf);
-	if (result != ISC_R_SUCCESS) {
-		fprintf(stderr, "error: %s\n", isc_result_totext(result));
-		return (1);
-	}
-	fprintf(stdout, "%.*s\n", (int)isc_buffer_usedlength(&buf), base64);
-	return (0);
-}

bin/tools/isc-hmac-fixup.docbook

@@ -1,96 +0,0 @@
-<!--
- - Copyright (C) 2010, 2013-2016  Internet Systems Consortium, Inc. ("ISC")
- -
- - This Source Code Form is subject to the terms of the Mozilla Public
- - License, v. 2.0. If a copy of the MPL was not distributed with this
- - file, You can obtain one at http://mozilla.org/MPL/2.0/.
--->
-
-<!-- Converted by db4-upgrade version 1.0 -->
-<refentry xmlns:db="http://docbook.org/ns/docbook" version="5.0" xml:id="man.isc-hmac-fixup">
-  <info>
-    <date>2013-04-28</date>
-  </info>
-  <refentryinfo>
-    <corpname>ISC</corpname>
-    <corpauthor>Internet Systems Consortium, Inc.</corpauthor>
-  </refentryinfo>
-
-  <refmeta>
-    <refentrytitle><application>isc-hmac-fixup</application></refentrytitle>
-    <manvolnum>8</manvolnum>
-    <refmiscinfo>BIND9</refmiscinfo>
-  </refmeta>
-
-  <refnamediv>
-    <refname><application>isc-hmac-fixup</application></refname>
-    <refpurpose>fixes HMAC keys generated by older versions of BIND</refpurpose>
-  </refnamediv>
-
-  <docinfo>
-    <copyright>
-      <year>2010</year>
-      <year>2013</year>
-      <year>2014</year>
-      <year>2015</year>
-      <year>2016</year>
-      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
-    </copyright>
-  </docinfo>
-
-  <refsynopsisdiv>
-    <cmdsynopsis sepchar=" ">
-      <command>isc-hmac-fixup</command>
-      <arg choice="req" rep="norepeat"><replaceable class="parameter">algorithm</replaceable></arg>
-      <arg choice="req" rep="norepeat"><replaceable class="parameter">secret</replaceable></arg>
-    </cmdsynopsis>
-  </refsynopsisdiv>
-
-  <refsection><info><title>DESCRIPTION</title></info>
-
-    <para>
-      Versions of BIND 9 up to and including BIND 9.6 had a bug causing
-      HMAC-SHA* TSIG keys which were longer than the digest length of the
-      hash algorithm (i.e., SHA1 keys longer than 160 bits, SHA256 keys
-      longer than 256 bits, etc) to be used incorrectly, generating a
-      message authentication code that was incompatible with other DNS
-      implementations.
-    </para>
-    <para>
-      This bug has been fixed in BIND 9.7.  However, the fix may
-      cause incompatibility between older and newer versions of
-      BIND, when using long keys.  <command>isc-hmac-fixup</command>
-      modifies those keys to restore compatibility.
-    </para>
-    <para>
-      To modify a key, run <command>isc-hmac-fixup</command> and
-      specify the key's algorithm and secret on the command line.  If the
-      secret is longer than the digest length of the algorithm (64 bytes
-      for SHA1 through SHA256, or 128 bytes for SHA384 and SHA512), then a
-      new secret will be generated consisting of a hash digest of the old
-      secret.  (If the secret did not require conversion, then it will be
-      printed without modification.)
-    </para>
-  </refsection>
-
-  <refsection><info><title>SECURITY CONSIDERATIONS</title></info>
-
-    <para>
-      Secrets that have been converted by <command>isc-hmac-fixup</command>
-      are shortened, but as this is how the HMAC protocol works in
-      operation anyway, it does not affect security.  RFC 2104 notes,
-      "Keys longer than [the digest length] are acceptable but the
-      extra length would not significantly increase the function
-      strength."
-    </para>
-  </refsection>
-
-  <refsection><info><title>SEE ALSO</title></info>
-
-    <para>
-      <citetitle>BIND 9 Administrator Reference Manual</citetitle>,
-      <citetitle>RFC 2104</citetitle>.
-    </para>
-  </refsection>
-
-</refentry>

bin/tools/isc-hmac-fixup.html

@@ -1,92 +0,0 @@
-<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
-<!--
- - Copyright (C) 2010, 2013-2016 Internet Systems Consortium, Inc. ("ISC")
- - 
- - This Source Code Form is subject to the terms of the Mozilla Public
- - License, v. 2.0. If a copy of the MPL was not distributed with this
- - file, You can obtain one at http://mozilla.org/MPL/2.0/.
--->
-<html lang="en">
-<head>
-<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
-<title>isc-hmac-fixup</title>
-<meta name="generator" content="DocBook XSL Stylesheets V1.78.1">
-</head>
-<body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="refentry">
-<a name="man.isc-hmac-fixup"></a><div class="titlepage"></div>
-  
-  
-
-  
-
-  <div class="refnamediv">
-<h2>Name</h2>
-<p>
-    <span class="application">isc-hmac-fixup</span>
-     &#8212; fixes HMAC keys generated by older versions of BIND
-  </p>
-</div>
-
-  
-
-  <div class="refsynopsisdiv">
-<h2>Synopsis</h2>
-    <div class="cmdsynopsis"><p>
-      <code class="command">isc-hmac-fixup</code> 
-       {<em class="replaceable"><code>algorithm</code></em>}
-       {<em class="replaceable"><code>secret</code></em>}
-    </p></div>
-  </div>
-
-  <div class="refsection">
-<a name="id-1.7"></a><h2>DESCRIPTION</h2>
-
-    <p>
-      Versions of BIND 9 up to and including BIND 9.6 had a bug causing
-      HMAC-SHA* TSIG keys which were longer than the digest length of the
-      hash algorithm (i.e., SHA1 keys longer than 160 bits, SHA256 keys
-      longer than 256 bits, etc) to be used incorrectly, generating a
-      message authentication code that was incompatible with other DNS
-      implementations.
-    </p>
-    <p>
-      This bug has been fixed in BIND 9.7.  However, the fix may
-      cause incompatibility between older and newer versions of
-      BIND, when using long keys.  <span class="command"><strong>isc-hmac-fixup</strong></span>
-      modifies those keys to restore compatibility.
-    </p>
-    <p>
-      To modify a key, run <span class="command"><strong>isc-hmac-fixup</strong></span> and
-      specify the key's algorithm and secret on the command line.  If the
-      secret is longer than the digest length of the algorithm (64 bytes
-      for SHA1 through SHA256, or 128 bytes for SHA384 and SHA512), then a
-      new secret will be generated consisting of a hash digest of the old
-      secret.  (If the secret did not require conversion, then it will be
-      printed without modification.)
-    </p>
-  </div>
-
-  <div class="refsection">
-<a name="id-1.8"></a><h2>SECURITY CONSIDERATIONS</h2>
-
-    <p>
-      Secrets that have been converted by <span class="command"><strong>isc-hmac-fixup</strong></span>
-      are shortened, but as this is how the HMAC protocol works in
-      operation anyway, it does not affect security.  RFC 2104 notes,
-      "Keys longer than [the digest length] are acceptable but the
-      extra length would not significantly increase the function
-      strength."
-    </p>
-  </div>
-
-  <div class="refsection">
-<a name="id-1.9"></a><h2>SEE ALSO</h2>
-
-    <p>
-      <em class="citetitle">BIND 9 Administrator Reference Manual</em>,
-      <em class="citetitle">RFC 2104</em>.
-    </p>
-  </div>
-
-</div></body>
-</html>

bin/tools/win32/ischmacfixup.vcxproj.filters.in

@@ -1,18 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
-  <ItemGroup>
-    <Filter Include="Source Files">
-      <UniqueIdentifier>{4FC737F1-C7A5-4376-A066-2A32D752A2FF}</UniqueIdentifier>
-      <Extensions>cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx</Extensions>
-    </Filter>
-    <Filter Include="Resource Files">
-      <UniqueIdentifier>{67DA6AB6-F800-4c08-8B7A-83BB121AAD01}</UniqueIdentifier>
-      <Extensions>rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms</Extensions>
-    </Filter>
-  </ItemGroup>
-  <ItemGroup>
-    <ClCompile Include="..\isc-hmac-fixup.c">
-      <Filter>Source Files</Filter>
-    </ClCompile>
-  </ItemGroup>
-</Project>

bin/tools/win32/ischmacfixup.vcxproj.in

@@ -1,112 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<Project DefaultTargets="Build" ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
-  <ItemGroup Label="ProjectConfigurations">
-    <ProjectConfiguration Include="Debug|@PLATFORM@">
-      <Configuration>Debug</Configuration>
-      <Platform>@PLATFORM@</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="Release|@PLATFORM@">
-      <Configuration>Release</Configuration>
-      <Platform>@PLATFORM@</Platform>
-    </ProjectConfiguration>
-  </ItemGroup>
-  <PropertyGroup Label="Globals">
-    <ProjectGuid>{70F2F0DF-665D-4444-A982-AEA31A861A22}</ProjectGuid>
-    <Keyword>Win32Proj</Keyword>
-    <RootNamespace>ischmacfixup</RootNamespace>
-  </PropertyGroup>
-  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|@PLATFORM@'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseDebugLibraries>true</UseDebugLibraries>
-    <CharacterSet>MultiByte</CharacterSet>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseDebugLibraries>false</UseDebugLibraries>
-    <WholeProgramOptimization>true</WholeProgramOptimization>
-    <CharacterSet>MultiByte</CharacterSet>
-  </PropertyGroup>
-  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
-  <ImportGroup Label="ExtensionSettings">
-  </ImportGroup>
-  <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|@PLATFORM@'">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <PropertyGroup Label="UserMacros" />
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|@PLATFORM@'">
-    <LinkIncremental>true</LinkIncremental>
-    <OutDir>..\..\..\Build\$(Configuration)\</OutDir>
-    <IntDir>.\$(Configuration)\</IntDir>
-    <TargetName>isc-hmac-fixup</TargetName>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'">
-    <LinkIncremental>false</LinkIncremental>
-    <OutDir>..\..\..\Build\$(Configuration)\</OutDir>
-    <IntDir>.\$(Configuration)\</IntDir>
-    <TargetName>isc-hmac-fixup</TargetName>
-  </PropertyGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|@PLATFORM@'">
-    <ClCompile>
-      <PrecompiledHeader>
-      </PrecompiledHeader>
-      <WarningLevel>Level3</WarningLevel>
-      <Optimization>Disabled</Optimization>
-      <PreprocessorDefinitions>WIN32;@CRYPTO@_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <PrecompiledHeaderOutputFile>.\$(Configuration)\$(ProjectName).pch</PrecompiledHeaderOutputFile>
-      <AssemblerListingLocation>.\$(Configuration)\</AssemblerListingLocation>
-      <ObjectFileName>.\$(Configuration)\</ObjectFileName>
-      <ProgramDataBaseFileName>$(OutDir)$(TargetName).pdb</ProgramDataBaseFileName>
-      <BrowseInformation>true</BrowseInformation>
-      <AdditionalIncludeDirectories>.\;..\..\..\;@LIBXML2_INC@@OPENSSL_INC@..\..\..\lib\isc\win32;..\..\..\lib\isc\win32\include;..\..\..\lib\isc\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <CompileAs>CompileAsC</CompileAs>
-    </ClCompile>
-    <Link>
-      <SubSystem>Console</SubSystem>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\lib\isc\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>libisc.lib;%(AdditionalDependencies)</AdditionalDependencies>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'">
-    <ClCompile>
-      <WarningLevel>Level3</WarningLevel>
-      <PrecompiledHeader>
-      </PrecompiledHeader>
-      <Optimization>MaxSpeed</Optimization>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <IntrinsicFunctions>@INTRINSIC@</IntrinsicFunctions>
-      <PreprocessorDefinitions>WIN32;@CRYPTO@NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <WholeProgramOptimization>false</WholeProgramOptimization>
-      <StringPooling>true</StringPooling>
-      <PrecompiledHeaderOutputFile>.\$(Configuration)\$(ProjectName).pch</PrecompiledHeaderOutputFile>
-      <AssemblerListingLocation>.\$(Configuration)\</AssemblerListingLocation>
-      <ObjectFileName>.\$(Configuration)\</ObjectFileName>
-      <ProgramDataBaseFileName>$(OutDir)$(TargetName).pdb</ProgramDataBaseFileName>
-      <AdditionalIncludeDirectories>.\;..\..\..\;@LIBXML2_INC@@OPENSSL_INC@..\..\..\lib\isc\win32;..\..\..\lib\isc\win32\include;..\..\..\lib\isc\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <CompileAs>CompileAsC</CompileAs>
-    </ClCompile>
-    <Link>
-      <SubSystem>Console</SubSystem>
-      <GenerateDebugInformation>false</GenerateDebugInformation>
-      <EnableCOMDATFolding>true</EnableCOMDATFolding>
-      <OptimizeReferences>true</OptimizeReferences>
-      <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
-      <LinkTimeCodeGeneration>Default</LinkTimeCodeGeneration>
-      <AdditionalLibraryDirectories>..\..\..\lib\isc\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>libisc.lib;%(AdditionalDependencies)</AdditionalDependencies>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemGroup>
-    <ClCompile Include="..\isc-hmac-fixup.c" />
-  </ItemGroup>
-  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
-  <ImportGroup Label="ExtensionTargets">
-  </ImportGroup>
-</Project>

bin/tools/win32/ischmacfixup.vcxproj.user

@@ -1,3 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
-</Project>

bin/win32/BINDInstall/BINDInstallDlg.cpp

@@ -186,7 +186,6 @@ const FileData installFiles[] =
 	{"named-compilezone.exe", FileData::BinDir, FileData::Normal, FALSE, FALSE},
 	{"named-journalprint.exe", FileData::BinDir, FileData::Normal, FALSE, FALSE},
 	{"named-rrchecker.exe", FileData::BinDir, FileData::Normal, FALSE, FALSE},
-	{"isc-hmac-fixup.exe", FileData::BinDir, FileData::Normal, FALSE, FALSE},
 #ifdef USE_PKCS11
 	{"pkcs11-destroy.exe", FileData::BinDir, FileData::Normal, FALSE, FALSE},
 	{"pkcs11-keygen.exe", FileData::BinDir, FileData::Normal, FALSE, FALSE},

configure

@@ -940,7 +940,6 @@ infodir
 docdir
 oldincludedir
 includedir
-runstatedir
 localstatedir
 sharedstatedir
 sysconfdir
@@ -1103,7 +1102,6 @@ datadir='${datarootdir}'
 sysconfdir='${prefix}/etc'
 sharedstatedir='${prefix}/com'
 localstatedir='${prefix}/var'
-runstatedir='${localstatedir}/run'
 includedir='${prefix}/include'
 oldincludedir='/usr/include'
 docdir='${datarootdir}/doc/${PACKAGE_TARNAME}'
@@ -1356,15 +1354,6 @@ do
   | -silent | --silent | --silen | --sile | --sil)
     silent=yes ;;
 
-  -runstatedir | --runstatedir | --runstatedi | --runstated \
-  | --runstate | --runstat | --runsta | --runst | --runs \
-  | --run | --ru | --r)
-    ac_prev=runstatedir ;;
-  -runstatedir=* | --runstatedir=* | --runstatedi=* | --runstated=* \
-  | --runstate=* | --runstat=* | --runsta=* | --runst=* | --runs=* \
-  | --run=* | --ru=* | --r=*)
-    runstatedir=$ac_optarg ;;
-
   -sbindir | --sbindir | --sbindi | --sbind | --sbin | --sbi | --sb)
     ac_prev=sbindir ;;
   -sbindir=* | --sbindir=* | --sbindi=* | --sbind=* | --sbin=* \
@@ -1502,7 +1491,7 @@ fi
 for ac_var in	exec_prefix prefix bindir sbindir libexecdir datarootdir \
 		datadir sysconfdir sharedstatedir localstatedir includedir \
 		oldincludedir docdir infodir htmldir dvidir pdfdir psdir \
-		libdir localedir mandir runstatedir
+		libdir localedir mandir
 do
   eval ac_val=\$$ac_var
   # Remove trailing slashes.
@@ -1655,7 +1644,6 @@ Fine tuning of the installation directories:
   --sysconfdir=DIR        read-only single-machine data [PREFIX/etc]
   --sharedstatedir=DIR    modifiable architecture-independent data [PREFIX/com]
   --localstatedir=DIR     modifiable single-machine data [PREFIX/var]
-  --runstatedir=DIR       modifiable per-process data [LOCALSTATEDIR/run]
   --libdir=DIR            object code libraries [EPREFIX/lib]
   --includedir=DIR        C header files [PREFIX/include]
   --oldincludedir=DIR     C header files for non-gcc [/usr/include]

doc/arm/Bv9ARM-book.xml

@@ -4309,6 +4309,7 @@ badresp:1,adberr:0,findfail:0,valfail:0]
   [ <command>maintain-ixfr-base</command> <replaceable>yes_or_no</replaceable> ; ]
   [ <command>ixfr-from-differences</command> ( <replaceable>yes_or_no</replaceable> | <option>master</option> | <option>slave</option> ) ; ]
   [ <command>auto-dnssec</command> ( <option>allow</option> | <option>maintain</option> | <option>off</option> ) ; ]
+  [ <command>inline-signing</command> <replaceable>yes_or_no</replaceable> ; ]
   [ <command>dnssec-enable</command> <replaceable>yes_or_no</replaceable> ; ]
   [ <command>dnssec-validation</command> ( <replaceable>yes_or_no</replaceable> | <option>auto</option> ) ; ]
   [ <command>dnssec-lookaside</command> ( <option>auto</option> | <option>no</option> | <replaceable>domain</replaceable> trust-anchor <replaceable>domain</replaceable> ) ; ]
@@ -4548,6 +4549,7 @@ badresp:1,adberr:0,findfail:0,valfail:0]
 	...
     <command>}</command> ; ]
   [ <command>v6-bias</command> <replaceable>number</replaceable> ; ]
+  [ <command>trust-anchor-telemetry</command> <replaceable>yes_or_no</replaceable> ; ]
 <command>}</command> ; ]
 </programlisting>
 
@@ -8830,7 +8832,7 @@ avoid-v6-udp-ports { 40000; range 50000 60000; };
 		  server waits on an idle TCP connection before closing
 		  it when the client is using the EDNS TCP keepalive
 		  option.  The default is 300 (30 seconds), the maximum
-		  is 1200 (two minutes), and the minimum is 1 (one tenth
+		  is 65535 (about 1.8 hours), and the minimum is 1 (one tenth
 		  of a second). Values above the maximum or below the minimum
 		  will be adjusted with a logged warning.
 		  This value may be greater than
@@ -8852,7 +8854,7 @@ avoid-v6-udp-ports { 40000; range 50000 60000; };
 		  keepalive option. This informs a client of the
 		  amount of time it may keep the session open.
 		  The default is 300 (30 seconds), the maximum is
-		  1200 (two minutes), and the minimum is 0, which
+		  65535 (about 1.8 hours), and the minimum is 0, which
 		  signals that the clients must close TCP connections
 		  immediately.  Ordinarily this should be set to the
 		  same value as <command>tcp-keepalive-timeout</command>.
@@ -18558,7 +18560,6 @@ allow-query { !{ !10/8; any; }; key example; };
       <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="../../bin/tools/dnstap-read.docbook"/>
       <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="../../bin/tools/genrandom.docbook"/>
       <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="../../bin/dig/host.docbook"/>
-      <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="../../bin/tools/isc-hmac-fixup.docbook"/>
       <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="../../bin/tools/mdig.docbook"/>
       <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="../../bin/check/named-checkconf.docbook"/>
       <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="../../bin/check/named-checkzone.docbook"/>

doc/arm/Bv9ARM.ch06.html

@@ -2395,6 +2395,7 @@ badresp:1,adberr:0,findfail:0,valfail:0]
   [ <span class="command"><strong>maintain-ixfr-base</strong></span> <em class="replaceable"><code>yes_or_no</code></em> ; ]
   [ <span class="command"><strong>ixfr-from-differences</strong></span> ( <em class="replaceable"><code>yes_or_no</code></em> | <code class="option">master</code> | <code class="option">slave</code> ) ; ]
   [ <span class="command"><strong>auto-dnssec</strong></span> ( <code class="option">allow</code> | <code class="option">maintain</code> | <code class="option">off</code> ) ; ]
+  [ <span class="command"><strong>inline-signing</strong></span> <em class="replaceable"><code>yes_or_no</code></em> ; ]
   [ <span class="command"><strong>dnssec-enable</strong></span> <em class="replaceable"><code>yes_or_no</code></em> ; ]
   [ <span class="command"><strong>dnssec-validation</strong></span> ( <em class="replaceable"><code>yes_or_no</code></em> | <code class="option">auto</code> ) ; ]
   [ <span class="command"><strong>dnssec-lookaside</strong></span> ( <code class="option">auto</code> | <code class="option">no</code> | <em class="replaceable"><code>domain</code></em> trust-anchor <em class="replaceable"><code>domain</code></em> ) ; ]
@@ -2634,6 +2635,7 @@ badresp:1,adberr:0,findfail:0,valfail:0]
         ...
     <span class="command"><strong>}</strong></span> ; ]
   [ <span class="command"><strong>v6-bias</strong></span> <em class="replaceable"><code>number</code></em> ; ]
+  [ <span class="command"><strong>trust-anchor-telemetry</strong></span> <em class="replaceable"><code>yes_or_no</code></em> ; ]
 <span class="command"><strong>}</strong></span> ; ]
 </pre>
 
@@ -3046,7 +3048,9 @@ badresp:1,adberr:0,findfail:0,valfail:0]
                 Specifies the directory in which to store the configuration
                 parameters for zones added via <span class="command"><strong>rndc addzone</strong></span>.
                 By default, this is the working directory. If set to a relative
-                path, it will be relative to the working directory.
+                path, it will be relative to the working directory. The
+                directory <span class="emphasis"><em>must</em></span> be writable by the
+                effective user ID of the <span class="command"><strong>named</strong></span> process.
               </p>
             </dd>
 <dt><span class="term"><span class="command"><strong>named-xfer</strong></span></span></dt>
@@ -4558,10 +4562,7 @@ options {
 <dt><span class="term"><span class="command"><strong>filter-aaaa-on-v4</strong></span></span></dt>
 <dd>
                 <p>
-                  This option is only available when
+                  This option is intended to help the
-                  <acronym class="acronym">BIND</acronym> 9 is compiled with the
-                  <strong class="userinput"><code>--enable-filter-aaaa</code></strong> option on the
-                  "configure" command line.  It is intended to help the
                   transition from IPv4 to IPv6 by not giving IPv6 addresses
                   to DNS clients unless they have connections to the IPv6
                   Internet.  This is not recommended unless absolutely
@@ -6450,7 +6451,7 @@ avoid-v6-udp-ports { 40000; range 50000 60000; };
                   server waits on an idle TCP connection before closing
                   it when the client is using the EDNS TCP keepalive
                   option.  The default is 300 (30 seconds), the maximum
-                  is 1200 (two minutes), and the minimum is 1 (one tenth
+                  is 65535 (about 1.8 hours), and the minimum is 1 (one tenth
                   of a second). Values above the maximum or below the minimum
                   will be adjusted with a logged warning.
                   This value may be greater than
@@ -6469,7 +6470,7 @@ avoid-v6-udp-ports { 40000; range 50000 60000; };
                   keepalive option. This informs a client of the
                   amount of time it may keep the session open.
                   The default is 300 (30 seconds), the maximum is
-                  1200 (two minutes), and the minimum is 0, which
+                  65535 (about 1.8 hours), and the minimum is 0, which
                   signals that the clients must close TCP connections
                   immediately.  Ordinarily this should be set to the
                   same value as <span class="command"><strong>tcp-keepalive-timeout</strong></span>.

doc/arm/Bv9ARM.ch09.html

@@ -498,6 +498,14 @@
 	  <span class="command"><strong>dnssec-settime</strong></span>, etc. [RT #46149]
 	</p>
       </li>
+<li class="listitem">
+	<p>
+	  <span class="command"><strong>dnssec-checkds -s</strong></span> specifies a file from
+	  which to read a DS set rather than querying the parent zone.
+	  This can be used to check zone correctness prior to
+	  publication. Thanks to Niall O'Reilly [RT #44667]
+	</p>
+      </li>
 </ul></div>
   </div>
 
