[rt46718] Pass callback parameters explicitly instead of using a va_list

This is a bit cumbersome, but retains type safety. Bikeshed a bit on variable names while at it.
[rt46718] style
2017-11-30 08:45:57 +01:00 · 2017-11-29 12:55:55 -08:00 · 2017-11-29 20:34:14 +01:00 · 2017-11-29 19:10:50 +01:00 · 2017-11-29 18:49:50 +01:00 · 2017-11-29 15:38:49 +01:00
224 changed files with 5896 additions and 4608 deletions
@@ -1,3 +1,136 @@
+4830.	[bug]		Failure to configure ATF when requested did not cause
+			an error in top-level configure script. [RT #46655]
+
+4829.	[bug]		isc_heap_delete did not zero the index value when
+			the heap was created with a callback to do that.
+			[RT #46709]
+
+4828.	[bug]		Do not use thread-local storage for storing LMDB reader
+			locktable slots. [RT #46556]
+
+4827.	[misc]		Add a precommit check script util/checklibs.sh
+			[RT #46215]
+
+4826.	[cleanup]	Prevent potential build failures in bin/confgen/ and
+			bin/named/ when using parallel make. [RT #46648]
+
+4825.	[bug]		Prevent a bogus "error during managed-keys processing
+			(no more)" warning from being logged. [RT #46645]
+
+4824.	[port]		Add iOS hooks to dig. [RT #42011]
+
+4823.	[test]		Refactor reclimit system test to improve its
+			reliability and speed. [RT #46632]
+
+4822.	[bug]		Use resign_sooner in dns_db_setsigningtime. [RT #46473]
+
+4821.	[bug]		When resigning ensure that the SOA's expire time is
+			always later that the resigning time of other records.
+			[RT #46473]
+
+4820.	[bug]		dns_db_subtractrdataset should transfer the resigning
+			information to the new header. [RT #46473]
+
+4819.	[bug]		Fully backout the transaction when adding a RRset
+			to the resigning / removal heaps fails. [RT #46473]
+
+4818.	[test]		The logfileconfig system test could intermittently
+			report false negatives on some platforms. [RT #46615]
+
+4817.	[cleanup]	Use DNS_NAME_INITABSOLUTE and DNS_NAME_INITNONABSOLUTE.
+			[RT #45433]
+
+4816.	[bug]		Don't use a common array for storing EDNS options
+			in DiG as it could fill up. [RT #45611]
+
+4815.	[bug]		rbt_test.c:insert_and_delete needed to call
+			dns_rbt_addnode instead of dns_rbt_addname. [RT #46553]
+
+4814.	[cleanup]	Use AS_HELP_STRING for consistent help text. [RT #46521]
+
+4813.	[bug]		Address potential read after free errors from
+			query_synthnodata, query_synthwildcard and
+			query_synthnxdomain. [RT #46547]
+
+4812.	[bug]		Minor improvements to stability and consistency of code
+			handling managed keys. [RT #46468]
+
+4811.	[bug]		Revert api changes to use <isc/buffer.h> inline
+			macros.  Provide a alternative mechanism to turn
+			on the use of inline macros when building BIND.
+			[RT #46520]
+
+4810.	[test]		The chain system test failed if the IPv6 interfaces
+			were not configured. [RT #46508]
+
+	--- 9.12.0b2 released ---
+
+4809.	[port]		Check at configure time whether -latomic is needed
+			for stdatomic.h. [RT #46324]
+
+4808.	[bug]		Properly test for zlib.h. [RT #46504]
+
+4807.	[cleanup]	isc_rng_randombytes() returns a specified number of
+			bytes from the PRNG; this is now used instead of
+			calling isc_rng_random() multiple times. [RT #46230]
+
+4806.	[func]		Log messages related to loading of zones are now
+			directed to the "zoneload" logging category.
+			[RT #41640]
+
+4805.	[bug]		TCP4Active and TCP6Active weren't being updated
+			correctly. [RT #46454]
+
+4804.	[port]		win32: access() does not work on directories as
+			required by POSIX.  Supply a alternative in
+			isc_file_isdirwritable. [RT #46394]
+
+4803.	[placeholder]
+
+4802.	[test]		Refactor mkeys system test to make it quicker and more
+			reliable. [RT #45293]
+
+4801.	[func]		'dnssec-lookaside auto;' and 'dnssec-lookaside .
+			trust-anchor dlv.isc.org;' now elicit warnings rather
+			than being fatal configuration errors. [RT #46410]
+
+4800.	[bug]		When processing delzone, write one zone config per
+			line to the NZF. [RT #46323]
+
+4799.	[cleanup]	Improve clarity of keytable unit tests. [RT #46407]
+
+4798.	[func]		Keys specified in "managed-keys" statements
+			are tagged as "initializing" until they have been
+			updated by a key refresh query. If initialization
+			fails it will be visible from "rndc secroots".
+			[RT #46267]
+
+4797.	[func]		Removed "isc-hmac-fixup", as the versions of BIND that
+			had the bug it worked around are long past end of
+			life. [RT #46411]
+
+4796.	[bug]		Increase the maximum configurable TCP keepalive
+			timeout to 65535. [RT #44710]
+
+4795.	[func]		A new statistics counter has been added to track
+			priming queries. [RT #46313]
+
+4794.	[func]		"dnssec-checkds -s" specifies a file from which
+			to read a DS set rather than querying the parent.
+			[RT #44667]
+
+4793.	[bug]		nsupdate -[46] could overflow the array of server
+			addresses. [RT #46402]
+
+4792.	[bug]		Fix map file header correctness check. [RT #38418]
+
+4791.	[doc]		Fixed outdated documentation about export libraries.
+			[RT #46341]
+
+4790.	[bug]		nsupdate could trigger a require when sending a
+			update to the second address of the server.
+			[RT #45731]
+
 4789.	[cleanup]	Check writability of new-zones-directory. [RT #46308]

 4788.	[cleanup]	When using "update-policy local", log a warning
@@ -13,10 +146,8 @@
 			[RT #46340]

 4785.	[func]		The hmac-md5 algorithm is no longer recommended for
-			use with RNDC keys. For compatibility reasons, it
-			it is still the default algorithm in rndc-confgen,
-			but this will be changed to hmac-sha256 in a future
-			release. [RT #42272]
+			use with RNDC keys.  The default in rndc-confgen
+			is now hmac-sha256. [RT #42272]

 4784.	[func]		The use of dnssec-keygen to generate HMAC keys is
 			deprecated in favor of tsig-keygen.  dnssec-keygen
@@ -165,7 +296,7 @@
 			- Removed DLV key from bind.keys
 			- No longer use ISC DLV by default in delv
 			- "dnssec-lookaside auto" and configuration of
-			  "dnssec-lookaide" with dlv.isc.org as trust
+			  "dnssec-lookaide" with dlv.isc.org as the trust
 			  anchor are both now fatal errors.
 			[RT #46155]

@@ -305,8 +436,8 @@
 4713.	[func]		Added support for the DNS Response Policy Service
 			(DNSRPS) API, which allows named to use an external
 			response policy daemon when built with
-			"configure --enable-dnsrps".  Thanks to Vernon
-			Schryver and Farsight Security. [RT #43376]
+			"configure --enable-dnsrps". Thanks to Farsight
+			Security. [RT #43376]

 4712.	[bug]		"dig +domain" and "dig +search" didn't retain the
 			search domain when retrying with TCP. [RT #45547]
@@ -22,4 +22,9 @@ Setting                   Description
                          Increase the maximum number of configurable
 -DNS_RPZ_MAX_ZONES=64     response policy zones from 32 to 64; this is the
                          highest possible setting
+                          Disable the use of inline functions to implement
+-DISC_BUFFER_USEINLINE=0  the isc_buffer API: this reduces performance but
+                          may be useful when debugging
+-DISC_HEAP_CHECK          Test heap consistency after every heap
+                          operation; used when debugging

@@ -21,3 +21,5 @@ Some of these settings are:
 |`-DCHECK_LOCAL=0`|Don't check out-of-zone addresses in `named-checkzone`|
 |`-DNS_RUN_PID_DIR=0`|Create default PID files in `${localstatedir}/run` rather than `${localstatedir}/run/named/`|
 |`-DNS_RPZ_MAX_ZONES=64`|Increase the maximum number of configurable response policy zones from 32 to 64; this is the highest possible setting|
+|`-DISC_BUFFER_USEINLINE=0`|Disable the use of inline functions to implement the `isc_buffer` API: this reduces performance but may be useful when debugging |
+|`-DISC_HEAP_CHECK`|Test heap consistency after every heap operation; used when debugging|
@@ -117,7 +117,11 @@ include:
  * 'named-checkconf -l' lists zones found in named.conf.
  * Added support for the EDNS Padding and Keepalive options.
  * 'new-zones-directory' option sets the location where the configuration
-    data for zones added by rndc addzone is stored
+    data for zones added by rndc addzone is stored.
+  * The default key algorithm in rndc-confgen is now hmac-sha256.
+  * filter-aaaa-on-v4 and filter-aaaa-on-v6 options are now available by
+    default without a configure option.
+  * The obsolete isc-hmac-fixup command has been removed.

 Building BIND

@@ -127,8 +131,8 @@ on many versions of Linux and UNIX, including RedHat, Fedora, Debian,
 Ubuntu, SuSE, Slackware, FreeBSD, NetBSD, OpenBSD, Mac OS X, Solaris,
 HP-UX, AIX, SCO OpenServer, and OpenWRT.

-BIND is also available for Windows XP, 2003, 2008, and higher. See
-win32utils/readme1st.txt for details on building for Windows systems.
+BIND is also available for Windows 2008 and higher. See win32utils/
+readme1st.txt for details on building for Windows systems.

 To build on a UNIX or Linux system, use:

@@ -129,7 +129,11 @@ include:
 * `'named-checkconf -l'` lists zones found in `named.conf`.
 * Added support for the EDNS Padding and Keepalive options.
 * 'new-zones-directory' option sets the location where the configuration
-  data for zones added by rndc addzone is stored
+  data for zones added by rndc addzone is stored.
+* The default key algorithm in `rndc-confgen` is now hmac-sha256.
+* `filter-aaaa-on-v4` and `filter-aaaa-on-v6` options are now available
+  by default without a configure option.
+* The obsolete `isc-hmac-fixup` command has been removed.

 ### <a name="build"/> Building BIND

@@ -139,8 +143,9 @@ many versions of Linux and UNIX, including RedHat, Fedora, Debian, Ubuntu,
 SuSE, Slackware, FreeBSD, NetBSD, OpenBSD, Mac OS X, Solaris, HP-UX, AIX,
 SCO OpenServer, and OpenWRT. 

-BIND is also available for Windows XP, 2003, 2008, and higher.  See
-`win32utils/readme1st.txt` for details on building for Windows systems.
+BIND is also available for Windows 2008 and higher.  See
+`win32utils/readme1st.txt` for details on building for Windows
+systems.

 To build on a UNIX or Linux system, use:

@@ -8,6 +8,10 @@ srcdir =	@srcdir@
 VPATH =		@srcdir@
 top_srcdir =	@top_srcdir@

+# Attempt to disable parallel processing.
+.NOTPARALLEL:
+.NO_PARALLEL:
+
 VERSION=@BIND9_VERSION@

@BIND9_MAKE_INCLUDES@
@@ -64,11 +68,11 @@ rndc-confgen.@O@: rndc-confgen.c
 ddns-confgen.@O@: ddns-confgen.c
 	${LIBTOOL_MODE_COMPILE} ${CC} ${ALL_CFLAGS} -c ${srcdir}/ddns-confgen.c

-rndc-confgen@EXEEXT@: rndc-confgen.@O@ util.@O@ keygen.@O@ ${UOBJS} ${CONFDEPLIBS}
+rndc-confgen@EXEEXT@: rndc-confgen.@O@ util.@O@ keygen.@O@ ${CONFDEPLIBS}
 	export BASEOBJS="rndc-confgen.@O@ util.@O@ keygen.@O@ ${UOBJS}"; \
 	${FINALBUILDCMD}

-ddns-confgen@EXEEXT@: ddns-confgen.@O@ util.@O@ keygen.@O@ ${UOBJS} ${CONFDEPLIBS}
+ddns-confgen@EXEEXT@: ddns-confgen.@O@ util.@O@ keygen.@O@ ${CONFDEPLIBS}
 	export BASEOBJS="ddns-confgen.@O@ util.@O@ keygen.@O@ ${UOBJS}"; \
 	${FINALBUILDCMD}

@@ -111,9 +111,7 @@ as directed\&.
 .PP
 \-A \fIalgorithm\fR
 .RS 4
-Specifies the algorithm to use for the TSIG key\&. Available choices are: hmac\-md5, hmac\-sha1, hmac\-sha224, hmac\-sha256, hmac\-sha384 and hmac\-sha512\&. The default is hmac\-md5, or if MD5 was disabled at compile time, hmac\-sha256\&.
-.sp
-Note: Use of hmac\-md5 is no longer recommended, and the default value will be changed to hmac\-sha256 in a future release\&.
+Specifies the algorithm to use for the TSIG key\&. Available choices are: hmac\-md5, hmac\-sha1, hmac\-sha224, hmac\-sha256, hmac\-sha384 and hmac\-sha512\&. The default is hmac\-sha256\&.
 .RE
 .PP
 \-b \fIkeysize\fR
@@ -6,8 +6,6 @@
 * file, You can obtain one at http://mozilla.org/MPL/2.0/.
 */

-/* $Id: rndc-confgen.c,v 1.7 2011/03/12 04:59:46 tbox Exp $ */
-
 /*! \file */

 /**
@@ -67,23 +65,6 @@ usage(int status) ISC_PLATFORM_NORETURN_POST;
 static void
 usage(int status) {

-#ifndef PK11_MD5_DISABLE
-	fprintf(stderr, "\
-Usage:\n\
- %s [-a] [-b bits] [-c keyfile] [-k keyname] [-p port] [-r randomfile] \
-[-s addr] [-t chrootdir] [-u user]\n\
-  -a:		 generate just the key clause and write it to keyfile (%s)\n\
-  -A alg:	 algorithm (default hmac-md5 (deprecated and will change))\n\
-  -b bits:	 from 1 through 512, default 256; total length of the secret\n\
-  -c keyfile:	 specify an alternate key file (requires -a)\n\
-  -k keyname:	 the name as it will be used  in named.conf and rndc.conf\n\
-  -p port:	 the port named will listen on and rndc will connect to\n\
-  -r randomfile: source of random data (use \"keyboard\" for key timing)\n\
-  -s addr:	 the address to which rndc should connect\n\
-  -t chrootdir:	 write a keyfile in chrootdir as well (requires -a)\n\
-  -u user:	 set the keyfile owner to \"user\" (requires -a)\n",
-		 progname, keydef);
-#else
 	fprintf(stderr, "\
 Usage:\n\
 %s [-a] [-b bits] [-c keyfile] [-k keyname] [-p port] [-r randomfile] \
@@ -99,7 +80,6 @@ Usage:\n\
  -t chrootdir:	 write a keyfile in chrootdir as well (requires -a)\n\
  -u user:	 set the keyfile owner to \"user\" (requires -a)\n",
 		 progname, keydef);
-#endif

 	exit (status);
 }
@@ -115,7 +95,6 @@ main(int argc, char **argv) {
 	const char *randomfile = NULL;
 	const char *serveraddr = NULL;
 	dns_secalg_t alg;
-	isc_boolean_t algset = ISC_FALSE;
 	const char *algname;
 	char *p;
 	int ch;
@@ -136,11 +115,7 @@ main(int argc, char **argv) {
 	progname = program;

 	keyname = DEFAULT_KEYNAME;
-#ifndef PK11_MD5_DISABLE
-	alg = DST_ALG_HMACMD5;
-#else
 	alg = DST_ALG_HMACSHA256;
-#endif
 	serveraddr = DEFAULT_SERVER;
 	port = DEFAULT_PORT;

@@ -154,7 +129,6 @@ main(int argc, char **argv) {
 			keyonly = ISC_TRUE;
 			break;
 		case 'A':
-			algset = ISC_TRUE;
 			algname = isc_commandline_argument;
 			alg = alg_fromtext(algname);
 			if (alg == DST_ALG_UNKNOWN)
@@ -228,17 +202,9 @@ main(int argc, char **argv) {
 		usage(1);

 	if (alg == DST_ALG_HMACMD5) {
-		if (algset) {
-			fprintf(stderr,
-				"warning: use of hmac-md5 for RNDC keys "
-				"is deprecated; hmac-sha256 is now "
-				"recommended.\n");
-		} else {
-			fprintf(stderr,
-				"warning: the default algorithm hmac-md5 "
-				"is deprecated and will be\n"
-				"changed to hmac-sha256 in a future release\n");
-		}
+		fprintf(stderr,
+			"warning: use of hmac-md5 for RNDC keys "
+			"is deprecated; hmac-sha256 is now recommended.\n");
 	}

 	if (keysize < 0)
@@ -129,12 +129,7 @@
          <para>
            Specifies the algorithm to use for the TSIG key.  Available
            choices are: hmac-md5, hmac-sha1, hmac-sha224, hmac-sha256,
-            hmac-sha384 and hmac-sha512.  The default is hmac-md5, or
-            if MD5 was disabled at compile time, hmac-sha256.
-          </para>
-          <para>
-            Note: Use of hmac-md5 is no longer recommended, and the default
-            value will be changed to hmac-sha256 in a future release.
+            hmac-sha384 and hmac-sha512.  The default is hmac-sha256.
          </para>
        </listitem>
      </varlistentry>
@@ -113,12 +113,7 @@
          <p>
            Specifies the algorithm to use for the TSIG key.  Available
            choices are: hmac-md5, hmac-sha1, hmac-sha224, hmac-sha256,
-            hmac-sha384 and hmac-sha512.  The default is hmac-md5, or
-            if MD5 was disabled at compile time, hmac-sha256.
-          </p>
-          <p>
-            Note: Use of hmac-md5 is no longer recommended, and the default
-            value will be changed to hmac-sha256 in a future release.
+            hmac-sha384 and hmac-sha512.  The default is hmac-sha256.
          </p>
        </dd>
 <dt><span class="term">-b <em class="replaceable"><code>keysize</code></em></span></dt>
@@ -469,6 +469,11 @@ Convert [do not convert] puny code on output\&. This requires IDN SUPPORT to hav
 Ignore truncation in UDP responses instead of retrying with TCP\&. By default, TCP retries are performed\&.
 .RE
 .PP
+\fB+[no]keepalive\fR
+.RS 4
+Send [or do not send] an EDNS Keepalive option\&.
+.RE
+.PP
 \fB+[no]keepopen\fR
 .RS 4
 Keep the TCP socket open between queries and reuse it rather than creating a new TCP socket for each lookup\&. The default is
@@ -109,6 +109,11 @@ print_usage(FILE *fp) {
 "            [ host [@local-server] {local-d-opt} [...]]\n", fp);
 }

+#if TARGET_OS_IPHONE
+static void usage(void) {
+	fprintf(stderr, "Press <Help> for complete list of options\n");
+}
+#else
 ISC_PLATFORM_NORETURN_PRE static void
 usage(void) ISC_PLATFORM_NORETURN_POST;

@@ -119,6 +124,7 @@ usage(void) {
 	      "for complete list of options\n", stderr);
 	exit(1);
 }
+#endif

 /*% version */
 static void
@@ -414,14 +420,8 @@ isdotlocal(dns_message_t *msg) {
 	isc_result_t result;
 	static unsigned char local_ndata[] = { "\005local\0" };
 	static unsigned char local_offsets[] = { 0, 6 };
-	static dns_name_t local = {
-		DNS_NAME_MAGIC,
-		local_ndata, 7, 2,
-		DNS_NAMEATTR_READONLY | DNS_NAMEATTR_ABSOLUTE,
-		local_offsets, NULL,
-		{(void *)-1, (void *)-1},
-		{NULL, NULL}
-	};
+	static dns_name_t local =
+		DNS_NAME_INITABSOLUTE(local_ndata, local_offsets);

 	for (result = dns_message_firstname(msg, DNS_SECTION_QUESTION);
 	     result == ISC_R_SUCCESS;
@@ -824,8 +824,10 @@ plus_option(const char *option, isc_boolean_t is_batchfile,
 				goto invalid_option;
 			result = parse_uint(&num, value, COMMSIZE,
 					    "buffer size");
-			if (result != ISC_R_SUCCESS)
-				fatal("Couldn't parse buffer size");
+			if (result != ISC_R_SUCCESS) {
+				warn("Couldn't parse buffer size");
+				goto exit_or_usage;
+			}
 			lookup->udpsize = num;
 			break;
 		default:
@@ -870,8 +872,10 @@ plus_option(const char *option, isc_boolean_t is_batchfile,
 				if (value != NULL) {
 					n = strlcpy(hexcookie, value,
 						    sizeof(hexcookie));
-					if (n >= sizeof(hexcookie))
-						fatal("COOKIE data too large");
+					if (n >= sizeof(hexcookie)) {
+						warn("COOKIE data too large");
+						goto exit_or_usage;
+					}
 					lookup->cookie = hexcookie;
 				} else
 					lookup->cookie = NULL;
@@ -922,8 +926,10 @@ plus_option(const char *option, isc_boolean_t is_batchfile,
 			if (value == NULL)
 				goto need_value;
 			result = parse_uint(&num, value, 0x3f, "DSCP");
-			if (result != ISC_R_SUCCESS)
-				fatal("Couldn't parse DSCP value");
+			if (result != ISC_R_SUCCESS) {
+				warn("Couldn't parse DSCP value");
+				goto exit_or_usage;
+			}
 			lookup->dscp = num;
 			break;
 		default:
@@ -952,9 +958,11 @@ plus_option(const char *option, isc_boolean_t is_batchfile,
 								    value,
 								    255,
 								    "edns");
-						if (result != ISC_R_SUCCESS)
-							fatal("Couldn't parse "
+						if (result != ISC_R_SUCCESS) {
+							warn("Couldn't parse "
 							      "edns");
+							goto exit_or_usage;
+						}
 						lookup->edns = num;
 						break;
 					case 'f':
@@ -971,9 +979,11 @@ plus_option(const char *option, isc_boolean_t is_batchfile,
 								    value,
 								    0xffff,
 								  "ednsflags");
-						if (result != ISC_R_SUCCESS)
-							fatal("Couldn't parse "
+						if (result != ISC_R_SUCCESS) {
+							warn("Couldn't parse "
 							      "ednsflags");
+							goto exit_or_usage;
+						}
 						lookup->ednsflags = num;
 						break;
 					case 'n':
@@ -986,10 +996,12 @@ plus_option(const char *option, isc_boolean_t is_batchfile,
 							lookup->ednsoptscnt = 0;
 							break;
 						}
-						if (value == NULL)
-							fatal("ednsopt no "
-							      "code point "
-							      "specified");
+						if (value == NULL) {
+							warn("ednsopt no "
+							     "code point "
+							     "specified");
+							goto exit_or_usage;
+						}
 						code = next_token(&value, ":");
 						save_opt(lookup, code, value);
 						break;
@@ -1104,8 +1116,10 @@ plus_option(const char *option, isc_boolean_t is_batchfile,
 			if (!state)
 				goto invalid_option;
 			result = parse_uint(&num, value, MAXNDOTS, "ndots");
-			if (result != ISC_R_SUCCESS)
-				fatal("Couldn't parse ndots");
+			if (result != ISC_R_SUCCESS) {
+				warn("Couldn't parse ndots");
+				goto exit_or_usage;
+			}
 			ndots = num;
 			break;
 		case 's':
@@ -1167,8 +1181,10 @@ plus_option(const char *option, isc_boolean_t is_batchfile,
 				break;
 			}
 			result = parse_uint(&num, value, 15, "opcode");
-			if (result != ISC_R_SUCCESS)
-				fatal("Couldn't parse opcode");
+			if (result != ISC_R_SUCCESS) {
+				warn("Couldn't parse opcode");
+				goto exit_or_usage;
+			}
 			lookup->opcode = (dns_opcode_t)num;
 			break;
 		default:
@@ -1182,8 +1198,10 @@ plus_option(const char *option, isc_boolean_t is_batchfile,
 		if (value == NULL)
 			goto need_value;
 		result = parse_uint(&num, value, 512, "padding");
-		if (result != ISC_R_SUCCESS)
-			fatal("Couldn't parse padding");
+		if (result != ISC_R_SUCCESS) {
+			warn("Couldn't parse padding");
+			goto exit_or_usage;
+		}
 		lookup->padding = (isc_uint16_t)num;
 		break;
 	case 'q':
@@ -1222,8 +1240,10 @@ plus_option(const char *option, isc_boolean_t is_batchfile,
 					goto invalid_option;
 				result = parse_uint(&lookup->retries, value,
 						    MAXTRIES - 1, "retries");
-				if (result != ISC_R_SUCCESS)
-					fatal("Couldn't parse retries");
+				if (result != ISC_R_SUCCESS) {
+					warn("Couldn't parse retries");
+					goto exit_or_usage;
+				}
 				lookup->retries++;
 				break;
 			default:
@@ -1306,8 +1326,10 @@ plus_option(const char *option, isc_boolean_t is_batchfile,
 			 */
 			if (splitwidth)
 				splitwidth += 3;
-			if (result != ISC_R_SUCCESS)
-				fatal("Couldn't parse split");
+			if (result != ISC_R_SUCCESS) {
+				warn("Couldn't parse split");
+				goto exit_or_usage;
+			}
 			break;
 		case 't': /* stats */
 			FULLCHECK("stats");
@@ -1331,8 +1353,10 @@ plus_option(const char *option, isc_boolean_t is_batchfile,
 				lookup->ecs_addr = NULL;
 			}
 			result = parse_netprefix(&lookup->ecs_addr, value);
-			if (result != ISC_R_SUCCESS)
-				fatal("Couldn't parse client");
+			if (result != ISC_R_SUCCESS) {
+				warn("Couldn't parse client");
+				goto exit_or_usage;
+			}
 			break;
 		default:
 			goto invalid_option;
@@ -1355,8 +1379,10 @@ plus_option(const char *option, isc_boolean_t is_batchfile,
 				goto invalid_option;
 			result = parse_uint(&timeout, value, MAXTIMEOUT,
 					    "timeout");
-			if (result != ISC_R_SUCCESS)
-				fatal("Couldn't parse timeout");
+			if (result != ISC_R_SUCCESS) {
+				warn("Couldn't parse timeout");
+				goto exit_or_usage;
+			}
 			if (timeout == 0)
 				timeout = 1;
 			break;
@@ -1392,8 +1418,10 @@ plus_option(const char *option, isc_boolean_t is_batchfile,
 					goto invalid_option;
 				result = parse_uint(&lookup->retries, value,
 						    MAXTRIES, "tries");
-				if (result != ISC_R_SUCCESS)
-					fatal("Couldn't parse tries");
+				if (result != ISC_R_SUCCESS) {
+					warn("Couldn't parse tries");
+					goto exit_or_usage;
+				}
 				if (lookup->retries == 0)
 					lookup->retries = 1;
 				break;
@@ -1450,11 +1478,19 @@ plus_option(const char *option, isc_boolean_t is_batchfile,
 	default:
 	invalid_option:
 	need_value:
+#if TARGET_OS_IPHONE
+	exit_or_usage:
+#endif
 		fprintf(stderr, "Invalid option: +%s\n",
 			option);
 		usage();
 	}
 	return;
+
+#if ! TARGET_OS_IPHONE
+ exit_or_usage:
+	digexit();
+#endif
 }

 /*%
@@ -784,6 +784,15 @@
 	  </listitem>
 	</varlistentry>

+	<varlistentry>
+	  <term><option>+[no]keepalive</option></term>
+	  <listitem>
+	    <para>
+	      Send [or do not send] an EDNS Keepalive option.
+	    </para>
+	  </listitem>
+	</varlistentry>
+
 	<varlistentry>
 	  <term><option>+[no]keepopen</option></term>
 	  <listitem>
@@ -628,6 +628,12 @@
 	      with TCP.  By default, TCP retries are performed.
 	    </p>
 	  </dd>
+<dt><span class="term"><code class="option">+[no]keepalive</code></span></dt>
+<dd>
+	    <p>
+	      Send [or do not send] an EDNS Keepalive option.
+	    </p>
+	  </dd>
 <dt><span class="term"><code class="option">+[no]keepopen</code></span></dt>
 <dd>
 	    <p>
@@ -375,6 +375,46 @@ get_reverse(char *reverse, size_t len, char *value, isc_boolean_t ip6_int,
 	}
 }

+void (*dighost_pre_exit_hook)(void) = NULL;
+
+#if TARGET_OS_IPHONE
+void
+warn(const char *format, ...) {
+	va_list args;
+
+	fflush(stdout);
+	fprintf(stderr, ";; Warning: ");
+	va_start(args, format);
+	vfprintf(stderr, format, args);
+	va_end(args);
+	fprintf(stderr, "\n");
+}
+#else
+void
+warn(const char *format, ...) {
+	va_list args;
+
+	fflush(stdout);
+	fprintf(stderr, "%s: ", progname);
+	va_start(args, format);
+	vfprintf(stderr, format, args);
+	va_end(args);
+	fprintf(stderr, "\n");
+}
+#endif
+
+void
+digexit(void) {
+	if (exitcode < 10)
+		exitcode = 10;
+	if (fatalexit != 0)
+		exitcode = fatalexit;
+	if (dighost_pre_exit_hook != NULL) {
+		dighost_pre_exit_hook();
+	}
+	exit(exitcode);
+}
+
 void
 fatal(const char *format, ...) {
 	va_list args;
@@ -385,11 +425,7 @@ fatal(const char *format, ...) {
 	vfprintf(stderr, format, args);
 	va_end(args);
 	fprintf(stderr, "\n");
-	if (exitcode < 10)
-		exitcode = 10;
-	if (fatalexit != 0)
-		exitcode = fatalexit;
-	exit(exitcode);
+	digexit();
 }

 void
@@ -655,6 +691,41 @@ make_empty_lookup(void) {
 	return (looknew);
 }

+#define EDNSOPT_OPTIONS 100U
+
+static void
+cloneopts(dig_lookup_t *looknew, dig_lookup_t *lookold) {
+	size_t len = sizeof(looknew->ednsopts[0]) * EDNSOPT_OPTIONS;
+	size_t i;
+	looknew->ednsopts = isc_mem_allocate(mctx, len);
+	if (looknew->ednsopts == NULL)
+		fatal("out of memory");
+	for (i = 0; i < EDNSOPT_OPTIONS; i++) {
+		looknew->ednsopts[i].code = 0;
+		looknew->ednsopts[i].length = 0;
+		looknew->ednsopts[i].value = NULL;
+	}
+	looknew->ednsoptscnt = 0;
+	if (lookold == NULL || lookold->ednsopts == NULL)
+		return;
+
+	for (i = 0; i < lookold->ednsoptscnt; i++) {
+		len = lookold->ednsopts[i].length;
+		if (len != 0) {
+			INSIST(lookold->ednsopts[i].value != NULL);
+			looknew->ednsopts[i].value =
+				 isc_mem_allocate(mctx, len);
+			if (looknew->ednsopts[i].value == NULL)
+				fatal("out of memory");
+			memmove(looknew->ednsopts[i].value,
+				lookold->ednsopts[i].value, len);
+		}
+		looknew->ednsopts[i].code = lookold->ednsopts[i].code;
+		looknew->ednsopts[i].length = len;
+	}
+	looknew->ednsoptscnt = lookold->ednsoptscnt;
+}
+
 /*%
 * Clone a lookup, perhaps copying the server list.  This does not clone
 * the query list, since it will be regenerated by the setup_lookup()
@@ -700,8 +771,12 @@ clone_lookup(dig_lookup_t *lookold, isc_boolean_t servers) {
 	looknew->seenbadcookie = lookold->seenbadcookie;
 	looknew->badcookie = lookold->badcookie;
 	looknew->cookie = lookold->cookie;
-	looknew->ednsopts = lookold->ednsopts;
-	looknew->ednsoptscnt = lookold->ednsoptscnt;
+	if (lookold->ednsopts != NULL) {
+		cloneopts(looknew, lookold);
+	} else {
+		looknew->ednsopts = NULL;
+		looknew->ednsoptscnt = 0;
+	}
 	looknew->ednsneg = lookold->ednsneg;
 	looknew->padding = lookold->padding;
 	looknew->mapped = lookold->mapped;
@@ -1317,13 +1392,6 @@ setup_libs(void) {
 	check_result(result, "isc_mutex_init");
 }

-/*
- * Array of up to 100 options configured by +ednsopt
- */
-#define EDNSOPT_OPTIONS 100U
-static dns_ednsopt_t ednsopts[EDNSOPT_OPTIONS];
-static unsigned char ednsoptscnt = 0;
-
 typedef struct dig_ednsoptname {
 	isc_uint32_t code;
 	const char  *name;
@@ -1350,12 +1418,12 @@ dig_ednsoptname_t optnames[] = {
 void
 save_opt(dig_lookup_t *lookup, char *code, char *value) {
 	isc_result_t result;
-	isc_uint32_t num;
+	isc_uint32_t num = 0;
 	isc_buffer_t b;
 	isc_boolean_t found = ISC_FALSE;
 	unsigned int i;

-	if (ednsoptscnt == EDNSOPT_OPTIONS)
+	if (lookup->ednsoptscnt >= EDNSOPT_OPTIONS)
 		fatal("too many ednsopts");

 	for (i = 0; i < N_EDNS_OPTNAMES; i++) {
@@ -1372,9 +1440,16 @@ save_opt(dig_lookup_t *lookup, char *code, char *value) {
 			fatal("bad edns code point: %s", code);
 	}

-	ednsopts[ednsoptscnt].code = num;
-	ednsopts[ednsoptscnt].length = 0;
-	ednsopts[ednsoptscnt].value = NULL;
+	if (lookup->ednsopts == NULL) {
+		cloneopts(lookup, NULL);
+	}
+
+	if (lookup->ednsopts[lookup->ednsoptscnt].value != NULL)
+		isc_mem_free(mctx, lookup->ednsopts[lookup->ednsoptscnt].value);
+
+	lookup->ednsopts[lookup->ednsoptscnt].code = num;
+	lookup->ednsopts[lookup->ednsoptscnt].length = 0;
+	lookup->ednsopts[lookup->ednsoptscnt].value = NULL;

 	if (value != NULL) {
 		char *buf;
@@ -1384,14 +1459,13 @@ save_opt(dig_lookup_t *lookup, char *code, char *value) {
 		isc_buffer_init(&b, buf, (unsigned int) strlen(value)/2 + 1);
 		result = isc_hex_decodestring(value, &b);
 		check_result(result, "isc_hex_decodestring");
-		ednsopts[ednsoptscnt].value = isc_buffer_base(&b);
-		ednsopts[ednsoptscnt].length = isc_buffer_usedlength(&b);
+		lookup->ednsopts[lookup->ednsoptscnt].value =
+						 isc_buffer_base(&b);
+		lookup->ednsopts[lookup->ednsoptscnt].length =
+						 isc_buffer_usedlength(&b);
 	}

-	if (lookup->ednsoptscnt == 0)
-		lookup->ednsopts = &ednsopts[ednsoptscnt];
 	lookup->ednsoptscnt++;
-	ednsoptscnt++;
 }

 /*%
@@ -1570,6 +1644,15 @@ destroy_lookup(dig_lookup_t *lookup) {
 	if (lookup->ecs_addr != NULL)
 		isc_mem_free(mctx, lookup->ecs_addr);

+	if (lookup->ednsopts != NULL) {
+		size_t i;
+		for (i = 0; i < EDNSOPT_OPTIONS; i++) {
+			if (lookup->ednsopts[i].value != NULL)
+				isc_mem_free(mctx, lookup->ednsopts[i].value);
+		}
+		isc_mem_free(mctx, lookup->ednsopts);
+	}
+
 	isc_mem_free(mctx, lookup);
 }

@@ -2114,9 +2197,13 @@ setup_lookup(dig_lookup_t *lookup) {
 		if (result != ISC_R_SUCCESS) {
 			dns_message_puttempname(lookup->sendmsg,
 						&lookup->name);
-			fatal("'%s' is not a legal name "
+			warn("'%s' is not a legal name "
 			      "(%s)", lookup->textname,
 			      isc_result_totext(result));
+#if TARGET_OS_IPHONE
+			check_next_lookup(current_lookup);
+			return (ISC_FALSE);
+#endif
 		}
 	}
 	dns_name_format(lookup->name, store, sizeof(store));
@@ -4127,12 +4214,6 @@ destroy_libs(void) {
 	debug("Removing log context");
 	isc_log_destroy(&lctx);

-	while (ednsoptscnt > 0U) {
-		ednsoptscnt--;
-		if (ednsopts[ednsoptscnt].value != NULL)
-			isc_mem_free(mctx, ednsopts[ednsoptscnt].value);
-	}
-
 	debug("Destroy memory");
 	if (memdebugging != 0)
 		isc_mem_stats(mctx, stderr);
@@ -26,6 +26,10 @@
 #include <isc/sockaddr.h>
 #include <isc/socket.h>

+#ifdef __APPLE__
+#include <TargetConditionals.h>
+#endif
+
 #define MXSERV 20
 #define MXNAME (DNS_NAME_MAXTEXT+1)
 #define MXRD 32
@@ -282,6 +286,13 @@ ISC_PLATFORM_NORETURN_PRE void
 fatal(const char *format, ...)
 ISC_FORMAT_PRINTF(1, 2) ISC_PLATFORM_NORETURN_POST;

+void
+warn(const char *format, ...) ISC_FORMAT_PRINTF(1, 2);
+
+ISC_PLATFORM_NORETURN_PRE void
+digexit(void)
+ISC_PLATFORM_NORETURN_POST;
+
 void
 debug(const char *format, ...) ISC_FORMAT_PRINTF(1, 2);

@@ -384,6 +395,9 @@ extern void
 extern void
 (*dighost_shutdown)(void);

+extern void
+(*dighost_pre_exit_hook)(void);
+
 void save_opt(dig_lookup_t *lookup, char *code, char *value);

 void setup_file_key(void);
@@ -62,11 +62,11 @@ may be preferable to direct use of
 .RS 4
 Selects the cryptographic algorithm\&. For DNSSEC keys, the value of
 \fBalgorithm\fR
-must be one of RSAMD5, RSASHA1, DSA, NSEC3RSASHA1, NSEC3DSA, RSASHA256, RSASHA512, ECCGOST, ECDSAP256SHA256, ECDSAP384SHA384, ED25519 or ED448\&. For TKEY and SIG(0) keys, the value must be DH (Diffie Hellman); specifying this value will automatically set the
+must be one of RSAMD5, RSASHA1, DSA, NSEC3RSASHA1, NSEC3DSA, RSASHA256, RSASHA512, ECCGOST, ECDSAP256SHA256, ECDSAP384SHA384, ED25519 or ED448\&. For TKEY, the value must be DH (Diffie Hellman); specifying his value will automatically set the
 \fB\-T KEY\fR
 option as well\&.
 .sp
-TSIG keys can also by generated by setting the value to one of HMAC\-MD5, HMAC\-SHA1, HMAC\-SHA224, HMAC\-SHA256, HMAC\-SHA384, or HMAC\-SHA512\&. As with DH, specifying these values will automatically set
+TSIG keys can also be generated by setting the value to one of HMAC\-MD5, HMAC\-SHA1, HMAC\-SHA224, HMAC\-SHA256, HMAC\-SHA384, or HMAC\-SHA512\&. As with DH, specifying these values will automatically set
 \fB\-T KEY\fR\&. Note, however, that
 \fBtsig\-keygen\fR
 produces TSIG keys in a more useful format\&. These algorithms have been deprecated in
@@ -122,12 +122,12 @@
 	    of <option>algorithm</option> must be one of RSAMD5, RSASHA1,
 	    DSA, NSEC3RSASHA1, NSEC3DSA, RSASHA256, RSASHA512, ECCGOST,
 	    ECDSAP256SHA256, ECDSAP384SHA384, ED25519 or ED448.  For
-	    TKEY and SIG(0) keys, the value must be DH (Diffie Hellman);
-	    specifying this value will automatically set the
-	    <option>-T KEY</option> option as well.
+	    TKEY, the value must be DH (Diffie Hellman); specifying
+	    his value will automatically set the <option>-T KEY</option>
+	    option as well.
 	  </para>
 	  <para>
-	    TSIG keys can also by generated by setting the value to
+	    TSIG keys can also be generated by setting the value to
 	    one of HMAC-MD5, HMAC-SHA1, HMAC-SHA224, HMAC-SHA256,
 	    HMAC-SHA384, or HMAC-SHA512.  As with DH, specifying these
 	    values will automatically set <option>-T KEY</option>. Note,
@@ -103,12 +103,12 @@
 	    of <code class="option">algorithm</code> must be one of RSAMD5, RSASHA1,
 	    DSA, NSEC3RSASHA1, NSEC3DSA, RSASHA256, RSASHA512, ECCGOST,
 	    ECDSAP256SHA256, ECDSAP384SHA384, ED25519 or ED448.  For
-	    TKEY and SIG(0) keys, the value must be DH (Diffie Hellman);
-	    specifying this value will automatically set the
-	    <code class="option">-T KEY</code> option as well.
+	    TKEY, the value must be DH (Diffie Hellman); specifying
+	    his value will automatically set the <code class="option">-T KEY</code>
+	    option as well.
 	  </p>
 	  <p>
-	    TSIG keys can also by generated by setting the value to
+	    TSIG keys can also be generated by setting the value to
 	    one of HMAC-MD5, HMAC-SHA1, HMAC-SHA224, HMAC-SHA256,
 	    HMAC-SHA384, or HMAC-SHA512.  As with DH, specifying these
 	    values will automatically set <code class="option">-T KEY</code>. Note,
@@ -8,6 +8,10 @@ srcdir =	@srcdir@
 VPATH =		@srcdir@
 top_srcdir =	@top_srcdir@

