[rt42272] stronger wording

[rt42272] also warn on use of MD5 for rndc keys
[rt42272] add a "deprecated" warning when generating hmac keys
2017-10-24 10:36:00 -07:00 · 2017-10-23 10:35:08 -07:00 · 2017-10-22 23:37:57 -07:00 · 2017-10-22 01:10:28 +00:00 · 2017-10-21 13:28:38 -07:00 · 2017-10-21 13:27:55 -07:00
68 changed files with 870 additions and 470 deletions
@@ -1,3 +1,15 @@
+4776.	[bug]		Improve portability of ht_test. [RT #46333]
+
+4775.	[bug]		Address Coverity warnings in ht_test.c and mem_test.c
+			[RT #46281]
+
+4774.	[bug]		<isc/util.h> was incorrectly included in several
+			header files. [RT #46311]
+
+4773.	[doc]		Fixed generating Doxygen documentation for functions
+			annotated using certain macros.  Miscellaneous
+			Doxygen-related cleanups. [RT #46276]
+
 	--- 9.12.0b1 released ---

 4772.	[test]		Expanded unit testing framework for libns, using
@@ -19,4 +19,7 @@ Setting                   Description
                          named-checkzone
 -DNS_RUN_PID_DIR=0        Create default PID files in ${localstatedir}/run
                          rather than ${localstatedir}/run/named/
+                          Increase the maximum number of configurable
+-DNS_RPZ_MAX_ZONES=64     response policy zones from 32 to 64; this is the
+                          highest possible setting

@@ -20,3 +20,4 @@ Some of these settings are:
 |`-DCHECK_SIBLING=0`|Don't check sibling glue in `named-checkzone`|
 |`-DCHECK_LOCAL=0`|Don't check out-of-zone addresses in `named-checkzone`|
 |`-DNS_RUN_PID_DIR=0`|Create default PID files in `${localstatedir}/run` rather than `${localstatedir}/run/named/`|
+|`-DNS_RPZ_MAX_ZONES=64`|Increase the maximum number of configurable response policy zones from 32 to 64; this is the highest possible setting|
@@ -56,12 +56,12 @@ General bug reports can be sent to bind9-bugs@isc.org.

 Feature requests can be sent to bind-suggest@isc.org.

-Please note that, while ISC's ticketing system is not currently publicly
-readable, this may change in the future. Please do not include information
-in bug reports that you consider to be confidential. For example, when
-sending the contents of your configuration file, it is advisable to
-obscure key secrets; this can be done automatically by using
-named-checkconf -px.
+Please note that, while tickets submitted to ISC's ticketing system are
+not initially publicly readable by default, they can be made publicly
+acessible afterward. Please do not include information in bug reports that
+you consider to be confidential. In particular, when sending the contents
+of your configuration file, it is advisable to obscure key secrets: this
+can be done automatically by using named-checkconf -px.

 Professional support and training for BIND are available from ISC at
 https://www.isc.org/support.
@@ -75,8 +75,9 @@ mailman/listinfo/bind-workers.

 Contributing to BIND

-A public git repository for BIND is maintained at http://www.isc.org/git/,
-and also on Github at https://github.com/isc-projects.
+ISC maintains a public git repository for BIND; details can be found at
+http://www.isc.org/git/, and also on Github at https://github.com/
+isc-projects.

 Information for BIND contributors can be found in the following files: -
 General information: doc/dev/contrib.md - BIND 9 code style: doc/dev/
@@ -103,10 +104,8 @@ include:
  * Cached, validated NSEC and other records can now be used to synthesize
    NXDOMAIN responses.
  * The DNS Response Policy Service API (DNSRPS) is now supported.
-  * Setting max-journal-size default now limits the size of journal files
-    to twice the size of the zone.
-  * The query handling code has been substantially refactored for improved
-    readability, maintainability and testability .
+  * Setting 'max-journal-size default' now limits the size of journal
+    files to twice the size of the zone.
  * dnstap-read -x prints a hex dump of the wire format of each logged DNS
    message.
  * dnstap output files can now be configured to roll automatically when
@@ -115,7 +114,7 @@ include:
    ISO 8601 (UTC) formats.
  * Logging channels and dnstap output files can now be configured to use
    a timestamp as the suffix when rolling to a new file.
-  * named-checkconf -l lists zones found in named.conf.
+  * 'named-checkconf -l' lists zones found in named.conf.
  * Added support for the EDNS Padding and Keepalive options.
  * 'new-zones-directory' option sets the location where the configuration
    data for zones added by rndc addzone is stored
@@ -189,10 +188,11 @@ smaller systems.
 For the server to support DNSSEC, you need to build it with crypto
 support. To use OpenSSL, you should have OpenSSL 1.0.2e or newer
 installed. If the OpenSSL library is installed in a nonstandard location,
-specify the prefix using "--with-openssl=/prefix" on the configure command
-line. To use a PKCS#11 hardware service module for cryptographic
+specify the prefix using "--with-openssl=<PREFIX>" on the configure
+command line. To use a PKCS#11 hardware service module for cryptographic
 operations, specify the path to the PKCS#11 provider library using
-"--with-pkcs11=/prefix", and configure BIND with "--enable-native-pkcs11".
+"--with-pkcs11=<PREFIX>", and configure BIND with
+"--enable-native-pkcs11".

 To support the HTTP statistics channel, the server must be linked with at
 least one of the following: libxml2 http://xmlsoft.org or json-c https://
@@ -212,13 +212,16 @@ libGeoIP. This is not turned on by default; BIND must be configured with
 "--with-geoip". If the library is installed in a nonstandard location, use
 specify the prefix using "--with-geoip=/prefix".

-For DNSTAP packet logging, you must have libfstrm https://github.com/
-farsightsec/fstrm and libprotobuf-c https://developers.google.com/
-protocol-buffers, and BIND must be configured with "--enable-dnstap".
+For DNSTAP packet logging, you must have installed libfstrm https://
+github.com/farsightsec/fstrm and libprotobuf-c https://
+developers.google.com/protocol-buffers, and BIND must be configured with
+"--enable-dnstap".

-Python requires the 'argparse' and 'ply' modules to be available.
-'argparse' is a standard module as of Python 2.7 and Python 3.2. 'ply' is
-available from https://pypi.python.org/pypi/ply.
+Portions of BIND that are written in Python, including dnssec-keymgr,
+dnssec-coverage, dnssec-checkds, and some of the system tests, require the
+'argparse' and 'ply' modules to be available. 'argparse' is a standard
+module as of Python 2.7 and Python 3.2. 'ply' is available from https://
+pypi.python.org/pypi/ply.

 On some platforms it is necessary to explicitly request large file support
 to handle files bigger than 2GB. This can be done by using
@@ -250,7 +253,7 @@ Automated testing
 A system test suite can be run with make test. The system tests require
 you to configure a set of virtual IP addresses on your system (this allows
 multiple servers to run locally and communicate with one another). These
-IP addresses can be configured by by running the script bin/tests/system/
+IP addresses can be configured by running the command bin/tests/system/
 ifconfig.sh up as root.

 Some tests require Perl and the Net::DNS and/or IO::Socket::INET6 modules,
@@ -66,12 +66,12 @@ General bug reports can be sent to
 Feature requests can be sent to
 [bind-suggest@isc.org](mailto:bind-suggest@isc.org).

-Please note that, while ISC's ticketing system is not currently publicly
-readable, this may change in the future.  Please do not include information
-in bug reports that you consider to be confidential. For example, when
-sending the contents of your configuration file, it is advisable to obscure
-key secrets; this can be done automatically by using `named-checkconf
-px`.
+Please note that, while tickets submitted to ISC's ticketing system
+are not initially publicly readable by default, they can be made publicly
+acessible afterward.  Please do not include information in bug reports that
+you consider to be confidential. In particular, when sending the contents of
+your configuration file, it is advisable to obscure key secrets: this can
+be done automatically by using `named-checkconf -px`.

 Professional support and training for BIND are available from
 ISC at [https://www.isc.org/support](https://www.isc.org/support).
@@ -85,8 +85,8 @@ may also want to join the __BIND Workers__ mailing list, at

 ### <a name="contrib"/> Contributing to BIND

-A public git repository for BIND is maintained at
-[http://www.isc.org/git/](http://www.isc.org/git/), and also on Github
+ISC maintains a public git repository for BIND; details can be found
+at [http://www.isc.org/git/](http://www.isc.org/git/), and also on Github
 at [https://github.com/isc-projects](https://github.com/isc-projects).

 Information for BIND contributors can be found in the following files:
@@ -116,10 +116,8 @@ include:
 * Cached, validated NSEC and other records can now be used to synthesize
  NXDOMAIN responses.
 * The DNS Response Policy Service API (DNSRPS) is now supported.
-* Setting `max-journal-size default` now limits the size of journal files
+* Setting `'max-journal-size default'` now limits the size of journal files
  to twice the size of the zone.
-* The query handling code has been substantially refactored for improved
-  readability, maintainability and testability .
 * `dnstap-read -x` prints a hex dump of the wire format of each logged
  DNS message.
 * `dnstap` output files can now be configured to roll automatically when
@@ -128,7 +126,7 @@ include:
  8601 (UTC) formats.
 * Logging channels and `dnstap` output files can now be configured to use a
  timestamp as the suffix when rolling to a new file.
-* `named-checkconf -l` lists zones found in `named.conf`.
+* `'named-checkconf -l'` lists zones found in `named.conf`.
 * Added support for the EDNS Padding and Keepalive options.
 * 'new-zones-directory' option sets the location where the configuration
  data for zones added by rndc addzone is stored
@@ -195,9 +193,9 @@ performance on smaller systems.
 For the server to support DNSSEC, you need to build it with crypto support.
 To use OpenSSL, you should have OpenSSL 1.0.2e or newer installed.  If the
 OpenSSL library is installed in a nonstandard location, specify the prefix
-using "--with-openssl=/prefix" on the configure command line. To use a
+using "--with-openssl=&lt;PREFIX&gt;" on the configure command line. To use a
 PKCS#11 hardware service module for cryptographic operations, specify the
-path to the PKCS#11 provider library using "--with-pkcs11=/prefix", and
+path to the PKCS#11 provider library using "--with-pkcs11=&lt;PREFIX&gt;", and
 configure BIND with "--enable-native-pkcs11".

 To support the HTTP statistics channel, the server must be linked with at
@@ -220,13 +218,15 @@ libGeoIP. This is not turned on by default; BIND must be configured with
 "--with-geoip". If the library is installed in a nonstandard location, use
 specify the prefix using "--with-geoip=/prefix".

-For DNSTAP packet logging, you must have libfstrm
+For DNSTAP packet logging, you must have installed libfstrm
 [https://github.com/farsightsec/fstrm](https://github.com/farsightsec/fstrm)
 and libprotobuf-c
 [https://developers.google.com/protocol-buffers](https://developers.google.com/protocol-buffers),
 and BIND must be configured with "--enable-dnstap".

-Python requires the 'argparse' and 'ply' modules to be available.
+Portions of BIND that are written in Python, including
+`dnssec-keymgr`, `dnssec-coverage`, `dnssec-checkds`, and some of the
+system tests, require the 'argparse' and 'ply' modules to be available.
 'argparse' is a standard module as of Python 2.7 and Python 3.2.
 'ply' is available from [https://pypi.python.org/pypi/ply](https://pypi.python.org/pypi/ply).

@@ -260,7 +260,7 @@ localstatedir defaults to `$prefix/var`.
 A system test suite can be run with `make test`.  The system tests require
 you to configure a set of virtual IP addresses on your system (this allows
 multiple servers to run locally and communicate with one another).  These
-IP addresses can be configured by by running the script
+IP addresses can be configured by running the command
 `bin/tests/system/ifconfig.sh up` as root.

 Some tests require Perl and the Net::DNS and/or IO::Socket::INET6 modules,
@@ -73,7 +73,7 @@ Usage:\n\
 %s [-a] [-b bits] [-c keyfile] [-k keyname] [-p port] [-r randomfile] \
 [-s addr] [-t chrootdir] [-u user]\n\
  -a:		 generate just the key clause and write it to keyfile (%s)\n\
-  -A alg:	 algorithm (default hmac-md5)\n\
+  -A alg:	 algorithm (default hmac-md5 (deprecated and will change))\n\
  -b bits:	 from 1 through 512, default 256; total length of the secret\n\
  -c keyfile:	 specify an alternate key file (requires -a)\n\
  -k keyname:	 the name as it will be used  in named.conf and rndc.conf\n\
@@ -115,6 +115,7 @@ main(int argc, char **argv) {
 	const char *randomfile = NULL;
 	const char *serveraddr = NULL;
 	dns_secalg_t alg;
+	isc_boolean_t algset = ISC_FALSE;
 	const char *algname;
 	char *p;
 	int ch;
@@ -153,6 +154,7 @@ main(int argc, char **argv) {
 			keyonly = ISC_TRUE;
 			break;
 		case 'A':
+			algset = ISC_TRUE;
 			algname = isc_commandline_argument;
 			alg = alg_fromtext(algname);
 			if (alg == DST_ALG_UNKNOWN)
@@ -225,6 +227,20 @@ main(int argc, char **argv) {
 	if (argc > 0)
 		usage(1);

+	if (alg == DST_ALG_HMACMD5) {
+		if (algset) {
+			fprintf(stderr,
+				"warning: use of hmac-md5 for RNDC keys "
+				"is deprecated; hmac-sha256 is now "
+				"recommended.\n");
+		} else {
+			fprintf(stderr,
+				"warning: the default algorithm hmac-md5 "
+				"is deprecated and will be\n"
+				"changed to hmac-sha256 in a future release\n")
+		}
+	}
+
 	if (keysize < 0)
 		keysize = alg_bits(alg);
 	algname = alg_totext(alg);
@@ -128,8 +128,12 @@
          <para>
            Specifies the algorithm to use for the TSIG key.  Available
            choices are: hmac-md5, hmac-sha1, hmac-sha224, hmac-sha256,
-            hmac-sha384 and hmac-sha512.  The default is hmac-md5 or
-            if MD5 was disabled hmac-sha256.
+            hmac-sha384 and hmac-sha512.  The default is hmac-md5, or
+            if MD5 was disabled at compile time, hmac-sha256.
+          </para>
+          <para>
+            Note: Use of hmac-md5 is no longer recommended, and the default
+            value will be changed to hmac-sha256 in a future release.
          </para>
        </listitem>
      </varlistentry>
@@ -582,6 +582,16 @@ main(int argc, char **argv) {
 		INSIST((alg != DNS_KEYALG_RSAMD5) && (alg != DST_ALG_HMACMD5));
 #endif

+
+		if (alg == DST_ALG_HMACMD5 || alg == DST_ALG_HMACSHA1 ||
+		    alg == DST_ALG_HMACSHA224 || alg == DST_ALG_HMACSHA256 ||
+		    alg == DST_ALG_HMACSHA384 || alg == DST_ALG_HMACSHA512)
+		{
+			fprintf(stderr,
+				"Use of dnssec-keygen for HMAC keys is "
+				"deprecated: use tsig-keygen\n");
+		}
+
 		if (!dst_algorithm_supported(alg))
 			fatal("unsupported algorithm: %d", alg);

@@ -122,12 +122,19 @@
 	    of <option>algorithm</option> must be one of RSAMD5, RSASHA1,
 	    DSA, NSEC3RSASHA1, NSEC3DSA, RSASHA256, RSASHA512, ECCGOST,
 	    ECDSAP256SHA256, ECDSAP384SHA384, ED25519 or ED448.  For
-            TSIG/TKEY keys, the value must be one of DH (Diffie Hellman),
-            HMAC-MD5, HMAC-SHA1, HMAC-SHA224, HMAC-SHA256, HMAC-SHA384,
-            or HMAC-SHA512; specifying any of these algorithms will
-            automatically set the <option>-T KEY</option> option as well.
-            (Note: <command>tsig-keygen</command> produces TSIG keys in a
-            more useful format than <command>dnssec-keygen</command>.)
+	    TKEY and SIG(0) keys, the value must be DH (Diffie Hellman);
+	    specifying this value will automatically set the
+	    <option>-T KEY</option> option as well.
+	  </para>
+	  <para>
+	    TSIG keys can also by generated by setting the value to
+	    one of HMAC-MD5, HMAC-SHA1, HMAC-SHA224, HMAC-SHA256,
+	    HMAC-SHA384, or HMAC-SHA512.  As with DH, specifying these
+	    values will automatically set <option>-T KEY</option>. Note,
+	    however, that <command>tsig-keygen</command> produces TSIG keys
+	    in a more useful format. These algorithms have been deprecated
+	    in <command>dnssec-keygen</command>, and will be removed in a
+	    future release.
 	  </para>
 	  <para>
 	    These values are case insensitive. In some cases, abbreviations
@@ -138,8 +145,8 @@
 	  </para>
 	  <para>
 	    As of BIND 9.12.0, this option is mandatory except when using
-	    the <option>-S</option> option (which copies the algorithm from
-	    the predecessor key).  Previously, the default for newly
+	    the <option>-S</option> option, which copies the algorithm from
+	    the predecessor key.  Previously, the default for newly
 	    generated keys was RSASHA1.
 	  </para>
 	</listitem>
@@ -349,6 +349,14 @@ If the key\*(Aqs revocation date is set and in the past, and the key is publishe
 .RS 4
 If either of the key\*(Aqs unpublication or deletion dates are set and in the past, the key is NOT published or used to sign the zone, regardless of any other metadata\&.
 .RE
+.PP
+.RS 4
+If key\*(Aqs sync publication date is set and in the past, synchronization records (type CDS and/or CDNSKEY) are created\&.
+.RE
+.PP
+.RS 4
+If key\*(Aqs sync deletion date is set and in the past, synchronization records (type CDS and/or CDNSKEY) are removed\&.
+.RE
 .RE
 .PP
 \-T \fIttl\fR
@@ -1958,7 +1958,7 @@ addnsec3(dns_name_t *name, dns_dbnode_t *node,
 * any NSEC3 records which have the same parameters as the chain we
 * are building.
 *
- * XXXMPA Should we also check that it of the form <hash>.<origin>?
+ * XXXMPA Should we also check that it of the form &lt;hash&gt;.&lt;origin&gt;?
 */
 static void
 nsec3clean(dns_name_t *name, dns_dbnode_t *node,
@@ -646,6 +646,26 @@
                </para>
 	      </listitem>
            </varlistentry>
+
+	    <varlistentry>
+              <listitem>
+                <para>
+                  If key's sync publication date is set and in the past,
+		  synchronization records (type CDS and/or CDNSKEY) are
+		  created.
+                </para>
+	      </listitem>
+            </varlistentry>
+
+	    <varlistentry>
+              <listitem>
+                <para>
+                  If key's sync deletion date is set and in the past,
+		  synchronization records (type CDS and/or CDNSKEY) are
+		  removed.
+                </para>
+	      </listitem>
+            </varlistentry>
 	 </variablelist>
        </listitem>
      </varlistentry>
@@ -519,6 +519,22 @@
                  zone, regardless of any other metadata.
                </p>
 	      </dd>
+<dt></dt>
+<dd>
+                <p>
+                  If key's sync publication date is set and in the past,
+		  synchronization records (type CDS and/or CDNSKEY) are
+		  created.
+                </p>
+	      </dd>
+<dt></dt>
+<dd>
+                <p>
+                  If key's sync deletion date is set and in the past,
+		  synchronization records (type CDS and/or CDNSKEY) are
+		  removed.
+                </p>
+	      </dd>
 </dl></div>
        </dd>
 <dt><span class="term">-T <em class="replaceable"><code>ttl</code></em></span></dt>
@@ -17,6 +17,7 @@
 #include <isc/stdio.h>
 #include <isc/string.h>
 #include <isc/syslog.h>
+#include <isc/util.h>

