[rt46718] Pass callback parameters explicitly instead of using a va_list

This is a bit cumbersome, but retains type safety.  Bikeshed a bit on
variable names while at it.

CHANGES

@@ -1,3 +1,136 @@
+4830.	[bug]		Failure to configure ATF when requested did not cause
+			an error in top-level configure script. [RT #46655]
+
+4829.	[bug]		isc_heap_delete did not zero the index value when
+			the heap was created with a callback to do that.
+			[RT #46709]
+
+4828.	[bug]		Do not use thread-local storage for storing LMDB reader
+			locktable slots. [RT #46556]
+
+4827.	[misc]		Add a precommit check script util/checklibs.sh
+			[RT #46215]
+
+4826.	[cleanup]	Prevent potential build failures in bin/confgen/ and
+			bin/named/ when using parallel make. [RT #46648]
+
+4825.	[bug]		Prevent a bogus "error during managed-keys processing
+			(no more)" warning from being logged. [RT #46645]
+
+4824.	[port]		Add iOS hooks to dig. [RT #42011]
+
+4823.	[test]		Refactor reclimit system test to improve its
+			reliability and speed. [RT #46632]
+
+4822.	[bug]		Use resign_sooner in dns_db_setsigningtime. [RT #46473]
+
+4821.	[bug]		When resigning ensure that the SOA's expire time is
+			always later that the resigning time of other records.
+			[RT #46473]
+
+4820.	[bug]		dns_db_subtractrdataset should transfer the resigning
+			information to the new header. [RT #46473]
+
+4819.	[bug]		Fully backout the transaction when adding a RRset
+			to the resigning / removal heaps fails. [RT #46473]
+
+4818.	[test]		The logfileconfig system test could intermittently
+			report false negatives on some platforms. [RT #46615]
+
+4817.	[cleanup]	Use DNS_NAME_INITABSOLUTE and DNS_NAME_INITNONABSOLUTE.
+			[RT #45433]
+
+4816.	[bug]		Don't use a common array for storing EDNS options
+			in DiG as it could fill up. [RT #45611]
+
+4815.	[bug]		rbt_test.c:insert_and_delete needed to call
+			dns_rbt_addnode instead of dns_rbt_addname. [RT #46553]
+
+4814.	[cleanup]	Use AS_HELP_STRING for consistent help text. [RT #46521]
+
+4813.	[bug]		Address potential read after free errors from
+			query_synthnodata, query_synthwildcard and
+			query_synthnxdomain. [RT #46547]
+
+4812.	[bug]		Minor improvements to stability and consistency of code
+			handling managed keys. [RT #46468]
+
+4811.	[bug]		Revert api changes to use <isc/buffer.h> inline
+			macros.  Provide a alternative mechanism to turn
+			on the use of inline macros when building BIND.
+			[RT #46520]
+
+4810.	[test]		The chain system test failed if the IPv6 interfaces
+			were not configured. [RT #46508]
+
+	--- 9.12.0b2 released ---
+
+4809.	[port]		Check at configure time whether -latomic is needed
+			for stdatomic.h. [RT #46324]
+
+4808.	[bug]		Properly test for zlib.h. [RT #46504]
+
+4807.	[cleanup]	isc_rng_randombytes() returns a specified number of
+			bytes from the PRNG; this is now used instead of
+			calling isc_rng_random() multiple times. [RT #46230]
+
+4806.	[func]		Log messages related to loading of zones are now
+			directed to the "zoneload" logging category.
+			[RT #41640]
+
+4805.	[bug]		TCP4Active and TCP6Active weren't being updated
+			correctly. [RT #46454]
+
+4804.	[port]		win32: access() does not work on directories as
+			required by POSIX.  Supply a alternative in
+			isc_file_isdirwritable. [RT #46394]
+
+4803.	[placeholder]
+
+4802.	[test]		Refactor mkeys system test to make it quicker and more
+			reliable. [RT #45293]
+
+4801.	[func]		'dnssec-lookaside auto;' and 'dnssec-lookaside .
+			trust-anchor dlv.isc.org;' now elicit warnings rather
+			than being fatal configuration errors. [RT #46410]
+
+4800.	[bug]		When processing delzone, write one zone config per
+			line to the NZF. [RT #46323]
+
+4799.	[cleanup]	Improve clarity of keytable unit tests. [RT #46407]
+
+4798.	[func]		Keys specified in "managed-keys" statements
+			are tagged as "initializing" until they have been
+			updated by a key refresh query. If initialization
+			fails it will be visible from "rndc secroots".
+			[RT #46267]
+
+4797.	[func]		Removed "isc-hmac-fixup", as the versions of BIND that
+			had the bug it worked around are long past end of
+			life. [RT #46411]
+
+4796.	[bug]		Increase the maximum configurable TCP keepalive
+			timeout to 65535. [RT #44710]
+
+4795.	[func]		A new statistics counter has been added to track
+			priming queries. [RT #46313]
+
+4794.	[func]		"dnssec-checkds -s" specifies a file from which
+			to read a DS set rather than querying the parent.
+			[RT #44667]
+
+4793.	[bug]		nsupdate -[46] could overflow the array of server
+			addresses. [RT #46402]
+
+4792.	[bug]		Fix map file header correctness check. [RT #38418]
+
+4791.	[doc]		Fixed outdated documentation about export libraries.
+			[RT #46341]
+
+4790.	[bug]		nsupdate could trigger a require when sending a
+			update to the second address of the server.
+			[RT #45731]
+
 4789.	[cleanup]	Check writability of new-zones-directory. [RT #46308]
 
 4788.	[cleanup]	When using "update-policy local", log a warning
@@ -13,10 +146,8 @@
 			[RT #46340]
 
 4785.	[func]		The hmac-md5 algorithm is no longer recommended for
-			use with RNDC keys. For compatibility reasons, it
+			use with RNDC keys.  The default in rndc-confgen
-			it is still the default algorithm in rndc-confgen,
+			is now hmac-sha256. [RT #42272]
-			but this will be changed to hmac-sha256 in a future
-			release. [RT #42272]
 
 4784.	[func]		The use of dnssec-keygen to generate HMAC keys is
 			deprecated in favor of tsig-keygen.  dnssec-keygen
@@ -165,7 +296,7 @@
 			- Removed DLV key from bind.keys
 			- No longer use ISC DLV by default in delv
 			- "dnssec-lookaside auto" and configuration of
-			  "dnssec-lookaide" with dlv.isc.org as trust
+			  "dnssec-lookaide" with dlv.isc.org as the trust
 			  anchor are both now fatal errors.
 			[RT #46155]
 
@@ -305,8 +436,8 @@
 4713.	[func]		Added support for the DNS Response Policy Service
 			(DNSRPS) API, which allows named to use an external
 			response policy daemon when built with
-			"configure --enable-dnsrps".  Thanks to Vernon
+			"configure --enable-dnsrps". Thanks to Farsight
-			Schryver and Farsight Security. [RT #43376]
+			Security. [RT #43376]
 
 4712.	[bug]		"dig +domain" and "dig +search" didn't retain the
 			search domain when retrying with TCP. [RT #45547]

OPTIONS

@@ -22,4 +22,9 @@ Setting                   Description
                           Increase the maximum number of configurable
 -DNS_RPZ_MAX_ZONES=64     response policy zones from 32 to 64; this is the
                           highest possible setting
+                          Disable the use of inline functions to implement
+-DISC_BUFFER_USEINLINE=0  the isc_buffer API: this reduces performance but
+                          may be useful when debugging
+-DISC_HEAP_CHECK          Test heap consistency after every heap
+                          operation; used when debugging
 

OPTIONS.md

@@ -21,3 +21,5 @@ Some of these settings are:
 |`-DCHECK_LOCAL=0`|Don't check out-of-zone addresses in `named-checkzone`|
 |`-DNS_RUN_PID_DIR=0`|Create default PID files in `${localstatedir}/run` rather than `${localstatedir}/run/named/`|
 |`-DNS_RPZ_MAX_ZONES=64`|Increase the maximum number of configurable response policy zones from 32 to 64; this is the highest possible setting|
+|`-DISC_BUFFER_USEINLINE=0`|Disable the use of inline functions to implement the `isc_buffer` API: this reduces performance but may be useful when debugging |
+|`-DISC_HEAP_CHECK`|Test heap consistency after every heap operation; used when debugging|

README

@@ -117,7 +117,11 @@ include:
   * 'named-checkconf -l' lists zones found in named.conf.
   * Added support for the EDNS Padding and Keepalive options.
   * 'new-zones-directory' option sets the location where the configuration
-    data for zones added by rndc addzone is stored
+    data for zones added by rndc addzone is stored.
+  * The default key algorithm in rndc-confgen is now hmac-sha256.
+  * filter-aaaa-on-v4 and filter-aaaa-on-v6 options are now available by
+    default without a configure option.
+  * The obsolete isc-hmac-fixup command has been removed.
 
 Building BIND
 
@@ -127,8 +131,8 @@ on many versions of Linux and UNIX, including RedHat, Fedora, Debian,
 Ubuntu, SuSE, Slackware, FreeBSD, NetBSD, OpenBSD, Mac OS X, Solaris,
 HP-UX, AIX, SCO OpenServer, and OpenWRT.
 
-BIND is also available for Windows XP, 2003, 2008, and higher. See
+BIND is also available for Windows 2008 and higher. See win32utils/
-win32utils/readme1st.txt for details on building for Windows systems.
+readme1st.txt for details on building for Windows systems.
 
 To build on a UNIX or Linux system, use:
 

README.md

@@ -129,7 +129,11 @@ include:
 * `'named-checkconf -l'` lists zones found in `named.conf`.
 * Added support for the EDNS Padding and Keepalive options.
 * 'new-zones-directory' option sets the location where the configuration
-  data for zones added by rndc addzone is stored
+  data for zones added by rndc addzone is stored.
+* The default key algorithm in `rndc-confgen` is now hmac-sha256.
+* `filter-aaaa-on-v4` and `filter-aaaa-on-v6` options are now available
+  by default without a configure option.
+* The obsolete `isc-hmac-fixup` command has been removed.
 
 ### <a name="build"/> Building BIND
 
@@ -139,8 +143,9 @@ many versions of Linux and UNIX, including RedHat, Fedora, Debian, Ubuntu,
 SuSE, Slackware, FreeBSD, NetBSD, OpenBSD, Mac OS X, Solaris, HP-UX, AIX,
 SCO OpenServer, and OpenWRT. 
 
-BIND is also available for Windows XP, 2003, 2008, and higher.  See
+BIND is also available for Windows 2008 and higher.  See
-`win32utils/readme1st.txt` for details on building for Windows systems.
+`win32utils/readme1st.txt` for details on building for Windows
+systems.
 
 To build on a UNIX or Linux system, use:
 

bin/confgen/Makefile.in

@@ -8,6 +8,10 @@ srcdir =	@srcdir@
 VPATH =		@srcdir@
 top_srcdir =	@top_srcdir@
 
+# Attempt to disable parallel processing.
+.NOTPARALLEL:
+.NO_PARALLEL:
+
 VERSION=@BIND9_VERSION@
 
 @BIND9_MAKE_INCLUDES@
@@ -64,11 +68,11 @@ rndc-confgen.@O@: rndc-confgen.c
 ddns-confgen.@O@: ddns-confgen.c
 	${LIBTOOL_MODE_COMPILE} ${CC} ${ALL_CFLAGS} -c ${srcdir}/ddns-confgen.c
 
-rndc-confgen@EXEEXT@: rndc-confgen.@O@ util.@O@ keygen.@O@ ${UOBJS} ${CONFDEPLIBS}
+rndc-confgen@EXEEXT@: rndc-confgen.@O@ util.@O@ keygen.@O@ ${CONFDEPLIBS}
 	export BASEOBJS="rndc-confgen.@O@ util.@O@ keygen.@O@ ${UOBJS}"; \
 	${FINALBUILDCMD}
 
-ddns-confgen@EXEEXT@: ddns-confgen.@O@ util.@O@ keygen.@O@ ${UOBJS} ${CONFDEPLIBS}
+ddns-confgen@EXEEXT@: ddns-confgen.@O@ util.@O@ keygen.@O@ ${CONFDEPLIBS}
 	export BASEOBJS="ddns-confgen.@O@ util.@O@ keygen.@O@ ${UOBJS}"; \
 	${FINALBUILDCMD}
 

bin/confgen/rndc-confgen.8

@@ -111,9 +111,7 @@ as directed\&.
 .PP
 \-A \fIalgorithm\fR
 .RS 4
-Specifies the algorithm to use for the TSIG key\&. Available choices are: hmac\-md5, hmac\-sha1, hmac\-sha224, hmac\-sha256, hmac\-sha384 and hmac\-sha512\&. The default is hmac\-md5, or if MD5 was disabled at compile time, hmac\-sha256\&.
+Specifies the algorithm to use for the TSIG key\&. Available choices are: hmac\-md5, hmac\-sha1, hmac\-sha224, hmac\-sha256, hmac\-sha384 and hmac\-sha512\&. The default is hmac\-sha256\&.
-.sp
-Note: Use of hmac\-md5 is no longer recommended, and the default value will be changed to hmac\-sha256 in a future release\&.
 .RE
 .PP
 \-b \fIkeysize\fR

bin/confgen/rndc-confgen.c

@@ -6,8 +6,6 @@
  * file, You can obtain one at http://mozilla.org/MPL/2.0/.
  */
 
-/* $Id: rndc-confgen.c,v 1.7 2011/03/12 04:59:46 tbox Exp $ */
-
 /*! \file */
 
 /**
@@ -67,23 +65,6 @@ usage(int status) ISC_PLATFORM_NORETURN_POST;
 static void
 usage(int status) {
 
-#ifndef PK11_MD5_DISABLE
-	fprintf(stderr, "\
-Usage:\n\
- %s [-a] [-b bits] [-c keyfile] [-k keyname] [-p port] [-r randomfile] \
-[-s addr] [-t chrootdir] [-u user]\n\
-  -a:		 generate just the key clause and write it to keyfile (%s)\n\
-  -A alg:	 algorithm (default hmac-md5 (deprecated and will change))\n\
-  -b bits:	 from 1 through 512, default 256; total length of the secret\n\
-  -c keyfile:	 specify an alternate key file (requires -a)\n\
-  -k keyname:	 the name as it will be used  in named.conf and rndc.conf\n\
-  -p port:	 the port named will listen on and rndc will connect to\n\
-  -r randomfile: source of random data (use \"keyboard\" for key timing)\n\
-  -s addr:	 the address to which rndc should connect\n\
-  -t chrootdir:	 write a keyfile in chrootdir as well (requires -a)\n\
-  -u user:	 set the keyfile owner to \"user\" (requires -a)\n",
-		 progname, keydef);
-#else
 	fprintf(stderr, "\
 Usage:\n\
  %s [-a] [-b bits] [-c keyfile] [-k keyname] [-p port] [-r randomfile] \
@@ -99,7 +80,6 @@ Usage:\n\
   -t chrootdir:	 write a keyfile in chrootdir as well (requires -a)\n\
   -u user:	 set the keyfile owner to \"user\" (requires -a)\n",
 		 progname, keydef);
-#endif
 
 	exit (status);
 }
@@ -115,7 +95,6 @@ main(int argc, char **argv) {
 	const char *randomfile = NULL;
 	const char *serveraddr = NULL;
 	dns_secalg_t alg;
-	isc_boolean_t algset = ISC_FALSE;
 	const char *algname;
 	char *p;
 	int ch;
@@ -136,11 +115,7 @@ main(int argc, char **argv) {
 	progname = program;
 
 	keyname = DEFAULT_KEYNAME;
-#ifndef PK11_MD5_DISABLE
-	alg = DST_ALG_HMACMD5;
-#else
 	alg = DST_ALG_HMACSHA256;
-#endif
 	serveraddr = DEFAULT_SERVER;
 	port = DEFAULT_PORT;
 
@@ -154,7 +129,6 @@ main(int argc, char **argv) {
 			keyonly = ISC_TRUE;
 			break;
 		case 'A':
-			algset = ISC_TRUE;
 			algname = isc_commandline_argument;
 			alg = alg_fromtext(algname);
 			if (alg == DST_ALG_UNKNOWN)
@@ -228,17 +202,9 @@ main(int argc, char **argv) {
 		usage(1);
 
 	if (alg == DST_ALG_HMACMD5) {
-		if (algset) {
+		fprintf(stderr,
-			fprintf(stderr,
+			"warning: use of hmac-md5 for RNDC keys "
-				"warning: use of hmac-md5 for RNDC keys "
+			"is deprecated; hmac-sha256 is now recommended.\n");
-				"is deprecated; hmac-sha256 is now "
-				"recommended.\n");
-		} else {
-			fprintf(stderr,
-				"warning: the default algorithm hmac-md5 "
-				"is deprecated and will be\n"
-				"changed to hmac-sha256 in a future release\n");
-		}
 	}
 
 	if (keysize < 0)

bin/confgen/rndc-confgen.docbook

@@ -129,12 +129,7 @@
           <para>
             Specifies the algorithm to use for the TSIG key.  Available
             choices are: hmac-md5, hmac-sha1, hmac-sha224, hmac-sha256,
-            hmac-sha384 and hmac-sha512.  The default is hmac-md5, or
+            hmac-sha384 and hmac-sha512.  The default is hmac-sha256.
-            if MD5 was disabled at compile time, hmac-sha256.
-          </para>
-          <para>
-            Note: Use of hmac-md5 is no longer recommended, and the default
-            value will be changed to hmac-sha256 in a future release.
           </para>
         </listitem>
       </varlistentry>

bin/confgen/rndc-confgen.html

@@ -113,12 +113,7 @@
           <p>
             Specifies the algorithm to use for the TSIG key.  Available
             choices are: hmac-md5, hmac-sha1, hmac-sha224, hmac-sha256,
-            hmac-sha384 and hmac-sha512.  The default is hmac-md5, or
+            hmac-sha384 and hmac-sha512.  The default is hmac-sha256.
-            if MD5 was disabled at compile time, hmac-sha256.
-          </p>
-          <p>
-            Note: Use of hmac-md5 is no longer recommended, and the default
-            value will be changed to hmac-sha256 in a future release.
           </p>
         </dd>
 <dt><span class="term">-b <em class="replaceable"><code>keysize</code></em></span></dt>

bin/dig/dig.1

@@ -469,6 +469,11 @@ Convert [do not convert] puny code on output\&. This requires IDN SUPPORT to hav
 Ignore truncation in UDP responses instead of retrying with TCP\&. By default, TCP retries are performed\&.
 .RE
 .PP
+\fB+[no]keepalive\fR
+.RS 4
+Send [or do not send] an EDNS Keepalive option\&.
+.RE
+.PP
 \fB+[no]keepopen\fR
 .RS 4
 Keep the TCP socket open between queries and reuse it rather than creating a new TCP socket for each lookup\&. The default is

bin/dig/dig.c

@@ -109,6 +109,11 @@ print_usage(FILE *fp) {
 "            [ host [@local-server] {local-d-opt} [...]]\n", fp);
 }
 
+#if TARGET_OS_IPHONE
+static void usage(void) {
+	fprintf(stderr, "Press <Help> for complete list of options\n");
+}
+#else
 ISC_PLATFORM_NORETURN_PRE static void
 usage(void) ISC_PLATFORM_NORETURN_POST;
 
@@ -119,6 +124,7 @@ usage(void) {
 	      "for complete list of options\n", stderr);
 	exit(1);
 }
+#endif
 
 /*% version */
 static void
@@ -414,14 +420,8 @@ isdotlocal(dns_message_t *msg) {
 	isc_result_t result;
 	static unsigned char local_ndata[] = { "\005local\0" };
 	static unsigned char local_offsets[] = { 0, 6 };
-	static dns_name_t local = {
+	static dns_name_t local =
-		DNS_NAME_MAGIC,
+		DNS_NAME_INITABSOLUTE(local_ndata, local_offsets);
-		local_ndata, 7, 2,
-		DNS_NAMEATTR_READONLY | DNS_NAMEATTR_ABSOLUTE,
-		local_offsets, NULL,
-		{(void *)-1, (void *)-1},
-		{NULL, NULL}
-	};
 
 	for (result = dns_message_firstname(msg, DNS_SECTION_QUESTION);
 	     result == ISC_R_SUCCESS;
@@ -824,8 +824,10 @@ plus_option(const char *option, isc_boolean_t is_batchfile,
 				goto invalid_option;
 			result = parse_uint(&num, value, COMMSIZE,
 					    "buffer size");
-			if (result != ISC_R_SUCCESS)
+			if (result != ISC_R_SUCCESS) {
-				fatal("Couldn't parse buffer size");
+				warn("Couldn't parse buffer size");
+				goto exit_or_usage;
+			}
 			lookup->udpsize = num;
 			break;
 		default:
@@ -870,8 +872,10 @@ plus_option(const char *option, isc_boolean_t is_batchfile,
 				if (value != NULL) {
 					n = strlcpy(hexcookie, value,
 						    sizeof(hexcookie));
-					if (n >= sizeof(hexcookie))
+					if (n >= sizeof(hexcookie)) {
-						fatal("COOKIE data too large");
+						warn("COOKIE data too large");
+						goto exit_or_usage;
+					}
 					lookup->cookie = hexcookie;
 				} else
 					lookup->cookie = NULL;
@@ -922,8 +926,10 @@ plus_option(const char *option, isc_boolean_t is_batchfile,
 			if (value == NULL)
 				goto need_value;
 			result = parse_uint(&num, value, 0x3f, "DSCP");
-			if (result != ISC_R_SUCCESS)
+			if (result != ISC_R_SUCCESS) {
-				fatal("Couldn't parse DSCP value");
+				warn("Couldn't parse DSCP value");
+				goto exit_or_usage;
+			}
 			lookup->dscp = num;
 			break;
 		default:
@@ -952,9 +958,11 @@ plus_option(const char *option, isc_boolean_t is_batchfile,
 								    value,
 								    255,
 								    "edns");
-						if (result != ISC_R_SUCCESS)
+						if (result != ISC_R_SUCCESS) {
-							fatal("Couldn't parse "
+							warn("Couldn't parse "
 							      "edns");
+							goto exit_or_usage;
+						}
 						lookup->edns = num;
 						break;
 					case 'f':
@@ -971,9 +979,11 @@ plus_option(const char *option, isc_boolean_t is_batchfile,
 								    value,
 								    0xffff,
 								  "ednsflags");
-						if (result != ISC_R_SUCCESS)
+						if (result != ISC_R_SUCCESS) {
-							fatal("Couldn't parse "
+							warn("Couldn't parse "
 							      "ednsflags");
+							goto exit_or_usage;
+						}
 						lookup->ednsflags = num;
 						break;
 					case 'n':
@@ -986,10 +996,12 @@ plus_option(const char *option, isc_boolean_t is_batchfile,
 							lookup->ednsoptscnt = 0;
 							break;
 						}
-						if (value == NULL)
+						if (value == NULL) {
-							fatal("ednsopt no "
+							warn("ednsopt no "
-							      "code point "
+							     "code point "
-							      "specified");
+							     "specified");
+							goto exit_or_usage;
+						}
 						code = next_token(&value, ":");
 						save_opt(lookup, code, value);
 						break;
@@ -1104,8 +1116,10 @@ plus_option(const char *option, isc_boolean_t is_batchfile,
 			if (!state)
 				goto invalid_option;
 			result = parse_uint(&num, value, MAXNDOTS, "ndots");
-			if (result != ISC_R_SUCCESS)
+			if (result != ISC_R_SUCCESS) {
-				fatal("Couldn't parse ndots");
+				warn("Couldn't parse ndots");
+				goto exit_or_usage;
+			}
 			ndots = num;
 			break;
 		case 's':
@@ -1167,8 +1181,10 @@ plus_option(const char *option, isc_boolean_t is_batchfile,
 				break;
 			}
 			result = parse_uint(&num, value, 15, "opcode");
-			if (result != ISC_R_SUCCESS)
+			if (result != ISC_R_SUCCESS) {
-				fatal("Couldn't parse opcode");
+				warn("Couldn't parse opcode");
+				goto exit_or_usage;
+			}
 			lookup->opcode = (dns_opcode_t)num;
 			break;
 		default:
@@ -1182,8 +1198,10 @@ plus_option(const char *option, isc_boolean_t is_batchfile,
 		if (value == NULL)
 			goto need_value;
 		result = parse_uint(&num, value, 512, "padding");
-		if (result != ISC_R_SUCCESS)
+		if (result != ISC_R_SUCCESS) {
-			fatal("Couldn't parse padding");
+			warn("Couldn't parse padding");
+			goto exit_or_usage;
+		}
 		lookup->padding = (isc_uint16_t)num;
 		break;
 	case 'q':
@@ -1222,8 +1240,10 @@ plus_option(const char *option, isc_boolean_t is_batchfile,
 					goto invalid_option;
 				result = parse_uint(&lookup->retries, value,
 						    MAXTRIES - 1, "retries");
-				if (result != ISC_R_SUCCESS)
+				if (result != ISC_R_SUCCESS) {
-					fatal("Couldn't parse retries");
+					warn("Couldn't parse retries");
+					goto exit_or_usage;
+				}
 				lookup->retries++;
 				break;
 			default:
@@ -1306,8 +1326,10 @@ plus_option(const char *option, isc_boolean_t is_batchfile,
 			 */
 			if (splitwidth)
 				splitwidth += 3;
-			if (result != ISC_R_SUCCESS)
+			if (result != ISC_R_SUCCESS) {
-				fatal("Couldn't parse split");
+				warn("Couldn't parse split");
+				goto exit_or_usage;
+			}
 			break;
 		case 't': /* stats */
 			FULLCHECK("stats");
@@ -1331,8 +1353,10 @@ plus_option(const char *option, isc_boolean_t is_batchfile,
 				lookup->ecs_addr = NULL;
 			}
 			result = parse_netprefix(&lookup->ecs_addr, value);
-			if (result != ISC_R_SUCCESS)
+			if (result != ISC_R_SUCCESS) {
-				fatal("Couldn't parse client");
+				warn("Couldn't parse client");
+				goto exit_or_usage;
+			}
 			break;
 		default:
 			goto invalid_option;
@@ -1355,8 +1379,10 @@ plus_option(const char *option, isc_boolean_t is_batchfile,
 				goto invalid_option;
 			result = parse_uint(&timeout, value, MAXTIMEOUT,
 					    "timeout");
-			if (result != ISC_R_SUCCESS)
+			if (result != ISC_R_SUCCESS) {
-				fatal("Couldn't parse timeout");
+				warn("Couldn't parse timeout");
+				goto exit_or_usage;
+			}
 			if (timeout == 0)
 				timeout = 1;
 			break;
@@ -1392,8 +1418,10 @@ plus_option(const char *option, isc_boolean_t is_batchfile,
 					goto invalid_option;
 				result = parse_uint(&lookup->retries, value,
 						    MAXTRIES, "tries");
-				if (result != ISC_R_SUCCESS)
+				if (result != ISC_R_SUCCESS) {
-					fatal("Couldn't parse tries");
+					warn("Couldn't parse tries");
+					goto exit_or_usage;
+				}
 				if (lookup->retries == 0)
 					lookup->retries = 1;
 				break;
@@ -1450,11 +1478,19 @@ plus_option(const char *option, isc_boolean_t is_batchfile,
 	default:
 	invalid_option:
 	need_value:
+#if TARGET_OS_IPHONE
+	exit_or_usage:
+#endif
 		fprintf(stderr, "Invalid option: +%s\n",
 			option);
 		usage();
 	}
 	return;
+
+#if ! TARGET_OS_IPHONE
+ exit_or_usage:
+	digexit();
+#endif
 }
 
 /*%

bin/dig/dig.docbook

@@ -784,6 +784,15 @@
 	  </listitem>
 	</varlistentry>
 
+	<varlistentry>
+	  <term><option>+[no]keepalive</option></term>
+	  <listitem>
+	    <para>
+	      Send [or do not send] an EDNS Keepalive option.
+	    </para>
+	  </listitem>
+	</varlistentry>
+
 	<varlistentry>
 	  <term><option>+[no]keepopen</option></term>
 	  <listitem>

bin/dig/dig.html

@@ -628,6 +628,12 @@
 	      with TCP.  By default, TCP retries are performed.
 	    </p>
 	  </dd>
+<dt><span class="term"><code class="option">+[no]keepalive</code></span></dt>
+<dd>
+	    <p>
+	      Send [or do not send] an EDNS Keepalive option.
+	    </p>
+	  </dd>
 <dt><span class="term"><code class="option">+[no]keepopen</code></span></dt>
 <dd>
 	    <p>

bin/dig/dighost.c

@@ -375,6 +375,46 @@ get_reverse(char *reverse, size_t len, char *value, isc_boolean_t ip6_int,
 	}
 }
 
+void (*dighost_pre_exit_hook)(void) = NULL;
+
+#if TARGET_OS_IPHONE
+void
+warn(const char *format, ...) {
+	va_list args;
+
+	fflush(stdout);
+	fprintf(stderr, ";; Warning: ");
+	va_start(args, format);
+	vfprintf(stderr, format, args);
+	va_end(args);
+	fprintf(stderr, "\n");
+}
+#else
+void
+warn(const char *format, ...) {
+	va_list args;
+
+	fflush(stdout);
+	fprintf(stderr, "%s: ", progname);
+	va_start(args, format);
+	vfprintf(stderr, format, args);
+	va_end(args);
+	fprintf(stderr, "\n");
+}
+#endif
+
+void
+digexit(void) {
+	if (exitcode < 10)
+		exitcode = 10;
+	if (fatalexit != 0)
+		exitcode = fatalexit;
+	if (dighost_pre_exit_hook != NULL) {
+		dighost_pre_exit_hook();
+	}
+	exit(exitcode);
+}
+
 void
 fatal(const char *format, ...) {
 	va_list args;
@@ -385,11 +425,7 @@ fatal(const char *format, ...) {
 	vfprintf(stderr, format, args);
 	va_end(args);
 	fprintf(stderr, "\n");
-	if (exitcode < 10)
+	digexit();
-		exitcode = 10;
-	if (fatalexit != 0)
-		exitcode = fatalexit;
-	exit(exitcode);
 }
 
 void
@@ -655,6 +691,41 @@ make_empty_lookup(void) {
 	return (looknew);
 }
 
+#define EDNSOPT_OPTIONS 100U
+
+static void
+cloneopts(dig_lookup_t *looknew, dig_lookup_t *lookold) {
+	size_t len = sizeof(looknew->ednsopts[0]) * EDNSOPT_OPTIONS;
+	size_t i;
+	looknew->ednsopts = isc_mem_allocate(mctx, len);
+	if (looknew->ednsopts == NULL)
+		fatal("out of memory");
+	for (i = 0; i < EDNSOPT_OPTIONS; i++) {
+		looknew->ednsopts[i].code = 0;
+		looknew->ednsopts[i].length = 0;
+		looknew->ednsopts[i].value = NULL;
+	}
+	looknew->ednsoptscnt = 0;
+	if (lookold == NULL || lookold->ednsopts == NULL)
+		return;
+
+	for (i = 0; i < lookold->ednsoptscnt; i++) {
+		len = lookold->ednsopts[i].length;
+		if (len != 0) {
+			INSIST(lookold->ednsopts[i].value != NULL);
+			looknew->ednsopts[i].value =
+				 isc_mem_allocate(mctx, len);
+			if (looknew->ednsopts[i].value == NULL)
+				fatal("out of memory");
+			memmove(looknew->ednsopts[i].value,
+				lookold->ednsopts[i].value, len);
+		}
+		looknew->ednsopts[i].code = lookold->ednsopts[i].code;
+		looknew->ednsopts[i].length = len;
+	}
+	looknew->ednsoptscnt = lookold->ednsoptscnt;
+}
+
 /*%
  * Clone a lookup, perhaps copying the server list.  This does not clone
  * the query list, since it will be regenerated by the setup_lookup()
@@ -700,8 +771,12 @@ clone_lookup(dig_lookup_t *lookold, isc_boolean_t servers) {
 	looknew->seenbadcookie = lookold->seenbadcookie;
 	looknew->badcookie = lookold->badcookie;
 	looknew->cookie = lookold->cookie;
-	looknew->ednsopts = lookold->ednsopts;
+	if (lookold->ednsopts != NULL) {
-	looknew->ednsoptscnt = lookold->ednsoptscnt;
+		cloneopts(looknew, lookold);
+	} else {
+		looknew->ednsopts = NULL;
+		looknew->ednsoptscnt = 0;
+	}
 	looknew->ednsneg = lookold->ednsneg;
 	looknew->padding = lookold->padding;
 	looknew->mapped = lookold->mapped;
@@ -1317,13 +1392,6 @@ setup_libs(void) {
 	check_result(result, "isc_mutex_init");
 }
 
-/*
- * Array of up to 100 options configured by +ednsopt
- */
-#define EDNSOPT_OPTIONS 100U
-static dns_ednsopt_t ednsopts[EDNSOPT_OPTIONS];
-static unsigned char ednsoptscnt = 0;
-
 typedef struct dig_ednsoptname {
 	isc_uint32_t code;
 	const char  *name;
@@ -1350,12 +1418,12 @@ dig_ednsoptname_t optnames[] = {
 void
 save_opt(dig_lookup_t *lookup, char *code, char *value) {
 	isc_result_t result;
-	isc_uint32_t num;
+	isc_uint32_t num = 0;
 	isc_buffer_t b;
 	isc_boolean_t found = ISC_FALSE;
 	unsigned int i;
 
-	if (ednsoptscnt == EDNSOPT_OPTIONS)
+	if (lookup->ednsoptscnt >= EDNSOPT_OPTIONS)
 		fatal("too many ednsopts");
 
 	for (i = 0; i < N_EDNS_OPTNAMES; i++) {
@@ -1372,9 +1440,16 @@ save_opt(dig_lookup_t *lookup, char *code, char *value) {
 			fatal("bad edns code point: %s", code);
 	}
 
-	ednsopts[ednsoptscnt].code = num;
+	if (lookup->ednsopts == NULL) {
-	ednsopts[ednsoptscnt].length = 0;
+		cloneopts(lookup, NULL);
-	ednsopts[ednsoptscnt].value = NULL;
+	}
+
+	if (lookup->ednsopts[lookup->ednsoptscnt].value != NULL)
+		isc_mem_free(mctx, lookup->ednsopts[lookup->ednsoptscnt].value);
+
+	lookup->ednsopts[lookup->ednsoptscnt].code = num;
+	lookup->ednsopts[lookup->ednsoptscnt].length = 0;
+	lookup->ednsopts[lookup->ednsoptscnt].value = NULL;
 
 	if (value != NULL) {
 		char *buf;
@@ -1384,14 +1459,13 @@ save_opt(dig_lookup_t *lookup, char *code, char *value) {
 		isc_buffer_init(&b, buf, (unsigned int) strlen(value)/2 + 1);
 		result = isc_hex_decodestring(value, &b);
 		check_result(result, "isc_hex_decodestring");
-		ednsopts[ednsoptscnt].value = isc_buffer_base(&b);
+		lookup->ednsopts[lookup->ednsoptscnt].value =
-		ednsopts[ednsoptscnt].length = isc_buffer_usedlength(&b);
+						 isc_buffer_base(&b);
+		lookup->ednsopts[lookup->ednsoptscnt].length =
+						 isc_buffer_usedlength(&b);
 	}
 
-	if (lookup->ednsoptscnt == 0)
-		lookup->ednsopts = &ednsopts[ednsoptscnt];
 	lookup->ednsoptscnt++;
-	ednsoptscnt++;
 }
 
 /*%
@@ -1570,6 +1644,15 @@ destroy_lookup(dig_lookup_t *lookup) {
 	if (lookup->ecs_addr != NULL)
 		isc_mem_free(mctx, lookup->ecs_addr);
 
+	if (lookup->ednsopts != NULL) {
+		size_t i;
+		for (i = 0; i < EDNSOPT_OPTIONS; i++) {
+			if (lookup->ednsopts[i].value != NULL)
+				isc_mem_free(mctx, lookup->ednsopts[i].value);
+		}
+		isc_mem_free(mctx, lookup->ednsopts);
+	}
+
 	isc_mem_free(mctx, lookup);
 }
 
@@ -2114,9 +2197,13 @@ setup_lookup(dig_lookup_t *lookup) {
 		if (result != ISC_R_SUCCESS) {
 			dns_message_puttempname(lookup->sendmsg,
 						&lookup->name);
-			fatal("'%s' is not a legal name "
+			warn("'%s' is not a legal name "
 			      "(%s)", lookup->textname,
 			      isc_result_totext(result));
+#if TARGET_OS_IPHONE
+			check_next_lookup(current_lookup);
+			return (ISC_FALSE);
+#endif
 		}
 	}
 	dns_name_format(lookup->name, store, sizeof(store));
@@ -4127,12 +4214,6 @@ destroy_libs(void) {
 	debug("Removing log context");
 	isc_log_destroy(&lctx);
 
-	while (ednsoptscnt > 0U) {
-		ednsoptscnt--;
-		if (ednsopts[ednsoptscnt].value != NULL)
-			isc_mem_free(mctx, ednsopts[ednsoptscnt].value);
-	}
-
 	debug("Destroy memory");
 	if (memdebugging != 0)
 		isc_mem_stats(mctx, stderr);

bin/dig/include/dig/dig.h

@@ -26,6 +26,10 @@
 #include <isc/sockaddr.h>
 #include <isc/socket.h>
 
+#ifdef __APPLE__
+#include <TargetConditionals.h>
+#endif
+
 #define MXSERV 20
 #define MXNAME (DNS_NAME_MAXTEXT+1)
 #define MXRD 32
@@ -282,6 +286,13 @@ ISC_PLATFORM_NORETURN_PRE void
 fatal(const char *format, ...)
 ISC_FORMAT_PRINTF(1, 2) ISC_PLATFORM_NORETURN_POST;
 
+void
+warn(const char *format, ...) ISC_FORMAT_PRINTF(1, 2);
+
+ISC_PLATFORM_NORETURN_PRE void
+digexit(void)
+ISC_PLATFORM_NORETURN_POST;
+
 void
 debug(const char *format, ...) ISC_FORMAT_PRINTF(1, 2);
 
@@ -384,6 +395,9 @@ extern void
 extern void
 (*dighost_shutdown)(void);
 