@@ -543,11 +551,17 @@
 <li class="listitem">
 	<p>
 	  The use of HMAC-MD5 for RNDC keys is no longer recommended.
-	  For compatibility, this is still the default algorithm generated
+	  The default algorithm generated by <span class="command"><strong>rndc-confgen</strong></span>,
-	  by <span class="command"><strong>rndc-confgen</strong></span>, but it will print a
+	  is now HMAC-256, and a warning message will be printed if
-	  warning message. The default algorithm in
+	  HMAC-MD5 is used. [RT #42272]
-	  <span class="command"><strong>rndc-confgen</strong></span> will be changed to HMAC-SHA256
+	</p>
-	  in a future release. [RT #42272]
+      </li>
+<li class="listitem">
+	<p>
+	  The <span class="command"><strong>isc-hmac-fixup</strong></span> command, which was created
+	  to address an interoperability problem in TSIG keys between
+	  early versions of BIND and other DNS implmentations, is now
+	  obsolete and has been removed. [RT #46411]
 	</p>
       </li>
 </ul></div>
@@ -606,6 +620,16 @@
 	  are not writable by the effective user ID. [RT #46077]
 	</p>
       </li>
+<li class="listitem">
+	<p>
+	  Initializing keys specified in a <span class="command"><strong>managed-keys</strong></span>
+	  statement or by <span class="command"><strong>dnssec-validation auto;</strong></span> are
+	  now tagged as "initializing", until they have been updated by a
+	  key refresh query. If key maintenance fails to initialize,
+	  this will be visible when running <span class="command"><strong>rndc secroots</strong></span>.
+	  [RT #46267]
+	</p>
+      </li>
 <li class="listitem">
 	<p>
 	  Previously, <span class="command"><strong>update-policy local;</strong></span> accepted
@@ -729,6 +753,12 @@
 	  queries. [RT #45847]
 	</p>
       </li>
+<li class="listitem">
+	<p>
+	  A new statistics counter has been added to track priming
+	  queries. [RT #46313]
+	</p>
+      </li>
 <li class="listitem">
 	<p>
 	  The <span class="command"><strong>dnssec-signzone -x</strong></span> flag and the
@@ -747,6 +777,13 @@
 	  catagory.
 	</p>
       </li>
+<li class="listitem">
+	<p>
+	  The <span class="command"><strong>filter-aaaa-on-v4</strong></span> and
+	  <span class="command"><strong>filter-aaaa-on-v6</strong></span> options are no longer
+	  conditionally compiled in <span class="command"><strong>named</strong></span>. [RT #46340]
+	</p>
+      </li>
 </ul></div>
   </div>
 

doc/arm/Bv9ARM.ch12.html

@@ -38,13 +38,11 @@
 <dl class="toc">
 <dt><span class="section"><a href="Bv9ARM.ch12.html#bind9.library">BIND 9 DNS Library Support</a></span></dt>
 <dd><dl>
-<dt><span class="section"><a href="Bv9ARM.ch12.html#id-1.13.2.4">Prerequisite</a></span></dt>
+<dt><span class="section"><a href="Bv9ARM.ch12.html#id-1.13.2.5">Installation</a></span></dt>
-<dt><span class="section"><a href="Bv9ARM.ch12.html#id-1.13.2.5">Compilation</a></span></dt>
+<dt><span class="section"><a href="Bv9ARM.ch12.html#id-1.13.2.6">Known Defects/Restrictions</a></span></dt>
-<dt><span class="section"><a href="Bv9ARM.ch12.html#id-1.13.2.6">Installation</a></span></dt>
+<dt><span class="section"><a href="Bv9ARM.ch12.html#id-1.13.2.7">The dns.conf File</a></span></dt>
-<dt><span class="section"><a href="Bv9ARM.ch12.html#id-1.13.2.7">Known Defects/Restrictions</a></span></dt>
+<dt><span class="section"><a href="Bv9ARM.ch12.html#id-1.13.2.8">Sample Applications</a></span></dt>
-<dt><span class="section"><a href="Bv9ARM.ch12.html#id-1.13.2.8">The dns.conf File</a></span></dt>
+<dt><span class="section"><a href="Bv9ARM.ch12.html#id-1.13.2.9">Library References</a></span></dt>
-<dt><span class="section"><a href="Bv9ARM.ch12.html#id-1.13.2.9">Sample Applications</a></span></dt>
-<dt><span class="section"><a href="Bv9ARM.ch12.html#id-1.13.2.10">Library References</a></span></dt>
 </dl></dd>
 </dl>
 </div>
@@ -52,107 +50,85 @@
 <div class="titlepage"><div><div><h2 class="title" style="clear: both">
 <a name="bind9.library"></a>BIND 9 DNS Library Support</h2></div></div></div>
   
-  <p>This version of BIND 9 "exports" its internal libraries so
+  <p>
-  that they can be used by third-party applications more easily (we
+    This version of BIND 9 "exports" its internal libraries so
-  call them "export" libraries in this document). In addition to
+    that they can be used by third-party applications more easily (we
-  all major DNS-related APIs BIND 9 is currently using, the export
+    call them "export" libraries in this document). Certain library
-  libraries provide the following features:</p>
+    functions are altered from specific BIND-only behavior to more generic
+    behavior when used by other applications; to enable this generic behavior,
+    the calling program initializes the libraries by calling
+    <span class="command"><strong>isc_lib_register()</strong></span>.
+  </p>
+  <p>
+    In addition to DNS-related APIs that are used within BIND 9, the
+    libraries provide the following features:
+  </p>
   <div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; ">
 <li class="listitem">
-      <p>The newly created "DNS client" module. This is a higher
+      <p>
-      level API that provides an interface to name resolution,
+	The "DNS client" module. This is a higher level API that
-      single DNS transaction with a particular server, and dynamic
+	provides an interface to name resolution, single DNS transaction
-      update. Regarding name resolution, it supports advanced
+	with a particular server, and dynamic update. Regarding name
-      features such as DNSSEC validation and caching. This module
+	resolution, it supports advanced features such as DNSSEC validation
-      supports both synchronous and asynchronous mode.</p>
+	and caching. This module supports both synchronous and asynchronous
+	mode.
+      </p>
     </li>
 <li class="listitem">
-      <p>The new "IRS" (Information Retrieval System) library.
+      <p>
-      It provides an interface to parse the traditional resolv.conf
+	The "IRS" (Information Retrieval System) library.  It provides an
-      file and more advanced, DNS-specific configuration file for
+	interface to parse the traditional <code class="filename">resolv.conf</code>
-      the rest of this package (see the description for the
+	file and more advanced, DNS-specific configuration file for the
-      dns.conf file below).</p>
+	rest of this package (see the description for the
+	<code class="filename">dns.conf</code> file below).
+      </p>
     </li>
 <li class="listitem">
-      <p>As part of the IRS library, newly implemented standard
+      <p>
-      address-name mapping functions, getaddrinfo() and
+	As part of the IRS library, the standard address-name
-      getnameinfo(), are provided. They use the DNSSEC-aware
+	mapping functions, <span class="command"><strong>getaddrinfo()</strong></span> and
-      validating resolver backend, and could use other advanced
+	<span class="command"><strong>getnameinfo()</strong></span>, are provided. They use the
-      features of the BIND 9 libraries such as caching. The
+	DNSSEC-aware validating resolver backend, and could use other
-      getaddrinfo() function resolves both A and AAAA RRs
+	advanced features of the BIND 9 libraries such as caching. The
-      concurrently (when the address family is unspecified).</p>
+	<span class="command"><strong>getaddrinfo()</strong></span> function resolves both A
+	and AAAA RRs concurrently when the address family is
+	unspecified.
+      </p>
     </li>
 <li class="listitem">
-      <p>An experimental framework to support other event
+      <p>
-      libraries than BIND 9's internal event task system.</p>
+	An experimental framework to support other event
+	libraries than BIND 9's internal event task system.
+      </p>
     </li>
 </ul></div>
   <div class="section">
 <div class="titlepage"><div><div><h3 class="title">
-<a name="id-1.13.2.4"></a>Prerequisite</h3></div></div></div>
+<a name="id-1.13.2.5"></a>Installation</h3></div></div></div>
     
-  <p>GNU make is required to build the export libraries (other
+    <pre class="screen">
-  part of BIND 9 can still be built with other types of make). In
-  the reminder of this document, "make" means GNU make. Note that
-  in some platforms you may need to invoke a different command name
-  than "make" (e.g. "gmake") to indicate it's GNU make.</p>
-  </div>
-  <div class="section">
-<div class="titlepage"><div><div><h3 class="title">
-<a name="id-1.13.2.5"></a>Compilation</h3></div></div></div>
-
-  <pre class="screen">
-$ <strong class="userinput"><code>./configure --enable-exportlib <em class="replaceable"><code>[other flags]</code></em></code></strong>
-$ <strong class="userinput"><code>make</code></strong>
-</pre>
-  <p>
-  This will create (in addition to usual BIND 9 programs) and a
-  separate set of libraries under the lib/export directory. For
-  example, <code class="filename">lib/export/dns/libdns.a</code> is the archive file of the
-  export version of the BIND 9 DNS library. Sample application
-  programs using the libraries will also be built under the
-  lib/export/samples directory (see below).</p>
-  </div>
-  <div class="section">
-<div class="titlepage"><div><div><h3 class="title">
-<a name="id-1.13.2.6"></a>Installation</h3></div></div></div>
-
-  <pre class="screen">
-$ <strong class="userinput"><code>cd lib/export</code></strong>
 $ <strong class="userinput"><code>make install</code></strong>
-</pre>
+    </pre>
-  <p>
+    <p>
-  This will install library object files under the directory
+      Normal installation of BIND will also install library object
-  specified by the --with-export-libdir configure option (default:
+      and header files.  Root privilege is normally required.
-  EPREFIX/lib/bind9), and header files under the directory
+    </p>
-  specified by the --with-export-includedir configure option
+    <p>
-  (default: PREFIX/include/bind9).
+      To see how to build your own application after the installation, see
-  Root privilege is normally required.
+      <code class="filename">lib/samples/Makefile-postinstall.in</code>.
-  "<span class="command"><strong>make install</strong></span>" at the top directory will do the
+    </p>
-  same.
-  </p>
-  <p>
-  To see how to build your own
-  application after the installation, see
-  <code class="filename">lib/export/samples/Makefile-postinstall.in</code>.</p>
   </div>
   <div class="section">
 <div class="titlepage"><div><div><h3 class="title">
-<a name="id-1.13.2.7"></a>Known Defects/Restrictions</h3></div></div></div>
+<a name="id-1.13.2.6"></a>Known Defects/Restrictions</h3></div></div></div>
     
-  <div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; ">
+    <div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; ">
 <li class="listitem">
-
+        <p>
-      <p>Currently, win32 is not supported for the export
+	The "fixed" RRset order is not (currently) supported in the export
-      library. (Normal BIND 9 application can be built as
+	library. If you want to use "fixed" RRset order for, e.g.
-      before).</p>
+	<span class="command"><strong>named</strong></span> while still building the export library
-    </li>
+	even without the fixed order support, build them separately:
-<li class="listitem">
-      <p>The "fixed" RRset order is not (currently) supported in
-      the export library. If you want to use "fixed" RRset order
-      for, e.g. <span class="command"><strong>named</strong></span> while still building the
-      export library even without the fixed order support, build
-      them separately:
       </p>
 <pre class="screen">
 $ <strong class="userinput"><code>./configure --enable-fixed-rrset <em class="replaceable"><code>[other flags, but not --enable-exportlib]</code></em></code></strong>
@@ -162,399 +138,381 @@ $ <strong class="userinput"><code>cd lib/export</code></strong>
 $ <strong class="userinput"><code>make</code></strong>
 </pre>
 <p>
-    </p>
+      </p>
-    </li>
+      </li>
 <li class="listitem">
-      <p>The client module and the IRS library currently do not
+        <p>
-      support DNSSEC validation using DLV (the underlying modules
+	RFC 5011 is not supported in the validating stub resolver of the
-      can handle it, but there is no tunable interface to enable
+	export library. In fact, it is not clear whether it should: trust
-      the feature).</p>
+	anchors would be a system-wide configuration which would be managed
-    </li>
+	by an administrator, while the stub resolver will be used by
+	ordinary applications run by a normal user.
+      </p>
+      </li>
 <li class="listitem">
-      <p>RFC 5011 is not supported in the validating stub
+        <p>
-      resolver of the export library. In fact, it is not clear
+	Not all common <code class="filename">/etc/resolv.conf</code> options are
-      whether it should: trust anchors would be a system-wide
+	supported in the IRS library. The only available options in this
-      configuration which would be managed by an administrator,
+	version are <span class="command"><strong>debug</strong></span> and <span class="command"><strong>ndots</strong></span>.
-      while the stub resolver will be used by ordinary applications
+      </p>
-      run by a normal user.</p>
+      </li>
-    </li>
-<li class="listitem">
-      <p>Not all common <code class="filename">/etc/resolv.conf</code>
-      options are supported
-      in the IRS library. The only available options in this
-      version are "debug" and "ndots".</p>
-    </li>
 </ul></div>
   </div>
   <div class="section">
 <div class="titlepage"><div><div><h3 class="title">
-<a name="id-1.13.2.8"></a>The dns.conf File</h3></div></div></div>
+<a name="id-1.13.2.7"></a>The dns.conf File</h3></div></div></div>
     
-  <p>The IRS library supports an "advanced" configuration file
+    <p>
-  related to the DNS library for configuration parameters that
+      The IRS library supports an "advanced" configuration file related to
-  would be beyond the capability of the
+      the DNS library for configuration parameters that would be beyond the
-  <code class="filename">resolv.conf</code> file.
+      capability of the <code class="filename">resolv.conf</code> file.
-  Specifically, it is intended to provide DNSSEC related
+      Specifically, it is intended to provide DNSSEC related configuration
-  configuration parameters. By default the path to this
+      parameters. By default the path to this configuration file is
-  configuration file is <code class="filename">/etc/dns.conf</code>.
+      <code class="filename">/etc/dns.conf</code>.  This module is very experimental
-  This module is very
+      and the configuration syntax or library interfaces may change in
-  experimental and the configuration syntax or library interfaces
+      future versions. Currently, only the <span class="command"><strong>trusted-keys</strong></span>
-  may change in future versions. Currently, only the
+      statement is supported, whose syntax is the same as the same
-  <span class="command"><strong>trusted-keys</strong></span>
+      statement in <code class="filename">named.conf</code>. (See
-  statement is supported, whose syntax is the same as the same name
+      <a class="xref" href="Bv9ARM.ch06.html#trusted-keys" title="trusted-keys Statement Grammar">the section called &#8220;<span class="command"><strong>trusted-keys</strong></span> Statement Grammar&#8221;</a> for details.)
-  of statement for <code class="filename">named.conf</code>. (See
+    </p>
-  <a class="xref" href="Bv9ARM.ch06.html#trusted-keys" title="trusted-keys Statement Grammar">the section called &#8220;<span class="command"><strong>trusted-keys</strong></span> Statement Grammar&#8221;</a> for details.)</p>
   </div>
   <div class="section">
 <div class="titlepage"><div><div><h3 class="title">
-<a name="id-1.13.2.9"></a>Sample Applications</h3></div></div></div>
+<a name="id-1.13.2.8"></a>Sample Applications</h3></div></div></div>
     
-  <p>Some sample application programs using this API are
+    <p>
-  provided for reference. The following is a brief description of
+      Some sample application programs using this API are provided for
-  these applications.
+      reference. The following is a brief description of these
-  </p>
+      applications.
-  <div class="section">
+    </p>
+    <div class="section">
 <div class="titlepage"><div><div><h4 class="title">
-<a name="id-1.13.2.9.3"></a>sample: a simple stub resolver utility</h4></div></div></div>
+<a name="id-1.13.2.8.3"></a>sample: a simple stub resolver utility</h4></div></div></div>
       
-  <p>
+      <p>
-  It sends a query of a given name (of a given optional RR type) to a
+	Sends a query of a given name (of a given optional RR type) to a
-  specified recursive server, and prints the result as a list of
+	specified recursive server and prints the result as a list of RRs.
-  RRs. It can also act as a validating stub resolver if a trust
+	It can also act as a validating stub resolver if a trust anchor is
-  anchor is given via a set of command line options.</p>
+	given via a set of command line options.
-  <p>
+      </p>
-  Usage: sample [options] server_address hostname
+      <p>
-  </p>
+	Usage: sample [options] server_address hostname
-  <p>
+      </p>
-  Options and Arguments:
+      <p>
-  </p>
+	Options and Arguments:
-  <div class="variablelist"><dl class="variablelist">
+      </p>
-<dt><span class="term">
+      <div class="variablelist"><dl class="variablelist">
-  -t RRtype
+<dt><span class="term">-t RRtype</span></dt>
-  </span></dt>
-<dd><p>
-	specify the RR type of the query.  The default is the A RR.
-  </p></dd>
-<dt><span class="term">
-  [-a algorithm] [-e] -k keyname -K keystring
-  </span></dt>
 <dd>
-<p>
+            <p>
-	specify a command-line DNS key to validate the answer.  For
+	      specify the RR type of the query.  The default is the A RR.
-	example, to specify the following DNSKEY of example.com:
+	    </p>
-</p>
+          </dd>
+<dt><span class="term">[-a algorithm] [-e] -k keyname -K keystring</span></dt>
+<dd>
+            <p>
+	      specify a command-line DNS key to validate the answer.  For
+	      example, to specify the following DNSKEY of example.com:
+	      </p>
 <div class="literallayout"><p><br>
-		example.com. 3600 IN DNSKEY 257 3 5 xxx<br>
+	              example.com. 3600 IN DNSKEY 257 3 5 xxx<br>
-</p></div>
+	      </p></div>
 <p>
-	specify the options as follows:
+	      specify the options as follows:
-</p>
+	      </p>
 <pre class="screen">
-<strong class="userinput"><code>
+<strong class="userinput"><code>-e -k example.com -K "xxx"</code></strong>
-	  -e -k example.com -K "xxx"
+	      </pre>
-</code></strong>
-</pre>
 <p>
-	-e means that this key is a zone's "key signing key" (as known
+	      -e means that this key is a zone's "key signing key" (also known
-	as "secure Entry point").
+	      as "secure entry point").
-	When -a is omitted rsasha1 will be used by default.
+	      When -a is omitted rsasha1 will be used by default.
-  </p>
+	    </p>
-</dd>
+          </dd>
-<dt><span class="term">
+<dt><span class="term">-s domain:alt_server_address</span></dt>
-  -s domain:alt_server_address
+<dd>
-  </span></dt>
+            <p>
-<dd><p>
+	       specify a separate recursive server address for the specific
-	 specify a separate recursive server address for the specific
+	       "domain".  Example: -s example.com:2001:db8::1234
-	"domain".  Example: -s example.com:2001:db8::1234
+	    </p>
-  </p></dd>
+          </dd>
 <dt><span class="term">server_address</span></dt>
-<dd><p>
+<dd>
-	an IP(v4/v6) address of the recursive server to which queries
+            <p>
-	are sent.
+	      an IP(v4/v6) address of the recursive server to which queries
-  </p></dd>
+	      are sent.
+	    </p>
+          </dd>
 <dt><span class="term">hostname</span></dt>
-<dd><p>
+<dd>
-	the domain name for the query
+            <p>
-  </p></dd>
+	      the domain name for the query
+	</p>
+          </dd>
 </dl></div>
-  </div>
+    </div>
-  <div class="section">
+    <div class="section">
 <div class="titlepage"><div><div><h4 class="title">
-<a name="id-1.13.2.9.4"></a>sample-async: a simple stub resolver, working asynchronously</h4></div></div></div>
+<a name="id-1.13.2.8.4"></a>sample-async: a simple stub resolver, working asynchronously</h4></div></div></div>
       
-  <p>
+      <p>
-  Similar to "sample", but accepts a list
+      Similar to "sample", but accepts a list
-  of (query) domain names as a separate file and resolves the names
+      of (query) domain names as a separate file and resolves the names
-  asynchronously.</p>
+      asynchronously.</p>
-  <p>
+      <p>
-    Usage: sample-async [-s server_address] [-t RR_type] input_file</p>
+	Usage: sample-async [-s server_address] [-t RR_type] input_file</p>
-  <p>
+      <p>
- Options and Arguments:
+     Options and Arguments:
-  </p>
+      </p>
-  <div class="variablelist"><dl class="variablelist">
+      <div class="variablelist"><dl class="variablelist">
-<dt><span class="term">
+<dt><span class="term">-s server_address</span></dt>
-   -s server_address
-   </span></dt>
 <dd>
-   an IPv4 address of the recursive server to which queries are sent.
+       an IPv4 address of the recursive server to which queries are sent.
-  (IPv6 addresses are not supported in this implementation)
+      (IPv6 addresses are not supported in this implementation)
-  </dd>
+      </dd>
-<dt><span class="term">
+<dt><span class="term">-t RR_type</span></dt>
-   -t RR_type
-  </span></dt>
 <dd>
-  specify the RR type of the queries. The default is the A
+      specify the RR type of the queries. The default is the A
-  RR.
+      RR.
-  </dd>
+      </dd>
-<dt><span class="term">
+<dt><span class="term">input_file</span></dt>
-   input_file
-  </span></dt>
 <dd>
-   a list of domain names to be resolved. each line
+	    a list of domain names to be resolved. each line consists of a
-  consists of a single domain name. Example:
+	    single domain name. Example:
-  <div class="literallayout"><p><br>
+      <div class="literallayout"><p><br>
-  www.example.com<br>
+      www.example.com<br>
-  mx.example.net<br>
+      mx.example.net<br>
-  ns.xxx.example<br>
+      ns.xxx.example<br>
-</p></div>
+      </p></div>
-  </dd>
+	  </dd>
 </dl></div>
-  </div>
+    </div>
-  <div class="section">
+    <div class="section">
 <div class="titlepage"><div><div><h4 class="title">
-<a name="id-1.13.2.9.5"></a>sample-request: a simple DNS transaction client</h4></div></div></div>
+<a name="id-1.13.2.8.5"></a>sample-request: a simple DNS transaction client</h4></div></div></div>
       
-  <p>
+      <p>
-  It sends a query to a specified server, and
+	Sends a query to a specified server, and prints the response with
-  prints the response with minimal processing. It doesn't act as a
+	minimal processing. It doesn't act as a "stub resolver": it stops
-  "stub resolver": it stops the processing once it gets any
+	the processing once it gets any response from the server, whether
-  response from the server, whether it's a referral or an alias
+	it's a referral or an alias (CNAME or DNAME) that would require
-  (CNAME or DNAME) that would require further queries to get the
+	further queries to get the ultimate answer. In other words, this
-  ultimate answer. In other words, this utility acts as a very
+	utility acts as a very simplified <span class="command"><strong>dig</strong></span>.
-  simplified <span class="command"><strong>dig</strong></span>.
+      </p>
-  </p>
+      <p>
-  <p>
+	Usage: sample-request [-t RRtype] server_address hostname
-  Usage: sample-request [-t RRtype] server_address hostname
+      </p>
-  </p>
+      <p>
-  <p>
+	Options and Arguments:
-    Options and Arguments:
+      </p>
-  </p>
+      <div class="variablelist"><dl class="variablelist">
-  <div class="variablelist"><dl class="variablelist">
+<dt><span class="term">-t RRtype</span></dt>
-<dt><span class="term">
-   -t RRtype
-  </span></dt>
 <dd>
-  <p>
+	    <p>
-  specify the RR type of
+	      specify the RR type of the queries. The default is the A RR.
-  the queries. The default is the A RR.
+            </p>
-  </p>
+          </dd>
-  </dd>
+<dt><span class="term">server_address</span></dt>
-<dt><span class="term">
-  server_address
-  </span></dt>
 <dd>
-  <p>
+	    <p>
-   an IP(v4/v6)
+	      an IP(v4/v6) address of the recursive server to which
-  address of the recursive server to which the query is sent.
+	      the query is sent.
-  </p>
+	    </p>
-  </dd>
+          </dd>
-<dt><span class="term">
+<dt><span class="term">hostname</span></dt>
-  hostname
-  </span></dt>
 <dd>
-  <p>
+	    <p>
-  the domain name for the query
+	      the domain name for the query
-  </p>
+	    </p>
-  </dd>
+          </dd>
 </dl></div>
-  </div>
+    </div>
-  <div class="section">
+    <div class="section">
 <div class="titlepage"><div><div><h4 class="title">
-<a name="id-1.13.2.9.6"></a>sample-gai: getaddrinfo() and getnameinfo() test code</h4></div></div></div>
+<a name="id-1.13.2.8.6"></a>sample-gai: getaddrinfo() and getnameinfo() test code</h4></div></div></div>
       
-  <p>
+      <p>
-  This is a test program
+	This is a test program to check <span class="command"><strong>getaddrinfo()</strong></span> and
-  to check getaddrinfo() and getnameinfo() behavior. It takes a
+	<span class="command"><strong>getnameinfo()</strong></span> behavior. It takes a host name as an
-  host name as an argument, calls getaddrinfo() with the given host
+	argument, calls <span class="command"><strong>getaddrinfo()</strong></span> with the given host
-  name, and calls getnameinfo() with the resulting IP addresses
+	name, and calls <span class="command"><strong>getnameinfo()</strong></span> with the resulting
-  returned by getaddrinfo(). If the dns.conf file exists and
+	IP addresses returned by <span class="command"><strong>getaddrinfo()</strong></span>. If the
-  defines a trust anchor, the underlying resolver will act as a
+	dns.conf file exists and defines a trust anchor, the underlying
-  validating resolver, and getaddrinfo()/getnameinfo() will fail
+	resolver will act as a validating resolver, and
-  with an EAI_INSECUREDATA error when DNSSEC validation fails.
+	<span class="command"><strong>getaddrinfo()</strong></span>/<span class="command"><strong>getnameinfo()</strong></span>
-  </p>
+	will fail with an EAI_INSECUREDATA error when DNSSEC validation
-  <p>
+	fails.
-  Usage: sample-gai hostname
+      </p>
-  </p>
+      <p>
-  </div>
+	Usage: sample-gai hostname
-  <div class="section">
+      </p>
+    </div>
+    <div class="section">
 <div class="titlepage"><div><div><h4 class="title">
-<a name="id-1.13.2.9.7"></a>sample-update: a simple dynamic update client program</h4></div></div></div>
+<a name="id-1.13.2.8.7"></a>sample-update: a simple dynamic update client program</h4></div></div></div>
       
