Bump the maximum TCP timeout to 65535 [RT #44710 ]

[master] check new-zones-directory
4789. [cleanup] Check writability of new-zones-directory. [RT #46308]
2017-10-25 14:15:04 +04:00 · 2017-10-25 01:19:46 -07:00 · 2017-10-25 00:58:11 -07:00 · 2017-10-25 09:46:18 +02:00 · 2017-10-25 00:33:51 -07:00 · 2017-10-25 15:02:36 +11:00
122 changed files with 1868 additions and 931 deletions
@@ -1,3 +1,64 @@
+4789.	[cleanup]	Check writability of new-zones-directory. [RT #46308]
+
+4788.	[cleanup]	When using "update-policy local", log a warning
+			when an update matching the session key is received
+			from a remote host. [RT #46213]
+
+4787.	[cleanup]	Turn nsec3param_salt_totext() into a public function,
+			dns_nsec3param_salttotext(), and add unit tests for it.
+			[RT #46289]
+
+4786.	[func]		The "filter-aaaa-on-v4" and "filter-aaaa-on-v6"
+			options are no longer conditionally compiled.
+			[RT #46340]
+
+4785.	[func]		The hmac-md5 algorithm is no longer recommended for
+			use with RNDC keys. For compatibility reasons, it
+			it is still the default algorithm in rndc-confgen,
+			but this will be changed to hmac-sha256 in a future
+			release. [RT #42272]
+
+4784.	[func]		The use of dnssec-keygen to generate HMAC keys is
+			deprecated in favor of tsig-keygen.  dnssec-keygen
+			will print a warning when used for this purpose.
+			All HMAC algorithms will be removed from
+			dnssec-keygen in a future release. [RT #42272]
+
+4783.	[test]		dnssec: 'check that NOTIFY is sent at the end of
+			NSEC3 chain generation failed' required more time
+			on some machines for the IXFR to complete. [RT #46388]
+
+4782.	[test]		dnssec: 'checking positive and negative validation
+			with negative trust anchors' required more time to
+			complete on some machines. [RT #46386]
+
+4781.	[maint]		B.ROOT-SERVERS.NET is now 199.9.14.201. [RT #45889]
+
+4780.	[bug]		When answering ANY queries, don't include the NS
+			RRset in the authority section if it was already
+			in the answer section. [RT #44543]
+
+4779.	[bug]		Expire NTA at the start of the second. Don't update
+			the expiry value if the record has already expired
+			after a successful check. [RT #46368]
+
+4778.	[test]		Improve synth-from-dnssec testing. [RT #46352]
+
+4777.	[cleanup]	Removed a redundant call to configure_view_acl().
+			[RT #46369]
+
+4776.	[bug]		Improve portability of ht_test. [RT #46333]
+
+4775.	[bug]		Address Coverity warnings in ht_test.c and mem_test.c
+			[RT #46281]
+
+4774.	[bug]		<isc/util.h> was incorrectly included in several
+			header files. [RT #46311]
+
+4773.	[doc]		Fixed generating Doxygen documentation for functions
+			annotated using certain macros.  Miscellaneous
+			Doxygen-related cleanups. [RT #46276]
+
 	--- 9.12.0b1 released ---

 4772.	[test]		Expanded unit testing framework for libns, using
@@ -19,4 +19,7 @@ Setting                   Description
                          named-checkzone
 -DNS_RUN_PID_DIR=0        Create default PID files in ${localstatedir}/run
                          rather than ${localstatedir}/run/named/
+                          Increase the maximum number of configurable
+-DNS_RPZ_MAX_ZONES=64     response policy zones from 32 to 64; this is the
+                          highest possible setting

@@ -20,3 +20,4 @@ Some of these settings are:
 |`-DCHECK_SIBLING=0`|Don't check sibling glue in `named-checkzone`|
 |`-DCHECK_LOCAL=0`|Don't check out-of-zone addresses in `named-checkzone`|
 |`-DNS_RUN_PID_DIR=0`|Create default PID files in `${localstatedir}/run` rather than `${localstatedir}/run/named/`|
+|`-DNS_RPZ_MAX_ZONES=64`|Increase the maximum number of configurable response policy zones from 32 to 64; this is the highest possible setting|
@@ -56,12 +56,12 @@ General bug reports can be sent to bind9-bugs@isc.org.

 Feature requests can be sent to bind-suggest@isc.org.

-Please note that, while ISC's ticketing system is not currently publicly
-readable, this may change in the future. Please do not include information
-in bug reports that you consider to be confidential. For example, when
-sending the contents of your configuration file, it is advisable to
-obscure key secrets; this can be done automatically by using
-named-checkconf -px.
+Please note that, while tickets submitted to ISC's ticketing system are
+not initially publicly readable by default, they can be made publicly
+acessible afterward. Please do not include information in bug reports that
+you consider to be confidential. In particular, when sending the contents
+of your configuration file, it is advisable to obscure key secrets: this
+can be done automatically by using named-checkconf -px.

 Professional support and training for BIND are available from ISC at
 https://www.isc.org/support.
@@ -75,8 +75,9 @@ mailman/listinfo/bind-workers.

 Contributing to BIND

-A public git repository for BIND is maintained at http://www.isc.org/git/,
-and also on Github at https://github.com/isc-projects.
+ISC maintains a public git repository for BIND; details can be found at
+http://www.isc.org/git/, and also on Github at https://github.com/
+isc-projects.

 Information for BIND contributors can be found in the following files: -
 General information: doc/dev/contrib.md - BIND 9 code style: doc/dev/
@@ -103,10 +104,8 @@ include:
  * Cached, validated NSEC and other records can now be used to synthesize
    NXDOMAIN responses.
  * The DNS Response Policy Service API (DNSRPS) is now supported.
-  * Setting max-journal-size default now limits the size of journal files
-    to twice the size of the zone.
-  * The query handling code has been substantially refactored for improved
-    readability, maintainability and testability .
+  * Setting 'max-journal-size default' now limits the size of journal
+    files to twice the size of the zone.
  * dnstap-read -x prints a hex dump of the wire format of each logged DNS
    message.
  * dnstap output files can now be configured to roll automatically when
@@ -115,7 +114,7 @@ include:
    ISO 8601 (UTC) formats.
  * Logging channels and dnstap output files can now be configured to use
    a timestamp as the suffix when rolling to a new file.
-  * named-checkconf -l lists zones found in named.conf.
+  * 'named-checkconf -l' lists zones found in named.conf.
  * Added support for the EDNS Padding and Keepalive options.
  * 'new-zones-directory' option sets the location where the configuration
    data for zones added by rndc addzone is stored
@@ -189,10 +188,11 @@ smaller systems.
 For the server to support DNSSEC, you need to build it with crypto
 support. To use OpenSSL, you should have OpenSSL 1.0.2e or newer
 installed. If the OpenSSL library is installed in a nonstandard location,
-specify the prefix using "--with-openssl=/prefix" on the configure command
-line. To use a PKCS#11 hardware service module for cryptographic
+specify the prefix using "--with-openssl=<PREFIX>" on the configure
+command line. To use a PKCS#11 hardware service module for cryptographic
 operations, specify the path to the PKCS#11 provider library using
-"--with-pkcs11=/prefix", and configure BIND with "--enable-native-pkcs11".
+"--with-pkcs11=<PREFIX>", and configure BIND with
+"--enable-native-pkcs11".

 To support the HTTP statistics channel, the server must be linked with at
 least one of the following: libxml2 http://xmlsoft.org or json-c https://
@@ -212,13 +212,16 @@ libGeoIP. This is not turned on by default; BIND must be configured with
 "--with-geoip". If the library is installed in a nonstandard location, use
 specify the prefix using "--with-geoip=/prefix".

-For DNSTAP packet logging, you must have libfstrm https://github.com/
-farsightsec/fstrm and libprotobuf-c https://developers.google.com/
-protocol-buffers, and BIND must be configured with "--enable-dnstap".
+For DNSTAP packet logging, you must have installed libfstrm https://
+github.com/farsightsec/fstrm and libprotobuf-c https://
+developers.google.com/protocol-buffers, and BIND must be configured with
+"--enable-dnstap".

-Python requires the 'argparse' and 'ply' modules to be available.
-'argparse' is a standard module as of Python 2.7 and Python 3.2. 'ply' is
-available from https://pypi.python.org/pypi/ply.
+Portions of BIND that are written in Python, including dnssec-keymgr,
+dnssec-coverage, dnssec-checkds, and some of the system tests, require the
+'argparse' and 'ply' modules to be available. 'argparse' is a standard
+module as of Python 2.7 and Python 3.2. 'ply' is available from https://
+pypi.python.org/pypi/ply.

 On some platforms it is necessary to explicitly request large file support
 to handle files bigger than 2GB. This can be done by using
@@ -250,7 +253,7 @@ Automated testing
 A system test suite can be run with make test. The system tests require
 you to configure a set of virtual IP addresses on your system (this allows
 multiple servers to run locally and communicate with one another). These
-IP addresses can be configured by by running the script bin/tests/system/
+IP addresses can be configured by running the command bin/tests/system/
 ifconfig.sh up as root.

 Some tests require Perl and the Net::DNS and/or IO::Socket::INET6 modules,
@@ -66,12 +66,12 @@ General bug reports can be sent to
 Feature requests can be sent to
 [bind-suggest@isc.org](mailto:bind-suggest@isc.org).

-Please note that, while ISC's ticketing system is not currently publicly
-readable, this may change in the future.  Please do not include information
-in bug reports that you consider to be confidential. For example, when
-sending the contents of your configuration file, it is advisable to obscure
-key secrets; this can be done automatically by using `named-checkconf
-px`.
+Please note that, while tickets submitted to ISC's ticketing system
+are not initially publicly readable by default, they can be made publicly
+acessible afterward.  Please do not include information in bug reports that
+you consider to be confidential. In particular, when sending the contents of
+your configuration file, it is advisable to obscure key secrets: this can
+be done automatically by using `named-checkconf -px`.

 Professional support and training for BIND are available from
 ISC at [https://www.isc.org/support](https://www.isc.org/support).
@@ -85,8 +85,8 @@ may also want to join the __BIND Workers__ mailing list, at

 ### <a name="contrib"/> Contributing to BIND

-A public git repository for BIND is maintained at
-[http://www.isc.org/git/](http://www.isc.org/git/), and also on Github
+ISC maintains a public git repository for BIND; details can be found
+at [http://www.isc.org/git/](http://www.isc.org/git/), and also on Github
 at [https://github.com/isc-projects](https://github.com/isc-projects).

 Information for BIND contributors can be found in the following files:
@@ -116,10 +116,8 @@ include:
 * Cached, validated NSEC and other records can now be used to synthesize
  NXDOMAIN responses.
 * The DNS Response Policy Service API (DNSRPS) is now supported.
-* Setting `max-journal-size default` now limits the size of journal files
+* Setting `'max-journal-size default'` now limits the size of journal files
  to twice the size of the zone.
-* The query handling code has been substantially refactored for improved
-  readability, maintainability and testability .
 * `dnstap-read -x` prints a hex dump of the wire format of each logged
  DNS message.
 * `dnstap` output files can now be configured to roll automatically when
@@ -128,7 +126,7 @@ include:
  8601 (UTC) formats.
 * Logging channels and `dnstap` output files can now be configured to use a
  timestamp as the suffix when rolling to a new file.
-* `named-checkconf -l` lists zones found in `named.conf`.
+* `'named-checkconf -l'` lists zones found in `named.conf`.
 * Added support for the EDNS Padding and Keepalive options.
 * 'new-zones-directory' option sets the location where the configuration
  data for zones added by rndc addzone is stored
@@ -195,9 +193,9 @@ performance on smaller systems.
 For the server to support DNSSEC, you need to build it with crypto support.
 To use OpenSSL, you should have OpenSSL 1.0.2e or newer installed.  If the
 OpenSSL library is installed in a nonstandard location, specify the prefix
-using "--with-openssl=/prefix" on the configure command line. To use a
+using "--with-openssl=&lt;PREFIX&gt;" on the configure command line. To use a
 PKCS#11 hardware service module for cryptographic operations, specify the
-path to the PKCS#11 provider library using "--with-pkcs11=/prefix", and
+path to the PKCS#11 provider library using "--with-pkcs11=&lt;PREFIX&gt;", and
 configure BIND with "--enable-native-pkcs11".

 To support the HTTP statistics channel, the server must be linked with at
@@ -220,13 +218,15 @@ libGeoIP. This is not turned on by default; BIND must be configured with
 "--with-geoip". If the library is installed in a nonstandard location, use
 specify the prefix using "--with-geoip=/prefix".

-For DNSTAP packet logging, you must have libfstrm
+For DNSTAP packet logging, you must have installed libfstrm
 [https://github.com/farsightsec/fstrm](https://github.com/farsightsec/fstrm)
 and libprotobuf-c
 [https://developers.google.com/protocol-buffers](https://developers.google.com/protocol-buffers),
 and BIND must be configured with "--enable-dnstap".

-Python requires the 'argparse' and 'ply' modules to be available.
+Portions of BIND that are written in Python, including
+`dnssec-keymgr`, `dnssec-coverage`, `dnssec-checkds`, and some of the
+system tests, require the 'argparse' and 'ply' modules to be available.
 'argparse' is a standard module as of Python 2.7 and Python 3.2.
 'ply' is available from [https://pypi.python.org/pypi/ply](https://pypi.python.org/pypi/ply).

@@ -260,7 +260,7 @@ localstatedir defaults to `$prefix/var`.
 A system test suite can be run with `make test`.  The system tests require
 you to configure a set of virtual IP addresses on your system (this allows
 multiple servers to run locally and communicate with one another).  These
-IP addresses can be configured by by running the script
+IP addresses can be configured by running the command
 `bin/tests/system/ifconfig.sh up` as root.

 Some tests require Perl and the Net::DNS and/or IO::Socket::INET6 modules,
@@ -1,4 +1,4 @@
-.\" Copyright (C) 2001, 2003-2005, 2007, 2009, 2013-2016 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2001, 2003-2005, 2007, 2009, 2013-2017 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" This Source Code Form is subject to the terms of the Mozilla Public
 .\" License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -111,7 +111,9 @@ as directed\&.
 .PP
 \-A \fIalgorithm\fR
 .RS 4
-Specifies the algorithm to use for the TSIG key\&. Available choices are: hmac\-md5, hmac\-sha1, hmac\-sha224, hmac\-sha256, hmac\-sha384 and hmac\-sha512\&. The default is hmac\-md5 or if MD5 was disabled hmac\-sha256\&.
+Specifies the algorithm to use for the TSIG key\&. Available choices are: hmac\-md5, hmac\-sha1, hmac\-sha224, hmac\-sha256, hmac\-sha384 and hmac\-sha512\&. The default is hmac\-md5, or if MD5 was disabled at compile time, hmac\-sha256\&.
+.sp
+Note: Use of hmac\-md5 is no longer recommended, and the default value will be changed to hmac\-sha256 in a future release\&.
 .RE
 .PP
 \-b \fIkeysize\fR
@@ -217,5 +219,5 @@ BIND 9 Administrator Reference Manual\&.
 \fBInternet Systems Consortium, Inc\&.\fR
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2001, 2003-2005, 2007, 2009, 2013-2016 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2001, 2003-2005, 2007, 2009, 2013-2017 Internet Systems Consortium, Inc. ("ISC")
 .br
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2001, 2003-2005, 2007-2009, 2011, 2013, 2014, 2016  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2001, 2003-2005, 2007-2009, 2011, 2013, 2014, 2016, 2017  Internet Systems Consortium, Inc. ("ISC")
 *
 * This Source Code Form is subject to the terms of the Mozilla Public
 * License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -73,7 +73,7 @@ Usage:\n\
 %s [-a] [-b bits] [-c keyfile] [-k keyname] [-p port] [-r randomfile] \
 [-s addr] [-t chrootdir] [-u user]\n\
  -a:		 generate just the key clause and write it to keyfile (%s)\n\
-  -A alg:	 algorithm (default hmac-md5)\n\
+  -A alg:	 algorithm (default hmac-md5 (deprecated and will change))\n\
  -b bits:	 from 1 through 512, default 256; total length of the secret\n\
  -c keyfile:	 specify an alternate key file (requires -a)\n\
  -k keyname:	 the name as it will be used  in named.conf and rndc.conf\n\
@@ -115,6 +115,7 @@ main(int argc, char **argv) {
 	const char *randomfile = NULL;
 	const char *serveraddr = NULL;
 	dns_secalg_t alg;
+	isc_boolean_t algset = ISC_FALSE;
 	const char *algname;
 	char *p;
 	int ch;
@@ -153,6 +154,7 @@ main(int argc, char **argv) {
 			keyonly = ISC_TRUE;
 			break;
 		case 'A':
+			algset = ISC_TRUE;
 			algname = isc_commandline_argument;
 			alg = alg_fromtext(algname);
 			if (alg == DST_ALG_UNKNOWN)
@@ -225,6 +227,20 @@ main(int argc, char **argv) {
 	if (argc > 0)
 		usage(1);

+	if (alg == DST_ALG_HMACMD5) {
+		if (algset) {
+			fprintf(stderr,
+				"warning: use of hmac-md5 for RNDC keys "
+				"is deprecated; hmac-sha256 is now "
+				"recommended.\n");
+		} else {
+			fprintf(stderr,
+				"warning: the default algorithm hmac-md5 "
+				"is deprecated and will be\n"
+				"changed to hmac-sha256 in a future release\n");
+		}
+	}
+
 	if (keysize < 0)
 		keysize = alg_bits(alg);
 	algname = alg_totext(alg);
@@ -1,5 +1,5 @@
 <!--
- - Copyright (C) 2001, 2003-2005, 2007, 2009, 2013-2016  Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2001, 2003-2005, 2007, 2009, 2013-2017  Internet Systems Consortium, Inc. ("ISC")
 -
 - This Source Code Form is subject to the terms of the Mozilla Public
 - License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -39,6 +39,7 @@
      <year>2014</year>
      <year>2015</year>
      <year>2016</year>
+      <year>2017</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
  </docinfo>
@@ -128,8 +129,12 @@
          <para>
            Specifies the algorithm to use for the TSIG key.  Available
            choices are: hmac-md5, hmac-sha1, hmac-sha224, hmac-sha256,
-            hmac-sha384 and hmac-sha512.  The default is hmac-md5 or
-            if MD5 was disabled hmac-sha256.
+            hmac-sha384 and hmac-sha512.  The default is hmac-md5, or
+            if MD5 was disabled at compile time, hmac-sha256.
+          </para>
+          <para>
+            Note: Use of hmac-md5 is no longer recommended, and the default
+            value will be changed to hmac-sha256 in a future release.
          </para>
        </listitem>
      </varlistentry>
@@ -1,6 +1,6 @@
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2001, 2003-2005, 2007, 2009, 2013-2016 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2001, 2003-2005, 2007, 2009, 2013-2017 Internet Systems Consortium, Inc. ("ISC")
 - 
 - This Source Code Form is subject to the terms of the Mozilla Public
 - License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -113,8 +113,12 @@
          <p>
            Specifies the algorithm to use for the TSIG key.  Available
            choices are: hmac-md5, hmac-sha1, hmac-sha224, hmac-sha256,
-            hmac-sha384 and hmac-sha512.  The default is hmac-md5 or
-            if MD5 was disabled hmac-sha256.
+            hmac-sha384 and hmac-sha512.  The default is hmac-md5, or
+            if MD5 was disabled at compile time, hmac-sha256.
+          </p>
+          <p>
+            Note: Use of hmac-md5 is no longer recommended, and the default
+            value will be changed to hmac-sha256 in a future release.
          </p>
        </dd>
 <dt><span class="term">-b <em class="replaceable"><code>keysize</code></em></span></dt>
@@ -62,12 +62,15 @@ may be preferable to direct use of
 .RS 4
 Selects the cryptographic algorithm\&. For DNSSEC keys, the value of
 \fBalgorithm\fR
-must be one of RSAMD5, RSASHA1, DSA, NSEC3RSASHA1, NSEC3DSA, RSASHA256, RSASHA512, ECCGOST, ECDSAP256SHA256, ECDSAP384SHA384, ED25519 or ED448\&. For TSIG/TKEY keys, the value must be one of DH (Diffie Hellman), HMAC\-MD5, HMAC\-SHA1, HMAC\-SHA224, HMAC\-SHA256, HMAC\-SHA384, or HMAC\-SHA512; specifying any of these algorithms will automatically set the
+must be one of RSAMD5, RSASHA1, DSA, NSEC3RSASHA1, NSEC3DSA, RSASHA256, RSASHA512, ECCGOST, ECDSAP256SHA256, ECDSAP384SHA384, ED25519 or ED448\&. For TKEY and SIG(0) keys, the value must be DH (Diffie Hellman); specifying this value will automatically set the
 \fB\-T KEY\fR
-option as well\&. (Note:
+option as well\&.
+.sp
+TSIG keys can also by generated by setting the value to one of HMAC\-MD5, HMAC\-SHA1, HMAC\-SHA224, HMAC\-SHA256, HMAC\-SHA384, or HMAC\-SHA512\&. As with DH, specifying these values will automatically set
+\fB\-T KEY\fR\&. Note, however, that
 \fBtsig\-keygen\fR
-produces TSIG keys in a more useful format than
-\fBdnssec\-keygen\fR\&.)
+produces TSIG keys in a more useful format\&. These algorithms have been deprecated in
+\fBdnssec\-keygen\fR, and will be removed in a future release\&.
 .sp
 These values are case insensitive\&. In some cases, abbreviations are supported, such as ECDSA256 for ECDSAP256SHA256 and ECDSA384 for ECDSAP384SHA384\&. If RSASHA1 or DSA is specified along with the
 \fB\-3\fR
@@ -75,7 +78,7 @@ option, then NSEC3RSASHA1 or NSEC3DSA will be used instead\&.
 .sp
 As of BIND 9\&.12\&.0, this option is mandatory except when using the
 \fB\-S\fR
-option (which copies the algorithm from the predecessor key)\&. Previously, the default for newly generated keys was RSASHA1\&.
+option, which copies the algorithm from the predecessor key\&. Previously, the default for newly generated keys was RSASHA1\&.
 .RE
 .PP
 \-b \fIkeysize\fR
@@ -582,6 +582,16 @@ main(int argc, char **argv) {
 		INSIST((alg != DNS_KEYALG_RSAMD5) && (alg != DST_ALG_HMACMD5));
 #endif

+
+		if (alg == DST_ALG_HMACMD5 || alg == DST_ALG_HMACSHA1 ||
+		    alg == DST_ALG_HMACSHA224 || alg == DST_ALG_HMACSHA256 ||
+		    alg == DST_ALG_HMACSHA384 || alg == DST_ALG_HMACSHA512)
+		{
+			fprintf(stderr,
+				"Use of dnssec-keygen for HMAC keys is "
+				"deprecated: use tsig-keygen\n");
+		}
+
 		if (!dst_algorithm_supported(alg))
 			fatal("unsupported algorithm: %d", alg);