 #include <isccfg/cfg.h>
 #include <isccfg/log.h>
@@ -20,6 +20,7 @@
 #include <isc/stats.h>
 #include <isc/string.h>
 #include <isc/task.h>
+#include <isc/util.h>

 #include <dns/cache.h>
 #include <dns/db.h>
@@ -16,6 +16,7 @@
 #include <isc/buffer.h>
 #include <isc/mem.h>
 #include <isc/string.h>
+#include <isc/util.h>

 #include <isccfg/cfg.h>

@@ -13,6 +13,7 @@
 #include <config.h>

 #include <isc/string.h>
+#include <isc/util.h>

 #include <dns/db.h>
 #include <dns/diff.h>
@@ -10,6 +10,7 @@
 #include <isc/eventclass.h>
 #include <isc/netaddr.h>
 #include <isc/task.h>
+#include <isc/util.h>

 #include <dns/byaddr.h>
 #include <dns/db.h>
@@ -1,110 +1,125 @@
-; File written on Thu May  1 12:16:00 2014
-; dnssec_signzone version 9.8.5-P1
-signed.			120	IN SOA	ns.utld. hostmaster.ns.utld. (
+; File written on Mon Oct 16 09:16:28 2017
+; dnssec_signzone version 9.11.2
+signed.			120	IN SOA	ns.signed. hostmaster.ns.signed. (
 					1          ; serial
 					3600       ; refresh (1 hour)
 					1200       ; retry (20 minutes)
 					604800     ; expire (1 week)
 					60         ; minimum (1 minute)
 					)
-			120	RRSIG	SOA 3 1 120 20820519023008 (
-					20140501011600 12955 signed.
-					BEFlElqfz17JeL/ISbgEz7yenWy2QjhgdMUx
-					VDLBx3+Eiz1nyB1CpWw= )
-			120	NS	ns.utld.
-			120	RRSIG	NS 3 1 120 20820519023008 (
-					20140501011600 12955 signed.
-					BC4nYbfEyROe0CZPj/cHRl7BCIc0MbzpDBwz
-					an8bPTHrbaHpC8rdX54= )
+			120	RRSIG	SOA 3 1 120 (
+					20820519023008 20140501011600 17876 signed.
+					BJDbUrXS4UzBrTeNUMA0sSGYd+h9M5d8qzsE
+					q7RJyDtUNJIwP5vAnSQ= )
+			120	NS	ns.signed.
+			120	RRSIG	NS 3 1 120 (
+					20820519023008 20140501011600 17876 signed.
+					BGoYuOkkcTAYnym27q2BgqkjUgP/0/Tip1yc
+					txRS1D0CipTUZhCNrXc= )
 			120	MX	10 mx.signed.
-			120	RRSIG	MX 3 1 120 20820519023008 (
-					20140501011600 12955 signed.
-					BEp7iUXEnBCXVtKHcIRfkiK34J83ZbC3g7qQ
-					XY+wdpJ7TxavEBtZO94= )
+			120	RRSIG	MX 3 1 120 (
+					20820519023008 20140501011600 17876 signed.
+					BOUPCSEEJ8dZ0oWeiYEvGIonjagvM1OS+mEY
+					i5VUmysn7kArWqeFERs= )
 			60	NSEC	a-only.signed. NS SOA MX RRSIG NSEC DNSKEY
-			60	RRSIG	NSEC 3 1 60 20820519023008 (
-					20140501011600 12955 signed.
-					BAjeMFAXkfL9AypyihxU7lvhGCENKAwpoGt6
-					WYd6G0kb6zdpZ/AR1GQ= )
+			60	RRSIG	NSEC 3 1 60 (
+					20820519023008 20140501011600 17876 signed.
+					BBzvCsFw4EgfrIsFOu5IjP2gncm8dntwHaMD
+					IeJ6g6s7IOwFT5nyrOU= )
 			120	DNSKEY	256 3 3 (
-					BJIozpii3vZYz7LNraaDEOOpLFcdlw091gEG
-					+SHpTEVDdb7atLaYCYoSaodASSYutOQbba1o
-					i6xLiEAZdb4MNoM50vOtQlb4NJDAGElTOShK
-					RE60G1veNVuN87ZpsiPlLU7m307l03aNUkJu
-					LNd19kEuq1ItZt1SFVUkLvAHxs8hSLyDpq/u
-					4P/6QnPG294dk2eh83m2PuQVChvJLcrFhIbJ
-					CWxCEsW9fe2eO1YtwoyFmqIIFSlAs84bwy2O
-					iA7x0PeoXpKGLhuKCbvre5zVLRaqMFoMDJmr
-					vpGTxJ+AbOLEzDgO8QkGT+WCEBSMqRXvUkX0
-					rBcSDAa8GpCTyhVs0j9KIedRbYalV24JzViy
-					m7UrKcZojCcXEjl0rXIJHNlfvQsfy6F3cq4m
-					GimMrtxmA5Wf1xoJ
-					) ; key id = 12955
+					BPXo3mJOeCCuorn7Hc7bxR3QDHrJvq9gUpPS
+					s8QYF3eiSpB97c8Br7fFzFYHQCJWWnCtpt1E
+					h7SveJSl1ASNl9W2KE6hDNXfDX+ixDOtFZ/7
+					PCh/obX36VK86EH+ZBNLxxEy9tHHCGO08zy8
+					3lWI3E5bk9a1sks2dy6hbQfMmyXWI5QwYS9D
+					j5Vs5yeUQ5e6SPmIqgqpn6VnDtAIfR2My7/r
+					/Jgf73gpZugZmn6wDbzNCyGIvtOJCHAY2OEg
+					ZfACKVdJrXZ42NKcJCgSTd1xY81UyMI9QAMq
+					64Lx/tENCo1GKBCk/1HMdiO6WKeXCJd1SYzN
+					VM+n4fRzEkmVT9wfyiSmoq6SxjeqrRebDz8G
+					42d4lsm2/0bmOlle+fva7LwtGOaS+tBqtD8K
+					kexFaixL5iY+LB0Q
+					) ; ZSK; alg = DSA ; key id = 17876
 			120	DNSKEY	257 3 3 (
-					BJIozpii3vZYz7LNraaDEOOpLFcdlw091gEG
-					+SHpTEVDdb7atLaYCYoSaodASSYutOQbba1o
-					i6xLiEAZdb4MNoM50vOtQlb4NJDAGElTOShK
-					RE60G1veNVuN87ZpsiPlLU7m307l03aNUkJu
-					LNd19kEuq1ItZt1SFVUkLvAHxs8hSLyDpq/u
-					4P/6QnPG294dk2eh83m2PuQVChvJLcrFhIbJ
-					CWxCEsW9fe2eO1YtwoyFmqIIFSlAs84bwy2O
-					iA7x0PeoXpKGLhuKCbvre5zVLRaqMFoMDJmr
-					vpGTxJ+AbOLEzDgO8QkGT+WCEBSMqRXvUkX0
-					rBcSDAa8GpCTyhVs0j9KIedRbYalV24JzViy
-					m7UrKcZojCcXEjl0rXIJHNlfvQsfy6F3cq4m
-					GimMrtxmA5Wf1xoJ
-					) ; key id = 12956
-			120	RRSIG	DNSKEY 3 1 120 20820519023008 (
-					20140501011600 12955 signed.
-					BG/sW/I/ZVcUCjGfAicxv4kYLLYoMZlivDqU
-					V3GfAXR5Bp69ywKp1OA= )
-			120	RRSIG	DNSKEY 3 1 120 20820519023008 (
-					20140501011600 12956 signed.
-					BAoQwXiKVoWwY+IDfzRndz9ndLPTSShDHpxS
-					Z9+uTx+KCPzUsZYQy4k= )
+					BOOhXnn+YV6RQ+jRPdayrnC2cd9x5P77c1/6
+					Ev41qaWl1N7QRDXYh7VDS1UowoPbvQOvgQU0
+					X7+zKWrB8UQcdsUe96IH/wPab1qkJlKanZni
+					uFdB/2sTvQ6yabIC41dItnGeuN9VY1qwCa7T
+					4QFRVYyDPKgxo7MRLq9YoUN8RTcB6lY1BH9Z
+					QgcHZljAFVgU1Zc/6DZlQeBZyJafwIR+I7Eq
+					Oe+rR44ZeD5JRgI1OwGyw/b1wKUxFhM+4XJi
+					i8mQ1mrvzZ27iQbYP4WEzaskU6P5X+nPrTFi
+					tLEaPugt8Oe7+lHLjpHvHzSOJZ5Radfiqgzg
+					GGOzj1qmLfKLdRmp4VuBQ+1kguiz9D3ev89d
+					pzP7dYHuSdCjc9X0fLmPjU1xD6RyLCDEmUm7
+					eeRP55SiTiQCzJFr
+					) ; KSK; alg = DSA ; key id = 3746
+			120	RRSIG	DNSKEY 3 1 120 (
+					20820519023008 20140501011600 3746 signed.
+					BFuLN7ACQrD6/3WaieXRD1JpSXW9s+/xCZ1x
+					0ihUT1iKNvJS8F4Pafc= )
+			120	RRSIG	DNSKEY 3 1 120 (
+					20820519023008 20140501011600 17876 signed.
+					BN+8hbh1FGTNqHds0In57dPr5fVRU/P28dZa
+					zIP19bAwTH/ZvgrqUF0= )
 a-only.signed.		120	IN NS	1.0.0.1.signed.
 			60	NSEC	aaaa-only.signed. NS RRSIG NSEC
-			60	RRSIG	NSEC 3 2 60 20820519023008 (
-					20140501011600 12955 signed.
-					BBRjTWMwkjpanDw386nblW6fwyliYRUeNNo+
-					OHwhqHXXd4bathApttg= )
+			60	RRSIG	NSEC 3 2 60 (
+					20820519023008 20140501011600 17876 signed.
+					BHpGpjMihpoIykHTpK1XmkVn0jqSST3/K6Fx
+					vTaIb24rpkTriaXxChM= )
 aaaa-only.signed.	120	IN AAAA	2001:db8::2
-			120	RRSIG	AAAA 3 2 120 20820519023008 (
-					20140501011600 12955 signed.
-					BDukZxGM62Wmk9JE7F5etkcX4LZyFLK0YS0H
-					CF0lovOlBeK5zLgi/MA= )
+			120	RRSIG	AAAA 3 2 120 (
+					20820519023008 20140501011600 17876 signed.
+					BOvYax/3CDnEKTtbc6zoP4hYwhMe5SoXZh0w
+					muzBWw9bEH+Bdt1ZEQ4= )
 			60	NSEC	dual.signed. AAAA RRSIG NSEC
-			60	RRSIG	NSEC 3 2 60 20820519023008 (
-					20140501011600 12955 signed.
-					BH1TJpK7j1Gu01hb2PimefFISv59NDLfZ9Gr
-					ojpnjDQNV6bA7HcHeEM= )
+			60	RRSIG	NSEC 3 2 60 (
+					20820519023008 20140501011600 17876 signed.
+					BIqxE79TUnT2DUuocTitGhTNGnLs0+3sLJdz
+					8haJbyH8pig1h7mqimU= )
 dual.signed.		120	IN A	1.0.0.3
-			120	RRSIG	A 3 2 120 20820519023008 (
-					20140501011600 12955 signed.
-					BBIDPDxbSm3X/Xf5xh/MYIkAvZ9CWpEzSwbM
-					Pks77CGb4rW8IF8WXxs= )
+			120	RRSIG	A 3 2 120 (
+					20820519023008 20140501011600 17876 signed.
+					BIGL70eEIGVDW0gcYpEWgCFv4ne14hutQCMh
+					gQ6kcEbl2qszosJA60E= )
 			120	AAAA	2001:db8::3
-			120	RRSIG	AAAA 3 2 120 20820519023008 (
-					20140501011600 12955 signed.
-					BHKD6egOF6e2DfY7+iPNDPcMS6TdU8/OCm8u
-					OYjmr11t5cI8S0R1Iqk= )
+			120	RRSIG	AAAA 3 2 120 (
+					20820519023008 20140501011600 17876 signed.
+					BCmwk+ng/x1O7MhheK8MgAXYFVDDbyiZ76RV
+					iwQrPRm0ThNRtsQU+UY= )
 			60	NSEC	mx.signed. A AAAA RRSIG NSEC
-			60	RRSIG	NSEC 3 2 60 20820519023008 (
-					20140501011600 12955 signed.
-					BHeXsjvM4Bmr/Ih4eDgR9VTC7R/UFlz5ns+g
-					7LPl+H9Oe6zGnM5rGOs= )
-mx.signed.		120	IN A	1.0.0.3
-			120	RRSIG	A 3 2 120 20820519023008 (
-					20140501011600 12955 signed.
-					BAq3t2X4XDI/dIofEkALZsNn1ezNWDYFH0M2
-					2GI5F0JHr/iZPlAzRbk= )
-			120	AAAA	2001:db8::3
-			120	RRSIG	AAAA 3 2 120 20820519023008 (
-					20140501011600 12955 signed.
-					BFts4Mon2FQaLQb6kPOKTEFkHaPIE1xUgrI6
-					qV8tEaAyFXfhH4su6Y0= )
+			60	RRSIG	NSEC 3 2 60 (
+					20820519023008 20140501011600 17876 signed.
+					BLlLAIHF4SX/eWMCkUvj0XTFmaOp3xnifqkL
+					nSWOAqtzJ5fwAdbNBdM= )
+ns.signed.		120	IN A	10.53.0.1
+			120	RRSIG	A 3 2 120 (
+					20820519023008 20140501011600 17876 signed.
+					BJ+Wll7VfNEjM4EfLY2rlx74oIwKRg9pjcJO
+					Zxt6GHQIJ2D6EfyMZ00= )
+			120	AAAA	fd92:7065:b8e:ffff::1
+			120	RRSIG	AAAA 3 2 120 (
+					20820519023008 20140501011600 17876 signed.
+					BGT/agHn4qcHzLV2hYcGeLJ6Tz1to9sTB8LI
+					lMwkV/KUu6UO7yvrnYk= )
 			60	NSEC	signed. A AAAA RRSIG NSEC
-			60	RRSIG	NSEC 3 2 60 20820519023008 (
-					20140501011600 12955 signed.
-					BCQWnlB8hrID+v5xG/o8t8E+YDb3Fz7Qodmw
-					kBQ+ZwyIeLOoH2+as5A= )
+			60	RRSIG	NSEC 3 2 60 (
+					20820519023008 20140501011600 17876 signed.
+					BNe3XmEGd/xxoh8FN3T3V9G1enCzNQJ7l3G+
+					D3QPrp7mYtPAGMxCLlc= )
+mx.signed.		120	IN A	1.0.0.3
+			120	RRSIG	A 3 2 120 (
+					20820519023008 20140501011600 17876 signed.
+					BMlIQp1acUSUvgzV1CWlM0+cS1bGkFsbS6HQ
+					d0S6TbNV+uNw0S1q0Dk= )
+			120	AAAA	2001:db8::3
+			120	RRSIG	AAAA 3 2 120 (
+					20820519023008 20140501011600 17876 signed.
+					BGtSuYQF7sRVT5OdVHPJjm0PERzSp4v+d/DP
+					Vp2UD0vSVSr3Vj2Wi4M= )
+			60	NSEC	ns.signed. A AAAA RRSIG NSEC
+			60	RRSIG	NSEC 3 2 60 (
+					20820519023008 20140501011600 17876 signed.
+					BMzQWws37wYfHvLnqgvjd+j5dkzBb2RYhrQk
+					ykM0GnTAR6ZpmgQO6jc= )
@@ -1171,7 +1171,7 @@ zone "eng.example.com" {
 		  "<userinput>hmac-sha256</userinput>",
 		  "<userinput>hmac-sha384</userinput>"
 		  and "<userinput>hmac-sha512</userinput>"
-		  have any meaning.  The secret is a base-64 encoded string
+		  have any meaning.  The secret is a Base64 encoded string
 		  as specified in RFC 3548.
 		</para>