-  <p>
+      <p>
-  It accepts a single update command as a
+	Accepts a single update command as a command-line argument, sends
-  command-line argument, sends an update request message to the
+	an update request message to the authoritative server, and shows
-  authoritative server, and shows the response from the server. In
+	the response from the server. In other words, this is a simplified
-  other words, this is a simplified <span class="command"><strong>nsupdate</strong></span>.
+	<span class="command"><strong>nsupdate</strong></span>.
-  </p>
+      </p>
-  <p>
+      <p>
-   Usage: sample-update [options] (add|delete) "update data"
+	Usage: sample-update [options] (add|delete) "update data"
-  </p>
+      </p>
-  <p>
+      <p>
-  Options and Arguments:
+	Options and Arguments:
-  </p>
+      </p>
-  <div class="variablelist"><dl class="variablelist">
+      <div class="variablelist"><dl class="variablelist">
-<dt><span class="term">
+<dt><span class="term">-a auth_server</span></dt>
-  -a auth_server
+<dd>
-   </span></dt>
+	    <p>
-<dd><p>
+	      An IP address of the authoritative server that has authority
-	An IP address of the authoritative server that has authority
+	      for the zone containing the update name.  This should
-	for the zone containing the update name.  This should normally
+	      normally be the primary authoritative server that accepts
-	be the primary authoritative server that accepts dynamic
+	      dynamic updates.  It can also be a secondary server that is
-	updates.  It can also be a secondary server that is configured
+	      configured to forward update requests to the primary server.
-	to forward update requests to the primary server.
+	    </p>
-   </p></dd>
+          </dd>
-<dt><span class="term">
+<dt><span class="term">-k keyfile</span></dt>
-  -k keyfile
+<dd>
-   </span></dt>
+	    <p>
-<dd><p>
+	      A TSIG key file to secure the update transaction.  The
-	A TSIG key file to secure the update transaction.  The keyfile
+	      keyfile format is the same as that for the nsupdate utility.
-	format is the same as that for the nsupdate utility.
+	    </p>
-   </p></dd>
+          </dd>
-<dt><span class="term">
+<dt><span class="term">-p prerequisite</span></dt>
-  -p prerequisite
+<dd>
-   </span></dt>
+	    <p>
-<dd><p>
+	      A prerequisite for the update (only one prerequisite can be
-	A prerequisite for the update (only one prerequisite can be
+	      specified).  The prerequisite format is the same as that is
-	specified).  The prerequisite format is the same as that is
+	      accepted by the nsupdate utility.
-	accepted by the nsupdate utility.
+	    </p>
-   </p></dd>
+          </dd>
-<dt><span class="term">
+<dt><span class="term">-r recursive_server</span></dt>
-  -r recursive_server
+<dd>
-   </span></dt>
+	    <p>
-<dd><p>
+	      An IP address of a recursive server that this utility will
-	An IP address of a recursive server that this utility will
+	      use.  A recursive server may be necessary to identify the
-	use.  A recursive server may be necessary to identify the
+	      authoritative server address to which the update request is
-	authoritative server address to which the update request is
+	      sent.
-	sent.
+	    </p>
-   </p></dd>
+          </dd>
-<dt><span class="term">
+<dt><span class="term">-z zonename</span></dt>
-  -z zonename
+<dd>
-   </span></dt>
+	    <p>
-<dd><p>
+	      The domain name of the zone that contains
-	The domain name of the zone that contains
+	    </p>
-   </p></dd>
+          </dd>
-<dt><span class="term">
+<dt><span class="term">(add|delete)</span></dt>
-  (add|delete)
+<dd>
-   </span></dt>
+	    <p>
-<dd><p>
+	      Specify the type of update operation.  Either "add" or
-	Specify the type of update operation.  Either "add" or "delete"
+	      "delete" must be specified.
-	must be specified.
+	    </p>
-   </p></dd>
+          </dd>
-<dt><span class="term">
+<dt><span class="term">"update data"</span></dt>
-  "update data"
+<dd>
-   </span></dt>
+	    <p>
-<dd><p>
+	      Specify the data to be updated.  A typical example of the
-	Specify the data to be updated.  A typical example of the data
+	      data would look like "name TTL RRtype RDATA".
-	would look like "name TTL RRtype RDATA".
+	    </p>
-  </p></dd>
+          </dd>
 </dl></div>
-
+      <div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
-   <div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
 <h3 class="title">Note</h3>
-<p>
+	<p>
-	In practice, either -a or -r must be specified.  Others can
+	  In practice, either -a or -r must be specified.  Others can be
-	be optional; the underlying library routine tries to identify the
+	  optional; the underlying library routine tries to identify the
-	appropriate server and the zone name for the update.
+	  appropriate server and the zone name for the update.
-   </p>
+	</p>
-</div>
+      </div>
-
+      <p>
-   <p>
+	Examples: assuming the primary authoritative server of the
-   Examples: assuming the primary authoritative server of the
+	dynamic.example.com zone has an IPv6 address 2001:db8::1234,
-   dynamic.example.com zone has an IPv6 address 2001:db8::1234,
+      </p>
-   </p>
+      <pre class="screen">
-   <pre class="screen">
 $ <strong class="userinput"><code>sample-update -a sample-update -k Kxxx.+nnn+mmmm.key add "foo.dynamic.example.com 30 IN A 192.168.2.1"</code></strong></pre>
-   <p>
+      <p>
-     adds an A RR for foo.dynamic.example.com using the given key.
+	adds an A RR for foo.dynamic.example.com using the given key.
-   </p>
+      </p>
-   <pre class="screen">
+      <pre class="screen">
 $ <strong class="userinput"><code>sample-update -a sample-update -k Kxxx.+nnn+mmmm.key delete "foo.dynamic.example.com 30 IN A"</code></strong></pre>
-   <p>
+      <p>
-     removes all A RRs for foo.dynamic.example.com using the given key.
+	removes all A RRs for foo.dynamic.example.com using the given key.
-   </p>
+      </p>
-   <pre class="screen">
+      <pre class="screen">
 $ <strong class="userinput"><code>sample-update -a sample-update -k Kxxx.+nnn+mmmm.key delete "foo.dynamic.example.com"</code></strong></pre>
-   <p>
+      <p>
-     removes all RRs for foo.dynamic.example.com using the given key.
+	removes all RRs for foo.dynamic.example.com using the given key.
-   </p>
+      </p>
-  </div>
+    </div>
-  <div class="section">
+    <div class="section">
 <div class="titlepage"><div><div><h4 class="title">
-<a name="id-1.13.2.9.8"></a>nsprobe: domain/name server checker in terms of RFC 4074</h4></div></div></div>
+<a name="id-1.13.2.8.8"></a>nsprobe: domain/name server checker in terms of RFC 4074</h4></div></div></div>
       
-  <p>
+      <p>
-  It checks a set
+	Checks a set of domains to see the name servers of the domains
-  of domains to see the name servers of the domains behave
+	behave correctly in terms of RFC 4074. This is included in the set
-  correctly in terms of RFC 4074. This is included in the set of
+	of sample programs to show how the export library can be used in a
-  sample programs to show how the export library can be used in a
+	DNS-related application.
-  DNS-related application.
+      </p>
-  </p>
+      <p>
-  <p>
+	Usage: nsprobe [-d] [-v [-v...]] [-c cache_address] [input_file]
- Usage: nsprobe [-d] [-v [-v...]] [-c cache_address] [input_file]
+      </p>
-  </p>
+      <p>
-  <p>
+	Options
-   Options
+      </p>
-  </p>
+      <div class="variablelist"><dl class="variablelist">
-
+<dt><span class="term">-d</span></dt>
-  <div class="variablelist"><dl class="variablelist">
+<dd>
-<dt><span class="term">
+	    <p>
-  -d
+	      Run in "debug" mode.  With this option nsprobe will dump
-  </span></dt>
+	      every RRs it receives.
-<dd><p>
+	    </p>
-	run in the "debug" mode.  with this option nsprobe will dump
+          </dd>
-	every RRs it receives.
+<dt><span class="term">-v</span></dt>
-  </p></dd>
+<dd>
-<dt><span class="term">
+	    <p>
-  -v
+	      Increase verbosity of other normal log messages.  This can be
-  </span></dt>
+	      specified multiple times.
-<dd><p>
+	    </p>
-	increase verbosity of other normal log messages.  This can be
+          </dd>
-	specified multiple times
+<dt><span class="term">-c cache_address</span></dt>
-  </p></dd>
+<dd>
-<dt><span class="term">
+	    <p>
-  -c cache_address
+	      Specify an IP address of a recursive (caching) name server.
-  </span></dt>
+	      nsprobe uses this server to get the NS RRset of each domain
-<dd><p>
+	      and the A and/or AAAA RRsets for the name servers.  The
-	specify an IP address of a recursive (caching) name server.
+	      default value is 127.0.0.1.
-	nsprobe uses this server to get the NS RRset of each domain and
+	    </p>
-	the A and/or AAAA RRsets for the name servers.  The default
+          </dd>
-	value is 127.0.0.1.
+<dt><span class="term">input_file</span></dt>
-  </p></dd>
+<dd>
-<dt><span class="term">
+	    <p>
-  input_file
+	      A file name containing a list of domain (zone) names to be
-  </span></dt>
+	      probed.  when omitted the standard input will be used.  Each
-<dd><p>
+	      line of the input file specifies a single domain name such as
-	a file name containing a list of domain (zone) names to be
+	      "example.com".  In general this domain name must be the apex
-	probed.  when omitted the standard input will be used.  Each
+	      name of some DNS zone (unlike normal "host names" such as
-	line of the input file specifies a single domain name such as
+	      "www.example.com").  nsprobe first identifies the NS RRsets
-	"example.com".  In general this domain name must be the apex
+	      for the given domain name, and sends A and AAAA queries to
-	name of some DNS zone (unlike normal "host names" such as
+	      these servers for some "widely used" names under the zone;
-	"www.example.com").  nsprobe first identifies the NS RRsets for
+	      specifically, adding "www" and "ftp" to the zone name.
-	the given domain name, and sends A and AAAA queries to these
+	    </p>
-	servers for some "widely used" names under the zone;
+          </dd>
-	specifically, adding "www" and "ftp" to the zone name.
-  </p></dd>
 </dl></div>
-  </div>
+    </div>
   </div>
   <div class="section">
 <div class="titlepage"><div><div><h3 class="title">
-<a name="id-1.13.2.10"></a>Library References</h3></div></div></div>
+<a name="id-1.13.2.9"></a>Library References</h3></div></div></div>
     
-  <p>As of this writing, there is no formal "manual" of the
+    <p>
-  libraries, except this document, header files (some of them
+      As of this writing, there is no formal "manual" for the libraries,
-  provide pretty detailed explanations), and sample application
+      except this document, header files (some of which provide pretty
-  programs.</p>
+      detailed explanations), and sample application programs.
+    </p>
   </div>
 </div>
     </div>

doc/arm/Bv9ARM.ch13.html

@@ -97,9 +97,6 @@
 <span class="refentrytitle"><a href="man.host.html">host</a></span><span class="refpurpose"> &#8212; DNS lookup utility</span>
 </dt>
 <dt>
-<span class="refentrytitle"><a href="man.isc-hmac-fixup.html"><span class="application">isc-hmac-fixup</span></a></span><span class="refpurpose"> &#8212; fixes HMAC keys generated by older versions of BIND</span>
-</dt>
-<dt>
 <span class="refentrytitle"><a href="man.mdig.html"><span class="application">mdig</span></a></span><span class="refpurpose"> &#8212; DNS pipelined lookup utility</span>
 </dt>
 <dt>
@@ -192,7 +189,6 @@
       
       
       
-      
       
       
     </div>

doc/arm/Bv9ARM.html

@@ -267,13 +267,11 @@
 <dd><dl>
 <dt><span class="section"><a href="Bv9ARM.ch12.html#bind9.library">BIND 9 DNS Library Support</a></span></dt>
 <dd><dl>
-<dt><span class="section"><a href="Bv9ARM.ch12.html#id-1.13.2.4">Prerequisite</a></span></dt>
+<dt><span class="section"><a href="Bv9ARM.ch12.html#id-1.13.2.5">Installation</a></span></dt>
-<dt><span class="section"><a href="Bv9ARM.ch12.html#id-1.13.2.5">Compilation</a></span></dt>
+<dt><span class="section"><a href="Bv9ARM.ch12.html#id-1.13.2.6">Known Defects/Restrictions</a></span></dt>
-<dt><span class="section"><a href="Bv9ARM.ch12.html#id-1.13.2.6">Installation</a></span></dt>
+<dt><span class="section"><a href="Bv9ARM.ch12.html#id-1.13.2.7">The dns.conf File</a></span></dt>
-<dt><span class="section"><a href="Bv9ARM.ch12.html#id-1.13.2.7">Known Defects/Restrictions</a></span></dt>
+<dt><span class="section"><a href="Bv9ARM.ch12.html#id-1.13.2.8">Sample Applications</a></span></dt>
-<dt><span class="section"><a href="Bv9ARM.ch12.html#id-1.13.2.8">The dns.conf File</a></span></dt>
+<dt><span class="section"><a href="Bv9ARM.ch12.html#id-1.13.2.9">Library References</a></span></dt>
-<dt><span class="section"><a href="Bv9ARM.ch12.html#id-1.13.2.9">Sample Applications</a></span></dt>
-<dt><span class="section"><a href="Bv9ARM.ch12.html#id-1.13.2.10">Library References</a></span></dt>
 </dl></dd>
 </dl></dd>
 <dt><span class="reference"><a href="Bv9ARM.ch13.html">I. Manual pages</a></span></dt>
@@ -336,9 +334,6 @@
 <span class="refentrytitle"><a href="man.host.html">host</a></span><span class="refpurpose"> &#8212; DNS lookup utility</span>
 </dt>
 <dt>
-<span class="refentrytitle"><a href="man.isc-hmac-fixup.html"><span class="application">isc-hmac-fixup</span></a></span><span class="refpurpose"> &#8212; fixes HMAC keys generated by older versions of BIND</span>
-</dt>
-<dt>
 <span class="refentrytitle"><a href="man.mdig.html"><span class="application">mdig</span></a></span><span class="refpurpose"> &#8212; DNS pipelined lookup utility</span>
 </dt>
 <dt>

doc/arm/man.dnssec-checkds.html

@@ -51,20 +51,13 @@
 <h2>Synopsis</h2>
     <div class="cmdsynopsis"><p>
       <code class="command">dnssec-checkds</code> 
-       [<code class="option">-l <em class="replaceable"><code>domain</code></em></code>]
-       [<code class="option">-f <em class="replaceable"><code>file</code></em></code>]
        [<code class="option">-d <em class="replaceable"><code>dig path</code></em></code>]
        [<code class="option">-D <em class="replaceable"><code>dsfromkey path</code></em></code>]
+       [<code class="option">-f <em class="replaceable"><code>file</code></em></code>]
+       [<code class="option">-l <em class="replaceable"><code>domain</code></em></code>]
+       [<code class="option">-s <em class="replaceable"><code>file</code></em></code>]
        {zone}
     </p></div>
-    <div class="cmdsynopsis"><p>
-      <code class="command">dnssec-dsfromkey</code> 
-       [<code class="option">-l <em class="replaceable"><code>domain</code></em></code>]
-       [<code class="option">-f <em class="replaceable"><code>file</code></em></code>]
-       [<code class="option">-d <em class="replaceable"><code>dig path</code></em></code>]
-       [<code class="option">-D <em class="replaceable"><code>dsfromkey path</code></em></code>]
-       {zone}
-   </p></div>
   </div>
 
   <div class="refsection">
@@ -97,6 +90,14 @@
             instead of checking for a DS record in the zone's parent.
           </p>
         </dd>
+<dt><span class="term">-s <em class="replaceable"><code>file</code></em></span></dt>
+<dd>
+          <p>
+            Specifies a prepared dsset file, such as would be generated
+            by <span class="command"><strong>dnssec-signzone</strong></span>, to use as a source for
+            the DS RRset instead of querying the parent.
+          </p>
+        </dd>
 <dt><span class="term">-d <em class="replaceable"><code>dig path</code></em></span></dt>
 <dd>
           <p>

doc/arm/man.host.html

@@ -14,7 +14,7 @@
 <link rel="home" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
 <link rel="up" href="Bv9ARM.ch13.html" title="Manual pages">
 <link rel="prev" href="man.genrandom.html" title="genrandom">
-<link rel="next" href="man.isc-hmac-fixup.html" title="isc-hmac-fixup">
+<link rel="next" href="man.mdig.html" title="mdig">
 </head>
 <body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF">
 <div class="navheader">
@@ -24,7 +24,7 @@
 <td width="20%" align="left">
 <a accesskey="p" href="man.genrandom.html">Prev</a> </td>
 <th width="60%" align="center">Manual pages</th>
-<td width="20%" align="right"> <a accesskey="n" href="man.isc-hmac-fixup.html">Next</a>
+<td width="20%" align="right"> <a accesskey="n" href="man.mdig.html">Next</a>
 </td>
 </tr>
 </table>
@@ -363,14 +363,14 @@
 <td width="40%" align="left">
 <a accesskey="p" href="man.genrandom.html">Prev</a> </td>
 <td width="20%" align="center"><a accesskey="u" href="Bv9ARM.ch13.html">Up</a></td>
-<td width="40%" align="right"> <a accesskey="n" href="man.isc-hmac-fixup.html">Next</a>
+<td width="40%" align="right"> <a accesskey="n" href="man.mdig.html">Next</a>
 </td>
 </tr>
 <tr>
 <td width="40%" align="left" valign="top">
 <span class="application">genrandom</span> </td>
 <td width="20%" align="center"><a accesskey="h" href="Bv9ARM.html">Home</a></td>
-<td width="40%" align="right" valign="top"> <span class="application">isc-hmac-fixup</span>
+<td width="40%" align="right" valign="top"> <span class="application">mdig</span>
 </td>
 </tr>
 </table>

doc/arm/man.isc-hmac-fixup.html

@@ -1,130 +0,0 @@
-<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
-<!--
- - Copyright (C) 2000-2017 Internet Systems Consortium, Inc. ("ISC")
- - 
- - This Source Code Form is subject to the terms of the Mozilla Public
- - License, v. 2.0. If a copy of the MPL was not distributed with this
- - file, You can obtain one at http://mozilla.org/MPL/2.0/.
--->
-<html lang="en">
-<head>
-<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
-<title>isc-hmac-fixup</title>
-<meta name="generator" content="DocBook XSL Stylesheets V1.78.1">
-<link rel="home" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
-<link rel="up" href="Bv9ARM.ch13.html" title="Manual pages">
-<link rel="prev" href="man.host.html" title="host">
-<link rel="next" href="man.mdig.html" title="mdig">
-</head>
-<body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF">
-<div class="navheader">
-<table width="100%" summary="Navigation header">
-<tr><th colspan="3" align="center"><span class="application">isc-hmac-fixup</span></th></tr>
-<tr>
-<td width="20%" align="left">
-<a accesskey="p" href="man.host.html">Prev</a> </td>
-<th width="60%" align="center">Manual pages</th>
-<td width="20%" align="right"> <a accesskey="n" href="man.mdig.html">Next</a>
-</td>
-</tr>
-</table>
-<hr>
-</div>
-<div class="refentry">
-<a name="man.isc-hmac-fixup"></a><div class="titlepage"></div>
-  
-  
-
-  
-
-  <div class="refnamediv">
-<h2>Name</h2>
-<p>
-    <span class="application">isc-hmac-fixup</span>
-     &#8212; fixes HMAC keys generated by older versions of BIND
-  </p>
-</div>
-
-  
-
-  <div class="refsynopsisdiv">
-<h2>Synopsis</h2>
-    <div class="cmdsynopsis"><p>
-      <code class="command">isc-hmac-fixup</code> 
-       {<em class="replaceable"><code>algorithm</code></em>}
-       {<em class="replaceable"><code>secret</code></em>}
-    </p></div>
-  </div>
-
-  <div class="refsection">
-<a name="id-1.14.21.7"></a><h2>DESCRIPTION</h2>
-
-    <p>
-      Versions of BIND 9 up to and including BIND 9.6 had a bug causing
-      HMAC-SHA* TSIG keys which were longer than the digest length of the
-      hash algorithm (i.e., SHA1 keys longer than 160 bits, SHA256 keys
-      longer than 256 bits, etc) to be used incorrectly, generating a
-      message authentication code that was incompatible with other DNS
-      implementations.
-    </p>
-    <p>
-      This bug has been fixed in BIND 9.7.  However, the fix may
-      cause incompatibility between older and newer versions of
-      BIND, when using long keys.  <span class="command"><strong>isc-hmac-fixup</strong></span>
-      modifies those keys to restore compatibility.
-    </p>
-    <p>
-      To modify a key, run <span class="command"><strong>isc-hmac-fixup</strong></span> and
-      specify the key's algorithm and secret on the command line.  If the
-      secret is longer than the digest length of the algorithm (64 bytes
-      for SHA1 through SHA256, or 128 bytes for SHA384 and SHA512), then a
-      new secret will be generated consisting of a hash digest of the old
-      secret.  (If the secret did not require conversion, then it will be
-      printed without modification.)
-    </p>
-  </div>
-
-  <div class="refsection">
-<a name="id-1.14.21.8"></a><h2>SECURITY CONSIDERATIONS</h2>
-
-    <p>
-      Secrets that have been converted by <span class="command"><strong>isc-hmac-fixup</strong></span>
-      are shortened, but as this is how the HMAC protocol works in
-      operation anyway, it does not affect security.  RFC 2104 notes,
-      "Keys longer than [the digest length] are acceptable but the
-      extra length would not significantly increase the function
-      strength."
-    </p>
-  </div>
-
-  <div class="refsection">
-<a name="id-1.14.21.9"></a><h2>SEE ALSO</h2>
-
-    <p>
-      <em class="citetitle">BIND 9 Administrator Reference Manual</em>,
-      <em class="citetitle">RFC 2104</em>.
-    </p>
-  </div>
-
-</div>
-<div class="navfooter">
-<hr>
-<table width="100%" summary="Navigation footer">
-<tr>
-<td width="40%" align="left">
-<a accesskey="p" href="man.host.html">Prev</a> </td>
-<td width="20%" align="center"><a accesskey="u" href="Bv9ARM.ch13.html">Up</a></td>
-<td width="40%" align="right"> <a accesskey="n" href="man.mdig.html">Next</a>
-</td>
-</tr>
-<tr>
-<td width="40%" align="left" valign="top">host </td>
-<td width="20%" align="center"><a accesskey="h" href="Bv9ARM.html">Home</a></td>
-<td width="40%" align="right" valign="top"> <span class="application">mdig</span>
-</td>
-</tr>
-</table>
-</div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.12.0b1</p>
-</body>
-</html>

doc/arm/man.mdig.html

@@ -13,7 +13,7 @@
 <meta name="generator" content="DocBook XSL Stylesheets V1.78.1">
 <link rel="home" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
 <link rel="up" href="Bv9ARM.ch13.html" title="Manual pages">
-<link rel="prev" href="man.isc-hmac-fixup.html" title="isc-hmac-fixup">
+<link rel="prev" href="man.host.html" title="host">
 <link rel="next" href="man.named-checkconf.html" title="named-checkconf">
 </head>
 <body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF">
@@ -22,7 +22,7 @@
 <tr><th colspan="3" align="center"><span class="application">mdig</span></th></tr>
 <tr>
 <td width="20%" align="left">
-<a accesskey="p" href="man.isc-hmac-fixup.html">Prev</a> </td>
+<a accesskey="p" href="man.host.html">Prev</a> </td>
 <th width="60%" align="center">Manual pages</th>
 <td width="20%" align="right"> <a accesskey="n" href="man.named-checkconf.html">Next</a>
 </td>
@@ -84,7 +84,7 @@
   </div>
 
   <div class="refsection">
-<a name="id-1.14.22.7"></a><h2>DESCRIPTION</h2>
+<a name="id-1.14.21.7"></a><h2>DESCRIPTION</h2>
 
     <p><span class="command"><strong>mdig</strong></span>
       is a multiple/pipelined query version of <span class="command"><strong>dig</strong></span>:
@@ -134,7 +134,7 @@
   </div>
 
   <div class="refsection">
-<a name="id-1.14.22.8"></a><h2>ANYWHERE OPTIONS</h2>
+<a name="id-1.14.21.8"></a><h2>ANYWHERE OPTIONS</h2>
 