@@ -122,12 +122,19 @@
 	    of <option>algorithm</option> must be one of RSAMD5, RSASHA1,
 	    DSA, NSEC3RSASHA1, NSEC3DSA, RSASHA256, RSASHA512, ECCGOST,
 	    ECDSAP256SHA256, ECDSAP384SHA384, ED25519 or ED448.  For
-            TSIG/TKEY keys, the value must be one of DH (Diffie Hellman),
-            HMAC-MD5, HMAC-SHA1, HMAC-SHA224, HMAC-SHA256, HMAC-SHA384,
-            or HMAC-SHA512; specifying any of these algorithms will
-            automatically set the <option>-T KEY</option> option as well.
-            (Note: <command>tsig-keygen</command> produces TSIG keys in a
-            more useful format than <command>dnssec-keygen</command>.)
+	    TKEY and SIG(0) keys, the value must be DH (Diffie Hellman);
+	    specifying this value will automatically set the
+	    <option>-T KEY</option> option as well.
+	  </para>
+	  <para>
+	    TSIG keys can also by generated by setting the value to
+	    one of HMAC-MD5, HMAC-SHA1, HMAC-SHA224, HMAC-SHA256,
+	    HMAC-SHA384, or HMAC-SHA512.  As with DH, specifying these
+	    values will automatically set <option>-T KEY</option>. Note,
+	    however, that <command>tsig-keygen</command> produces TSIG keys
+	    in a more useful format. These algorithms have been deprecated
+	    in <command>dnssec-keygen</command>, and will be removed in a
+	    future release.
 	  </para>
 	  <para>
 	    These values are case insensitive. In some cases, abbreviations
@@ -138,8 +145,8 @@
 	  </para>
 	  <para>
 	    As of BIND 9.12.0, this option is mandatory except when using
-	    the <option>-S</option> option (which copies the algorithm from
-	    the predecessor key).  Previously, the default for newly
+	    the <option>-S</option> option, which copies the algorithm from
+	    the predecessor key.  Previously, the default for newly
 	    generated keys was RSASHA1.
 	  </para>
 	</listitem>
@@ -103,12 +103,19 @@
 	    of <code class="option">algorithm</code> must be one of RSAMD5, RSASHA1,
 	    DSA, NSEC3RSASHA1, NSEC3DSA, RSASHA256, RSASHA512, ECCGOST,
 	    ECDSAP256SHA256, ECDSAP384SHA384, ED25519 or ED448.  For
-            TSIG/TKEY keys, the value must be one of DH (Diffie Hellman),
-            HMAC-MD5, HMAC-SHA1, HMAC-SHA224, HMAC-SHA256, HMAC-SHA384,
-            or HMAC-SHA512; specifying any of these algorithms will
-            automatically set the <code class="option">-T KEY</code> option as well.
-            (Note: <span class="command"><strong>tsig-keygen</strong></span> produces TSIG keys in a
-            more useful format than <span class="command"><strong>dnssec-keygen</strong></span>.)
+	    TKEY and SIG(0) keys, the value must be DH (Diffie Hellman);
+	    specifying this value will automatically set the
+	    <code class="option">-T KEY</code> option as well.
+	  </p>
+	  <p>
+	    TSIG keys can also by generated by setting the value to
+	    one of HMAC-MD5, HMAC-SHA1, HMAC-SHA224, HMAC-SHA256,
+	    HMAC-SHA384, or HMAC-SHA512.  As with DH, specifying these
+	    values will automatically set <code class="option">-T KEY</code>. Note,
+	    however, that <span class="command"><strong>tsig-keygen</strong></span> produces TSIG keys
+	    in a more useful format. These algorithms have been deprecated
+	    in <span class="command"><strong>dnssec-keygen</strong></span>, and will be removed in a
+	    future release.
 	  </p>
 	  <p>
 	    These values are case insensitive. In some cases, abbreviations
@@ -119,8 +126,8 @@
 	  </p>
 	  <p>
 	    As of BIND 9.12.0, this option is mandatory except when using
-	    the <code class="option">-S</code> option (which copies the algorithm from
-	    the predecessor key).  Previously, the default for newly
+	    the <code class="option">-S</code> option, which copies the algorithm from
+	    the predecessor key.  Previously, the default for newly
 	    generated keys was RSASHA1.
 	  </p>
 	</dd>
@@ -349,6 +349,14 @@ If the key\*(Aqs revocation date is set and in the past, and the key is publishe
 .RS 4
 If either of the key\*(Aqs unpublication or deletion dates are set and in the past, the key is NOT published or used to sign the zone, regardless of any other metadata\&.
 .RE
+.PP
+.RS 4
+If key\*(Aqs sync publication date is set and in the past, synchronization records (type CDS and/or CDNSKEY) are created\&.
+.RE
+.PP
+.RS 4
+If key\*(Aqs sync deletion date is set and in the past, synchronization records (type CDS and/or CDNSKEY) are removed\&.
+.RE
 .RE
 .PP
 \-T \fIttl\fR
@@ -1958,7 +1958,7 @@ addnsec3(dns_name_t *name, dns_dbnode_t *node,
 * any NSEC3 records which have the same parameters as the chain we
 * are building.
 *
- * XXXMPA Should we also check that it of the form <hash>.<origin>?
+ * XXXMPA Should we also check that it of the form &lt;hash&gt;.&lt;origin&gt;?
 */
 static void
 nsec3clean(dns_name_t *name, dns_dbnode_t *node,
@@ -646,6 +646,26 @@
                </para>
 	      </listitem>
            </varlistentry>
+
+	    <varlistentry>
+              <listitem>
+                <para>
+                  If key's sync publication date is set and in the past,
+		  synchronization records (type CDS and/or CDNSKEY) are
+		  created.
+                </para>
+	      </listitem>
+            </varlistentry>
+
+	    <varlistentry>
+              <listitem>
+                <para>
+                  If key's sync deletion date is set and in the past,
+		  synchronization records (type CDS and/or CDNSKEY) are
+		  removed.
+                </para>
+	      </listitem>
+            </varlistentry>
 	 </variablelist>
        </listitem>
      </varlistentry>
@@ -519,6 +519,22 @@
                  zone, regardless of any other metadata.
                </p>
 	      </dd>
+<dt></dt>
+<dd>
+                <p>
+                  If key's sync publication date is set and in the past,
+		  synchronization records (type CDS and/or CDNSKEY) are
+		  created.
+                </p>
+	      </dd>
+<dt></dt>
+<dd>
+                <p>
+                  If key's sync deletion date is set and in the past,
+		  synchronization records (type CDS and/or CDNSKEY) are
+		  removed.
+                </p>
+	      </dd>
 </dl></div>
        </dd>
 <dt><span class="term">-T <em class="replaceable"><code>ttl</code></em></span></dt>
@@ -156,12 +156,10 @@ options {\n\
 #	fetch-glue <obsolete>;\n\
 	fetch-quota-params 100 0.1 0.3 0.7;\n\
 	fetches-per-server 0;\n\
-	fetches-per-zone 0;\n"
-#ifdef ALLOW_FILTER_AAAA
-"	filter-aaaa-on-v4 no;\n\
+	fetches-per-zone 0;\n\
+	filter-aaaa-on-v4 no;\n\
 	filter-aaaa-on-v6 no;\n\
 	filter-aaaa { any; };\n"
-#endif
 #ifdef HAVE_GEOIP
 "	geoip-use-ecs yes;\n"
 #endif
@@ -17,6 +17,7 @@
 #include <isc/stdio.h>
 #include <isc/string.h>
 #include <isc/syslog.h>
+#include <isc/util.h>

 #include <isccfg/cfg.h>
 #include <isccfg/log.h>
@@ -160,6 +160,8 @@
 #define DIR_PERM_OK W_OK|X_OK
 #endif

+#define MAX_TCP_TIMEOUT 65535
+
 /*%
 * Check an operation for failure.  Assumes that the function
 * using it has a 'result' variable and a 'cleanup' label.
@@ -4681,20 +4683,19 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
 	 * "allow-recursion" inherits from "allow-query-cache" if set,
 	 * otherwise from "allow-query" if set.
 	 */
-	if (view->cacheacl == NULL && view->recursionacl != NULL)
+	if (view->cacheacl == NULL && view->recursionacl != NULL) {
 		dns_acl_attach(view->recursionacl, &view->cacheacl);
-	/*
-	 * XXXEACH: This call to configure_view_acl() is redundant.  We
-	 * are leaving it as it is because we are making a minimal change
-	 * for a patch release.  In the future this should be changed to
-	 * dns_acl_attach(view->queryacl, &view->cacheacl).
-	 */
-	if (view->cacheacl == NULL && view->recursion)
-		CHECK(configure_view_acl(vconfig, config, "allow-query", NULL,
-					 actx, named_g_mctx, &view->cacheacl));
+	}
+
+	if (view->cacheacl == NULL && view->recursion) {
+		dns_acl_attach(view->queryacl, &view->cacheacl);
+	}
+
 	if (view->recursion &&
 	    view->recursionacl == NULL && view->cacheacl != NULL)
+	{
 		dns_acl_attach(view->cacheacl, &view->recursionacl);
+	}

 	/*
 	 * Set default "allow-recursion", "allow-recursion-on" and
@@ -4875,7 +4876,6 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
 					      dns_quotatype_zone, r);
 	}

-#ifdef ALLOW_FILTER_AAAA
 	obj = NULL;
 	result = named_config_get(maps, "filter-aaaa-on-v4", &obj);
 	INSIST(result == ISC_R_SUCCESS);
@@ -4910,7 +4910,7 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,

 	CHECK(configure_view_acl(vconfig, config, "filter-aaaa", NULL,
 				 actx, named_g_mctx, &view->aaaa_acl));
-#endif
+
 	obj = NULL;
 	result = named_config_get(maps, "prefetch", &obj);
 	if (result == ISC_R_SUCCESS) {
@@ -7053,6 +7053,13 @@ setup_newzones(dns_view_t *view, cfg_obj_t *config, cfg_obj_t *vconfig,
 				      dir, isc_result_totext(result));
 			return (result);
 		}
+		if (access(dir, DIR_PERM_OK) != 0) {
+			isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+				      NAMED_LOGMODULE_SERVER, ISC_LOG_ERROR,
+				      "new-zones-directory '%s' "
+				      "is not writable", dir);
+			return (ISC_R_NOPERM);
+		}

 		dns_view_setnewzonedir(view, dir);
 	}
@@ -7881,11 +7888,11 @@ load_configuration(const char *filename, named_server_t *server,
 	result = named_config_get(maps, "tcp-keepalive-timeout", &obj);
 	INSIST(result == ISC_R_SUCCESS);
 	keepalive = cfg_obj_asuint32(obj);
-	if (keepalive > 1200) {
+	if (keepalive > MAX_TCP_TIMEOUT) {
 		cfg_obj_log(obj, named_g_lctx, ISC_LOG_WARNING,
 			    "tcp-keepalive-timeout value is out of range: "
-			    "lowering to 1200");
-		keepalive = 1200;
+			    "lowering to %u", MAX_TCP_TIMEOUT);
+		keepalive = MAX_TCP_TIMEOUT;
 	} else if (keepalive < 1) {
 		cfg_obj_log(obj, named_g_lctx, ISC_LOG_WARNING,
 			    "tcp-keepalive-timeout value is out of range: "
@@ -7897,11 +7904,11 @@ load_configuration(const char *filename, named_server_t *server,
 	result = named_config_get(maps, "tcp-advertised-timeout", &obj);
 	INSIST(result == ISC_R_SUCCESS);
 	advertised = cfg_obj_asuint32(obj);
-	if (advertised > 1200) {
+	if (advertised > MAX_TCP_TIMEOUT) {
 		cfg_obj_log(obj, named_g_lctx, ISC_LOG_WARNING,
 			    "tcp-advertized-timeout value is out of range: "
-			    "lowering to 1200");
-		advertised = 1200;
+			    "lowering to %u", MAX_TCP_TIMEOUT);
+		advertised = MAX_TCP_TIMEOUT;
 	}

 	ns_server_settimeouts(named_g_server->sctx,
@@ -14695,7 +14702,7 @@ named_server_tcptimeouts(isc_lex_t *lex, isc_buffer_t **text) {
 		if (ptr == NULL)
 			return (ISC_R_UNEXPECTEDEND);
 		CHECK(isc_parse_uint32(&keepalive, ptr, 10));
-		if (keepalive > 1200)
+		if (keepalive > MAX_TCP_TIMEOUT)
 			CHECK(ISC_R_RANGE);
 		if (keepalive < 1)
 			CHECK(ISC_R_RANGE);
@@ -14704,7 +14711,7 @@ named_server_tcptimeouts(isc_lex_t *lex, isc_buffer_t **text) {
 		if (ptr == NULL)
 			return (ISC_R_UNEXPECTEDEND);
 		CHECK(isc_parse_uint32(&advertised, ptr, 10));
-		if (advertised > 1200)
+		if (advertised > MAX_TCP_TIMEOUT)
 			CHECK(ISC_R_RANGE);

 		result = isc_task_beginexclusive(named_g_server->task);
@@ -20,6 +20,7 @@
 #include <isc/stats.h>
 #include <isc/string.h>
 #include <isc/task.h>
+#include <isc/util.h>

 #include <dns/cache.h>
 #include <dns/db.h>
@@ -16,6 +16,7 @@
 #include <isc/buffer.h>
 #include <isc/mem.h>
 #include <isc/string.h>
+#include <isc/util.h>

 #include <isccfg/cfg.h>

@@ -1,19 +1,17 @@
 #!/bin/sh
 #
-# Copyright (C) 2013, 2014, 2016  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2013, 2014, 2016, 2017  Internet Systems Consortium, Inc. ("ISC")
 #
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.

-# $Id: clean.sh,v 1.6 2007/09/26 03:22:44 marka Exp $
-
 #
 # Clean up after tests.
 #

 rm -f dig.out.*
 rm -f */named.memstats
-rm -f */named.conf
+rm -f ns1/named.conf
 rm -f */named.run
 rm -f ns*/named.lock
@@ -0,0 +1,25 @@
+/*
+ * Copyright (C) 2017  Internet Systems Consortium, Inc. ("ISC")
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ */
+
+controls { /* empty */ };
+
+options {
+	query-source address 10.53.0.3;
+	notify-source 10.53.0.3;
+	transfer-source 10.53.0.3;
+	port 5300;
+	pid-file "named.pid";
+	listen-on { 10.53.0.3; };
+	listen-on-v6 { none; };
+	recursion yes;
+};
+
+zone "." {
+	type hint;
+	file "root.hint";
+};
@@ -0,0 +1,8 @@
+; Copyright (C) 2017  Internet Systems Consortium, Inc. ("ISC")
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0. If a copy of the MPL was not distributed with this
+; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+. NS ns1.
+ns1. A 10.53.0.1
@@ -212,7 +212,7 @@ echo "I:testing with 'minimal-responses yes;'"
 minimal=yes
 dotests

-echo "I:reconfiguring server"
+echo "I:reconfiguring server: minimal-responses no"
 cp ns1/named2.conf ns1/named.conf
 $RNDC -c ../common/rndc.conf -s 10.53.0.1 -p 9953 reconfig 2>&1 | sed 's/^/I:ns1 /'
 sleep 2
@@ -230,7 +230,7 @@ if [ $ret -eq 1 ] ; then
    echo "I: failed"; status=1
 fi

-echo "I:reconfiguring server"
+echo "I:reconfiguring server: minimal-any yes"
 cp ns1/named3.conf ns1/named.conf
 $RNDC -c ../common/rndc.conf -s 10.53.0.1 -p 9953 reconfig 2>&1 | sed 's/^/I:ns1 /'
 sleep 2
@@ -266,7 +266,7 @@ echo "I:testing with 'minimal-responses no-auth;'"
 minimal=no-auth
 dotests

-echo "I:reconfiguring server"
+echo "I:reconfiguring server: minimal-responses no-auth-recursive"
 cp ns1/named4.conf ns1/named.conf
 $RNDC -c ../common/rndc.conf -s 10.53.0.1 -p 9953 reconfig 2>&1 | sed 's/^/I:ns1 /'
 sleep 2
@@ -297,5 +297,30 @@ if [ $ret -eq 1 ] ; then
    echo "I: failed"; status=1
 fi

+echo "I:reconfiguring server: minimal-responses no"
+cp ns1/named2.conf ns1/named.conf
+$RNDC -c ../common/rndc.conf -s 10.53.0.1 -p 9953 reconfig 2>&1 | sed 's/^/I:ns1 /'
+sleep 2
+
+n=`expr $n + 1`
+echo "I:testing NS handling in ANY responses (authoritative) ($n)"
+ret=0
+$DIG -t ANY rt.example @10.53.0.1 -p 5300 > dig.out.$n || ret=1
+grep "AUTHORITY: 0" dig.out.$n  > /dev/null || ret=1
+grep "NS[ 	]*ns" dig.out.$n  > /dev/null || ret=1
+if [ $ret -eq 1 ] ; then
+    echo "I: failed"; status=1
+fi
+
+n=`expr $n + 1`
+echo "I:testing NS handling in ANY responses (recursive) ($n)"
+ret=0
+$DIG -t ANY rt.example @10.53.0.3 -p 5300 > dig.out.$n || ret=1
+grep "AUTHORITY: 0" dig.out.$n  > /dev/null || ret=1
+grep "NS[ 	]*ns" dig.out.$n  > /dev/null || ret=1
+if [ $ret -eq 1 ] ; then
+    echo "I: failed"; status=1
+fi
+
 echo "I:exit status: $status"
 [ $status -eq 0 ] || exit 1
@@ -24,8 +24,8 @@ options {
 	dnssec-must-be-secure mustbesecure.example yes;
 	minimal-responses no;

-	nta-lifetime 10s;
-	nta-recheck 7s;
+	nta-lifetime 12s;
+	nta-recheck 9s;

 	# Note: We only reference the bind.keys file here to confirm that it
 	# is *not* being used.  It contains the real root key, and we're
@@ -1722,7 +1722,7 @@ echo "I: waiting for NTA rechecks/expirations"
 # fakenode.secure.example should both be lifted, but badds.example
 # should still be going.
 #
-$PERL -e 'my $delay =  '$start' + 8 - time(); select(undef, undef, undef, $delay) if ($delay > 0);'
+$PERL -e 'my $delay =  '$start' + 10 - time(); select(undef, undef, undef, $delay) if ($delay > 0);'
 $DIG $DIGOPTS b.secure.example. a @10.53.0.4 > dig.out.ns4.test$n.8 || ret=1
 grep "status: SERVFAIL" dig.out.ns4.test$n.8 > /dev/null && ret=1
 grep "flags:[^;]* ad[^;]*;" dig.out.ns4.test$n.8 > /dev/null || ret=1
@@ -1742,7 +1742,7 @@ ret=0
 # it should still be NTA'd, but badds.example used the default
 # lifetime of 10s, so it should revert to SERVFAIL now.
 #
-$PERL -e 'my $delay = '$start' + 11 - time(); select(undef, undef, undef, $delay) if ($delay > 0);'
+$PERL -e 'my $delay = '$start' + 13 - time(); select(undef, undef, undef, $delay) if ($delay > 0);'
 # check nta table
 $RNDC -c ../common/rndc.conf -s 10.53.0.4 -p 9953 nta -d > rndc.out.ns4.test$n._11
 lines=`grep " expiry " rndc.out.ns4.test$n._11 | wc -l`
@@ -2501,9 +2501,15 @@ do
 done;
 grep "ANSWER: 3," dig.out.ns2.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo "I:nsec3 chain generation not complete"; fi
-sleep 3
 $DIG $DIGOPTS +noauth +nodnssec soa nsec3chain-test @10.53.0.2 > dig.out.ns2.test$n || ret=1
-$DIG $DIGOPTS +noauth +nodnssec soa nsec3chain-test @10.53.0.3 > dig.out.ns3.test$n || ret=1
+s2=`awk '$4 == "SOA" { print $7}' dig.out.ns2.test$n`
+for i in 1 2 3 4 5 6 7 8 9 10
+do
+	$DIG $DIGOPTS +noauth +nodnssec soa nsec3chain-test @10.53.0.3 > dig.out.ns3.test$n || ret=1
+	s3=`awk '$4 == "SOA" { print $7}' dig.out.ns3.test$n`
+	test "$s2" = "$s3" && break
+	sleep 1
+done
 $PERL ../digcomp.pl dig.out.ns2.test$n dig.out.ns3.test$n || ret=1
 n=`expr $n + 1`
 if [ $ret != 0 ]; then echo "I:failed"; fi
@@ -13,6 +13,7 @@
 #include <config.h>

 #include <isc/string.h>
+#include <isc/util.h>

 #include <dns/db.h>
 #include <dns/diff.h>
@@ -10,6 +10,7 @@
 #include <isc/eventclass.h>
 #include <isc/netaddr.h>
 #include <isc/task.h>
+#include <isc/util.h>

 #include <dns/byaddr.h>
 #include <dns/db.h>
@@ -36,7 +36,6 @@ usage() {
 	fprintf(stderr, "args:\n");
 	fprintf(stderr, "	--edns-version\n");
 	fprintf(stderr, "	--enable-dnsrps\n");
-	fprintf(stderr, "	--enable-filter-aaaa\n");
 	fprintf(stderr, "	--gethostname\n");
 	fprintf(stderr, "	--gssapi\n");
 	fprintf(stderr, "	--have-dlopen\n");
@@ -63,14 +62,6 @@ main(int argc, char **argv) {
 #endif
 	}