+extern void
+(*dighost_pre_exit_hook)(void);
+
 void save_opt(dig_lookup_t *lookup, char *code, char *value);
 
 void setup_file_key(void);

bin/dnssec/dnssec-keygen.8

@@ -62,11 +62,11 @@ may be preferable to direct use of
 .RS 4
 Selects the cryptographic algorithm\&. For DNSSEC keys, the value of
 \fBalgorithm\fR
-must be one of RSAMD5, RSASHA1, DSA, NSEC3RSASHA1, NSEC3DSA, RSASHA256, RSASHA512, ECCGOST, ECDSAP256SHA256, ECDSAP384SHA384, ED25519 or ED448\&. For TKEY and SIG(0) keys, the value must be DH (Diffie Hellman); specifying this value will automatically set the
+must be one of RSAMD5, RSASHA1, DSA, NSEC3RSASHA1, NSEC3DSA, RSASHA256, RSASHA512, ECCGOST, ECDSAP256SHA256, ECDSAP384SHA384, ED25519 or ED448\&. For TKEY, the value must be DH (Diffie Hellman); specifying his value will automatically set the
 \fB\-T KEY\fR
 option as well\&.
 .sp
-TSIG keys can also by generated by setting the value to one of HMAC\-MD5, HMAC\-SHA1, HMAC\-SHA224, HMAC\-SHA256, HMAC\-SHA384, or HMAC\-SHA512\&. As with DH, specifying these values will automatically set
+TSIG keys can also be generated by setting the value to one of HMAC\-MD5, HMAC\-SHA1, HMAC\-SHA224, HMAC\-SHA256, HMAC\-SHA384, or HMAC\-SHA512\&. As with DH, specifying these values will automatically set
 \fB\-T KEY\fR\&. Note, however, that
 \fBtsig\-keygen\fR
 produces TSIG keys in a more useful format\&. These algorithms have been deprecated in

bin/dnssec/dnssec-keygen.docbook

@@ -122,12 +122,12 @@
 	    of <option>algorithm</option> must be one of RSAMD5, RSASHA1,
 	    DSA, NSEC3RSASHA1, NSEC3DSA, RSASHA256, RSASHA512, ECCGOST,
 	    ECDSAP256SHA256, ECDSAP384SHA384, ED25519 or ED448.  For
-	    TKEY and SIG(0) keys, the value must be DH (Diffie Hellman);
+	    TKEY, the value must be DH (Diffie Hellman); specifying
-	    specifying this value will automatically set the
+	    his value will automatically set the <option>-T KEY</option>
-	    <option>-T KEY</option> option as well.
+	    option as well.
 	  </para>
 	  <para>
-	    TSIG keys can also by generated by setting the value to
+	    TSIG keys can also be generated by setting the value to
 	    one of HMAC-MD5, HMAC-SHA1, HMAC-SHA224, HMAC-SHA256,
 	    HMAC-SHA384, or HMAC-SHA512.  As with DH, specifying these
 	    values will automatically set <option>-T KEY</option>. Note,

bin/dnssec/dnssec-keygen.html

@@ -103,12 +103,12 @@
 	    of <code class="option">algorithm</code> must be one of RSAMD5, RSASHA1,
 	    DSA, NSEC3RSASHA1, NSEC3DSA, RSASHA256, RSASHA512, ECCGOST,
 	    ECDSAP256SHA256, ECDSAP384SHA384, ED25519 or ED448.  For
-	    TKEY and SIG(0) keys, the value must be DH (Diffie Hellman);
+	    TKEY, the value must be DH (Diffie Hellman); specifying
-	    specifying this value will automatically set the
+	    his value will automatically set the <code class="option">-T KEY</code>
-	    <code class="option">-T KEY</code> option as well.
+	    option as well.
 	  </p>
 	  <p>
-	    TSIG keys can also by generated by setting the value to
+	    TSIG keys can also be generated by setting the value to
 	    one of HMAC-MD5, HMAC-SHA1, HMAC-SHA224, HMAC-SHA256,
 	    HMAC-SHA384, or HMAC-SHA512.  As with DH, specifying these
 	    values will automatically set <code class="option">-T KEY</code>. Note,

bin/named/Makefile.in

@@ -8,6 +8,10 @@ srcdir =	@srcdir@
 VPATH =		@srcdir@
 top_srcdir =	@top_srcdir@
 
+# Attempt to disable parallel processing.
+.NOTPARALLEL:
+.NO_PARALLEL:
+
 VERSION=@BIND9_VERSION@
 
 @BIND9_PRODUCT@
@@ -130,7 +134,7 @@ server.@O@: server.c
 		-DPRODUCT=\"${PRODUCT}\" \
 		-DVERSION=\"${VERSION}\" -c ${srcdir}/server.c
 
-named@EXEEXT@: ${OBJS} ${UOBJS} ${DEPLIBS}
+named@EXEEXT@: ${OBJS} ${DEPLIBS}
 	export MAKE_SYMTABLE="yes"; \
 	export BASEOBJS="${OBJS} ${UOBJS}"; \
 	${FINALBUILDCMD}

bin/named/bind9.xsl

@@ -9,7 +9,7 @@
 
 <xsl:stylesheet xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns="http://www.w3.org/1999/xhtml" version="1.0">
   <xsl:output method="html" indent="yes" version="4.0"/>
-  <xsl:template match="statistics[@version=&quot;3.10&quot;]">
+  <xsl:template match="statistics[@version=&quot;3.11&quot;]">
     <html>
       <head>
         <xsl:if test="system-property('xsl:vendor')!='Transformiix'">

bin/named/bind9.xsl.h

@@ -14,7 +14,7 @@ static char xslmsg[] =
 	"\n"
 	"<xsl:stylesheet xmlns:xsl=\"http://www.w3.org/1999/XSL/Transform\" xmlns=\"http://www.w3.org/1999/xhtml\" version=\"1.0\">\n"
 	" <xsl:output method=\"html\" indent=\"yes\" version=\"4.0\"/>\n"
-	" <xsl:template match=\"statistics[@version=&quot;3.10&quot;]\">\n"
+	" <xsl:template match=\"statistics[@version=&quot;3.11&quot;]\">\n"
 	" <html>\n"
 	" <head>\n"
 	" <xsl:if test=\"system-property('xsl:vendor')!='Transformiix'\">\n"

bin/named/controlconf.c

@@ -456,9 +456,8 @@ control_recvmessage(isc_task_t *task, isc_event_t *event) {
 	 */
 	if (conn->nonce == 0) {
 		while (conn->nonce == 0) {
-			isc_uint16_t r1 = isc_rng_random(server->sctx->rngctx);
+			isc_rng_randombytes(server->sctx->rngctx, &conn->nonce,
-			isc_uint16_t r2 = isc_rng_random(server->sctx->rngctx);
+					    sizeof(conn->nonce));
-			conn->nonce = (r1 << 16) | r2;
 		}
 		eresult = ISC_R_SUCCESS;
 	} else

bin/named/include/named/seccomp.h

@@ -26,6 +26,8 @@
 int scmp_syscalls[] = {
 	SCMP_SYS(access),
 	SCMP_SYS(open),
+	SCMP_SYS(openat),
+	SCMP_SYS(lseek),
 	SCMP_SYS(clock_gettime),
 	SCMP_SYS(time),
 	SCMP_SYS(read),
@@ -54,6 +56,7 @@ int scmp_syscalls[] = {
 #ifdef HAVE_GETRANDOM
 	SCMP_SYS(getrandom),
 #endif
+	SCMP_SYS(rename),
 	SCMP_SYS(unlink),
 	SCMP_SYS(socket),
 	SCMP_SYS(sendto),
@@ -72,7 +75,6 @@ int scmp_syscalls[] = {
 	SCMP_SYS(getsockopt),
 	SCMP_SYS(getsockname),
 	SCMP_SYS(lstat),
-	SCMP_SYS(lseek),
 	SCMP_SYS(getgid),
 	SCMP_SYS(getegid),
 	SCMP_SYS(getuid),
@@ -83,9 +85,7 @@ int scmp_syscalls[] = {
 	SCMP_SYS(setuid),
 	SCMP_SYS(prctl),
 	SCMP_SYS(epoll_wait),
-	SCMP_SYS(openat),
 	SCMP_SYS(getdents),
-	SCMP_SYS(rename),
 	SCMP_SYS(utimes),
 	SCMP_SYS(dup),
 #endif
@@ -93,6 +93,8 @@ int scmp_syscalls[] = {
 const char *scmp_syscall_names[] = {
 	"access",
 	"open",
+	"openat",
+	"lseek",
 	"clock_gettime",
 	"time",
 	"read",
@@ -121,6 +123,7 @@ const char *scmp_syscall_names[] = {
 #ifdef HAVE_GETRANDOM
 	"getrandom",
 #endif
+	"rename",
 	"unlink",
 	"socket",
 	"sendto",
@@ -139,7 +142,6 @@ const char *scmp_syscall_names[] = {
 	"getsockopt",
 	"getsockname",
 	"lstat",
-	"lseek",
 	"getgid",
 	"getegid",
 	"getuid",
@@ -150,9 +152,7 @@ const char *scmp_syscall_names[] = {
 	"setuid",
 	"prctl",
 	"epoll_wait",
-	"openat",
 	"getdents",
-	"rename",
 	"utimes",
 	"dup",
 #endif

bin/named/server.c

@@ -154,11 +154,7 @@
 #define EXCLBUFFERS 4096
 #endif /* TUNE_LARGE */
 
-#ifdef WIN32
+#define MAX_TCP_TIMEOUT 65535
-#define DIR_PERM_OK W_OK
-#else
-#define DIR_PERM_OK W_OK|X_OK
-#endif
 
 /*%
  * Check an operation for failure.  Assumes that the function
@@ -803,6 +799,11 @@ dstkey_fromconfig(const cfg_obj_t *vconfig, const cfg_obj_t *key,
 	return (result);
 }
 
+/*
+ * Load keys from configuration into key table. If 'keyname' is specified,
+ * only load keys matching that name. If 'managed' is true, load the key as
+ * an initializing key.
+ */
 static isc_result_t
 load_view_keys(const cfg_obj_t *keys, const cfg_obj_t *vconfig,
 	       dns_view_t *view, isc_boolean_t managed,
@@ -818,12 +819,14 @@ load_view_keys(const cfg_obj_t *keys, const cfg_obj_t *vconfig,
 
 	for (elt = cfg_list_first(keys);
 	     elt != NULL;
-	     elt = cfg_list_next(elt)) {
+	     elt = cfg_list_next(elt))
+	{
 		keylist = cfg_listelt_value(elt);
 
 		for (elt2 = cfg_list_first(keylist);
 		     elt2 != NULL;
-		     elt2 = cfg_list_next(elt2)) {
+		     elt2 = cfg_list_next(elt2))
+		{
 			key = cfg_listelt_value(elt2);
 			result = dstkey_fromconfig(vconfig, key, managed,
 						   &dstkey, mctx);
@@ -831,8 +834,9 @@ load_view_keys(const cfg_obj_t *keys, const cfg_obj_t *vconfig,
 				result = ISC_R_SUCCESS;
 				continue;
 			}
-			if (result != ISC_R_SUCCESS)
+			if (result != ISC_R_SUCCESS) {
 				goto cleanup;
+			}
 
 			/*
 			 * If keyname was specified, we only add that key.
@@ -844,17 +848,27 @@ load_view_keys(const cfg_obj_t *keys, const cfg_obj_t *vconfig,
 				continue;
 			}
 
-			CHECK(dns_keytable_add(secroots, managed, &dstkey));
+			/*
+			 * This key is taken from the configuration, so
+			 * if it's a managed key then it's an
+			 * initializing key; that's why 'managed'
+			 * is duplicated below.
+			 */
+			CHECK(dns_keytable_add2(secroots, managed,
+						managed, &dstkey));
 		}
 	}
 
  cleanup:
-	if (dstkey != NULL)
+	if (dstkey != NULL) {
 		dst_key_free(&dstkey);
-	if (secroots != NULL)
+	}
+	if (secroots != NULL) {
 		dns_keytable_detach(&secroots);
-	if (result == DST_R_NOCRYPTO)
+	}
+	if (result == DST_R_NOCRYPTO) {
 		result = ISC_R_SUCCESS;
+	}
 	return (result);
 }
 
@@ -1024,7 +1038,7 @@ configure_view_dnsseckeys(dns_view_t *view, const cfg_obj_t *vconfig,
 	}
 
 	/*
-	 * Add key zone for managed-keys.
+	 * Add key zone for managed keys.
 	 */
 	obj = NULL;
 	(void)named_config_get(maps, "managed-keys-directory", &obj);
@@ -1039,7 +1053,7 @@ configure_view_dnsseckeys(dns_view_t *view, const cfg_obj_t *vconfig,
 		goto cleanup;
 
 	} else if (directory != NULL) {
-		if (access(directory, DIR_PERM_OK) != 0) {
+		if (!isc_file_isdirwritable(directory)) {
 			isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 				      NAMED_LOGMODULE_SERVER, ISC_LOG_ERROR,
 				      "managed-keys-directory '%s' "
@@ -1048,6 +1062,7 @@ configure_view_dnsseckeys(dns_view_t *view, const cfg_obj_t *vconfig,
 			goto cleanup;
 		}
 	}
+
 	CHECK(add_keydata_zone(view, directory, named_g_mctx));
 
   cleanup:
@@ -3323,7 +3338,7 @@ create_empty_zone(dns_zone_t *zone, dns_name_t *name, dns_view_t *view,
 		viewname = "";
 	}
 	dns_name_format(name, namebuf, sizeof(namebuf));
-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+	isc_log_write(named_g_lctx, DNS_LOGCATEGORY_ZONELOAD,
 		      NAMED_LOGMODULE_SERVER, ISC_LOG_INFO,
 		      "automatic empty zone%s%s: %s",
 		      sep, viewname, namebuf);
@@ -4954,11 +4969,9 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
 			if (!strcasecmp(dom, "no")) {
 				result = ISC_R_NOTFOUND;
 			} else if (!strcasecmp(dom, "auto")) {
-				cfg_obj_log(obj, named_g_lctx, ISC_LOG_WARNING,
+				/*
-					    "WARNING: the DLV server at "
+				 * Warning logged by libbind9.
-					    "'dlv.isc.org' is no longer "
+				 */
-					    "in service; dnssec-lookaside "
-					    "ignored");
 				result = ISC_R_NOTFOUND;
 			}
 		}
@@ -4984,11 +4997,9 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
 			CHECK(dns_name_fromstring(dlv, cfg_obj_asstring(obj),
 						  DNS_NAME_DOWNCASE, NULL));
 			if (dns_name_equal(dlv, iscdlv)) {
-				cfg_obj_log(obj, named_g_lctx, ISC_LOG_WARNING,
+				/*
-					    "WARNING: the DLV server at "
+				 * Warning logged by libbind9.
-					    "'dlv.isc.org' is no longer "
+				 */
-					    "in service; dnssec-lookaside "
-					    "ignored");
 				view->dlv = NULL;
 			} else {
 				view->dlv = dlv;
@@ -6005,7 +6016,7 @@ configure_zone(const cfg_obj_t *config, const cfg_obj_t *zconfig,
 	 * Add the zone to its view in the new view list.
 	 */
 	if (!modify)
-	CHECK(dns_view_addzone(view, zone));
+		CHECK(dns_view_addzone(view, zone));
 
 	if (zone_is_catz) {
 		/*
@@ -6163,7 +6174,7 @@ directory_callback(const char *clausename, const cfg_obj_t *obj, void *arg) {
 			    "option 'directory' contains relative path '%s'",
 			    directory);
 
-	if (access(directory, DIR_PERM_OK) != 0) {
+	if (!isc_file_isdirwritable(directory)) {
 		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 			      NAMED_LOGMODULE_SERVER, ISC_LOG_ERROR,
 			      "directory '%s' is not writable",
@@ -6441,16 +6452,19 @@ dotat(dns_keytable_t *keytable, dns_keynode_t *keynode, void *arg) {
 		}
 		nextnode = NULL;
 		(void)dns_keytable_nextkeynode(keytable, keynode, &nextnode);
-		if (keynode != firstnode)
+		if (keynode != firstnode) {
 			dns_keytable_detachkeynode(keytable, &keynode);
+		}
 		keynode = nextnode;
 	} while (keynode != NULL);
 
-	if (n == 0)
+	if (n == 0) {
 		return;
+	}
 
-	if (n > 1)
+	if (n > 1) {
 		qsort(ids, n, sizeof(ids[0]), cid);
+	}
 
 	/*
 	 * Encoded as "_ta-xxxx\(-xxxx\)*" where xxxx is the hex version of
@@ -6458,22 +6472,25 @@ dotat(dns_keytable_t *keytable, dns_keynode_t *keynode, void *arg) {
 	 */
 	label[0] = 0;
 	r.base = label;
-	r.length = sizeof(label);;
+	r.length = sizeof(label);
 	m = snprintf(r.base, r.length, "_ta");
-	if (m < 0 || (unsigned)m > r.length)
+	if (m < 0 || (unsigned)m > r.length) {
 		return;
+	}
 	isc_textregion_consume(&r, m);
 	for (i = 0; i < n; i++) {
 		m = snprintf(r.base, r.length, "-%04x", ids[i]);
-		if (m < 0 || (unsigned)m > r.length)
+		if (m < 0 || (unsigned)m > r.length) {
 			return;
+		}
 		isc_textregion_consume(&r, m);
 	}
 	dns_fixedname_init(&fixed);
 	tatname = dns_fixedname_name(&fixed);
 	result = dns_name_fromstring2(tatname, label, name, 0, NULL);
-	if (result != ISC_R_SUCCESS)
+	if (result != ISC_R_SUCCESS) {
 		return;
+	}
 
 	dns_name_format(tatname, namebuf, sizeof(namebuf));
 	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
@@ -6482,8 +6499,9 @@ dotat(dns_keytable_t *keytable, dns_keynode_t *keynode, void *arg) {
 		     view->name, namebuf);
 
 	tat = isc_mem_get(dotat_arg->view->mctx, sizeof(*tat));
-	if (tat == NULL)
+	if (tat == NULL) {
 		return;
+	}
 
 	tat->mctx = NULL;
 	tat->task = NULL;
@@ -7051,7 +7069,7 @@ setup_newzones(dns_view_t *view, cfg_obj_t *config, cfg_obj_t *vconfig,
 				      dir, isc_result_totext(result));
 			return (result);
 		}
-		if (access(dir, DIR_PERM_OK) != 0) {
+		if (!isc_file_isdirwritable(dir)) {
 			isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 				      NAMED_LOGMODULE_SERVER, ISC_LOG_ERROR,
 				      "new-zones-directory '%s' "
@@ -7315,18 +7333,128 @@ data_to_cfg(dns_view_t *view, MDB_val *key, MDB_val *data,
 	return (result);
 }
 
+/*%
+ * Prototype for a callback which can be used with for_all_newzone_cfgs().
+ */
+typedef isc_result_t (*newzone_cfg_cb_t)(const cfg_obj_t *zconfig,
+					 cfg_obj_t *config, cfg_obj_t *vconfig,
+					 isc_mem_t *mctx, dns_view_t *view,
+					 cfg_aclconfctx_t *actx);
+
+/*%
+ * For each zone found in a NZD opened by the caller, create an object
+ * representing its configuration and invoke "callback" with the created
+ * object, "config", "vconfig", "mctx", "view" and "actx" as arguments (all
+ * these are non-global variables required to invoke configure_zone()).
+ * Immediately interrupt processing if an error is encountered while
+ * transforming NZD data into a zone configuration object or if "callback"
+ * returns an error.
+ */
+static isc_result_t
+for_all_newzone_cfgs(newzone_cfg_cb_t callback, cfg_obj_t *config,
+		     cfg_obj_t *vconfig, isc_mem_t *mctx, dns_view_t *view,
+		     cfg_aclconfctx_t *actx, MDB_txn *txn, MDB_dbi dbi)
+{
+	const cfg_obj_t *zconfig, *zlist = NULL;
+	isc_result_t result = ISC_R_SUCCESS;
+	cfg_obj_t *zconfigobj = NULL;
+	isc_buffer_t *text = NULL;
+	MDB_cursor *cursor = NULL;
+	MDB_val data, key;
+	int status;
+
+	status = mdb_cursor_open(txn, dbi, &cursor);
+	if (status != MDB_SUCCESS) {
+		return (ISC_R_FAILURE);
+	}
+
+	for (status = mdb_cursor_get(cursor, &key, &data, MDB_FIRST);
+	     status == MDB_SUCCESS;
+	     status = mdb_cursor_get(cursor, &key, &data, MDB_NEXT))
+	{
+		/*
+		 * Create a configuration object from data fetched from NZD.
+		 */
+		result = data_to_cfg(view, &key, &data, &text, &zconfigobj);
+		if (result != ISC_R_SUCCESS) {
+			break;
+		}
+
+		/*
+		 * Extract zone configuration from configuration object.
+		 */
+		result = cfg_map_get(zconfigobj, "zone", &zlist);
+		if (result != ISC_R_SUCCESS) {
+			break;
+		} else if (!cfg_obj_islist(zlist)) {
+			result = ISC_R_FAILURE;
+			break;
+		}
+		zconfig = cfg_listelt_value(cfg_list_first(zlist));
+
+		/*
+		 * Invoke callback.
+		 */
+		result = callback(zconfig, config, vconfig, mctx, view, actx);
+		if (result != ISC_R_SUCCESS) {
+			break;
+		}
+
+		/*
+		 * Destroy the configuration object created in this iteration.
+		 */
+		cfg_obj_destroy(named_g_addparser, &zconfigobj);
+	}
+
+	if (text != NULL) {
+		isc_buffer_free(&text);
+	}
+	if (zconfigobj != NULL) {
+		cfg_obj_destroy(named_g_addparser, &zconfigobj);
+	}
+	mdb_cursor_close(cursor);
+
+	return (result);
+}
+
+/*%
+ * Attempt to configure a zone found in NZD and return the result.
+ */
+static isc_result_t
+configure_newzone(const cfg_obj_t *zconfig, cfg_obj_t *config,
+		  cfg_obj_t *vconfig, isc_mem_t *mctx, dns_view_t *view,
+		  cfg_aclconfctx_t *actx)
+{
+	return (configure_zone(config, zconfig, vconfig, mctx, view,
+			       &named_g_server->viewlist, actx, ISC_TRUE,
+			       ISC_FALSE, ISC_FALSE));
+}
+
+/*%
+ * Revert new view assignment for a zone found in NZD.
+ */
+static isc_result_t
+configure_newzone_revert(const cfg_obj_t *zconfig, cfg_obj_t *config,
+			 cfg_obj_t *vconfig, isc_mem_t *mctx, dns_view_t *view,
+			 cfg_aclconfctx_t *actx)
+{
+	UNUSED(config);
+	UNUSED(vconfig);
+	UNUSED(mctx);
+	UNUSED(actx);
+
+	configure_zone_setviewcommit(ISC_R_FAILURE, zconfig, view);
+
+	return (ISC_R_SUCCESS);
+}
+
 static isc_result_t
 configure_newzones(dns_view_t *view, cfg_obj_t *config, cfg_obj_t *vconfig,
 		   isc_mem_t *mctx, cfg_aclconfctx_t *actx)
 {
-	isc_result_t result = ISC_R_SUCCESS;
+	isc_result_t result;
-	int status;
-	isc_buffer_t *text = NULL;
-	cfg_obj_t *zoneconf = NULL;
-	MDB_cursor *cursor = NULL;
 	MDB_txn *txn = NULL;
 	MDB_dbi dbi;
-	MDB_val key, data;
 
 	if (view->new_zone_config == NULL) {
 		return (ISC_R_SUCCESS);
@@ -7343,82 +7471,22 @@ configure_newzones(dns_view_t *view, cfg_obj_t *config, cfg_obj_t *vconfig,
 		      "for view '%s'",
 		      view->new_zone_db, view->name);
 
-	status = mdb_cursor_open(txn, dbi, &cursor);
+	result = for_all_newzone_cfgs(configure_newzone, config, vconfig, mctx,
-	if (status != 0) {
+				      view, actx, txn, dbi);
-		result = ISC_R_FAILURE;
-		goto cleanup;
-	}
-
-	while (mdb_cursor_get(cursor, &key, &data, MDB_NEXT) == 0) {
-		const cfg_obj_t *zlist = NULL;
-		const cfg_obj_t *zoneobj = NULL;
-
-		result = data_to_cfg(view, &key, &data, &text, &zoneconf);
-		if (result != ISC_R_SUCCESS) {
-			goto cleanup;
-		}
-
-		CHECK(cfg_map_get(zoneconf, "zone", &zlist));
-		if (!cfg_obj_islist(zlist)) {
-			CHECK(ISC_R_FAILURE);
-		}
-
-		zoneobj = cfg_listelt_value(cfg_list_first(zlist));
-		CHECK(configure_zone(config, zoneobj, vconfig, mctx,
-				     view, &named_g_server->viewlist, actx,
-				     ISC_TRUE, ISC_FALSE, ISC_FALSE));
-
-		cfg_obj_destroy(named_g_addparser, &zoneconf);
-	}
-
-	result = ISC_R_SUCCESS;
-
- cleanup:
-	if (zoneconf != NULL) {
-		cfg_obj_destroy(named_g_addparser, &zoneconf);
-	}
-	if (cursor != NULL) {
-		mdb_cursor_close(cursor);
-		cursor = NULL;
-	}
 	if (result != ISC_R_SUCCESS) {
-		status = mdb_cursor_open(txn, dbi, &cursor);
+		/*
-		if (status != 0) {
+		 * An error was encountered while attempting to configure zones
-			goto cleanup2;
+		 * found in NZD.  As this error may have been caused by a
-		}
+		 * configure_zone() failure, try restoring a sane configuration
-		while (mdb_cursor_get(cursor, &key, &data, MDB_NEXT) == 0) {
+		 * by reattaching all zones found in NZD to the old view.  If
-			const cfg_obj_t *zlist = NULL;
+		 * this also fails, too bad, there is nothing more we can do in
-			const cfg_obj_t *zconfig = NULL;
+		 * terms of trying to make things right.
-			isc_result_t result2;
+		 */
-
+		(void) for_all_newzone_cfgs(configure_newzone_revert, config,
-			result2 = data_to_cfg(view, &key, &data, &text,
+					    vconfig, mctx, view, actx, txn,
-					      &zoneconf);
+					    dbi);
-			if (result2 != ISC_R_SUCCESS) {
-				goto cleanup2;
-			}
-
-			result2 = cfg_map_get(zoneconf, "zone", &zlist);
-			if (result2 != ISC_R_SUCCESS) {
-				goto cleanup2;
-			}
-
-			zconfig = cfg_listelt_value(cfg_list_first(zlist));
-			configure_zone_setviewcommit(result, zconfig, view);
-
-			cfg_obj_destroy(named_g_addparser, &zoneconf);
-		}
 	}
 
- cleanup2:
-	if (text != NULL) {
-		isc_buffer_free(&text);
-	}
-	if (zoneconf != NULL) {
-		cfg_obj_destroy(named_g_addparser, &zoneconf);
-	}
-	if (cursor != NULL) {
-		mdb_cursor_close(cursor);
-	}
 	(void) nzd_close(&txn, ISC_FALSE);
 	return (result);
 }
@@ -7462,8 +7530,9 @@ get_newzone_config(dns_view_t *view, const char *zonename,
 	key.mv_size = strlen(zname);
 
 	status = mdb_get(txn, dbi, &key, &data);
-	if (status != 0)
+	if (status != MDB_SUCCESS) {
 		CHECK(ISC_R_FAILURE);
+	}
 
 	CHECK(data_to_cfg(view, &key, &data, &text, &zoneconf));
 
@@ -7886,11 +7955,11 @@ load_configuration(const char *filename, named_server_t *server,
 	result = named_config_get(maps, "tcp-keepalive-timeout", &obj);
 	INSIST(result == ISC_R_SUCCESS);
 	keepalive = cfg_obj_asuint32(obj);
-	if (keepalive > 1200) {
+	if (keepalive > MAX_TCP_TIMEOUT) {
 		cfg_obj_log(obj, named_g_lctx, ISC_LOG_WARNING,
 			    "tcp-keepalive-timeout value is out of range: "
-			    "lowering to 1200");
+			    "lowering to %u", MAX_TCP_TIMEOUT);
-		keepalive = 1200;
+		keepalive = MAX_TCP_TIMEOUT;
 	} else if (keepalive < 1) {
 		cfg_obj_log(obj, named_g_lctx, ISC_LOG_WARNING,
 			    "tcp-keepalive-timeout value is out of range: "
@@ -7902,11 +7971,11 @@ load_configuration(const char *filename, named_server_t *server,
 	result = named_config_get(maps, "tcp-advertised-timeout", &obj);
 	INSIST(result == ISC_R_SUCCESS);
 	advertised = cfg_obj_asuint32(obj);
-	if (advertised > 1200) {
+	if (advertised > MAX_TCP_TIMEOUT) {
 		cfg_obj_log(obj, named_g_lctx, ISC_LOG_WARNING,
 			    "tcp-advertized-timeout value is out of range: "
-			    "lowering to 1200");
+			    "lowering to %u", MAX_TCP_TIMEOUT);
-		advertised = 1200;
+		advertised = MAX_TCP_TIMEOUT;
 	}
 
 	ns_server_settimeouts(named_g_server->sctx,
@@ -8492,7 +8561,7 @@ load_configuration(const char *filename, named_server_t *server,
 	/*
 	 * Check that the working directory is writable.
 	 */
-	if (access(".", DIR_PERM_OK) != 0) {
+	if (!isc_file_isdirwritable(".")) {
 		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 			      NAMED_LOGMODULE_SERVER, ISC_LOG_ERROR,
 			      "the working directory is not writable");
@@ -11744,6 +11813,10 @@ nzf_append(dns_view_t *view, const cfg_obj_t *zconfig) {
 
 static isc_result_t
 nzf_writeconf(const cfg_obj_t *config, dns_view_t *view) {
+	const cfg_obj_t *zl = NULL;
+	cfg_list_t *list;
+	const cfg_listelt_t *elt;
+
 	FILE *fp = NULL;
 	char tmp[1024];
 	isc_result_t result;
@@ -11755,9 +11828,24 @@ nzf_writeconf(const cfg_obj_t *config, dns_view_t *view) {
 	if (result != ISC_R_SUCCESS)
 		return (result);
 
+	cfg_map_get(config, "zone", &zl);
+	if (!cfg_obj_islist(zl))
+		CHECK(ISC_R_FAILURE);
+
+	DE_CONST(&zl->value.list, list);
+
 	CHECK(add_comment(fp, view->name));	/* force a comment */
 
-	cfg_printx(config, CFG_PRINTER_ONELINE, dumpzone, fp);
+	for (elt = ISC_LIST_HEAD(*list);
+	     elt != NULL;
+	     elt = ISC_LIST_NEXT(elt, link))
+	{
+		const cfg_obj_t *zconfig = cfg_listelt_value(elt);
+
+		CHECK(isc_stdio_write("zone ", 5, 1, fp, NULL));
+		cfg_printx(zconfig, CFG_PRINTER_ONELINE, dumpzone, fp);
+		CHECK(isc_stdio_write(";\n", 2, 1, fp, NULL));
+	}
 
 	CHECK(isc_stdio_flush(fp));
 	result = isc_stdio_close(fp);
@@ -11816,7 +11904,7 @@ nzd_save(MDB_txn **txnp, MDB_dbi dbi, dns_zone_t *zone,
 	if (zconfig == NULL) {
 		/* We're deleting the zone from the database */
 		status = mdb_del(*txnp, dbi, &key, NULL);
-		if (status != 0 && status != MDB_NOTFOUND) {
+		if (status != MDB_SUCCESS && status != MDB_NOTFOUND) {
 			isc_log_write(named_g_lctx,
 				      NAMED_LOGCATEGORY_GENERAL,
 				      NAMED_LOGMODULE_SERVER,
@@ -11826,8 +11914,9 @@ nzd_save(MDB_txn **txnp, MDB_dbi dbi, dns_zone_t *zone,
 				      namebuf, mdb_strerror(status));
 			result = ISC_R_FAILURE;
 			goto cleanup;
-		} else if (status != MDB_NOTFOUND)
+		} else if (status != MDB_NOTFOUND) {
 			commit = ISC_TRUE;
+		}
 	} else {
 		/* We're creating or overwriting the zone */
 		const cfg_obj_t *zoptions;
@@ -11862,7 +11951,7 @@ nzd_save(MDB_txn **txnp, MDB_dbi dbi, dns_zone_t *zone,
 		data.mv_size = isc_buffer_usedlength(text);
 
 		status = mdb_put(*txnp, dbi, &key, &data, 0);
-		if (status != 0) {
+		if (status != MDB_SUCCESS) {
 			isc_log_write(named_g_lctx,
 				      NAMED_LOGCATEGORY_GENERAL,
 				      NAMED_LOGMODULE_SERVER,
@@ -11880,11 +11969,11 @@ nzd_save(MDB_txn **txnp, MDB_dbi dbi, dns_zone_t *zone,
 	result = ISC_R_SUCCESS;
 
  cleanup:
-	if (!commit || result != ISC_R_SUCCESS)
+	if (!commit || result != ISC_R_SUCCESS) {
 		(void) mdb_txn_abort(*txnp);
-	else {
+	} else {
 		status = mdb_txn_commit(*txnp);
-		if (status != 0) {
+		if (status != MDB_SUCCESS) {
 			isc_log_write(named_g_lctx,
 				      NAMED_LOGCATEGORY_GENERAL,
 				      NAMED_LOGMODULE_SERVER,
@@ -11899,8 +11988,10 @@ nzd_save(MDB_txn **txnp, MDB_dbi dbi, dns_zone_t *zone,
 
 	UNLOCK(&view->new_zone_lock);
 
-	if (text != NULL)
+	if (text != NULL) {
 		isc_buffer_free(&text);
+	}
+
 	return (result);
 }
 
@@ -11914,7 +12005,7 @@ nzd_writable(dns_view_t *view) {
 	REQUIRE(view != NULL);
 
 	status = mdb_txn_begin((MDB_env *) view->new_zone_dbenv, 0, 0, &txn);
-	if (status != 0) {
+	if (status != MDB_SUCCESS) {
 		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 			      NAMED_LOGMODULE_SERVER, ISC_LOG_WARNING,
 			      "mdb_txn_begin: %s",
@@ -11923,7 +12014,7 @@ nzd_writable(dns_view_t *view) {
 	}
 
 	status = mdb_dbi_open(txn, NULL, 0, &dbi);
-	if (status != 0) {
+	if (status != MDB_SUCCESS) {
 		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 			      NAMED_LOGMODULE_SERVER, ISC_LOG_WARNING,
 			      "mdb_dbi_open: %s",
@@ -11946,7 +12037,7 @@ nzd_open(dns_view_t *view, unsigned int flags, MDB_txn **txnp, MDB_dbi *dbi) {
 
 	status = mdb_txn_begin((MDB_env *) view->new_zone_dbenv, 0,
 			       flags, &txn);
-	if (status != 0) {
+	if (status != MDB_SUCCESS) {
 		isc_log_write(named_g_lctx,
 			      NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_SERVER,
 			      ISC_LOG_WARNING, "mdb_txn_begin: %s",
@@ -11955,7 +12046,7 @@ nzd_open(dns_view_t *view, unsigned int flags, MDB_txn **txnp, MDB_dbi *dbi) {
 	}
 
 	status = mdb_dbi_open(txn, NULL, 0, dbi);
-	if (status != 0) {
+	if (status != MDB_SUCCESS) {
 		isc_log_write(named_g_lctx,
 		      NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_SERVER,
 			      ISC_LOG_WARNING, "mdb_dbi_open: %s",
@@ -11966,9 +12057,10 @@ nzd_open(dns_view_t *view, unsigned int flags, MDB_txn **txnp, MDB_dbi *dbi) {
 	*txnp = txn;
 
  cleanup:
-	if (status != 0) {
+	if (status != MDB_SUCCESS) {
-		if (txn != NULL)
+		if (txn != NULL) {
 			mdb_txn_abort(txn);
+		}
 		return (ISC_R_FAILURE);
 	}
 
@@ -11982,38 +12074,34 @@ nzd_open(dns_view_t *view, unsigned int flags, MDB_txn **txnp, MDB_dbi *dbi) {
  */
 static void
 nzd_env_close(dns_view_t *view) {
-	if (view->new_zone_dbenv != NULL) {
+	const char *dbpath = NULL;
-		const char *dbpath = NULL;
+	char dbpath_copy[PATH_MAX];
-		isc_boolean_t have_dbpath = ISC_FALSE;
+	char lockpath[PATH_MAX];
-		char dbpath_copy[PATH_MAX];
+	int status, ret;
-		char lockpath[PATH_MAX];
-		int ret;
 