@@ -3552,7 +3552,7 @@ $ORIGIN 0.0.0.0.0.0.0.0.8.b.d.0.1.0.0.2.ip6.arpa.
 	  number of required bits preceded by a dash, e.g.
 	  <literal>hmac-sha1-80</literal>.  The
 	  <replaceable>secret_string</replaceable> is the secret
-	  to be used by the algorithm, and is treated as a base-64
+	  to be used by the algorithm, and is treated as a Base64
 	  encoded string.
 	</para>

@@ -3815,17 +3815,17 @@ notrace</command>. All debugging messages in the server have a debug
 	    <command>print-time</command> can be set to
 	    <userinput>yes</userinput>, <userinput>no</userinput>,
 	    or a time format specifier, which may be one of
-	    <option>local</option>, <option>iso8601</option> or
-	    <option>iso8601-utc</option>.  If set to
+	    <userinput>local</userinput>, <userinput>iso8601</userinput> or
+	    <userinput>iso8601-utc</userinput>.  If set to
 	    <userinput>no</userinput>, then the date and time will
 	    not be logged.  If set to <userinput>yes</userinput>
-	    or <option>local</option>, the date and time are logged
+	    or <userinput>local</userinput>, the date and time are logged
 	    in a human readable format, using the local time zone.
-	    If set to <option>iso8601</option> the local time is
+	    If set to <userinput>iso8601</userinput> the local time is
 	    logged in ISO8601 format.  If set to
-	    <option>iso8601-utc</option>, then the date and time
+	    <userinput>iso8601-utc</userinput>, then the date and time
 	    are logged in ISO8601 format, with time zone set to
-	    UTC. The default is <option>local</option>.
+	    UTC. The default is <userinput>local</userinput>.
 	  </para>
 	  <para>
 	    <command>print-time</command> may
@@ -4987,7 +4987,8 @@ badresp:1,adberr:0,findfail:0,valfail:0]
 	      <para>
 		Specifies the directory in which to store the configuration
 		parameters for zones added via <command>rndc addzone</command>.
-		By default, this is the working directory.
+		By default, this is the working directory. If set to a relative
+		path, it will be relative to the working directory.
 	      </para>
 	    </listitem>
 	  </varlistentry>
@@ -5710,12 +5711,14 @@ options {
 	    <listitem>
 	      <para>
 		Specifies the TTL to be returned on stale answers.
-		The default is 1 second. The minimal allowed is
+		The default is 1 second. The minimum allowed is
 		also 1 second; a value of 0 will be updated silently
-		to 1 second.  For stale answers to be returned
+		to 1 second.  For stale answers to be returned,
+		they must be enabled (either in the configuration file
+		using <command>stale-answer-enable</command> or via
+		<command>rndc</command>), and
 		<option>max-stale-ttl</option> must be set to a
-		non zero value and they must not have been disabled
-		by <command>rndc</command>.
+		nonzero value.
 	      </para>
 	    </listitem>
 	  </varlistentry>
@@ -6448,17 +6451,21 @@ options {
 	    </varlistentry>

 	    <varlistentry>
-	      <term><command>serve-stale-enable</command></term>
+	      <term><command>stale-answer-enable</command></term>
 	      <listitem>
 		<para>
 		  Enable the returning of stale answers when the
 		  nameservers for the zone are not answering.  This
-		  is off by default but can be enabled/disabled via
-		  <command>rndc server-stale on</command> and
-		  <command>rndc server-stale off</command> which
-		  override the named.conf setting.  <command>rndc
-		  server-stale reset</command> will restore control
-		  via named.conf.
+		  is off by default, but can be enabled/disabled via
+		  <command>rndc serve-stale on</command> and
+		  <command>rndc serve-stale off</command>, which
+		  override the <filename>named.conf</filename>
+		  setting.  <command>rndc serve-stale reset</command>
+		  restores the setting to the one specified in
+		  <filename>named.conf</filename>.  Note that
+		  reloading or reconfiguring <command>named</command>
+		  will not re-enable serving of stale records if they
+		  have been disabled via <command>rndc</command>.
 		</para>
 	      </listitem>
 	    </varlistentry>
@@ -11356,7 +11363,7 @@ example.com                 CNAME   rpz-tcp-only.
 	  <para>
 	    The <command>trusted-keys</command> statement can contain
 	    multiple key entries, each consisting of the key's
-	    domain name, flags, protocol, algorithm, and the Base-64
+	    domain name, flags, protocol, algorithm, and the Base64
 	    representation of the key data.
 	    Spaces, tabs, newlines and carriage returns are ignored
 	    in the key data, so the configuration may be split up into
@@ -603,7 +603,7 @@ zone "eng.example.com" {
                  "<strong class="userinput"><code>hmac-sha256</code></strong>",
                  "<strong class="userinput"><code>hmac-sha384</code></strong>"
                  and "<strong class="userinput"><code>hmac-sha512</code></strong>"
-                  have any meaning.  The secret is a base-64 encoded string
+                  have any meaning.  The secret is a Base64 encoded string
                  as specified in RFC 3548.
                </p>

@@ -1232,7 +1232,7 @@
          number of required bits preceded by a dash, e.g.
          <code class="literal">hmac-sha1-80</code>.  The
          <em class="replaceable"><code>secret_string</code></em> is the secret
-          to be used by the algorithm, and is treated as a base-64
+          to be used by the algorithm, and is treated as a Base64
          encoded string.
        </p>

@@ -1501,17 +1501,17 @@ notrace</strong></span>. All debugging messages in the server have a debug
            <span class="command"><strong>print-time</strong></span> can be set to
            <strong class="userinput"><code>yes</code></strong>, <strong class="userinput"><code>no</code></strong>,
            or a time format specifier, which may be one of
-            <code class="option">local</code>, <code class="option">iso8601</code> or
-            <code class="option">iso8601-utc</code>.  If set to
+            <strong class="userinput"><code>local</code></strong>, <strong class="userinput"><code>iso8601</code></strong> or
+            <strong class="userinput"><code>iso8601-utc</code></strong>.  If set to
            <strong class="userinput"><code>no</code></strong>, then the date and time will
            not be logged.  If set to <strong class="userinput"><code>yes</code></strong>
-            or <code class="option">local</code>, the date and time are logged
+            or <strong class="userinput"><code>local</code></strong>, the date and time are logged
            in a human readable format, using the local time zone.
-            If set to <code class="option">iso8601</code> the local time is
+            If set to <strong class="userinput"><code>iso8601</code></strong> the local time is
            logged in ISO8601 format.  If set to
-            <code class="option">iso8601-utc</code>, then the date and time
+            <strong class="userinput"><code>iso8601-utc</code></strong>, then the date and time
            are logged in ISO8601 format, with time zone set to
-            UTC. The default is <code class="option">local</code>.
+            UTC. The default is <strong class="userinput"><code>local</code></strong>.
          </p>
          <p>
            <span class="command"><strong>print-time</strong></span> may
@@ -3045,7 +3045,8 @@ badresp:1,adberr:0,findfail:0,valfail:0]
              <p>
                Specifies the directory in which to store the configuration
                parameters for zones added via <span class="command"><strong>rndc addzone</strong></span>.
-                By default, this is the working directory.
+                By default, this is the working directory. If set to a relative
+                path, it will be relative to the working directory.
              </p>
            </dd>
 <dt><span class="term"><span class="command"><strong>named-xfer</strong></span></span></dt>
@@ -3671,12 +3672,14 @@ options {
 <dd>
              <p>
                Specifies the TTL to be returned on stale answers.
-                The default is 1 second. The minimal allowed is
+                The default is 1 second. The minimum allowed is
                also 1 second; a value of 0 will be updated silently
-                to 1 second.  For stale answers to be returned
+                to 1 second.  For stale answers to be returned,
+                they must be enabled (either in the configuration file
+                using <span class="command"><strong>stale-answer-enable</strong></span> or via
+                <span class="command"><strong>rndc</strong></span>), and
                <code class="option">max-stale-ttl</code> must be set to a
-                non zero value and they must not have been disabled
-                by <span class="command"><strong>rndc</strong></span>.
+                nonzero value.
              </p>
            </dd>
 <dt><span class="term"><span class="command"><strong>serial-update-method</strong></span></span></dt>
@@ -4330,17 +4333,21 @@ options {
                  <span class="command"><strong>nocookie-udp-size</strong></span> option.
                </p>
              </dd>
-<dt><span class="term"><span class="command"><strong>serve-stale-enable</strong></span></span></dt>
+<dt><span class="term"><span class="command"><strong>stale-answer-enable</strong></span></span></dt>
 <dd>
                <p>
                  Enable the returning of stale answers when the
                  nameservers for the zone are not answering.  This
-                  is off by default but can be enabled/disabled via
-                  <span class="command"><strong>rndc server-stale on</strong></span> and
-                  <span class="command"><strong>rndc server-stale off</strong></span> which
-                  override the named.conf setting.  <span class="command"><strong>rndc
-                  server-stale reset</strong></span> will restore control
-                  via named.conf.
+                  is off by default, but can be enabled/disabled via
+                  <span class="command"><strong>rndc serve-stale on</strong></span> and
+                  <span class="command"><strong>rndc serve-stale off</strong></span>, which
+                  override the <code class="filename">named.conf</code>
+                  setting.  <span class="command"><strong>rndc serve-stale reset</strong></span>
+                  restores the setting to the one specified in
+                  <code class="filename">named.conf</code>.  Note that
+                  reloading or reconfiguring <span class="command"><strong>named</strong></span>
+                  will not re-enable serving of stale records if they
+                  have been disabled via <span class="command"><strong>rndc</strong></span>.
                </p>
              </dd>
 <dt><span class="term"><span class="command"><strong>nocookie-udp-size</strong></span></span></dt>
@@ -8884,7 +8891,7 @@ example.com                 CNAME   rpz-tcp-only.
          <p>
            The <span class="command"><strong>trusted-keys</strong></span> statement can contain
            multiple key entries, each consisting of the key's
-            domain name, flags, protocol, algorithm, and the Base-64
+            domain name, flags, protocol, algorithm, and the Base64
            representation of the key data.
            Spaces, tabs, newlines and carriage returns are ignored
            in the key data, so the configuration may be split up into
@@ -41,9 +41,10 @@
 <dt><span class="section"><a href="Bv9ARM.ch09.html#relnotes_intro">Introduction</a></span></dt>
 <dt><span class="section"><a href="Bv9ARM.ch09.html#relnotes_download">Download</a></span></dt>
 <dt><span class="section"><a href="Bv9ARM.ch09.html#relnotes_license">License Change</a></span></dt>
-<dt><span class="section"><a href="Bv9ARM.ch09.html#win_support">Windows XP No Longer Supported</a></span></dt>
+<dt><span class="section"><a href="Bv9ARM.ch09.html#win_support">Legacy Windows No Longer Supported</a></span></dt>
 <dt><span class="section"><a href="Bv9ARM.ch09.html#relnotes_security">Security Fixes</a></span></dt>
 <dt><span class="section"><a href="Bv9ARM.ch09.html#relnotes_features">New Features</a></span></dt>
+<dt><span class="section"><a href="Bv9ARM.ch09.html#relnotes_removed">Removed Features</a></span></dt>
 <dt><span class="section"><a href="Bv9ARM.ch09.html#proto_changes">Protocol Changes</a></span></dt>
 <dt><span class="section"><a href="Bv9ARM.ch09.html#relnotes_changes">Feature Changes</a></span></dt>
 <dt><span class="section"><a href="Bv9ARM.ch09.html#relnotes_bugs">Bug Fixes</a></span></dt>
@@ -96,10 +97,11 @@
      anything other than the changes you made to our software.
    </p>
    <p>
-      This requirement will not affect anyone who is using BIND
-      without redistributing it, nor anyone redistributing it without
-      changes, therefore this change will be without consequence
-      for most individuals and organizations who are using BIND.
+      This requirement will not affect anyone who is using BIND, with
+      or without modifications, without redistributing it, nor anyone
+      redistributing it without changes. Therefore, this change will be
+      without consequence for most individuals and organizations who are
+      using BIND.
    </p>
    <p>
      Those unsure whether or not the license change affects their
@@ -111,10 +113,10 @@

  <div class="section">
 <div class="titlepage"><div><div><h3 class="title">
-<a name="win_support"></a>Windows XP No Longer Supported</h3></div></div></div>
+<a name="win_support"></a>Legacy Windows No Longer Supported</h3></div></div></div>
    <p>
-      As of BIND 9.11.2, Windows XP is no longer a supported platform for
-      BIND, and Windows XP binaries are no longer available for download
+      As of BIND 9.11.2, Windows XP and Windows 2003 are no longer supported
+      platforms for BIND; "XP" binaries are no longer available for download
      from ISC.
    </p>
  </div>
@@ -143,10 +145,12 @@
 <li class="listitem">
 	    <p>
 	      The additional cache ("acache") was found not to
-	      significantly improve performance and has been removed;
-	      the <span class="command"><strong>acache-enable</strong></span> and
-	      <span class="command"><strong>acache-cleaning-interval</strong></span> options are now
-	      deprecated.
+	      significantly improve performance and has been removed.
+	      As a result, the <span class="command"><strong>acache-enable</strong></span> and
+	      <span class="command"><strong>acache-cleaning-interval</strong></span> options no longer
+	      have any effect. For backwards compatibility, BIND will
+	      accept their presence in a configuration file, but
+	      will log a warning.
 	    </p>
 	  </li>
 <li class="listitem">
@@ -159,15 +163,16 @@
 	  </li>
 <li class="listitem">
 	    <p>
-	      The <span class="command"><strong>additional-from-cache</strong></span>
-	      and <span class="command"><strong>additional-from-auth</strong></span> options have been
-	      deprecated.
+	      <span class="command"><strong>minimal-responses</strong></span> is now set
+	      to <code class="literal">no-auth-recursive</code> by default.
 	    </p>
 	  </li>
 <li class="listitem">
 	    <p>
-	      <span class="command"><strong>minimal-responses</strong></span> is now set
-	      to <code class="literal">yes</code> by default.
+	      The <span class="command"><strong>additional-from-cache</strong></span>
+	      and <span class="command"><strong>additional-from-auth</strong></span> options no longer
+	      have any effect. <span class="command"><strong>named</strong></span> will log a warning
+	      if they are set.
 	    </p>
 	  </li>
 <li class="listitem">
@@ -342,13 +347,14 @@
 	  zone's validated CDS or CDNSKEY records. It can produce a
 	  <code class="filename">dsset</code> file suitable for input to
 	  <span class="command"><strong>dnssec-signzone</strong></span>, or a series of
-	  <span class="command"><strong>nsupdate</strong></span> to update the parent zone via dynamic
-	  DNS. Thanks to Tony Finch for the contribution.  [RT #46090]
+	  <span class="command"><strong>nsupdate</strong></span> commands to update the parent zone
+	  via dynamic DNS. Thanks to Tony Finch for the contribution.
+	  [RT #46090]
 	</p>
      </li>
 <li class="listitem">
 	<p>
-	  <span class="command"><strong>nsupdate</strong></span> and <span class="command"><strong>rndc</strong></span> now accepts
+	  <span class="command"><strong>nsupdate</strong></span> and <span class="command"><strong>rndc</strong></span> now accept
 	  command line options <span class="command"><strong>-4</strong></span> and <span class="command"><strong>-6</strong></span>
 	  which force using only IPv4 or only IPv6, respectively. [RT #45632]
 	</p>
@@ -497,6 +503,36 @@