 
     <p>
@@ -158,7 +158,7 @@
   </div>
 
   <div class="refsection">
-<a name="id-1.14.22.9"></a><h2>GLOBAL OPTIONS</h2>
+<a name="id-1.14.21.9"></a><h2>GLOBAL OPTIONS</h2>
 
 
     <p>
@@ -358,7 +358,7 @@
   </div>
 
   <div class="refsection">
-<a name="id-1.14.22.10"></a><h2>LOCAL OPTIONS</h2>
+<a name="id-1.14.21.10"></a><h2>LOCAL OPTIONS</h2>
 
 
     <p>
@@ -583,7 +583,7 @@
   </div>
 
   <div class="refsection">
-<a name="id-1.14.22.11"></a><h2>SEE ALSO</h2>
+<a name="id-1.14.21.11"></a><h2>SEE ALSO</h2>
 
     <p><span class="citerefentry">
         <span class="refentrytitle">dig</span>(1)
@@ -597,14 +597,13 @@
 <table width="100%" summary="Navigation footer">
 <tr>
 <td width="40%" align="left">
-<a accesskey="p" href="man.isc-hmac-fixup.html">Prev</a> </td>
+<a accesskey="p" href="man.host.html">Prev</a> </td>
 <td width="20%" align="center"><a accesskey="u" href="Bv9ARM.ch13.html">Up</a></td>
 <td width="40%" align="right"> <a accesskey="n" href="man.named-checkconf.html">Next</a>
 </td>
 </tr>
 <tr>
-<td width="40%" align="left" valign="top">
+<td width="40%" align="left" valign="top">host </td>
-<span class="application">isc-hmac-fixup</span> </td>
 <td width="20%" align="center"><a accesskey="h" href="Bv9ARM.html">Home</a></td>
 <td width="40%" align="right" valign="top"> <span class="application">named-checkconf</span>
 </td>

doc/arm/man.named-checkconf.html

@@ -61,7 +61,7 @@
   </div>
 
   <div class="refsection">
-<a name="id-1.14.23.7"></a><h2>DESCRIPTION</h2>
+<a name="id-1.14.22.7"></a><h2>DESCRIPTION</h2>
 
     <p><span class="command"><strong>named-checkconf</strong></span>
       checks the syntax, but not the semantics, of a
@@ -83,7 +83,7 @@
   </div>
 
   <div class="refsection">
-<a name="id-1.14.23.8"></a><h2>OPTIONS</h2>
+<a name="id-1.14.22.8"></a><h2>OPTIONS</h2>
 
     <div class="variablelist"><dl class="variablelist">
 <dt><span class="term">-h</span></dt>
@@ -160,7 +160,7 @@
   </div>
 
   <div class="refsection">
-<a name="id-1.14.23.9"></a><h2>RETURN VALUES</h2>
+<a name="id-1.14.22.9"></a><h2>RETURN VALUES</h2>
 
     <p><span class="command"><strong>named-checkconf</strong></span>
       returns an exit status of 1 if
@@ -169,7 +169,7 @@
   </div>
 
   <div class="refsection">
-<a name="id-1.14.23.10"></a><h2>SEE ALSO</h2>
+<a name="id-1.14.22.10"></a><h2>SEE ALSO</h2>
 
     <p><span class="citerefentry">
         <span class="refentrytitle">named</span>(8)

doc/arm/man.named-checkzone.html

@@ -111,7 +111,7 @@
   </div>
 
   <div class="refsection">
-<a name="id-1.14.24.7"></a><h2>DESCRIPTION</h2>
+<a name="id-1.14.23.7"></a><h2>DESCRIPTION</h2>
 
     <p><span class="command"><strong>named-checkzone</strong></span>
       checks the syntax and integrity of a zone file.  It performs the
@@ -133,7 +133,7 @@
   </div>
 
   <div class="refsection">
-<a name="id-1.14.24.8"></a><h2>OPTIONS</h2>
+<a name="id-1.14.23.8"></a><h2>OPTIONS</h2>
 
 
     <div class="variablelist"><dl class="variablelist">
@@ -421,7 +421,7 @@
   </div>
 
   <div class="refsection">
-<a name="id-1.14.24.9"></a><h2>RETURN VALUES</h2>
+<a name="id-1.14.23.9"></a><h2>RETURN VALUES</h2>
 
     <p><span class="command"><strong>named-checkzone</strong></span>
       returns an exit status of 1 if
@@ -430,7 +430,7 @@
   </div>
 
   <div class="refsection">
-<a name="id-1.14.24.10"></a><h2>SEE ALSO</h2>
+<a name="id-1.14.23.10"></a><h2>SEE ALSO</h2>
 
     <p><span class="citerefentry">
         <span class="refentrytitle">named</span>(8)

doc/arm/man.named-journalprint.html

@@ -56,7 +56,7 @@
   </div>
 
   <div class="refsection">
-<a name="id-1.14.25.7"></a><h2>DESCRIPTION</h2>
+<a name="id-1.14.24.7"></a><h2>DESCRIPTION</h2>
 
     <p>
       <span class="command"><strong>named-journalprint</strong></span>
@@ -84,7 +84,7 @@
   </div>
 
   <div class="refsection">
-<a name="id-1.14.25.8"></a><h2>SEE ALSO</h2>
+<a name="id-1.14.24.8"></a><h2>SEE ALSO</h2>
 
     <p>
       <span class="citerefentry">

doc/arm/man.named-nzd2nzf.html

@@ -57,7 +57,7 @@
   </div>
 
   <div class="refsect1">
-<a name="id-1.14.26.6"></a><h2>DESCRIPTION</h2>
+<a name="id-1.14.25.6"></a><h2>DESCRIPTION</h2>
     
     <p>
       <span class="command"><strong>named-nzd2nzf</strong></span> converts an NZD database to NZF
@@ -71,7 +71,7 @@
   </div>
 
   <div class="refsect1">
-<a name="id-1.14.26.7"></a><h2>ARGUMENTS</h2>
+<a name="id-1.14.25.7"></a><h2>ARGUMENTS</h2>
     
     <div class="variablelist"><dl class="variablelist">
 <dt><span class="term">filename</span></dt>
@@ -85,7 +85,7 @@
   </div>
 
   <div class="refsect1">
-<a name="id-1.14.26.8"></a><h2>SEE ALSO</h2>
+<a name="id-1.14.25.8"></a><h2>SEE ALSO</h2>
     
     <p>
       <em class="citetitle">BIND 9 Administrator Reference Manual</em>
@@ -93,7 +93,7 @@
   </div>
 
   <div class="refsect1">
-<a name="id-1.14.26.9"></a><h2>AUTHOR</h2>
+<a name="id-1.14.25.9"></a><h2>AUTHOR</h2>
     
     <p><span class="corpauthor">Internet Systems Consortium</span>
     </p>

doc/arm/man.named-rrchecker.html

@@ -60,7 +60,7 @@
   </div>
 
   <div class="refsection">
-<a name="id-1.14.27.7"></a><h2>DESCRIPTION</h2>
+<a name="id-1.14.26.7"></a><h2>DESCRIPTION</h2>
 
     <p><span class="command"><strong>named-rrchecker</strong></span>
      read a individual DNS resource record from standard input and checks if it
@@ -90,7 +90,7 @@
   </div>
 
   <div class="refsection">
-<a name="id-1.14.27.8"></a><h2>SEE ALSO</h2>
+<a name="id-1.14.26.8"></a><h2>SEE ALSO</h2>
 
     <p>
       <em class="citetitle">RFC 1034</em>,

doc/arm/man.named.conf.html

@@ -55,7 +55,7 @@
   </div>
 
   <div class="refsection">
-<a name="id-1.14.28.7"></a><h2>DESCRIPTION</h2>
+<a name="id-1.14.27.7"></a><h2>DESCRIPTION</h2>
 
     <p><code class="filename">named.conf</code> is the configuration file
       for
@@ -76,7 +76,7 @@
   </div>
 
   <div class="refsection">
-<a name="id-1.14.28.8"></a><h2>ACL</h2>
+<a name="id-1.14.27.8"></a><h2>ACL</h2>
 
     <div class="literallayout"><p><br>
 acl <em class="replaceable"><code>string</code></em> { <em class="replaceable"><code>address_match_element</code></em>; ... };<br>
@@ -84,7 +84,7 @@ acl
   </div>
 
   <div class="refsection">
-<a name="id-1.14.28.9"></a><h2>CONTROLS</h2>
+<a name="id-1.14.27.9"></a><h2>CONTROLS</h2>
 
     <div class="literallayout"><p><br>
 controls {<br>
@@ -102,7 +102,7 @@ controls
   </div>
 
   <div class="refsection">
-<a name="id-1.14.28.10"></a><h2>DLZ</h2>
+<a name="id-1.14.27.10"></a><h2>DLZ</h2>
 
     <div class="literallayout"><p><br>
 dlz <em class="replaceable"><code>string</code></em> {<br>
@@ -113,7 +113,7 @@ dlz
   </div>
 
   <div class="refsection">
-<a name="id-1.14.28.11"></a><h2>DYNDB</h2>
+<a name="id-1.14.27.11"></a><h2>DYNDB</h2>
 
     <div class="literallayout"><p><br>
 dyndb <em class="replaceable"><code>string</code></em> <em class="replaceable"><code>quoted_string</code></em> {<br>
@@ -122,7 +122,7 @@ dyndb
   </div>
 
   <div class="refsection">
-<a name="id-1.14.28.12"></a><h2>KEY</h2>
+<a name="id-1.14.27.12"></a><h2>KEY</h2>
 
     <div class="literallayout"><p><br>
 key <em class="replaceable"><code>string</code></em> {<br>
@@ -133,7 +133,7 @@ key
   </div>
 
   <div class="refsection">
-<a name="id-1.14.28.13"></a><h2>LOGGING</h2>
+<a name="id-1.14.27.13"></a><h2>LOGGING</h2>
 
     <div class="literallayout"><p><br>
 logging {<br>
@@ -155,7 +155,7 @@ logging
   </div>
 
   <div class="refsection">
-<a name="id-1.14.28.14"></a><h2>MANAGED-KEYS</h2>
+<a name="id-1.14.27.14"></a><h2>MANAGED-KEYS</h2>
 
     <div class="literallayout"><p><br>
 managed-keys { <em class="replaceable"><code>string</code></em> <em class="replaceable"><code>string</code></em> <em class="replaceable"><code>integer</code></em><br>
@@ -164,7 +164,7 @@ managed-keys
   </div>
 
   <div class="refsection">
-<a name="id-1.14.28.15"></a><h2>MASTERS</h2>
+<a name="id-1.14.27.15"></a><h2>MASTERS</h2>
 
     <div class="literallayout"><p><br>
 masters <em class="replaceable"><code>string</code></em> [<span class="optional"> port <em class="replaceable"><code>integer</code></em> </span>] [<span class="optional"> dscp<br>
@@ -175,7 +175,7 @@ masters
   </div>
 
   <div class="refsection">
-<a name="id-1.14.28.16"></a><h2>OPTIONS</h2>
+<a name="id-1.14.27.16"></a><h2>OPTIONS</h2>
 
     <div class="literallayout"><p><br>
 options {<br>
@@ -466,7 +466,7 @@ options
   </div>
 
   <div class="refsection">
-<a name="id-1.14.28.17"></a><h2>SERVER</h2>
+<a name="id-1.14.27.17"></a><h2>SERVER</h2>
 
     <div class="literallayout"><p><br>
 server <em class="replaceable"><code>netprefix</code></em> {<br>
@@ -505,7 +505,7 @@ server
   </div>
 
   <div class="refsection">
-<a name="id-1.14.28.18"></a><h2>STATISTICS-CHANNELS</h2>
+<a name="id-1.14.27.18"></a><h2>STATISTICS-CHANNELS</h2>
 
     <div class="literallayout"><p><br>
 statistics-channels {<br>
@@ -518,7 +518,7 @@ statistics-channels
   </div>
 
   <div class="refsection">
-<a name="id-1.14.28.19"></a><h2>TRUSTED-KEYS</h2>
+<a name="id-1.14.27.19"></a><h2>TRUSTED-KEYS</h2>
 
     <div class="literallayout"><p><br>
 trusted-keys { <em class="replaceable"><code>string</code></em> <em class="replaceable"><code>integer</code></em> <em class="replaceable"><code>integer</code></em><br>
@@ -527,7 +527,7 @@ trusted-keys
   </div>
 
   <div class="refsection">
-<a name="id-1.14.28.20"></a><h2>VIEW</h2>
+<a name="id-1.14.27.20"></a><h2>VIEW</h2>
 
     <div class="literallayout"><p><br>
 view <em class="replaceable"><code>string</code></em> [<span class="optional"> <em class="replaceable"><code>class</code></em> </span>] {<br>
@@ -891,7 +891,7 @@ view
   </div>
 
   <div class="refsection">
-<a name="id-1.14.28.21"></a><h2>ZONE</h2>
+<a name="id-1.14.27.21"></a><h2>ZONE</h2>
 
     <div class="literallayout"><p><br>
 zone <em class="replaceable"><code>string</code></em> [<span class="optional"> <em class="replaceable"><code>class</code></em> </span>] {<br>
@@ -991,14 +991,14 @@ zone
   </div>
 
   <div class="refsection">
-<a name="id-1.14.28.22"></a><h2>FILES</h2>
+<a name="id-1.14.27.22"></a><h2>FILES</h2>
 
     <p><code class="filename">/etc/named.conf</code>
     </p>
   </div>
 
   <div class="refsection">
-<a name="id-1.14.28.23"></a><h2>SEE ALSO</h2>
+<a name="id-1.14.27.23"></a><h2>SEE ALSO</h2>
 
     <p><span class="citerefentry">
 	<span class="refentrytitle">ddns-confgen</span>(8)

doc/arm/man.named.html

@@ -79,7 +79,7 @@
   </div>
 
   <div class="refsection">
-<a name="id-1.14.29.7"></a><h2>DESCRIPTION</h2>
+<a name="id-1.14.28.7"></a><h2>DESCRIPTION</h2>
 
     <p><span class="command"><strong>named</strong></span>
       is a Domain Name System (DNS) server,
@@ -96,7 +96,7 @@
   </div>
 
   <div class="refsection">
-<a name="id-1.14.29.8"></a><h2>OPTIONS</h2>
+<a name="id-1.14.28.8"></a><h2>OPTIONS</h2>
 
 
     <div class="variablelist"><dl class="variablelist">
@@ -375,7 +375,7 @@
   </div>
 
   <div class="refsection">
-<a name="id-1.14.29.9"></a><h2>SIGNALS</h2>
+<a name="id-1.14.28.9"></a><h2>SIGNALS</h2>
 
     <p>
       In routine operation, signals should not be used to control
@@ -405,7 +405,7 @@
   </div>
 
   <div class="refsection">
-<a name="id-1.14.29.10"></a><h2>CONFIGURATION</h2>
+<a name="id-1.14.28.10"></a><h2>CONFIGURATION</h2>
 
     <p>
       The <span class="command"><strong>named</strong></span> configuration file is too complex
@@ -426,7 +426,7 @@
   </div>
 
   <div class="refsection">
-<a name="id-1.14.29.11"></a><h2>FILES</h2>
+<a name="id-1.14.28.11"></a><h2>FILES</h2>
 
 
     <div class="variablelist"><dl class="variablelist">
@@ -447,7 +447,7 @@
   </div>
 
   <div class="refsection">
-<a name="id-1.14.29.12"></a><h2>SEE ALSO</h2>
+<a name="id-1.14.28.12"></a><h2>SEE ALSO</h2>
 
     <p><em class="citetitle">RFC 1033</em>,
       <em class="citetitle">RFC 1034</em>,

doc/arm/man.nsec3hash.html

@@ -67,7 +67,7 @@
   </div>
 
   <div class="refsection">
-<a name="id-1.14.30.7"></a><h2>DESCRIPTION</h2>
+<a name="id-1.14.29.7"></a><h2>DESCRIPTION</h2>
 
     <p>
       <span class="command"><strong>nsec3hash</strong></span> generates an NSEC3 hash based on
@@ -87,7 +87,7 @@
   </div>
 
   <div class="refsection">
-<a name="id-1.14.30.8"></a><h2>ARGUMENTS</h2>
+<a name="id-1.14.29.8"></a><h2>ARGUMENTS</h2>
 
     <div class="variablelist"><dl class="variablelist">
 <dt><span class="term">salt</span></dt>
@@ -128,7 +128,7 @@
   </div>
 
   <div class="refsection">
-<a name="id-1.14.30.9"></a><h2>SEE ALSO</h2>
+<a name="id-1.14.29.9"></a><h2>SEE ALSO</h2>
 
     <p>
       <em class="citetitle">BIND 9 Administrator Reference Manual</em>,

doc/arm/man.nslookup.html

@@ -58,7 +58,7 @@
   </div>
 
   <div class="refsection">
-<a name="id-1.14.31.7"></a><h2>DESCRIPTION</h2>
+<a name="id-1.14.30.7"></a><h2>DESCRIPTION</h2>
 
     <p><span class="command"><strong>Nslookup</strong></span>
       is a program to query Internet domain name servers.  <span class="command"><strong>Nslookup</strong></span>
@@ -72,7 +72,7 @@
   </div>
 
   <div class="refsection">
-<a name="id-1.14.31.8"></a><h2>ARGUMENTS</h2>
+<a name="id-1.14.30.8"></a><h2>ARGUMENTS</h2>
 
     <p>
       Interactive mode is entered in the following cases:
@@ -121,7 +121,7 @@ nslookup -query=hinfo  -timeout=10
   </div>
 
   <div class="refsection">
-<a name="id-1.14.31.9"></a><h2>INTERACTIVE COMMANDS</h2>
+<a name="id-1.14.30.9"></a><h2>INTERACTIVE COMMANDS</h2>
 
     <div class="variablelist"><dl class="variablelist">
 <dt><span class="term"><code class="constant">host</code> [<span class="optional">server</span>]</span></dt>
@@ -372,7 +372,7 @@ nslookup -query=hinfo  -timeout=10
   </div>
 
   <div class="refsection">
-<a name="id-1.14.31.10"></a><h2>RETURN VALUES</h2>
+<a name="id-1.14.30.10"></a><h2>RETURN VALUES</h2>
     <p>
       <span class="command"><strong>nslookup</strong></span> returns with an exit status of 1
       if any query failed, and 0 otherwise.
@@ -380,14 +380,14 @@ nslookup -query=hinfo  -timeout=10
   </div>
 
   <div class="refsection">
-<a name="id-1.14.31.11"></a><h2>FILES</h2>
+<a name="id-1.14.30.11"></a><h2>FILES</h2>
 
     <p><code class="filename">/etc/resolv.conf</code>
     </p>
   </div>
 
   <div class="refsection">
-<a name="id-1.14.31.12"></a><h2>SEE ALSO</h2>
+<a name="id-1.14.30.12"></a><h2>SEE ALSO</h2>
 
     <p><span class="citerefentry">
         <span class="refentrytitle">dig</span>(1)

doc/arm/man.nsupdate.html

@@ -78,7 +78,7 @@
   </div>
 
   <div class="refsection">
-<a name="id-1.14.32.7"></a><h2>DESCRIPTION</h2>
+<a name="id-1.14.31.7"></a><h2>DESCRIPTION</h2>
 
     <p><span class="command"><strong>nsupdate</strong></span>
       is used to submit Dynamic DNS Update requests as defined in RFC 2136
@@ -138,7 +138,7 @@
   </div>
 
   <div class="refsection">
-<a name="id-1.14.32.8"></a><h2>OPTIONS</h2>
+<a name="id-1.14.31.8"></a><h2>OPTIONS</h2>
 
 
     <div class="variablelist"><dl class="variablelist">
@@ -322,7 +322,7 @@
   </div>
 
   <div class="refsection">
-<a name="id-1.14.32.9"></a><h2>INPUT FORMAT</h2>
+<a name="id-1.14.31.9"></a><h2>INPUT FORMAT</h2>
 
     <p><span class="command"><strong>nsupdate</strong></span>
       reads input from
@@ -686,7 +686,7 @@
   </div>
 
   <div class="refsection">
-<a name="id-1.14.32.10"></a><h2>EXAMPLES</h2>
+<a name="id-1.14.31.10"></a><h2>EXAMPLES</h2>
 
     <p>
       The examples below show how
@@ -742,7 +742,7 @@
   </div>
 
   <div class="refsection">
-<a name="id-1.14.32.11"></a><h2>FILES</h2>
+<a name="id-1.14.31.11"></a><h2>FILES</h2>
 
 
     <div class="variablelist"><dl class="variablelist">
@@ -780,7 +780,7 @@
   </div>
 
   <div class="refsection">
-<a name="id-1.14.32.12"></a><h2>SEE ALSO</h2>
+<a name="id-1.14.31.12"></a><h2>SEE ALSO</h2>
 
     <p>
       <em class="citetitle">RFC 2136</em>,
@@ -803,7 +803,7 @@
   </div>
 
   <div class="refsection">
-<a name="id-1.14.32.13"></a><h2>BUGS</h2>
+<a name="id-1.14.31.13"></a><h2>BUGS</h2>
 
     <p>
       The TSIG key is redundantly stored in two separate files.

doc/arm/man.pkcs11-destroy.html

@@ -63,7 +63,7 @@
   </div>
 
   <div class="refsection">
-<a name="id-1.14.33.7"></a><h2>DESCRIPTION</h2>
+<a name="id-1.14.32.7"></a><h2>DESCRIPTION</h2>
 
     <p>
       <span class="command"><strong>pkcs11-destroy</strong></span> destroys keys stored in a
@@ -78,7 +78,7 @@
   </div>
 
   <div class="refsection">
-<a name="id-1.14.33.8"></a><h2>ARGUMENTS</h2>
+<a name="id-1.14.32.8"></a><h2>ARGUMENTS</h2>
 
     <div class="variablelist"><dl class="variablelist">
 <dt><span class="term">-m <em class="replaceable"><code>module</code></em></span></dt>
@@ -127,7 +127,7 @@
   </div>
 
   <div class="refsection">
-<a name="id-1.14.33.9"></a><h2>SEE ALSO</h2>
+<a name="id-1.14.32.9"></a><h2>SEE ALSO</h2>
 
     <p>
       <span class="citerefentry">

doc/arm/man.pkcs11-keygen.html

@@ -66,7 +66,7 @@
   </div>
 
   <div class="refsection">
-<a name="id-1.14.34.7"></a><h2>DESCRIPTION</h2>
+<a name="id-1.14.33.7"></a><h2>DESCRIPTION</h2>
 
     <p>
       <span class="command"><strong>pkcs11-keygen</strong></span> causes a PKCS#11 device to generate
@@ -76,7 +76,7 @@
   </div>
 
   <div class="refsection">
-<a name="id-1.14.34.8"></a><h2>ARGUMENTS</h2>
+<a name="id-1.14.33.8"></a><h2>ARGUMENTS</h2>
 
     <div class="variablelist"><dl class="variablelist">
 <dt><span class="term">-a <em class="replaceable"><code>algorithm</code></em></span></dt>
@@ -162,7 +162,7 @@
   </div>
 
   <div class="refsection">
-<a name="id-1.14.34.9"></a><h2>SEE ALSO</h2>
+<a name="id-1.14.33.9"></a><h2>SEE ALSO</h2>
 
     <p>
       <span class="citerefentry">

doc/arm/man.pkcs11-list.html

@@ -61,7 +61,7 @@
   </div>
 
   <div class="refsection">
-<a name="id-1.14.35.7"></a><h2>DESCRIPTION</h2>
+<a name="id-1.14.34.7"></a><h2>DESCRIPTION</h2>
 
     <p>
       <span class="command"><strong>pkcs11-list</strong></span>
@@ -75,7 +75,7 @@
   </div>
 
   <div class="refsection">
-<a name="id-1.14.35.8"></a><h2>ARGUMENTS</h2>
+<a name="id-1.14.34.8"></a><h2>ARGUMENTS</h2>
 
     <div class="variablelist"><dl class="variablelist">
 <dt><span class="term">-P</span></dt>
@@ -123,7 +123,7 @@
   </div>
 
   <div class="refsection">
-<a name="id-1.14.35.9"></a><h2>SEE ALSO</h2>
+<a name="id-1.14.34.9"></a><h2>SEE ALSO</h2>
 
     <p>
       <span class="citerefentry">

doc/arm/man.pkcs11-tokens.html

@@ -57,7 +57,7 @@
   </div>
 
   <div class="refsection">
-<a name="id-1.14.36.7"></a><h2>DESCRIPTION</h2>
+<a name="id-1.14.35.7"></a><h2>DESCRIPTION</h2>
 
     <p>
       <span class="command"><strong>pkcs11-tokens</strong></span>
@@ -67,7 +67,7 @@
   </div>
 
   <div class="refsection">
-<a name="id-1.14.36.8"></a><h2>ARGUMENTS</h2>
+<a name="id-1.14.35.8"></a><h2>ARGUMENTS</h2>
 