-		if (mdb_env_get_path(view->new_zone_dbenv, &dbpath) == 0) {
+	if (view->new_zone_dbenv == NULL) {
-			have_dbpath = ISC_TRUE;
+		return;
-			snprintf(lockpath, sizeof(lockpath), "%s-lock",
-				 dbpath);
-			strlcpy(dbpath_copy, dbpath, sizeof(dbpath_copy));
-		}
-
-		mdb_env_close((MDB_env *) view->new_zone_dbenv);
-		view->new_zone_dbenv = NULL;
-
-		if (have_dbpath) {
-			/*
-			 * Database files must be owned by the eventual user, not
-			 * by root.
-			 */
-			ret = chown(dbpath_copy, ns_os_uid(), -1);
-			UNUSED(ret);
-
-			/*
-			 * Some platforms need the lockfile not to exist when we
-			 * reopen the environment.
-			 */
-			(void) isc_file_remove(lockpath);
-		}
 	}
+
+	status = mdb_env_get_path(view->new_zone_dbenv, &dbpath);
+	INSIST(status == MDB_SUCCESS);
+	snprintf(lockpath, sizeof(lockpath), "%s-lock", dbpath);
+	strlcpy(dbpath_copy, dbpath, sizeof(dbpath_copy));
+	mdb_env_close((MDB_env *) view->new_zone_dbenv);
+
+	/*
+	 * Database files must be owned by the eventual user, not by root.
+	 */
+	ret = chown(dbpath_copy, ns_os_uid(), -1);
+	UNUSED(ret);
+
+	/*
+	 * Some platforms need the lockfile not to exist when we reopen the
+	 * environment.
+	 */
+	(void) isc_file_remove(lockpath);
+
+	view->new_zone_dbenv = NULL;
 }
 
 static isc_result_t
@@ -12029,7 +12117,7 @@ nzd_env_reopen(dns_view_t *view) {
 	nzd_env_close(view);
 
 	status = mdb_env_create(&env);
-	if (status != 0) {
+	if (status != MDB_SUCCESS) {
 		isc_log_write(dns_lctx, DNS_LOGCATEGORY_GENERAL,
 			      ISC_LOGMODULE_OTHER, ISC_LOG_ERROR,
 			      "mdb_env_create failed: %s",
@@ -12039,7 +12127,7 @@ nzd_env_reopen(dns_view_t *view) {
 
 	if (view->new_zone_mapsize != 0ULL) {
 		status = mdb_env_set_mapsize(env, view->new_zone_mapsize);
-		if (status != 0) {
+		if (status != MDB_SUCCESS) {
 			isc_log_write(dns_lctx, DNS_LOGCATEGORY_GENERAL,
 				      ISC_LOGMODULE_OTHER, ISC_LOG_ERROR,
 				      "mdb_env_set_mapsize failed: %s",
@@ -12048,9 +12136,8 @@ nzd_env_reopen(dns_view_t *view) {
 		}
 	}
 
-	status = mdb_env_open(env, view->new_zone_db,
+	status = mdb_env_open(env, view->new_zone_db, DNS_LMDB_FLAGS, 0600);
-			      MDB_NOSUBDIR|MDB_CREATE, 0600);
+	if (status != MDB_SUCCESS) {
-	if (status != 0) {
 		isc_log_write(dns_lctx, DNS_LOGCATEGORY_GENERAL,
 			      ISC_LOGMODULE_OTHER, ISC_LOG_ERROR,
 			      "mdb_env_open of '%s' failed: %s",
@@ -12079,10 +12166,12 @@ nzd_close(MDB_txn **txnp, isc_boolean_t commit) {
 	if (*txnp != NULL) {
 		if (commit) {
 			status = mdb_txn_commit(*txnp);
-			if (status != 0)
+			if (status != MDB_SUCCESS) {
 				result = ISC_R_FAILURE;
-		} else
+			}
+		} else {
 			mdb_txn_abort(*txnp);
+		}
 		*txnp = NULL;
 	}
 
@@ -12100,11 +12189,12 @@ nzd_count(dns_view_t *view, int *countp) {
 	REQUIRE(countp != NULL);
 
 	result = nzd_open(view, MDB_RDONLY, &txn, &dbi);
-	if (result != ISC_R_SUCCESS)
+	if (result != ISC_R_SUCCESS) {
 		goto cleanup;
+	}
 
 	status = mdb_stat(txn, dbi, &statbuf);
-	if (status != 0) {
+	if (status != MDB_SUCCESS) {
 		isc_log_write(named_g_lctx,
 			      NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_SERVER,
 			      ISC_LOG_WARNING, "mdb_stat: %s",
@@ -12177,8 +12267,9 @@ migrate_nzf(dns_view_t *view) {
 
 	zonelist = NULL;
 	CHECK(cfg_map_get(nzf_config, "zone", &zonelist));
-	if (!cfg_obj_islist(zonelist))
+	if (!cfg_obj_islist(zonelist)) {
 		CHECK(ISC_R_FAILURE);
+	}
 
 	CHECK(nzd_open(view, 0, &txn, &dbi));
 
@@ -12229,7 +12320,7 @@ migrate_nzf(dns_view_t *view) {
 		data.mv_size = isc_buffer_usedlength(text);
 
 		status = mdb_put(txn, dbi, &key, &data, MDB_NOOVERWRITE);
-		if (status != 0) {
+		if (status != MDB_SUCCESS) {
 			isc_log_write(named_g_lctx,
 				      NAMED_LOGCATEGORY_GENERAL,
 				      NAMED_LOGMODULE_SERVER,
@@ -12258,15 +12349,19 @@ migrate_nzf(dns_view_t *view) {
 	}
 
  cleanup:
-	if (result != ISC_R_SUCCESS)
+	if (result != ISC_R_SUCCESS) {
 		(void) nzd_close(&txn, ISC_FALSE);
-	else
+	} else {
 		result = nzd_close(&txn, commit);
+	}
 
-	if (text != NULL)
+	if (text != NULL) {
 		isc_buffer_free(&text);
-	if (nzf_config != NULL)
+	}
+
+	if (nzf_config != NULL) {
 		cfg_obj_destroy(named_g_addparser, &nzf_config);
+	}
 
 	return (result);
 }
@@ -13447,11 +13542,6 @@ newzone_cfgctx_destroy(void **cfgp) {
 
 static isc_result_t
 generate_salt(unsigned char *salt, size_t saltlen) {
-	size_t i, n;
-	union {
-		unsigned char rnd[256];
-		isc_uint16_t rnd16[128];
-	} rnd;
 	unsigned char text[512 + 1];
 	isc_region_t r;
 	isc_buffer_t buf;
@@ -13460,14 +13550,9 @@ generate_salt(unsigned char *salt, size_t saltlen) {
 	if (saltlen > 256U)
 		return (ISC_R_RANGE);
 
-	n = (saltlen + sizeof(isc_uint16_t) - 1) / sizeof(isc_uint16_t);
+	isc_rng_randombytes(named_g_server->sctx->rngctx, salt, saltlen);
-	for (i = 0; i < n; i++) {
-		rnd.rnd16[i] = isc_rng_random(named_g_server->sctx->rngctx);
-	}
 
-	memmove(salt, rnd.rnd, saltlen);
+	r.base = salt;
-
-	r.base = rnd.rnd;
 	r.length = (unsigned int) saltlen;
 
 	isc_buffer_init(&buf, text, sizeof(text));
@@ -14428,10 +14513,10 @@ mkey_dumpzone(dns_view_t *view, isc_buffer_t **text) {
 			else if (revoked)
 				snprintf(buf, sizeof(buf),
 					 "\n\ttrust revoked");
-			else if (kd.addhd < now)
+			else if (kd.addhd <= now)
 				snprintf(buf, sizeof(buf),
 					 "\n\ttrusted since: %s", tbuf);
-			else if (kd.addhd >= now)
+			else if (kd.addhd > now)
 				snprintf(buf, sizeof(buf),
 					 "\n\ttrust pending: %s", tbuf);
 			CHECK(putstr(text, buf));
@@ -14700,7 +14785,7 @@ named_server_tcptimeouts(isc_lex_t *lex, isc_buffer_t **text) {
 		if (ptr == NULL)
 			return (ISC_R_UNEXPECTEDEND);
 		CHECK(isc_parse_uint32(&keepalive, ptr, 10));
-		if (keepalive > 1200)
+		if (keepalive > MAX_TCP_TIMEOUT)
 			CHECK(ISC_R_RANGE);
 		if (keepalive < 1)
 			CHECK(ISC_R_RANGE);
@@ -14709,7 +14794,7 @@ named_server_tcptimeouts(isc_lex_t *lex, isc_buffer_t **text) {
 		if (ptr == NULL)
 			return (ISC_R_UNEXPECTEDEND);
 		CHECK(isc_parse_uint32(&advertised, ptr, 10));
-		if (advertised > 1200)
+		if (advertised > MAX_TCP_TIMEOUT)
 			CHECK(ISC_R_RANGE);
 
 		result = isc_task_beginexclusive(named_g_server->task);

bin/named/statschannel.c

@@ -395,6 +395,7 @@ init_desc(void) {
 	SET_RESSTATDESC(serverquota, "spilled due to server quota",
 			"ServerQuota");
 	SET_RESSTATDESC(nextitem, "waited for next item", "NextItem");
+	SET_RESSTATDESC(priming, "priming queries", "Priming");
 
 	INSIST(i == dns_resstatscounter_max);
 
@@ -1615,7 +1616,7 @@ generatexml(named_server_t *server, isc_uint32_t flags,
 			ISC_XMLCHAR "type=\"text/xsl\" href=\"/bind9.xsl\""));
 	TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "statistics"));
 	TRY0(xmlTextWriterWriteAttribute(writer, ISC_XMLCHAR "version",
-					 ISC_XMLCHAR "3.10"));
+					 ISC_XMLCHAR "3.11"));
 
 	/* Set common fields for statistics dump */
 	dumparg.type = isc_statsformat_xml;
@@ -2411,7 +2412,7 @@ generatejson(named_server_t *server, size_t *msglen,
 	/*
 	 * These statistics are included no matter which URL we use.
 	 */
-	obj = json_object_new_string("1.4");
+	obj = json_object_new_string("1.5");
 	CHECKMEM(obj);
 	json_object_object_add(bindstats, "json-stats-version", obj);
 

bin/nsupdate/nsupdate.c

@@ -150,6 +150,7 @@ static dns_dispatch_t *dispatchv4 = NULL;
 static dns_dispatch_t *dispatchv6 = NULL;
 static dns_message_t *updatemsg = NULL;
 static dns_fixedname_t fuserzone;
+static dns_fixedname_t fzname;
 static dns_name_t *userzone = NULL;
 static dns_name_t *zname = NULL;
 static dns_name_t tmpzonename;
@@ -943,16 +944,21 @@ setup_system(void) {
 			case AF_INET:
 				if (have_ipv4) {
 					sa->type.sin.sin_port = htons(dnsport);
+				} else {
+					continue;
 				}
 				break;
 			case AF_INET6:
 				if (have_ipv6) {
 					sa->type.sin6.sin6_port = htons(dnsport);
+				} else {
+					continue;
 				}
 				break;
 			default:
 				fatal("bad family");
 			}
+			INSIST(i < ns_alloc);
 			servers[i++] = *sa;
 		}
 	}
@@ -2390,7 +2396,6 @@ update_completed(isc_task_t *task, isc_event_t *event) {
 		dns_request_destroy(&request);
 		dns_message_renderreset(updatemsg);
 		dns_message_settsigkey(updatemsg, NULL);
-		/* XXX MPA fix zonename is freed already */
 		send_update(zname, &master_servers[master_inuse]);
 		isc_event_free(&event);
 		return;
@@ -2693,13 +2698,17 @@ recvsoa(isc_task_t *task, isc_event_t *event) {
 	dns_name_init(&master, NULL);
 	dns_name_clone(&soa.origin, &master);
 
-	/*
+	if (userzone != NULL) {
-	 * XXXMPA
-	 */
-	if (userzone != NULL)
 		zname = userzone;
-	else
+	} else {
-		zname = name;
+		/*
+		 * Save the zone name in case we need to try a second
+		 * address.
+		 */
+		dns_fixedname_init(&fzname);
+		zname = dns_fixedname_name(&fzname);
+		dns_name_copy(name, zname, NULL);
+	}
 
 	if (debugging) {
 		char namestr[DNS_NAME_FORMATSIZE];

bin/python/dnssec-checkds.8

@@ -39,9 +39,7 @@
 dnssec-checkds \- DNSSEC delegation consistency checking tool
 .SH "SYNOPSIS"
 .HP \w'\fBdnssec\-checkds\fR\ 'u
-\fBdnssec\-checkds\fR [\fB\-l\ \fR\fB\fIdomain\fR\fR] [\fB\-f\ \fR\fB\fIfile\fR\fR] [\fB\-d\ \fR\fB\fIdig\ path\fR\fR] [\fB\-D\ \fR\fB\fIdsfromkey\ path\fR\fR] {zone}
+\fBdnssec\-checkds\fR [\fB\-d\ \fR\fB\fIdig\ path\fR\fR] [\fB\-D\ \fR\fB\fIdsfromkey\ path\fR\fR] [\fB\-f\ \fR\fB\fIfile\fR\fR] [\fB\-l\ \fR\fB\fIdomain\fR\fR] [\fB\-s\ \fR\fB\fIfile\fR\fR] {zone}
-.HP \w'\fBdnssec\-dsfromkey\fR\ 'u
-\fBdnssec\-dsfromkey\fR [\fB\-l\ \fR\fB\fIdomain\fR\fR] [\fB\-f\ \fR\fB\fIfile\fR\fR] [\fB\-d\ \fR\fB\fIdig\ path\fR\fR] [\fB\-D\ \fR\fB\fIdsfromkey\ path\fR\fR] {zone}
 .SH "DESCRIPTION"
 .PP
 \fBdnssec\-checkds\fR
@@ -60,6 +58,12 @@ is specified, then the zone is read from that file to find the DNSKEY records\&.
 Check for a DLV record in the specified lookaside domain, instead of checking for a DS record in the zone\*(Aqs parent\&.
 .RE
 .PP
+\-s \fIfile\fR
+.RS 4
+Specifies a prepared dsset file, such as would be generated by
+\fBdnssec\-signzone\fR, to use as a source for the DS RRset instead of querying the parent\&.
+.RE
+.PP
 \-d \fIdig path\fR
 .RS 4
 Specifies a path to a

bin/python/dnssec-checkds.docbook

@@ -42,20 +42,13 @@
   <refsynopsisdiv>
     <cmdsynopsis sepchar=" ">
       <command>dnssec-checkds</command>
-      <arg choice="opt" rep="norepeat"><option>-l <replaceable class="parameter">domain</replaceable></option></arg>
-      <arg choice="opt" rep="norepeat"><option>-f <replaceable class="parameter">file</replaceable></option></arg>
       <arg choice="opt" rep="norepeat"><option>-d <replaceable class="parameter">dig path</replaceable></option></arg>
       <arg choice="opt" rep="norepeat"><option>-D <replaceable class="parameter">dsfromkey path</replaceable></option></arg>
+      <arg choice="opt" rep="norepeat"><option>-f <replaceable class="parameter">file</replaceable></option></arg>
+      <arg choice="opt" rep="norepeat"><option>-l <replaceable class="parameter">domain</replaceable></option></arg>
+      <arg choice="opt" rep="norepeat"><option>-s <replaceable class="parameter">file</replaceable></option></arg>
       <arg choice="req" rep="norepeat">zone</arg>
     </cmdsynopsis>
-    <cmdsynopsis sepchar=" ">
-      <command>dnssec-dsfromkey</command>
-      <arg choice="opt" rep="norepeat"><option>-l <replaceable class="parameter">domain</replaceable></option></arg>
-      <arg choice="opt" rep="norepeat"><option>-f <replaceable class="parameter">file</replaceable></option></arg>
-      <arg choice="opt" rep="norepeat"><option>-d <replaceable class="parameter">dig path</replaceable></option></arg>
-      <arg choice="opt" rep="norepeat"><option>-D <replaceable class="parameter">dsfromkey path</replaceable></option></arg>
-      <arg choice="req" rep="norepeat">zone</arg>
-   </cmdsynopsis>
   </refsynopsisdiv>
 
   <refsection><info><title>DESCRIPTION</title></info>
@@ -92,6 +85,17 @@
         </listitem>
       </varlistentry>
 
+      <varlistentry>
+        <term>-s <replaceable class="parameter">file</replaceable></term>
+        <listitem>
+          <para>
+            Specifies a prepared dsset file, such as would be generated
+            by <command>dnssec-signzone</command>, to use as a source for
+            the DS RRset instead of querying the parent.
+          </para>
+        </listitem>
+      </varlistentry>
+
       <varlistentry>
         <term>-d <replaceable class="parameter">dig path</replaceable></term>
         <listitem>

bin/python/dnssec-checkds.html

@@ -33,20 +33,13 @@
 <h2>Synopsis</h2>
     <div class="cmdsynopsis"><p>
       <code class="command">dnssec-checkds</code> 
-       [<code class="option">-l <em class="replaceable"><code>domain</code></em></code>]
-       [<code class="option">-f <em class="replaceable"><code>file</code></em></code>]
        [<code class="option">-d <em class="replaceable"><code>dig path</code></em></code>]
        [<code class="option">-D <em class="replaceable"><code>dsfromkey path</code></em></code>]
+       [<code class="option">-f <em class="replaceable"><code>file</code></em></code>]
+       [<code class="option">-l <em class="replaceable"><code>domain</code></em></code>]
+       [<code class="option">-s <em class="replaceable"><code>file</code></em></code>]
        {zone}
     </p></div>
-    <div class="cmdsynopsis"><p>
-      <code class="command">dnssec-dsfromkey</code> 
-       [<code class="option">-l <em class="replaceable"><code>domain</code></em></code>]
-       [<code class="option">-f <em class="replaceable"><code>file</code></em></code>]
-       [<code class="option">-d <em class="replaceable"><code>dig path</code></em></code>]
-       [<code class="option">-D <em class="replaceable"><code>dsfromkey path</code></em></code>]
-       {zone}
-   </p></div>
   </div>
 
   <div class="refsection">
@@ -79,6 +72,14 @@
             instead of checking for a DS record in the zone's parent.
           </p>
         </dd>
+<dt><span class="term">-s <em class="replaceable"><code>file</code></em></span></dt>
+<dd>
+          <p>
+            Specifies a prepared dsset file, such as would be generated
+            by <span class="command"><strong>dnssec-signzone</strong></span>, to use as a source for
+            the DS RRset instead of querying the parent.
+          </p>
+        </dd>
 <dt><span class="term">-d <em class="replaceable"><code>dig path</code></em></span></dt>
 <dd>
           <p>

bin/python/isc/checkds.py.in

@@ -1,5 +1,5 @@
 ############################################################################
-# Copyright (C) 2012-2016  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2012-2017  Internet Systems Consortium, Inc. ("ISC")
 #
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -34,7 +34,11 @@ class SECRR:
         if not rrtext:
             raise Exception
 
-        fields = rrtext.decode('ascii').split()
+        # 'str' does not have decode method in python3
+        if type(rrtext) is not str:
+            fields = rrtext.decode('ascii').split()
+        else:
+            fields = rrtext.split()
         if len(fields) < 7:
             raise Exception
 
@@ -89,35 +93,39 @@ class SECRR:
 # Generate a set of expected DS/DLV records from the DNSKEY RRset,
 # and report on congruency.
 ############################################################################
-def check(zone, args, masterfile=None, lookaside=None):
+def check(zone, args):
     rrlist = []
-    cmd = [args.dig, "+noall", "+answer", "-t", "dlv" if lookaside else "ds",
+    if args.dssetfile:
-           "-q", zone + "." + lookaside if lookaside else zone]
+        fp = open(args.dssetfile).read()
-    fp, _ = Popen(cmd, stdout=PIPE).communicate()
+    else:
+        cmd = [args.dig, "+noall", "+answer", "-t",
+                "dlv" if args.lookaside else "ds", "-q",
+                zone + "." + args.lookaside if args.lookaside else zone]
+        fp, _ = Popen(cmd, stdout=PIPE).communicate()
 
     for line in fp.splitlines():
-        rrlist.append(SECRR(line, lookaside))
+        rrlist.append(SECRR(line, args.lookaside))
     rrlist = sorted(rrlist, key=lambda rr: (rr.keyid, rr.keyalg, rr.hashalg))
 
     klist = []
 
-    if masterfile:
+    if args.masterfile:
-        cmd = [args.dsfromkey, "-f", masterfile]
+        cmd = [args.dsfromkey, "-f", args.masterfile]
-        if lookaside:
+        if args.lookaside:
-            cmd += ["-l", lookaside]
+            cmd += ["-l", args.lookaside]
         cmd.append(zone)
         fp, _ = Popen(cmd, stdout=PIPE).communicate()
     else:
         intods, _ = Popen([args.dig, "+noall", "+answer", "-t", "dnskey",
                            "-q", zone], stdout=PIPE).communicate()
         cmd = [args.dsfromkey, "-f", "-"]
-        if lookaside:
+        if args.lookaside:
-            cmd += ["-l", lookaside]
+            cmd += ["-l", args.lookaside]
         cmd.append(zone)
         fp, _ = Popen(cmd, stdin=PIPE, stdout=PIPE).communicate(intods)
 
     for line in fp.splitlines():
-        klist.append(SECRR(line, lookaside))
+        klist.append(SECRR(line, args.lookaside))
 
     if len(klist) < 1:
         print("No DNSKEY records found in zone apex")
@@ -136,7 +144,8 @@ def check(zone, args, masterfile=None, lookaside=None):
                    rr.keyid, SECRR.hashalgs[rr.hashalg]))
 
     if not found:
-        print("No %s records were found for any DNSKEY" % ("DLV" if lookaside else "DS"))
+        print("No %s records were found for any DNSKEY" %
+                ("DLV" if args.lookaside else "DS"))
 
     return found
 
@@ -151,10 +160,6 @@ def parse_args():
     sbindir = 'bin' if os.name == 'nt' else 'sbin'
 
     parser.add_argument('zone', type=str, help='zone to check')
-    parser.add_argument('-f', '--file', dest='masterfile', type=str,
-                        help='zone master file')
-    parser.add_argument('-l', '--lookaside', dest='lookaside', type=str,
-                        help='DLV lookaside zone')
     parser.add_argument('-d', '--dig', dest='dig',
                         default=os.path.join(prefix(bindir), 'dig'),
                         type=str, help='path to \'dig\'')
@@ -162,6 +167,12 @@ def parse_args():
                         default=os.path.join(prefix(sbindir),
                                              'dnssec-dsfromkey'),
                         type=str, help='path to \'dig\'')
+    parser.add_argument('-f', '--file', dest='masterfile', type=str,
+                        help='zone master file')
+    parser.add_argument('-l', '--lookaside', dest='lookaside', type=str,
+                        help='DLV lookaside zone')
+    parser.add_argument('-s', '--dsset', dest='dssetfile', type=str,
+                        help='prepared DSset file')
     parser.add_argument('-v', '--version', action='version',
                         version=version)
     args = parser.parse_args()
@@ -178,5 +189,5 @@ def parse_args():
 ############################################################################
 def main():
     args = parse_args()
-    found = check(args.zone, args, args.masterfile, args.lookaside)
+    found = check(args.zone, args)
     exit(0 if found else 1)

bin/rndc/rndc.8

@@ -516,7 +516,10 @@ Status will report whether serving of stale answers is currently enabled, disabl
 .PP
 \fBsecroots \fR\fB[\-]\fR\fB \fR\fB[\fIview \&.\&.\&.\fR]\fR
 .RS 4
-Dump the server\*(Aqs security roots and negative trust anchors for the specified views\&. If no view is specified, all views are dumped\&.
+Dump the security roots (i\&.e\&., trust anchors configured via
+\fBtrusted\-keys\fR,
+\fBmanaged\-keys\fR, or
+\fBdnssec\-validation auto\fR) and negative trust anchors for the specified views\&. If no view is specified, all views are dumped\&. Security roots will indicate whether they are configured as trusted keys, managed keys, or initializing managed keys (managed keys that have not yet been updated by a successful key refresh query)\&.
 .sp
 If the first argument is "\-", then the output is returned via the
 \fBrndc\fR

bin/rndc/rndc.docbook

@@ -774,9 +774,15 @@
 	<term><userinput>secroots <optional>-</optional> <optional><replaceable>view ...</replaceable></optional></userinput></term>
 	<listitem>
 	  <para>
-	    Dump the server's security roots and negative trust anchors
+	    Dump the security roots (i.e., trust anchors
-	    for the specified views.  If no view is specified, all views
+	    configured via <command>trusted-keys</command>,
-	    are dumped.
+	    <command>managed-keys</command>, or
+	    <command>dnssec-validation auto</command>) and negative trust
+	    anchors for the specified views.  If no view is specified, all
+	    views are dumped.  Security roots will indicate whether
+	    they are configured as trusted keys, managed keys, or
+	    initializing managed keys (managed keys that have not yet
+	    been updated by a successful key refresh query).
 	  </para>
 	  <para>
 	    If the first argument is "-", then the output is
@@ -963,15 +969,15 @@
 	<listitem>
 	  <para>
 	    When called without arguments, display the current
-            values of the <command>tcp-initial-timeout</command>,
+	    values of the <command>tcp-initial-timeout</command>,
 	    <command>tcp-idle-timeout</command>,
 	    <command>tcp-keepalive-timeout</command> and
 	    <command>tcp-advertised-timeout</command> options.
-            When called with arguments, update these values. This
+	    When called with arguments, update these values. This
-            allows an administrator to make rapid adjustments when
+	    allows an administrator to make rapid adjustments when
-            under a denial of service attack.  See the descriptions of
+	    under a denial of service attack.  See the descriptions of
-            these options in the BIND 9 Administrator Reference Manual
+	    these options in the BIND 9 Administrator Reference Manual
-            for details of their use.
+	    for details of their use.
 	  </para>
 	</listitem>
       </varlistentry>

bin/rndc/rndc.html

@@ -657,9 +657,15 @@
 <dt><span class="term"><strong class="userinput"><code>secroots [<span class="optional">-</span>] [<span class="optional"><em class="replaceable"><code>view ...</code></em></span>]</code></strong></span></dt>
 <dd>
 	  <p>
-	    Dump the server's security roots and negative trust anchors
+	    Dump the security roots (i.e., trust anchors
-	    for the specified views.  If no view is specified, all views
+	    configured via <span class="command"><strong>trusted-keys</strong></span>,
-	    are dumped.
+	    <span class="command"><strong>managed-keys</strong></span>, or
+	    <span class="command"><strong>dnssec-validation auto</strong></span>) and negative trust
+	    anchors for the specified views.  If no view is specified, all
+	    views are dumped.  Security roots will indicate whether
+	    they are configured as trusted keys, managed keys, or
+	    initializing managed keys (managed keys that have not yet
+	    been updated by a successful key refresh query).
 	  </p>
 	  <p>
 	    If the first argument is "-", then the output is
@@ -822,15 +828,15 @@
 <dd>
 	  <p>
 	    When called without arguments, display the current
-            values of the <span class="command"><strong>tcp-initial-timeout</strong></span>,
+	    values of the <span class="command"><strong>tcp-initial-timeout</strong></span>,
 	    <span class="command"><strong>tcp-idle-timeout</strong></span>,
 	    <span class="command"><strong>tcp-keepalive-timeout</strong></span> and
 	    <span class="command"><strong>tcp-advertised-timeout</strong></span> options.
-            When called with arguments, update these values. This
+	    When called with arguments, update these values. This
-            allows an administrator to make rapid adjustments when
+	    allows an administrator to make rapid adjustments when
-            under a denial of service attack.  See the descriptions of
+	    under a denial of service attack.  See the descriptions of
-            these options in the BIND 9 Administrator Reference Manual
+	    these options in the BIND 9 Administrator Reference Manual
-            for details of their use.
+	    for details of their use.
 	  </p>
 	</dd>
 <dt><span class="term"><strong class="userinput"><code>thaw [<span class="optional"><em class="replaceable"><code>zone</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em> [<span class="optional"><em class="replaceable"><code>view</code></em></span>]</span>]</span>]</code></strong></span></dt>

bin/tests/system/cds/checkmtime.pl

@@ -10,4 +10,4 @@ my $target = shift;
 my $file = shift;
 my $mtime = time - (stat $file)[9];
 die "bad mtime $mtime"
-	unless abs($mtime - $target) < 3;
+	unless abs($mtime - $target) < 10;

bin/tests/system/cds/tests.sh

@@ -43,7 +43,7 @@ check_stderr() {
 		[ -s err.$n ] || return 0
 	fi
 	echo "D:stderr did not match '$err'"
-	sed 's/^/D:/' err
+	sed 's/^/D:/' err.$n
 	fail
 }
 

bin/tests/system/chain/ans4/ans.py

@@ -254,7 +254,7 @@ def create_response(msg):
 def sigterm(signum, frame):
     print ("Shutting down now...")
     os.remove('ans.pid')
-    running = 0
+    running = False
     sys.exit(0)
 
 ############################################################################
@@ -270,8 +270,17 @@ sock = 5300
 
 query4_socket = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
 query4_socket.bind((ip4, sock))
-query6_socket = socket.socket(socket.AF_INET6, socket.SOCK_DGRAM)
+
-query6_socket.bind((ip6, sock))
+havev6 = True
+try:
+    query6_socket = socket.socket(socket.AF_INET6, socket.SOCK_DGRAM)
+    try:
+        query6_socket.bind((ip6, sock))
+    except:
+        query6_socket.close()
+        havev6 = False
+except:
+    havev6 = False
 
 ctrl_socket = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
 ctrl_socket.bind((ip4, sock + 1))
@@ -284,14 +293,18 @@ pid = os.getpid()
 print (pid, file=f)
 f.close()
 
-running = 1
+running = True
 
 print ("Listening on %s port %d" % (ip4, sock))
-print ("Listening on %s port %d" % (ip6, sock))
+if havev6:
+    print ("Listening on %s port %d" % (ip6, sock))
 print ("Control channel on %s port %d" % (ip4, sock + 1))
 print ("Ctrl-c to quit")
 
-input = [query4_socket, query6_socket, ctrl_socket]
+if havev6:
+    input = [query4_socket, query6_socket, ctrl_socket]
+else:
+    input = [query4_socket, ctrl_socket]
 
 while running:
     try:

bin/tests/system/checkconf/good-dlv-dlv.example.com.conf

@@ -0,0 +1,11 @@
+/*
+ * Copyright (C) 2017  Internet Systems Consortium, Inc. ("ISC")
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ */
+
+options {
+	dnssec-lookaside . trust-anchor dlv.example.com;
+};

bin/tests/system/checkconf/tests.sh

@@ -1,4 +1,4 @@
-# Copyright (C) 2005, 2007, 2010-2016  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2005, 2007, 2010-2017  Internet Systems Consortium, Inc. ("ISC")
 #
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -135,6 +135,7 @@ done
 if [ $ret != 0 ]; then echo "I:failed"; fi
 status=`expr $status + $ret`
 
+n=`expr $n + 1`
 echo "I: checking options allowed in inline-signing slaves ($n)"
 ret=0
 l=`$CHECKCONF bad-dnssec.conf 2>&1 | grep "dnssec-dnskey-kskonly.*requires inline" | wc -l`
@@ -327,5 +328,29 @@ diff good.zonelist checkconf.out$n  > diff.out$n || ret=1
 if [ $ret != 0 ]; then echo "I:failed"; ret=1; fi
 status=`expr $status + $ret`
 
+n=`expr $n + 1`
+echo "I: check that 'dnssec-lookaside auto;' generates a warning ($n)"
+ret=0
+$CHECKCONF warn-dlv-auto.conf > checkconf.out$n 2>/dev/null || ret=1
+grep "dnssec-lookaside 'auto' is no longer supported" checkconf.out$n > /dev/null || ret=1
+if [ $ret != 0 ]; then echo "I:failed"; ret=1; fi
+status=`expr $status + $ret`
+
+n=`expr $n + 1`
+echo "I: check that 'dnssec-lookaside . trust-anchor dlv.isc.org;' generates a warning ($n)"
+ret=0
+$CHECKCONF warn-dlv-dlv.isc.org.conf > checkconf.out$n 2>/dev/null || ret=1
+grep "dlv.isc.org has been shut down" checkconf.out$n > /dev/null || ret=1
+if [ $ret != 0 ]; then echo "I:failed"; ret=1; fi
+status=`expr $status + $ret`
+
+n=`expr $n + 1`
+echo "I: check that 'dnssec-lookaside . trust-anchor dlv.example.com;' doesn't generates a warning ($n)"
+ret=0
+$CHECKCONF good-dlv-dlv.example.com.conf > checkconf.out$n 2>/dev/null || ret=1
+[ -s checkconf.out$n ] && ret=1
+if [ $ret != 0 ]; then echo "I:failed"; ret=1; fi
+status=`expr $status + $ret`
+
 echo "I:exit status: $status"
 [ $status -eq 0 ] || exit 1

bin/tests/system/checkds/clean.sh

@@ -1,12 +1,10 @@
 #!/bin/sh
 #
-# Copyright (C) 2012-2014, 2016  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2012-2014, 2016, 2017  Internet Systems Consortium, Inc. ("ISC")
 #
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
 
-# $Id$
-
 rm -f checkds.*
 rm -f ns*/named.lock

bin/tests/system/checkds/dig.pl

@@ -1,13 +1,11 @@
 #!/usr/bin/perl
 #
-# Copyright (C) 2014, 2016  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2014, 2016, 2017  Internet Systems Consortium, Inc. ("ISC")
 #
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
 
-# $Id$
-
 my $arg;
 my $ext;
 my $file;

bin/tests/system/checkds/dig.sh

@@ -1,14 +1,11 @@
 #!/bin/sh
 #
-# Copyright (C) 2012, 2013, 2016  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2012, 2013, 2016, 2017  Internet Systems Consortium, Inc. ("ISC")
 #
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
 
-# $Id$
-
-
 while [ "$#" != 0 ]; do
     case $1 in
     +*) shift ;;

bin/tests/system/checkds/prep.example.db

@@ -0,0 +1,121 @@
+; File written on Thu Oct  5 23:44:34 2017
+; dnssec_signzone version 9.12.0a1
+prep.example.		300	IN SOA	ns1.prep.example. hostmaster.prep.example. (
+					1          ; serial
+					2000       ; refresh (33 minutes 20 seconds)
+					2000       ; retry (33 minutes 20 seconds)
+					1814400    ; expire (3 weeks)
+					3600       ; minimum (1 hour)
+					)
+			300	RRSIG	SOA 8 2 300 (
+					20171105054434 20171006054434 19260 prep.example.
+					1fX0z7Swu4gMPews/ZE8bzNg+JXNedFBDGIH
+					PTSfVQtVLIvRWpME+PylX7MdVMZE/PST+x4/
+					mWyveyjetEOo7/7aQL236FfI0y6TxQFy7HwC
+					FMieqoQCUluuKOvToxg4vUp4GOdlUGbqC63h
+					DbX5Z37VptJXLkt4niF4Kl2iD+U9/bk7HAEU
+					4zDiKroYnusGKfVB9xAWddzoHdLxhVuPi7ut
+					328suPdgX0bfs7uB+y4cikhGzAmPpNMlGHju
+					qYG74NcFGQNutLB7ayx/m87t7mTty7jbNKm3
+					QWJSPf5IR8/kmzAi8HMnapY5vUmm+hX8JOfU
+					UtH7i0iEsUqRbEwu5A== )
+			300	NS	ns1.prep.example.
+			300	RRSIG	NS 8 2 300 (
+					20171105054434 20171006054434 19260 prep.example.
+					u5sU2cfqNqIyCLw18ZNnFw28/GyRt0EOiPYS
+					dygmpfMDrvDaxjiiai8zWYjnl/E3qzVH9Zku
+					07lEDORZdVb0uCDe1NynjAyw4AHps85cAwVc
+					8HTSbzdVZsQTELpunYFJffh24PDr9unw7KOY
+					jzTP6qNedJ1uM54TOr177zfmBh7N2fkAoGyV
+					NjvTKrlgDYGNIn8/YMgHb4sNgyfe54MYY00f
+					kehVxfKnRCgDsbJ0Pk6jhBMCQWvOh8jG8WyV
+					ElAa/eMqlxUC1idF8ydWefjsI/7lPcjSalw9
+					qZw4CDCLHHZy0TOSmCYRRZuIeVXzBfDPJyi4
+					2A3iLntKFJ4AOLFMJg== )
+			3600	NSEC	ns1.prep.example. NS SOA RRSIG NSEC DNSKEY
+			3600	RRSIG	NSEC 8 2 3600 (
+					20171105054434 20171006054434 19260 prep.example.
+					Aed99/jdG82YAkKVWjoKOsAGtB3JnyKkCaAq
+					zgMrYkXU41y3KDCAmGzooGPQY7NN+WxX7FJ2
+					1nXkgljma/azgpsbi9ssneFtv7PPFClVmN+u
+					j+mM4MK/ZR7eJOsMqETg4PAO5VAh6c/GVmyA
+					RD/m6EhJVZEjPfLWbDoC4hVAgem7DP/NMjyI
+					GfztpDjMmyLQyv6tL+UEXSJHGp3ZEa5Z5i7X
+					Nl/bRTUlZs7L4rTgoqHv6LEmsXKAf9rZYq4b
+					eP6GF9I1Ry41MfHLc7lPUmtR38ErEsM5uGzw
+					trCQYEFhuRWUBxZ8OSL2EZK9rUBXZX+cwK/8
+					ZP7mIfDfljkXPQcmow== )
+			3600	DNSKEY	256 3 8 (
+					AwEAAfMzj6aZIgZDVcpH1pKOtq998E85+nEY
+					YJa0lLS8+QTCC1Efke8GLwsXT0IPTuwnOuXM
+					RjySirab0NuEr69T8KP/43YxcRdmCg89mjjN
+					szoVPPstC9xBKVOc0pRMDF7sfsTrSye3RY7+
+					Z6uZEH5FOAkz2hNbJJHOn4HpNUhLPJGRauhf
+					0evamwUmQ/mlhkVW5q4WmqPCDMNY3K6XtkEm
+					cvm8n9ZCXC9Z5AX6KpynujzLdKyxpdGqUk6r
+					lavp9ILPpRKoTZDX+2q1pDgP5cDndwtgNSvU
+					DBQZoD0psS2cyB3PHo+dPwwpEyM//ZSKsH9m
+					e85Ti0413TOWFyFd/jUOUA8=
+					) ; ZSK; alg = RSASHA256 ; key id = 19260
+			3600	DNSKEY	257 3 8 (
+					AwEAAbV8X06Qvk350aZ6eZ1d7WbT1H/Y0Sv7
+					qAdbk5fbYIKpMvZ8D9xqoTHgD0z0uCgWWIcm
+					/xyKBfmax76oLwMBpR/kdtuJz0irgFITnJCH
+					pEfR9AJ/Mfm7NyMglq+/39I03E1/LXvpXQLG
+					tg+Mo/2CUE5sbG31jmPNK/2J8RMESkIi87fW
+					azZU/oyUEtECE5PGbdyw+4PacAsXNjnwl30T
+					aatL277wX4pt+IUPdE6EIph3t+dxXJ7OpHgW
+					8g+YSHLlCImLVapdg3oD/cs6ncaBq9z7la5Y
+					dHNw2QAIAvQ11EsonrkonPqO6zNVZAVdT2VB
+					X5YzGAoCFUvbCvlnl2a7SxM=
+					) ; KSK; alg = RSASHA256 ; key id = 65482
+			3600	RRSIG	DNSKEY 8 2 3600 (
+					20171105054434 20171006054434 19260 prep.example.
+					pPw81pJ3PeF+tqEswTul9N8Qsl9JKgK4v8SV
+					lPfP0pnlMBMbtMFFkx5ZmhQg3Z3U8SdE64Bt
+					C5St3qItyyKdTQ0Rbm9mfV6twxDB8lVry8F7
+					Pv7gJmmcWzBcbLGcrXIrVNSZhigkemQXTElj
+					P8y1j7kaNFWBWbDMn7KesiZ9BiC6sqvuKa3R
+					wSofjwXTESspWZP0NtXr5ymaBIMR9UtNj5Wh
+					jm1+tg6BxNBKxhCHlSC0ltPS/qq9J1ZUmtJz
+					sj/EAFfPVJVuEveebMvi1oDWPTgajO9+EHl4
+					ELrgnQHCgaybMzbpd/A5+Tr1hQkv48I8Mb0/
+					8LJ2/6xrvJm64yRteg== )
+			3600	RRSIG	DNSKEY 8 2 3600 (
+					20171105054434 20171006054434 65482 prep.example.
+					WeIWiC9SnBe2+UocVjpap62O8Rz+iljwJiu9
+					VlGUwct3Vydq4/4FVAKdPklXV5cYbBLhO2MB
+					3R4toX8RNU/0Ny8DnugQzLKvVfg0xoyU/UAJ
+					k4aWa/vPivSLGouLQPiNp71bdXN4LB/2xmzu
+					cPYXzS9ePpwCOp/9JLoNjBSMQkfjfWAcaNtj
+					1DKDmHHL1sPMizninxSJLQOAKb+JwUAjAkOM
+					O1JqwkB12/IZuzxN5hly+uNsbFFxPzQkcnJ4
+					5bhzxuh5D/JRXW0nF5aO4aR+9X+lSUpDJQZ1
+					5fOt1cybZCn/ag68RA92zrnisdbrggJGS003
+					wn/VKbLVfFj3eQrfNA== )
+ns1.prep.example.	300	IN A	1.1.1.1
+			300	RRSIG	A 8 3 300 (
+					20171105054434 20171006054434 19260 prep.example.
+					QUyDyJVk3JGEq+VTZtY3firzsRqOA0LUm3Tf
+					/fnemQBeOlMda2ErA7DqYVriIGfM8jph416E
+					YX8SKAZXGEAlsEbC9cWBVyc5TYH6tZ43sV51
+					55kGTiUY92NnrH10Q+m2SLAEEaKCA/cgBwOR
+					tN2Wb1meHgiLbGYN2LbANfDQzoEk4AYAgT6r
+					wDKVVg/V9Ed7JnCnBQc9MN9+LQ3h4NBGUiEY
+					mr7HX2w+yzqcGFNLI1aFPe2IwFt120QPLyyl
+					cZgc6FUBX4YCnWoCb0aFyyOT76AQkKF5YBRn
+					gAv6S8q1pZ/0B5w4gjaLEGlts3LG0bxZ1GJd
+					gCQMEhgYgyXUchTtZA== )
+			3600	NSEC	prep.example. A RRSIG NSEC
+			3600	RRSIG	NSEC 8 3 3600 (
+					20171105054434 20171006054434 19260 prep.example.
+					rDWN40u1a3DSzWOrS+4YR2XOxaem0BAQ/glN
+					QkXNDew1WsZo3fe0IHIhDKlJ/5MJAfAHq8Xs
+					A5UGUw2efoNAN/0LuWsI/9IPm4dwQOXiTCly
+					uxugXf5islPYyvn1Z14ay/7/2P3W6HZknXzo
+					lZFpwqfFZQCxz7c/1aH+2ntAMeqx8LHuewSr
+					Rz/sLsSiCcZQ6NMWnZdoC5SGy4CTcIIPPS8z
+					9dQ6QYTC5iq4MKRfyJUyvODyU9be4e6jbo5b
+					mjRcov4ttbImhD5jrLAZIfjO6DSazGNVFf/x
+					6rjxjrc8SISPkt2xYwcOlYch9OZuoH86wcZu
+					3Don6yAnLDYDrZylAA== )

bin/tests/system/checkds/prep.example.ds.db

@@ -0,0 +1,2 @@
+prep.example.		IN DS 65482 8 1 F3673708FBADDEC3EB55933E2E393ACE85EAC2BB
+prep.example.		IN DS 65482 8 2 51A7C97AAC42803DA515D1CAFEE28031A5018F6345F12F4B6C1B6D20 02B59820

bin/tests/system/checkds/tests.sh

@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# Copyright (C) 2012-2014, 2016  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2012-2014, 2016, 2017  Internet Systems Consortium, Inc. ("ISC")
 #
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -171,6 +171,15 @@ n=`expr $n + 1`
 if [ $ret != 0 ]; then echo "I:failed"; fi
 status=`expr $status + $ret`
 