  <div class="section">
 <div class="titlepage"><div><div><h3 class="title">
+<a name="relnotes_removed"></a>Removed Features</h3></div></div></div>
+    <div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; ">
+<li class="listitem">
+	<p>
+	  The ISC DNSSEC Lookaside Validation (DLV) service has been shut
+	  down; all DLV records in the dlv.isc.org zone have been removed.
+	  References to the service have been removed from BIND documentation.
+	  Lookaside validation is no longer used by default by
+	  <span class="command"><strong>delv</strong></span>. The DLV key has been removed from
+	  <code class="filename">bind.keys</code>. Setting
+	  <span class="command"><strong>dnssec-lookaside</strong></span> to
+	  <span class="command"><strong>auto</strong></span> or to use dlv.isc.org as a trust
+	  anchor is now a fatal configuration error. [RT #46155]
+	</p>
+      </li>
+<li class="listitem">
+	<p>
+	  As noted above, the <span class="command"><strong>acache-enable</strong></span>,
+	  <span class="command"><strong>acache-cleaning-interval</strong></span>,
+	  <span class="command"><strong>additional-from-cache</strong></span> and
+	  <span class="command"><strong>additional-from-auth</strong></span> options are no longer
+	  effective and <span class="command"><strong>named</strong></span> will log a warning if
+	  they are set.
+	</p>
+      </li>
+</ul></div>
+  </div>
+
+  <div class="section">
+<div class="titlepage"><div><div><h3 class="title">
 <a name="proto_changes"></a>Protocol Changes</h3></div></div></div>
    <div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; ">
 <li class="listitem">
@@ -506,13 +542,17 @@
 	  these algorithms must be supported in OpenSSL;
 	  currently they are only available in the development branch
 	  of OpenSSL at
-	  <a class="link" href="https://github.com/openssl/openssl" target="_top">https://github.com/openssl/openssl</a>.
+	  <a class="link" href="https://github.com/openssl/openssl" target="_top">
+	    https://github.com/openssl/openssl</a>.
 	  [RT #44696]
 	</p>
      </li>
 <li class="listitem">
 	<p>
-	  EDNS KEY TAG options are verified and printed.
+	  When parsing DNS messages, EDNS KEY TAG options are checked
+	  for correctness. When printing messages (for example, in
+	  <span class="command"><strong>dig</strong></span>), EDNS KEY TAG options are printed
+	  in readable format.
 	</p>
      </li>
 </ul></div>
@@ -530,7 +570,7 @@
 	  Lookaside validation is no longer used by default by
 	  <span class="command"><strong>delv</strong></span>. The DLV key has been removed from
 	  <code class="filename">bind.keys</code>. Setting
-	  <span class="command"><strong>dnssec-lookaside</strong></span> set to
+	  <span class="command"><strong>dnssec-lookaside</strong></span> to
 	  <span class="command"><strong>auto</strong></span> or to use dlv.isc.org as a trust
 	  anchor is now a fatal configuration error. [RT #46155]
 	</p>
@@ -651,15 +691,6 @@
 	  are now fully rolled back in the event of failure. [RT #45841]
 	</p>
      </li>
-<li class="listitem">
-	<p>
-	  Fixed a bug that was introduced in an earlier development
-	  release which caused multi-packet AXFR and IXFR messages to fail
-	  validation if not all packets contained TSIG records; this
-	  caused interoperability problems with some other DNS
-	  implementations. [RT #45509]
-	</p>
-      </li>
 <li class="listitem">
 	<p>
 	  Multiple <span class="command"><strong>cookie-secret</strong></span> clauses are now
@@ -686,19 +717,39 @@
 	  contribution. [RT #45689]
 	</p>
      </li>
+<li class="listitem">
+	<p>
+	  Trust anchor telemetry messages, as specified by
+	  RFC 8145, are now logged to the
+	  <span class="command"><strong>trust-anchor-telemetry</strong></span> logging
+	  catagory.
+	</p>
+      </li>
 </ul></div>
  </div>

  <div class="section">
 <div class="titlepage"><div><div><h3 class="title">
 <a name="relnotes_bugs"></a>Bug Fixes</h3></div></div></div>
-    <div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; "><li class="listitem">
+    <div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; ">
+<li class="listitem">
 	<p>
 	  The introduction of <span class="command"><strong>libns</strong></span> caused a bug
 	  in which TCP client objects were not recycled after use,
 	  leading to unconstrained memory growth. [RT #46029]
 	</p>
-      </li></ul></div>
+      </li>
+<li class="listitem">
+	<p>
+	  Some header files included &lt;isc/util.h&gt; incorrectly as
+	  it pollutes with namespace with non ISC_ macros and this should
+	  only be done by explicitly including &lt;isc/util.h&gt;.  This
+	  has been corrected.  Some code may depend on &lt;isc/util.h&gt;
+	  being implicitly included via other header files.  Such
+	  code should explicitly include &lt;isc/util.h&gt;.
+	</p>
+      </li>
+</ul></div>
  </div>

  <div class="section">
@@ -241,9 +241,10 @@
 <dt><span class="section"><a href="Bv9ARM.ch09.html#relnotes_intro">Introduction</a></span></dt>
 <dt><span class="section"><a href="Bv9ARM.ch09.html#relnotes_download">Download</a></span></dt>
 <dt><span class="section"><a href="Bv9ARM.ch09.html#relnotes_license">License Change</a></span></dt>
-<dt><span class="section"><a href="Bv9ARM.ch09.html#win_support">Windows XP No Longer Supported</a></span></dt>
+<dt><span class="section"><a href="Bv9ARM.ch09.html#win_support">Legacy Windows No Longer Supported</a></span></dt>
 <dt><span class="section"><a href="Bv9ARM.ch09.html#relnotes_security">Security Fixes</a></span></dt>
 <dt><span class="section"><a href="Bv9ARM.ch09.html#relnotes_features">New Features</a></span></dt>
+<dt><span class="section"><a href="Bv9ARM.ch09.html#relnotes_removed">Removed Features</a></span></dt>
 <dt><span class="section"><a href="Bv9ARM.ch09.html#proto_changes">Protocol Changes</a></span></dt>
 <dt><span class="section"><a href="Bv9ARM.ch09.html#relnotes_changes">Feature Changes</a></span></dt>
 <dt><span class="section"><a href="Bv9ARM.ch09.html#relnotes_bugs">Bug Fixes</a></span></dt>
@@ -537,6 +537,22 @@
                  zone, regardless of any other metadata.
                </p>
 	      </dd>
+<dt></dt>
+<dd>
+                <p>
+                  If key's sync publication date is set and in the past,
+		  synchronization records (type CDS and/or CDNSKEY) are
+		  created.
+                </p>
+	      </dd>
+<dt></dt>
+<dd>
+                <p>
+                  If key's sync deletion date is set and in the past,
+		  synchronization records (type CDS and/or CDNSKEY) are
+		  removed.
+                </p>
+	      </dd>
 </dl></div>
        </dd>
 <dt><span class="term">-T <em class="replaceable"><code>ttl</code></em></span></dt>
@@ -57,10 +57,11 @@
      anything other than the changes you made to our software.
    </p>
    <p>
-      This requirement will not affect anyone who is using BIND
-      without redistributing it, nor anyone redistributing it without
-      changes, therefore this change will be without consequence
-      for most individuals and organizations who are using BIND.
+      This requirement will not affect anyone who is using BIND, with
+      or without modifications, without redistributing it, nor anyone
+      redistributing it without changes. Therefore, this change will be
+      without consequence for most individuals and organizations who are
+      using BIND.
    </p>
    <p>
      Those unsure whether or not the license change affects their
@@ -72,10 +73,10 @@

  <div class="section">
 <div class="titlepage"><div><div><h3 class="title">
-<a name="win_support"></a>Windows XP No Longer Supported</h3></div></div></div>
+<a name="win_support"></a>Legacy Windows No Longer Supported</h3></div></div></div>
    <p>
-      As of BIND 9.11.2, Windows XP is no longer a supported platform for
-      BIND, and Windows XP binaries are no longer available for download
+      As of BIND 9.11.2, Windows XP and Windows 2003 are no longer supported
+      platforms for BIND; "XP" binaries are no longer available for download
      from ISC.
    </p>
  </div>
@@ -104,10 +105,12 @@
 <li class="listitem">
 	    <p>
 	      The additional cache ("acache") was found not to
-	      significantly improve performance and has been removed;
-	      the <span class="command"><strong>acache-enable</strong></span> and
-	      <span class="command"><strong>acache-cleaning-interval</strong></span> options are now
-	      deprecated.
+	      significantly improve performance and has been removed.
+	      As a result, the <span class="command"><strong>acache-enable</strong></span> and
+	      <span class="command"><strong>acache-cleaning-interval</strong></span> options no longer
+	      have any effect. For backwards compatibility, BIND will
+	      accept their presence in a configuration file, but
+	      will log a warning.
 	    </p>
 	  </li>
 <li class="listitem">
@@ -120,15 +123,16 @@
 	  </li>
 <li class="listitem">
 	    <p>
-	      The <span class="command"><strong>additional-from-cache</strong></span>
-	      and <span class="command"><strong>additional-from-auth</strong></span> options have been
-	      deprecated.
+	      <span class="command"><strong>minimal-responses</strong></span> is now set
+	      to <code class="literal">no-auth-recursive</code> by default.
 	    </p>
 	  </li>
 <li class="listitem">
 	    <p>
-	      <span class="command"><strong>minimal-responses</strong></span> is now set
-	      to <code class="literal">yes</code> by default.
+	      The <span class="command"><strong>additional-from-cache</strong></span>
+	      and <span class="command"><strong>additional-from-auth</strong></span> options no longer
+	      have any effect. <span class="command"><strong>named</strong></span> will log a warning
+	      if they are set.
 	    </p>
 	  </li>
 <li class="listitem">
@@ -303,13 +307,14 @@
 	  zone's validated CDS or CDNSKEY records. It can produce a
 	  <code class="filename">dsset</code> file suitable for input to
 	  <span class="command"><strong>dnssec-signzone</strong></span>, or a series of
-	  <span class="command"><strong>nsupdate</strong></span> to update the parent zone via dynamic
-	  DNS. Thanks to Tony Finch for the contribution.  [RT #46090]
+	  <span class="command"><strong>nsupdate</strong></span> commands to update the parent zone
+	  via dynamic DNS. Thanks to Tony Finch for the contribution.
+	  [RT #46090]
 	</p>
      </li>
 <li class="listitem">
 	<p>
-	  <span class="command"><strong>nsupdate</strong></span> and <span class="command"><strong>rndc</strong></span> now accepts
+	  <span class="command"><strong>nsupdate</strong></span> and <span class="command"><strong>rndc</strong></span> now accept
 	  command line options <span class="command"><strong>-4</strong></span> and <span class="command"><strong>-6</strong></span>
 	  which force using only IPv4 or only IPv6, respectively. [RT #45632]
 	</p>
@@ -458,6 +463,36 @@

  <div class="section">
 <div class="titlepage"><div><div><h3 class="title">
+<a name="relnotes_removed"></a>Removed Features</h3></div></div></div>
+    <div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; ">
+<li class="listitem">
+	<p>
+	  The ISC DNSSEC Lookaside Validation (DLV) service has been shut
+	  down; all DLV records in the dlv.isc.org zone have been removed.
+	  References to the service have been removed from BIND documentation.
+	  Lookaside validation is no longer used by default by
+	  <span class="command"><strong>delv</strong></span>. The DLV key has been removed from
+	  <code class="filename">bind.keys</code>. Setting
+	  <span class="command"><strong>dnssec-lookaside</strong></span> to
+	  <span class="command"><strong>auto</strong></span> or to use dlv.isc.org as a trust
+	  anchor is now a fatal configuration error. [RT #46155]
+	</p>
+      </li>
+<li class="listitem">
+	<p>
+	  As noted above, the <span class="command"><strong>acache-enable</strong></span>,
+	  <span class="command"><strong>acache-cleaning-interval</strong></span>,
+	  <span class="command"><strong>additional-from-cache</strong></span> and
+	  <span class="command"><strong>additional-from-auth</strong></span> options are no longer
+	  effective and <span class="command"><strong>named</strong></span> will log a warning if
+	  they are set.
+	</p>
+      </li>
+</ul></div>
+  </div>
+
+  <div class="section">
+<div class="titlepage"><div><div><h3 class="title">
 <a name="proto_changes"></a>Protocol Changes</h3></div></div></div>
    <div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; ">
 <li class="listitem">
@@ -467,13 +502,17 @@
 	  these algorithms must be supported in OpenSSL;
 	  currently they are only available in the development branch
 	  of OpenSSL at
-	  <a class="link" href="https://github.com/openssl/openssl" target="_top">https://github.com/openssl/openssl</a>.
+	  <a class="link" href="https://github.com/openssl/openssl" target="_top">
+	    https://github.com/openssl/openssl</a>.
 	  [RT #44696]
 	</p>
      </li>
 <li class="listitem">
 	<p>
-	  EDNS KEY TAG options are verified and printed.
+	  When parsing DNS messages, EDNS KEY TAG options are checked
+	  for correctness. When printing messages (for example, in
+	  <span class="command"><strong>dig</strong></span>), EDNS KEY TAG options are printed
+	  in readable format.
 	</p>
      </li>
 </ul></div>
@@ -491,7 +530,7 @@
 	  Lookaside validation is no longer used by default by
 	  <span class="command"><strong>delv</strong></span>. The DLV key has been removed from
 	  <code class="filename">bind.keys</code>. Setting
-	  <span class="command"><strong>dnssec-lookaside</strong></span> set to
+	  <span class="command"><strong>dnssec-lookaside</strong></span> to
 	  <span class="command"><strong>auto</strong></span> or to use dlv.isc.org as a trust
 	  anchor is now a fatal configuration error. [RT #46155]
 	</p>
@@ -612,15 +651,6 @@
 	  are now fully rolled back in the event of failure. [RT #45841]
 	</p>
      </li>
-<li class="listitem">
-	<p>
-	  Fixed a bug that was introduced in an earlier development
-	  release which caused multi-packet AXFR and IXFR messages to fail
-	  validation if not all packets contained TSIG records; this
-	  caused interoperability problems with some other DNS
-	  implementations. [RT #45509]
-	</p>
-      </li>
 <li class="listitem">
 	<p>
 	  Multiple <span class="command"><strong>cookie-secret</strong></span> clauses are now
@@ -647,19 +677,39 @@
 	  contribution. [RT #45689]
 	</p>
      </li>
+<li class="listitem">
+	<p>
+	  Trust anchor telemetry messages, as specified by
+	  RFC 8145, are now logged to the
+	  <span class="command"><strong>trust-anchor-telemetry</strong></span> logging
+	  catagory.
+	</p>
+      </li>
 </ul></div>
  </div>

  <div class="section">
 <div class="titlepage"><div><div><h3 class="title">
 <a name="relnotes_bugs"></a>Bug Fixes</h3></div></div></div>
-    <div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; "><li class="listitem">
+    <div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; ">
+<li class="listitem">
 	<p>
 	  The introduction of <span class="command"><strong>libns</strong></span> caused a bug
 	  in which TCP client objects were not recycled after use,
 	  leading to unconstrained memory growth. [RT #46029]
 	</p>
-      </li></ul></div>
+      </li>
+<li class="listitem">
+	<p>
+	  Some header files included &lt;isc/util.h&gt; incorrectly as
+	  it pollutes with namespace with non ISC_ macros and this should
+	  only be done by explicitly including &lt;isc/util.h&gt;.  This
+	  has been corrected.  Some code may depend on &lt;isc/util.h&gt;
+	  being implicitly included via other header files.  Such
+	  code should explicitly include &lt;isc/util.h&gt;.
+	</p>
+      </li>
+</ul></div>
  </div>

  <div class="section">
@@ -50,10 +50,11 @@
      anything other than the changes you made to our software.
    </para>
    <para>
-      This requirement will not affect anyone who is using BIND
-      without redistributing it, nor anyone redistributing it without
-      changes, therefore this change will be without consequence
-      for most individuals and organizations who are using BIND.
+      This requirement will not affect anyone who is using BIND, with
+      or without modifications, without redistributing it, nor anyone
+      redistributing it without changes. Therefore, this change will be
+      without consequence for most individuals and organizations who are
+      using BIND.
    </para>
    <para>
      Those unsure whether or not the license change affects their
@@ -65,10 +66,10 @@
    </para>
  </section>

-  <section xml:id="win_support"><info><title>Windows XP No Longer Supported</title></info>
+  <section xml:id="win_support"><info><title>Legacy Windows No Longer Supported</title></info>
    <para>
-      As of BIND 9.11.2, Windows XP is no longer a supported platform for
-      BIND, and Windows XP binaries are no longer available for download
+      As of BIND 9.11.2, Windows XP and Windows 2003 are no longer supported
+      platforms for BIND; "XP" binaries are no longer available for download
      from ISC.
    </para>
  </section>
@@ -95,10 +96,12 @@
 	  <listitem>
 	    <para>
 	      The additional cache ("acache") was found not to
-	      significantly improve performance and has been removed;
-	      the <command>acache-enable</command> and
-	      <command>acache-cleaning-interval</command> options are now
-	      deprecated.
+	      significantly improve performance and has been removed.
+	      As a result, the <command>acache-enable</command> and
+	      <command>acache-cleaning-interval</command> options no longer
+	      have any effect. For backwards compatibility, BIND will
+	      accept their presence in a configuration file, but
+	      will log a warning.
 	    </para>
 	  </listitem>
 	  <listitem>
@@ -111,15 +114,16 @@
 	  </listitem>
 	  <listitem>
 	    <para>
-	      The <command>additional-from-cache</command>
-	      and <command>additional-from-auth</command> options have been
-	      deprecated.
+	      <command>minimal-responses</command> is now set
+	      to <literal>no-auth-recursive</literal> by default.
 	    </para>
 	  </listitem>
 	  <listitem>
 	    <para>
-	      <command>minimal-responses</command> is now set
-	      to <literal>yes</literal> by default.
+	      The <command>additional-from-cache</command>
+	      and <command>additional-from-auth</command> options no longer
+	      have any effect. <command>named</command> will log a warning
+	      if they are set.
 	    </para>
 	  </listitem>
 	  <listitem>
@@ -294,13 +298,14 @@
 	  zone's validated CDS or CDNSKEY records. It can produce a
 	  <filename>dsset</filename> file suitable for input to
 	  <command>dnssec-signzone</command>, or a series of
-	  <command>nsupdate</command> to update the parent zone via dynamic
-	  DNS. Thanks to Tony Finch for the contribution.  [RT #46090]
+	  <command>nsupdate</command> commands to update the parent zone
+	  via dynamic DNS. Thanks to Tony Finch for the contribution.
+	  [RT #46090]
 	</para>
      </listitem>
      <listitem>
 	<para>
-	  <command>nsupdate</command> and <command>rndc</command> now accepts
+	  <command>nsupdate</command> and <command>rndc</command> now accept
 	  command line options <command>-4</command> and <command>-6</command>
 	  which force using only IPv4 or only IPv6, respectively. [RT #45632]
 	</para>
@@ -447,6 +452,56 @@
    </itemizedlist>
  </section>

