[rt42272] stronger wording

[rt42272] also warn on use of MD5 for rndc keys
[rt42272] add a "deprecated" warning when generating hmac keys
2017-10-24 10:36:00 -07:00 · 2017-10-23 10:35:08 -07:00 · 2017-10-22 23:37:57 -07:00
236 changed files with 4477 additions and 5887 deletions
@@ -1,144 +1,3 @@
-4817.	[cleanup]	Use DNS_NAME_INITABSOLUTE and DNS_NAME_INITNONABSOLUTE.
-			[RT #45433]
-
-4816.	[bug]		Don't use a common array for storing EDNS options
-			in DiG as it could fill up. [RT #45611]
-
-4815.	[bug]		rbt_test.c:insert_and_delete needed to call
-			dns_rbt_addnode instead of dns_rbt_addname. [RT #46553]
-
-4814.	[cleanup]	Use AS_HELP_STRING for consistent help text. [RT #46521]
-
-4813.	[bug]		Address potential read after free errors from
-			query_synthnodata, query_synthwildcard and
-			query_synthnxdomain. [RT #46547]
-
-4812.	[bug]		Minor improvements to stability and consistency of code
-			handling managed keys. [RT #46468]
-
-4811.	[bug]		Revert api changes to use <isc/buffer.h> inline
-			macros.  Provide a alternative mechanism to turn
-			on the use of inline macros when building BIND.
-			[RT #46520]
-
-4810.	[test]		The chain system test failed if the IPv6 interfaces
-			were not configured. [RT #46508]
-
-	--- 9.12.0b2 released ---
-
-4809.	[port]		Check at configure time whether -latomic is needed
-			for stdatomic.h. [RT #46324]
-
-4808.	[bug]		Properly test for zlib.h. [RT #46504]
-
-4807.	[cleanup]	isc_rng_randombytes() returns a specified number of
-			bytes from the PRNG; this is now used instead of
-			calling isc_rng_random() multiple times. [RT #46230]
-
-4806.	[func]		Log messages related to loading of zones are now
-			directed to the "zoneload" logging category.
-			[RT #41640]
-
-4805.	[bug]		TCP4Active and TCP6Active weren't being updated
-			correctly. [RT #46454]
-
-4804.	[port]		win32: access() does not work on directories as
-			required by POSIX.  Supply a alternative in
-			isc_file_isdirwritable. [RT #46394]
-
-4803.	[placeholder]
-
-4802.	[test]		Refactor mkeys system test to make it quicker and more
-			reliable. [RT #45293]
-
-4801.	[func]		'dnssec-lookaside auto;' and 'dnssec-lookaside .
-			trust-anchor dlv.isc.org;' now elicit warnings rather
-			than being fatal configuration errors. [RT #46410]
-
-4800.	[bug]		When processing delzone, write one zone config per
-			line to the NZF. [RT #46323]
-
-4799.	[cleanup]	Improve clarity of keytable unit tests. [RT #46407]
-
-4798.	[func]		Keys specified in "managed-keys" statements
-			are tagged as "initializing" until they have been
-			updated by a key refresh query. If initialization
-			fails it will be visible from "rndc secroots".
-			[RT #46267]
-
-4797.	[func]		Removed "isc-hmac-fixup", as the versions of BIND that
-			had the bug it worked around are long past end of
-			life. [RT #46411]
-
-4796.	[bug]		Increase the maximum configurable TCP keepalive
-			timeout to 65535. [RT #44710]
-
-4795.	[func]		A new statistics counter has been added to track
-			priming queries. [RT #46313]
-
-4794.	[func]		"dnssec-checkds -s" specifies a file from which
-			to read a DS set rather than querying the parent.
-			[RT #44667]
-
-4793.	[bug]		nsupdate -[46] could overflow the array of server
-			addresses. [RT #46402]
-
-4792.	[bug]		Fix map file header correctness check. [RT #38418]
-
-4791.	[doc]		Fixed outdated documentation about export libraries.
-			[RT #46341]
-
-4790.	[bug]		nsupdate could trigger a require when sending a
-			update to the second address of the server.
-			[RT #45731]
-
-4789.	[cleanup]	Check writability of new-zones-directory. [RT #46308]
-
-4788.	[cleanup]	When using "update-policy local", log a warning
-			when an update matching the session key is received
-			from a remote host. [RT #46213]
-
-4787.	[cleanup]	Turn nsec3param_salt_totext() into a public function,
-			dns_nsec3param_salttotext(), and add unit tests for it.
-			[RT #46289]
-
-4786.	[func]		The "filter-aaaa-on-v4" and "filter-aaaa-on-v6"
-			options are no longer conditionally compiled.
-			[RT #46340]
-
-4785.	[func]		The hmac-md5 algorithm is no longer recommended for
-			use with RNDC keys.  The default in rndc-confgen
-			is now hmac-sha256. [RT #42272]
-
-4784.	[func]		The use of dnssec-keygen to generate HMAC keys is
-			deprecated in favor of tsig-keygen.  dnssec-keygen
-			will print a warning when used for this purpose.
-			All HMAC algorithms will be removed from
-			dnssec-keygen in a future release. [RT #42272]
-
-4783.	[test]		dnssec: 'check that NOTIFY is sent at the end of
-			NSEC3 chain generation failed' required more time
-			on some machines for the IXFR to complete. [RT #46388]
-
-4782.	[test]		dnssec: 'checking positive and negative validation
-			with negative trust anchors' required more time to
-			complete on some machines. [RT #46386]
-
-4781.	[maint]		B.ROOT-SERVERS.NET is now 199.9.14.201. [RT #45889]
-
-4780.	[bug]		When answering ANY queries, don't include the NS
-			RRset in the authority section if it was already
-			in the answer section. [RT #44543]
-
-4779.	[bug]		Expire NTA at the start of the second. Don't update
-			the expiry value if the record has already expired
-			after a successful check. [RT #46368]
-
-4778.	[test]		Improve synth-from-dnssec testing. [RT #46352]
-
-4777.	[cleanup]	Removed a redundant call to configure_view_acl().
-			[RT #46369]
-
 4776.	[bug]		Improve portability of ht_test. [RT #46333]

 4775.	[bug]		Address Coverity warnings in ht_test.c and mem_test.c
@@ -257,7 +116,7 @@
 			- Removed DLV key from bind.keys
 			- No longer use ISC DLV by default in delv
 			- "dnssec-lookaside auto" and configuration of
-			  "dnssec-lookaide" with dlv.isc.org as the trust
+			  "dnssec-lookaide" with dlv.isc.org as trust
 			  anchor are both now fatal errors.
 			[RT #46155]

@@ -397,8 +256,8 @@
 4713.	[func]		Added support for the DNS Response Policy Service
 			(DNSRPS) API, which allows named to use an external
 			response policy daemon when built with
-			"configure --enable-dnsrps". Thanks to Farsight
-			Security. [RT #43376]
+			"configure --enable-dnsrps".  Thanks to Vernon
+			Schryver and Farsight Security. [RT #43376]

 4712.	[bug]		"dig +domain" and "dig +search" didn't retain the
 			search domain when retrying with TCP. [RT #45547]
@@ -22,7 +22,4 @@ Setting                   Description
                          Increase the maximum number of configurable
 -DNS_RPZ_MAX_ZONES=64     response policy zones from 32 to 64; this is the
                          highest possible setting
-                          Disable the use of inline functions to implement
-DISC_BUFFER_USEINLINE=0  the isc_buffer API: this reduces performance but
-                          may be useful when debugging

@@ -21,4 +21,3 @@ Some of these settings are:
 |`-DCHECK_LOCAL=0`|Don't check out-of-zone addresses in `named-checkzone`|
 |`-DNS_RUN_PID_DIR=0`|Create default PID files in `${localstatedir}/run` rather than `${localstatedir}/run/named/`|
 |`-DNS_RPZ_MAX_ZONES=64`|Increase the maximum number of configurable response policy zones from 32 to 64; this is the highest possible setting|
-|`-DISC_BUFFER_USEINLINE=0`|Disable the use of inline functions to implement the `isc_buffer` API: this reduces performance but may be useful when debugging |
@@ -117,11 +117,7 @@ include:
  * 'named-checkconf -l' lists zones found in named.conf.
  * Added support for the EDNS Padding and Keepalive options.
  * 'new-zones-directory' option sets the location where the configuration
-    data for zones added by rndc addzone is stored.
-  * The default key algorithm in rndc-confgen is now hmac-sha256.
-  * filter-aaaa-on-v4 and filter-aaaa-on-v6 options are now available by
-    default without a configure option.
-  * The obsolete isc-hmac-fixup command has been removed.
+    data for zones added by rndc addzone is stored

 Building BIND

@@ -131,8 +127,8 @@ on many versions of Linux and UNIX, including RedHat, Fedora, Debian,
 Ubuntu, SuSE, Slackware, FreeBSD, NetBSD, OpenBSD, Mac OS X, Solaris,
 HP-UX, AIX, SCO OpenServer, and OpenWRT.

-BIND is also available for Windows 2008 and higher. See win32utils/
-readme1st.txt for details on building for Windows systems.
+BIND is also available for Windows XP, 2003, 2008, and higher. See
+win32utils/readme1st.txt for details on building for Windows systems.

 To build on a UNIX or Linux system, use:

@@ -129,11 +129,7 @@ include:
 * `'named-checkconf -l'` lists zones found in `named.conf`.
 * Added support for the EDNS Padding and Keepalive options.
 * 'new-zones-directory' option sets the location where the configuration
-  data for zones added by rndc addzone is stored.
-* The default key algorithm in `rndc-confgen` is now hmac-sha256.
-* `filter-aaaa-on-v4` and `filter-aaaa-on-v6` options are now available
-  by default without a configure option.
-* The obsolete `isc-hmac-fixup` command has been removed.
+  data for zones added by rndc addzone is stored

 ### <a name="build"/> Building BIND

@@ -143,9 +139,8 @@ many versions of Linux and UNIX, including RedHat, Fedora, Debian, Ubuntu,
 SuSE, Slackware, FreeBSD, NetBSD, OpenBSD, Mac OS X, Solaris, HP-UX, AIX,
 SCO OpenServer, and OpenWRT. 

-BIND is also available for Windows 2008 and higher.  See
-`win32utils/readme1st.txt` for details on building for Windows
-systems.
+BIND is also available for Windows XP, 2003, 2008, and higher.  See
+`win32utils/readme1st.txt` for details on building for Windows systems.

 To build on a UNIX or Linux system, use:

@@ -1,4 +1,4 @@
-.\" Copyright (C) 2001, 2003-2005, 2007, 2009, 2013-2017 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2001, 2003-2005, 2007, 2009, 2013-2016 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" This Source Code Form is subject to the terms of the Mozilla Public
 .\" License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -111,7 +111,7 @@ as directed\&.
 .PP
 \-A \fIalgorithm\fR
 .RS 4
-Specifies the algorithm to use for the TSIG key\&. Available choices are: hmac\-md5, hmac\-sha1, hmac\-sha224, hmac\-sha256, hmac\-sha384 and hmac\-sha512\&. The default is hmac\-sha256\&.
+Specifies the algorithm to use for the TSIG key\&. Available choices are: hmac\-md5, hmac\-sha1, hmac\-sha224, hmac\-sha256, hmac\-sha384 and hmac\-sha512\&. The default is hmac\-md5 or if MD5 was disabled hmac\-sha256\&.
 .RE
 .PP
 \-b \fIkeysize\fR
@@ -217,5 +217,5 @@ BIND 9 Administrator Reference Manual\&.
 \fBInternet Systems Consortium, Inc\&.\fR
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2001, 2003-2005, 2007, 2009, 2013-2017 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2001, 2003-2005, 2007, 2009, 2013-2016 Internet Systems Consortium, Inc. ("ISC")
 .br
@@ -1,11 +1,13 @@
 /*
- * Copyright (C) 2001, 2003-2005, 2007-2009, 2011, 2013, 2014, 2016, 2017  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2001, 2003-2005, 2007-2009, 2011, 2013, 2014, 2016  Internet Systems Consortium, Inc. ("ISC")
 *
 * This Source Code Form is subject to the terms of the Mozilla Public
 * License, v. 2.0. If a copy of the MPL was not distributed with this
 * file, You can obtain one at http://mozilla.org/MPL/2.0/.
 */

+/* $Id: rndc-confgen.c,v 1.7 2011/03/12 04:59:46 tbox Exp $ */
+
 /*! \file */

 /**
@@ -65,6 +67,23 @@ usage(int status) ISC_PLATFORM_NORETURN_POST;
 static void
 usage(int status) {

+#ifndef PK11_MD5_DISABLE
+	fprintf(stderr, "\
+Usage:\n\
+ %s [-a] [-b bits] [-c keyfile] [-k keyname] [-p port] [-r randomfile] \
+[-s addr] [-t chrootdir] [-u user]\n\
+  -a:		 generate just the key clause and write it to keyfile (%s)\n\
+  -A alg:	 algorithm (default hmac-md5 (deprecated and will change))\n\
+  -b bits:	 from 1 through 512, default 256; total length of the secret\n\
+  -c keyfile:	 specify an alternate key file (requires -a)\n\
+  -k keyname:	 the name as it will be used  in named.conf and rndc.conf\n\
+  -p port:	 the port named will listen on and rndc will connect to\n\
+  -r randomfile: source of random data (use \"keyboard\" for key timing)\n\
+  -s addr:	 the address to which rndc should connect\n\
+  -t chrootdir:	 write a keyfile in chrootdir as well (requires -a)\n\
+  -u user:	 set the keyfile owner to \"user\" (requires -a)\n",
+		 progname, keydef);
+#else
 	fprintf(stderr, "\
 Usage:\n\
 %s [-a] [-b bits] [-c keyfile] [-k keyname] [-p port] [-r randomfile] \
@@ -80,6 +99,7 @@ Usage:\n\
  -t chrootdir:	 write a keyfile in chrootdir as well (requires -a)\n\
  -u user:	 set the keyfile owner to \"user\" (requires -a)\n",
 		 progname, keydef);
+#endif

 	exit (status);
 }
@@ -95,6 +115,7 @@ main(int argc, char **argv) {
 	const char *randomfile = NULL;
 	const char *serveraddr = NULL;
 	dns_secalg_t alg;
+	isc_boolean_t algset = ISC_FALSE;
 	const char *algname;
 	char *p;
 	int ch;
@@ -115,7 +136,11 @@ main(int argc, char **argv) {
 	progname = program;

 	keyname = DEFAULT_KEYNAME;
+#ifndef PK11_MD5_DISABLE
+	alg = DST_ALG_HMACMD5;
+#else
 	alg = DST_ALG_HMACSHA256;
+#endif
 	serveraddr = DEFAULT_SERVER;
 	port = DEFAULT_PORT;

@@ -129,6 +154,7 @@ main(int argc, char **argv) {
 			keyonly = ISC_TRUE;
 			break;
 		case 'A':
+			algset = ISC_TRUE;
 			algname = isc_commandline_argument;
 			alg = alg_fromtext(algname);
 			if (alg == DST_ALG_UNKNOWN)
@@ -202,9 +228,17 @@ main(int argc, char **argv) {
 		usage(1);

 	if (alg == DST_ALG_HMACMD5) {
-		fprintf(stderr,
-			"warning: use of hmac-md5 for RNDC keys "
-			"is deprecated; hmac-sha256 is now recommended.\n");
+		if (algset) {
+			fprintf(stderr,
+				"warning: use of hmac-md5 for RNDC keys "
+				"is deprecated; hmac-sha256 is now "
+				"recommended.\n");
+		} else {
+			fprintf(stderr,
+				"warning: the default algorithm hmac-md5 "
+				"is deprecated and will be\n"
+				"changed to hmac-sha256 in a future release\n")
+		}
 	}

 	if (keysize < 0)
@@ -1,5 +1,5 @@
 <!--
- - Copyright (C) 2001, 2003-2005, 2007, 2009, 2013-2017  Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2001, 2003-2005, 2007, 2009, 2013-2016  Internet Systems Consortium, Inc. ("ISC")
 -
 - This Source Code Form is subject to the terms of the Mozilla Public
 - License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -39,7 +39,6 @@
      <year>2014</year>
      <year>2015</year>
      <year>2016</year>
-      <year>2017</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
  </docinfo>
@@ -129,7 +128,12 @@
          <para>
            Specifies the algorithm to use for the TSIG key.  Available
            choices are: hmac-md5, hmac-sha1, hmac-sha224, hmac-sha256,
-            hmac-sha384 and hmac-sha512.  The default is hmac-sha256.
+            hmac-sha384 and hmac-sha512.  The default is hmac-md5, or
+            if MD5 was disabled at compile time, hmac-sha256.
+          </para>
+          <para>
+            Note: Use of hmac-md5 is no longer recommended, and the default
+            value will be changed to hmac-sha256 in a future release.
          </para>
        </listitem>
      </varlistentry>
@@ -1,6 +1,6 @@
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2001, 2003-2005, 2007, 2009, 2013-2017 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2001, 2003-2005, 2007, 2009, 2013-2016 Internet Systems Consortium, Inc. ("ISC")
 - 
 - This Source Code Form is subject to the terms of the Mozilla Public
 - License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -113,7 +113,8 @@
          <p>
            Specifies the algorithm to use for the TSIG key.  Available
            choices are: hmac-md5, hmac-sha1, hmac-sha224, hmac-sha256,
-            hmac-sha384 and hmac-sha512.  The default is hmac-sha256.
+            hmac-sha384 and hmac-sha512.  The default is hmac-md5 or
+            if MD5 was disabled hmac-sha256.
          </p>
        </dd>
 <dt><span class="term">-b <em class="replaceable"><code>keysize</code></em></span></dt>
@@ -469,11 +469,6 @@ Convert [do not convert] puny code on output\&. This requires IDN SUPPORT to hav
 Ignore truncation in UDP responses instead of retrying with TCP\&. By default, TCP retries are performed\&.
 .RE
 .PP
-\fB+[no]keepalive\fR
-.RS 4
-Send [or do not send] an EDNS Keepalive option\&.
-.RE
-.PP
 \fB+[no]keepopen\fR
 .RS 4
 Keep the TCP socket open between queries and reuse it rather than creating a new TCP socket for each lookup\&. The default is
@@ -414,8 +414,14 @@ isdotlocal(dns_message_t *msg) {
 	isc_result_t result;
 	static unsigned char local_ndata[] = { "\005local\0" };
 	static unsigned char local_offsets[] = { 0, 6 };
-	static dns_name_t local =
-		DNS_NAME_INITABSOLUTE(local_ndata, local_offsets);
+	static dns_name_t local = {
+		DNS_NAME_MAGIC,
+		local_ndata, 7, 2,
+		DNS_NAMEATTR_READONLY | DNS_NAMEATTR_ABSOLUTE,
+		local_offsets, NULL,
+		{(void *)-1, (void *)-1},
+		{NULL, NULL}
+	};

 	for (result = dns_message_firstname(msg, DNS_SECTION_QUESTION);
 	     result == ISC_R_SUCCESS;
@@ -784,15 +784,6 @@
 	  </listitem>
 	</varlistentry>

-	<varlistentry>
-	  <term><option>+[no]keepalive</option></term>
-	  <listitem>
-	    <para>
-	      Send [or do not send] an EDNS Keepalive option.
-	    </para>
-	  </listitem>
-	</varlistentry>
-
 	<varlistentry>
 	  <term><option>+[no]keepopen</option></term>
 	  <listitem>
@@ -628,12 +628,6 @@
 	      with TCP.  By default, TCP retries are performed.
 	    </p>
 	  </dd>
-<dt><span class="term"><code class="option">+[no]keepalive</code></span></dt>
-<dd>
-	    <p>
-	      Send [or do not send] an EDNS Keepalive option.
-	    </p>
-	  </dd>
 <dt><span class="term"><code class="option">+[no]keepopen</code></span></dt>
 <dd>
 	    <p>
@@ -655,41 +655,6 @@ make_empty_lookup(void) {
 	return (looknew);
 }

-#define EDNSOPT_OPTIONS 100U
-
-static void
-cloneopts(dig_lookup_t *looknew, dig_lookup_t *lookold) {
-	size_t len = sizeof(looknew->ednsopts[0]) * EDNSOPT_OPTIONS;
-	size_t i;
-	looknew->ednsopts = isc_mem_allocate(mctx, len);
-	if (looknew->ednsopts == NULL)
-		fatal("out of memory");
-	for (i = 0; i < EDNSOPT_OPTIONS; i++) {
-		looknew->ednsopts[i].code = 0;
-		looknew->ednsopts[i].length = 0;
-		looknew->ednsopts[i].value = NULL;
-	}
-	looknew->ednsoptscnt = 0;
-	if (lookold == NULL || lookold->ednsopts == NULL)
-		return;
-
-	for (i = 0; i < lookold->ednsoptscnt; i++) {
-		len = lookold->ednsopts[i].length;
-		if (len != 0) {
-			INSIST(lookold->ednsopts[i].value != NULL);
-			looknew->ednsopts[i].value =
-				 isc_mem_allocate(mctx, len);
-			if (looknew->ednsopts[i].value == NULL)
-				fatal("out of memory");
-			memmove(looknew->ednsopts[i].value,
-				lookold->ednsopts[i].value, len);
-		}
-		looknew->ednsopts[i].code = lookold->ednsopts[i].code;
-		looknew->ednsopts[i].length = len;
-	}
-	looknew->ednsoptscnt = lookold->ednsoptscnt;
-}
-
 /*%
 * Clone a lookup, perhaps copying the server list.  This does not clone
 * the query list, since it will be regenerated by the setup_lookup()
@@ -735,12 +700,8 @@ clone_lookup(dig_lookup_t *lookold, isc_boolean_t servers) {
 	looknew->seenbadcookie = lookold->seenbadcookie;
 	looknew->badcookie = lookold->badcookie;
 	looknew->cookie = lookold->cookie;
-	if (lookold->ednsopts != NULL) {
-		cloneopts(looknew, lookold);
-	} else {
-		looknew->ednsopts = NULL;
-		looknew->ednsoptscnt = 0;
-	}
+	looknew->ednsopts = lookold->ednsopts;
+	looknew->ednsoptscnt = lookold->ednsoptscnt;
 	looknew->ednsneg = lookold->ednsneg;
 	looknew->padding = lookold->padding;
 	looknew->mapped = lookold->mapped;
@@ -1356,6 +1317,13 @@ setup_libs(void) {
 	check_result(result, "isc_mutex_init");
 }

+/*
+ * Array of up to 100 options configured by +ednsopt
+ */
+#define EDNSOPT_OPTIONS 100U
+static dns_ednsopt_t ednsopts[EDNSOPT_OPTIONS];
+static unsigned char ednsoptscnt = 0;
+
 typedef struct dig_ednsoptname {
 	isc_uint32_t code;
 	const char  *name;
@@ -1387,7 +1355,7 @@ save_opt(dig_lookup_t *lookup, char *code, char *value) {
 	isc_boolean_t found = ISC_FALSE;
 	unsigned int i;

-	if (lookup->ednsoptscnt >= EDNSOPT_OPTIONS)
+	if (ednsoptscnt == EDNSOPT_OPTIONS)
 		fatal("too many ednsopts");

 	for (i = 0; i < N_EDNS_OPTNAMES; i++) {
@@ -1404,16 +1372,9 @@ save_opt(dig_lookup_t *lookup, char *code, char *value) {
 			fatal("bad edns code point: %s", code);
 	}

-	if (lookup->ednsopts == NULL) {
-		cloneopts(lookup, NULL);
-	}
-
-	if (lookup->ednsopts[lookup->ednsoptscnt].value != NULL)
-		isc_mem_free(mctx, lookup->ednsopts[lookup->ednsoptscnt].value);
-
-	lookup->ednsopts[lookup->ednsoptscnt].code = num;
-	lookup->ednsopts[lookup->ednsoptscnt].length = 0;
-	lookup->ednsopts[lookup->ednsoptscnt].value = NULL;
+	ednsopts[ednsoptscnt].code = num;
+	ednsopts[ednsoptscnt].length = 0;
+	ednsopts[ednsoptscnt].value = NULL;

 	if (value != NULL) {
 		char *buf;
@@ -1423,13 +1384,14 @@ save_opt(dig_lookup_t *lookup, char *code, char *value) {
 		isc_buffer_init(&b, buf, (unsigned int) strlen(value)/2 + 1);
 		result = isc_hex_decodestring(value, &b);
 		check_result(result, "isc_hex_decodestring");
-		lookup->ednsopts[lookup->ednsoptscnt].value =
-						 isc_buffer_base(&b);
-		lookup->ednsopts[lookup->ednsoptscnt].length =
-						 isc_buffer_usedlength(&b);
+		ednsopts[ednsoptscnt].value = isc_buffer_base(&b);
+		ednsopts[ednsoptscnt].length = isc_buffer_usedlength(&b);
 	}

+	if (lookup->ednsoptscnt == 0)
+		lookup->ednsopts = &ednsopts[ednsoptscnt];
 	lookup->ednsoptscnt++;
+	ednsoptscnt++;
 }

 /*%
@@ -1608,15 +1570,6 @@ destroy_lookup(dig_lookup_t *lookup) {
 	if (lookup->ecs_addr != NULL)
 		isc_mem_free(mctx, lookup->ecs_addr);

-	if (lookup->ednsopts != NULL) {
-		size_t i;
-		for (i = 0; i < EDNSOPT_OPTIONS; i++) {
-			if (lookup->ednsopts[i].value != NULL)
-				isc_mem_free(mctx, lookup->ednsopts[i].value);
-		}
-		isc_mem_free(mctx, lookup->ednsopts);
-	}
-
 	isc_mem_free(mctx, lookup);
 }

@@ -4174,6 +4127,12 @@ destroy_libs(void) {
 	debug("Removing log context");
 	isc_log_destroy(&lctx);