+echo "I:checking with prepared dsset file ($n)"
+ret=0
+$CHECKDS -f prep.example.db -s prep.example.ds.db prep.example > checkds.out.$n || ret=1
+grep 'SHA-1.*found' checkds.out.$n > /dev/null 2>&1 || ret=1
+grep 'SHA-256.*found' checkds.out.$n > /dev/null 2>&1 || ret=1
+n=`expr $n + 1`
+if [ $ret != 0 ]; then echo "I:failed"; fi
+status=`expr $status + $ret`
+
 if [ $status = 0 ]; then $SHELL clean.sh; fi
 echo "I:exit status: $status"
 [ $status -eq 0 ] || exit 1

bin/tests/system/conf.sh.in

@@ -186,6 +186,19 @@ else
 	}
 fi
 
+#
+# Useful functions in test scripts
+#
+
+# nextpart: read everything that's been appended to a file since the
+# last time 'nextpart' was called.
+nextpart () {
+    [ -f $1.prev ] || echo "0" > $1.prev
+    prev=`cat $1.prev`
+    awk "NR > $prev "'{ print }
+         END          { print NR > "/dev/stderr" }' $1 2> $1.prev
+}
+
 #
 # Export command paths
 #

bin/tests/system/conf.sh.win32

@@ -58,6 +58,8 @@ MDIG=$TOP/Build/$VSCONF/mdig@EXEEXT@
 NZD2NZF=$TOP/Build/$VSCONF/named-nzd2nzf@EXEEXT@
 FSTRM_CAPTURE=@FSTRM_CAPTURE@
 FEATURETEST=$TOP/Build/$VSCONF/feature-test@EXEEXT@
+SAMPLEUPDATE=$TOP/Build/$VSCONF/update@EXEEXT@
+
 # to port WIRETEST=$TOP/Build/$VSCONF/wire_test@EXEEXT@
 
 # this is given as argument to native WIN32 executables
@@ -176,6 +178,19 @@ echoinfo () {
         printf "${COLOR_INFO}%s${COLOR_NONE}\n" "$*"
 }
 
+#
+# Useful functions in test scripts
+#
+
+# nextpart: read everything that's been appended to a file since the
+# last time 'nextpart' was called.
+nextpart () {
+    [ -f $1.prev ] || echo "0" > $1.prev
+    prev=`cat $1.prev`
+    awk "NR > $prev "'{ print }
+         END          { print NR > "/dev/stderr" }' $1 2> $1.prev
+}
+
 #
 # Export command paths
 #
@@ -211,6 +226,7 @@ export RANDFILE
 export RESOLVE
 export RNDC
 export RRCHECKER
+export SAMPLEUPDATE
 export SIGNER
 export SUBDIRS
 export TESTSOCK6

bin/tests/system/logfileconfig/tests.sh

@@ -35,6 +35,19 @@ PIDFILE="${THISDIR}/${CONFDIR}/named.pid"
 myRNDC="$RNDC -c ${THISDIR}/${CONFDIR}/rndc.conf"
 myNAMED="$NAMED -c ${THISDIR}/${CONFDIR}/named.conf -m record,size,mctx -T clienttest -T nosyslog -d 99 -X named.lock -U 4"
 
+# Test given condition.  If true, test again after a second.  Used for testing
+# filesystem-dependent conditions in order to prevent false negatives caused by
+# directory contents not being synchronized immediately after rename() returns.
+test_with_retry() {
+	if test "$@"; then
+		sleep 1
+		if test "$@"; then
+			return 0
+		fi
+	fi
+	return 1
+}
+
 waitforpidfile() {
 	for _w in 1 2 3 4 5 6 7 8 9 10
 	do
@@ -48,9 +61,10 @@ n=0
 
 cd $CONFDIR
 
-n=`expr $n + 1`
+echo "I:testing log file validity (named -g + only plain files allowed)"
-echo "I:testing log file validity (named -g + only plain files allowed) ($n)"
 
+n=`expr $n + 1`
+echo "I: testing plain file (named -g) ($n)"
 # First run with a known good config.
 echo > $PLAINFILE
 cp $PLAINCONF named.conf
@@ -58,9 +72,9 @@ $myRNDC reconfig > rndc.out.test$n 2>&1
 grep "reloading configuration failed" named.run > /dev/null 2>&1
 if [ $? -ne 0 ]
 then
-	echo "I: testing plain file succeeded"
+	echo "I:  testing plain file succeeded"
 else
-	echo "I: testing plain file failed (unexpected)"
+	echo "I:  testing plain file failed (unexpected)"
 	echo "I:exit status: 1"
 	exit 1 
 fi
@@ -79,14 +93,14 @@ then
 	grep "checking logging configuration failed: invalid file" named.run > /dev/null 2>&1
 	if [ $? -ne 0 ]
 	then
-		echo "I: testing directory as file succeeded (UNEXPECTED)"
+		echo "I:  testing directory as file succeeded (UNEXPECTED)"
 		echo "I:exit status: 1"
 		exit 1
 	else
-		echo "I: testing directory as log file failed (expected)"
+		echo "I:  testing directory as log file failed (expected)"
 	fi
 else
-	echo "I: skipping directory test (unable to create directory)"
+	echo "I:  skipping directory test (unable to create directory)"
 fi
 
 # Now try pipe file, expect failure
@@ -103,14 +117,14 @@ then
 	grep "checking logging configuration failed: invalid file" named.run  > /dev/null 2>&1
 	if [ $? -ne 0 ]
 	then
-		echo "I: testing pipe file as log file succeeded (UNEXPECTED)"
+		echo "I:  testing pipe file as log file succeeded (UNEXPECTED)"
 		echo "I:exit status: 1"
 		exit 1
 	else
-		echo "I: testing pipe file as log file failed (expected)"
+		echo "I:  testing pipe file as log file failed (expected)"
 	fi
 else
-	echo "I: skipping pipe test (unable to create pipe)"
+	echo "I:  skipping pipe test (unable to create pipe)"
 fi
 
 # Now try symlink file to plain file, expect success 
@@ -129,14 +143,14 @@ then
 	grep "reloading configuration failed" named.run > /dev/null 2>&1
 	if [ $? -ne 0 ]
 	then
-		echo "I: testing symlink to plain file succeeded"
+		echo "I:  testing symlink to plain file succeeded"
 	else
-		echo "I: testing symlink to plain file failed (unexpected)"
+		echo "I:  testing symlink to plain file failed (unexpected)"
 		echo "I:exit status: 1"
 		exit 1
 	fi
 else
-	echo "I: skipping symlink test (unable to create symlink)"
+	echo "I:  skipping symlink test (unable to create symlink)"
 fi
 # Stop the server and run through a series of tests with various config
 # files while controlling the stop/start of the server.
@@ -155,9 +169,10 @@ fi
 
 status=0
 
-n=`expr $n + 1`
+echo "I:testing log file validity (only plain files allowed)"
-echo "I:testing log file validity (only plain files allowed) ($n)"
 
+n=`expr $n + 1`
+echo "I: testing plain file (named -g) ($n)"
 # First run with a known good config.
 echo > $PLAINFILE
 cp $PLAINCONF named.conf
@@ -165,9 +180,9 @@ $myRNDC reconfig > rndc.out.test$n 2>&1
 grep "reloading configuration failed" named.run > /dev/null 2>&1
 if [ $? -ne 0 ]
 then
-	echo "I: testing plain file succeeded"
+	echo "I:  testing plain file succeeded"
 else
-	echo "I: testing plain file failed (unexpected)"
+	echo "I:  testing plain file failed (unexpected)"
 	echo "I:exit status: 1"
 	exit 1 
 fi
@@ -186,14 +201,14 @@ then
 	grep "configuring logging: invalid file" named.run > /dev/null 2>&1
 	if [ $? -ne 0 ]
 	then
-		echo "I: testing directory as file succeeded (UNEXPECTED)"
+		echo "I:  testing directory as file succeeded (UNEXPECTED)"
 		echo "I:exit status: 1"
 		exit 1
 	else
-		echo "I: testing directory as log file failed (expected)"
+		echo "I:  testing directory as log file failed (expected)"
 	fi
 else
-	echo "I: skipping directory test (unable to create directory)"
+	echo "I:  skipping directory test (unable to create directory)"
 fi
 
 # Now try pipe file, expect failure
@@ -210,14 +225,14 @@ then
 	grep "configuring logging: invalid file" named.run  > /dev/null 2>&1
 	if [ $? -ne 0 ]
 	then
-		echo "I: testing pipe file as log file succeeded (UNEXPECTED)"
+		echo "I:  testing pipe file as log file succeeded (UNEXPECTED)"
 		echo "I:exit status: 1"
 		exit 1
 	else
-		echo "I: testing pipe file as log file failed (expected)"
+		echo "I:  testing pipe file as log file failed (expected)"
 	fi
 else
-	echo "I: skipping pipe test (unable to create pipe)"
+	echo "I:  skipping pipe test (unable to create pipe)"
 fi
 
 # Now try symlink file to plain file, expect success 
@@ -237,18 +252,18 @@ then
 	grep "reloading configuration failed" named.run > /dev/null 2>&1
 	if [ $? -ne 0 ]
 	then
-		echo "I: testing symlink to plain file succeeded"
+		echo "I:  testing symlink to plain file succeeded"
 	else
-		echo "I: testing symlink to plain file failed (unexpected)"
+		echo "I:  testing symlink to plain file failed (unexpected)"
 		echo "I:exit status: 1"
 		exit 1
 	fi
 else
-	echo "I: skipping symlink test (unable to create symlink)"
+	echo "I:  skipping symlink test (unable to create symlink)"
 fi
 
 n=`expr $n + 1`
-echo "I: testing default logfile using named -L file ($n)"
+echo "I:testing default logfile using named -L file ($n)"
 # Now stop the server again and test the -L option
 rm -f $DLFILE
 $PERL ../../stop.pl .. ns1
@@ -256,7 +271,7 @@ if ! test -f $PIDFILE; then
 	cp $PLAINCONF named.conf
 	$myNAMED -L $DLFILE > /dev/null 2>&1
 	if [ $? -ne 0 ]; then
-		echo "I:failed to start $myNAMED"
+		echo "I: failed to start $myNAMED"
 		echo "I:exit status: $status"
 		exit $status
 	fi
@@ -272,7 +287,7 @@ if ! test -f $PIDFILE; then
 		exit 1
 	fi
 else
-	echo "I:failed to cleanly stop $myNAMED"
+	echo "I: failed to cleanly stop $myNAMED"
 	echo "I:exit status: 1"
 	exit 1
 fi
@@ -284,9 +299,9 @@ echo "I: testing iso8601 timestamp ($n)"
 cp $ISOCONF named.conf
 $myRNDC reconfig > rndc.out.test$n 2>&1
 if grep '^....-..-..T..:..:..\.... ' $ISOFILE > /dev/null; then
-	echo "I: testing iso8601 timestamp succeeded"
+	echo "I:  testing iso8601 timestamp succeeded"
 else
-	echo "I: testing iso8601 timestamp failed"
+	echo "I:  testing iso8601 timestamp failed"
 	status=`expr $status + 1`
 fi
 
@@ -295,14 +310,14 @@ echo "I: testing iso8601-utc timestamp ($n)"
 cp $ISOCONFUTC named.conf
 $myRNDC reconfig > rndc.out.test$n 2>&1
 if grep '^....-..-..T..:..:..\....Z' $ISOUTCFILE > /dev/null; then
-	echo "I: testing iso8601-utc timestamp succeeded"
+	echo "I:  testing iso8601-utc timestamp succeeded"
 else
-	echo "I: testing iso8601-utc timestamp failed"
+	echo "I:  testing iso8601-utc timestamp failed"
 	status=`expr $status + 1`
 fi
 
 n=`expr $n + 1`
-echo "I: testing explict versions ($n)"
+echo "I: testing explicit versions ($n)"
 cp $VERSCONF named.conf
 # a seconds since epoch version number
 touch $VERSFILE.1480039317
@@ -313,27 +328,27 @@ t2=`$PERL -e 'print time()."\n";'`
 t=`expr ${t2:-0} - ${t1:-0}`
 if test ${t:-1000} -gt 5
 then
-        echo "I: testing explict versions failed cleanup of old entries took too long ($t secs)"
+        echo "I:  testing explicit versions failed: cleanup of old entries took too long ($t secs)"
 	status=`expr $status + 1`
 fi 
 if ! grep "status: NOERROR" dig.out.test$n > /dev/null
 then
-	echo "I: testing explict versions failed DiG lookup failed"
+	echo "I:  testing explicit versions failed: DiG lookup failed"
 	status=`expr $status + 1`
 fi
-if test -f $VERSFILE.1480039317
+if test_with_retry -f $VERSFILE.1480039317
 then
-	echo "I: testing explict versions failed $VERSFILE.1480039317 not removed"
+	echo "I:  testing explicit versions failed: $VERSFILE.1480039317 not removed"
 	status=`expr $status + 1`
 fi
-if test -f $VERSFILE.5
+if test_with_retry -f $VERSFILE.5
 then
-	echo "I: testing explict versions failed $VERSFILE.5 exists"
+	echo "I:  testing explicit versions failed: $VERSFILE.5 exists"
 	status=`expr $status + 1`
 fi
-if test ! -f $VERSFILE.4
+if test_with_retry ! -f $VERSFILE.4
 then
-	echo "I: testing explict versions failed $VERSFILE.4 does not exist"
+	echo "I:  testing explicit versions failed: $VERSFILE.4 does not exist"
 	status=`expr $status + 1`
 fi
 
@@ -349,17 +364,17 @@ t2=`$PERL -e 'print time()."\n";'`
 t=`expr ${t2:-0} - ${t1:-0}`
 if test ${t:-1000} -gt 5
 then
-        echo "I:  testing timestamped versions failed cleanup of old entries took too long ($t secs)"
+        echo "I:  testing timestamped versions failed: cleanup of old entries took too long ($t secs)"
 	status=`expr $status + 1`
 fi 
 if ! grep "status: NOERROR" dig.out.test$n > /dev/null
 then
-	echo "I:  testing timestamped versions failed DiG lookup failed"
+	echo "I:  testing timestamped versions failed: DiG lookup failed"
 	status=`expr $status + 1`
 fi
-if test -f $TSFILE.1480039317
+if test_with_retry -f $TSFILE.1480039317
 then
-	echo "I:  testing timestamped versions failed $TSFILE.1480039317 not removed"
+	echo "I:  testing timestamped versions failed: $TSFILE.1480039317 not removed"
 	status=`expr $status + 1`
 fi
 
@@ -375,22 +390,22 @@ t2=`$PERL -e 'print time()."\n";'`
 t=`expr ${t2:-0} - ${t1:-0}`
 if test ${t:-1000} -gt 5
 then
-        echo "I: testing unlimited versions failed took too long ($t secs)"
+        echo "I:  testing unlimited versions failed: took too long ($t secs)"
 	status=`expr $status + 1`
 fi 
 if ! grep "status: NOERROR" dig.out.test$n > /dev/null
 then
-	echo "I: testing unlimited versions failed DiG lookup failed"
+	echo "I:  testing unlimited versions failed: DiG lookup failed"
 	status=`expr $status + 1`
 fi
-if test ! -f $UNLIMITEDFILE.1480039317
+if test_with_retry ! -f $UNLIMITEDFILE.1480039317
 then
-	echo "I: testing unlimited versions failed $UNLIMITEDFILE.1480039317 removed"
+	echo "I:  testing unlimited versions failed: $UNLIMITEDFILE.1480039317 removed"
 	status=`expr $status + 1`
 fi
-if test ! -f $UNLIMITEDFILE.4
+if test_with_retry ! -f $UNLIMITEDFILE.4
 then
-	echo "I: testing unlimited versions failed $UNLIMITEDFILE.4 does not"
+	echo "I:  testing unlimited versions failed: $UNLIMITEDFILE.4 does not exist"
 	status=`expr $status + 1`
 fi
 

bin/tests/system/masterformat/tests.sh

@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# Copyright (C) 2005, 2007, 2011-2014, 2016  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2005, 2007, 2011-2014, 2016, 2017  Internet Systems Consortium, Inc. ("ISC")
 #
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -238,6 +238,16 @@ done
 [ $ret -eq 0 ] || echo "I:failed"
 status=`expr $status + $ret`
 
+# stomp on the file header
+echo "I:checking corrupt map files fail to load (bad file header)"
+ret=0
+./named-compilezone -D -f text -F map -o map.5 example.nil baseline.txt > /dev/null
+cp map.5 badmap
+stomp badmap 0 32 99
+./named-compilezone -D -f map -F text -o text.5 example.nil badmap > /dev/null
+[ $? = 1 ] || ret=1
+[ $ret -eq 0 ] || echo "I:failed"
+status=`expr $status + $ret`
 # stomp on the file data so it hashes differently.
 # these are small and subtle changes, so that the resulting file
 # would appear to be a legitimate map file and would not trigger an
@@ -245,7 +255,6 @@ status=`expr $status + $ret`
 # load because of a SHA1 hash mismatch.
 echo "I:checking corrupt map files fail to load (bad node header)"
 ret=0
-./named-compilezone -D -f text -F map -o map.5 example.nil baseline.txt > /dev/null
 cp map.5 badmap
 stomp badmap 2754 2 99
 ./named-compilezone -D -f map -F text -o text.5 example.nil badmap > /dev/null

bin/tests/system/mkeys/README

@@ -16,16 +16,8 @@ is used so it will send TAT queries once per second.
 
 ns3 is a validator with a broken key in managed-keys.
 
-Tests TODO:
+ns4 is a validator with a deliberately broken managed-keys.bind and
+managed-keys.jnl, causing RFC 5011 initialization to fail.
 
-- initial working KSK
+ns5 is a validator which is prevented from getting a response from the
-
+root server, causing key refresh queries to fail.
-TODO: test using delv with new trusted key too
-
-- introduce a REVOKE bit
-
-- later remove a signature
-
-- corrupt a signature
-
-TODO: also same things with dlv auto updates of trust anchor

bin/tests/system/mkeys/clean.sh

@@ -10,8 +10,10 @@ rm -f */K* */*.signed */trusted.conf */*.jnl */*.bk
 rm -f dsset-. ns1/dsset-.
 rm -f ns*/named.lock
 rm -f */managed-keys.bind* */named.secroots
-rm -f */managed.conf ns1/managed.key ns1/managed.key.id
+rm -f */managed*.conf ns1/managed.key ns1/managed.key.id
-rm -f */named.memstats */named.run
+rm -f */named.memstats */named.run */named.run.prev
 rm -f dig.out* delv.out* rndc.out* signer.out*
 rm -f ns1/named.secroots ns1/root.db.signed* ns1/root.db.tmp
 rm -f ns1/named.conf
+rm -rf ns4/nope
+rm -f ns5/named.args

bin/tests/system/mkeys/ns1/named1.conf

@@ -10,6 +10,11 @@
 
 controls { /* empty */ };
 
+acl allowed {
+	! 10.53.0.5;
+	any;
+};
+
 options {
 	query-source address 10.53.0.1;
 	notify-source 10.53.0.1;
@@ -22,6 +27,7 @@ options {
 	notify no;
 	dnssec-enable yes;
 	dnssec-validation yes;
+	allow-query { allowed; };
 };
 
 key rndc_key {

bin/tests/system/mkeys/ns1/named2.conf

@@ -10,6 +10,11 @@
 
 controls { /* empty */ };
 
+acl allowed {
+	! 10.53.0.5;
+	any;
+};
+
 options {
 	query-source address 10.53.0.1;
 	notify-source 10.53.0.1;
@@ -22,6 +27,7 @@ options {
 	notify no;
 	dnssec-enable yes;
 	dnssec-validation yes;
+	allow-query { allowed; };
 };
 
 key rndc_key {

bin/tests/system/mkeys/ns1/named3.conf

@@ -0,0 +1,39 @@
+/*
+ * Copyright (C) 2017  Internet Systems Consortium, Inc. ("ISC")
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ */
+
+// NS1
+
+controls { /* empty */ };
+
+options {
+	query-source address 10.53.0.1;
+	notify-source 10.53.0.1;
+	transfer-source 10.53.0.1;
+	port 5300;
+	pid-file "named.pid";
+	listen-on { 10.53.0.1; };
+	listen-on-v6 { none; };
+	recursion no;
+	notify no;
+	dnssec-enable yes;
+	dnssec-validation yes;
+};
+
+key rndc_key {
+	secret "1234abcd8765";
+	algorithm hmac-sha256;
+};
+
+controls {
+	inet 10.53.0.1 port 9953 allow { any; } keys { rndc_key; };
+};
+
+zone "." {
+	type master;
+	file "root.db.signed";
+};

bin/tests/system/mkeys/ns1/root.db

@@ -1,10 +1,10 @@
-; Copyright (C) 2015, 2016  Internet Systems Consortium, Inc. ("ISC")
+; Copyright (C) 2015-2017  Internet Systems Consortium, Inc. ("ISC")
 ;
 ; This Source Code Form is subject to the terms of the Mozilla Public
 ; License, v. 2.0. If a copy of the MPL was not distributed with this
 ; file, You can obtain one at http://mozilla.org/MPL/2.0/.
 
-$TTL 2
+$TTL 20
 . 			IN SOA	gson.nominum.com. a.root.servers.nil. (
 				2000042100   	; serial
 				600         	; refresh

bin/tests/system/mkeys/ns1/sign.sh

@@ -28,6 +28,8 @@ managed-keys {
 EOF
 ' > managed.conf
 cp managed.conf ../ns2/managed.conf
+cp managed.conf ../ns4/managed.conf
+cp managed.conf ../ns5/managed.conf
 
 # Configure a trusted key statement (used by delve)
 cat $keyname.key | grep -v '^; ' | $PERL -n -e '

bin/tests/system/mkeys/ns2/named.args

@@ -1 +1 @@
--m record,size,mctx -T clienttest -c named.conf -d 99 -X named.lock -g -T mkeytimers=2/20/40
+-m record,size,mctx -T clienttest -c named.conf -d 99 -X named.lock -g -T mkeytimers=5/10/20 -T tat=1

bin/tests/system/mkeys/ns3/named.args

@@ -1 +1 @@
--m record,size,mctx -T clienttest -c named.conf -d 99 -X named.lock -g -T mkeytimers=2/20/40 -T tat=1
+-m record,size,mctx -T clienttest -c named.conf -d 99 -X named.lock -g -T mkeytimers=5/10/20

bin/tests/system/mkeys/ns3/named.conf

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2015, 2016  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2015-2017  Internet Systems Consortium, Inc. ("ISC")
  *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -23,6 +23,7 @@ options {
 	dnssec-enable yes;
 	dnssec-validation yes;
 	bindkeys-file "managed.conf";
+	trust-anchor-telemetry no;
 };
 
 key rndc_key {

bin/tests/system/mkeys/ns4/named.conf

@@ -0,0 +1,41 @@
+/*
+ * Copyright (C) 2017  Internet Systems Consortium, Inc. ("ISC")
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ */
+
+// NS4
+
+controls { /* empty */ };
+
+options {
+	query-source address 10.53.0.4;
+	notify-source 10.53.0.4;
+	transfer-source 10.53.0.4;
+	port 5300;
+	pid-file "named.pid";
+	listen-on { 10.53.0.4; };
+	listen-on-v6 { none; };
+	recursion yes;
+	notify no;
+	dnssec-enable yes;
+	dnssec-validation auto;
+	bindkeys-file "managed.conf";
+	managed-keys-directory "nope";
+};
+
+key rndc_key {
+	secret "1234abcd8765";
+	algorithm hmac-sha256;
+};
+
+controls {
+	inet 10.53.0.4 port 9953 allow { any; } keys { rndc_key; };
+};
+
+zone "." {
+	type hint;
+	file "../../common/root.hint";
+};

bin/tests/system/mkeys/ns5/named.conf

@@ -0,0 +1,38 @@
+/*
+ * Copyright (C) 2017  Internet Systems Consortium, Inc. ("ISC")
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ */
+
+// NS5
+
+options {
+	query-source address 10.53.0.5;
+	notify-source 10.53.0.5;
+	transfer-source 10.53.0.5;
+	port 5300;
+	pid-file "named.pid";
+	listen-on { 10.53.0.5; };
+	listen-on-v6 { none; };
+	recursion yes;
+	notify no;
+	dnssec-enable yes;
+	dnssec-validation auto;
+	bindkeys-file "managed.conf";
+};
+
+key rndc_key {
+	secret "1234abcd8765";
+	algorithm hmac-sha256;
+};
+
+controls {
+	inet 10.53.0.5 port 9953 allow { any; } keys { rndc_key; };
+};
+
+zone "." {
+	type hint;
+	file "../../common/root.hint";
+};

bin/tests/system/mkeys/ns5/named1.args

@@ -0,0 +1 @@
+-m record,size,mctx -T clienttest -c named.conf -d 99 -X named.lock -g

bin/tests/system/mkeys/ns5/named2.args

@@ -0,0 +1 @@
+-m record,size,mctx -T clienttest -c named.conf -d 99 -X named.lock -g -T mkeytimers=2/20/40

bin/tests/system/mkeys/setup.sh

@@ -14,5 +14,14 @@ $SHELL clean.sh
 test -r $RANDFILE || $GENRANDOM 800 $RANDFILE
 
 cp ns1/named1.conf ns1/named.conf
+cp ns5/named1.args ns5/named.args
 
-cd ns1 && $SHELL sign.sh
+( cd ns1 && $SHELL sign.sh )
+
+cp ns2/managed.conf ns2/managed1.conf
+
+cd ns4
+mkdir nope
+touch nope/managed-keys.bind
+touch nope/managed.keys.bind.jnl
+chmod 444 nope/*

bin/tests/system/mkeys/tests.sh

@@ -9,6 +9,74 @@
 SYSTEMTESTTOP=..
 . $SYSTEMTESTTOP/conf.sh
 
+wait_for_log() {
+	msg=$1
+	file=$2
+	for i in 1 2 3 4 5 6 7 8 9 10; do
+		nextpart "$file" | grep "$msg" > /dev/null && return
+		sleep 1
+	done
+	echo "I: exceeded time limit waiting for '$msg' in $file"
+	ret=1
+}
+
+mkeys_reconfig_on() {
+	nsidx=$1
+	$RNDC -c ../common/rndc.conf -s 10.53.0.${nsidx} -p 9953 reconfig . | sed "s/^/I: ns${nsidx} /"
+}
+
+mkeys_reload_on() {
+	nsidx=$1
+	nextpart ns${nsidx}/named.run > /dev/null
+	$RNDC -c ../common/rndc.conf -s 10.53.0.${nsidx} -p 9953 reload . | sed "s/^/I: ns${nsidx} /"
+	wait_for_log "loaded serial" ns${nsidx}/named.run
+}
+
+mkeys_loadkeys_on() {
+	nsidx=$1
+	nextpart ns${nsidx}/named.run > /dev/null
+	$RNDC -c ../common/rndc.conf -s 10.53.0.${nsidx} -p 9953 loadkeys . | sed "s/^/I: ns${nsidx} /"
+	wait_for_log "next key event" ns${nsidx}/named.run
+}
+
+mkeys_refresh_on() {
+	nsidx=$1
+	nextpart ns${nsidx}/named.run > /dev/null
+	$RNDC -c ../common/rndc.conf -s 10.53.0.${nsidx} -p 9953 managed-keys refresh | sed "s/^/I: ns${nsidx} /"
+	wait_for_log "Returned from key fetch in keyfetch_done()" ns${nsidx}/named.run
+}
+
+mkeys_sync_on() {
+	# No race with mkeys_refresh_on() is possible as even if the latter
+	# returns immediately after the expected log message is written, the
+	# managed-keys zone is already locked and the command below calls
+	# dns_zone_flush(), which also attempts to take that zone's lock
+	nsidx=$1
+	nextpart ns${nsidx}/named.run > /dev/null
+	$RNDC -c ../common/rndc.conf -s 10.53.0.${nsidx} -p 9953 managed-keys sync | sed "s/^/I: ns${nsidx} /"
+	wait_for_log "dump_done" ns${nsidx}/named.run
+}
+
+mkeys_status_on() {
+	# No race with mkeys_refresh_on() is possible as even if the latter
+	# returns immediately after the expected log message is written, the
+	# managed-keys zone is already locked and the command below calls
+	# mkey_status(), which in turn calls dns_zone_getrefreshkeytime(),
+	# which also attempts to take that zone's lock
+	nsidx=$1
+	$RNDC -c ../common/rndc.conf -s 10.53.0.${nsidx} -p 9953 managed-keys status
+}
+
+mkeys_flush_on() {
+	nsidx=$1
+	$RNDC -c ../common/rndc.conf -s 10.53.0.${nsidx} -p 9953 flush | sed "s/^/I: ns${nsidx} /"
+}
+
+mkeys_secroots_on() {
+	nsidx=$1
+	$RNDC -c ../common/rndc.conf -s 10.53.0.${nsidx} -p 9953 secroots | sed "s/^/I: ns${nsidx} /"
+}
+
 status=0
 n=1
 
@@ -58,11 +126,9 @@ n=`expr $n + 1`
 echo "I: check new trust anchor can be added ($n)"
 ret=0
 standby1=`$KEYGEN -a rsasha256 -qfk -r $RANDFILE -K ns1 .`
-$RNDC -c ../common/rndc.conf -s 10.53.0.1 -p 9953 loadkeys . | sed 's/^/I: ns1 /'
+mkeys_loadkeys_on 1
-sleep 5
+mkeys_refresh_on 2
-$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys refresh | sed 's/^/I: ns2 /'
+mkeys_status_on 2 > rndc.out.$n 2>&1
-$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys sync | sed 's/^/I: ns2 /'
-$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys status > rndc.out.$n 2>&1
 # there should be two keys listed now
 count=`grep -c "keyid: " rndc.out.$n` 
 [ "$count" -eq 2 ] || ret=1
@@ -81,10 +147,8 @@ status=`expr $status + $ret`
 n=`expr $n + 1`
 echo "I: check new trust anchor can't be added with bad initial key ($n)"
 ret=0
-$RNDC -c ../common/rndc.conf -s 10.53.0.3 -p 9953 managed-keys refresh | sed 's/^/I: ns3 /'
+mkeys_refresh_on 3
-sleep 1
+mkeys_status_on 3 > rndc.out.$n 2>&1
-$RNDC -c ../common/rndc.conf -s 10.53.0.3 -p 9953 managed-keys sync | sed 's/^/I: ns3 /'
-$RNDC -c ../common/rndc.conf -s 10.53.0.3 -p 9953 managed-keys status > rndc.out.$n 2>&1
 # there should be one key listed now
 count=`grep -c "keyid: " rndc.out.$n` 
 [ "$count" -eq 1 ] || ret=1
@@ -100,14 +164,17 @@ status=`expr $status + $ret`
 n=`expr $n + 1`
 echo "I: remove untrusted standby key, check timer restarts ($n)"
 ret=0
-$SETTIME -D now -K ns1 $standby1 > /dev/null
+mkeys_sync_on 2
 t1=`grep "trust pending" ns2/managed-keys.bind`
-$RNDC -c ../common/rndc.conf -s 10.53.0.1 -p 9953 loadkeys . | sed 's/^/I: ns1 /'
+$SETTIME -D now -K ns1 $standby1 > /dev/null
-sleep 3
+mkeys_loadkeys_on 1
-$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys refresh | sed 's/^/I: ns2 /'
+# Less than a second may have passed since the last time ns2 received a
-sleep 1
+# ./DNSKEY response from ns1.  Ensure keys are refreshed at a different
-$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys sync | sed 's/^/I: ns2 /'
+# timestamp to prevent false negatives caused by the acceptance timer getting
+# reset to the same timestamp.
 sleep 1
+mkeys_refresh_on 2
+mkeys_sync_on 2
 t2=`grep "trust pending" ns2/managed-keys.bind`
 # trust pending date must be different
 [ -n "$t2" ] || ret=1
@@ -121,12 +188,15 @@ echo "I: restore untrusted standby key, revoke original key ($n)"
 t1=$t2
 $SETTIME -D none -K ns1 $standby1 > /dev/null
 $SETTIME -R now -K ns1 `cat ns1/managed.key` > /dev/null
-$RNDC -c ../common/rndc.conf -s 10.53.0.1 -p 9953 loadkeys . | sed 's/^/I: ns1 /'
+mkeys_loadkeys_on 1
-sleep 3
+# Less than a second may have passed since the last time ns2 received a
-$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys refresh | sed 's/^/I: ns2 /'
+# ./DNSKEY response from ns1.  Ensure keys are refreshed at a different
+# timestamp to prevent false negatives caused by the acceptance timer getting
+# reset to the same timestamp.
 sleep 1
-$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys sync | sed 's/^/I: ns2 /'
+mkeys_refresh_on 2
-$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys status > rndc.out.$n 2>&1
+mkeys_sync_on 2
+mkeys_status_on 2 > rndc.out.$n 2>&1
 # two keys listed
 count=`grep -c "keyid: " rndc.out.$n` 
 [ "$count" -eq 2 ] || ret=1
@@ -153,10 +223,14 @@ n=`expr $n + 1`
 ret=0
 echo "I: refresh managed-keys, ensure same result ($n)"
 t1=$t2
-sleep 2
+# Less than a second may have passed since the last time ns2 received a
-$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys refresh | sed 's/^/I: ns2 /'
+# ./DNSKEY response from ns1.  Ensure keys are refreshed at a different
-$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys sync | sed 's/^/I: ns2 /'
+# timestamp to prevent false negatives caused by the acceptance timer getting
-$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys status > rndc.out.$n 2>&1
+# reset to the same timestamp.
+sleep 1
+mkeys_refresh_on 2
+mkeys_sync_on 2
+mkeys_status_on 2 > rndc.out.$n 2>&1
 # two keys listed
 count=`grep -c "keyid: " rndc.out.$n` 
 [ "$count" -eq 2 ] || ret=1
@@ -184,15 +258,17 @@ ret=0
 echo "I: restore revoked key, ensure same result ($n)"
 t1=$t2
 $SETTIME -R none -D now -K ns1 `cat ns1/managed.key` > /dev/null
-$RNDC -c ../common/rndc.conf -s 10.53.0.1 -p 9953 loadkeys . | sed 's/^/I: ns1 /'
+mkeys_loadkeys_on 1
-sleep 3
 $SETTIME -D none -K ns1 `cat ns1/managed.key` > /dev/null
-$RNDC -c ../common/rndc.conf -s 10.53.0.1 -p 9953 loadkeys . | sed 's/^/I: ns1 /'
+mkeys_loadkeys_on 1
-sleep 3
+# Less than a second may have passed since the last time ns2 received a
-$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys refresh | sed 's/^/I: ns2 /'
+# ./DNSKEY response from ns1.  Ensure keys are refreshed at a different
+# timestamp to prevent false negatives caused by the acceptance timer getting
+# reset to the same timestamp.
 sleep 1
-$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys sync | sed 's/^/I: ns2 /'
+mkeys_refresh_on 2
-$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys status > rndc.out.$n 2>&1
+mkeys_sync_on 2
+mkeys_status_on 2 > rndc.out.$n 2>&1
 # two keys listed
 count=`grep -c "keyid: " rndc.out.$n` 
 [ "$count" -eq 2 ] || ret=1
@@ -215,17 +291,44 @@ t2=`grep "trust pending" ns2/managed-keys.bind`
 if [ $ret != 0 ]; then echo "I:failed"; fi
 status=`expr $status + $ret`
 