+# Attempt to disable parallel processing.
+.NOTPARALLEL:
+.NO_PARALLEL:
+
 VERSION=@BIND9_VERSION@

@BIND9_PRODUCT@
@@ -130,7 +134,7 @@ server.@O@: server.c
 		-DPRODUCT=\"${PRODUCT}\" \
 		-DVERSION=\"${VERSION}\" -c ${srcdir}/server.c

-named@EXEEXT@: ${OBJS} ${UOBJS} ${DEPLIBS}
+named@EXEEXT@: ${OBJS} ${DEPLIBS}
 	export MAKE_SYMTABLE="yes"; \
 	export BASEOBJS="${OBJS} ${UOBJS}"; \
 	${FINALBUILDCMD}
@@ -9,7 +9,7 @@

 <xsl:stylesheet xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns="http://www.w3.org/1999/xhtml" version="1.0">
  <xsl:output method="html" indent="yes" version="4.0"/>
-  <xsl:template match="statistics[@version=&quot;3.10&quot;]">
+  <xsl:template match="statistics[@version=&quot;3.11&quot;]">
    <html>
      <head>
        <xsl:if test="system-property('xsl:vendor')!='Transformiix'">
@@ -14,7 +14,7 @@ static char xslmsg[] =
 	"\n"
 	"<xsl:stylesheet xmlns:xsl=\"http://www.w3.org/1999/XSL/Transform\" xmlns=\"http://www.w3.org/1999/xhtml\" version=\"1.0\">\n"
 	" <xsl:output method=\"html\" indent=\"yes\" version=\"4.0\"/>\n"
-	" <xsl:template match=\"statistics[@version=&quot;3.10&quot;]\">\n"
+	" <xsl:template match=\"statistics[@version=&quot;3.11&quot;]\">\n"
 	" <html>\n"
 	" <head>\n"
 	" <xsl:if test=\"system-property('xsl:vendor')!='Transformiix'\">\n"
@@ -456,9 +456,8 @@ control_recvmessage(isc_task_t *task, isc_event_t *event) {
 	 */
 	if (conn->nonce == 0) {
 		while (conn->nonce == 0) {
-			isc_uint16_t r1 = isc_rng_random(server->sctx->rngctx);
-			isc_uint16_t r2 = isc_rng_random(server->sctx->rngctx);
-			conn->nonce = (r1 << 16) | r2;
+			isc_rng_randombytes(server->sctx->rngctx, &conn->nonce,
+					    sizeof(conn->nonce));
 		}
 		eresult = ISC_R_SUCCESS;
 	} else
@@ -26,6 +26,8 @@
 int scmp_syscalls[] = {
 	SCMP_SYS(access),
 	SCMP_SYS(open),
+	SCMP_SYS(openat),
+	SCMP_SYS(lseek),
 	SCMP_SYS(clock_gettime),
 	SCMP_SYS(time),
 	SCMP_SYS(read),
@@ -54,6 +56,7 @@ int scmp_syscalls[] = {
 #ifdef HAVE_GETRANDOM
 	SCMP_SYS(getrandom),
 #endif
+	SCMP_SYS(rename),
 	SCMP_SYS(unlink),
 	SCMP_SYS(socket),
 	SCMP_SYS(sendto),
@@ -72,7 +75,6 @@ int scmp_syscalls[] = {
 	SCMP_SYS(getsockopt),
 	SCMP_SYS(getsockname),
 	SCMP_SYS(lstat),
-	SCMP_SYS(lseek),
 	SCMP_SYS(getgid),
 	SCMP_SYS(getegid),
 	SCMP_SYS(getuid),
@@ -83,9 +85,7 @@ int scmp_syscalls[] = {
 	SCMP_SYS(setuid),
 	SCMP_SYS(prctl),
 	SCMP_SYS(epoll_wait),
-	SCMP_SYS(openat),
 	SCMP_SYS(getdents),
-	SCMP_SYS(rename),
 	SCMP_SYS(utimes),
 	SCMP_SYS(dup),
 #endif
@@ -93,6 +93,8 @@ int scmp_syscalls[] = {
 const char *scmp_syscall_names[] = {
 	"access",
 	"open",
+	"openat",
+	"lseek",
 	"clock_gettime",
 	"time",
 	"read",
@@ -121,6 +123,7 @@ const char *scmp_syscall_names[] = {
 #ifdef HAVE_GETRANDOM
 	"getrandom",
 #endif
+	"rename",
 	"unlink",
 	"socket",
 	"sendto",
@@ -139,7 +142,6 @@ const char *scmp_syscall_names[] = {
 	"getsockopt",
 	"getsockname",
 	"lstat",
-	"lseek",
 	"getgid",
 	"getegid",
 	"getuid",
@@ -150,9 +152,7 @@ const char *scmp_syscall_names[] = {
 	"setuid",
 	"prctl",
 	"epoll_wait",
-	"openat",
 	"getdents",
-	"rename",
 	"utimes",
 	"dup",
 #endif
@@ -154,11 +154,7 @@
 #define EXCLBUFFERS 4096
 #endif /* TUNE_LARGE */

-#ifdef WIN32
-#define DIR_PERM_OK W_OK
-#else
-#define DIR_PERM_OK W_OK|X_OK
-#endif
+#define MAX_TCP_TIMEOUT 65535

 /*%
 * Check an operation for failure.  Assumes that the function
@@ -803,6 +799,11 @@ dstkey_fromconfig(const cfg_obj_t *vconfig, const cfg_obj_t *key,
 	return (result);
 }

+/*
+ * Load keys from configuration into key table. If 'keyname' is specified,
+ * only load keys matching that name. If 'managed' is true, load the key as
+ * an initializing key.
+ */
 static isc_result_t
 load_view_keys(const cfg_obj_t *keys, const cfg_obj_t *vconfig,
 	       dns_view_t *view, isc_boolean_t managed,
@@ -818,12 +819,14 @@ load_view_keys(const cfg_obj_t *keys, const cfg_obj_t *vconfig,

 	for (elt = cfg_list_first(keys);
 	     elt != NULL;
-	     elt = cfg_list_next(elt)) {
+	     elt = cfg_list_next(elt))
+	{
 		keylist = cfg_listelt_value(elt);

 		for (elt2 = cfg_list_first(keylist);
 		     elt2 != NULL;
-		     elt2 = cfg_list_next(elt2)) {
+		     elt2 = cfg_list_next(elt2))
+		{
 			key = cfg_listelt_value(elt2);
 			result = dstkey_fromconfig(vconfig, key, managed,
 						   &dstkey, mctx);
@@ -831,8 +834,9 @@ load_view_keys(const cfg_obj_t *keys, const cfg_obj_t *vconfig,
 				result = ISC_R_SUCCESS;
 				continue;
 			}
-			if (result != ISC_R_SUCCESS)
+			if (result != ISC_R_SUCCESS) {
 				goto cleanup;
+			}

 			/*
 			 * If keyname was specified, we only add that key.
@@ -844,17 +848,27 @@ load_view_keys(const cfg_obj_t *keys, const cfg_obj_t *vconfig,
 				continue;
 			}

-			CHECK(dns_keytable_add(secroots, managed, &dstkey));
+			/*
+			 * This key is taken from the configuration, so
+			 * if it's a managed key then it's an
+			 * initializing key; that's why 'managed'
+			 * is duplicated below.
+			 */
+			CHECK(dns_keytable_add2(secroots, managed,
+						managed, &dstkey));
 		}
 	}

 cleanup:
-	if (dstkey != NULL)
+	if (dstkey != NULL) {
 		dst_key_free(&dstkey);
-	if (secroots != NULL)
+	}
+	if (secroots != NULL) {
 		dns_keytable_detach(&secroots);
-	if (result == DST_R_NOCRYPTO)
+	}
+	if (result == DST_R_NOCRYPTO) {
 		result = ISC_R_SUCCESS;
+	}
 	return (result);
 }

@@ -1024,7 +1038,7 @@ configure_view_dnsseckeys(dns_view_t *view, const cfg_obj_t *vconfig,
 	}

 	/*
-	 * Add key zone for managed-keys.
+	 * Add key zone for managed keys.
 	 */
 	obj = NULL;
 	(void)named_config_get(maps, "managed-keys-directory", &obj);
@@ -1039,7 +1053,7 @@ configure_view_dnsseckeys(dns_view_t *view, const cfg_obj_t *vconfig,
 		goto cleanup;

 	} else if (directory != NULL) {
-		if (access(directory, DIR_PERM_OK) != 0) {
+		if (!isc_file_isdirwritable(directory)) {
 			isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 				      NAMED_LOGMODULE_SERVER, ISC_LOG_ERROR,
 				      "managed-keys-directory '%s' "
@@ -1048,6 +1062,7 @@ configure_view_dnsseckeys(dns_view_t *view, const cfg_obj_t *vconfig,
 			goto cleanup;
 		}
 	}
+
 	CHECK(add_keydata_zone(view, directory, named_g_mctx));

  cleanup:
@@ -3323,7 +3338,7 @@ create_empty_zone(dns_zone_t *zone, dns_name_t *name, dns_view_t *view,
 		viewname = "";
 	}
 	dns_name_format(name, namebuf, sizeof(namebuf));
-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+	isc_log_write(named_g_lctx, DNS_LOGCATEGORY_ZONELOAD,
 		      NAMED_LOGMODULE_SERVER, ISC_LOG_INFO,
 		      "automatic empty zone%s%s: %s",
 		      sep, viewname, namebuf);
@@ -4954,11 +4969,9 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
 			if (!strcasecmp(dom, "no")) {
 				result = ISC_R_NOTFOUND;
 			} else if (!strcasecmp(dom, "auto")) {
-				cfg_obj_log(obj, named_g_lctx, ISC_LOG_WARNING,
-					    "WARNING: the DLV server at "
-					    "'dlv.isc.org' is no longer "
-					    "in service; dnssec-lookaside "
-					    "ignored");
+				/*
+				 * Warning logged by libbind9.
+				 */
 				result = ISC_R_NOTFOUND;
 			}
 		}
@@ -4984,11 +4997,9 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
 			CHECK(dns_name_fromstring(dlv, cfg_obj_asstring(obj),
 						  DNS_NAME_DOWNCASE, NULL));
 			if (dns_name_equal(dlv, iscdlv)) {
-				cfg_obj_log(obj, named_g_lctx, ISC_LOG_WARNING,
-					    "WARNING: the DLV server at "
-					    "'dlv.isc.org' is no longer "
-					    "in service; dnssec-lookaside "
-					    "ignored");
+				/*
+				 * Warning logged by libbind9.
+				 */
 				view->dlv = NULL;
 			} else {
 				view->dlv = dlv;
@@ -6005,7 +6016,7 @@ configure_zone(const cfg_obj_t *config, const cfg_obj_t *zconfig,
 	 * Add the zone to its view in the new view list.
 	 */
 	if (!modify)
-	CHECK(dns_view_addzone(view, zone));
+		CHECK(dns_view_addzone(view, zone));

 	if (zone_is_catz) {
 		/*
@@ -6163,7 +6174,7 @@ directory_callback(const char *clausename, const cfg_obj_t *obj, void *arg) {
 			    "option 'directory' contains relative path '%s'",
 			    directory);

-	if (access(directory, DIR_PERM_OK) != 0) {
+	if (!isc_file_isdirwritable(directory)) {
 		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 			      NAMED_LOGMODULE_SERVER, ISC_LOG_ERROR,
 			      "directory '%s' is not writable",
@@ -6441,16 +6452,19 @@ dotat(dns_keytable_t *keytable, dns_keynode_t *keynode, void *arg) {
 		}
 		nextnode = NULL;
 		(void)dns_keytable_nextkeynode(keytable, keynode, &nextnode);
-		if (keynode != firstnode)
+		if (keynode != firstnode) {
 			dns_keytable_detachkeynode(keytable, &keynode);
+		}
 		keynode = nextnode;
 	} while (keynode != NULL);

-	if (n == 0)
+	if (n == 0) {
 		return;
+	}

-	if (n > 1)
+	if (n > 1) {
 		qsort(ids, n, sizeof(ids[0]), cid);
+	}

 	/*
 	 * Encoded as "_ta-xxxx\(-xxxx\)*" where xxxx is the hex version of
@@ -6458,22 +6472,25 @@ dotat(dns_keytable_t *keytable, dns_keynode_t *keynode, void *arg) {
 	 */
 	label[0] = 0;
 	r.base = label;
-	r.length = sizeof(label);;
+	r.length = sizeof(label);
 	m = snprintf(r.base, r.length, "_ta");
-	if (m < 0 || (unsigned)m > r.length)
+	if (m < 0 || (unsigned)m > r.length) {
 		return;
+	}
 	isc_textregion_consume(&r, m);
 	for (i = 0; i < n; i++) {
 		m = snprintf(r.base, r.length, "-%04x", ids[i]);
-		if (m < 0 || (unsigned)m > r.length)
+		if (m < 0 || (unsigned)m > r.length) {
 			return;
+		}
 		isc_textregion_consume(&r, m);
 	}
 	dns_fixedname_init(&fixed);
 	tatname = dns_fixedname_name(&fixed);
 	result = dns_name_fromstring2(tatname, label, name, 0, NULL);
-	if (result != ISC_R_SUCCESS)
+	if (result != ISC_R_SUCCESS) {
 		return;
+	}

 	dns_name_format(tatname, namebuf, sizeof(namebuf));
 	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
@@ -6482,8 +6499,9 @@ dotat(dns_keytable_t *keytable, dns_keynode_t *keynode, void *arg) {
 		     view->name, namebuf);

 	tat = isc_mem_get(dotat_arg->view->mctx, sizeof(*tat));
-	if (tat == NULL)
+	if (tat == NULL) {
 		return;
+	}

 	tat->mctx = NULL;
 	tat->task = NULL;
@@ -7051,7 +7069,7 @@ setup_newzones(dns_view_t *view, cfg_obj_t *config, cfg_obj_t *vconfig,
 				      dir, isc_result_totext(result));
 			return (result);
 		}
-		if (access(dir, DIR_PERM_OK) != 0) {
+		if (!isc_file_isdirwritable(dir)) {
 			isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 				      NAMED_LOGMODULE_SERVER, ISC_LOG_ERROR,
 				      "new-zones-directory '%s' "
@@ -7315,18 +7333,128 @@ data_to_cfg(dns_view_t *view, MDB_val *key, MDB_val *data,
 	return (result);
 }

+/*%
+ * Prototype for a callback which can be used with for_all_newzone_cfgs().
+ */
+typedef isc_result_t (*newzone_cfg_cb_t)(const cfg_obj_t *zconfig,
+					 cfg_obj_t *config, cfg_obj_t *vconfig,
+					 isc_mem_t *mctx, dns_view_t *view,
+					 cfg_aclconfctx_t *actx);
+
+/*%
+ * For each zone found in a NZD opened by the caller, create an object
+ * representing its configuration and invoke "callback" with the created
+ * object, "config", "vconfig", "mctx", "view" and "actx" as arguments (all
+ * these are non-global variables required to invoke configure_zone()).
+ * Immediately interrupt processing if an error is encountered while
+ * transforming NZD data into a zone configuration object or if "callback"
+ * returns an error.
+ */
+static isc_result_t
+for_all_newzone_cfgs(newzone_cfg_cb_t callback, cfg_obj_t *config,
+		     cfg_obj_t *vconfig, isc_mem_t *mctx, dns_view_t *view,
+		     cfg_aclconfctx_t *actx, MDB_txn *txn, MDB_dbi dbi)
+{
+	const cfg_obj_t *zconfig, *zlist = NULL;
+	isc_result_t result = ISC_R_SUCCESS;
+	cfg_obj_t *zconfigobj = NULL;
+	isc_buffer_t *text = NULL;
+	MDB_cursor *cursor = NULL;
+	MDB_val data, key;
+	int status;
+
+	status = mdb_cursor_open(txn, dbi, &cursor);
+	if (status != MDB_SUCCESS) {
+		return (ISC_R_FAILURE);
+	}
+
+	for (status = mdb_cursor_get(cursor, &key, &data, MDB_FIRST);
+	     status == MDB_SUCCESS;
+	     status = mdb_cursor_get(cursor, &key, &data, MDB_NEXT))
+	{
+		/*
+		 * Create a configuration object from data fetched from NZD.
+		 */
+		result = data_to_cfg(view, &key, &data, &text, &zconfigobj);
+		if (result != ISC_R_SUCCESS) {
+			break;
+		}
+
+		/*
+		 * Extract zone configuration from configuration object.
+		 */
+		result = cfg_map_get(zconfigobj, "zone", &zlist);
+		if (result != ISC_R_SUCCESS) {
+			break;
+		} else if (!cfg_obj_islist(zlist)) {
+			result = ISC_R_FAILURE;
+			break;
+		}
+		zconfig = cfg_listelt_value(cfg_list_first(zlist));
+
+		/*
+		 * Invoke callback.
+		 */
+		result = callback(zconfig, config, vconfig, mctx, view, actx);
+		if (result != ISC_R_SUCCESS) {
+			break;
+		}
+
+		/*
+		 * Destroy the configuration object created in this iteration.
+		 */
+		cfg_obj_destroy(named_g_addparser, &zconfigobj);
+	}
+
+	if (text != NULL) {
+		isc_buffer_free(&text);
+	}
+	if (zconfigobj != NULL) {
+		cfg_obj_destroy(named_g_addparser, &zconfigobj);
+	}
+	mdb_cursor_close(cursor);
+
+	return (result);
+}
+
+/*%
+ * Attempt to configure a zone found in NZD and return the result.
+ */
+static isc_result_t
+configure_newzone(const cfg_obj_t *zconfig, cfg_obj_t *config,
+		  cfg_obj_t *vconfig, isc_mem_t *mctx, dns_view_t *view,
+		  cfg_aclconfctx_t *actx)
+{
+	return (configure_zone(config, zconfig, vconfig, mctx, view,
+			       &named_g_server->viewlist, actx, ISC_TRUE,
+			       ISC_FALSE, ISC_FALSE));
+}
+
+/*%
+ * Revert new view assignment for a zone found in NZD.
+ */
+static isc_result_t
+configure_newzone_revert(const cfg_obj_t *zconfig, cfg_obj_t *config,
+			 cfg_obj_t *vconfig, isc_mem_t *mctx, dns_view_t *view,
+			 cfg_aclconfctx_t *actx)
+{
+	UNUSED(config);
+	UNUSED(vconfig);
+	UNUSED(mctx);
+	UNUSED(actx);
+
+	configure_zone_setviewcommit(ISC_R_FAILURE, zconfig, view);
+
+	return (ISC_R_SUCCESS);
+}
+
 static isc_result_t
 configure_newzones(dns_view_t *view, cfg_obj_t *config, cfg_obj_t *vconfig,
 		   isc_mem_t *mctx, cfg_aclconfctx_t *actx)
 {
-	isc_result_t result = ISC_R_SUCCESS;
-	int status;
-	isc_buffer_t *text = NULL;
-	cfg_obj_t *zoneconf = NULL;
-	MDB_cursor *cursor = NULL;
+	isc_result_t result;
 	MDB_txn *txn = NULL;
 	MDB_dbi dbi;
-	MDB_val key, data;

 	if (view->new_zone_config == NULL) {
 		return (ISC_R_SUCCESS);
@@ -7343,82 +7471,22 @@ configure_newzones(dns_view_t *view, cfg_obj_t *config, cfg_obj_t *vconfig,
 		      "for view '%s'",
 		      view->new_zone_db, view->name);

-	status = mdb_cursor_open(txn, dbi, &cursor);
-	if (status != 0) {
-		result = ISC_R_FAILURE;
-		goto cleanup;
-	}
-
-	while (mdb_cursor_get(cursor, &key, &data, MDB_NEXT) == 0) {
-		const cfg_obj_t *zlist = NULL;
-		const cfg_obj_t *zoneobj = NULL;
-
-		result = data_to_cfg(view, &key, &data, &text, &zoneconf);
-		if (result != ISC_R_SUCCESS) {
-			goto cleanup;
-		}
-
-		CHECK(cfg_map_get(zoneconf, "zone", &zlist));
-		if (!cfg_obj_islist(zlist)) {
-			CHECK(ISC_R_FAILURE);
-		}
-
-		zoneobj = cfg_listelt_value(cfg_list_first(zlist));
-		CHECK(configure_zone(config, zoneobj, vconfig, mctx,
-				     view, &named_g_server->viewlist, actx,
-				     ISC_TRUE, ISC_FALSE, ISC_FALSE));
-
-		cfg_obj_destroy(named_g_addparser, &zoneconf);
-	}
-
-	result = ISC_R_SUCCESS;
-
- cleanup:
-	if (zoneconf != NULL) {
-		cfg_obj_destroy(named_g_addparser, &zoneconf);
-	}
-	if (cursor != NULL) {
-		mdb_cursor_close(cursor);
-		cursor = NULL;
-	}
+	result = for_all_newzone_cfgs(configure_newzone, config, vconfig, mctx,
+				      view, actx, txn, dbi);
 	if (result != ISC_R_SUCCESS) {
-		status = mdb_cursor_open(txn, dbi, &cursor);
-		if (status != 0) {
-			goto cleanup2;
-		}
-		while (mdb_cursor_get(cursor, &key, &data, MDB_NEXT) == 0) {
-			const cfg_obj_t *zlist = NULL;
-			const cfg_obj_t *zconfig = NULL;
-			isc_result_t result2;
-
-			result2 = data_to_cfg(view, &key, &data, &text,
-					      &zoneconf);
-			if (result2 != ISC_R_SUCCESS) {
-				goto cleanup2;
-			}
-
-			result2 = cfg_map_get(zoneconf, "zone", &zlist);
-			if (result2 != ISC_R_SUCCESS) {
-				goto cleanup2;
-			}
-
-			zconfig = cfg_listelt_value(cfg_list_first(zlist));
-			configure_zone_setviewcommit(result, zconfig, view);
-
-			cfg_obj_destroy(named_g_addparser, &zoneconf);
-		}
+		/*
+		 * An error was encountered while attempting to configure zones
+		 * found in NZD.  As this error may have been caused by a
+		 * configure_zone() failure, try restoring a sane configuration
+		 * by reattaching all zones found in NZD to the old view.  If
+		 * this also fails, too bad, there is nothing more we can do in
+		 * terms of trying to make things right.
+		 */
+		(void) for_all_newzone_cfgs(configure_newzone_revert, config,
+					    vconfig, mctx, view, actx, txn,
+					    dbi);
 	}

- cleanup2:
-	if (text != NULL) {
-		isc_buffer_free(&text);
-	}
-	if (zoneconf != NULL) {
-		cfg_obj_destroy(named_g_addparser, &zoneconf);
-	}
-	if (cursor != NULL) {
-		mdb_cursor_close(cursor);
-	}
 	(void) nzd_close(&txn, ISC_FALSE);
 	return (result);
 }
@@ -7462,8 +7530,9 @@ get_newzone_config(dns_view_t *view, const char *zonename,
 	key.mv_size = strlen(zname);

 	status = mdb_get(txn, dbi, &key, &data);
-	if (status != 0)
+	if (status != MDB_SUCCESS) {
 		CHECK(ISC_R_FAILURE);
+	}

 	CHECK(data_to_cfg(view, &key, &data, &text, &zoneconf));

@@ -7886,11 +7955,11 @@ load_configuration(const char *filename, named_server_t *server,
 	result = named_config_get(maps, "tcp-keepalive-timeout", &obj);
 	INSIST(result == ISC_R_SUCCESS);
 	keepalive = cfg_obj_asuint32(obj);
-	if (keepalive > 1200) {
+	if (keepalive > MAX_TCP_TIMEOUT) {
 		cfg_obj_log(obj, named_g_lctx, ISC_LOG_WARNING,
 			    "tcp-keepalive-timeout value is out of range: "
-			    "lowering to 1200");
-		keepalive = 1200;
+			    "lowering to %u", MAX_TCP_TIMEOUT);
+		keepalive = MAX_TCP_TIMEOUT;
 	} else if (keepalive < 1) {
 		cfg_obj_log(obj, named_g_lctx, ISC_LOG_WARNING,
 			    "tcp-keepalive-timeout value is out of range: "
@@ -7902,11 +7971,11 @@ load_configuration(const char *filename, named_server_t *server,
 	result = named_config_get(maps, "tcp-advertised-timeout", &obj);
 	INSIST(result == ISC_R_SUCCESS);
 	advertised = cfg_obj_asuint32(obj);
-	if (advertised > 1200) {
+	if (advertised > MAX_TCP_TIMEOUT) {
 		cfg_obj_log(obj, named_g_lctx, ISC_LOG_WARNING,
 			    "tcp-advertized-timeout value is out of range: "
-			    "lowering to 1200");
-		advertised = 1200;
+			    "lowering to %u", MAX_TCP_TIMEOUT);
+		advertised = MAX_TCP_TIMEOUT;
 	}

 	ns_server_settimeouts(named_g_server->sctx,
@@ -8492,7 +8561,7 @@ load_configuration(const char *filename, named_server_t *server,
 	/*
 	 * Check that the working directory is writable.
 	 */
-	if (access(".", DIR_PERM_OK) != 0) {
+	if (!isc_file_isdirwritable(".")) {
 		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 			      NAMED_LOGMODULE_SERVER, ISC_LOG_ERROR,
 			      "the working directory is not writable");
@@ -11744,6 +11813,10 @@ nzf_append(dns_view_t *view, const cfg_obj_t *zconfig) {

 static isc_result_t
 nzf_writeconf(const cfg_obj_t *config, dns_view_t *view) {
+	const cfg_obj_t *zl = NULL;
+	cfg_list_t *list;
+	const cfg_listelt_t *elt;
+
 	FILE *fp = NULL;
 	char tmp[1024];
 	isc_result_t result;
@@ -11755,9 +11828,24 @@ nzf_writeconf(const cfg_obj_t *config, dns_view_t *view) {
 	if (result != ISC_R_SUCCESS)
 		return (result);

+	cfg_map_get(config, "zone", &zl);
+	if (!cfg_obj_islist(zl))
+		CHECK(ISC_R_FAILURE);
+
+	DE_CONST(&zl->value.list, list);
+
 	CHECK(add_comment(fp, view->name));	/* force a comment */

-	cfg_printx(config, CFG_PRINTER_ONELINE, dumpzone, fp);
+	for (elt = ISC_LIST_HEAD(*list);
+	     elt != NULL;
+	     elt = ISC_LIST_NEXT(elt, link))
+	{
+		const cfg_obj_t *zconfig = cfg_listelt_value(elt);
+
+		CHECK(isc_stdio_write("zone ", 5, 1, fp, NULL));
+		cfg_printx(zconfig, CFG_PRINTER_ONELINE, dumpzone, fp);
+		CHECK(isc_stdio_write(";\n", 2, 1, fp, NULL));
+	}

 	CHECK(isc_stdio_flush(fp));
 	result = isc_stdio_close(fp);
@@ -11816,7 +11904,7 @@ nzd_save(MDB_txn **txnp, MDB_dbi dbi, dns_zone_t *zone,
 	if (zconfig == NULL) {
 		/* We're deleting the zone from the database */
 		status = mdb_del(*txnp, dbi, &key, NULL);
-		if (status != 0 && status != MDB_NOTFOUND) {
+		if (status != MDB_SUCCESS && status != MDB_NOTFOUND) {
 			isc_log_write(named_g_lctx,
 				      NAMED_LOGCATEGORY_GENERAL,
 				      NAMED_LOGMODULE_SERVER,
@@ -11826,8 +11914,9 @@ nzd_save(MDB_txn **txnp, MDB_dbi dbi, dns_zone_t *zone,
 				      namebuf, mdb_strerror(status));
 			result = ISC_R_FAILURE;
 			goto cleanup;
-		} else if (status != MDB_NOTFOUND)
+		} else if (status != MDB_NOTFOUND) {
 			commit = ISC_TRUE;
+		}
 	} else {
 		/* We're creating or overwriting the zone */
 		const cfg_obj_t *zoptions;
@@ -11862,7 +11951,7 @@ nzd_save(MDB_txn **txnp, MDB_dbi dbi, dns_zone_t *zone,
 		data.mv_size = isc_buffer_usedlength(text);

 		status = mdb_put(*txnp, dbi, &key, &data, 0);
-		if (status != 0) {
+		if (status != MDB_SUCCESS) {
 			isc_log_write(named_g_lctx,
 				      NAMED_LOGCATEGORY_GENERAL,
 				      NAMED_LOGMODULE_SERVER,
@@ -11880,11 +11969,11 @@ nzd_save(MDB_txn **txnp, MDB_dbi dbi, dns_zone_t *zone,
 	result = ISC_R_SUCCESS;

 cleanup:
-	if (!commit || result != ISC_R_SUCCESS)
+	if (!commit || result != ISC_R_SUCCESS) {
 		(void) mdb_txn_abort(*txnp);
-	else {
+	} else {
 		status = mdb_txn_commit(*txnp);
-		if (status != 0) {
+		if (status != MDB_SUCCESS) {
 			isc_log_write(named_g_lctx,
 				      NAMED_LOGCATEGORY_GENERAL,
 				      NAMED_LOGMODULE_SERVER,
@@ -11899,8 +11988,10 @@ nzd_save(MDB_txn **txnp, MDB_dbi dbi, dns_zone_t *zone,

 	UNLOCK(&view->new_zone_lock);

-	if (text != NULL)
+	if (text != NULL) {
 		isc_buffer_free(&text);
+	}
+
 	return (result);
 }

@@ -11914,7 +12005,7 @@ nzd_writable(dns_view_t *view) {
 	REQUIRE(view != NULL);

 	status = mdb_txn_begin((MDB_env *) view->new_zone_dbenv, 0, 0, &txn);
-	if (status != 0) {
+	if (status != MDB_SUCCESS) {
 		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 			      NAMED_LOGMODULE_SERVER, ISC_LOG_WARNING,
 			      "mdb_txn_begin: %s",
@@ -11923,7 +12014,7 @@ nzd_writable(dns_view_t *view) {
 	}

 	status = mdb_dbi_open(txn, NULL, 0, &dbi);
-	if (status != 0) {
+	if (status != MDB_SUCCESS) {
 		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 			      NAMED_LOGMODULE_SERVER, ISC_LOG_WARNING,
 			      "mdb_dbi_open: %s",
@@ -11946,7 +12037,7 @@ nzd_open(dns_view_t *view, unsigned int flags, MDB_txn **txnp, MDB_dbi *dbi) {

 	status = mdb_txn_begin((MDB_env *) view->new_zone_dbenv, 0,
 			       flags, &txn);
-	if (status != 0) {
+	if (status != MDB_SUCCESS) {
 		isc_log_write(named_g_lctx,
 			      NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_SERVER,
 			      ISC_LOG_WARNING, "mdb_txn_begin: %s",
@@ -11955,7 +12046,7 @@ nzd_open(dns_view_t *view, unsigned int flags, MDB_txn **txnp, MDB_dbi *dbi) {
 	}

 	status = mdb_dbi_open(txn, NULL, 0, dbi);
-	if (status != 0) {
+	if (status != MDB_SUCCESS) {
 		isc_log_write(named_g_lctx,
 		      NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_SERVER,
 			      ISC_LOG_WARNING, "mdb_dbi_open: %s",
@@ -11966,9 +12057,10 @@ nzd_open(dns_view_t *view, unsigned int flags, MDB_txn **txnp, MDB_dbi *dbi) {
 	*txnp = txn;

 cleanup:
-	if (status != 0) {
-		if (txn != NULL)
+	if (status != MDB_SUCCESS) {
+		if (txn != NULL) {
 			mdb_txn_abort(txn);
+		}
 		return (ISC_R_FAILURE);
 	}

@@ -11982,38 +12074,34 @@ nzd_open(dns_view_t *view, unsigned int flags, MDB_txn **txnp, MDB_dbi *dbi) {
 */
 static void
 nzd_env_close(dns_view_t *view) {
-	if (view->new_zone_dbenv != NULL) {
-		const char *dbpath = NULL;
-		isc_boolean_t have_dbpath = ISC_FALSE;
-		char dbpath_copy[PATH_MAX];
-		char lockpath[PATH_MAX];
-		int ret;
+	const char *dbpath = NULL;
+	char dbpath_copy[PATH_MAX];
+	char lockpath[PATH_MAX];
+	int status, ret;

-		if (mdb_env_get_path(view->new_zone_dbenv, &dbpath) == 0) {
-			have_dbpath = ISC_TRUE;
-			snprintf(lockpath, sizeof(lockpath), "%s-lock",
-				 dbpath);
-			strlcpy(dbpath_copy, dbpath, sizeof(dbpath_copy));
-		}
-
-		mdb_env_close((MDB_env *) view->new_zone_dbenv);
-		view->new_zone_dbenv = NULL;
-
-		if (have_dbpath) {
-			/*
-			 * Database files must be owned by the eventual user, not
-			 * by root.
-			 */
-			ret = chown(dbpath_copy, ns_os_uid(), -1);
-			UNUSED(ret);
-
-			/*
-			 * Some platforms need the lockfile not to exist when we
-			 * reopen the environment.
-			 */
-			(void) isc_file_remove(lockpath);
-		}
+	if (view->new_zone_dbenv == NULL) {
+		return;
 	}
+
+	status = mdb_env_get_path(view->new_zone_dbenv, &dbpath);
+	INSIST(status == MDB_SUCCESS);
+	snprintf(lockpath, sizeof(lockpath), "%s-lock", dbpath);
+	strlcpy(dbpath_copy, dbpath, sizeof(dbpath_copy));
+	mdb_env_close((MDB_env *) view->new_zone_dbenv);
+
+	/*
+	 * Database files must be owned by the eventual user, not by root.
+	 */
+	ret = chown(dbpath_copy, ns_os_uid(), -1);
+	UNUSED(ret);
+
+	/*
+	 * Some platforms need the lockfile not to exist when we reopen the
+	 * environment.
+	 */
+	(void) isc_file_remove(lockpath);
+
+	view->new_zone_dbenv = NULL;
 }

 static isc_result_t
@@ -12029,7 +12117,7 @@ nzd_env_reopen(dns_view_t *view) {
 	nzd_env_close(view);

 	status = mdb_env_create(&env);
-	if (status != 0) {
+	if (status != MDB_SUCCESS) {
 		isc_log_write(dns_lctx, DNS_LOGCATEGORY_GENERAL,
 			      ISC_LOGMODULE_OTHER, ISC_LOG_ERROR,
 			      "mdb_env_create failed: %s",
@@ -12039,7 +12127,7 @@ nzd_env_reopen(dns_view_t *view) {

 	if (view->new_zone_mapsize != 0ULL) {
 		status = mdb_env_set_mapsize(env, view->new_zone_mapsize);
-		if (status != 0) {
+		if (status != MDB_SUCCESS) {
 			isc_log_write(dns_lctx, DNS_LOGCATEGORY_GENERAL,
 				      ISC_LOGMODULE_OTHER, ISC_LOG_ERROR,
 				      "mdb_env_set_mapsize failed: %s",
@@ -12048,9 +12136,8 @@ nzd_env_reopen(dns_view_t *view) {
 		}
 	}

-	status = mdb_env_open(env, view->new_zone_db,
-			      MDB_NOSUBDIR|MDB_CREATE, 0600);
-	if (status != 0) {
+	status = mdb_env_open(env, view->new_zone_db, DNS_LMDB_FLAGS, 0600);
+	if (status != MDB_SUCCESS) {
 		isc_log_write(dns_lctx, DNS_LOGCATEGORY_GENERAL,
 			      ISC_LOGMODULE_OTHER, ISC_LOG_ERROR,
 			      "mdb_env_open of '%s' failed: %s",
@@ -12079,10 +12166,12 @@ nzd_close(MDB_txn **txnp, isc_boolean_t commit) {
 	if (*txnp != NULL) {
 		if (commit) {
 			status = mdb_txn_commit(*txnp);
-			if (status != 0)
+			if (status != MDB_SUCCESS) {
 				result = ISC_R_FAILURE;
-		} else
+			}
+		} else {
 			mdb_txn_abort(*txnp);
+		}
 		*txnp = NULL;
 	}

@@ -12100,11 +12189,12 @@ nzd_count(dns_view_t *view, int *countp) {
 	REQUIRE(countp != NULL);

 	result = nzd_open(view, MDB_RDONLY, &txn, &dbi);
-	if (result != ISC_R_SUCCESS)
+	if (result != ISC_R_SUCCESS) {
 		goto cleanup;
+	}

 	status = mdb_stat(txn, dbi, &statbuf);
-	if (status != 0) {
+	if (status != MDB_SUCCESS) {
 		isc_log_write(named_g_lctx,
 			      NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_SERVER,
 			      ISC_LOG_WARNING, "mdb_stat: %s",
@@ -12177,8 +12267,9 @@ migrate_nzf(dns_view_t *view) {

 	zonelist = NULL;
 	CHECK(cfg_map_get(nzf_config, "zone", &zonelist));
-	if (!cfg_obj_islist(zonelist))
+	if (!cfg_obj_islist(zonelist)) {
 		CHECK(ISC_R_FAILURE);
+	}

 	CHECK(nzd_open(view, 0, &txn, &dbi));

@@ -12229,7 +12320,7 @@ migrate_nzf(dns_view_t *view) {
 		data.mv_size = isc_buffer_usedlength(text);

 		status = mdb_put(txn, dbi, &key, &data, MDB_NOOVERWRITE);
-		if (status != 0) {
+		if (status != MDB_SUCCESS) {
 			isc_log_write(named_g_lctx,
 				      NAMED_LOGCATEGORY_GENERAL,
 				      NAMED_LOGMODULE_SERVER,
@@ -12258,15 +12349,19 @@ migrate_nzf(dns_view_t *view) {
 	}

 cleanup:
-	if (result != ISC_R_SUCCESS)
+	if (result != ISC_R_SUCCESS) {
 		(void) nzd_close(&txn, ISC_FALSE);
-	else
+	} else {
 		result = nzd_close(&txn, commit);
+	}

-	if (text != NULL)
+	if (text != NULL) {
 		isc_buffer_free(&text);
-	if (nzf_config != NULL)
+	}
+
+	if (nzf_config != NULL) {
 		cfg_obj_destroy(named_g_addparser, &nzf_config);
+	}

 	return (result);
 }
@@ -13447,11 +13542,6 @@ newzone_cfgctx_destroy(void **cfgp) {

 static isc_result_t
 generate_salt(unsigned char *salt, size_t saltlen) {
-	size_t i, n;
-	union {
-		unsigned char rnd[256];
-		isc_uint16_t rnd16[128];
-	} rnd;
 	unsigned char text[512 + 1];
 	isc_region_t r;
 	isc_buffer_t buf;
@@ -13460,14 +13550,9 @@ generate_salt(unsigned char *salt, size_t saltlen) {
 	if (saltlen > 256U)
 		return (ISC_R_RANGE);

-	n = (saltlen + sizeof(isc_uint16_t) - 1) / sizeof(isc_uint16_t);
-	for (i = 0; i < n; i++) {
-		rnd.rnd16[i] = isc_rng_random(named_g_server->sctx->rngctx);
-	}
+	isc_rng_randombytes(named_g_server->sctx->rngctx, salt, saltlen);