+  <section xml:id="relnotes_removed"><info><title>Removed Features</title></info>
+    <itemizedlist>
+      <listitem>
+	<para>
+	  The ISC DNSSEC Lookaside Validation (DLV) service has been shut
+	  down; all DLV records in the dlv.isc.org zone have been removed.
+	  References to the service have been removed from BIND documentation.
+	  Lookaside validation is no longer used by default by
+	  <command>delv</command>. The DLV key has been removed from
+	  <filename>bind.keys</filename>. Setting
+	  <command>dnssec-lookaside</command> to
+	  <command>auto</command> or to use dlv.isc.org as a trust
+	  anchor is now a fatal configuration error. [RT #46155]
+	</para>
+      </listitem>
+      <listitem>
+	<para>
+	  As noted above, the <command>acache-enable</command>,
+	  <command>acache-cleaning-interval</command>,
+	  <command>additional-from-cache</command> and
+	  <command>additional-from-auth</command> options are no longer
+	  effective and <command>named</command> will log a warning if
+	  they are set.
+	</para>
+      </listitem>
+      <listitem>
+	<para>
+	  The use of <command>dnssec-keygen</command> to generate
+	  HMAC keys for TSIG authentication has been deprecated in favor
+	  of <command>tsig-keygen</command>. If the algorithms HMAC-MD5,
+	  HMAC-SHA1, HMAC-SHA224, HMAC-SHA256, HMAC-SHA384, or
+	  HMAC-SHA512 are specified, <command>dnssec-keygen</command>
+	  will print a warning message. These algorithms will be
+	  removed from <command>dnssec-keygen</command> entirely in
+	  a future release. [RT #42272]
+	</para>
+      </listitem>
+      <listitem>
+	<para>
+	  The use of HMAC-MD5 for RNDC keys is no longer recommended.
+	  For compatibility, this is still the default algorithm generated
+	  by <command>rndc-confgen</command>, but it will print a
+	  warning message. The default algorithm in
+	  <command>rndc-confgen</command> will be changed to HMAC-SHA256
+	  in a future release. [RT #42272]
+	</para>
+      </listitem>
+    </itemizedlist>
+  </section>
+
  <section xml:id="proto_changes"><info><title>Protocol Changes</title></info>
    <itemizedlist>
      <listitem>
@@ -456,13 +511,18 @@
 	  these algorithms must be supported in OpenSSL;
 	  currently they are only available in the development branch
 	  of OpenSSL at
-	  <link xmlns:xlink="http://www.w3.org/1999/xlink" xlink:href="https://github.com/openssl/openssl">https://github.com/openssl/openssl</link>.
+	  <link xmlns:xlink="http://www.w3.org/1999/xlink"
+	    xlink:href="https://github.com/openssl/openssl">
+	    https://github.com/openssl/openssl</link>.
 	  [RT #44696]
 	</para>
      </listitem>
      <listitem>
 	<para>
-	  EDNS KEY TAG options are verified and printed.
+	  When parsing DNS messages, EDNS KEY TAG options are checked
+	  for correctness. When printing messages (for example, in
+	  <command>dig</command>), EDNS KEY TAG options are printed
+	  in readable format.
 	</para>
      </listitem>
    </itemizedlist>
@@ -478,7 +538,7 @@
 	  Lookaside validation is no longer used by default by
 	  <command>delv</command>. The DLV key has been removed from
 	  <filename>bind.keys</filename>. Setting
-	  <command>dnssec-lookaside</command> set to
+	  <command>dnssec-lookaside</command> to
 	  <command>auto</command> or to use dlv.isc.org as a trust
 	  anchor is now a fatal configuration error. [RT #46155]
 	</para>
@@ -599,15 +659,6 @@
 	  are now fully rolled back in the event of failure. [RT #45841]
 	</para>
      </listitem>
-      <listitem>
-	<para>
-	  Fixed a bug that was introduced in an earlier development
-	  release which caused multi-packet AXFR and IXFR messages to fail
-	  validation if not all packets contained TSIG records; this
-	  caused interoperability problems with some other DNS
-	  implementations. [RT #45509]
-	</para>
-      </listitem>
      <listitem>
 	<para>
 	  Multiple <command>cookie-secret</command> clauses are now
@@ -634,6 +685,14 @@
 	  contribution. [RT #45689]
 	</para>
      </listitem>
+      <listitem>
+	<para>
+	  Trust anchor telemetry messages, as specified by
+	  RFC 8145, are now logged to the
+	  <command>trust-anchor-telemetry</command> logging
+	  catagory.
+	</para>
+      </listitem>
    </itemizedlist>
  </section>

@@ -646,6 +705,16 @@
 	  leading to unconstrained memory growth. [RT #46029]
 	</para>
      </listitem>
+      <listitem>
+	<para>
+	  Some header files included &lt;isc/util.h&gt; incorrectly as
+	  it pollutes with namespace with non ISC_ macros and this should
+	  only be done by explicitly including &lt;isc/util.h&gt;.  This
+	  has been corrected.  Some code may depend on &lt;isc/util.h&gt;
+	  being implicitly included via other header files.  Such
+	  code should explicitly include &lt;isc/util.h&gt;.
+	</para>
+      </listitem>
    </itemizedlist>
  </section>

@@ -992,13 +992,13 @@ ENABLE_PREPROCESSING   = YES
 # compilation will be performed. Macro expansion can be done in a controlled 
 # way by setting EXPAND_ONLY_PREDEF to YES.

-MACRO_EXPANSION        = NO
+MACRO_EXPANSION        = YES

 # If the EXPAND_ONLY_PREDEF and MACRO_EXPANSION tags are both set to YES 
 # then the macro expansion is limited to the macros specified with the 
 # PREDEFINED and EXPAND_AS_DEFINED tags.

-EXPAND_ONLY_PREDEF     = NO
+EXPAND_ONLY_PREDEF     = YES

 # If the SEARCH_INCLUDES tag is set to YES (the default) the includes files 
 # in the INCLUDE_PATH (see below) will be search if a #include is found.
@@ -1026,7 +1026,8 @@ INCLUDE_FILE_PATTERNS  =
 # undefined via #undef or recursively expanded use the := operator 
 # instead of the = operator.

-PREDEFINED             = 
+PREDEFINED             = "ISC_FORMAT_PRINTF(fmt, args)=" \
+			 "LIBRPZ_PF(f, l)="

 # If the MACRO_EXPANSION and EXPAND_ONLY_PREDEF tags are set to YES then 
 # this tag can be used to specify a list of macro names that should be expanded. 
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2001, 2004-2007, 2009, 2016  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2001, 2004-2007, 2009, 2016, 2017  Internet Systems Consortium, Inc. ("ISC")
 *
 * This Source Code Form is subject to the terms of the Mozilla Public
 * License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -43,7 +43,7 @@ bind9_getaddresses(const char *hostname, in_port_t port,
 * Returns:
 *\li	#ISC_R_SUCCESS
 *\li	#ISC_R_NOTFOUND
- *\li	#ISC_R_NOFAMILYSUPPORT - 'hostname' is an IPv6 address, and IPv6 is
+ *\li	#ISC_R_FAMILYNOSUPPORT - 'hostname' is an IPv6 address, and IPv6 is
 *		not supported.
 */

@@ -17,6 +17,7 @@
 #include <isc/result.h>
 #include <isc/sha2.h>
 #include <isc/task.h>
+#include <isc/util.h>

 #include <dns/catz.h>
 #include <dns/dbiterator.h>
@@ -45,6 +45,7 @@
 ***** Imports
 *****/

+#include <isc/deprecated.h>
 #include <isc/lang.h>
 #include <isc/magic.h>
 #include <isc/ondestroy.h>
@@ -859,14 +860,6 @@ dns_db_findext(dns_db_t *db, const dns_name_t *name, dns_dbversion_t *version,
 *	\li	#ISC_R_SUCCESS			The desired node and type were
 *						found.
 *
- *	\li	#DNS_R_WILDCARD			The desired node and type were
- *						found after performing
- *						wildcard matching.  This is
- *						only returned if the
- *						#DNS_DBFIND_INDICATEWILD
- *						option is set; otherwise
- *						#ISC_R_SUCCESS is returned.
- *
 *	\li	#DNS_R_GLUE			The desired node and type were
 *						found, but are glue.  This
 *						result can only occur if
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2011-2013, 2016  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2011-2013, 2016, 2017  Internet Systems Consortium, Inc. ("ISC")
 *
 * This Source Code Form is subject to the terms of the Mozilla Public
 * License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -8,7 +8,7 @@

 /* $Id$ */

-/*! \file dns/dlz_open.h */
+/*! \file dns/dlz_dlopen.h */

 #ifndef DLZ_DLOPEN_H
 #define DLZ_DLOPEN_H
@@ -355,7 +355,7 @@ dns_dt_open(const char *filename, dns_dtmode_t mode,
 *\li	#ISC_R_NOMEMORY if the fstrm library was unable to allocate a
 *      reader or options structure
 *\li	#ISC_R_FAILURE if 'filename' could not be opened.
- *\li	#ISC_R_BADDNSTAP if 'filename' does not contain a dnstap
+ *\li	#DNS_R_BADDNSTAP if 'filename' does not contain a dnstap
 *      framestream.
 */

@@ -393,7 +393,7 @@ LIBDEF_F(clist_detach)
 /**
 * Create a librpz client handle.
 * @param[out] emsg: error message
- * @param: list of dnsrpzd connections
+ * @param clist: of dnsrpzd connections
 * @param cstr: string of configuration settings separated by ';' or '\n'
 * @param use_expired: true to not ignore expired zones
 * @return client handle or NULL if the handle could not be created
@@ -668,7 +668,7 @@ LIBDEF_F(db_info)
 /**
 * Start a context for listing the nodes and/or zones in the mapped file
 * @param[out] emsg: error message for false return or *rspp=NULL
- * @param[out[ rspp created context or NULL
+ * @param[out] rspp: created context or NULL
 * @param client context
 * @return false after error
 */
@@ -814,8 +814,6 @@ dns_name_fromtext(dns_name_t *name, isc_buffer_t *source,
 *\li	#DNS_R_EMPTYLABEL
 *\li	#DNS_R_LABELTOOLONG
 *\li	#DNS_R_BADESCAPE
- *\li	(#DNS_R_BADBITSTRING: should not be returned)
- *\li	(#DNS_R_BITSTRINGTOOLONG: should not be returned)
 *\li	#DNS_R_BADDOTTEDQUAD
 *\li	#ISC_R_NOSPACE
 *\li	#ISC_R_UNEXPECTEDEND
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2002, 2004-2007, 2016  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2002, 2004-2007, 2016, 2017  Internet Systems Consortium, Inc. ("ISC")
 *
 * This Source Code Form is subject to the terms of the Mozilla Public
 * License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -44,8 +44,8 @@ dns_order_add(dns_order_t *order, const dns_name_t *name,
 * Requires:
 * \li	'order' to be valid.
 *\li	'name' to be valid.
- *\li	'mode' to be one of #DNS_RDATASERATTR_RANDOMIZE,
- *		#DNS_RDATASERATTR_RANDOMIZE or zero (#DNS_RDATASERATTR_CYCLIC).
+ *\li	'mode' to be one of #DNS_RDATASETATTR_RANDOMIZE,
+ *		#DNS_RDATASETATTR_FIXEDORDER or zero (#DNS_RDATASETATTR_CYCLIC).
 *
 * Returns:
 *\li	#ISC_R_SUCCESS
@@ -13,6 +13,7 @@

 /*! \file dns/rbt.h */

+#include <isc/assertions.h>
 #include <isc/crc64.h>
 #include <isc/lang.h>
 #include <isc/magic.h>
@@ -1077,7 +1078,7 @@ dns_rbtnodechain_nextflat(dns_rbtnodechain_t *chain, dns_name_t *name);
 	} while (0)
 #else  /* DNS_RBT_USEISCREFCOUNT */
 #define dns_rbtnode_refinit(node, n)    ((node)->references = (n))
-#define dns_rbtnode_refdestroy(node)    REQUIRE((node)->references == 0)
+#define dns_rbtnode_refdestroy(node)    ISC_REQUIRE((node)->references == 0)
 #define dns_rbtnode_refcurrent(node)    ((node)->references)

 #if (__STDC_VERSION__ + 0) >= 199901L || defined __GNUC__
@@ -1090,7 +1091,7 @@ dns_rbtnode_refincrement0(dns_rbtnode_t *node, unsigned int *refs) {

 static inline void
 dns_rbtnode_refincrement(dns_rbtnode_t *node, unsigned int *refs) {
-	REQUIRE(node->references > 0);
+	ISC_REQUIRE(node->references > 0);
 	node->references++;
 	if (refs != NULL)
 		*refs = node->references;
@@ -1098,7 +1099,7 @@ dns_rbtnode_refincrement(dns_rbtnode_t *node, unsigned int *refs) {

 static inline void
 dns_rbtnode_refdecrement(dns_rbtnode_t *node, unsigned int *refs) {
-	REQUIRE(node->references > 0);
+	ISC_REQUIRE(node->references > 0);
 	node->references--;
 	if (refs != NULL)
 		*refs = node->references;
@@ -1113,14 +1114,14 @@ dns_rbtnode_refdecrement(dns_rbtnode_t *node, unsigned int *refs) {
 	} while (0)
 #define dns_rbtnode_refincrement(node, refs)                    \
 	do {                                                    \
-		REQUIRE((node)->references > 0);                \
+		ISC_REQUIRE((node)->references > 0);                \
 		(node)->references++;                           \
 		if ((refs) != NULL)                             \
 			(*refs) = (node)->references;           \
 	} while (0)
 #define dns_rbtnode_refdecrement(node, refs)                    \
 	do {                                                    \
-		REQUIRE((node)->references > 0);                \
+		ISC_REQUIRE((node)->references > 0);                \
 		(node)->references--;                           \
 		if ((refs) != NULL)                             \
 			(*refs) = (node)->references;           \
@@ -10,12 +10,13 @@
 #ifndef DNS_RPZ_H
 #define DNS_RPZ_H 1

+#include <isc/deprecated.h>
+#include <isc/event.h>
+#include <isc/ht.h>
 #include <isc/lang.h>
 #include <isc/refcount.h>
 #include <isc/rwlock.h>
-#include <isc/ht.h>
 #include <isc/time.h>
-#include <isc/event.h>
 #include <isc/timer.h>

 #include <dns/fixedname.h>
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2007-2009, 2013, 2014, 2016  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2007-2009, 2013, 2014, 2016, 2017  Internet Systems Consortium, Inc. ("ISC")
 *
 * This Source Code Form is subject to the terms of the Mozilla Public
 * License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -10,6 +10,7 @@

 #include <isc/mem.h>
 #include <isc/radix.h>
+#include <isc/util.h>

 #include <dns/acl.h>

@@ -13,4 +13,4 @@
 # Whenever releasing a new major release of BIND9, set this value
 # back to 1.0 when releasing the first alpha.  Map files are *never*
 # compatible across major releases.
-MAPAPI=1.0
+MAPAPI=1.1
@@ -6,8 +6,6 @@
 * file, You can obtain one at http://mozilla.org/MPL/2.0/.
 */

-/* $Id$ */
-
 #include "config.h"

 #include <isc/base64.h>
@@ -15,6 +13,7 @@
 #include <isc/result.h>
 #include <isc/string.h>
 #include <isc/types.h>
+#include <isc/util.h>

 #include <dns/nsec3.h>
 #include <dns/private.h>
@@ -226,11 +226,11 @@ getdata(dns_rbtnode_t *node, file_header_t *header) {
 * The variable length stuff stored after the node has the following
 * structure.
 *
- *	<name_data>{1..255}<oldoffsetlen>{1}<offsets>{1..128}
+ *	&lt;name_data&gt;{1..255}&lt;oldoffsetlen&gt;{1}&lt;offsets&gt;{1..128}
 *
- * <name_data> contains the name of the node when it was created.
- * <oldoffsetlen> contains the length of <offsets> when the node was created.
- * <offsets> contains the offets into name for each label when the node was
+ * &lt;name_data&gt; contains the name of the node when it was created.
+ * &lt;oldoffsetlen&gt; contains the length of &lt;offsets&gt; when the node was created.
+ * &lt;offsets&gt; contains the offets into name for each label when the node was
 * created.
 */

@@ -19,6 +19,7 @@
 #include <isc/net.h>
 #include <isc/netaddr.h>
 #include <isc/print.h>
+#include <isc/util.h>

 #include <dns/result.h>
 #include <dns/rcode.h>
@@ -1,16 +1,15 @@
 /*
- * Copyright (C) 2009, 2010, 2016  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2009, 2010, 2016, 2017  Internet Systems Consortium, Inc. ("ISC")
 *
 * This Source Code Form is subject to the terms of the Mozilla Public
 * License, v. 2.0. If a copy of the MPL was not distributed with this
 * file, You can obtain one at http://mozilla.org/MPL/2.0/.
 */

-/* $Id: tsec.c,v 1.7 2010/12/09 00:54:34 marka Exp $ */
-
 #include <config.h>

 #include <isc/mem.h>
+#include <isc/util.h>

 #include <pk11/site.h>

@@ -17,12 +17,12 @@ VERSION=@BIND9_VERSION@
 #
 HEADERS =	aes.h app.h assertions.h backtrace.h base32.h base64.h \
 		bind9.h boolean.h buffer.h bufferlist.h \
-		commandline.h counter.h crc64.h \
+		commandline.h counter.h crc64.h deprecated.h \
 		entropy.h errno.h error.h event.h eventclass.h \
 		file.h formatcheck.h fsaccess.h fuzz.h \
 		hash.h heap.h hex.h hmacmd5.h hmacsha.h ht.h httpd.h \
 		interfaceiter.h @ISC_IPV6_H@ iterated_hash.h \
-		json.h lang.h lex.h lfsr.h lib.h list.h log.h \
+		json.h lang.h lex.h lfsr.h lib.h likely.h list.h log.h \
 		magic.h md5.h mem.h meminfo.h msgcat.h msgs.h mutexblock.h \
 		netaddr.h netscope.h ondestroy.h os.h parseint.h \
 		pool.h portset.h print.h queue.h quota.h \
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 1997-2001, 2004-2009, 2016  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 1997-2001, 2004-2009, 2016, 2017  Internet Systems Consortium, Inc. ("ISC")
 *
 * This Source Code Form is subject to the terms of the Mozilla Public
 * License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -16,6 +16,7 @@
 #define ISC_ASSERTIONS_H 1