     <div class="variablelist"><dl class="variablelist">
 <dt><span class="term">-m <em class="replaceable"><code>module</code></em></span></dt>
@@ -88,7 +88,7 @@
   </div>
 
   <div class="refsection">
-<a name="id-1.14.36.9"></a><h2>SEE ALSO</h2>
+<a name="id-1.14.35.9"></a><h2>SEE ALSO</h2>
 
     <p>
       <span class="citerefentry">

doc/arm/man.rndc-confgen.html

@@ -66,7 +66,7 @@
   </div>
 
   <div class="refsection">
-<a name="id-1.14.37.7"></a><h2>DESCRIPTION</h2>
+<a name="id-1.14.36.7"></a><h2>DESCRIPTION</h2>
 
     <p><span class="command"><strong>rndc-confgen</strong></span>
       generates configuration files
@@ -85,7 +85,7 @@
   </div>
 
   <div class="refsection">
-<a name="id-1.14.37.8"></a><h2>OPTIONS</h2>
+<a name="id-1.14.36.8"></a><h2>OPTIONS</h2>
 
 
     <div class="variablelist"><dl class="variablelist">
@@ -131,12 +131,7 @@
           <p>
             Specifies the algorithm to use for the TSIG key.  Available
             choices are: hmac-md5, hmac-sha1, hmac-sha224, hmac-sha256,
-            hmac-sha384 and hmac-sha512.  The default is hmac-md5, or
+            hmac-sha384 and hmac-sha512.  The default is hmac-sha256.
-            if MD5 was disabled at compile time, hmac-sha256.
-          </p>
-          <p>
-            Note: Use of hmac-md5 is no longer recommended, and the default
-            value will be changed to hmac-sha256 in a future release.
           </p>
         </dd>
 <dt><span class="term">-b <em class="replaceable"><code>keysize</code></em></span></dt>
@@ -227,7 +222,7 @@
   </div>
 
   <div class="refsection">
-<a name="id-1.14.37.9"></a><h2>EXAMPLES</h2>
+<a name="id-1.14.36.9"></a><h2>EXAMPLES</h2>
 
     <p>
       To allow <span class="command"><strong>rndc</strong></span> to be used with
@@ -246,7 +241,7 @@
   </div>
 
   <div class="refsection">
-<a name="id-1.14.37.10"></a><h2>SEE ALSO</h2>
+<a name="id-1.14.36.10"></a><h2>SEE ALSO</h2>
 
     <p><span class="citerefentry">
         <span class="refentrytitle">rndc</span>(8)

doc/arm/man.rndc.conf.html

@@ -55,7 +55,7 @@
   </div>
 
   <div class="refsection">
-<a name="id-1.14.38.7"></a><h2>DESCRIPTION</h2>
+<a name="id-1.14.37.7"></a><h2>DESCRIPTION</h2>
 
     <p><code class="filename">rndc.conf</code> is the configuration file
       for <span class="command"><strong>rndc</strong></span>, the BIND 9 name server control
@@ -143,7 +143,7 @@
   </div>
 
   <div class="refsection">
-<a name="id-1.14.38.8"></a><h2>EXAMPLE</h2>
+<a name="id-1.14.37.8"></a><h2>EXAMPLE</h2>
 
 
     <pre class="programlisting">
@@ -221,7 +221,7 @@
   </div>
 
   <div class="refsection">
-<a name="id-1.14.38.9"></a><h2>NAME SERVER CONFIGURATION</h2>
+<a name="id-1.14.37.9"></a><h2>NAME SERVER CONFIGURATION</h2>
 
     <p>
       The name server must be configured to accept rndc connections and
@@ -233,7 +233,7 @@
   </div>
 
   <div class="refsection">
-<a name="id-1.14.38.10"></a><h2>SEE ALSO</h2>
+<a name="id-1.14.37.10"></a><h2>SEE ALSO</h2>
 
     <p><span class="citerefentry">
         <span class="refentrytitle">rndc</span>(8)

doc/arm/man.rndc.html

@@ -67,7 +67,7 @@
   </div>
 
   <div class="refsection">
-<a name="id-1.14.39.7"></a><h2>DESCRIPTION</h2>
+<a name="id-1.14.38.7"></a><h2>DESCRIPTION</h2>
 
     <p><span class="command"><strong>rndc</strong></span>
       controls the operation of a name
@@ -100,7 +100,7 @@
   </div>
 
   <div class="refsection">
-<a name="id-1.14.39.8"></a><h2>OPTIONS</h2>
+<a name="id-1.14.38.8"></a><h2>OPTIONS</h2>
 
 
     <div class="variablelist"><dl class="variablelist">
@@ -210,7 +210,7 @@
   </div>
 
   <div class="refsection">
-<a name="id-1.14.39.9"></a><h2>COMMANDS</h2>
+<a name="id-1.14.38.9"></a><h2>COMMANDS</h2>
 
     <p>
       A list of commands supported by <span class="command"><strong>rndc</strong></span> can
@@ -945,7 +945,7 @@
   </div>
 
   <div class="refsection">
-<a name="id-1.14.39.10"></a><h2>LIMITATIONS</h2>
+<a name="id-1.14.38.10"></a><h2>LIMITATIONS</h2>
 
     <p>
       There is currently no way to provide the shared secret for a
@@ -957,7 +957,7 @@
   </div>
 
   <div class="refsection">
-<a name="id-1.14.39.11"></a><h2>SEE ALSO</h2>
+<a name="id-1.14.38.11"></a><h2>SEE ALSO</h2>
 
     <p><span class="citerefentry">
 	<span class="refentrytitle">rndc.conf</span>(5)

doc/arm/notes.html

@@ -458,6 +458,14 @@
 	  <span class="command"><strong>dnssec-settime</strong></span>, etc. [RT #46149]
 	</p>
       </li>
+<li class="listitem">
+	<p>
+	  <span class="command"><strong>dnssec-checkds -s</strong></span> specifies a file from
+	  which to read a DS set rather than querying the parent zone.
+	  This can be used to check zone correctness prior to
+	  publication. Thanks to Niall O'Reilly [RT #44667]
+	</p>
+      </li>
 </ul></div>
   </div>
 
@@ -503,11 +511,17 @@
 <li class="listitem">
 	<p>
 	  The use of HMAC-MD5 for RNDC keys is no longer recommended.
-	  For compatibility, this is still the default algorithm generated
+	  The default algorithm generated by <span class="command"><strong>rndc-confgen</strong></span>,
-	  by <span class="command"><strong>rndc-confgen</strong></span>, but it will print a
+	  is now HMAC-256, and a warning message will be printed if
-	  warning message. The default algorithm in
+	  HMAC-MD5 is used. [RT #42272]
-	  <span class="command"><strong>rndc-confgen</strong></span> will be changed to HMAC-SHA256
+	</p>
-	  in a future release. [RT #42272]
+      </li>
+<li class="listitem">
+	<p>
+	  The <span class="command"><strong>isc-hmac-fixup</strong></span> command, which was created
+	  to address an interoperability problem in TSIG keys between
+	  early versions of BIND and other DNS implmentations, is now
+	  obsolete and has been removed. [RT #46411]
 	</p>
       </li>
 </ul></div>
@@ -566,6 +580,16 @@
 	  are not writable by the effective user ID. [RT #46077]
 	</p>
       </li>
+<li class="listitem">
+	<p>
+	  Initializing keys specified in a <span class="command"><strong>managed-keys</strong></span>
+	  statement or by <span class="command"><strong>dnssec-validation auto;</strong></span> are
+	  now tagged as "initializing", until they have been updated by a
+	  key refresh query. If key maintenance fails to initialize,
+	  this will be visible when running <span class="command"><strong>rndc secroots</strong></span>.
+	  [RT #46267]
+	</p>
+      </li>
 <li class="listitem">
 	<p>
 	  Previously, <span class="command"><strong>update-policy local;</strong></span> accepted
@@ -689,6 +713,12 @@
 	  queries. [RT #45847]
 	</p>
       </li>
+<li class="listitem">
+	<p>
+	  A new statistics counter has been added to track priming
+	  queries. [RT #46313]
+	</p>
+      </li>
 <li class="listitem">
 	<p>
 	  The <span class="command"><strong>dnssec-signzone -x</strong></span> flag and the
@@ -707,6 +737,13 @@
 	  catagory.
 	</p>
       </li>
+<li class="listitem">
+	<p>
+	  The <span class="command"><strong>filter-aaaa-on-v4</strong></span> and
+	  <span class="command"><strong>filter-aaaa-on-v6</strong></span> options are no longer
+	  conditionally compiled in <span class="command"><strong>named</strong></span>. [RT #46340]
+	</p>
+      </li>
 </ul></div>
   </div>
 

doc/arm/notes.xml

@@ -449,6 +449,14 @@
 	  <command>dnssec-settime</command>, etc. [RT #46149]
 	</para>
       </listitem>
+      <listitem>
+	<para>
+	  <command>dnssec-checkds -s</command> specifies a file from
+	  which to read a DS set rather than querying the parent zone.
+	  This can be used to check zone correctness prior to
+	  publication. Thanks to Niall O'Reilly [RT #44667]
+	</para>
+      </listitem>
     </itemizedlist>
   </section>
 
@@ -492,11 +500,17 @@
       <listitem>
 	<para>
 	  The use of HMAC-MD5 for RNDC keys is no longer recommended.
-	  For compatibility, this is still the default algorithm generated
+	  The default algorithm generated by <command>rndc-confgen</command>,
-	  by <command>rndc-confgen</command>, but it will print a
+	  is now HMAC-256, and a warning message will be printed if
-	  warning message. The default algorithm in
+	  HMAC-MD5 is used. [RT #42272]
-	  <command>rndc-confgen</command> will be changed to HMAC-SHA256
+	</para>
-	  in a future release. [RT #42272]
+      </listitem>
+      <listitem>
+	<para>
+	  The <command>isc-hmac-fixup</command> command, which was created
+	  to address an interoperability problem in TSIG keys between
+	  early versions of BIND and other DNS implmentations, is now
+	  obsolete and has been removed. [RT #46411]
 	</para>
       </listitem>
     </itemizedlist>
@@ -552,6 +566,16 @@
 	  are not writable by the effective user ID. [RT #46077]
 	</para>
       </listitem>
+      <listitem>
+	<para>
+	  Initializing keys specified in a <command>managed-keys</command>
+	  statement or by <command>dnssec-validation auto;</command> are
+	  now tagged as "initializing", until they have been updated by a
+	  key refresh query. If key maintenance fails to initialize,
+	  this will be visible when running <command>rndc secroots</command>.
+	  [RT #46267]
+	</para>
+      </listitem>
       <listitem>
 	<para>
 	  Previously, <command>update-policy local;</command> accepted
@@ -675,6 +699,12 @@
 	  queries. [RT #45847]
 	</para>
       </listitem>
+      <listitem>
+	<para>
+	  A new statistics counter has been added to track priming
+	  queries. [RT #46313]
+	</para>
+      </listitem>
       <listitem>
 	<para>
 	  The <command>dnssec-signzone -x</command> flag and the

doc/dev/dev.md

@@ -22,6 +22,7 @@
     * [Lists](#lists)
     * [Buffers and regions](#buffers)
     * [Names](#names)
+    * [Rdata Classes](#rdata)
     * [Iterators](#iterators)
     * [Logging](#logging)
     * [Adding a new RR type](#rrtype)
@@ -875,6 +876,38 @@ name.  This allows names to be stack-allocated with minimal initialization:
 stored for the duration of this function; there is no need to initialize,
 allocate, or free memory.
 
+#### <a name="rdata"></a>Rdata Classes
+
+##### Rdataset
+
+An rdataset (`dns_rdataset_t`) is BIND's representation of a DNS RRset,
+excluding the owner name but including the type, TTL, and the contents of
+each RR. The rdataset object does not hold the data itself: it is a view
+that refers to data held elsewhere -- for example, in a DNS message, or in
+an rbtdb (for cached or authoritative data).
+
+It is a vaguely object-oriented polymorphic data structure, with different
+implementations depending on the backing data structure that actually holds
+the records. The rdataset is explicitly associated/disassociated with the
+backing data structure so that it can maintain reference counts.
+
+One important rdataset implementation is part of the red-black tree
+database, implemented in `rdata.c`.
+
+##### Rdatalist
+
+Another backing data structure for an rdataset is the rdatalist
+(`dns_rdatalist_t`) -- a linked list of rdata structures.  An rdatalist is
+used to record the locations of records in a DNS message. It does not
+maintain reference counts.  An rdatalist can be converted to or from an
+rdataset using `dns_rdatalist_tordataset()` and
+`dns_rdatalist_fromrdataset()`.
+
+##### Rdata
+
+See the [RRATA Types](rdata.md) document for details on type-specific
+rdata conversions.
+
 #### <a name="iterators"></a>Iterators
 