-echo "I: reinitialize trust anchors"
+echo "I: reinitialize trust anchors, add second key to bind.keys"
 $PERL $SYSTEMTESTTOP/stop.pl --use-rndc . ns2
 rm -f ns2/managed-keys.bind*
+cat ns1/$standby1.key | grep -v '^; ' | $PERL -n -e '
+local ($dn, $class, $type, $flags, $proto, $alg, @rest) = split;
+local $key = join("", @rest);
+local $originalkey = `grep initial-key ns2/managed1.conf`;
+print <<EOF
+managed-keys {
+    $originalkey
+    "$dn" initial-key $flags $proto $alg "$key";
+};
+EOF
+' > ns2/managed.conf
+nextpart ns2/named.run > /dev/null
+$PERL $SYSTEMTESTTOP/start.pl --noclean --restart . ns2
+
+n=`expr $n + 1`
+echo "I: check that no key from bind.keys is marked as an initializing key ($n)"
+ret=0
+wait_for_log "Returned from key fetch in keyfetch_done()" ns2/named.run
+mkeys_secroots_on 2
+grep '; initializing' ns2/named.secroots > /dev/null 2>&1 && ret=1
+if [ $ret != 0 ]; then echo "I:failed"; fi
+status=`expr $status + $ret`
+
+echo "I: reinitialize trust anchors, revert to one key in bind.keys"
+$PERL $SYSTEMTESTTOP/stop.pl --use-rndc . ns2
+rm -f ns2/managed-keys.bind*
+mv ns2/managed1.conf ns2/managed.conf
+nextpart ns2/named.run > /dev/null
 $PERL $SYSTEMTESTTOP/start.pl --noclean --restart . ns2
 
 n=`expr $n + 1`
 echo "I: check that standby key is now trusted ($n)"
 ret=0
-sleep 3
+wait_for_log "Returned from key fetch in keyfetch_done()" ns2/named.run
-$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys sync | sed 's/^/I: ns2 /'
+mkeys_status_on 2 > rndc.out.$n 2>&1
-$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys status > rndc.out.$n 2>&1
 # two keys listed
 count=`grep -c "keyid: " rndc.out.$n` 
 [ "$count" -eq 2 ] || ret=1
@@ -243,12 +346,9 @@ echo "I: revoke original key, add new standby ($n)"
 ret=0
 standby2=`$KEYGEN -a rsasha256 -qfk -r $RANDFILE -K ns1 .`
 $SETTIME -R now -K ns1 `cat ns1/managed.key` > /dev/null
-$RNDC -c ../common/rndc.conf -s 10.53.0.1 -p 9953 loadkeys . | sed 's/^/I: ns1 /'
+mkeys_loadkeys_on 1
-sleep 3
+mkeys_refresh_on 2
-$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys refresh | sed 's/^/I: ns2 /'
+mkeys_status_on 2 > rndc.out.$n 2>&1
-sleep 1
-$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys sync | sed 's/^/I: ns2 /'
-$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys status > rndc.out.$n 2>&1
 # three keys listed
 count=`grep -c "keyid: " rndc.out.$n` 
 [ "$count" -eq 3 ] || ret=1
@@ -277,11 +377,9 @@ n=`expr $n + 1`
 echo "I: revoke standby before it is trusted ($n)"
 ret=0
 standby3=`$KEYGEN -a rsasha256 -qfk -r $RANDFILE -K ns1 .`
-$RNDC -c ../common/rndc.conf -s 10.53.0.1 -p 9953 loadkeys . | sed 's/^/I: ns1 /'
+mkeys_loadkeys_on 1
-sleep 3
+mkeys_refresh_on 2
-$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys refresh | sed 's/^/I: ns2 /'
+mkeys_status_on 2 > rndc.out.a.$n 2>&1
-sleep 1
-$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys status > rndc.out.a.$n 2>&1
 # four keys listed
 count=`grep -c "keyid: " rndc.out.a.$n` 
 [ "$count" -eq 4 ] || { echo "keyid: count ($count) != 4"; ret=1; }
@@ -292,11 +390,9 @@ count=`grep -c "trust revoked" rndc.out.a.$n`
 count=`grep -c "trust pending" rndc.out.a.$n` 
 [ "$count" -eq 2 ] || { echo "trust pending count ($count) != 2"; ret=1; }
 $SETTIME -R now -K ns1 $standby3 > /dev/null
-$RNDC -c ../common/rndc.conf -s 10.53.0.1 -p 9953 loadkeys . | sed 's/^/I: ns1 /'
+mkeys_loadkeys_on 1
-sleep 3
+mkeys_refresh_on 2
-$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys refresh | sed 's/^/I: ns2 /'
+mkeys_status_on 2 > rndc.out.b.$n 2>&1
-sleep 1
-$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys status > rndc.out.b.$n 2>&1
 # now three keys listed
 count=`grep -c "keyid: " rndc.out.b.$n` 
 [ "$count" -eq 3 ] || { echo "keyid: count ($count) != 3"; ret=1; }
@@ -307,18 +403,16 @@ count=`grep -c "trust revoked" rndc.out.b.$n`
 count=`grep -c "trust pending" rndc.out.b.$n` 
 [ "$count" -eq 1 ] || { echo "trust pending count ($count) != 1"; ret=1; }
 $SETTIME -D now -K ns1 $standby3 > /dev/null
-$RNDC -c ../common/rndc.conf -s 10.53.0.1 -p 9953 loadkeys . | sed 's/^/I: ns1 /'
+mkeys_loadkeys_on 1
 if [ $ret != 0 ]; then echo "I:failed"; fi
 status=`expr $status + $ret`
 
 n=`expr $n + 1`
-echo "I: wait 30 seconds for key add/remove holddowns to expire ($n)"
+echo "I: wait 20 seconds for key add/remove holddowns to expire ($n)"
 ret=0
-sleep 30
+sleep 20
-$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys refresh | sed 's/^/I: ns2 /'
+mkeys_refresh_on 2
-sleep 1
+mkeys_status_on 2 > rndc.out.$n 2>&1
-$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys sync | sed 's/^/I: ns2 /'
-$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys status > rndc.out.$n 2>&1
 # two keys listed
 count=`grep -c "keyid: " rndc.out.$n` 
 [ "$count" -eq 2 ] || ret=1
@@ -340,12 +434,9 @@ ret=0
 $SETTIME -D now -K ns1 `cat ns1/managed.key` > /dev/null
 $SETTIME -R now -K ns1 $standby1 > /dev/null
 $SETTIME -R now -K ns1 $standby2 > /dev/null
-$RNDC -c ../common/rndc.conf -s 10.53.0.1 -p 9953 loadkeys . | sed 's/^/I: ns1 /'
+mkeys_loadkeys_on 1
-sleep 3
+mkeys_refresh_on 2
-$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys refresh | sed 's/^/I: ns2 /'
+mkeys_status_on 2 > rndc.out.$n 2>&1
-sleep 1
-$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys sync | sed 's/^/I: ns2 /'
-$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys status > rndc.out.$n 2>&1
 # two keys listed
 count=`grep -c "keyid: " rndc.out.$n` 
 [ "$count" -eq 2 ] || ret=1
@@ -367,8 +458,10 @@ status=`expr $status + $ret`
 n=`expr $n + 1`
 echo "I: check for insecure response ($n)"
 ret=0
+mkeys_refresh_on 2
 $DIG $DIGOPTS +noauth example. @10.53.0.2 txt > dig.out.ns2.test$n || ret=1
 grep "status: NOERROR" dig.out.ns2.test$n > /dev/null || ret=1
+grep "flags:.*ad.*QUERY" dig.out.ns2.test$n > /dev/null && ret=1
 grep "example..*.RRSIG..*TXT" dig.out.ns2.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo "I:failed"; fi
 status=`expr $status + $ret`
@@ -380,16 +473,18 @@ $SETTIME -D now -K ns1 $standby2 > /dev/null
 $SIGNER -Sg -K ns1 -N unixtime -r $RANDFILE -o . ns1/root.db > /dev/null 2>&-
 cp ns1/named2.conf ns1/named.conf
 rm -f ns1/root.db.signed.jnl
-$RNDC -c ../common/rndc.conf -s 10.53.0.1 -p 9953 reconfig
+mkeys_reconfig_on 1
 
 echo "I: reinitialize trust anchors"
 $PERL $SYSTEMTESTTOP/stop.pl --use-rndc . ns2
 rm -f ns2/managed-keys.bind*
+nextpart ns2/named.run > /dev/null
 $PERL $SYSTEMTESTTOP/start.pl --noclean --restart . ns2
 
 n=`expr $n + 1`
 echo "I: check positive validation ($n)"
 ret=0
+wait_for_log "Returned from key fetch in keyfetch_done()" ns2/named.run
 $DIG $DIGOPTS +noauth example. @10.53.0.2 txt > dig.out.ns2.test$n || ret=1
 grep "flags:.*ad.*QUERY" dig.out.ns2.test$n > /dev/null || ret=1
 grep "example..*.RRSIG..*TXT" dig.out.ns2.test$n > /dev/null || ret=1
@@ -403,17 +498,25 @@ orig=`cat ns1/managed.key`
 keyid=`cat ns1/managed.key.id`
 revoked=`$REVOKE -K ns1 $orig`
 rkeyid=`expr $revoked : 'ns1/K\.+00.+0*\([1-9]*[0-9]*[0-9]\)'`
+rm -f ns1/root.db.signed.jnl
+# We need to activate at least one valid DNSKEY to prevent dnssec-signzone from
+# failing.  Alternatively, we could use -P to disable post-sign verification,
+# but we actually do want post-sign verification to happen to ensure the zone
+# is correct before we break it on purpose.
 $SETTIME -R none -D none -K ns1 $standby1 > /dev/null
 $SIGNER -Sg -K ns1 -N unixtime -r $RANDFILE -O full -o . -f signer.out.$n ns1/root.db > /dev/null 2>&-
 cp -f ns1/root.db.signed ns1/root.db.tmp
 BADSIG="SVn2tLDzpNX2rxR4xRceiCsiTqcWNKh7NQ0EQfCrVzp9WEmLw60sQ5kP xGk4FS/xSKfh89hO2O/H20Bzp0lMdtr2tKy8IMdU/mBZxQf2PXhUWRkg V2buVBKugTiOPTJSnaqYCN3rSfV1o7NtC1VNHKKK/D5g6bpDehdn5Gaq kpBhN+MSCCh9OZP2IT20luS1ARXxLlvuSVXJ3JYuuhTsQXUbX/SQpNoB Lo6ahCE55szJnmAxZEbb2KOVnSlZRA6ZBHDhdtO0S4OkvcmTutvcVV+7 w53CbKdaXhirvHIh0mZXmYk2PbPLDY7PU9wSH40UiWPOB9f00wwn6hUe uEQ1Qg=="
-sed -e "/ $rkeyid \./s, \. .*$, . $BADSIG," signer.out.$n > ns1/root.db.signed
+# Less than a second may have passed since ns1 was started.  If we call
-$RNDC -c ../common/rndc.conf -s 10.53.0.1 -p 9953 reload . | sed 's/^/I: ns1 /'
+# dnssec-signzone immediately, ns1/root.db.signed will not be reloaded by the
-sleep 3
+# subsequent "rndc reload ." call on platforms which do not set the
-$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys refresh | sed 's/^/I: ns2 /'
+# "nanoseconds" field of isc_time_t, due to zone load time being seemingly
+# equal to master file modification time.
 sleep 1
-$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys sync | sed 's/^/I: ns2 /'
+sed -e "/ $rkeyid \./s, \. .*$, . $BADSIG," signer.out.$n > ns1/root.db.signed
-$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys status > rndc.out.$n 2>&1
+mkeys_reload_on 1
+mkeys_refresh_on 2
+mkeys_status_on 2 > rndc.out.$n 2>&1
 # one key listed
 count=`grep -c "keyid: " rndc.out.$n` 
 [ "$count" -eq 1 ] || { echo "'keyid:' count ($count) != 1"; ret=1; }
@@ -434,6 +537,7 @@ status=`expr $status + $ret`
 n=`expr $n + 1`
 echo "I: check validation fails with bad DNSKEY rrset ($n)"
 ret=0
+mkeys_flush_on 2
 $DIG $DIGOPTS +noauth example. @10.53.0.2 txt > dig.out.ns2.test$n || ret=1
 grep "status: SERVFAIL" dig.out.ns2.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo "I:failed"; fi
@@ -443,17 +547,18 @@ n=`expr $n + 1`
 echo "I: restore DNSKEY rrset, check validation succeeds again ($n)"
 ret=0
 rm -f ${revoked}.key ${revoked}.private
+rm -f ns1/root.db.signed.jnl
 $SETTIME -D none -R none -K ns1 `cat ns1/managed.key` > /dev/null
 $SETTIME -D now -K ns1 $standby1 > /dev/null
-$SETTIME -D now -K ns1 $standby2 > /dev/null
+# Less than a second may have passed since ns1 was started.  If we call
-$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 flush | sed 's/^/I: ns1 /'
+# dnssec-signzone immediately, ns1/root.db.signed will not be reloaded by the
+# subsequent "rndc reload ." call on platforms which do not set the
+# "nanoseconds" field of isc_time_t, due to zone load time being seemingly
+# equal to master file modification time.
 sleep 1
 $SIGNER -Sg -K ns1 -N unixtime -r $RANDFILE -o . ns1/root.db > /dev/null 2>&-
-$RNDC -c ../common/rndc.conf -s 10.53.0.1 -p 9953 reload . | sed 's/^/I: ns1 /'
+mkeys_reload_on 1
-sleep 3
+mkeys_flush_on 2
-$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys refresh | sed 's/^/I: ns2 /'
-sleep 1
-$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys status > rndc.out.$n 2>&1
 $DIG $DIGOPTS +noauth example. @10.53.0.2 txt > dig.out.ns2.test$n || ret=1
 grep "flags:.*ad.*QUERY" dig.out.ns2.test$n > /dev/null || ret=1
 grep "example..*.RRSIG..*TXT" dig.out.ns2.test$n > /dev/null || ret=1
@@ -462,15 +567,24 @@ status=`expr $status + $ret`
 
 n=`expr $n + 1`
 echo "I: reset the root server with no keys, check for minimal update ($n)"
-$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys status > rndc.out.$n 2>&1
+ret=0
+# Refresh keys first to prevent previous checks from influencing this one.
+# Note that we might still get occasional false negatives on some really slow
+# machines, when $t1 equals $t2 due to the time elapsed between "rndc
+# managed-keys status" calls being equal to the normal active refresh period
+# (as calculated per rules listed in RFC 5011 section 2.3) minus an "hour" (as
+# set using -T mkeytimers).
+mkeys_refresh_on 2
+mkeys_status_on 2 > rndc.out.$n 2>&1
 t1=`grep 'next refresh:' rndc.out.$n`
 $PERL $SYSTEMTESTTOP/stop.pl --use-rndc . ns1
+rm -f ns1/root.db.signed.jnl
 cp ns1/root.db ns1/root.db.signed
+nextpart ns1/named.run > /dev/null
 $PERL $SYSTEMTESTTOP/start.pl --noclean --restart . ns1
-sleep 3
+wait_for_log "loaded serial" ns1/named.run
-$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys refresh | sed 's/^/I: ns2 /'
+mkeys_refresh_on 2
-sleep 1
+mkeys_status_on 2 > rndc.out.$n 2>&1
-$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys status > rndc.out.$n 2>&1
 # one key listed
 count=`grep -c "keyid: " rndc.out.$n` 
 [ "$count" -eq 1 ] || ret=1
@@ -492,14 +606,23 @@ status=`expr $status + $ret`
 
 n=`expr $n + 1`
 echo "I: reset the root server with no signatures, check for minimal update ($n)"
-t2=$t1
+ret=0
+# Refresh keys first to prevent previous checks from influencing this one
+mkeys_refresh_on 2
+mkeys_status_on 2 > rndc.out.$n 2>&1
+t1=`grep 'next refresh:' rndc.out.$n`
 $PERL $SYSTEMTESTTOP/stop.pl --use-rndc . ns1
+rm -f ns1/root.db.signed.jnl
 cat ns1/K*.key >> ns1/root.db.signed
+nextpart ns1/named.run > /dev/null
 $PERL $SYSTEMTESTTOP/start.pl --noclean --restart . ns1
-sleep 3
+wait_for_log "loaded serial" ns1/named.run
-$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys refresh | sed 's/^/I: ns2 /'
+# Less than a second may have passed since the last time ns2 received a
+# ./DNSKEY response from ns1.  Ensure keys are refreshed at a different
+# timestamp to prevent minimal update from resetting it to the same timestamp.
 sleep 1
-$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys status > rndc.out.$n 2>&1
+mkeys_refresh_on 2
+mkeys_status_on 2 > rndc.out.$n 2>&1
 # one key listed
 count=`grep -c "keyid: " rndc.out.$n` 
 [ "$count" -eq 1 ] || ret=1
@@ -521,13 +644,12 @@ status=`expr $status + $ret`
 
 n=`expr $n + 1`
 echo "I: restore root server, check validation succeeds again ($n)"
+ret=0
 rm -f ns1/root.db.signed.jnl
 $SIGNER -Sg -K ns1 -N unixtime -r $RANDFILE -o . ns1/root.db > /dev/null 2>&-
-$RNDC -c ../common/rndc.conf -s 10.53.0.1 -p 9953 reload . | sed 's/^/I: ns1 /'
+mkeys_reload_on 1
-sleep 3
+mkeys_refresh_on 2
-$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys refresh | sed 's/^/I: ns2 /'
+mkeys_status_on 2 > rndc.out.$n 2>&1
-sleep 1
-$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys status > rndc.out.$n 2>&1
 $DIG $DIGOPTS +noauth example. @10.53.0.2 txt > dig.out.ns2.test$n || ret=1
 grep "flags:.*ad.*QUERY" dig.out.ns2.test$n > /dev/null || ret=1
 grep "example..*.RRSIG..*TXT" dig.out.ns2.test$n > /dev/null || ret=1
@@ -537,14 +659,14 @@ status=`expr $status + $ret`
 n=`expr $n + 1`
 echo "I: check that trust-anchor-telemetry queries are logged ($n)"
 ret=0
-grep "sending trust-anchor-telemetry query '_ta-[0-9a-f]*/NULL" ns3/named.run > /dev/null || ret=1
+grep "sending trust-anchor-telemetry query '_ta-[0-9a-f]*/NULL" ns2/named.run > /dev/null || ret=1
 if [ $ret != 0 ]; then echo "I:failed"; fi
 status=`expr $status + $ret`
 
 n=`expr $n + 1`
 echo "I: check that trust-anchor-telemetry queries are received ($n)"
 ret=0
-grep "query '_ta-[0-9a-f]*/NULL/IN' approved" ns1/named.run > /dev/null || ret=1
+grep "query '_ta-[0-9a-f][0-9a-f]*/NULL/IN' approved" ns1/named.run > /dev/null || ret=1
 if [ $ret != 0 ]; then echo "I:failed"; fi
 status=`expr $status + $ret`
 
@@ -552,15 +674,91 @@ n=`expr $n + 1`
 echo "I: check 'rndc-managed-keys destroy' ($n)"
 ret=0
 $RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys destroy | sed 's/^/I: ns2 /'
-sleep 1
+mkeys_status_on 2 > rndc.out.$n 2>&1
-$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys status > rndc.out.$n 2>&1
 grep "no views with managed keys" rndc.out.$n > /dev/null || ret=1
-$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 reconfig | sed 's/^/I: ns2 /'
+mkeys_reconfig_on 2
-sleep 1
+mkeys_status_on 2 > rndc.out.$n 2>&1
-$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys status > rndc.out.$n 2>&1
 grep "name: \." rndc.out.$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo "I:failed"; fi
 status=`expr $status + $ret`
 
+n=`expr $n + 1`
+echo "I: check that trust-anchor-telemetry queries contain the correct key ($n)"
+ret=0
+# convert the hexadecimal key from the TAT query into decimal and
+# compare against the known key.
+tathex=`grep "query '_ta-[0-9a-f][0-9a-f]*/NULL/IN' approved" ns1/named.run | awk '{print $6; exit 0}' | sed -e 's/(_ta-\([0-9a-f][0-9a-f]*\)):/\1/'`
+tatkey=`$PERL -e 'printf("%d\n", hex(@ARGV[0]));' $tathex`
+realkey=`$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 secroots - | sed -n 's#.*SHA256/\([0-9][0-9]*\) ; .*managed.*#\1#p'`
+[ "$tatkey" -eq "$realkey" ] || ret=1
+if [ $ret != 0 ]; then echo "I:failed"; fi
+status=`expr $status + $ret`
+
+n=`expr $n + 1`
+echo "I: check initialization fails if managed-keys can't be created ($n)"
+ret=0
+mkeys_secroots_on 4
+grep '; initializing managed' ns4/named.secroots > /dev/null 2>&1 || ret=1
+grep '; managed' ns4/named.secroots > /dev/null 2>&1 && ret=1
+grep '; trusted' ns4/named.secroots > /dev/null 2>&1 && ret=1
+if [ $ret != 0 ]; then echo "I:failed"; fi
+status=`expr $status + $ret`
+
+n=`expr $n + 1`
+echo "I: check failure to contact root servers does not prevent key refreshes after restart ($n)"
+ret=0
+# By the time we get here, ns5 should have attempted refreshing its managed
+# keys.  These attempts should fail as ns1 is configured to REFUSE all queries
+# from ns5.  Note that named1.args does not contain "-T mkeytimers"; this is to
+# ensure key refresh retry will be scheduled to one actual hour after the first
+# key refresh failure instead of just a few seconds, in order to prevent races
+# between the next scheduled key refresh time and startup time of restarted ns5.
+$PERL $SYSTEMTESTTOP/stop.pl --use-rndc . ns5
+nextpart ns5/named.run > /dev/null
+$PERL $SYSTEMTESTTOP/start.pl --noclean --restart . ns5
+wait_for_log "Returned from key fetch in keyfetch_done()" ns5/named.run
+# ns5/named.run will contain logs from both the old instance and the new
+# instance.  In order for the test to pass, both must attempt a fetch.
+count=`grep -c "Creating key fetch" ns5/named.run`
+[ $count -lt 2 ] && ret=1
+if [ $ret != 0 ]; then echo "I:failed"; fi
+status=`expr $status + $ret`
+
+n=`expr $n + 1`
+echo "I: check key refreshes are resumed after root servers become available ($n)"
+ret=0
+$PERL $SYSTEMTESTTOP/stop.pl --use-rndc . ns5
+# Prevent previous check from affecting this one
+rm -f ns5/managed-keys.bind*
+# named2.args adds "-T mkeytimers=2/20/40" to named1.args as we need to wait for
+# an "hour" until keys are refreshed again after initial failure
+cp ns5/named2.args ns5/named.args
+nextpart ns5/named.run > /dev/null
+$PERL $SYSTEMTESTTOP/start.pl --noclean --restart . ns5
+wait_for_log "Returned from key fetch in keyfetch_done()" ns5/named.run
+mkeys_secroots_on 5
+grep '; initializing managed' ns5/named.secroots > /dev/null 2>&1 || ret=1
+# ns1 should still REFUSE queries from ns5, so resolving should be impossible
+$DIG $DIGOPTS +noauth example. @10.53.0.5 txt > dig.out.ns5.a.test$n || ret=1
+grep "flags:.*ad.*QUERY" dig.out.ns5.a.test$n > /dev/null && ret=1
+grep "example..*.RRSIG..*TXT" dig.out.ns5.a.test$n > /dev/null && ret=1
+grep "status: SERVFAIL" dig.out.ns5.a.test$n > /dev/null || ret=1
+# Allow queries from ns5 to ns1
+cp ns1/named3.conf ns1/named.conf
+rm -f ns1/root.db.signed.jnl
+mkeys_reconfig_on 1
+nextpart ns5/named.run > /dev/null
+wait_for_log "Returned from key fetch in keyfetch_done()" ns5/named.run
+mkeys_secroots_on 5
+grep '; managed' ns5/named.secroots > /dev/null 2>&1 || ret=1
+# ns1 should not longer REFUSE queries from ns5, so managed keys should be
+# correctly refreshed and resolving should succeed
+$DIG $DIGOPTS +noauth example. @10.53.0.5 txt > dig.out.ns5.b.test$n || ret=1
+grep "flags:.*ad.*QUERY" dig.out.ns5.b.test$n > /dev/null || ret=1
+grep "example..*.RRSIG..*TXT" dig.out.ns5.b.test$n > /dev/null || ret=1
+grep "status: NOERROR" dig.out.ns5.b.test$n > /dev/null || ret=1
+if [ $ret != 0 ]; then echo "I:failed"; fi
+status=`expr $status + $ret`
+
 echo "I:exit status: $status"
 [ $status -eq 0 ] || exit 1

bin/tests/system/notify/ns5/named.conf

@@ -53,6 +53,7 @@ view "b" {
 		type slave;
 		masters { 10.53.0.5 key "a"; };
 		file "x21.bk-b";
+		notify no;
 	};
 };
 
@@ -62,5 +63,6 @@ view "c" {
 		type slave;
 		masters { 10.53.0.5 key "a"; };
 		file "x21.bk-c";
+		notify no;
 	};
 };

bin/tests/system/nsupdate/ns2/named.conf

@@ -20,6 +20,7 @@ options {
 	listen-on-v6 { none; };
 	recursion yes;
 	notify yes;
+	serial-query-rate 1; // workaround for KB AA-01213
 };
 
 key altkey {

bin/tests/system/nsupdate/tests.sh

@@ -278,7 +278,7 @@ sleep 10
 if 
 	$PERL $SYSTEMTESTTOP/start.pl --noclean --restart . ns1
 then
-	echo "I:restarted server ns1"	
+	echo "I:restarted server ns1"
 else
 	echo "I:could not restart server ns1"
 	exit 1
@@ -709,8 +709,12 @@ size=`$PERL -e 'use File::stat; my $sb = stat(@ARGV[0]); printf("%s\n", $sb->siz
 [ "$size" -gt 6000 ] || ret=1
 sleep 1
 $RNDC -c ../common/rndc.conf -s 10.53.0.1 -p 9953 sync maxjournal.test
-sleep 1
+for i in 1 2 3 4 5 6
-
+do
+    sleep 1
+    size=`$PERL -e 'use File::stat; my $sb = stat(@ARGV[0]); printf("%s\n", $sb->size);' ns1/maxjournal.db.jnl`
+    [ "$size" -lt 5000 ] && break
+done
 size=`$PERL -e 'use File::stat; my $sb = stat(@ARGV[0]); printf("%s\n", $sb->size);' ns1/maxjournal.db.jnl`
 [ "$size" -lt 5000 ] || ret=1
 [ $ret = 0 ] || { echo I:failed; status=1; }
@@ -885,75 +889,81 @@ grep "address family not supported" nsupdate.out-$n > /dev/null 2>&1 || ret=1
 #
 #  Add client library tests here
 #
-n=`expr $n + 1`
+
-ret=0
+if test unset != "${SAMPLEUPDATE:-unset}" -a -x "${SAMPLEUPDATE}"
-echo "I:check that dns_client_update handles prerequisite NXDOMAIN failure ($n)"
+then
-$SAMPLEUPDATE -P 5300 -a 10.53.0.1 -a 10.53.0.2 -p "nxdomain exists.sample" \
+
+    n=`expr $n + 1`
+    ret=0
+    echo "I:check that dns_client_update handles prerequisite NXDOMAIN failure ($n)"
+    $SAMPLEUPDATE -P 5300 -a 10.53.0.1 -a 10.53.0.2 -p "nxdomain exists.sample" \
 	add "nxdomain-exists.sample 0 in a 1.2.3.4" > update.out.test$n 2>&1
-$SAMPLEUPDATE -P 5300 -a 10.53.0.2 -p "nxdomain exists.sample" \
+    $SAMPLEUPDATE -P 5300 -a 10.53.0.2 -p "nxdomain exists.sample" \
 	add "check-nxdomain-exists.sample 0 in a 1.2.3.4" > update.out.check$n 2>&1
-$DIG +tcp @10.53.0.1 -p 5300 a nxdomain-exists.sample > dig.out.ns1.test$n
+    $DIG +tcp @10.53.0.1 -p 5300 a nxdomain-exists.sample > dig.out.ns1.test$n
-$DIG +tcp @10.53.0.2 -p 5300 a nxdomain-exists.sample > dig.out.ns2.test$n
+    $DIG +tcp @10.53.0.2 -p 5300 a nxdomain-exists.sample > dig.out.ns2.test$n
-$DIG +tcp @10.53.0.2 -p 5300 a check-nxdomain-exists.sample > check.out.ns2.test$n
+    $DIG +tcp @10.53.0.2 -p 5300 a check-nxdomain-exists.sample > check.out.ns2.test$n
-grep "update failed: YXDOMAIN" update.out.test$n > /dev/null || ret=1
+    grep "update failed: YXDOMAIN" update.out.test$n > /dev/null || ret=1
-grep "update succeeded" update.out.check$n > /dev/null || ret=1
+    grep "update succeeded" update.out.check$n > /dev/null || ret=1
-grep "status: NXDOMAIN" dig.out.ns1.test$n > /dev/null || ret=1
+    grep "status: NXDOMAIN" dig.out.ns1.test$n > /dev/null || ret=1
-grep "status: NXDOMAIN" dig.out.ns2.test$n > /dev/null || ret=1
+    grep "status: NXDOMAIN" dig.out.ns2.test$n > /dev/null || ret=1
-grep "status: NOERROR" check.out.ns2.test$n > /dev/null || ret=1
+    grep "status: NOERROR" check.out.ns2.test$n > /dev/null || ret=1
-[ $ret = 0 ] || { echo I:failed; status=1; }
+    [ $ret = 0 ] || { echo I:failed; status=1; }
 
-n=`expr $n + 1`
+    n=`expr $n + 1`
-ret=0
+    ret=0
-echo "I:check that dns_client_update handles prerequisite YXDOMAIN failure ($n)"
+    echo "I:check that dns_client_update handles prerequisite YXDOMAIN failure ($n)"
-$SAMPLEUPDATE -P 5300 -a 10.53.0.1 -a 10.53.0.2 -p "yxdomain nxdomain.sample" \
+    $SAMPLEUPDATE -P 5300 -a 10.53.0.1 -a 10.53.0.2 -p "yxdomain nxdomain.sample" \
 	add "yxdomain-nxdomain.sample 0 in a 1.2.3.4" > update.out.test$n 2>&1
-$SAMPLEUPDATE -P 5300 -a 10.53.0.2 -p "yxdomain nxdomain.sample" \
+    $SAMPLEUPDATE -P 5300 -a 10.53.0.2 -p "yxdomain nxdomain.sample" \
 	add "check-yxdomain-nxdomain.sample 0 in a 1.2.3.4" > update.out.check$n 2>&1
-$DIG +tcp @10.53.0.1 -p 5300 a nxdomain-exists.sample > dig.out.ns1.test$n
+    $DIG +tcp @10.53.0.1 -p 5300 a nxdomain-exists.sample > dig.out.ns1.test$n
-$DIG +tcp @10.53.0.2 -p 5300 a nxdomain-exists.sample > dig.out.ns2.test$n
+    $DIG +tcp @10.53.0.2 -p 5300 a nxdomain-exists.sample > dig.out.ns2.test$n
-$DIG +tcp @10.53.0.2 -p 5300 a check-nxdomain-exists.sample > check.out.ns2.test$n
+    $DIG +tcp @10.53.0.2 -p 5300 a check-nxdomain-exists.sample > check.out.ns2.test$n
-grep "update failed: NXDOMAIN" update.out.test$n > /dev/null || ret=1
+    grep "update failed: NXDOMAIN" update.out.test$n > /dev/null || ret=1
-grep "update succeeded" update.out.check$n > /dev/null || ret=1
+    grep "update succeeded" update.out.check$n > /dev/null || ret=1
-grep "status: NXDOMAIN" dig.out.ns1.test$n > /dev/null || ret=1
+    grep "status: NXDOMAIN" dig.out.ns1.test$n > /dev/null || ret=1
-grep "status: NXDOMAIN" dig.out.ns2.test$n > /dev/null || ret=1
+    grep "status: NXDOMAIN" dig.out.ns2.test$n > /dev/null || ret=1
-grep "status: NOERROR" check.out.ns2.test$n > /dev/null || ret=1
+    grep "status: NOERROR" check.out.ns2.test$n > /dev/null || ret=1
-[ $ret = 0 ] || { echo I:failed; status=1; }
+    [ $ret = 0 ] || { echo I:failed; status=1; }
 
-n=`expr $n + 1`
+    n=`expr $n + 1`
-ret=0
+    ret=0
-echo "I:check that dns_client_update handles prerequisite NXRRSET failure ($n)"
+    echo "I:check that dns_client_update handles prerequisite NXRRSET failure ($n)"
-$SAMPLEUPDATE -P 5300 -a 10.53.0.1 -a 10.53.0.2 -p "nxrrset exists.sample TXT This RRset exists." \
+    $SAMPLEUPDATE -P 5300 -a 10.53.0.1 -a 10.53.0.2 -p "nxrrset exists.sample TXT This RRset exists." \
 	add "nxrrset-exists.sample 0 in a 1.2.3.4" > update.out.test$n 2>&1
-$SAMPLEUPDATE -P 5300 -a 10.53.0.2 -p "nxrrset exists.sample TXT This RRset exists." \
+    $SAMPLEUPDATE -P 5300 -a 10.53.0.2 -p "nxrrset exists.sample TXT This RRset exists." \
 	add "check-nxrrset-exists.sample 0 in a 1.2.3.4" > update.out.check$n 2>&1
-$DIG +tcp @10.53.0.1 -p 5300 a nxrrset-exists.sample > dig.out.ns1.test$n
+    $DIG +tcp @10.53.0.1 -p 5300 a nxrrset-exists.sample > dig.out.ns1.test$n
-$DIG +tcp @10.53.0.2 -p 5300 a nxrrset-exists.sample > dig.out.ns2.test$n
+    $DIG +tcp @10.53.0.2 -p 5300 a nxrrset-exists.sample > dig.out.ns2.test$n
-$DIG +tcp @10.53.0.2 -p 5300 a check-nxrrset-exists.sample > check.out.ns2.test$n
+    $DIG +tcp @10.53.0.2 -p 5300 a check-nxrrset-exists.sample > check.out.ns2.test$n
-grep "update failed: YXRRSET" update.out.test$n > /dev/null || ret=1
+    grep "update failed: YXRRSET" update.out.test$n > /dev/null || ret=1
-grep "update succeeded" update.out.check$n > /dev/null || ret=1
+    grep "update succeeded" update.out.check$n > /dev/null || ret=1
-grep "status: NXDOMAIN" dig.out.ns1.test$n > /dev/null || ret=1
+    grep "status: NXDOMAIN" dig.out.ns1.test$n > /dev/null || ret=1
-grep "status: NXDOMAIN" dig.out.ns2.test$n > /dev/null || ret=1
+    grep "status: NXDOMAIN" dig.out.ns2.test$n > /dev/null || ret=1
-grep "status: NOERROR" check.out.ns2.test$n > /dev/null || ret=1
+    grep "status: NOERROR" check.out.ns2.test$n > /dev/null || ret=1
-[ $ret = 0 ] || { echo I:failed; status=1; }
+    [ $ret = 0 ] || { echo I:failed; status=1; }
 