-	memmove(salt, rnd.rnd, saltlen);
-
-	r.base = rnd.rnd;
+	r.base = salt;
 	r.length = (unsigned int) saltlen;

 	isc_buffer_init(&buf, text, sizeof(text));
@@ -14428,10 +14513,10 @@ mkey_dumpzone(dns_view_t *view, isc_buffer_t **text) {
 			else if (revoked)
 				snprintf(buf, sizeof(buf),
 					 "\n\ttrust revoked");
-			else if (kd.addhd < now)
+			else if (kd.addhd <= now)
 				snprintf(buf, sizeof(buf),
 					 "\n\ttrusted since: %s", tbuf);
-			else if (kd.addhd >= now)
+			else if (kd.addhd > now)
 				snprintf(buf, sizeof(buf),
 					 "\n\ttrust pending: %s", tbuf);
 			CHECK(putstr(text, buf));
@@ -14700,7 +14785,7 @@ named_server_tcptimeouts(isc_lex_t *lex, isc_buffer_t **text) {
 		if (ptr == NULL)
 			return (ISC_R_UNEXPECTEDEND);
 		CHECK(isc_parse_uint32(&keepalive, ptr, 10));
-		if (keepalive > 1200)
+		if (keepalive > MAX_TCP_TIMEOUT)
 			CHECK(ISC_R_RANGE);
 		if (keepalive < 1)
 			CHECK(ISC_R_RANGE);
@@ -14709,7 +14794,7 @@ named_server_tcptimeouts(isc_lex_t *lex, isc_buffer_t **text) {
 		if (ptr == NULL)
 			return (ISC_R_UNEXPECTEDEND);
 		CHECK(isc_parse_uint32(&advertised, ptr, 10));
-		if (advertised > 1200)
+		if (advertised > MAX_TCP_TIMEOUT)
 			CHECK(ISC_R_RANGE);

 		result = isc_task_beginexclusive(named_g_server->task);
@@ -395,6 +395,7 @@ init_desc(void) {
 	SET_RESSTATDESC(serverquota, "spilled due to server quota",
 			"ServerQuota");
 	SET_RESSTATDESC(nextitem, "waited for next item", "NextItem");
+	SET_RESSTATDESC(priming, "priming queries", "Priming");

 	INSIST(i == dns_resstatscounter_max);

@@ -1615,7 +1616,7 @@ generatexml(named_server_t *server, isc_uint32_t flags,
 			ISC_XMLCHAR "type=\"text/xsl\" href=\"/bind9.xsl\""));
 	TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "statistics"));
 	TRY0(xmlTextWriterWriteAttribute(writer, ISC_XMLCHAR "version",
-					 ISC_XMLCHAR "3.10"));
+					 ISC_XMLCHAR "3.11"));

 	/* Set common fields for statistics dump */
 	dumparg.type = isc_statsformat_xml;
@@ -2411,7 +2412,7 @@ generatejson(named_server_t *server, size_t *msglen,
 	/*
 	 * These statistics are included no matter which URL we use.
 	 */
-	obj = json_object_new_string("1.4");
+	obj = json_object_new_string("1.5");
 	CHECKMEM(obj);
 	json_object_object_add(bindstats, "json-stats-version", obj);

@@ -150,6 +150,7 @@ static dns_dispatch_t *dispatchv4 = NULL;
 static dns_dispatch_t *dispatchv6 = NULL;
 static dns_message_t *updatemsg = NULL;
 static dns_fixedname_t fuserzone;
+static dns_fixedname_t fzname;
 static dns_name_t *userzone = NULL;
 static dns_name_t *zname = NULL;
 static dns_name_t tmpzonename;
@@ -943,16 +944,21 @@ setup_system(void) {
 			case AF_INET:
 				if (have_ipv4) {
 					sa->type.sin.sin_port = htons(dnsport);
+				} else {
+					continue;
 				}
 				break;
 			case AF_INET6:
 				if (have_ipv6) {
 					sa->type.sin6.sin6_port = htons(dnsport);
+				} else {
+					continue;
 				}
 				break;
 			default:
 				fatal("bad family");
 			}
+			INSIST(i < ns_alloc);
 			servers[i++] = *sa;
 		}
 	}
@@ -2390,7 +2396,6 @@ update_completed(isc_task_t *task, isc_event_t *event) {
 		dns_request_destroy(&request);
 		dns_message_renderreset(updatemsg);
 		dns_message_settsigkey(updatemsg, NULL);
-		/* XXX MPA fix zonename is freed already */
 		send_update(zname, &master_servers[master_inuse]);
 		isc_event_free(&event);
 		return;
@@ -2693,13 +2698,17 @@ recvsoa(isc_task_t *task, isc_event_t *event) {
 	dns_name_init(&master, NULL);
 	dns_name_clone(&soa.origin, &master);

-	/*
-	 * XXXMPA
-	 */
-	if (userzone != NULL)
+	if (userzone != NULL) {
 		zname = userzone;
-	else
-		zname = name;
+	} else {
+		/*
+		 * Save the zone name in case we need to try a second
+		 * address.
+		 */
+		dns_fixedname_init(&fzname);
+		zname = dns_fixedname_name(&fzname);
+		dns_name_copy(name, zname, NULL);
+	}

 	if (debugging) {
 		char namestr[DNS_NAME_FORMATSIZE];
@@ -39,9 +39,7 @@
 dnssec-checkds \- DNSSEC delegation consistency checking tool
 .SH "SYNOPSIS"
 .HP \w'\fBdnssec\-checkds\fR\ 'u
-\fBdnssec\-checkds\fR [\fB\-l\ \fR\fB\fIdomain\fR\fR] [\fB\-f\ \fR\fB\fIfile\fR\fR] [\fB\-d\ \fR\fB\fIdig\ path\fR\fR] [\fB\-D\ \fR\fB\fIdsfromkey\ path\fR\fR] {zone}
-.HP \w'\fBdnssec\-dsfromkey\fR\ 'u
-\fBdnssec\-dsfromkey\fR [\fB\-l\ \fR\fB\fIdomain\fR\fR] [\fB\-f\ \fR\fB\fIfile\fR\fR] [\fB\-d\ \fR\fB\fIdig\ path\fR\fR] [\fB\-D\ \fR\fB\fIdsfromkey\ path\fR\fR] {zone}
+\fBdnssec\-checkds\fR [\fB\-d\ \fR\fB\fIdig\ path\fR\fR] [\fB\-D\ \fR\fB\fIdsfromkey\ path\fR\fR] [\fB\-f\ \fR\fB\fIfile\fR\fR] [\fB\-l\ \fR\fB\fIdomain\fR\fR] [\fB\-s\ \fR\fB\fIfile\fR\fR] {zone}
 .SH "DESCRIPTION"
 .PP
 \fBdnssec\-checkds\fR
@@ -60,6 +58,12 @@ is specified, then the zone is read from that file to find the DNSKEY records\&.
 Check for a DLV record in the specified lookaside domain, instead of checking for a DS record in the zone\*(Aqs parent\&.
 .RE
 .PP
+\-s \fIfile\fR
+.RS 4
+Specifies a prepared dsset file, such as would be generated by
+\fBdnssec\-signzone\fR, to use as a source for the DS RRset instead of querying the parent\&.
+.RE
+.PP
 \-d \fIdig path\fR
 .RS 4
 Specifies a path to a
@@ -42,20 +42,13 @@
  <refsynopsisdiv>
    <cmdsynopsis sepchar=" ">
      <command>dnssec-checkds</command>
-      <arg choice="opt" rep="norepeat"><option>-l <replaceable class="parameter">domain</replaceable></option></arg>
-      <arg choice="opt" rep="norepeat"><option>-f <replaceable class="parameter">file</replaceable></option></arg>
      <arg choice="opt" rep="norepeat"><option>-d <replaceable class="parameter">dig path</replaceable></option></arg>
      <arg choice="opt" rep="norepeat"><option>-D <replaceable class="parameter">dsfromkey path</replaceable></option></arg>
+      <arg choice="opt" rep="norepeat"><option>-f <replaceable class="parameter">file</replaceable></option></arg>
+      <arg choice="opt" rep="norepeat"><option>-l <replaceable class="parameter">domain</replaceable></option></arg>
+      <arg choice="opt" rep="norepeat"><option>-s <replaceable class="parameter">file</replaceable></option></arg>
      <arg choice="req" rep="norepeat">zone</arg>
    </cmdsynopsis>
-    <cmdsynopsis sepchar=" ">
-      <command>dnssec-dsfromkey</command>
-      <arg choice="opt" rep="norepeat"><option>-l <replaceable class="parameter">domain</replaceable></option></arg>
-      <arg choice="opt" rep="norepeat"><option>-f <replaceable class="parameter">file</replaceable></option></arg>
-      <arg choice="opt" rep="norepeat"><option>-d <replaceable class="parameter">dig path</replaceable></option></arg>
-      <arg choice="opt" rep="norepeat"><option>-D <replaceable class="parameter">dsfromkey path</replaceable></option></arg>
-      <arg choice="req" rep="norepeat">zone</arg>
-   </cmdsynopsis>
  </refsynopsisdiv>

  <refsection><info><title>DESCRIPTION</title></info>
@@ -92,6 +85,17 @@
        </listitem>
      </varlistentry>

+      <varlistentry>
+        <term>-s <replaceable class="parameter">file</replaceable></term>
+        <listitem>
+          <para>
+            Specifies a prepared dsset file, such as would be generated
+            by <command>dnssec-signzone</command>, to use as a source for
+            the DS RRset instead of querying the parent.
+          </para>
+        </listitem>
+      </varlistentry>
+
      <varlistentry>
        <term>-d <replaceable class="parameter">dig path</replaceable></term>
        <listitem>
@@ -33,20 +33,13 @@
 <h2>Synopsis</h2>
    <div class="cmdsynopsis"><p>
      <code class="command">dnssec-checkds</code> 
-       [<code class="option">-l <em class="replaceable"><code>domain</code></em></code>]
-       [<code class="option">-f <em class="replaceable"><code>file</code></em></code>]
       [<code class="option">-d <em class="replaceable"><code>dig path</code></em></code>]
       [<code class="option">-D <em class="replaceable"><code>dsfromkey path</code></em></code>]
+       [<code class="option">-f <em class="replaceable"><code>file</code></em></code>]
+       [<code class="option">-l <em class="replaceable"><code>domain</code></em></code>]
+       [<code class="option">-s <em class="replaceable"><code>file</code></em></code>]
       {zone}
    </p></div>
-    <div class="cmdsynopsis"><p>
-      <code class="command">dnssec-dsfromkey</code> 
-       [<code class="option">-l <em class="replaceable"><code>domain</code></em></code>]
-       [<code class="option">-f <em class="replaceable"><code>file</code></em></code>]
-       [<code class="option">-d <em class="replaceable"><code>dig path</code></em></code>]
-       [<code class="option">-D <em class="replaceable"><code>dsfromkey path</code></em></code>]
-       {zone}
-   </p></div>
  </div>

  <div class="refsection">
@@ -79,6 +72,14 @@
            instead of checking for a DS record in the zone's parent.
          </p>
        </dd>
+<dt><span class="term">-s <em class="replaceable"><code>file</code></em></span></dt>
+<dd>
+          <p>
+            Specifies a prepared dsset file, such as would be generated
+            by <span class="command"><strong>dnssec-signzone</strong></span>, to use as a source for
+            the DS RRset instead of querying the parent.
+          </p>
+        </dd>
 <dt><span class="term">-d <em class="replaceable"><code>dig path</code></em></span></dt>
 <dd>
          <p>
@@ -1,5 +1,5 @@
 ############################################################################
-# Copyright (C) 2012-2016  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2012-2017  Internet Systems Consortium, Inc. ("ISC")
 #
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -34,7 +34,11 @@ class SECRR:
        if not rrtext:
            raise Exception

-        fields = rrtext.decode('ascii').split()
+        # 'str' does not have decode method in python3
+        if type(rrtext) is not str:
+            fields = rrtext.decode('ascii').split()
+        else:
+            fields = rrtext.split()
        if len(fields) < 7:
            raise Exception

@@ -89,35 +93,39 @@ class SECRR:
 # Generate a set of expected DS/DLV records from the DNSKEY RRset,
 # and report on congruency.
 ############################################################################
-def check(zone, args, masterfile=None, lookaside=None):
+def check(zone, args):
    rrlist = []
-    cmd = [args.dig, "+noall", "+answer", "-t", "dlv" if lookaside else "ds",
-           "-q", zone + "." + lookaside if lookaside else zone]
-    fp, _ = Popen(cmd, stdout=PIPE).communicate()
+    if args.dssetfile:
+        fp = open(args.dssetfile).read()
+    else:
+        cmd = [args.dig, "+noall", "+answer", "-t",
+                "dlv" if args.lookaside else "ds", "-q",
+                zone + "." + args.lookaside if args.lookaside else zone]
+        fp, _ = Popen(cmd, stdout=PIPE).communicate()

    for line in fp.splitlines():
-        rrlist.append(SECRR(line, lookaside))
+        rrlist.append(SECRR(line, args.lookaside))
    rrlist = sorted(rrlist, key=lambda rr: (rr.keyid, rr.keyalg, rr.hashalg))

    klist = []

-    if masterfile:
-        cmd = [args.dsfromkey, "-f", masterfile]
-        if lookaside:
-            cmd += ["-l", lookaside]
+    if args.masterfile:
+        cmd = [args.dsfromkey, "-f", args.masterfile]
+        if args.lookaside:
+            cmd += ["-l", args.lookaside]
        cmd.append(zone)
        fp, _ = Popen(cmd, stdout=PIPE).communicate()
    else:
        intods, _ = Popen([args.dig, "+noall", "+answer", "-t", "dnskey",
                           "-q", zone], stdout=PIPE).communicate()
        cmd = [args.dsfromkey, "-f", "-"]
-        if lookaside:
-            cmd += ["-l", lookaside]
+        if args.lookaside:
+            cmd += ["-l", args.lookaside]
        cmd.append(zone)
        fp, _ = Popen(cmd, stdin=PIPE, stdout=PIPE).communicate(intods)

    for line in fp.splitlines():
-        klist.append(SECRR(line, lookaside))
+        klist.append(SECRR(line, args.lookaside))

    if len(klist) < 1:
        print("No DNSKEY records found in zone apex")
@@ -136,7 +144,8 @@ def check(zone, args, masterfile=None, lookaside=None):
                   rr.keyid, SECRR.hashalgs[rr.hashalg]))

    if not found:
-        print("No %s records were found for any DNSKEY" % ("DLV" if lookaside else "DS"))
+        print("No %s records were found for any DNSKEY" %
+                ("DLV" if args.lookaside else "DS"))

    return found

@@ -151,10 +160,6 @@ def parse_args():
    sbindir = 'bin' if os.name == 'nt' else 'sbin'

    parser.add_argument('zone', type=str, help='zone to check')
-    parser.add_argument('-f', '--file', dest='masterfile', type=str,
-                        help='zone master file')
-    parser.add_argument('-l', '--lookaside', dest='lookaside', type=str,
-                        help='DLV lookaside zone')
    parser.add_argument('-d', '--dig', dest='dig',
                        default=os.path.join(prefix(bindir), 'dig'),
                        type=str, help='path to \'dig\'')
@@ -162,6 +167,12 @@ def parse_args():
                        default=os.path.join(prefix(sbindir),
                                             'dnssec-dsfromkey'),
                        type=str, help='path to \'dig\'')
+    parser.add_argument('-f', '--file', dest='masterfile', type=str,
+                        help='zone master file')
+    parser.add_argument('-l', '--lookaside', dest='lookaside', type=str,
+                        help='DLV lookaside zone')
+    parser.add_argument('-s', '--dsset', dest='dssetfile', type=str,
+                        help='prepared DSset file')
    parser.add_argument('-v', '--version', action='version',
                        version=version)
    args = parser.parse_args()
@@ -178,5 +189,5 @@ def parse_args():
 ############################################################################
 def main():
    args = parse_args()
-    found = check(args.zone, args, args.masterfile, args.lookaside)
+    found = check(args.zone, args)
    exit(0 if found else 1)
@@ -516,7 +516,10 @@ Status will report whether serving of stale answers is currently enabled, disabl
 .PP
 \fBsecroots \fR\fB[\-]\fR\fB \fR\fB[\fIview \&.\&.\&.\fR]\fR
 .RS 4
-Dump the server\*(Aqs security roots and negative trust anchors for the specified views\&. If no view is specified, all views are dumped\&.
+Dump the security roots (i\&.e\&., trust anchors configured via
+\fBtrusted\-keys\fR,
+\fBmanaged\-keys\fR, or
+\fBdnssec\-validation auto\fR) and negative trust anchors for the specified views\&. If no view is specified, all views are dumped\&. Security roots will indicate whether they are configured as trusted keys, managed keys, or initializing managed keys (managed keys that have not yet been updated by a successful key refresh query)\&.
 .sp
 If the first argument is "\-", then the output is returned via the
 \fBrndc\fR
@@ -774,9 +774,15 @@
 	<term><userinput>secroots <optional>-</optional> <optional><replaceable>view ...</replaceable></optional></userinput></term>
 	<listitem>
 	  <para>
-	    Dump the server's security roots and negative trust anchors
-	    for the specified views.  If no view is specified, all views
-	    are dumped.
+	    Dump the security roots (i.e., trust anchors
+	    configured via <command>trusted-keys</command>,
+	    <command>managed-keys</command>, or
+	    <command>dnssec-validation auto</command>) and negative trust
+	    anchors for the specified views.  If no view is specified, all
+	    views are dumped.  Security roots will indicate whether
+	    they are configured as trusted keys, managed keys, or
+	    initializing managed keys (managed keys that have not yet
+	    been updated by a successful key refresh query).
 	  </para>
 	  <para>
 	    If the first argument is "-", then the output is
@@ -963,15 +969,15 @@
 	<listitem>
 	  <para>
 	    When called without arguments, display the current
-            values of the <command>tcp-initial-timeout</command>,
+	    values of the <command>tcp-initial-timeout</command>,
 	    <command>tcp-idle-timeout</command>,
 	    <command>tcp-keepalive-timeout</command> and
 	    <command>tcp-advertised-timeout</command> options.
-            When called with arguments, update these values. This
-            allows an administrator to make rapid adjustments when
-            under a denial of service attack.  See the descriptions of
-            these options in the BIND 9 Administrator Reference Manual
-            for details of their use.
+	    When called with arguments, update these values. This
+	    allows an administrator to make rapid adjustments when
+	    under a denial of service attack.  See the descriptions of
+	    these options in the BIND 9 Administrator Reference Manual
+	    for details of their use.
 	  </para>
 	</listitem>
      </varlistentry>
@@ -657,9 +657,15 @@
 <dt><span class="term"><strong class="userinput"><code>secroots [<span class="optional">-</span>] [<span class="optional"><em class="replaceable"><code>view ...</code></em></span>]</code></strong></span></dt>
 <dd>
 	  <p>
-	    Dump the server's security roots and negative trust anchors
-	    for the specified views.  If no view is specified, all views
-	    are dumped.
+	    Dump the security roots (i.e., trust anchors
+	    configured via <span class="command"><strong>trusted-keys</strong></span>,
+	    <span class="command"><strong>managed-keys</strong></span>, or
+	    <span class="command"><strong>dnssec-validation auto</strong></span>) and negative trust
+	    anchors for the specified views.  If no view is specified, all
+	    views are dumped.  Security roots will indicate whether
+	    they are configured as trusted keys, managed keys, or
+	    initializing managed keys (managed keys that have not yet
+	    been updated by a successful key refresh query).
 	  </p>
 	  <p>
 	    If the first argument is "-", then the output is
@@ -822,15 +828,15 @@
 <dd>
 	  <p>
 	    When called without arguments, display the current
-            values of the <span class="command"><strong>tcp-initial-timeout</strong></span>,
+	    values of the <span class="command"><strong>tcp-initial-timeout</strong></span>,
 	    <span class="command"><strong>tcp-idle-timeout</strong></span>,
 	    <span class="command"><strong>tcp-keepalive-timeout</strong></span> and
 	    <span class="command"><strong>tcp-advertised-timeout</strong></span> options.
-            When called with arguments, update these values. This
-            allows an administrator to make rapid adjustments when
-            under a denial of service attack.  See the descriptions of
-            these options in the BIND 9 Administrator Reference Manual
-            for details of their use.
+	    When called with arguments, update these values. This
+	    allows an administrator to make rapid adjustments when
+	    under a denial of service attack.  See the descriptions of
+	    these options in the BIND 9 Administrator Reference Manual
+	    for details of their use.
 	  </p>
 	</dd>
 <dt><span class="term"><strong class="userinput"><code>thaw [<span class="optional"><em class="replaceable"><code>zone</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em> [<span class="optional"><em class="replaceable"><code>view</code></em></span>]</span>]</span>]</code></strong></span></dt>
@@ -10,4 +10,4 @@ my $target = shift;
 my $file = shift;
 my $mtime = time - (stat $file)[9];
 die "bad mtime $mtime"
-	unless abs($mtime - $target) < 3;
+	unless abs($mtime - $target) < 10;
@@ -43,7 +43,7 @@ check_stderr() {
 		[ -s err.$n ] || return 0
 	fi
 	echo "D:stderr did not match '$err'"
-	sed 's/^/D:/' err
+	sed 's/^/D:/' err.$n
 	fail
 }

@@ -254,7 +254,7 @@ def create_response(msg):
 def sigterm(signum, frame):
    print ("Shutting down now...")
    os.remove('ans.pid')
-    running = 0
+    running = False
    sys.exit(0)

 ############################################################################
@@ -270,8 +270,17 @@ sock = 5300

 query4_socket = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
 query4_socket.bind((ip4, sock))
-query6_socket = socket.socket(socket.AF_INET6, socket.SOCK_DGRAM)
-query6_socket.bind((ip6, sock))
+
+havev6 = True
+try:
+    query6_socket = socket.socket(socket.AF_INET6, socket.SOCK_DGRAM)
+    try:
+        query6_socket.bind((ip6, sock))
+    except:
+        query6_socket.close()
+        havev6 = False
+except:
+    havev6 = False

 ctrl_socket = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
 ctrl_socket.bind((ip4, sock + 1))
@@ -284,14 +293,18 @@ pid = os.getpid()
 print (pid, file=f)
 f.close()

-running = 1
+running = True

 print ("Listening on %s port %d" % (ip4, sock))
-print ("Listening on %s port %d" % (ip6, sock))
+if havev6:
+    print ("Listening on %s port %d" % (ip6, sock))
 print ("Control channel on %s port %d" % (ip4, sock + 1))
 print ("Ctrl-c to quit")

-input = [query4_socket, query6_socket, ctrl_socket]
+if havev6:
+    input = [query4_socket, query6_socket, ctrl_socket]
+else:
+    input = [query4_socket, ctrl_socket]

 while running:
    try:
@@ -0,0 +1,11 @@
+/*
+ * Copyright (C) 2017  Internet Systems Consortium, Inc. ("ISC")
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ */
+
+options {
+	dnssec-lookaside . trust-anchor dlv.example.com;
+};
@@ -1,4 +1,4 @@
-# Copyright (C) 2005, 2007, 2010-2016  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2005, 2007, 2010-2017  Internet Systems Consortium, Inc. ("ISC")
 #
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -135,6 +135,7 @@ done
 if [ $ret != 0 ]; then echo "I:failed"; fi
 status=`expr $status + $ret`

+n=`expr $n + 1`
 echo "I: checking options allowed in inline-signing slaves ($n)"
 ret=0
 l=`$CHECKCONF bad-dnssec.conf 2>&1 | grep "dnssec-dnskey-kskonly.*requires inline" | wc -l`
@@ -327,5 +328,29 @@ diff good.zonelist checkconf.out$n  > diff.out$n || ret=1
 if [ $ret != 0 ]; then echo "I:failed"; ret=1; fi
 status=`expr $status + $ret`

+n=`expr $n + 1`
+echo "I: check that 'dnssec-lookaside auto;' generates a warning ($n)"
+ret=0
+$CHECKCONF warn-dlv-auto.conf > checkconf.out$n 2>/dev/null || ret=1
+grep "dnssec-lookaside 'auto' is no longer supported" checkconf.out$n > /dev/null || ret=1
+if [ $ret != 0 ]; then echo "I:failed"; ret=1; fi
+status=`expr $status + $ret`
+
+n=`expr $n + 1`
+echo "I: check that 'dnssec-lookaside . trust-anchor dlv.isc.org;' generates a warning ($n)"
+ret=0
+$CHECKCONF warn-dlv-dlv.isc.org.conf > checkconf.out$n 2>/dev/null || ret=1
+grep "dlv.isc.org has been shut down" checkconf.out$n > /dev/null || ret=1
+if [ $ret != 0 ]; then echo "I:failed"; ret=1; fi
+status=`expr $status + $ret`
+
+n=`expr $n + 1`
+echo "I: check that 'dnssec-lookaside . trust-anchor dlv.example.com;' doesn't generates a warning ($n)"
+ret=0
+$CHECKCONF good-dlv-dlv.example.com.conf > checkconf.out$n 2>/dev/null || ret=1
+[ -s checkconf.out$n ] && ret=1
+if [ $ret != 0 ]; then echo "I:failed"; ret=1; fi
+status=`expr $status + $ret`
+
 echo "I:exit status: $status"
 [ $status -eq 0 ] || exit 1
@@ -1,12 +1,10 @@
 #!/bin/sh
 #
-# Copyright (C) 2012-2014, 2016  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2012-2014, 2016, 2017  Internet Systems Consortium, Inc. ("ISC")
 #
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.

-# $Id$
-
 rm -f checkds.*
 rm -f ns*/named.lock
@@ -1,13 +1,11 @@
 #!/usr/bin/perl
 #
-# Copyright (C) 2014, 2016  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2014, 2016, 2017  Internet Systems Consortium, Inc. ("ISC")
 #
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.

-# $Id$
-
 my $arg;
 my $ext;
 my $file;
@@ -1,14 +1,11 @@
 #!/bin/sh
 #
-# Copyright (C) 2012, 2013, 2016  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2012, 2013, 2016, 2017  Internet Systems Consortium, Inc. ("ISC")
 #
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.

-# $Id$
-
-
 while [ "$#" != 0 ]; do
    case $1 in
    +*) shift ;;
@@ -0,0 +1,121 @@
+; File written on Thu Oct  5 23:44:34 2017
+; dnssec_signzone version 9.12.0a1
+prep.example.		300	IN SOA	ns1.prep.example. hostmaster.prep.example. (
+					1          ; serial
+					2000       ; refresh (33 minutes 20 seconds)
+					2000       ; retry (33 minutes 20 seconds)
+					1814400    ; expire (3 weeks)
+					3600       ; minimum (1 hour)
+					)
+			300	RRSIG	SOA 8 2 300 (
+					20171105054434 20171006054434 19260 prep.example.
+					1fX0z7Swu4gMPews/ZE8bzNg+JXNedFBDGIH
+					PTSfVQtVLIvRWpME+PylX7MdVMZE/PST+x4/
+					mWyveyjetEOo7/7aQL236FfI0y6TxQFy7HwC
+					FMieqoQCUluuKOvToxg4vUp4GOdlUGbqC63h
+					DbX5Z37VptJXLkt4niF4Kl2iD+U9/bk7HAEU
+					4zDiKroYnusGKfVB9xAWddzoHdLxhVuPi7ut
+					328suPdgX0bfs7uB+y4cikhGzAmPpNMlGHju
+					qYG74NcFGQNutLB7ayx/m87t7mTty7jbNKm3
+					QWJSPf5IR8/kmzAi8HMnapY5vUmm+hX8JOfU
+					UtH7i0iEsUqRbEwu5A== )
+			300	NS	ns1.prep.example.
+			300	RRSIG	NS 8 2 300 (
+					20171105054434 20171006054434 19260 prep.example.
+					u5sU2cfqNqIyCLw18ZNnFw28/GyRt0EOiPYS
+					dygmpfMDrvDaxjiiai8zWYjnl/E3qzVH9Zku
+					07lEDORZdVb0uCDe1NynjAyw4AHps85cAwVc
+					8HTSbzdVZsQTELpunYFJffh24PDr9unw7KOY
+					jzTP6qNedJ1uM54TOr177zfmBh7N2fkAoGyV
+					NjvTKrlgDYGNIn8/YMgHb4sNgyfe54MYY00f
+					kehVxfKnRCgDsbJ0Pk6jhBMCQWvOh8jG8WyV
+					ElAa/eMqlxUC1idF8ydWefjsI/7lPcjSalw9
+					qZw4CDCLHHZy0TOSmCYRRZuIeVXzBfDPJyi4
+					2A3iLntKFJ4AOLFMJg== )
+			3600	NSEC	ns1.prep.example. NS SOA RRSIG NSEC DNSKEY
+			3600	RRSIG	NSEC 8 2 3600 (
+					20171105054434 20171006054434 19260 prep.example.
+					Aed99/jdG82YAkKVWjoKOsAGtB3JnyKkCaAq
+					zgMrYkXU41y3KDCAmGzooGPQY7NN+WxX7FJ2
+					1nXkgljma/azgpsbi9ssneFtv7PPFClVmN+u
+					j+mM4MK/ZR7eJOsMqETg4PAO5VAh6c/GVmyA
+					RD/m6EhJVZEjPfLWbDoC4hVAgem7DP/NMjyI
+					GfztpDjMmyLQyv6tL+UEXSJHGp3ZEa5Z5i7X
+					Nl/bRTUlZs7L4rTgoqHv6LEmsXKAf9rZYq4b
+					eP6GF9I1Ry41MfHLc7lPUmtR38ErEsM5uGzw
+					trCQYEFhuRWUBxZ8OSL2EZK9rUBXZX+cwK/8
+					ZP7mIfDfljkXPQcmow== )
+			3600	DNSKEY	256 3 8 (
+					AwEAAfMzj6aZIgZDVcpH1pKOtq998E85+nEY
+					YJa0lLS8+QTCC1Efke8GLwsXT0IPTuwnOuXM
+					RjySirab0NuEr69T8KP/43YxcRdmCg89mjjN
+					szoVPPstC9xBKVOc0pRMDF7sfsTrSye3RY7+
+					Z6uZEH5FOAkz2hNbJJHOn4HpNUhLPJGRauhf
+					0evamwUmQ/mlhkVW5q4WmqPCDMNY3K6XtkEm
+					cvm8n9ZCXC9Z5AX6KpynujzLdKyxpdGqUk6r
+					lavp9ILPpRKoTZDX+2q1pDgP5cDndwtgNSvU
+					DBQZoD0psS2cyB3PHo+dPwwpEyM//ZSKsH9m
+					e85Ti0413TOWFyFd/jUOUA8=
+					) ; ZSK; alg = RSASHA256 ; key id = 19260
+			3600	DNSKEY	257 3 8 (
+					AwEAAbV8X06Qvk350aZ6eZ1d7WbT1H/Y0Sv7
+					qAdbk5fbYIKpMvZ8D9xqoTHgD0z0uCgWWIcm
+					/xyKBfmax76oLwMBpR/kdtuJz0irgFITnJCH
+					pEfR9AJ/Mfm7NyMglq+/39I03E1/LXvpXQLG
+					tg+Mo/2CUE5sbG31jmPNK/2J8RMESkIi87fW
+					azZU/oyUEtECE5PGbdyw+4PacAsXNjnwl30T
+					aatL277wX4pt+IUPdE6EIph3t+dxXJ7OpHgW
+					8g+YSHLlCImLVapdg3oD/cs6ncaBq9z7la5Y
+					dHNw2QAIAvQ11EsonrkonPqO6zNVZAVdT2VB
+					X5YzGAoCFUvbCvlnl2a7SxM=
+					) ; KSK; alg = RSASHA256 ; key id = 65482
+			3600	RRSIG	DNSKEY 8 2 3600 (
+					20171105054434 20171006054434 19260 prep.example.
+					pPw81pJ3PeF+tqEswTul9N8Qsl9JKgK4v8SV
+					lPfP0pnlMBMbtMFFkx5ZmhQg3Z3U8SdE64Bt
+					C5St3qItyyKdTQ0Rbm9mfV6twxDB8lVry8F7
+					Pv7gJmmcWzBcbLGcrXIrVNSZhigkemQXTElj
+					P8y1j7kaNFWBWbDMn7KesiZ9BiC6sqvuKa3R
+					wSofjwXTESspWZP0NtXr5ymaBIMR9UtNj5Wh
+					jm1+tg6BxNBKxhCHlSC0ltPS/qq9J1ZUmtJz
+					sj/EAFfPVJVuEveebMvi1oDWPTgajO9+EHl4
+					ELrgnQHCgaybMzbpd/A5+Tr1hQkv48I8Mb0/
+					8LJ2/6xrvJm64yRteg== )
+			3600	RRSIG	DNSKEY 8 2 3600 (
+					20171105054434 20171006054434 65482 prep.example.
+					WeIWiC9SnBe2+UocVjpap62O8Rz+iljwJiu9
+					VlGUwct3Vydq4/4FVAKdPklXV5cYbBLhO2MB
+					3R4toX8RNU/0Ny8DnugQzLKvVfg0xoyU/UAJ
+					k4aWa/vPivSLGouLQPiNp71bdXN4LB/2xmzu
+					cPYXzS9ePpwCOp/9JLoNjBSMQkfjfWAcaNtj
+					1DKDmHHL1sPMizninxSJLQOAKb+JwUAjAkOM
+					O1JqwkB12/IZuzxN5hly+uNsbFFxPzQkcnJ4
+					5bhzxuh5D/JRXW0nF5aO4aR+9X+lSUpDJQZ1
+					5fOt1cybZCn/ag68RA92zrnisdbrggJGS003
+					wn/VKbLVfFj3eQrfNA== )
+ns1.prep.example.	300	IN A	1.1.1.1
+			300	RRSIG	A 8 3 300 (
+					20171105054434 20171006054434 19260 prep.example.
+					QUyDyJVk3JGEq+VTZtY3firzsRqOA0LUm3Tf
+					/fnemQBeOlMda2ErA7DqYVriIGfM8jph416E
+					YX8SKAZXGEAlsEbC9cWBVyc5TYH6tZ43sV51
+					55kGTiUY92NnrH10Q+m2SLAEEaKCA/cgBwOR
+					tN2Wb1meHgiLbGYN2LbANfDQzoEk4AYAgT6r
+					wDKVVg/V9Ed7JnCnBQc9MN9+LQ3h4NBGUiEY
+					mr7HX2w+yzqcGFNLI1aFPe2IwFt120QPLyyl
+					cZgc6FUBX4YCnWoCb0aFyyOT76AQkKF5YBRn
+					gAv6S8q1pZ/0B5w4gjaLEGlts3LG0bxZ1GJd
+					gCQMEhgYgyXUchTtZA== )
+			3600	NSEC	prep.example. A RRSIG NSEC
+			3600	RRSIG	NSEC 8 3 3600 (
+					20171105054434 20171006054434 19260 prep.example.
+					rDWN40u1a3DSzWOrS+4YR2XOxaem0BAQ/glN
+					QkXNDew1WsZo3fe0IHIhDKlJ/5MJAfAHq8Xs
+					A5UGUw2efoNAN/0LuWsI/9IPm4dwQOXiTCly
+					uxugXf5islPYyvn1Z14ay/7/2P3W6HZknXzo
+					lZFpwqfFZQCxz7c/1aH+2ntAMeqx8LHuewSr
+					Rz/sLsSiCcZQ6NMWnZdoC5SGy4CTcIIPPS8z
+					9dQ6QYTC5iq4MKRfyJUyvODyU9be4e6jbo5b
+					mjRcov4ttbImhD5jrLAZIfjO6DSazGNVFf/x
+					6rjxjrc8SISPkt2xYwcOlYch9OZuoH86wcZu
+					3Don6yAnLDYDrZylAA== )
@@ -0,0 +1,2 @@
+prep.example.		IN DS 65482 8 1 F3673708FBADDEC3EB55933E2E393ACE85EAC2BB
+prep.example.		IN DS 65482 8 2 51A7C97AAC42803DA515D1CAFEE28031A5018F6345F12F4B6C1B6D20 02B59820
@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# Copyright (C) 2012-2014, 2016  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2012-2014, 2016, 2017  Internet Systems Consortium, Inc. ("ISC")
 #
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -171,6 +171,15 @@ n=`expr $n + 1`
 if [ $ret != 0 ]; then echo "I:failed"; fi
 status=`expr $status + $ret`

+echo "I:checking with prepared dsset file ($n)"
+ret=0
+$CHECKDS -f prep.example.db -s prep.example.ds.db prep.example > checkds.out.$n || ret=1
+grep 'SHA-1.*found' checkds.out.$n > /dev/null 2>&1 || ret=1
+grep 'SHA-256.*found' checkds.out.$n > /dev/null 2>&1 || ret=1
+n=`expr $n + 1`
+if [ $ret != 0 ]; then echo "I:failed"; fi
+status=`expr $status + $ret`
+
 if [ $status = 0 ]; then $SHELL clean.sh; fi
 echo "I:exit status: $status"
 [ $status -eq 0 ] || exit 1
@@ -186,6 +186,19 @@ else
 	}
 fi

+#
+# Useful functions in test scripts
+#
+
+# nextpart: read everything that's been appended to a file since the
+# last time 'nextpart' was called.
+nextpart () {
+    [ -f $1.prev ] || echo "0" > $1.prev
+    prev=`cat $1.prev`
+    awk "NR > $prev "'{ print }
+         END          { print NR > "/dev/stderr" }' $1 2> $1.prev
+}
+
 #
 # Export command paths
 #
@@ -58,6 +58,8 @@ MDIG=$TOP/Build/$VSCONF/mdig@EXEEXT@
 NZD2NZF=$TOP/Build/$VSCONF/named-nzd2nzf@EXEEXT@
 FSTRM_CAPTURE=@FSTRM_CAPTURE@
 FEATURETEST=$TOP/Build/$VSCONF/feature-test@EXEEXT@
+SAMPLEUPDATE=$TOP/Build/$VSCONF/update@EXEEXT@
+
 # to port WIRETEST=$TOP/Build/$VSCONF/wire_test@EXEEXT@

 # this is given as argument to native WIN32 executables
@@ -176,6 +178,19 @@ echoinfo () {
        printf "${COLOR_INFO}%s${COLOR_NONE}\n" "$*"
 }

+#
+# Useful functions in test scripts
+#
+
+# nextpart: read everything that's been appended to a file since the
+# last time 'nextpart' was called.
+nextpart () {
+    [ -f $1.prev ] || echo "0" > $1.prev
+    prev=`cat $1.prev`
+    awk "NR > $prev "'{ print }
+         END          { print NR > "/dev/stderr" }' $1 2> $1.prev
+}
+
 #
 # Export command paths
 #
@@ -211,6 +226,7 @@ export RANDFILE
 export RESOLVE
 export RNDC
 export RRCHECKER
+export SAMPLEUPDATE
 export SIGNER
 export SUBDIRS
 export TESTSOCK6
@@ -35,6 +35,19 @@ PIDFILE="${THISDIR}/${CONFDIR}/named.pid"
 myRNDC="$RNDC -c ${THISDIR}/${CONFDIR}/rndc.conf"
 myNAMED="$NAMED -c ${THISDIR}/${CONFDIR}/named.conf -m record,size,mctx -T clienttest -T nosyslog -d 99 -X named.lock -U 4"

+# Test given condition.  If true, test again after a second.  Used for testing
+# filesystem-dependent conditions in order to prevent false negatives caused by
+# directory contents not being synchronized immediately after rename() returns.
+test_with_retry() {
+	if test "$@"; then
+		sleep 1
+		if test "$@"; then
+			return 0
+		fi
+	fi
+	return 1
+}
+
 waitforpidfile() {
 	for _w in 1 2 3 4 5 6 7 8 9 10
 	do
@@ -48,9 +61,10 @@ n=0

 cd $CONFDIR

-n=`expr $n + 1`
-echo "I:testing log file validity (named -g + only plain files allowed) ($n)"
+echo "I:testing log file validity (named -g + only plain files allowed)"