 Retrieving data from BIND databases involves the use of iterator

doc/dev/rdata.html

@@ -1,608 +0,0 @@
-<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
-<!--
- - Copyright (C) 1999-2001, 2004, 2007, 2016  Internet Systems Consortium, Inc. ("ISC")
- -
- - This Source Code Form is subject to the terms of the Mozilla Public
- - License, v. 2.0. If a copy of the MPL was not distributed with this
- - file, You can obtain one at http://mozilla.org/MPL/2.0/.
--->
-
-<!-- $Id: rdata.html,v 1.15 2007/06/19 23:47:13 tbox Exp $ -->
-
-<HTML>
-<HEAD>
-  <TITLE>Adding new RDATA type</TITLE>
-</HEAD>
-<BODY>
-<H2>Overview</H2>
-The dns rdata routines (<CODE>dns_rdata_fromtext()</CODE>,
-<CODE>dns_rdata_totext()</CODE>, <CODE>dns_rdata_fromwire()</CODE>,
-<CODE>dns_rdata_towire()</CODE> <CODE>dns_rdata_fromstruct()</CODE>,
-<CODE>dns_rdata_tostruct()</CODE> and <CODE>dns_rdata_compare()</CODE>)
-are designed to provide a single set of routines
-for encoding, decoding and comparing dns data preventing the problems that
-occurred in BIND 8.x and earlier where there were multiple places in the
-code base that
-decoded wire format to internal format or compared rdata sometimes with
-subtly different behaviour (bugs) or didn't support a particular type leading
-to internal inconsistancy.
-<P>
-Each of these generic routines calls type specific routines that provide
-the type specific details.
-<P>
-From time to time new types are defined and it is necessary to add these types
-into the existing structure.
-This document is written to provide instruction on how to do this.
-<H2>Adding new RDATA types</H2>
-
-Adding a new rdata type requires determining if the new rdata type is class
-specific or generic.
-Writing code to perform the following set of operations
-and then integrating it into the build by placing the code into the rdata
-hierachy at the correct place.
-Running <CODE>make clean</CODE> followed <CODE>make</CODE> in
-<CODE>lib/dns</CODE> will cause the new rdata type to be picked up.
-<P>
-Each rdata module must perform the following operations:
-<DL>
-<DT>Convert from text format to internal format</DT>
-<DT>Convert from internal format to text format</DT>
-<DT>Convert from wire format to internal format</DT>
-<DT>Convert from internal format to wire format</DT>
-<DT>Convert from a structure to internal format</DT>
-<DT>Convert from internal format to a structure</DT>
-<DT>Compare two rdata in internal format<DT>
-</DL>
-<P>
-There is an additional set of support <A HREF="#functions">functions</A> and
-<A HREF="#macros">macros</A> only available to
-to rdata code.
-<H2>RDATA Hierarchy</H2>
-The <CODE>rdata</CODE> hierarchy has the following format.
-<PRE>
-	rdata/
-		generic/
-			<I>typename_typenumber</I>.h
-		<I>classname_classnumber</I>/
-			<I>typename_typenumber</I>.h
-<PRE>
-<P>
-Initial rdata hierarchy:
-<P>
-<PRE>
-	rdata/
-		generic/
-			ns_2.h
-			md_3.h
-			mf_4.h
-			cname_5.h
-			soa_6.h
-			mb_7.h
-			mg_8.h
-			mr_9.h
-			null_10.h
-			ptr_12.h
-			hinfo_13.h
-			minfo_14.h
-			mx_15.h
-			txt_16.h
-			rp_17.h
-			afsdb_18.h
-			x25_19.h
-			isdn_20.h
-			rt_21.h
-			sig_24.h
-			key_25.h
-			gpos_27.h
-			loc_29.h
-			nxt_30.h
-			cert_37.h
-			dname_39.h
-			unspec_103.h
-			tkey_249.h
-		in_1/
-			a_1.h
-			wks_11.h
-			nsap_22.h
-			nsap-ptr_23.h
-			px_26.h
-			aaaa_28.h
-			srv_33.h
-			naptr_35.h
-			kx_36.h
-			a6_38.h
-		any_255/
-			tsig_250.h
-</PRE>
-
-<H2>CLASSNAME and TYPENAME</H2>
-Class and type names must be from the following alphabet and less that 11
-characters in length or otherwise they will be ignored.
-Permissible alphabet: a to z, 0 to 9 and dash (-).
-Dash is mapped to underscore (_) for the C function names below.
-
-<H2>Internal Format</H2>
-The internal format chosen is DNS wire format without any compression being
-applied to domain names in the rdata.
-
-<H2>Convert from text format to internal format</H2>
-The functions to convert from text format has the following call formats and
-is declared as follows for class generic functions.
-<PRE>
-<CODE>static dns_result_t
-fromtext_<I>typename</I>(dns_rdataclass_t class, dns_rdatatype_t type,
-		  isc_lex_t *lexer, dns_name_t *origin,
-		  isc_boolean_t downcase, isc_buffer_t *target);</CODE>
-</PRE>
-Class specific functions contain the class name in addition to the
-type name.
-<PRE>
-<CODE>static dns_result_t
-fromtext_<I>classname_typename</I>(dns_rdataclass_t class, dns_rdatatype_t type,
-		           isc_lex_t *lexer, dns_name_t *origin,
-			   isc_boolean_t downcase, isc_buffer_t *target);</CODE>
-</PRE>
-
-<DL>
-<DT><CODE>class</CODE></DT>
-<DD>
-This argument should be ignored when used with a class generic RR type
-otherwise <CODE>REQUIRE(class == #)</CODE> should be present at the start
-of the function.
-<DT><CODE>type</CODE></DT>
-<DD>
-This should be tested with a <CODE>REQUIRE(type == #)</CODE> statement at
-the begining of the function.
-<DT><CODE>lexer</CODE></DT>
-<DD>
-This is used to read the input text stream.
-<DT><CODE>origin</CODE></DT>
-<DD>
-This is a absolute name used to qualify unqualified / partially qualified
-domainnames in the text stream.
-It is passed to the name parsing routines.
-<DT><CODE>downcase</CODE></DT>
-<DD>
-This is passed to the name parsing routines to determine whether to downcase
-the names it generates or leave them in the case they are pesented in.
-<DT><CODE>target</CODE></DT>
-<DD>
-This is a <CODE>BINARY</CODE> buffer used to write the internal format of the rdata record being read in to.
-</DL>
-
-<CODE>fromtext_<I>typename</I>()</CODE> reads tokens from <CODE>lexer</CODE>,
-up to but not including the end of line (EOL) token or end of file (EOF) token.
-If the EOL / EOF token is read it should be returned to the input stream.
-<A HREF="#gettoken"><CODE>gettoken()</CODE></A>
-should be used to read the next token from the input stream and
-will return EOL / EOF tokens
-automatically unless
-they are specifcally requested.
-<CODE>isc_lex_ungettoken()</CODE> should
-be used to return EOL / EOF (or any other token) to the input stream if
-the EOL / EOF token is read.
-Unused tokens will cause <CODE>dns_rdata_fromtext()</CODE> to return
-<CODE>DNS_R_EXTRATOKEN</CODE> if <CODE>fromtext_<I>typename</I>()</CODE> was successful.
-<P>
-<CODE>fromtext_<I>typename</I>()</CODE> reads external input and as such is a high security area and must be paranoid about its input.
-<H2>Convert from internal format to text format</H2>
-<PRE>
-<CODE>static dns_result_t
-totext_<I>typename</I>(dns_rdata_t *rdata, dns_name_t *origin,
-		isc_buffer_t *target);</CODE>
-</PRE>
-<PRE>
-<CODE>static dns_result_t
-totext_<I>classname_typename</I>(dns_rdata_t *rdata, dns_name_t *origin,
-			  isc_buffer_t *target);</CODE>
-</PRE>
-<DL>
-<DT><CODE>rdata</CODE></DT>
-<DD>
-This is the rdata record to be converted from internal format to text.
-<CODE>rdata->type</CODE> and <CODE>rdata->class</CODE> for class specific
-RR types should be checked at the start of the function with
-<CODE>REQUIRE(rdata->type == #)</CODE> statements.
-<DT><CODE>origin</CODE></DT>
-<DD>
-If this in non <CODE>NULL</CODE> then any domainnames with this suffix
-should be written out unqualified.
-<A HREF="#name_prefix"><CODE>name_prefix()</CODE></A> can be used to
-check if <CODE>origin</CODE> is <CODE>NULL</CODE> and provide the correct
-arguments to the name conversion routines.
-<DT><CODE>target</CODE></DT>
-<DD>
-This is a <CODE>TEXT</CODE> buffer used to hold the output.
-</DL>
-<H2>Convert from wire format to internal format</H2>
-<PRE>
-<CODE>static dns_result_t
-fromwire_<I>typename</I>(dns_rdataclass_t class, dns_rdatatype_t type,
-                  isc_buffer_t *source, dns_decompress_t *dctx,
-	          isc_boolean_t downcase, isc_buffer_t *target);</CODE>
-</PRE>
-<PRE>
-<CODE>static dns_result_t
-fromwire_<I>classname_typename</I>(dns_rdataclass_t class, dns_rdatatype_t type,
-			    isc_buffer_t *source, dns_decompress_t *dctx,
-			    isc_boolean_t downcase, isc_buffer_t *target);</CODE>
-</PRE>
-<P>
-<CODE>fromwire_<I>classname_typename</I>()</CODE> is required to set the valid
-decompression methods if there is a domain name in the rdata.
-<PRE>
-<CODE>if (dns_decompress_edns(dctx) >= # || !dns_decompress_strict(dctx))
-	dns_decompress_setmethods(dctx, DNS_COMPRESS_ALL);
-else
-	dns_decompress_setmethods(dctx, DNS_COMPRESS_GLOBAL14);</CODE>
-</PRE>
-
-<DL>
-<DT><CODE>class</CODE></DT>
-<DD>
-This argument should be ignored when used with a class generic RR type
-otherwise <CODE>REQUIRE(class == #)</CODE> should be present at the start
-of the function.
-<DT><CODE>type</CODE></DT>
-<DD>
-This should be tested with a <CODE>REQUIRE(type == #)</CODE> statement at
-the begining of the function.
-<DT><CODE>source</CODE></DT>
-<DD>
-This is a <CODE>BINARY</CODE> buffer with the <CODE>active</CODE> region
-containing a RR record in wire format.
-<DT><CODE>dctx</CODE></DT>
-<DD>
-This is the decompression context and is passed to
-<CODE>dns_name_fromwire()</CODE>,
-along with <CODE>downcase</CODE>, to enable a compressed domain name
-to be extracted from the source.
-<DT><CODE>downcase</CODE></DT>
-<DD>
-This is passed to <CODE>dns_name_fromwire()</CODE> to say whether the
-extracted domainname should be downcased during the extraction.
-<DT><CODE>target</CODE></DT>
-<DD>
-This is a <CODE>BINARY</CODE> buffer where the decompressed and checked
-RR record is written.
-</DL>
-<CODE>fromwire_<I>typename</I>()</CODE> is a security sensitive routine
-as it reads external data and should take extreme care to ensure that
-the input data matches its description.
-<P>
-If the <CODE>active</CODE> buffer is not empty at completion and
-<CODE>fromwire_<I>typename</I>()</CODE> was otherwise successful
-<CODE>dns_rdata_fromwire()</CODE> will return <CODE>DNS_R_EXTRADATA</CODE>.
-<H2>Convert from internal format to wire format</H2>
-<PRE>
-<CODE>static dns_result_t
-towire_<I>typename</I>(dns_rdata_t *rdata, dns_compress_t *cctx,
-                isc_buffer_t *target);</CODE>
-</PRE>
-<PRE>
-<CODE>static dns_result_t
-towire_<I>classname_typename</I>(dns_rdata_t *rdata, dns_compress_t *cctx,
-                          isc_buffer_t *target);<CODE>
-</PRE>
-<P>
-<CODE>towire_<I>classname_typename</I>()</CODE> is required to set the
-allowed name compression methods based on EDNS version if there is a
-domain name in the rdata.
-<PRE>
-<CODE>if (dns_compress_getedns(cctx) >= #)
-	dns_compress_setmethods(cctx, DNS_COMPRESS_ALL);
-else
-	dns_compress_setmethods(cctx, DNS_COMPRESS_GLOBAL14);</CODE>
-</PRE>
-<DL>
-<DT><CODE>rdata</CODE></DT>
-<DD>
-This is the rdata record to be converted from internal format to text.
-<CODE>rdata->type</CODE> and <CODE>rdata->class</CODE> for class specific
-RR types should be checked at the start of the function with
-<CODE>REQUIRE(rdata->type == #)</CODE> statements.
-<DT><CODE>cctx</CODE></DT>
-<DD>
-This is the compression context, it should be passed to <CODE>dns_name_towire()</CODE> when putting domainnames on the wire.
-<DT><CODE>target</CODE></DT>
-<DD>
-This is a <CODE>BINARY</CODE> buffer used to write the rdata to.
-</DL>
-Simple RR types without domainnames can use the following code to
-transfer the contents of the <CODE>rdata</CODE> to the target buffer.
-<PRE>
-	<CODE>return (<A HREF="#mem_tobuffer">mem_tobuffer</A>(target, rdata->data, rdata->length));</CODE>
-</PRE>
-<H2>Convert from a structure to internal format</H2>
-<PRE>
-<CODE>static dns_result_t
-fromstruct_<I>typename</I>(dns_rdataclass_t class, dns_rdatatype_t type,
-		    void *source, isc_buffer_t *target);</CODE>
-</PRE>
-<PRE>
-<CODE>static dns_result_t
-fromstruct_<I>classname_typename</I>(dns_rdataclass_t class, dns_rdatatype_t type,
-		    	      void *source, isc_buffer_t *target);</CODE>
-</PRE>
-<DL>
-<DT><CODE>class</CODE></DT>
-<DD>
-This argument should be ignored when used with a class generic RR type
-otherwise <CODE>REQUIRE(class == #)</CODE> should be present at the start
-of the function.
-<DT><CODE>type</CODE></DT>
-<DD>
-This should be tested with a <CODE>REQUIRE(type == #)</CODE> statement at
-the beginning of the function.
-<DT><CODE>source</CODE></DT>
-<DD>
-This points to a type specific structure.
-<DT><CODE>target</CODE></DT>
-<DD>
-This is a <CODE>BINARY</CODE> buffer used to write the internal format of the rdata record being read in to.
-</DL>
-<H2>Convert from internal format to a structure</H2>
-<PRE>
-<CODE>static dns_result_t
-tostruct_<I>typename</I>(dns_rdata_t *rdata, void *target);</CODE>
-</PRE>
-<PRE>
-<CODE>static dns_result_t
-tostruct_<I>classname_typename</I>(dns_rdata_t *rdata, void *target);</CODE>
-</PRE>
-<DL>
-<DT><CODE>rdata</CODE></DT>
-<DD>
-This is the rdata record to be converted from internal format to a structure.
-<CODE>rdata->type</CODE> and <CODE>rdata->class</CODE> for class specific
-RR types should be checked at the start of the function with
-<CODE>REQUIRE(rdata->type == #)</CODE> statements.
-<DT><CODE>target</CODE></DT>
-<DD>
-Pointer to a type specific structure.
-</DL>
-<H2>Compare two rdata in internal format</H2>
-<PRE>
-<CODE>static int
-compare_<I>typename</I>(dns_rdata_t *rdata1, dns_rdata_t *rdata2);</CODE>
-</PRE>
-<PRE>
-<CODE>static int
-compare_<I>classname_typename</I>(dns_rdata_t *rdata1, dns_rdata_t *rdata2);</CODE>
-</PRE>
-Compares <CODE>rdata1</CODE> and <CODE>rdata2<CODE> as required for DNSSEC
-ordering.  The routine should
-ensure that the <CODE>type</CODE> and <CODE>class</CODE> of the two rdata
-match with <CODE>REQUIRE(rdata1->type == rdata2->type);</CODE> and
-<CODE>REQUIRE(rdata1->class == rdata2->class);</CODE> statements. The
-<CODE>rdata->type</CODE> should also be verified and if the RR type is
-class specific the <CODE>rdata->class</CLASS>.
-<P>
-<CODE>compare_<I>classname_typename</I>()</CODE> returns -1, 0, 1.
-<H2><A NAME="functions">Support Functions</A></H2>
-The following static support functions are available to use.
-<DL>
-<DT><CODE>static unsigned int<BR>
-name_length(dns_name_t *name);</CODE></DT>
-<DD>
-<P>
-Returns the length of <CODE>name</CODE>.
-<P>
-<DT><CODE>static dns_result_t<BR>
-txt_totext(isc_region_t *source, isc_buffer_t *target);</CODE></DT>
-<DD>
-<P>
-Extracts the octet length tagged text string at the start of
-<CODE>source</CODE> and writes it as a quoted string to <CODE>target</CODE>.
-<CODE>source</CODE> is adjusted so that it points to first octet after the
-text string.
-<P>
-Returns <CODE>DNS_R_NOSPACE</CODE> or <CODE>DNS_R_SUCCESS</CODE>.
-<P>
-<DT><CODE>static dns_result_t<BR>
-txt_fromtext(isc_textregion_t *source, isc_buffer_t *target);</CODE></DT>
-<DD>
-<P>
-Take the text region <CODE>source</CODE> and convert it to a length tagged
-text string writing it to <CODE>target</CODE>.
-<P>
-Returns <CODE>DNS_R_NOSPACE</CODE>, <CODE>DNS_R_TEXTTOLONG</CODE>
-or <CODE>DNS_R_SUCCESS</CODE>.
-<P>
-<DT><CODE>static dns_result_t<BR>
-txt_fromwire(isc_buffer_t *source, isc_buffer_t *target);</CODE></DT>
-<DD>
-<P>
-Read a octet length tagged text string from <CODE>source</CODE> and
-write it to <CODE>target</CODE>.
-Ensures that octet length tagged text string was wholly within the active
-area of <CODE>source</CODE>.
-Adjusts the active area of <CODE>source</CODE> so that it refers to the first
-octet after the octet length tagged text string.
-<P>
-Returns <CODE>DNS_R_UNEXPECTEDEND</CODE>, <CODE>DNS_R_NOSPACE</CODE> or
-<CODE>DNS_R_SUCCESS</CODE>.
-<P>
-<DT><A NAME="name_prefix"><CODE>static isc_boolean_t<BR>
-name_prefix(dns_name_t *name, dns_name_t *origin, dns_name_t *target);</CODE>
-</A></DT>
-<DD>
-<P>
-If <CODE>origin</CODE> is NULL or the root label set <CODE>target<CODE> to
-refer to <CODE>name</CODE> and return <CODE>ISC_FALSE</CODE>.
-Otherwise see if <CODE>name</CODE> is a sub domain of <CODE>origin</CODE>
-and are not equal.
-If so make <CODE>target</CODE> refer to the prefix of <CODE>name</CODE> and
-return <CODE>ISC_TRUE</CODE>.
-Otherwise make <CODE>target</CODE> refer to <CODE>name</CODE> and return
-<CODE>ISC_FALSE</CODE>.
-<P>
-Typical use:
-<PRE><CODE>
-static dns_result_t
-totext_<I>typename</I>(dns_rdata_t *rdata, dns_name_t *origin,
-		isc_buffer_t * target)
-{
-	isc_region_t region;
-	dns_name_t name, prefix;
-	isc_boolean_t sub;
-
-	dns_name_init(&amp;name, NULL);
-	dns_name_init(&amp;prefix, NULL);
-	dns_rdata_toregion(rdata, &amp;region);
-	dns_name_fromregion(&amp;name, &amp;region);
-	sub = <B>name_prefix</B>(&amp;name, origin, &amp;prefix);
-	return (dns_name_totext(&amp;prefix, sub, target));
-}
-</CODE></PRE>
-<DT><CODE>static dns_result_t<BR>
-str_totext(char *source, isc_buffer_t *target);</CODE></DT>
-<DD>
-<P>
-This adds the <CODE>NULL</CODE> terminated string <CODE>source</CODE>
-up to but not including <CODE>NULL</CODE> to <CODE>target</CODE>.
-<P>
-Returns <CODE>DNS_R_NOSPACE</CODE> and <CODE>DNS_R_SUCCESS</CODE>.
-<P>
-<DT><CODE>static isc_boolean_t<BR>
-buffer_empty(isc_buffer_t *source);</CODE></DT>
-<DD>
-<P>
-Returns <CODE>ISC_TRUE</CODE> if the active region of <CODE>source</CODE> is
-empty otherwise <CODE>ISC_FALSE</CODE>.
-<P>
-<DT><CODE>static void<BR>
-buffer_fromregion(isc_buffer_t *buffer, isc_region_t *region,
-unsigned int type);</CODE></DT>
-<DD>
-<P>
-Make <CODE>buffer</CODE> refer to the memory in <CODE>region</CODE> and
-make it active.
-<P>
-<DT><CODE>static dns_result_t<BR>
-uint32_tobuffer(isc_uint32_t value, isc_buffer_t *target);</CODE></DT>
-<DD>
-<P>
-Write the 32 bit <CODE>value</CODE> in network order to <CODE>target</CODE>.
-<P>
-Returns <CODE>DNS_R_NOSPACE</CODE> and <CODE>DNS_R_SUCCESS</CODE>.
-<P>
-<DT><CODE>static dns_result_t<BR>
-uint16_tobuffer(isc_uint32_t value, isc_buffer_t *target);</CODE></DT>
-<DD>
-<P>
-Write them 16 bit <CODE>value</CODE> in network order to <CODE>target</CODE>.
-<P>
-Returns <CODE>ISC_R_RANGE</CODE>, <CODE>DNS_R_NOSPACE</CODE> and <CODE>DNS_R_SUCCESS</CODE>.
-<P>
-<DT><CODE>static isc_uint32_t<BR>
-uint32_fromregion(isc_region_t *region);</CODE></DT>
-<DD>
-<P>
-Returns the 32 bit at the start of <CODE>region</CODE> in host order.
-<P>
-Requires <CODE>(region->length >= 4)</CODE>.
-<P>
-<DT><CODE>static isc_uint16_t<BR>
-uint16_fromregion(isc_region_t *region);</CODE></DT>
-<DD>
-<P>
-Returns the 16 bit at the start of <CODE>region</CODE> in host order.
-<P>
-Requires <CODE>(region->length >= 2)</CODE>.
-<P>
-<DT><CODE>static dns_result_t<BR>
-<A NAME="gettoken">gettoken</A>(isc_lex_t *lexer, isc_token_t *token, isc_tokentype_t expect, isc_boolean_t eol);</CODE></DT>
-<DD>
-<P>
-Gets the next token from the input stream <CODE>lexer</CODE>. Ensure that the
-returned token matches <CODE>expect</CODE> (isc_tokentype_qstring can also
-return isc_tokentype_string), or isc_tokentype_eol and isc_tokentype_eof if
-<CODE>eol</CODE> is <CODE>ISC_TRUE</CODE>.
-<P>
-Returns <CODE>DNS_R_UNEXPECTED</CODE>, <CODE>DNS_R_UNEXPECTEDEND</CODE>,
-<CODE>DNS_R_UNEXPECTEDTOKEN</CODE> and <CODE>DNS_R_SUCCESS</CODE>.
-<P>
-</DT>
-<DT><CODE>static dns_result_t<BR>
-<A NAME="mem_tobuffer">mem_tobuffer</A>(isc_buffer_t *target, void *base, unsigned int length);</CODE></DT>
-<DD>
-<P>
-Add the memory referred to by <CODE>base</CODE> to <CODE>target</CODE>.
-<P>
-Returns <CODE>DNS_R_NOSPACE</CODE> and <CODE>DNS_R_SUCCESS</CODE>.
-<P>
-<DT><CODE>static int<BR>
-compare_region(isc_region_t *r1, isc_region_t *r2)</CODE></DT>
-<DD>
-<P>
-Compares two regions returning -1, 0, 1 based on their DNSSEC ordering.
-<P>
-<DT><CODE>static int<BR>
-hexvalue(char value);</CODE></DT>
-<DD>
-<P>
-Returns the hexadecimal value of <CODE>value</CODE> or -1 if not
-a hexadecimal character.
-<P>
-<DT><CODE>static int<BR>
-decvalue(char value);</CODE></DT>
-<DD>
-<P>
-Returns the decimal value of <CODE>value</CODE> or -1 if not
-a decimal character.
-<P>
-<DT><CODE>static dns_result_t<BR>
-base64_totext(isc_region_t *source, isc_buffer_t *target);</CODE></DT>
-<DD>
-<P>
-Convert the region referred to by <CODE>source</CODE> to base64 encoded text
-and put it into <CODE>target</CODE>.
-<P>
-Returns <CODE>DNS_R_NOSPACE</CODE> or <CODE>DNS_R_SUCCESS</CODE>.
-<P>
-<DT><CODE>static dns_result_t<BR>
-base64_tobuffer(isc_lex_t *lexer, isc_buffer_t *target,
-int length);</CODE></DT>
-<DD>
-<P>
-Read a series of tokens from <CODE>lexer</CODE> that containing base64 data
-until one of end of line, <CODE>length</CODE> (<CODE>length</CODE> &gt;= 0)
-bytes have been read or base64 pad characters are seen.
-If <CODE>length</CODE> &lt; 0 it is ignored otherwise it is an error if there
-are not <CODE>length</CODE> octets of data or when processing a token
-<CODE>length</CODE> octets would have been exceeded.
-<P>
-Returns <CODE>DNS_R_BADBASE64</CODE>, <CODE>DNS_R_UNEXPECTED</CODE>,
-<CODE>DNS_R_UNEXPECTEDEND</CODE>, <CODE>DNS_R_UNEXPECTEDTOKEN</CODE>
-and <CODE>DNS_R_SUCCESS</CODE>.
-<P>
-<DT><CODE>static dns_result_t<BR>
-time_totext(unsigned long value, isc_buffer_t *target);</CODE></DT>
-<DD>
-<P>
-Convert the date represented by <CODE>value</CODE> into YYYYMMDDHHMMSS format
-taking into account the active epochs. This code is Y2K and Y2038 compliant.
-<P>
-Returns <CODE>DNS_R_NOSPACE</CODE> and <CODE>DNS_R_SUCCESS</CODE>.
-<DT><CODE>static dns_result_t<BR>
-time_tobuffer(char *source, isc_buffer_t *target);</CODE></DT>
-<DD>
-<P>
-Take the date in <CODE>source</CODE> and convert it seconds since January 1,
-1970 (ignoring leap seconds) and place the least significant 32 bits into
-<CODE>target</CODE>.
-<P>
-Returns <CODE>ISC_R_RANGE</CODE>, <CODE>DNS_R_SYNTAX</CODE>,
-<CODE>DNS_R_NOSPACE</CODE> and <CODE>DNS_R_SUCCESS</CODE>.
-</DL>
-<H2><A NAME="macros">Support Macros<A></H2>
-The following macro is available:
-<DL>
-<DT><CODE>RETERR(x)</CODE><DT>
-<DD>
-<P>
-Evaluate <CODE>x</CODE> and call <CODE>return (<I>&lt;value of x&gt;</I>);</CODE> if the result is not <CODE>DNS_R_SUCCESS</CODE>.
-</DL>
-</BODY>
-</HTML>

doc/dev/rdata.md

@@ -0,0 +1,497 @@
+<!--
+ - Copyright (C) 1999-2001, 2004, 2007, 2016, 2017  Internet Systems Consortium, Inc. ("ISC")
+ -
+ - This Source Code Form is subject to the terms of the Mozilla Public
+ - License, v. 2.0. If a copy of the MPL was not distributed with this
+ - file, You can obtain one at http://mozilla.org/MPL/2.0/.
+-->
+## RDATA Types
+
+### Overview
+
+The dns rdata routines (`dns_rdata_fromtext()`,
+`dns_rdata_totext()`, `dns_rdata_fromwire()`,
+`dns_rdata_towire()` `dns_rdata_fromstruct()`,
+`dns_rdata_tostruct()` and `dns_rdata_compare()`)
+are designed to provide a single set of routines
+for encoding, decoding and comparing dns data preventing the problems that
+occurred in BIND 8.x and earlier, in which there were multiple places in the
+code base that decoded wire format to internal format or compared rdata,
+sometimes with subtly different behaviour (bugs), and sometimes failing to
+support a particular type, leading to internal inconsistancy.
+
+Each of these generic routines calls type-specific routines that provide
+the type-specific details.
+
+From time to time new types are defined and it is necessary to add these types
+into the existing structure.  This document is written to provide instruction
+on how to do this.
+
+### Adding new RDATA types
+
+Adding a new rdata type requires determining whether the new rdata type is
+class-specific or generic, writing code to perform the rdata operations for the
+type, then integrating it into the build by placing the code into the rdata
+hierachy at the correct location under `lib/dns/rdata`.  Running `make clean`
+followed by `make` in `lib/dns` will cause the new rdata type to be picked up
+and compiled.
+
+Each rdata module must perform the following operations:
+
+* Convert from text format to internal format
+* Convert from internal format to text format
+* Convert from wire format to internal format
+* Convert from internal format to wire format
+* Convert from a structure to internal format
+* Convert from internal format to a structure
+* Compare two rdata in internal format
+
+There is an additional set of support functions and macros only available to
+rdata code.
+
+#### RDATA Hierarchy
+
+The `rdata` hierarchy has the following format.
+
+        rdata/
+                generic/
+                        typename_typenumber.h
+                classname_classnumber/
+                        typename_typenumber.h
+
+Initial rdata hierarchy:
+
+        rdata/
+                generic/
+                        ns_2.h
+                        md_3.h
+                        mf_4.h
+                        cname_5.h
+                        soa_6.h
+                        mb_7.h
+                        mg_8.h
+                        mr_9.h
+                        null_10.h
+                        ptr_12.h
+                        hinfo_13.h
+                        minfo_14.h
+                        mx_15.h
+                        txt_16.h
+                        rp_17.h
+                        afsdb_18.h
+                        x25_19.h
+                        isdn_20.h
+                        rt_21.h
+                        sig_24.h
+                        key_25.h
+                        gpos_27.h
+                        loc_29.h
+                        nxt_30.h
+                        cert_37.h
+                        dname_39.h
+                        unspec_103.h
+                        tkey_249.h
+                in_1/
+                        a_1.h
+                        wks_11.h
+                        nsap_22.h
+                        nsap-ptr_23.h
+                        px_26.h
+                        aaaa_28.h
+                        srv_33.h
+                        naptr_35.h
+                        kx_36.h
+                        a6_38.h
+                any_255/
+                        tsig_250.h
+
+#### CLASSNAME and TYPENAME
+
+Class and type names must be from the following alphabet and less that 11
+characters in length or otherwise they will be ignored.
+Permissible alphabet: a to z, 0 to 9 and dash (-).
+Dash is mapped to underscore (_) for the C function names below.
+
+#### Internal Format
+
+The internal format chosen is DNS wire format without any compression being
+applied to domain names in the rdata.
+
+#### Converting from text format to internal format
+
+The functions to convert from text format has the following call formats and
+is declared as follows for class-generic functions.
+
+        static dns_result_t
+        fromtext_typename(dns_rdataclass_t class, dns_rdatatype_t type,
+                          isc_lex_t *lexer, dns_name_t *origin,
+                          isc_boolean_t downcase, isc_buffer_t *target);
+
+Class specific functions contain the class name in addition to the
+type name.
+
+        static dns_result_t
+        fromtext_classname_typename(dns_rdataclass_t class,
+                                    dns_rdatatype_t type,
+                                    isc_lex_t *lexer,
+                                    dns_name_t *origin,
+                                    isc_boolean_t downcase,
+                                    isc_buffer_t *target);
+
+|Parameter|Description |
+|---------|-----------------------|
+|`class`|This argument should be ignored when used with a class-generic RR type, otherwise `REQUIRE(class == <value>)` should be present at the start of the function.|
+|`type`|This should be tested with a `REQUIRE(type == <value>)` statement at the begining of the function.|
+|`lexer`|This is used to read the input text stream.|
+|`origin`|This is a absolute name used to qualify unqualified / partially qualified domain names in the text stream.  It is passed to the name parsing routines.|
+|`downcase`|This is passed to the name parsing routines to determine whether to downcase the names it generates or leave them in the case they are presented in.|
+|`target`|This is a `BINARY` buffer into which to write the internal format of the rdata record being read.|
+
+`fromtext_typename()` reads tokens from `lexer`,
+up to but not including the end of line (EOL) token or end of file (EOF) token.
+If the EOL / EOF token is read it should be returned to the input stream.
+
+`gettoken()` should be used to read the next token from the input stream.
+
+`isc_lex_ungettoken()` should be used to return EOL / EOF (or any other token)
+to the input stream if the EOL / EOF token is read.
+
+Unused tokens will cause `dns_rdata_fromtext()` to return `DNS_R_EXTRATOKEN` if
+`fromtext_typename()` was successful.
+
+`fromtext_typename()` reads external input and as such is a high
+security area and must be paranoid about its input.
+
+#### Converting from internal format to text format
+
+        static dns_result_t
+        totext_typename(dns_rdata_t *rdata, dns_name_t *origin,
+                        isc_buffer_t *target);
+
+        static dns_result_t
+        totext_classname_typename(dns_rdata_t *rdata,
+                        dns_name_t *origin, isc_buffer_t *target);
+
+|Parameter|Description |
+|---------|-----------------------|
+|`rdata`|This is the rdata record to be converted from internal format to text.  `rdata->type` (and `rdata->class` for class-specific RR types) should be checked at the start of the function with `REQUIRE` statements.|
+|`origin`|If this is not `NULL`, then any domain names with this suffix should be written out as unqualified subdomains.  `name_prefix()` can be used to check whether `origin` is `NULL` and provide the correct arguments to the name conversion routines.|
+|`target`|This is a `TEXT` buffer into which to write the output.|
+
+#### Converting from wire format to internal format
+
+        static dns_result_t
+        fromwire_typename(dns_rdataclass_t class,
+                           dns_rdatatype_t type,
+                           isc_buffer_t *source,
+                           dns_decompress_t *dctx,
+                           isc_boolean_t downcase,
+                           isc_buffer_t *target);
+
+        static dns_result_t
+        fromwire_classname_typename(dns_rdataclass_t class,
+                                    dns_rdatatype_t type,
+                                    isc_buffer_t *source,
+                                    dns_decompress_t *dctx,
+                                    isc_boolean_t downcase,
+                                    isc_buffer_t *target);
+
+`fromwire_classname_typename()` is required to set the valid
+decompression methods if there is a domain name in the rdata.
+
+        if (dns_decompress_edns(dctx) >= # || !dns_decompress_strict(dctx))
+                dns_decompress_setmethods(dctx, DNS_COMPRESS_ALL);
+        else
+                dns_decompress_setmethods(dctx, DNS_COMPRESS_GLOBAL14);
+
+|Parameter|Description |
+|---------|-----------------------|
+|`class`|This argument should be ignored when used with a class-generic RR type otherwise `REQUIRE(class == <value>)` should be present at the start of the function.|
+|`type`|This should be tested with a `REQUIRE(type == <value>)` statement at the begining of the function.|
+|`source`|This is a `BINARY` buffer with the `active` region containing a resource record in wire format.|
+|`dctx`|This is the decompression context and is passed to `dns_name_fromwire()`, along with `downcase`, to enable a compressed domain name to be extracted from the source.|
+|`downcase`|This is passed to `dns_name_fromwire()` to say whether the extracted domain name should be downcased during the extraction.|
+|`target`|This is a `BINARY` buffer into which the decompressed and checked resource record is written.|
+
+`fromwire_typename()` is a security sensitive routine
+as it reads external data, and should take extreme care to ensure that
+the input data matches its description.
+
+If the `active` buffer is not empty at completion and
+`fromwire_typename()` was otherwise successful, `dns_rdata_fromwire()`
+will return `DNS_R_EXTRADATA`.
+
+#### Converting from internal format to wire format
+
+        static dns_result_t
+        towire_typename(dns_rdata_t *rdata,
+                        dns_compress_t *cctx,
+                        isc_buffer_t *target);
+
+        static dns_result_t
+        towire_classname_typename(dns_rdata_t *rdata,
+                                  dns_compress_t *cctx,
+                                  isc_buffer_t *target);
+
+`towire_classname_typename()` is required to set the
+allowed name compression methods based on the EDNS version, if there
+is a domain name in the rdata.
+
+        if (dns_compress_getedns(cctx) >= #)
+                dns_compress_setmethods(cctx, DNS_COMPRESS_ALL);
+        else
+                dns_compress_setmethods(cctx, DNS_COMPRESS_GLOBAL14);
+
+|Parameter|Description |
+|---------|-----------------------|
+|`rdata`|This is the rdata record to be converted from internal format to text.  `rdata->type` (and `rdata->class` for class-specific RR types) should be checked at the start of the function with `REQUIRE` statements.|
+|`cctx`|This is the compression context. It should be passed to `dns_name_towire()` when putting domain names on the wire.|
+|`target`|This is a `BINARY` buffer into which to write the rdata|
+
+Simple RR types without domain names can use the following code to
+transfer the contents of the `rdata` to the target buffer.
+
+        return (mem_tobuffer(target, rdata->data, rdata->length));
+
+#### Converting from a structure to internal format
+
+        static dns_result_t
+        fromstruct_typename(dns_rdataclass_t class,
+                            dns_rdatatype_t type,
+                            void *source,
+                            isc_buffer_t *target);
+
+        static dns_result_t
+        fromstruct_classname_typename(dns_rdataclass_t class,
+                                      dns_rdatatype_t type,
+                                      void *source,
+                                      isc_buffer_t *target);
+
+|Parameter|Description |
+|---------|-----------------------|
+|`class`|This argument should be ignored when used with a class-generic RR type otherwise `REQUIRE(class == <value>)` should be present at the start of the function.|
+|`type`|This should be tested with a `REQUIRE(type == <value>)` statement at the beginning of the function.|
+|`source`|This points to a type-specific structure.|
+|`target`|This is a `BINARY` buffer into which to write the internal format of the rdata record being read in.|
+
+#### Converting from internal format to a structure
+
+        static dns_result_t
+        tostruct_typename(dns_rdata_t *rdata, void *target);
+
+        static dns_result_t
+        tostruct_classname_typename(dns_rdata_t *rdata, void *target);
+
+|Parameter|Description |
+|---------|-----------------------|
+|`rdata`|This is the rdata record to be converted from internal format to a structure. `rdata->type` (and `rdata->class` for class-specific RR types) should be checked at the start of the function with `REQUIRE` statements.|
+|`target`|Pointer to a type-specific structure.|
+
+#### Comparing two rdata in internal format
+
+        static int
+        compare_typename(dns_rdata_t *rdata1,
+                         dns_rdata_t *rdata2);
+
+        static int
+        compare_classname_typename(dns_rdata_t *rdata1,
+                                   dns_rdata_t *rdata2);
+
+This function compares `rdata1` and `rdata2` as required for DNSSEC
+ordering.  The routine should ensure that the `type` and `class` of the
+two rdata match with `REQUIRE(rdata1->type == rdata2->type);` and
+`REQUIRE(rdata1->class == rdata2->class);` statements. The
+`rdata->type` should also be verified, and if the RR type is
+class-specific, also the `rdata->class`.
+
+`compare_classname_typename()` returns -1, 0, 1.
+
+#### Support Functions
+
+The following static support functions are available to use.
+
+        static unsigned int
+        name_length(dns_name_t *name);
+
+Returns the length of `name`.
+
+        static dns_result_t
+        txt_totext(isc_region_t *source, isc_buffer_t *target);
+
+Extracts the octet-length-tagged text string at the start of
+`source` and writes it as a quoted string to `target`.
+`source` is adjusted so that it points to first octet after the
+text string.
+
+Returns `DNS_R_NOSPACE` or `DNS_R_SUCCESS`.
+
+        static dns_result_t
+        txt_fromtext(isc_textregion_t *source, isc_buffer_t *target);
+
+Take the text region `source` and convert it to a length-tagged
+text string, writing it to `target`.
+
+Returns `DNS_R_NOSPACE`, `DNS_R_TEXTTOLONG` or `DNS_R_SUCCESS`.
+
+        static dns_result_t
+        txt_fromwire(isc_buffer_t *source, isc_buffer_t *target);
+
+Read an octet-length-tagged text string from `source` and write it to `target`.
+Ensures that octet-length-tagged text string was wholly within the active area
+of `source`.  Adjusts the active area of `source` so that it refers to the
+first octet after the octet-length-tagged text string.
+
+Returns `DNS_R_UNEXPECTEDEND`, `DNS_R_NOSPACE` or `DNS_R_SUCCESS`.
+
+        static isc_boolean_t
+        name_prefix(dns_name_t *name, dns_name_t *origin, dns_name_t *target);
+
+If `origin` is NULL or the root label, set `target` to refer to `name` and
+return `ISC_FALSE`.  Otherwise, see if `name` is a subdomain of `origin` and
+not equal to it.  If so, make `target` refer to the prefix of `name` and return
+`ISC_TRUE`.  Otherwise, make `target` refer to `name` and return `ISC_FALSE`.
+
+Typical use:
+
+        static dns_result_t
+        totext_typename(dns_rdata_t *rdata, dns_name_t *origin,
+                        isc_buffer_t * target)
+        {
+                isc_region_t region;
+                dns_name_t name, prefix;
+                isc_boolean_t sub;
+
+                dns_name_init(&name, NULL);
+                dns_name_init(&prefix, NULL);
+                dns_rdata_toregion(rdata, &region);
+                dns_name_fromregion(&name, &region);
+                sub = name_prefix(&name, origin, &prefix);
+                return (dns_name_totext(&prefix, sub, target));
+        }
+
+static dns_result_t
+str_totext(char *source, isc_buffer_t *target);
+
+Adds the `NULL`-terminated string `source`, up to but not including `NULL`,
+to `target`.
+
+Returns `DNS_R_NOSPACE` and `DNS_R_SUCCESS`.
+
+        static isc_boolean_t
+        buffer_empty(isc_buffer_t *source);
+
+Returns `ISC_TRUE` if the active region of `source` is
+empty otherwise `ISC_FALSE`.
+
+        static void
+        buffer_fromregion(isc_buffer_t *buffer, isc_region_t *region,
+                          unsigned int type);
+
+Make `buffer` refer to the memory in `region` and make it active.
+
+        static dns_result_t
+        uint32_tobuffer(isc_uint32_t value, isc_buffer_t *target);
+
+Write the 32 bit `value` in network order to `target`.
+
+Returns `DNS_R_NOSPACE` and `DNS_R_SUCCESS`.
+
+static dns_result_t
+uint16_tobuffer(isc_uint32_t value, isc_buffer_t *target);
+
+Write them 16 bit `value` in network order to `target`.
+
+Returns `ISC_R_RANGE`, `DNS_R_NOSPACE` and `DNS_R_SUCCESS`.
+
+        static isc_uint32_t
+        uint32_fromregion(isc_region_t *region);
+
+Returns the 32 bit at the start of `region` in host byte order.
+
+Requires `(region->length >= 4)`.
+
+        static isc_uint16_t
+        uint16_fromregion(isc_region_t *region);
+
+Returns the 16 bit at the start of `region` in host byte order.
+
+Requires `(region->length >= 2)`.
+
+        static dns_result_t
+        gettoken(isc_lex_t *lexer, isc_token_t *token,
+                 isc_tokentype_t expect, isc_boolean_t eol);
+
+Gets the next token from the input stream `lexer`. Ensures that the returned
+token matches `expect` (isc_tokentype_qstring can also return
+isc_tokentype_string), or isc_tokentype_eol and isc_tokentype_eof if `eol` is
+`ISC_TRUE`.
+
+Returns `DNS_R_UNEXPECTED`, `DNS_R_UNEXPECTEDEND`, `DNS_R_UNEXPECTEDTOKEN` and
+`DNS_R_SUCCESS`.
+
+        static dns_result_t
+        mem_tobuffer(isc_buffer_t *target, void *base, unsigned int length);
+
+Add the memory referred to by `base` to `target`.
+
+Returns `DNS_R_NOSPACE` and `DNS_R_SUCCESS`.
+
+        static int
+        compare_region(isc_region_t *r1, isc_region_t *r2)
+
+Compares two regions, returning -1, 0, 1 based on their DNSSEC ordering.
+
+        static int
+        hexvalue(char value);
+
+Returns the hexadecimal value of `value`, or -1 if not a hexadecimal character.
+
+        static int
+        decvalue(char value);
+
+Returns the decimal value of `value`, or -1 if not a decimal character.
+
+        static dns_result_t
+        base64_totext(isc_region_t *source, isc_buffer_t *target);
+
+Convert the region referred to by `source` to Base64 encoded text and put it
+into `target`.
+
+Returns `DNS_R_NOSPACE` or `DNS_R_SUCCESS`.
+
+        static dns_result_t
+        base64_tobuffer(isc_lex_t *lexer, isc_buffer_t *target, int length);
+
+Read a series of tokens from `lexer` that containing base64 data until one of
+end of line, `length` (`length` >= 0) bytes have been read or base64 pad
+characters are seen.  If `length` < 0 it is ignored; otherwise, it is an
+error if there are not `length` octets of data or if when processing a
+token, `length` octets would have been exceeded.
+
+Returns `DNS_R_BADBASE64`, `DNS_R_UNEXPECTED`, `DNS_R_UNEXPECTEDEND`,
+`DNS_R_UNEXPECTEDTOKEN` and `DNS_R_SUCCESS`.
+
+        static dns_result_t
+        time_totext(unsigned long value, isc_buffer_t *target);`
+
+Convert the date represented by `value` into YYYYMMDDHHMMSS format
+taking into account the active epochs. This code is Y2K and Y2038 compliant.
+
+Returns `DNS_R_NOSPACE` and `DNS_R_SUCCESS`.
+
+        static dns_result_t
+        time_tobuffer(char *source, isc_buffer_t *target);
+
+Take the date in `source` and convert it to seconds since January 1, 1970
+(ignoring leap seconds) and place the least significant 32 bits into `target`.
+
+Returns `ISC_R_RANGE`, `DNS_R_SYNTAX`, `DNS_R_NOSPACE` and `DNS_R_SUCCESS`.
+
+#### Support Macros
+
+The following macro is available:
+
+`RETERR(x)`
+
+Evaluate `x` and call `return (<value of x>);` if the result is
+not `ISC_R_SUCCESS`.