+	while (ednsoptscnt > 0U) {
+		ednsoptscnt--;
+		if (ednsopts[ednsoptscnt].value != NULL)
+			isc_mem_free(mctx, ednsopts[ednsoptscnt].value);
+	}
+
 	debug("Destroy memory");
 	if (memdebugging != 0)
 		isc_mem_stats(mctx, stderr);
@@ -62,15 +62,12 @@ may be preferable to direct use of
 .RS 4
 Selects the cryptographic algorithm\&. For DNSSEC keys, the value of
 \fBalgorithm\fR
-must be one of RSAMD5, RSASHA1, DSA, NSEC3RSASHA1, NSEC3DSA, RSASHA256, RSASHA512, ECCGOST, ECDSAP256SHA256, ECDSAP384SHA384, ED25519 or ED448\&. For TKEY, the value must be DH (Diffie Hellman); specifying his value will automatically set the
+must be one of RSAMD5, RSASHA1, DSA, NSEC3RSASHA1, NSEC3DSA, RSASHA256, RSASHA512, ECCGOST, ECDSAP256SHA256, ECDSAP384SHA384, ED25519 or ED448\&. For TSIG/TKEY keys, the value must be one of DH (Diffie Hellman), HMAC\-MD5, HMAC\-SHA1, HMAC\-SHA224, HMAC\-SHA256, HMAC\-SHA384, or HMAC\-SHA512; specifying any of these algorithms will automatically set the
 \fB\-T KEY\fR
-option as well\&.
-.sp
-TSIG keys can also be generated by setting the value to one of HMAC\-MD5, HMAC\-SHA1, HMAC\-SHA224, HMAC\-SHA256, HMAC\-SHA384, or HMAC\-SHA512\&. As with DH, specifying these values will automatically set
-\fB\-T KEY\fR\&. Note, however, that
+option as well\&. (Note:
 \fBtsig\-keygen\fR
-produces TSIG keys in a more useful format\&. These algorithms have been deprecated in
-\fBdnssec\-keygen\fR, and will be removed in a future release\&.
+produces TSIG keys in a more useful format than
+\fBdnssec\-keygen\fR\&.)
 .sp
 These values are case insensitive\&. In some cases, abbreviations are supported, such as ECDSA256 for ECDSAP256SHA256 and ECDSA384 for ECDSAP384SHA384\&. If RSASHA1 or DSA is specified along with the
 \fB\-3\fR
@@ -78,7 +75,7 @@ option, then NSEC3RSASHA1 or NSEC3DSA will be used instead\&.
 .sp
 As of BIND 9\&.12\&.0, this option is mandatory except when using the
 \fB\-S\fR
-option, which copies the algorithm from the predecessor key\&. Previously, the default for newly generated keys was RSASHA1\&.
+option (which copies the algorithm from the predecessor key)\&. Previously, the default for newly generated keys was RSASHA1\&.
 .RE
 .PP
 \-b \fIkeysize\fR
@@ -122,12 +122,12 @@
 	    of <option>algorithm</option> must be one of RSAMD5, RSASHA1,
 	    DSA, NSEC3RSASHA1, NSEC3DSA, RSASHA256, RSASHA512, ECCGOST,
 	    ECDSAP256SHA256, ECDSAP384SHA384, ED25519 or ED448.  For
-	    TKEY, the value must be DH (Diffie Hellman); specifying
-	    his value will automatically set the <option>-T KEY</option>
-	    option as well.
+	    TKEY and SIG(0) keys, the value must be DH (Diffie Hellman);
+	    specifying this value will automatically set the
+	    <option>-T KEY</option> option as well.
 	  </para>
 	  <para>
-	    TSIG keys can also be generated by setting the value to
+	    TSIG keys can also by generated by setting the value to
 	    one of HMAC-MD5, HMAC-SHA1, HMAC-SHA224, HMAC-SHA256,
 	    HMAC-SHA384, or HMAC-SHA512.  As with DH, specifying these
 	    values will automatically set <option>-T KEY</option>. Note,
@@ -103,19 +103,12 @@
 	    of <code class="option">algorithm</code> must be one of RSAMD5, RSASHA1,
 	    DSA, NSEC3RSASHA1, NSEC3DSA, RSASHA256, RSASHA512, ECCGOST,
 	    ECDSAP256SHA256, ECDSAP384SHA384, ED25519 or ED448.  For
-	    TKEY, the value must be DH (Diffie Hellman); specifying
-	    his value will automatically set the <code class="option">-T KEY</code>
-	    option as well.
-	  </p>
-	  <p>
-	    TSIG keys can also be generated by setting the value to
-	    one of HMAC-MD5, HMAC-SHA1, HMAC-SHA224, HMAC-SHA256,
-	    HMAC-SHA384, or HMAC-SHA512.  As with DH, specifying these
-	    values will automatically set <code class="option">-T KEY</code>. Note,
-	    however, that <span class="command"><strong>tsig-keygen</strong></span> produces TSIG keys
-	    in a more useful format. These algorithms have been deprecated
-	    in <span class="command"><strong>dnssec-keygen</strong></span>, and will be removed in a
-	    future release.
+            TSIG/TKEY keys, the value must be one of DH (Diffie Hellman),
+            HMAC-MD5, HMAC-SHA1, HMAC-SHA224, HMAC-SHA256, HMAC-SHA384,
+            or HMAC-SHA512; specifying any of these algorithms will
+            automatically set the <code class="option">-T KEY</code> option as well.
+            (Note: <span class="command"><strong>tsig-keygen</strong></span> produces TSIG keys in a
+            more useful format than <span class="command"><strong>dnssec-keygen</strong></span>.)
 	  </p>
 	  <p>
 	    These values are case insensitive. In some cases, abbreviations
@@ -126,8 +119,8 @@
 	  </p>
 	  <p>
 	    As of BIND 9.12.0, this option is mandatory except when using
-	    the <code class="option">-S</code> option, which copies the algorithm from
-	    the predecessor key.  Previously, the default for newly
+	    the <code class="option">-S</code> option (which copies the algorithm from
+	    the predecessor key).  Previously, the default for newly
 	    generated keys was RSASHA1.
 	  </p>
 	</dd>
@@ -9,7 +9,7 @@

 <xsl:stylesheet xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns="http://www.w3.org/1999/xhtml" version="1.0">
  <xsl:output method="html" indent="yes" version="4.0"/>
-  <xsl:template match="statistics[@version=&quot;3.11&quot;]">
+  <xsl:template match="statistics[@version=&quot;3.10&quot;]">
    <html>
      <head>
        <xsl:if test="system-property('xsl:vendor')!='Transformiix'">
@@ -14,7 +14,7 @@ static char xslmsg[] =
 	"\n"
 	"<xsl:stylesheet xmlns:xsl=\"http://www.w3.org/1999/XSL/Transform\" xmlns=\"http://www.w3.org/1999/xhtml\" version=\"1.0\">\n"
 	" <xsl:output method=\"html\" indent=\"yes\" version=\"4.0\"/>\n"
-	" <xsl:template match=\"statistics[@version=&quot;3.11&quot;]\">\n"
+	" <xsl:template match=\"statistics[@version=&quot;3.10&quot;]\">\n"
 	" <html>\n"
 	" <head>\n"
 	" <xsl:if test=\"system-property('xsl:vendor')!='Transformiix'\">\n"
@@ -156,10 +156,12 @@ options {\n\
 #	fetch-glue <obsolete>;\n\
 	fetch-quota-params 100 0.1 0.3 0.7;\n\
 	fetches-per-server 0;\n\
-	fetches-per-zone 0;\n\
-	filter-aaaa-on-v4 no;\n\
+	fetches-per-zone 0;\n"
+#ifdef ALLOW_FILTER_AAAA
+"	filter-aaaa-on-v4 no;\n\
 	filter-aaaa-on-v6 no;\n\
 	filter-aaaa { any; };\n"
+#endif
 #ifdef HAVE_GEOIP
 "	geoip-use-ecs yes;\n"
 #endif
@@ -456,8 +456,9 @@ control_recvmessage(isc_task_t *task, isc_event_t *event) {
 	 */
 	if (conn->nonce == 0) {
 		while (conn->nonce == 0) {
-			isc_rng_randombytes(server->sctx->rngctx, &conn->nonce,
-					    sizeof(conn->nonce));
+			isc_uint16_t r1 = isc_rng_random(server->sctx->rngctx);
+			isc_uint16_t r2 = isc_rng_random(server->sctx->rngctx);
+			conn->nonce = (r1 << 16) | r2;
 		}
 		eresult = ISC_R_SUCCESS;
 	} else
@@ -154,7 +154,11 @@
 #define EXCLBUFFERS 4096
 #endif /* TUNE_LARGE */

-#define MAX_TCP_TIMEOUT 65535
+#ifdef WIN32
+#define DIR_PERM_OK W_OK
+#else
+#define DIR_PERM_OK W_OK|X_OK
+#endif

 /*%
 * Check an operation for failure.  Assumes that the function
@@ -511,44 +515,32 @@ nzf_append(dns_view_t *view, const cfg_obj_t *zconfig);
 */
 static isc_result_t
 configure_view_acl(const cfg_obj_t *vconfig, const cfg_obj_t *config,
-		   const cfg_obj_t *gconfig, const char *aclname,
-		   const char *acltuplename, cfg_aclconfctx_t *actx,
-		   isc_mem_t *mctx, dns_acl_t **aclp)
+		   const char *aclname, const char *acltuplename,
+		   cfg_aclconfctx_t *actx, isc_mem_t *mctx, dns_acl_t **aclp)
 {
 	isc_result_t result;
-	const cfg_obj_t *maps[4];
+	const cfg_obj_t *maps[3];
 	const cfg_obj_t *aclobj = NULL;
 	int i = 0;

-	if (*aclp != NULL) {
+	if (*aclp != NULL)
 		dns_acl_detach(aclp);
-	}
-	if (vconfig != NULL) {
+	if (vconfig != NULL)
 		maps[i++] = cfg_tuple_get(vconfig, "options");
-	}
 	if (config != NULL) {
 		const cfg_obj_t *options = NULL;
 		(void)cfg_map_get(config, "options", &options);
-		if (options != NULL) {
+		if (options != NULL)
 			maps[i++] = options;
-		}
-	}
-	if (gconfig != NULL) {
-		const cfg_obj_t *options = NULL;
-		(void)cfg_map_get(gconfig, "options", &options);
-		if (options != NULL) {
-			maps[i++] = options;
-		}
 	}
 	maps[i] = NULL;

 	(void)named_config_get(maps, aclname, &aclobj);
-	if (aclobj == NULL) {
+	if (aclobj == NULL)
 		/*
 		 * No value available.	*aclp == NULL.
 		 */
 		return (ISC_R_SUCCESS);
-	}

 	if (acltuplename != NULL) {
 		/*
@@ -811,11 +803,6 @@ dstkey_fromconfig(const cfg_obj_t *vconfig, const cfg_obj_t *key,
 	return (result);
 }

-/*
- * Load keys from configuration into key table. If 'keyname' is specified,
- * only load keys matching that name. If 'managed' is true, load the key as
- * an initializing key.
- */
 static isc_result_t
 load_view_keys(const cfg_obj_t *keys, const cfg_obj_t *vconfig,
 	       dns_view_t *view, isc_boolean_t managed,
@@ -831,14 +818,12 @@ load_view_keys(const cfg_obj_t *keys, const cfg_obj_t *vconfig,

 	for (elt = cfg_list_first(keys);
 	     elt != NULL;
-	     elt = cfg_list_next(elt))
-	{
+	     elt = cfg_list_next(elt)) {
 		keylist = cfg_listelt_value(elt);

 		for (elt2 = cfg_list_first(keylist);
 		     elt2 != NULL;
-		     elt2 = cfg_list_next(elt2))
-		{
+		     elt2 = cfg_list_next(elt2)) {
 			key = cfg_listelt_value(elt2);
 			result = dstkey_fromconfig(vconfig, key, managed,
 						   &dstkey, mctx);
@@ -846,9 +831,8 @@ load_view_keys(const cfg_obj_t *keys, const cfg_obj_t *vconfig,
 				result = ISC_R_SUCCESS;
 				continue;
 			}
-			if (result != ISC_R_SUCCESS) {
+			if (result != ISC_R_SUCCESS)
 				goto cleanup;
-			}

 			/*
 			 * If keyname was specified, we only add that key.
@@ -860,27 +844,17 @@ load_view_keys(const cfg_obj_t *keys, const cfg_obj_t *vconfig,
 				continue;
 			}

-			/*
-			 * This key is taken from the configuration, so
-			 * if it's a managed key then it's an
-			 * initializing key; that's why 'managed'
-			 * is duplicated below.
-			 */
-			CHECK(dns_keytable_add2(secroots, managed,
-						managed, &dstkey));
+			CHECK(dns_keytable_add(secroots, managed, &dstkey));
 		}
 	}

 cleanup:
-	if (dstkey != NULL) {
+	if (dstkey != NULL)
 		dst_key_free(&dstkey);
-	}
-	if (secroots != NULL) {
+	if (secroots != NULL)
 		dns_keytable_detach(&secroots);
-	}
-	if (result == DST_R_NOCRYPTO) {
+	if (result == DST_R_NOCRYPTO)
 		result = ISC_R_SUCCESS;
-	}
 	return (result);
 }

@@ -1050,7 +1024,7 @@ configure_view_dnsseckeys(dns_view_t *view, const cfg_obj_t *vconfig,
 	}

 	/*
-	 * Add key zone for managed keys.
+	 * Add key zone for managed-keys.
 	 */
 	obj = NULL;
 	(void)named_config_get(maps, "managed-keys-directory", &obj);
@@ -1065,7 +1039,7 @@ configure_view_dnsseckeys(dns_view_t *view, const cfg_obj_t *vconfig,
 		goto cleanup;

 	} else if (directory != NULL) {
-		if (!isc_file_isdirwritable(directory)) {
+		if (access(directory, DIR_PERM_OK) != 0) {
 			isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 				      NAMED_LOGMODULE_SERVER, ISC_LOG_ERROR,
 				      "managed-keys-directory '%s' "
@@ -1074,7 +1048,6 @@ configure_view_dnsseckeys(dns_view_t *view, const cfg_obj_t *vconfig,
 			goto cleanup;
 		}
 	}
-
 	CHECK(add_keydata_zone(view, directory, named_g_mctx));

  cleanup:
@@ -3350,7 +3323,7 @@ create_empty_zone(dns_zone_t *zone, dns_name_t *name, dns_view_t *view,
 		viewname = "";
 	}
 	dns_name_format(name, namebuf, sizeof(namebuf));
-	isc_log_write(named_g_lctx, DNS_LOGCATEGORY_ZONELOAD,
+	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 		      NAMED_LOGMODULE_SERVER, ISC_LOG_INFO,
 		      "automatic empty zone%s%s: %s",
 		      sep, viewname, namebuf);
@@ -3718,9 +3691,13 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
 	CHECKM(named_config_getport(config, &port), "port");
 	dns_view_setdstport(view, port);

-	CHECK(configure_view_acl(vconfig, config, named_g_config,
-				 "allow-query", NULL, actx,
+	CHECK(configure_view_acl(vconfig, config, "allow-query", NULL, actx,
 				 named_g_mctx, &view->queryacl));
+	if (view->queryacl == NULL) {
+		CHECK(configure_view_acl(NULL, named_g_config, "allow-query",
+					 NULL, actx, named_g_mctx,
+					 &view->queryacl));
+	}

 	/*
 	 * Make the list of response policy zone names for a view that
@@ -4603,16 +4580,11 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,

 	/*
 	 * Configure the "match-clients" and "match-destinations" ACL.
-	 * (These are only meaningful at the view level, but 'config'
-	 * must be passed so that named ACLs defined at the global level
-	 * can be retrieved.)
 	 */
-	CHECK(configure_view_acl(vconfig, config, NULL, "match-clients",
-				 NULL, actx, named_g_mctx,
-				 &view->matchclients));
-	CHECK(configure_view_acl(vconfig, config, NULL, "match-destinations",
-				 NULL, actx, named_g_mctx,
-				 &view->matchdestinations));
+	CHECK(configure_view_acl(vconfig, config, "match-clients", NULL, actx,
+				 named_g_mctx, &view->matchclients));
+	CHECK(configure_view_acl(vconfig, config, "match-destinations", NULL,
+				 actx, named_g_mctx, &view->matchdestinations));

 	/*
 	 * Configure the "match-recursive-only" option.
@@ -4681,85 +4653,71 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
 	INSIST(result == ISC_R_SUCCESS);
 	view->trust_anchor_telemetry = cfg_obj_asboolean(obj);

-	CHECK(configure_view_acl(vconfig, config, named_g_config,
-				 "allow-query-cache-on", NULL, actx,
-				 named_g_mctx, &view->cacheonacl));
 	/*
-	 * Set "allow-query-cache", "allow-recursion", and
-	 * "allow-recursion-on" acls if configured in named.conf.
-	 * (Ignore the global defaults for now, because these ACLs
-	 * can inherit from each other when only some of them set at
-	 * the options/view level.)
+	 * Set "allow-query-cache", "allow-query-cache-on",
+	 * "allow-recursion", and "allow-recursion-on" acls if
+	 * configured in named.conf.
 	 */
-	CHECK(configure_view_acl(vconfig, config, NULL, "allow-query-cache",
-				 NULL, actx, named_g_mctx, &view->cacheacl));
-
-	if (strcmp(view->name, "_bind") != 0 &&
-	    view->rdclass != dns_rdataclass_chaos)
-	{
-		CHECK(configure_view_acl(vconfig, config, NULL,
-					 "allow-recursion", NULL, actx,
-					 named_g_mctx, &view->recursionacl));
-		CHECK(configure_view_acl(vconfig, config, NULL,
-					 "allow-recursion-on", NULL, actx,
-					 named_g_mctx, &view->recursiononacl));
+	CHECK(configure_view_acl(vconfig, config, "allow-query-cache", NULL,
+				 actx, named_g_mctx, &view->cacheacl));
+	CHECK(configure_view_acl(vconfig, config, "allow-query-cache-on", NULL,
+				 actx, named_g_mctx, &view->cacheonacl));
+	if (view->cacheonacl == NULL)
+		CHECK(configure_view_acl(NULL, named_g_config,
+					 "allow-query-cache-on", NULL, actx,
+					 named_g_mctx, &view->cacheonacl));
+	if (strcmp(view->name, "_bind") != 0) {
+		CHECK(configure_view_acl(vconfig, config, "allow-recursion",
+					 NULL, actx, named_g_mctx,
+					 &view->recursionacl));
+		CHECK(configure_view_acl(vconfig, config, "allow-recursion-on",
+					 NULL, actx, named_g_mctx,
+					 &view->recursiononacl));
 	}

-	if (view->recursion) {
-		/*
-		 * "allow-query-cache" inherits from "allow-recursion" if set,
-		 * otherwise from "allow-query" if set.
-		 * "allow-recursion" inherits from "allow-query-cache" if set,
-		 * otherwise from "allow-query" if set.
-		 */
-		if (view->cacheacl == NULL) {
-			if (view->recursionacl != NULL) {
-				dns_acl_attach(view->recursionacl,
-					       &view->cacheacl);
-			} else if (view->queryacl != NULL) {
-				dns_acl_attach(view->queryacl,
-					       &view->cacheacl);
-			}
-		}
-		if (view->recursionacl == NULL) {
-			if (view->cacheacl != NULL) {
-				dns_acl_attach(view->cacheacl,
-					       &view->recursionacl);
-			} else if (view->queryacl != NULL) {
-				dns_acl_attach(view->queryacl,
-					       &view->recursionacl);
-			}
-		}
+	/*
+	 * "allow-query-cache" inherits from "allow-recursion" if set,
+	 * otherwise from "allow-query" if set.
+	 * "allow-recursion" inherits from "allow-query-cache" if set,
+	 * otherwise from "allow-query" if set.
+	 */
+	if (view->cacheacl == NULL && view->recursionacl != NULL)
+		dns_acl_attach(view->recursionacl, &view->cacheacl);
+	/*
+	 * XXXEACH: This call to configure_view_acl() is redundant.  We
+	 * are leaving it as it is because we are making a minimal change
+	 * for a patch release.  In the future this should be changed to
+	 * dns_acl_attach(view->queryacl, &view->cacheacl).
+	 */
+	if (view->cacheacl == NULL && view->recursion)
+		CHECK(configure_view_acl(vconfig, config, "allow-query", NULL,
+					 actx, named_g_mctx, &view->cacheacl));
+	if (view->recursion &&
+	    view->recursionacl == NULL && view->cacheacl != NULL)
+		dns_acl_attach(view->cacheacl, &view->recursionacl);

-		/*
-		 * If any are still unset, we now get default "allow-recursion",
-		 * "allow-recursion-on" and "allow-query-cache" ACLs from
-		 * the global config.
-		 */
-		if (view->recursionacl == NULL) {
-			CHECK(configure_view_acl(NULL, NULL, named_g_config,
-						 "allow-recursion", NULL,
-						 actx, named_g_mctx,
-						 &view->recursionacl));
-		}
-		if (view->recursiononacl == NULL) {
-			CHECK(configure_view_acl(NULL, NULL, named_g_config,
-						 "allow-recursion-on", NULL,
-						 actx, named_g_mctx,
-						 &view->recursiononacl));
-		}
-		if (view->cacheacl == NULL) {
-			CHECK(configure_view_acl(NULL, NULL, named_g_config,
+	/*
+	 * Set default "allow-recursion", "allow-recursion-on" and
+	 * "allow-query-cache" acls.
+	 */
+	if (view->recursionacl == NULL && view->recursion)
+		CHECK(configure_view_acl(NULL, named_g_config,
+					 "allow-recursion", NULL,
+					 actx, named_g_mctx,
+					 &view->recursionacl));
+	if (view->recursiononacl == NULL && view->recursion)
+		CHECK(configure_view_acl(NULL, named_g_config,
+					 "allow-recursion-on", NULL,
+					 actx, named_g_mctx,
+					 &view->recursiononacl));
+	if (view->cacheacl == NULL) {
+		if (view->recursion)
+			CHECK(configure_view_acl(NULL, named_g_config,
 						 "allow-query-cache", NULL,
 						 actx, named_g_mctx,
 						 &view->cacheacl));
-		}
-	} else if (view->cacheacl == NULL) {
-		/*
-		 * We're not recursive; if "allow-query-cache" hasn't been
-		 * set at the options/view level, set it to none.
-		 */
-		CHECK(dns_acl_none(mctx, &view->cacheacl));
+		else
+			CHECK(dns_acl_none(mctx, &view->cacheacl));
 	}

 	/*
@@ -4767,14 +4725,14 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
 	 * clients. This causes case not always to be preserved,
 	 * and is needed by some broken clients.
 	 */
-	CHECK(configure_view_acl(vconfig, config, named_g_config,
-				 "no-case-compress", NULL, actx,
-				 named_g_mctx, &view->nocasecompress));
+	CHECK(configure_view_acl(vconfig, config, "no-case-compress", NULL,
+				 actx, named_g_mctx, &view->nocasecompress));

 	/*
 	 * Disable name compression completely, this is a tradeoff
 	 * between CPU and network usage.
 	 */
+
 	obj = NULL;
 	result = named_config_get(maps, "message-compression", &obj);
 	INSIST(result == ISC_R_SUCCESS);
@@ -4783,9 +4741,8 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
 	/*
 	 * Filter setting on addresses in the answer section.
 	 */
-	CHECK(configure_view_acl(vconfig, config, named_g_config,
-				 "deny-answer-addresses", "acl",
-				 actx, named_g_mctx,
+	CHECK(configure_view_acl(vconfig, config, "deny-answer-addresses",
+				 "acl", actx, named_g_mctx,
 				 &view->denyansweracl));
 	CHECK(configure_view_nametable(vconfig, config, "deny-answer-addresses",
 				       "except-from", named_g_mctx,
@@ -4808,36 +4765,26 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
 				      &view->sortlist));

 	/*
-	 * Configure default allow-notify, allow-update
-	 * and allow-update-forwarding ACLs, so they can be
-	 * inherited by zones. (Note these cannot be set at
-	 * options/view level.)
+	 * Configure default allow-transfer, allow-notify, allow-update
+	 * and allow-update-forwarding ACLs, if set, so they can be
+	 * inherited by zones.
 	 */
-	if (view->notifyacl == NULL) {
-		CHECK(configure_view_acl(vconfig, config, named_g_config,
+	if (view->notifyacl == NULL)
+		CHECK(configure_view_acl(NULL, named_g_config,
 					 "allow-notify", NULL, actx,
 					 named_g_mctx, &view->notifyacl));
-	}
-	if (view->updateacl == NULL) {
-		CHECK(configure_view_acl(NULL, NULL, named_g_config,
-					 "allow-update", NULL, actx,
-					 named_g_mctx, &view->updateacl));
-	}
-	if (view->upfwdacl == NULL) {
-		CHECK(configure_view_acl(NULL, NULL, named_g_config,
-					 "allow-update-forwarding", NULL, actx,
-					 named_g_mctx, &view->upfwdacl));
-	}
-
-	/*
-	 * Configure default allow-transer ACL so it can be inherited
-	 * by zones. (Note this *can* be set at options or view level.)
-	 */
-	if (view->transferacl == NULL) {
-		CHECK(configure_view_acl(vconfig, config, named_g_config,
+	if (view->transferacl == NULL)
+		CHECK(configure_view_acl(NULL, named_g_config,
 					 "allow-transfer", NULL, actx,
 					 named_g_mctx, &view->transferacl));
-	}
+	if (view->updateacl == NULL)
+		CHECK(configure_view_acl(NULL, named_g_config,
+					 "allow-update", NULL, actx,
+					 named_g_mctx, &view->updateacl));
+	if (view->upfwdacl == NULL)
+		CHECK(configure_view_acl(NULL, named_g_config,
+					 "allow-update-forwarding", NULL, actx,
+					 named_g_mctx, &view->upfwdacl));

 	obj = NULL;
 	result = named_config_get(maps, "provide-ixfr", &obj);
@@ -4928,6 +4875,7 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
 					      dns_quotatype_zone, r);
 	}

+#ifdef ALLOW_FILTER_AAAA
 	obj = NULL;
 	result = named_config_get(maps, "filter-aaaa-on-v4", &obj);
 	INSIST(result == ISC_R_SUCCESS);
@@ -4960,10 +4908,9 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
 			INSIST(0);
 	}