-	if (strcmp(argv[1], "--enable-filter-aaaa") == 0) {
-#ifdef ALLOW_FILTER_AAAA
-		return (0);
-#else
-		return (1);
-#endif
-	}
-
 	if (strcmp(argv[1], "--edns-version") == 0) {
 #ifdef DNS_EDNS_VERSION
 		printf("%d\n", DNS_EDNS_VERSION);
@@ -1,110 +1,125 @@
-; File written on Thu May  1 12:16:00 2014
-; dnssec_signzone version 9.8.5-P1
-signed.			120	IN SOA	ns.utld. hostmaster.ns.utld. (
+; File written on Mon Oct 16 09:16:28 2017
+; dnssec_signzone version 9.11.2
+signed.			120	IN SOA	ns.signed. hostmaster.ns.signed. (
 					1          ; serial
 					3600       ; refresh (1 hour)
 					1200       ; retry (20 minutes)
 					604800     ; expire (1 week)
 					60         ; minimum (1 minute)
 					)
-			120	RRSIG	SOA 3 1 120 20820519023008 (
-					20140501011600 12955 signed.
-					BEFlElqfz17JeL/ISbgEz7yenWy2QjhgdMUx
-					VDLBx3+Eiz1nyB1CpWw= )
-			120	NS	ns.utld.
-			120	RRSIG	NS 3 1 120 20820519023008 (
-					20140501011600 12955 signed.
-					BC4nYbfEyROe0CZPj/cHRl7BCIc0MbzpDBwz
-					an8bPTHrbaHpC8rdX54= )
+			120	RRSIG	SOA 3 1 120 (
+					20820519023008 20140501011600 17876 signed.
+					BJDbUrXS4UzBrTeNUMA0sSGYd+h9M5d8qzsE
+					q7RJyDtUNJIwP5vAnSQ= )
+			120	NS	ns.signed.
+			120	RRSIG	NS 3 1 120 (
+					20820519023008 20140501011600 17876 signed.
+					BGoYuOkkcTAYnym27q2BgqkjUgP/0/Tip1yc
+					txRS1D0CipTUZhCNrXc= )
 			120	MX	10 mx.signed.
-			120	RRSIG	MX 3 1 120 20820519023008 (
-					20140501011600 12955 signed.
-					BEp7iUXEnBCXVtKHcIRfkiK34J83ZbC3g7qQ
-					XY+wdpJ7TxavEBtZO94= )
+			120	RRSIG	MX 3 1 120 (
+					20820519023008 20140501011600 17876 signed.
+					BOUPCSEEJ8dZ0oWeiYEvGIonjagvM1OS+mEY
+					i5VUmysn7kArWqeFERs= )
 			60	NSEC	a-only.signed. NS SOA MX RRSIG NSEC DNSKEY
-			60	RRSIG	NSEC 3 1 60 20820519023008 (
-					20140501011600 12955 signed.
-					BAjeMFAXkfL9AypyihxU7lvhGCENKAwpoGt6
-					WYd6G0kb6zdpZ/AR1GQ= )
+			60	RRSIG	NSEC 3 1 60 (
+					20820519023008 20140501011600 17876 signed.
+					BBzvCsFw4EgfrIsFOu5IjP2gncm8dntwHaMD
+					IeJ6g6s7IOwFT5nyrOU= )
 			120	DNSKEY	256 3 3 (
-					BJIozpii3vZYz7LNraaDEOOpLFcdlw091gEG
-					+SHpTEVDdb7atLaYCYoSaodASSYutOQbba1o
-					i6xLiEAZdb4MNoM50vOtQlb4NJDAGElTOShK
-					RE60G1veNVuN87ZpsiPlLU7m307l03aNUkJu
-					LNd19kEuq1ItZt1SFVUkLvAHxs8hSLyDpq/u
-					4P/6QnPG294dk2eh83m2PuQVChvJLcrFhIbJ
-					CWxCEsW9fe2eO1YtwoyFmqIIFSlAs84bwy2O
-					iA7x0PeoXpKGLhuKCbvre5zVLRaqMFoMDJmr
-					vpGTxJ+AbOLEzDgO8QkGT+WCEBSMqRXvUkX0
-					rBcSDAa8GpCTyhVs0j9KIedRbYalV24JzViy
-					m7UrKcZojCcXEjl0rXIJHNlfvQsfy6F3cq4m
-					GimMrtxmA5Wf1xoJ
-					) ; key id = 12955
+					BPXo3mJOeCCuorn7Hc7bxR3QDHrJvq9gUpPS
+					s8QYF3eiSpB97c8Br7fFzFYHQCJWWnCtpt1E
+					h7SveJSl1ASNl9W2KE6hDNXfDX+ixDOtFZ/7
+					PCh/obX36VK86EH+ZBNLxxEy9tHHCGO08zy8
+					3lWI3E5bk9a1sks2dy6hbQfMmyXWI5QwYS9D
+					j5Vs5yeUQ5e6SPmIqgqpn6VnDtAIfR2My7/r
+					/Jgf73gpZugZmn6wDbzNCyGIvtOJCHAY2OEg
+					ZfACKVdJrXZ42NKcJCgSTd1xY81UyMI9QAMq
+					64Lx/tENCo1GKBCk/1HMdiO6WKeXCJd1SYzN
+					VM+n4fRzEkmVT9wfyiSmoq6SxjeqrRebDz8G
+					42d4lsm2/0bmOlle+fva7LwtGOaS+tBqtD8K
+					kexFaixL5iY+LB0Q
+					) ; ZSK; alg = DSA ; key id = 17876
 			120	DNSKEY	257 3 3 (
-					BJIozpii3vZYz7LNraaDEOOpLFcdlw091gEG
-					+SHpTEVDdb7atLaYCYoSaodASSYutOQbba1o
-					i6xLiEAZdb4MNoM50vOtQlb4NJDAGElTOShK
-					RE60G1veNVuN87ZpsiPlLU7m307l03aNUkJu
-					LNd19kEuq1ItZt1SFVUkLvAHxs8hSLyDpq/u
-					4P/6QnPG294dk2eh83m2PuQVChvJLcrFhIbJ
-					CWxCEsW9fe2eO1YtwoyFmqIIFSlAs84bwy2O
-					iA7x0PeoXpKGLhuKCbvre5zVLRaqMFoMDJmr
-					vpGTxJ+AbOLEzDgO8QkGT+WCEBSMqRXvUkX0
-					rBcSDAa8GpCTyhVs0j9KIedRbYalV24JzViy
-					m7UrKcZojCcXEjl0rXIJHNlfvQsfy6F3cq4m
-					GimMrtxmA5Wf1xoJ
-					) ; key id = 12956
-			120	RRSIG	DNSKEY 3 1 120 20820519023008 (
-					20140501011600 12955 signed.
-					BG/sW/I/ZVcUCjGfAicxv4kYLLYoMZlivDqU
-					V3GfAXR5Bp69ywKp1OA= )
-			120	RRSIG	DNSKEY 3 1 120 20820519023008 (
-					20140501011600 12956 signed.
-					BAoQwXiKVoWwY+IDfzRndz9ndLPTSShDHpxS
-					Z9+uTx+KCPzUsZYQy4k= )
+					BOOhXnn+YV6RQ+jRPdayrnC2cd9x5P77c1/6
+					Ev41qaWl1N7QRDXYh7VDS1UowoPbvQOvgQU0
+					X7+zKWrB8UQcdsUe96IH/wPab1qkJlKanZni
+					uFdB/2sTvQ6yabIC41dItnGeuN9VY1qwCa7T
+					4QFRVYyDPKgxo7MRLq9YoUN8RTcB6lY1BH9Z
+					QgcHZljAFVgU1Zc/6DZlQeBZyJafwIR+I7Eq
+					Oe+rR44ZeD5JRgI1OwGyw/b1wKUxFhM+4XJi
+					i8mQ1mrvzZ27iQbYP4WEzaskU6P5X+nPrTFi
+					tLEaPugt8Oe7+lHLjpHvHzSOJZ5Radfiqgzg
+					GGOzj1qmLfKLdRmp4VuBQ+1kguiz9D3ev89d
+					pzP7dYHuSdCjc9X0fLmPjU1xD6RyLCDEmUm7
+					eeRP55SiTiQCzJFr
+					) ; KSK; alg = DSA ; key id = 3746
+			120	RRSIG	DNSKEY 3 1 120 (
+					20820519023008 20140501011600 3746 signed.
+					BFuLN7ACQrD6/3WaieXRD1JpSXW9s+/xCZ1x
+					0ihUT1iKNvJS8F4Pafc= )
+			120	RRSIG	DNSKEY 3 1 120 (
+					20820519023008 20140501011600 17876 signed.
+					BN+8hbh1FGTNqHds0In57dPr5fVRU/P28dZa
+					zIP19bAwTH/ZvgrqUF0= )
 a-only.signed.		120	IN NS	1.0.0.1.signed.
 			60	NSEC	aaaa-only.signed. NS RRSIG NSEC
-			60	RRSIG	NSEC 3 2 60 20820519023008 (
-					20140501011600 12955 signed.
-					BBRjTWMwkjpanDw386nblW6fwyliYRUeNNo+
-					OHwhqHXXd4bathApttg= )
+			60	RRSIG	NSEC 3 2 60 (
+					20820519023008 20140501011600 17876 signed.
+					BHpGpjMihpoIykHTpK1XmkVn0jqSST3/K6Fx
+					vTaIb24rpkTriaXxChM= )
 aaaa-only.signed.	120	IN AAAA	2001:db8::2
-			120	RRSIG	AAAA 3 2 120 20820519023008 (
-					20140501011600 12955 signed.
-					BDukZxGM62Wmk9JE7F5etkcX4LZyFLK0YS0H
-					CF0lovOlBeK5zLgi/MA= )
+			120	RRSIG	AAAA 3 2 120 (
+					20820519023008 20140501011600 17876 signed.
+					BOvYax/3CDnEKTtbc6zoP4hYwhMe5SoXZh0w
+					muzBWw9bEH+Bdt1ZEQ4= )
 			60	NSEC	dual.signed. AAAA RRSIG NSEC
-			60	RRSIG	NSEC 3 2 60 20820519023008 (
-					20140501011600 12955 signed.
-					BH1TJpK7j1Gu01hb2PimefFISv59NDLfZ9Gr
-					ojpnjDQNV6bA7HcHeEM= )
+			60	RRSIG	NSEC 3 2 60 (
+					20820519023008 20140501011600 17876 signed.
+					BIqxE79TUnT2DUuocTitGhTNGnLs0+3sLJdz
+					8haJbyH8pig1h7mqimU= )
 dual.signed.		120	IN A	1.0.0.3
-			120	RRSIG	A 3 2 120 20820519023008 (
-					20140501011600 12955 signed.
-					BBIDPDxbSm3X/Xf5xh/MYIkAvZ9CWpEzSwbM
-					Pks77CGb4rW8IF8WXxs= )
+			120	RRSIG	A 3 2 120 (
+					20820519023008 20140501011600 17876 signed.
+					BIGL70eEIGVDW0gcYpEWgCFv4ne14hutQCMh
+					gQ6kcEbl2qszosJA60E= )
 			120	AAAA	2001:db8::3
-			120	RRSIG	AAAA 3 2 120 20820519023008 (
-					20140501011600 12955 signed.
-					BHKD6egOF6e2DfY7+iPNDPcMS6TdU8/OCm8u
-					OYjmr11t5cI8S0R1Iqk= )
+			120	RRSIG	AAAA 3 2 120 (
+					20820519023008 20140501011600 17876 signed.
+					BCmwk+ng/x1O7MhheK8MgAXYFVDDbyiZ76RV
+					iwQrPRm0ThNRtsQU+UY= )
 			60	NSEC	mx.signed. A AAAA RRSIG NSEC
-			60	RRSIG	NSEC 3 2 60 20820519023008 (
-					20140501011600 12955 signed.
-					BHeXsjvM4Bmr/Ih4eDgR9VTC7R/UFlz5ns+g
-					7LPl+H9Oe6zGnM5rGOs= )
-mx.signed.		120	IN A	1.0.0.3
-			120	RRSIG	A 3 2 120 20820519023008 (
-					20140501011600 12955 signed.
-					BAq3t2X4XDI/dIofEkALZsNn1ezNWDYFH0M2
-					2GI5F0JHr/iZPlAzRbk= )
-			120	AAAA	2001:db8::3
-			120	RRSIG	AAAA 3 2 120 20820519023008 (
-					20140501011600 12955 signed.
-					BFts4Mon2FQaLQb6kPOKTEFkHaPIE1xUgrI6
-					qV8tEaAyFXfhH4su6Y0= )
+			60	RRSIG	NSEC 3 2 60 (
+					20820519023008 20140501011600 17876 signed.
+					BLlLAIHF4SX/eWMCkUvj0XTFmaOp3xnifqkL
+					nSWOAqtzJ5fwAdbNBdM= )
+ns.signed.		120	IN A	10.53.0.1
+			120	RRSIG	A 3 2 120 (
+					20820519023008 20140501011600 17876 signed.
+					BJ+Wll7VfNEjM4EfLY2rlx74oIwKRg9pjcJO
+					Zxt6GHQIJ2D6EfyMZ00= )
+			120	AAAA	fd92:7065:b8e:ffff::1
+			120	RRSIG	AAAA 3 2 120 (
+					20820519023008 20140501011600 17876 signed.
+					BGT/agHn4qcHzLV2hYcGeLJ6Tz1to9sTB8LI
+					lMwkV/KUu6UO7yvrnYk= )
 			60	NSEC	signed. A AAAA RRSIG NSEC
-			60	RRSIG	NSEC 3 2 60 20820519023008 (
-					20140501011600 12955 signed.
-					BCQWnlB8hrID+v5xG/o8t8E+YDb3Fz7Qodmw
-					kBQ+ZwyIeLOoH2+as5A= )
+			60	RRSIG	NSEC 3 2 60 (
+					20820519023008 20140501011600 17876 signed.
+					BNe3XmEGd/xxoh8FN3T3V9G1enCzNQJ7l3G+
+					D3QPrp7mYtPAGMxCLlc= )
+mx.signed.		120	IN A	1.0.0.3
+			120	RRSIG	A 3 2 120 (
+					20820519023008 20140501011600 17876 signed.
+					BMlIQp1acUSUvgzV1CWlM0+cS1bGkFsbS6HQ
+					d0S6TbNV+uNw0S1q0Dk= )
+			120	AAAA	2001:db8::3
+			120	RRSIG	AAAA 3 2 120 (
+					20820519023008 20140501011600 17876 signed.
+					BGtSuYQF7sRVT5OdVHPJjm0PERzSp4v+d/DP
+					Vp2UD0vSVSr3Vj2Wi4M= )
+			60	NSEC	ns.signed. A AAAA RRSIG NSEC
+			60	RRSIG	NSEC 3 2 60 (
+					20820519023008 20140501011600 17876 signed.
+					BMzQWws37wYfHvLnqgvjd+j5dkzBb2RYhrQk
+					ykM0GnTAR6ZpmgQO6jc= )
@@ -1,16 +0,0 @@
-#!/bin/sh
-#
-# Copyright (C) 2010, 2012, 2014, 2016  Internet Systems Consortium, Inc. ("ISC")
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, You can obtain one at http://mozilla.org/MPL/2.0/.
-
-SYSTEMTESTTOP=..
-. $SYSTEMTESTTOP/conf.sh
-
-$FEATURETEST --enable-filter-aaaa || {
-    echo "I:This test requires --enable-filter-aaaa at compile time." >&2
-    exit 255
-}
-exit 0
@@ -486,6 +486,7 @@ fi
 n=`expr $n + 1`
 ret=0
 echo "I:check that 'update-policy local' fails from non-localhost address ($n)"
+grep 'match on session key not from localhost' ns5/named.run > /dev/null && ret=1
 $NSUPDATE -p 5300 -k ns5/session.key > nsupdate.out.$n 2>&1 << END && ret=1
 server 10.53.0.5 5300
 local 10.53.0.1
@@ -493,6 +494,7 @@ update add nonlocal.local.nil. 600 A 4.3.2.1
 send
 END
 grep REFUSED nsupdate.out.$n > /dev/null 2>&1 || ret=1
+grep 'match on session key not from localhost' ns5/named.run > /dev/null || ret=1
 $DIG @10.53.0.5 -p 5300 \
        +tcp +noadd +nosea +nostat +noquest +nocomm +nocmd \
        nonlocal.local.nil. > dig.out.ns5.$n || ret=1
@@ -100,26 +100,27 @@ $PERL stop.pl $test
 status=`expr $status + $?`

 if [ $status != 0 ]; then
-	echofail "R:FAIL"
-	# Don't clean up - we need the evidence.
-	find . -name core -exec chmod 0644 '{}' \;
+    echofail "R:FAIL"
+    # Don't clean up - we need the evidence.
+    find . -name core -exec chmod 0644 '{}' \;
 else
-	echopass "R:PASS"
+    echopass "R:PASS"

-	if $clean
+    if $clean
+    then
+	rm -f $SYSTEMTESTTOP/random.data
+	if test -f $test/clean.sh
 	then
-		rm -f $SYSTEMTESTTOP/random.data
-		if test -f $test/clean.sh
-		then
-			( cd $test && $SHELL clean.sh "$@" )
-		fi
-		if test -d ../../../.git
-		then
-			git status -su $test |
-			sed -n 's/^?? \(.*\)/I:file \1 not removed/p'
-		fi
-
+	    ( cd $test && $SHELL clean.sh "$@" )
 	fi
+	if test -d ../../../.git
+	then
+	    git status -su --ignored $test |
+	    sed -n -e 's|^?? \(.*\)|I:file \1 not removed|p' \
+		-e 's|^!! \(.*/named.run\)$|I:file \1 not removed|p' \
+		-e 's|^!! \(.*/named.memstats\)$|I:file \1 not removed|p'
+	fi
+    fi
 fi

 echoinfo "E:$test:`date`"
@@ -0,0 +1,16 @@
+/*
+ * Copyright (C) 2017  Internet Systems Consortium, Inc. ("ISC")
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ */
+
+options {
+	new-zones-directory "./nope";
+	port 5300;
+	pid-file "../named.pid";
+	listen-on { 127.0.0.1; };
+	listen-on-v6 { none; };
+	recursion no;
+};
@@ -73,6 +73,17 @@ grep "managed-keys-directory './nope' is not writable" ns2/named.run > /dev/null
 if [ $ret != 0 ]; then echo "I:failed"; fi
 status=`expr $status + $ret`

+n=`expr $n + 1`
+echo "I: checking that named refuses to reconfigure if new-zones-directory is not writable ($n)"
+ret=0
+cp -f ns2/named-alt6.conf ns2/named.conf
+$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 reconfig > rndc.out.$n 2>&1
+grep "failed: permission denied" rndc.out.$n > /dev/null 2>&1 || ret=1
+sleep 1
+grep "new-zones-directory './nope' is not writable" ns2/named.run > /dev/null 2>&1 || ret=1
+if [ $ret != 0 ]; then echo "I:failed"; fi
+status=`expr $status + $ret`
+
 n=`expr $n + 1`
 echo "I: checking that named refuses to start if working directory is not writable ($n)"
 ret=0
@@ -4,6 +4,8 @@
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.

+rm -f */named.memstats
+rm -f */named.run
 rm -f dig.out.*
 rm -f ns1/K*+*+*.key
 rm -f ns1/K*+*+*.private
@@ -0,0 +1,34 @@
+/*
+ * Copyright (C) 2017  Internet Systems Consortium, Inc. ("ISC")
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ */
+
+// NS4
+
+controls { /* empty */ };
+
+options {
+	query-source address 10.53.0.4;
+	notify-source 10.53.0.4;
+	transfer-source 10.53.0.4;
+	port 5300;
+	pid-file "named.pid";
+	listen-on { 10.53.0.4; };
+	listen-on-v6 { none; };
+	recursion yes;
+	notify no;
+	dnssec-enable yes;
+	dnssec-validation yes;
+	synth-from-dnssec no;
+};
+
+zone "." {
+	type hint;
+	file "root.hints";
+};
+
+include "../ns1/trusted.conf";
+// include "../../common/controls.conf";
@@ -0,0 +1,8 @@
+; Copyright (C) 2017  Internet Systems Consortium, Inc. ("ISC")
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0. If a copy of the MPL was not distributed with this
+; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+.	NS	ns1
+ns1	A	10.53.0.1
@@ -0,0 +1,33 @@
+/*
+ * Copyright (C) 2017  Internet Systems Consortium, Inc. ("ISC")
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ */
+
+// NS5
+
+controls { /* empty */ };
+
+options {
+	query-source address 10.53.0.5;
+	notify-source 10.53.0.5;
+	transfer-source 10.53.0.5;
+	port 5300;
+	pid-file "named.pid";
+	listen-on { 10.53.0.5; };
+	listen-on-v6 { none; };
+	recursion yes;
+	notify no;
+	dnssec-enable yes;
+	dnssec-validation yes;
+	synth-from-dnssec yes;
+};
+
+zone "." {
+	type hint;
+	file "root.hints";
+};
+
+include "../ns1/trusted.conf";
@@ -0,0 +1,8 @@
+; Copyright (C) 2017  Internet Systems Consortium, Inc. ("ISC")
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0. If a copy of the MPL was not distributed with this
+; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+.	NS	ns1
+ns1	A	10.53.0.1
@@ -17,49 +17,58 @@ rm -f dig.out.*
 DIGOPTS="+tcp +noadd +nosea +nostat +nocmd +dnssec -p 5300"
 DELVOPTS="-a ns1/trusted.conf -p 5300"

-echo "I:prime negative NXDOMAIN response ($n)"
-ret=0
-$DIG $DIGOPTS a.example. @10.53.0.2 a > dig.out.ns2.test$n || ret=1
-grep "flags:[^;]* ad[ ;]" dig.out.ns2.test$n > /dev/null || ret=1
-grep "status: NXDOMAIN," dig.out.ns2.test$n > /dev/null || ret=1
-grep "example.*3600.IN.SOA" dig.out.ns2.test$n > /dev/null || ret=1
-nxdomain=dig.out.ns2.test$n
-n=`expr $n + 1`
-if [ $ret != 0 ]; then echo "I:failed"; fi
-status=`expr $status + $ret`
+for ns in 2 4 5
+do
+    case $ns in
+    2) description="<default>";;
+    4) description="no";;
+    5) description="yes";;
+    *) exit 1;;
+    esac
+    echo "I:prime negative NXDOMAIN response (synth-from-dnssec ${description};) ($n)"
+    ret=0
+    $DIG $DIGOPTS a.example. @10.53.0.${ns} a > dig.out.ns${ns}.test$n || ret=1
+    grep "flags:[^;]* ad[ ;]" dig.out.ns${ns}.test$n > /dev/null || ret=1
+    grep "status: NXDOMAIN," dig.out.ns${ns}.test$n > /dev/null || ret=1
+    grep "example.*3600.IN.SOA" dig.out.ns${ns}.test$n > /dev/null || ret=1
+    [ $ns -eq ${ns} ] && nxdomain=dig.out.ns${ns}.test$n
+    n=`expr $n + 1`
+    if [ $ret != 0 ]; then echo "I:failed"; fi
+    status=`expr $status + $ret`

-echo "I:prime negative NODATA response ($n)"
-ret=0
-$DIG $DIGOPTS nodata.example. @10.53.0.2 a > dig.out.ns2.test$n || ret=1
-grep "flags:[^;]* ad[ ;]" dig.out.ns2.test$n > /dev/null || ret=1
-grep "status: NOERROR," dig.out.ns2.test$n > /dev/null || ret=1
-grep "example.*3600.IN.SOA" dig.out.ns2.test$n > /dev/null || ret=1
-nodata=dig.out.ns2.test$n
-n=`expr $n + 1`
-if [ $ret != 0 ]; then echo "I:failed"; fi
-status=`expr $status + $ret`
+    echo "I:prime negative NODATA response (synth-from-dnssec ${description};) ($n)"
+    ret=0
+    $DIG $DIGOPTS nodata.example. @10.53.0.${ns} a > dig.out.ns${ns}.test$n || ret=1
+    grep "flags:[^;]* ad[ ;]" dig.out.ns${ns}.test$n > /dev/null || ret=1
+    grep "status: NOERROR," dig.out.ns${ns}.test$n > /dev/null || ret=1
+    grep "example.*3600.IN.SOA" dig.out.ns${ns}.test$n > /dev/null || ret=1
+    [ $ns -eq 2 ] && nodata=dig.out.ns${ns}.test$n
+    n=`expr $n + 1`
+    if [ $ret != 0 ]; then echo "I:failed"; fi
+    status=`expr $status + $ret`

-echo "I:prime wildcard response ($n)"
-ret=0
-$DIG $DIGOPTS a.wild-a.example. @10.53.0.2 a > dig.out.ns2.test$n || ret=1
-grep "flags:[^;]* ad[ ;]" dig.out.ns2.test$n > /dev/null || ret=1
-grep "status: NOERROR," dig.out.ns2.test$n > /dev/null || ret=1
-grep "a.wild-a.example.*3600.IN.A" dig.out.ns2.test$n > /dev/null || ret=1
-n=`expr $n + 1`
-if [ $ret != 0 ]; then echo "I:failed"; fi
-status=`expr $status + $ret`
+    echo "I:prime wildcard response (synth-from-dnssec ${description};) ($n)"
+    ret=0
+    $DIG $DIGOPTS a.wild-a.example. @10.53.0.${ns} a > dig.out.ns${ns}.test$n || ret=1
+    grep "flags:[^;]* ad[ ;]" dig.out.ns${ns}.test$n > /dev/null || ret=1
+    grep "status: NOERROR," dig.out.ns${ns}.test$n > /dev/null || ret=1
+    grep "a.wild-a.example.*3600.IN.A" dig.out.ns${ns}.test$n > /dev/null || ret=1
+    n=`expr $n + 1`
+    if [ $ret != 0 ]; then echo "I:failed"; fi
+    status=`expr $status + $ret`

-echo "I:prime wildcard CNAME response ($n)"
-ret=0
-$DIG $DIGOPTS a.wild-cname.example. @10.53.0.2 a > dig.out.ns2.test$n || ret=1
-grep "flags:[^;]* ad[ ;]" dig.out.ns2.test$n > /dev/null || ret=1
-grep "status: NOERROR," dig.out.ns2.test$n > /dev/null || ret=1
-grep "a.wild-cname.example.*3600.IN.CNAME" dig.out.ns2.test$n > /dev/null || ret=1
-n=`expr $n + 1`
-if [ $ret != 0 ]; then echo "I:failed"; fi
-status=`expr $status + $ret`
+    echo "I:prime wildcard CNAME response (synth-from-dnssec ${description};) ($n)"
+    ret=0
+    $DIG $DIGOPTS a.wild-cname.example. @10.53.0.${ns} a > dig.out.ns${ns}.test$n || ret=1
+    grep "flags:[^;]* ad[ ;]" dig.out.ns${ns}.test$n > /dev/null || ret=1
+    grep "status: NOERROR," dig.out.ns${ns}.test$n > /dev/null || ret=1
+    grep "a.wild-cname.example.*3600.IN.CNAME" dig.out.ns${ns}.test$n > /dev/null || ret=1
+    n=`expr $n + 1`
+    if [ $ret != 0 ]; then echo "I:failed"; fi
+    status=`expr $status + $ret`
+done

-echo "I:prime redirect response (+nodnssec) ($n)"
+echo "I:prime redirect response (+nodnssec) (synth-from-dnssec <default>;) ($n)"
 ret=0
 $DIG $DIGOPTS +nodnssec a.redirect. @10.53.0.3 a > dig.out.ns2.test$n || ret=1
 grep "flags:[^;]* ad[ ;]" dig.out.ns2.test$n > /dev/null && ret=1
@@ -69,54 +78,88 @@ n=`expr $n + 1`
 if [ $ret != 0 ]; then echo "I:failed"; fi
 status=`expr $status + $ret`

+#
+# ensure TTL of synthesised answers differs from direct answers.
+#
 sleep 1

-$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 dumpdb
+for ns in 2 4 5
+do
+    case $ns in
+    2) synth=yes description="<default>";;
+    4) synth=no  description="no";;
+    5) synth=yes description="yes";;
+    *) exit 1;;
+    esac
+    echo "I:check synthesized NXDOMAIN response (synth-from-dnssec ${description};) ($n)"
+    ret=0
+    $DIG $DIGOPTS b.example. @10.53.0.${ns} a > dig.out.ns${ns}.test$n || ret=1
+    grep "flags:[^;]* ad[ ;]" dig.out.ns${ns}.test$n > /dev/null || ret=1
+    grep "status: NXDOMAIN," dig.out.ns${ns}.test$n > /dev/null || ret=1
+    if [ ${synth} = yes ]
+    then
+	grep "example.*IN.SOA" dig.out.ns${ns}.test$n > /dev/null || ret=1
+	grep "example.*3600.IN.SOA" dig.out.ns${ns}.test$n > /dev/null && ret=1
+    else
+	grep "example.*3600.IN.SOA" dig.out.ns${ns}.test$n > /dev/null || ret=1
+    fi
+    $PERL ../digcomp.pl $nxdomain dig.out.ns${ns}.test$n || ret=1
+    n=`expr $n + 1`
+    if [ $ret != 0 ]; then echo "I:failed"; fi
+    status=`expr $status + $ret`

-echo "I:check synthesized NXDOMAIN response ($n)"
-ret=0
-$DIG $DIGOPTS b.example. @10.53.0.2 a > dig.out.ns2.test$n || ret=1
-grep "flags:[^;]* ad[ ;]" dig.out.ns2.test$n > /dev/null || ret=1
-grep "status: NXDOMAIN," dig.out.ns2.test$n > /dev/null || ret=1
-grep "example.*3600.IN.SOA" dig.out.ns2.test$n > /dev/null && ret=1
-$PERL ../digcomp.pl $nxdomain dig.out.ns2.test$n || ret=1
-n=`expr $n + 1`
-if [ $ret != 0 ]; then echo "I:failed"; fi
-status=`expr $status + $ret`
+    echo "I:check synthesized NODATA response (synth-from-dnssec ${description};) ($n)"
+    ret=0
+    $DIG $DIGOPTS nodata.example. @10.53.0.${ns} aaaa > dig.out.ns${ns}.test$n || ret=1
+    grep "flags:[^;]* ad[ ;]" dig.out.ns${ns}.test$n > /dev/null || ret=1
+    grep "status: NOERROR," dig.out.ns${ns}.test$n > /dev/null || ret=1
+    if [ ${synth} = yes ]
+    then
+	grep "example.*IN.SOA" dig.out.ns${ns}.test$n > /dev/null || ret=1
+	grep "example.*3600.IN.SOA" dig.out.ns${ns}.test$n > /dev/null && ret=1
+    else
+	grep "example.*3600.IN.SOA" dig.out.ns${ns}.test$n > /dev/null || ret=1
+    fi
+    $PERL ../digcomp.pl $nodata dig.out.ns${ns}.test$n || ret=1
+    n=`expr $n + 1`
+    if [ $ret != 0 ]; then echo "I:failed"; fi
+    status=`expr $status + $ret`