 #include <isc/lang.h>
+#include <isc/likely.h>
 #include <isc/platform.h>

 ISC_LANG_BEGINDECLS
@@ -96,7 +96,10 @@
 *** Imports
 ***/

+#include <isc/assertions.h>
+#include <isc/formatcheck.h>
 #include <isc/lang.h>
+#include <isc/likely.h>
 #include <isc/magic.h>
 #include <isc/types.h>

@@ -910,10 +913,10 @@ ISC_LANG_ENDDECLS
 	do { \
 		if (ISC_UNLIKELY((_b)->autore)) { \
 			isc_buffer_t *_tmp = _b; \
-			REQUIRE(isc_buffer_reserve(&_tmp, _length) \
+			ISC_REQUIRE(isc_buffer_reserve(&_tmp, _length) \
 				== ISC_R_SUCCESS); \
 		} \
-		REQUIRE(isc_buffer_availablelength(_b) >= (unsigned int) _length); \
+		ISC_REQUIRE(isc_buffer_availablelength(_b) >= (unsigned int) _length); \
 		memmove(isc_buffer_used(_b), (_base), (_length)); \
 		(_b)->used += (_length); \
 	} while (0)
@@ -925,10 +928,10 @@ ISC_LANG_ENDDECLS
 		_length = strlen(_source); \
 		if (ISC_UNLIKELY((_b)->autore)) { \
 			isc_buffer_t *_tmp = _b; \
-			REQUIRE(isc_buffer_reserve(&_tmp, _length) \
+			ISC_REQUIRE(isc_buffer_reserve(&_tmp, _length) \
 				== ISC_R_SUCCESS); \
 		} \
-		REQUIRE(isc_buffer_availablelength(_b) >= (unsigned int) _length); \
+		ISC_REQUIRE(isc_buffer_availablelength(_b) >= (unsigned int) _length); \
 		_cp = isc_buffer_used(_b); \
 		memmove(_cp, (_source), _length); \
 		(_b)->used += (_length); \
@@ -941,10 +944,10 @@ ISC_LANG_ENDDECLS
 		isc_uint8_t _val2 = (_val); \
 		if (ISC_UNLIKELY((_b)->autore)) { \
 			isc_buffer_t *_tmp = _b; \
-			REQUIRE(isc_buffer_reserve(&_tmp, 1) \
+			ISC_REQUIRE(isc_buffer_reserve(&_tmp, 1) \
 				== ISC_R_SUCCESS); \
 		} \
-		REQUIRE(isc_buffer_availablelength(_b) >= 1U); \
+		ISC_REQUIRE(isc_buffer_availablelength(_b) >= 1U); \
 		_cp = isc_buffer_used(_b); \
 		(_b)->used++; \
 		_cp[0] = _val2; \
@@ -957,10 +960,10 @@ ISC_LANG_ENDDECLS
 		isc_uint16_t _val2 = (_val); \
 		if (ISC_UNLIKELY((_b)->autore)) { \
 			isc_buffer_t *_tmp = _b; \
-			REQUIRE(isc_buffer_reserve(&_tmp, 2) \
+			ISC_REQUIRE(isc_buffer_reserve(&_tmp, 2) \
 				== ISC_R_SUCCESS); \
 		} \
-		REQUIRE(isc_buffer_availablelength(_b) >= 2U); \
+		ISC_REQUIRE(isc_buffer_availablelength(_b) >= 2U); \
 		_cp = isc_buffer_used(_b); \
 		(_b)->used += 2; \
 		_cp[0] = (unsigned char)(_val2 >> 8); \
@@ -974,10 +977,10 @@ ISC_LANG_ENDDECLS
 		isc_uint32_t _val2 = (_val); \
 		if (ISC_UNLIKELY((_b)->autore)) { \
 			isc_buffer_t *_tmp = _b; \
-			REQUIRE(isc_buffer_reserve(&_tmp, 3) \
+			ISC_REQUIRE(isc_buffer_reserve(&_tmp, 3) \
 				== ISC_R_SUCCESS); \
 		} \
-		REQUIRE(isc_buffer_availablelength(_b) >= 3U); \
+		ISC_REQUIRE(isc_buffer_availablelength(_b) >= 3U); \
 		_cp = isc_buffer_used(_b); \
 		(_b)->used += 3; \
 		_cp[0] = (unsigned char)(_val2 >> 16); \
@@ -992,10 +995,10 @@ ISC_LANG_ENDDECLS
 		isc_uint32_t _val2 = (_val); \
 		if (ISC_UNLIKELY((_b)->autore)) { \
 			isc_buffer_t *_tmp = _b; \
-			REQUIRE(isc_buffer_reserve(&_tmp, 4) \
+			ISC_REQUIRE(isc_buffer_reserve(&_tmp, 4) \
 				== ISC_R_SUCCESS); \
 		} \
-		REQUIRE(isc_buffer_availablelength(_b) >= 4U); \
+		ISC_REQUIRE(isc_buffer_availablelength(_b) >= 4U); \
 		_cp = isc_buffer_used(_b); \
 		(_b)->used += 4; \
 		_cp[0] = (unsigned char)(_val2 >> 24); \
@@ -0,0 +1,19 @@
+/*
+ * Copyright (C) 2017  Internet Systems Consortium, Inc. ("ISC")
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ */
+
+
+#ifndef ISC_DEPRECATED_H
+#define ISC_DEPRECATED_H
+
+#ifdef __GNUC__
+#define ISC_DEPRECATED                  __attribute__((deprecated))
+#else
+#define ISC_DEPRECATED                  /* none */
+#endif /* __GNUC __ */
+
+#endif
@@ -17,6 +17,7 @@

 #include <isc/formatcheck.h>
 #include <isc/lang.h>
+#include <isc/likely.h>
 #include <isc/platform.h>

 ISC_LANG_BEGINDECLS
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2003-2007, 2009, 2013-2016  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2003-2007, 2009, 2013-2017  Internet Systems Consortium, Inc. ("ISC")
 *
 * This Source Code Form is subject to the terms of the Mozilla Public
 * License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -9,8 +9,8 @@
 #ifndef ISC_HASH_H
 #define ISC_HASH_H 1

+#include <isc/deprecated.h>
 #include <isc/types.h>
-#include <isc/util.h>

 /*****
 ***** Module Info
@@ -0,0 +1,23 @@
+/*
+ * Copyright (C) 2017  Internet Systems Consortium, Inc. ("ISC")
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ */
+
+#ifndef ISC_LIKELY_H
+#define ISC_LIKELY_H 1
+
+/*%
+ * Performance
+ */
+#ifdef HAVE_BUILTIN_EXPECT
+#define ISC_LIKELY(x)            __builtin_expect(!!(x), 1)
+#define ISC_UNLIKELY(x)          __builtin_expect(!!(x), 0)
+#else
+#define ISC_LIKELY(x)            (x)
+#define ISC_UNLIKELY(x)          (x)
+#endif
+
+#endif /* ISC_LIKELY_H */
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 1999-2001, 2004-2007, 2016  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 1999-2001, 2004-2007, 2016, 2017  Internet Systems Consortium, Inc. ("ISC")
 *
 * This Source Code Form is subject to the terms of the Mozilla Public
 * License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -11,7 +11,7 @@
 #ifndef ISC_MAGIC_H
 #define ISC_MAGIC_H 1

-#include <isc/util.h>
+#include <isc/likely.h>

 /*! \file isc/magic.h */

@@ -11,12 +11,13 @@
 #ifndef ISC_REFCOUNT_H
 #define ISC_REFCOUNT_H 1

+#include <isc/assertions.h>
 #include <isc/atomic.h>
+#include <isc/error.h>
 #include <isc/lang.h>
 #include <isc/mutex.h>
 #include <isc/platform.h>
 #include <isc/types.h>
-#include <isc/util.h>

 #if defined(ISC_PLATFORM_HAVESTDATOMIC)
 #include <stdatomic.h>
@@ -109,7 +110,7 @@ typedef struct isc_refcount {
 #define isc_refcount_current(rp)					\
 	((unsigned int)(atomic_load_explicit(&(rp)->refs,		\
 					     memory_order_relaxed)))
-#define isc_refcount_destroy(rp) REQUIRE(isc_refcount_current(rp) == 0)
+#define isc_refcount_destroy(rp) ISC_REQUIRE(isc_refcount_current(rp) == 0)

 #define isc_refcount_increment0(rp, tp)				\
 	do {							\
@@ -127,7 +128,7 @@ typedef struct isc_refcount {
 		isc_int32_t prev;				\
 		prev = atomic_fetch_add_explicit		\
 			(&(rp)->refs, 1, memory_order_relaxed); \
-		REQUIRE(prev > 0);				\
+		ISC_REQUIRE(prev > 0);				\
 		if (_tmp != NULL)				\
 			*_tmp = prev + 1;			\
 	} while (0)
@@ -138,7 +139,7 @@ typedef struct isc_refcount {
 		isc_int32_t prev;				\
 		prev = atomic_fetch_sub_explicit		\
 			(&(rp)->refs, 1, memory_order_relaxed); \
-		REQUIRE(prev > 0);				\
+		ISC_REQUIRE(prev > 0);				\
 		if (_tmp != NULL)				\
 			*_tmp = prev - 1;			\
 	} while (0)
@@ -147,7 +148,7 @@ typedef struct isc_refcount {

 #define isc_refcount_current(rp)				\
 	((unsigned int)(isc_atomic_xadd(&(rp)->refs, 0)))
-#define isc_refcount_destroy(rp) REQUIRE(isc_refcount_current(rp) == 0)
+#define isc_refcount_destroy(rp) ISC_REQUIRE(isc_refcount_current(rp) == 0)

 #define isc_refcount_increment0(rp, tp)				\
 	do {							\
@@ -163,7 +164,7 @@ typedef struct isc_refcount {
 		unsigned int *_tmp = (unsigned int *)(tp);	\
 		isc_int32_t prev;				\
 		prev = isc_atomic_xadd(&(rp)->refs, 1);		\
-		REQUIRE(prev > 0);				\
+		ISC_REQUIRE(prev > 0);				\
 		if (_tmp != NULL)				\
 			*_tmp = prev + 1;			\
 	} while (0)
@@ -173,7 +174,7 @@ typedef struct isc_refcount {
 		unsigned int *_tmp = (unsigned int *)(tp);	\
 		isc_int32_t prev;				\
 		prev = isc_atomic_xadd(&(rp)->refs, -1);	\
-		REQUIRE(prev > 0);				\
+		ISC_REQUIRE(prev > 0);				\
 		if (_tmp != NULL)				\
 			*_tmp = prev - 1;			\
 	} while (0)
@@ -188,46 +189,63 @@ typedef struct isc_refcount {
 } isc_refcount_t;

 /*% Destroys a reference counter. */
-#define isc_refcount_destroy(rp)			\
-	do {						\
-		REQUIRE((rp)->refs == 0);		\
-		DESTROYLOCK(&(rp)->lock);		\
+#define isc_refcount_destroy(rp)					\
+	do {								\
+		isc_result_t _result;					\
+		ISC_REQUIRE((rp)->refs == 0);				\
+		_result = isc_mutex_destroy(&(rp)->lock);		\
+		ISC_ERROR_RUNTIMECHECK(_result == ISC_R_SUCCESS);	\
 	} while (0)

 #define isc_refcount_current(rp) ((unsigned int)((rp)->refs))

-/*% Increments the reference count, returning the new value in targetp if it's not NULL. */
-#define isc_refcount_increment0(rp, tp)				\
-	do {							\
-		unsigned int *_tmp = (unsigned int *)(tp);	\
-		LOCK(&(rp)->lock);				\
-		++((rp)->refs);					\
-		if (_tmp != NULL)				\
-			*_tmp = ((rp)->refs);			\
-		UNLOCK(&(rp)->lock);				\
+/*%
+ * Increments the reference count, returning the new value in
+ * 'tp' if it's not NULL.
+ */
+#define isc_refcount_increment0(rp, tp)					\
+	do {								\
+		isc_result_t _result;					\
+		unsigned int *_tmp = (unsigned int *)(tp);		\
+		_result = isc_mutex_lock(&(rp)->lock);			\
+		ISC_ERROR_RUNTIMECHECK(_result == ISC_R_SUCCESS);	\
+		++((rp)->refs);						\
+		if (_tmp != NULL)					\
+			*_tmp = ((rp)->refs);				\
+		_result = isc_mutex_unlock(&(rp)->lock);		\
+		ISC_ERROR_RUNTIMECHECK(_result == ISC_R_SUCCESS);	\
 	} while (0)

-#define isc_refcount_increment(rp, tp)				\
-	do {							\
-		unsigned int *_tmp = (unsigned int *)(tp);	\
-		LOCK(&(rp)->lock);				\
-		REQUIRE((rp)->refs > 0);			\
-		++((rp)->refs);					\
-		if (_tmp != NULL)				\
-			*_tmp = ((rp)->refs);			\
-		UNLOCK(&(rp)->lock);				\
+#define isc_refcount_increment(rp, tp)					\
+	do {								\
+		isc_result_t _result;					\
+		unsigned int *_tmp = (unsigned int *)(tp);		\
+		_result = isc_mutex_lock(&(rp)->lock);			\
+		ISC_ERROR_RUNTIMECHECK(_result == ISC_R_SUCCESS);	\
+		ISC_REQUIRE((rp)->refs > 0);				\
+		++((rp)->refs);						\
+		if (_tmp != NULL)					\
+			*_tmp = ((rp)->refs);				\
+		_result = isc_mutex_unlock(&(rp)->lock);		\
+		ISC_ERROR_RUNTIMECHECK(_result == ISC_R_SUCCESS);	\
 	} while (0)

-/*% Decrements the reference count,  returning the new value in targetp if it's not NULL. */
-#define isc_refcount_decrement(rp, tp)				\
-	do {							\
-		unsigned int *_tmp = (unsigned int *)(tp);	\
-		LOCK(&(rp)->lock);				\
-		REQUIRE((rp)->refs > 0);			\
-		--((rp)->refs);					\
-		if (_tmp != NULL)				\
-			*_tmp = ((rp)->refs);			\
-		UNLOCK(&(rp)->lock);				\
+/*%
+ * Decrements the reference count, returning the new value in 'tp'
+ * if it's not NULL.
+ */
+#define isc_refcount_decrement(rp, tp)					\
+	do {								\
+		isc_result_t _result;					\
+		unsigned int *_tmp = (unsigned int *)(tp);		\
+		_result = isc_mutex_lock(&(rp)->lock);			\
+		ISC_ERROR_RUNTIMECHECK(_result == ISC_R_SUCCESS);	\
+		ISC_REQUIRE((rp)->refs > 0);				\
+		--((rp)->refs);						\
+		if (_tmp != NULL)					\
+			*_tmp = ((rp)->refs);				\
+		_result = isc_mutex_unlock(&(rp)->lock);		\
+		ISC_ERROR_RUNTIMECHECK(_result == ISC_R_SUCCESS);	\
 	} while (0)

 #endif /* (defined(ISC_PLATFORM_HAVESTDATOMIC) && defined(ATOMIC_INT_LOCK_FREE)) || defined(ISC_PLATFORM_HAVEXADD) */
@@ -237,7 +255,7 @@ typedef struct isc_refcount {
 	int refs;
 } isc_refcount_t;

-#define isc_refcount_destroy(rp) REQUIRE((rp)->refs == 0)
+#define isc_refcount_destroy(rp) ISC_REQUIRE((rp)->refs == 0)
 #define isc_refcount_current(rp) ((unsigned int)((rp)->refs))

 #define isc_refcount_increment0(rp, tp)					\
@@ -252,7 +270,7 @@ typedef struct isc_refcount {
 	do {								\
 		unsigned int *_tmp = (unsigned int *)(tp);		\
 		int _n;							\
-		REQUIRE((rp)->refs > 0);				\
+		ISC_REQUIRE((rp)->refs > 0);				\
 		_n = ++(rp)->refs;					\
 		if (_tmp != NULL)					\
 			*_tmp = _n;					\
@@ -262,7 +280,7 @@ typedef struct isc_refcount {
 	do {								\
 		unsigned int *_tmp = (unsigned int *)(tp);		\
 		int _n;							\
-		REQUIRE((rp)->refs > 0);				\
+		ISC_REQUIRE((rp)->refs > 0);				\
 		_n = --(rp)->refs;					\
 		if (_tmp != NULL)					\
 			*_tmp = _n;					\
@@ -458,7 +458,7 @@ isc_task_onshutdown(isc_task_t *task, isc_taskaction_t action,
 *
 *\li	#ISC_R_SUCCESS
 *\li	#ISC_R_NOMEMORY
- *\li	#ISC_R_TASKSHUTTINGDOWN			Task is shutting down.
+ *\li	#ISC_R_SHUTTINGDOWN			Task is shutting down.
 */

 void
@@ -1,13 +1,11 @@
 /*
- * Copyright (C) 1998-2001, 2004-2007, 2010-2012, 2015, 2016  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 1998-2001, 2004-2007, 2010-2012, 2015-2017  Internet Systems Consortium, Inc. ("ISC")
 *
 * This Source Code Form is subject to the terms of the Mozilla Public
 * License, v. 2.0. If a copy of the MPL was not distributed with this
 * file, You can obtain one at http://mozilla.org/MPL/2.0/.
 */