+n=`expr $n + 1`
+echo "I: testing plain file (named -g) ($n)"
 # First run with a known good config.
 echo > $PLAINFILE
 cp $PLAINCONF named.conf
@@ -58,9 +72,9 @@ $myRNDC reconfig > rndc.out.test$n 2>&1
 grep "reloading configuration failed" named.run > /dev/null 2>&1
 if [ $? -ne 0 ]
 then
-	echo "I: testing plain file succeeded"
+	echo "I:  testing plain file succeeded"
 else
-	echo "I: testing plain file failed (unexpected)"
+	echo "I:  testing plain file failed (unexpected)"
 	echo "I:exit status: 1"
 	exit 1 
 fi
@@ -79,14 +93,14 @@ then
 	grep "checking logging configuration failed: invalid file" named.run > /dev/null 2>&1
 	if [ $? -ne 0 ]
 	then
-		echo "I: testing directory as file succeeded (UNEXPECTED)"
+		echo "I:  testing directory as file succeeded (UNEXPECTED)"
 		echo "I:exit status: 1"
 		exit 1
 	else
-		echo "I: testing directory as log file failed (expected)"
+		echo "I:  testing directory as log file failed (expected)"
 	fi
 else
-	echo "I: skipping directory test (unable to create directory)"
+	echo "I:  skipping directory test (unable to create directory)"
 fi

 # Now try pipe file, expect failure
@@ -103,14 +117,14 @@ then
 	grep "checking logging configuration failed: invalid file" named.run  > /dev/null 2>&1
 	if [ $? -ne 0 ]
 	then
-		echo "I: testing pipe file as log file succeeded (UNEXPECTED)"
+		echo "I:  testing pipe file as log file succeeded (UNEXPECTED)"
 		echo "I:exit status: 1"
 		exit 1
 	else
-		echo "I: testing pipe file as log file failed (expected)"
+		echo "I:  testing pipe file as log file failed (expected)"
 	fi
 else
-	echo "I: skipping pipe test (unable to create pipe)"
+	echo "I:  skipping pipe test (unable to create pipe)"
 fi

 # Now try symlink file to plain file, expect success 
@@ -129,14 +143,14 @@ then
 	grep "reloading configuration failed" named.run > /dev/null 2>&1
 	if [ $? -ne 0 ]
 	then
-		echo "I: testing symlink to plain file succeeded"
+		echo "I:  testing symlink to plain file succeeded"
 	else
-		echo "I: testing symlink to plain file failed (unexpected)"
+		echo "I:  testing symlink to plain file failed (unexpected)"
 		echo "I:exit status: 1"
 		exit 1
 	fi
 else
-	echo "I: skipping symlink test (unable to create symlink)"
+	echo "I:  skipping symlink test (unable to create symlink)"
 fi
 # Stop the server and run through a series of tests with various config
 # files while controlling the stop/start of the server.
@@ -155,9 +169,10 @@ fi

 status=0

-n=`expr $n + 1`
-echo "I:testing log file validity (only plain files allowed) ($n)"
+echo "I:testing log file validity (only plain files allowed)"

+n=`expr $n + 1`
+echo "I: testing plain file (named -g) ($n)"
 # First run with a known good config.
 echo > $PLAINFILE
 cp $PLAINCONF named.conf
@@ -165,9 +180,9 @@ $myRNDC reconfig > rndc.out.test$n 2>&1
 grep "reloading configuration failed" named.run > /dev/null 2>&1
 if [ $? -ne 0 ]
 then
-	echo "I: testing plain file succeeded"
+	echo "I:  testing plain file succeeded"
 else
-	echo "I: testing plain file failed (unexpected)"
+	echo "I:  testing plain file failed (unexpected)"
 	echo "I:exit status: 1"
 	exit 1 
 fi
@@ -186,14 +201,14 @@ then
 	grep "configuring logging: invalid file" named.run > /dev/null 2>&1
 	if [ $? -ne 0 ]
 	then
-		echo "I: testing directory as file succeeded (UNEXPECTED)"
+		echo "I:  testing directory as file succeeded (UNEXPECTED)"
 		echo "I:exit status: 1"
 		exit 1
 	else
-		echo "I: testing directory as log file failed (expected)"
+		echo "I:  testing directory as log file failed (expected)"
 	fi
 else
-	echo "I: skipping directory test (unable to create directory)"
+	echo "I:  skipping directory test (unable to create directory)"
 fi

 # Now try pipe file, expect failure
@@ -210,14 +225,14 @@ then
 	grep "configuring logging: invalid file" named.run  > /dev/null 2>&1
 	if [ $? -ne 0 ]
 	then
-		echo "I: testing pipe file as log file succeeded (UNEXPECTED)"
+		echo "I:  testing pipe file as log file succeeded (UNEXPECTED)"
 		echo "I:exit status: 1"
 		exit 1
 	else
-		echo "I: testing pipe file as log file failed (expected)"
+		echo "I:  testing pipe file as log file failed (expected)"
 	fi
 else
-	echo "I: skipping pipe test (unable to create pipe)"
+	echo "I:  skipping pipe test (unable to create pipe)"
 fi

 # Now try symlink file to plain file, expect success 
@@ -237,18 +252,18 @@ then
 	grep "reloading configuration failed" named.run > /dev/null 2>&1
 	if [ $? -ne 0 ]
 	then
-		echo "I: testing symlink to plain file succeeded"
+		echo "I:  testing symlink to plain file succeeded"
 	else
-		echo "I: testing symlink to plain file failed (unexpected)"
+		echo "I:  testing symlink to plain file failed (unexpected)"
 		echo "I:exit status: 1"
 		exit 1
 	fi
 else
-	echo "I: skipping symlink test (unable to create symlink)"
+	echo "I:  skipping symlink test (unable to create symlink)"
 fi

 n=`expr $n + 1`
-echo "I: testing default logfile using named -L file ($n)"
+echo "I:testing default logfile using named -L file ($n)"
 # Now stop the server again and test the -L option
 rm -f $DLFILE
 $PERL ../../stop.pl .. ns1
@@ -256,7 +271,7 @@ if ! test -f $PIDFILE; then
 	cp $PLAINCONF named.conf
 	$myNAMED -L $DLFILE > /dev/null 2>&1
 	if [ $? -ne 0 ]; then
-		echo "I:failed to start $myNAMED"
+		echo "I: failed to start $myNAMED"
 		echo "I:exit status: $status"
 		exit $status
 	fi
@@ -272,7 +287,7 @@ if ! test -f $PIDFILE; then
 		exit 1
 	fi
 else
-	echo "I:failed to cleanly stop $myNAMED"
+	echo "I: failed to cleanly stop $myNAMED"
 	echo "I:exit status: 1"
 	exit 1
 fi
@@ -284,9 +299,9 @@ echo "I: testing iso8601 timestamp ($n)"
 cp $ISOCONF named.conf
 $myRNDC reconfig > rndc.out.test$n 2>&1
 if grep '^....-..-..T..:..:..\.... ' $ISOFILE > /dev/null; then
-	echo "I: testing iso8601 timestamp succeeded"
+	echo "I:  testing iso8601 timestamp succeeded"
 else
-	echo "I: testing iso8601 timestamp failed"
+	echo "I:  testing iso8601 timestamp failed"
 	status=`expr $status + 1`
 fi

@@ -295,14 +310,14 @@ echo "I: testing iso8601-utc timestamp ($n)"
 cp $ISOCONFUTC named.conf
 $myRNDC reconfig > rndc.out.test$n 2>&1
 if grep '^....-..-..T..:..:..\....Z' $ISOUTCFILE > /dev/null; then
-	echo "I: testing iso8601-utc timestamp succeeded"
+	echo "I:  testing iso8601-utc timestamp succeeded"
 else
-	echo "I: testing iso8601-utc timestamp failed"
+	echo "I:  testing iso8601-utc timestamp failed"
 	status=`expr $status + 1`
 fi

 n=`expr $n + 1`
-echo "I: testing explict versions ($n)"
+echo "I: testing explicit versions ($n)"
 cp $VERSCONF named.conf
 # a seconds since epoch version number
 touch $VERSFILE.1480039317
@@ -313,27 +328,27 @@ t2=`$PERL -e 'print time()."\n";'`
 t=`expr ${t2:-0} - ${t1:-0}`
 if test ${t:-1000} -gt 5
 then
-        echo "I: testing explict versions failed cleanup of old entries took too long ($t secs)"
+        echo "I:  testing explicit versions failed: cleanup of old entries took too long ($t secs)"
 	status=`expr $status + 1`
 fi 
 if ! grep "status: NOERROR" dig.out.test$n > /dev/null
 then
-	echo "I: testing explict versions failed DiG lookup failed"
+	echo "I:  testing explicit versions failed: DiG lookup failed"
 	status=`expr $status + 1`
 fi
-if test -f $VERSFILE.1480039317
+if test_with_retry -f $VERSFILE.1480039317
 then
-	echo "I: testing explict versions failed $VERSFILE.1480039317 not removed"
+	echo "I:  testing explicit versions failed: $VERSFILE.1480039317 not removed"
 	status=`expr $status + 1`
 fi
-if test -f $VERSFILE.5
+if test_with_retry -f $VERSFILE.5
 then
-	echo "I: testing explict versions failed $VERSFILE.5 exists"
+	echo "I:  testing explicit versions failed: $VERSFILE.5 exists"
 	status=`expr $status + 1`
 fi
-if test ! -f $VERSFILE.4
+if test_with_retry ! -f $VERSFILE.4
 then
-	echo "I: testing explict versions failed $VERSFILE.4 does not exist"
+	echo "I:  testing explicit versions failed: $VERSFILE.4 does not exist"
 	status=`expr $status + 1`
 fi

@@ -349,17 +364,17 @@ t2=`$PERL -e 'print time()."\n";'`
 t=`expr ${t2:-0} - ${t1:-0}`
 if test ${t:-1000} -gt 5
 then
-        echo "I:  testing timestamped versions failed cleanup of old entries took too long ($t secs)"
+        echo "I:  testing timestamped versions failed: cleanup of old entries took too long ($t secs)"
 	status=`expr $status + 1`
 fi 
 if ! grep "status: NOERROR" dig.out.test$n > /dev/null
 then
-	echo "I:  testing timestamped versions failed DiG lookup failed"
+	echo "I:  testing timestamped versions failed: DiG lookup failed"
 	status=`expr $status + 1`
 fi
-if test -f $TSFILE.1480039317
+if test_with_retry -f $TSFILE.1480039317
 then
-	echo "I:  testing timestamped versions failed $TSFILE.1480039317 not removed"
+	echo "I:  testing timestamped versions failed: $TSFILE.1480039317 not removed"
 	status=`expr $status + 1`
 fi

@@ -375,22 +390,22 @@ t2=`$PERL -e 'print time()."\n";'`
 t=`expr ${t2:-0} - ${t1:-0}`
 if test ${t:-1000} -gt 5
 then
-        echo "I: testing unlimited versions failed took too long ($t secs)"
+        echo "I:  testing unlimited versions failed: took too long ($t secs)"
 	status=`expr $status + 1`
 fi 
 if ! grep "status: NOERROR" dig.out.test$n > /dev/null
 then
-	echo "I: testing unlimited versions failed DiG lookup failed"
+	echo "I:  testing unlimited versions failed: DiG lookup failed"
 	status=`expr $status + 1`
 fi
-if test ! -f $UNLIMITEDFILE.1480039317
+if test_with_retry ! -f $UNLIMITEDFILE.1480039317
 then
-	echo "I: testing unlimited versions failed $UNLIMITEDFILE.1480039317 removed"
+	echo "I:  testing unlimited versions failed: $UNLIMITEDFILE.1480039317 removed"
 	status=`expr $status + 1`
 fi
-if test ! -f $UNLIMITEDFILE.4
+if test_with_retry ! -f $UNLIMITEDFILE.4
 then
-	echo "I: testing unlimited versions failed $UNLIMITEDFILE.4 does not"
+	echo "I:  testing unlimited versions failed: $UNLIMITEDFILE.4 does not exist"
 	status=`expr $status + 1`
 fi

@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# Copyright (C) 2005, 2007, 2011-2014, 2016  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2005, 2007, 2011-2014, 2016, 2017  Internet Systems Consortium, Inc. ("ISC")
 #
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -238,6 +238,16 @@ done
 [ $ret -eq 0 ] || echo "I:failed"
 status=`expr $status + $ret`

+# stomp on the file header
+echo "I:checking corrupt map files fail to load (bad file header)"
+ret=0
+./named-compilezone -D -f text -F map -o map.5 example.nil baseline.txt > /dev/null
+cp map.5 badmap
+stomp badmap 0 32 99
+./named-compilezone -D -f map -F text -o text.5 example.nil badmap > /dev/null
+[ $? = 1 ] || ret=1
+[ $ret -eq 0 ] || echo "I:failed"
+status=`expr $status + $ret`
 # stomp on the file data so it hashes differently.
 # these are small and subtle changes, so that the resulting file
 # would appear to be a legitimate map file and would not trigger an
@@ -245,7 +255,6 @@ status=`expr $status + $ret`
 # load because of a SHA1 hash mismatch.
 echo "I:checking corrupt map files fail to load (bad node header)"
 ret=0
-./named-compilezone -D -f text -F map -o map.5 example.nil baseline.txt > /dev/null
 cp map.5 badmap
 stomp badmap 2754 2 99
 ./named-compilezone -D -f map -F text -o text.5 example.nil badmap > /dev/null
@@ -16,16 +16,8 @@ is used so it will send TAT queries once per second.

 ns3 is a validator with a broken key in managed-keys.

-Tests TODO:
+ns4 is a validator with a deliberately broken managed-keys.bind and
+managed-keys.jnl, causing RFC 5011 initialization to fail.

- initial working KSK
-
-TODO: test using delv with new trusted key too
-
- introduce a REVOKE bit
-
- later remove a signature
-
- corrupt a signature
-
-TODO: also same things with dlv auto updates of trust anchor
+ns5 is a validator which is prevented from getting a response from the
+root server, causing key refresh queries to fail.
@@ -10,8 +10,10 @@ rm -f */K* */*.signed */trusted.conf */*.jnl */*.bk
 rm -f dsset-. ns1/dsset-.
 rm -f ns*/named.lock
 rm -f */managed-keys.bind* */named.secroots
-rm -f */managed.conf ns1/managed.key ns1/managed.key.id
-rm -f */named.memstats */named.run
+rm -f */managed*.conf ns1/managed.key ns1/managed.key.id
+rm -f */named.memstats */named.run */named.run.prev
 rm -f dig.out* delv.out* rndc.out* signer.out*
 rm -f ns1/named.secroots ns1/root.db.signed* ns1/root.db.tmp
 rm -f ns1/named.conf
+rm -rf ns4/nope
+rm -f ns5/named.args
@@ -10,6 +10,11 @@

 controls { /* empty */ };

+acl allowed {
+	! 10.53.0.5;
+	any;
+};
+
 options {
 	query-source address 10.53.0.1;
 	notify-source 10.53.0.1;
@@ -22,6 +27,7 @@ options {
 	notify no;
 	dnssec-enable yes;
 	dnssec-validation yes;
+	allow-query { allowed; };
 };

 key rndc_key {
@@ -10,6 +10,11 @@

 controls { /* empty */ };

+acl allowed {
+	! 10.53.0.5;
+	any;
+};
+
 options {
 	query-source address 10.53.0.1;
 	notify-source 10.53.0.1;
@@ -22,6 +27,7 @@ options {
 	notify no;
 	dnssec-enable yes;
 	dnssec-validation yes;
+	allow-query { allowed; };
 };

 key rndc_key {
@@ -0,0 +1,39 @@
+/*
+ * Copyright (C) 2017  Internet Systems Consortium, Inc. ("ISC")
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ */
+
+// NS1
+
+controls { /* empty */ };
+
+options {
+	query-source address 10.53.0.1;
+	notify-source 10.53.0.1;
+	transfer-source 10.53.0.1;
+	port 5300;
+	pid-file "named.pid";
+	listen-on { 10.53.0.1; };
+	listen-on-v6 { none; };
+	recursion no;
+	notify no;
+	dnssec-enable yes;
+	dnssec-validation yes;
+};
+
+key rndc_key {
+	secret "1234abcd8765";
+	algorithm hmac-sha256;
+};
+
+controls {
+	inet 10.53.0.1 port 9953 allow { any; } keys { rndc_key; };
+};
+
+zone "." {
+	type master;
+	file "root.db.signed";
+};
@@ -1,10 +1,10 @@
-; Copyright (C) 2015, 2016  Internet Systems Consortium, Inc. ("ISC")
+; Copyright (C) 2015-2017  Internet Systems Consortium, Inc. ("ISC")
 ;
 ; This Source Code Form is subject to the terms of the Mozilla Public
 ; License, v. 2.0. If a copy of the MPL was not distributed with this
 ; file, You can obtain one at http://mozilla.org/MPL/2.0/.

-$TTL 2
+$TTL 20
 . 			IN SOA	gson.nominum.com. a.root.servers.nil. (
 				2000042100   	; serial
 				600         	; refresh
@@ -28,6 +28,8 @@ managed-keys {
 EOF
 ' > managed.conf
 cp managed.conf ../ns2/managed.conf
+cp managed.conf ../ns4/managed.conf
+cp managed.conf ../ns5/managed.conf

 # Configure a trusted key statement (used by delve)
 cat $keyname.key | grep -v '^; ' | $PERL -n -e '
@@ -1 +1 @@
-m record,size,mctx -T clienttest -c named.conf -d 99 -X named.lock -g -T mkeytimers=2/20/40
+-m record,size,mctx -T clienttest -c named.conf -d 99 -X named.lock -g -T mkeytimers=5/10/20 -T tat=1
@@ -1 +1 @@
-m record,size,mctx -T clienttest -c named.conf -d 99 -X named.lock -g -T mkeytimers=2/20/40 -T tat=1
+-m record,size,mctx -T clienttest -c named.conf -d 99 -X named.lock -g -T mkeytimers=5/10/20
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2015, 2016  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2015-2017  Internet Systems Consortium, Inc. ("ISC")
 *
 * This Source Code Form is subject to the terms of the Mozilla Public
 * License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -23,6 +23,7 @@ options {
 	dnssec-enable yes;
 	dnssec-validation yes;
 	bindkeys-file "managed.conf";
+	trust-anchor-telemetry no;
 };

 key rndc_key {
@@ -0,0 +1,41 @@
+/*
+ * Copyright (C) 2017  Internet Systems Consortium, Inc. ("ISC")
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ */
+
+// NS4
+
+controls { /* empty */ };
+
+options {
+	query-source address 10.53.0.4;
+	notify-source 10.53.0.4;
+	transfer-source 10.53.0.4;
+	port 5300;
+	pid-file "named.pid";
+	listen-on { 10.53.0.4; };
+	listen-on-v6 { none; };
+	recursion yes;
+	notify no;
+	dnssec-enable yes;
+	dnssec-validation auto;
+	bindkeys-file "managed.conf";
+	managed-keys-directory "nope";
+};
+
+key rndc_key {
+	secret "1234abcd8765";
+	algorithm hmac-sha256;
+};
+
+controls {
+	inet 10.53.0.4 port 9953 allow { any; } keys { rndc_key; };
+};
+
+zone "." {
+	type hint;
+	file "../../common/root.hint";
+};
@@ -0,0 +1,38 @@
+/*
+ * Copyright (C) 2017  Internet Systems Consortium, Inc. ("ISC")
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ */
+
+// NS5
+
+options {
+	query-source address 10.53.0.5;
+	notify-source 10.53.0.5;
+	transfer-source 10.53.0.5;
+	port 5300;
+	pid-file "named.pid";
+	listen-on { 10.53.0.5; };
+	listen-on-v6 { none; };
+	recursion yes;
+	notify no;
+	dnssec-enable yes;
+	dnssec-validation auto;
+	bindkeys-file "managed.conf";
+};
+
+key rndc_key {
+	secret "1234abcd8765";
+	algorithm hmac-sha256;
+};
+
+controls {
+	inet 10.53.0.5 port 9953 allow { any; } keys { rndc_key; };
+};
+
+zone "." {
+	type hint;
+	file "../../common/root.hint";
+};
@@ -0,0 +1 @@
+-m record,size,mctx -T clienttest -c named.conf -d 99 -X named.lock -g
@@ -0,0 +1 @@
+-m record,size,mctx -T clienttest -c named.conf -d 99 -X named.lock -g -T mkeytimers=2/20/40
@@ -14,5 +14,14 @@ $SHELL clean.sh
 test -r $RANDFILE || $GENRANDOM 800 $RANDFILE

 cp ns1/named1.conf ns1/named.conf
+cp ns5/named1.args ns5/named.args

-cd ns1 && $SHELL sign.sh
+( cd ns1 && $SHELL sign.sh )
+
+cp ns2/managed.conf ns2/managed1.conf
+
+cd ns4
+mkdir nope
+touch nope/managed-keys.bind
+touch nope/managed.keys.bind.jnl
+chmod 444 nope/*
@@ -9,6 +9,74 @@
 SYSTEMTESTTOP=..
 . $SYSTEMTESTTOP/conf.sh

+wait_for_log() {
+	msg=$1
+	file=$2
+	for i in 1 2 3 4 5 6 7 8 9 10; do
+		nextpart "$file" | grep "$msg" > /dev/null && return
+		sleep 1
+	done
+	echo "I: exceeded time limit waiting for '$msg' in $file"
+	ret=1
+}
+
+mkeys_reconfig_on() {
+	nsidx=$1
+	$RNDC -c ../common/rndc.conf -s 10.53.0.${nsidx} -p 9953 reconfig . | sed "s/^/I: ns${nsidx} /"
+}
+
+mkeys_reload_on() {
+	nsidx=$1
+	nextpart ns${nsidx}/named.run > /dev/null
+	$RNDC -c ../common/rndc.conf -s 10.53.0.${nsidx} -p 9953 reload . | sed "s/^/I: ns${nsidx} /"
+	wait_for_log "loaded serial" ns${nsidx}/named.run
+}
+
+mkeys_loadkeys_on() {
+	nsidx=$1
+	nextpart ns${nsidx}/named.run > /dev/null
+	$RNDC -c ../common/rndc.conf -s 10.53.0.${nsidx} -p 9953 loadkeys . | sed "s/^/I: ns${nsidx} /"
+	wait_for_log "next key event" ns${nsidx}/named.run
+}
+
+mkeys_refresh_on() {
+	nsidx=$1
+	nextpart ns${nsidx}/named.run > /dev/null
+	$RNDC -c ../common/rndc.conf -s 10.53.0.${nsidx} -p 9953 managed-keys refresh | sed "s/^/I: ns${nsidx} /"
+	wait_for_log "Returned from key fetch in keyfetch_done()" ns${nsidx}/named.run
+}
+
+mkeys_sync_on() {
+	# No race with mkeys_refresh_on() is possible as even if the latter
+	# returns immediately after the expected log message is written, the
+	# managed-keys zone is already locked and the command below calls
+	# dns_zone_flush(), which also attempts to take that zone's lock
+	nsidx=$1
+	nextpart ns${nsidx}/named.run > /dev/null
+	$RNDC -c ../common/rndc.conf -s 10.53.0.${nsidx} -p 9953 managed-keys sync | sed "s/^/I: ns${nsidx} /"
+	wait_for_log "dump_done" ns${nsidx}/named.run
+}
+
+mkeys_status_on() {
+	# No race with mkeys_refresh_on() is possible as even if the latter
+	# returns immediately after the expected log message is written, the
+	# managed-keys zone is already locked and the command below calls
+	# mkey_status(), which in turn calls dns_zone_getrefreshkeytime(),
+	# which also attempts to take that zone's lock
+	nsidx=$1
+	$RNDC -c ../common/rndc.conf -s 10.53.0.${nsidx} -p 9953 managed-keys status
+}
+
+mkeys_flush_on() {
+	nsidx=$1
+	$RNDC -c ../common/rndc.conf -s 10.53.0.${nsidx} -p 9953 flush | sed "s/^/I: ns${nsidx} /"
+}
+
+mkeys_secroots_on() {
+	nsidx=$1
+	$RNDC -c ../common/rndc.conf -s 10.53.0.${nsidx} -p 9953 secroots | sed "s/^/I: ns${nsidx} /"
+}
+
 status=0
 n=1

@@ -58,11 +126,9 @@ n=`expr $n + 1`
 echo "I: check new trust anchor can be added ($n)"
 ret=0
 standby1=`$KEYGEN -a rsasha256 -qfk -r $RANDFILE -K ns1 .`
-$RNDC -c ../common/rndc.conf -s 10.53.0.1 -p 9953 loadkeys . | sed 's/^/I: ns1 /'
-sleep 5
-$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys refresh | sed 's/^/I: ns2 /'
-$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys sync | sed 's/^/I: ns2 /'
-$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys status > rndc.out.$n 2>&1
+mkeys_loadkeys_on 1
+mkeys_refresh_on 2
+mkeys_status_on 2 > rndc.out.$n 2>&1
 # there should be two keys listed now
 count=`grep -c "keyid: " rndc.out.$n` 
 [ "$count" -eq 2 ] || ret=1
@@ -81,10 +147,8 @@ status=`expr $status + $ret`
 n=`expr $n + 1`
 echo "I: check new trust anchor can't be added with bad initial key ($n)"
 ret=0
-$RNDC -c ../common/rndc.conf -s 10.53.0.3 -p 9953 managed-keys refresh | sed 's/^/I: ns3 /'
-sleep 1
-$RNDC -c ../common/rndc.conf -s 10.53.0.3 -p 9953 managed-keys sync | sed 's/^/I: ns3 /'
-$RNDC -c ../common/rndc.conf -s 10.53.0.3 -p 9953 managed-keys status > rndc.out.$n 2>&1
+mkeys_refresh_on 3
+mkeys_status_on 3 > rndc.out.$n 2>&1
 # there should be one key listed now
 count=`grep -c "keyid: " rndc.out.$n` 
 [ "$count" -eq 1 ] || ret=1
@@ -100,14 +164,17 @@ status=`expr $status + $ret`
 n=`expr $n + 1`
 echo "I: remove untrusted standby key, check timer restarts ($n)"
 ret=0
-$SETTIME -D now -K ns1 $standby1 > /dev/null
+mkeys_sync_on 2
 t1=`grep "trust pending" ns2/managed-keys.bind`
-$RNDC -c ../common/rndc.conf -s 10.53.0.1 -p 9953 loadkeys . | sed 's/^/I: ns1 /'
-sleep 3
-$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys refresh | sed 's/^/I: ns2 /'
-sleep 1
-$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys sync | sed 's/^/I: ns2 /'
+$SETTIME -D now -K ns1 $standby1 > /dev/null
+mkeys_loadkeys_on 1
+# Less than a second may have passed since the last time ns2 received a
+# ./DNSKEY response from ns1.  Ensure keys are refreshed at a different
+# timestamp to prevent false negatives caused by the acceptance timer getting
+# reset to the same timestamp.
 sleep 1
+mkeys_refresh_on 2
+mkeys_sync_on 2
 t2=`grep "trust pending" ns2/managed-keys.bind`
 # trust pending date must be different
 [ -n "$t2" ] || ret=1
@@ -121,12 +188,15 @@ echo "I: restore untrusted standby key, revoke original key ($n)"
 t1=$t2
 $SETTIME -D none -K ns1 $standby1 > /dev/null
 $SETTIME -R now -K ns1 `cat ns1/managed.key` > /dev/null
-$RNDC -c ../common/rndc.conf -s 10.53.0.1 -p 9953 loadkeys . | sed 's/^/I: ns1 /'
-sleep 3
-$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys refresh | sed 's/^/I: ns2 /'
+mkeys_loadkeys_on 1
+# Less than a second may have passed since the last time ns2 received a
+# ./DNSKEY response from ns1.  Ensure keys are refreshed at a different
+# timestamp to prevent false negatives caused by the acceptance timer getting
+# reset to the same timestamp.
 sleep 1
-$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys sync | sed 's/^/I: ns2 /'
-$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys status > rndc.out.$n 2>&1
+mkeys_refresh_on 2
+mkeys_sync_on 2
+mkeys_status_on 2 > rndc.out.$n 2>&1
 # two keys listed
 count=`grep -c "keyid: " rndc.out.$n` 
 [ "$count" -eq 2 ] || ret=1
@@ -153,10 +223,14 @@ n=`expr $n + 1`
 ret=0
 echo "I: refresh managed-keys, ensure same result ($n)"
 t1=$t2
-sleep 2
-$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys refresh | sed 's/^/I: ns2 /'
-$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys sync | sed 's/^/I: ns2 /'
-$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys status > rndc.out.$n 2>&1
+# Less than a second may have passed since the last time ns2 received a
+# ./DNSKEY response from ns1.  Ensure keys are refreshed at a different
+# timestamp to prevent false negatives caused by the acceptance timer getting
+# reset to the same timestamp.
+sleep 1
+mkeys_refresh_on 2
+mkeys_sync_on 2
+mkeys_status_on 2 > rndc.out.$n 2>&1
 # two keys listed
 count=`grep -c "keyid: " rndc.out.$n` 
 [ "$count" -eq 2 ] || ret=1
@@ -184,15 +258,17 @@ ret=0
 echo "I: restore revoked key, ensure same result ($n)"
 t1=$t2
 $SETTIME -R none -D now -K ns1 `cat ns1/managed.key` > /dev/null
-$RNDC -c ../common/rndc.conf -s 10.53.0.1 -p 9953 loadkeys . | sed 's/^/I: ns1 /'
-sleep 3
+mkeys_loadkeys_on 1
 $SETTIME -D none -K ns1 `cat ns1/managed.key` > /dev/null
-$RNDC -c ../common/rndc.conf -s 10.53.0.1 -p 9953 loadkeys . | sed 's/^/I: ns1 /'
-sleep 3
-$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys refresh | sed 's/^/I: ns2 /'
+mkeys_loadkeys_on 1
+# Less than a second may have passed since the last time ns2 received a
+# ./DNSKEY response from ns1.  Ensure keys are refreshed at a different
+# timestamp to prevent false negatives caused by the acceptance timer getting
+# reset to the same timestamp.
 sleep 1
-$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys sync | sed 's/^/I: ns2 /'
-$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys status > rndc.out.$n 2>&1
+mkeys_refresh_on 2
+mkeys_sync_on 2
+mkeys_status_on 2 > rndc.out.$n 2>&1
 # two keys listed
 count=`grep -c "keyid: " rndc.out.$n` 
 [ "$count" -eq 2 ] || ret=1
@@ -215,17 +291,44 @@ t2=`grep "trust pending" ns2/managed-keys.bind`
 if [ $ret != 0 ]; then echo "I:failed"; fi
 status=`expr $status + $ret`

-echo "I: reinitialize trust anchors"
+echo "I: reinitialize trust anchors, add second key to bind.keys"
 $PERL $SYSTEMTESTTOP/stop.pl --use-rndc . ns2
 rm -f ns2/managed-keys.bind*
+cat ns1/$standby1.key | grep -v '^; ' | $PERL -n -e '
+local ($dn, $class, $type, $flags, $proto, $alg, @rest) = split;
+local $key = join("", @rest);
+local $originalkey = `grep initial-key ns2/managed1.conf`;
+print <<EOF
+managed-keys {
+    $originalkey
+    "$dn" initial-key $flags $proto $alg "$key";
+};
+EOF
+' > ns2/managed.conf
+nextpart ns2/named.run > /dev/null
+$PERL $SYSTEMTESTTOP/start.pl --noclean --restart . ns2
+
+n=`expr $n + 1`
+echo "I: check that no key from bind.keys is marked as an initializing key ($n)"
+ret=0
+wait_for_log "Returned from key fetch in keyfetch_done()" ns2/named.run
+mkeys_secroots_on 2
+grep '; initializing' ns2/named.secroots > /dev/null 2>&1 && ret=1
+if [ $ret != 0 ]; then echo "I:failed"; fi
+status=`expr $status + $ret`
+
+echo "I: reinitialize trust anchors, revert to one key in bind.keys"
+$PERL $SYSTEMTESTTOP/stop.pl --use-rndc . ns2
+rm -f ns2/managed-keys.bind*
+mv ns2/managed1.conf ns2/managed.conf
+nextpart ns2/named.run > /dev/null
 $PERL $SYSTEMTESTTOP/start.pl --noclean --restart . ns2

 n=`expr $n + 1`
 echo "I: check that standby key is now trusted ($n)"
 ret=0
-sleep 3
-$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys sync | sed 's/^/I: ns2 /'
-$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys status > rndc.out.$n 2>&1
+wait_for_log "Returned from key fetch in keyfetch_done()" ns2/named.run
+mkeys_status_on 2 > rndc.out.$n 2>&1
 # two keys listed
 count=`grep -c "keyid: " rndc.out.$n` 
 [ "$count" -eq 2 ] || ret=1
@@ -243,12 +346,9 @@ echo "I: revoke original key, add new standby ($n)"
 ret=0
 standby2=`$KEYGEN -a rsasha256 -qfk -r $RANDFILE -K ns1 .`
 $SETTIME -R now -K ns1 `cat ns1/managed.key` > /dev/null
-$RNDC -c ../common/rndc.conf -s 10.53.0.1 -p 9953 loadkeys . | sed 's/^/I: ns1 /'
-sleep 3
-$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys refresh | sed 's/^/I: ns2 /'
-sleep 1
-$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys sync | sed 's/^/I: ns2 /'
-$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys status > rndc.out.$n 2>&1
+mkeys_loadkeys_on 1
+mkeys_refresh_on 2
+mkeys_status_on 2 > rndc.out.$n 2>&1
 # three keys listed
 count=`grep -c "keyid: " rndc.out.$n` 
 [ "$count" -eq 3 ] || ret=1
@@ -277,11 +377,9 @@ n=`expr $n + 1`
 echo "I: revoke standby before it is trusted ($n)"
 ret=0
 standby3=`$KEYGEN -a rsasha256 -qfk -r $RANDFILE -K ns1 .`
-$RNDC -c ../common/rndc.conf -s 10.53.0.1 -p 9953 loadkeys . | sed 's/^/I: ns1 /'
-sleep 3
-$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys refresh | sed 's/^/I: ns2 /'
-sleep 1
-$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys status > rndc.out.a.$n 2>&1
+mkeys_loadkeys_on 1
+mkeys_refresh_on 2
+mkeys_status_on 2 > rndc.out.a.$n 2>&1
 # four keys listed
 count=`grep -c "keyid: " rndc.out.a.$n` 
 [ "$count" -eq 4 ] || { echo "keyid: count ($count) != 4"; ret=1; }
@@ -292,11 +390,9 @@ count=`grep -c "trust revoked" rndc.out.a.$n`
 count=`grep -c "trust pending" rndc.out.a.$n` 
 [ "$count" -eq 2 ] || { echo "trust pending count ($count) != 2"; ret=1; }
 $SETTIME -R now -K ns1 $standby3 > /dev/null
-$RNDC -c ../common/rndc.conf -s 10.53.0.1 -p 9953 loadkeys . | sed 's/^/I: ns1 /'
-sleep 3
-$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys refresh | sed 's/^/I: ns2 /'
-sleep 1
-$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys status > rndc.out.b.$n 2>&1
+mkeys_loadkeys_on 1
+mkeys_refresh_on 2
+mkeys_status_on 2 > rndc.out.b.$n 2>&1
 # now three keys listed
 count=`grep -c "keyid: " rndc.out.b.$n` 
 [ "$count" -eq 3 ] || { echo "keyid: count ($count) != 3"; ret=1; }
@@ -307,18 +403,16 @@ count=`grep -c "trust revoked" rndc.out.b.$n`
 count=`grep -c "trust pending" rndc.out.b.$n` 
 [ "$count" -eq 1 ] || { echo "trust pending count ($count) != 1"; ret=1; }
 $SETTIME -D now -K ns1 $standby3 > /dev/null
-$RNDC -c ../common/rndc.conf -s 10.53.0.1 -p 9953 loadkeys . | sed 's/^/I: ns1 /'
+mkeys_loadkeys_on 1
 if [ $ret != 0 ]; then echo "I:failed"; fi
 status=`expr $status + $ret`

 n=`expr $n + 1`
-echo "I: wait 30 seconds for key add/remove holddowns to expire ($n)"
+echo "I: wait 20 seconds for key add/remove holddowns to expire ($n)"
 ret=0
-sleep 30
-$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys refresh | sed 's/^/I: ns2 /'
-sleep 1
-$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys sync | sed 's/^/I: ns2 /'
-$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys status > rndc.out.$n 2>&1
+sleep 20
+mkeys_refresh_on 2
+mkeys_status_on 2 > rndc.out.$n 2>&1
 # two keys listed
 count=`grep -c "keyid: " rndc.out.$n` 
 [ "$count" -eq 2 ] || ret=1
@@ -340,12 +434,9 @@ ret=0
 $SETTIME -D now -K ns1 `cat ns1/managed.key` > /dev/null
 $SETTIME -R now -K ns1 $standby1 > /dev/null
 $SETTIME -R now -K ns1 $standby2 > /dev/null
-$RNDC -c ../common/rndc.conf -s 10.53.0.1 -p 9953 loadkeys . | sed 's/^/I: ns1 /'
-sleep 3
-$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys refresh | sed 's/^/I: ns2 /'
-sleep 1
-$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys sync | sed 's/^/I: ns2 /'
-$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys status > rndc.out.$n 2>&1
+mkeys_loadkeys_on 1
+mkeys_refresh_on 2
+mkeys_status_on 2 > rndc.out.$n 2>&1
 # two keys listed
 count=`grep -c "keyid: " rndc.out.$n` 
 [ "$count" -eq 2 ] || ret=1
@@ -367,8 +458,10 @@ status=`expr $status + $ret`
 n=`expr $n + 1`
 echo "I: check for insecure response ($n)"
 ret=0
+mkeys_refresh_on 2
 $DIG $DIGOPTS +noauth example. @10.53.0.2 txt > dig.out.ns2.test$n || ret=1
 grep "status: NOERROR" dig.out.ns2.test$n > /dev/null || ret=1
+grep "flags:.*ad.*QUERY" dig.out.ns2.test$n > /dev/null && ret=1
 grep "example..*.RRSIG..*TXT" dig.out.ns2.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo "I:failed"; fi
 status=`expr $status + $ret`
@@ -380,16 +473,18 @@ $SETTIME -D now -K ns1 $standby2 > /dev/null
 $SIGNER -Sg -K ns1 -N unixtime -r $RANDFILE -o . ns1/root.db > /dev/null 2>&-
 cp ns1/named2.conf ns1/named.conf
 rm -f ns1/root.db.signed.jnl
-$RNDC -c ../common/rndc.conf -s 10.53.0.1 -p 9953 reconfig
+mkeys_reconfig_on 1

 echo "I: reinitialize trust anchors"
 $PERL $SYSTEMTESTTOP/stop.pl --use-rndc . ns2
 rm -f ns2/managed-keys.bind*
+nextpart ns2/named.run > /dev/null
 $PERL $SYSTEMTESTTOP/start.pl --noclean --restart . ns2