doc/misc/docbook-options.pl

@@ -22,9 +22,9 @@ my $FILE = shift;
 
 my $DATE;
 if (@ARGV >= 2) {
-        $DATE = shift
+	$DATE = shift
 } else {
-        $DATE = `git log --max-count=1 --date=short --format='%cd' $FILE` or die "unable to determine last modification date of '$FILE'; specify on command line\nexiting";
+	$DATE = `git log --max-count=1 --date=short --format='%cd' $FILE` or die "unable to determine last modification date of '$FILE'; specify on command line\nexiting";
 }
 chomp $DATE;
 
@@ -115,15 +115,17 @@ while (<FH>) {
 	}
 }
 
+my $blank = 0;
 while (<FH>) {
-        if (m{// not.*implemented} || m{// obsolete}) {
+	if (m{// not.*implemented} || m{// obsolete} || m{// test.*only}) {
-                next;
+		next;
-        }
+	}
+
 	s{ // not configured}{};
 	s{ // may occur multiple times}{};
 	s{<([a-z0-9_-]+)>}{<replaceable>$1</replaceable>}g;
-	s{[[]}{<optional>}g;
+	s{[[]}{[}g;
-	s{[]]}{</optional>}g;
+	s{[]]}{]}g;
 	s{        }{\t}g;
 	if (m{^([a-z0-9-]+) }) {
 		my $HEADING = uc $1;
@@ -133,11 +135,15 @@ while (<FH>) {
     <literallayout class="normal">
 END
 	}
-	if (m{^\s*$}) {
+
+	if (m{^\s*$} && !$blank) {
+		$blank = 1;
 		print <<END;
 </literallayout>
   </refsection>
 END
+	} else {
+		$blank = 0;
 	}
 	print;
 }

doc/misc/options

@@ -168,9 +168,9 @@ options {
         fetches-per-server <integer> [ ( drop | fail ) ];
         fetches-per-zone <integer> [ ( drop | fail ) ];
         files ( default | unlimited | <sizeval> );
-        filter-aaaa { <address_match_element>; ... }; // not configured
+        filter-aaaa { <address_match_element>; ... };
-        filter-aaaa-on-v4 ( break-dnssec | <boolean> ); // not configured
+        filter-aaaa-on-v4 ( break-dnssec | <boolean> );
-        filter-aaaa-on-v6 ( break-dnssec | <boolean> ); // not configured
+        filter-aaaa-on-v6 ( break-dnssec | <boolean> );
         flush-zones-on-shutdown <boolean>;
         forward ( first | only );
         forwarders [ port <integer> ] [ dscp <integer> ] { ( <ipv4_address>
@@ -521,9 +521,9 @@ view <string> [ <class> ] {
         fetch-quota-params <integer> <fixedpoint> <fixedpoint> <fixedpoint>;
         fetches-per-server <integer> [ ( drop | fail ) ];
         fetches-per-zone <integer> [ ( drop | fail ) ];
-        filter-aaaa { <address_match_element>; ... }; // not configured
+        filter-aaaa { <address_match_element>; ... };
-        filter-aaaa-on-v4 ( break-dnssec | <boolean> ); // not configured
+        filter-aaaa-on-v4 ( break-dnssec | <boolean> );
-        filter-aaaa-on-v6 ( break-dnssec | <boolean> ); // not configured
+        filter-aaaa-on-v6 ( break-dnssec | <boolean> );
         forward ( first | only );
         forwarders [ port <integer> ] [ dscp <integer> ] { ( <ipv4_address>
             | <ipv6_address> ) [ port <integer> ] [ dscp <integer> ]; ... };

lib/dns/client.c

@@ -1546,7 +1546,7 @@ dns_client_addtrustedkey(dns_client_t *client, dns_rdataclass_t rdclass,
 	if (result != ISC_R_SUCCESS)
 		goto cleanup;
 
-	result = dns_keytable_add(secroots, ISC_FALSE, &dstkey);
+	result = dns_keytable_add2(secroots, ISC_FALSE, ISC_FALSE, &dstkey);
 
  cleanup:
 	if (dstkey != NULL)

lib/dns/dispatch.c

@@ -3281,7 +3281,7 @@ dns_dispatch_addresponse3(dns_dispatch_t *disp, unsigned int options,
 	if ((options & DNS_DISPATCHOPT_FIXEDID) != 0)
 		id = *idp;
 	else
-		id = (dns_messageid_t)isc_rng_random(DISP_RNGCTX(disp));
+		isc_rng_randombytes(DISP_RNGCTX(disp), &id, sizeof(id));
 	ok = ISC_FALSE;
 	i = 0;
 	do {

lib/dns/include/dns/keytable.h

@@ -102,10 +102,18 @@ dns_keytable_detach(dns_keytable_t **keytablep);
 
 isc_result_t
 dns_keytable_add(dns_keytable_t *keytable, isc_boolean_t managed,
-		 dst_key_t **keyp);
+		 dst_key_t **keyp) ISC_DEPRECATED;
+isc_result_t
+dns_keytable_add2(dns_keytable_t *keytable, isc_boolean_t managed,
+		 isc_boolean_t initial, dst_key_t **keyp);
 /*%<
  * Add '*keyp' to 'keytable' (using the name in '*keyp').
- * The value of keynode->managed is set to 'managed'
+ * The value of keynode->managed is set to 'managed', and the
+ * value of keynode->initial is set to 'initial'. (Note: 'initial'
+ * should only be used when adding managed-keys from configuration.
+ * This indicates the key is in "initializing" state, and has not yet
+ * been confirmed with a key refresh query.  Once a key refresh query
+ * has validated, we update the keynode with inital == ISC_FALSE.)
  *
  * Notes:
  *
@@ -117,6 +125,8 @@ dns_keytable_add(dns_keytable_t *keytable, isc_boolean_t managed,
  *
  *\li	'keytable' points to a valid keytable.
  *
+ *\li	if 'initial' is true then 'managed' must also be true.
+ *
  *\li	keyp != NULL && *keyp is a valid dst_key_t *.
  *
  * Ensures:
@@ -402,6 +412,19 @@ dns_keynode_managed(dns_keynode_t *keynode);
  * Is this flagged as a managed key?
  */
 
+isc_boolean_t
+dns_keynode_initial(dns_keynode_t *keynode);
+/*%<
+ * Is this flagged as an initializing key?
+ */
+
+void
+dns_keynode_trust(dns_keynode_t *keynode);
+/*%<
+ * Sets keynode->initial to ISC_FALSE in order to mark the key as
+ * trusted: no longer an initializing key.
+ */
+
 isc_result_t
 dns_keynode_create(isc_mem_t *mctx, dns_keynode_t **target);
 /*%<

lib/dns/include/dns/message.h

@@ -138,7 +138,6 @@ typedef int dns_messagetextflag_t;
 #define DNS_MESSAGETEXTFLAG_NOHEADERS	0x0002
 #define DNS_MESSAGETEXTFLAG_ONESOA	0x0004
 #define DNS_MESSAGETEXTFLAG_OMITSOA	0x0008
-#define DNS_MESSAGETEXTFLAG_COMMENTDATA	0x0010
 
 /*
  * Dynamic update names for these sections.
@@ -383,21 +382,20 @@ dns_message_totext(dns_message_t *msg, const dns_master_style_t *style,
 /*%<
  * Convert all sections of message 'msg' to a cleartext representation
  *
- * Notes:
+ * Notes on flags:
- * \li     In flags, If #DNS_MESSAGETEXTFLAG_OMITDOT is set, then the
+ *\li	If #DNS_MESSAGETEXTFLAG_NOCOMMENTS is cleared, lines beginning with
- *      final '.' in absolute names will not be emitted.  If
+ * 	";;" will be emitted indicating section name.
- *      #DNS_MESSAGETEXTFLAG_NOCOMMENTS is cleared, lines beginning
+ *\li	If #DNS_MESSAGETEXTFLAG_NOHEADERS is cleared, header lines will be
- *      with ";;" will be emitted indicating section name.  If
+ * 	emitted.
- *      #DNS_MESSAGETEXTFLAG_NOHEADERS is cleared, header lines will
+ *\li   If #DNS_MESSAGETEXTFLAG_ONESOA is set then only print the first
- *      be emitted.
+ *	SOA record in the answer section.
+ *\li	If *#DNS_MESSAGETEXTFLAG_OMITSOA is set don't print any SOA records
+ *	in the answer section.
  *
- *	If #DNS_MESSAGETEXTFLAG_ONESOA is set then only print the
+ * The SOA flags are useful for suppressing the display of the second
- *	first SOA record in the answer section.  If
+ * SOA record in an AXFR by setting #DNS_MESSAGETEXTFLAG_ONESOA on the
- *	#DNS_MESSAGETEXTFLAG_OMITSOA is set don't print any SOA records
+ * first message in an AXFR stream and #DNS_MESSAGETEXTFLAG_OMITSOA on
- *	in the answer section.  These are useful for suppressing the
+ * subsequent messages.
- *	display of the second SOA record in a AXFR by setting
- *	#DNS_MESSAGETEXTFLAG_ONESOA on the first message in a AXFR stream
- *	and #DNS_MESSAGETEXTFLAG_OMITSOA on subsequent messages.
  *
  * Requires:
  *

lib/dns/include/dns/resolver.h

@@ -614,6 +614,12 @@ dns_resolver_setnonbackofftries(dns_resolver_t *resolver, unsigned int tries);
 
 unsigned int
 dns_resolver_getoptions(dns_resolver_t *resolver);
+/*%<
+ * Get the resolver options.
+ *
+ * Requires:
+ * \li	resolver to be valid.
+ */
 
 void
 dns_resolver_addbadcache(dns_resolver_t *resolver, const dns_name_t *name,

lib/dns/include/dns/stats.h

@@ -64,7 +64,8 @@ enum {
 	dns_resstatscounter_zonequota = 41,
 	dns_resstatscounter_serverquota = 42,
 	dns_resstatscounter_nextitem = 43,
-	dns_resstatscounter_max = 44,
+	dns_resstatscounter_priming = 44,
+	dns_resstatscounter_max = 45,
 
 	/*
 	 * DNSSEC stats.

lib/dns/keytable.c

@@ -47,6 +47,7 @@ struct dns_keynode {
 	isc_refcount_t          refcount;
 	dst_key_t *             key;
 	isc_boolean_t           managed;
+	isc_boolean_t		initial;
 	struct dns_keynode *    next;
 };
 
@@ -164,83 +165,169 @@ dns_keytable_detach(dns_keytable_t **keytablep) {
 	*keytablep = NULL;
 }
 
+/*%
+ * Search "node" for either a null key node or a key node for the exact same
+ * key as the one supplied in "keyp" and, if found, update it accordingly.
+ */
 static isc_result_t
-insert(dns_keytable_t *keytable, isc_boolean_t managed,
+update_keynode(dst_key_t **keyp, dns_rbtnode_t *node, isc_boolean_t initial) {
-       const dns_name_t *keyname, dst_key_t **keyp)
+	dns_keynode_t *knode;
+
+	REQUIRE(keyp != NULL && *keyp != NULL);
+	REQUIRE(node != NULL);
+
+	for (knode = node->data; knode != NULL; knode = knode->next) {
+		if (knode->key == NULL) {
+			/*
+			 * Null key node found.  Attach the supplied key to it,
+			 * making it a non-null key node and transferring key
+			 * ownership to the keytable.
+			 */
+			knode->key = *keyp;
+			*keyp = NULL;
+			return (ISC_R_SUCCESS);
+		} else if (dst_key_compare(knode->key, *keyp)) {
+			/*
+			 * Key node found for the supplied key.  Free the
+			 * supplied copy of the key and update the found key
+			 * node's flags if necessary.
+			 */
+			dst_key_free(keyp);
+			if (!initial) {
+				dns_keynode_trust(knode);
+			}
+			return (ISC_R_SUCCESS);
+		}
+	}
+
+	return (ISC_R_NOTFOUND);
+}
+
+/*%
+ * Create a key node for "keyp" (or a null key node if "keyp" is NULL), set
+ * "managed" and "initial" as requested and make the created key node the first
+ * one attached to "node" in "keytable".
+ */
+static isc_result_t
+prepend_keynode(dst_key_t **keyp, dns_rbtnode_t *node,
+		dns_keytable_t *keytable, isc_boolean_t managed,
+		isc_boolean_t initial)
 {
-	isc_result_t result;
 	dns_keynode_t *knode = NULL;
-	dns_rbtnode_t *node;
+	isc_result_t result;
 
 	REQUIRE(keyp == NULL || *keyp != NULL);
 	REQUIRE(VALID_KEYTABLE(keytable));
+	REQUIRE(!initial || managed);
 
 	result = dns_keynode_create(keytable->mctx, &knode);
-	if (result != ISC_R_SUCCESS)
+	if (result != ISC_R_SUCCESS) {
 		return (result);
+	}
+
+	/*
+	 * If a key was supplied, transfer its ownership to the keytable.
+	 */
+	if (keyp) {
+		knode->key = *keyp;
+		*keyp = NULL;
+	}
 
 	knode->managed = managed;
+	knode->initial = initial;
+	knode->next = node->data;
+	node->data = knode;
+
+	return (ISC_R_SUCCESS);
+}
+
+/*%
+ * Add key "keyp" at "keyname" in "keytable".  If the key already exists at the
+ * requested name, update its flags.  If "keyp" is NULL, add a null key to
+ * indicate that "keyname" should be treated as a secure domain without
+ * supplying key data which would allow the domain to be validated.
+ */
+static isc_result_t
+insert(dns_keytable_t *keytable, isc_boolean_t managed, isc_boolean_t initial,
+       const dns_name_t *keyname, dst_key_t **keyp)
+{
+	dns_rbtnode_t *node = NULL;
+	isc_result_t result;
+
+	REQUIRE(VALID_KEYTABLE(keytable));
 
 	RWLOCK(&keytable->rwlock, isc_rwlocktype_write);
 
-	node = NULL;
 	result = dns_rbt_addnode(keytable->table, keyname, &node);
-
-	if (keyp != NULL) {
-		if (result == ISC_R_EXISTS) {
-			/* Key already in table? */
-			dns_keynode_t *k;
-			for (k = node->data; k != NULL; k = k->next) {
-				if (k->key == NULL) {
-					k->key = *keyp;
-					*keyp = NULL; /* transfer ownership */
-					break;
-				}
-				if (dst_key_compare(k->key, *keyp) == ISC_TRUE)
-					break;
-			}
-
-			if (k == NULL)
-				result = ISC_R_SUCCESS;
-			else if (*keyp != NULL)
-				dst_key_free(keyp);
-		}
-
-		if (result == ISC_R_SUCCESS) {
-			knode->key = *keyp;
-			knode->next = node->data;
-			*keyp = NULL;
-		}
-	}
-
 	if (result == ISC_R_SUCCESS) {
-		node->data = knode;
+		/*
-		knode = NULL;
+		 * There was no node for "keyname" in "keytable" yet, so one
+		 * was created.  Create a new key node for the supplied key (or
+		 * a null key node if "keyp" is NULL) and attach it to the
+		 * created node.
+		 */
+		result = prepend_keynode(keyp, node, keytable, managed,
+					 initial);
+	} else if (result == ISC_R_EXISTS) {
+		/*
+		 * A node already exists for "keyname" in "keytable".
+		 */
+		if (keyp == NULL) {
+			/*
+			 * We were told to add a null key at "keyname", which
+			 * means there is nothing left to do as there is either
+			 * a null key at this node already or there is a
+			 * non-null key node which would not be affected.
+			 * Reset result to reflect the fact that the node for
+			 * "keyname" is already marked as secure.
+			 */
+			result = ISC_R_SUCCESS;
+		} else {
+			/*
+			 * We were told to add the key supplied in "keyp" at
+			 * "keyname".  Try to find an already existing key node
+			 * we could reuse for the supplied key (i.e. a null key
+			 * node or a key node for the exact same key) and, if
+			 * found, update it accordingly.
+			 */
+			result = update_keynode(keyp, node, initial);
+			if (result == ISC_R_NOTFOUND) {
+				/*
+				 * The node for "keyname" only contains key
+				 * nodes for keys different than the supplied
+				 * one.  Create a new key node for the supplied
+				 * key and prepend it before the others.
+				 */
+				result = prepend_keynode(keyp, node, keytable,
+							 managed, initial);
+			}
+		}
 	}
 