-/* $Id$ */
-
 #ifndef ISC_UTIL_H
 #define ISC_UTIL_H 1

@@ -200,13 +198,7 @@
 /*%
 * Performance
 */
-#ifdef HAVE_BUILTIN_EXPECT
-#define ISC_LIKELY(x)            __builtin_expect(!!(x), 1)
-#define ISC_UNLIKELY(x)          __builtin_expect(!!(x), 0)
-#else
-#define ISC_LIKELY(x)            (x)
-#define ISC_UNLIKELY(x)          (x)
-#endif
+#include <isc/likely.h>

 /*
 * Assertions
@@ -240,12 +232,8 @@
 #define TIME_NOW(tp) 	RUNTIME_CHECK(isc_time_now((tp)) == ISC_R_SUCCESS)

 /*%
- * Misc.
+ * Misc
 */
-#ifdef __GNUC__
-#define ISC_DEPRECATED			__attribute__((deprecated))
-#else
-#define ISC_DEPRECATED			/* none */
-#endif /* __GNUC __ */
+#include <isc/deprecated.h>

 #endif /* ISC_UTIL_H */
@@ -15,6 +15,7 @@
 #include <isc/mutex.h>
 #include <isc/refcount.h>
 #include <isc/result.h>
+#include <isc/util.h>

 isc_result_t
 isc_refcount_init(isc_refcount_t *ref, unsigned int n) {
@@ -23,6 +23,8 @@
 #include <isc/string.h>
 #include <isc/util.h>

+#include <inttypes.h>
+
 static void *
 default_memalloc(void *arg, size_t size) {
 	UNUSED(arg);
@@ -37,18 +39,20 @@ default_memfree(void *arg, void *ptr) {
 	free(ptr);
 }

-
-static void test_ht_full(int bits, int count) {
+static void test_ht_full(int bits, uintptr_t count) {
 	isc_ht_t *ht = NULL;
 	isc_result_t result;
 	isc_mem_t *mctx = NULL;
-	isc_int64_t i;
+	uintptr_t i;

 	result = isc_mem_createx2(0, 0, default_memalloc, default_memfree,
 				  NULL, &mctx, 0);
 	ATF_REQUIRE_EQ(result, ISC_R_SUCCESS);

-	isc_ht_init(&ht, mctx, bits);
+	result = isc_ht_init(&ht, mctx, bits);
+	ATF_REQUIRE_EQ(result, ISC_R_SUCCESS);
+	ATF_REQUIRE(ht != NULL);
+
 	for (i = 1; i < count; i++) {
 		/*
 		 * Note: snprintf() is followed with strlcat()
@@ -68,7 +72,7 @@ static void test_ht_full(int bits, int count) {
 		strlcat((char *)key, " key of a raw hashtable!!", sizeof(key));
 		result = isc_ht_find(ht, key, 16, &f);
 		ATF_REQUIRE_EQ(result, ISC_R_SUCCESS);
-		ATF_REQUIRE_EQ(i, (isc_int64_t) f);
+		ATF_REQUIRE_EQ(i, (uintptr_t) f);
 	}

 	for (i = 1; i < count; i++) {
@@ -164,7 +168,7 @@ static void test_ht_full(int bits, int count) {
 		strlcat((char *)key, " KEY of a raw hashtable!!", sizeof(key));
 		result = isc_ht_find(ht, key, 16, &f);
 		ATF_REQUIRE_EQ(result, ISC_R_SUCCESS);
-		ATF_REQUIRE_EQ(i, (isc_int64_t) f);
+		ATF_REQUIRE_EQ(i, (uintptr_t) f);
 	}

 	for (i = 1; i < count; i++) {
@@ -186,9 +190,9 @@ static void test_ht_iterator() {
 	isc_result_t result;
 	isc_mem_t *mctx = NULL;
 	isc_ht_iter_t * iter = NULL;
-	isc_int64_t i;
-	isc_int64_t v;
-	isc_uint32_t count = 10000;
+	uintptr_t i;
+	void *v;
+	uintptr_t count = 10000;
 	isc_uint32_t walked;
 	unsigned char key[16];
 	unsigned char *tkey;
@@ -220,10 +224,11 @@ static void test_ht_iterator() {
 	     result == ISC_R_SUCCESS;
 	     result = isc_ht_iter_next(iter))
 	{
-		isc_ht_iter_current(iter, (void**) &v);
+		isc_ht_iter_current(iter, &v);
 		isc_ht_iter_currentkey(iter, &tkey, &tksize);
 		ATF_REQUIRE_EQ(tksize, 16);
-		snprintf((char *)key, sizeof(key), "%u", (unsigned int)v);
+		i = (uintptr_t)v;
+		snprintf((char *)key, sizeof(key), "%u", (unsigned int)i);
 		strlcat((char *)key, "key of a raw hashtable!!", sizeof(key));
 		ATF_REQUIRE_EQ(memcmp(key, tkey, 16), 0);
 		walked++;
@@ -235,13 +240,14 @@ static void test_ht_iterator() {
 	walked = 0;
 	result = isc_ht_iter_first(iter);
 	while (result == ISC_R_SUCCESS) {
-		isc_ht_iter_current(iter, (void**) &v);
+		isc_ht_iter_current(iter, &v);
 		isc_ht_iter_currentkey(iter, &tkey, &tksize);
 		ATF_REQUIRE_EQ(tksize, 16);
-		snprintf((char *)key, sizeof(key), "%u", (unsigned int)v);
+		i = (uintptr_t)v;
+		snprintf((char *)key, sizeof(key), "%u", (unsigned int)i);
 		strlcat((char *)key, "key of a raw hashtable!!", sizeof(key));
 		ATF_REQUIRE_EQ(memcmp(key, tkey, 16), 0);
-		if (v % 2 == 0) {
+		if ((uintptr_t)v % 2 == 0) {
 			result = isc_ht_iter_delcurrent_next(iter);
 		} else {
 			result = isc_ht_iter_next(iter);
@@ -255,13 +261,14 @@ static void test_ht_iterator() {
 	walked = 0;
 	result = isc_ht_iter_first(iter);
 	while (result == ISC_R_SUCCESS) {
-		isc_ht_iter_current(iter, (void**) &v);
+		isc_ht_iter_current(iter, &v);
 		isc_ht_iter_currentkey(iter, &tkey, &tksize);
 		ATF_REQUIRE_EQ(tksize, 16);
-		snprintf((char *)key, sizeof(key), "%u", (unsigned int)v);
+		i = (uintptr_t)v;
+		snprintf((char *)key, sizeof(key), "%u", (unsigned int)i);
 		strlcat((char *)key, "key of a raw hashtable!!", sizeof(key));
 		ATF_REQUIRE_EQ(memcmp(key, tkey, 16), 0);
-		if (v % 2 == 1) {
+		if ((uintptr_t)v % 2 == 1) {
 			result = isc_ht_iter_delcurrent_next(iter);
 		} else {
 			result = isc_ht_iter_next(iter);
@@ -155,7 +155,6 @@ ATF_TC_BODY(isc_mem_noflags, tc) {
 	char buf[4096], *p, *q;
 	FILE *f;
 	void *ptr;
-	size_t size;

 	result = isc_stdio_open("mem.output", "w", &f);
 	ATF_REQUIRE_EQ(result, ISC_R_SUCCESS);
@@ -174,22 +173,27 @@ ATF_TC_BODY(isc_mem_noflags, tc) {
 	isc_mem_destroy(&mctx2);
 	isc_stdio_close(f);

+	memset(buf, 0, sizeof(buf));
 	result = isc_stdio_open("mem.output", "r", &f);
 	ATF_REQUIRE_EQ(result, ISC_R_SUCCESS);
-	result = isc_stdio_read(buf, sizeof(buf), 1, f, &size);
+	result = isc_stdio_read(buf, sizeof(buf), 1, f, NULL);
 	ATF_REQUIRE_EQ(result, ISC_R_EOF);
 	isc_stdio_close(f);
 	isc_file_remove("mem.output");

+	buf[sizeof(buf) - 1] = 0;
+
 	p = strchr(buf, '\n');
+	ATF_REQUIRE(p != NULL);
+	ATF_REQUIRE(p < buf + sizeof(buf) - 2);
 	p += 2;
 	q = strchr(p, '\n');
+	ATF_REQUIRE(q != NULL);
 	*q = '\0';
 	ATF_CHECK_STREQ(p, "None.");

 	isc_mem_debugging = ISC_MEM_DEBUGRECORD;
 	isc_test_end();
-
 }

 ATF_TC(isc_mem_recordflag);
@@ -203,7 +207,6 @@ ATF_TC_BODY(isc_mem_recordflag, tc) {
 	char buf[4096], *p;
 	FILE *f;
 	void *ptr;
-	size_t size;

 	result = isc_stdio_open("mem.output", "w", &f);
 	ATF_REQUIRE_EQ(result, ISC_R_SUCCESS);
@@ -224,14 +227,19 @@ ATF_TC_BODY(isc_mem_recordflag, tc) {
 	memset(buf, 0, sizeof(buf));
 	result = isc_stdio_open("mem.output", "r", &f);
 	ATF_REQUIRE_EQ(result, ISC_R_SUCCESS);
-	result = isc_stdio_read(buf, sizeof(buf), 1, f, &size);
+	result = isc_stdio_read(buf, sizeof(buf), 1, f, NULL);
 	ATF_REQUIRE_EQ(result, ISC_R_EOF);
 	isc_stdio_close(f);
 	isc_file_remove("mem.output");

+	buf[sizeof(buf) - 1] = 0;
+
 	p = strchr(buf, '\n');
+	ATF_REQUIRE(p != NULL);
+	ATF_REQUIRE(p < buf + sizeof(buf) - 2);
 	ATF_CHECK(strncmp(p + 2, "ptr ", 4) == 0);
 	p = strchr(p + 1, '\n');
+	ATF_REQUIRE(p != NULL);
 	ATF_CHECK(strlen(p) == 1);

 	isc_test_end();
@@ -248,7 +256,6 @@ ATF_TC_BODY(isc_mem_traceflag, tc) {
 	char buf[4096], *p;
 	FILE *f;
 	void *ptr;
-	size_t size;

 	/* redirect stderr so we can check trace output */
 	f = freopen("mem.output", "w", stderr);
@@ -268,9 +275,10 @@ ATF_TC_BODY(isc_mem_traceflag, tc) {
 	isc_mem_destroy(&mctx2);
 	isc_stdio_close(f);

+	memset(buf, 0, sizeof(buf));
 	result = isc_stdio_open("mem.output", "r", &f);
 	ATF_REQUIRE_EQ(result, ISC_R_SUCCESS);
-	result = isc_stdio_read(buf, sizeof(buf), 1, f, &size);
+	result = isc_stdio_read(buf, sizeof(buf), 1, f, NULL);
 	ATF_REQUIRE_EQ(result, ISC_R_EOF);
 	isc_stdio_close(f);
 	isc_file_remove("mem.output");
@@ -278,11 +286,17 @@ ATF_TC_BODY(isc_mem_traceflag, tc) {
 	/* return stderr to TTY so we can see errors */
 	f = freopen("/dev/tty", "w", stderr);

+	buf[sizeof(buf) - 1] = 0;
+
 	ATF_CHECK(strncmp(buf, "add ", 4) == 0);
 	p = strchr(buf, '\n');
+	ATF_REQUIRE(p != NULL);
 	p = strchr(p + 1, '\n');
+	ATF_REQUIRE(p != NULL);
+	ATF_REQUIRE(p < buf + sizeof(buf) - 2);
 	ATF_CHECK(strncmp(p + 2, "ptr ", 4) == 0);
 	p = strchr(p + 1, '\n');
+	ATF_REQUIRE(p != NULL);
 	ATF_CHECK(strncmp(p + 1, "del ", 4) == 0);

 	isc_mem_debugging = ISC_MEM_DEBUGRECORD;
@@ -175,6 +175,11 @@
 #define PF_INET6 AF_INET6
 #endif

+#ifndef INADDR_ANY
+/*% inaddr any */
+#define INADDR_ANY 0x00000000UL
+#endif
+
 #ifndef INADDR_LOOPBACK
 /*% inaddr loopback */
 #define INADDR_LOOPBACK 0x7f000001UL
@@ -87,6 +87,10 @@
 */
 #undef interface

+#ifndef INADDR_ANY
+#define INADDR_ANY 0x00000000UL
+#endif
+
 #ifndef INADDR_LOOPBACK
 #define INADDR_LOOPBACK 0x7f000001UL
 #endif
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2005, 2007, 2008, 2015, 2016  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2005, 2007, 2008, 2015-2017  Internet Systems Consortium, Inc. ("ISC")
 *
 * This Source Code Form is subject to the terms of the Mozilla Public
 * License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -122,12 +122,10 @@ isc_atomic_cmpxchg(isc_int32_t *p, isc_int32_t cmpval, isc_int32_t val) {
 * positions of the stack frame, which would not actually point to the
 * intended address in the embedded mnemonic.
 */
-#include <isc/util.h>		/* for 'UNUSED' macro */
-
 static isc_int32_t
 isc_atomic_xadd(isc_int32_t *p, isc_int32_t val) {
-	UNUSED(p);
-	UNUSED(val);
+	(void)(p);
+	(void)(val);

 	__asm (
 		"movl 8(%ebp), %ecx\n"
@@ -148,8 +146,8 @@ isc_atomic_xadd(isc_int32_t *p, isc_int32_t val) {

 static void
 isc_atomic_store(isc_int32_t *p, isc_int32_t val) {
-	UNUSED(p);
-	UNUSED(val);
+	(void)(p);
+	(void)(val);

 	__asm (
 		"movl 8(%ebp), %ecx\n"
@@ -163,9 +161,9 @@ isc_atomic_store(isc_int32_t *p, isc_int32_t val) {

 static isc_int32_t
 isc_atomic_cmpxchg(isc_int32_t *p, isc_int32_t cmpval, isc_int32_t val) {
-	UNUSED(p);
-	UNUSED(cmpval);
-	UNUSED(val);
+	(void)(p);
+	(void)(cmpval);
+	(void)(val);

 	__asm (
 		"movl 8(%ebp), %ecx\n"
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2005, 2007, 2008, 2015, 2016  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2005, 2007, 2008, 2015-2017  Internet Systems Consortium, Inc. ("ISC")
 *
 * This Source Code Form is subject to the terms of the Mozilla Public
 * License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -27,12 +27,11 @@
 * registers for arguments, which would not actually correspond to the
 * intended address or value in the embedded mnemonic.
 */
-#include <isc/util.h>		/* for 'UNUSED' macro */

 static isc_int32_t
 isc_atomic_xadd(isc_int32_t *p, isc_int32_t val) {
-	UNUSED(p);
-	UNUSED(val);
+	(void)(p);
+	(void)(val);

 	__asm (
 		"movq %rdi, %rdx\n"
@@ -50,8 +49,8 @@ isc_atomic_xadd(isc_int32_t *p, isc_int32_t val) {
 #ifdef ISC_PLATFORM_HAVEXADDQ
 static isc_int64_t
 isc_atomic_xaddq(isc_int64_t *p, isc_int64_t val) {
-	UNUSED(p);
-	UNUSED(val);
+	(void)(p);
+	(void)(val);

 	__asm (
 		"movq %rdi, %rdx\n"
@@ -69,8 +68,8 @@ isc_atomic_xaddq(isc_int64_t *p, isc_int64_t val) {

 static void
 isc_atomic_store(isc_int32_t *p, isc_int32_t val) {
-	UNUSED(p);
-	UNUSED(val);
+	(void)(p);
+	(void)(val);

 	__asm (
 		"movq %rdi, %rax\n"
@@ -85,8 +84,8 @@ isc_atomic_store(isc_int32_t *p, isc_int32_t val) {
 #ifdef ISC_PLATFORM_HAVEATOMICSTOREQ
 static void
 isc_atomic_storeq(isc_int64_t *p, isc_int64_t val) {
-	UNUSED(p);
-	UNUSED(val);
+	(void)(p);
+	(void)(val);

 	__asm (
 		"movq %rdi, %rax\n"
@@ -101,9 +100,9 @@ isc_atomic_storeq(isc_int64_t *p, isc_int64_t val) {

 static isc_int32_t
 isc_atomic_cmpxchg(isc_int32_t *p, isc_int32_t cmpval, isc_int32_t val) {
-	UNUSED(p);
-	UNUSED(cmpval);
-	UNUSED(val);
+	(void)(p);
+	(void)(cmpval);
+	(void)(val);

 	__asm (
 		/*
@@ -1261,7 +1261,7 @@ static cfg_type_t cfg_type_resppadding = {

 /*%
 *  dnstap {
- *      <message type> [query | response] ;
+ *      &lt;message type&gt; [query | response] ;
 *      ...
 *  }
 *
@@ -1416,8 +1416,8 @@ static cfg_type_t cfg_type_dnstapoutput = {

 /*%
 *  response-policy {
- *	zone <string> [ policy (given|disabled|passthru|drop|tcp-only|
- *					nxdomain|nodata|cname <domain> ) ]
+ *	zone &lt;string&gt; [ policy (given|disabled|passthru|drop|tcp-only|
+ *					nxdomain|nodata|cname &lt;domain&gt; ) ]
 *		      [ recursive-only yes|no ] [ log yes|no ]
 *		      [ max-policy-ttl number ]
 *		      [ nsip-enable yes|no ] [ nsdname-enable yes|no ];
@@ -9,7 +9,7 @@
 #ifndef NS_LIB_H
 #define NS_LIB_H 1