-echo "I:check synthesized NODATA response ($n)"
-ret=0
-$DIG $DIGOPTS nodata.example. @10.53.0.2 aaaa > dig.out.ns2.test$n || ret=1
-grep "flags:[^;]* ad[ ;]" dig.out.ns2.test$n > /dev/null || ret=1
-grep "status: NOERROR," dig.out.ns2.test$n > /dev/null || ret=1
-grep "example.*3600.IN.SOA" dig.out.ns2.test$n > /dev/null && ret=1
-$PERL ../digcomp.pl $nodata dig.out.ns2.test$n || ret=1
-n=`expr $n + 1`
-if [ $ret != 0 ]; then echo "I:failed"; fi
-status=`expr $status + $ret`
+    echo "I:check synthesized wildcard response (synth-from-dnssec ${description};) ($n)"
+    ret=0
+    $DIG $DIGOPTS b.wild-a.example. @10.53.0.${ns} a > dig.out.ns${ns}.test$n || ret=1
+    grep "flags:[^;]* ad[ ;]" dig.out.ns${ns}.test$n > /dev/null || ret=1
+    grep "status: NOERROR," dig.out.ns${ns}.test$n > /dev/null || ret=1
+    if [ ${synth} = yes ]
+    then
+	    grep "b\.wild-a\.example\..*IN.A" dig.out.ns${ns}.test$n > /dev/null || ret=1
+	    grep "b\.wild-a\.example\..*3600.IN.A" dig.out.ns${ns}.test$n > /dev/null && ret=1
+    else
+	    grep "b\.wild-a\.example\..*3600.IN.A" dig.out.ns${ns}.test$n > /dev/null || ret=1
+    fi
+    n=`expr $n + 1`
+    if [ $ret != 0 ]; then echo "I:failed"; fi
+    status=`expr $status + $ret`

-echo "I:check synthesized wildcard response ($n)"
-ret=0
-$DIG $DIGOPTS b.wild-a.example. @10.53.0.2 a > dig.out.ns2.test$n || ret=1
-grep "flags:[^;]* ad[ ;]" dig.out.ns2.test$n > /dev/null || ret=1
-grep "status: NOERROR," dig.out.ns2.test$n > /dev/null || ret=1
-grep "b\.wild-a\.example\..*3600.IN.A" dig.out.ns2.test$n > /dev/null && ret=1
-n=`expr $n + 1`
-if [ $ret != 0 ]; then echo "I:failed"; fi
-status=`expr $status + $ret`
+    echo "I:check synthesized wildcard CNAME response (synth-from-dnssec ${description};) ($n)"
+    ret=0
+    $DIG $DIGOPTS b.wild-cname.example. @10.53.0.${ns} a > dig.out.ns${ns}.test$n || ret=1
+    grep "flags:[^;]* ad[ ;]" dig.out.ns${ns}.test$n > /dev/null || ret=1
+    grep "status: NOERROR," dig.out.ns${ns}.test$n > /dev/null || ret=1
+    if [ ${synth} = yes ]
+    then
+	grep "b.wild-cname.example.*IN.CNAME" dig.out.ns${ns}.test$n > /dev/null || ret=1
+	grep "b.wild-cname.example.*3600.IN.CNAME" dig.out.ns${ns}.test$n > /dev/null && ret=1
+    else
+	grep "b.wild-cname.example.*3600.IN.CNAME" dig.out.ns${ns}.test$n > /dev/null || ret=1
+    fi
+    grep "ns1.example.*.IN.A" dig.out.ns${ns}.test$n > /dev/null || ret=1
+    n=`expr $n + 1`
+    if [ $ret != 0 ]; then echo "I:failed"; fi
+    status=`expr $status + $ret`
+done

-echo "I:check synthesized wildcard CNAME response ($n)"
-ret=0
-$DIG $DIGOPTS b.wild-cname.example. @10.53.0.2 a > dig.out.ns2.test$n || ret=1
-grep "flags:[^;]* ad[ ;]" dig.out.ns2.test$n > /dev/null || ret=1
-grep "status: NOERROR," dig.out.ns2.test$n > /dev/null || ret=1
-grep "b.wild-cname.example.*3600.IN.CNAME" dig.out.ns2.test$n > /dev/null && ret=1
-grep "ns1.example.*.IN.A" dig.out.ns2.test$n > /dev/null || ret=1
-n=`expr $n + 1`
-if [ $ret != 0 ]; then echo "I:failed"; fi
-status=`expr $status + $ret`
-
-echo "I:check redirect response (+dnssec) ($n)"
+echo "I:check redirect response (+dnssec) (synth-from-dnssec <default>;) ($n)"
 ret=0
 $DIG $DIGOPTS b.redirect. @10.53.0.3 a > dig.out.ns2.test$n || ret=1
 grep "flags:[^;]* ad[ ;]" dig.out.ns2.test$n > /dev/null || ret=1
@@ -126,7 +169,7 @@ n=`expr $n + 1`
 if [ $ret != 0 ]; then echo "I:failed"; fi
 status=`expr $status + $ret`

-echo "I:check redirect response (+nodnssec) ($n)"
+echo "I:check redirect response (+nodnssec) (synth-from-dnssec <default>;) ($n)"
 ret=0
 $DIG $DIGOPTS +nodnssec b.redirect. @10.53.0.3 a > dig.out.ns2.test$n || ret=1
 grep "flags:[^;]* ad[ ;]" dig.out.ns2.test$n > /dev/null && ret=1
@@ -141,10 +141,6 @@ int sigwait(const unsigned int *set, int *sig);
 /* Use AES for Client Cookie generation */
 #undef AES_CC

-/* Define to enable the "filter-aaaa-on-v4" and "filter-aaaa-on-v6" options.
-   */
-#undef ALLOW_FILTER_AAAA
-
 /* define if ATF unit tests are to be built. */
 #undef ATF_TEST

@@ -306,10 +306,6 @@ typedef __int64 off_t;
 /* Define to the sockaddr length type used by getnameinfo(3). */
 #define IRS_GETNAMEINFO_SOCKLEN_T socklen_t

-/* Define to enable the "filter-aaaa-on-v4" and "filter-aaaa-on-v6" options.
-   */
-@ALLOW_FILTER_AAAA@
-
 /* Define to enable "rrset-order fixed" syntax. */
@DNS_RDATASET_FIXED@

@@ -940,6 +940,7 @@ infodir
 docdir
 oldincludedir
 includedir
+runstatedir
 localstatedir
 sharedstatedir
 sysconfdir
@@ -1033,7 +1034,6 @@ enable_dnsrps_dl
 with_dnsrps_libname
 with_dnsrps_dir
 enable_dnsrps
-enable_filter_aaaa
 enable_dnstap
 with_protobuf_c
 with_libfstrm
@@ -1103,6 +1103,7 @@ datadir='${datarootdir}'
 sysconfdir='${prefix}/etc'
 sharedstatedir='${prefix}/com'
 localstatedir='${prefix}/var'
+runstatedir='${localstatedir}/run'
 includedir='${prefix}/include'
 oldincludedir='/usr/include'
 docdir='${datarootdir}/doc/${PACKAGE_TARNAME}'
@@ -1355,6 +1356,15 @@ do
  | -silent | --silent | --silen | --sile | --sil)
    silent=yes ;;

+  -runstatedir | --runstatedir | --runstatedi | --runstated \
+  | --runstate | --runstat | --runsta | --runst | --runs \
+  | --run | --ru | --r)
+    ac_prev=runstatedir ;;
+  -runstatedir=* | --runstatedir=* | --runstatedi=* | --runstated=* \
+  | --runstate=* | --runstat=* | --runsta=* | --runst=* | --runs=* \
+  | --run=* | --ru=* | --r=*)
+    runstatedir=$ac_optarg ;;
+
  -sbindir | --sbindir | --sbindi | --sbind | --sbin | --sbi | --sb)
    ac_prev=sbindir ;;
  -sbindir=* | --sbindir=* | --sbindi=* | --sbind=* | --sbin=* \
@@ -1492,7 +1502,7 @@ fi
 for ac_var in	exec_prefix prefix bindir sbindir libexecdir datarootdir \
 		datadir sysconfdir sharedstatedir localstatedir includedir \
 		oldincludedir docdir infodir htmldir dvidir pdfdir psdir \
-		libdir localedir mandir
+		libdir localedir mandir runstatedir
 do
  eval ac_val=\$$ac_var
  # Remove trailing slashes.
@@ -1645,6 +1655,7 @@ Fine tuning of the installation directories:
  --sysconfdir=DIR        read-only single-machine data [PREFIX/etc]
  --sharedstatedir=DIR    modifiable architecture-independent data [PREFIX/com]
  --localstatedir=DIR     modifiable single-machine data [PREFIX/var]
+  --runstatedir=DIR       modifiable per-process data [LOCALSTATEDIR/run]
  --libdir=DIR            object code libraries [EPREFIX/lib]
  --includedir=DIR        C header files [PREFIX/include]
  --oldincludedir=DIR     C header files for non-gcc [/usr/include]
@@ -1719,7 +1730,6 @@ Optional Features:
  --disable-rpz-nsdname	  disable rpz nsdname rules [default=enabled]
  --enable-dnsrps-dl	  DNS Response Policy Service delayed link [default=$librpz_dl]
  --enable-dnsrps         enable DNS Response Policy Service API
-  --enable-filter-aaaa    enable filtering of AAAA records [default=no]
  --enable-dnstap         enable dnstap support (requires fstrm, protobuf-c)
  --enable-querytrace     enable very verbose query trace logging [default=no]
  --enable-full-report	  report values of all configure options
@@ -11470,7 +11480,6 @@ yes)
 	test "${enable_fixed_rrset+set}" = set || enable_fixed_rrset=yes
 	test "${enable_querytrace+set}" = set || enable_querytrace=yes
 	test "${with_atf+set}" = set || with_atf=yes
-	test "${enable_filter_aaaa+set}" = set || enable_filter_aaaa=yes
 	test "${with_dlz_filesystem+set}" = set || with_dlz_filesystem=yes
 	test "${enable_symtable+set}" = set || enable_symtable=all
 	test "${enable_warn_error+set}" = set || enable_warn_error=yes
@@ -20944,28 +20953,6 @@ $as_echo "#define USE_DNSRPS 1" >>confdefs.h

 fi

-#
-# Activate "filter-aaaa-on-v4/v6" or not?
-#
-# Check whether --enable-filter-aaaa was given.
-if test "${enable_filter_aaaa+set}" = set; then :
-  enableval=$enable_filter_aaaa; enable_filter="$enableval"
-else
-  enable_filter="no"
-fi
-
-case "$enable_filter" in
-	yes)
-
-$as_echo "#define ALLOW_FILTER_AAAA 1" >>confdefs.h
-
-		;;
-	no)
-		;;
-	*)
-		;;
-esac
-
 #
 # Activate dnstap?
 #
@@ -26238,8 +26225,6 @@ report() {
        echo "    DNS Response Policy Service interface (--enable-dnsrps)"
    test "yes" = "$enable_fixed" && \
        echo "    Allow 'fixed' rrset-order (--enable-fixed-rrset)"
-    test "yes" = "$enable_filter" && \
-        echo "    AAAA filtering (--enable-filter-aaaa)"
    test "yes" = "$enable_seccomp" && \
        echo "    Use libseccomp system call filtering (--enable-seccomp)"
    test "yes" = "$want_backtrace" && \
@@ -66,7 +66,6 @@ yes)
 	test "${enable_fixed_rrset+set}" = set || enable_fixed_rrset=yes
 	test "${enable_querytrace+set}" = set || enable_querytrace=yes
 	test "${with_atf+set}" = set || with_atf=yes
-	test "${enable_filter_aaaa+set}" = set || enable_filter_aaaa=yes
 	test "${with_dlz_filesystem+set}" = set || with_dlz_filesystem=yes
 	test "${enable_symtable+set}" = set || enable_symtable=all
 	test "${enable_warn_error+set}" = set || enable_warn_error=yes
@@ -4413,24 +4412,6 @@ if test "x$enable_dnsrps" != "xno"; then
 	AC_DEFINE([USE_DNSRPS], [1], [Enable DNS Response Policy Service API])
 fi

-#
-# Activate "filter-aaaa-on-v4/v6" or not?
-#
-AC_ARG_ENABLE(filter-aaaa,
-	[  --enable-filter-aaaa    enable filtering of AAAA records [[default=no]]],
-			enable_filter="$enableval",
-			enable_filter="no")
-case "$enable_filter" in
-	yes)
-		AC_DEFINE(ALLOW_FILTER_AAAA, 1,
-			  [Define to enable the "filter-aaaa-on-v4" and "filter-aaaa-on-v6" options.])
-		;;
-	no)
-		;;
-	*)
-		;;
-esac
-
 #
 # Activate dnstap?
 #
@@ -5481,8 +5462,6 @@ report() {
        echo "    DNS Response Policy Service interface (--enable-dnsrps)"
    test "yes" = "$enable_fixed" && \
        echo "    Allow 'fixed' rrset-order (--enable-fixed-rrset)"
-    test "yes" = "$enable_filter" && \
-        echo "    AAAA filtering (--enable-filter-aaaa)"
    test "yes" = "$enable_seccomp" && \
        echo "    Use libseccomp system call filtering (--enable-seccomp)"
    test "yes" = "$want_backtrace" && \
@@ -1171,7 +1171,7 @@ zone "eng.example.com" {
 		  "<userinput>hmac-sha256</userinput>",
 		  "<userinput>hmac-sha384</userinput>"
 		  and "<userinput>hmac-sha512</userinput>"
-		  have any meaning.  The secret is a base-64 encoded string
+		  have any meaning.  The secret is a Base64 encoded string
 		  as specified in RFC 3548.
 		</para>

@@ -3552,7 +3552,7 @@ $ORIGIN 0.0.0.0.0.0.0.0.8.b.d.0.1.0.0.2.ip6.arpa.
 	  number of required bits preceded by a dash, e.g.
 	  <literal>hmac-sha1-80</literal>.  The
 	  <replaceable>secret_string</replaceable> is the secret
-	  to be used by the algorithm, and is treated as a base-64
+	  to be used by the algorithm, and is treated as a Base64
 	  encoded string.
 	</para>

@@ -3815,17 +3815,17 @@ notrace</command>. All debugging messages in the server have a debug
 	    <command>print-time</command> can be set to
 	    <userinput>yes</userinput>, <userinput>no</userinput>,
 	    or a time format specifier, which may be one of
-	    <option>local</option>, <option>iso8601</option> or
-	    <option>iso8601-utc</option>.  If set to
+	    <userinput>local</userinput>, <userinput>iso8601</userinput> or
+	    <userinput>iso8601-utc</userinput>.  If set to
 	    <userinput>no</userinput>, then the date and time will
 	    not be logged.  If set to <userinput>yes</userinput>
-	    or <option>local</option>, the date and time are logged
+	    or <userinput>local</userinput>, the date and time are logged
 	    in a human readable format, using the local time zone.
-	    If set to <option>iso8601</option> the local time is
+	    If set to <userinput>iso8601</userinput> the local time is
 	    logged in ISO8601 format.  If set to
-	    <option>iso8601-utc</option>, then the date and time
+	    <userinput>iso8601-utc</userinput>, then the date and time
 	    are logged in ISO8601 format, with time zone set to
-	    UTC. The default is <option>local</option>.
+	    UTC. The default is <userinput>local</userinput>.
 	  </para>
 	  <para>
 	    <command>print-time</command> may
@@ -4987,7 +4987,10 @@ badresp:1,adberr:0,findfail:0,valfail:0]
 	      <para>
 		Specifies the directory in which to store the configuration
 		parameters for zones added via <command>rndc addzone</command>.
-		By default, this is the working directory.
+		By default, this is the working directory. If set to a relative
+		path, it will be relative to the working directory. The
+		directory <emphasis>must</emphasis> be writable by the
+		effective user ID of the <command>named</command> process.
 	      </para>
 	    </listitem>
 	  </varlistentry>
@@ -5710,12 +5713,14 @@ options {
 	    <listitem>
 	      <para>
 		Specifies the TTL to be returned on stale answers.
-		The default is 1 second. The minimal allowed is
+		The default is 1 second. The minimum allowed is
 		also 1 second; a value of 0 will be updated silently
-		to 1 second.  For stale answers to be returned
+		to 1 second.  For stale answers to be returned,
+		they must be enabled (either in the configuration file
+		using <command>stale-answer-enable</command> or via
+		<command>rndc</command>), and
 		<option>max-stale-ttl</option> must be set to a
-		non zero value and they must not have been disabled
-		by <command>rndc</command>.
+		nonzero value.
 	      </para>
 	    </listitem>
 	  </varlistentry>
@@ -6448,17 +6453,21 @@ options {
 	    </varlistentry>

 	    <varlistentry>
-	      <term><command>serve-stale-enable</command></term>
+	      <term><command>stale-answer-enable</command></term>
 	      <listitem>
 		<para>
 		  Enable the returning of stale answers when the
 		  nameservers for the zone are not answering.  This
-		  is off by default but can be enabled/disabled via
-		  <command>rndc server-stale on</command> and
-		  <command>rndc server-stale off</command> which
-		  override the named.conf setting.  <command>rndc
-		  server-stale reset</command> will restore control
-		  via named.conf.
+		  is off by default, but can be enabled/disabled via
+		  <command>rndc serve-stale on</command> and
+		  <command>rndc serve-stale off</command>, which
+		  override the <filename>named.conf</filename>
+		  setting.  <command>rndc serve-stale reset</command>
+		  restores the setting to the one specified in
+		  <filename>named.conf</filename>.  Note that
+		  reloading or reconfiguring <command>named</command>
+		  will not re-enable serving of stale records if they
+		  have been disabled via <command>rndc</command>.
 		</para>
 	      </listitem>
 	    </varlistentry>
@@ -6707,10 +6716,7 @@ options {
 	      <term><command>filter-aaaa-on-v4</command></term>
 	      <listitem>
 		<para>
-		  This option is only available when
-		  <acronym>BIND</acronym> 9 is compiled with the
-		  <userinput>--enable-filter-aaaa</userinput> option on the
-		  "configure" command line.  It is intended to help the
+		  This option is intended to help the
 		  transition from IPv4 to IPv6 by not giving IPv6 addresses
 		  to DNS clients unless they have connections to the IPv6
 		  Internet.  This is not recommended unless absolutely
@@ -8824,7 +8830,7 @@ avoid-v6-udp-ports { 40000; range 50000 60000; };
 		  server waits on an idle TCP connection before closing
 		  it when the client is using the EDNS TCP keepalive
 		  option.  The default is 300 (30 seconds), the maximum
-		  is 1200 (two minutes), and the minimum is 1 (one tenth
+		  is 65535 (about 1.8 hours), and the minimum is 1 (one tenth
 		  of a second). Values above the maximum or below the minimum
 		  will be adjusted with a logged warning.
 		  This value may be greater than
@@ -8846,7 +8852,7 @@ avoid-v6-udp-ports { 40000; range 50000 60000; };
 		  keepalive option. This informs a client of the
 		  amount of time it may keep the session open.
 		  The default is 300 (30 seconds), the maximum is
-		  1200 (two minutes), and the minimum is 0, which
+		  65535 (about 1.8 hours), and the minimum is 0, which
 		  signals that the clients must close TCP connections
 		  immediately.  Ordinarily this should be set to the
 		  same value as <command>tcp-keepalive-timeout</command>.
@@ -11356,7 +11362,7 @@ example.com                 CNAME   rpz-tcp-only.
 	  <para>
 	    The <command>trusted-keys</command> statement can contain
 	    multiple key entries, each consisting of the key's
-	    domain name, flags, protocol, algorithm, and the Base-64
+	    domain name, flags, protocol, algorithm, and the Base64
 	    representation of the key data.
 	    Spaces, tabs, newlines and carriage returns are ignored
 	    in the key data, so the configuration may be split up into
@@ -12503,6 +12509,23 @@ view "external" {
 		</listitem>
 	      </varlistentry>

+	      <varlistentry>
+		<term><command>file</command></term>
+		<listitem>
+		  <para>
+		    Set the zone's filename. In <command>master</command>,
+		    <command>hint</command>, and <command>redirect</command>
+		    zones which do not have <command>masters</command>
+		    defined, zone data is loaded from this file. In
+		    <command>slave</command>, <command>stub</command>, and
+		    <command>redirect</command> zones which do have
+		    <command>masters</command> defined, zone data is
+		    retrieved from another server and saved in this file.
+		    This option is not applicable to other zone types.
+		  </para>
+		</listitem>
+	      </varlistentry>
+
 	      <varlistentry>
 		<term><command>forward</command></term>
 		<listitem>
@@ -603,7 +603,7 @@ zone "eng.example.com" {
                  "<strong class="userinput"><code>hmac-sha256</code></strong>",
                  "<strong class="userinput"><code>hmac-sha384</code></strong>"
                  and "<strong class="userinput"><code>hmac-sha512</code></strong>"
-                  have any meaning.  The secret is a base-64 encoded string
+                  have any meaning.  The secret is a Base64 encoded string
                  as specified in RFC 3548.
                </p>

@@ -1232,7 +1232,7 @@
          number of required bits preceded by a dash, e.g.
          <code class="literal">hmac-sha1-80</code>.  The
          <em class="replaceable"><code>secret_string</code></em> is the secret
-          to be used by the algorithm, and is treated as a base-64
+          to be used by the algorithm, and is treated as a Base64
          encoded string.
        </p>