-n=`expr $n + 1`
+    n=`expr $n + 1`
-ret=0
+    ret=0
-echo "I:check that dns_client_update handles prerequisite YXRRSET failure ($n)"
+    echo "I:check that dns_client_update handles prerequisite YXRRSET failure ($n)"
-$SAMPLEUPDATE -s -P 5300 -a 10.53.0.1 -a 10.53.0.2 \
+    $SAMPLEUPDATE -s -P 5300 -a 10.53.0.1 -a 10.53.0.2 \
 	-p "yxrrset no-txt.sample TXT" \
 	add "yxrrset-nxrrset.sample 0 in a 1.2.3.4" > update.out.test$n 2>&1
-$SAMPLEUPDATE -P 5300 -a 10.53.0.2 -p "yxrrset no-txt.sample TXT" \
+    $SAMPLEUPDATE -P 5300 -a 10.53.0.2 -p "yxrrset no-txt.sample TXT" \
 	add "check-yxrrset-nxrrset.sample 0 in a 1.2.3.4" > update.out.check$n 2>&1
-$DIG +tcp @10.53.0.1 -p 5300 a yxrrset-nxrrset.sample > dig.out.ns1.test$n
+    $DIG +tcp @10.53.0.1 -p 5300 a yxrrset-nxrrset.sample > dig.out.ns1.test$n
-$DIG +tcp @10.53.0.2 -p 5300 a yxrrset-nxrrset.sample > dig.out.ns2.test$n
+    $DIG +tcp @10.53.0.2 -p 5300 a yxrrset-nxrrset.sample > dig.out.ns2.test$n
-$DIG +tcp @10.53.0.2 -p 5300 a check-yxrrset-nxrrset.sample > check.out.ns2.test$n
+    $DIG +tcp @10.53.0.2 -p 5300 a check-yxrrset-nxrrset.sample > check.out.ns2.test$n
-grep "update failed: NXRRSET" update.out.test$n > /dev/null || ret=1
+    grep "update failed: NXRRSET" update.out.test$n > /dev/null || ret=1
-grep "update succeeded" update.out.check$n > /dev/null || ret=1
+    grep "update succeeded" update.out.check$n > /dev/null || ret=1
-grep "status: NXDOMAIN" dig.out.ns1.test$n > /dev/null || ret=1
+    grep "status: NXDOMAIN" dig.out.ns1.test$n > /dev/null || ret=1
-grep "status: NXDOMAIN" dig.out.ns2.test$n > /dev/null || ret=1
+    grep "status: NXDOMAIN" dig.out.ns2.test$n > /dev/null || ret=1
-grep "status: NOERROR" check.out.ns2.test$n > /dev/null || ret=1
+    grep "status: NOERROR" check.out.ns2.test$n > /dev/null || ret=1
-grep "2nd update failed: NXRRSET" update.out.test$n > /dev/null || ret=1
+    grep "2nd update failed: NXRRSET" update.out.test$n > /dev/null || ret=1
-[ $ret = 0 ] || { echo I:failed; status=1; }
+    [ $ret = 0 ] || { echo I:failed; status=1; }
+
+fi
 
 #
 # End client library tests here

bin/tests/system/reclimit/README

@@ -1,4 +1,4 @@
-Copyright (C) 2014, 2016  Internet Systems Consortium, Inc. ("ISC")
+Copyright (C) 2014, 2016, 2017  Internet Systems Consortium, Inc. ("ISC")
 
 This Source Code Form is subject to the terms of the Mozilla Public
 License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -7,8 +7,9 @@ file, You can obtain one at http://mozilla.org/MPL/2.0/.
 system test for recursion limits
 
 ns1  -- root server
-ans2 -- delegate to ns1.(n+1).example.com for all n, up to
+ans2 -- for example.org: delegate to ns1.(n+1).example.org for all n, up to the
-        the value specified in ans.limit (or forever if limit is 0)
+                         value specified in ans.limit (or forever if limit is 0)
+        for example.net: delegate every query to 15 more name servers, with
+                         "victim" address
 ns3  -- resolver under test
-ans4 -- delegates every query to 16 more name servers, with "victim" address
 ans7 -- "victim" server

bin/tests/system/reclimit/ans2/ans.pl

@@ -1,6 +1,6 @@
 #!/usr/bin/env perl
 #
-# Copyright (C) 2014-2016  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2014-2017  Internet Systems Consortium, Inc. ("ISC")
 #
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -10,9 +10,17 @@ use strict;
 use warnings;
 
 use IO::File;
-use Getopt::Long;
+use IO::Socket;
-use Net::DNS::Nameserver;
+use Net::DNS;
-use Time::HiRes qw(usleep nanosleep);
+
+my $localaddr = "10.53.0.2";
+my $limit = getlimit();
+my $no_more_waiting = 0;
+my @delayed_response;
+my $timeout;
+
+my $udpsock = IO::Socket::INET->new(LocalAddr => "$localaddr",
+   LocalPort => 5300, Proto => "udp", Reuse => 1) or die "$!";
 
 my $pidf = new IO::File "ans.pid", "w" or die "cannot open pid file: $!";
 print $pidf "$$\n" or die "cannot write pid file: $!";
@@ -39,21 +47,18 @@ sub getlimit {
     return 0;
 }
 
-my $localaddr = "10.53.0.2";
+# If $wait == 0 is returned, returned reply will be sent immediately.
-my $localport = 5300;
+# If $wait == 1 is returned, sending the returned reply might be delayed; see
-my $verbose = 0;
+# comments inside handle_UDP() for details.
-my $limit = getlimit();
-
 sub reply_handler {
-    my ($qname, $qclass, $qtype, $peerhost, $query, $conn) = @_;
+    my ($qname, $qclass, $qtype) = @_;
-    my ($rcode, @ans, @auth, @add);
+    my ($rcode, @ans, @auth, @add, $wait);
 
     print ("request: $qname/$qtype\n");
     STDOUT->flush();
 
+    $wait = 0;
     $count += 1;
-    # Sleep 100ms to make sure that named sends both A and AAAA queries.
-    usleep(100000);
 
     if ($qname eq "count" ) {
 	if ($qtype eq "TXT") {
@@ -95,6 +100,7 @@ sub reply_handler {
 	$rcode = "NOERROR";
     } elsif ($qname =~ /^ns1\.(\d+)\.example\.org$/) {
 	my $next = $1 + 1;
+	$wait = 1;
 	if ($limit == 0 || (! $send_response && $next <= $limit)) {
 	    my $rr = new Net::DNS::RR("$1.example.org 86400 $qclass NS ns1.$next.example.org");
 	    push @auth, $rr;
@@ -108,24 +114,114 @@ sub reply_handler {
 	    }
 	}
 	$rcode = "NOERROR";
+    } elsif ($qname eq "direct.example.net" ) {
+        if ($qtype eq "A") {
+            my ($ttl, $rdata) = (3600, $localaddr);
+            my $rr = new Net::DNS::RR("$qname $ttl $qclass $qtype $rdata");
+            push @ans, $rr;
+        }
+        $rcode = "NOERROR";
+    } elsif( $qname =~ /^ns1\.(\d+)\.example\.net$/ ) {
+        my $next = ($1 + 1) * 16;
+        for (my $i = 1; $i < 16; $i++) {
+            my $s = $next + $i;
+            my $rr = new Net::DNS::RR("$1.example.net 86400 $qclass NS ns1.$s.example.net");
+            push @auth, $rr;
+            $rr = new Net::DNS::RR("ns1.$s.example.net 86400 $qclass A 10.53.0.7");
+            push @add, $rr;
+        }
+        $rcode = "NOERROR";
     } else {
 	$rcode = "NXDOMAIN";
     }
 
-    # mark the answer as authoritive (by setting the 'aa' flag
+    return ($rcode, \@ans, \@auth, \@add, $wait);
-    return ($rcode, \@ans, \@auth, \@add, { aa => 1 });
 }
 
-GetOptions(
+sub handleUDP {
-    'port=i' => \$localport,
+	my ($buf, $peer) = @_;
-    'verbose!' => \$verbose,
+	my ($request, $rcode, $ans, $auth, $add, $wait);
-);
 
-my $ns = Net::DNS::Nameserver->new(
+	$request = new Net::DNS::Packet(\$buf, 0);
-    LocalAddr => $localaddr,
+	$@ and die $@;
-    LocalPort => $localport,
-    ReplyHandler => \&reply_handler,
-    Verbose => $verbose,
-);
 
-$ns->main_loop;
+	my ($question) = $request->question;
+	my $qname = $question->qname;
+	my $qclass = $question->qclass;
+	my $qtype = $question->qtype;
+
+	($rcode, $ans, $auth, $add, $wait) = reply_handler($qname, $qclass, $qtype);
+
+	my $reply = $request->reply();
+
+	$reply->header->rcode($rcode);
+	$reply->header->aa(@$ans ? 1 : 0);
+	$reply->header->id($request->header->id);
+	$reply->{answer} = $ans if $ans;
+	$reply->{authority} = $auth if $auth;
+	$reply->{additional} = $add if $add;
+
+	if ($wait) {
+		# reply_handler() asked us to delay sending this reply until
+		# another reply with $wait == 1 is generated or a timeout
+		# occurs.
+		if (@delayed_response) {
+			# A delayed reply is already queued, so we can now send
+			# both the delayed reply and the current reply.
+			send_delayed_response();
+			return $reply;
+		} elsif ($no_more_waiting) {
+			# It was determined before that there is no point in
+			# waiting for "accompanying" queries.  Thus, send the
+			# current reply immediately.
+			return $reply;
+		} else {
+			# No delayed reply is queued and the client is expected
+			# to send an "accompanying" query shortly.  Do not send
+			# the current reply right now, just save it for later
+			# and wait for an "accompanying" query to be received.
+			@delayed_response = ($reply, $peer);
+			$timeout = 0.5;
+			return;
+		}
+	} else {
+		# Send reply immediately.
+		return $reply;
+	}
+}
+
+sub send_delayed_response {
+	my ($reply, $peer) = @delayed_response;
+	# Truncation to 512 bytes is required for triggering "NS explosion" on
+	# builds without IPv6 support
+	$udpsock->send($reply->data(512), 0, $peer);
+	undef @delayed_response;
+	undef $timeout;
+}
+
+# Main
+my $rin;
+my $rout;
+for (;;) {
+	$rin = '';
+	vec($rin, fileno($udpsock), 1) = 1;
+
+	select($rout = $rin, undef, undef, $timeout);
+
+	if (vec($rout, fileno($udpsock), 1)) {
+		my ($buf, $peer, $reply);
+		$udpsock->recv($buf, 512);
+		$peer = $udpsock->peername();
+		$reply = handleUDP($buf, $peer);
+		# Truncation to 512 bytes is required for triggering "NS
+		# explosion" on builds without IPv6 support
+		$udpsock->send($reply->data(512), 0, $peer) if $reply;
+	} else {
+		# An "accompanying" query was expected to come in, but did not.
+		# Assume the client never sends "accompanying" queries to
+		# prevent pointlessly waiting for them ever again.
+		$no_more_waiting = 1;
+		# Send the delayed reply to the query which caused us to wait.
+		send_delayed_response();
+	}
+}

bin/tests/system/reclimit/ans4/ans.pl

@@ -1,89 +0,0 @@
-#!/usr/bin/env perl
-#
-# Copyright (C) 2014, 2016  Internet Systems Consortium, Inc. ("ISC")
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, You can obtain one at http://mozilla.org/MPL/2.0/.
-
-use strict;
-use warnings;
-
-use IO::File;
-use Getopt::Long;
-use Net::DNS::Nameserver;
-
-my $pidf = new IO::File "ans.pid", "w" or die "cannot open pid file: $!";
-print $pidf "$$\n" or die "cannot write pid file: $!";
-$pidf->close or die "cannot close pid file: $!";
-sub rmpid { unlink "ans.pid"; exit 1; };
-
-$SIG{INT} = \&rmpid;
-$SIG{TERM} = \&rmpid;
-
-my $count = 0;
-my $send_response = 0;
-
-my $localaddr = "10.53.0.4";
-my $localport = 5300;
-my $verbose = 0;
-
-sub reply_handler {
-    my ($qname, $qclass, $qtype, $peerhost, $query, $conn) = @_;
-    my ($rcode, @ans, @auth, @add);
-
-    print ("request: $qname/$qtype\n");
-    STDOUT->flush();
-
-    $count += 1;
-
-    if ($qname eq "count" ) {
-        if ($qtype eq "TXT") {
-            my ($ttl, $rdata) = (0, "$count");
-            my $rr = new Net::DNS::RR("$qname $ttl $qclass $qtype $rdata");
-            push @ans, $rr;
-            print ("\tcount: $count\n");
-        }
-        $rcode = "NOERROR";
-    } elsif ($qname eq "reset" ) {
-        $count = 0;
-        $send_response = 0;
-        $rcode = "NOERROR";
-    } elsif ($qname eq "direct.example.net" ) {
-        if ($qtype eq "A") {
-            my ($ttl, $rdata) = (3600, $localaddr);
-            my $rr = new Net::DNS::RR("$qname $ttl $qclass $qtype $rdata");
-            push @ans, $rr;
-        }
-        $rcode = "NOERROR";
-    } elsif( $qname =~ /^ns1\.(\d+)\.example\.net$/ ) {
-        my $next = ($1 + 1) * 16;
-        for (my $i = 1; $i < 16; $i++) {
-            my $s = $next + $i;
-            my $rr = new Net::DNS::RR("$1.example.net 86400 $qclass NS ns1.$s.example.net");
-            push @auth, $rr;
-            $rr = new Net::DNS::RR("ns1.$s.example.net 86400 $qclass A 10.53.0.7");
-            push @add, $rr;
-        }
-        $rcode = "NOERROR";
-    } else {
-        $rcode = "NXDOMAIN";
-    }
-
-    # mark the answer as authoritive (by setting the 'aa' flag
-    return ($rcode, \@ans, \@auth, \@add, { aa => 1 });
-}
-
-GetOptions(
-    'port=i' => \$localport,
-    'verbose!' => \$verbose,
-);
-
-my $ns = Net::DNS::Nameserver->new(
-    LocalAddr => $localaddr,
-    LocalPort => $localport,
-    ReplyHandler => \&reply_handler,
-    Verbose => $verbose,
-);
-
-$ns->main_loop;

bin/tests/system/reclimit/ns1/root.db

@@ -1,4 +1,4 @@
-; Copyright (C) 2014, 2016  Internet Systems Consortium, Inc. ("ISC")
+; Copyright (C) 2014, 2016, 2017  Internet Systems Consortium, Inc. ("ISC")
 ;
 ; This Source Code Form is subject to the terms of the Mozilla Public
 ; License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -11,4 +11,4 @@ ns.tld1. 60 IN A 10.53.0.1
 example.org. 60 IN NS direct.example.org.
 direct.example.org. 60 IN A 10.53.0.2
 example.net. 60 IN NS direct.example.net.
-direct.example.net. 60 IN A 10.53.0.4
+direct.example.net. 60 IN A 10.53.0.2

bin/tests/system/reclimit/prereq.sh

@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# Copyright (C) 2015, 2016  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2015-2017  Internet Systems Consortium, Inc. ("ISC")
 #
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -9,6 +9,20 @@
 SYSTEMTESTTOP=..
 . $SYSTEMTESTTOP/conf.sh
 
+if $PERL -e 'use Net::DNS;' 2>/dev/null
+then
+    if $PERL -e 'use Net::DNS; die if ($Net::DNS::VERSION <= 0.78);' 2>/dev/null
+    then
+        :
+    else
+        echo "I:Net::DNS versions up to 0.78 have a bug that causes this test to fail: please update." >&2
+        exit 1
+    fi
+else
+    echo "I:This test requires the Net::DNS library." >&2
+    exit 1
+fi
+
 if $PERL -e 'use Net::DNS::Nameserver;' 2>/dev/null
 then
     :

bin/tests/system/reclimit/tests.sh

@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# Copyright (C) 2014-2016  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2014-2017  Internet Systems Consortium, Inc. ("ISC")
 #
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -14,101 +14,107 @@ DIGOPTS="-p 5300"
 status=0
 n=0
 
+ns3_reset() {
+	cp $1 ns3/named.conf
+	$RNDC -c ../common/rndc.conf -s 10.53.0.3 -p 9953 reconfig 2>&1 | sed 's/^/I:ns3 /'
+	$RNDC -c ../common/rndc.conf -s 10.53.0.3 -p 9953 flush | sed 's/^/I: ns3 /'
+}
+
+ns3_sends_aaaa_queries() {
+	if grep "started AAAA fetch" ns3/named.run >/dev/null; then
+		return 0
+	else
+		return 1
+	fi
+}
+
+# Check whether the number of queries ans2 received from ns3 (this value is
+# read from dig output stored in file $1) is as expected.  The expected query
+# count is variable:
+#   - if ns3 sends AAAA queries, the query count should equal $2,
+#   - if ns3 does not send AAAA queries, the query count should equal $3.
+check_query_count() {
+	count=`sed 's/[^0-9]//g;' $1`
+	expected_count_with_aaaa=$2
+	expected_count_without_aaaa=$3
+
+	if ns3_sends_aaaa_queries; then
+		expected_count=$expected_count_with_aaaa
+	else
+		expected_count=$expected_count_without_aaaa
+	fi
+
+	if [ $count -ne $expected_count ]; then
+		echo "I: count ($count) != $expected_count"
+		ret=1
+	fi
+}
+
+echo "I: set max-recursion-depth=12"
+
 n=`expr $n + 1`
-echo "I: attempt excessive-depth lookup ($n)"
+echo "I:  attempt excessive-depth lookup ($n)"
 ret=0
 echo "1000" > ans2/ans.limit
 $DIG $DIGOPTS @10.53.0.2 reset > /dev/null || ret=1
 $DIG $DIGOPTS @10.53.0.3 indirect1.example.org > dig.out.1.test$n || ret=1
 grep "status: SERVFAIL" dig.out.1.test$n > /dev/null || ret=1
 $DIG $DIGOPTS +short @10.53.0.2 count txt > dig.out.2.test$n || ret=1
-eval count=`cat dig.out.2.test$n`
+check_query_count dig.out.2.test$n 26 14
-if [ "$TESTSOCK6" != "false" ]
-then
-  [ $count -eq 26 ] || { ret=1; echo "I: count ($count) != 26"; }
-else
-  [ $count -eq 14 ] || { ret=1; echo "I: count ($count) != 14"; }
-fi
 if [ $ret != 0 ]; then echo "I:failed"; fi
 status=`expr $status + $ret`
 
 n=`expr $n + 1`
-echo "I: attempt permissible lookup ($n)"
+echo "I:  attempt permissible lookup ($n)"
 ret=0
-sleep 2
 echo "12" > ans2/ans.limit
-$RNDC -c ../common/rndc.conf -s 10.53.0.3 -p 9953 flush 2>&1 | sed 's/^/I:ns1 /'
+ns3_reset ns3/named1.conf
 $DIG $DIGOPTS @10.53.0.2 reset > /dev/null || ret=1
 $DIG $DIGOPTS @10.53.0.3 indirect2.example.org > dig.out.1.test$n || ret=1
 grep "status: NOERROR" dig.out.1.test$n > /dev/null || ret=1
 $DIG $DIGOPTS +short @10.53.0.2 count txt > dig.out.2.test$n || ret=1
-eval count=`cat dig.out.2.test$n`
+check_query_count dig.out.2.test$n 49 26
-if [ "$TESTSOCK6" != "false" ]
-then
-  [ $count -eq 49 ] || { ret=1; echo "I: count ($count) != 49"; }
-else
-  [ $count -eq 26 ] || { ret=1; echo "I: count ($count) != 26"; }
-fi
 if [ $ret != 0 ]; then echo "I:failed"; fi
 status=`expr $status + $ret`
 
-echo "I:reset max-recursion-depth"
+echo "I: set max-recursion-depth=5"
-cp ns3/named2.conf ns3/named.conf
-$RNDC -c ../common/rndc.conf -s 10.53.0.3 -p 9953 reconfig 2>&1 | sed 's/^/I:ns1 /'
-sleep 2
 
 n=`expr $n + 1`
-echo "I: attempt excessive-depth lookup ($n)"
+echo "I:  attempt excessive-depth lookup ($n)"
 ret=0
 echo "12" > ans2/ans.limit
-$RNDC -c ../common/rndc.conf -s 10.53.0.3 -p 9953 flush 2>&1 | sed 's/^/I:ns1 /'
+ns3_reset ns3/named2.conf
 $DIG $DIGOPTS @10.53.0.2 reset > /dev/null || ret=1
 $DIG $DIGOPTS @10.53.0.3 indirect3.example.org > dig.out.1.test$n || ret=1
 grep "status: SERVFAIL" dig.out.1.test$n > /dev/null || ret=1
 $DIG $DIGOPTS +short @10.53.0.2 count txt > dig.out.2.test$n || ret=1
-eval count=`cat dig.out.2.test$n`
+check_query_count dig.out.2.test$n 12 7
-if [ "$TESTSOCK6" != "false" ]
-then
-  [ $count -eq 12 ] || { ret=1; echo "I: count ($count) != 12"; }
-else
-  [ $count -eq 7 ] || { ret=1; echo "I: count ($count) != 7"; }
-fi
 if [ $ret != 0 ]; then echo "I:failed"; fi
 status=`expr $status + $ret`
 
 n=`expr $n + 1`
-echo "I: attempt permissible lookup ($n)"
+echo "I:  attempt permissible lookup ($n)"
 ret=0
 echo "5" > ans2/ans.limit
-$RNDC -c ../common/rndc.conf -s 10.53.0.3 -p 9953 flush 2>&1 | sed 's/^/I:ns1 /'
+ns3_reset ns3/named2.conf
 $DIG $DIGOPTS @10.53.0.2 reset > /dev/null || ret=1
 $DIG $DIGOPTS @10.53.0.3 indirect4.example.org > dig.out.1.test$n || ret=1
 grep "status: NOERROR" dig.out.1.test$n > /dev/null || ret=1
 $DIG $DIGOPTS +short @10.53.0.2 count txt > dig.out.2.test$n || ret=1
-eval count=`cat dig.out.2.test$n`
+check_query_count dig.out.2.test$n 21 12
-if [ "$TESTSOCK6" != "false" ]
-then
-  [ $count -eq 21 ] || { ret=1; echo "I: count ($count) != 21"; }
-else
-  [ $count -eq 12 ] || { ret=1; echo "I: count ($count) != 12"; }
-fi
 if [ $ret != 0 ]; then echo "I:failed"; fi
 status=`expr $status + $ret`
 
-echo "I:reset max-recursion-depth"
+echo "I: set max-recursion-depth=100, max-recursion-queries=50"
-cp ns3/named3.conf ns3/named.conf
-$RNDC -c ../common/rndc.conf -s 10.53.0.3 -p 9953 reconfig 2>&1 | sed 's/^/I:ns1 /'
-sleep 2
 
 n=`expr $n + 1`
-echo "I: attempt excessive-queries lookup ($n)"
+echo "I:  attempt excessive-queries lookup ($n)"
 ret=0
 echo "13" > ans2/ans.limit
-$RNDC -c ../common/rndc.conf -s 10.53.0.3 -p 9953 flush 2>&1 | sed 's/^/I:ns1 /'
+ns3_reset ns3/named3.conf
 $DIG $DIGOPTS @10.53.0.2 reset > /dev/null || ret=1
 $DIG $DIGOPTS @10.53.0.3 indirect5.example.org > dig.out.1.test$n || ret=1
-if [ "$TESTSOCK6" != "false" ]
+if ns3_sends_aaaa_queries; then
-then
   grep "status: SERVFAIL" dig.out.1.test$n > /dev/null || ret=1
 fi
 $DIG $DIGOPTS +short @10.53.0.2 count txt > dig.out.2.test$n || ret=1
@@ -118,10 +124,10 @@ if [ $ret != 0 ]; then echo "I:failed"; fi
 status=`expr $status + $ret`
 
 n=`expr $n + 1`
-echo "I: attempt permissible lookup ($n)"
+echo "I:  attempt permissible lookup ($n)"
 ret=0
 echo "12" > ans2/ans.limit
-$RNDC -c ../common/rndc.conf -s 10.53.0.3 -p 9953 flush 2>&1 | sed 's/^/I:ns1 /'
+ns3_reset ns3/named3.conf
 $DIG $DIGOPTS @10.53.0.2 reset > /dev/null || ret=1
 $DIG $DIGOPTS @10.53.0.3 indirect6.example.org > dig.out.1.test$n || ret=1
 grep "status: NOERROR" dig.out.1.test$n > /dev/null || ret=1
@@ -131,20 +137,16 @@ eval count=`cat dig.out.2.test$n`
 if [ $ret != 0 ]; then echo "I:failed"; fi
 status=`expr $status + $ret`
 
-echo "I:reset max-recursion-queries"
+echo "I: set max-recursion-depth=100, max-recursion-queries=40"
-cp ns3/named4.conf ns3/named.conf
-$RNDC -c ../common/rndc.conf -s 10.53.0.3 -p 9953 reconfig 2>&1 | sed 's/^/I:ns1 /'
-sleep 2
 
 n=`expr $n + 1`
-echo "I: attempt excessive-queries lookup ($n)"
+echo "I:  attempt excessive-queries lookup ($n)"
 ret=0
 echo "10" > ans2/ans.limit
-$RNDC -c ../common/rndc.conf -s 10.53.0.3 -p 9953 flush 2>&1 | sed 's/^/I:ns1 /'
+ns3_reset ns3/named4.conf
 $DIG $DIGOPTS @10.53.0.2 reset > /dev/null || ret=1
 $DIG $DIGOPTS @10.53.0.3 indirect7.example.org > dig.out.1.test$n || ret=1
-if [ "$TESTSOCK6" != "false" ]
+if ns3_sends_aaaa_queries; then
-then
   grep "status: SERVFAIL" dig.out.1.test$n > /dev/null || ret=1
 fi
 $DIG $DIGOPTS +short @10.53.0.2 count txt > dig.out.2.test$n || ret=1
@@ -154,10 +156,10 @@ if [ $ret != 0 ]; then echo "I:failed"; fi
 status=`expr $status + $ret`
 
 n=`expr $n + 1`
-echo "I: attempt permissible lookup ($n)"
+echo "I:  attempt permissible lookup ($n)"
 ret=0
 echo "9" > ans2/ans.limit
-$RNDC -c ../common/rndc.conf -s 10.53.0.3 -p 9953 flush 2>&1 | sed 's/^/I:ns1 /'
+ns3_reset ns3/named4.conf
 $DIG $DIGOPTS @10.53.0.2 reset > /dev/null || ret=1
 $DIG $DIGOPTS @10.53.0.3 indirect8.example.org > dig.out.1.test$n || ret=1
 grep "status: NOERROR" dig.out.1.test$n > /dev/null || ret=1
@@ -170,10 +172,10 @@ status=`expr $status + $ret`
 n=`expr $n + 1`
 echo "I: attempting NS explosion ($n)"
 ret=0
-$RNDC -c ../common/rndc.conf -s 10.53.0.3 -p 9953 flush 2>&1 | sed 's/^/I:ns1 /'
+ns3_reset ns3/named4.conf
+$DIG $DIGOPTS @10.53.0.2 reset > /dev/null || ret=1
 $DIG $DIGOPTS +short @10.53.0.3 ns1.1.example.net > dig.out.1.test$n || ret=1
-sleep 2
+$DIG $DIGOPTS +short @10.53.0.2 count txt > dig.out.2.test$n || ret=1
-$DIG $DIGOPTS +short @10.53.0.4 count txt > dig.out.2.test$n || ret=1
 eval count=`cat dig.out.2.test$n`
 [ $count -lt 50 ] || ret=1
 $DIG $DIGOPTS +short @10.53.0.7 count txt > dig.out.3.test$n || ret=1

bin/tests/system/runtime/setup.sh

@@ -14,4 +14,10 @@ $SHELL clean.sh
 cp ns2/named1.conf ns2/named.conf
 
 mkdir ns2/nope
-chmod 555 ns2/nope
+
+if [ 1 = "${CYGWIN:-0}" ]
+then
+    setfacl -s user::r-x,group::r-x,other::r-x ns2/nope
+else
+    chmod 555 ns2/nope
+fi

bin/tests/system/sfcache/tests.sh

@@ -16,15 +16,6 @@ rm -f dig.out.*
 
 DIGOPTS="+tcp +noadd +nosea +nostat +nocmd -p 5300"
 
-# read everything that's been appended to a file since the last time
-# 'nextpart' was called.
-nextpart () {
-    [ -f $1.prev ] || echo "0" > $1.prev
-    prev=`cat $1.prev`
-    awk "FNR > $prev "'{ print }
-         END           { print NR > "/dev/stderr" }' $1 2> $1.prev
-}
-
 echo "I:checking DNSSEC SERVFAIL is cached ($n)"
 ret=0
 $DIG $DIGOPTS +dnssec foo.example. a @10.53.0.5 > dig.out.ns5.test$n || ret=1

bin/tests/system/smartsign/tests.sh

@@ -342,8 +342,8 @@ status=`expr $status + $ret`
 
 echo "I:checking sync record publication"
 ret=0
-grep CDNSKEY $cfile.signed > /dev/null || ret=1
+grep -w CDNSKEY $cfile.signed > /dev/null || ret=1
-grep CDS $cfile.signed > /dev/null || ret=1
+grep -w CDS $cfile.signed > /dev/null || ret=1
 if [ $ret != 0 ]; then echo "I:failed"; fi
 status=`expr $status + $ret`
 
@@ -352,8 +352,8 @@ ret=0
 $SETTIME -P now -A now -Dsync now ${cksk5} > /dev/null
 $SIGNER -Sg -r $RANDFILE -o $czone -f $cfile.new $cfile.signed > /dev/null 2>&1
 mv $cfile.new $cfile.signed
-grep CDNSKEY $cfile.signed > /dev/null && ret=1
+grep -w CDNSKEY $cfile.signed > /dev/null && ret=1
-grep CDS $cfile.signed > /dev/null && ret=1
+grep -w CDS $cfile.signed > /dev/null && ret=1
 if [ $ret != 0 ]; then echo "I:failed"; fi
 status=`expr $status + $ret`
 

bin/tests/system/statistics/tests.sh

@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# Copyright (C) 2012, 2015, 2016  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2012, 2015-2017  Internet Systems Consortium, Inc. ("ISC")
 #
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -137,5 +137,12 @@ fi
 if [ $ret != 0 ]; then echo "I:failed"; fi
 status=`expr $status + $ret`
 
+ret=0
+n=`expr $n + 1`
+echo "I:checking priming queries are counted ($n)"
+grep "1 priming queries" ns3/named.stats
+if [ $ret != 0 ]; then echo "I:failed"; fi
+status=`expr $status + $ret`
+
 echo "I:exit status: $status"
 [ $status -eq 0 ] || exit 1

bin/tools/.gitignore

@@ -1,7 +1,6 @@
 arpaname
 dnstap-read
 genrandom
-isc-hmac-fixup
 mdig
 named-journalprint
 named-nzd2nzf

bin/tools/Makefile.in

@@ -38,21 +38,21 @@ DNSTAPTARGETS =	dnstap-read@EXEEXT@
 NZDTARGETS =	named-nzd2nzf@EXEEXT@
 TARGETS =	arpaname@EXEEXT@ named-journalprint@EXEEXT@ \
 		named-rrchecker@EXEEXT@ nsec3hash@EXEEXT@ \
-		genrandom@EXEEXT@ isc-hmac-fixup@EXEEXT@ mdig@EXEEXT@ \
+		genrandom@EXEEXT@ mdig@EXEEXT@ \
 		@DNSTAPTARGETS@ @NZDTARGETS@
 
 DNSTAPSRCS  =	dnstap-read.c
 NZDSRCS  =	named-nzd2nzf.c
 SRCS =		arpaname.c named-journalprint.c named-rrchecker.c \
-		nsec3hash.c genrandom.c isc-hmac-fixup.c mdig.c \
+		nsec3hash.c genrandom.c mdig.c \
 		@DNSTAPSRCS@ @NZDSRCS@
 
 MANPAGES =	arpaname.1 dnstap-read.1 genrandom.8 \
-		isc-hmac-fixup.8 mdig.1 named-journalprint.8 \
+		mdig.1 named-journalprint.8 \
 		named-nzd2nzf.8 named-rrchecker.1 nsec3hash.8
 
 HTMLPAGES =	arpaname.html dnstap-read.html genrandom.html \
-		isc-hmac-fixup.html mdig.html named-journalprint.html \
+		mdig.html named-journalprint.html \
 		named-nzd2nzf.html named-rrchecker.html nsec3hash.html
 
 MANOBJS =	${MANPAGES} ${HTMLPAGES}
@@ -78,11 +78,6 @@ nsec3hash@EXEEXT@: nsec3hash.@O@ ${ISCDEPLIBS} ${DNSDEPLIBS}
 	export LIBS0="${DNSLIBS} ${ISCLIBS}"; \
 	${FINALBUILDCMD}
 
-isc-hmac-fixup@EXEEXT@: isc-hmac-fixup.@O@ ${ISCDEPLIBS}
-	export BASEOBJS="isc-hmac-fixup.@O@"; \
-	export LIBS0="${ISCLIBS}"; \
-	${FINALBUILDCMD}
-
 genrandom@EXEEXT@: genrandom.@O@
 	${LIBTOOL_MODE_LINK} ${PURIFY} ${CC} ${CFLAGS} ${LDFLAGS} \
 		-o $@ genrandom.@O@ @GENRANDOMLIB@ ${LIBS}
@@ -134,12 +129,9 @@ install:: ${TARGETS} installdirs @DNSTAP@ @NZD_TOOLS@
 		${DESTDIR}${sbindir}
 	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} genrandom@EXEEXT@ \
 		${DESTDIR}${sbindir}
-	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} isc-hmac-fixup@EXEEXT@ \
-		${DESTDIR}${sbindir}
 	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} mdig@EXEEXT@ \
 		${DESTDIR}${bindir}
 	${INSTALL_DATA} ${srcdir}/arpaname.1 ${DESTDIR}${mandir}/man1
-	${INSTALL_DATA} ${srcdir}/isc-hmac-fixup.8 ${DESTDIR}${mandir}/man8
 	${INSTALL_DATA} ${srcdir}/named-journalprint.8 ${DESTDIR}${mandir}/man8
 	${INSTALL_DATA} ${srcdir}/named-rrchecker.1 ${DESTDIR}${mandir}/man1
 	${INSTALL_DATA} ${srcdir}/nsec3hash.8 ${DESTDIR}${mandir}/man8
@@ -152,12 +144,9 @@ uninstall::
 	rm -f ${DESTDIR}${mandir}/man8/nsec3hash.8
 	rm -f ${DESTDIR}${mandir}/man1/named-rrchecker.1
 	rm -f ${DESTDIR}${mandir}/man8/named-journalprint.8
-	rm -f ${DESTDIR}${mandir}/man8/isc-hmac-fixup.8
 	rm -f ${DESTDIR}${mandir}/man1/arpaname.1
 	${LIBTOOL_MODE_UNINSTALL} rm -f \
 		${DESTDIR}${bindir}/mdig@EXEEXT@
-	${LIBTOOL_MODE_UNINSTALL} rm -f \
-		${DESTDIR}${sbindir}/isc-hmac-fixup@EXEEXT@
 	${LIBTOOL_MODE_UNINSTALL} rm -f \
 		${DESTDIR}${sbindir}/genrandom@EXEEXT@
 	${LIBTOOL_MODE_UNINSTALL} rm -f \

bin/tools/isc-hmac-fixup.8

@@ -1,69 +0,0 @@
-.\" Copyright (C) 2010, 2013-2016 Internet Systems Consortium, Inc. ("ISC")
-.\" 
-.\" This Source Code Form is subject to the terms of the Mozilla Public
-.\" License, v. 2.0. If a copy of the MPL was not distributed with this
-.\" file, You can obtain one at http://mozilla.org/MPL/2.0/.
-.\"
-.hy 0
-.ad l
-'\" t
-.\"     Title: isc-hmac-fixup
-.\"    Author: 
-.\" Generator: DocBook XSL Stylesheets v1.78.1 <http://docbook.sf.net/>
-.\"      Date: 2013-04-28
-.\"    Manual: BIND9
-.\"    Source: ISC
-.\"  Language: English
-.\"
-.TH "ISC\-HMAC\-FIXUP" "8" "2013\-04\-28" "ISC" "BIND9"
-.\" -----------------------------------------------------------------
-.\" * Define some portability stuff
-.\" -----------------------------------------------------------------
-.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-.\" http://bugs.debian.org/507673
-.\" http://lists.gnu.org/archive/html/groff/2009-02/msg00013.html
-.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-.ie \n(.g .ds Aq \(aq
-.el       .ds Aq '
-.\" -----------------------------------------------------------------
-.\" * set default formatting
-.\" -----------------------------------------------------------------
-.\" disable hyphenation
-.nh
-.\" disable justification (adjust text to left margin only)
-.ad l
-.\" -----------------------------------------------------------------
-.\" * MAIN CONTENT STARTS HERE *
-.\" -----------------------------------------------------------------
-.SH "NAME"
-isc-hmac-fixup \- fixes HMAC keys generated by older versions of BIND
-.SH "SYNOPSIS"
-.HP \w'\fBisc\-hmac\-fixup\fR\ 'u
-\fBisc\-hmac\-fixup\fR {\fIalgorithm\fR} {\fIsecret\fR}
-.SH "DESCRIPTION"
-.PP
-Versions of BIND 9 up to and including BIND 9\&.6 had a bug causing HMAC\-SHA* TSIG keys which were longer than the digest length of the hash algorithm (i\&.e\&., SHA1 keys longer than 160 bits, SHA256 keys longer than 256 bits, etc) to be used incorrectly, generating a message authentication code that was incompatible with other DNS implementations\&.
-.PP
-This bug has been fixed in BIND 9\&.7\&. However, the fix may cause incompatibility between older and newer versions of BIND, when using long keys\&.
-\fBisc\-hmac\-fixup\fR
-modifies those keys to restore compatibility\&.
-.PP
-To modify a key, run
-\fBisc\-hmac\-fixup\fR
-and specify the key\*(Aqs algorithm and secret on the command line\&. If the secret is longer than the digest length of the algorithm (64 bytes for SHA1 through SHA256, or 128 bytes for SHA384 and SHA512), then a new secret will be generated consisting of a hash digest of the old secret\&. (If the secret did not require conversion, then it will be printed without modification\&.)
-.SH "SECURITY CONSIDERATIONS"
-.PP
-Secrets that have been converted by
-\fBisc\-hmac\-fixup\fR
-are shortened, but as this is how the HMAC protocol works in operation anyway, it does not affect security\&. RFC 2104 notes, "Keys longer than [the digest length] are acceptable but the extra length would not significantly increase the function strength\&."
-.SH "SEE ALSO"
-.PP
-BIND 9 Administrator Reference Manual,
-RFC 2104\&.
-.SH "AUTHOR"
-.PP
-\fBInternet Systems Consortium, Inc\&.\fR
-.SH "COPYRIGHT"
-.br
-Copyright \(co 2010, 2013-2016 Internet Systems Consortium, Inc. ("ISC")
-.br