 n=`expr $n + 1`
 echo "I: check positive validation ($n)"
 ret=0
+wait_for_log "Returned from key fetch in keyfetch_done()" ns2/named.run
 $DIG $DIGOPTS +noauth example. @10.53.0.2 txt > dig.out.ns2.test$n || ret=1
 grep "flags:.*ad.*QUERY" dig.out.ns2.test$n > /dev/null || ret=1
 grep "example..*.RRSIG..*TXT" dig.out.ns2.test$n > /dev/null || ret=1
@@ -403,17 +498,25 @@ orig=`cat ns1/managed.key`
 keyid=`cat ns1/managed.key.id`
 revoked=`$REVOKE -K ns1 $orig`
 rkeyid=`expr $revoked : 'ns1/K\.+00.+0*\([1-9]*[0-9]*[0-9]\)'`
+rm -f ns1/root.db.signed.jnl
+# We need to activate at least one valid DNSKEY to prevent dnssec-signzone from
+# failing.  Alternatively, we could use -P to disable post-sign verification,
+# but we actually do want post-sign verification to happen to ensure the zone
+# is correct before we break it on purpose.
 $SETTIME -R none -D none -K ns1 $standby1 > /dev/null
 $SIGNER -Sg -K ns1 -N unixtime -r $RANDFILE -O full -o . -f signer.out.$n ns1/root.db > /dev/null 2>&-
 cp -f ns1/root.db.signed ns1/root.db.tmp
 BADSIG="SVn2tLDzpNX2rxR4xRceiCsiTqcWNKh7NQ0EQfCrVzp9WEmLw60sQ5kP xGk4FS/xSKfh89hO2O/H20Bzp0lMdtr2tKy8IMdU/mBZxQf2PXhUWRkg V2buVBKugTiOPTJSnaqYCN3rSfV1o7NtC1VNHKKK/D5g6bpDehdn5Gaq kpBhN+MSCCh9OZP2IT20luS1ARXxLlvuSVXJ3JYuuhTsQXUbX/SQpNoB Lo6ahCE55szJnmAxZEbb2KOVnSlZRA6ZBHDhdtO0S4OkvcmTutvcVV+7 w53CbKdaXhirvHIh0mZXmYk2PbPLDY7PU9wSH40UiWPOB9f00wwn6hUe uEQ1Qg=="
-sed -e "/ $rkeyid \./s, \. .*$, . $BADSIG," signer.out.$n > ns1/root.db.signed
-$RNDC -c ../common/rndc.conf -s 10.53.0.1 -p 9953 reload . | sed 's/^/I: ns1 /'
-sleep 3
-$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys refresh | sed 's/^/I: ns2 /'
+# Less than a second may have passed since ns1 was started.  If we call
+# dnssec-signzone immediately, ns1/root.db.signed will not be reloaded by the
+# subsequent "rndc reload ." call on platforms which do not set the
+# "nanoseconds" field of isc_time_t, due to zone load time being seemingly
+# equal to master file modification time.
 sleep 1
-$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys sync | sed 's/^/I: ns2 /'
-$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys status > rndc.out.$n 2>&1
+sed -e "/ $rkeyid \./s, \. .*$, . $BADSIG," signer.out.$n > ns1/root.db.signed
+mkeys_reload_on 1
+mkeys_refresh_on 2
+mkeys_status_on 2 > rndc.out.$n 2>&1
 # one key listed
 count=`grep -c "keyid: " rndc.out.$n` 
 [ "$count" -eq 1 ] || { echo "'keyid:' count ($count) != 1"; ret=1; }
@@ -434,6 +537,7 @@ status=`expr $status + $ret`
 n=`expr $n + 1`
 echo "I: check validation fails with bad DNSKEY rrset ($n)"
 ret=0
+mkeys_flush_on 2
 $DIG $DIGOPTS +noauth example. @10.53.0.2 txt > dig.out.ns2.test$n || ret=1
 grep "status: SERVFAIL" dig.out.ns2.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo "I:failed"; fi
@@ -443,17 +547,18 @@ n=`expr $n + 1`
 echo "I: restore DNSKEY rrset, check validation succeeds again ($n)"
 ret=0
 rm -f ${revoked}.key ${revoked}.private
+rm -f ns1/root.db.signed.jnl
 $SETTIME -D none -R none -K ns1 `cat ns1/managed.key` > /dev/null
 $SETTIME -D now -K ns1 $standby1 > /dev/null
-$SETTIME -D now -K ns1 $standby2 > /dev/null
-$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 flush | sed 's/^/I: ns1 /'
+# Less than a second may have passed since ns1 was started.  If we call
+# dnssec-signzone immediately, ns1/root.db.signed will not be reloaded by the
+# subsequent "rndc reload ." call on platforms which do not set the
+# "nanoseconds" field of isc_time_t, due to zone load time being seemingly
+# equal to master file modification time.
 sleep 1
 $SIGNER -Sg -K ns1 -N unixtime -r $RANDFILE -o . ns1/root.db > /dev/null 2>&-
-$RNDC -c ../common/rndc.conf -s 10.53.0.1 -p 9953 reload . | sed 's/^/I: ns1 /'
-sleep 3
-$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys refresh | sed 's/^/I: ns2 /'
-sleep 1
-$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys status > rndc.out.$n 2>&1
+mkeys_reload_on 1
+mkeys_flush_on 2
 $DIG $DIGOPTS +noauth example. @10.53.0.2 txt > dig.out.ns2.test$n || ret=1
 grep "flags:.*ad.*QUERY" dig.out.ns2.test$n > /dev/null || ret=1
 grep "example..*.RRSIG..*TXT" dig.out.ns2.test$n > /dev/null || ret=1
@@ -462,15 +567,24 @@ status=`expr $status + $ret`

 n=`expr $n + 1`
 echo "I: reset the root server with no keys, check for minimal update ($n)"
-$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys status > rndc.out.$n 2>&1
+ret=0
+# Refresh keys first to prevent previous checks from influencing this one.
+# Note that we might still get occasional false negatives on some really slow
+# machines, when $t1 equals $t2 due to the time elapsed between "rndc
+# managed-keys status" calls being equal to the normal active refresh period
+# (as calculated per rules listed in RFC 5011 section 2.3) minus an "hour" (as
+# set using -T mkeytimers).
+mkeys_refresh_on 2
+mkeys_status_on 2 > rndc.out.$n 2>&1
 t1=`grep 'next refresh:' rndc.out.$n`
 $PERL $SYSTEMTESTTOP/stop.pl --use-rndc . ns1
+rm -f ns1/root.db.signed.jnl
 cp ns1/root.db ns1/root.db.signed
+nextpart ns1/named.run > /dev/null
 $PERL $SYSTEMTESTTOP/start.pl --noclean --restart . ns1
-sleep 3
-$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys refresh | sed 's/^/I: ns2 /'
-sleep 1
-$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys status > rndc.out.$n 2>&1
+wait_for_log "loaded serial" ns1/named.run
+mkeys_refresh_on 2
+mkeys_status_on 2 > rndc.out.$n 2>&1
 # one key listed
 count=`grep -c "keyid: " rndc.out.$n` 
 [ "$count" -eq 1 ] || ret=1
@@ -492,14 +606,23 @@ status=`expr $status + $ret`

 n=`expr $n + 1`
 echo "I: reset the root server with no signatures, check for minimal update ($n)"
-t2=$t1
+ret=0
+# Refresh keys first to prevent previous checks from influencing this one
+mkeys_refresh_on 2
+mkeys_status_on 2 > rndc.out.$n 2>&1
+t1=`grep 'next refresh:' rndc.out.$n`
 $PERL $SYSTEMTESTTOP/stop.pl --use-rndc . ns1
+rm -f ns1/root.db.signed.jnl
 cat ns1/K*.key >> ns1/root.db.signed
+nextpart ns1/named.run > /dev/null
 $PERL $SYSTEMTESTTOP/start.pl --noclean --restart . ns1
-sleep 3
-$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys refresh | sed 's/^/I: ns2 /'
+wait_for_log "loaded serial" ns1/named.run
+# Less than a second may have passed since the last time ns2 received a
+# ./DNSKEY response from ns1.  Ensure keys are refreshed at a different
+# timestamp to prevent minimal update from resetting it to the same timestamp.
 sleep 1
-$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys status > rndc.out.$n 2>&1
+mkeys_refresh_on 2
+mkeys_status_on 2 > rndc.out.$n 2>&1
 # one key listed
 count=`grep -c "keyid: " rndc.out.$n` 
 [ "$count" -eq 1 ] || ret=1
@@ -521,13 +644,12 @@ status=`expr $status + $ret`

 n=`expr $n + 1`
 echo "I: restore root server, check validation succeeds again ($n)"
+ret=0
 rm -f ns1/root.db.signed.jnl
 $SIGNER -Sg -K ns1 -N unixtime -r $RANDFILE -o . ns1/root.db > /dev/null 2>&-
-$RNDC -c ../common/rndc.conf -s 10.53.0.1 -p 9953 reload . | sed 's/^/I: ns1 /'
-sleep 3
-$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys refresh | sed 's/^/I: ns2 /'
-sleep 1
-$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys status > rndc.out.$n 2>&1
+mkeys_reload_on 1
+mkeys_refresh_on 2
+mkeys_status_on 2 > rndc.out.$n 2>&1
 $DIG $DIGOPTS +noauth example. @10.53.0.2 txt > dig.out.ns2.test$n || ret=1
 grep "flags:.*ad.*QUERY" dig.out.ns2.test$n > /dev/null || ret=1
 grep "example..*.RRSIG..*TXT" dig.out.ns2.test$n > /dev/null || ret=1
@@ -537,14 +659,14 @@ status=`expr $status + $ret`
 n=`expr $n + 1`
 echo "I: check that trust-anchor-telemetry queries are logged ($n)"
 ret=0
-grep "sending trust-anchor-telemetry query '_ta-[0-9a-f]*/NULL" ns3/named.run > /dev/null || ret=1
+grep "sending trust-anchor-telemetry query '_ta-[0-9a-f]*/NULL" ns2/named.run > /dev/null || ret=1
 if [ $ret != 0 ]; then echo "I:failed"; fi
 status=`expr $status + $ret`

 n=`expr $n + 1`
 echo "I: check that trust-anchor-telemetry queries are received ($n)"
 ret=0
-grep "query '_ta-[0-9a-f]*/NULL/IN' approved" ns1/named.run > /dev/null || ret=1
+grep "query '_ta-[0-9a-f][0-9a-f]*/NULL/IN' approved" ns1/named.run > /dev/null || ret=1
 if [ $ret != 0 ]; then echo "I:failed"; fi
 status=`expr $status + $ret`

@@ -552,15 +674,91 @@ n=`expr $n + 1`
 echo "I: check 'rndc-managed-keys destroy' ($n)"
 ret=0
 $RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys destroy | sed 's/^/I: ns2 /'
-sleep 1
-$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys status > rndc.out.$n 2>&1
+mkeys_status_on 2 > rndc.out.$n 2>&1
 grep "no views with managed keys" rndc.out.$n > /dev/null || ret=1
-$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 reconfig | sed 's/^/I: ns2 /'
-sleep 1
-$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys status > rndc.out.$n 2>&1
+mkeys_reconfig_on 2
+mkeys_status_on 2 > rndc.out.$n 2>&1
 grep "name: \." rndc.out.$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo "I:failed"; fi
 status=`expr $status + $ret`

+n=`expr $n + 1`
+echo "I: check that trust-anchor-telemetry queries contain the correct key ($n)"
+ret=0
+# convert the hexadecimal key from the TAT query into decimal and
+# compare against the known key.
+tathex=`grep "query '_ta-[0-9a-f][0-9a-f]*/NULL/IN' approved" ns1/named.run | awk '{print $6; exit 0}' | sed -e 's/(_ta-\([0-9a-f][0-9a-f]*\)):/\1/'`
+tatkey=`$PERL -e 'printf("%d\n", hex(@ARGV[0]));' $tathex`
+realkey=`$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 secroots - | sed -n 's#.*SHA256/\([0-9][0-9]*\) ; .*managed.*#\1#p'`
+[ "$tatkey" -eq "$realkey" ] || ret=1
+if [ $ret != 0 ]; then echo "I:failed"; fi
+status=`expr $status + $ret`
+
+n=`expr $n + 1`
+echo "I: check initialization fails if managed-keys can't be created ($n)"
+ret=0
+mkeys_secroots_on 4
+grep '; initializing managed' ns4/named.secroots > /dev/null 2>&1 || ret=1
+grep '; managed' ns4/named.secroots > /dev/null 2>&1 && ret=1
+grep '; trusted' ns4/named.secroots > /dev/null 2>&1 && ret=1
+if [ $ret != 0 ]; then echo "I:failed"; fi
+status=`expr $status + $ret`
+
+n=`expr $n + 1`
+echo "I: check failure to contact root servers does not prevent key refreshes after restart ($n)"
+ret=0
+# By the time we get here, ns5 should have attempted refreshing its managed
+# keys.  These attempts should fail as ns1 is configured to REFUSE all queries
+# from ns5.  Note that named1.args does not contain "-T mkeytimers"; this is to
+# ensure key refresh retry will be scheduled to one actual hour after the first
+# key refresh failure instead of just a few seconds, in order to prevent races
+# between the next scheduled key refresh time and startup time of restarted ns5.
+$PERL $SYSTEMTESTTOP/stop.pl --use-rndc . ns5
+nextpart ns5/named.run > /dev/null
+$PERL $SYSTEMTESTTOP/start.pl --noclean --restart . ns5
+wait_for_log "Returned from key fetch in keyfetch_done()" ns5/named.run
+# ns5/named.run will contain logs from both the old instance and the new
+# instance.  In order for the test to pass, both must attempt a fetch.
+count=`grep -c "Creating key fetch" ns5/named.run`
+[ $count -lt 2 ] && ret=1
+if [ $ret != 0 ]; then echo "I:failed"; fi
+status=`expr $status + $ret`
+
+n=`expr $n + 1`
+echo "I: check key refreshes are resumed after root servers become available ($n)"
+ret=0
+$PERL $SYSTEMTESTTOP/stop.pl --use-rndc . ns5
+# Prevent previous check from affecting this one
+rm -f ns5/managed-keys.bind*
+# named2.args adds "-T mkeytimers=2/20/40" to named1.args as we need to wait for
+# an "hour" until keys are refreshed again after initial failure
+cp ns5/named2.args ns5/named.args
+nextpart ns5/named.run > /dev/null
+$PERL $SYSTEMTESTTOP/start.pl --noclean --restart . ns5
+wait_for_log "Returned from key fetch in keyfetch_done()" ns5/named.run
+mkeys_secroots_on 5
+grep '; initializing managed' ns5/named.secroots > /dev/null 2>&1 || ret=1
+# ns1 should still REFUSE queries from ns5, so resolving should be impossible
+$DIG $DIGOPTS +noauth example. @10.53.0.5 txt > dig.out.ns5.a.test$n || ret=1
+grep "flags:.*ad.*QUERY" dig.out.ns5.a.test$n > /dev/null && ret=1
+grep "example..*.RRSIG..*TXT" dig.out.ns5.a.test$n > /dev/null && ret=1
+grep "status: SERVFAIL" dig.out.ns5.a.test$n > /dev/null || ret=1
+# Allow queries from ns5 to ns1
+cp ns1/named3.conf ns1/named.conf
+rm -f ns1/root.db.signed.jnl
+mkeys_reconfig_on 1
+nextpart ns5/named.run > /dev/null
+wait_for_log "Returned from key fetch in keyfetch_done()" ns5/named.run
+mkeys_secroots_on 5
+grep '; managed' ns5/named.secroots > /dev/null 2>&1 || ret=1
+# ns1 should not longer REFUSE queries from ns5, so managed keys should be
+# correctly refreshed and resolving should succeed
+$DIG $DIGOPTS +noauth example. @10.53.0.5 txt > dig.out.ns5.b.test$n || ret=1
+grep "flags:.*ad.*QUERY" dig.out.ns5.b.test$n > /dev/null || ret=1
+grep "example..*.RRSIG..*TXT" dig.out.ns5.b.test$n > /dev/null || ret=1
+grep "status: NOERROR" dig.out.ns5.b.test$n > /dev/null || ret=1
+if [ $ret != 0 ]; then echo "I:failed"; fi
+status=`expr $status + $ret`
+
 echo "I:exit status: $status"
 [ $status -eq 0 ] || exit 1
@@ -53,6 +53,7 @@ view "b" {
 		type slave;
 		masters { 10.53.0.5 key "a"; };
 		file "x21.bk-b";
+		notify no;
 	};
 };

@@ -62,5 +63,6 @@ view "c" {
 		type slave;
 		masters { 10.53.0.5 key "a"; };
 		file "x21.bk-c";
+		notify no;
 	};
 };
@@ -20,6 +20,7 @@ options {
 	listen-on-v6 { none; };
 	recursion yes;
 	notify yes;
+	serial-query-rate 1; // workaround for KB AA-01213
 };

 key altkey {
@@ -278,7 +278,7 @@ sleep 10
 if 
 	$PERL $SYSTEMTESTTOP/start.pl --noclean --restart . ns1
 then
-	echo "I:restarted server ns1"	
+	echo "I:restarted server ns1"
 else
 	echo "I:could not restart server ns1"
 	exit 1
@@ -709,8 +709,12 @@ size=`$PERL -e 'use File::stat; my $sb = stat(@ARGV[0]); printf("%s\n", $sb->siz
 [ "$size" -gt 6000 ] || ret=1
 sleep 1
 $RNDC -c ../common/rndc.conf -s 10.53.0.1 -p 9953 sync maxjournal.test
-sleep 1
-
+for i in 1 2 3 4 5 6
+do
+    sleep 1
+    size=`$PERL -e 'use File::stat; my $sb = stat(@ARGV[0]); printf("%s\n", $sb->size);' ns1/maxjournal.db.jnl`
+    [ "$size" -lt 5000 ] && break
+done
 size=`$PERL -e 'use File::stat; my $sb = stat(@ARGV[0]); printf("%s\n", $sb->size);' ns1/maxjournal.db.jnl`
 [ "$size" -lt 5000 ] || ret=1
 [ $ret = 0 ] || { echo I:failed; status=1; }
@@ -885,75 +889,81 @@ grep "address family not supported" nsupdate.out-$n > /dev/null 2>&1 || ret=1
 #
 #  Add client library tests here
 #
-n=`expr $n + 1`
-ret=0
-echo "I:check that dns_client_update handles prerequisite NXDOMAIN failure ($n)"
-$SAMPLEUPDATE -P 5300 -a 10.53.0.1 -a 10.53.0.2 -p "nxdomain exists.sample" \
+
+if test unset != "${SAMPLEUPDATE:-unset}" -a -x "${SAMPLEUPDATE}"
+then
+
+    n=`expr $n + 1`
+    ret=0
+    echo "I:check that dns_client_update handles prerequisite NXDOMAIN failure ($n)"
+    $SAMPLEUPDATE -P 5300 -a 10.53.0.1 -a 10.53.0.2 -p "nxdomain exists.sample" \
 	add "nxdomain-exists.sample 0 in a 1.2.3.4" > update.out.test$n 2>&1
-$SAMPLEUPDATE -P 5300 -a 10.53.0.2 -p "nxdomain exists.sample" \
+    $SAMPLEUPDATE -P 5300 -a 10.53.0.2 -p "nxdomain exists.sample" \
 	add "check-nxdomain-exists.sample 0 in a 1.2.3.4" > update.out.check$n 2>&1
-$DIG +tcp @10.53.0.1 -p 5300 a nxdomain-exists.sample > dig.out.ns1.test$n
-$DIG +tcp @10.53.0.2 -p 5300 a nxdomain-exists.sample > dig.out.ns2.test$n
-$DIG +tcp @10.53.0.2 -p 5300 a check-nxdomain-exists.sample > check.out.ns2.test$n
-grep "update failed: YXDOMAIN" update.out.test$n > /dev/null || ret=1
-grep "update succeeded" update.out.check$n > /dev/null || ret=1
-grep "status: NXDOMAIN" dig.out.ns1.test$n > /dev/null || ret=1
-grep "status: NXDOMAIN" dig.out.ns2.test$n > /dev/null || ret=1
-grep "status: NOERROR" check.out.ns2.test$n > /dev/null || ret=1
-[ $ret = 0 ] || { echo I:failed; status=1; }
+    $DIG +tcp @10.53.0.1 -p 5300 a nxdomain-exists.sample > dig.out.ns1.test$n
+    $DIG +tcp @10.53.0.2 -p 5300 a nxdomain-exists.sample > dig.out.ns2.test$n
+    $DIG +tcp @10.53.0.2 -p 5300 a check-nxdomain-exists.sample > check.out.ns2.test$n
+    grep "update failed: YXDOMAIN" update.out.test$n > /dev/null || ret=1
+    grep "update succeeded" update.out.check$n > /dev/null || ret=1
+    grep "status: NXDOMAIN" dig.out.ns1.test$n > /dev/null || ret=1
+    grep "status: NXDOMAIN" dig.out.ns2.test$n > /dev/null || ret=1
+    grep "status: NOERROR" check.out.ns2.test$n > /dev/null || ret=1
+    [ $ret = 0 ] || { echo I:failed; status=1; }

-n=`expr $n + 1`
-ret=0
-echo "I:check that dns_client_update handles prerequisite YXDOMAIN failure ($n)"
-$SAMPLEUPDATE -P 5300 -a 10.53.0.1 -a 10.53.0.2 -p "yxdomain nxdomain.sample" \
+    n=`expr $n + 1`
+    ret=0
+    echo "I:check that dns_client_update handles prerequisite YXDOMAIN failure ($n)"
+    $SAMPLEUPDATE -P 5300 -a 10.53.0.1 -a 10.53.0.2 -p "yxdomain nxdomain.sample" \
 	add "yxdomain-nxdomain.sample 0 in a 1.2.3.4" > update.out.test$n 2>&1
-$SAMPLEUPDATE -P 5300 -a 10.53.0.2 -p "yxdomain nxdomain.sample" \
+    $SAMPLEUPDATE -P 5300 -a 10.53.0.2 -p "yxdomain nxdomain.sample" \
 	add "check-yxdomain-nxdomain.sample 0 in a 1.2.3.4" > update.out.check$n 2>&1
-$DIG +tcp @10.53.0.1 -p 5300 a nxdomain-exists.sample > dig.out.ns1.test$n
-$DIG +tcp @10.53.0.2 -p 5300 a nxdomain-exists.sample > dig.out.ns2.test$n
-$DIG +tcp @10.53.0.2 -p 5300 a check-nxdomain-exists.sample > check.out.ns2.test$n
-grep "update failed: NXDOMAIN" update.out.test$n > /dev/null || ret=1
-grep "update succeeded" update.out.check$n > /dev/null || ret=1
-grep "status: NXDOMAIN" dig.out.ns1.test$n > /dev/null || ret=1
-grep "status: NXDOMAIN" dig.out.ns2.test$n > /dev/null || ret=1
-grep "status: NOERROR" check.out.ns2.test$n > /dev/null || ret=1
-[ $ret = 0 ] || { echo I:failed; status=1; }
+    $DIG +tcp @10.53.0.1 -p 5300 a nxdomain-exists.sample > dig.out.ns1.test$n
+    $DIG +tcp @10.53.0.2 -p 5300 a nxdomain-exists.sample > dig.out.ns2.test$n
+    $DIG +tcp @10.53.0.2 -p 5300 a check-nxdomain-exists.sample > check.out.ns2.test$n
+    grep "update failed: NXDOMAIN" update.out.test$n > /dev/null || ret=1
+    grep "update succeeded" update.out.check$n > /dev/null || ret=1
+    grep "status: NXDOMAIN" dig.out.ns1.test$n > /dev/null || ret=1
+    grep "status: NXDOMAIN" dig.out.ns2.test$n > /dev/null || ret=1
+    grep "status: NOERROR" check.out.ns2.test$n > /dev/null || ret=1
+    [ $ret = 0 ] || { echo I:failed; status=1; }

-n=`expr $n + 1`
-ret=0
-echo "I:check that dns_client_update handles prerequisite NXRRSET failure ($n)"
-$SAMPLEUPDATE -P 5300 -a 10.53.0.1 -a 10.53.0.2 -p "nxrrset exists.sample TXT This RRset exists." \
+    n=`expr $n + 1`
+    ret=0
+    echo "I:check that dns_client_update handles prerequisite NXRRSET failure ($n)"
+    $SAMPLEUPDATE -P 5300 -a 10.53.0.1 -a 10.53.0.2 -p "nxrrset exists.sample TXT This RRset exists." \
 	add "nxrrset-exists.sample 0 in a 1.2.3.4" > update.out.test$n 2>&1
-$SAMPLEUPDATE -P 5300 -a 10.53.0.2 -p "nxrrset exists.sample TXT This RRset exists." \
+    $SAMPLEUPDATE -P 5300 -a 10.53.0.2 -p "nxrrset exists.sample TXT This RRset exists." \
 	add "check-nxrrset-exists.sample 0 in a 1.2.3.4" > update.out.check$n 2>&1
-$DIG +tcp @10.53.0.1 -p 5300 a nxrrset-exists.sample > dig.out.ns1.test$n
-$DIG +tcp @10.53.0.2 -p 5300 a nxrrset-exists.sample > dig.out.ns2.test$n
-$DIG +tcp @10.53.0.2 -p 5300 a check-nxrrset-exists.sample > check.out.ns2.test$n
-grep "update failed: YXRRSET" update.out.test$n > /dev/null || ret=1
-grep "update succeeded" update.out.check$n > /dev/null || ret=1
-grep "status: NXDOMAIN" dig.out.ns1.test$n > /dev/null || ret=1
-grep "status: NXDOMAIN" dig.out.ns2.test$n > /dev/null || ret=1
-grep "status: NOERROR" check.out.ns2.test$n > /dev/null || ret=1
-[ $ret = 0 ] || { echo I:failed; status=1; }
+    $DIG +tcp @10.53.0.1 -p 5300 a nxrrset-exists.sample > dig.out.ns1.test$n
+    $DIG +tcp @10.53.0.2 -p 5300 a nxrrset-exists.sample > dig.out.ns2.test$n
+    $DIG +tcp @10.53.0.2 -p 5300 a check-nxrrset-exists.sample > check.out.ns2.test$n
+    grep "update failed: YXRRSET" update.out.test$n > /dev/null || ret=1
+    grep "update succeeded" update.out.check$n > /dev/null || ret=1
+    grep "status: NXDOMAIN" dig.out.ns1.test$n > /dev/null || ret=1
+    grep "status: NXDOMAIN" dig.out.ns2.test$n > /dev/null || ret=1
+    grep "status: NOERROR" check.out.ns2.test$n > /dev/null || ret=1
+    [ $ret = 0 ] || { echo I:failed; status=1; }

-n=`expr $n + 1`
-ret=0
-echo "I:check that dns_client_update handles prerequisite YXRRSET failure ($n)"
-$SAMPLEUPDATE -s -P 5300 -a 10.53.0.1 -a 10.53.0.2 \
+    n=`expr $n + 1`
+    ret=0
+    echo "I:check that dns_client_update handles prerequisite YXRRSET failure ($n)"
+    $SAMPLEUPDATE -s -P 5300 -a 10.53.0.1 -a 10.53.0.2 \
 	-p "yxrrset no-txt.sample TXT" \
 	add "yxrrset-nxrrset.sample 0 in a 1.2.3.4" > update.out.test$n 2>&1
-$SAMPLEUPDATE -P 5300 -a 10.53.0.2 -p "yxrrset no-txt.sample TXT" \
+    $SAMPLEUPDATE -P 5300 -a 10.53.0.2 -p "yxrrset no-txt.sample TXT" \
 	add "check-yxrrset-nxrrset.sample 0 in a 1.2.3.4" > update.out.check$n 2>&1
-$DIG +tcp @10.53.0.1 -p 5300 a yxrrset-nxrrset.sample > dig.out.ns1.test$n
-$DIG +tcp @10.53.0.2 -p 5300 a yxrrset-nxrrset.sample > dig.out.ns2.test$n
-$DIG +tcp @10.53.0.2 -p 5300 a check-yxrrset-nxrrset.sample > check.out.ns2.test$n
-grep "update failed: NXRRSET" update.out.test$n > /dev/null || ret=1
-grep "update succeeded" update.out.check$n > /dev/null || ret=1
-grep "status: NXDOMAIN" dig.out.ns1.test$n > /dev/null || ret=1
-grep "status: NXDOMAIN" dig.out.ns2.test$n > /dev/null || ret=1
-grep "status: NOERROR" check.out.ns2.test$n > /dev/null || ret=1
-grep "2nd update failed: NXRRSET" update.out.test$n > /dev/null || ret=1
-[ $ret = 0 ] || { echo I:failed; status=1; }
+    $DIG +tcp @10.53.0.1 -p 5300 a yxrrset-nxrrset.sample > dig.out.ns1.test$n
+    $DIG +tcp @10.53.0.2 -p 5300 a yxrrset-nxrrset.sample > dig.out.ns2.test$n
+    $DIG +tcp @10.53.0.2 -p 5300 a check-yxrrset-nxrrset.sample > check.out.ns2.test$n
+    grep "update failed: NXRRSET" update.out.test$n > /dev/null || ret=1
+    grep "update succeeded" update.out.check$n > /dev/null || ret=1
+    grep "status: NXDOMAIN" dig.out.ns1.test$n > /dev/null || ret=1
+    grep "status: NXDOMAIN" dig.out.ns2.test$n > /dev/null || ret=1
+    grep "status: NOERROR" check.out.ns2.test$n > /dev/null || ret=1
+    grep "2nd update failed: NXRRSET" update.out.test$n > /dev/null || ret=1
+    [ $ret = 0 ] || { echo I:failed; status=1; }
+
+fi

 #
 # End client library tests here
@@ -1,4 +1,4 @@
-Copyright (C) 2014, 2016  Internet Systems Consortium, Inc. ("ISC")
+Copyright (C) 2014, 2016, 2017  Internet Systems Consortium, Inc. ("ISC")

 This Source Code Form is subject to the terms of the Mozilla Public
 License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -7,8 +7,9 @@ file, You can obtain one at http://mozilla.org/MPL/2.0/.
 system test for recursion limits

 ns1  -- root server
-ans2 -- delegate to ns1.(n+1).example.com for all n, up to
-        the value specified in ans.limit (or forever if limit is 0)
+ans2 -- for example.org: delegate to ns1.(n+1).example.org for all n, up to the
+                         value specified in ans.limit (or forever if limit is 0)
+        for example.net: delegate every query to 15 more name servers, with
+                         "victim" address
 ns3  -- resolver under test
-ans4 -- delegates every query to 16 more name servers, with "victim" address
 ans7 -- "victim" server
@@ -1,6 +1,6 @@
 #!/usr/bin/env perl
 #
-# Copyright (C) 2014-2016  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2014-2017  Internet Systems Consortium, Inc. ("ISC")
 #
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -10,9 +10,17 @@ use strict;
 use warnings;

 use IO::File;
-use Getopt::Long;
-use Net::DNS::Nameserver;
-use Time::HiRes qw(usleep nanosleep);
+use IO::Socket;
+use Net::DNS;
+
+my $localaddr = "10.53.0.2";
+my $limit = getlimit();
+my $no_more_waiting = 0;
+my @delayed_response;
+my $timeout;
+
+my $udpsock = IO::Socket::INET->new(LocalAddr => "$localaddr",
+   LocalPort => 5300, Proto => "udp", Reuse => 1) or die "$!";

 my $pidf = new IO::File "ans.pid", "w" or die "cannot open pid file: $!";
 print $pidf "$$\n" or die "cannot write pid file: $!";
@@ -39,21 +47,18 @@ sub getlimit {
    return 0;
 }

-my $localaddr = "10.53.0.2";
-my $localport = 5300;
-my $verbose = 0;
-my $limit = getlimit();
-
+# If $wait == 0 is returned, returned reply will be sent immediately.
+# If $wait == 1 is returned, sending the returned reply might be delayed; see
+# comments inside handle_UDP() for details.
 sub reply_handler {
-    my ($qname, $qclass, $qtype, $peerhost, $query, $conn) = @_;
-    my ($rcode, @ans, @auth, @add);
+    my ($qname, $qclass, $qtype) = @_;
+    my ($rcode, @ans, @auth, @add, $wait);

    print ("request: $qname/$qtype\n");
    STDOUT->flush();

+    $wait = 0;
    $count += 1;
-    # Sleep 100ms to make sure that named sends both A and AAAA queries.
-    usleep(100000);

    if ($qname eq "count" ) {
 	if ($qtype eq "TXT") {
@@ -95,6 +100,7 @@ sub reply_handler {
 	$rcode = "NOERROR";
    } elsif ($qname =~ /^ns1\.(\d+)\.example\.org$/) {
 	my $next = $1 + 1;
+	$wait = 1;
 	if ($limit == 0 || (! $send_response && $next <= $limit)) {
 	    my $rr = new Net::DNS::RR("$1.example.org 86400 $qclass NS ns1.$next.example.org");
 	    push @auth, $rr;
@@ -108,24 +114,114 @@ sub reply_handler {
 	    }
 	}
 	$rcode = "NOERROR";
+    } elsif ($qname eq "direct.example.net" ) {
+        if ($qtype eq "A") {
+            my ($ttl, $rdata) = (3600, $localaddr);
+            my $rr = new Net::DNS::RR("$qname $ttl $qclass $qtype $rdata");
+            push @ans, $rr;
+        }
+        $rcode = "NOERROR";
+    } elsif( $qname =~ /^ns1\.(\d+)\.example\.net$/ ) {
+        my $next = ($1 + 1) * 16;
+        for (my $i = 1; $i < 16; $i++) {
+            my $s = $next + $i;
+            my $rr = new Net::DNS::RR("$1.example.net 86400 $qclass NS ns1.$s.example.net");
+            push @auth, $rr;
+            $rr = new Net::DNS::RR("ns1.$s.example.net 86400 $qclass A 10.53.0.7");
+            push @add, $rr;
+        }
+        $rcode = "NOERROR";
    } else {
 	$rcode = "NXDOMAIN";
    }

-    # mark the answer as authoritive (by setting the 'aa' flag
-    return ($rcode, \@ans, \@auth, \@add, { aa => 1 });
+    return ($rcode, \@ans, \@auth, \@add, $wait);
 }

-GetOptions(
-    'port=i' => \$localport,
-    'verbose!' => \$verbose,
-);
+sub handleUDP {
+	my ($buf, $peer) = @_;
+	my ($request, $rcode, $ans, $auth, $add, $wait);

-my $ns = Net::DNS::Nameserver->new(
-    LocalAddr => $localaddr,
-    LocalPort => $localport,
-    ReplyHandler => \&reply_handler,
-    Verbose => $verbose,
-);
+	$request = new Net::DNS::Packet(\$buf, 0);
+	$@ and die $@;

-$ns->main_loop;
+	my ($question) = $request->question;
+	my $qname = $question->qname;
+	my $qclass = $question->qclass;
+	my $qtype = $question->qtype;
+
+	($rcode, $ans, $auth, $add, $wait) = reply_handler($qname, $qclass, $qtype);
+
+	my $reply = $request->reply();
+
+	$reply->header->rcode($rcode);
+	$reply->header->aa(@$ans ? 1 : 0);
+	$reply->header->id($request->header->id);
+	$reply->{answer} = $ans if $ans;
+	$reply->{authority} = $auth if $auth;
+	$reply->{additional} = $add if $add;
+
+	if ($wait) {
+		# reply_handler() asked us to delay sending this reply until
+		# another reply with $wait == 1 is generated or a timeout
+		# occurs.
+		if (@delayed_response) {
+			# A delayed reply is already queued, so we can now send
+			# both the delayed reply and the current reply.
+			send_delayed_response();
+			return $reply;
+		} elsif ($no_more_waiting) {
+			# It was determined before that there is no point in
+			# waiting for "accompanying" queries.  Thus, send the
+			# current reply immediately.
+			return $reply;
+		} else {
+			# No delayed reply is queued and the client is expected
+			# to send an "accompanying" query shortly.  Do not send
+			# the current reply right now, just save it for later
+			# and wait for an "accompanying" query to be received.
+			@delayed_response = ($reply, $peer);
+			$timeout = 0.5;
+			return;
+		}
+	} else {
+		# Send reply immediately.
+		return $reply;
+	}
+}
+
+sub send_delayed_response {
+	my ($reply, $peer) = @delayed_response;
+	# Truncation to 512 bytes is required for triggering "NS explosion" on
+	# builds without IPv6 support
+	$udpsock->send($reply->data(512), 0, $peer);
+	undef @delayed_response;
+	undef $timeout;
+}
+
+# Main
+my $rin;
+my $rout;
+for (;;) {
+	$rin = '';
+	vec($rin, fileno($udpsock), 1) = 1;
+
+	select($rout = $rin, undef, undef, $timeout);
+
+	if (vec($rout, fileno($udpsock), 1)) {
+		my ($buf, $peer, $reply);
+		$udpsock->recv($buf, 512);
+		$peer = $udpsock->peername();
+		$reply = handleUDP($buf, $peer);
+		# Truncation to 512 bytes is required for triggering "NS
+		# explosion" on builds without IPv6 support
+		$udpsock->send($reply->data(512), 0, $peer) if $reply;
+	} else {
+		# An "accompanying" query was expected to come in, but did not.
+		# Assume the client never sends "accompanying" queries to
+		# prevent pointlessly waiting for them ever again.
+		$no_more_waiting = 1;
+		# Send the delayed reply to the query which caused us to wait.
+		send_delayed_response();
+	}
+}
@@ -1,89 +0,0 @@
-#!/usr/bin/env perl
-#
-# Copyright (C) 2014, 2016  Internet Systems Consortium, Inc. ("ISC")
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, You can obtain one at http://mozilla.org/MPL/2.0/.
-
-use strict;
-use warnings;
-
-use IO::File;
-use Getopt::Long;
-use Net::DNS::Nameserver;
-
-my $pidf = new IO::File "ans.pid", "w" or die "cannot open pid file: $!";
-print $pidf "$$\n" or die "cannot write pid file: $!";
-$pidf->close or die "cannot close pid file: $!";
-sub rmpid { unlink "ans.pid"; exit 1; };
-
-$SIG{INT} = \&rmpid;
-$SIG{TERM} = \&rmpid;
-
-my $count = 0;
-my $send_response = 0;
-
-my $localaddr = "10.53.0.4";
-my $localport = 5300;
-my $verbose = 0;
-
-sub reply_handler {
-    my ($qname, $qclass, $qtype, $peerhost, $query, $conn) = @_;
-    my ($rcode, @ans, @auth, @add);
-
-    print ("request: $qname/$qtype\n");
-    STDOUT->flush();
-
-    $count += 1;
-
-    if ($qname eq "count" ) {
-        if ($qtype eq "TXT") {
-            my ($ttl, $rdata) = (0, "$count");
-            my $rr = new Net::DNS::RR("$qname $ttl $qclass $qtype $rdata");
-            push @ans, $rr;
-            print ("\tcount: $count\n");
-        }
-        $rcode = "NOERROR";
-    } elsif ($qname eq "reset" ) {
-        $count = 0;
-        $send_response = 0;
-        $rcode = "NOERROR";
-    } elsif ($qname eq "direct.example.net" ) {
-        if ($qtype eq "A") {
-            my ($ttl, $rdata) = (3600, $localaddr);
-            my $rr = new Net::DNS::RR("$qname $ttl $qclass $qtype $rdata");
-            push @ans, $rr;
-        }
-        $rcode = "NOERROR";
-    } elsif( $qname =~ /^ns1\.(\d+)\.example\.net$/ ) {
-        my $next = ($1 + 1) * 16;
-        for (my $i = 1; $i < 16; $i++) {
-            my $s = $next + $i;
-            my $rr = new Net::DNS::RR("$1.example.net 86400 $qclass NS ns1.$s.example.net");
-            push @auth, $rr;
-            $rr = new Net::DNS::RR("ns1.$s.example.net 86400 $qclass A 10.53.0.7");
-            push @add, $rr;
-        }
-        $rcode = "NOERROR";
-    } else {
-        $rcode = "NXDOMAIN";
-    }
-
-    # mark the answer as authoritive (by setting the 'aa' flag
-    return ($rcode, \@ans, \@auth, \@add, { aa => 1 });
-}
-
-GetOptions(
-    'port=i' => \$localport,
-    'verbose!' => \$verbose,
-);
-
-my $ns = Net::DNS::Nameserver->new(
-    LocalAddr => $localaddr,
-    LocalPort => $localport,
-    ReplyHandler => \&reply_handler,
-    Verbose => $verbose,
-);
-
-$ns->main_loop;
@@ -1,4 +1,4 @@
-; Copyright (C) 2014, 2016  Internet Systems Consortium, Inc. ("ISC")
+; Copyright (C) 2014, 2016, 2017  Internet Systems Consortium, Inc. ("ISC")
 ;
 ; This Source Code Form is subject to the terms of the Mozilla Public
 ; License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -11,4 +11,4 @@ ns.tld1. 60 IN A 10.53.0.1
 example.org. 60 IN NS direct.example.org.
 direct.example.org. 60 IN A 10.53.0.2
 example.net. 60 IN NS direct.example.net.
-direct.example.net. 60 IN A 10.53.0.4
+direct.example.net. 60 IN A 10.53.0.2
@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# Copyright (C) 2015, 2016  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2015-2017  Internet Systems Consortium, Inc. ("ISC")
 #
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -9,6 +9,20 @@
 SYSTEMTESTTOP=..
 . $SYSTEMTESTTOP/conf.sh

+if $PERL -e 'use Net::DNS;' 2>/dev/null
+then
+    if $PERL -e 'use Net::DNS; die if ($Net::DNS::VERSION <= 0.78);' 2>/dev/null
+    then
+        :
+    else
+        echo "I:Net::DNS versions up to 0.78 have a bug that causes this test to fail: please update." >&2
+        exit 1
+    fi
+else
+    echo "I:This test requires the Net::DNS library." >&2
+    exit 1
+fi
+
 if $PERL -e 'use Net::DNS::Nameserver;' 2>/dev/null
 then
    :
@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# Copyright (C) 2014-2016  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2014-2017  Internet Systems Consortium, Inc. ("ISC")
 #
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -14,101 +14,107 @@ DIGOPTS="-p 5300"
 status=0
 n=0