-	CHECK(configure_view_acl(vconfig, config, named_g_config,
-				 "filter-aaaa", NULL, actx,
-				 named_g_mctx, &view->aaaa_acl));
-
+	CHECK(configure_view_acl(vconfig, config, "filter-aaaa", NULL,
+				 actx, named_g_mctx, &view->aaaa_acl));
+#endif
 	obj = NULL;
 	result = named_config_get(maps, "prefetch", &obj);
 	if (result == ISC_R_SUCCESS) {
@@ -5009,9 +4956,11 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
 			if (!strcasecmp(dom, "no")) {
 				result = ISC_R_NOTFOUND;
 			} else if (!strcasecmp(dom, "auto")) {
-				/*
-				 * Warning logged by libbind9.
-				 */
+				cfg_obj_log(obj, named_g_lctx, ISC_LOG_WARNING,
+					    "WARNING: the DLV server at "
+					    "'dlv.isc.org' is no longer "
+					    "in service; dnssec-lookaside "
+					    "ignored");
 				result = ISC_R_NOTFOUND;
 			}
 		}
@@ -5037,9 +4986,11 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
 			CHECK(dns_name_fromstring(dlv, cfg_obj_asstring(obj),
 						  DNS_NAME_DOWNCASE, NULL));
 			if (dns_name_equal(dlv, iscdlv)) {
-				/*
-				 * Warning logged by libbind9.
-				 */
+				cfg_obj_log(obj, named_g_lctx, ISC_LOG_WARNING,
+					    "WARNING: the DLV server at "
+					    "'dlv.isc.org' is no longer "
+					    "in service; dnssec-lookaside "
+					    "ignored");
 				view->dlv = NULL;
 			} else {
 				view->dlv = dlv;
@@ -6214,7 +6165,7 @@ directory_callback(const char *clausename, const cfg_obj_t *obj, void *arg) {
 			    "option 'directory' contains relative path '%s'",
 			    directory);

-	if (!isc_file_isdirwritable(directory)) {
+	if (access(directory, DIR_PERM_OK) != 0) {
 		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 			      NAMED_LOGMODULE_SERVER, ISC_LOG_ERROR,
 			      "directory '%s' is not writable",
@@ -6492,19 +6443,16 @@ dotat(dns_keytable_t *keytable, dns_keynode_t *keynode, void *arg) {
 		}
 		nextnode = NULL;
 		(void)dns_keytable_nextkeynode(keytable, keynode, &nextnode);
-		if (keynode != firstnode) {
+		if (keynode != firstnode)
 			dns_keytable_detachkeynode(keytable, &keynode);
-		}
 		keynode = nextnode;
 	} while (keynode != NULL);

-	if (n == 0) {
+	if (n == 0)
 		return;
-	}

-	if (n > 1) {
+	if (n > 1)
 		qsort(ids, n, sizeof(ids[0]), cid);
-	}

 	/*
 	 * Encoded as "_ta-xxxx\(-xxxx\)*" where xxxx is the hex version of
@@ -6512,25 +6460,22 @@ dotat(dns_keytable_t *keytable, dns_keynode_t *keynode, void *arg) {
 	 */
 	label[0] = 0;
 	r.base = label;
-	r.length = sizeof(label);
+	r.length = sizeof(label);;
 	m = snprintf(r.base, r.length, "_ta");
-	if (m < 0 || (unsigned)m > r.length) {
+	if (m < 0 || (unsigned)m > r.length)
 		return;
-	}
 	isc_textregion_consume(&r, m);
 	for (i = 0; i < n; i++) {
 		m = snprintf(r.base, r.length, "-%04x", ids[i]);
-		if (m < 0 || (unsigned)m > r.length) {
+		if (m < 0 || (unsigned)m > r.length)
 			return;
-		}
 		isc_textregion_consume(&r, m);
 	}
 	dns_fixedname_init(&fixed);
 	tatname = dns_fixedname_name(&fixed);
 	result = dns_name_fromstring2(tatname, label, name, 0, NULL);
-	if (result != ISC_R_SUCCESS) {
+	if (result != ISC_R_SUCCESS)
 		return;
-	}

 	dns_name_format(tatname, namebuf, sizeof(namebuf));
 	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
@@ -6539,9 +6484,8 @@ dotat(dns_keytable_t *keytable, dns_keynode_t *keynode, void *arg) {
 		     view->name, namebuf);

 	tat = isc_mem_get(dotat_arg->view->mctx, sizeof(*tat));
-	if (tat == NULL) {
+	if (tat == NULL)
 		return;
-	}

 	tat->mctx = NULL;
 	tat->task = NULL;
@@ -7109,13 +7053,6 @@ setup_newzones(dns_view_t *view, cfg_obj_t *config, cfg_obj_t *vconfig,
 				      dir, isc_result_totext(result));
 			return (result);
 		}
-		if (!isc_file_isdirwritable(dir)) {
-			isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-				      NAMED_LOGMODULE_SERVER, ISC_LOG_ERROR,
-				      "new-zones-directory '%s' "
-				      "is not writable", dir);
-			return (ISC_R_NOPERM);
-		}

 		dns_view_setnewzonedir(view, dir);
 	}
@@ -7887,11 +7824,7 @@ load_configuration(const char *filename, named_server_t *server,

 	isc_quota_soft(&server->sctx->recursionquota, softquota);

-	/*
-	 * Set "blackhole". Only legal at options level; there is
-	 * no default.
-	 */
-	CHECK(configure_view_acl(NULL, config, NULL, "blackhole", NULL,
+	CHECK(configure_view_acl(NULL, config, "blackhole", NULL,
 				 named_g_aclconfctx, named_g_mctx,
 				 &server->sctx->blackholeacl));
 	if (server->sctx->blackholeacl != NULL) {
@@ -7899,11 +7832,7 @@ load_configuration(const char *filename, named_server_t *server,
 					     server->sctx->blackholeacl);
 	}

-	/*
-	 * Set "blackhole". Only legal at options or global defaults level.
-	 */
-	CHECK(configure_view_acl(NULL, config, named_g_config,
-				 "keep-response-order", NULL,
+	CHECK(configure_view_acl(NULL, config, "keep-response-order", NULL,
 				 named_g_aclconfctx, named_g_mctx,
 				 &server->sctx->keepresporder));

@@ -7952,11 +7881,11 @@ load_configuration(const char *filename, named_server_t *server,
 	result = named_config_get(maps, "tcp-keepalive-timeout", &obj);
 	INSIST(result == ISC_R_SUCCESS);
 	keepalive = cfg_obj_asuint32(obj);
-	if (keepalive > MAX_TCP_TIMEOUT) {
+	if (keepalive > 1200) {
 		cfg_obj_log(obj, named_g_lctx, ISC_LOG_WARNING,
 			    "tcp-keepalive-timeout value is out of range: "
-			    "lowering to %u", MAX_TCP_TIMEOUT);
-		keepalive = MAX_TCP_TIMEOUT;
+			    "lowering to 1200");
+		keepalive = 1200;
 	} else if (keepalive < 1) {
 		cfg_obj_log(obj, named_g_lctx, ISC_LOG_WARNING,
 			    "tcp-keepalive-timeout value is out of range: "
@@ -7968,11 +7897,11 @@ load_configuration(const char *filename, named_server_t *server,
 	result = named_config_get(maps, "tcp-advertised-timeout", &obj);
 	INSIST(result == ISC_R_SUCCESS);
 	advertised = cfg_obj_asuint32(obj);
-	if (advertised > MAX_TCP_TIMEOUT) {
+	if (advertised > 1200) {
 		cfg_obj_log(obj, named_g_lctx, ISC_LOG_WARNING,
 			    "tcp-advertized-timeout value is out of range: "
-			    "lowering to %u", MAX_TCP_TIMEOUT);
-		advertised = MAX_TCP_TIMEOUT;
+			    "lowering to 1200");
+		advertised = 1200;
 	}

 	ns_server_settimeouts(named_g_server->sctx,
@@ -8558,7 +8487,7 @@ load_configuration(const char *filename, named_server_t *server,
 	/*
 	 * Check that the working directory is writable.
 	 */
-	if (!isc_file_isdirwritable(".")) {
+	if (access(".", DIR_PERM_OK) != 0) {
 		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 			      NAMED_LOGMODULE_SERVER, ISC_LOG_ERROR,
 			      "the working directory is not writable");
@@ -11810,10 +11739,6 @@ nzf_append(dns_view_t *view, const cfg_obj_t *zconfig) {

 static isc_result_t
 nzf_writeconf(const cfg_obj_t *config, dns_view_t *view) {
-	const cfg_obj_t *zl = NULL;
-	cfg_list_t *list;
-	const cfg_listelt_t *elt;
-
 	FILE *fp = NULL;
 	char tmp[1024];
 	isc_result_t result;
@@ -11825,24 +11750,9 @@ nzf_writeconf(const cfg_obj_t *config, dns_view_t *view) {
 	if (result != ISC_R_SUCCESS)
 		return (result);

-	cfg_map_get(config, "zone", &zl);
-	if (!cfg_obj_islist(zl))
-		CHECK(ISC_R_FAILURE);
-
-	DE_CONST(&zl->value.list, list);
-
 	CHECK(add_comment(fp, view->name));	/* force a comment */

-	for (elt = ISC_LIST_HEAD(*list);
-	     elt != NULL;
-	     elt = ISC_LIST_NEXT(elt, link))
-	{
-		const cfg_obj_t *zconfig = cfg_listelt_value(elt);
-
-		CHECK(isc_stdio_write("zone ", 5, 1, fp, NULL));
-		cfg_printx(zconfig, CFG_PRINTER_ONELINE, dumpzone, fp);
-		CHECK(isc_stdio_write(";\n", 2, 1, fp, NULL));
-	}
+	cfg_printx(config, CFG_PRINTER_ONELINE, dumpzone, fp);

 	CHECK(isc_stdio_flush(fp));
 	result = isc_stdio_close(fp);
@@ -13532,6 +13442,11 @@ newzone_cfgctx_destroy(void **cfgp) {

 static isc_result_t
 generate_salt(unsigned char *salt, size_t saltlen) {
+	size_t i, n;
+	union {
+		unsigned char rnd[256];
+		isc_uint16_t rnd16[128];
+	} rnd;
 	unsigned char text[512 + 1];
 	isc_region_t r;
 	isc_buffer_t buf;
@@ -13540,9 +13455,14 @@ generate_salt(unsigned char *salt, size_t saltlen) {
 	if (saltlen > 256U)
 		return (ISC_R_RANGE);

-	isc_rng_randombytes(named_g_server->sctx->rngctx, salt, saltlen);
+	n = (saltlen + sizeof(isc_uint16_t) - 1) / sizeof(isc_uint16_t);
+	for (i = 0; i < n; i++) {
+		rnd.rnd16[i] = isc_rng_random(named_g_server->sctx->rngctx);
+	}

-	r.base = salt;
+	memmove(salt, rnd.rnd, saltlen);
+
+	r.base = rnd.rnd;
 	r.length = (unsigned int) saltlen;

 	isc_buffer_init(&buf, text, sizeof(text));
@@ -14503,10 +14423,10 @@ mkey_dumpzone(dns_view_t *view, isc_buffer_t **text) {
 			else if (revoked)
 				snprintf(buf, sizeof(buf),
 					 "\n\ttrust revoked");
-			else if (kd.addhd <= now)
+			else if (kd.addhd < now)
 				snprintf(buf, sizeof(buf),
 					 "\n\ttrusted since: %s", tbuf);
-			else if (kd.addhd > now)
+			else if (kd.addhd >= now)
 				snprintf(buf, sizeof(buf),
 					 "\n\ttrust pending: %s", tbuf);
 			CHECK(putstr(text, buf));
@@ -14775,7 +14695,7 @@ named_server_tcptimeouts(isc_lex_t *lex, isc_buffer_t **text) {
 		if (ptr == NULL)
 			return (ISC_R_UNEXPECTEDEND);
 		CHECK(isc_parse_uint32(&keepalive, ptr, 10));
-		if (keepalive > MAX_TCP_TIMEOUT)
+		if (keepalive > 1200)
 			CHECK(ISC_R_RANGE);
 		if (keepalive < 1)
 			CHECK(ISC_R_RANGE);
@@ -14784,7 +14704,7 @@ named_server_tcptimeouts(isc_lex_t *lex, isc_buffer_t **text) {
 		if (ptr == NULL)
 			return (ISC_R_UNEXPECTEDEND);
 		CHECK(isc_parse_uint32(&advertised, ptr, 10));
-		if (advertised > MAX_TCP_TIMEOUT)
+		if (advertised > 1200)
 			CHECK(ISC_R_RANGE);

 		result = isc_task_beginexclusive(named_g_server->task);
@@ -395,7 +395,6 @@ init_desc(void) {
 	SET_RESSTATDESC(serverquota, "spilled due to server quota",
 			"ServerQuota");
 	SET_RESSTATDESC(nextitem, "waited for next item", "NextItem");
-	SET_RESSTATDESC(priming, "priming queries", "Priming");

 	INSIST(i == dns_resstatscounter_max);

@@ -1616,7 +1615,7 @@ generatexml(named_server_t *server, isc_uint32_t flags,
 			ISC_XMLCHAR "type=\"text/xsl\" href=\"/bind9.xsl\""));
 	TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "statistics"));
 	TRY0(xmlTextWriterWriteAttribute(writer, ISC_XMLCHAR "version",
-					 ISC_XMLCHAR "3.11"));
+					 ISC_XMLCHAR "3.10"));

 	/* Set common fields for statistics dump */
 	dumparg.type = isc_statsformat_xml;
@@ -2412,7 +2411,7 @@ generatejson(named_server_t *server, size_t *msglen,
 	/*
 	 * These statistics are included no matter which URL we use.
 	 */
-	obj = json_object_new_string("1.5");
+	obj = json_object_new_string("1.4");
 	CHECKMEM(obj);
 	json_object_object_add(bindstats, "json-stats-version", obj);

@@ -150,7 +150,6 @@ static dns_dispatch_t *dispatchv4 = NULL;
 static dns_dispatch_t *dispatchv6 = NULL;
 static dns_message_t *updatemsg = NULL;
 static dns_fixedname_t fuserzone;
-static dns_fixedname_t fzname;
 static dns_name_t *userzone = NULL;
 static dns_name_t *zname = NULL;
 static dns_name_t tmpzonename;
@@ -944,21 +943,16 @@ setup_system(void) {
 			case AF_INET:
 				if (have_ipv4) {
 					sa->type.sin.sin_port = htons(dnsport);
-				} else {
-					continue;
 				}
 				break;
 			case AF_INET6:
 				if (have_ipv6) {
 					sa->type.sin6.sin6_port = htons(dnsport);
-				} else {
-					continue;
 				}
 				break;
 			default:
 				fatal("bad family");
 			}
-			INSIST(i < ns_alloc);
 			servers[i++] = *sa;
 		}
 	}
@@ -2396,6 +2390,7 @@ update_completed(isc_task_t *task, isc_event_t *event) {
 		dns_request_destroy(&request);
 		dns_message_renderreset(updatemsg);
 		dns_message_settsigkey(updatemsg, NULL);
+		/* XXX MPA fix zonename is freed already */
 		send_update(zname, &master_servers[master_inuse]);
 		isc_event_free(&event);
 		return;
@@ -2698,17 +2693,13 @@ recvsoa(isc_task_t *task, isc_event_t *event) {
 	dns_name_init(&master, NULL);
 	dns_name_clone(&soa.origin, &master);

-	if (userzone != NULL) {
+	/*
+	 * XXXMPA
+	 */
+	if (userzone != NULL)
 		zname = userzone;
-	} else {
-		/*
-		 * Save the zone name in case we need to try a second
-		 * address.
-		 */
-		dns_fixedname_init(&fzname);
-		zname = dns_fixedname_name(&fzname);
-		dns_name_copy(name, zname, NULL);
-	}
+	else
+		zname = name;

 	if (debugging) {
 		char namestr[DNS_NAME_FORMATSIZE];
@@ -39,7 +39,9 @@
 dnssec-checkds \- DNSSEC delegation consistency checking tool
 .SH "SYNOPSIS"
 .HP \w'\fBdnssec\-checkds\fR\ 'u
-\fBdnssec\-checkds\fR [\fB\-d\ \fR\fB\fIdig\ path\fR\fR] [\fB\-D\ \fR\fB\fIdsfromkey\ path\fR\fR] [\fB\-f\ \fR\fB\fIfile\fR\fR] [\fB\-l\ \fR\fB\fIdomain\fR\fR] [\fB\-s\ \fR\fB\fIfile\fR\fR] {zone}
+\fBdnssec\-checkds\fR [\fB\-l\ \fR\fB\fIdomain\fR\fR] [\fB\-f\ \fR\fB\fIfile\fR\fR] [\fB\-d\ \fR\fB\fIdig\ path\fR\fR] [\fB\-D\ \fR\fB\fIdsfromkey\ path\fR\fR] {zone}
+.HP \w'\fBdnssec\-dsfromkey\fR\ 'u
+\fBdnssec\-dsfromkey\fR [\fB\-l\ \fR\fB\fIdomain\fR\fR] [\fB\-f\ \fR\fB\fIfile\fR\fR] [\fB\-d\ \fR\fB\fIdig\ path\fR\fR] [\fB\-D\ \fR\fB\fIdsfromkey\ path\fR\fR] {zone}
 .SH "DESCRIPTION"
 .PP
 \fBdnssec\-checkds\fR
@@ -58,12 +60,6 @@ is specified, then the zone is read from that file to find the DNSKEY records\&.
 Check for a DLV record in the specified lookaside domain, instead of checking for a DS record in the zone\*(Aqs parent\&.
 .RE
 .PP
-\-s \fIfile\fR
-.RS 4
-Specifies a prepared dsset file, such as would be generated by
-\fBdnssec\-signzone\fR, to use as a source for the DS RRset instead of querying the parent\&.
-.RE
-.PP
 \-d \fIdig path\fR
 .RS 4
 Specifies a path to a
@@ -42,13 +42,20 @@
  <refsynopsisdiv>
    <cmdsynopsis sepchar=" ">
      <command>dnssec-checkds</command>
+      <arg choice="opt" rep="norepeat"><option>-l <replaceable class="parameter">domain</replaceable></option></arg>
+      <arg choice="opt" rep="norepeat"><option>-f <replaceable class="parameter">file</replaceable></option></arg>
      <arg choice="opt" rep="norepeat"><option>-d <replaceable class="parameter">dig path</replaceable></option></arg>
      <arg choice="opt" rep="norepeat"><option>-D <replaceable class="parameter">dsfromkey path</replaceable></option></arg>
-      <arg choice="opt" rep="norepeat"><option>-f <replaceable class="parameter">file</replaceable></option></arg>
-      <arg choice="opt" rep="norepeat"><option>-l <replaceable class="parameter">domain</replaceable></option></arg>
-      <arg choice="opt" rep="norepeat"><option>-s <replaceable class="parameter">file</replaceable></option></arg>
      <arg choice="req" rep="norepeat">zone</arg>
    </cmdsynopsis>
+    <cmdsynopsis sepchar=" ">
+      <command>dnssec-dsfromkey</command>
+      <arg choice="opt" rep="norepeat"><option>-l <replaceable class="parameter">domain</replaceable></option></arg>
+      <arg choice="opt" rep="norepeat"><option>-f <replaceable class="parameter">file</replaceable></option></arg>
+      <arg choice="opt" rep="norepeat"><option>-d <replaceable class="parameter">dig path</replaceable></option></arg>
+      <arg choice="opt" rep="norepeat"><option>-D <replaceable class="parameter">dsfromkey path</replaceable></option></arg>
+      <arg choice="req" rep="norepeat">zone</arg>
+   </cmdsynopsis>
  </refsynopsisdiv>

  <refsection><info><title>DESCRIPTION</title></info>
@@ -85,17 +92,6 @@
        </listitem>
      </varlistentry>

-      <varlistentry>
-        <term>-s <replaceable class="parameter">file</replaceable></term>
-        <listitem>
-          <para>
-            Specifies a prepared dsset file, such as would be generated
-            by <command>dnssec-signzone</command>, to use as a source for
-            the DS RRset instead of querying the parent.
-          </para>
-        </listitem>
-      </varlistentry>
-
      <varlistentry>
        <term>-d <replaceable class="parameter">dig path</replaceable></term>
        <listitem>
@@ -33,13 +33,20 @@
 <h2>Synopsis</h2>
    <div class="cmdsynopsis"><p>
      <code class="command">dnssec-checkds</code> 
+       [<code class="option">-l <em class="replaceable"><code>domain</code></em></code>]
+       [<code class="option">-f <em class="replaceable"><code>file</code></em></code>]
       [<code class="option">-d <em class="replaceable"><code>dig path</code></em></code>]
       [<code class="option">-D <em class="replaceable"><code>dsfromkey path</code></em></code>]
-       [<code class="option">-f <em class="replaceable"><code>file</code></em></code>]
-       [<code class="option">-l <em class="replaceable"><code>domain</code></em></code>]
-       [<code class="option">-s <em class="replaceable"><code>file</code></em></code>]
       {zone}
    </p></div>
+    <div class="cmdsynopsis"><p>
+      <code class="command">dnssec-dsfromkey</code> 
+       [<code class="option">-l <em class="replaceable"><code>domain</code></em></code>]
+       [<code class="option">-f <em class="replaceable"><code>file</code></em></code>]
+       [<code class="option">-d <em class="replaceable"><code>dig path</code></em></code>]
+       [<code class="option">-D <em class="replaceable"><code>dsfromkey path</code></em></code>]
+       {zone}
+   </p></div>
  </div>

  <div class="refsection">
@@ -72,14 +79,6 @@
            instead of checking for a DS record in the zone's parent.
          </p>
        </dd>
-<dt><span class="term">-s <em class="replaceable"><code>file</code></em></span></dt>
-<dd>
-          <p>
-            Specifies a prepared dsset file, such as would be generated
-            by <span class="command"><strong>dnssec-signzone</strong></span>, to use as a source for
-            the DS RRset instead of querying the parent.
-          </p>
-        </dd>
 <dt><span class="term">-d <em class="replaceable"><code>dig path</code></em></span></dt>
 <dd>
          <p>
@@ -1,5 +1,5 @@
 ############################################################################
-# Copyright (C) 2012-2017  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2012-2016  Internet Systems Consortium, Inc. ("ISC")
 #
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -34,11 +34,7 @@ class SECRR:
        if not rrtext:
            raise Exception

-        # 'str' does not have decode method in python3
-        if type(rrtext) is not str:
-            fields = rrtext.decode('ascii').split()
-        else:
-            fields = rrtext.split()
+        fields = rrtext.decode('ascii').split()
        if len(fields) < 7:
            raise Exception

@@ -93,39 +89,35 @@ class SECRR:
 # Generate a set of expected DS/DLV records from the DNSKEY RRset,
 # and report on congruency.
 ############################################################################
-def check(zone, args):
+def check(zone, args, masterfile=None, lookaside=None):
    rrlist = []
-    if args.dssetfile:
-        fp = open(args.dssetfile).read()
-    else:
-        cmd = [args.dig, "+noall", "+answer", "-t",
-                "dlv" if args.lookaside else "ds", "-q",
-                zone + "." + args.lookaside if args.lookaside else zone]
-        fp, _ = Popen(cmd, stdout=PIPE).communicate()
+    cmd = [args.dig, "+noall", "+answer", "-t", "dlv" if lookaside else "ds",
+           "-q", zone + "." + lookaside if lookaside else zone]
+    fp, _ = Popen(cmd, stdout=PIPE).communicate()

    for line in fp.splitlines():
-        rrlist.append(SECRR(line, args.lookaside))
+        rrlist.append(SECRR(line, lookaside))
    rrlist = sorted(rrlist, key=lambda rr: (rr.keyid, rr.keyalg, rr.hashalg))

    klist = []