-	/* Key was already there?  That's the same as a success */
-	if (result == ISC_R_EXISTS)
-		result = ISC_R_SUCCESS;
-
 	RWUNLOCK(&keytable->rwlock, isc_rwlocktype_write);
 
-	if (knode != NULL)
-		dns_keynode_detach(keytable->mctx, &knode);
-
 	return (result);
 }
 
 isc_result_t
 dns_keytable_add(dns_keytable_t *keytable, isc_boolean_t managed,
 		 dst_key_t **keyp)
+{
+	return (dns_keytable_add2(keytable, managed, ISC_FALSE, keyp));
+}
+
+isc_result_t
+dns_keytable_add2(dns_keytable_t *keytable, isc_boolean_t managed,
+		  isc_boolean_t initial, dst_key_t **keyp)
 {
 	REQUIRE(keyp != NULL && *keyp != NULL);
-	return (insert(keytable, managed, dst_key_name(*keyp), keyp));
+	REQUIRE(!initial || managed);
+	return (insert(keytable, managed, initial, dst_key_name(*keyp), keyp));
 }
 
 isc_result_t
 dns_keytable_marksecure(dns_keytable_t *keytable, const dns_name_t *name) {
-	return (insert(keytable, ISC_TRUE, name, NULL));
+	return (insert(keytable, ISC_TRUE, ISC_FALSE, name, NULL));
 }
 
 isc_result_t
@@ -644,8 +731,9 @@ dns_keytable_totext(dns_keytable_t *keytable, isc_buffer_t **text) {
 			if (knode->key == NULL)
 				continue;
 			dst_key_format(knode->key, pbuf, sizeof(pbuf));
-			snprintf(obuf, sizeof(obuf), "%s ; %s\n", pbuf,
+			snprintf(obuf, sizeof(obuf), "%s ; %s%s\n", pbuf,
-				knode->managed ? "managed" : "trusted");
+				 knode->initial ? "initializing " : "",
+				 knode->managed ? "managed" : "trusted");
 			result = putstr(text, obuf);
 			if (result != ISC_R_SUCCESS)
 				break;
@@ -703,11 +791,6 @@ dns_keytable_forall(dns_keytable_t *keytable,
 
 dst_key_t *
 dns_keynode_key(dns_keynode_t *keynode) {
-
-	/*
-	 * Get the DST key associated with keynode.
-	 */
-
 	REQUIRE(VALID_KEYNODE(keynode));
 
 	return (keynode->key);
@@ -715,14 +798,25 @@ dns_keynode_key(dns_keynode_t *keynode) {
 
 isc_boolean_t
 dns_keynode_managed(dns_keynode_t *keynode) {
-	/*
-	 * Is this a managed key?
-	 */
 	REQUIRE(VALID_KEYNODE(keynode));
 
 	return (keynode->managed);
 }
 
+isc_boolean_t
+dns_keynode_initial(dns_keynode_t *keynode) {
+	REQUIRE(VALID_KEYNODE(keynode));
+
+	return (keynode->initial);
+}
+
+void
+dns_keynode_trust(dns_keynode_t *keynode) {
+	REQUIRE(VALID_KEYNODE(keynode));
+
+	keynode->initial = ISC_FALSE;
+}
+
 isc_result_t
 dns_keynode_create(isc_mem_t *mctx, dns_keynode_t **target) {
 	isc_result_t result;
@@ -736,6 +830,7 @@ dns_keynode_create(isc_mem_t *mctx, dns_keynode_t **target) {
 
 	knode->magic = KEYNODE_MAGIC;
 	knode->managed = ISC_FALSE;
+	knode->initial = ISC_FALSE;
 	knode->key = NULL;
 	knode->next = NULL;
 

lib/dns/rbt.c

@@ -21,6 +21,7 @@
 #include <isc/file.h>
 #include <isc/hex.h>
 #include <isc/mem.h>
+#include <isc/once.h>
 #include <isc/platform.h>
 #include <isc/print.h>
 #include <isc/refcount.h>
@@ -138,6 +139,9 @@ static isc_result_t
 write_header(FILE *file, dns_rbt_t *rbt, isc_uint64_t first_node_offset,
 	     isc_uint64_t crc);
 
+static isc_boolean_t
+match_header_version(file_header_t *header);
+
 static isc_result_t
 serialize_node(FILE *file, dns_rbtnode_t *node, uintptr_t left,
 	       uintptr_t right, uintptr_t down, uintptr_t parent,
@@ -483,6 +487,18 @@ dns_rbt_zero_header(FILE *file) {
 	return (ISC_R_SUCCESS);
 }
 
+static isc_once_t once = ISC_ONCE_INIT;
+
+static void
+init_file_version(void) {
+	int n;
+
+	memset(FILE_VERSION, 0, sizeof(FILE_VERSION));
+	n = snprintf(FILE_VERSION, sizeof(FILE_VERSION),
+		 "RBT Image %s %s", dns_major, dns_mapapi);
+	INSIST(n > 0 && (unsigned int)n < sizeof(FILE_VERSION));
+}
+
 /*
  * Write out the real header, including NodeDump version information
  * and the offset of the first node.
@@ -498,11 +514,7 @@ write_header(FILE *file, dns_rbt_t *rbt, isc_uint64_t first_node_offset,
 	isc_result_t result;
 	off_t location;
 
-	if (FILE_VERSION[0] == '\0') {
+	RUNTIME_CHECK(isc_once_do(&once, init_file_version) == ISC_R_SUCCESS);
-		memset(FILE_VERSION, 0, sizeof(FILE_VERSION));
-		snprintf(FILE_VERSION, sizeof(FILE_VERSION),
-			 "RBT Image %s %s", dns_major, dns_mapapi);
-	}
 
 	memset(&header, 0, sizeof(file_header_t));
 	memmove(header.version1, FILE_VERSION, sizeof(header.version1));
@@ -534,6 +546,21 @@ write_header(FILE *file, dns_rbt_t *rbt, isc_uint64_t first_node_offset,
 	return (result);
 }
 
+static isc_boolean_t
+match_header_version(file_header_t *header) {
+	RUNTIME_CHECK(isc_once_do(&once, init_file_version) == ISC_R_SUCCESS);
+
+	if (memcmp(header->version1, FILE_VERSION,
+		   sizeof(header->version1)) != 0 ||
+	    memcmp(header->version2, FILE_VERSION,
+		   sizeof(header->version1)) != 0)
+	{
+		return (ISC_FALSE);
+	}
+
+	return (ISC_TRUE);
+}
+
 static isc_result_t
 serialize_node(FILE *file, dns_rbtnode_t *node, uintptr_t left,
 	       uintptr_t right, uintptr_t down, uintptr_t parent,
@@ -608,7 +635,7 @@ serialize_node(FILE *file, dns_rbtnode_t *node, uintptr_t left,
 #endif
 
 	isc_crc64_update(crc, (const isc_uint8_t *) &temp_node,
-			sizeof(dns_rbtnode_t));
+			 sizeof(dns_rbtnode_t));
 	isc_crc64_update(crc, (const isc_uint8_t *) node_data, datasize);
 
  cleanup:
@@ -880,6 +907,10 @@ dns_rbt_deserialize_tree(void *base_address, size_t filesize,
 	rbt->mmap_location = base_address;
 
 	header = (file_header_t *)((char *)base_address + header_offset);
+	if (!match_header_version(header)) {
+		result = ISC_R_INVALIDFILE;
+		goto cleanup;
+	}
 
 #ifdef DNS_RDATASET_FIXED
 	if (header->rdataset_fixed != 1) {

lib/dns/rbtdb.c

@@ -900,6 +900,8 @@ static void overmem(dns_db_t *db, isc_boolean_t over);
 static void setnsec3parameters(dns_db_t *db, rbtdb_version_t *version);
 static void setownercase(rdatasetheader_t *header, const dns_name_t *name);
 
+static isc_boolean_t match_header_version(rbtdb_file_header_t *header);
+
 /* Pad to 32 bytes */
 static char FILE_VERSION[32] = "\0";
 
@@ -7479,10 +7481,15 @@ deserialize32(void *arg, FILE *f, off_t offset) {
 #endif
 
 	base = isc_file_mmap(NULL, filesize, protect, flags, fd, 0);
-	if (base == NULL || base == MAP_FAILED)
+	if (base == NULL || base == MAP_FAILED) {
 		return (ISC_R_FAILURE);
+	}
 
 	header = (rbtdb_file_header_t *)(base + offset);
+	if (!match_header_version(header)) {
+		result = ISC_R_INVALIDFILE;
+		goto cleanup;
+	}
 
 	if (header->tree != 0) {
 		result = dns_rbt_deserialize_tree(base, filesize,
@@ -7786,6 +7793,21 @@ rbtdb_write_header(FILE *rbtfile, off_t tree_location, off_t nsec_location,
 	return (result);
 }
 
+static isc_boolean_t
+match_header_version(rbtdb_file_header_t *header) {
+	RUNTIME_CHECK(isc_once_do(&once, init_file_version) == ISC_R_SUCCESS);
+
+	if (memcmp(header->version1, FILE_VERSION,
+		   sizeof(header->version1)) != 0 ||
+	    memcmp(header->version2, FILE_VERSION,
+		   sizeof(header->version1)) != 0)
+	{
+		return (ISC_FALSE);
+	}
+
+	return (ISC_TRUE);
+}
+
 static isc_result_t
 serialize(dns_db_t *db, dns_dbversion_t *ver, FILE *rbtfile) {
 	rbtdb_version_t *version = (rbtdb_version_t *) ver;

lib/dns/resolver.c

@@ -9987,6 +9987,7 @@ dns_resolver_prime(dns_resolver_t *res) {
 			res->priming = ISC_FALSE;
 			UNLOCK(&res->lock);
 		}
+		inc_stats(res, dns_resstatscounter_priming);
 	}
 }
 
@@ -10594,8 +10595,8 @@ dns_resolver_addbadcache(dns_resolver_t *resolver, const dns_name_t *name,
 	if (!fuzzing_resolver)
 #endif
 	{
-		(void) dns_badcache_add(resolver->badcache, name, type,
+		dns_badcache_add(resolver->badcache, name, type,
-					ISC_FALSE, 0, expire);
+				 ISC_FALSE, 0, expire);
 	}
 }
 

lib/dns/tests/dnstest.h

@@ -88,5 +88,5 @@ dns_test_tohex(const unsigned char *data, size_t len, char *buf, size_t buflen);
  */
 isc_result_t
 dns_test_rdata_fromstring(dns_rdata_t *rdata, dns_rdataclass_t rdclass,
-                          dns_rdatatype_t rdtype, unsigned char *dst,
+			  dns_rdatatype_t rdtype, unsigned char *dst,
-                          size_t dstlen, const char *src);
+			  size_t dstlen, const char *src);

lib/dns/tests/keytable_test.c

@@ -126,7 +126,12 @@ create_tables() {
 
 	/* Add a normal key */
 	create_key(257, 3, 5, "example.com", keystr1, &key);
-	ATF_REQUIRE_EQ(dns_keytable_add(keytable, ISC_FALSE, &key),
+	ATF_REQUIRE_EQ(dns_keytable_add2(keytable, ISC_FALSE, ISC_FALSE, &key),
+		       ISC_R_SUCCESS);
+
+	/* Add an initializing managed key */
+	create_key(257, 3, 5, "managed.com", keystr1, &key);
+	ATF_REQUIRE_EQ(dns_keytable_add2(keytable, ISC_TRUE, ISC_TRUE, &key),
 		       ISC_R_SUCCESS);
 
 	/* Add a null key */
@@ -185,7 +190,7 @@ ATF_TC_BODY(add, tc) {
 	 * nextkeynode() should still return NOTFOUND.
 	 */
 	create_key(257, 3, 5, "example.com", keystr1, &key);
-	ATF_REQUIRE_EQ(dns_keytable_add(keytable, ISC_FALSE, &key),
+	ATF_REQUIRE_EQ(dns_keytable_add2(keytable, ISC_FALSE, ISC_FALSE, &key),
 		       ISC_R_SUCCESS);
 	ATF_REQUIRE_EQ(dns_keytable_nextkeynode(keytable, keynode,
 						&next_keynode), ISC_R_NOTFOUND);
@@ -193,23 +198,129 @@ ATF_TC_BODY(add, tc) {
 	/* Add another key (different keydata) */
 	dns_keytable_detachkeynode(keytable, &keynode);
 	create_key(257, 3, 5, "example.com", keystr2, &key);
-	ATF_REQUIRE_EQ(dns_keytable_add(keytable, ISC_FALSE, &key),
+	ATF_REQUIRE_EQ(dns_keytable_add2(keytable, ISC_FALSE, ISC_FALSE, &key),
 		       ISC_R_SUCCESS);
 	ATF_REQUIRE_EQ(dns_keytable_find(keytable, str2name("example.com"),
 					 &keynode), ISC_R_SUCCESS);
 	ATF_REQUIRE_EQ(dns_keytable_nextkeynode(keytable, keynode,
 						&next_keynode), ISC_R_SUCCESS);
 	dns_keytable_detachkeynode(keytable, &next_keynode);
+	dns_keytable_detachkeynode(keytable, &keynode);
+
+	/*
+	 * Get the keynode for the managed.com key.  There's no other key for
+	 * the name, so nextkeynode() should return NOTFOUND.  Ensure the
+	 * retrieved key is an initializing key, then mark it as trusted using
+	 * dns_keynode_trust() and ensure the latter works as expected.
+	 */
+	ATF_REQUIRE_EQ(dns_keytable_find(keytable, str2name("managed.com"),
+					 &keynode), ISC_R_SUCCESS);
+	ATF_REQUIRE_EQ(dns_keytable_nextkeynode(keytable, keynode,
+						&next_keynode), ISC_R_NOTFOUND);
+	ATF_REQUIRE_EQ(dns_keynode_initial(keynode), ISC_TRUE);
+	dns_keynode_trust(keynode);
+	ATF_REQUIRE_EQ(dns_keynode_initial(keynode), ISC_FALSE);
+	dns_keytable_detachkeynode(keytable, &keynode);
+
+	/*
+	 * Add a different managed key for managed.com, marking it as an
+	 * initializing key.  Ensure nextkeynode() no longer returns
+	 * ISC_R_NOTFOUND and that the added key is an initializing key.
+	 */
+	create_key(257, 3, 5, "managed.com", keystr2, &key);
+	ATF_REQUIRE_EQ(dns_keytable_add2(keytable, ISC_TRUE, ISC_TRUE, &key),
+		       ISC_R_SUCCESS);
+	ATF_REQUIRE_EQ(dns_keytable_find(keytable, str2name("managed.com"),
+					 &keynode), ISC_R_SUCCESS);
+	ATF_REQUIRE_EQ(dns_keytable_nextkeynode(keytable, keynode,
+						&next_keynode), ISC_R_SUCCESS);
+	ATF_REQUIRE_EQ(dns_keynode_initial(keynode), ISC_TRUE);
+	dns_keytable_detachkeynode(keytable, &next_keynode);
+	dns_keytable_detachkeynode(keytable, &keynode);
+
+	/*
+	 * Add the same managed key again, but this time mark it as a
+	 * non-initializing key.  Ensure the previously added key is upgraded
+	 * to a non-initializing key and make sure there are still two key
+	 * nodes for managed.com, both containing non-initializing keys.
+	 */
+	create_key(257, 3, 5, "managed.com", keystr2, &key);
+	ATF_REQUIRE_EQ(dns_keytable_add2(keytable, ISC_TRUE, ISC_FALSE, &key),
+		       ISC_R_SUCCESS);
+	ATF_REQUIRE_EQ(dns_keytable_find(keytable, str2name("managed.com"),
+					 &keynode), ISC_R_SUCCESS);
+	ATF_REQUIRE_EQ(dns_keynode_initial(keynode), ISC_FALSE);
+	ATF_REQUIRE_EQ(dns_keytable_nextkeynode(keytable, keynode,
+						&next_keynode), ISC_R_SUCCESS);
+	dns_keytable_detachkeynode(keytable, &keynode);
+	keynode = next_keynode;
+	next_keynode = NULL;
+	ATF_REQUIRE_EQ(dns_keynode_initial(keynode), ISC_FALSE);
+	ATF_REQUIRE_EQ(dns_keytable_nextkeynode(keytable, keynode,
+						&next_keynode), ISC_R_NOTFOUND);
+	dns_keytable_detachkeynode(keytable, &keynode);
+
+	/*
+	 * Add a managed key at a new node, two.com, marking it as an
+	 * initializing key.  Ensure nextkeynode() returns ISC_R_NOTFOUND and
+	 * that the added key is an initializing key.
+	 */
+	create_key(257, 3, 5, "two.com", keystr1, &key);
+	ATF_REQUIRE_EQ(dns_keytable_add2(keytable, ISC_TRUE, ISC_TRUE, &key),
+		       ISC_R_SUCCESS);
+	ATF_REQUIRE_EQ(dns_keytable_find(keytable, str2name("two.com"),
+					 &keynode), ISC_R_SUCCESS);
+	ATF_REQUIRE_EQ(dns_keytable_nextkeynode(keytable, keynode,
+						&next_keynode), ISC_R_NOTFOUND);
+	ATF_REQUIRE_EQ(dns_keynode_initial(keynode), ISC_TRUE);
+	dns_keytable_detachkeynode(keytable, &keynode);
+
+	/*
+	 * Add a different managed key for two.com, marking it as a
+	 * non-initializing key.  Ensure nextkeynode() no longer returns
+	 * ISC_R_NOTFOUND and that the added key is not an initializing key.
+	 */
+	create_key(257, 3, 5, "two.com", keystr2, &key);
+	ATF_REQUIRE_EQ(dns_keytable_add2(keytable, ISC_TRUE, ISC_FALSE, &key),
+		       ISC_R_SUCCESS);
+	ATF_REQUIRE_EQ(dns_keytable_find(keytable, str2name("two.com"),
+					 &keynode), ISC_R_SUCCESS);
+	ATF_REQUIRE_EQ(dns_keytable_nextkeynode(keytable, keynode,
+						&next_keynode), ISC_R_SUCCESS);
+	ATF_REQUIRE_EQ(dns_keynode_initial(keynode), ISC_FALSE);
+	dns_keytable_detachkeynode(keytable, &next_keynode);
+	dns_keytable_detachkeynode(keytable, &keynode);
+
+	/*
+	 * Add the first managed key again, but this time mark it as a
+	 * non-initializing key.  Ensure the previously added key is upgraded
+	 * to a non-initializing key and make sure there are still two key
+	 * nodes for two.com, both containing non-initializing keys.
+	 */
+	create_key(257, 3, 5, "two.com", keystr1, &key);
+	ATF_REQUIRE_EQ(dns_keytable_add2(keytable, ISC_TRUE, ISC_FALSE, &key),
+		       ISC_R_SUCCESS);
+	ATF_REQUIRE_EQ(dns_keytable_find(keytable, str2name("two.com"),
+					 &keynode), ISC_R_SUCCESS);
+	ATF_REQUIRE_EQ(dns_keynode_initial(keynode), ISC_FALSE);
+	ATF_REQUIRE_EQ(dns_keytable_nextkeynode(keytable, keynode,
+						&next_keynode), ISC_R_SUCCESS);
+	dns_keytable_detachkeynode(keytable, &keynode);
+	keynode = next_keynode;
+	next_keynode = NULL;
+	ATF_REQUIRE_EQ(dns_keynode_initial(keynode), ISC_FALSE);
+	ATF_REQUIRE_EQ(dns_keytable_nextkeynode(keytable, keynode,
+						&next_keynode), ISC_R_NOTFOUND);
+	dns_keytable_detachkeynode(keytable, &keynode);
 
 	/*
 	 * Add a normal key to a name that has a null key.  The null key node
 	 * will be updated with the normal key.
 	 */
-	dns_keytable_detachkeynode(keytable, &keynode);
 	ATF_REQUIRE_EQ(dns_keytable_find(keytable, str2name("null.example"),
 					 &null_keynode), ISC_R_SUCCESS);
 	create_key(257, 3, 5, "null.example", keystr2, &key);
-	ATF_REQUIRE_EQ(dns_keytable_add(keytable, ISC_FALSE, &key),
+	ATF_REQUIRE_EQ(dns_keytable_add2(keytable, ISC_FALSE, ISC_FALSE, &key),
 		       ISC_R_SUCCESS);
 	ATF_REQUIRE_EQ(dns_keytable_find(keytable, str2name("null.example"),
 					 &keynode), ISC_R_SUCCESS);
@@ -346,8 +457,7 @@ ATF_TC_BODY(find, tc) {
 
 	/*
 	 * dns_keytable_find() requires exact name match.  It matches node
-	 * that has a null key, too.  But it doesn't match a negative trust
+	 * that has a null key, too.
-	 * anchor.
 	 */
 	ATF_REQUIRE_EQ(dns_keytable_find(keytable, str2name("example.org"),
 					 &keynode), ISC_R_NOTFOUND);
@@ -360,12 +470,10 @@ ATF_TC_BODY(find, tc) {
 					 &keynode), ISC_R_SUCCESS);
 	ATF_REQUIRE_EQ(dns_keynode_key(keynode), NULL);
 	dns_keytable_detachkeynode(keytable, &keynode);
-	ATF_REQUIRE_EQ(dns_keytable_find(keytable, str2name("insecure.example"),
-					 &keynode), ISC_R_NOTFOUND);
 
 	/*
 	 * dns_keytable_finddeepestmatch() allows partial match.  Also match
-	 * nodes with a null key or a negative trust anchor.
+	 * nodes with a null key.
 	 */
 	dns_fixedname_init(&fname);
 	name = dns_fixedname_name(&fname);
@@ -389,8 +497,7 @@ ATF_TC_BODY(find, tc) {
 	/*
 	 * dns_keytable_findkeynode() requires exact name, algorithm, keytag
 	 * match.  If algorithm or keytag doesn't match, should result in
-	 * PARTIALMATCH.  Same for a node with a null key or a negative trust
+	 * PARTIALMATCH.  Same for a node with a null key.
-	 * anchor.
 	 */
 	ATF_REQUIRE_EQ(dns_keytable_findkeynode(keytable,
 						str2name("example.org"),
@@ -452,19 +559,15 @@ ATF_TC_BODY(issecuredomain, tc) {
 	}
 
 	/*
-	 * Domains that are an exact or partial match of a negative trust
+	 * If the key table has no entry (not even a null one) for a domain or
-	 * anchor are considered insecure.
+	 * any of its ancestors, that domain is considered insecure.
 	 */
 	ATF_REQUIRE_EQ(dns_keytable_issecuredomain(keytable,
-						   str2name("insecure.example"),
+						   str2name("example.org"),
 						   NULL,
 						   &issecure),
 		       ISC_R_SUCCESS);
 	ATF_REQUIRE_EQ(issecure, ISC_FALSE);
-	ATF_REQUIRE_EQ(dns_keytable_issecuredomain(
-			       keytable, str2name("sub.insecure.example"),
-			       NULL, &issecure), ISC_R_SUCCESS);
-	ATF_REQUIRE_EQ(issecure, ISC_FALSE);
 
 	destroy_tables();
 	dns_test_end();
@@ -523,7 +626,7 @@ ATF_TC_BODY(nta, tc) {
 	ATF_REQUIRE_EQ(result, ISC_R_SUCCESS);
 
 	create_key(257, 3, 5, "example", keystr1, &key);
-	result = dns_keytable_add(keytable, ISC_FALSE, &key);
+	result = dns_keytable_add2(keytable, ISC_FALSE, ISC_FALSE, &key);
 	ATF_REQUIRE_EQ(result, ISC_R_SUCCESS);
 
 	isc_stdtime_get(&now);
@@ -564,6 +667,11 @@ ATF_TC_BODY(nta, tc) {
 	ATF_CHECK(issecure);
 
 	/* Now check deletion */
+	result = dns_view_issecuredomain(myview, str2name("test.new.example"),
+					 now, ISC_TRUE, &issecure);
+	ATF_CHECK_EQ(result, ISC_R_SUCCESS);
+	ATF_CHECK(issecure);
+
 	result = dns_ntatable_add(ntatable, str2name("new.example"),
 				  ISC_FALSE, now, 3600);
 	ATF_REQUIRE_EQ(result, ISC_R_SUCCESS);

lib/dns/tests/nsec3_test.c

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2012, 2014-2016  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2012, 2014-2017  Internet Systems Consortium, Inc. ("ISC")
  *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this

lib/dns/win32/libdns.def.in

@@ -431,10 +431,13 @@ dns_keynode_attach
 dns_keynode_create
 dns_keynode_detach
 dns_keynode_detachall
+dns_keynode_initial
 dns_keynode_key
 dns_keynode_managed
+dns_keynode_trust
 dns_keyring_restore
 dns_keytable_add
+dns_keytable_add2
 dns_keytable_attach
 dns_keytable_attachkeynode
 dns_keytable_create