+ns3_reset() {
+	cp $1 ns3/named.conf
+	$RNDC -c ../common/rndc.conf -s 10.53.0.3 -p 9953 reconfig 2>&1 | sed 's/^/I:ns3 /'
+	$RNDC -c ../common/rndc.conf -s 10.53.0.3 -p 9953 flush | sed 's/^/I: ns3 /'
+}
+
+ns3_sends_aaaa_queries() {
+	if grep "started AAAA fetch" ns3/named.run >/dev/null; then
+		return 0
+	else
+		return 1
+	fi
+}
+
+# Check whether the number of queries ans2 received from ns3 (this value is
+# read from dig output stored in file $1) is as expected.  The expected query
+# count is variable:
+#   - if ns3 sends AAAA queries, the query count should equal $2,
+#   - if ns3 does not send AAAA queries, the query count should equal $3.
+check_query_count() {
+	count=`sed 's/[^0-9]//g;' $1`
+	expected_count_with_aaaa=$2
+	expected_count_without_aaaa=$3
+
+	if ns3_sends_aaaa_queries; then
+		expected_count=$expected_count_with_aaaa
+	else
+		expected_count=$expected_count_without_aaaa
+	fi
+
+	if [ $count -ne $expected_count ]; then
+		echo "I: count ($count) != $expected_count"
+		ret=1
+	fi
+}
+
+echo "I: set max-recursion-depth=12"
+
 n=`expr $n + 1`
-echo "I: attempt excessive-depth lookup ($n)"
+echo "I:  attempt excessive-depth lookup ($n)"
 ret=0
 echo "1000" > ans2/ans.limit
 $DIG $DIGOPTS @10.53.0.2 reset > /dev/null || ret=1
 $DIG $DIGOPTS @10.53.0.3 indirect1.example.org > dig.out.1.test$n || ret=1
 grep "status: SERVFAIL" dig.out.1.test$n > /dev/null || ret=1
 $DIG $DIGOPTS +short @10.53.0.2 count txt > dig.out.2.test$n || ret=1
-eval count=`cat dig.out.2.test$n`
-if [ "$TESTSOCK6" != "false" ]
-then
-  [ $count -eq 26 ] || { ret=1; echo "I: count ($count) != 26"; }
-else
-  [ $count -eq 14 ] || { ret=1; echo "I: count ($count) != 14"; }
-fi
+check_query_count dig.out.2.test$n 26 14
 if [ $ret != 0 ]; then echo "I:failed"; fi
 status=`expr $status + $ret`

 n=`expr $n + 1`
-echo "I: attempt permissible lookup ($n)"
+echo "I:  attempt permissible lookup ($n)"
 ret=0
-sleep 2
 echo "12" > ans2/ans.limit
-$RNDC -c ../common/rndc.conf -s 10.53.0.3 -p 9953 flush 2>&1 | sed 's/^/I:ns1 /'
+ns3_reset ns3/named1.conf
 $DIG $DIGOPTS @10.53.0.2 reset > /dev/null || ret=1
 $DIG $DIGOPTS @10.53.0.3 indirect2.example.org > dig.out.1.test$n || ret=1
 grep "status: NOERROR" dig.out.1.test$n > /dev/null || ret=1
 $DIG $DIGOPTS +short @10.53.0.2 count txt > dig.out.2.test$n || ret=1
-eval count=`cat dig.out.2.test$n`
-if [ "$TESTSOCK6" != "false" ]
-then
-  [ $count -eq 49 ] || { ret=1; echo "I: count ($count) != 49"; }
-else
-  [ $count -eq 26 ] || { ret=1; echo "I: count ($count) != 26"; }
-fi
+check_query_count dig.out.2.test$n 49 26
 if [ $ret != 0 ]; then echo "I:failed"; fi
 status=`expr $status + $ret`

-echo "I:reset max-recursion-depth"
-cp ns3/named2.conf ns3/named.conf
-$RNDC -c ../common/rndc.conf -s 10.53.0.3 -p 9953 reconfig 2>&1 | sed 's/^/I:ns1 /'
-sleep 2
+echo "I: set max-recursion-depth=5"

 n=`expr $n + 1`
-echo "I: attempt excessive-depth lookup ($n)"
+echo "I:  attempt excessive-depth lookup ($n)"
 ret=0
 echo "12" > ans2/ans.limit
-$RNDC -c ../common/rndc.conf -s 10.53.0.3 -p 9953 flush 2>&1 | sed 's/^/I:ns1 /'
+ns3_reset ns3/named2.conf
 $DIG $DIGOPTS @10.53.0.2 reset > /dev/null || ret=1
 $DIG $DIGOPTS @10.53.0.3 indirect3.example.org > dig.out.1.test$n || ret=1
 grep "status: SERVFAIL" dig.out.1.test$n > /dev/null || ret=1
 $DIG $DIGOPTS +short @10.53.0.2 count txt > dig.out.2.test$n || ret=1
-eval count=`cat dig.out.2.test$n`
-if [ "$TESTSOCK6" != "false" ]
-then
-  [ $count -eq 12 ] || { ret=1; echo "I: count ($count) != 12"; }
-else
-  [ $count -eq 7 ] || { ret=1; echo "I: count ($count) != 7"; }
-fi
+check_query_count dig.out.2.test$n 12 7
 if [ $ret != 0 ]; then echo "I:failed"; fi
 status=`expr $status + $ret`

 n=`expr $n + 1`
-echo "I: attempt permissible lookup ($n)"
+echo "I:  attempt permissible lookup ($n)"
 ret=0
 echo "5" > ans2/ans.limit
-$RNDC -c ../common/rndc.conf -s 10.53.0.3 -p 9953 flush 2>&1 | sed 's/^/I:ns1 /'
+ns3_reset ns3/named2.conf
 $DIG $DIGOPTS @10.53.0.2 reset > /dev/null || ret=1
 $DIG $DIGOPTS @10.53.0.3 indirect4.example.org > dig.out.1.test$n || ret=1
 grep "status: NOERROR" dig.out.1.test$n > /dev/null || ret=1
 $DIG $DIGOPTS +short @10.53.0.2 count txt > dig.out.2.test$n || ret=1
-eval count=`cat dig.out.2.test$n`
-if [ "$TESTSOCK6" != "false" ]
-then
-  [ $count -eq 21 ] || { ret=1; echo "I: count ($count) != 21"; }
-else
-  [ $count -eq 12 ] || { ret=1; echo "I: count ($count) != 12"; }
-fi
+check_query_count dig.out.2.test$n 21 12
 if [ $ret != 0 ]; then echo "I:failed"; fi
 status=`expr $status + $ret`

-echo "I:reset max-recursion-depth"
-cp ns3/named3.conf ns3/named.conf
-$RNDC -c ../common/rndc.conf -s 10.53.0.3 -p 9953 reconfig 2>&1 | sed 's/^/I:ns1 /'
-sleep 2
+echo "I: set max-recursion-depth=100, max-recursion-queries=50"

 n=`expr $n + 1`
-echo "I: attempt excessive-queries lookup ($n)"
+echo "I:  attempt excessive-queries lookup ($n)"
 ret=0
 echo "13" > ans2/ans.limit
-$RNDC -c ../common/rndc.conf -s 10.53.0.3 -p 9953 flush 2>&1 | sed 's/^/I:ns1 /'
+ns3_reset ns3/named3.conf
 $DIG $DIGOPTS @10.53.0.2 reset > /dev/null || ret=1
 $DIG $DIGOPTS @10.53.0.3 indirect5.example.org > dig.out.1.test$n || ret=1
-if [ "$TESTSOCK6" != "false" ]
-then
+if ns3_sends_aaaa_queries; then
  grep "status: SERVFAIL" dig.out.1.test$n > /dev/null || ret=1
 fi
 $DIG $DIGOPTS +short @10.53.0.2 count txt > dig.out.2.test$n || ret=1
@@ -118,10 +124,10 @@ if [ $ret != 0 ]; then echo "I:failed"; fi
 status=`expr $status + $ret`

 n=`expr $n + 1`
-echo "I: attempt permissible lookup ($n)"
+echo "I:  attempt permissible lookup ($n)"
 ret=0
 echo "12" > ans2/ans.limit
-$RNDC -c ../common/rndc.conf -s 10.53.0.3 -p 9953 flush 2>&1 | sed 's/^/I:ns1 /'
+ns3_reset ns3/named3.conf
 $DIG $DIGOPTS @10.53.0.2 reset > /dev/null || ret=1
 $DIG $DIGOPTS @10.53.0.3 indirect6.example.org > dig.out.1.test$n || ret=1
 grep "status: NOERROR" dig.out.1.test$n > /dev/null || ret=1
@@ -131,20 +137,16 @@ eval count=`cat dig.out.2.test$n`
 if [ $ret != 0 ]; then echo "I:failed"; fi
 status=`expr $status + $ret`

-echo "I:reset max-recursion-queries"
-cp ns3/named4.conf ns3/named.conf
-$RNDC -c ../common/rndc.conf -s 10.53.0.3 -p 9953 reconfig 2>&1 | sed 's/^/I:ns1 /'
-sleep 2
+echo "I: set max-recursion-depth=100, max-recursion-queries=40"

 n=`expr $n + 1`
-echo "I: attempt excessive-queries lookup ($n)"
+echo "I:  attempt excessive-queries lookup ($n)"
 ret=0
 echo "10" > ans2/ans.limit
-$RNDC -c ../common/rndc.conf -s 10.53.0.3 -p 9953 flush 2>&1 | sed 's/^/I:ns1 /'
+ns3_reset ns3/named4.conf
 $DIG $DIGOPTS @10.53.0.2 reset > /dev/null || ret=1
 $DIG $DIGOPTS @10.53.0.3 indirect7.example.org > dig.out.1.test$n || ret=1
-if [ "$TESTSOCK6" != "false" ]
-then
+if ns3_sends_aaaa_queries; then
  grep "status: SERVFAIL" dig.out.1.test$n > /dev/null || ret=1
 fi
 $DIG $DIGOPTS +short @10.53.0.2 count txt > dig.out.2.test$n || ret=1
@@ -154,10 +156,10 @@ if [ $ret != 0 ]; then echo "I:failed"; fi
 status=`expr $status + $ret`

 n=`expr $n + 1`
-echo "I: attempt permissible lookup ($n)"
+echo "I:  attempt permissible lookup ($n)"
 ret=0
 echo "9" > ans2/ans.limit
-$RNDC -c ../common/rndc.conf -s 10.53.0.3 -p 9953 flush 2>&1 | sed 's/^/I:ns1 /'
+ns3_reset ns3/named4.conf
 $DIG $DIGOPTS @10.53.0.2 reset > /dev/null || ret=1
 $DIG $DIGOPTS @10.53.0.3 indirect8.example.org > dig.out.1.test$n || ret=1
 grep "status: NOERROR" dig.out.1.test$n > /dev/null || ret=1
@@ -170,10 +172,10 @@ status=`expr $status + $ret`
 n=`expr $n + 1`
 echo "I: attempting NS explosion ($n)"
 ret=0
-$RNDC -c ../common/rndc.conf -s 10.53.0.3 -p 9953 flush 2>&1 | sed 's/^/I:ns1 /'
+ns3_reset ns3/named4.conf
+$DIG $DIGOPTS @10.53.0.2 reset > /dev/null || ret=1
 $DIG $DIGOPTS +short @10.53.0.3 ns1.1.example.net > dig.out.1.test$n || ret=1
-sleep 2
-$DIG $DIGOPTS +short @10.53.0.4 count txt > dig.out.2.test$n || ret=1
+$DIG $DIGOPTS +short @10.53.0.2 count txt > dig.out.2.test$n || ret=1
 eval count=`cat dig.out.2.test$n`
 [ $count -lt 50 ] || ret=1
 $DIG $DIGOPTS +short @10.53.0.7 count txt > dig.out.3.test$n || ret=1
@@ -14,4 +14,10 @@ $SHELL clean.sh
 cp ns2/named1.conf ns2/named.conf

 mkdir ns2/nope
-chmod 555 ns2/nope
+
+if [ 1 = "${CYGWIN:-0}" ]
+then
+    setfacl -s user::r-x,group::r-x,other::r-x ns2/nope
+else
+    chmod 555 ns2/nope
+fi
@@ -16,15 +16,6 @@ rm -f dig.out.*

 DIGOPTS="+tcp +noadd +nosea +nostat +nocmd -p 5300"

-# read everything that's been appended to a file since the last time
-# 'nextpart' was called.
-nextpart () {
-    [ -f $1.prev ] || echo "0" > $1.prev
-    prev=`cat $1.prev`
-    awk "FNR > $prev "'{ print }
-         END           { print NR > "/dev/stderr" }' $1 2> $1.prev
-}
-
 echo "I:checking DNSSEC SERVFAIL is cached ($n)"
 ret=0
 $DIG $DIGOPTS +dnssec foo.example. a @10.53.0.5 > dig.out.ns5.test$n || ret=1
@@ -342,8 +342,8 @@ status=`expr $status + $ret`

 echo "I:checking sync record publication"
 ret=0
-grep CDNSKEY $cfile.signed > /dev/null || ret=1
-grep CDS $cfile.signed > /dev/null || ret=1
+grep -w CDNSKEY $cfile.signed > /dev/null || ret=1
+grep -w CDS $cfile.signed > /dev/null || ret=1
 if [ $ret != 0 ]; then echo "I:failed"; fi
 status=`expr $status + $ret`

@@ -352,8 +352,8 @@ ret=0
 $SETTIME -P now -A now -Dsync now ${cksk5} > /dev/null
 $SIGNER -Sg -r $RANDFILE -o $czone -f $cfile.new $cfile.signed > /dev/null 2>&1
 mv $cfile.new $cfile.signed
-grep CDNSKEY $cfile.signed > /dev/null && ret=1
-grep CDS $cfile.signed > /dev/null && ret=1
+grep -w CDNSKEY $cfile.signed > /dev/null && ret=1
+grep -w CDS $cfile.signed > /dev/null && ret=1
 if [ $ret != 0 ]; then echo "I:failed"; fi
 status=`expr $status + $ret`

@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# Copyright (C) 2012, 2015, 2016  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2012, 2015-2017  Internet Systems Consortium, Inc. ("ISC")
 #
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -137,5 +137,12 @@ fi
 if [ $ret != 0 ]; then echo "I:failed"; fi
 status=`expr $status + $ret`

+ret=0
+n=`expr $n + 1`
+echo "I:checking priming queries are counted ($n)"
+grep "1 priming queries" ns3/named.stats
+if [ $ret != 0 ]; then echo "I:failed"; fi
+status=`expr $status + $ret`
+
 echo "I:exit status: $status"
 [ $status -eq 0 ] || exit 1
@@ -1,7 +1,6 @@
 arpaname
 dnstap-read
 genrandom
-isc-hmac-fixup
 mdig
 named-journalprint
 named-nzd2nzf
@@ -38,21 +38,21 @@ DNSTAPTARGETS =	dnstap-read@EXEEXT@
 NZDTARGETS =	named-nzd2nzf@EXEEXT@
 TARGETS =	arpaname@EXEEXT@ named-journalprint@EXEEXT@ \
 		named-rrchecker@EXEEXT@ nsec3hash@EXEEXT@ \
-		genrandom@EXEEXT@ isc-hmac-fixup@EXEEXT@ mdig@EXEEXT@ \
+		genrandom@EXEEXT@ mdig@EXEEXT@ \
 		@DNSTAPTARGETS@ @NZDTARGETS@

 DNSTAPSRCS  =	dnstap-read.c
 NZDSRCS  =	named-nzd2nzf.c
 SRCS =		arpaname.c named-journalprint.c named-rrchecker.c \
-		nsec3hash.c genrandom.c isc-hmac-fixup.c mdig.c \
+		nsec3hash.c genrandom.c mdig.c \
 		@DNSTAPSRCS@ @NZDSRCS@

 MANPAGES =	arpaname.1 dnstap-read.1 genrandom.8 \
-		isc-hmac-fixup.8 mdig.1 named-journalprint.8 \
+		mdig.1 named-journalprint.8 \
 		named-nzd2nzf.8 named-rrchecker.1 nsec3hash.8

 HTMLPAGES =	arpaname.html dnstap-read.html genrandom.html \
-		isc-hmac-fixup.html mdig.html named-journalprint.html \
+		mdig.html named-journalprint.html \
 		named-nzd2nzf.html named-rrchecker.html nsec3hash.html

 MANOBJS =	${MANPAGES} ${HTMLPAGES}
@@ -78,11 +78,6 @@ nsec3hash@EXEEXT@: nsec3hash.@O@ ${ISCDEPLIBS} ${DNSDEPLIBS}
 	export LIBS0="${DNSLIBS} ${ISCLIBS}"; \
 	${FINALBUILDCMD}

-isc-hmac-fixup@EXEEXT@: isc-hmac-fixup.@O@ ${ISCDEPLIBS}
-	export BASEOBJS="isc-hmac-fixup.@O@"; \
-	export LIBS0="${ISCLIBS}"; \
-	${FINALBUILDCMD}
-
 genrandom@EXEEXT@: genrandom.@O@
 	${LIBTOOL_MODE_LINK} ${PURIFY} ${CC} ${CFLAGS} ${LDFLAGS} \
 		-o $@ genrandom.@O@ @GENRANDOMLIB@ ${LIBS}
@@ -134,12 +129,9 @@ install:: ${TARGETS} installdirs @DNSTAP@ @NZD_TOOLS@
 		${DESTDIR}${sbindir}
 	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} genrandom@EXEEXT@ \
 		${DESTDIR}${sbindir}
-	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} isc-hmac-fixup@EXEEXT@ \
-		${DESTDIR}${sbindir}
 	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} mdig@EXEEXT@ \
 		${DESTDIR}${bindir}
 	${INSTALL_DATA} ${srcdir}/arpaname.1 ${DESTDIR}${mandir}/man1
-	${INSTALL_DATA} ${srcdir}/isc-hmac-fixup.8 ${DESTDIR}${mandir}/man8
 	${INSTALL_DATA} ${srcdir}/named-journalprint.8 ${DESTDIR}${mandir}/man8
 	${INSTALL_DATA} ${srcdir}/named-rrchecker.1 ${DESTDIR}${mandir}/man1
 	${INSTALL_DATA} ${srcdir}/nsec3hash.8 ${DESTDIR}${mandir}/man8
@@ -152,12 +144,9 @@ uninstall::
 	rm -f ${DESTDIR}${mandir}/man8/nsec3hash.8
 	rm -f ${DESTDIR}${mandir}/man1/named-rrchecker.1
 	rm -f ${DESTDIR}${mandir}/man8/named-journalprint.8
-	rm -f ${DESTDIR}${mandir}/man8/isc-hmac-fixup.8
 	rm -f ${DESTDIR}${mandir}/man1/arpaname.1
 	${LIBTOOL_MODE_UNINSTALL} rm -f \
 		${DESTDIR}${bindir}/mdig@EXEEXT@
-	${LIBTOOL_MODE_UNINSTALL} rm -f \
-		${DESTDIR}${sbindir}/isc-hmac-fixup@EXEEXT@
 	${LIBTOOL_MODE_UNINSTALL} rm -f \
 		${DESTDIR}${sbindir}/genrandom@EXEEXT@
 	${LIBTOOL_MODE_UNINSTALL} rm -f \
@@ -1,69 +0,0 @@
-.\" Copyright (C) 2010, 2013-2016 Internet Systems Consortium, Inc. ("ISC")
-.\" 
-.\" This Source Code Form is subject to the terms of the Mozilla Public
-.\" License, v. 2.0. If a copy of the MPL was not distributed with this
-.\" file, You can obtain one at http://mozilla.org/MPL/2.0/.
-.\"
-.hy 0
-.ad l
-'\" t
-.\"     Title: isc-hmac-fixup
-.\"    Author: 
-.\" Generator: DocBook XSL Stylesheets v1.78.1 <http://docbook.sf.net/>
-.\"      Date: 2013-04-28
-.\"    Manual: BIND9
-.\"    Source: ISC
-.\"  Language: English
-.\"
-.TH "ISC\-HMAC\-FIXUP" "8" "2013\-04\-28" "ISC" "BIND9"
-.\" -----------------------------------------------------------------
-.\" * Define some portability stuff
-.\" -----------------------------------------------------------------
-.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-.\" http://bugs.debian.org/507673
-.\" http://lists.gnu.org/archive/html/groff/2009-02/msg00013.html
-.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-.ie \n(.g .ds Aq \(aq
-.el       .ds Aq '
-.\" -----------------------------------------------------------------
-.\" * set default formatting
-.\" -----------------------------------------------------------------
-.\" disable hyphenation
-.nh
-.\" disable justification (adjust text to left margin only)
-.ad l
-.\" -----------------------------------------------------------------
-.\" * MAIN CONTENT STARTS HERE *
-.\" -----------------------------------------------------------------
-.SH "NAME"
-isc-hmac-fixup \- fixes HMAC keys generated by older versions of BIND
-.SH "SYNOPSIS"
-.HP \w'\fBisc\-hmac\-fixup\fR\ 'u
-\fBisc\-hmac\-fixup\fR {\fIalgorithm\fR} {\fIsecret\fR}
-.SH "DESCRIPTION"
-.PP
-Versions of BIND 9 up to and including BIND 9\&.6 had a bug causing HMAC\-SHA* TSIG keys which were longer than the digest length of the hash algorithm (i\&.e\&., SHA1 keys longer than 160 bits, SHA256 keys longer than 256 bits, etc) to be used incorrectly, generating a message authentication code that was incompatible with other DNS implementations\&.
-.PP
-This bug has been fixed in BIND 9\&.7\&. However, the fix may cause incompatibility between older and newer versions of BIND, when using long keys\&.
-\fBisc\-hmac\-fixup\fR
-modifies those keys to restore compatibility\&.
-.PP
-To modify a key, run
-\fBisc\-hmac\-fixup\fR
-and specify the key\*(Aqs algorithm and secret on the command line\&. If the secret is longer than the digest length of the algorithm (64 bytes for SHA1 through SHA256, or 128 bytes for SHA384 and SHA512), then a new secret will be generated consisting of a hash digest of the old secret\&. (If the secret did not require conversion, then it will be printed without modification\&.)
-.SH "SECURITY CONSIDERATIONS"
-.PP
-Secrets that have been converted by
-\fBisc\-hmac\-fixup\fR
-are shortened, but as this is how the HMAC protocol works in operation anyway, it does not affect security\&. RFC 2104 notes, "Keys longer than [the digest length] are acceptable but the extra length would not significantly increase the function strength\&."
-.SH "SEE ALSO"
-.PP
-BIND 9 Administrator Reference Manual,
-RFC 2104\&.
-.SH "AUTHOR"
-.PP
-\fBInternet Systems Consortium, Inc\&.\fR
-.SH "COPYRIGHT"
-.br
-Copyright \(co 2010, 2013-2016 Internet Systems Consortium, Inc. ("ISC")
-.br
@@ -1,139 +0,0 @@
-/*
- * Copyright (C) 2010, 2014-2016  Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- */
-
-/* $Id: isc-hmac-fixup.c,v 1.4 2010/03/10 02:17:52 marka Exp $ */
-
-#include <config.h>
-
-#include <isc/base64.h>
-#include <isc/buffer.h>
-#include <isc/md5.h>
-#include <isc/print.h>
-#include <isc/region.h>
-#include <isc/result.h>
-#include <isc/sha1.h>
-#include <isc/sha2.h>
-#include <isc/stdio.h>
-#include <isc/string.h>
-
-#include <pk11/site.h>
-
-#define HMAC_LEN	64
-
-int
-main(int argc, char **argv)  {
-	isc_buffer_t buf;
-	unsigned char key[1024];
-	char secret[1024];
-	char base64[(1024*4)/3];
-	isc_region_t r;
-	isc_result_t result;
-
-	if (argc != 3) {
-		fprintf(stderr, "Usage:\t%s algorithm secret\n", argv[0]);
-#ifndef PK11_MD5_DISABLE
-		fprintf(stderr, "\talgorithm: (MD5 | SHA1 | SHA224 | "
-				"SHA256 | SHA384 | SHA512)\n");
-#else
-		fprintf(stderr, "\talgorithm: (SHA1 | SHA224 | "
-				"SHA256 | SHA384 | SHA512)\n");
-#endif
-		return (1);
-	}
-
-	isc_buffer_init(&buf, secret, sizeof(secret));
-	result = isc_base64_decodestring(argv[2], &buf);
-	if (result != ISC_R_SUCCESS) {
-		fprintf(stderr, "error: %s\n", isc_result_totext(result));
-		return (1);
-	}
-	isc_buffer_usedregion(&buf, &r);
-
-#ifndef PK11_MD5_DISABLE
-	if (!strcasecmp(argv[1], "md5") ||
-	    !strcasecmp(argv[1], "hmac-md5")) {
-		if (r.length > HMAC_LEN) {
-			isc_md5_t md5ctx;
-			isc_md5_init(&md5ctx);
-			isc_md5_update(&md5ctx, r.base, r.length);
-			isc_md5_final(&md5ctx, key);
-
-			r.base = key;
-			r.length = ISC_MD5_DIGESTLENGTH;
-		}
-	} else
-#endif
-	if (!strcasecmp(argv[1], "sha1") ||
-		   !strcasecmp(argv[1], "hmac-sha1")) {
-		if (r.length > ISC_SHA1_DIGESTLENGTH) {
-			isc_sha1_t sha1ctx;
-			isc_sha1_init(&sha1ctx);
-			isc_sha1_update(&sha1ctx, r.base, r.length);
-			isc_sha1_final(&sha1ctx, key);
-
-			r.base = key;
-			r.length = ISC_SHA1_DIGESTLENGTH;
-		}
-	} else if (!strcasecmp(argv[1], "sha224") ||
-		   !strcasecmp(argv[1], "hmac-sha224")) {
-		if (r.length > ISC_SHA224_DIGESTLENGTH) {
-			isc_sha224_t sha224ctx;
-			isc_sha224_init(&sha224ctx);
-			isc_sha224_update(&sha224ctx, r.base, r.length);
-			isc_sha224_final(key, &sha224ctx);
-
-			r.base = key;
-			r.length = ISC_SHA224_DIGESTLENGTH;
-		}
-	} else if (!strcasecmp(argv[1], "sha256") ||
-		   !strcasecmp(argv[1], "hmac-sha256")) {
-		if (r.length > ISC_SHA256_DIGESTLENGTH) {
-			isc_sha256_t sha256ctx;
-			isc_sha256_init(&sha256ctx);
-			isc_sha256_update(&sha256ctx, r.base, r.length);
-			isc_sha256_final(key, &sha256ctx);
-
-			r.base = key;
-			r.length = ISC_SHA256_DIGESTLENGTH;
-		}
-	} else if (!strcasecmp(argv[1], "sha384") ||
-		   !strcasecmp(argv[1], "hmac-sha384")) {
-		if (r.length > ISC_SHA384_DIGESTLENGTH) {
-			isc_sha384_t sha384ctx;
-			isc_sha384_init(&sha384ctx);
-			isc_sha384_update(&sha384ctx, r.base, r.length);
-			isc_sha384_final(key, &sha384ctx);
-
-			r.base = key;
-			r.length = ISC_SHA384_DIGESTLENGTH;
-		}
-	} else if (!strcasecmp(argv[1], "sha512") ||
-		   !strcasecmp(argv[1], "hmac-sha512")) {
-		if (r.length > ISC_SHA512_DIGESTLENGTH) {
-			isc_sha512_t sha512ctx;
-			isc_sha512_init(&sha512ctx);
-			isc_sha512_update(&sha512ctx, r.base, r.length);
-			isc_sha512_final(key, &sha512ctx);
-
-			r.base = key;
-			r.length = ISC_SHA512_DIGESTLENGTH;
-		}
-	} else {
-		fprintf(stderr, "unknown hmac/digest algorithm: %s\n", argv[1]);
-		return (1);
-	}
-
-	isc_buffer_init(&buf, base64, sizeof(base64));
-	result = isc_base64_totext(&r, 0, "", &buf);
-	if (result != ISC_R_SUCCESS) {
-		fprintf(stderr, "error: %s\n", isc_result_totext(result));
-		return (1);
-	}
-	fprintf(stdout, "%.*s\n", (int)isc_buffer_usedlength(&buf), base64);
-	return (0);
-}
@@ -1,96 +0,0 @@
-<!--
- - Copyright (C) 2010, 2013-2016  Internet Systems Consortium, Inc. ("ISC")
- -
- - This Source Code Form is subject to the terms of the Mozilla Public
- - License, v. 2.0. If a copy of the MPL was not distributed with this
- - file, You can obtain one at http://mozilla.org/MPL/2.0/.
-->
-
-<!-- Converted by db4-upgrade version 1.0 -->
-<refentry xmlns:db="http://docbook.org/ns/docbook" version="5.0" xml:id="man.isc-hmac-fixup">
-  <info>
-    <date>2013-04-28</date>
-  </info>
-  <refentryinfo>
-    <corpname>ISC</corpname>
-    <corpauthor>Internet Systems Consortium, Inc.</corpauthor>
-  </refentryinfo>
-
-  <refmeta>
-    <refentrytitle><application>isc-hmac-fixup</application></refentrytitle>
-    <manvolnum>8</manvolnum>
-    <refmiscinfo>BIND9</refmiscinfo>
-  </refmeta>
-
-  <refnamediv>
-    <refname><application>isc-hmac-fixup</application></refname>
-    <refpurpose>fixes HMAC keys generated by older versions of BIND</refpurpose>
-  </refnamediv>
-
-  <docinfo>
-    <copyright>
-      <year>2010</year>
-      <year>2013</year>
-      <year>2014</year>
-      <year>2015</year>
-      <year>2016</year>
-      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
-    </copyright>
-  </docinfo>
-
-  <refsynopsisdiv>
-    <cmdsynopsis sepchar=" ">
-      <command>isc-hmac-fixup</command>
-      <arg choice="req" rep="norepeat"><replaceable class="parameter">algorithm</replaceable></arg>
-      <arg choice="req" rep="norepeat"><replaceable class="parameter">secret</replaceable></arg>
-    </cmdsynopsis>
-  </refsynopsisdiv>
-
-  <refsection><info><title>DESCRIPTION</title></info>
-
-    <para>
-      Versions of BIND 9 up to and including BIND 9.6 had a bug causing
-      HMAC-SHA* TSIG keys which were longer than the digest length of the
-      hash algorithm (i.e., SHA1 keys longer than 160 bits, SHA256 keys
-      longer than 256 bits, etc) to be used incorrectly, generating a
-      message authentication code that was incompatible with other DNS
-      implementations.
-    </para>
-    <para>
-      This bug has been fixed in BIND 9.7.  However, the fix may
-      cause incompatibility between older and newer versions of
-      BIND, when using long keys.  <command>isc-hmac-fixup</command>
-      modifies those keys to restore compatibility.
-    </para>
-    <para>
-      To modify a key, run <command>isc-hmac-fixup</command> and
-      specify the key's algorithm and secret on the command line.  If the
-      secret is longer than the digest length of the algorithm (64 bytes
-      for SHA1 through SHA256, or 128 bytes for SHA384 and SHA512), then a
-      new secret will be generated consisting of a hash digest of the old
-      secret.  (If the secret did not require conversion, then it will be
-      printed without modification.)
-    </para>
-  </refsection>
-
-  <refsection><info><title>SECURITY CONSIDERATIONS</title></info>
-
-    <para>
-      Secrets that have been converted by <command>isc-hmac-fixup</command>
-      are shortened, but as this is how the HMAC protocol works in
-      operation anyway, it does not affect security.  RFC 2104 notes,
-      "Keys longer than [the digest length] are acceptable but the
-      extra length would not significantly increase the function
-      strength."
-    </para>
-  </refsection>
-
-  <refsection><info><title>SEE ALSO</title></info>
-
-    <para>
-      <citetitle>BIND 9 Administrator Reference Manual</citetitle>,
-      <citetitle>RFC 2104</citetitle>.
-    </para>
-  </refsection>
-
-</refentry>
@@ -1,92 +0,0 @@
-<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
-<!--
- - Copyright (C) 2010, 2013-2016 Internet Systems Consortium, Inc. ("ISC")
- - 
- - This Source Code Form is subject to the terms of the Mozilla Public
- - License, v. 2.0. If a copy of the MPL was not distributed with this
- - file, You can obtain one at http://mozilla.org/MPL/2.0/.
-->
-<html lang="en">
-<head>
-<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
-<title>isc-hmac-fixup</title>
-<meta name="generator" content="DocBook XSL Stylesheets V1.78.1">
-</head>
-<body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="refentry">
-<a name="man.isc-hmac-fixup"></a><div class="titlepage"></div>
-  
-  
-
-  
-
-  <div class="refnamediv">
-<h2>Name</h2>
-<p>
-    <span class="application">isc-hmac-fixup</span>
-     &#8212; fixes HMAC keys generated by older versions of BIND
-  </p>
-</div>
-
-  
-
-  <div class="refsynopsisdiv">
-<h2>Synopsis</h2>
-    <div class="cmdsynopsis"><p>
-      <code class="command">isc-hmac-fixup</code> 
-       {<em class="replaceable"><code>algorithm</code></em>}
-       {<em class="replaceable"><code>secret</code></em>}
-    </p></div>
-  </div>
-
-  <div class="refsection">
-<a name="id-1.7"></a><h2>DESCRIPTION</h2>
-
-    <p>
-      Versions of BIND 9 up to and including BIND 9.6 had a bug causing
-      HMAC-SHA* TSIG keys which were longer than the digest length of the
-      hash algorithm (i.e., SHA1 keys longer than 160 bits, SHA256 keys
-      longer than 256 bits, etc) to be used incorrectly, generating a
-      message authentication code that was incompatible with other DNS
-      implementations.
-    </p>
-    <p>
-      This bug has been fixed in BIND 9.7.  However, the fix may
-      cause incompatibility between older and newer versions of
-      BIND, when using long keys.  <span class="command"><strong>isc-hmac-fixup</strong></span>
-      modifies those keys to restore compatibility.
-    </p>
-    <p>
-      To modify a key, run <span class="command"><strong>isc-hmac-fixup</strong></span> and
-      specify the key's algorithm and secret on the command line.  If the
-      secret is longer than the digest length of the algorithm (64 bytes
-      for SHA1 through SHA256, or 128 bytes for SHA384 and SHA512), then a
-      new secret will be generated consisting of a hash digest of the old
-      secret.  (If the secret did not require conversion, then it will be
-      printed without modification.)
-    </p>
-  </div>
-
-  <div class="refsection">
-<a name="id-1.8"></a><h2>SECURITY CONSIDERATIONS</h2>
-
-    <p>
-      Secrets that have been converted by <span class="command"><strong>isc-hmac-fixup</strong></span>
-      are shortened, but as this is how the HMAC protocol works in
-      operation anyway, it does not affect security.  RFC 2104 notes,
-      "Keys longer than [the digest length] are acceptable but the
-      extra length would not significantly increase the function
-      strength."
-    </p>
-  </div>
-
-  <div class="refsection">
-<a name="id-1.9"></a><h2>SEE ALSO</h2>
-
-    <p>
-      <em class="citetitle">BIND 9 Administrator Reference Manual</em>,
-      <em class="citetitle">RFC 2104</em>.
-    </p>
-  </div>
-
-</div></body>
-</html>
@@ -16,6 +16,8 @@
 #include <stdlib.h>
 #include <lmdb.h>

+#include <dns/view.h>
+
 #include <isc/print.h>

 int
@@ -36,42 +38,43 @@ main (int argc, char *argv[]) {
 	path = argv[1];

 	status = mdb_env_create(&env);
-	if (status != 0) {
+	if (status != MDB_SUCCESS) {
 		fprintf(stderr, "named-nzd2nzf: mdb_env_create: %s",
 			mdb_strerror(status));
 		exit(1);
 	}

-	status = mdb_env_open(env, path,
-			      MDB_RDONLY|MDB_NOTLS|MDB_NOSUBDIR, 0600);
-	if (status != 0) {
+	status = mdb_env_open(env, path, DNS_LMDB_FLAGS, 0600);
+	if (status != MDB_SUCCESS) {
 		fprintf(stderr, "named-nzd2nzf: mdb_env_open: %s",
 			mdb_strerror(status));
 		exit(1);
 	}

 	status = mdb_txn_begin(env, 0, MDB_RDONLY, &txn);
-	if (status != 0) {
+	if (status != MDB_SUCCESS) {
 		fprintf(stderr, "named-nzd2nzf: mdb_txn_begin: %s",
 			mdb_strerror(status));
 		exit(1);
 	}

 	status = mdb_dbi_open(txn, NULL, 0, &dbi);
-	if (status != 0) {
+	if (status != MDB_SUCCESS) {
 		fprintf(stderr, "named-nzd2nzf: mdb_dbi_open: %s",
 			mdb_strerror(status));
 		exit(1);
 	}

 	status = mdb_cursor_open(txn, dbi, &cursor);
-	if (status != 0) {
+	if (status != MDB_SUCCESS) {
 		fprintf(stderr, "named-nzd2nzf: mdb_cursor_open: %s",
 			mdb_strerror(status));
 		exit(1);
 	}

-	while (mdb_cursor_get(cursor, &key, &data, MDB_NEXT) == 0) {
+	for (status = mdb_cursor_get(cursor, &key, &data, MDB_FIRST);
+	     status == MDB_SUCCESS;
+	     status = mdb_cursor_get(cursor, &key, &data, MDB_NEXT)) {
 		if (key.mv_data == NULL || key.mv_size == 0 ||
 		    data.mv_data == NULL || data.mv_size == 0)
 		{
@@ -1,18 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
-  <ItemGroup>
-    <Filter Include="Source Files">
-      <UniqueIdentifier>{4FC737F1-C7A5-4376-A066-2A32D752A2FF}</UniqueIdentifier>
-      <Extensions>cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx</Extensions>
-    </Filter>
-    <Filter Include="Resource Files">
-      <UniqueIdentifier>{67DA6AB6-F800-4c08-8B7A-83BB121AAD01}</UniqueIdentifier>
-      <Extensions>rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms</Extensions>
-    </Filter>
-  </ItemGroup>
-  <ItemGroup>
-    <ClCompile Include="..\isc-hmac-fixup.c">
-      <Filter>Source Files</Filter>
-    </ClCompile>
-  </ItemGroup>
-</Project>
@@ -1,112 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<Project DefaultTargets="Build" ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
-  <ItemGroup Label="ProjectConfigurations">
-    <ProjectConfiguration Include="Debug|@PLATFORM@">
-      <Configuration>Debug</Configuration>
-      <Platform>@PLATFORM@</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="Release|@PLATFORM@">
-      <Configuration>Release</Configuration>
-      <Platform>@PLATFORM@</Platform>
-    </ProjectConfiguration>
-  </ItemGroup>
-  <PropertyGroup Label="Globals">
-    <ProjectGuid>{70F2F0DF-665D-4444-A982-AEA31A861A22}</ProjectGuid>
-    <Keyword>Win32Proj</Keyword>
-    <RootNamespace>ischmacfixup</RootNamespace>
-  </PropertyGroup>
-  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|@PLATFORM@'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseDebugLibraries>true</UseDebugLibraries>
-    <CharacterSet>MultiByte</CharacterSet>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseDebugLibraries>false</UseDebugLibraries>
-    <WholeProgramOptimization>true</WholeProgramOptimization>
-    <CharacterSet>MultiByte</CharacterSet>
-  </PropertyGroup>
-  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
-  <ImportGroup Label="ExtensionSettings">
-  </ImportGroup>
-  <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|@PLATFORM@'">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <PropertyGroup Label="UserMacros" />
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|@PLATFORM@'">
-    <LinkIncremental>true</LinkIncremental>
-    <OutDir>..\..\..\Build\$(Configuration)\</OutDir>
-    <IntDir>.\$(Configuration)\</IntDir>
-    <TargetName>isc-hmac-fixup</TargetName>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'">
-    <LinkIncremental>false</LinkIncremental>
-    <OutDir>..\..\..\Build\$(Configuration)\</OutDir>
-    <IntDir>.\$(Configuration)\</IntDir>
-    <TargetName>isc-hmac-fixup</TargetName>
-  </PropertyGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|@PLATFORM@'">
-    <ClCompile>
-      <PrecompiledHeader>
-      </PrecompiledHeader>
-      <WarningLevel>Level3</WarningLevel>
-      <Optimization>Disabled</Optimization>
-      <PreprocessorDefinitions>WIN32;@CRYPTO@_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <PrecompiledHeaderOutputFile>.\$(Configuration)\$(ProjectName).pch</PrecompiledHeaderOutputFile>
-      <AssemblerListingLocation>.\$(Configuration)\</AssemblerListingLocation>
-      <ObjectFileName>.\$(Configuration)\</ObjectFileName>
-      <ProgramDataBaseFileName>$(OutDir)$(TargetName).pdb</ProgramDataBaseFileName>
-      <BrowseInformation>true</BrowseInformation>
-      <AdditionalIncludeDirectories>.\;..\..\..\;@LIBXML2_INC@@OPENSSL_INC@..\..\..\lib\isc\win32;..\..\..\lib\isc\win32\include;..\..\..\lib\isc\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <CompileAs>CompileAsC</CompileAs>
-    </ClCompile>
-    <Link>
-      <SubSystem>Console</SubSystem>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\lib\isc\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>libisc.lib;%(AdditionalDependencies)</AdditionalDependencies>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'">
-    <ClCompile>
-      <WarningLevel>Level3</WarningLevel>
-      <PrecompiledHeader>
-      </PrecompiledHeader>
-      <Optimization>MaxSpeed</Optimization>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <IntrinsicFunctions>@INTRINSIC@</IntrinsicFunctions>
-      <PreprocessorDefinitions>WIN32;@CRYPTO@NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <WholeProgramOptimization>false</WholeProgramOptimization>
-      <StringPooling>true</StringPooling>
-      <PrecompiledHeaderOutputFile>.\$(Configuration)\$(ProjectName).pch</PrecompiledHeaderOutputFile>
-      <AssemblerListingLocation>.\$(Configuration)\</AssemblerListingLocation>
-      <ObjectFileName>.\$(Configuration)\</ObjectFileName>
-      <ProgramDataBaseFileName>$(OutDir)$(TargetName).pdb</ProgramDataBaseFileName>
-      <AdditionalIncludeDirectories>.\;..\..\..\;@LIBXML2_INC@@OPENSSL_INC@..\..\..\lib\isc\win32;..\..\..\lib\isc\win32\include;..\..\..\lib\isc\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <CompileAs>CompileAsC</CompileAs>
-    </ClCompile>
-    <Link>
-      <SubSystem>Console</SubSystem>
-      <GenerateDebugInformation>false</GenerateDebugInformation>
-      <EnableCOMDATFolding>true</EnableCOMDATFolding>
-      <OptimizeReferences>true</OptimizeReferences>
-      <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
-      <LinkTimeCodeGeneration>Default</LinkTimeCodeGeneration>
-      <AdditionalLibraryDirectories>..\..\..\lib\isc\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>libisc.lib;%(AdditionalDependencies)</AdditionalDependencies>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemGroup>
-    <ClCompile Include="..\isc-hmac-fixup.c" />
-  </ItemGroup>
-  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
-  <ImportGroup Label="ExtensionTargets">
-  </ImportGroup>
-</Project>
@@ -1,3 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
-</Project>
@@ -186,7 +186,6 @@ const FileData installFiles[] =
 	{"named-compilezone.exe", FileData::BinDir, FileData::Normal, FALSE, FALSE},
 	{"named-journalprint.exe", FileData::BinDir, FileData::Normal, FALSE, FALSE},
 	{"named-rrchecker.exe", FileData::BinDir, FileData::Normal, FALSE, FALSE},
-	{"isc-hmac-fixup.exe", FileData::BinDir, FileData::Normal, FALSE, FALSE},
 #ifdef USE_PKCS11
 	{"pkcs11-destroy.exe", FileData::BinDir, FileData::Normal, FALSE, FALSE},
 	{"pkcs11-keygen.exe", FileData::BinDir, FileData::Normal, FALSE, FALSE},
@@ -535,6 +535,9 @@ int sigwait(const unsigned int *set, int *sig);
 /* Define to the sockaddr length type used by getnameinfo(3). */
 #undef IRS_GETNAMEINFO_SOCKLEN_T