@@ -1501,17 +1501,17 @@ notrace</strong></span>. All debugging messages in the server have a debug
            <span class="command"><strong>print-time</strong></span> can be set to
            <strong class="userinput"><code>yes</code></strong>, <strong class="userinput"><code>no</code></strong>,
            or a time format specifier, which may be one of
-            <code class="option">local</code>, <code class="option">iso8601</code> or
-            <code class="option">iso8601-utc</code>.  If set to
+            <strong class="userinput"><code>local</code></strong>, <strong class="userinput"><code>iso8601</code></strong> or
+            <strong class="userinput"><code>iso8601-utc</code></strong>.  If set to
            <strong class="userinput"><code>no</code></strong>, then the date and time will
            not be logged.  If set to <strong class="userinput"><code>yes</code></strong>
-            or <code class="option">local</code>, the date and time are logged
+            or <strong class="userinput"><code>local</code></strong>, the date and time are logged
            in a human readable format, using the local time zone.
-            If set to <code class="option">iso8601</code> the local time is
+            If set to <strong class="userinput"><code>iso8601</code></strong> the local time is
            logged in ISO8601 format.  If set to
-            <code class="option">iso8601-utc</code>, then the date and time
+            <strong class="userinput"><code>iso8601-utc</code></strong>, then the date and time
            are logged in ISO8601 format, with time zone set to
-            UTC. The default is <code class="option">local</code>.
+            UTC. The default is <strong class="userinput"><code>local</code></strong>.
          </p>
          <p>
            <span class="command"><strong>print-time</strong></span> may
@@ -3045,7 +3045,8 @@ badresp:1,adberr:0,findfail:0,valfail:0]
              <p>
                Specifies the directory in which to store the configuration
                parameters for zones added via <span class="command"><strong>rndc addzone</strong></span>.
-                By default, this is the working directory.
+                By default, this is the working directory. If set to a relative
+                path, it will be relative to the working directory.
              </p>
            </dd>
 <dt><span class="term"><span class="command"><strong>named-xfer</strong></span></span></dt>
@@ -3671,12 +3672,14 @@ options {
 <dd>
              <p>
                Specifies the TTL to be returned on stale answers.
-                The default is 1 second. The minimal allowed is
+                The default is 1 second. The minimum allowed is
                also 1 second; a value of 0 will be updated silently
-                to 1 second.  For stale answers to be returned
+                to 1 second.  For stale answers to be returned,
+                they must be enabled (either in the configuration file
+                using <span class="command"><strong>stale-answer-enable</strong></span> or via
+                <span class="command"><strong>rndc</strong></span>), and
                <code class="option">max-stale-ttl</code> must be set to a
-                non zero value and they must not have been disabled
-                by <span class="command"><strong>rndc</strong></span>.
+                nonzero value.
              </p>
            </dd>
 <dt><span class="term"><span class="command"><strong>serial-update-method</strong></span></span></dt>
@@ -4330,17 +4333,21 @@ options {
                  <span class="command"><strong>nocookie-udp-size</strong></span> option.
                </p>
              </dd>
-<dt><span class="term"><span class="command"><strong>serve-stale-enable</strong></span></span></dt>
+<dt><span class="term"><span class="command"><strong>stale-answer-enable</strong></span></span></dt>
 <dd>
                <p>
                  Enable the returning of stale answers when the
                  nameservers for the zone are not answering.  This
-                  is off by default but can be enabled/disabled via
-                  <span class="command"><strong>rndc server-stale on</strong></span> and
-                  <span class="command"><strong>rndc server-stale off</strong></span> which
-                  override the named.conf setting.  <span class="command"><strong>rndc
-                  server-stale reset</strong></span> will restore control
-                  via named.conf.
+                  is off by default, but can be enabled/disabled via
+                  <span class="command"><strong>rndc serve-stale on</strong></span> and
+                  <span class="command"><strong>rndc serve-stale off</strong></span>, which
+                  override the <code class="filename">named.conf</code>
+                  setting.  <span class="command"><strong>rndc serve-stale reset</strong></span>
+                  restores the setting to the one specified in
+                  <code class="filename">named.conf</code>.  Note that
+                  reloading or reconfiguring <span class="command"><strong>named</strong></span>
+                  will not re-enable serving of stale records if they
+                  have been disabled via <span class="command"><strong>rndc</strong></span>.
                </p>
              </dd>
 <dt><span class="term"><span class="command"><strong>nocookie-udp-size</strong></span></span></dt>
@@ -8884,7 +8891,7 @@ example.com                 CNAME   rpz-tcp-only.
          <p>
            The <span class="command"><strong>trusted-keys</strong></span> statement can contain
            multiple key entries, each consisting of the key's
-            domain name, flags, protocol, algorithm, and the Base-64
+            domain name, flags, protocol, algorithm, and the Base64
            representation of the key data.
            Spaces, tabs, newlines and carriage returns are ignored
            in the key data, so the configuration may be split up into
@@ -9981,6 +9988,20 @@ view "external" {
                    See caveats in <a class="xref" href="Bv9ARM.ch06.html#root_delegation_only"><span class="command"><strong>root-delegation-only</strong></span></a>.
                  </p>
                </dd>
+<dt><span class="term"><span class="command"><strong>file</strong></span></span></dt>
+<dd>
+                  <p>
+                    Set the zone's filename. In <span class="command"><strong>master</strong></span>,
+                    <span class="command"><strong>hint</strong></span>, and <span class="command"><strong>redirect</strong></span>
+                    zones which do not have <span class="command"><strong>masters</strong></span>
+                    defined, zone data is loaded from this file. In
+                    <span class="command"><strong>slave</strong></span>, <span class="command"><strong>stub</strong></span>, and
+                    <span class="command"><strong>redirect</strong></span> zones which do have
+                    <span class="command"><strong>masters</strong></span> defined, zone data is
+                    retrieved from another server and saved in this file.
+                    This option is not applicable to other zone types.
+                  </p>
+                </dd>
 <dt><span class="term"><span class="command"><strong>forward</strong></span></span></dt>
 <dd>
                  <p>
@@ -41,9 +41,10 @@
 <dt><span class="section"><a href="Bv9ARM.ch09.html#relnotes_intro">Introduction</a></span></dt>
 <dt><span class="section"><a href="Bv9ARM.ch09.html#relnotes_download">Download</a></span></dt>
 <dt><span class="section"><a href="Bv9ARM.ch09.html#relnotes_license">License Change</a></span></dt>
-<dt><span class="section"><a href="Bv9ARM.ch09.html#win_support">Windows XP No Longer Supported</a></span></dt>
+<dt><span class="section"><a href="Bv9ARM.ch09.html#win_support">Legacy Windows No Longer Supported</a></span></dt>
 <dt><span class="section"><a href="Bv9ARM.ch09.html#relnotes_security">Security Fixes</a></span></dt>
 <dt><span class="section"><a href="Bv9ARM.ch09.html#relnotes_features">New Features</a></span></dt>
+<dt><span class="section"><a href="Bv9ARM.ch09.html#relnotes_removed">Removed Features</a></span></dt>
 <dt><span class="section"><a href="Bv9ARM.ch09.html#proto_changes">Protocol Changes</a></span></dt>
 <dt><span class="section"><a href="Bv9ARM.ch09.html#relnotes_changes">Feature Changes</a></span></dt>
 <dt><span class="section"><a href="Bv9ARM.ch09.html#relnotes_bugs">Bug Fixes</a></span></dt>
@@ -96,10 +97,11 @@
      anything other than the changes you made to our software.
    </p>
    <p>
-      This requirement will not affect anyone who is using BIND
-      without redistributing it, nor anyone redistributing it without
-      changes, therefore this change will be without consequence
-      for most individuals and organizations who are using BIND.
+      This requirement will not affect anyone who is using BIND, with
+      or without modifications, without redistributing it, nor anyone
+      redistributing it without changes. Therefore, this change will be
+      without consequence for most individuals and organizations who are
+      using BIND.
    </p>
    <p>
      Those unsure whether or not the license change affects their
@@ -111,10 +113,10 @@

  <div class="section">
 <div class="titlepage"><div><div><h3 class="title">
-<a name="win_support"></a>Windows XP No Longer Supported</h3></div></div></div>
+<a name="win_support"></a>Legacy Windows No Longer Supported</h3></div></div></div>
    <p>
-      As of BIND 9.11.2, Windows XP is no longer a supported platform for
-      BIND, and Windows XP binaries are no longer available for download
+      As of BIND 9.11.2, Windows XP and Windows 2003 are no longer supported
+      platforms for BIND; "XP" binaries are no longer available for download
      from ISC.
    </p>
  </div>
@@ -143,10 +145,12 @@
 <li class="listitem">
 	    <p>
 	      The additional cache ("acache") was found not to
-	      significantly improve performance and has been removed;
-	      the <span class="command"><strong>acache-enable</strong></span> and
-	      <span class="command"><strong>acache-cleaning-interval</strong></span> options are now
-	      deprecated.
+	      significantly improve performance and has been removed.
+	      As a result, the <span class="command"><strong>acache-enable</strong></span> and
+	      <span class="command"><strong>acache-cleaning-interval</strong></span> options no longer
+	      have any effect. For backwards compatibility, BIND will
+	      accept their presence in a configuration file, but
+	      will log a warning.
 	    </p>
 	  </li>
 <li class="listitem">
@@ -159,15 +163,16 @@
 	  </li>
 <li class="listitem">
 	    <p>
-	      The <span class="command"><strong>additional-from-cache</strong></span>
-	      and <span class="command"><strong>additional-from-auth</strong></span> options have been
-	      deprecated.
+	      <span class="command"><strong>minimal-responses</strong></span> is now set
+	      to <code class="literal">no-auth-recursive</code> by default.
 	    </p>
 	  </li>
 <li class="listitem">
 	    <p>
-	      <span class="command"><strong>minimal-responses</strong></span> is now set
-	      to <code class="literal">yes</code> by default.
+	      The <span class="command"><strong>additional-from-cache</strong></span>
+	      and <span class="command"><strong>additional-from-auth</strong></span> options no longer
+	      have any effect. <span class="command"><strong>named</strong></span> will log a warning
+	      if they are set.
 	    </p>
 	  </li>
 <li class="listitem">
@@ -342,13 +347,14 @@
 	  zone's validated CDS or CDNSKEY records. It can produce a
 	  <code class="filename">dsset</code> file suitable for input to
 	  <span class="command"><strong>dnssec-signzone</strong></span>, or a series of
-	  <span class="command"><strong>nsupdate</strong></span> to update the parent zone via dynamic
-	  DNS. Thanks to Tony Finch for the contribution.  [RT #46090]
+	  <span class="command"><strong>nsupdate</strong></span> commands to update the parent zone
+	  via dynamic DNS. Thanks to Tony Finch for the contribution.
+	  [RT #46090]
 	</p>
      </li>
 <li class="listitem">
 	<p>
-	  <span class="command"><strong>nsupdate</strong></span> and <span class="command"><strong>rndc</strong></span> now accepts
+	  <span class="command"><strong>nsupdate</strong></span> and <span class="command"><strong>rndc</strong></span> now accept
 	  command line options <span class="command"><strong>-4</strong></span> and <span class="command"><strong>-6</strong></span>
 	  which force using only IPv4 or only IPv6, respectively. [RT #45632]
 	</p>
@@ -497,6 +503,58 @@

  <div class="section">
 <div class="titlepage"><div><div><h3 class="title">
+<a name="relnotes_removed"></a>Removed Features</h3></div></div></div>
+    <div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; ">
+<li class="listitem">
+	<p>
+	  The ISC DNSSEC Lookaside Validation (DLV) service has been shut
+	  down; all DLV records in the dlv.isc.org zone have been removed.
+	  References to the service have been removed from BIND documentation.
+	  Lookaside validation is no longer used by default by
+	  <span class="command"><strong>delv</strong></span>. The DLV key has been removed from
+	  <code class="filename">bind.keys</code>. Setting
+	  <span class="command"><strong>dnssec-lookaside</strong></span> to
+	  <span class="command"><strong>auto</strong></span> or to use dlv.isc.org as a trust
+	  anchor is now a fatal configuration error. [RT #46155]
+	</p>
+      </li>
+<li class="listitem">
+	<p>
+	  As noted above, the <span class="command"><strong>acache-enable</strong></span>,
+	  <span class="command"><strong>acache-cleaning-interval</strong></span>,
+	  <span class="command"><strong>additional-from-cache</strong></span> and
+	  <span class="command"><strong>additional-from-auth</strong></span> options are no longer
+	  effective and <span class="command"><strong>named</strong></span> will log a warning if
+	  they are set.
+	</p>
+      </li>
+<li class="listitem">
+	<p>
+	  The use of <span class="command"><strong>dnssec-keygen</strong></span> to generate
+	  HMAC keys for TSIG authentication has been deprecated in favor
+	  of <span class="command"><strong>tsig-keygen</strong></span>. If the algorithms HMAC-MD5,
+	  HMAC-SHA1, HMAC-SHA224, HMAC-SHA256, HMAC-SHA384, or
+	  HMAC-SHA512 are specified, <span class="command"><strong>dnssec-keygen</strong></span>
+	  will print a warning message. These algorithms will be
+	  removed from <span class="command"><strong>dnssec-keygen</strong></span> entirely in
+	  a future release. [RT #42272]
+	</p>
+      </li>
+<li class="listitem">
+	<p>
+	  The use of HMAC-MD5 for RNDC keys is no longer recommended.
+	  For compatibility, this is still the default algorithm generated
+	  by <span class="command"><strong>rndc-confgen</strong></span>, but it will print a
+	  warning message. The default algorithm in
+	  <span class="command"><strong>rndc-confgen</strong></span> will be changed to HMAC-SHA256
+	  in a future release. [RT #42272]
+	</p>
+      </li>
+</ul></div>
+  </div>
+
+  <div class="section">
+<div class="titlepage"><div><div><h3 class="title">
 <a name="proto_changes"></a>Protocol Changes</h3></div></div></div>
    <div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; ">
 <li class="listitem">
@@ -506,13 +564,17 @@
 	  these algorithms must be supported in OpenSSL;
 	  currently they are only available in the development branch
 	  of OpenSSL at
-	  <a class="link" href="https://github.com/openssl/openssl" target="_top">https://github.com/openssl/openssl</a>.
+	  <a class="link" href="https://github.com/openssl/openssl" target="_top">
+	    https://github.com/openssl/openssl</a>.
 	  [RT #44696]
 	</p>
      </li>
 <li class="listitem">
 	<p>
-	  EDNS KEY TAG options are verified and printed.
+	  When parsing DNS messages, EDNS KEY TAG options are checked
+	  for correctness. When printing messages (for example, in
+	  <span class="command"><strong>dig</strong></span>), EDNS KEY TAG options are printed
+	  in readable format.
 	</p>
      </li>
 </ul></div>
@@ -530,7 +592,7 @@
 	  Lookaside validation is no longer used by default by
 	  <span class="command"><strong>delv</strong></span>. The DLV key has been removed from
 	  <code class="filename">bind.keys</code>. Setting
-	  <span class="command"><strong>dnssec-lookaside</strong></span> set to
+	  <span class="command"><strong>dnssec-lookaside</strong></span> to
 	  <span class="command"><strong>auto</strong></span> or to use dlv.isc.org as a trust
 	  anchor is now a fatal configuration error. [RT #46155]
 	</p>
@@ -651,15 +713,6 @@
 	  are now fully rolled back in the event of failure. [RT #45841]
 	</p>
      </li>
-<li class="listitem">
-	<p>
-	  Fixed a bug that was introduced in an earlier development
-	  release which caused multi-packet AXFR and IXFR messages to fail
-	  validation if not all packets contained TSIG records; this
-	  caused interoperability problems with some other DNS
-	  implementations. [RT #45509]
-	</p>
-      </li>
 <li class="listitem">
 	<p>
 	  Multiple <span class="command"><strong>cookie-secret</strong></span> clauses are now
@@ -686,19 +739,39 @@
 	  contribution. [RT #45689]
 	</p>
      </li>
+<li class="listitem">
+	<p>
+	  Trust anchor telemetry messages, as specified by
+	  RFC 8145, are now logged to the
+	  <span class="command"><strong>trust-anchor-telemetry</strong></span> logging
+	  catagory.
+	</p>
+      </li>
 </ul></div>
  </div>

  <div class="section">
 <div class="titlepage"><div><div><h3 class="title">
 <a name="relnotes_bugs"></a>Bug Fixes</h3></div></div></div>
-    <div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; "><li class="listitem">
+    <div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; ">
+<li class="listitem">
 	<p>
 	  The introduction of <span class="command"><strong>libns</strong></span> caused a bug
 	  in which TCP client objects were not recycled after use,
 	  leading to unconstrained memory growth. [RT #46029]
 	</p>
-      </li></ul></div>
+      </li>
+<li class="listitem">
+	<p>
+	  Some header files included &lt;isc/util.h&gt; incorrectly as
+	  it pollutes with namespace with non ISC_ macros and this should
+	  only be done by explicitly including &lt;isc/util.h&gt;.  This
+	  has been corrected.  Some code may depend on &lt;isc/util.h&gt;
+	  being implicitly included via other header files.  Such
+	  code should explicitly include &lt;isc/util.h&gt;.
+	</p>
+      </li>
+</ul></div>
  </div>

  <div class="section">
@@ -241,9 +241,10 @@
 <dt><span class="section"><a href="Bv9ARM.ch09.html#relnotes_intro">Introduction</a></span></dt>
 <dt><span class="section"><a href="Bv9ARM.ch09.html#relnotes_download">Download</a></span></dt>
 <dt><span class="section"><a href="Bv9ARM.ch09.html#relnotes_license">License Change</a></span></dt>
-<dt><span class="section"><a href="Bv9ARM.ch09.html#win_support">Windows XP No Longer Supported</a></span></dt>
+<dt><span class="section"><a href="Bv9ARM.ch09.html#win_support">Legacy Windows No Longer Supported</a></span></dt>
 <dt><span class="section"><a href="Bv9ARM.ch09.html#relnotes_security">Security Fixes</a></span></dt>
 <dt><span class="section"><a href="Bv9ARM.ch09.html#relnotes_features">New Features</a></span></dt>
+<dt><span class="section"><a href="Bv9ARM.ch09.html#relnotes_removed">Removed Features</a></span></dt>
 <dt><span class="section"><a href="Bv9ARM.ch09.html#proto_changes">Protocol Changes</a></span></dt>
 <dt><span class="section"><a href="Bv9ARM.ch09.html#relnotes_changes">Feature Changes</a></span></dt>
 <dt><span class="section"><a href="Bv9ARM.ch09.html#relnotes_bugs">Bug Fixes</a></span></dt>
@@ -121,12 +121,19 @@
 	    of <code class="option">algorithm</code> must be one of RSAMD5, RSASHA1,
 	    DSA, NSEC3RSASHA1, NSEC3DSA, RSASHA256, RSASHA512, ECCGOST,
 	    ECDSAP256SHA256, ECDSAP384SHA384, ED25519 or ED448.  For
-            TSIG/TKEY keys, the value must be one of DH (Diffie Hellman),
-            HMAC-MD5, HMAC-SHA1, HMAC-SHA224, HMAC-SHA256, HMAC-SHA384,
-            or HMAC-SHA512; specifying any of these algorithms will
-            automatically set the <code class="option">-T KEY</code> option as well.
-            (Note: <span class="command"><strong>tsig-keygen</strong></span> produces TSIG keys in a
-            more useful format than <span class="command"><strong>dnssec-keygen</strong></span>.)
+	    TKEY and SIG(0) keys, the value must be DH (Diffie Hellman);
+	    specifying this value will automatically set the
+	    <code class="option">-T KEY</code> option as well.
+	  </p>
+	  <p>
+	    TSIG keys can also by generated by setting the value to
+	    one of HMAC-MD5, HMAC-SHA1, HMAC-SHA224, HMAC-SHA256,
+	    HMAC-SHA384, or HMAC-SHA512.  As with DH, specifying these
+	    values will automatically set <code class="option">-T KEY</code>. Note,
+	    however, that <span class="command"><strong>tsig-keygen</strong></span> produces TSIG keys
+	    in a more useful format. These algorithms have been deprecated
+	    in <span class="command"><strong>dnssec-keygen</strong></span>, and will be removed in a
+	    future release.
 	  </p>
 	  <p>
 	    These values are case insensitive. In some cases, abbreviations
@@ -137,8 +144,8 @@
 	  </p>
 	  <p>
 	    As of BIND 9.12.0, this option is mandatory except when using
-	    the <code class="option">-S</code> option (which copies the algorithm from
-	    the predecessor key).  Previously, the default for newly
+	    the <code class="option">-S</code> option, which copies the algorithm from
+	    the predecessor key.  Previously, the default for newly
 	    generated keys was RSASHA1.
 	  </p>
 	</dd>
@@ -537,6 +537,22 @@
                  zone, regardless of any other metadata.
                </p>
 	      </dd>
+<dt></dt>
+<dd>
+                <p>
+                  If key's sync publication date is set and in the past,
+		  synchronization records (type CDS and/or CDNSKEY) are
+		  created.
+                </p>
+	      </dd>
+<dt></dt>
+<dd>
+                <p>
+                  If key's sync deletion date is set and in the past,
+		  synchronization records (type CDS and/or CDNSKEY) are
+		  removed.
+                </p>
+	      </dd>
 </dl></div>
        </dd>
 <dt><span class="term">-T <em class="replaceable"><code>ttl</code></em></span></dt>
@@ -131,8 +131,12 @@
          <p>
            Specifies the algorithm to use for the TSIG key.  Available
            choices are: hmac-md5, hmac-sha1, hmac-sha224, hmac-sha256,
-            hmac-sha384 and hmac-sha512.  The default is hmac-md5 or
-            if MD5 was disabled hmac-sha256.
+            hmac-sha384 and hmac-sha512.  The default is hmac-md5, or
+            if MD5 was disabled at compile time, hmac-sha256.
+          </p>
+          <p>
+            Note: Use of hmac-md5 is no longer recommended, and the default
+            value will be changed to hmac-sha256 in a future release.
          </p>
        </dd>
 <dt><span class="term">-b <em class="replaceable"><code>keysize</code></em></span></dt>
@@ -57,10 +57,11 @@
      anything other than the changes you made to our software.
    </p>
    <p>
-      This requirement will not affect anyone who is using BIND
-      without redistributing it, nor anyone redistributing it without
-      changes, therefore this change will be without consequence
-      for most individuals and organizations who are using BIND.
+      This requirement will not affect anyone who is using BIND, with
+      or without modifications, without redistributing it, nor anyone
+      redistributing it without changes. Therefore, this change will be
+      without consequence for most individuals and organizations who are
+      using BIND.
    </p>
    <p>
      Those unsure whether or not the license change affects their
@@ -72,10 +73,10 @@

  <div class="section">
 <div class="titlepage"><div><div><h3 class="title">
-<a name="win_support"></a>Windows XP No Longer Supported</h3></div></div></div>
+<a name="win_support"></a>Legacy Windows No Longer Supported</h3></div></div></div>
    <p>
-      As of BIND 9.11.2, Windows XP is no longer a supported platform for
-      BIND, and Windows XP binaries are no longer available for download
+      As of BIND 9.11.2, Windows XP and Windows 2003 are no longer supported
+      platforms for BIND; "XP" binaries are no longer available for download
      from ISC.
    </p>
  </div>
@@ -104,10 +105,12 @@
 <li class="listitem">
 	    <p>
 	      The additional cache ("acache") was found not to
-	      significantly improve performance and has been removed;
-	      the <span class="command"><strong>acache-enable</strong></span> and
-	      <span class="command"><strong>acache-cleaning-interval</strong></span> options are now
-	      deprecated.
+	      significantly improve performance and has been removed.
+	      As a result, the <span class="command"><strong>acache-enable</strong></span> and
+	      <span class="command"><strong>acache-cleaning-interval</strong></span> options no longer
+	      have any effect. For backwards compatibility, BIND will
+	      accept their presence in a configuration file, but
+	      will log a warning.
 	    </p>
 	  </li>
 <li class="listitem">
@@ -120,15 +123,16 @@
 	  </li>
 <li class="listitem">
 	    <p>
-	      The <span class="command"><strong>additional-from-cache</strong></span>
-	      and <span class="command"><strong>additional-from-auth</strong></span> options have been
-	      deprecated.
+	      <span class="command"><strong>minimal-responses</strong></span> is now set
+	      to <code class="literal">no-auth-recursive</code> by default.
 	    </p>
 	  </li>
 <li class="listitem">
 	    <p>
-	      <span class="command"><strong>minimal-responses</strong></span> is now set
-	      to <code class="literal">yes</code> by default.
+	      The <span class="command"><strong>additional-from-cache</strong></span>
+	      and <span class="command"><strong>additional-from-auth</strong></span> options no longer
+	      have any effect. <span class="command"><strong>named</strong></span> will log a warning
+	      if they are set.
 	    </p>
 	  </li>
 <li class="listitem">
@@ -303,13 +307,14 @@
 	  zone's validated CDS or CDNSKEY records. It can produce a
 	  <code class="filename">dsset</code> file suitable for input to
 	  <span class="command"><strong>dnssec-signzone</strong></span>, or a series of
-	  <span class="command"><strong>nsupdate</strong></span> to update the parent zone via dynamic
-	  DNS. Thanks to Tony Finch for the contribution.  [RT #46090]
+	  <span class="command"><strong>nsupdate</strong></span> commands to update the parent zone
+	  via dynamic DNS. Thanks to Tony Finch for the contribution.
+	  [RT #46090]
 	</p>
      </li>
 <li class="listitem">
 	<p>
-	  <span class="command"><strong>nsupdate</strong></span> and <span class="command"><strong>rndc</strong></span> now accepts
+	  <span class="command"><strong>nsupdate</strong></span> and <span class="command"><strong>rndc</strong></span> now accept
 	  command line options <span class="command"><strong>-4</strong></span> and <span class="command"><strong>-6</strong></span>
 	  which force using only IPv4 or only IPv6, respectively. [RT #45632]
 	</p>
@@ -458,6 +463,58 @@