-    if args.masterfile:
-        cmd = [args.dsfromkey, "-f", args.masterfile]
-        if args.lookaside:
-            cmd += ["-l", args.lookaside]
+    if masterfile:
+        cmd = [args.dsfromkey, "-f", masterfile]
+        if lookaside:
+            cmd += ["-l", lookaside]
        cmd.append(zone)
        fp, _ = Popen(cmd, stdout=PIPE).communicate()
    else:
        intods, _ = Popen([args.dig, "+noall", "+answer", "-t", "dnskey",
                           "-q", zone], stdout=PIPE).communicate()
        cmd = [args.dsfromkey, "-f", "-"]
-        if args.lookaside:
-            cmd += ["-l", args.lookaside]
+        if lookaside:
+            cmd += ["-l", lookaside]
        cmd.append(zone)
        fp, _ = Popen(cmd, stdin=PIPE, stdout=PIPE).communicate(intods)

    for line in fp.splitlines():
-        klist.append(SECRR(line, args.lookaside))
+        klist.append(SECRR(line, lookaside))

    if len(klist) < 1:
        print("No DNSKEY records found in zone apex")
@@ -144,8 +136,7 @@ def check(zone, args):
                   rr.keyid, SECRR.hashalgs[rr.hashalg]))

    if not found:
-        print("No %s records were found for any DNSKEY" %
-                ("DLV" if args.lookaside else "DS"))
+        print("No %s records were found for any DNSKEY" % ("DLV" if lookaside else "DS"))

    return found

@@ -160,6 +151,10 @@ def parse_args():
    sbindir = 'bin' if os.name == 'nt' else 'sbin'

    parser.add_argument('zone', type=str, help='zone to check')
+    parser.add_argument('-f', '--file', dest='masterfile', type=str,
+                        help='zone master file')
+    parser.add_argument('-l', '--lookaside', dest='lookaside', type=str,
+                        help='DLV lookaside zone')
    parser.add_argument('-d', '--dig', dest='dig',
                        default=os.path.join(prefix(bindir), 'dig'),
                        type=str, help='path to \'dig\'')
@@ -167,12 +162,6 @@ def parse_args():
                        default=os.path.join(prefix(sbindir),
                                             'dnssec-dsfromkey'),
                        type=str, help='path to \'dig\'')
-    parser.add_argument('-f', '--file', dest='masterfile', type=str,
-                        help='zone master file')
-    parser.add_argument('-l', '--lookaside', dest='lookaside', type=str,
-                        help='DLV lookaside zone')
-    parser.add_argument('-s', '--dsset', dest='dssetfile', type=str,
-                        help='prepared DSset file')
    parser.add_argument('-v', '--version', action='version',
                        version=version)
    args = parser.parse_args()
@@ -189,5 +178,5 @@ def parse_args():
 ############################################################################
 def main():
    args = parse_args()
-    found = check(args.zone, args)
+    found = check(args.zone, args, args.masterfile, args.lookaside)
    exit(0 if found else 1)
@@ -516,10 +516,7 @@ Status will report whether serving of stale answers is currently enabled, disabl
 .PP
 \fBsecroots \fR\fB[\-]\fR\fB \fR\fB[\fIview \&.\&.\&.\fR]\fR
 .RS 4
-Dump the security roots (i\&.e\&., trust anchors configured via
-\fBtrusted\-keys\fR,
-\fBmanaged\-keys\fR, or
-\fBdnssec\-validation auto\fR) and negative trust anchors for the specified views\&. If no view is specified, all views are dumped\&. Security roots will indicate whether they are configured as trusted keys, managed keys, or initializing managed keys (managed keys that have not yet been updated by a successful key refresh query)\&.
+Dump the server\*(Aqs security roots and negative trust anchors for the specified views\&. If no view is specified, all views are dumped\&.
 .sp
 If the first argument is "\-", then the output is returned via the
 \fBrndc\fR
@@ -774,15 +774,9 @@
 	<term><userinput>secroots <optional>-</optional> <optional><replaceable>view ...</replaceable></optional></userinput></term>
 	<listitem>
 	  <para>
-	    Dump the security roots (i.e., trust anchors
-	    configured via <command>trusted-keys</command>,
-	    <command>managed-keys</command>, or
-	    <command>dnssec-validation auto</command>) and negative trust
-	    anchors for the specified views.  If no view is specified, all
-	    views are dumped.  Security roots will indicate whether
-	    they are configured as trusted keys, managed keys, or
-	    initializing managed keys (managed keys that have not yet
-	    been updated by a successful key refresh query).
+	    Dump the server's security roots and negative trust anchors
+	    for the specified views.  If no view is specified, all views
+	    are dumped.
 	  </para>
 	  <para>
 	    If the first argument is "-", then the output is
@@ -969,15 +963,15 @@
 	<listitem>
 	  <para>
 	    When called without arguments, display the current
-	    values of the <command>tcp-initial-timeout</command>,
+            values of the <command>tcp-initial-timeout</command>,
 	    <command>tcp-idle-timeout</command>,
 	    <command>tcp-keepalive-timeout</command> and
 	    <command>tcp-advertised-timeout</command> options.
-	    When called with arguments, update these values. This
-	    allows an administrator to make rapid adjustments when
-	    under a denial of service attack.  See the descriptions of
-	    these options in the BIND 9 Administrator Reference Manual
-	    for details of their use.
+            When called with arguments, update these values. This
+            allows an administrator to make rapid adjustments when
+            under a denial of service attack.  See the descriptions of
+            these options in the BIND 9 Administrator Reference Manual
+            for details of their use.
 	  </para>
 	</listitem>
      </varlistentry>
@@ -657,15 +657,9 @@
 <dt><span class="term"><strong class="userinput"><code>secroots [<span class="optional">-</span>] [<span class="optional"><em class="replaceable"><code>view ...</code></em></span>]</code></strong></span></dt>
 <dd>
 	  <p>
-	    Dump the security roots (i.e., trust anchors
-	    configured via <span class="command"><strong>trusted-keys</strong></span>,
-	    <span class="command"><strong>managed-keys</strong></span>, or
-	    <span class="command"><strong>dnssec-validation auto</strong></span>) and negative trust
-	    anchors for the specified views.  If no view is specified, all
-	    views are dumped.  Security roots will indicate whether
-	    they are configured as trusted keys, managed keys, or
-	    initializing managed keys (managed keys that have not yet
-	    been updated by a successful key refresh query).
+	    Dump the server's security roots and negative trust anchors
+	    for the specified views.  If no view is specified, all views
+	    are dumped.
 	  </p>
 	  <p>
 	    If the first argument is "-", then the output is
@@ -828,15 +822,15 @@
 <dd>
 	  <p>
 	    When called without arguments, display the current
-	    values of the <span class="command"><strong>tcp-initial-timeout</strong></span>,
+            values of the <span class="command"><strong>tcp-initial-timeout</strong></span>,
 	    <span class="command"><strong>tcp-idle-timeout</strong></span>,
 	    <span class="command"><strong>tcp-keepalive-timeout</strong></span> and
 	    <span class="command"><strong>tcp-advertised-timeout</strong></span> options.
-	    When called with arguments, update these values. This
-	    allows an administrator to make rapid adjustments when
-	    under a denial of service attack.  See the descriptions of
-	    these options in the BIND 9 Administrator Reference Manual
-	    for details of their use.
+            When called with arguments, update these values. This
+            allows an administrator to make rapid adjustments when
+            under a denial of service attack.  See the descriptions of
+            these options in the BIND 9 Administrator Reference Manual
+            for details of their use.
 	  </p>
 	</dd>
 <dt><span class="term"><strong class="userinput"><code>thaw [<span class="optional"><em class="replaceable"><code>zone</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em> [<span class="optional"><em class="replaceable"><code>view</code></em></span>]</span>]</span>]</code></strong></span></dt>
@@ -15,5 +15,3 @@ rm -f ns2/example.db ns2/tsigzone.db ns2/example.db.jnl ns2/named.conf
 rm -f */named.memstats
 rm -f */named.run
 rm -f ns*/named.lock
-rm -f ns*/_default.nzf
-rm -f ns*/_default.nzd*
@@ -1,10 +0,0 @@
-$TTL 300	; 5 minutes
-@			IN SOA	ns root (
-				2000082401 ; serial
-				1800       ; refresh (30 minutes)
-				1800       ; retry (30 minutes)
-				1814400    ; expire (3 weeks)
-				3600       ; minimum (1 hour)
-				)
-			NS	ns
-ns			A	10.53.0.3
@@ -1,22 +0,0 @@
-options {
-        query-source address 10.53.0.3;
-        notify-source 10.53.0.3;
-        transfer-source 10.53.0.3;
-        port 5300;
-        pid-file "named.pid";
-        listen-on { 10.53.0.3; };
-        listen-on-v6 { none; };
-        recursion no;
-        notify no;
-        allow-new-zones yes;
-        allow-transfer { none; };
-};
-
-controls {
-        inet 10.53.0.3 port 9953 allow { any; } keys { rndc_key; };
-};
-
-key rndc_key {
-        secret "1234abcd8765";
-        algorithm hmac-sha256;
-};
@@ -1,10 +0,0 @@
-$TTL 300	; 5 minutes
-@			IN SOA	ns root (
-				2000082401 ; serial
-				1800       ; refresh (30 minutes)
-				1800       ; retry (30 minutes)
-				1814400    ; expire (3 weeks)
-				3600       ; minimum (1 hour)
-				)
-			NS	ns
-ns			A	10.53.0.4
@@ -1,10 +0,0 @@
-$TTL 300	; 5 minutes
-@			IN SOA	ns root (
-				2000082401 ; serial
-				1800       ; refresh (30 minutes)
-				1800       ; retry (30 minutes)
-				1814400    ; expire (3 weeks)
-				3600       ; minimum (1 hour)
-				)
-			NS	ns
-ns			A	10.53.0.4
@@ -1,27 +0,0 @@
-options {
-        query-source address 10.53.0.4;
-        notify-source 10.53.0.4;
-        transfer-source 10.53.0.4;
-        port 5300;
-        pid-file "named.pid";
-        listen-on { 10.53.0.4; };
-        listen-on-v6 { none; };
-        recursion no;
-        notify no;
-        allow-new-zones yes;
-        allow-transfer { none; };
-};
-
-controls {
-        inet 10.53.0.4 port 9953 allow { any; } keys { rndc_key; };
-};
-
-key rndc_key {
-        secret "1234abcd8765";
-        algorithm hmac-sha256;
-};
-
-zone "existing" {
-        type master;
-        file "existing.db";
-};
@@ -172,65 +172,5 @@ t=`expr $t + 1`
 $DIG example. soa @10.53.0.2 +subnet="192.0.2.128/32" -p 5300 > dig.out.${t}
 grep "CLIENT-SUBNET.*192.0.2.128/32/24" dig.out.${t} > /dev/null || { echo "I:test $t failed" ; status=1; }

-# AXFR tests against ns3
-
-echo "I:testing allow-transfer ACLs against ns3 (no existing zones)"
-
-echo "I:calling addzone example.com on ns3"
-$RNDC -c ../common/rndc.conf -s 10.53.0.3 -p 9953 addzone 'example.com {type master; file "example.db"; }; '
-
-sleep 1
-
-t=`expr $t + 1`
-ret=0
-echo "I:checking AXFR of example.com from ns3 with ACL allow-transfer { none; }; (${t})"
-$DIG @10.53.0.3 -p 5300 example.com axfr > dig.out.${t} 2>&1
-grep "Transfer failed." dig.out.${t} >/dev/null 2>&1 || ret=1
-[ $ret -eq 0 ] || echo "I:failed"
-status=`expr $status + $ret`
-
-echo "I:calling rndc reconfig"
-$RNDC -c ../common/rndc.conf -s 10.53.0.3 -p 9953 reconfig
-
-sleep 1
-
-t=`expr $t + 1`
-ret=0
-echo "I:re-checking AXFR of example.com from ns3 with ACL allow-transfer { none; }; (${t})"
-$DIG @10.53.0.3 -p 5300 example.com axfr > dig.out.${t} 2>&1
-grep "Transfer failed." dig.out.${t} >/dev/null 2>&1 || ret=1
-[ $ret -eq 0 ] || echo "I:failed"
-status=`expr $status + $ret`
-
-# AXFR tests against ns4
-
-echo "I:testing allow-transfer ACLs against ns4 (1 pre-existing zone)"
-
-echo "I:calling addzone example.com on ns4"
-$RNDC -c ../common/rndc.conf -s 10.53.0.4 -p 9953 addzone 'example.com {type master; file "example.db"; }; '
-
-sleep 1
-
-t=`expr $t + 1`
-ret=0
-echo "I:checking AXFR of example.com from ns4 with ACL allow-transfer { none; }; (${t})"
-$DIG @10.53.0.4 -p 5300 example.com axfr > dig.out.${t} 2>&1
-grep "Transfer failed." dig.out.${t} >/dev/null 2>&1 || ret=1
-[ $ret -eq 0 ] || echo "I:failed"
-status=`expr $status + $ret`
-
-echo "I:calling rndc reconfig"
-$RNDC -c ../common/rndc.conf -s 10.53.0.4 -p 9953 reconfig
-
-sleep 1
-
-t=`expr $t + 1`
-ret=0
-echo "I:re-checking AXFR of example.com from ns4 with ACL allow-transfer { none; }; (${t})"
-$DIG @10.53.0.4 -p 5300 example.com axfr > dig.out.${t} 2>&1
-grep "Transfer failed." dig.out.${t} >/dev/null 2>&1 || ret=1
-[ $ret -eq 0 ] || echo "I:failed"
-status=`expr $status + $ret`
-
 echo "I:exit status: $status"
 [ $status -eq 0 ] || exit 1
@@ -1,17 +1,19 @@
 #!/bin/sh
 #
-# Copyright (C) 2013, 2014, 2016, 2017  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2013, 2014, 2016  Internet Systems Consortium, Inc. ("ISC")
 #
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.

+# $Id: clean.sh,v 1.6 2007/09/26 03:22:44 marka Exp $
+
 #
 # Clean up after tests.
 #

 rm -f dig.out.*
 rm -f */named.memstats
-rm -f ns1/named.conf
+rm -f */named.conf
 rm -f */named.run
 rm -f ns*/named.lock
@@ -1,25 +0,0 @@
-/*
- * Copyright (C) 2017  Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- */
-
-controls { /* empty */ };
-
-options {
-	query-source address 10.53.0.3;
-	notify-source 10.53.0.3;
-	transfer-source 10.53.0.3;
-	port 5300;
-	pid-file "named.pid";
-	listen-on { 10.53.0.3; };
-	listen-on-v6 { none; };
-	recursion yes;
-};
-
-zone "." {
-	type hint;
-	file "root.hint";
-};
@@ -1,8 +0,0 @@
-; Copyright (C) 2017  Internet Systems Consortium, Inc. ("ISC")
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
-
-. NS ns1.
-ns1. A 10.53.0.1
@@ -212,7 +212,7 @@ echo "I:testing with 'minimal-responses yes;'"
 minimal=yes
 dotests

-echo "I:reconfiguring server: minimal-responses no"
+echo "I:reconfiguring server"
 cp ns1/named2.conf ns1/named.conf
 $RNDC -c ../common/rndc.conf -s 10.53.0.1 -p 9953 reconfig 2>&1 | sed 's/^/I:ns1 /'
 sleep 2
@@ -230,7 +230,7 @@ if [ $ret -eq 1 ] ; then
    echo "I: failed"; status=1
 fi

-echo "I:reconfiguring server: minimal-any yes"
+echo "I:reconfiguring server"
 cp ns1/named3.conf ns1/named.conf
 $RNDC -c ../common/rndc.conf -s 10.53.0.1 -p 9953 reconfig 2>&1 | sed 's/^/I:ns1 /'
 sleep 2
@@ -266,7 +266,7 @@ echo "I:testing with 'minimal-responses no-auth;'"
 minimal=no-auth
 dotests

-echo "I:reconfiguring server: minimal-responses no-auth-recursive"
+echo "I:reconfiguring server"
 cp ns1/named4.conf ns1/named.conf
 $RNDC -c ../common/rndc.conf -s 10.53.0.1 -p 9953 reconfig 2>&1 | sed 's/^/I:ns1 /'
 sleep 2
@@ -297,30 +297,5 @@ if [ $ret -eq 1 ] ; then
    echo "I: failed"; status=1
 fi

-echo "I:reconfiguring server: minimal-responses no"
-cp ns1/named2.conf ns1/named.conf
-$RNDC -c ../common/rndc.conf -s 10.53.0.1 -p 9953 reconfig 2>&1 | sed 's/^/I:ns1 /'
-sleep 2
-
-n=`expr $n + 1`
-echo "I:testing NS handling in ANY responses (authoritative) ($n)"
-ret=0
-$DIG -t ANY rt.example @10.53.0.1 -p 5300 > dig.out.$n || ret=1
-grep "AUTHORITY: 0" dig.out.$n  > /dev/null || ret=1
-grep "NS[ 	]*ns" dig.out.$n  > /dev/null || ret=1
-if [ $ret -eq 1 ] ; then
-    echo "I: failed"; status=1
-fi
-
-n=`expr $n + 1`
-echo "I:testing NS handling in ANY responses (recursive) ($n)"
-ret=0
-$DIG -t ANY rt.example @10.53.0.3 -p 5300 > dig.out.$n || ret=1
-grep "AUTHORITY: 0" dig.out.$n  > /dev/null || ret=1
-grep "NS[ 	]*ns" dig.out.$n  > /dev/null || ret=1
-if [ $ret -eq 1 ] ; then
-    echo "I: failed"; status=1
-fi
-
 echo "I:exit status: $status"
 [ $status -eq 0 ] || exit 1
@@ -43,7 +43,7 @@ check_stderr() {
 		[ -s err.$n ] || return 0
 	fi
 	echo "D:stderr did not match '$err'"
-	sed 's/^/D:/' err.$n
+	sed 's/^/D:/' err
 	fail
 }

@@ -254,7 +254,7 @@ def create_response(msg):
 def sigterm(signum, frame):
    print ("Shutting down now...")
    os.remove('ans.pid')
-    running = False
+    running = 0
    sys.exit(0)

 ############################################################################
@@ -270,17 +270,8 @@ sock = 5300

 query4_socket = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
 query4_socket.bind((ip4, sock))
-
-havev6 = True
-try:
-    query6_socket = socket.socket(socket.AF_INET6, socket.SOCK_DGRAM)
-    try:
-        query6_socket.bind((ip6, sock))
-    except:
-        query6_socket.close()
-        havev6 = False
-except:
-    havev6 = False
+query6_socket = socket.socket(socket.AF_INET6, socket.SOCK_DGRAM)
+query6_socket.bind((ip6, sock))

 ctrl_socket = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
 ctrl_socket.bind((ip4, sock + 1))
@@ -293,18 +284,14 @@ pid = os.getpid()
 print (pid, file=f)
 f.close()

-running = True
+running = 1

 print ("Listening on %s port %d" % (ip4, sock))
-if havev6:
-    print ("Listening on %s port %d" % (ip6, sock))
+print ("Listening on %s port %d" % (ip6, sock))
 print ("Control channel on %s port %d" % (ip4, sock + 1))
 print ("Ctrl-c to quit")

-if havev6:
-    input = [query4_socket, query6_socket, ctrl_socket]
-else:
-    input = [query4_socket, ctrl_socket]
+input = [query4_socket, query6_socket, ctrl_socket]

 while running:
    try:
@@ -1,11 +0,0 @@
-/*
- * Copyright (C) 2017  Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- */
-
-options {
-	dnssec-lookaside . trust-anchor dlv.example.com;
-};
@@ -1,4 +1,4 @@
-# Copyright (C) 2005, 2007, 2010-2017  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2005, 2007, 2010-2016  Internet Systems Consortium, Inc. ("ISC")
 #
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -135,7 +135,6 @@ done
 if [ $ret != 0 ]; then echo "I:failed"; fi
 status=`expr $status + $ret`

-n=`expr $n + 1`
 echo "I: checking options allowed in inline-signing slaves ($n)"
 ret=0
 l=`$CHECKCONF bad-dnssec.conf 2>&1 | grep "dnssec-dnskey-kskonly.*requires inline" | wc -l`
@@ -328,29 +327,5 @@ diff good.zonelist checkconf.out$n  > diff.out$n || ret=1
 if [ $ret != 0 ]; then echo "I:failed"; ret=1; fi
 status=`expr $status + $ret`

-n=`expr $n + 1`
-echo "I: check that 'dnssec-lookaside auto;' generates a warning ($n)"
-ret=0
-$CHECKCONF warn-dlv-auto.conf > checkconf.out$n 2>/dev/null || ret=1
-grep "dnssec-lookaside 'auto' is no longer supported" checkconf.out$n > /dev/null || ret=1
-if [ $ret != 0 ]; then echo "I:failed"; ret=1; fi
-status=`expr $status + $ret`
-
-n=`expr $n + 1`
-echo "I: check that 'dnssec-lookaside . trust-anchor dlv.isc.org;' generates a warning ($n)"
-ret=0
-$CHECKCONF warn-dlv-dlv.isc.org.conf > checkconf.out$n 2>/dev/null || ret=1
-grep "dlv.isc.org has been shut down" checkconf.out$n > /dev/null || ret=1
-if [ $ret != 0 ]; then echo "I:failed"; ret=1; fi
-status=`expr $status + $ret`
-
-n=`expr $n + 1`
-echo "I: check that 'dnssec-lookaside . trust-anchor dlv.example.com;' doesn't generates a warning ($n)"
-ret=0
-$CHECKCONF good-dlv-dlv.example.com.conf > checkconf.out$n 2>/dev/null || ret=1
-[ -s checkconf.out$n ] && ret=1
-if [ $ret != 0 ]; then echo "I:failed"; ret=1; fi
-status=`expr $status + $ret`
-
 echo "I:exit status: $status"
 [ $status -eq 0 ] || exit 1
@@ -1,10 +1,12 @@
 #!/bin/sh
 #
-# Copyright (C) 2012-2014, 2016, 2017  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2012-2014, 2016  Internet Systems Consortium, Inc. ("ISC")
 #
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.

+# $Id$
+
 rm -f checkds.*
 rm -f ns*/named.lock
@@ -1,11 +1,13 @@
 #!/usr/bin/perl
 #
-# Copyright (C) 2014, 2016, 2017  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2014, 2016  Internet Systems Consortium, Inc. ("ISC")
 #
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.

+# $Id$
+
 my $arg;
 my $ext;
 my $file;
@@ -1,11 +1,14 @@
 #!/bin/sh
 #
-# Copyright (C) 2012, 2013, 2016, 2017  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2012, 2013, 2016  Internet Systems Consortium, Inc. ("ISC")
 #
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.

+# $Id$
+
+
 while [ "$#" != 0 ]; do
    case $1 in
    +*) shift ;;
@@ -1,121 +0,0 @@
-; File written on Thu Oct  5 23:44:34 2017
-; dnssec_signzone version 9.12.0a1
-prep.example.		300	IN SOA	ns1.prep.example. hostmaster.prep.example. (
-					1          ; serial
-					2000       ; refresh (33 minutes 20 seconds)
-					2000       ; retry (33 minutes 20 seconds)
-					1814400    ; expire (3 weeks)
-					3600       ; minimum (1 hour)
-					)
-			300	RRSIG	SOA 8 2 300 (
-					20171105054434 20171006054434 19260 prep.example.
-					1fX0z7Swu4gMPews/ZE8bzNg+JXNedFBDGIH
-					PTSfVQtVLIvRWpME+PylX7MdVMZE/PST+x4/
-					mWyveyjetEOo7/7aQL236FfI0y6TxQFy7HwC
-					FMieqoQCUluuKOvToxg4vUp4GOdlUGbqC63h
-					DbX5Z37VptJXLkt4niF4Kl2iD+U9/bk7HAEU
-					4zDiKroYnusGKfVB9xAWddzoHdLxhVuPi7ut
-					328suPdgX0bfs7uB+y4cikhGzAmPpNMlGHju
-					qYG74NcFGQNutLB7ayx/m87t7mTty7jbNKm3
-					QWJSPf5IR8/kmzAi8HMnapY5vUmm+hX8JOfU
-					UtH7i0iEsUqRbEwu5A== )
-			300	NS	ns1.prep.example.
-			300	RRSIG	NS 8 2 300 (
-					20171105054434 20171006054434 19260 prep.example.
-					u5sU2cfqNqIyCLw18ZNnFw28/GyRt0EOiPYS
-					dygmpfMDrvDaxjiiai8zWYjnl/E3qzVH9Zku
-					07lEDORZdVb0uCDe1NynjAyw4AHps85cAwVc
-					8HTSbzdVZsQTELpunYFJffh24PDr9unw7KOY
-					jzTP6qNedJ1uM54TOr177zfmBh7N2fkAoGyV
-					NjvTKrlgDYGNIn8/YMgHb4sNgyfe54MYY00f
-					kehVxfKnRCgDsbJ0Pk6jhBMCQWvOh8jG8WyV
-					ElAa/eMqlxUC1idF8ydWefjsI/7lPcjSalw9
-					qZw4CDCLHHZy0TOSmCYRRZuIeVXzBfDPJyi4
-					2A3iLntKFJ4AOLFMJg== )
-			3600	NSEC	ns1.prep.example. NS SOA RRSIG NSEC DNSKEY
-			3600	RRSIG	NSEC 8 2 3600 (
-					20171105054434 20171006054434 19260 prep.example.
-					Aed99/jdG82YAkKVWjoKOsAGtB3JnyKkCaAq
-					zgMrYkXU41y3KDCAmGzooGPQY7NN+WxX7FJ2
-					1nXkgljma/azgpsbi9ssneFtv7PPFClVmN+u
-					j+mM4MK/ZR7eJOsMqETg4PAO5VAh6c/GVmyA
-					RD/m6EhJVZEjPfLWbDoC4hVAgem7DP/NMjyI
-					GfztpDjMmyLQyv6tL+UEXSJHGp3ZEa5Z5i7X
-					Nl/bRTUlZs7L4rTgoqHv6LEmsXKAf9rZYq4b
-					eP6GF9I1Ry41MfHLc7lPUmtR38ErEsM5uGzw
-					trCQYEFhuRWUBxZ8OSL2EZK9rUBXZX+cwK/8
-					ZP7mIfDfljkXPQcmow== )
-			3600	DNSKEY	256 3 8 (
-					AwEAAfMzj6aZIgZDVcpH1pKOtq998E85+nEY
-					YJa0lLS8+QTCC1Efke8GLwsXT0IPTuwnOuXM
-					RjySirab0NuEr69T8KP/43YxcRdmCg89mjjN
-					szoVPPstC9xBKVOc0pRMDF7sfsTrSye3RY7+
-					Z6uZEH5FOAkz2hNbJJHOn4HpNUhLPJGRauhf
-					0evamwUmQ/mlhkVW5q4WmqPCDMNY3K6XtkEm
-					cvm8n9ZCXC9Z5AX6KpynujzLdKyxpdGqUk6r
-					lavp9ILPpRKoTZDX+2q1pDgP5cDndwtgNSvU
-					DBQZoD0psS2cyB3PHo+dPwwpEyM//ZSKsH9m
-					e85Ti0413TOWFyFd/jUOUA8=
-					) ; ZSK; alg = RSASHA256 ; key id = 19260
-			3600	DNSKEY	257 3 8 (
-					AwEAAbV8X06Qvk350aZ6eZ1d7WbT1H/Y0Sv7
-					qAdbk5fbYIKpMvZ8D9xqoTHgD0z0uCgWWIcm
-					/xyKBfmax76oLwMBpR/kdtuJz0irgFITnJCH
-					pEfR9AJ/Mfm7NyMglq+/39I03E1/LXvpXQLG
-					tg+Mo/2CUE5sbG31jmPNK/2J8RMESkIi87fW
-					azZU/oyUEtECE5PGbdyw+4PacAsXNjnwl30T
-					aatL277wX4pt+IUPdE6EIph3t+dxXJ7OpHgW
-					8g+YSHLlCImLVapdg3oD/cs6ncaBq9z7la5Y
-					dHNw2QAIAvQ11EsonrkonPqO6zNVZAVdT2VB
-					X5YzGAoCFUvbCvlnl2a7SxM=
-					) ; KSK; alg = RSASHA256 ; key id = 65482
-			3600	RRSIG	DNSKEY 8 2 3600 (
-					20171105054434 20171006054434 19260 prep.example.
-					pPw81pJ3PeF+tqEswTul9N8Qsl9JKgK4v8SV
-					lPfP0pnlMBMbtMFFkx5ZmhQg3Z3U8SdE64Bt
-					C5St3qItyyKdTQ0Rbm9mfV6twxDB8lVry8F7
-					Pv7gJmmcWzBcbLGcrXIrVNSZhigkemQXTElj
-					P8y1j7kaNFWBWbDMn7KesiZ9BiC6sqvuKa3R
-					wSofjwXTESspWZP0NtXr5ymaBIMR9UtNj5Wh
-					jm1+tg6BxNBKxhCHlSC0ltPS/qq9J1ZUmtJz
-					sj/EAFfPVJVuEveebMvi1oDWPTgajO9+EHl4
-					ELrgnQHCgaybMzbpd/A5+Tr1hQkv48I8Mb0/
-					8LJ2/6xrvJm64yRteg== )
-			3600	RRSIG	DNSKEY 8 2 3600 (
-					20171105054434 20171006054434 65482 prep.example.
-					WeIWiC9SnBe2+UocVjpap62O8Rz+iljwJiu9
-					VlGUwct3Vydq4/4FVAKdPklXV5cYbBLhO2MB
-					3R4toX8RNU/0Ny8DnugQzLKvVfg0xoyU/UAJ
-					k4aWa/vPivSLGouLQPiNp71bdXN4LB/2xmzu
-					cPYXzS9ePpwCOp/9JLoNjBSMQkfjfWAcaNtj
-					1DKDmHHL1sPMizninxSJLQOAKb+JwUAjAkOM
-					O1JqwkB12/IZuzxN5hly+uNsbFFxPzQkcnJ4
-					5bhzxuh5D/JRXW0nF5aO4aR+9X+lSUpDJQZ1
-					5fOt1cybZCn/ag68RA92zrnisdbrggJGS003
-					wn/VKbLVfFj3eQrfNA== )
-ns1.prep.example.	300	IN A	1.1.1.1
-			300	RRSIG	A 8 3 300 (
-					20171105054434 20171006054434 19260 prep.example.
-					QUyDyJVk3JGEq+VTZtY3firzsRqOA0LUm3Tf
-					/fnemQBeOlMda2ErA7DqYVriIGfM8jph416E
-					YX8SKAZXGEAlsEbC9cWBVyc5TYH6tZ43sV51
-					55kGTiUY92NnrH10Q+m2SLAEEaKCA/cgBwOR
-					tN2Wb1meHgiLbGYN2LbANfDQzoEk4AYAgT6r
-					wDKVVg/V9Ed7JnCnBQc9MN9+LQ3h4NBGUiEY
-					mr7HX2w+yzqcGFNLI1aFPe2IwFt120QPLyyl
-					cZgc6FUBX4YCnWoCb0aFyyOT76AQkKF5YBRn
-					gAv6S8q1pZ/0B5w4gjaLEGlts3LG0bxZ1GJd
-					gCQMEhgYgyXUchTtZA== )
-			3600	NSEC	prep.example. A RRSIG NSEC
-			3600	RRSIG	NSEC 8 3 3600 (
-					20171105054434 20171006054434 19260 prep.example.
-					rDWN40u1a3DSzWOrS+4YR2XOxaem0BAQ/glN
-					QkXNDew1WsZo3fe0IHIhDKlJ/5MJAfAHq8Xs
-					A5UGUw2efoNAN/0LuWsI/9IPm4dwQOXiTCly
-					uxugXf5islPYyvn1Z14ay/7/2P3W6HZknXzo
-					lZFpwqfFZQCxz7c/1aH+2ntAMeqx8LHuewSr
-					Rz/sLsSiCcZQ6NMWnZdoC5SGy4CTcIIPPS8z
-					9dQ6QYTC5iq4MKRfyJUyvODyU9be4e6jbo5b
-					mjRcov4ttbImhD5jrLAZIfjO6DSazGNVFf/x
-					6rjxjrc8SISPkt2xYwcOlYch9OZuoH86wcZu
-					3Don6yAnLDYDrZylAA== )
@@ -1,2 +0,0 @@
-prep.example.		IN DS 65482 8 1 F3673708FBADDEC3EB55933E2E393ACE85EAC2BB
-prep.example.		IN DS 65482 8 2 51A7C97AAC42803DA515D1CAFEE28031A5018F6345F12F4B6C1B6D20 02B59820
@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# Copyright (C) 2012-2014, 2016, 2017  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2012-2014, 2016  Internet Systems Consortium, Inc. ("ISC")
 #
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -171,15 +171,6 @@ n=`expr $n + 1`
 if [ $ret != 0 ]; then echo "I:failed"; fi
 status=`expr $status + $ret`