+/* Define if you want to use inline buffers */
+#undef ISC_BUFFER_USEINLINE
+
 /* Define to allow building of objects for dlopen(). */
 #undef ISC_DLZ_DLOPEN

@@ -940,7 +940,6 @@ infodir
 docdir
 oldincludedir
 includedir
-runstatedir
 localstatedir
 sharedstatedir
 sysconfdir
@@ -981,6 +980,7 @@ with_gnu_ld
 with_sysroot
 enable_libtool_lock
 enable_libbind
+enable_buffer_useinline
 enable_warn_shadow
 enable_warn_error
 enable_developer
@@ -1103,7 +1103,6 @@ datadir='${datarootdir}'
 sysconfdir='${prefix}/etc'
 sharedstatedir='${prefix}/com'
 localstatedir='${prefix}/var'
-runstatedir='${localstatedir}/run'
 includedir='${prefix}/include'
 oldincludedir='/usr/include'
 docdir='${datarootdir}/doc/${PACKAGE_TARNAME}'
@@ -1356,15 +1355,6 @@ do
  | -silent | --silent | --silen | --sile | --sil)
    silent=yes ;;

-  -runstatedir | --runstatedir | --runstatedi | --runstated \
-  | --runstate | --runstat | --runsta | --runst | --runs \
-  | --run | --ru | --r)
-    ac_prev=runstatedir ;;
-  -runstatedir=* | --runstatedir=* | --runstatedi=* | --runstated=* \
-  | --runstate=* | --runstat=* | --runsta=* | --runst=* | --runs=* \
-  | --run=* | --ru=* | --r=*)
-    runstatedir=$ac_optarg ;;
-
  -sbindir | --sbindir | --sbindi | --sbind | --sbin | --sbi | --sb)
    ac_prev=sbindir ;;
  -sbindir=* | --sbindir=* | --sbindi=* | --sbind=* | --sbin=* \
@@ -1502,7 +1492,7 @@ fi
 for ac_var in	exec_prefix prefix bindir sbindir libexecdir datarootdir \
 		datadir sysconfdir sharedstatedir localstatedir includedir \
 		oldincludedir docdir infodir htmldir dvidir pdfdir psdir \
-		libdir localedir mandir runstatedir
+		libdir localedir mandir
 do
  eval ac_val=\$$ac_var
  # Remove trailing slashes.
@@ -1655,7 +1645,6 @@ Fine tuning of the installation directories:
  --sysconfdir=DIR        read-only single-machine data [PREFIX/etc]
  --sharedstatedir=DIR    modifiable architecture-independent data [PREFIX/com]
  --localstatedir=DIR     modifiable single-machine data [PREFIX/var]
-  --runstatedir=DIR       modifiable per-process data [LOCALSTATEDIR/run]
  --libdir=DIR            object code libraries [EPREFIX/lib]
  --includedir=DIR        C header files [PREFIX/include]
  --oldincludedir=DIR     C header files for non-gcc [/usr/include]
@@ -1697,11 +1686,14 @@ Optional Features:
  --enable-fast-install[=PKGS]
                          optimize for fast installation [default=yes]
  --disable-libtool-lock  avoid locking (might break parallel builds)
-  --enable-libbind	  deprecated
-  --enable-warn-shadow	  turn on -Wshadow when compiling
-  --enable-warn-error	  turn on -Werror when compiling
+  --enable-libbind        deprecated
+  --enable-buffer-useinline
+                          define ISC_BUFFER_USEINLINE when compiling
+                          [default=yes]
+  --enable-warn-shadow    turn on -Wshadow when compiling
+  --enable-warn-error     turn on -Werror when compiling
  --enable-developer      enable developer build settings
-  --enable-afl		  enable American Fuzzy Lop test harness [default=no]
+  --enable-afl            enable American Fuzzy Lop test harness [default=no]
  --enable-seccomp        enable support for libseccomp system call filtering
                          [default=no]
  --enable-kqueue         use BSD kqueue when available [default=yes]
@@ -1713,26 +1705,27 @@ Optional Features:
                          check OpenSSL version [default=yes]
  --enable-openssl-hash   use OpenSSL for hash functions [default=yes]
  --enable-crypto-rand    use the crypto provider for random [default=yes]
-  --enable-largefile	  64-bit file support
+  --enable-largefile      64-bit file support
  --enable-backtrace      log stack backtrace on abort [default=yes]
  --enable-symtable       use internal symbol table for backtrace
-			  [all|minimal(default)|none]
-  --enable-ipv6           use IPv6 default=autodetect
+                          [all|minimal(default)|none]
+  --enable-ipv6           use IPv6 [default=autodetect]
  --disable-tcp-fastopen  disable TCP Fast Open support [default=autodetect]
  --enable-getifaddrs     enable the use of getifaddrs() [yes|no].
  --disable-isc-spnego    use SPNEGO from GSSAPI library
  --disable-chroot        disable chroot
-  --disable-linux-caps	  disable linux capabilities
-  --enable-atomic	  enable machine specific atomic operations
-			  [default=autodetect]
+  --disable-linux-caps    disable linux capabilities
+  --enable-atomic         enable machine specific atomic operations
+                          [default=autodetect]
  --enable-fixed-rrset    enable fixed rrset ordering [default=no]
-  --disable-rpz-nsip	  disable rpz nsip rules [default=enabled]
-  --disable-rpz-nsdname	  disable rpz nsdname rules [default=enabled]
-  --enable-dnsrps-dl	  DNS Response Policy Service delayed link [default=$librpz_dl]
+  --disable-rpz-nsip      disable rpz nsip rules [default=enabled]
+  --disable-rpz-nsdname   disable rpz nsdname rules [default=enabled]
+  --enable-dnsrps-dl      DNS Response Policy Service delayed link
+                          [default=$librpz_dl]
  --enable-dnsrps         enable DNS Response Policy Service API
  --enable-dnstap         enable dnstap support (requires fstrm, protobuf-c)
  --enable-querytrace     enable very verbose query trace logging [default=no]
-  --enable-full-report	  report values of all configure options
+  --enable-full-report    report values of all configure options

 Optional Packages:
  --with-PACKAGE[=ARG]    use PACKAGE [ARG=yes]
@@ -1746,54 +1739,60 @@ Optional Packages:
  --with-python-install-dir=PATH
                          installation directory for Python modules
  --with-geoip=PATH       Build with GeoIP support (yes|no|path)
-  --with-gssapi=[PATH|[/path/]krb5-config]      Specify path for system-supplied GSSAPI [default=yes]
+  --with-gssapi=PATH|/path/krb5-config
+                          Specify path for system-supplied GSSAPI
+                          [default=yes]
  --with-randomdev=PATH   Specify path for random device
  --with-locktype=ARG     Specify mutex lock type (adaptive or standard)
  --with-libtool          use GNU libtool
-  --with-openssl=PATH     Build with OpenSSL yes|no|path.
-			  (Crypto is required for DNSSEC)
-  --with-pkcs11=PATH      Build with PKCS11 support yes|no|path
-			  (PATH is for the PKCS11 provider)
+  --with-openssl=PATH     Build with OpenSSL [yes|no|path]. (Crypto is
+                          required for DNSSEC)
+  --with-pkcs11=PATH      Build with PKCS11 support [yes|no|path] (PATH is for
+                          the PKCS11 provider)
  --with-ecdsa            Crypto ECDSA
-  --with-gost             Crypto GOST yes|no|raw|asn1.
-  --with-eddsa            Crypto EDDSA yes|all|no.
+  --with-gost             Crypto GOST [yes|no|raw|asn1].
+  --with-eddsa            Crypto EDDSA [yes|all|no].
  --with-aes              Crypto AES
-  --with-cc-alg=ALG      choose the algorithm for Client Cookie [aes|sha1|sha256]
-  --with-lmdb=PATH        build with LMDB library yes|no|path
-  --with-libxml2=PATH     build with libxml2 library yes|no|path
-  --with-libjson=PATH     build with libjson0 library yes|no|path
+  --with-cc-alg=ALG       choose the algorithm for Client Cookie
+                          [aes|sha1|sha256]
+  --with-lmdb=PATH        build with LMDB library [yes|no|path]
+  --with-libxml2=PATH     build with libxml2 library [yes|no|path]
+  --with-libjson=PATH     build with libjson0 library [yes|no|path]
  --with-zlib=PATH        build with zlib for HTTP compression [default=yes]
  --with-purify=PATH      use Rational purify
-  --with-gperftools-profiler  use gperftools CPU profiler
-  --with-kame=PATH	  use Kame IPv6 default path /usr/local/v6
-  --with-readline=LIBSPEC    specify readline library default auto
+  --with-gperftools-profiler
+                          use gperftools CPU profiler
+  --with-kame=PATH        use Kame IPv6 [default path /usr/local/v6]
+  --with-readline=LIBSPEC specify readline library [default auto]

-  --with-dnsrps-libname  DNSRPS provider library name (librpz.so)
-  --with-dnsrps-dir	  path to DNSRPS provider library
+  --with-dnsrps-libname   DNSRPS provider library name (librpz.so)
+  --with-dnsrps-dir       path to DNSRPS provider library
  --with-protobuf-c=path  Path where protobuf-c is installed, for dnstap
  --with-libfstrm=path    Path where libfstrm is installed, for dnstap
  --with-docbook-xsl=PATH specify path for Docbook-XSL stylesheets
-  --with-idn=MPREFIX      enable IDN support using idnkit default PREFIX
-  --with-libiconv=IPREFIX GNU libiconv are in IPREFIX default PREFIX
-  --with-iconv=LIBSPEC    specify iconv library default -liconv
+  --with-idn=MPREFIX      enable IDN support using idnkit [default PREFIX]
+  --with-libiconv=IPREFIX GNU libiconv are in IPREFIX [default PREFIX]
+  --with-iconv=LIBSPEC    specify iconv library [default -liconv]
  --with-idnlib=ARG       specify libidnkit
-  --with-atf=ARG          support Automated Test Framework
+  --with-atf              support Automated Test Framework
  --with-tuning=ARG       Specify server tuning (large or default)
  --with-dlopen=ARG       support dynamically loadable DLZ drivers
-  --with-dlz-postgres=PATH   Build with Postgres DLZ driver yes|no|path.
-			       (Required to use Postgres with DLZ)
-  --with-dlz-mysql=PATH   Build with MySQL DLZ driver yes|no|path.
-			       (Required to use MySQL with DLZ)
-  --with-dlz-bdb=PATH   Build with Berkeley DB DLZ driver yes|no|path.
-			       (Required to use Berkeley DB with DLZ)
-  --with-dlz-filesystem=ARG    Build with filesystem DLZ driver yes|no.
-			       (Required to use file system driver with DLZ)
-  --with-dlz-ldap=PATH   Build with LDAP DLZ driver yes|no|path.
-			       (Required to use LDAP with DLZ)
-  --with-dlz-odbc=PATH   Build with ODBC DLZ driver yes|no|path.
-			       (Required to use ODBC with DLZ)
-  --with-dlz-stub=ARG    Build with stub DLZ driver yes|no.
-			       (Required to use stub driver with DLZ)
+  --with-dlz-postgres=PATH
+                          Build with Postgres DLZ driver [yes|no|path].
+                          (Required to use Postgres with DLZ)
+  --with-dlz-mysql=PATH   Build with MySQL DLZ driver [yes|no|path]. (Required
+                          to use MySQL with DLZ)
+  --with-dlz-bdb=PATH     Build with Berkeley DB DLZ driver [yes|no|path].
+                          (Required to use Berkeley DB with DLZ)
+  --with-dlz-filesystem=ARG
+                          Build with filesystem DLZ driver [yes|no]. (Required
+                          to use file system driver with DLZ)
+  --with-dlz-ldap=PATH    Build with LDAP DLZ driver [yes|no|path]. (Required
+                          to use LDAP with DLZ)
+  --with-dlz-odbc=PATH    Build with ODBC DLZ driver [yes|no|path]. (Required
+                          to use ODBC with DLZ)
+  --with-dlz-stub=ARG     Build with stub DLZ driver [yes|no]. (Required to
+                          use stub driver with DLZ)
  --with-make-clean       run "make clean" at end of configure [yes|no]

 Some influential environment variables:
@@ -11456,6 +11455,20 @@ It is available from http://www.isc.org as a separate download." "$LINENO" 5
 		;;
 esac

+# Check whether --enable-buffer_useinline was given.
+if test "${enable_buffer_useinline+set}" = set; then :
+  enableval=$enable_buffer_useinline; if test yes = "${enable}"
+	      then
+
+$as_echo "#define ISC_BUFFER_USEINLINE 1" >>confdefs.h
+
+	      fi
+else
+  $as_echo "#define ISC_BUFFER_USEINLINE 1" >>confdefs.h
+
+fi
+
+
 # Check whether --enable-warn_shadow was given.
 if test "${enable_warn_shadow+set}" = set; then :
  enableval=$enable_warn_shadow;
@@ -11937,24 +11950,24 @@ $as_echo_n "checking python2 version >= 2.7 or python3 version >= 3.2... " >&6;
 				if ${PYTHON:-false} -c "$testminvers"; then
 					{ $as_echo "$as_me:${as_lineno-$LINENO}: result: found" >&5
 $as_echo "found" >&6; }
-                                else
-                                        { $as_echo "$as_me:${as_lineno-$LINENO}: result: not found" >&5
+				else
+					{ $as_echo "$as_me:${as_lineno-$LINENO}: result: not found" >&5
 $as_echo "not found" >&6; }
-                                        unset ac_cv_path_PYTHON
-                                        unset PYTHON
-                                        continue
+					unset ac_cv_path_PYTHON
+					unset PYTHON
+					continue
 				fi
 				{ $as_echo "$as_me:${as_lineno-$LINENO}: checking python module 'argparse'" >&5
 $as_echo_n "checking python module 'argparse'... " >&6; }
 				if ${PYTHON:-false} -c "$testargparse"; then
 					{ $as_echo "$as_me:${as_lineno-$LINENO}: result: found" >&5
 $as_echo "found" >&6; }
-                                else
-                                        { $as_echo "$as_me:${as_lineno-$LINENO}: result: not found" >&5
+				else
+					{ $as_echo "$as_me:${as_lineno-$LINENO}: result: not found" >&5
 $as_echo "not found" >&6; }
-                                        unset ac_cv_path_PYTHON
-                                        unset PYTHON
-                                        continue
+					unset ac_cv_path_PYTHON
+					unset PYTHON
+					continue
 				fi

 				{ $as_echo "$as_me:${as_lineno-$LINENO}: checking python module 'ply'" >&5
@@ -11963,11 +11976,11 @@ $as_echo_n "checking python module 'ply'... " >&6; }
 					{ $as_echo "$as_me:${as_lineno-$LINENO}: result: found" >&5
 $as_echo "found" >&6; }
 					break
-                                else
-                                        { $as_echo "$as_me:${as_lineno-$LINENO}: result: not found" >&5
+				else
+					{ $as_echo "$as_me:${as_lineno-$LINENO}: result: not found" >&5
 $as_echo "not found" >&6; }
-                                        unset ac_cv_path_PYTHON
-                                        unset PYTHON
+					unset ac_cv_path_PYTHON
+					unset PYTHON
 				fi
 			done
 			if test "X$PYTHON" != "X"
@@ -13394,12 +13407,12 @@ _ACEOF
 if ac_fn_c_try_compile "$LINENO"; then :
  { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
 $as_echo "yes" >&6; }
-         $as_echo "#define HAVE_UNAME 1" >>confdefs.h
+	 $as_echo "#define HAVE_UNAME 1" >>confdefs.h

 else
  { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
 $as_echo "no" >&6; }
-         { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: uname is not correctly supported" >&5
+	 { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: uname is not correctly supported" >&5
 $as_echo "$as_me: WARNING: uname is not correctly supported" >&2;}
 fi
 rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
@@ -15459,12 +15472,12 @@ else
 fi


-        case "$locktype" in
-                adaptive)
-                        { $as_echo "$as_me:${as_lineno-$LINENO}: checking for PTHREAD_MUTEX_ADAPTIVE_NP" >&5
+	case "$locktype" in
+		adaptive)
+			{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for PTHREAD_MUTEX_ADAPTIVE_NP" >&5
 $as_echo_n "checking for PTHREAD_MUTEX_ADAPTIVE_NP... " >&6; }

-                        cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+			cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 /* end confdefs.h.  */

 			  #ifndef _GNU_SOURCE
@@ -15493,15 +15506,15 @@ else
 $as_echo "using standard lock type" >&6; }
 fi
 rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
-                        ;;
-                standard)
-                        { $as_echo "$as_me:${as_lineno-$LINENO}: result: using standard lock type" >&5
+			;;
+		standard)
+			{ $as_echo "$as_me:${as_lineno-$LINENO}: result: using standard lock type" >&5
 $as_echo "using standard lock type" >&6; }
-                        ;;
-                *)
-                        as_fn_error $? "You must specify \"adaptive\" or \"standard\" for --with-locktype." "$LINENO" 5
-                        ;;
-        esac
+			;;
+		*)
+			as_fn_error $? "You must specify \"adaptive\" or \"standard\" for --with-locktype." "$LINENO" 5
+			;;
+	esac

 	for ac_header in sched.h
 do :
@@ -15980,7 +15993,7 @@ If you do not want OpenSSL, use --without-openssl" "$LINENO" 5
 	*)
 		if test "yes" = "$want_native_pkcs11"
 		then
-                        { $as_echo "$as_me:${as_lineno-$LINENO}: result: " >&5
+			{ $as_echo "$as_me:${as_lineno-$LINENO}: result: " >&5
 $as_echo "" >&6; }
 			as_fn_error $? "OpenSSL and native PKCS11 cannot be used together." "$LINENO" 5
 		fi
@@ -16504,7 +16517,7 @@ $as_echo_n "checking for OpenSSL AES support... " >&6; }
 	if test "$cross_compiling" = yes; then :
  { $as_echo "$as_me:${as_lineno-$LINENO}: result: using --with-aes" >&5
 $as_echo "using --with-aes" >&6; }
-         # Expect cross-compiling with a modern OpenSSL
+	 # Expect cross-compiling with a modern OpenSSL
 	 have_aes="evp"
 else
  cat confdefs.h - <<_ACEOF >conftest.$ac_ext
@@ -17251,8 +17264,8 @@ then
 $as_echo "#define HAVE_LMDB 1" >>confdefs.h

 	NZD_TOOLS="nzd"
-        NZDSRCS='${NZDSRCS}'
-        NZDTARGETS='${NZDTARGETS}'
+	NZDSRCS='${NZDSRCS}'
+	NZDTARGETS='${NZDTARGETS}'
 fi


@@ -17520,7 +17533,7 @@ case "$with_zlib" in
 		done
 		;;
 	*)
-		if test -f "${with_zlib}/zlib.h"
+		if test -f "${with_zlib}/include/zlib.h"
 		then
 			zlib_cflags="-I${with_zlib}/include"
 			LIBS="$LIBS -L${with_zlib}/lib"
@@ -19383,11 +19396,11 @@ else

 #include <stdio.h>
 main() {
-        size_t j = 0;
-        char buf[100];
-        buf[0] = 0;
-        sprintf(buf, "%zu", j);
-        exit(strcmp(buf, "0") != 0);
+	size_t j = 0;
+	char buf[100];
+	buf[0] = 0;
+	sprintf(buf, "%zu", j);
+	exit(strcmp(buf, "0") != 0);
 }

 _ACEOF
@@ -19399,9 +19412,9 @@ else
 $as_echo "no" >&6; }
 	ISC_PRINT_OBJS="print.$O"
 	ISC_PRINT_SRCS="print.c"
-        ISC_PLATFORM_NEEDPRINTF='#define ISC_PLATFORM_NEEDPRINTF 1'
-        ISC_PLATFORM_NEEDFPRINTF='#define ISC_PLATFORM_NEEDFPRINTF 1'
-        ISC_PLATFORM_NEEDFSRINTF='#define ISC_PLATFORM_NEEDSPRINTF 1'
+	ISC_PLATFORM_NEEDPRINTF='#define ISC_PLATFORM_NEEDPRINTF 1'
+	ISC_PLATFORM_NEEDFPRINTF='#define ISC_PLATFORM_NEEDFPRINTF 1'
+	ISC_PLATFORM_NEEDFSRINTF='#define ISC_PLATFORM_NEEDSPRINTF 1'
 	ISC_PLATFORM_NEEDVSNPRINTF="#define ISC_PLATFORM_NEEDVSNPRINTF 1"
 fi
 rm -f core *.core core.conftest.* gmon.out bb.out conftest$ac_exeext \
@@ -19730,11 +19743,11 @@ _ACEOF
 if ac_fn_c_try_compile "$LINENO"; then :
  { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
 $as_echo "yes" >&6; }
-        ISC_PLATFORM_HAVESTATNSEC="#define ISC_PLATFORM_HAVESTATNSEC 1"
+	ISC_PLATFORM_HAVESTATNSEC="#define ISC_PLATFORM_HAVESTATNSEC 1"
 else
  { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
 $as_echo "no" >&6; }
-        ISC_PLATFORM_HAVESTATNSEC="#undef ISC_PLATFORM_HAVESTATNSEC"
+	ISC_PLATFORM_HAVESTATNSEC="#undef ISC_PLATFORM_HAVESTATNSEC"
 fi
 rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext

@@ -20141,6 +20154,7 @@ done
 #
 # Machine architecture dependent features
 #
+have_stdatomic=no
 for ac_header in stdatomic.h
 do :
  ac_fn_c_check_header_mongrel "$LINENO" "stdatomic.h" "ac_cv_header_stdatomic_h" "$ac_includes_default"
@@ -20148,9 +20162,11 @@ if test "x$ac_cv_header_stdatomic_h" = xyes; then :
  cat >>confdefs.h <<_ACEOF
 #define HAVE_STDATOMIC_H 1
 _ACEOF
- ISC_PLATFORM_HAVESTDATOMIC="#define ISC_PLATFORM_HAVESTDATOMIC 1"
+ have_stdatomic=yes
+		  ISC_PLATFORM_HAVESTDATOMIC="#define ISC_PLATFORM_HAVESTDATOMIC 1"
 else
-  ISC_PLATFORM_HAVESTDATOMIC="#undef ISC_PLATFORM_HAVESTDATOMIC"
+  have_stdatomic=no
+		  ISC_PLATFORM_HAVESTDATOMIC="#undef ISC_PLATFORM_HAVESTDATOMIC"
 fi

 done
@@ -20231,12 +20247,42 @@ rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
 		esac
 		;;
 	no)
+		have_stdatomic=no
 		ISC_PLATFORM_HAVESTDATOMIC="#undef ISC_PLATFORM_HAVESTDATOMIC"
 		use_atomic=no
 		arch=noatomic
 		;;
 esac

+if test "X$have_stdatomic" = "Xyes"; then
+    { $as_echo "$as_me:${as_lineno-$LINENO}: checking if -latomic is needed to use 64-bit stdatomic.h primitives" >&5
+$as_echo_n "checking if -latomic is needed to use 64-bit stdatomic.h primitives... " >&6; }
+    cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+/* end confdefs.h.  */
+#include <stdatomic.h>
+int
+main ()
+{
+atomic_int_fast64_t val = 0; atomic_fetch_add_explicit(&val, 1, memory_order_relaxed);
+  ;
+  return 0;
+}
+_ACEOF
+if ac_fn_c_try_link "$LINENO"; then :
+  { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
+$as_echo "no" >&6; }
+	 ISC_ATOMIC_LIBS=""
+else
+  { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
+$as_echo "yes" >&6; }
+	 ISC_ATOMIC_LIBS="-latomic"
+
+fi
+rm -f core conftest.err conftest.$ac_objext \
+    conftest$ac_exeext conftest.$ac_ext
+    LIBS="$LIBS $ISC_ATOMIC_LIBS"
+fi
+


 ISC_PLATFORM_USEOSFASM="#undef ISC_PLATFORM_USEOSFASM"
@@ -20486,7 +20532,7 @@ int
 main ()
 {

-        return (__builtin_expect(1, 1) ? 1 : 0);
+	return (__builtin_expect(1, 1) ? 1 : 0);

  ;
  return 0;
@@ -20494,14 +20540,14 @@ main ()
 _ACEOF
 if ac_fn_c_try_link "$LINENO"; then :

-        have_builtin_expect=yes
-        { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
+	have_builtin_expect=yes
+	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
 $as_echo "yes" >&6; }

 else

-        have_builtin_expect=no
-        { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
+	have_builtin_expect=no
+	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
 $as_echo "no" >&6; }

 fi
@@ -20525,7 +20571,7 @@ int
 main ()
 {

-        return (__builtin_clz(0xff) == 24 ? 1 : 0);
+	return (__builtin_clz(0xff) == 24 ? 1 : 0);

  ;
  return 0;
@@ -20533,14 +20579,14 @@ main ()
 _ACEOF
 if ac_fn_c_try_link "$LINENO"; then :

-        have_builtin_clz=yes
-        { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
+	have_builtin_clz=yes
+	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
 $as_echo "yes" >&6; }

 else

-        have_builtin_clz=no
-        { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
+	have_builtin_clz=no
+	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
 $as_echo "no" >&6; }

 fi
@@ -20942,9 +20988,9 @@ else
 fi

 if test "x$enable_dnsrps" != "xno"; then
-        if test "x$dnsrps_avail" != "xyes"; then
-                as_fn_error $? "dlopen and librpz.so needed for DNSRPS" "$LINENO" 5
-        fi
+	if test "x$dnsrps_avail" != "xyes"; then
+		as_fn_error $? "dlopen and librpz.so needed for DNSRPS" "$LINENO" 5
+	fi
 	if test "x$dnsrps_lib_open" = "x0"; then
 		as_fn_error $? "dlopen and librpz.so needed for DNSRPS" "$LINENO" 5
 	fi
@@ -22212,7 +22258,7 @@ if test "no" != "$atf"; then
 $as_echo "#define ATF_TEST 1" >>confdefs.h

 	STD_CINCLUDES="$STD_CINCLUDES -I$atf/include"
-        STD_CDEFINES="$STD_CDEFINES -DNS_HOOKS_ENABLE=1"
+	STD_CDEFINES="$STD_CDEFINES -DNS_HOOKS_ENABLE=1"
 	ATFBIN="$atf/bin"
 	ATFLIBS="-L$atf/lib -latf-c"
 	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for exp in -lm" >&5
@@ -22874,7 +22920,11 @@ else
 fi


-for ac_prog in mysql_config
+mysql_include=""
+mysql_lib=""
+if test "$use_dlz_mysql" = "yes"
+then
+	for ac_prog in mysql_config
 do
  # Extract the first word of "$ac_prog", so it can be a program name with args.
 set dummy $ac_prog; ac_word=$2
@@ -22916,11 +22966,6 @@ fi
  test -n "$MYSQL_CONFIG" && break
 done

-
-mysql_include=""
-mysql_lib=""
-if test "$use_dlz_mysql" = "yes"
-then
 	if test -n "$MYSQL_CONFIG"
 	then
 		mysql_include=`${MYSQL_CONFIG} --include`
@@ -26157,9 +26202,9 @@ yes)
 	then
 		if test "yes" = "$silent"
 		then
-                        make clean > /dev/null
-                else
-                        make clean
+			make clean > /dev/null
+		else
+			make clean
 		fi
 	fi
 	;;
@@ -26177,84 +26222,84 @@ report() {
    echo "-------------------------------------------------------------------------------"
    echo "Optional features enabled:"
    if $use_threads; then
-        echo "    Multiprocessing support (--enable-threads)"
-        if test "yes" = "$enable_full_report" -o "standard" = "$locktype"; then
-            echo "        Mutex lock type: $locktype"
-        fi
+	echo "    Multiprocessing support (--enable-threads)"
+	if test "yes" = "$enable_full_report" -o "standard" = "$locktype"; then
+	    echo "        Mutex lock type: $locktype"
+	fi
    fi
    test "large" = "$use_tuning" && echo "    Large-system tuning (--with-tuning)"
    test "no" = "$use_dnstap" || \
-            echo "    Allow 'dnstap' packet logging (--enable-dnstap)"
+	    echo "    Allow 'dnstap' packet logging (--enable-dnstap)"
    test "no" = "$use_geoip" || echo "    GeoIP access control (--with-geoip)"
    test "no" = "$use_gssapi" || echo "    GSS-API (--with-gssapi)"
    if test "yes" = "$enable_full_report" -o "aes" != "$with_cc_alg"; then
-        echo "        Algorithm: $with_cc_alg"
+	echo "        Algorithm: $with_cc_alg"
    fi

    # these lines are only printed if run with --enable-full-report
    if test "yes" = "$enable_full_report"; then
-        test "no" = "$enable_ipv6" -o "no" = "$found_ipv6" || \
-            echo "    IPv6 support (--enable-ipv6)"
-        test "X$CRYPTO" = "X" -o "yes" = "$want_native_pkcs11" || \
-                echo "    OpenSSL cryptography/DNSSEC (--with-openssl)"
-        test "no" = "$want_crypto_rand" || \
-                echo "    Crypto provider entropy source (--enable-crypto-rand)"
-        test "X$PYTHON" = "X" || echo "    Python tools (--with-python)"
-        test "X$XMLSTATS" = "X" || echo "    XML statistics (--with-libxml2)"
-        test "X$JSONSTATS" = "X" || echo "    JSON statistics (--with-libjson)"
-        test "X$ZLIB" = "X" || echo "    HTTP zlib compression (--with-zlib)"
-        test "X$NZD_TOOLS" = "X" || echo "    LMDB database to store configuration for 'addzone' zones (--with-lmdb)"
+	test "no" = "$enable_ipv6" -o "no" = "$found_ipv6" || \
+	    echo "    IPv6 support (--enable-ipv6)"
+	test "X$CRYPTO" = "X" -o "yes" = "$want_native_pkcs11" || \
+		echo "    OpenSSL cryptography/DNSSEC (--with-openssl)"
+	test "no" = "$want_crypto_rand" || \
+		echo "    Crypto provider entropy source (--enable-crypto-rand)"
+	test "X$PYTHON" = "X" || echo "    Python tools (--with-python)"
+	test "X$XMLSTATS" = "X" || echo "    XML statistics (--with-libxml2)"
+	test "X$JSONSTATS" = "X" || echo "    JSON statistics (--with-libjson)"
+	test "X$ZLIB" = "X" || echo "    HTTP zlib compression (--with-zlib)"
+	test "X$NZD_TOOLS" = "X" || echo "    LMDB database to store configuration for 'addzone' zones (--with-lmdb)"
    fi

    if test "no" != "$use_pkcs11"; then
-        if test "yes" = "$want_native_pkcs11"; then
-            echo "    Native PKCS#11/Cryptoki support (--enable-native-pkcs11)"
-        else
-            echo "    PKCS#11/Cryptoki support using OpenSSL (--with-pkcs11)"
-        fi
-        echo "        Provider library: $PKCS11_PROVIDER"
+	if test "yes" = "$want_native_pkcs11"; then
+	    echo "    Native PKCS#11/Cryptoki support (--enable-native-pkcs11)"
+	else
+	    echo "    PKCS#11/Cryptoki support using OpenSSL (--with-pkcs11)"
+	fi
+	echo "        Provider library: $PKCS11_PROVIDER"
    fi
    if test "yes" = "$OPENSSL_GOST" -o "yes" = "$PKCS11_GOST"; then
-        echo "    GOST algorithm support (encoding: $gosttype) (--with-gost)"
+	echo "    GOST algorithm support (encoding: $gosttype) (--with-gost)"
    fi
    test "yes" = "$OPENSSL_ECDSA" -o "$PKCS11_ECDSA" && \
-        echo "    ECDSA algorithm support (--with-ecdsa)"
+	echo "    ECDSA algorithm support (--with-ecdsa)"
    test "yes" = "$OPENSSL_ED25519" -o "$PKCS11_ED25519" && \
-        echo "    EDDSA algorithm support (--with-eddsa)"
+	echo "    EDDSA algorithm support (--with-eddsa)"
    test "yes" = "$enable_dnsrps" && \
-        echo "    DNS Response Policy Service interface (--enable-dnsrps)"
+	echo "    DNS Response Policy Service interface (--enable-dnsrps)"
    test "yes" = "$enable_fixed" && \
-        echo "    Allow 'fixed' rrset-order (--enable-fixed-rrset)"
+	echo "    Allow 'fixed' rrset-order (--enable-fixed-rrset)"
    test "yes" = "$enable_seccomp" && \
-        echo "    Use libseccomp system call filtering (--enable-seccomp)"
+	echo "    Use libseccomp system call filtering (--enable-seccomp)"
    test "yes" = "$want_backtrace" && \
-        echo "    Print backtrace on crash (--enable-backtrace)"
+	echo "    Print backtrace on crash (--enable-backtrace)"
    test "minimal" = "$want_symtable" && \
-        echo "    Use symbol table for backtrace, named only (--enable-symtable)"
+	echo "    Use symbol table for backtrace, named only (--enable-symtable)"
    test "yes" = "$want_symtable" -o "all" = "$want_symtable" && \
-        echo "    Use symbol table for backtrace, all binaries (--enable-symtable=all)"
+	echo "    Use symbol table for backtrace, all binaries (--enable-symtable=all)"
    test "no" = "$use_libtool" || echo "    Use GNU libtool (--with-libtool)"
    test "yes" = "$want_querytrace" && \
-        echo "    Very verbose query trace logging (--enable-querytrace)"
+	echo "    Very verbose query trace logging (--enable-querytrace)"
    test "no" = "$atf" || echo "    Automated Testing Framework (--with-atf)"

    echo "    Cryptographic library for DNSSEC: $CRYPTOLIB"

    echo "    Dynamically loadable zone (DLZ) drivers:"
    test "no" = "$use_dlz_bdb" || \
-        echo "        Berkeley DB (--with-dlz-bdb)"
+	echo "        Berkeley DB (--with-dlz-bdb)"
    test "no" = "$use_dlz_ldap" || \
-        echo "        LDAP (--with-dlz-ldap)"
+	echo "        LDAP (--with-dlz-ldap)"
    test "no" = "$use_dlz_mysql" || \
-        echo "        MySQL (--with-dlz-mysql)"
+	echo "        MySQL (--with-dlz-mysql)"
    test "no" = "$use_dlz_odbc" || \
-        echo "        ODBC (--with-dlz-odbc)"
+	echo "        ODBC (--with-dlz-odbc)"
    test "no" = "$use_dlz_postgres" || \
-        echo "        Postgres (--with-dlz-postgres)"
+	echo "        Postgres (--with-dlz-postgres)"
    test "no" = "$use_dlz_filesystem" || \
-        echo "        Filesystem (--with-dlz-filesystem)"
+	echo "        Filesystem (--with-dlz-filesystem)"
    test "no" = "$use_dlz_stub" || \
-        echo "        Stub (--with-dlz-stub)"
+	echo "        Stub (--with-dlz-stub)"
    test "$use_dlz_bdb $use_dlz_ldap $use_dlz_mysql $use_dlz_odbc $use_dlz_postgres $use_dlz_filesystem $use_dlz_stub" = "no no no no no no no" && echo "        None"

    echo "-------------------------------------------------------------------------------"
@@ -26262,43 +26307,43 @@ report() {
    echo "Features disabled or unavailable on this platform:"
    $use_threads || echo "    Multiprocessing support (--enable-threads)"
    test "no" = "$enable_ipv6" -o "no" = "$found_ipv6" && \
-            echo "    IPv6 support (--enable-ipv6)"
+	    echo "    IPv6 support (--enable-ipv6)"
    test "large" = "$use_tuning" || echo "    Large-system tuning (--with-tuning)"

    test "no" = "$use_dnstap" && \
-            echo "    Allow 'dnstap' packet logging (--enable-dnstap)"
+	    echo "    Allow 'dnstap' packet logging (--enable-dnstap)"
    test "no" = "$use_geoip" && echo "    GeoIP access control (--with-geoip)"
    test "no" = "$use_gssapi" && echo "    GSS-API (--with-gssapi)"

    test "no" = "$enable_dnsrps" && \
-        echo "    DNS Response Policy Service interface (--enable-dnsrps)"
+	echo "    DNS Response Policy Service interface (--enable-dnsrps)"

    test "yes" = "$enable_fixed" || \
-        echo "    Allow 'fixed' rrset-order (--enable-fixed-rrset)"
+	echo "    Allow 'fixed' rrset-order (--enable-fixed-rrset)"

    if test "X$CRYPTO" = "X" -o "yes" = "$want_native_pkcs11"
    then
-        echo "    OpenSSL cryptography/DNSSEC (--with-openssl)"
+	echo "    OpenSSL cryptography/DNSSEC (--with-openssl)"
    elif test "no" = "$use_pkcs11"; then
-        echo "    PKCS#11/Cryptoki support (--with-pkcs11)"
+	echo "    PKCS#11/Cryptoki support (--with-pkcs11)"
    fi
    test "yes" = "$want_native_pkcs11" ||
-        echo "    Native PKCS#11/Cryptoki support (--enable-native-pkcs11)"
+	echo "    Native PKCS#11/Cryptoki support (--enable-native-pkcs11)"
    test "X$CRYPTO" = "X" -o "yes" = "$OPENSSL_GOST" -o "yes" = "$PKCS11_GOST" || \
-        echo "    GOST algorithm support (--with-gost)"
+	echo "    GOST algorithm support (--with-gost)"
    test "X$CRYPTO" = "X" -o "yes" = "$OPENSSL_ECDSA" -o "yes" = "$PKCS11_ECDSA" || \
-        echo "    ECDSA algorithm support (--with-ecdsa)"
+	echo "    ECDSA algorithm support (--with-ecdsa)"
    test "X$CRYPTO" = "X" -o "yes" = "$OPENSSL_ED25519" -o "yes" = "$PKCS11_ED25519" || \
-        echo "    EDDSA algorithm support (--with-eddsa)"
+	echo "    EDDSA algorithm support (--with-eddsa)"
    test "yes" = "$want_crypto_rand" || \
-        echo "    Crypto provider entropy source (--enable-crypto-rand)"
+	echo "    Crypto provider entropy source (--enable-crypto-rand)"

    test "yes" = "$enable_seccomp" || \
-        echo "    Use libseccomp system call filtering (--enable-seccomp)"
+	echo "    Use libseccomp system call filtering (--enable-seccomp)"
    test "yes" = "$want_backtrace" || \
-        echo "    Print backtrace on crash (--enable-backtrace)"
+	echo "    Print backtrace on crash (--enable-backtrace)"
    test "yes" = "$want_querytrace" || \
-        echo "    Very verbose query trace logging (--enable-querytrace)"
+	echo "    Very verbose query trace logging (--enable-querytrace)"

    test "yes" = "$use_libtool" || echo "    Use GNU libtool (--with-libtool)"
    test "no" = "$atf" && echo "    Automated Testing Framework (--with-atf)"
@@ -26317,20 +26362,20 @@ report() {


    if test "X$ac_unrecognized_opts" != "X"; then
-        echo
-        echo "Unrecognized options:"
-        echo "    $ac_unrecognized_opts"
+	echo
+	echo "Unrecognized options:"
+	echo "    $ac_unrecognized_opts"
    fi

    if test "yes" != "$enable_full_report"; then
-        echo "-------------------------------------------------------------------------------"
-        echo "For more detail, use --enable-full-report."
+	echo "-------------------------------------------------------------------------------"
+	echo "For more detail, use --enable-full-report."
    fi
    echo "==============================================================================="
 }

 if test "yes" != "$silent"; then
-        report
+	report
 fi

 if test "X$CRYPTO" = "X"; then
@@ -57,8 +57,9 @@ AC_DEFUN(DLZ_ADD_DRIVER, [

 AC_MSG_CHECKING(for Postgres DLZ driver)
 AC_ARG_WITH(dlz_postgres,
-[  --with-dlz-postgres[=PATH]   Build with Postgres DLZ driver [yes|no|path].
-			       (Required to use Postgres with DLZ)],
+	    AS_HELP_STRING([--with-dlz-postgres[=PATH]],
+			   [Build with Postgres DLZ driver [yes|no|path].
+			       (Required to use Postgres with DLZ)]),
    use_dlz_postgres="$withval", use_dlz_postgres="no")

 if test "$use_dlz_postgres" != "no"
@@ -126,16 +127,16 @@ esac

 AC_MSG_CHECKING(for MySQL DLZ driver)
 AC_ARG_WITH(dlz_mysql,
-[  --with-dlz-mysql[=PATH]   Build with MySQL DLZ driver [yes|no|path].
-			       (Required to use MySQL with DLZ)],
+	    AS_HELP_STRING([--with-dlz-mysql[=PATH]],
+		           [Build with MySQL DLZ driver [yes|no|path].
+			       (Required to use MySQL with DLZ)]),
    use_dlz_mysql="$withval", use_dlz_mysql="no")