  <div class="section">
 <div class="titlepage"><div><div><h3 class="title">
+<a name="relnotes_removed"></a>Removed Features</h3></div></div></div>
+    <div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; ">
+<li class="listitem">
+	<p>
+	  The ISC DNSSEC Lookaside Validation (DLV) service has been shut
+	  down; all DLV records in the dlv.isc.org zone have been removed.
+	  References to the service have been removed from BIND documentation.
+	  Lookaside validation is no longer used by default by
+	  <span class="command"><strong>delv</strong></span>. The DLV key has been removed from
+	  <code class="filename">bind.keys</code>. Setting
+	  <span class="command"><strong>dnssec-lookaside</strong></span> to
+	  <span class="command"><strong>auto</strong></span> or to use dlv.isc.org as a trust
+	  anchor is now a fatal configuration error. [RT #46155]
+	</p>
+      </li>
+<li class="listitem">
+	<p>
+	  As noted above, the <span class="command"><strong>acache-enable</strong></span>,
+	  <span class="command"><strong>acache-cleaning-interval</strong></span>,
+	  <span class="command"><strong>additional-from-cache</strong></span> and
+	  <span class="command"><strong>additional-from-auth</strong></span> options are no longer
+	  effective and <span class="command"><strong>named</strong></span> will log a warning if
+	  they are set.
+	</p>
+      </li>
+<li class="listitem">
+	<p>
+	  The use of <span class="command"><strong>dnssec-keygen</strong></span> to generate
+	  HMAC keys for TSIG authentication has been deprecated in favor
+	  of <span class="command"><strong>tsig-keygen</strong></span>. If the algorithms HMAC-MD5,
+	  HMAC-SHA1, HMAC-SHA224, HMAC-SHA256, HMAC-SHA384, or
+	  HMAC-SHA512 are specified, <span class="command"><strong>dnssec-keygen</strong></span>
+	  will print a warning message. These algorithms will be
+	  removed from <span class="command"><strong>dnssec-keygen</strong></span> entirely in
+	  a future release. [RT #42272]
+	</p>
+      </li>
+<li class="listitem">
+	<p>
+	  The use of HMAC-MD5 for RNDC keys is no longer recommended.
+	  For compatibility, this is still the default algorithm generated
+	  by <span class="command"><strong>rndc-confgen</strong></span>, but it will print a
+	  warning message. The default algorithm in
+	  <span class="command"><strong>rndc-confgen</strong></span> will be changed to HMAC-SHA256
+	  in a future release. [RT #42272]
+	</p>
+      </li>
+</ul></div>
+  </div>
+
+  <div class="section">
+<div class="titlepage"><div><div><h3 class="title">
 <a name="proto_changes"></a>Protocol Changes</h3></div></div></div>
    <div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; ">
 <li class="listitem">
@@ -467,13 +524,17 @@
 	  these algorithms must be supported in OpenSSL;
 	  currently they are only available in the development branch
 	  of OpenSSL at
-	  <a class="link" href="https://github.com/openssl/openssl" target="_top">https://github.com/openssl/openssl</a>.
+	  <a class="link" href="https://github.com/openssl/openssl" target="_top">
+	    https://github.com/openssl/openssl</a>.
 	  [RT #44696]
 	</p>
      </li>
 <li class="listitem">
 	<p>
-	  EDNS KEY TAG options are verified and printed.
+	  When parsing DNS messages, EDNS KEY TAG options are checked
+	  for correctness. When printing messages (for example, in
+	  <span class="command"><strong>dig</strong></span>), EDNS KEY TAG options are printed
+	  in readable format.
 	</p>
      </li>
 </ul></div>
@@ -491,7 +552,7 @@
 	  Lookaside validation is no longer used by default by
 	  <span class="command"><strong>delv</strong></span>. The DLV key has been removed from
 	  <code class="filename">bind.keys</code>. Setting
-	  <span class="command"><strong>dnssec-lookaside</strong></span> set to
+	  <span class="command"><strong>dnssec-lookaside</strong></span> to
 	  <span class="command"><strong>auto</strong></span> or to use dlv.isc.org as a trust
 	  anchor is now a fatal configuration error. [RT #46155]
 	</p>
@@ -612,15 +673,6 @@
 	  are now fully rolled back in the event of failure. [RT #45841]
 	</p>
      </li>
-<li class="listitem">
-	<p>
-	  Fixed a bug that was introduced in an earlier development
-	  release which caused multi-packet AXFR and IXFR messages to fail
-	  validation if not all packets contained TSIG records; this
-	  caused interoperability problems with some other DNS
-	  implementations. [RT #45509]
-	</p>
-      </li>
 <li class="listitem">
 	<p>
 	  Multiple <span class="command"><strong>cookie-secret</strong></span> clauses are now
@@ -647,19 +699,39 @@
 	  contribution. [RT #45689]
 	</p>
      </li>
+<li class="listitem">
+	<p>
+	  Trust anchor telemetry messages, as specified by
+	  RFC 8145, are now logged to the
+	  <span class="command"><strong>trust-anchor-telemetry</strong></span> logging
+	  catagory.
+	</p>
+      </li>
 </ul></div>
  </div>

  <div class="section">
 <div class="titlepage"><div><div><h3 class="title">
 <a name="relnotes_bugs"></a>Bug Fixes</h3></div></div></div>
-    <div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; "><li class="listitem">
+    <div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; ">
+<li class="listitem">
 	<p>
 	  The introduction of <span class="command"><strong>libns</strong></span> caused a bug
 	  in which TCP client objects were not recycled after use,
 	  leading to unconstrained memory growth. [RT #46029]
 	</p>
-      </li></ul></div>
+      </li>
+<li class="listitem">
+	<p>
+	  Some header files included &lt;isc/util.h&gt; incorrectly as
+	  it pollutes with namespace with non ISC_ macros and this should
+	  only be done by explicitly including &lt;isc/util.h&gt;.  This
+	  has been corrected.  Some code may depend on &lt;isc/util.h&gt;
+	  being implicitly included via other header files.  Such
+	  code should explicitly include &lt;isc/util.h&gt;.
+	</p>
+      </li>
+</ul></div>
  </div>

  <div class="section">
@@ -50,10 +50,11 @@
      anything other than the changes you made to our software.
    </para>
    <para>
-      This requirement will not affect anyone who is using BIND
-      without redistributing it, nor anyone redistributing it without
-      changes, therefore this change will be without consequence
-      for most individuals and organizations who are using BIND.
+      This requirement will not affect anyone who is using BIND, with
+      or without modifications, without redistributing it, nor anyone
+      redistributing it without changes. Therefore, this change will be
+      without consequence for most individuals and organizations who are
+      using BIND.
    </para>
    <para>
      Those unsure whether or not the license change affects their
@@ -65,10 +66,10 @@
    </para>
  </section>

-  <section xml:id="win_support"><info><title>Windows XP No Longer Supported</title></info>
+  <section xml:id="win_support"><info><title>Legacy Windows No Longer Supported</title></info>
    <para>
-      As of BIND 9.11.2, Windows XP is no longer a supported platform for
-      BIND, and Windows XP binaries are no longer available for download
+      As of BIND 9.11.2, Windows XP and Windows 2003 are no longer supported
+      platforms for BIND; "XP" binaries are no longer available for download
      from ISC.
    </para>
  </section>
@@ -95,10 +96,12 @@
 	  <listitem>
 	    <para>
 	      The additional cache ("acache") was found not to
-	      significantly improve performance and has been removed;
-	      the <command>acache-enable</command> and
-	      <command>acache-cleaning-interval</command> options are now
-	      deprecated.
+	      significantly improve performance and has been removed.
+	      As a result, the <command>acache-enable</command> and
+	      <command>acache-cleaning-interval</command> options no longer
+	      have any effect. For backwards compatibility, BIND will
+	      accept their presence in a configuration file, but
+	      will log a warning.
 	    </para>
 	  </listitem>
 	  <listitem>
@@ -111,15 +114,16 @@
 	  </listitem>
 	  <listitem>
 	    <para>
-	      The <command>additional-from-cache</command>
-	      and <command>additional-from-auth</command> options have been
-	      deprecated.
+	      <command>minimal-responses</command> is now set
+	      to <literal>no-auth-recursive</literal> by default.
 	    </para>
 	  </listitem>
 	  <listitem>
 	    <para>
-	      <command>minimal-responses</command> is now set
-	      to <literal>yes</literal> by default.
+	      The <command>additional-from-cache</command>
+	      and <command>additional-from-auth</command> options no longer
+	      have any effect. <command>named</command> will log a warning
+	      if they are set.
 	    </para>
 	  </listitem>
 	  <listitem>
@@ -294,13 +298,14 @@
 	  zone's validated CDS or CDNSKEY records. It can produce a
 	  <filename>dsset</filename> file suitable for input to
 	  <command>dnssec-signzone</command>, or a series of
-	  <command>nsupdate</command> to update the parent zone via dynamic
-	  DNS. Thanks to Tony Finch for the contribution.  [RT #46090]
+	  <command>nsupdate</command> commands to update the parent zone
+	  via dynamic DNS. Thanks to Tony Finch for the contribution.
+	  [RT #46090]
 	</para>
      </listitem>
      <listitem>
 	<para>
-	  <command>nsupdate</command> and <command>rndc</command> now accepts
+	  <command>nsupdate</command> and <command>rndc</command> now accept
 	  command line options <command>-4</command> and <command>-6</command>
 	  which force using only IPv4 or only IPv6, respectively. [RT #45632]
 	</para>
@@ -447,6 +452,56 @@
    </itemizedlist>
  </section>

+  <section xml:id="relnotes_removed"><info><title>Removed Features</title></info>
+    <itemizedlist>
+      <listitem>
+	<para>
+	  The ISC DNSSEC Lookaside Validation (DLV) service has been shut
+	  down; all DLV records in the dlv.isc.org zone have been removed.
+	  References to the service have been removed from BIND documentation.
+	  Lookaside validation is no longer used by default by
+	  <command>delv</command>. The DLV key has been removed from
+	  <filename>bind.keys</filename>. Setting
+	  <command>dnssec-lookaside</command> to
+	  <command>auto</command> or to use dlv.isc.org as a trust
+	  anchor is now a fatal configuration error. [RT #46155]
+	</para>
+      </listitem>
+      <listitem>
+	<para>
+	  As noted above, the <command>acache-enable</command>,
+	  <command>acache-cleaning-interval</command>,
+	  <command>additional-from-cache</command> and
+	  <command>additional-from-auth</command> options are no longer
+	  effective and <command>named</command> will log a warning if
+	  they are set.
+	</para>
+      </listitem>
+      <listitem>
+	<para>
+	  The use of <command>dnssec-keygen</command> to generate
+	  HMAC keys for TSIG authentication has been deprecated in favor
+	  of <command>tsig-keygen</command>. If the algorithms HMAC-MD5,
+	  HMAC-SHA1, HMAC-SHA224, HMAC-SHA256, HMAC-SHA384, or
+	  HMAC-SHA512 are specified, <command>dnssec-keygen</command>
+	  will print a warning message. These algorithms will be
+	  removed from <command>dnssec-keygen</command> entirely in
+	  a future release. [RT #42272]
+	</para>
+      </listitem>
+      <listitem>
+	<para>
+	  The use of HMAC-MD5 for RNDC keys is no longer recommended.
+	  For compatibility, this is still the default algorithm generated
+	  by <command>rndc-confgen</command>, but it will print a
+	  warning message. The default algorithm in
+	  <command>rndc-confgen</command> will be changed to HMAC-SHA256
+	  in a future release. [RT #42272]
+	</para>
+      </listitem>
+    </itemizedlist>
+  </section>
+
  <section xml:id="proto_changes"><info><title>Protocol Changes</title></info>
    <itemizedlist>
      <listitem>
@@ -456,13 +511,18 @@
 	  these algorithms must be supported in OpenSSL;
 	  currently they are only available in the development branch
 	  of OpenSSL at
-	  <link xmlns:xlink="http://www.w3.org/1999/xlink" xlink:href="https://github.com/openssl/openssl">https://github.com/openssl/openssl</link>.
+	  <link xmlns:xlink="http://www.w3.org/1999/xlink"
+	    xlink:href="https://github.com/openssl/openssl">
+	    https://github.com/openssl/openssl</link>.
 	  [RT #44696]
 	</para>
      </listitem>
      <listitem>
 	<para>
-	  EDNS KEY TAG options are verified and printed.
+	  When parsing DNS messages, EDNS KEY TAG options are checked
+	  for correctness. When printing messages (for example, in
+	  <command>dig</command>), EDNS KEY TAG options are printed
+	  in readable format.
 	</para>
      </listitem>
    </itemizedlist>
@@ -478,7 +538,7 @@
 	  Lookaside validation is no longer used by default by
 	  <command>delv</command>. The DLV key has been removed from
 	  <filename>bind.keys</filename>. Setting
-	  <command>dnssec-lookaside</command> set to
+	  <command>dnssec-lookaside</command> to
 	  <command>auto</command> or to use dlv.isc.org as a trust
 	  anchor is now a fatal configuration error. [RT #46155]
 	</para>
@@ -599,15 +659,6 @@
 	  are now fully rolled back in the event of failure. [RT #45841]
 	</para>
      </listitem>
-      <listitem>
-	<para>
-	  Fixed a bug that was introduced in an earlier development
-	  release which caused multi-packet AXFR and IXFR messages to fail
-	  validation if not all packets contained TSIG records; this
-	  caused interoperability problems with some other DNS
-	  implementations. [RT #45509]
-	</para>
-      </listitem>
      <listitem>
 	<para>
 	  Multiple <command>cookie-secret</command> clauses are now
@@ -634,6 +685,21 @@
 	  contribution. [RT #45689]
 	</para>
      </listitem>
+      <listitem>
+	<para>
+	  Trust anchor telemetry messages, as specified by
+	  RFC 8145, are now logged to the
+	  <command>trust-anchor-telemetry</command> logging
+	  catagory.
+	</para>
+      </listitem>
+      <listitem>
+	<para>
+	  The <command>filter-aaaa-on-v4</command> and
+	  <command>filter-aaaa-on-v6</command> options are no longer
+	  conditionally compiled in <command>named</command>. [RT #46340]
+	</para>
+      </listitem>
    </itemizedlist>
  </section>

@@ -646,6 +712,16 @@
 	  leading to unconstrained memory growth. [RT #46029]
 	</para>
      </listitem>
+      <listitem>
+	<para>
+	  Some header files included &lt;isc/util.h&gt; incorrectly as
+	  it pollutes with namespace with non ISC_ macros and this should
+	  only be done by explicitly including &lt;isc/util.h&gt;.  This
+	  has been corrected.  Some code may depend on &lt;isc/util.h&gt;
+	  being implicitly included via other header files.  Such
+	  code should explicitly include &lt;isc/util.h&gt;.
+	</para>
+      </listitem>
    </itemizedlist>
  </section>

@@ -992,13 +992,13 @@ ENABLE_PREPROCESSING   = YES
 # compilation will be performed. Macro expansion can be done in a controlled 
 # way by setting EXPAND_ONLY_PREDEF to YES.

-MACRO_EXPANSION        = NO
+MACRO_EXPANSION        = YES

 # If the EXPAND_ONLY_PREDEF and MACRO_EXPANSION tags are both set to YES 
 # then the macro expansion is limited to the macros specified with the 
 # PREDEFINED and EXPAND_AS_DEFINED tags.

-EXPAND_ONLY_PREDEF     = NO
+EXPAND_ONLY_PREDEF     = YES

 # If the SEARCH_INCLUDES tag is set to YES (the default) the includes files 
 # in the INCLUDE_PATH (see below) will be search if a #include is found.
@@ -1026,7 +1026,8 @@ INCLUDE_FILE_PATTERNS  =
 # undefined via #undef or recursively expanded use the := operator 
 # instead of the = operator.

-PREDEFINED             = 
+PREDEFINED             = "ISC_FORMAT_PRINTF(fmt, args)=" \
+			 "LIBRPZ_PF(f, l)="

 # If the MACRO_EXPANSION and EXPAND_ONLY_PREDEF tags are set to YES then 
 # this tag can be used to specify a list of macro names that should be expanded. 
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2001, 2004-2007, 2009, 2016  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2001, 2004-2007, 2009, 2016, 2017  Internet Systems Consortium, Inc. ("ISC")
 *
 * This Source Code Form is subject to the terms of the Mozilla Public
 * License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -43,7 +43,7 @@ bind9_getaddresses(const char *hostname, in_port_t port,
 * Returns:
 *\li	#ISC_R_SUCCESS
 *\li	#ISC_R_NOTFOUND
- *\li	#ISC_R_NOFAMILYSUPPORT - 'hostname' is an IPv6 address, and IPv6 is
+ *\li	#ISC_R_FAMILYNOSUPPORT - 'hostname' is an IPv6 address, and IPv6 is
 *		not supported.
 */

@@ -17,6 +17,7 @@
 #include <isc/result.h>
 #include <isc/sha2.h>
 #include <isc/task.h>
+#include <isc/util.h>

 #include <dns/catz.h>
 #include <dns/dbiterator.h>
@@ -3718,7 +3718,6 @@ dns_dispatch_importrecv(dns_dispatch_t *disp, isc_event_t *event) {
 	isc_socketevent_t *sevent, *newsevent;

 	REQUIRE(VALID_DISPATCH(disp));
-	REQUIRE((disp->attributes & DNS_DISPATCHATTR_NOLISTEN) != 0);
 	REQUIRE(event != NULL);

 	if ((disp->attributes & DNS_DISPATCHATTR_NOLISTEN) == 0)
@@ -45,6 +45,7 @@
 ***** Imports
 *****/

+#include <isc/deprecated.h>
 #include <isc/lang.h>
 #include <isc/magic.h>
 #include <isc/ondestroy.h>
@@ -859,14 +860,6 @@ dns_db_findext(dns_db_t *db, const dns_name_t *name, dns_dbversion_t *version,
 *	\li	#ISC_R_SUCCESS			The desired node and type were
 *						found.
 *
- *	\li	#DNS_R_WILDCARD			The desired node and type were
- *						found after performing
- *						wildcard matching.  This is
- *						only returned if the
- *						#DNS_DBFIND_INDICATEWILD
- *						option is set; otherwise
- *						#ISC_R_SUCCESS is returned.
- *
 *	\li	#DNS_R_GLUE			The desired node and type were
 *						found, but are glue.  This
 *						result can only occur if
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2011-2013, 2016  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2011-2013, 2016, 2017  Internet Systems Consortium, Inc. ("ISC")
 *
 * This Source Code Form is subject to the terms of the Mozilla Public
 * License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -8,7 +8,7 @@

 /* $Id$ */

-/*! \file dns/dlz_open.h */
+/*! \file dns/dlz_dlopen.h */

 #ifndef DLZ_DLOPEN_H
 #define DLZ_DLOPEN_H
@@ -355,7 +355,7 @@ dns_dt_open(const char *filename, dns_dtmode_t mode,
 *\li	#ISC_R_NOMEMORY if the fstrm library was unable to allocate a
 *      reader or options structure
 *\li	#ISC_R_FAILURE if 'filename' could not be opened.
- *\li	#ISC_R_BADDNSTAP if 'filename' does not contain a dnstap
+ *\li	#DNS_R_BADDNSTAP if 'filename' does not contain a dnstap
 *      framestream.
 */

@@ -393,7 +393,7 @@ LIBDEF_F(clist_detach)
 /**
 * Create a librpz client handle.
 * @param[out] emsg: error message
- * @param: list of dnsrpzd connections
+ * @param clist: of dnsrpzd connections
 * @param cstr: string of configuration settings separated by ';' or '\n'
 * @param use_expired: true to not ignore expired zones
 * @return client handle or NULL if the handle could not be created
@@ -668,7 +668,7 @@ LIBDEF_F(db_info)
 /**
 * Start a context for listing the nodes and/or zones in the mapped file
 * @param[out] emsg: error message for false return or *rspp=NULL
- * @param[out[ rspp created context or NULL
+ * @param[out] rspp: created context or NULL
 * @param client context
 * @return false after error
 */
@@ -73,6 +73,7 @@ LIBDNS_EXTERNAL_DATA extern isc_logmodule_t dns_modules[];
 #define DNS_LOGMODULE_NTA		(&dns_modules[30])
 #define DNS_LOGMODULE_DYNDB		(&dns_modules[31])
 #define DNS_LOGMODULE_DNSTAP		(&dns_modules[32])
+#define DNS_LOGMODULE_SSU		(&dns_modules[33])

 ISC_LANG_BEGINDECLS

@@ -176,9 +176,7 @@ typedef int dns_messagetextflag_t;
 						      additional section. */
 #define DNS_MESSAGERENDER_PREFER_AAAA	0x0010	/*%< prefer AAAA records in
 						  additional section. */
-#ifdef ALLOW_FILTER_AAAA
 #define DNS_MESSAGERENDER_FILTER_AAAA	0x0020	/*%< filter AAAA records */
-#endif

 typedef struct dns_msgblock dns_msgblock_t;

@@ -814,8 +814,6 @@ dns_name_fromtext(dns_name_t *name, isc_buffer_t *source,
 *\li	#DNS_R_EMPTYLABEL
 *\li	#DNS_R_LABELTOOLONG
 *\li	#DNS_R_BADESCAPE
- *\li	(#DNS_R_BADBITSTRING: should not be returned)
- *\li	(#DNS_R_BITSTRINGTOOLONG: should not be returned)
 *\li	#DNS_R_BADDOTTEDQUAD
 *\li	#ISC_R_NOSPACE
 *\li	#ISC_R_UNEXPECTEDEND
@@ -235,6 +235,19 @@ dns_nsec3param_toprivate(dns_rdata_t *src, dns_rdata_t *target,
 * 'buf' should be at least src->length + 1 in size.
 */

+isc_result_t
+dns_nsec3param_salttotext(dns_rdata_nsec3param_t *nsec3param, char *dst,
+			  size_t dstlen);
+/*%<
+ * Convert the salt of given NSEC3PARAM RDATA into hex-encoded, NULL-terminated
+ * text stored at "dst".
+ *
+ * Requires:
+ *
+ *\li 	"dst" to have enough space (as indicated by "dstlen") to hold the
+ * 	resulting text and its NULL-terminating byte.
+ */
+
 isc_result_t
 dns_nsec3param_deletechains(dns_db_t *db, dns_dbversion_t *ver,
 			    dns_zone_t *zone, isc_boolean_t nonsec,
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2002, 2004-2007, 2016  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2002, 2004-2007, 2016, 2017  Internet Systems Consortium, Inc. ("ISC")
 *
 * This Source Code Form is subject to the terms of the Mozilla Public
 * License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -44,8 +44,8 @@ dns_order_add(dns_order_t *order, const dns_name_t *name,
 * Requires:
 * \li	'order' to be valid.
 *\li	'name' to be valid.
- *\li	'mode' to be one of #DNS_RDATASERATTR_RANDOMIZE,
- *		#DNS_RDATASERATTR_RANDOMIZE or zero (#DNS_RDATASERATTR_CYCLIC).
+ *\li	'mode' to be one of #DNS_RDATASETATTR_RANDOMIZE,
+ *		#DNS_RDATASETATTR_FIXEDORDER or zero (#DNS_RDATASETATTR_CYCLIC).
 *
 * Returns:
 *\li	#ISC_R_SUCCESS
@@ -13,6 +13,7 @@

 /*! \file dns/rbt.h */

+#include <isc/assertions.h>
 #include <isc/crc64.h>
 #include <isc/lang.h>
 #include <isc/magic.h>
@@ -1077,7 +1078,7 @@ dns_rbtnodechain_nextflat(dns_rbtnodechain_t *chain, dns_name_t *name);
 	} while (0)
 #else  /* DNS_RBT_USEISCREFCOUNT */
 #define dns_rbtnode_refinit(node, n)    ((node)->references = (n))
-#define dns_rbtnode_refdestroy(node)    REQUIRE((node)->references == 0)
+#define dns_rbtnode_refdestroy(node)    ISC_REQUIRE((node)->references == 0)
 #define dns_rbtnode_refcurrent(node)    ((node)->references)

 #if (__STDC_VERSION__ + 0) >= 199901L || defined __GNUC__
@@ -1090,7 +1091,7 @@ dns_rbtnode_refincrement0(dns_rbtnode_t *node, unsigned int *refs) {

 static inline void
 dns_rbtnode_refincrement(dns_rbtnode_t *node, unsigned int *refs) {
-	REQUIRE(node->references > 0);
+	ISC_REQUIRE(node->references > 0);
 	node->references++;
 	if (refs != NULL)
 		*refs = node->references;
@@ -1098,7 +1099,7 @@ dns_rbtnode_refincrement(dns_rbtnode_t *node, unsigned int *refs) {

 static inline void
 dns_rbtnode_refdecrement(dns_rbtnode_t *node, unsigned int *refs) {
-	REQUIRE(node->references > 0);
+	ISC_REQUIRE(node->references > 0);
 	node->references--;
 	if (refs != NULL)
 		*refs = node->references;
@@ -1113,14 +1114,14 @@ dns_rbtnode_refdecrement(dns_rbtnode_t *node, unsigned int *refs) {
 	} while (0)
 #define dns_rbtnode_refincrement(node, refs)                    \
 	do {                                                    \
-		REQUIRE((node)->references > 0);                \
+		ISC_REQUIRE((node)->references > 0);                \
 		(node)->references++;                           \
 		if ((refs) != NULL)                             \
 			(*refs) = (node)->references;           \
 	} while (0)
 #define dns_rbtnode_refdecrement(node, refs)                    \
 	do {                                                    \
-		REQUIRE((node)->references > 0);                \
+		ISC_REQUIRE((node)->references > 0);                \
 		(node)->references--;                           \
 		if ((refs) != NULL)                             \
 			(*refs) = (node)->references;           \
@@ -10,12 +10,13 @@
 #ifndef DNS_RPZ_H
 #define DNS_RPZ_H 1

+#include <isc/deprecated.h>
+#include <isc/event.h>
+#include <isc/ht.h>
 #include <isc/lang.h>
 #include <isc/refcount.h>
 #include <isc/rwlock.h>
-#include <isc/ht.h>
 #include <isc/time.h>
-#include <isc/event.h>
 #include <isc/timer.h>

 #include <dns/fixedname.h>
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2007-2009, 2013, 2014, 2016  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2007-2009, 2013, 2014, 2016, 2017  Internet Systems Consortium, Inc. ("ISC")
 *
 * This Source Code Form is subject to the terms of the Mozilla Public
 * License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -10,6 +10,7 @@

 #include <isc/mem.h>
 #include <isc/radix.h>
+#include <isc/util.h>

 #include <dns/acl.h>

@@ -79,6 +79,7 @@ LIBDNS_EXTERNAL_DATA isc_logmodule_t dns_modules[] = {
 	{ "dns/nta",		0 },
 	{ "dns/dyndb",		0 },
 	{ "dns/dnstap",		0 },
+	{ "dns/ssu",		0 },
 	{ NULL, 		0 }
 };