bin/tools/isc-hmac-fixup.c

@@ -1,139 +0,0 @@
-/*
- * Copyright (C) 2010, 2014-2016  Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- */
-
-/* $Id: isc-hmac-fixup.c,v 1.4 2010/03/10 02:17:52 marka Exp $ */
-
-#include <config.h>
-
-#include <isc/base64.h>
-#include <isc/buffer.h>
-#include <isc/md5.h>
-#include <isc/print.h>
-#include <isc/region.h>
-#include <isc/result.h>
-#include <isc/sha1.h>
-#include <isc/sha2.h>
-#include <isc/stdio.h>
-#include <isc/string.h>
-
-#include <pk11/site.h>
-
-#define HMAC_LEN	64
-
-int
-main(int argc, char **argv)  {
-	isc_buffer_t buf;
-	unsigned char key[1024];
-	char secret[1024];
-	char base64[(1024*4)/3];
-	isc_region_t r;
-	isc_result_t result;
-
-	if (argc != 3) {
-		fprintf(stderr, "Usage:\t%s algorithm secret\n", argv[0]);
-#ifndef PK11_MD5_DISABLE
-		fprintf(stderr, "\talgorithm: (MD5 | SHA1 | SHA224 | "
-				"SHA256 | SHA384 | SHA512)\n");
-#else
-		fprintf(stderr, "\talgorithm: (SHA1 | SHA224 | "
-				"SHA256 | SHA384 | SHA512)\n");
-#endif
-		return (1);
-	}
-
-	isc_buffer_init(&buf, secret, sizeof(secret));
-	result = isc_base64_decodestring(argv[2], &buf);
-	if (result != ISC_R_SUCCESS) {
-		fprintf(stderr, "error: %s\n", isc_result_totext(result));
-		return (1);
-	}
-	isc_buffer_usedregion(&buf, &r);
-
-#ifndef PK11_MD5_DISABLE
-	if (!strcasecmp(argv[1], "md5") ||
-	    !strcasecmp(argv[1], "hmac-md5")) {
-		if (r.length > HMAC_LEN) {
-			isc_md5_t md5ctx;
-			isc_md5_init(&md5ctx);
-			isc_md5_update(&md5ctx, r.base, r.length);
-			isc_md5_final(&md5ctx, key);
-
-			r.base = key;
-			r.length = ISC_MD5_DIGESTLENGTH;
-		}
-	} else
-#endif
-	if (!strcasecmp(argv[1], "sha1") ||
-		   !strcasecmp(argv[1], "hmac-sha1")) {
-		if (r.length > ISC_SHA1_DIGESTLENGTH) {
-			isc_sha1_t sha1ctx;
-			isc_sha1_init(&sha1ctx);
-			isc_sha1_update(&sha1ctx, r.base, r.length);
-			isc_sha1_final(&sha1ctx, key);
-
-			r.base = key;
-			r.length = ISC_SHA1_DIGESTLENGTH;
-		}
-	} else if (!strcasecmp(argv[1], "sha224") ||
-		   !strcasecmp(argv[1], "hmac-sha224")) {
-		if (r.length > ISC_SHA224_DIGESTLENGTH) {
-			isc_sha224_t sha224ctx;
-			isc_sha224_init(&sha224ctx);
-			isc_sha224_update(&sha224ctx, r.base, r.length);
-			isc_sha224_final(key, &sha224ctx);
-
-			r.base = key;
-			r.length = ISC_SHA224_DIGESTLENGTH;
-		}
-	} else if (!strcasecmp(argv[1], "sha256") ||
-		   !strcasecmp(argv[1], "hmac-sha256")) {
-		if (r.length > ISC_SHA256_DIGESTLENGTH) {
-			isc_sha256_t sha256ctx;
-			isc_sha256_init(&sha256ctx);
-			isc_sha256_update(&sha256ctx, r.base, r.length);
-			isc_sha256_final(key, &sha256ctx);
-
-			r.base = key;
-			r.length = ISC_SHA256_DIGESTLENGTH;
-		}
-	} else if (!strcasecmp(argv[1], "sha384") ||
-		   !strcasecmp(argv[1], "hmac-sha384")) {
-		if (r.length > ISC_SHA384_DIGESTLENGTH) {
-			isc_sha384_t sha384ctx;
-			isc_sha384_init(&sha384ctx);
-			isc_sha384_update(&sha384ctx, r.base, r.length);
-			isc_sha384_final(key, &sha384ctx);
-
-			r.base = key;
-			r.length = ISC_SHA384_DIGESTLENGTH;
-		}
-	} else if (!strcasecmp(argv[1], "sha512") ||
-		   !strcasecmp(argv[1], "hmac-sha512")) {
-		if (r.length > ISC_SHA512_DIGESTLENGTH) {
-			isc_sha512_t sha512ctx;
-			isc_sha512_init(&sha512ctx);
-			isc_sha512_update(&sha512ctx, r.base, r.length);
-			isc_sha512_final(key, &sha512ctx);
-
-			r.base = key;
-			r.length = ISC_SHA512_DIGESTLENGTH;
-		}
-	} else {
-		fprintf(stderr, "unknown hmac/digest algorithm: %s\n", argv[1]);
-		return (1);
-	}
-
-	isc_buffer_init(&buf, base64, sizeof(base64));
-	result = isc_base64_totext(&r, 0, "", &buf);
-	if (result != ISC_R_SUCCESS) {
-		fprintf(stderr, "error: %s\n", isc_result_totext(result));
-		return (1);
-	}
-	fprintf(stdout, "%.*s\n", (int)isc_buffer_usedlength(&buf), base64);
-	return (0);
-}

bin/tools/isc-hmac-fixup.docbook

@@ -1,96 +0,0 @@
-<!--
- - Copyright (C) 2010, 2013-2016  Internet Systems Consortium, Inc. ("ISC")
- -
- - This Source Code Form is subject to the terms of the Mozilla Public
- - License, v. 2.0. If a copy of the MPL was not distributed with this
- - file, You can obtain one at http://mozilla.org/MPL/2.0/.
--->
-
-<!-- Converted by db4-upgrade version 1.0 -->
-<refentry xmlns:db="http://docbook.org/ns/docbook" version="5.0" xml:id="man.isc-hmac-fixup">
-  <info>
-    <date>2013-04-28</date>
-  </info>
-  <refentryinfo>
-    <corpname>ISC</corpname>
-    <corpauthor>Internet Systems Consortium, Inc.</corpauthor>
-  </refentryinfo>
-
-  <refmeta>
-    <refentrytitle><application>isc-hmac-fixup</application></refentrytitle>
-    <manvolnum>8</manvolnum>
-    <refmiscinfo>BIND9</refmiscinfo>
-  </refmeta>
-
-  <refnamediv>
-    <refname><application>isc-hmac-fixup</application></refname>
-    <refpurpose>fixes HMAC keys generated by older versions of BIND</refpurpose>
-  </refnamediv>
-
-  <docinfo>
-    <copyright>
-      <year>2010</year>
-      <year>2013</year>
-      <year>2014</year>
-      <year>2015</year>
-      <year>2016</year>
-      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
-    </copyright>
-  </docinfo>
-
-  <refsynopsisdiv>
-    <cmdsynopsis sepchar=" ">
-      <command>isc-hmac-fixup</command>
-      <arg choice="req" rep="norepeat"><replaceable class="parameter">algorithm</replaceable></arg>
-      <arg choice="req" rep="norepeat"><replaceable class="parameter">secret</replaceable></arg>
-    </cmdsynopsis>
-  </refsynopsisdiv>
-
-  <refsection><info><title>DESCRIPTION</title></info>
-
-    <para>
-      Versions of BIND 9 up to and including BIND 9.6 had a bug causing
-      HMAC-SHA* TSIG keys which were longer than the digest length of the
-      hash algorithm (i.e., SHA1 keys longer than 160 bits, SHA256 keys
-      longer than 256 bits, etc) to be used incorrectly, generating a
-      message authentication code that was incompatible with other DNS
-      implementations.
-    </para>
-    <para>
-      This bug has been fixed in BIND 9.7.  However, the fix may
-      cause incompatibility between older and newer versions of
-      BIND, when using long keys.  <command>isc-hmac-fixup</command>
-      modifies those keys to restore compatibility.
-    </para>
-    <para>
-      To modify a key, run <command>isc-hmac-fixup</command> and
-      specify the key's algorithm and secret on the command line.  If the
-      secret is longer than the digest length of the algorithm (64 bytes
-      for SHA1 through SHA256, or 128 bytes for SHA384 and SHA512), then a
-      new secret will be generated consisting of a hash digest of the old
-      secret.  (If the secret did not require conversion, then it will be
-      printed without modification.)
-    </para>
-  </refsection>
-
-  <refsection><info><title>SECURITY CONSIDERATIONS</title></info>
-
-    <para>
-      Secrets that have been converted by <command>isc-hmac-fixup</command>
-      are shortened, but as this is how the HMAC protocol works in
-      operation anyway, it does not affect security.  RFC 2104 notes,
-      "Keys longer than [the digest length] are acceptable but the
-      extra length would not significantly increase the function
-      strength."
-    </para>
-  </refsection>
-
-  <refsection><info><title>SEE ALSO</title></info>
-
-    <para>
-      <citetitle>BIND 9 Administrator Reference Manual</citetitle>,
-      <citetitle>RFC 2104</citetitle>.
-    </para>
-  </refsection>
-
-</refentry>

bin/tools/isc-hmac-fixup.html

@@ -1,92 +0,0 @@
-<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
-<!--
- - Copyright (C) 2010, 2013-2016 Internet Systems Consortium, Inc. ("ISC")
- - 
- - This Source Code Form is subject to the terms of the Mozilla Public
- - License, v. 2.0. If a copy of the MPL was not distributed with this
- - file, You can obtain one at http://mozilla.org/MPL/2.0/.
--->
-<html lang="en">
-<head>
-<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
-<title>isc-hmac-fixup</title>
-<meta name="generator" content="DocBook XSL Stylesheets V1.78.1">
-</head>
-<body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="refentry">
-<a name="man.isc-hmac-fixup"></a><div class="titlepage"></div>
-  
-  
-
-  
-
-  <div class="refnamediv">
-<h2>Name</h2>
-<p>
-    <span class="application">isc-hmac-fixup</span>
-     &#8212; fixes HMAC keys generated by older versions of BIND
-  </p>
-</div>
-
-  
-
-  <div class="refsynopsisdiv">
-<h2>Synopsis</h2>
-    <div class="cmdsynopsis"><p>
-      <code class="command">isc-hmac-fixup</code> 
-       {<em class="replaceable"><code>algorithm</code></em>}
-       {<em class="replaceable"><code>secret</code></em>}
-    </p></div>
-  </div>
-
-  <div class="refsection">
-<a name="id-1.7"></a><h2>DESCRIPTION</h2>
-
-    <p>
-      Versions of BIND 9 up to and including BIND 9.6 had a bug causing
-      HMAC-SHA* TSIG keys which were longer than the digest length of the
-      hash algorithm (i.e., SHA1 keys longer than 160 bits, SHA256 keys
-      longer than 256 bits, etc) to be used incorrectly, generating a
-      message authentication code that was incompatible with other DNS
-      implementations.
-    </p>
-    <p>
-      This bug has been fixed in BIND 9.7.  However, the fix may
-      cause incompatibility between older and newer versions of
-      BIND, when using long keys.  <span class="command"><strong>isc-hmac-fixup</strong></span>
-      modifies those keys to restore compatibility.
-    </p>
-    <p>
-      To modify a key, run <span class="command"><strong>isc-hmac-fixup</strong></span> and
-      specify the key's algorithm and secret on the command line.  If the
-      secret is longer than the digest length of the algorithm (64 bytes
-      for SHA1 through SHA256, or 128 bytes for SHA384 and SHA512), then a
-      new secret will be generated consisting of a hash digest of the old
-      secret.  (If the secret did not require conversion, then it will be
-      printed without modification.)
-    </p>
-  </div>
-
-  <div class="refsection">
-<a name="id-1.8"></a><h2>SECURITY CONSIDERATIONS</h2>
-
-    <p>
-      Secrets that have been converted by <span class="command"><strong>isc-hmac-fixup</strong></span>
-      are shortened, but as this is how the HMAC protocol works in
-      operation anyway, it does not affect security.  RFC 2104 notes,
-      "Keys longer than [the digest length] are acceptable but the
-      extra length would not significantly increase the function
-      strength."
-    </p>
-  </div>
-
-  <div class="refsection">
-<a name="id-1.9"></a><h2>SEE ALSO</h2>
-
-    <p>
-      <em class="citetitle">BIND 9 Administrator Reference Manual</em>,
-      <em class="citetitle">RFC 2104</em>.
-    </p>
-  </div>
-
-</div></body>
-</html>

bin/tools/named-nzd2nzf.c

@@ -16,6 +16,8 @@
 #include <stdlib.h>
 #include <lmdb.h>
 
+#include <dns/view.h>
+
 #include <isc/print.h>
 
 int
@@ -36,42 +38,43 @@ main (int argc, char *argv[]) {
 	path = argv[1];
 
 	status = mdb_env_create(&env);
-	if (status != 0) {
+	if (status != MDB_SUCCESS) {
 		fprintf(stderr, "named-nzd2nzf: mdb_env_create: %s",
 			mdb_strerror(status));
 		exit(1);
 	}
 
-	status = mdb_env_open(env, path,
+	status = mdb_env_open(env, path, DNS_LMDB_FLAGS, 0600);
-			      MDB_RDONLY|MDB_NOTLS|MDB_NOSUBDIR, 0600);
+	if (status != MDB_SUCCESS) {
-	if (status != 0) {
 		fprintf(stderr, "named-nzd2nzf: mdb_env_open: %s",
 			mdb_strerror(status));
 		exit(1);
 	}
 
 	status = mdb_txn_begin(env, 0, MDB_RDONLY, &txn);
-	if (status != 0) {
+	if (status != MDB_SUCCESS) {
 		fprintf(stderr, "named-nzd2nzf: mdb_txn_begin: %s",
 			mdb_strerror(status));
 		exit(1);
 	}
 
 	status = mdb_dbi_open(txn, NULL, 0, &dbi);
-	if (status != 0) {
+	if (status != MDB_SUCCESS) {
 		fprintf(stderr, "named-nzd2nzf: mdb_dbi_open: %s",
 			mdb_strerror(status));
 		exit(1);
 	}
 
 	status = mdb_cursor_open(txn, dbi, &cursor);
-	if (status != 0) {
+	if (status != MDB_SUCCESS) {
 		fprintf(stderr, "named-nzd2nzf: mdb_cursor_open: %s",
 			mdb_strerror(status));
 		exit(1);
 	}
 
-	while (mdb_cursor_get(cursor, &key, &data, MDB_NEXT) == 0) {
+	for (status = mdb_cursor_get(cursor, &key, &data, MDB_FIRST);
+	     status == MDB_SUCCESS;
+	     status = mdb_cursor_get(cursor, &key, &data, MDB_NEXT)) {
 		if (key.mv_data == NULL || key.mv_size == 0 ||
 		    data.mv_data == NULL || data.mv_size == 0)
 		{

bin/tools/win32/ischmacfixup.vcxproj.filters.in

@@ -1,18 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
-  <ItemGroup>
-    <Filter Include="Source Files">
-      <UniqueIdentifier>{4FC737F1-C7A5-4376-A066-2A32D752A2FF}</UniqueIdentifier>
-      <Extensions>cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx</Extensions>
-    </Filter>
-    <Filter Include="Resource Files">
-      <UniqueIdentifier>{67DA6AB6-F800-4c08-8B7A-83BB121AAD01}</UniqueIdentifier>
-      <Extensions>rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms</Extensions>
-    </Filter>
-  </ItemGroup>
-  <ItemGroup>
-    <ClCompile Include="..\isc-hmac-fixup.c">
-      <Filter>Source Files</Filter>
-    </ClCompile>
-  </ItemGroup>
-</Project>

bin/tools/win32/ischmacfixup.vcxproj.in

@@ -1,112 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<Project DefaultTargets="Build" ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
-  <ItemGroup Label="ProjectConfigurations">
-    <ProjectConfiguration Include="Debug|@PLATFORM@">
-      <Configuration>Debug</Configuration>
-      <Platform>@PLATFORM@</Platform>
-    </ProjectConfiguration>
-    <ProjectConfiguration Include="Release|@PLATFORM@">
-      <Configuration>Release</Configuration>
-      <Platform>@PLATFORM@</Platform>
-    </ProjectConfiguration>
-  </ItemGroup>
-  <PropertyGroup Label="Globals">
-    <ProjectGuid>{70F2F0DF-665D-4444-A982-AEA31A861A22}</ProjectGuid>
-    <Keyword>Win32Proj</Keyword>
-    <RootNamespace>ischmacfixup</RootNamespace>
-  </PropertyGroup>
-  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|@PLATFORM@'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseDebugLibraries>true</UseDebugLibraries>
-    <CharacterSet>MultiByte</CharacterSet>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'" Label="Configuration">
-    <ConfigurationType>Application</ConfigurationType>
-    <UseDebugLibraries>false</UseDebugLibraries>
-    <WholeProgramOptimization>true</WholeProgramOptimization>
-    <CharacterSet>MultiByte</CharacterSet>
-  </PropertyGroup>
-  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
-  <ImportGroup Label="ExtensionSettings">
-  </ImportGroup>
-  <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|@PLATFORM@'">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'">
-    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-  </ImportGroup>
-  <PropertyGroup Label="UserMacros" />
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|@PLATFORM@'">
-    <LinkIncremental>true</LinkIncremental>
-    <OutDir>..\..\..\Build\$(Configuration)\</OutDir>
-    <IntDir>.\$(Configuration)\</IntDir>
-    <TargetName>isc-hmac-fixup</TargetName>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'">
-    <LinkIncremental>false</LinkIncremental>
-    <OutDir>..\..\..\Build\$(Configuration)\</OutDir>
-    <IntDir>.\$(Configuration)\</IntDir>
-    <TargetName>isc-hmac-fixup</TargetName>
-  </PropertyGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|@PLATFORM@'">
-    <ClCompile>
-      <PrecompiledHeader>
-      </PrecompiledHeader>
-      <WarningLevel>Level3</WarningLevel>
-      <Optimization>Disabled</Optimization>
-      <PreprocessorDefinitions>WIN32;@CRYPTO@_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <PrecompiledHeaderOutputFile>.\$(Configuration)\$(ProjectName).pch</PrecompiledHeaderOutputFile>
-      <AssemblerListingLocation>.\$(Configuration)\</AssemblerListingLocation>
-      <ObjectFileName>.\$(Configuration)\</ObjectFileName>
-      <ProgramDataBaseFileName>$(OutDir)$(TargetName).pdb</ProgramDataBaseFileName>
-      <BrowseInformation>true</BrowseInformation>
-      <AdditionalIncludeDirectories>.\;..\..\..\;@LIBXML2_INC@@OPENSSL_INC@..\..\..\lib\isc\win32;..\..\..\lib\isc\win32\include;..\..\..\lib\isc\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <CompileAs>CompileAsC</CompileAs>
-    </ClCompile>
-    <Link>
-      <SubSystem>Console</SubSystem>
-      <GenerateDebugInformation>true</GenerateDebugInformation>
-      <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\lib\isc\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>libisc.lib;%(AdditionalDependencies)</AdditionalDependencies>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'">
-    <ClCompile>
-      <WarningLevel>Level3</WarningLevel>
-      <PrecompiledHeader>
-      </PrecompiledHeader>
-      <Optimization>MaxSpeed</Optimization>
-      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <IntrinsicFunctions>@INTRINSIC@</IntrinsicFunctions>
-      <PreprocessorDefinitions>WIN32;@CRYPTO@NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
-      <WholeProgramOptimization>false</WholeProgramOptimization>
-      <StringPooling>true</StringPooling>
-      <PrecompiledHeaderOutputFile>.\$(Configuration)\$(ProjectName).pch</PrecompiledHeaderOutputFile>
-      <AssemblerListingLocation>.\$(Configuration)\</AssemblerListingLocation>
-      <ObjectFileName>.\$(Configuration)\</ObjectFileName>
-      <ProgramDataBaseFileName>$(OutDir)$(TargetName).pdb</ProgramDataBaseFileName>
-      <AdditionalIncludeDirectories>.\;..\..\..\;@LIBXML2_INC@@OPENSSL_INC@..\..\..\lib\isc\win32;..\..\..\lib\isc\win32\include;..\..\..\lib\isc\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <CompileAs>CompileAsC</CompileAs>
-    </ClCompile>
-    <Link>
-      <SubSystem>Console</SubSystem>
-      <GenerateDebugInformation>false</GenerateDebugInformation>
-      <EnableCOMDATFolding>true</EnableCOMDATFolding>
-      <OptimizeReferences>true</OptimizeReferences>
-      <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
-      <LinkTimeCodeGeneration>Default</LinkTimeCodeGeneration>
-      <AdditionalLibraryDirectories>..\..\..\lib\isc\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>libisc.lib;%(AdditionalDependencies)</AdditionalDependencies>
-    </Link>
-  </ItemDefinitionGroup>
-  <ItemGroup>
-    <ClCompile Include="..\isc-hmac-fixup.c" />
-  </ItemGroup>
-  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
-  <ImportGroup Label="ExtensionTargets">
-  </ImportGroup>
-</Project>

bin/tools/win32/ischmacfixup.vcxproj.user

@@ -1,3 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
-</Project>

bin/win32/BINDInstall/BINDInstallDlg.cpp

@@ -186,7 +186,6 @@ const FileData installFiles[] =
 	{"named-compilezone.exe", FileData::BinDir, FileData::Normal, FALSE, FALSE},
 	{"named-journalprint.exe", FileData::BinDir, FileData::Normal, FALSE, FALSE},
 	{"named-rrchecker.exe", FileData::BinDir, FileData::Normal, FALSE, FALSE},
-	{"isc-hmac-fixup.exe", FileData::BinDir, FileData::Normal, FALSE, FALSE},
 #ifdef USE_PKCS11
 	{"pkcs11-destroy.exe", FileData::BinDir, FileData::Normal, FALSE, FALSE},
 	{"pkcs11-keygen.exe", FileData::BinDir, FileData::Normal, FALSE, FALSE},

config.h.in

@@ -535,6 +535,9 @@ int sigwait(const unsigned int *set, int *sig);
 /* Define to the sockaddr length type used by getnameinfo(3). */
 #undef IRS_GETNAMEINFO_SOCKLEN_T
 
+/* Define if you want to use inline buffers */
+#undef ISC_BUFFER_USEINLINE
+
 /* Define to allow building of objects for dlopen(). */
 #undef ISC_DLZ_DLOPEN
 

configure

@@ -940,7 +940,6 @@ infodir
 docdir
 oldincludedir
 includedir
-runstatedir
 localstatedir
 sharedstatedir
 sysconfdir
@@ -981,6 +980,7 @@ with_gnu_ld
 with_sysroot
 enable_libtool_lock
 enable_libbind
+enable_buffer_useinline
 enable_warn_shadow
 enable_warn_error
 enable_developer
@@ -1103,7 +1103,6 @@ datadir='${datarootdir}'
 sysconfdir='${prefix}/etc'
 sharedstatedir='${prefix}/com'
 localstatedir='${prefix}/var'
-runstatedir='${localstatedir}/run'
 includedir='${prefix}/include'
 oldincludedir='/usr/include'
 docdir='${datarootdir}/doc/${PACKAGE_TARNAME}'
@@ -1356,15 +1355,6 @@ do
   | -silent | --silent | --silen | --sile | --sil)
     silent=yes ;;
 
-  -runstatedir | --runstatedir | --runstatedi | --runstated \
-  | --runstate | --runstat | --runsta | --runst | --runs \
-  | --run | --ru | --r)
-    ac_prev=runstatedir ;;
-  -runstatedir=* | --runstatedir=* | --runstatedi=* | --runstated=* \
-  | --runstate=* | --runstat=* | --runsta=* | --runst=* | --runs=* \
-  | --run=* | --ru=* | --r=*)
-    runstatedir=$ac_optarg ;;
-
   -sbindir | --sbindir | --sbindi | --sbind | --sbin | --sbi | --sb)
     ac_prev=sbindir ;;
   -sbindir=* | --sbindir=* | --sbindi=* | --sbind=* | --sbin=* \
@@ -1502,7 +1492,7 @@ fi
 for ac_var in	exec_prefix prefix bindir sbindir libexecdir datarootdir \
 		datadir sysconfdir sharedstatedir localstatedir includedir \
 		oldincludedir docdir infodir htmldir dvidir pdfdir psdir \
-		libdir localedir mandir runstatedir
+		libdir localedir mandir
 do
   eval ac_val=\$$ac_var
   # Remove trailing slashes.
@@ -1655,7 +1645,6 @@ Fine tuning of the installation directories:
   --sysconfdir=DIR        read-only single-machine data [PREFIX/etc]
   --sharedstatedir=DIR    modifiable architecture-independent data [PREFIX/com]
   --localstatedir=DIR     modifiable single-machine data [PREFIX/var]
-  --runstatedir=DIR       modifiable per-process data [LOCALSTATEDIR/run]
   --libdir=DIR            object code libraries [EPREFIX/lib]
   --includedir=DIR        C header files [PREFIX/include]
   --oldincludedir=DIR     C header files for non-gcc [/usr/include]
@@ -1697,11 +1686,14 @@ Optional Features:
   --enable-fast-install[=PKGS]
                           optimize for fast installation [default=yes]
   --disable-libtool-lock  avoid locking (might break parallel builds)
-  --enable-libbind	  deprecated
+  --enable-libbind        deprecated
-  --enable-warn-shadow	  turn on -Wshadow when compiling
+  --enable-buffer-useinline
-  --enable-warn-error	  turn on -Werror when compiling
+                          define ISC_BUFFER_USEINLINE when compiling
+                          [default=yes]
+  --enable-warn-shadow    turn on -Wshadow when compiling
+  --enable-warn-error     turn on -Werror when compiling
   --enable-developer      enable developer build settings
-  --enable-afl		  enable American Fuzzy Lop test harness [default=no]
+  --enable-afl            enable American Fuzzy Lop test harness [default=no]
   --enable-seccomp        enable support for libseccomp system call filtering
                           [default=no]
   --enable-kqueue         use BSD kqueue when available [default=yes]
@@ -1713,26 +1705,27 @@ Optional Features:
                           check OpenSSL version [default=yes]
   --enable-openssl-hash   use OpenSSL for hash functions [default=yes]
   --enable-crypto-rand    use the crypto provider for random [default=yes]
-  --enable-largefile	  64-bit file support
+  --enable-largefile      64-bit file support
   --enable-backtrace      log stack backtrace on abort [default=yes]
   --enable-symtable       use internal symbol table for backtrace
-			  [all|minimal(default)|none]
+                          [all|minimal(default)|none]
-  --enable-ipv6           use IPv6 default=autodetect
+  --enable-ipv6           use IPv6 [default=autodetect]
   --disable-tcp-fastopen  disable TCP Fast Open support [default=autodetect]
   --enable-getifaddrs     enable the use of getifaddrs() [yes|no].
   --disable-isc-spnego    use SPNEGO from GSSAPI library
   --disable-chroot        disable chroot
-  --disable-linux-caps	  disable linux capabilities
+  --disable-linux-caps    disable linux capabilities
-  --enable-atomic	  enable machine specific atomic operations
+  --enable-atomic         enable machine specific atomic operations
-			  [default=autodetect]
+                          [default=autodetect]
   --enable-fixed-rrset    enable fixed rrset ordering [default=no]
-  --disable-rpz-nsip	  disable rpz nsip rules [default=enabled]
+  --disable-rpz-nsip      disable rpz nsip rules [default=enabled]
-  --disable-rpz-nsdname	  disable rpz nsdname rules [default=enabled]
+  --disable-rpz-nsdname   disable rpz nsdname rules [default=enabled]
-  --enable-dnsrps-dl	  DNS Response Policy Service delayed link [default=$librpz_dl]
+  --enable-dnsrps-dl      DNS Response Policy Service delayed link
+                          [default=$librpz_dl]
   --enable-dnsrps         enable DNS Response Policy Service API
   --enable-dnstap         enable dnstap support (requires fstrm, protobuf-c)
   --enable-querytrace     enable very verbose query trace logging [default=no]
-  --enable-full-report	  report values of all configure options
+  --enable-full-report    report values of all configure options
 
 Optional Packages:
   --with-PACKAGE[=ARG]    use PACKAGE [ARG=yes]
@@ -1746,54 +1739,60 @@ Optional Packages:
   --with-python-install-dir=PATH
                           installation directory for Python modules
   --with-geoip=PATH       Build with GeoIP support (yes|no|path)
-  --with-gssapi=[PATH|[/path/]krb5-config]      Specify path for system-supplied GSSAPI [default=yes]
+  --with-gssapi=PATH|/path/krb5-config
+                          Specify path for system-supplied GSSAPI
+                          [default=yes]
   --with-randomdev=PATH   Specify path for random device
   --with-locktype=ARG     Specify mutex lock type (adaptive or standard)
   --with-libtool          use GNU libtool
-  --with-openssl=PATH     Build with OpenSSL yes|no|path.
+  --with-openssl=PATH     Build with OpenSSL [yes|no|path]. (Crypto is
-			  (Crypto is required for DNSSEC)
+                          required for DNSSEC)
-  --with-pkcs11=PATH      Build with PKCS11 support yes|no|path
+  --with-pkcs11=PATH      Build with PKCS11 support [yes|no|path] (PATH is for
-			  (PATH is for the PKCS11 provider)
+                          the PKCS11 provider)
   --with-ecdsa            Crypto ECDSA
-  --with-gost             Crypto GOST yes|no|raw|asn1.
+  --with-gost             Crypto GOST [yes|no|raw|asn1].
-  --with-eddsa            Crypto EDDSA yes|all|no.
+  --with-eddsa            Crypto EDDSA [yes|all|no].
   --with-aes              Crypto AES
-  --with-cc-alg=ALG      choose the algorithm for Client Cookie [aes|sha1|sha256]
+  --with-cc-alg=ALG       choose the algorithm for Client Cookie
-  --with-lmdb=PATH        build with LMDB library yes|no|path
+                          [aes|sha1|sha256]
-  --with-libxml2=PATH     build with libxml2 library yes|no|path
+  --with-lmdb=PATH        build with LMDB library [yes|no|path]
-  --with-libjson=PATH     build with libjson0 library yes|no|path
+  --with-libxml2=PATH     build with libxml2 library [yes|no|path]
+  --with-libjson=PATH     build with libjson0 library [yes|no|path]
   --with-zlib=PATH        build with zlib for HTTP compression [default=yes]
   --with-purify=PATH      use Rational purify
-  --with-gperftools-profiler  use gperftools CPU profiler
+  --with-gperftools-profiler
-  --with-kame=PATH	  use Kame IPv6 default path /usr/local/v6
+                          use gperftools CPU profiler
-  --with-readline=LIBSPEC    specify readline library default auto
+  --with-kame=PATH        use Kame IPv6 [default path /usr/local/v6]
+  --with-readline=LIBSPEC specify readline library [default auto]
 
-  --with-dnsrps-libname  DNSRPS provider library name (librpz.so)
+  --with-dnsrps-libname   DNSRPS provider library name (librpz.so)
-  --with-dnsrps-dir	  path to DNSRPS provider library
+  --with-dnsrps-dir       path to DNSRPS provider library
   --with-protobuf-c=path  Path where protobuf-c is installed, for dnstap
   --with-libfstrm=path    Path where libfstrm is installed, for dnstap
   --with-docbook-xsl=PATH specify path for Docbook-XSL stylesheets
-  --with-idn=MPREFIX      enable IDN support using idnkit default PREFIX
+  --with-idn=MPREFIX      enable IDN support using idnkit [default PREFIX]
-  --with-libiconv=IPREFIX GNU libiconv are in IPREFIX default PREFIX
+  --with-libiconv=IPREFIX GNU libiconv are in IPREFIX [default PREFIX]
-  --with-iconv=LIBSPEC    specify iconv library default -liconv
+  --with-iconv=LIBSPEC    specify iconv library [default -liconv]
   --with-idnlib=ARG       specify libidnkit
-  --with-atf=ARG          support Automated Test Framework
+  --with-atf              support Automated Test Framework
   --with-tuning=ARG       Specify server tuning (large or default)
   --with-dlopen=ARG       support dynamically loadable DLZ drivers
-  --with-dlz-postgres=PATH   Build with Postgres DLZ driver yes|no|path.
+  --with-dlz-postgres=PATH
-			       (Required to use Postgres with DLZ)
+                          Build with Postgres DLZ driver [yes|no|path].
-  --with-dlz-mysql=PATH   Build with MySQL DLZ driver yes|no|path.
+                          (Required to use Postgres with DLZ)
-			       (Required to use MySQL with DLZ)
+  --with-dlz-mysql=PATH   Build with MySQL DLZ driver [yes|no|path]. (Required
-  --with-dlz-bdb=PATH   Build with Berkeley DB DLZ driver yes|no|path.
+                          to use MySQL with DLZ)
-			       (Required to use Berkeley DB with DLZ)
+  --with-dlz-bdb=PATH     Build with Berkeley DB DLZ driver [yes|no|path].
-  --with-dlz-filesystem=ARG    Build with filesystem DLZ driver yes|no.
+                          (Required to use Berkeley DB with DLZ)
-			       (Required to use file system driver with DLZ)
+  --with-dlz-filesystem=ARG
-  --with-dlz-ldap=PATH   Build with LDAP DLZ driver yes|no|path.
+                          Build with filesystem DLZ driver [yes|no]. (Required
-			       (Required to use LDAP with DLZ)
+                          to use file system driver with DLZ)
-  --with-dlz-odbc=PATH   Build with ODBC DLZ driver yes|no|path.
+  --with-dlz-ldap=PATH    Build with LDAP DLZ driver [yes|no|path]. (Required
-			       (Required to use ODBC with DLZ)
+                          to use LDAP with DLZ)
-  --with-dlz-stub=ARG    Build with stub DLZ driver yes|no.
+  --with-dlz-odbc=PATH    Build with ODBC DLZ driver [yes|no|path]. (Required
-			       (Required to use stub driver with DLZ)
+                          to use ODBC with DLZ)
+  --with-dlz-stub=ARG     Build with stub DLZ driver [yes|no]. (Required to
+                          use stub driver with DLZ)
   --with-make-clean       run "make clean" at end of configure [yes|no]
 
 Some influential environment variables:
@@ -11456,6 +11455,20 @@ It is available from http://www.isc.org as a separate download." "$LINENO" 5
 		;;
 esac
 
+# Check whether --enable-buffer_useinline was given.
+if test "${enable_buffer_useinline+set}" = set; then :
+  enableval=$enable_buffer_useinline; if test yes = "${enable}"
+	      then
+
+$as_echo "#define ISC_BUFFER_USEINLINE 1" >>confdefs.h
+
+	      fi
+else
+  $as_echo "#define ISC_BUFFER_USEINLINE 1" >>confdefs.h
+
+fi
+
+
 # Check whether --enable-warn_shadow was given.
 if test "${enable_warn_shadow+set}" = set; then :
   enableval=$enable_warn_shadow;
@@ -11937,24 +11950,24 @@ $as_echo_n "checking python2 version >= 2.7 or python3 version >= 3.2... " >&6;
 				if ${PYTHON:-false} -c "$testminvers"; then
 					{ $as_echo "$as_me:${as_lineno-$LINENO}: result: found" >&5
 $as_echo "found" >&6; }
-                                else
+				else
-                                        { $as_echo "$as_me:${as_lineno-$LINENO}: result: not found" >&5
+					{ $as_echo "$as_me:${as_lineno-$LINENO}: result: not found" >&5
 $as_echo "not found" >&6; }
-                                        unset ac_cv_path_PYTHON
+					unset ac_cv_path_PYTHON
-                                        unset PYTHON
+					unset PYTHON
-                                        continue
+					continue
 				fi
 				{ $as_echo "$as_me:${as_lineno-$LINENO}: checking python module 'argparse'" >&5
 $as_echo_n "checking python module 'argparse'... " >&6; }
 				if ${PYTHON:-false} -c "$testargparse"; then
 					{ $as_echo "$as_me:${as_lineno-$LINENO}: result: found" >&5
 $as_echo "found" >&6; }
-                                else
+				else
-                                        { $as_echo "$as_me:${as_lineno-$LINENO}: result: not found" >&5
+					{ $as_echo "$as_me:${as_lineno-$LINENO}: result: not found" >&5
 $as_echo "not found" >&6; }
-                                        unset ac_cv_path_PYTHON
+					unset ac_cv_path_PYTHON
-                                        unset PYTHON
+					unset PYTHON
-                                        continue
+					continue
 				fi
 
 				{ $as_echo "$as_me:${as_lineno-$LINENO}: checking python module 'ply'" >&5
@@ -11963,11 +11976,11 @@ $as_echo_n "checking python module 'ply'... " >&6; }
 					{ $as_echo "$as_me:${as_lineno-$LINENO}: result: found" >&5
 $as_echo "found" >&6; }
 					break
-                                else
+				else
-                                        { $as_echo "$as_me:${as_lineno-$LINENO}: result: not found" >&5
+					{ $as_echo "$as_me:${as_lineno-$LINENO}: result: not found" >&5
 $as_echo "not found" >&6; }
-                                        unset ac_cv_path_PYTHON
+					unset ac_cv_path_PYTHON
-                                        unset PYTHON
+					unset PYTHON
 				fi
 			done
 			if test "X$PYTHON" != "X"
@@ -13394,12 +13407,12 @@ _ACEOF
 if ac_fn_c_try_compile "$LINENO"; then :
   { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
 $as_echo "yes" >&6; }
-         $as_echo "#define HAVE_UNAME 1" >>confdefs.h
+	 $as_echo "#define HAVE_UNAME 1" >>confdefs.h
 
 else
   { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
 $as_echo "no" >&6; }
-         { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: uname is not correctly supported" >&5
+	 { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: uname is not correctly supported" >&5
 $as_echo "$as_me: WARNING: uname is not correctly supported" >&2;}
 fi
 rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
@@ -15459,12 +15472,12 @@ else
 fi
 