-echo "I:checking with prepared dsset file ($n)"
-ret=0
-$CHECKDS -f prep.example.db -s prep.example.ds.db prep.example > checkds.out.$n || ret=1
-grep 'SHA-1.*found' checkds.out.$n > /dev/null 2>&1 || ret=1
-grep 'SHA-256.*found' checkds.out.$n > /dev/null 2>&1 || ret=1
-n=`expr $n + 1`
-if [ $ret != 0 ]; then echo "I:failed"; fi
-status=`expr $status + $ret`
-
 if [ $status = 0 ]; then $SHELL clean.sh; fi
 echo "I:exit status: $status"
 [ $status -eq 0 ] || exit 1
@@ -186,19 +186,6 @@ else
 	}
 fi

-#
-# Useful functions in test scripts
-#
-
-# nextpart: read everything that's been appended to a file since the
-# last time 'nextpart' was called.
-nextpart () {
-    [ -f $1.prev ] || echo "0" > $1.prev
-    prev=`cat $1.prev`
-    awk "NR > $prev "'{ print }
-         END          { print NR > "/dev/stderr" }' $1 2> $1.prev
-}
-
 #
 # Export command paths
 #
@@ -58,8 +58,6 @@ MDIG=$TOP/Build/$VSCONF/mdig@EXEEXT@
 NZD2NZF=$TOP/Build/$VSCONF/named-nzd2nzf@EXEEXT@
 FSTRM_CAPTURE=@FSTRM_CAPTURE@
 FEATURETEST=$TOP/Build/$VSCONF/feature-test@EXEEXT@
-SAMPLEUPDATE=$TOP/Build/$VSCONF/update@EXEEXT@
-
 # to port WIRETEST=$TOP/Build/$VSCONF/wire_test@EXEEXT@

 # this is given as argument to native WIN32 executables
@@ -178,19 +176,6 @@ echoinfo () {
        printf "${COLOR_INFO}%s${COLOR_NONE}\n" "$*"
 }

-#
-# Useful functions in test scripts
-#
-
-# nextpart: read everything that's been appended to a file since the
-# last time 'nextpart' was called.
-nextpart () {
-    [ -f $1.prev ] || echo "0" > $1.prev
-    prev=`cat $1.prev`
-    awk "NR > $prev "'{ print }
-         END          { print NR > "/dev/stderr" }' $1 2> $1.prev
-}
-
 #
 # Export command paths
 #
@@ -226,7 +211,6 @@ export RANDFILE
 export RESOLVE
 export RNDC
 export RRCHECKER
-export SAMPLEUPDATE
 export SIGNER
 export SUBDIRS
 export TESTSOCK6
@@ -24,8 +24,8 @@ options {
 	dnssec-must-be-secure mustbesecure.example yes;
 	minimal-responses no;

-	nta-lifetime 12s;
-	nta-recheck 9s;
+	nta-lifetime 10s;
+	nta-recheck 7s;

 	# Note: We only reference the bind.keys file here to confirm that it
 	# is *not* being used.  It contains the real root key, and we're
@@ -1722,7 +1722,7 @@ echo "I: waiting for NTA rechecks/expirations"
 # fakenode.secure.example should both be lifted, but badds.example
 # should still be going.
 #
-$PERL -e 'my $delay =  '$start' + 10 - time(); select(undef, undef, undef, $delay) if ($delay > 0);'
+$PERL -e 'my $delay =  '$start' + 8 - time(); select(undef, undef, undef, $delay) if ($delay > 0);'
 $DIG $DIGOPTS b.secure.example. a @10.53.0.4 > dig.out.ns4.test$n.8 || ret=1
 grep "status: SERVFAIL" dig.out.ns4.test$n.8 > /dev/null && ret=1
 grep "flags:[^;]* ad[^;]*;" dig.out.ns4.test$n.8 > /dev/null || ret=1
@@ -1742,7 +1742,7 @@ ret=0
 # it should still be NTA'd, but badds.example used the default
 # lifetime of 10s, so it should revert to SERVFAIL now.
 #
-$PERL -e 'my $delay = '$start' + 13 - time(); select(undef, undef, undef, $delay) if ($delay > 0);'
+$PERL -e 'my $delay = '$start' + 11 - time(); select(undef, undef, undef, $delay) if ($delay > 0);'
 # check nta table
 $RNDC -c ../common/rndc.conf -s 10.53.0.4 -p 9953 nta -d > rndc.out.ns4.test$n._11
 lines=`grep " expiry " rndc.out.ns4.test$n._11 | wc -l`
@@ -2501,15 +2501,9 @@ do
 done;
 grep "ANSWER: 3," dig.out.ns2.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo "I:nsec3 chain generation not complete"; fi
+sleep 3
 $DIG $DIGOPTS +noauth +nodnssec soa nsec3chain-test @10.53.0.2 > dig.out.ns2.test$n || ret=1
-s2=`awk '$4 == "SOA" { print $7}' dig.out.ns2.test$n`
-for i in 1 2 3 4 5 6 7 8 9 10
-do
-	$DIG $DIGOPTS +noauth +nodnssec soa nsec3chain-test @10.53.0.3 > dig.out.ns3.test$n || ret=1
-	s3=`awk '$4 == "SOA" { print $7}' dig.out.ns3.test$n`
-	test "$s2" = "$s3" && break
-	sleep 1
-done
+$DIG $DIGOPTS +noauth +nodnssec soa nsec3chain-test @10.53.0.3 > dig.out.ns3.test$n || ret=1
 $PERL ../digcomp.pl dig.out.ns2.test$n dig.out.ns3.test$n || ret=1
 n=`expr $n + 1`
 if [ $ret != 0 ]; then echo "I:failed"; fi
@@ -36,6 +36,7 @@ usage() {
 	fprintf(stderr, "args:\n");
 	fprintf(stderr, "	--edns-version\n");
 	fprintf(stderr, "	--enable-dnsrps\n");
+	fprintf(stderr, "	--enable-filter-aaaa\n");
 	fprintf(stderr, "	--gethostname\n");
 	fprintf(stderr, "	--gssapi\n");
 	fprintf(stderr, "	--have-dlopen\n");
@@ -62,6 +63,14 @@ main(int argc, char **argv) {
 #endif
 	}

+	if (strcmp(argv[1], "--enable-filter-aaaa") == 0) {
+#ifdef ALLOW_FILTER_AAAA
+		return (0);
+#else
+		return (1);
+#endif
+	}
+
 	if (strcmp(argv[1], "--edns-version") == 0) {
 #ifdef DNS_EDNS_VERSION
 		printf("%d\n", DNS_EDNS_VERSION);
@@ -0,0 +1,16 @@
+#!/bin/sh
+#
+# Copyright (C) 2010, 2012, 2014, 2016  Internet Systems Consortium, Inc. ("ISC")
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+SYSTEMTESTTOP=..
+. $SYSTEMTESTTOP/conf.sh
+
+$FEATURETEST --enable-filter-aaaa || {
+    echo "I:This test requires --enable-filter-aaaa at compile time." >&2
+    exit 255
+}
+exit 0
@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# Copyright (C) 2005, 2007, 2011-2014, 2016, 2017  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2005, 2007, 2011-2014, 2016  Internet Systems Consortium, Inc. ("ISC")
 #
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -238,16 +238,6 @@ done
 [ $ret -eq 0 ] || echo "I:failed"
 status=`expr $status + $ret`

-# stomp on the file header
-echo "I:checking corrupt map files fail to load (bad file header)"
-ret=0
-./named-compilezone -D -f text -F map -o map.5 example.nil baseline.txt > /dev/null
-cp map.5 badmap
-stomp badmap 0 32 99
-./named-compilezone -D -f map -F text -o text.5 example.nil badmap > /dev/null
-[ $? = 1 ] || ret=1
-[ $ret -eq 0 ] || echo "I:failed"
-status=`expr $status + $ret`
 # stomp on the file data so it hashes differently.
 # these are small and subtle changes, so that the resulting file
 # would appear to be a legitimate map file and would not trigger an
@@ -255,6 +245,7 @@ status=`expr $status + $ret`
 # load because of a SHA1 hash mismatch.
 echo "I:checking corrupt map files fail to load (bad node header)"
 ret=0
+./named-compilezone -D -f text -F map -o map.5 example.nil baseline.txt > /dev/null
 cp map.5 badmap
 stomp badmap 2754 2 99
 ./named-compilezone -D -f map -F text -o text.5 example.nil badmap > /dev/null
@@ -16,8 +16,16 @@ is used so it will send TAT queries once per second.

 ns3 is a validator with a broken key in managed-keys.

-ns4 is a validator with a deliberately broken managed-keys.bind and
-managed-keys.jnl, causing RFC 5011 initialization to fail.
+Tests TODO:

-ns5 is a validator which is prevented from getting a response from the
-root server, causing key refresh queries to fail.
+- initial working KSK
+
+TODO: test using delv with new trusted key too
+
+- introduce a REVOKE bit
+
+- later remove a signature
+
+- corrupt a signature
+
+TODO: also same things with dlv auto updates of trust anchor
@@ -10,10 +10,8 @@ rm -f */K* */*.signed */trusted.conf */*.jnl */*.bk
 rm -f dsset-. ns1/dsset-.
 rm -f ns*/named.lock
 rm -f */managed-keys.bind* */named.secroots
-rm -f */managed*.conf ns1/managed.key ns1/managed.key.id
-rm -f */named.memstats */named.run */named.run.prev
+rm -f */managed.conf ns1/managed.key ns1/managed.key.id
+rm -f */named.memstats */named.run
 rm -f dig.out* delv.out* rndc.out* signer.out*
 rm -f ns1/named.secroots ns1/root.db.signed* ns1/root.db.tmp
 rm -f ns1/named.conf
-rm -rf ns4/nope
-rm -f ns5/named.args
@@ -10,11 +10,6 @@

 controls { /* empty */ };

-acl allowed {
-	! 10.53.0.5;
-	any;
-};
-
 options {
 	query-source address 10.53.0.1;
 	notify-source 10.53.0.1;
@@ -27,7 +22,6 @@ options {
 	notify no;
 	dnssec-enable yes;
 	dnssec-validation yes;
-	allow-query { allowed; };
 };

 key rndc_key {
@@ -10,11 +10,6 @@

 controls { /* empty */ };

-acl allowed {
-	! 10.53.0.5;
-	any;
-};
-
 options {
 	query-source address 10.53.0.1;
 	notify-source 10.53.0.1;
@@ -27,7 +22,6 @@ options {
 	notify no;
 	dnssec-enable yes;
 	dnssec-validation yes;
-	allow-query { allowed; };
 };

 key rndc_key {
@@ -1,39 +0,0 @@
-/*
- * Copyright (C) 2017  Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- */
-
-// NS1
-
-controls { /* empty */ };
-
-options {
-	query-source address 10.53.0.1;
-	notify-source 10.53.0.1;
-	transfer-source 10.53.0.1;
-	port 5300;
-	pid-file "named.pid";
-	listen-on { 10.53.0.1; };
-	listen-on-v6 { none; };
-	recursion no;
-	notify no;
-	dnssec-enable yes;
-	dnssec-validation yes;
-};
-
-key rndc_key {
-	secret "1234abcd8765";
-	algorithm hmac-sha256;
-};
-
-controls {
-	inet 10.53.0.1 port 9953 allow { any; } keys { rndc_key; };
-};
-
-zone "." {
-	type master;
-	file "root.db.signed";
-};
@@ -1,10 +1,10 @@
-; Copyright (C) 2015-2017  Internet Systems Consortium, Inc. ("ISC")
+; Copyright (C) 2015, 2016  Internet Systems Consortium, Inc. ("ISC")
 ;
 ; This Source Code Form is subject to the terms of the Mozilla Public
 ; License, v. 2.0. If a copy of the MPL was not distributed with this
 ; file, You can obtain one at http://mozilla.org/MPL/2.0/.

-$TTL 20
+$TTL 2
 . 			IN SOA	gson.nominum.com. a.root.servers.nil. (
 				2000042100   	; serial
 				600         	; refresh
@@ -28,8 +28,6 @@ managed-keys {
 EOF
 ' > managed.conf
 cp managed.conf ../ns2/managed.conf
-cp managed.conf ../ns4/managed.conf
-cp managed.conf ../ns5/managed.conf

 # Configure a trusted key statement (used by delve)
 cat $keyname.key | grep -v '^; ' | $PERL -n -e '
@@ -1 +1 @@
-m record,size,mctx -T clienttest -c named.conf -d 99 -X named.lock -g -T mkeytimers=5/10/20 -T tat=1
+-m record,size,mctx -T clienttest -c named.conf -d 99 -X named.lock -g -T mkeytimers=2/20/40
@@ -1 +1 @@
-m record,size,mctx -T clienttest -c named.conf -d 99 -X named.lock -g -T mkeytimers=5/10/20
+-m record,size,mctx -T clienttest -c named.conf -d 99 -X named.lock -g -T mkeytimers=2/20/40 -T tat=1
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2015-2017  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2015, 2016  Internet Systems Consortium, Inc. ("ISC")
 *
 * This Source Code Form is subject to the terms of the Mozilla Public
 * License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -23,7 +23,6 @@ options {
 	dnssec-enable yes;
 	dnssec-validation yes;
 	bindkeys-file "managed.conf";
-	trust-anchor-telemetry no;
 };

 key rndc_key {
@@ -1,41 +0,0 @@
-/*
- * Copyright (C) 2017  Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- */
-
-// NS4
-
-controls { /* empty */ };
-
-options {
-	query-source address 10.53.0.4;
-	notify-source 10.53.0.4;
-	transfer-source 10.53.0.4;
-	port 5300;
-	pid-file "named.pid";
-	listen-on { 10.53.0.4; };
-	listen-on-v6 { none; };
-	recursion yes;
-	notify no;
-	dnssec-enable yes;
-	dnssec-validation auto;
-	bindkeys-file "managed.conf";
-	managed-keys-directory "nope";
-};
-
-key rndc_key {
-	secret "1234abcd8765";
-	algorithm hmac-sha256;
-};
-
-controls {
-	inet 10.53.0.4 port 9953 allow { any; } keys { rndc_key; };
-};
-
-zone "." {
-	type hint;
-	file "../../common/root.hint";
-};
@@ -1,38 +0,0 @@
-/*
- * Copyright (C) 2017  Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- */
-
-// NS5
-
-options {
-	query-source address 10.53.0.5;
-	notify-source 10.53.0.5;
-	transfer-source 10.53.0.5;
-	port 5300;
-	pid-file "named.pid";
-	listen-on { 10.53.0.5; };
-	listen-on-v6 { none; };
-	recursion yes;
-	notify no;
-	dnssec-enable yes;
-	dnssec-validation auto;
-	bindkeys-file "managed.conf";
-};
-
-key rndc_key {
-	secret "1234abcd8765";
-	algorithm hmac-sha256;
-};
-
-controls {
-	inet 10.53.0.5 port 9953 allow { any; } keys { rndc_key; };
-};
-
-zone "." {
-	type hint;
-	file "../../common/root.hint";
-};
@@ -1 +0,0 @@
-m record,size,mctx -T clienttest -c named.conf -d 99 -X named.lock -g
@@ -1 +0,0 @@
-m record,size,mctx -T clienttest -c named.conf -d 99 -X named.lock -g -T mkeytimers=2/20/40
@@ -14,14 +14,5 @@ $SHELL clean.sh
 test -r $RANDFILE || $GENRANDOM 800 $RANDFILE

 cp ns1/named1.conf ns1/named.conf
-cp ns5/named1.args ns5/named.args

-( cd ns1 && $SHELL sign.sh )
-
-cp ns2/managed.conf ns2/managed1.conf
-
-cd ns4
-mkdir nope
-touch nope/managed-keys.bind
-touch nope/managed.keys.bind.jnl
-chmod 444 nope/*
+cd ns1 && $SHELL sign.sh
@@ -9,78 +9,6 @@
 SYSTEMTESTTOP=..
 . $SYSTEMTESTTOP/conf.sh

-wait_for_log() {
-	msg=$1
-	file=$2
-	for i in 1 2 3 4 5 6 7 8 9 10; do
-		nextpart "$file" | grep "$msg" > /dev/null && return
-		sleep 1
-	done
-	echo "I: exceeded time limit waiting for '$msg' in $file"
-	ret=1
-}
-
-mkeys_reconfig_on() {
-	nsidx=$1
-	nextpart ns${nsidx}/named.run > /dev/null
-	$RNDC -c ../common/rndc.conf -s 10.53.0.${nsidx} -p 9953 reconfig . | sed "s/^/I: ns${nsidx} /"
-	wait_for_log "running" ns${nsidx}/named.run
-}
-
-mkeys_reload_on() {
-	nsidx=$1
-	nextpart ns${nsidx}/named.run > /dev/null
-	$RNDC -c ../common/rndc.conf -s 10.53.0.${nsidx} -p 9953 reload . | sed "s/^/I: ns${nsidx} /"
-	wait_for_log "loaded serial" ns${nsidx}/named.run
-}
-
-mkeys_loadkeys_on() {
-	nsidx=$1
-	nextpart ns${nsidx}/named.run > /dev/null
-	$RNDC -c ../common/rndc.conf -s 10.53.0.${nsidx} -p 9953 loadkeys . | sed "s/^/I: ns${nsidx} /"
-	wait_for_log "next key event" ns${nsidx}/named.run
-}
-
-mkeys_refresh_on() {
-	nsidx=$1
-	nextpart ns${nsidx}/named.run > /dev/null
-	$RNDC -c ../common/rndc.conf -s 10.53.0.${nsidx} -p 9953 managed-keys refresh | sed "s/^/I: ns${nsidx} /"
-	wait_for_log "Returned from key fetch in keyfetch_done()" ns${nsidx}/named.run
-}
-
-mkeys_sync_on() {
-	# No race with mkeys_refresh_on() is possible as even if the latter
-	# returns immediately after the expected log message is written, the
-	# managed-keys zone is already locked and the command below calls
-	# dns_zone_flush(), which also attempts to take that zone's lock
-	nsidx=$1
-	nextpart ns${nsidx}/named.run > /dev/null
-	$RNDC -c ../common/rndc.conf -s 10.53.0.${nsidx} -p 9953 managed-keys sync | sed "s/^/I: ns${nsidx} /"
-	wait_for_log "dump_done" ns${nsidx}/named.run
-}
-
-mkeys_status_on() {
-	# No race with mkeys_refresh_on() is possible as even if the latter
-	# returns immediately after the expected log message is written, the
-	# managed-keys zone is already locked and the command below calls
-	# mkey_status(), which in turn calls dns_zone_getrefreshkeytime(),
-	# which also attempts to take that zone's lock
-	nsidx=$1
-	$RNDC -c ../common/rndc.conf -s 10.53.0.${nsidx} -p 9953 managed-keys status
-}
-
-mkeys_flush_on() {
-	nsidx=$1
-	nextpart ns${nsidx}/named.run > /dev/null
-	$RNDC -c ../common/rndc.conf -s 10.53.0.${nsidx} -p 9953 flush | sed "s/^/I: ns${nsidx} /"
-	wait_for_log "flushing caches in all views succeeded" ns${nsidx}/named.run
-}
-
-mkeys_secroots_on() {
-	nsidx=$1
-	$RNDC -c ../common/rndc.conf -s 10.53.0.${nsidx} -p 9953 secroots | sed "s/^/I: ns${nsidx} /"
-}
-
 status=0
 n=1