@@ -13,4 +13,4 @@
 # Whenever releasing a new major release of BIND9, set this value
 # back to 1.0 when releasing the first alpha.  Map files are *never*
 # compatible across major releases.
-MAPAPI=1.0
+MAPAPI=1.1
@@ -1897,7 +1897,6 @@ wrong_priority(dns_rdataset_t *rds, int pass, dns_rdatatype_t preferred_glue) {
 	return (ISC_TRUE);
 }

-#ifdef ALLOW_FILTER_AAAA
 /*
 * Decide whether to not answer with an AAAA record and its RRSIG
 */
@@ -1939,7 +1938,6 @@ norender_rdataset(const dns_rdataset_t *rdataset, unsigned int options,

 	return (ISC_TRUE);
 }
-#endif

 static isc_result_t
 renderset(dns_rdataset_t *rdataset, const dns_name_t *owner_name,
@@ -2100,13 +2098,14 @@ dns_message_rendersection(dns_message_t *msg, dns_section_t sectionid,
 						      preferred_glue))
 					goto next;

-#ifdef ALLOW_FILTER_AAAA
 				/*
 				 * Suppress AAAAs if asked and we are
 				 * not doing DNSSEC or are breaking DNSSEC.
 				 * Say so in the AD bit if we break DNSSEC.
 				 */
-				if (norender_rdataset(rdataset, options, sectionid)) {
+				if (norender_rdataset(rdataset, options,
+						      sectionid))
+				{
 					if (sectionid == DNS_SECTION_ANSWER ||
 					    sectionid == DNS_SECTION_AUTHORITY)
 					    msg->flags &= ~DNS_MESSAGEFLAG_AD;
@@ -2115,7 +2114,6 @@ dns_message_rendersection(dns_message_t *msg, dns_section_t sectionid,
 					goto next;
 				}

-#endif
 				st = *(msg->buffer);

 				count = 0;
@@ -1009,6 +1009,42 @@ rr_exists(dns_db_t *db, dns_dbversion_t *ver, const dns_name_t *name,
 	return (result);
 }

+isc_result_t
+dns_nsec3param_salttotext(dns_rdata_nsec3param_t *nsec3param, char *dst,
+			  size_t dstlen)
+{
+	isc_result_t result;
+	isc_region_t r;
+	isc_buffer_t b;
+
+	REQUIRE(nsec3param != NULL);
+	REQUIRE(dst != NULL);
+
+	if (nsec3param->salt_length == 0) {
+		if (dstlen < 2U) {
+			return (ISC_R_NOSPACE);
+		}
+		strlcpy(dst, "-", dstlen);
+		return (ISC_R_SUCCESS);
+	}
+
+	r.base = nsec3param->salt;
+	r.length = nsec3param->salt_length;
+	isc_buffer_init(&b, dst, (unsigned int)dstlen);
+
+	result = isc_hex_totext(&r, 2, "", &b);
+	if (result != ISC_R_SUCCESS) {
+		return (result);
+	}
+
+	if (isc_buffer_availablelength(&b) < 1) {
+		return (ISC_R_NOSPACE);
+	}
+	isc_buffer_putuint8(&b, 0);
+
+	return (ISC_R_SUCCESS);
+}
+
 isc_result_t
 dns_nsec3param_deletechains(dns_db_t *db, dns_dbversion_t *ver,
 			    dns_zone_t *zone, isc_boolean_t nonsec,
@@ -227,7 +227,8 @@ fetch_done(isc_task_t *task, isc_event_t *event) {
 	case DNS_R_NXDOMAIN:
 	case DNS_R_NCACHENXRRSET:
 	case DNS_R_NXRRSET:
-		nta->expiry = now;
+		if (nta->expiry > now)
+			nta->expiry = now;
 		break;
 	default:
 		break;
@@ -458,7 +459,7 @@ dns_ntatable_covered(dns_ntatable_t *ntatable, isc_stdtime_t now,
 	}
 	if (result == ISC_R_SUCCESS) {
 		nta = (dns_nta_t *) node->data;
-		answer = ISC_TF(nta->expiry >= now);
+		answer = ISC_TF(nta->expiry > now);
 	}

 	/* Deal with expired NTA */
@@ -551,7 +552,7 @@ dns_ntatable_totext(dns_ntatable_t *ntatable, isc_buffer_t **buf) {

 			snprintf(obuf, sizeof(obuf), "%s%s: %s %s",
 				 first ? "" : "\n", nbuf,
-				 n->expiry < now ? "expired" : "expiry",
+				 n->expiry <= now ? "expired" : "expiry",
 				 tbuf);
 			first = ISC_FALSE;
 			result = putstr(buf, obuf);
@@ -605,7 +606,7 @@ dns_ntatable_dump(dns_ntatable_t *ntatable, FILE *fp) {
 			isc_time_set(&t, n->expiry, 0);
 			isc_time_formattimestamp(&t, tbuf, sizeof(tbuf));
 			fprintf(fp, "%s: %s %s\n", nbuf,
-				n->expiry < now ? "expired" : "expiry",
+				n->expiry <= now ? "expired" : "expiry",
 				tbuf);
 		}
 		result = dns_rbtnodechain_next(&chain, NULL, NULL);
@@ -672,7 +673,7 @@ dns_ntatable_save(dns_ntatable_t *ntatable, FILE *fp) {
 		dns_rbtnodechain_current(&chain, NULL, NULL, &node);
 		if (node->data != NULL) {
 			dns_nta_t *n = (dns_nta_t *) node->data;
-			if (now <= n->expiry) {
+			if (n->expiry > now) {
 				isc_buffer_t b;
 				char nbuf[DNS_NAME_FORMATSIZE + 1], tbuf[80];
 				dns_fixedname_t fn;
@@ -6,8 +6,6 @@
 * file, You can obtain one at http://mozilla.org/MPL/2.0/.
 */

-/* $Id$ */
-
 #include "config.h"

 #include <isc/base64.h>
@@ -15,6 +13,7 @@
 #include <isc/result.h>
 #include <isc/string.h>
 #include <isc/types.h>
+#include <isc/util.h>

 #include <dns/nsec3.h>
 #include <dns/private.h>
@@ -226,11 +226,11 @@ getdata(dns_rbtnode_t *node, file_header_t *header) {
 * The variable length stuff stored after the node has the following
 * structure.
 *
- *	<name_data>{1..255}<oldoffsetlen>{1}<offsets>{1..128}
+ *	&lt;name_data&gt;{1..255}&lt;oldoffsetlen&gt;{1}&lt;offsets&gt;{1..128}
 *
- * <name_data> contains the name of the node when it was created.
- * <oldoffsetlen> contains the length of <offsets> when the node was created.
- * <offsets> contains the offets into name for each label when the node was
+ * &lt;name_data&gt; contains the name of the node when it was created.
+ * &lt;oldoffsetlen&gt; contains the length of &lt;offsets&gt; when the node was created.
+ * &lt;offsets&gt; contains the offets into name for each label when the node was
 * created.
 */

@@ -52,7 +52,7 @@ static char root_ns[] =
 ".                       518400  IN      NS      M.ROOT-SERVERS.NET.\n"
 "A.ROOT-SERVERS.NET.     3600000 IN      A       198.41.0.4\n"
 "A.ROOT-SERVERS.NET.     3600000 IN      AAAA    2001:503:BA3E::2:30\n"
-"B.ROOT-SERVERS.NET.     3600000 IN      A       192.228.79.201\n"
+"B.ROOT-SERVERS.NET.     3600000 IN      A       199.9.14.201\n"
 "B.ROOT-SERVERS.NET.     3600000 IN      AAAA    2001:500:200::b\n"
 "C.ROOT-SERVERS.NET.     3600000 IN      A       192.33.4.12\n"
 "C.ROOT-SERVERS.NET.     3600000 IN      AAAA    2001:500:2::c\n"
@@ -19,6 +19,7 @@
 #include <isc/net.h>
 #include <isc/netaddr.h>
 #include <isc/print.h>
+#include <isc/util.h>

 #include <dns/result.h>
 #include <dns/rcode.h>
@@ -425,12 +425,21 @@ dns_ssutable_checkrules2(dns_ssutable_t *table, const dns_name_t *signer,
 				continue;
 			}
 			if (!dns_name_issubdomain(name, rule->name)) {
-
 				continue;
 			}
 			dns_acl_match(addr, NULL, env->localhost,
 				      NULL, &match, NULL);
 			if (match == 0) {
+				if (signer != NULL) {
+					isc_log_write(dns_lctx,
+						      DNS_LOGCATEGORY_GENERAL,
+						      DNS_LOGMODULE_SSU,
+						      ISC_LOG_WARNING,
+						      "update-policy local: "
+						      "match on session "
+						      "key not from "
+						      "localhost");
+				}
 				continue;
 			}
 			break;
@@ -22,6 +22,7 @@
 #include <isc/file.h>
 #include <isc/hash.h>
 #include <isc/hex.h>
+#include <isc/lex.h>
 #include <isc/mem.h>
 #include <isc/os.h>
 #include <isc/print.h>
@@ -100,7 +101,7 @@ create_managers(void) {
 	CHECK(isc_task_create(taskmgr, 0, &maintask));
 	return (ISC_R_SUCCESS);

-  cleanup:
+ cleanup:
 	cleanup_managers();
 	return (result);
 }
@@ -158,7 +159,7 @@ dns_test_begin(FILE *logfile, isc_boolean_t start_managers) {

 	return (ISC_R_SUCCESS);

-  cleanup:
+ cleanup:
 	dns_test_end();
 	return (result);
 }
@@ -434,3 +435,58 @@ dns_test_getdata(const char *file, unsigned char *buf,
 	isc_stdio_close(f);
 	return (result);
 }
+
+isc_result_t
+dns_test_rdata_fromstring(dns_rdata_t *rdata, dns_rdataclass_t rdclass,
+			  dns_rdatatype_t rdtype, unsigned char *dst,
+			  size_t dstlen, const char *src)
+{
+	isc_buffer_t source, target;
+	isc_lex_t *lex = NULL;
+	isc_result_t result;
+	size_t length;
+
+	REQUIRE(rdata != NULL);
+	REQUIRE(DNS_RDATA_INITIALIZED(rdata));
+	REQUIRE(dst != NULL);
+	REQUIRE(src != NULL);
+
+	/*
+	 * Set up source to hold the input string.
+	 */
+	length = strlen(src);
+	isc_buffer_constinit(&source, src, length);
+	isc_buffer_add(&source, length);
+
+	/*
+	 * Create a lexer as one is required by dns_rdata_fromtext().
+	 */
+	result = isc_lex_create(mctx, 64, &lex);
+	if (result != ISC_R_SUCCESS) {
+		return (result);
+	}
+
+	/*
+	 * Point lexer at source.
+	 */
+	result = isc_lex_openbuffer(lex, &source);
+	if (result != ISC_R_SUCCESS) {
+		goto destroy_lexer;
+	}
+
+	/*
+	 * Set up target for storing uncompressed wire form of provided RDATA.
+	 */
+	isc_buffer_init(&target, dst, dstlen);
+
+	/*
+	 * Parse input string, determining result.
+	 */
+	result = dns_rdata_fromtext(rdata, rdclass, rdtype, lex, dns_rootname,
+				    0, NULL, &target, NULL);
+
+ destroy_lexer:
+	isc_lex_destroy(&lex);
+
+	return (result);
+}
@@ -80,3 +80,13 @@ dns_test_getdata(const char *file, unsigned char *buf,

 char *
 dns_test_tohex(const unsigned char *data, size_t len, char *buf, size_t buflen);
+
+/*%
+ * Try parsing text form RDATA in "src" (of class "rdclass" and type "rdtype")
+ * into a structure representing that RDATA at "rdata", storing the
+ * uncompressed wire form of that RDATA at "dst", which is "dstlen" bytes long.
+ */
+isc_result_t
+dns_test_rdata_fromstring(dns_rdata_t *rdata, dns_rdataclass_t rdclass,
+                          dns_rdatatype_t rdtype, unsigned char *dst,
+                          size_t dstlen, const char *src);
@@ -43,6 +43,82 @@ iteration_test(const char *file, unsigned int expected) {
 	dns_db_detach(&db);
 }

+/*%
+ * Structure containing parameters for nsec3param_salttotext_test().
+ */
+typedef struct {
+	const char *nsec3param_text;	/* NSEC3PARAM RDATA in text form */
+	const char *expected_salt;	/* string expected in target buffer */
+} nsec3param_salttotext_test_params_t;
+
+/*%
+ * Check whether dns_nsec3param_salttotext() handles supplied text form
+ * NSEC3PARAM RDATA correctly: test whether the result of calling the former is
+ * as expected and whether it properly checks available buffer space.
+ *
+ * Assumes supplied text form NSEC3PARAM RDATA is valid as testing handling of
+ * invalid NSEC3PARAM RDATA is out of scope of this unit test.
+ */
+static void
+nsec3param_salttotext_test(const nsec3param_salttotext_test_params_t *params) {
+	dns_rdata_t rdata = DNS_RDATA_INIT;
+	dns_rdata_nsec3param_t nsec3param;
+	unsigned char buf[1024];
+	isc_result_t result;
+	char salt[64];
+	size_t length;
+
+	/*
+	 * Prepare a dns_rdata_nsec3param_t structure for testing.
+	 */
+	result = dns_test_rdata_fromstring(&rdata, dns_rdataclass_in,
+					   dns_rdatatype_nsec3param, buf,
+					   sizeof(buf),
+					   params->nsec3param_text);
+	ATF_REQUIRE_EQ(result, ISC_R_SUCCESS);
+	result = dns_rdata_tostruct(&rdata, &nsec3param, NULL);
+	ATF_REQUIRE_EQ(result, ISC_R_SUCCESS);
+
+	/*
+	 * Check typical use.
+	 */
+	result = dns_nsec3param_salttotext(&nsec3param, salt, sizeof(salt));
+	ATF_CHECK_EQ_MSG(result, ISC_R_SUCCESS,
+			 "\"%s\": expected success, got %s\n",
+			 params->nsec3param_text, isc_result_totext(result));
+	ATF_CHECK_EQ_MSG(strcmp(salt, params->expected_salt), 0,
+			 "\"%s\": expected salt \"%s\", got \"%s\"",
+			 params->nsec3param_text, params->expected_salt, salt);
+
+	/*
+	 * Ensure available space in the buffer is checked before the salt is
+	 * printed to it and that the amount of space checked for includes the
+	 * terminating NULL byte.
+	 */
+	length = strlen(params->expected_salt);
+	ATF_REQUIRE(length < sizeof(salt) - 1);	/* prevent buffer overwrite */
+	ATF_REQUIRE(length > 0U);		/* prevent length underflow */
+
+	result = dns_nsec3param_salttotext(&nsec3param, salt, length - 1);
+	ATF_CHECK_EQ_MSG(result, ISC_R_NOSPACE,
+			 "\"%s\": expected a %lu-byte target buffer to be "
+			 "rejected, got %s\n",
+			 params->nsec3param_text, length - 1,
+			 isc_result_totext(result));
+	result = dns_nsec3param_salttotext(&nsec3param, salt, length);
+	ATF_CHECK_EQ_MSG(result, ISC_R_NOSPACE,
+			 "\"%s\": expected a %lu-byte target buffer to be "
+			 "rejected, got %s\n",
+			 params->nsec3param_text, length,
+			 isc_result_totext(result));
+	result = dns_nsec3param_salttotext(&nsec3param, salt, length + 1);
+	ATF_CHECK_EQ_MSG(result, ISC_R_SUCCESS,
+			 "\"%s\": expected a %lu-byte target buffer to be "
+			 "accepted, got %s\n",
+			 params->nsec3param_text, length + 1,
+			 isc_result_totext(result));
+}
+
 /*
 * Individual unit tests
 */
@@ -68,6 +144,40 @@ ATF_TC_BODY(max_iterations, tc) {

 	dns_test_end();
 }
+
+ATF_TC(nsec3param_salttotext);
+ATF_TC_HEAD(nsec3param_salttotext, tc) {
+	atf_tc_set_md_var(tc, "descr", "check dns_nsec3param_salttotext()");
+}
+ATF_TC_BODY(nsec3param_salttotext, tc) {
+	isc_result_t result;
+	size_t i;
+
+	const nsec3param_salttotext_test_params_t tests[] = {
+		/*
+		 * Tests with non-empty salts.
+		 */
+		{ "0 0 10 0123456789abcdef", "0123456789ABCDEF" },
+		{ "0 1 11 0123456789abcdef", "0123456789ABCDEF" },
+		{ "1 0 12 42", "42" },
+		{ "1 1 13 42", "42" },
+		/*
+		 * Test with empty salt.
+		 */
+		{ "0 0 0 -", "-" },
+	};
+
+	UNUSED(tc);
+
+	result = dns_test_begin(NULL, ISC_FALSE);
+	ATF_REQUIRE_EQ(result, ISC_R_SUCCESS);
+
+	for (i = 0; i < sizeof(tests) / sizeof(tests[0]); i++) {
+		nsec3param_salttotext_test(&tests[i]);
+	}
+
+	dns_test_end();
+}
 #else
 ATF_TC(untested);
 ATF_TC_HEAD(untested, tc) {
@@ -85,6 +195,7 @@ ATF_TC_BODY(untested, tc) {
 ATF_TP_ADD_TCS(tp) {
 #if defined(OPENSSL) || defined(PKCS11CRYPTO)
 	ATF_TP_ADD_TC(tp, max_iterations);
+	ATF_TP_ADD_TC(tp, nsec3param_salttotext);
 #else
 	ATF_TP_ADD_TC(tp, untested);
 #endif
@@ -141,38 +141,18 @@ static void
 check_text_ok_single(const text_ok_t *text_ok, dns_rdataclass_t rdclass,
 		     dns_rdatatype_t type, size_t structsize)
 {
-	isc_buffer_t source, target;
+	dns_rdata_t rdata = DNS_RDATA_INIT;
 	unsigned char buf_fromtext[1024];
 	char buf_totext[1024] = { 0 };
-	isc_lex_t *lex = NULL;
+	isc_buffer_t target;
 	isc_result_t result;
-	dns_rdata_t rdata;
-	size_t length;

-	/*
-	 * Set up lexer to read data.
-	 */
-	result = isc_lex_create(mctx, 64, &lex);
-	ATF_REQUIRE_EQ(result, ISC_R_SUCCESS);
-	length = strlen(text_ok->text_in);
-	isc_buffer_constinit(&source, text_ok->text_in, length);
-	isc_buffer_add(&source, length);
-	result = isc_lex_openbuffer(lex, &source);
-	ATF_REQUIRE_EQ(result, ISC_R_SUCCESS);
-	/*
-	 * Initialize target structures.
-	 */
-	isc_buffer_init(&target, buf_fromtext, sizeof(buf_fromtext));
-	dns_rdata_init(&rdata);
 	/*
 	 * Try converting text form RDATA into uncompressed wire form.
 	 */
-	result = dns_rdata_fromtext(&rdata, rdclass, type, lex, dns_rootname,
-				    0, NULL, &target, NULL);
-	/*
-	 * Destroy lexer now to simplify error handling below.
-	 */
-	isc_lex_destroy(&lex);
+	result = dns_test_rdata_fromstring(&rdata, rdclass, type, buf_fromtext,
+					   sizeof(buf_fromtext),
+					   text_ok->text_in);
 	/*
 	 * Check whether result is as expected.
 	 */
@@ -1,16 +1,15 @@
 /*
- * Copyright (C) 2009, 2010, 2016  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2009, 2010, 2016, 2017  Internet Systems Consortium, Inc. ("ISC")
 *
 * This Source Code Form is subject to the terms of the Mozilla Public
 * License, v. 2.0. If a copy of the MPL was not distributed with this
 * file, You can obtain one at http://mozilla.org/MPL/2.0/.
 */

-/* $Id: tsec.c,v 1.7 2010/12/09 00:54:34 marka Exp $ */
-
 #include <config.h>

 #include <isc/mem.h>
+#include <isc/util.h>

 #include <pk11/site.h>

@@ -637,6 +637,7 @@ dns_nsec3_supportedhash
 dns_nsec3_typepresent
 dns_nsec3param_deletechains
 dns_nsec3param_fromprivate
+dns_nsec3param_salttotext
 dns_nsec3param_toprivate
 dns_nsec_build
 dns_nsec_buildrdata
@@ -3303,50 +3303,6 @@ resume_signingwithkey(dns_zone_t *zone) {
 	}
 }

-/*
- * Convert the salt of given NSEC3PARAM RDATA into hex-encoded, NULL-terminated
- * text stored at "dst".
- *
- * Requires:
- * 	"dst" to have enough space (as indicated by "dstlen") to hold the
- * 	resulting text and its NULL-terminating byte.
- */
-static isc_result_t
-nsec3param_salt_totext(dns_rdata_nsec3param_t *nsec3param, char *dst,
-		       size_t dstlen)
-{
-	isc_result_t result;
-	isc_region_t r;
-	isc_buffer_t b;
-
-	REQUIRE(nsec3param != NULL);
-	REQUIRE(dst != NULL);
-
-	if (nsec3param->salt_length == 0) {
-		if (dstlen < 2U) {
-			return (ISC_R_NOSPACE);
-		}
-		strlcpy(dst, "-", dstlen);
-		return (ISC_R_SUCCESS);
-	}
-
-	r.base = nsec3param->salt;
-	r.length = nsec3param->salt_length;
-	isc_buffer_init(&b, dst, (unsigned int)dstlen);
-
-	result = isc_hex_totext(&r, 2, "", &b);
-	if (result != ISC_R_SUCCESS) {
-		return (result);
-	}
-
-	if (isc_buffer_availablelength(&b) < 1) {
-		return (ISC_R_NOSPACE);
-	}
-	isc_buffer_putuint8(&b, 0);
-
-	return (ISC_R_SUCCESS);
-}
-
 /*
 * Initiate adding/removing NSEC3 records belonging to the chain defined by the
 * supplied NSEC3PARAM RDATA.
@@ -3450,7 +3406,8 @@ zone_addnsec3chain(dns_zone_t *zone, dns_rdata_nsec3param_t *nsec3param) {
 				strlcat(flags, "|OPTOUT", sizeof(flags));
 		}
 	}
-	result = nsec3param_salt_totext(nsec3param, saltbuf, sizeof(saltbuf));
+	result = dns_nsec3param_salttotext(nsec3param, saltbuf,
+					   sizeof(saltbuf));
 	RUNTIME_CHECK(result == ISC_R_SUCCESS);
 	dns_zone_log(zone, ISC_LOG_INFO,
 		     "zone_addnsec3chain(%u,%s,%u,%s)",
@@ -17258,7 +17215,7 @@ dns_zone_addnsec3chain(dns_zone_t *zone, dns_rdata_nsec3param_t *nsec3param) {

 	REQUIRE(DNS_ZONE_VALID(zone));

-	result = nsec3param_salt_totext(nsec3param, salt, sizeof(salt));
+	result = dns_nsec3param_salttotext(nsec3param, salt, sizeof(salt));
 	RUNTIME_CHECK(result == ISC_R_SUCCESS);
 	dns_zone_log(zone, ISC_LOG_NOTICE,
 		     "dns_zone_addnsec3chain(hash=%u, iterations=%u, salt=%s)",
@@ -17,12 +17,12 @@ VERSION=@BIND9_VERSION@
 #
 HEADERS =	aes.h app.h assertions.h backtrace.h base32.h base64.h \
 		bind9.h boolean.h buffer.h bufferlist.h \
-		commandline.h counter.h crc64.h \
+		commandline.h counter.h crc64.h deprecated.h \
 		entropy.h errno.h error.h event.h eventclass.h \
 		file.h formatcheck.h fsaccess.h fuzz.h \
 		hash.h heap.h hex.h hmacmd5.h hmacsha.h ht.h httpd.h \
 		interfaceiter.h @ISC_IPV6_H@ iterated_hash.h \
-		json.h lang.h lex.h lfsr.h lib.h list.h log.h \
+		json.h lang.h lex.h lfsr.h lib.h likely.h list.h log.h \
 		magic.h md5.h mem.h meminfo.h msgcat.h msgs.h mutexblock.h \
 		netaddr.h netscope.h ondestroy.h os.h parseint.h \
 		pool.h portset.h print.h queue.h quota.h \
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 1997-2001, 2004-2009, 2016  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 1997-2001, 2004-2009, 2016, 2017  Internet Systems Consortium, Inc. ("ISC")
 *
 * This Source Code Form is subject to the terms of the Mozilla Public
 * License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -16,6 +16,7 @@
 #define ISC_ASSERTIONS_H 1

 #include <isc/lang.h>
+#include <isc/likely.h>
 #include <isc/platform.h>

 ISC_LANG_BEGINDECLS
@@ -96,7 +96,10 @@
 *** Imports
 ***/

+#include <isc/assertions.h>
+#include <isc/formatcheck.h>
 #include <isc/lang.h>
+#include <isc/likely.h>
 #include <isc/magic.h>
 #include <isc/types.h>