-/*! \file ns/lib.h */
+/*! \file include/ns/lib.h */

 #include <isc/types.h>
 #include <isc/lang.h>
@@ -9,7 +9,7 @@
 #ifndef NS_STATS_H
 #define NS_STATS_H 1

-/*! \file ns/stats.h */
+/*! \file include/ns/stats.h */

 #include <ns/types.h>

@@ -6,7 +6,7 @@
 * file, You can obtain one at http://mozilla.org/MPL/2.0/.
 */

-/*! \file ns/version.h */
+/*! \file include/ns/version.h */

 #include <isc/platform.h>

@@ -12,6 +12,7 @@

 #include <isc/mem.h>
 #include <isc/stats.h>
+#include <isc/util.h>

 #include <dns/tkey.h>
 #include <dns/stats.h>
@@ -1326,7 +1326,7 @@
 ./bin/tests/system/dyndb/driver/lock.h		X	2015
 ./bin/tests/system/dyndb/driver/log.c		X	2015
 ./bin/tests/system/dyndb/driver/log.h		X	2015
-./bin/tests/system/dyndb/driver/syncptr.c	X	2015
+./bin/tests/system/dyndb/driver/syncptr.c	X	2015,2017
 ./bin/tests/system/dyndb/driver/syncptr.h	X	2015
 ./bin/tests/system/dyndb/driver/util.h		X	2015
 ./bin/tests/system/dyndb/driver/zone.c		X	2015
@@ -1403,7 +1403,7 @@
 ./bin/tests/system/filter-aaaa/ns1/root.db	ZONE	2010,2012,2016,2017
 ./bin/tests/system/filter-aaaa/ns1/sign.sh	SH	2010,2012,2014,2016
 ./bin/tests/system/filter-aaaa/ns1/signed.db.in	ZONE	2010,2012,2016,2017
-./bin/tests/system/filter-aaaa/ns1/signed.db.presigned	X	2014
+./bin/tests/system/filter-aaaa/ns1/signed.db.presigned	X	2014,2017
 ./bin/tests/system/filter-aaaa/ns1/unsigned.db	ZONE	2010,2012,2016,2017
 ./bin/tests/system/filter-aaaa/ns2/hints	ZONE	2010,2016
 ./bin/tests/system/filter-aaaa/ns2/named1.conf	CONF-C	2012,2013,2016,2017
@@ -3190,7 +3190,7 @@
 ./lib/bind9/include/Makefile.in			MAKE	2001,2004,2007,2012,2016
 ./lib/bind9/include/bind9/Makefile.in		MAKE	2001,2004,2007,2012,2015,2016
 ./lib/bind9/include/bind9/check.h		C	2001,2004,2005,2006,2007,2016
-./lib/bind9/include/bind9/getaddresses.h	C	2001,2004,2005,2006,2007,2009,2016
+./lib/bind9/include/bind9/getaddresses.h	C	2001,2004,2005,2006,2007,2009,2016,2017
 ./lib/bind9/include/bind9/version.h		C	2001,2004,2005,2006,2007,2016
 ./lib/bind9/version.c				C	2001,2004,2005,2007,2016
 ./lib/bind9/win32/DLLMain.c			C	2001,2004,2007,2016
@@ -3265,7 +3265,7 @@
 ./lib/dns/include/dns/diff.h			C	2000,2001,2004,2005,2006,2007,2008,2009,2010,2013,2016
 ./lib/dns/include/dns/dispatch.h		C	1999,2000,2001,2002,2003,2004,2005,2006,2007,2008,2009,2011,2012,2013,2014,2015,2016,2017
 ./lib/dns/include/dns/dlz.h			C.PORTION	1999,2000,2001,2005,2006,2007,2009,2010,2011,2012,2013,2016
-./lib/dns/include/dns/dlz_dlopen.h		C	2011,2012,2013,2016
+./lib/dns/include/dns/dlz_dlopen.h		C	2011,2012,2013,2016,2017
 ./lib/dns/include/dns/dns64.h			C	2010,2014,2016
 ./lib/dns/include/dns/dnsrps.h			C	2017
 ./lib/dns/include/dns/dnssec.h			C	1999,2000,2001,2002,2004,2005,2006,2007,2009,2010,2011,2012,2013,2014,2015,2016
@@ -3300,7 +3300,7 @@
 ./lib/dns/include/dns/nsec3.h			C	2008,2009,2010,2011,2012,2013,2016,2017
 ./lib/dns/include/dns/nta.h			C	2014,2015,2016
 ./lib/dns/include/dns/opcode.h			C	2002,2004,2005,2006,2007,2016
-./lib/dns/include/dns/order.h			C	2002,2004,2005,2006,2007,2016
+./lib/dns/include/dns/order.h			C	2002,2004,2005,2006,2007,2016,2017
 ./lib/dns/include/dns/peer.h			C	2000,2001,2003,2004,2005,2006,2007,2008,2009,2013,2014,2015,2016,2017
 ./lib/dns/include/dns/portlist.h		C	2003,2004,2005,2006,2007,2016
 ./lib/dns/include/dns/private.h			C	2009,2011,2012,2016
@@ -3349,7 +3349,7 @@
 ./lib/dns/include/dst/lib.h			C	1999,2000,2001,2004,2005,2006,2007,2016
 ./lib/dns/include/dst/result.h			C	1999,2000,2001,2004,2005,2006,2007,2008,2012,2014,2016
 ./lib/dns/ipkeylist.c				C	2016
-./lib/dns/iptable.c				C	2007,2008,2009,2013,2014,2016
+./lib/dns/iptable.c				C	2007,2008,2009,2013,2014,2016,2017
 ./lib/dns/journal.c				C	1999,2000,2001,2002,2004,2005,2007,2008,2009,2010,2011,2013,2014,2015,2016,2017
 ./lib/dns/key.c					C	2001,2004,2005,2006,2007,2011,2016
 ./lib/dns/keydata.c				C	2009,2014,2016
@@ -3647,7 +3647,7 @@
 ./lib/dns/time.c				C	1998,1999,2000,2001,2002,2003,2004,2005,2007,2009,2010,2011,2012,2014,2016,2017
 ./lib/dns/timer.c				C	2000,2001,2004,2005,2007,2016
 ./lib/dns/tkey.c				C	1999,2000,2001,2003,2004,2005,2006,2007,2008,2009,2010,2011,2012,2013,2014,2015,2016
-./lib/dns/tsec.c				C	2009,2010,2016
+./lib/dns/tsec.c				C	2009,2010,2016,2017
 ./lib/dns/tsig.c				C	1999,2000,2001,2002,2004,2005,2006,2007,2008,2009,2010,2011,2012,2013,2014,2015,2016,2017
 ./lib/dns/tsig_p.h				C	2017
 ./lib/dns/ttl.c					C	1999,2000,2001,2004,2005,2007,2011,2012,2013,2014,2016,2017
@@ -3757,7 +3757,7 @@
 ./lib/isc/include/isc/Makefile.in		MAKE	1998,1999,2000,2001,2003,2004,2005,2006,2007,2008,2009,2012,2013,2014,2015,2016,2017
 ./lib/isc/include/isc/aes.h			C	2014,2016
 ./lib/isc/include/isc/app.h			C	1999,2000,2001,2004,2005,2006,2007,2009,2013,2014,2015,2016
-./lib/isc/include/isc/assertions.h		C	1997,1998,1999,2000,2001,2004,2005,2006,2007,2008,2009,2016
+./lib/isc/include/isc/assertions.h		C	1997,1998,1999,2000,2001,2004,2005,2006,2007,2008,2009,2016,2017
 ./lib/isc/include/isc/backtrace.h		C	2009,2016
 ./lib/isc/include/isc/base32.h			C	2008,2014,2016
 ./lib/isc/include/isc/base64.h			C	1999,2000,2001,2004,2005,2006,2007,2016
@@ -3768,6 +3768,7 @@
 ./lib/isc/include/isc/commandline.h		C	1999,2000,2001,2004,2005,2006,2007,2015,2016
 ./lib/isc/include/isc/counter.h			C	2014,2016
 ./lib/isc/include/isc/crc64.h			C	2013,2016
+./lib/isc/include/isc/deprecated.h		C	2017
 ./lib/isc/include/isc/entropy.h			C	2000,2001,2004,2005,2006,2007,2009,2016,2017
 ./lib/isc/include/isc/errno.h			C	2016
 ./lib/isc/include/isc/error.h			C	1998,1999,2000,2001,2004,2005,2006,2007,2009,2016,2017
@@ -3777,7 +3778,7 @@
 ./lib/isc/include/isc/formatcheck.h		C	2000,2001,2004,2005,2006,2007,2016
 ./lib/isc/include/isc/fsaccess.h		C	2000,2001,2004,2005,2006,2007,2009,2016
 ./lib/isc/include/isc/fuzz.h			C	2017
-./lib/isc/include/isc/hash.h			C	2003,2004,2005,2006,2007,2009,2013,2014,2015,2016
+./lib/isc/include/isc/hash.h			C	2003,2004,2005,2006,2007,2009,2013,2014,2015,2016,2017
 ./lib/isc/include/isc/heap.h			C	1997,1998,1999,2000,2001,2004,2005,2006,2007,2009,2012,2016
 ./lib/isc/include/isc/hex.h			C	2000,2001,2004,2005,2006,2007,2008,2016
 ./lib/isc/include/isc/hmacmd5.h			C	2000,2001,2004,2005,2006,2007,2009,2014,2016,2017
@@ -3792,9 +3793,10 @@
 ./lib/isc/include/isc/lex.h			C	1998,1999,2000,2001,2002,2004,2005,2007,2008,2015,2016,2017
 ./lib/isc/include/isc/lfsr.h			C	1999,2000,2001,2004,2005,2006,2007,2016
 ./lib/isc/include/isc/lib.h			C	1999,2000,2001,2004,2005,2006,2007,2009,2016
+./lib/isc/include/isc/likely.h			C	2017
 ./lib/isc/include/isc/list.h			C	1997,1998,1999,2000,2001,2002,2004,2006,2007,2011,2012,2013,2016
 ./lib/isc/include/isc/log.h			C	1999,2000,2001,2002,2004,2005,2006,2007,2009,2014,2016,2017
-./lib/isc/include/isc/magic.h			C	1999,2000,2001,2004,2005,2006,2007,2016
+./lib/isc/include/isc/magic.h			C	1999,2000,2001,2004,2005,2006,2007,2016,2017
 ./lib/isc/include/isc/md5.h			C	2000,2001,2004,2005,2006,2007,2009,2010,2014,2016,2017
 ./lib/isc/include/isc/mem.h			C	1997,1998,1999,2000,2001,2004,2005,2006,2007,2008,2009,2010,2011,2012,2013,2015,2016,2017
 ./lib/isc/include/isc/meminfo.h			C	2015,2016
@@ -3838,7 +3840,7 @@
 ./lib/isc/include/isc/timer.h			C	1998,1999,2000,2001,2002,2004,2005,2006,2007,2008,2009,2012,2013,2014,2016
 ./lib/isc/include/isc/tm.h			C	2014,2016
 ./lib/isc/include/isc/types.h			C	1999,2000,2001,2002,2003,2004,2005,2006,2007,2008,2009,2012,2013,2014,2016,2017
-./lib/isc/include/isc/util.h			C	1998,1999,2000,2001,2004,2005,2006,2007,2010,2011,2012,2015,2016
+./lib/isc/include/isc/util.h			C	1998,1999,2000,2001,2004,2005,2006,2007,2010,2011,2012,2015,2016,2017
 ./lib/isc/include/isc/version.h			C	2001,2004,2005,2006,2007,2016
 ./lib/isc/include/isc/xml.h			C	2006,2007,2016
 ./lib/isc/include/pk11/Makefile.in		MAKE	2014,2015,2016
@@ -4079,11 +4081,11 @@
 ./lib/isc/x86_32/Makefile.in			MAKE	2007,2012,2016
 ./lib/isc/x86_32/include/Makefile.in		MAKE	2007,2012,2016
 ./lib/isc/x86_32/include/isc/Makefile.in	MAKE	2007,2012,2015,2016
-./lib/isc/x86_32/include/isc/atomic.h		C	2005,2007,2008,2015,2016
+./lib/isc/x86_32/include/isc/atomic.h		C	2005,2007,2008,2015,2016,2017
 ./lib/isc/x86_64/Makefile.in			MAKE	2007,2012,2016
 ./lib/isc/x86_64/include/Makefile.in		MAKE	2007,2012,2016
 ./lib/isc/x86_64/include/isc/Makefile.in	MAKE	2007,2012,2015,2016
-./lib/isc/x86_64/include/isc/atomic.h		C	2005,2007,2008,2015,2016
+./lib/isc/x86_64/include/isc/atomic.h		C	2005,2007,2008,2015,2016,2017
 ./lib/isccc/Makefile.in				MAKE	2001,2003,2004,2007,2009,2011,2012,2014,2015,2016,2017
 ./lib/isccc/alist.c				C.NOM	2001,2004,2005,2007,2015,2016
 ./lib/isccc/api					X	2001,2006,2008,2009,2010,2011,2012,2013,2014,2015,2016,2017
Author	SHA1	Message	Date
Evan Hunt	150deb0126	[rt42272] stronger wording	2017-10-24 10:36:00 -07:00
Evan Hunt	894ce6081a	[rt42272] also warn on use of MD5 for rndc keys	2017-10-23 10:35:08 -07:00
Evan Hunt	5cdcb725a9	[rt42272] add a "deprecated" warning when generating hmac keys	2017-10-22 23:37:57 -07:00
Tinderbox User	2e662cf514	regen master	2017-10-22 01:10:28 +00:00
Evan Hunt	321b8429f5	[master] doc nit: Base64 is capitalized and not hyphenated	2017-10-21 13:28:38 -07:00
Evan Hunt	172aa40e8f	[master] add DNS_RPZ_MAX_ZONES to OPTIONS	2017-10-21 13:27:55 -07:00
Tinderbox User	0fc861dea9	regen master	2017-10-21 01:13:05 +00:00
Evan Hunt	b284857f96	[master] mapapi should have been bumped when rbtdb changed	2017-10-20 09:39:55 -07:00
Mark Andrews	807ad469fe	use correct tag (cherry picked from commit `317330c25a`)	2017-10-20 19:06:28 +11:00
Mark Andrews	5ff48dca18	#include <inttypes.h>	2017-10-20 16:36:07 +11:00
Mark Andrews	66258ca349	4776. [bug] Improve portability of ht_test. [RT #46333 ]	2017-10-20 16:04:59 +11:00
Tinderbox User	2115e319ba	regen master	2017-10-20 01:09:53 +00:00
Tinderbox User	429a43b720	update copyright notice / whitespace	2017-10-19 23:46:02 +00:00
Tinderbox User	bf9b90f977	newcopyrights	2017-10-19 23:30:21 +00:00
Mark Andrews	d8442c1a15	s/made/may/	2017-10-20 10:29:24 +11:00
Mark Andrews	9e5439a6d8	note removal of <isc/util.h> from other header files	2017-10-20 10:25:45 +11:00
Mark Andrews	0fab171196	s/REQUIRE/ISC_REQUIRE/; include <isc/assertions.h> if ISC_REQUIRE is used; include <isc/likely.h> if ISC_{UN}LIKELY is used	2017-10-19 16:39:53 +11:00
Mark Andrews	583e355951	4775. [bug] Address Coverity warnings in ht_test.c and mem_test.c [RT #46281]	2017-10-19 13:08:31 +11:00
Mark Andrews	fe79e2efbf	4774. [bug] <isc/util.h> was incorrectly included in several header files. [RT #46311]	2017-10-19 12:26:32 +11:00
Tinderbox User	b7b8e298f6	regen master	2017-10-19 01:09:18 +00:00
Evan Hunt	d99d5249b7	[master] clarify releates notes about deprecated/ineffective options	2017-10-18 12:41:25 -07:00
Tinderbox User	208abf3fc7	regen master	2017-10-18 01:10:52 +00:00
Tinderbox User	6e87e723a4	update copyright notice / whitespace	2017-10-17 23:47:21 +00:00
Tinderbox User	4f554c2445	newcopyrights	2017-10-17 23:30:15 +00:00
Evan Hunt	30419509dd	[master] README and relnote fixes	2017-10-17 13:47:33 -07:00
Michał Kępień	2361003a88	[master] Doxygen fixes and cleanups 4773. [doc] Fixed generating Doxygen documentation for functions annotated using certain macros. Miscellaneous Doxygen-related cleanups. [RT #46276]	2017-10-17 06:56:46 +02:00
Tinderbox User	94d96121b9	regen master	2017-10-17 01:08:55 +00:00
Evan Hunt	31275c3f39	[master] fixes to release notes - some typos - call out removed features in a "Removed Features" section - mention TAT logging	2017-10-16 17:46:12 -07:00
Evan Hunt	d63943f063	[master] fixes to release notes - fixed some typos - call out feature removals in a "Removed Features" section - TAT logging	2017-10-16 17:45:08 -07:00
Tinderbox User	ebf5459c44	newcopyrights	2017-10-16 23:30:10 +00:00
Michał Kępień	9d47a267c4	[master] Regenerate presigned zone for the filter-aaaa system test [RT #46283 ] This change is only applied to master for consistency with other branches, where it is required to fix the filter-aaaa system test for builds without DNSSEC support.	2017-10-16 09:38:34 +02:00