@@ -130,9 +58,11 @@ n=`expr $n + 1`
 echo "I: check new trust anchor can be added ($n)"
 ret=0
 standby1=`$KEYGEN -a rsasha256 -qfk -r $RANDFILE -K ns1 .`
-mkeys_loadkeys_on 1
-mkeys_refresh_on 2
-mkeys_status_on 2 > rndc.out.$n 2>&1
+$RNDC -c ../common/rndc.conf -s 10.53.0.1 -p 9953 loadkeys . | sed 's/^/I: ns1 /'
+sleep 5
+$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys refresh | sed 's/^/I: ns2 /'
+$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys sync | sed 's/^/I: ns2 /'
+$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys status > rndc.out.$n 2>&1
 # there should be two keys listed now
 count=`grep -c "keyid: " rndc.out.$n` 
 [ "$count" -eq 2 ] || ret=1
@@ -151,8 +81,10 @@ status=`expr $status + $ret`
 n=`expr $n + 1`
 echo "I: check new trust anchor can't be added with bad initial key ($n)"
 ret=0
-mkeys_refresh_on 3
-mkeys_status_on 3 > rndc.out.$n 2>&1
+$RNDC -c ../common/rndc.conf -s 10.53.0.3 -p 9953 managed-keys refresh | sed 's/^/I: ns3 /'
+sleep 1
+$RNDC -c ../common/rndc.conf -s 10.53.0.3 -p 9953 managed-keys sync | sed 's/^/I: ns3 /'
+$RNDC -c ../common/rndc.conf -s 10.53.0.3 -p 9953 managed-keys status > rndc.out.$n 2>&1
 # there should be one key listed now
 count=`grep -c "keyid: " rndc.out.$n` 
 [ "$count" -eq 1 ] || ret=1
@@ -168,17 +100,14 @@ status=`expr $status + $ret`
 n=`expr $n + 1`
 echo "I: remove untrusted standby key, check timer restarts ($n)"
 ret=0
-mkeys_sync_on 2
-t1=`grep "trust pending" ns2/managed-keys.bind`
 $SETTIME -D now -K ns1 $standby1 > /dev/null
-mkeys_loadkeys_on 1
-# Less than a second may have passed since the last time ns2 received a
-# ./DNSKEY response from ns1.  Ensure keys are refreshed at a different
-# timestamp to prevent false negatives caused by the acceptance timer getting
-# reset to the same timestamp.
+t1=`grep "trust pending" ns2/managed-keys.bind`
+$RNDC -c ../common/rndc.conf -s 10.53.0.1 -p 9953 loadkeys . | sed 's/^/I: ns1 /'
+sleep 3
+$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys refresh | sed 's/^/I: ns2 /'
+sleep 1
+$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys sync | sed 's/^/I: ns2 /'
 sleep 1
-mkeys_refresh_on 2
-mkeys_sync_on 2
 t2=`grep "trust pending" ns2/managed-keys.bind`
 # trust pending date must be different
 [ -n "$t2" ] || ret=1
@@ -192,15 +121,12 @@ echo "I: restore untrusted standby key, revoke original key ($n)"
 t1=$t2
 $SETTIME -D none -K ns1 $standby1 > /dev/null
 $SETTIME -R now -K ns1 `cat ns1/managed.key` > /dev/null
-mkeys_loadkeys_on 1
-# Less than a second may have passed since the last time ns2 received a
-# ./DNSKEY response from ns1.  Ensure keys are refreshed at a different
-# timestamp to prevent false negatives caused by the acceptance timer getting
-# reset to the same timestamp.
+$RNDC -c ../common/rndc.conf -s 10.53.0.1 -p 9953 loadkeys . | sed 's/^/I: ns1 /'
+sleep 3
+$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys refresh | sed 's/^/I: ns2 /'
 sleep 1
-mkeys_refresh_on 2
-mkeys_sync_on 2
-mkeys_status_on 2 > rndc.out.$n 2>&1
+$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys sync | sed 's/^/I: ns2 /'
+$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys status > rndc.out.$n 2>&1
 # two keys listed
 count=`grep -c "keyid: " rndc.out.$n` 
 [ "$count" -eq 2 ] || ret=1
@@ -227,14 +153,10 @@ n=`expr $n + 1`
 ret=0
 echo "I: refresh managed-keys, ensure same result ($n)"
 t1=$t2
-# Less than a second may have passed since the last time ns2 received a
-# ./DNSKEY response from ns1.  Ensure keys are refreshed at a different
-# timestamp to prevent false negatives caused by the acceptance timer getting
-# reset to the same timestamp.
-sleep 1
-mkeys_refresh_on 2
-mkeys_sync_on 2
-mkeys_status_on 2 > rndc.out.$n 2>&1
+sleep 2
+$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys refresh | sed 's/^/I: ns2 /'
+$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys sync | sed 's/^/I: ns2 /'
+$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys status > rndc.out.$n 2>&1
 # two keys listed
 count=`grep -c "keyid: " rndc.out.$n` 
 [ "$count" -eq 2 ] || ret=1
@@ -262,17 +184,15 @@ ret=0
 echo "I: restore revoked key, ensure same result ($n)"
 t1=$t2
 $SETTIME -R none -D now -K ns1 `cat ns1/managed.key` > /dev/null
-mkeys_loadkeys_on 1
+$RNDC -c ../common/rndc.conf -s 10.53.0.1 -p 9953 loadkeys . | sed 's/^/I: ns1 /'
+sleep 3
 $SETTIME -D none -K ns1 `cat ns1/managed.key` > /dev/null
-mkeys_loadkeys_on 1
-# Less than a second may have passed since the last time ns2 received a
-# ./DNSKEY response from ns1.  Ensure keys are refreshed at a different
-# timestamp to prevent false negatives caused by the acceptance timer getting
-# reset to the same timestamp.
+$RNDC -c ../common/rndc.conf -s 10.53.0.1 -p 9953 loadkeys . | sed 's/^/I: ns1 /'
+sleep 3
+$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys refresh | sed 's/^/I: ns2 /'
 sleep 1
-mkeys_refresh_on 2
-mkeys_sync_on 2
-mkeys_status_on 2 > rndc.out.$n 2>&1
+$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys sync | sed 's/^/I: ns2 /'
+$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys status > rndc.out.$n 2>&1
 # two keys listed
 count=`grep -c "keyid: " rndc.out.$n` 
 [ "$count" -eq 2 ] || ret=1
@@ -295,44 +215,17 @@ t2=`grep "trust pending" ns2/managed-keys.bind`
 if [ $ret != 0 ]; then echo "I:failed"; fi
 status=`expr $status + $ret`

-echo "I: reinitialize trust anchors, add second key to bind.keys"
+echo "I: reinitialize trust anchors"
 $PERL $SYSTEMTESTTOP/stop.pl --use-rndc . ns2
 rm -f ns2/managed-keys.bind*
-cat ns1/$standby1.key | grep -v '^; ' | $PERL -n -e '
-local ($dn, $class, $type, $flags, $proto, $alg, @rest) = split;
-local $key = join("", @rest);
-local $originalkey = `grep initial-key ns2/managed1.conf`;
-print <<EOF
-managed-keys {
-    $originalkey
-    "$dn" initial-key $flags $proto $alg "$key";
-};
-EOF
-' > ns2/managed.conf
-nextpart ns2/named.run > /dev/null
-$PERL $SYSTEMTESTTOP/start.pl --noclean --restart . ns2
-
-n=`expr $n + 1`
-echo "I: check that no key from bind.keys is marked as an initializing key ($n)"
-ret=0
-wait_for_log "Returned from key fetch in keyfetch_done()" ns2/named.run
-mkeys_secroots_on 2
-grep '; initializing' ns2/named.secroots > /dev/null 2>&1 && ret=1
-if [ $ret != 0 ]; then echo "I:failed"; fi
-status=`expr $status + $ret`
-
-echo "I: reinitialize trust anchors, revert to one key in bind.keys"
-$PERL $SYSTEMTESTTOP/stop.pl --use-rndc . ns2
-rm -f ns2/managed-keys.bind*
-mv ns2/managed1.conf ns2/managed.conf
-nextpart ns2/named.run > /dev/null
 $PERL $SYSTEMTESTTOP/start.pl --noclean --restart . ns2

 n=`expr $n + 1`
 echo "I: check that standby key is now trusted ($n)"
 ret=0
-wait_for_log "Returned from key fetch in keyfetch_done()" ns2/named.run
-mkeys_status_on 2 > rndc.out.$n 2>&1
+sleep 3
+$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys sync | sed 's/^/I: ns2 /'
+$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys status > rndc.out.$n 2>&1
 # two keys listed
 count=`grep -c "keyid: " rndc.out.$n` 
 [ "$count" -eq 2 ] || ret=1
@@ -350,9 +243,12 @@ echo "I: revoke original key, add new standby ($n)"
 ret=0
 standby2=`$KEYGEN -a rsasha256 -qfk -r $RANDFILE -K ns1 .`
 $SETTIME -R now -K ns1 `cat ns1/managed.key` > /dev/null
-mkeys_loadkeys_on 1
-mkeys_refresh_on 2
-mkeys_status_on 2 > rndc.out.$n 2>&1
+$RNDC -c ../common/rndc.conf -s 10.53.0.1 -p 9953 loadkeys . | sed 's/^/I: ns1 /'
+sleep 3
+$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys refresh | sed 's/^/I: ns2 /'
+sleep 1
+$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys sync | sed 's/^/I: ns2 /'
+$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys status > rndc.out.$n 2>&1
 # three keys listed
 count=`grep -c "keyid: " rndc.out.$n` 
 [ "$count" -eq 3 ] || ret=1
@@ -381,9 +277,11 @@ n=`expr $n + 1`
 echo "I: revoke standby before it is trusted ($n)"
 ret=0
 standby3=`$KEYGEN -a rsasha256 -qfk -r $RANDFILE -K ns1 .`
-mkeys_loadkeys_on 1
-mkeys_refresh_on 2
-mkeys_status_on 2 > rndc.out.a.$n 2>&1
+$RNDC -c ../common/rndc.conf -s 10.53.0.1 -p 9953 loadkeys . | sed 's/^/I: ns1 /'
+sleep 3
+$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys refresh | sed 's/^/I: ns2 /'
+sleep 1
+$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys status > rndc.out.a.$n 2>&1
 # four keys listed
 count=`grep -c "keyid: " rndc.out.a.$n` 
 [ "$count" -eq 4 ] || { echo "keyid: count ($count) != 4"; ret=1; }
@@ -394,9 +292,11 @@ count=`grep -c "trust revoked" rndc.out.a.$n`
 count=`grep -c "trust pending" rndc.out.a.$n` 
 [ "$count" -eq 2 ] || { echo "trust pending count ($count) != 2"; ret=1; }
 $SETTIME -R now -K ns1 $standby3 > /dev/null
-mkeys_loadkeys_on 1
-mkeys_refresh_on 2
-mkeys_status_on 2 > rndc.out.b.$n 2>&1
+$RNDC -c ../common/rndc.conf -s 10.53.0.1 -p 9953 loadkeys . | sed 's/^/I: ns1 /'
+sleep 3
+$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys refresh | sed 's/^/I: ns2 /'
+sleep 1
+$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys status > rndc.out.b.$n 2>&1
 # now three keys listed
 count=`grep -c "keyid: " rndc.out.b.$n` 
 [ "$count" -eq 3 ] || { echo "keyid: count ($count) != 3"; ret=1; }
@@ -407,16 +307,18 @@ count=`grep -c "trust revoked" rndc.out.b.$n`
 count=`grep -c "trust pending" rndc.out.b.$n` 
 [ "$count" -eq 1 ] || { echo "trust pending count ($count) != 1"; ret=1; }
 $SETTIME -D now -K ns1 $standby3 > /dev/null
-mkeys_loadkeys_on 1
+$RNDC -c ../common/rndc.conf -s 10.53.0.1 -p 9953 loadkeys . | sed 's/^/I: ns1 /'
 if [ $ret != 0 ]; then echo "I:failed"; fi
 status=`expr $status + $ret`

 n=`expr $n + 1`
-echo "I: wait 20 seconds for key add/remove holddowns to expire ($n)"
+echo "I: wait 30 seconds for key add/remove holddowns to expire ($n)"
 ret=0
-sleep 20
-mkeys_refresh_on 2
-mkeys_status_on 2 > rndc.out.$n 2>&1
+sleep 30
+$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys refresh | sed 's/^/I: ns2 /'
+sleep 1
+$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys sync | sed 's/^/I: ns2 /'
+$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys status > rndc.out.$n 2>&1
 # two keys listed
 count=`grep -c "keyid: " rndc.out.$n` 
 [ "$count" -eq 2 ] || ret=1
@@ -438,9 +340,12 @@ ret=0
 $SETTIME -D now -K ns1 `cat ns1/managed.key` > /dev/null
 $SETTIME -R now -K ns1 $standby1 > /dev/null
 $SETTIME -R now -K ns1 $standby2 > /dev/null
-mkeys_loadkeys_on 1
-mkeys_refresh_on 2
-mkeys_status_on 2 > rndc.out.$n 2>&1
+$RNDC -c ../common/rndc.conf -s 10.53.0.1 -p 9953 loadkeys . | sed 's/^/I: ns1 /'
+sleep 3
+$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys refresh | sed 's/^/I: ns2 /'
+sleep 1
+$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys sync | sed 's/^/I: ns2 /'
+$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys status > rndc.out.$n 2>&1
 # two keys listed
 count=`grep -c "keyid: " rndc.out.$n` 
 [ "$count" -eq 2 ] || ret=1
@@ -462,10 +367,8 @@ status=`expr $status + $ret`
 n=`expr $n + 1`
 echo "I: check for insecure response ($n)"
 ret=0
-mkeys_refresh_on 2
 $DIG $DIGOPTS +noauth example. @10.53.0.2 txt > dig.out.ns2.test$n || ret=1
 grep "status: NOERROR" dig.out.ns2.test$n > /dev/null || ret=1
-grep "flags:.*ad.*QUERY" dig.out.ns2.test$n > /dev/null && ret=1
 grep "example..*.RRSIG..*TXT" dig.out.ns2.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo "I:failed"; fi
 status=`expr $status + $ret`
@@ -477,18 +380,16 @@ $SETTIME -D now -K ns1 $standby2 > /dev/null
 $SIGNER -Sg -K ns1 -N unixtime -r $RANDFILE -o . ns1/root.db > /dev/null 2>&-
 cp ns1/named2.conf ns1/named.conf
 rm -f ns1/root.db.signed.jnl
-mkeys_reconfig_on 1
+$RNDC -c ../common/rndc.conf -s 10.53.0.1 -p 9953 reconfig

 echo "I: reinitialize trust anchors"
 $PERL $SYSTEMTESTTOP/stop.pl --use-rndc . ns2
 rm -f ns2/managed-keys.bind*
-nextpart ns2/named.run > /dev/null
 $PERL $SYSTEMTESTTOP/start.pl --noclean --restart . ns2

 n=`expr $n + 1`
 echo "I: check positive validation ($n)"
 ret=0
-wait_for_log "Returned from key fetch in keyfetch_done()" ns2/named.run
 $DIG $DIGOPTS +noauth example. @10.53.0.2 txt > dig.out.ns2.test$n || ret=1
 grep "flags:.*ad.*QUERY" dig.out.ns2.test$n > /dev/null || ret=1
 grep "example..*.RRSIG..*TXT" dig.out.ns2.test$n > /dev/null || ret=1
@@ -502,25 +403,17 @@ orig=`cat ns1/managed.key`
 keyid=`cat ns1/managed.key.id`
 revoked=`$REVOKE -K ns1 $orig`
 rkeyid=`expr $revoked : 'ns1/K\.+00.+0*\([1-9]*[0-9]*[0-9]\)'`
-rm -f ns1/root.db.signed.jnl
-# We need to activate at least one valid DNSKEY to prevent dnssec-signzone from
-# failing.  Alternatively, we could use -P to disable post-sign verification,
-# but we actually do want post-sign verification to happen to ensure the zone
-# is correct before we break it on purpose.
 $SETTIME -R none -D none -K ns1 $standby1 > /dev/null
 $SIGNER -Sg -K ns1 -N unixtime -r $RANDFILE -O full -o . -f signer.out.$n ns1/root.db > /dev/null 2>&-
 cp -f ns1/root.db.signed ns1/root.db.tmp
 BADSIG="SVn2tLDzpNX2rxR4xRceiCsiTqcWNKh7NQ0EQfCrVzp9WEmLw60sQ5kP xGk4FS/xSKfh89hO2O/H20Bzp0lMdtr2tKy8IMdU/mBZxQf2PXhUWRkg V2buVBKugTiOPTJSnaqYCN3rSfV1o7NtC1VNHKKK/D5g6bpDehdn5Gaq kpBhN+MSCCh9OZP2IT20luS1ARXxLlvuSVXJ3JYuuhTsQXUbX/SQpNoB Lo6ahCE55szJnmAxZEbb2KOVnSlZRA6ZBHDhdtO0S4OkvcmTutvcVV+7 w53CbKdaXhirvHIh0mZXmYk2PbPLDY7PU9wSH40UiWPOB9f00wwn6hUe uEQ1Qg=="
-# Less than a second may have passed since ns1 was started.  If we call
-# dnssec-signzone immediately, ns1/root.db.signed will not be reloaded by the
-# subsequent "rndc reload ." call on platforms which do not set the
-# "nanoseconds" field of isc_time_t, due to zone load time being seemingly
-# equal to master file modification time.
-sleep 1
 sed -e "/ $rkeyid \./s, \. .*$, . $BADSIG," signer.out.$n > ns1/root.db.signed
-mkeys_reload_on 1
-mkeys_refresh_on 2
-mkeys_status_on 2 > rndc.out.$n 2>&1
+$RNDC -c ../common/rndc.conf -s 10.53.0.1 -p 9953 reload . | sed 's/^/I: ns1 /'
+sleep 3
+$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys refresh | sed 's/^/I: ns2 /'
+sleep 1
+$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys sync | sed 's/^/I: ns2 /'
+$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys status > rndc.out.$n 2>&1
 # one key listed
 count=`grep -c "keyid: " rndc.out.$n` 
 [ "$count" -eq 1 ] || { echo "'keyid:' count ($count) != 1"; ret=1; }
@@ -541,7 +434,6 @@ status=`expr $status + $ret`
 n=`expr $n + 1`
 echo "I: check validation fails with bad DNSKEY rrset ($n)"
 ret=0
-mkeys_flush_on 2
 $DIG $DIGOPTS +noauth example. @10.53.0.2 txt > dig.out.ns2.test$n || ret=1
 grep "status: SERVFAIL" dig.out.ns2.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo "I:failed"; fi
@@ -551,18 +443,17 @@ n=`expr $n + 1`
 echo "I: restore DNSKEY rrset, check validation succeeds again ($n)"
 ret=0
 rm -f ${revoked}.key ${revoked}.private
-rm -f ns1/root.db.signed.jnl
 $SETTIME -D none -R none -K ns1 `cat ns1/managed.key` > /dev/null
 $SETTIME -D now -K ns1 $standby1 > /dev/null
-# Less than a second may have passed since ns1 was started.  If we call
-# dnssec-signzone immediately, ns1/root.db.signed will not be reloaded by the
-# subsequent "rndc reload ." call on platforms which do not set the
-# "nanoseconds" field of isc_time_t, due to zone load time being seemingly
-# equal to master file modification time.
+$SETTIME -D now -K ns1 $standby2 > /dev/null
+$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 flush | sed 's/^/I: ns1 /'
 sleep 1
 $SIGNER -Sg -K ns1 -N unixtime -r $RANDFILE -o . ns1/root.db > /dev/null 2>&-
-mkeys_reload_on 1
-mkeys_flush_on 2
+$RNDC -c ../common/rndc.conf -s 10.53.0.1 -p 9953 reload . | sed 's/^/I: ns1 /'
+sleep 3
+$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys refresh | sed 's/^/I: ns2 /'
+sleep 1
+$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys status > rndc.out.$n 2>&1
 $DIG $DIGOPTS +noauth example. @10.53.0.2 txt > dig.out.ns2.test$n || ret=1
 grep "flags:.*ad.*QUERY" dig.out.ns2.test$n > /dev/null || ret=1
 grep "example..*.RRSIG..*TXT" dig.out.ns2.test$n > /dev/null || ret=1
@@ -571,24 +462,15 @@ status=`expr $status + $ret`

 n=`expr $n + 1`
 echo "I: reset the root server with no keys, check for minimal update ($n)"
-ret=0
-# Refresh keys first to prevent previous checks from influencing this one.
-# Note that we might still get occasional false negatives on some really slow
-# machines, when $t1 equals $t2 due to the time elapsed between "rndc
-# managed-keys status" calls being equal to the normal active refresh period
-# (as calculated per rules listed in RFC 5011 section 2.3) minus an "hour" (as
-# set using -T mkeytimers).
-mkeys_refresh_on 2
-mkeys_status_on 2 > rndc.out.$n 2>&1
+$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys status > rndc.out.$n 2>&1
 t1=`grep 'next refresh:' rndc.out.$n`
 $PERL $SYSTEMTESTTOP/stop.pl --use-rndc . ns1
-rm -f ns1/root.db.signed.jnl
 cp ns1/root.db ns1/root.db.signed
-nextpart ns1/named.run > /dev/null
 $PERL $SYSTEMTESTTOP/start.pl --noclean --restart . ns1
-wait_for_log "loaded serial" ns1/named.run
-mkeys_refresh_on 2
-mkeys_status_on 2 > rndc.out.$n 2>&1
+sleep 3
+$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys refresh | sed 's/^/I: ns2 /'
+sleep 1
+$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys status > rndc.out.$n 2>&1
 # one key listed
 count=`grep -c "keyid: " rndc.out.$n` 
 [ "$count" -eq 1 ] || ret=1
@@ -610,23 +492,14 @@ status=`expr $status + $ret`

 n=`expr $n + 1`
 echo "I: reset the root server with no signatures, check for minimal update ($n)"
-ret=0
-# Refresh keys first to prevent previous checks from influencing this one
-mkeys_refresh_on 2
-mkeys_status_on 2 > rndc.out.$n 2>&1
-t1=`grep 'next refresh:' rndc.out.$n`
+t2=$t1
 $PERL $SYSTEMTESTTOP/stop.pl --use-rndc . ns1
-rm -f ns1/root.db.signed.jnl
 cat ns1/K*.key >> ns1/root.db.signed
-nextpart ns1/named.run > /dev/null
 $PERL $SYSTEMTESTTOP/start.pl --noclean --restart . ns1
-wait_for_log "loaded serial" ns1/named.run
-# Less than a second may have passed since the last time ns2 received a
-# ./DNSKEY response from ns1.  Ensure keys are refreshed at a different
-# timestamp to prevent minimal update from resetting it to the same timestamp.
+sleep 3
+$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys refresh | sed 's/^/I: ns2 /'
 sleep 1
-mkeys_refresh_on 2
-mkeys_status_on 2 > rndc.out.$n 2>&1
+$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys status > rndc.out.$n 2>&1
 # one key listed
 count=`grep -c "keyid: " rndc.out.$n` 
 [ "$count" -eq 1 ] || ret=1
@@ -648,12 +521,13 @@ status=`expr $status + $ret`

 n=`expr $n + 1`
 echo "I: restore root server, check validation succeeds again ($n)"
-ret=0
 rm -f ns1/root.db.signed.jnl
 $SIGNER -Sg -K ns1 -N unixtime -r $RANDFILE -o . ns1/root.db > /dev/null 2>&-
-mkeys_reload_on 1
-mkeys_refresh_on 2
-mkeys_status_on 2 > rndc.out.$n 2>&1
+$RNDC -c ../common/rndc.conf -s 10.53.0.1 -p 9953 reload . | sed 's/^/I: ns1 /'
+sleep 3
+$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys refresh | sed 's/^/I: ns2 /'
+sleep 1
+$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys status > rndc.out.$n 2>&1
 $DIG $DIGOPTS +noauth example. @10.53.0.2 txt > dig.out.ns2.test$n || ret=1
 grep "flags:.*ad.*QUERY" dig.out.ns2.test$n > /dev/null || ret=1
 grep "example..*.RRSIG..*TXT" dig.out.ns2.test$n > /dev/null || ret=1
@@ -663,14 +537,14 @@ status=`expr $status + $ret`
 n=`expr $n + 1`
 echo "I: check that trust-anchor-telemetry queries are logged ($n)"
 ret=0
-grep "sending trust-anchor-telemetry query '_ta-[0-9a-f]*/NULL" ns2/named.run > /dev/null || ret=1
+grep "sending trust-anchor-telemetry query '_ta-[0-9a-f]*/NULL" ns3/named.run > /dev/null || ret=1
 if [ $ret != 0 ]; then echo "I:failed"; fi
 status=`expr $status + $ret`

 n=`expr $n + 1`
 echo "I: check that trust-anchor-telemetry queries are received ($n)"
 ret=0
-grep "query '_ta-[0-9a-f][0-9a-f]*/NULL/IN' approved" ns1/named.run > /dev/null || ret=1
+grep "query '_ta-[0-9a-f]*/NULL/IN' approved" ns1/named.run > /dev/null || ret=1
 if [ $ret != 0 ]; then echo "I:failed"; fi
 status=`expr $status + $ret`

@@ -678,91 +552,15 @@ n=`expr $n + 1`
 echo "I: check 'rndc-managed-keys destroy' ($n)"
 ret=0
 $RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys destroy | sed 's/^/I: ns2 /'
-mkeys_status_on 2 > rndc.out.$n 2>&1
+sleep 1
+$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys status > rndc.out.$n 2>&1
 grep "no views with managed keys" rndc.out.$n > /dev/null || ret=1
-mkeys_reconfig_on 2
-mkeys_status_on 2 > rndc.out.$n 2>&1
+$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 reconfig | sed 's/^/I: ns2 /'
+sleep 1
+$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys status > rndc.out.$n 2>&1
 grep "name: \." rndc.out.$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo "I:failed"; fi
 status=`expr $status + $ret`