@@ -910,10 +913,10 @@ ISC_LANG_ENDDECLS
 	do { \
 		if (ISC_UNLIKELY((_b)->autore)) { \
 			isc_buffer_t *_tmp = _b; \
-			REQUIRE(isc_buffer_reserve(&_tmp, _length) \
+			ISC_REQUIRE(isc_buffer_reserve(&_tmp, _length) \
 				== ISC_R_SUCCESS); \
 		} \
-		REQUIRE(isc_buffer_availablelength(_b) >= (unsigned int) _length); \
+		ISC_REQUIRE(isc_buffer_availablelength(_b) >= (unsigned int) _length); \
 		memmove(isc_buffer_used(_b), (_base), (_length)); \
 		(_b)->used += (_length); \
 	} while (0)
@@ -925,10 +928,10 @@ ISC_LANG_ENDDECLS
 		_length = strlen(_source); \
 		if (ISC_UNLIKELY((_b)->autore)) { \
 			isc_buffer_t *_tmp = _b; \
-			REQUIRE(isc_buffer_reserve(&_tmp, _length) \
+			ISC_REQUIRE(isc_buffer_reserve(&_tmp, _length) \
 				== ISC_R_SUCCESS); \
 		} \
-		REQUIRE(isc_buffer_availablelength(_b) >= (unsigned int) _length); \
+		ISC_REQUIRE(isc_buffer_availablelength(_b) >= (unsigned int) _length); \
 		_cp = isc_buffer_used(_b); \
 		memmove(_cp, (_source), _length); \
 		(_b)->used += (_length); \
@@ -941,10 +944,10 @@ ISC_LANG_ENDDECLS
 		isc_uint8_t _val2 = (_val); \
 		if (ISC_UNLIKELY((_b)->autore)) { \
 			isc_buffer_t *_tmp = _b; \
-			REQUIRE(isc_buffer_reserve(&_tmp, 1) \
+			ISC_REQUIRE(isc_buffer_reserve(&_tmp, 1) \
 				== ISC_R_SUCCESS); \
 		} \
-		REQUIRE(isc_buffer_availablelength(_b) >= 1U); \
+		ISC_REQUIRE(isc_buffer_availablelength(_b) >= 1U); \
 		_cp = isc_buffer_used(_b); \
 		(_b)->used++; \
 		_cp[0] = _val2; \
@@ -957,10 +960,10 @@ ISC_LANG_ENDDECLS
 		isc_uint16_t _val2 = (_val); \
 		if (ISC_UNLIKELY((_b)->autore)) { \
 			isc_buffer_t *_tmp = _b; \
-			REQUIRE(isc_buffer_reserve(&_tmp, 2) \
+			ISC_REQUIRE(isc_buffer_reserve(&_tmp, 2) \
 				== ISC_R_SUCCESS); \
 		} \
-		REQUIRE(isc_buffer_availablelength(_b) >= 2U); \
+		ISC_REQUIRE(isc_buffer_availablelength(_b) >= 2U); \
 		_cp = isc_buffer_used(_b); \
 		(_b)->used += 2; \
 		_cp[0] = (unsigned char)(_val2 >> 8); \
@@ -974,10 +977,10 @@ ISC_LANG_ENDDECLS
 		isc_uint32_t _val2 = (_val); \
 		if (ISC_UNLIKELY((_b)->autore)) { \
 			isc_buffer_t *_tmp = _b; \
-			REQUIRE(isc_buffer_reserve(&_tmp, 3) \
+			ISC_REQUIRE(isc_buffer_reserve(&_tmp, 3) \
 				== ISC_R_SUCCESS); \
 		} \
-		REQUIRE(isc_buffer_availablelength(_b) >= 3U); \
+		ISC_REQUIRE(isc_buffer_availablelength(_b) >= 3U); \
 		_cp = isc_buffer_used(_b); \
 		(_b)->used += 3; \
 		_cp[0] = (unsigned char)(_val2 >> 16); \
@@ -992,10 +995,10 @@ ISC_LANG_ENDDECLS
 		isc_uint32_t _val2 = (_val); \
 		if (ISC_UNLIKELY((_b)->autore)) { \
 			isc_buffer_t *_tmp = _b; \
-			REQUIRE(isc_buffer_reserve(&_tmp, 4) \
+			ISC_REQUIRE(isc_buffer_reserve(&_tmp, 4) \
 				== ISC_R_SUCCESS); \
 		} \
-		REQUIRE(isc_buffer_availablelength(_b) >= 4U); \
+		ISC_REQUIRE(isc_buffer_availablelength(_b) >= 4U); \
 		_cp = isc_buffer_used(_b); \
 		(_b)->used += 4; \
 		_cp[0] = (unsigned char)(_val2 >> 24); \
@@ -0,0 +1,19 @@
+/*
+ * Copyright (C) 2017  Internet Systems Consortium, Inc. ("ISC")
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ */
+
+
+#ifndef ISC_DEPRECATED_H
+#define ISC_DEPRECATED_H
+
+#ifdef __GNUC__
+#define ISC_DEPRECATED                  __attribute__((deprecated))
+#else
+#define ISC_DEPRECATED                  /* none */
+#endif /* __GNUC __ */
+
+#endif
@@ -17,6 +17,7 @@

 #include <isc/formatcheck.h>
 #include <isc/lang.h>
+#include <isc/likely.h>
 #include <isc/platform.h>

 ISC_LANG_BEGINDECLS
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2003-2007, 2009, 2013-2016  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2003-2007, 2009, 2013-2017  Internet Systems Consortium, Inc. ("ISC")
 *
 * This Source Code Form is subject to the terms of the Mozilla Public
 * License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -9,8 +9,8 @@
 #ifndef ISC_HASH_H
 #define ISC_HASH_H 1

+#include <isc/deprecated.h>
 #include <isc/types.h>
-#include <isc/util.h>

 /*****
 ***** Module Info
@@ -0,0 +1,23 @@
+/*
+ * Copyright (C) 2017  Internet Systems Consortium, Inc. ("ISC")
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ */
+
+#ifndef ISC_LIKELY_H
+#define ISC_LIKELY_H 1
+
+/*%
+ * Performance
+ */
+#ifdef HAVE_BUILTIN_EXPECT
+#define ISC_LIKELY(x)            __builtin_expect(!!(x), 1)
+#define ISC_UNLIKELY(x)          __builtin_expect(!!(x), 0)
+#else
+#define ISC_LIKELY(x)            (x)
+#define ISC_UNLIKELY(x)          (x)
+#endif
+
+#endif /* ISC_LIKELY_H */
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 1999-2001, 2004-2007, 2016  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 1999-2001, 2004-2007, 2016, 2017  Internet Systems Consortium, Inc. ("ISC")
 *
 * This Source Code Form is subject to the terms of the Mozilla Public
 * License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -11,7 +11,7 @@
 #ifndef ISC_MAGIC_H
 #define ISC_MAGIC_H 1

-#include <isc/util.h>
+#include <isc/likely.h>

 /*! \file isc/magic.h */

@@ -11,12 +11,13 @@
 #ifndef ISC_REFCOUNT_H
 #define ISC_REFCOUNT_H 1

+#include <isc/assertions.h>
 #include <isc/atomic.h>
+#include <isc/error.h>
 #include <isc/lang.h>
 #include <isc/mutex.h>
 #include <isc/platform.h>
 #include <isc/types.h>
-#include <isc/util.h>

 #if defined(ISC_PLATFORM_HAVESTDATOMIC)
 #include <stdatomic.h>
@@ -109,7 +110,7 @@ typedef struct isc_refcount {
 #define isc_refcount_current(rp)					\
 	((unsigned int)(atomic_load_explicit(&(rp)->refs,		\
 					     memory_order_relaxed)))
-#define isc_refcount_destroy(rp) REQUIRE(isc_refcount_current(rp) == 0)
+#define isc_refcount_destroy(rp) ISC_REQUIRE(isc_refcount_current(rp) == 0)

 #define isc_refcount_increment0(rp, tp)				\
 	do {							\
@@ -127,7 +128,7 @@ typedef struct isc_refcount {
 		isc_int32_t prev;				\
 		prev = atomic_fetch_add_explicit		\
 			(&(rp)->refs, 1, memory_order_relaxed); \
-		REQUIRE(prev > 0);				\
+		ISC_REQUIRE(prev > 0);				\
 		if (_tmp != NULL)				\
 			*_tmp = prev + 1;			\
 	} while (0)
@@ -138,7 +139,7 @@ typedef struct isc_refcount {
 		isc_int32_t prev;				\
 		prev = atomic_fetch_sub_explicit		\
 			(&(rp)->refs, 1, memory_order_relaxed); \
-		REQUIRE(prev > 0);				\
+		ISC_REQUIRE(prev > 0);				\
 		if (_tmp != NULL)				\
 			*_tmp = prev - 1;			\
 	} while (0)
@@ -147,7 +148,7 @@ typedef struct isc_refcount {

 #define isc_refcount_current(rp)				\
 	((unsigned int)(isc_atomic_xadd(&(rp)->refs, 0)))
-#define isc_refcount_destroy(rp) REQUIRE(isc_refcount_current(rp) == 0)
+#define isc_refcount_destroy(rp) ISC_REQUIRE(isc_refcount_current(rp) == 0)

 #define isc_refcount_increment0(rp, tp)				\
 	do {							\
@@ -163,7 +164,7 @@ typedef struct isc_refcount {
 		unsigned int *_tmp = (unsigned int *)(tp);	\
 		isc_int32_t prev;				\
 		prev = isc_atomic_xadd(&(rp)->refs, 1);		\
-		REQUIRE(prev > 0);				\
+		ISC_REQUIRE(prev > 0);				\
 		if (_tmp != NULL)				\
 			*_tmp = prev + 1;			\
 	} while (0)
@@ -173,7 +174,7 @@ typedef struct isc_refcount {
 		unsigned int *_tmp = (unsigned int *)(tp);	\
 		isc_int32_t prev;				\
 		prev = isc_atomic_xadd(&(rp)->refs, -1);	\
-		REQUIRE(prev > 0);				\
+		ISC_REQUIRE(prev > 0);				\
 		if (_tmp != NULL)				\
 			*_tmp = prev - 1;			\
 	} while (0)
@@ -188,46 +189,63 @@ typedef struct isc_refcount {
 } isc_refcount_t;

 /*% Destroys a reference counter. */
-#define isc_refcount_destroy(rp)			\
-	do {						\
-		REQUIRE((rp)->refs == 0);		\
-		DESTROYLOCK(&(rp)->lock);		\
+#define isc_refcount_destroy(rp)					\
+	do {								\
+		isc_result_t _result;					\
+		ISC_REQUIRE((rp)->refs == 0);				\
+		_result = isc_mutex_destroy(&(rp)->lock);		\
+		ISC_ERROR_RUNTIMECHECK(_result == ISC_R_SUCCESS);	\
 	} while (0)

 #define isc_refcount_current(rp) ((unsigned int)((rp)->refs))

-/*% Increments the reference count, returning the new value in targetp if it's not NULL. */
-#define isc_refcount_increment0(rp, tp)				\
-	do {							\
-		unsigned int *_tmp = (unsigned int *)(tp);	\
-		LOCK(&(rp)->lock);				\
-		++((rp)->refs);					\
-		if (_tmp != NULL)				\
-			*_tmp = ((rp)->refs);			\
-		UNLOCK(&(rp)->lock);				\
+/*%
+ * Increments the reference count, returning the new value in
+ * 'tp' if it's not NULL.
+ */
+#define isc_refcount_increment0(rp, tp)					\
+	do {								\
+		isc_result_t _result;					\
+		unsigned int *_tmp = (unsigned int *)(tp);		\
+		_result = isc_mutex_lock(&(rp)->lock);			\
+		ISC_ERROR_RUNTIMECHECK(_result == ISC_R_SUCCESS);	\
+		++((rp)->refs);						\
+		if (_tmp != NULL)					\
+			*_tmp = ((rp)->refs);				\
+		_result = isc_mutex_unlock(&(rp)->lock);		\
+		ISC_ERROR_RUNTIMECHECK(_result == ISC_R_SUCCESS);	\
 	} while (0)

-#define isc_refcount_increment(rp, tp)				\
-	do {							\
-		unsigned int *_tmp = (unsigned int *)(tp);	\
-		LOCK(&(rp)->lock);				\
-		REQUIRE((rp)->refs > 0);			\
-		++((rp)->refs);					\
-		if (_tmp != NULL)				\
-			*_tmp = ((rp)->refs);			\
-		UNLOCK(&(rp)->lock);				\
+#define isc_refcount_increment(rp, tp)					\
+	do {								\
+		isc_result_t _result;					\
+		unsigned int *_tmp = (unsigned int *)(tp);		\
+		_result = isc_mutex_lock(&(rp)->lock);			\
+		ISC_ERROR_RUNTIMECHECK(_result == ISC_R_SUCCESS);	\
+		ISC_REQUIRE((rp)->refs > 0);				\
+		++((rp)->refs);						\
+		if (_tmp != NULL)					\
+			*_tmp = ((rp)->refs);				\
+		_result = isc_mutex_unlock(&(rp)->lock);		\
+		ISC_ERROR_RUNTIMECHECK(_result == ISC_R_SUCCESS);	\
 	} while (0)

-/*% Decrements the reference count,  returning the new value in targetp if it's not NULL. */
-#define isc_refcount_decrement(rp, tp)				\
-	do {							\
-		unsigned int *_tmp = (unsigned int *)(tp);	\
-		LOCK(&(rp)->lock);				\
-		REQUIRE((rp)->refs > 0);			\
-		--((rp)->refs);					\
-		if (_tmp != NULL)				\
-			*_tmp = ((rp)->refs);			\
-		UNLOCK(&(rp)->lock);				\
+/*%
+ * Decrements the reference count, returning the new value in 'tp'
+ * if it's not NULL.
+ */
+#define isc_refcount_decrement(rp, tp)					\
+	do {								\
+		isc_result_t _result;					\
+		unsigned int *_tmp = (unsigned int *)(tp);		\
+		_result = isc_mutex_lock(&(rp)->lock);			\
+		ISC_ERROR_RUNTIMECHECK(_result == ISC_R_SUCCESS);	\
+		ISC_REQUIRE((rp)->refs > 0);				\
+		--((rp)->refs);						\
+		if (_tmp != NULL)					\
+			*_tmp = ((rp)->refs);				\
+		_result = isc_mutex_unlock(&(rp)->lock);		\
+		ISC_ERROR_RUNTIMECHECK(_result == ISC_R_SUCCESS);	\
 	} while (0)

 #endif /* (defined(ISC_PLATFORM_HAVESTDATOMIC) && defined(ATOMIC_INT_LOCK_FREE)) || defined(ISC_PLATFORM_HAVEXADD) */
@@ -237,7 +255,7 @@ typedef struct isc_refcount {
 	int refs;
 } isc_refcount_t;

-#define isc_refcount_destroy(rp) REQUIRE((rp)->refs == 0)
+#define isc_refcount_destroy(rp) ISC_REQUIRE((rp)->refs == 0)
 #define isc_refcount_current(rp) ((unsigned int)((rp)->refs))

 #define isc_refcount_increment0(rp, tp)					\
@@ -252,7 +270,7 @@ typedef struct isc_refcount {
 	do {								\
 		unsigned int *_tmp = (unsigned int *)(tp);		\
 		int _n;							\
-		REQUIRE((rp)->refs > 0);				\
+		ISC_REQUIRE((rp)->refs > 0);				\
 		_n = ++(rp)->refs;					\
 		if (_tmp != NULL)					\
 			*_tmp = _n;					\
@@ -262,7 +280,7 @@ typedef struct isc_refcount {
 	do {								\
 		unsigned int *_tmp = (unsigned int *)(tp);		\
 		int _n;							\
-		REQUIRE((rp)->refs > 0);				\
+		ISC_REQUIRE((rp)->refs > 0);				\
 		_n = --(rp)->refs;					\
 		if (_tmp != NULL)					\
 			*_tmp = _n;					\
@@ -458,7 +458,7 @@ isc_task_onshutdown(isc_task_t *task, isc_taskaction_t action,
 *
 *\li	#ISC_R_SUCCESS
 *\li	#ISC_R_NOMEMORY
- *\li	#ISC_R_TASKSHUTTINGDOWN			Task is shutting down.
+ *\li	#ISC_R_SHUTTINGDOWN			Task is shutting down.
 */

 void
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Brian ConryandOndřej Surý	740c8050b4	Bump the maximum TCP timeout to 65535 [RT #44710 ]	2017-10-25 14:15:04 +04:00
Evan Hunt	eb2ef7b53e	[master] check new-zones-directory 4789. [cleanup] Check writability of new-zones-directory. [RT #46308]	2017-10-25 01:19:46 -07:00
Evan Hunt	aebdc6cd7d	[master] log when update-policy local gets a key match from a remote host 4788. [cleanup] When using "update-policy local", log a warning when an update matching the session key is received from a remote host. [RT #46213] - this completes change #4762.	2017-10-25 00:58:11 -07:00
Michał Kępień	910a01550a	[master] Rename nsec3param_salt_totext() to dns_nsec3param_salttotext(), make it public, add unit tests 4786. [cleanup] Turn nsec3param_salt_totext() into a public function, dns_nsec3param_salttotext(), and add unit tests for it. [RT #46289]	2017-10-25 09:46:18 +02:00
Evan Hunt	65314b0fd8	[master] "enable-filter-aaaa" no longer optional 4786. [func] The "filter-aaaa-on-v4" and "filter-aaaa-on-v6" options are no longer conditionally compiled. [RT #46340]	2017-10-25 00:33:51 -07:00
Mark Andrews	80739779fc	read dig.out.ns3.test$n rather than dig.out.ns2.test$n	2017-10-25 15:02:36 +11:00
Tinderbox User	a53e03205a	regen master	2017-10-25 01:08:58 +00:00
Tinderbox User	ea055a82cd	update copyright notice / whitespace	2017-10-24 23:47:14 +00:00
Tinderbox User	89c95e7141	newcopyrights	2017-10-24 23:30:30 +00:00
Mark Andrews	79e78994d0	add missing semicolon	2017-10-25 10:29:10 +11:00
Evan Hunt	21761bfe79	[master] deprecate HMAC in dnssec-keygen, MD5 in rndc-confgen 4785. [func] The hmac-md5 algorithm is no longer recommended for use with RNDC keys. For compatibility reasons, it it is still the default algorithm in rndc-confgen, but this will be changed to hmac-sha256 in a future release. [RT #42272] 4784. [func] The use of dnssec-keygen to generate HMAC keys is deprecated in favor of tsig-keygen. dnssec-keygen will print a warning when used for this purpose. All HMAC algorithms will be removed from dnssec-keygen in a future release. [RT #42272]	2017-10-24 15:35:13 -07:00
Mark Andrews	969d923536	4783. [test] dnssec: 'check that NOTIFY is sent at the end of NSEC3 chain generation failed' required more time on some machines for the IXFR to complete. [RT #46388]	2017-10-25 09:21:14 +11:00
Mark Andrews	6b8e4d6e69	4782. [test] dnssec: 'checking positive and negative validation with negative trust anchors' required more time to complete on some machines. [RT #46386]	2017-10-25 09:13:05 +11:00
Michał Kępień	a94d68ce43	[master] Remove REQUIRE preventing change 4592 from working Change 4592 was supposed to replace a REQUIRE with a conditional return. While the latter was added, the former was not removed. Remove the relevant REQUIRE to fix RT #43822 for good.	2017-10-24 21:11:31 +02:00
Evan Hunt	7810817b71	[master] update B.ROOT-SERVERS.NET	2017-10-24 09:17:08 -07:00
Mark Andrews	b49042a6a5	report test number	2017-10-24 15:02:00 +11:00
Evan Hunt	b1042e011c	[master] zone "file" option was undocumented	2017-10-23 19:39:56 -07:00
Evan Hunt	0207f6ff9e	[master] omit NS from authority section if it was in answer 4780. [bug] When answering ANY queries, don't include the NS RRset in the authority section if it was already in the answer section. [RT #44543]	2017-10-23 19:16:27 -07:00
Mark Andrews	65f8b51893	remove named.memstats and named.run	2017-10-24 12:51:03 +11:00
Mark Andrews	5bead588b7	report if named.run or named.memstats not removed after successful test	2017-10-24 12:45:13 +11:00
Mark Andrews	3f2e5f840a	update	2017-10-24 10:41:13 +11:00
Mark Andrews	c9438ee2e0	4779. [bug] Expire NTA at the start of the second. Don't update the expiry value if the record has already expired after a successful check. [RT #46368]	2017-10-24 09:54:25 +11:00
Mark Andrews	a59d687db4	4778. [test] Improve synth-from-dnssec testing. [RT #46352 ]	2017-10-24 09:49:07 +11:00
Evan Hunt	89636d8f30	[master] clean up a redundancy 4777. [cleanup] Removed a redundant call to configure_view_acl(). [RT #46369]	2017-10-23 11:11:19 -07:00
Michał Kępień	34ee1cdb56	[master] Extend hooks documentation	2017-10-23 14:17:44 +02:00
Michał Kępień	6853af8fc5	[master] Deconstify hook tables as replacing single entries is allowed	2017-10-23 14:17:07 +02:00
Tinderbox User	2e662cf514	regen master	2017-10-22 01:10:28 +00:00
Evan Hunt	321b8429f5	[master] doc nit: Base64 is capitalized and not hyphenated	2017-10-21 13:28:38 -07:00
Evan Hunt	172aa40e8f	[master] add DNS_RPZ_MAX_ZONES to OPTIONS	2017-10-21 13:27:55 -07:00
Tinderbox User	0fc861dea9	regen master	2017-10-21 01:13:05 +00:00
Evan Hunt	b284857f96	[master] mapapi should have been bumped when rbtdb changed	2017-10-20 09:39:55 -07:00
Mark Andrews	807ad469fe	use correct tag (cherry picked from commit `317330c25a`)	2017-10-20 19:06:28 +11:00
Mark Andrews	5ff48dca18	#include <inttypes.h>	2017-10-20 16:36:07 +11:00
Mark Andrews	66258ca349	4776. [bug] Improve portability of ht_test. [RT #46333 ]	2017-10-20 16:04:59 +11:00
Tinderbox User	2115e319ba	regen master	2017-10-20 01:09:53 +00:00
Tinderbox User	429a43b720	update copyright notice / whitespace	2017-10-19 23:46:02 +00:00
Tinderbox User	bf9b90f977	newcopyrights	2017-10-19 23:30:21 +00:00
Mark Andrews	d8442c1a15	s/made/may/	2017-10-20 10:29:24 +11:00
Mark Andrews	9e5439a6d8	note removal of <isc/util.h> from other header files	2017-10-20 10:25:45 +11:00
Mark Andrews	0fab171196	s/REQUIRE/ISC_REQUIRE/; include <isc/assertions.h> if ISC_REQUIRE is used; include <isc/likely.h> if ISC_{UN}LIKELY is used	2017-10-19 16:39:53 +11:00
Mark Andrews	583e355951	4775. [bug] Address Coverity warnings in ht_test.c and mem_test.c [RT #46281]	2017-10-19 13:08:31 +11:00
Mark Andrews	fe79e2efbf	4774. [bug] <isc/util.h> was incorrectly included in several header files. [RT #46311]	2017-10-19 12:26:32 +11:00
Tinderbox User	b7b8e298f6	regen master	2017-10-19 01:09:18 +00:00
Evan Hunt	d99d5249b7	[master] clarify releates notes about deprecated/ineffective options	2017-10-18 12:41:25 -07:00
Tinderbox User	208abf3fc7	regen master	2017-10-18 01:10:52 +00:00
Tinderbox User	6e87e723a4	update copyright notice / whitespace	2017-10-17 23:47:21 +00:00
Tinderbox User	4f554c2445	newcopyrights	2017-10-17 23:30:15 +00:00
Evan Hunt	30419509dd	[master] README and relnote fixes	2017-10-17 13:47:33 -07:00
Michał Kępień	2361003a88	[master] Doxygen fixes and cleanups 4773. [doc] Fixed generating Doxygen documentation for functions annotated using certain macros. Miscellaneous Doxygen-related cleanups. [RT #46276]	2017-10-17 06:56:46 +02:00
Tinderbox User	94d96121b9	regen master	2017-10-17 01:08:55 +00:00
Evan Hunt	31275c3f39	[master] fixes to release notes - some typos - call out removed features in a "Removed Features" section - mention TAT logging	2017-10-16 17:46:12 -07:00
Evan Hunt	d63943f063	[master] fixes to release notes - fixed some typos - call out feature removals in a "Removed Features" section - TAT logging	2017-10-16 17:45:08 -07:00
Tinderbox User	ebf5459c44	newcopyrights	2017-10-16 23:30:10 +00:00
Michał Kępień	9d47a267c4	[master] Regenerate presigned zone for the filter-aaaa system test [RT #46283 ] This change is only applied to master for consistency with other branches, where it is required to fix the filter-aaaa system test for builds without DNSSEC support.	2017-10-16 09:38:34 +02:00