 
-        case "$locktype" in
+	case "$locktype" in
-                adaptive)
+		adaptive)
-                        { $as_echo "$as_me:${as_lineno-$LINENO}: checking for PTHREAD_MUTEX_ADAPTIVE_NP" >&5
+			{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for PTHREAD_MUTEX_ADAPTIVE_NP" >&5
 $as_echo_n "checking for PTHREAD_MUTEX_ADAPTIVE_NP... " >&6; }
 
-                        cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+			cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 /* end confdefs.h.  */
 
 			  #ifndef _GNU_SOURCE
@@ -15493,15 +15506,15 @@ else
 $as_echo "using standard lock type" >&6; }
 fi
 rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
-                        ;;
+			;;
-                standard)
+		standard)
-                        { $as_echo "$as_me:${as_lineno-$LINENO}: result: using standard lock type" >&5
+			{ $as_echo "$as_me:${as_lineno-$LINENO}: result: using standard lock type" >&5
 $as_echo "using standard lock type" >&6; }
-                        ;;
+			;;
-                *)
+		*)
-                        as_fn_error $? "You must specify \"adaptive\" or \"standard\" for --with-locktype." "$LINENO" 5
+			as_fn_error $? "You must specify \"adaptive\" or \"standard\" for --with-locktype." "$LINENO" 5
-                        ;;
+			;;
-        esac
+	esac
 
 	for ac_header in sched.h
 do :
@@ -15980,7 +15993,7 @@ If you do not want OpenSSL, use --without-openssl" "$LINENO" 5
 	*)
 		if test "yes" = "$want_native_pkcs11"
 		then
-                        { $as_echo "$as_me:${as_lineno-$LINENO}: result: " >&5
+			{ $as_echo "$as_me:${as_lineno-$LINENO}: result: " >&5
 $as_echo "" >&6; }
 			as_fn_error $? "OpenSSL and native PKCS11 cannot be used together." "$LINENO" 5
 		fi
@@ -16504,7 +16517,7 @@ $as_echo_n "checking for OpenSSL AES support... " >&6; }
 	if test "$cross_compiling" = yes; then :
   { $as_echo "$as_me:${as_lineno-$LINENO}: result: using --with-aes" >&5
 $as_echo "using --with-aes" >&6; }
-         # Expect cross-compiling with a modern OpenSSL
+	 # Expect cross-compiling with a modern OpenSSL
 	 have_aes="evp"
 else
   cat confdefs.h - <<_ACEOF >conftest.$ac_ext
@@ -17251,8 +17264,8 @@ then
 $as_echo "#define HAVE_LMDB 1" >>confdefs.h
 
 	NZD_TOOLS="nzd"
-        NZDSRCS='${NZDSRCS}'
+	NZDSRCS='${NZDSRCS}'
-        NZDTARGETS='${NZDTARGETS}'
+	NZDTARGETS='${NZDTARGETS}'
 fi
 
 
@@ -17520,7 +17533,7 @@ case "$with_zlib" in
 		done
 		;;
 	*)
-		if test -f "${with_zlib}/zlib.h"
+		if test -f "${with_zlib}/include/zlib.h"
 		then
 			zlib_cflags="-I${with_zlib}/include"
 			LIBS="$LIBS -L${with_zlib}/lib"
@@ -19383,11 +19396,11 @@ else
 
 #include <stdio.h>
 main() {
-        size_t j = 0;
+	size_t j = 0;
-        char buf[100];
+	char buf[100];
-        buf[0] = 0;
+	buf[0] = 0;
-        sprintf(buf, "%zu", j);
+	sprintf(buf, "%zu", j);
-        exit(strcmp(buf, "0") != 0);
+	exit(strcmp(buf, "0") != 0);
 }
 
 _ACEOF
@@ -19399,9 +19412,9 @@ else
 $as_echo "no" >&6; }
 	ISC_PRINT_OBJS="print.$O"
 	ISC_PRINT_SRCS="print.c"
-        ISC_PLATFORM_NEEDPRINTF='#define ISC_PLATFORM_NEEDPRINTF 1'
+	ISC_PLATFORM_NEEDPRINTF='#define ISC_PLATFORM_NEEDPRINTF 1'
-        ISC_PLATFORM_NEEDFPRINTF='#define ISC_PLATFORM_NEEDFPRINTF 1'
+	ISC_PLATFORM_NEEDFPRINTF='#define ISC_PLATFORM_NEEDFPRINTF 1'
-        ISC_PLATFORM_NEEDFSRINTF='#define ISC_PLATFORM_NEEDSPRINTF 1'
+	ISC_PLATFORM_NEEDFSRINTF='#define ISC_PLATFORM_NEEDSPRINTF 1'
 	ISC_PLATFORM_NEEDVSNPRINTF="#define ISC_PLATFORM_NEEDVSNPRINTF 1"
 fi
 rm -f core *.core core.conftest.* gmon.out bb.out conftest$ac_exeext \
@@ -19730,11 +19743,11 @@ _ACEOF
 if ac_fn_c_try_compile "$LINENO"; then :
   { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
 $as_echo "yes" >&6; }
-        ISC_PLATFORM_HAVESTATNSEC="#define ISC_PLATFORM_HAVESTATNSEC 1"
+	ISC_PLATFORM_HAVESTATNSEC="#define ISC_PLATFORM_HAVESTATNSEC 1"
 else
   { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
 $as_echo "no" >&6; }
-        ISC_PLATFORM_HAVESTATNSEC="#undef ISC_PLATFORM_HAVESTATNSEC"
+	ISC_PLATFORM_HAVESTATNSEC="#undef ISC_PLATFORM_HAVESTATNSEC"
 fi
 rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
 
@@ -20141,6 +20154,7 @@ done
 #
 # Machine architecture dependent features
 #
+have_stdatomic=no
 for ac_header in stdatomic.h
 do :
   ac_fn_c_check_header_mongrel "$LINENO" "stdatomic.h" "ac_cv_header_stdatomic_h" "$ac_includes_default"
@@ -20148,9 +20162,11 @@ if test "x$ac_cv_header_stdatomic_h" = xyes; then :
   cat >>confdefs.h <<_ACEOF
 #define HAVE_STDATOMIC_H 1
 _ACEOF
- ISC_PLATFORM_HAVESTDATOMIC="#define ISC_PLATFORM_HAVESTDATOMIC 1"
+ have_stdatomic=yes
+		  ISC_PLATFORM_HAVESTDATOMIC="#define ISC_PLATFORM_HAVESTDATOMIC 1"
 else
-  ISC_PLATFORM_HAVESTDATOMIC="#undef ISC_PLATFORM_HAVESTDATOMIC"
+  have_stdatomic=no
+		  ISC_PLATFORM_HAVESTDATOMIC="#undef ISC_PLATFORM_HAVESTDATOMIC"
 fi
 
 done
@@ -20231,12 +20247,42 @@ rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
 		esac
 		;;
 	no)
+		have_stdatomic=no
 		ISC_PLATFORM_HAVESTDATOMIC="#undef ISC_PLATFORM_HAVESTDATOMIC"
 		use_atomic=no
 		arch=noatomic
 		;;
 esac
 
+if test "X$have_stdatomic" = "Xyes"; then
+    { $as_echo "$as_me:${as_lineno-$LINENO}: checking if -latomic is needed to use 64-bit stdatomic.h primitives" >&5
+$as_echo_n "checking if -latomic is needed to use 64-bit stdatomic.h primitives... " >&6; }
+    cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+/* end confdefs.h.  */
+#include <stdatomic.h>
+int
+main ()
+{
+atomic_int_fast64_t val = 0; atomic_fetch_add_explicit(&val, 1, memory_order_relaxed);
+  ;
+  return 0;
+}
+_ACEOF
+if ac_fn_c_try_link "$LINENO"; then :
+  { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
+$as_echo "no" >&6; }
+	 ISC_ATOMIC_LIBS=""
+else
+  { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
+$as_echo "yes" >&6; }
+	 ISC_ATOMIC_LIBS="-latomic"
+
+fi
+rm -f core conftest.err conftest.$ac_objext \
+    conftest$ac_exeext conftest.$ac_ext
+    LIBS="$LIBS $ISC_ATOMIC_LIBS"
+fi
+
 
 
 ISC_PLATFORM_USEOSFASM="#undef ISC_PLATFORM_USEOSFASM"
@@ -20486,7 +20532,7 @@ int
 main ()
 {
 
-        return (__builtin_expect(1, 1) ? 1 : 0);
+	return (__builtin_expect(1, 1) ? 1 : 0);
 
   ;
   return 0;
@@ -20494,14 +20540,14 @@ main ()
 _ACEOF
 if ac_fn_c_try_link "$LINENO"; then :
 
-        have_builtin_expect=yes
+	have_builtin_expect=yes
-        { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
+	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
 $as_echo "yes" >&6; }
 
 else
 
-        have_builtin_expect=no
+	have_builtin_expect=no
-        { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
+	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
 $as_echo "no" >&6; }
 
 fi
@@ -20525,7 +20571,7 @@ int
 main ()
 {
 
-        return (__builtin_clz(0xff) == 24 ? 1 : 0);
+	return (__builtin_clz(0xff) == 24 ? 1 : 0);
 
   ;
   return 0;
@@ -20533,14 +20579,14 @@ main ()
 _ACEOF
 if ac_fn_c_try_link "$LINENO"; then :
 
-        have_builtin_clz=yes
+	have_builtin_clz=yes
-        { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
+	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
 $as_echo "yes" >&6; }
 
 else
 
-        have_builtin_clz=no
+	have_builtin_clz=no
-        { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
+	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
 $as_echo "no" >&6; }
 
 fi
@@ -20942,9 +20988,9 @@ else
 fi
 
 if test "x$enable_dnsrps" != "xno"; then
-        if test "x$dnsrps_avail" != "xyes"; then
+	if test "x$dnsrps_avail" != "xyes"; then
-                as_fn_error $? "dlopen and librpz.so needed for DNSRPS" "$LINENO" 5
+		as_fn_error $? "dlopen and librpz.so needed for DNSRPS" "$LINENO" 5
-        fi
+	fi
 	if test "x$dnsrps_lib_open" = "x0"; then
 		as_fn_error $? "dlopen and librpz.so needed for DNSRPS" "$LINENO" 5
 	fi
@@ -22212,7 +22258,7 @@ if test "no" != "$atf"; then
 $as_echo "#define ATF_TEST 1" >>confdefs.h
 
 	STD_CINCLUDES="$STD_CINCLUDES -I$atf/include"
-        STD_CDEFINES="$STD_CDEFINES -DNS_HOOKS_ENABLE=1"
+	STD_CDEFINES="$STD_CDEFINES -DNS_HOOKS_ENABLE=1"
 	ATFBIN="$atf/bin"
 	ATFLIBS="-L$atf/lib -latf-c"
 	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for exp in -lm" >&5
@@ -22874,7 +22920,11 @@ else
 fi
 
 
-for ac_prog in mysql_config
+mysql_include=""
+mysql_lib=""
+if test "$use_dlz_mysql" = "yes"
+then
+	for ac_prog in mysql_config
 do
   # Extract the first word of "$ac_prog", so it can be a program name with args.
 set dummy $ac_prog; ac_word=$2
@@ -22916,11 +22966,6 @@ fi
   test -n "$MYSQL_CONFIG" && break
 done
 
-
-mysql_include=""
-mysql_lib=""
-if test "$use_dlz_mysql" = "yes"
-then
 	if test -n "$MYSQL_CONFIG"
 	then
 		mysql_include=`${MYSQL_CONFIG} --include`
@@ -26157,9 +26202,9 @@ yes)
 	then
 		if test "yes" = "$silent"
 		then
-                        make clean > /dev/null
+			make clean > /dev/null
-                else
+		else
-                        make clean
+			make clean
 		fi
 	fi
 	;;
@@ -26177,84 +26222,84 @@ report() {
     echo "-------------------------------------------------------------------------------"
     echo "Optional features enabled:"
     if $use_threads; then
-        echo "    Multiprocessing support (--enable-threads)"
+	echo "    Multiprocessing support (--enable-threads)"
-        if test "yes" = "$enable_full_report" -o "standard" = "$locktype"; then
+	if test "yes" = "$enable_full_report" -o "standard" = "$locktype"; then
-            echo "        Mutex lock type: $locktype"
+	    echo "        Mutex lock type: $locktype"
-        fi
+	fi
     fi
     test "large" = "$use_tuning" && echo "    Large-system tuning (--with-tuning)"
     test "no" = "$use_dnstap" || \
-            echo "    Allow 'dnstap' packet logging (--enable-dnstap)"
+	    echo "    Allow 'dnstap' packet logging (--enable-dnstap)"
     test "no" = "$use_geoip" || echo "    GeoIP access control (--with-geoip)"
     test "no" = "$use_gssapi" || echo "    GSS-API (--with-gssapi)"
     if test "yes" = "$enable_full_report" -o "aes" != "$with_cc_alg"; then
-        echo "        Algorithm: $with_cc_alg"
+	echo "        Algorithm: $with_cc_alg"
     fi
 
     # these lines are only printed if run with --enable-full-report
     if test "yes" = "$enable_full_report"; then
-        test "no" = "$enable_ipv6" -o "no" = "$found_ipv6" || \
+	test "no" = "$enable_ipv6" -o "no" = "$found_ipv6" || \
-            echo "    IPv6 support (--enable-ipv6)"
+	    echo "    IPv6 support (--enable-ipv6)"
-        test "X$CRYPTO" = "X" -o "yes" = "$want_native_pkcs11" || \
+	test "X$CRYPTO" = "X" -o "yes" = "$want_native_pkcs11" || \
-                echo "    OpenSSL cryptography/DNSSEC (--with-openssl)"
+		echo "    OpenSSL cryptography/DNSSEC (--with-openssl)"
-        test "no" = "$want_crypto_rand" || \
+	test "no" = "$want_crypto_rand" || \
-                echo "    Crypto provider entropy source (--enable-crypto-rand)"
+		echo "    Crypto provider entropy source (--enable-crypto-rand)"
-        test "X$PYTHON" = "X" || echo "    Python tools (--with-python)"
+	test "X$PYTHON" = "X" || echo "    Python tools (--with-python)"
-        test "X$XMLSTATS" = "X" || echo "    XML statistics (--with-libxml2)"
+	test "X$XMLSTATS" = "X" || echo "    XML statistics (--with-libxml2)"
-        test "X$JSONSTATS" = "X" || echo "    JSON statistics (--with-libjson)"
+	test "X$JSONSTATS" = "X" || echo "    JSON statistics (--with-libjson)"
-        test "X$ZLIB" = "X" || echo "    HTTP zlib compression (--with-zlib)"
+	test "X$ZLIB" = "X" || echo "    HTTP zlib compression (--with-zlib)"
-        test "X$NZD_TOOLS" = "X" || echo "    LMDB database to store configuration for 'addzone' zones (--with-lmdb)"
+	test "X$NZD_TOOLS" = "X" || echo "    LMDB database to store configuration for 'addzone' zones (--with-lmdb)"
     fi
 
     if test "no" != "$use_pkcs11"; then
-        if test "yes" = "$want_native_pkcs11"; then
+	if test "yes" = "$want_native_pkcs11"; then
-            echo "    Native PKCS#11/Cryptoki support (--enable-native-pkcs11)"
+	    echo "    Native PKCS#11/Cryptoki support (--enable-native-pkcs11)"
-        else
+	else
-            echo "    PKCS#11/Cryptoki support using OpenSSL (--with-pkcs11)"
+	    echo "    PKCS#11/Cryptoki support using OpenSSL (--with-pkcs11)"
-        fi
+	fi
-        echo "        Provider library: $PKCS11_PROVIDER"
+	echo "        Provider library: $PKCS11_PROVIDER"
     fi
     if test "yes" = "$OPENSSL_GOST" -o "yes" = "$PKCS11_GOST"; then
-        echo "    GOST algorithm support (encoding: $gosttype) (--with-gost)"
+	echo "    GOST algorithm support (encoding: $gosttype) (--with-gost)"
     fi
     test "yes" = "$OPENSSL_ECDSA" -o "$PKCS11_ECDSA" && \
-        echo "    ECDSA algorithm support (--with-ecdsa)"
+	echo "    ECDSA algorithm support (--with-ecdsa)"
     test "yes" = "$OPENSSL_ED25519" -o "$PKCS11_ED25519" && \
-        echo "    EDDSA algorithm support (--with-eddsa)"
+	echo "    EDDSA algorithm support (--with-eddsa)"
     test "yes" = "$enable_dnsrps" && \
-        echo "    DNS Response Policy Service interface (--enable-dnsrps)"
+	echo "    DNS Response Policy Service interface (--enable-dnsrps)"
     test "yes" = "$enable_fixed" && \
-        echo "    Allow 'fixed' rrset-order (--enable-fixed-rrset)"
+	echo "    Allow 'fixed' rrset-order (--enable-fixed-rrset)"
     test "yes" = "$enable_seccomp" && \
-        echo "    Use libseccomp system call filtering (--enable-seccomp)"
+	echo "    Use libseccomp system call filtering (--enable-seccomp)"
     test "yes" = "$want_backtrace" && \
-        echo "    Print backtrace on crash (--enable-backtrace)"
+	echo "    Print backtrace on crash (--enable-backtrace)"
     test "minimal" = "$want_symtable" && \
-        echo "    Use symbol table for backtrace, named only (--enable-symtable)"
+	echo "    Use symbol table for backtrace, named only (--enable-symtable)"
     test "yes" = "$want_symtable" -o "all" = "$want_symtable" && \
-        echo "    Use symbol table for backtrace, all binaries (--enable-symtable=all)"
+	echo "    Use symbol table for backtrace, all binaries (--enable-symtable=all)"
     test "no" = "$use_libtool" || echo "    Use GNU libtool (--with-libtool)"
     test "yes" = "$want_querytrace" && \
-        echo "    Very verbose query trace logging (--enable-querytrace)"
+	echo "    Very verbose query trace logging (--enable-querytrace)"
     test "no" = "$atf" || echo "    Automated Testing Framework (--with-atf)"
 
     echo "    Cryptographic library for DNSSEC: $CRYPTOLIB"
 
     echo "    Dynamically loadable zone (DLZ) drivers:"
     test "no" = "$use_dlz_bdb" || \
-        echo "        Berkeley DB (--with-dlz-bdb)"
+	echo "        Berkeley DB (--with-dlz-bdb)"
     test "no" = "$use_dlz_ldap" || \
-        echo "        LDAP (--with-dlz-ldap)"
+	echo "        LDAP (--with-dlz-ldap)"
     test "no" = "$use_dlz_mysql" || \
-        echo "        MySQL (--with-dlz-mysql)"
+	echo "        MySQL (--with-dlz-mysql)"
     test "no" = "$use_dlz_odbc" || \
-        echo "        ODBC (--with-dlz-odbc)"
+	echo "        ODBC (--with-dlz-odbc)"
     test "no" = "$use_dlz_postgres" || \
-        echo "        Postgres (--with-dlz-postgres)"
+	echo "        Postgres (--with-dlz-postgres)"
     test "no" = "$use_dlz_filesystem" || \
-        echo "        Filesystem (--with-dlz-filesystem)"
+	echo "        Filesystem (--with-dlz-filesystem)"
     test "no" = "$use_dlz_stub" || \
-        echo "        Stub (--with-dlz-stub)"
+	echo "        Stub (--with-dlz-stub)"
     test "$use_dlz_bdb $use_dlz_ldap $use_dlz_mysql $use_dlz_odbc $use_dlz_postgres $use_dlz_filesystem $use_dlz_stub" = "no no no no no no no" && echo "        None"
 
     echo "-------------------------------------------------------------------------------"
@@ -26262,43 +26307,43 @@ report() {
     echo "Features disabled or unavailable on this platform:"
     $use_threads || echo "    Multiprocessing support (--enable-threads)"
     test "no" = "$enable_ipv6" -o "no" = "$found_ipv6" && \
-            echo "    IPv6 support (--enable-ipv6)"
+	    echo "    IPv6 support (--enable-ipv6)"
     test "large" = "$use_tuning" || echo "    Large-system tuning (--with-tuning)"
 
     test "no" = "$use_dnstap" && \
-            echo "    Allow 'dnstap' packet logging (--enable-dnstap)"
+	    echo "    Allow 'dnstap' packet logging (--enable-dnstap)"
     test "no" = "$use_geoip" && echo "    GeoIP access control (--with-geoip)"
     test "no" = "$use_gssapi" && echo "    GSS-API (--with-gssapi)"
 
     test "no" = "$enable_dnsrps" && \
-        echo "    DNS Response Policy Service interface (--enable-dnsrps)"
+	echo "    DNS Response Policy Service interface (--enable-dnsrps)"
 
     test "yes" = "$enable_fixed" || \
-        echo "    Allow 'fixed' rrset-order (--enable-fixed-rrset)"
+	echo "    Allow 'fixed' rrset-order (--enable-fixed-rrset)"
 
     if test "X$CRYPTO" = "X" -o "yes" = "$want_native_pkcs11"
     then
-        echo "    OpenSSL cryptography/DNSSEC (--with-openssl)"
+	echo "    OpenSSL cryptography/DNSSEC (--with-openssl)"
     elif test "no" = "$use_pkcs11"; then
-        echo "    PKCS#11/Cryptoki support (--with-pkcs11)"
+	echo "    PKCS#11/Cryptoki support (--with-pkcs11)"
     fi
     test "yes" = "$want_native_pkcs11" ||
-        echo "    Native PKCS#11/Cryptoki support (--enable-native-pkcs11)"
+	echo "    Native PKCS#11/Cryptoki support (--enable-native-pkcs11)"
     test "X$CRYPTO" = "X" -o "yes" = "$OPENSSL_GOST" -o "yes" = "$PKCS11_GOST" || \
-        echo "    GOST algorithm support (--with-gost)"
+	echo "    GOST algorithm support (--with-gost)"
     test "X$CRYPTO" = "X" -o "yes" = "$OPENSSL_ECDSA" -o "yes" = "$PKCS11_ECDSA" || \
-        echo "    ECDSA algorithm support (--with-ecdsa)"
+	echo "    ECDSA algorithm support (--with-ecdsa)"
     test "X$CRYPTO" = "X" -o "yes" = "$OPENSSL_ED25519" -o "yes" = "$PKCS11_ED25519" || \
-        echo "    EDDSA algorithm support (--with-eddsa)"
+	echo "    EDDSA algorithm support (--with-eddsa)"
     test "yes" = "$want_crypto_rand" || \
-        echo "    Crypto provider entropy source (--enable-crypto-rand)"
+	echo "    Crypto provider entropy source (--enable-crypto-rand)"
 
     test "yes" = "$enable_seccomp" || \
-        echo "    Use libseccomp system call filtering (--enable-seccomp)"
+	echo "    Use libseccomp system call filtering (--enable-seccomp)"
     test "yes" = "$want_backtrace" || \
-        echo "    Print backtrace on crash (--enable-backtrace)"
+	echo "    Print backtrace on crash (--enable-backtrace)"
     test "yes" = "$want_querytrace" || \
-        echo "    Very verbose query trace logging (--enable-querytrace)"
+	echo "    Very verbose query trace logging (--enable-querytrace)"
 
     test "yes" = "$use_libtool" || echo "    Use GNU libtool (--with-libtool)"
     test "no" = "$atf" && echo "    Automated Testing Framework (--with-atf)"
@@ -26317,20 +26362,20 @@ report() {
 
 
     if test "X$ac_unrecognized_opts" != "X"; then
-        echo
+	echo
-        echo "Unrecognized options:"
+	echo "Unrecognized options:"
-        echo "    $ac_unrecognized_opts"
+	echo "    $ac_unrecognized_opts"
     fi
 
     if test "yes" != "$enable_full_report"; then
-        echo "-------------------------------------------------------------------------------"
+	echo "-------------------------------------------------------------------------------"
-        echo "For more detail, use --enable-full-report."
+	echo "For more detail, use --enable-full-report."
     fi
     echo "==============================================================================="
 }
 
 if test "yes" != "$silent"; then
-        report
+	report
 fi
 
 if test "X$CRYPTO" = "X"; then

contrib/dlz/config.dlz.in

@@ -57,8 +57,9 @@ AC_DEFUN(DLZ_ADD_DRIVER, [
 
 AC_MSG_CHECKING(for Postgres DLZ driver)
 AC_ARG_WITH(dlz_postgres,
-[  --with-dlz-postgres[=PATH]   Build with Postgres DLZ driver [yes|no|path].
+	    AS_HELP_STRING([--with-dlz-postgres[=PATH]],
-			       (Required to use Postgres with DLZ)],
+			   [Build with Postgres DLZ driver [yes|no|path].
+			       (Required to use Postgres with DLZ)]),
     use_dlz_postgres="$withval", use_dlz_postgres="no")
 
 if test "$use_dlz_postgres" != "no"
@@ -126,16 +127,16 @@ esac
 
 AC_MSG_CHECKING(for MySQL DLZ driver)
 AC_ARG_WITH(dlz_mysql,
-[  --with-dlz-mysql[=PATH]   Build with MySQL DLZ driver [yes|no|path].
+	    AS_HELP_STRING([--with-dlz-mysql[=PATH]],
-			       (Required to use MySQL with DLZ)],
+		           [Build with MySQL DLZ driver [yes|no|path].
+			       (Required to use MySQL with DLZ)]),
     use_dlz_mysql="$withval", use_dlz_mysql="no")
 
-AC_CHECK_PROGS(MYSQL_CONFIG, mysql_config)
-
 mysql_include=""
 mysql_lib=""
 if test "$use_dlz_mysql" = "yes"
 then
+	AC_CHECK_PROGS(MYSQL_CONFIG, mysql_config)
 	if test -n "$MYSQL_CONFIG"
 	then
 		mysql_include=`${MYSQL_CONFIG} --include`
@@ -232,8 +233,9 @@ esac
 
 AC_MSG_CHECKING(for Berkeley DB DLZ driver...)
 AC_ARG_WITH(dlz_bdb,
-[  --with-dlz-bdb[=PATH]   Build with Berkeley DB DLZ driver [yes|no|path].
+	    AS_HELP_STRING([--with-dlz-bdb[=PATH]],
-			       (Required to use Berkeley DB with DLZ)],
+			   [Build with Berkeley DB DLZ driver [yes|no|path].
+			       (Required to use Berkeley DB with DLZ)]),
     use_dlz_bdb="$withval", use_dlz_bdb="no")
 
 case "$use_dlz_bdb" in
@@ -356,8 +358,9 @@ esac
 
 AC_MSG_CHECKING(for file system DLZ driver)
 AC_ARG_WITH(dlz_filesystem,
-[  --with-dlz-filesystem[=ARG]    Build with filesystem DLZ driver [yes|no].
+	    AS_HELP_STRING([--with-dlz-filesystem[=ARG]],
-			       (Required to use file system driver with DLZ)],
+			   [Build with filesystem DLZ driver [yes|no].
+			       (Required to use file system driver with DLZ)]),
     use_dlz_filesystem="$withval", use_dlz_filesystem="no")
 
 case "$use_dlz_filesystem" in
@@ -378,8 +381,9 @@ esac
 
 AC_MSG_CHECKING(for LDAP DLZ driver)
 AC_ARG_WITH(dlz_ldap,
-[  --with-dlz-ldap[=PATH]   Build with LDAP DLZ driver [yes|no|path].
+	    AS_HELP_STRING([--with-dlz-ldap[=PATH]],
-			       (Required to use LDAP with DLZ)],
+			   [Build with LDAP DLZ driver [yes|no|path].
+			       (Required to use LDAP with DLZ)]),
     use_dlz_ldap="$withval", use_dlz_ldap="no")
 
 if test "$use_dlz_ldap" = "yes"
@@ -424,8 +428,9 @@ esac
 
 AC_MSG_CHECKING(for ODBC DLZ driver)
 AC_ARG_WITH(dlz_odbc,
-[  --with-dlz-odbc[=PATH]   Build with ODBC DLZ driver [yes|no|path].
+	    AS_HELP_STRING([--with-dlz-odbc[=PATH]],
-			       (Required to use ODBC with DLZ)],
+			   [Build with ODBC DLZ driver [yes|no|path].
+			       (Required to use ODBC with DLZ)]),
     use_dlz_odbc="$withval", use_dlz_odbc="no")
 
 if test "$use_dlz_odbc" = "yes"
@@ -481,8 +486,9 @@ esac
 
 AC_MSG_CHECKING(for stub DLZ driver)
 AC_ARG_WITH(dlz_stub,
-[  --with-dlz-stub[=ARG]    Build with stub DLZ driver [yes|no].
+	    AS_HELP_STRING([--with-dlz-stub[=ARG]],
-			       (Required to use stub driver with DLZ)],
+			   [Build with stub DLZ driver [yes|no].
+			       (Required to use stub driver with DLZ)]),
     use_dlz_stub="$withval", use_dlz_stub="no")
 
 case "$use_dlz_stub" in

contrib/scripts/check5011.pl

@@ -43,7 +43,7 @@ sub printstatus ($) {
 	my $a = shift;
 	if ($a->{removehd} ne "19700101000000") {
 		printf " untrusted and to be removed at %s\n", ext8601 $a->{removehd};
-	} elsif ($a->{addhd} lt $now) {
+	} elsif ($a->{addhd} le $now) {
 		printf " trusted\n";
 	} else {
 		printf " waiting for %s\n", ext8601 $a->{addhd};

doc/arm/Bv9ARM-book.xml

@@ -397,14 +397,31 @@
 	  <para>
 	    The other authoritative servers, the <emphasis>slave</emphasis>
 	    servers (also known as <emphasis>secondary</emphasis> servers)
-	    load
+	    load the zone contents from another server using a replication
-	    the zone contents from another server using a replication process
+	    process known as a <emphasis>zone transfer</emphasis>.
-	    known as a <emphasis>zone transfer</emphasis>.  Typically the data
+	    Typically the data are transferred directly from the primary
-	    are
+	    master, but it is also possible to transfer it from another
-	    transferred directly from the primary master, but it is also
+	    slave.  In other words, a slave server may itself act as a
-	    possible
+	    master to a subordinate slave server.
-	    to transfer it from another slave.  In other words, a slave server
+	  </para>
-	    may itself act as a master to a subordinate slave server.
+	  <para>
+	    Periodically, the slave server must send a refresh query to
+	    determine whether the zone contents have been updated. This
+	    is done by sending a query for the zone's SOA record and
+	    checking whether the SERIAL field has been updated; if so,
+	    a new transfer request is initiated. The timing of these
+	    refresh queries is controlled by the SOA REFRESH and RETRY
+	    fields, but can be overrridden with the
+	    <command>max-refresh-time</command>,
+	    <command>min-refresh-time</command>,
+	    <command>max-retry-time</command>, and
+	    <command>min-retry-time</command> options.
+	  </para>
+	  <para>
+	    If the zone data cannot be updated within the time specified
+	    by the SOA EXPIRE option (up to a hard-coded maximum of
+	    24 weeks) then the slave zone expires and will no longer
+	    respond to queries.
 	  </para>
 	</section>
 
@@ -2340,8 +2357,6 @@ options {
 	  <para>
 	    The logged error reads "insecurity proof failed" and
 	    "got insecure response; parent indicates it should be secure".
-	    (Prior to BIND 9.7, the logged error was "not insecure".
-	    This referred to the zone, not the response.)
 	  </para>
 	</note>
       </section>
@@ -4309,6 +4324,7 @@ badresp:1,adberr:0,findfail:0,valfail:0]
   [ <command>maintain-ixfr-base</command> <replaceable>yes_or_no</replaceable> ; ]
   [ <command>ixfr-from-differences</command> ( <replaceable>yes_or_no</replaceable> | <option>master</option> | <option>slave</option> ) ; ]
   [ <command>auto-dnssec</command> ( <option>allow</option> | <option>maintain</option> | <option>off</option> ) ; ]
+  [ <command>inline-signing</command> <replaceable>yes_or_no</replaceable> ; ]
   [ <command>dnssec-enable</command> <replaceable>yes_or_no</replaceable> ; ]
   [ <command>dnssec-validation</command> ( <replaceable>yes_or_no</replaceable> | <option>auto</option> ) ; ]
   [ <command>dnssec-lookaside</command> ( <option>auto</option> | <option>no</option> | <replaceable>domain</replaceable> trust-anchor <replaceable>domain</replaceable> ) ; ]
@@ -4548,6 +4564,7 @@ badresp:1,adberr:0,findfail:0,valfail:0]
 	...
     <command>}</command> ; ]
   [ <command>v6-bias</command> <replaceable>number</replaceable> ; ]
+  [ <command>trust-anchor-telemetry</command> <replaceable>yes_or_no</replaceable> ; ]
 <command>}</command> ; ]
 </programlisting>
 
@@ -8830,7 +8847,7 @@ avoid-v6-udp-ports { 40000; range 50000 60000; };
 		  server waits on an idle TCP connection before closing
 		  it when the client is using the EDNS TCP keepalive
 		  option.  The default is 300 (30 seconds), the maximum
-		  is 1200 (two minutes), and the minimum is 1 (one tenth
+		  is 65535 (about 1.8 hours), and the minimum is 1 (one tenth
 		  of a second). Values above the maximum or below the minimum
 		  will be adjusted with a logged warning.
 		  This value may be greater than
@@ -8852,7 +8869,7 @@ avoid-v6-udp-ports { 40000; range 50000 60000; };
 		  keepalive option. This informs a client of the
 		  amount of time it may keep the session open.
 		  The default is 300 (30 seconds), the maximum is
-		  1200 (two minutes), and the minimum is 0, which
+		  65535 (about 1.8 hours), and the minimum is 0, which
 		  signals that the clients must close TCP connections
 		  immediately.  Ordinarily this should be set to the
 		  same value as <command>tcp-keepalive-timeout</command>.
@@ -9383,21 +9400,18 @@ avoid-v6-udp-ports { 40000; range 50000 60000; };
 	      <listitem>
 		<para>
 		  These options control the server's behavior on refreshing a
-		  zone
+		  zone (querying for SOA changes) or retrying failed
-		  (querying for SOA changes) or retrying failed transfers.
+		  transfers.  Usually the SOA values for the zone are used,
-		  Usually the SOA values for the zone are used, but these
+		  up to a hard-coded maximum expiry of 24 weeks. However,
-		  values
+		  these values are set by the master, giving slave server
-		  are set by the master, giving slave server administrators
+		  administrators little control over their contents.
-		  little
-		  control over their contents.
 		</para>
 		<para>
 		  These options allow the administrator to set a minimum and
 		  maximum refresh and retry time in seconds per-zone,
-		  per-view, or globally.
+		  per-view, or globally.  These options are valid for
-		  These options are valid for slave and stub zones,
+		  slave and stub zones, and clamp the SOA refresh and
-		  and clamp the SOA refresh and retry times to the specified
+		  retry times to the specified values.
-		  values.
 		</para>
 		<para>
 		  The following defaults apply.
@@ -11426,8 +11440,8 @@ example.com                 CNAME   rpz-tcp-only.
 	    A <command>managed-keys</command> statement contains a list of
 	    the keys to be managed, along with information about how the
 	    keys are to be initialized for the first time.  The only
-	    initialization method currently supported (as of
+	    initialization method currently supported is
-	    <acronym>BIND</acronym> 9.7.0) is <literal>initial-key</literal>.
+	    <literal>initial-key</literal>.
 	    This means the <command>managed-keys</command> statement must
 	    contain a copy of the initializing key.  (Future releases may
 	    allow keys to be initialized by other methods, eliminating this
@@ -18558,7 +18572,6 @@ allow-query { !{ !10/8; any; }; key example; };
       <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="../../bin/tools/dnstap-read.docbook"/>
       <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="../../bin/tools/genrandom.docbook"/>
       <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="../../bin/dig/host.docbook"/>
-      <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="../../bin/tools/isc-hmac-fixup.docbook"/>
       <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="../../bin/tools/mdig.docbook"/>
       <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="../../bin/check/named-checkconf.docbook"/>
       <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="../../bin/check/named-checkzone.docbook"/>

doc/arm/Bv9ARM.ch01.html

@@ -436,14 +436,31 @@
           <p>
             The other authoritative servers, the <span class="emphasis"><em>slave</em></span>
             servers (also known as <span class="emphasis"><em>secondary</em></span> servers)
-            load
+            load the zone contents from another server using a replication
-            the zone contents from another server using a replication process
+            process known as a <span class="emphasis"><em>zone transfer</em></span>.
-            known as a <span class="emphasis"><em>zone transfer</em></span>.  Typically the data
+            Typically the data are transferred directly from the primary
-            are
+            master, but it is also possible to transfer it from another
-            transferred directly from the primary master, but it is also
+            slave.  In other words, a slave server may itself act as a
-            possible
+            master to a subordinate slave server.
-            to transfer it from another slave.  In other words, a slave server
+          </p>
-            may itself act as a master to a subordinate slave server.
+          <p>
+            Periodically, the slave server must send a refresh query to
+            determine whether the zone contents have been updated. This
+            is done by sending a query for the zone's SOA record and
+            checking whether the SERIAL field has been updated; if so,
+            a new transfer request is initiated. The timing of these
+            refresh queries is controlled by the SOA REFRESH and RETRY
+            fields, but can be overrridden with the
+            <span class="command"><strong>max-refresh-time</strong></span>,
+            <span class="command"><strong>min-refresh-time</strong></span>,
+            <span class="command"><strong>max-retry-time</strong></span>, and
+            <span class="command"><strong>min-retry-time</strong></span> options.
+          </p>
+          <p>
+            If the zone data cannot be updated within the time specified
+            by the SOA EXPIRE option (up to a hard-coded maximum of
+            24 weeks) then the slave zone expires and will no longer
+            respond to queries.
           </p>
         </div>
 
@@ -599,6 +616,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.12.0b1</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.12.0b2</p>
 </body>
 </html>

doc/arm/Bv9ARM.ch02.html

@@ -146,6 +146,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.12.0b1</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.12.0b2</p>
 </body>
 </html>

doc/arm/Bv9ARM.ch03.html

@@ -759,6 +759,6 @@ controls {
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.12.0b1</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.12.0b2</p>
 </body>
 </html>