-n=`expr $n + 1`
-echo "I: check that trust-anchor-telemetry queries contain the correct key ($n)"
-ret=0
-# convert the hexadecimal key from the TAT query into decimal and
-# compare against the known key.
-tathex=`grep "query '_ta-[0-9a-f][0-9a-f]*/NULL/IN' approved" ns1/named.run | awk '{print $6; exit 0}' | sed -e 's/(_ta-\([0-9a-f][0-9a-f]*\)):/\1/'`
-tatkey=`$PERL -e 'printf("%d\n", hex(@ARGV[0]));' $tathex`
-realkey=`$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 secroots - | grep '; managed' | sed 's#.*SHA256/\([0-9][0-9]*\) ; managed.*#\1#'`
-[ "$tatkey" -eq "$realkey" ] || ret=1
-if [ $ret != 0 ]; then echo "I:failed"; fi
-status=`expr $status + $ret`
-
-n=`expr $n + 1`
-echo "I: check initialization fails if managed-keys can't be created ($n)"
-ret=0
-mkeys_secroots_on 4
-grep '; initializing managed' ns4/named.secroots > /dev/null 2>&1 || ret=1
-grep '; managed' ns4/named.secroots > /dev/null 2>&1 && ret=1
-grep '; trusted' ns4/named.secroots > /dev/null 2>&1 && ret=1
-if [ $ret != 0 ]; then echo "I:failed"; fi
-status=`expr $status + $ret`
-
-n=`expr $n + 1`
-echo "I: check failure to contact root servers does not prevent key refreshes after restart ($n)"
-ret=0
-# By the time we get here, ns5 should have attempted refreshing its managed
-# keys.  These attempts should fail as ns1 is configured to REFUSE all queries
-# from ns5.  Note that named1.args does not contain "-T mkeytimers"; this is to
-# ensure key refresh retry will be scheduled to one actual hour after the first
-# key refresh failure instead of just a few seconds, in order to prevent races
-# between the next scheduled key refresh time and startup time of restarted ns5.
-$PERL $SYSTEMTESTTOP/stop.pl --use-rndc . ns5
-nextpart ns5/named.run > /dev/null
-$PERL $SYSTEMTESTTOP/start.pl --noclean --restart . ns5
-wait_for_log "Returned from key fetch in keyfetch_done()" ns5/named.run
-# ns5/named.run will contain logs from both the old instance and the new
-# instance.  In order for the test to pass, both must attempt a fetch.
-count=`grep -c "Creating key fetch" ns5/named.run`
-[ $count -lt 2 ] && ret=1
-if [ $ret != 0 ]; then echo "I:failed"; fi
-status=`expr $status + $ret`
-
-n=`expr $n + 1`
-echo "I: check key refreshes are resumed after root servers become available ($n)"
-ret=0
-$PERL $SYSTEMTESTTOP/stop.pl --use-rndc . ns5
-# Prevent previous check from affecting this one
-rm -f ns5/managed-keys.bind*
-# named2.args adds "-T mkeytimers=2/20/40" to named1.args as we need to wait for
-# an "hour" until keys are refreshed again after initial failure
-cp ns5/named2.args ns5/named.args
-nextpart ns5/named.run > /dev/null
-$PERL $SYSTEMTESTTOP/start.pl --noclean --restart . ns5
-wait_for_log "Returned from key fetch in keyfetch_done()" ns5/named.run
-mkeys_secroots_on 5
-grep '; initializing managed' ns5/named.secroots > /dev/null 2>&1 || ret=1
-# ns1 should still REFUSE queries from ns5, so resolving should be impossible
-$DIG $DIGOPTS +noauth example. @10.53.0.5 txt > dig.out.ns5.a.test$n || ret=1
-grep "flags:.*ad.*QUERY" dig.out.ns5.a.test$n > /dev/null && ret=1
-grep "example..*.RRSIG..*TXT" dig.out.ns5.a.test$n > /dev/null && ret=1
-grep "status: SERVFAIL" dig.out.ns5.a.test$n > /dev/null || ret=1
-# Allow queries from ns5 to ns1
-cp ns1/named3.conf ns1/named.conf
-rm -f ns1/root.db.signed.jnl
-mkeys_reconfig_on 1
-nextpart ns5/named.run > /dev/null
-wait_for_log "Returned from key fetch in keyfetch_done()" ns5/named.run
-mkeys_secroots_on 5
-grep '; managed' ns5/named.secroots > /dev/null 2>&1 || ret=1
-# ns1 should not longer REFUSE queries from ns5, so managed keys should be
-# correctly refreshed and resolving should succeed
-$DIG $DIGOPTS +noauth example. @10.53.0.5 txt > dig.out.ns5.b.test$n || ret=1
-grep "flags:.*ad.*QUERY" dig.out.ns5.b.test$n > /dev/null || ret=1
-grep "example..*.RRSIG..*TXT" dig.out.ns5.b.test$n > /dev/null || ret=1
-grep "status: NOERROR" dig.out.ns5.b.test$n > /dev/null || ret=1
-if [ $ret != 0 ]; then echo "I:failed"; fi
-status=`expr $status + $ret`
-
 echo "I:exit status: $status"
 [ $status -eq 0 ] || exit 1
@@ -53,7 +53,6 @@ view "b" {
 		type slave;
 		masters { 10.53.0.5 key "a"; };
 		file "x21.bk-b";
-		notify no;
 	};
 };

@@ -63,6 +62,5 @@ view "c" {
 		type slave;
 		masters { 10.53.0.5 key "a"; };
 		file "x21.bk-c";
-		notify no;
 	};
 };
@@ -278,7 +278,7 @@ sleep 10
 if 
 	$PERL $SYSTEMTESTTOP/start.pl --noclean --restart . ns1
 then
-	echo "I:restarted server ns1"
+	echo "I:restarted server ns1"	
 else
 	echo "I:could not restart server ns1"
 	exit 1
@@ -486,7 +486,6 @@ fi
 n=`expr $n + 1`
 ret=0
 echo "I:check that 'update-policy local' fails from non-localhost address ($n)"
-grep 'match on session key not from localhost' ns5/named.run > /dev/null && ret=1
 $NSUPDATE -p 5300 -k ns5/session.key > nsupdate.out.$n 2>&1 << END && ret=1
 server 10.53.0.5 5300
 local 10.53.0.1
@@ -494,7 +493,6 @@ update add nonlocal.local.nil. 600 A 4.3.2.1
 send
 END
 grep REFUSED nsupdate.out.$n > /dev/null 2>&1 || ret=1
-grep 'match on session key not from localhost' ns5/named.run > /dev/null || ret=1
 $DIG @10.53.0.5 -p 5300 \
        +tcp +noadd +nosea +nostat +noquest +nocomm +nocmd \
        nonlocal.local.nil. > dig.out.ns5.$n || ret=1
@@ -709,12 +707,8 @@ size=`$PERL -e 'use File::stat; my $sb = stat(@ARGV[0]); printf("%s\n", $sb->siz
 [ "$size" -gt 6000 ] || ret=1
 sleep 1
 $RNDC -c ../common/rndc.conf -s 10.53.0.1 -p 9953 sync maxjournal.test
-for i in 1 2 3 4 5 6
-do
-    sleep 1
-    size=`$PERL -e 'use File::stat; my $sb = stat(@ARGV[0]); printf("%s\n", $sb->size);' ns1/maxjournal.db.jnl`
-    [ "$size" -lt 5000 ] && break
-done
+sleep 1
+
 size=`$PERL -e 'use File::stat; my $sb = stat(@ARGV[0]); printf("%s\n", $sb->size);' ns1/maxjournal.db.jnl`
 [ "$size" -lt 5000 ] || ret=1
 [ $ret = 0 ] || { echo I:failed; status=1; }
@@ -889,81 +883,75 @@ grep "address family not supported" nsupdate.out-$n > /dev/null 2>&1 || ret=1
 #
 #  Add client library tests here
 #
-
-if test unset != "${SAMPLEUPDATE:-unset}" -a -x "${SAMPLEUPDATE}"
-then
-
-    n=`expr $n + 1`
-    ret=0
-    echo "I:check that dns_client_update handles prerequisite NXDOMAIN failure ($n)"
-    $SAMPLEUPDATE -P 5300 -a 10.53.0.1 -a 10.53.0.2 -p "nxdomain exists.sample" \
+n=`expr $n + 1`
+ret=0
+echo "I:check that dns_client_update handles prerequisite NXDOMAIN failure ($n)"
+$SAMPLEUPDATE -P 5300 -a 10.53.0.1 -a 10.53.0.2 -p "nxdomain exists.sample" \
 	add "nxdomain-exists.sample 0 in a 1.2.3.4" > update.out.test$n 2>&1
-    $SAMPLEUPDATE -P 5300 -a 10.53.0.2 -p "nxdomain exists.sample" \
+$SAMPLEUPDATE -P 5300 -a 10.53.0.2 -p "nxdomain exists.sample" \
 	add "check-nxdomain-exists.sample 0 in a 1.2.3.4" > update.out.check$n 2>&1
-    $DIG +tcp @10.53.0.1 -p 5300 a nxdomain-exists.sample > dig.out.ns1.test$n
-    $DIG +tcp @10.53.0.2 -p 5300 a nxdomain-exists.sample > dig.out.ns2.test$n
-    $DIG +tcp @10.53.0.2 -p 5300 a check-nxdomain-exists.sample > check.out.ns2.test$n
-    grep "update failed: YXDOMAIN" update.out.test$n > /dev/null || ret=1
-    grep "update succeeded" update.out.check$n > /dev/null || ret=1
-    grep "status: NXDOMAIN" dig.out.ns1.test$n > /dev/null || ret=1
-    grep "status: NXDOMAIN" dig.out.ns2.test$n > /dev/null || ret=1
-    grep "status: NOERROR" check.out.ns2.test$n > /dev/null || ret=1
-    [ $ret = 0 ] || { echo I:failed; status=1; }
+$DIG +tcp @10.53.0.1 -p 5300 a nxdomain-exists.sample > dig.out.ns1.test$n
+$DIG +tcp @10.53.0.2 -p 5300 a nxdomain-exists.sample > dig.out.ns2.test$n
+$DIG +tcp @10.53.0.2 -p 5300 a check-nxdomain-exists.sample > check.out.ns2.test$n
+grep "update failed: YXDOMAIN" update.out.test$n > /dev/null || ret=1
+grep "update succeeded" update.out.check$n > /dev/null || ret=1
+grep "status: NXDOMAIN" dig.out.ns1.test$n > /dev/null || ret=1
+grep "status: NXDOMAIN" dig.out.ns2.test$n > /dev/null || ret=1
+grep "status: NOERROR" check.out.ns2.test$n > /dev/null || ret=1
+[ $ret = 0 ] || { echo I:failed; status=1; }

-    n=`expr $n + 1`
-    ret=0
-    echo "I:check that dns_client_update handles prerequisite YXDOMAIN failure ($n)"
-    $SAMPLEUPDATE -P 5300 -a 10.53.0.1 -a 10.53.0.2 -p "yxdomain nxdomain.sample" \
+n=`expr $n + 1`
+ret=0
+echo "I:check that dns_client_update handles prerequisite YXDOMAIN failure ($n)"
+$SAMPLEUPDATE -P 5300 -a 10.53.0.1 -a 10.53.0.2 -p "yxdomain nxdomain.sample" \
 	add "yxdomain-nxdomain.sample 0 in a 1.2.3.4" > update.out.test$n 2>&1
-    $SAMPLEUPDATE -P 5300 -a 10.53.0.2 -p "yxdomain nxdomain.sample" \
+$SAMPLEUPDATE -P 5300 -a 10.53.0.2 -p "yxdomain nxdomain.sample" \
 	add "check-yxdomain-nxdomain.sample 0 in a 1.2.3.4" > update.out.check$n 2>&1
-    $DIG +tcp @10.53.0.1 -p 5300 a nxdomain-exists.sample > dig.out.ns1.test$n
-    $DIG +tcp @10.53.0.2 -p 5300 a nxdomain-exists.sample > dig.out.ns2.test$n
-    $DIG +tcp @10.53.0.2 -p 5300 a check-nxdomain-exists.sample > check.out.ns2.test$n
-    grep "update failed: NXDOMAIN" update.out.test$n > /dev/null || ret=1
-    grep "update succeeded" update.out.check$n > /dev/null || ret=1
-    grep "status: NXDOMAIN" dig.out.ns1.test$n > /dev/null || ret=1
-    grep "status: NXDOMAIN" dig.out.ns2.test$n > /dev/null || ret=1
-    grep "status: NOERROR" check.out.ns2.test$n > /dev/null || ret=1
-    [ $ret = 0 ] || { echo I:failed; status=1; }
+$DIG +tcp @10.53.0.1 -p 5300 a nxdomain-exists.sample > dig.out.ns1.test$n
+$DIG +tcp @10.53.0.2 -p 5300 a nxdomain-exists.sample > dig.out.ns2.test$n
+$DIG +tcp @10.53.0.2 -p 5300 a check-nxdomain-exists.sample > check.out.ns2.test$n
+grep "update failed: NXDOMAIN" update.out.test$n > /dev/null || ret=1
+grep "update succeeded" update.out.check$n > /dev/null || ret=1
+grep "status: NXDOMAIN" dig.out.ns1.test$n > /dev/null || ret=1
+grep "status: NXDOMAIN" dig.out.ns2.test$n > /dev/null || ret=1
+grep "status: NOERROR" check.out.ns2.test$n > /dev/null || ret=1
+[ $ret = 0 ] || { echo I:failed; status=1; }

-    n=`expr $n + 1`
-    ret=0
-    echo "I:check that dns_client_update handles prerequisite NXRRSET failure ($n)"
-    $SAMPLEUPDATE -P 5300 -a 10.53.0.1 -a 10.53.0.2 -p "nxrrset exists.sample TXT This RRset exists." \
+n=`expr $n + 1`
+ret=0
+echo "I:check that dns_client_update handles prerequisite NXRRSET failure ($n)"
+$SAMPLEUPDATE -P 5300 -a 10.53.0.1 -a 10.53.0.2 -p "nxrrset exists.sample TXT This RRset exists." \
 	add "nxrrset-exists.sample 0 in a 1.2.3.4" > update.out.test$n 2>&1
-    $SAMPLEUPDATE -P 5300 -a 10.53.0.2 -p "nxrrset exists.sample TXT This RRset exists." \
+$SAMPLEUPDATE -P 5300 -a 10.53.0.2 -p "nxrrset exists.sample TXT This RRset exists." \
 	add "check-nxrrset-exists.sample 0 in a 1.2.3.4" > update.out.check$n 2>&1
-    $DIG +tcp @10.53.0.1 -p 5300 a nxrrset-exists.sample > dig.out.ns1.test$n
-    $DIG +tcp @10.53.0.2 -p 5300 a nxrrset-exists.sample > dig.out.ns2.test$n
-    $DIG +tcp @10.53.0.2 -p 5300 a check-nxrrset-exists.sample > check.out.ns2.test$n
-    grep "update failed: YXRRSET" update.out.test$n > /dev/null || ret=1
-    grep "update succeeded" update.out.check$n > /dev/null || ret=1
-    grep "status: NXDOMAIN" dig.out.ns1.test$n > /dev/null || ret=1
-    grep "status: NXDOMAIN" dig.out.ns2.test$n > /dev/null || ret=1
-    grep "status: NOERROR" check.out.ns2.test$n > /dev/null || ret=1
-    [ $ret = 0 ] || { echo I:failed; status=1; }
+$DIG +tcp @10.53.0.1 -p 5300 a nxrrset-exists.sample > dig.out.ns1.test$n
+$DIG +tcp @10.53.0.2 -p 5300 a nxrrset-exists.sample > dig.out.ns2.test$n
+$DIG +tcp @10.53.0.2 -p 5300 a check-nxrrset-exists.sample > check.out.ns2.test$n
+grep "update failed: YXRRSET" update.out.test$n > /dev/null || ret=1
+grep "update succeeded" update.out.check$n > /dev/null || ret=1
+grep "status: NXDOMAIN" dig.out.ns1.test$n > /dev/null || ret=1
+grep "status: NXDOMAIN" dig.out.ns2.test$n > /dev/null || ret=1
+grep "status: NOERROR" check.out.ns2.test$n > /dev/null || ret=1
+[ $ret = 0 ] || { echo I:failed; status=1; }

-    n=`expr $n + 1`
-    ret=0
-    echo "I:check that dns_client_update handles prerequisite YXRRSET failure ($n)"
-    $SAMPLEUPDATE -s -P 5300 -a 10.53.0.1 -a 10.53.0.2 \
+n=`expr $n + 1`
+ret=0
+echo "I:check that dns_client_update handles prerequisite YXRRSET failure ($n)"
+$SAMPLEUPDATE -s -P 5300 -a 10.53.0.1 -a 10.53.0.2 \
 	-p "yxrrset no-txt.sample TXT" \
 	add "yxrrset-nxrrset.sample 0 in a 1.2.3.4" > update.out.test$n 2>&1
-    $SAMPLEUPDATE -P 5300 -a 10.53.0.2 -p "yxrrset no-txt.sample TXT" \
+$SAMPLEUPDATE -P 5300 -a 10.53.0.2 -p "yxrrset no-txt.sample TXT" \
 	add "check-yxrrset-nxrrset.sample 0 in a 1.2.3.4" > update.out.check$n 2>&1
-    $DIG +tcp @10.53.0.1 -p 5300 a yxrrset-nxrrset.sample > dig.out.ns1.test$n
-    $DIG +tcp @10.53.0.2 -p 5300 a yxrrset-nxrrset.sample > dig.out.ns2.test$n
-    $DIG +tcp @10.53.0.2 -p 5300 a check-yxrrset-nxrrset.sample > check.out.ns2.test$n
-    grep "update failed: NXRRSET" update.out.test$n > /dev/null || ret=1
-    grep "update succeeded" update.out.check$n > /dev/null || ret=1
-    grep "status: NXDOMAIN" dig.out.ns1.test$n > /dev/null || ret=1
-    grep "status: NXDOMAIN" dig.out.ns2.test$n > /dev/null || ret=1
-    grep "status: NOERROR" check.out.ns2.test$n > /dev/null || ret=1
-    grep "2nd update failed: NXRRSET" update.out.test$n > /dev/null || ret=1
-    [ $ret = 0 ] || { echo I:failed; status=1; }
-
-fi
+$DIG +tcp @10.53.0.1 -p 5300 a yxrrset-nxrrset.sample > dig.out.ns1.test$n
+$DIG +tcp @10.53.0.2 -p 5300 a yxrrset-nxrrset.sample > dig.out.ns2.test$n
+$DIG +tcp @10.53.0.2 -p 5300 a check-yxrrset-nxrrset.sample > check.out.ns2.test$n
+grep "update failed: NXRRSET" update.out.test$n > /dev/null || ret=1
+grep "update succeeded" update.out.check$n > /dev/null || ret=1
+grep "status: NXDOMAIN" dig.out.ns1.test$n > /dev/null || ret=1
+grep "status: NXDOMAIN" dig.out.ns2.test$n > /dev/null || ret=1
+grep "status: NOERROR" check.out.ns2.test$n > /dev/null || ret=1
+grep "2nd update failed: NXRRSET" update.out.test$n > /dev/null || ret=1
+[ $ret = 0 ] || { echo I:failed; status=1; }

 #
 # End client library tests here
@@ -100,27 +100,26 @@ $PERL stop.pl $test
 status=`expr $status + $?`

 if [ $status != 0 ]; then
-    echofail "R:FAIL"
-    # Don't clean up - we need the evidence.
-    find . -name core -exec chmod 0644 '{}' \;
+	echofail "R:FAIL"
+	# Don't clean up - we need the evidence.
+	find . -name core -exec chmod 0644 '{}' \;
 else
-    echopass "R:PASS"
+	echopass "R:PASS"

-    if $clean
-    then
-	rm -f $SYSTEMTESTTOP/random.data
-	if test -f $test/clean.sh
+	if $clean
 	then
-	    ( cd $test && $SHELL clean.sh "$@" )
+		rm -f $SYSTEMTESTTOP/random.data
+		if test -f $test/clean.sh
+		then
+			( cd $test && $SHELL clean.sh "$@" )
+		fi
+		if test -d ../../../.git
+		then
+			git status -su $test |
+			sed -n 's/^?? \(.*\)/I:file \1 not removed/p'
+		fi
+
 	fi
-	if test -d ../../../.git
-	then
-	    git status -su --ignored $test |
-	    sed -n -e 's|^?? \(.*\)|I:file \1 not removed|p' \
-		-e 's|^!! \(.*/named.run\)$|I:file \1 not removed|p' \
-		-e 's|^!! \(.*/named.memstats\)$|I:file \1 not removed|p'
-	fi
-    fi
 fi

 echoinfo "E:$test:`date`"
@@ -1,16 +0,0 @@
-/*
- * Copyright (C) 2017  Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- */
-
-options {
-	new-zones-directory "./nope";
-	port 5300;
-	pid-file "../named.pid";
-	listen-on { 127.0.0.1; };
-	listen-on-v6 { none; };
-	recursion no;
-};
@@ -14,10 +14,4 @@ $SHELL clean.sh
 cp ns2/named1.conf ns2/named.conf

 mkdir ns2/nope
-
-if [ 1 = "${CYGWIN:-0}" ]
-then
-    setfacl -s user::r-x,group::r-x,other::r-x ns2/nope
-else
-    chmod 555 ns2/nope
-fi
+chmod 555 ns2/nope
@@ -73,17 +73,6 @@ grep "managed-keys-directory './nope' is not writable" ns2/named.run > /dev/null
 if [ $ret != 0 ]; then echo "I:failed"; fi
 status=`expr $status + $ret`

-n=`expr $n + 1`
-echo "I: checking that named refuses to reconfigure if new-zones-directory is not writable ($n)"
-ret=0
-cp -f ns2/named-alt6.conf ns2/named.conf
-$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 reconfig > rndc.out.$n 2>&1
-grep "failed: permission denied" rndc.out.$n > /dev/null 2>&1 || ret=1
-sleep 1
-grep "new-zones-directory './nope' is not writable" ns2/named.run > /dev/null 2>&1 || ret=1
-if [ $ret != 0 ]; then echo "I:failed"; fi
-status=`expr $status + $ret`
-
 n=`expr $n + 1`
 echo "I: checking that named refuses to start if working directory is not writable ($n)"
 ret=0
@@ -16,6 +16,15 @@ rm -f dig.out.*

 DIGOPTS="+tcp +noadd +nosea +nostat +nocmd -p 5300"

+# read everything that's been appended to a file since the last time
+# 'nextpart' was called.
+nextpart () {
+    [ -f $1.prev ] || echo "0" > $1.prev
+    prev=`cat $1.prev`
+    awk "FNR > $prev "'{ print }
+         END           { print NR > "/dev/stderr" }' $1 2> $1.prev
+}
+
 echo "I:checking DNSSEC SERVFAIL is cached ($n)"
 ret=0
 $DIG $DIGOPTS +dnssec foo.example. a @10.53.0.5 > dig.out.ns5.test$n || ret=1
@@ -342,8 +342,8 @@ status=`expr $status + $ret`

 echo "I:checking sync record publication"
 ret=0
-grep -w CDNSKEY $cfile.signed > /dev/null || ret=1
-grep -w CDS $cfile.signed > /dev/null || ret=1
+grep CDNSKEY $cfile.signed > /dev/null || ret=1
+grep CDS $cfile.signed > /dev/null || ret=1
 if [ $ret != 0 ]; then echo "I:failed"; fi
 status=`expr $status + $ret`

@@ -352,8 +352,8 @@ ret=0
 $SETTIME -P now -A now -Dsync now ${cksk5} > /dev/null
 $SIGNER -Sg -r $RANDFILE -o $czone -f $cfile.new $cfile.signed > /dev/null 2>&1
 mv $cfile.new $cfile.signed
-grep -w CDNSKEY $cfile.signed > /dev/null && ret=1
-grep -w CDS $cfile.signed > /dev/null && ret=1
+grep CDNSKEY $cfile.signed > /dev/null && ret=1
+grep CDS $cfile.signed > /dev/null && ret=1
 if [ $ret != 0 ]; then echo "I:failed"; fi
 status=`expr $status + $ret`

@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# Copyright (C) 2012, 2015-2017  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2012, 2015, 2016  Internet Systems Consortium, Inc. ("ISC")
 #
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -137,12 +137,5 @@ fi
 if [ $ret != 0 ]; then echo "I:failed"; fi
 status=`expr $status + $ret`

-ret=0
-n=`expr $n + 1`
-echo "I:checking priming queries are counted ($n)"
-grep "1 priming queries" ns3/named.stats
-if [ $ret != 0 ]; then echo "I:failed"; fi
-status=`expr $status + $ret`
-
 echo "I:exit status: $status"
 [ $status -eq 0 ] || exit 1
@@ -4,8 +4,6 @@
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.