-AC_CHECK_PROGS(MYSQL_CONFIG, mysql_config)
-
 mysql_include=""
 mysql_lib=""
 if test "$use_dlz_mysql" = "yes"
 then
+	AC_CHECK_PROGS(MYSQL_CONFIG, mysql_config)
 	if test -n "$MYSQL_CONFIG"
 	then
 		mysql_include=`${MYSQL_CONFIG} --include`
@@ -232,8 +233,9 @@ esac

 AC_MSG_CHECKING(for Berkeley DB DLZ driver...)
 AC_ARG_WITH(dlz_bdb,
-[  --with-dlz-bdb[=PATH]   Build with Berkeley DB DLZ driver [yes|no|path].
-			       (Required to use Berkeley DB with DLZ)],
+	    AS_HELP_STRING([--with-dlz-bdb[=PATH]],
+			   [Build with Berkeley DB DLZ driver [yes|no|path].
+			       (Required to use Berkeley DB with DLZ)]),
    use_dlz_bdb="$withval", use_dlz_bdb="no")

 case "$use_dlz_bdb" in
@@ -356,8 +358,9 @@ esac

 AC_MSG_CHECKING(for file system DLZ driver)
 AC_ARG_WITH(dlz_filesystem,
-[  --with-dlz-filesystem[=ARG]    Build with filesystem DLZ driver [yes|no].
-			       (Required to use file system driver with DLZ)],
+	    AS_HELP_STRING([--with-dlz-filesystem[=ARG]],
+			   [Build with filesystem DLZ driver [yes|no].
+			       (Required to use file system driver with DLZ)]),
    use_dlz_filesystem="$withval", use_dlz_filesystem="no")

 case "$use_dlz_filesystem" in
@@ -378,8 +381,9 @@ esac

 AC_MSG_CHECKING(for LDAP DLZ driver)
 AC_ARG_WITH(dlz_ldap,
-[  --with-dlz-ldap[=PATH]   Build with LDAP DLZ driver [yes|no|path].
-			       (Required to use LDAP with DLZ)],
+	    AS_HELP_STRING([--with-dlz-ldap[=PATH]],
+			   [Build with LDAP DLZ driver [yes|no|path].
+			       (Required to use LDAP with DLZ)]),
    use_dlz_ldap="$withval", use_dlz_ldap="no")

 if test "$use_dlz_ldap" = "yes"
@@ -424,8 +428,9 @@ esac

 AC_MSG_CHECKING(for ODBC DLZ driver)
 AC_ARG_WITH(dlz_odbc,
-[  --with-dlz-odbc[=PATH]   Build with ODBC DLZ driver [yes|no|path].
-			       (Required to use ODBC with DLZ)],
+	    AS_HELP_STRING([--with-dlz-odbc[=PATH]],
+			   [Build with ODBC DLZ driver [yes|no|path].
+			       (Required to use ODBC with DLZ)]),
    use_dlz_odbc="$withval", use_dlz_odbc="no")

 if test "$use_dlz_odbc" = "yes"
@@ -481,8 +486,9 @@ esac

 AC_MSG_CHECKING(for stub DLZ driver)
 AC_ARG_WITH(dlz_stub,
-[  --with-dlz-stub[=ARG]    Build with stub DLZ driver [yes|no].
-			       (Required to use stub driver with DLZ)],
+	    AS_HELP_STRING([--with-dlz-stub[=ARG]],
+			   [Build with stub DLZ driver [yes|no].
+			       (Required to use stub driver with DLZ)]),
    use_dlz_stub="$withval", use_dlz_stub="no")

 case "$use_dlz_stub" in
@@ -43,7 +43,7 @@ sub printstatus ($) {
 	my $a = shift;
 	if ($a->{removehd} ne "19700101000000") {
 		printf " untrusted and to be removed at %s\n", ext8601 $a->{removehd};
-	} elsif ($a->{addhd} lt $now) {
+	} elsif ($a->{addhd} le $now) {
 		printf " trusted\n";
 	} else {
 		printf " waiting for %s\n", ext8601 $a->{addhd};
@@ -397,14 +397,31 @@
 	  <para>
 	    The other authoritative servers, the <emphasis>slave</emphasis>
 	    servers (also known as <emphasis>secondary</emphasis> servers)
-	    load
-	    the zone contents from another server using a replication process
-	    known as a <emphasis>zone transfer</emphasis>.  Typically the data
-	    are
-	    transferred directly from the primary master, but it is also
-	    possible
-	    to transfer it from another slave.  In other words, a slave server
-	    may itself act as a master to a subordinate slave server.
+	    load the zone contents from another server using a replication
+	    process known as a <emphasis>zone transfer</emphasis>.
+	    Typically the data are transferred directly from the primary
+	    master, but it is also possible to transfer it from another
+	    slave.  In other words, a slave server may itself act as a
+	    master to a subordinate slave server.
+	  </para>
+	  <para>
+	    Periodically, the slave server must send a refresh query to
+	    determine whether the zone contents have been updated. This
+	    is done by sending a query for the zone's SOA record and
+	    checking whether the SERIAL field has been updated; if so,
+	    a new transfer request is initiated. The timing of these
+	    refresh queries is controlled by the SOA REFRESH and RETRY
+	    fields, but can be overrridden with the
+	    <command>max-refresh-time</command>,
+	    <command>min-refresh-time</command>,
+	    <command>max-retry-time</command>, and
+	    <command>min-retry-time</command> options.
+	  </para>
+	  <para>
+	    If the zone data cannot be updated within the time specified
+	    by the SOA EXPIRE option (up to a hard-coded maximum of
+	    24 weeks) then the slave zone expires and will no longer
+	    respond to queries.
 	  </para>
 	</section>

@@ -2340,8 +2357,6 @@ options {
 	  <para>
 	    The logged error reads "insecurity proof failed" and
 	    "got insecure response; parent indicates it should be secure".
-	    (Prior to BIND 9.7, the logged error was "not insecure".
-	    This referred to the zone, not the response.)
 	  </para>
 	</note>
      </section>
@@ -4309,6 +4324,7 @@ badresp:1,adberr:0,findfail:0,valfail:0]
  [ <command>maintain-ixfr-base</command> <replaceable>yes_or_no</replaceable> ; ]
  [ <command>ixfr-from-differences</command> ( <replaceable>yes_or_no</replaceable> | <option>master</option> | <option>slave</option> ) ; ]
  [ <command>auto-dnssec</command> ( <option>allow</option> | <option>maintain</option> | <option>off</option> ) ; ]
+  [ <command>inline-signing</command> <replaceable>yes_or_no</replaceable> ; ]
  [ <command>dnssec-enable</command> <replaceable>yes_or_no</replaceable> ; ]
  [ <command>dnssec-validation</command> ( <replaceable>yes_or_no</replaceable> | <option>auto</option> ) ; ]
  [ <command>dnssec-lookaside</command> ( <option>auto</option> | <option>no</option> | <replaceable>domain</replaceable> trust-anchor <replaceable>domain</replaceable> ) ; ]
@@ -4548,6 +4564,7 @@ badresp:1,adberr:0,findfail:0,valfail:0]
 	...
    <command>}</command> ; ]
  [ <command>v6-bias</command> <replaceable>number</replaceable> ; ]
+  [ <command>trust-anchor-telemetry</command> <replaceable>yes_or_no</replaceable> ; ]
 <command>}</command> ; ]
 </programlisting>

@@ -8830,7 +8847,7 @@ avoid-v6-udp-ports { 40000; range 50000 60000; };
 		  server waits on an idle TCP connection before closing
 		  it when the client is using the EDNS TCP keepalive
 		  option.  The default is 300 (30 seconds), the maximum
-		  is 1200 (two minutes), and the minimum is 1 (one tenth
+		  is 65535 (about 1.8 hours), and the minimum is 1 (one tenth
 		  of a second). Values above the maximum or below the minimum
 		  will be adjusted with a logged warning.
 		  This value may be greater than
@@ -8852,7 +8869,7 @@ avoid-v6-udp-ports { 40000; range 50000 60000; };
 		  keepalive option. This informs a client of the
 		  amount of time it may keep the session open.
 		  The default is 300 (30 seconds), the maximum is
-		  1200 (two minutes), and the minimum is 0, which
+		  65535 (about 1.8 hours), and the minimum is 0, which
 		  signals that the clients must close TCP connections
 		  immediately.  Ordinarily this should be set to the
 		  same value as <command>tcp-keepalive-timeout</command>.
@@ -9383,21 +9400,18 @@ avoid-v6-udp-ports { 40000; range 50000 60000; };
 	      <listitem>
 		<para>
 		  These options control the server's behavior on refreshing a
-		  zone
-		  (querying for SOA changes) or retrying failed transfers.
-		  Usually the SOA values for the zone are used, but these
-		  values
-		  are set by the master, giving slave server administrators
-		  little
-		  control over their contents.
+		  zone (querying for SOA changes) or retrying failed
+		  transfers.  Usually the SOA values for the zone are used,
+		  up to a hard-coded maximum expiry of 24 weeks. However,
+		  these values are set by the master, giving slave server
+		  administrators little control over their contents.
 		</para>
 		<para>
 		  These options allow the administrator to set a minimum and
 		  maximum refresh and retry time in seconds per-zone,
-		  per-view, or globally.
-		  These options are valid for slave and stub zones,
-		  and clamp the SOA refresh and retry times to the specified
-		  values.
+		  per-view, or globally.  These options are valid for
+		  slave and stub zones, and clamp the SOA refresh and
+		  retry times to the specified values.
 		</para>
 		<para>
 		  The following defaults apply.
@@ -11426,8 +11440,8 @@ example.com                 CNAME   rpz-tcp-only.
 	    A <command>managed-keys</command> statement contains a list of
 	    the keys to be managed, along with information about how the
 	    keys are to be initialized for the first time.  The only
-	    initialization method currently supported (as of
-	    <acronym>BIND</acronym> 9.7.0) is <literal>initial-key</literal>.
+	    initialization method currently supported is
+	    <literal>initial-key</literal>.
 	    This means the <command>managed-keys</command> statement must
 	    contain a copy of the initializing key.  (Future releases may
 	    allow keys to be initialized by other methods, eliminating this
@@ -18558,7 +18572,6 @@ allow-query { !{ !10/8; any; }; key example; };
      <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="../../bin/tools/dnstap-read.docbook"/>
      <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="../../bin/tools/genrandom.docbook"/>
      <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="../../bin/dig/host.docbook"/>
-      <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="../../bin/tools/isc-hmac-fixup.docbook"/>
      <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="../../bin/tools/mdig.docbook"/>
      <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="../../bin/check/named-checkconf.docbook"/>
      <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="../../bin/check/named-checkzone.docbook"/>
@@ -436,14 +436,31 @@
          <p>
            The other authoritative servers, the <span class="emphasis"><em>slave</em></span>
            servers (also known as <span class="emphasis"><em>secondary</em></span> servers)
-            load
-            the zone contents from another server using a replication process
-            known as a <span class="emphasis"><em>zone transfer</em></span>.  Typically the data
-            are
-            transferred directly from the primary master, but it is also
-            possible
-            to transfer it from another slave.  In other words, a slave server
-            may itself act as a master to a subordinate slave server.
+            load the zone contents from another server using a replication
+            process known as a <span class="emphasis"><em>zone transfer</em></span>.
+            Typically the data are transferred directly from the primary
+            master, but it is also possible to transfer it from another
+            slave.  In other words, a slave server may itself act as a
+            master to a subordinate slave server.
+          </p>
+          <p>
+            Periodically, the slave server must send a refresh query to
+            determine whether the zone contents have been updated. This
+            is done by sending a query for the zone's SOA record and
+            checking whether the SERIAL field has been updated; if so,
+            a new transfer request is initiated. The timing of these
+            refresh queries is controlled by the SOA REFRESH and RETRY
+            fields, but can be overrridden with the
+            <span class="command"><strong>max-refresh-time</strong></span>,
+            <span class="command"><strong>min-refresh-time</strong></span>,
+            <span class="command"><strong>max-retry-time</strong></span>, and
+            <span class="command"><strong>min-retry-time</strong></span> options.
+          </p>
+          <p>
+            If the zone data cannot be updated within the time specified
+            by the SOA EXPIRE option (up to a hard-coded maximum of
+            24 weeks) then the slave zone expires and will no longer
+            respond to queries.
          </p>
        </div>

@@ -599,6 +616,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.12.0b1</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.12.0b2</p>
 </body>
 </html>
@@ -146,6 +146,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.12.0b1</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.12.0b2</p>
 </body>
 </html>
@@ -759,6 +759,6 @@ controls {
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.12.0b1</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.12.0b2</p>
 </body>
 </html>
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Michał Kępień	b9e33d9cce	[rt46718] Pass callback parameters explicitly instead of using a va_list This is a bit cumbersome, but retains type safety. Bikeshed a bit on variable names while at it.	2017-11-30 08:45:57 +01:00
Evan Hunt	e94465e304	[rt46718] style	2017-11-29 12:55:55 -08:00
Michał Kępień	8b9e2015f3	[rt46718] Update for_all_newzone_cfgs() comment to sync it with revised callback prototype	2017-11-29 20:34:14 +01:00
Michał Kępień	f64da6cabb	[rt46718] Initialize result in for_all_newzone_cfgs() This ensures for_all_newzone_cfgs() will return ISC_R_SUCCESS for an empty NZD.	2017-11-29 19:10:50 +01:00
Michał Kępień	6954eceb80	[rt46718] Use va_list instead of a structure pointer in for_all_newzone_cfgs() callback prototype	2017-11-29 18:49:50 +01:00
Michał Kępień	378774821a	[rt46718] Replace the loop invoking configure_zone_setviewcommit() with a for_all_newzone_cfgs() call	2017-11-29 15:38:49 +01:00
Michał Kępień	40562e37ee	[rt46718] Replace the loop invoking configure_zone() with a for_all_newzone_cfgs() call	2017-11-29 15:38:48 +01:00
Michał Kępień	e7256edf67	[rt46718] Add a function invoking a callback for all zones in a NZD Extract duplicate code found in two conditional branches into a separate function to improve code readability.	2017-11-29 15:38:47 +01:00
Michał Kępień	7edff5d2bb	[rt46718] Coding style trivia Surround single-line conditional branches with curly braces.	2017-11-28 14:51:11 +01:00
Michał Kępień	5fd05a6d88	[rt46718] Assign NULL to view->new_zone_dbenv after calling mdb_env_close() This change has no practical impact for now, but it does not hurt to be consistent.	2017-11-28 14:51:09 +01:00
Michał Kępień	3009554a0b	[rt46718] Only assign view->new_zone_mapsize when mdb_env_set_mapsize() returns MDB_SUCCESS If mdb_env_set_mapsize() fails, dns_view_setnewzones() will return an error, but view->new_zone_mapsize will still be set. This is essentially harmless as the NZD will not be subsequently used, but we should nevertheless refrain from setting variables related to failed function calls.	2017-11-28 14:51:06 +01:00
Michał Kępień	7545b00842	[rt46718] Use both MDB_FIRST and MDB_NEXT when iterating over an LMDB database "while(mdb_cursor_get(..., MDB_NEXT))" works because LMDB handles this internally in the right way, but the docs [1] state: For example, to list all key/value pairs in a database, use operation MDB_FIRST for the first call to mdb_cursor_get(), and MDB_NEXT on subsequent calls, until the end is hit. It does not hurt to follow the docs to the letter, plus the revised syntax arguably conveys the intent a bit more clearly. [1] http://www.lmdb.tech/doc/starting.html#Cursors	2017-11-28 14:51:05 +01:00
Michał Kępień	396772811a	[rt46718] Use MDB_SUCCESS instead of 0 when checking values returned by mdb_*()	2017-11-28 14:51:03 +01:00
Michał Kępień	c0494994f0	[rt46718] Simplify nzd_env_close() - The whole code of this function is inside a conditional branch. Unindent the code by returning early when view->new_zone_dbenv is NULL. - mdb_env_get_path() only returns an error when either of its arguments is NULL. view->new_zone_dbenv is checked beforehand and &dbpath is a pointer to a stack variable, so it will never be NULL. Drop the "have_dbpath" local variable and further unindent code.	2017-11-28 14:51:02 +01:00
Michał Kępień	1970f078cf	[rt46718] Fix LMDB support on OpenBSD OpenBSD does not have a unified buffer cache, which does not play nicely with LMDB's use of a combination of a read-only mmap() and "regular" writes. One workaround is to set the MDB_WRITEMAP flag when creating LMDB environments on OpenBSD. This causes the LMDB library to mmap() its databases in read-write mode and perform stores by writing to addresses mapped in such a way instead of using "regular" writes. To avoid repeating the same set of flags over and over in different places, #define them in a header file.	2017-11-28 14:50:53 +01:00
Michał Kępień	376d5996a1	[master] Bail out of "./configure --with-atf" if "./configure" inside unit/atf-src fails 4830. [bug] Failure to configure ATF when requested did not cause an error in top-level configure script. [RT #46655]	2017-11-28 13:36:57 +01:00
Mark Andrews	65a483106e	4829. [bug] isc_heap_delete did not zero the index value when the heap was created with a callback to do that. [RT #46709]	2017-11-28 18:49:52 +11:00
Mark Andrews	5f308740df	allow 10 seconds when checking mtime	2017-11-28 16:32:07 +11:00
Mark Andrews	a8c1bfd673	map more entry points to <name>64	2017-11-28 14:08:14 +11:00
Mark Andrews	18c7fa2f93	#define update_recordsandbytes update_recordsandbytes64	2017-11-28 13:58:49 +11:00
Tinderbox User	3f8c9d92af	regen master	2017-11-28 01:07:49 +00:00
Tinderbox User	393135d693	update copyright notice / whitespace	2017-11-27 23:46:24 +00:00
Tinderbox User	82354deeb1	newcopyrights	2017-11-27 23:30:10 +00:00
Mark Andrews	c22b540e4c	restore setting header->heap_index to zero in setsigningtime	2017-11-28 06:46:33 +11:00
Ray Bellis	d92d70ac5d	fix warning under Xcode for iOS	2017-11-27 10:16:55 +00:00
Michał Kępień	00ff44c7c2	[master] Stabilize nsupdate system test [RT #46673 ]	2017-11-27 10:10:42 +01:00
Michał Kępień	2f13e0ef98	[master] Minor mkeys system test tweaks [RT #46649 ]	2017-11-27 10:04:11 +01:00
Michał Kępień	a80dc538bd	[master] Only look for mysql_config if --with-dlz-mysql is used [RT #46647 ]	2017-11-27 10:00:38 +01:00
Michał Kępień	40a90fbf89	[master] Do not use thread-local storage for storing LMDB reader locktable slots 4828. [bug] Do not use thread-local storage for storing LMDB reader locktable slots. [RT #46556]	2017-11-27 09:48:10 +01:00
Michał Kępień	31b6ae485e	[master] Fix OPTIONS formatting	2017-11-27 09:35:08 +01:00
Mark Andrews	19f6a63184	More: 4819. [bug] Fully backout the transaction when adding a RRset to the resigning / removal heaps fails. [RT #46473]	2017-11-27 15:15:41 +11:00
Mark Andrews	14e9925868	add missing entries to .def files [RT #46215 ]	2017-11-27 13:49:39 +11:00
Mark Andrews	7bc5d7f5e8	4827. [misc] Add a precommit check script util/checklibs.sh [RT #46215]	2017-11-27 13:47:36 +11:00
Mark Andrews	1dc8208a89	silence %lu vs size_t warning by casting to (unsigned long)	2017-11-24 10:25:37 +11:00
Mark Andrews	6ead410268	in rdbdb.c:setsigningtime stop breaking heap invariant property unless we are going to restore the invariant property	2017-11-24 08:47:52 +11:00
Michał Kępień	a573b93b46	[master] Disable parallel make inside bin/confgen/ and bin/named/ 4826. [cleanup] Prevent potential build failures in bin/confgen/ and bin/named/ when using parallel make. [RT #46648]	2017-11-23 11:44:33 +01:00
Michał Kępień	165df18f75	[master] Prevent bogus warning from being logged 4825. [bug] Prevent a bogus "error during managed-keys processing (no more)" warning from being logged. [RT #46645]	2017-11-23 09:36:04 +01:00
Mark Andrews	9bb32395b2	silence compiler warning [RT #46471 ]	2017-11-23 17:01:40 +11:00
Ray BellisandMark Andrews	8993ecd06a	4824. [port] Add iOS hooks to dig. [RT #42011 ]	2017-11-23 16:58:12 +11:00
Mark Andrews	2f4e0e5a81	initalise serve_stale_ttl	2017-11-23 16:11:49 +11:00
Mark Andrews	78e1d7cdde	style	2017-11-23 16:09:27 +11:00
Mark Andrews	ba613d22bf	remove bin/tests/system/reclimit/ans4/ans.pl	2017-11-23 12:09:23 +11:00
Tinderbox User	858228febe	update copyright notice / whitespace	2017-11-21 23:45:29 +00:00
Tinderbox User	5b2b9340fe	newcopyrights	2017-11-21 23:30:08 +00:00
Michał Kępień	6035d557c4	[master] Refactor reclimit system test 4823. [test] Refactor reclimit system test to improve its reliability and speed. [RT #46632]	2017-11-21 10:32:45 +01:00
Mark Andrews	900215654b	#include <isc/util.h> [RT #46626 ]	2017-11-18 11:22:44 +11:00
Tinderbox User	445cabb392	update copyright notice / whitespace	2017-11-17 23:45:28 +00:00
Mark Andrews	a197094d76	remove out of date comment	2017-11-18 08:50:58 +11:00
Mark Andrews	f975d0acaa	4822. [bug] Use resign_sooner in dns_db_setsigningtime. [RT #46473 ]	2017-11-18 07:50:43 +11:00
Mark Andrews	656eed7c9b	4821. [bug] When resigning ensure that the SOA's expire time is always later that the resigning time of other records. [RT #46473] 4820. [bug] dns_db_subtractrdataset should transfer the resigning information to the new header. [RT #46473] 4819. [bug] Fully backout the transaction when adding a RRset to the resigning / removal heaps fail. [RT #46473]	2017-11-18 07:11:12 +11:00
Michał Kępień	7a0188774f	[master] Stabilize logfileconfig system test 4818. [test] The logfileconfig system test could intermittently report false negatives on some platforms. [RT #46615]	2017-11-16 08:06:57 +01:00
Mark Andrews	bcce55197a	whitespace	2017-11-14 14:48:41 +11:00
Tinderbox User	3bfc28a0d0	update copyright notice / whitespace	2017-11-13 23:45:33 +00:00
Tinderbox User	6f5cc4206d	newcopyrights	2017-11-13 23:30:10 +00:00
Mark Andrews	e2f9dcfd86	more DNS_NAME_INITABSOLUTE cases	2017-11-14 00:21:50 +11:00
Mark Andrews	31975d85de	remove out of date comment	2017-11-14 00:18:20 +11:00
Mark Andrews	3d905e0533	4817. [cleanup] Use DNS_NAME_INITABSOLUTE and DNS_NAME_INITNONABSOLUTE. [RT #45433]	2017-11-13 16:58:12 +11:00
Mark Andrews	3def40b01b	4816. [bug] Don't use a common array for storing EDNS options in DiG as it could fill up. [RT #45611]	2017-11-13 16:10:35 +11:00
Mark Andrews	04934b28ea	4815. [bug] rbt_test.c:insert_and_delete needed to call dns_rbt_addnode instead of dns_rbt_addname. [RT #46553]	2017-11-13 15:26:35 +11:00
Mark Andrews	8c1b8dd55d	fix merge error	2017-11-13 13:06:12 +11:00
Mark Andrews	6bbbf12936	4814. [cleanup] Use AS_HELP_STRING for consistent help text. [RT #46521 ]	2017-11-13 11:36:45 +11:00
Mark Andrews	9eb5aa40aa	set SAMPLEUPDATE under windows; test if SAMPLEUPDATE exists and only run tests if it does	2017-11-11 09:23:44 +11:00
Mark Andrews	f581ac4726	allow more time for journal to sync	2017-11-10 18:18:04 +11:00
Mark Andrews	c0e3e1fe44	4813. [bug] Address potential read after free errors from query_synthnodata, query_synthwildcard and query_synthnxdomain. [RT #46547]	2017-11-10 13:33:18 +11:00
Michał Kępień	312c84c73a	[master] Minor improvements to code handling managed keys 4812. [bug] Minor improvements to stability and consistency of code handling managed keys. [RT #46468]	2017-11-09 15:18:39 +01:00
Mark Andrews	b231ddc65d	fix the IPv6 address length in compute_cookie. [RT #46538 ]	2017-11-09 23:59:20 +11:00
Tinderbox User	0cba7ca6af	regen master	2017-11-09 01:07:39 +00:00
Evan Hunt	f4b2356359	[master] remove extra comma	2017-11-08 09:31:25 -08:00
Tinderbox User	a1aa42b9cd	regenerate	2017-11-08 17:28:38 +00:00
Tinderbox User	c999531fa4	regen master	2017-11-08 17:26:53 +00:00
Evan Hunt	00827f59d2	[master] revise incorrect release note	2017-11-08 09:18:29 -08:00
Mark Andrews	e03e455cd5	whitespace	2017-11-08 23:30:46 +11:00
Mark Andrews	a1a5145867	4811. [bug] Revert api changes to use <isc/buffer.h> inline macros. Provide a alternative mechanism to turn on the use of inline macros when building BIND. [RT #46520]	2017-11-08 23:28:10 +11:00
Michał Kępień	4034b098d8	[master] Prevent junk from being logged when using "also-notify { <ip> key <keyname>; };"	2017-11-08 09:21:23 +01:00
Michał Kępień	27bf48327c	[master] Do not NOTIFY back the master view from slave views in notify system test This prevents a Linux kernel bug discussed in RT #32355 from being triggered and thus makes "checking notify to multiple views using tsig" stable.	2017-11-08 09:21:16 +01:00
Mark Andrews	c652213857	4810. [test] The chain system test failed if the IPv6 interfaces were not configured. [RT #46508]	2017-11-08 10:17:03 +11:00
Evan Hunt	5b1e929b8b	[master] Merge branch 'master' of ssh://repo.isc.org/proj/git/prod/bind9	2017-11-07 13:48:37 -08:00
Tinderbox User	a41e41d6a4	regenerate	2017-11-07 21:48:23 +00:00
Tinderbox User	0e29543a3d	regen master	2017-11-07 21:42:32 +00:00
Evan Hunt	f13c1c09e9	[master] move release tag	2017-11-07 13:33:24 -08:00
Evan Hunt	e3d9aafff0	[master] Check if -latomic is needed to handle 64-bit stdatomic.h types 4809. [port] Check at configure time whether -latomic is needed for stdatomic.h. [RT #46324]	2017-11-07 13:27:14 -08:00
Evan Hunt	23b81977fe	[master] minor doc fixes	2017-11-07 13:23:41 -08:00
Tinderbox User	2a390b2537	regen master	2017-11-07 01:08:53 +00:00
Tinderbox User	e6801bf89e	update copyright notice / whitespace	2017-11-06 23:45:48 +00:00
Tinderbox User	3300f6aeda	newcopyrights	2017-11-06 23:30:12 +00:00
Mark Andrews	b819a478b7	4808. [bug] Properly test for zlib.h. [RT #46504 ]	2017-11-07 10:11:55 +11:00
Mukund SivaramanandEvan Hunt	7e1df5182c	[master] isc_rng_randombytes() 4807. [cleanup] isc_rng_randombytes() returns a specified number of bytes from the PRNG; this is now used instead of calling isc_rng_random() multiple times. [RT #46230]	2017-11-06 10:44:37 -08:00
Tinderbox User	72ddd51e74	regen master	2017-11-03 01:08:09 +00:00
Evan Hunt	c3d0ccdc8f	[master] update logging categories in doc	2017-11-02 12:53:33 -07:00
Tinderbox User	f305a705c4	regenerate	2017-11-02 18:59:07 +00:00
Tinderbox User	490c321e25	regen master	2017-11-02 18:58:45 +00:00
Evan Hunt	e7b53943fe	[master] copyrights	2017-11-02 11:50:43 -07:00
Evan Hunt	8d23105547	[master] prep 9.12.0b2	2017-11-02 11:50:07 -07:00
Evan Hunt	95dce4e68c	[master] clarify doc on zone refresh and expiry	2017-11-01 23:06:20 -07:00
Evan Hunt	9bb007fd2d	[master] "zoneload" logging category 4806. [func] Log messages related to loading of zones are now directed to the "zoneload" logging category. [RT #41640]	2017-11-01 22:48:12 -07:00
Evan Hunt	3b5718a8c9	[master] removed references to obsolete versions in documentation	2017-11-01 22:19:11 -07:00
Tinderbox User	40298d8bee	regen master	2017-11-02 01:09:26 +00:00
Mark Andrews	92bbc9914c	4805. [bug] TCP4Active and TCP6Active weren't being updated correctly. [RT #46454]	2017-11-02 10:42:42 +11:00
Evan Hunt	4359be18f4	[master] update secroots doc in rndc man page	2017-11-01 15:37:12 -07:00
Mark Andrews	0698ad8503	don't use the ERR macro as GCC 7 only does a partial static analysis which generates false positives for fallthrough. [RT #46115 ]	2017-11-01 19:11:48 +11:00
Tinderbox User	9b3fc207df	regen master	2017-11-01 01:09:07 +00:00
Tinderbox User	db15f78ad7	update copyright notice / whitespace	2017-10-31 23:45:54 +00:00
Mark Andrews	ff30290b48	4804. [port] win32: access() does not work on directories as required by POSIX. Supply a alternative in isc_file_isdirwritable. [RT #46394]	2017-11-01 09:29:24 +11:00
Evan Hunt	7bbb034952	[master] doc was incorrect about SIG(0)	2017-10-31 13:09:58 -07:00
Evan Hunt	a51352c4a4	[master] typo	2017-10-31 13:02:41 -07:00
Michał Kępień	37039792cb	[master] Replace FNR with NR in the awk script used by nextpart() awk on Solaris does not support the FNR variable. As nextpart() only reads from one file, replace FNR with NR.	2017-10-31 14:57:52 +01:00
Michał Kępień	41b1a98545	[master] Copy nextpart() from conf.sh.in to conf.sh.win32	2017-10-31 12:03:04 +01:00
Michał Kępień	dd61c4ad3e	[master] Add placeholder	2017-10-31 07:54:56 +01:00
Tinderbox User	85bd975d3d	update copyright notice / whitespace	2017-10-30 23:45:50 +00:00
Tinderbox User	ee42f734d5	Merge branch 'master' of /proj/git/prod/bind9	2017-10-30 23:45:16 +00:00
Mark Andrews	6e02359034	tmp should be a (struct in_addr) not (struct in_addr *)	2017-10-31 10:35:07 +11:00
Tinderbox User	0ed0c4b1a5	newcopyrights	2017-10-30 23:30:10 +00:00
Michał Kępień	facf811847	[master] Refactor mkeys system test 4802. [test] Refactor mkeys system test to make it quicker and more reliable. [RT #45293]	2017-10-30 09:41:24 +01:00
Tinderbox User	4ae8f28711	regen master	2017-10-30 01:08:21 +00:00
Tinderbox User	2658ebbcba	update copyright notice / whitespace	2017-10-29 23:45:51 +00:00
Evan Hunt	45d4d62a0c	[master] copyrights	2017-10-29 16:44:55 -07:00
Tinderbox User	63d83632d7	newcopyrights	2017-10-29 23:30:15 +00:00
Mark Andrews	40e1e659b6	add missing test number increment	2017-10-30 08:50:00 +11:00
Mark Andrews	f5e1b555c5	4801. [func] 'dnssec-lookaside auto;' and 'dnssec-lookaside . trust-anchor dlv.isc.org;' now elicit warnings rather than being fatal configuration errors. [RT #46410]	2017-10-30 07:40:59 +11:00
Mark Andrews	4e2ba60f3c	don't add copyright notices	2017-10-29 18:53:07 +11:00
Mukund Sivaraman	625f656aa8	When processing delzone, write one zone config per line to the NZF (#46323 )	2017-10-29 07:40:20 +05:30
Tinderbox User	278b68ced5	update copyright notice / whitespace	2017-10-28 23:45:38 +00:00
Michał Kępień	c6c1193e39	[master] Improve clarity of keytable unit tests 4799. [cleanup] Improve clarity of keytable unit tests. [RT #46407]	2017-10-28 19:59:40 +02:00
Evan Hunt	8f532a13cb	[master] update xsl version number	2017-10-27 19:19:04 -07:00
Tinderbox User	497f3f913e	regen master	2017-10-28 01:12:35 +00:00
Mark Andrews	01139573bc	update copyrights	2017-10-28 10:56:21 +11:00
Mark Andrews	4cbaa08602	allow for numbered namedX.args	2017-10-28 10:53:20 +11:00
Evan Hunt	c9f8165a06	[master] tag initializing keys 4798. [func] Keys specified in "managed-keys" statements are tagged as "initializing" until they have been updated by a key refresh query. If initialization fails it will be visible from "rndc secroots". [RT #46267]	2017-10-27 15:49:44 -07:00
Evan Hunt	1d57d460d4	[master] change rndc-confgen default algorithm this completes change 4785. the CHANGES note has been revised: 4785. [func] The hmac-md5 algorithm is no longer recommended for use with RNDC keys. The default in rndc-confgen is now hmac-sha256. [RT #42272]	2017-10-27 10:56:43 -07:00
Evan Hunt	959d294067	[master] remove isc-hmac-fixup 4797. [func] Removed "isc-hmac-fixup", as the versions of BIND that had the bug it worked around are long past end of life. [RT #46411]	2017-10-27 09:56:11 -07:00
Brian ConryandOndřej Surý	864bc6b56e	[master] Increase the maximum TCP keepalive timeout to 65535 4796. [bug] Increase the maximum configurable TCP keepalive timeout to 65535. [RT #44710]	2017-10-27 14:58:48 +02:00
Evan Hunt	06049b1c6c	[master] stats counter for priming queries 4795. [func] A new statistics counter has been added to track priming queries. [RT #46313]	2017-10-26 21:38:43 -07:00
Evan Hunt	3b4f23cdbf	[master] dnssec-checkds -s 4794. [func] "dnssec-checkds -s" specifies a file from which to read a DS set rather than querying the parent. [RT #44667]	2017-10-26 21:05:11 -07:00
Tinderbox User	08f18efba2	update copyright notice / whitespace	2017-10-26 23:45:58 +00:00
Mark Andrews	f808b5e0d2	.md for MKD	2017-10-27 10:40:32 +11:00
Tinderbox User	a4bf990ed7	newcopyrights	2017-10-26 23:30:10 +00:00
Mark Andrews	c341e524dc	address resource leak [RT #46413 ]	2017-10-27 09:58:55 +11:00
Evan Hunt	63270d33f1	[master] some improvements in doc/dev [RT #46011 ] - add info about rdatasets, etc, to dev.md (thanks to Tony Finch) - convert rdata.html to markdown	2017-10-25 23:30:10 -07:00
Mark Andrews	09baa0cbb1	use 'grep -w' to reduce false negatives	2017-10-26 16:14:30 +11:00
Mark Andrews	87387d8a41	4793. [bug] nsupdate -[46] could overflow the array of server addresses. [RT #46402]	2017-10-26 16:00:24 +11:00
Evan Hunt	5c76f3664c	[master] enable ISC_BUFFER_USEINLINE to be overridden	2017-10-25 21:42:56 -07:00
Evan Hunt	5b69d3da83	[master] check file and tree headers when loading map files 4792. [bug] Fix map file header correctness check. [RT #38418]	2017-10-25 21:37:00 -07:00
Evan Hunt	89d1777560	[master] clean up DNS_MESSAGETEXTFLAG comments	2017-10-25 21:33:24 -07:00
Tinderbox User	d3e8e9bdbb	regen master	2017-10-26 01:09:30 +00:00
Mark Andrews	3056d6f532	use consistent filename	2017-10-26 11:43:20 +11:00
Mark Andrews	96ebb55501	update	2017-10-26 11:38:34 +11:00
Tinderbox User	8e2a8a3855	update copyright notice / whitespace	2017-10-25 23:47:47 +00:00
Evan Hunt	81570e84a2	[master] fix some documentation errors [RT #45527 ]	2017-10-25 11:02:26 -07:00
Evan Hunt	6a59e53a69	[master] fixed libdns doc 4791. [doc] Fixed outdated documentation about export libraries. [RT #46341]	2017-10-25 10:55:34 -07:00
Mark Andrews	2bbca9594f	4790. [bug] nsupdate could trigger a require when sending a update to the second address of the server. [RT #45731]	2017-10-26 00:29:52 +11:00
				`@@ -0,0 +1 @@`
				`-m record,size,mctx -T clienttest -c named.conf -d 99 -X named.lock -g`