-rm -f */named.memstats
-rm -f */named.run
 rm -f dig.out.*
 rm -f ns1/K*+*+*.key
 rm -f ns1/K*+*+*.private
@@ -1,34 +0,0 @@
-/*
- * Copyright (C) 2017  Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- */
-
-// NS4
-
-controls { /* empty */ };
-
-options {
-	query-source address 10.53.0.4;
-	notify-source 10.53.0.4;
-	transfer-source 10.53.0.4;
-	port 5300;
-	pid-file "named.pid";
-	listen-on { 10.53.0.4; };
-	listen-on-v6 { none; };
-	recursion yes;
-	notify no;
-	dnssec-enable yes;
-	dnssec-validation yes;
-	synth-from-dnssec no;
-};
-
-zone "." {
-	type hint;
-	file "root.hints";
-};
-
-include "../ns1/trusted.conf";
-// include "../../common/controls.conf";
@@ -1,8 +0,0 @@
-; Copyright (C) 2017  Internet Systems Consortium, Inc. ("ISC")
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
-
-.	NS	ns1
-ns1	A	10.53.0.1
@@ -1,33 +0,0 @@
-/*
- * Copyright (C) 2017  Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- */
-
-// NS5
-
-controls { /* empty */ };
-
-options {
-	query-source address 10.53.0.5;
-	notify-source 10.53.0.5;
-	transfer-source 10.53.0.5;
-	port 5300;
-	pid-file "named.pid";
-	listen-on { 10.53.0.5; };
-	listen-on-v6 { none; };
-	recursion yes;
-	notify no;
-	dnssec-enable yes;
-	dnssec-validation yes;
-	synth-from-dnssec yes;
-};
-
-zone "." {
-	type hint;
-	file "root.hints";
-};
-
-include "../ns1/trusted.conf";
@@ -1,8 +0,0 @@
-; Copyright (C) 2017  Internet Systems Consortium, Inc. ("ISC")
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
-
-.	NS	ns1
-ns1	A	10.53.0.1
@@ -17,58 +17,49 @@ rm -f dig.out.*
 DIGOPTS="+tcp +noadd +nosea +nostat +nocmd +dnssec -p 5300"
 DELVOPTS="-a ns1/trusted.conf -p 5300"

-for ns in 2 4 5
-do
-    case $ns in
-    2) description="<default>";;
-    4) description="no";;
-    5) description="yes";;
-    *) exit 1;;
-    esac
-    echo "I:prime negative NXDOMAIN response (synth-from-dnssec ${description};) ($n)"
-    ret=0
-    $DIG $DIGOPTS a.example. @10.53.0.${ns} a > dig.out.ns${ns}.test$n || ret=1
-    grep "flags:[^;]* ad[ ;]" dig.out.ns${ns}.test$n > /dev/null || ret=1
-    grep "status: NXDOMAIN," dig.out.ns${ns}.test$n > /dev/null || ret=1
-    grep "example.*3600.IN.SOA" dig.out.ns${ns}.test$n > /dev/null || ret=1
-    [ $ns -eq ${ns} ] && nxdomain=dig.out.ns${ns}.test$n
-    n=`expr $n + 1`
-    if [ $ret != 0 ]; then echo "I:failed"; fi
-    status=`expr $status + $ret`
+echo "I:prime negative NXDOMAIN response ($n)"
+ret=0
+$DIG $DIGOPTS a.example. @10.53.0.2 a > dig.out.ns2.test$n || ret=1
+grep "flags:[^;]* ad[ ;]" dig.out.ns2.test$n > /dev/null || ret=1
+grep "status: NXDOMAIN," dig.out.ns2.test$n > /dev/null || ret=1
+grep "example.*3600.IN.SOA" dig.out.ns2.test$n > /dev/null || ret=1
+nxdomain=dig.out.ns2.test$n
+n=`expr $n + 1`
+if [ $ret != 0 ]; then echo "I:failed"; fi
+status=`expr $status + $ret`

-    echo "I:prime negative NODATA response (synth-from-dnssec ${description};) ($n)"
-    ret=0
-    $DIG $DIGOPTS nodata.example. @10.53.0.${ns} a > dig.out.ns${ns}.test$n || ret=1
-    grep "flags:[^;]* ad[ ;]" dig.out.ns${ns}.test$n > /dev/null || ret=1
-    grep "status: NOERROR," dig.out.ns${ns}.test$n > /dev/null || ret=1
-    grep "example.*3600.IN.SOA" dig.out.ns${ns}.test$n > /dev/null || ret=1
-    [ $ns -eq 2 ] && nodata=dig.out.ns${ns}.test$n
-    n=`expr $n + 1`
-    if [ $ret != 0 ]; then echo "I:failed"; fi
-    status=`expr $status + $ret`
+echo "I:prime negative NODATA response ($n)"
+ret=0
+$DIG $DIGOPTS nodata.example. @10.53.0.2 a > dig.out.ns2.test$n || ret=1
+grep "flags:[^;]* ad[ ;]" dig.out.ns2.test$n > /dev/null || ret=1
+grep "status: NOERROR," dig.out.ns2.test$n > /dev/null || ret=1
+grep "example.*3600.IN.SOA" dig.out.ns2.test$n > /dev/null || ret=1
+nodata=dig.out.ns2.test$n
+n=`expr $n + 1`
+if [ $ret != 0 ]; then echo "I:failed"; fi
+status=`expr $status + $ret`

-    echo "I:prime wildcard response (synth-from-dnssec ${description};) ($n)"
-    ret=0
-    $DIG $DIGOPTS a.wild-a.example. @10.53.0.${ns} a > dig.out.ns${ns}.test$n || ret=1
-    grep "flags:[^;]* ad[ ;]" dig.out.ns${ns}.test$n > /dev/null || ret=1
-    grep "status: NOERROR," dig.out.ns${ns}.test$n > /dev/null || ret=1
-    grep "a.wild-a.example.*3600.IN.A" dig.out.ns${ns}.test$n > /dev/null || ret=1
-    n=`expr $n + 1`
-    if [ $ret != 0 ]; then echo "I:failed"; fi
-    status=`expr $status + $ret`
+echo "I:prime wildcard response ($n)"
+ret=0
+$DIG $DIGOPTS a.wild-a.example. @10.53.0.2 a > dig.out.ns2.test$n || ret=1
+grep "flags:[^;]* ad[ ;]" dig.out.ns2.test$n > /dev/null || ret=1
+grep "status: NOERROR," dig.out.ns2.test$n > /dev/null || ret=1
+grep "a.wild-a.example.*3600.IN.A" dig.out.ns2.test$n > /dev/null || ret=1
+n=`expr $n + 1`
+if [ $ret != 0 ]; then echo "I:failed"; fi
+status=`expr $status + $ret`

-    echo "I:prime wildcard CNAME response (synth-from-dnssec ${description};) ($n)"
-    ret=0
-    $DIG $DIGOPTS a.wild-cname.example. @10.53.0.${ns} a > dig.out.ns${ns}.test$n || ret=1
-    grep "flags:[^;]* ad[ ;]" dig.out.ns${ns}.test$n > /dev/null || ret=1
-    grep "status: NOERROR," dig.out.ns${ns}.test$n > /dev/null || ret=1
-    grep "a.wild-cname.example.*3600.IN.CNAME" dig.out.ns${ns}.test$n > /dev/null || ret=1
-    n=`expr $n + 1`
-    if [ $ret != 0 ]; then echo "I:failed"; fi
-    status=`expr $status + $ret`
-done
+echo "I:prime wildcard CNAME response ($n)"
+ret=0
+$DIG $DIGOPTS a.wild-cname.example. @10.53.0.2 a > dig.out.ns2.test$n || ret=1
+grep "flags:[^;]* ad[ ;]" dig.out.ns2.test$n > /dev/null || ret=1
+grep "status: NOERROR," dig.out.ns2.test$n > /dev/null || ret=1
+grep "a.wild-cname.example.*3600.IN.CNAME" dig.out.ns2.test$n > /dev/null || ret=1
+n=`expr $n + 1`
+if [ $ret != 0 ]; then echo "I:failed"; fi
+status=`expr $status + $ret`

-echo "I:prime redirect response (+nodnssec) (synth-from-dnssec <default>;) ($n)"
+echo "I:prime redirect response (+nodnssec) ($n)"
 ret=0
 $DIG $DIGOPTS +nodnssec a.redirect. @10.53.0.3 a > dig.out.ns2.test$n || ret=1
 grep "flags:[^;]* ad[ ;]" dig.out.ns2.test$n > /dev/null && ret=1
@@ -78,88 +69,54 @@ n=`expr $n + 1`
 if [ $ret != 0 ]; then echo "I:failed"; fi
 status=`expr $status + $ret`

-#
-# ensure TTL of synthesised answers differs from direct answers.
-#
 sleep 1

-for ns in 2 4 5
-do
-    case $ns in
-    2) synth=yes description="<default>";;
-    4) synth=no  description="no";;
-    5) synth=yes description="yes";;
-    *) exit 1;;
-    esac
-    echo "I:check synthesized NXDOMAIN response (synth-from-dnssec ${description};) ($n)"
-    ret=0
-    $DIG $DIGOPTS b.example. @10.53.0.${ns} a > dig.out.ns${ns}.test$n || ret=1
-    grep "flags:[^;]* ad[ ;]" dig.out.ns${ns}.test$n > /dev/null || ret=1
-    grep "status: NXDOMAIN," dig.out.ns${ns}.test$n > /dev/null || ret=1
-    if [ ${synth} = yes ]
-    then
-	grep "example.*IN.SOA" dig.out.ns${ns}.test$n > /dev/null || ret=1
-	grep "example.*3600.IN.SOA" dig.out.ns${ns}.test$n > /dev/null && ret=1
-    else
-	grep "example.*3600.IN.SOA" dig.out.ns${ns}.test$n > /dev/null || ret=1
-    fi
-    $PERL ../digcomp.pl $nxdomain dig.out.ns${ns}.test$n || ret=1
-    n=`expr $n + 1`
-    if [ $ret != 0 ]; then echo "I:failed"; fi
-    status=`expr $status + $ret`
+$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 dumpdb

-    echo "I:check synthesized NODATA response (synth-from-dnssec ${description};) ($n)"
-    ret=0
-    $DIG $DIGOPTS nodata.example. @10.53.0.${ns} aaaa > dig.out.ns${ns}.test$n || ret=1
-    grep "flags:[^;]* ad[ ;]" dig.out.ns${ns}.test$n > /dev/null || ret=1
-    grep "status: NOERROR," dig.out.ns${ns}.test$n > /dev/null || ret=1
-    if [ ${synth} = yes ]
-    then
-	grep "example.*IN.SOA" dig.out.ns${ns}.test$n > /dev/null || ret=1
-	grep "example.*3600.IN.SOA" dig.out.ns${ns}.test$n > /dev/null && ret=1
-    else
-	grep "example.*3600.IN.SOA" dig.out.ns${ns}.test$n > /dev/null || ret=1
-    fi
-    $PERL ../digcomp.pl $nodata dig.out.ns${ns}.test$n || ret=1
-    n=`expr $n + 1`
-    if [ $ret != 0 ]; then echo "I:failed"; fi
-    status=`expr $status + $ret`
+echo "I:check synthesized NXDOMAIN response ($n)"
+ret=0
+$DIG $DIGOPTS b.example. @10.53.0.2 a > dig.out.ns2.test$n || ret=1
+grep "flags:[^;]* ad[ ;]" dig.out.ns2.test$n > /dev/null || ret=1
+grep "status: NXDOMAIN," dig.out.ns2.test$n > /dev/null || ret=1
+grep "example.*3600.IN.SOA" dig.out.ns2.test$n > /dev/null && ret=1
+$PERL ../digcomp.pl $nxdomain dig.out.ns2.test$n || ret=1
+n=`expr $n + 1`
+if [ $ret != 0 ]; then echo "I:failed"; fi
+status=`expr $status + $ret`

-    echo "I:check synthesized wildcard response (synth-from-dnssec ${description};) ($n)"
-    ret=0
-    $DIG $DIGOPTS b.wild-a.example. @10.53.0.${ns} a > dig.out.ns${ns}.test$n || ret=1
-    grep "flags:[^;]* ad[ ;]" dig.out.ns${ns}.test$n > /dev/null || ret=1
-    grep "status: NOERROR," dig.out.ns${ns}.test$n > /dev/null || ret=1
-    if [ ${synth} = yes ]
-    then
-	    grep "b\.wild-a\.example\..*IN.A" dig.out.ns${ns}.test$n > /dev/null || ret=1
-	    grep "b\.wild-a\.example\..*3600.IN.A" dig.out.ns${ns}.test$n > /dev/null && ret=1
-    else
-	    grep "b\.wild-a\.example\..*3600.IN.A" dig.out.ns${ns}.test$n > /dev/null || ret=1
-    fi
-    n=`expr $n + 1`
-    if [ $ret != 0 ]; then echo "I:failed"; fi
-    status=`expr $status + $ret`
+echo "I:check synthesized NODATA response ($n)"
+ret=0
+$DIG $DIGOPTS nodata.example. @10.53.0.2 aaaa > dig.out.ns2.test$n || ret=1
+grep "flags:[^;]* ad[ ;]" dig.out.ns2.test$n > /dev/null || ret=1
+grep "status: NOERROR," dig.out.ns2.test$n > /dev/null || ret=1
+grep "example.*3600.IN.SOA" dig.out.ns2.test$n > /dev/null && ret=1
+$PERL ../digcomp.pl $nodata dig.out.ns2.test$n || ret=1
+n=`expr $n + 1`
+if [ $ret != 0 ]; then echo "I:failed"; fi
+status=`expr $status + $ret`

-    echo "I:check synthesized wildcard CNAME response (synth-from-dnssec ${description};) ($n)"
-    ret=0
-    $DIG $DIGOPTS b.wild-cname.example. @10.53.0.${ns} a > dig.out.ns${ns}.test$n || ret=1
-    grep "flags:[^;]* ad[ ;]" dig.out.ns${ns}.test$n > /dev/null || ret=1
-    grep "status: NOERROR," dig.out.ns${ns}.test$n > /dev/null || ret=1
-    if [ ${synth} = yes ]
-    then
-	grep "b.wild-cname.example.*IN.CNAME" dig.out.ns${ns}.test$n > /dev/null || ret=1
-	grep "b.wild-cname.example.*3600.IN.CNAME" dig.out.ns${ns}.test$n > /dev/null && ret=1
-    else
-	grep "b.wild-cname.example.*3600.IN.CNAME" dig.out.ns${ns}.test$n > /dev/null || ret=1
-    fi
-    grep "ns1.example.*.IN.A" dig.out.ns${ns}.test$n > /dev/null || ret=1
-    n=`expr $n + 1`
-    if [ $ret != 0 ]; then echo "I:failed"; fi
-    status=`expr $status + $ret`
-done
+echo "I:check synthesized wildcard response ($n)"
+ret=0
+$DIG $DIGOPTS b.wild-a.example. @10.53.0.2 a > dig.out.ns2.test$n || ret=1
+grep "flags:[^;]* ad[ ;]" dig.out.ns2.test$n > /dev/null || ret=1
+grep "status: NOERROR," dig.out.ns2.test$n > /dev/null || ret=1
+grep "b\.wild-a\.example\..*3600.IN.A" dig.out.ns2.test$n > /dev/null && ret=1
+n=`expr $n + 1`
+if [ $ret != 0 ]; then echo "I:failed"; fi
+status=`expr $status + $ret`

-echo "I:check redirect response (+dnssec) (synth-from-dnssec <default>;) ($n)"
+echo "I:check synthesized wildcard CNAME response ($n)"
+ret=0
+$DIG $DIGOPTS b.wild-cname.example. @10.53.0.2 a > dig.out.ns2.test$n || ret=1
+grep "flags:[^;]* ad[ ;]" dig.out.ns2.test$n > /dev/null || ret=1
+grep "status: NOERROR," dig.out.ns2.test$n > /dev/null || ret=1
+grep "b.wild-cname.example.*3600.IN.CNAME" dig.out.ns2.test$n > /dev/null && ret=1
+grep "ns1.example.*.IN.A" dig.out.ns2.test$n > /dev/null || ret=1
+n=`expr $n + 1`
+if [ $ret != 0 ]; then echo "I:failed"; fi
+status=`expr $status + $ret`
+
+echo "I:check redirect response (+dnssec) ($n)"
 ret=0
 $DIG $DIGOPTS b.redirect. @10.53.0.3 a > dig.out.ns2.test$n || ret=1
 grep "flags:[^;]* ad[ ;]" dig.out.ns2.test$n > /dev/null || ret=1
@@ -169,7 +126,7 @@ n=`expr $n + 1`
 if [ $ret != 0 ]; then echo "I:failed"; fi
 status=`expr $status + $ret`

-echo "I:check redirect response (+nodnssec) (synth-from-dnssec <default>;) ($n)"
+echo "I:check redirect response (+nodnssec) ($n)"
 ret=0
 $DIG $DIGOPTS +nodnssec b.redirect. @10.53.0.3 a > dig.out.ns2.test$n || ret=1
 grep "flags:[^;]* ad[ ;]" dig.out.ns2.test$n > /dev/null && ret=1
@@ -1,6 +1,7 @@
 arpaname
 dnstap-read
 genrandom
+isc-hmac-fixup
 mdig
 named-journalprint
 named-nzd2nzf
@@ -38,21 +38,21 @@ DNSTAPTARGETS =	dnstap-read@EXEEXT@
 NZDTARGETS =	named-nzd2nzf@EXEEXT@
 TARGETS =	arpaname@EXEEXT@ named-journalprint@EXEEXT@ \
 		named-rrchecker@EXEEXT@ nsec3hash@EXEEXT@ \
-		genrandom@EXEEXT@ mdig@EXEEXT@ \
+		genrandom@EXEEXT@ isc-hmac-fixup@EXEEXT@ mdig@EXEEXT@ \
 		@DNSTAPTARGETS@ @NZDTARGETS@

 DNSTAPSRCS  =	dnstap-read.c
 NZDSRCS  =	named-nzd2nzf.c
 SRCS =		arpaname.c named-journalprint.c named-rrchecker.c \
-		nsec3hash.c genrandom.c mdig.c \
+		nsec3hash.c genrandom.c isc-hmac-fixup.c mdig.c \
 		@DNSTAPSRCS@ @NZDSRCS@

 MANPAGES =	arpaname.1 dnstap-read.1 genrandom.8 \
-		mdig.1 named-journalprint.8 \
+		isc-hmac-fixup.8 mdig.1 named-journalprint.8 \
 		named-nzd2nzf.8 named-rrchecker.1 nsec3hash.8

 HTMLPAGES =	arpaname.html dnstap-read.html genrandom.html \
-		mdig.html named-journalprint.html \
+		isc-hmac-fixup.html mdig.html named-journalprint.html \
 		named-nzd2nzf.html named-rrchecker.html nsec3hash.html

 MANOBJS =	${MANPAGES} ${HTMLPAGES}
@@ -78,6 +78,11 @@ nsec3hash@EXEEXT@: nsec3hash.@O@ ${ISCDEPLIBS} ${DNSDEPLIBS}
 	export LIBS0="${DNSLIBS} ${ISCLIBS}"; \
 	${FINALBUILDCMD}

+isc-hmac-fixup@EXEEXT@: isc-hmac-fixup.@O@ ${ISCDEPLIBS}
+	export BASEOBJS="isc-hmac-fixup.@O@"; \
+	export LIBS0="${ISCLIBS}"; \
+	${FINALBUILDCMD}
+
 genrandom@EXEEXT@: genrandom.@O@
 	${LIBTOOL_MODE_LINK} ${PURIFY} ${CC} ${CFLAGS} ${LDFLAGS} \
 		-o $@ genrandom.@O@ @GENRANDOMLIB@ ${LIBS}
@@ -129,9 +134,12 @@ install:: ${TARGETS} installdirs @DNSTAP@ @NZD_TOOLS@
 		${DESTDIR}${sbindir}
 	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} genrandom@EXEEXT@ \
 		${DESTDIR}${sbindir}
+	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} isc-hmac-fixup@EXEEXT@ \
+		${DESTDIR}${sbindir}
 	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} mdig@EXEEXT@ \
 		${DESTDIR}${bindir}
 	${INSTALL_DATA} ${srcdir}/arpaname.1 ${DESTDIR}${mandir}/man1
+	${INSTALL_DATA} ${srcdir}/isc-hmac-fixup.8 ${DESTDIR}${mandir}/man8
 	${INSTALL_DATA} ${srcdir}/named-journalprint.8 ${DESTDIR}${mandir}/man8
 	${INSTALL_DATA} ${srcdir}/named-rrchecker.1 ${DESTDIR}${mandir}/man1
 	${INSTALL_DATA} ${srcdir}/nsec3hash.8 ${DESTDIR}${mandir}/man8
@@ -144,9 +152,12 @@ uninstall::
 	rm -f ${DESTDIR}${mandir}/man8/nsec3hash.8
 	rm -f ${DESTDIR}${mandir}/man1/named-rrchecker.1
 	rm -f ${DESTDIR}${mandir}/man8/named-journalprint.8
+	rm -f ${DESTDIR}${mandir}/man8/isc-hmac-fixup.8
 	rm -f ${DESTDIR}${mandir}/man1/arpaname.1
 	${LIBTOOL_MODE_UNINSTALL} rm -f \
 		${DESTDIR}${bindir}/mdig@EXEEXT@
+	${LIBTOOL_MODE_UNINSTALL} rm -f \
+		${DESTDIR}${sbindir}/isc-hmac-fixup@EXEEXT@
 	${LIBTOOL_MODE_UNINSTALL} rm -f \
 		${DESTDIR}${sbindir}/genrandom@EXEEXT@
 	${LIBTOOL_MODE_UNINSTALL} rm -f \
@@ -0,0 +1,69 @@
+.\" Copyright (C) 2010, 2013-2016 Internet Systems Consortium, Inc. ("ISC")
+.\" 
+.\" This Source Code Form is subject to the terms of the Mozilla Public
+.\" License, v. 2.0. If a copy of the MPL was not distributed with this
+.\" file, You can obtain one at http://mozilla.org/MPL/2.0/.
+.\"
+.hy 0
+.ad l
+'\" t
+.\"     Title: isc-hmac-fixup
+.\"    Author: 
+.\" Generator: DocBook XSL Stylesheets v1.78.1 <http://docbook.sf.net/>
+.\"      Date: 2013-04-28
+.\"    Manual: BIND9
+.\"    Source: ISC
+.\"  Language: English
+.\"
+.TH "ISC\-HMAC\-FIXUP" "8" "2013\-04\-28" "ISC" "BIND9"
+.\" -----------------------------------------------------------------
+.\" * Define some portability stuff
+.\" -----------------------------------------------------------------
+.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+.\" http://bugs.debian.org/507673
+.\" http://lists.gnu.org/archive/html/groff/2009-02/msg00013.html
+.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+.ie \n(.g .ds Aq \(aq
+.el       .ds Aq '
+.\" -----------------------------------------------------------------
+.\" * set default formatting
+.\" -----------------------------------------------------------------
+.\" disable hyphenation
+.nh
+.\" disable justification (adjust text to left margin only)
+.ad l
+.\" -----------------------------------------------------------------
+.\" * MAIN CONTENT STARTS HERE *
+.\" -----------------------------------------------------------------
+.SH "NAME"
+isc-hmac-fixup \- fixes HMAC keys generated by older versions of BIND
+.SH "SYNOPSIS"
+.HP \w'\fBisc\-hmac\-fixup\fR\ 'u
+\fBisc\-hmac\-fixup\fR {\fIalgorithm\fR} {\fIsecret\fR}
+.SH "DESCRIPTION"
+.PP
+Versions of BIND 9 up to and including BIND 9\&.6 had a bug causing HMAC\-SHA* TSIG keys which were longer than the digest length of the hash algorithm (i\&.e\&., SHA1 keys longer than 160 bits, SHA256 keys longer than 256 bits, etc) to be used incorrectly, generating a message authentication code that was incompatible with other DNS implementations\&.
+.PP
+This bug has been fixed in BIND 9\&.7\&. However, the fix may cause incompatibility between older and newer versions of BIND, when using long keys\&.
+\fBisc\-hmac\-fixup\fR
+modifies those keys to restore compatibility\&.
+.PP
+To modify a key, run
+\fBisc\-hmac\-fixup\fR
+and specify the key\*(Aqs algorithm and secret on the command line\&. If the secret is longer than the digest length of the algorithm (64 bytes for SHA1 through SHA256, or 128 bytes for SHA384 and SHA512), then a new secret will be generated consisting of a hash digest of the old secret\&. (If the secret did not require conversion, then it will be printed without modification\&.)
+.SH "SECURITY CONSIDERATIONS"
+.PP
+Secrets that have been converted by
+\fBisc\-hmac\-fixup\fR
+are shortened, but as this is how the HMAC protocol works in operation anyway, it does not affect security\&. RFC 2104 notes, "Keys longer than [the digest length] are acceptable but the extra length would not significantly increase the function strength\&."
+.SH "SEE ALSO"
+.PP
+BIND 9 Administrator Reference Manual,
+RFC 2104\&.
+.SH "AUTHOR"
+.PP
+\fBInternet Systems Consortium, Inc\&.\fR
+.SH "COPYRIGHT"
+.br
+Copyright \(co 2010, 2013-2016 Internet Systems Consortium, Inc. ("ISC")
+.br
@@ -0,0 +1,139 @@
+/*
+ * Copyright (C) 2010, 2014-2016  Internet Systems Consortium, Inc. ("ISC")
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ */
+
+/* $Id: isc-hmac-fixup.c,v 1.4 2010/03/10 02:17:52 marka Exp $ */
+
+#include <config.h>
+
+#include <isc/base64.h>
+#include <isc/buffer.h>
+#include <isc/md5.h>
+#include <isc/print.h>
+#include <isc/region.h>
+#include <isc/result.h>
+#include <isc/sha1.h>
+#include <isc/sha2.h>
+#include <isc/stdio.h>
+#include <isc/string.h>
+
+#include <pk11/site.h>
+
+#define HMAC_LEN	64
+
+int
+main(int argc, char **argv)  {
+	isc_buffer_t buf;
+	unsigned char key[1024];
+	char secret[1024];
+	char base64[(1024*4)/3];
+	isc_region_t r;
+	isc_result_t result;
+
+	if (argc != 3) {
+		fprintf(stderr, "Usage:\t%s algorithm secret\n", argv[0]);
+#ifndef PK11_MD5_DISABLE
+		fprintf(stderr, "\talgorithm: (MD5 | SHA1 | SHA224 | "
+				"SHA256 | SHA384 | SHA512)\n");
+#else
+		fprintf(stderr, "\talgorithm: (SHA1 | SHA224 | "
+				"SHA256 | SHA384 | SHA512)\n");
+#endif
+		return (1);
+	}
+
+	isc_buffer_init(&buf, secret, sizeof(secret));
+	result = isc_base64_decodestring(argv[2], &buf);
+	if (result != ISC_R_SUCCESS) {
+		fprintf(stderr, "error: %s\n", isc_result_totext(result));
+		return (1);
+	}
+	isc_buffer_usedregion(&buf, &r);
+
+#ifndef PK11_MD5_DISABLE
+	if (!strcasecmp(argv[1], "md5") ||
+	    !strcasecmp(argv[1], "hmac-md5")) {
+		if (r.length > HMAC_LEN) {
+			isc_md5_t md5ctx;
+			isc_md5_init(&md5ctx);
+			isc_md5_update(&md5ctx, r.base, r.length);
+			isc_md5_final(&md5ctx, key);
+
+			r.base = key;
+			r.length = ISC_MD5_DIGESTLENGTH;
+		}
+	} else
+#endif
+	if (!strcasecmp(argv[1], "sha1") ||
+		   !strcasecmp(argv[1], "hmac-sha1")) {
+		if (r.length > ISC_SHA1_DIGESTLENGTH) {
+			isc_sha1_t sha1ctx;
+			isc_sha1_init(&sha1ctx);
+			isc_sha1_update(&sha1ctx, r.base, r.length);
+			isc_sha1_final(&sha1ctx, key);
+
+			r.base = key;
+			r.length = ISC_SHA1_DIGESTLENGTH;
+		}
+	} else if (!strcasecmp(argv[1], "sha224") ||
+		   !strcasecmp(argv[1], "hmac-sha224")) {
+		if (r.length > ISC_SHA224_DIGESTLENGTH) {
+			isc_sha224_t sha224ctx;
+			isc_sha224_init(&sha224ctx);
+			isc_sha224_update(&sha224ctx, r.base, r.length);
+			isc_sha224_final(key, &sha224ctx);
+
+			r.base = key;
+			r.length = ISC_SHA224_DIGESTLENGTH;
+		}
+	} else if (!strcasecmp(argv[1], "sha256") ||
+		   !strcasecmp(argv[1], "hmac-sha256")) {
+		if (r.length > ISC_SHA256_DIGESTLENGTH) {
+			isc_sha256_t sha256ctx;
+			isc_sha256_init(&sha256ctx);
+			isc_sha256_update(&sha256ctx, r.base, r.length);
+			isc_sha256_final(key, &sha256ctx);
+
+			r.base = key;
+			r.length = ISC_SHA256_DIGESTLENGTH;
+		}
+	} else if (!strcasecmp(argv[1], "sha384") ||
+		   !strcasecmp(argv[1], "hmac-sha384")) {
+		if (r.length > ISC_SHA384_DIGESTLENGTH) {
+			isc_sha384_t sha384ctx;
+			isc_sha384_init(&sha384ctx);
+			isc_sha384_update(&sha384ctx, r.base, r.length);
+			isc_sha384_final(key, &sha384ctx);
+
+			r.base = key;
+			r.length = ISC_SHA384_DIGESTLENGTH;
+		}
+	} else if (!strcasecmp(argv[1], "sha512") ||
+		   !strcasecmp(argv[1], "hmac-sha512")) {
+		if (r.length > ISC_SHA512_DIGESTLENGTH) {
+			isc_sha512_t sha512ctx;
+			isc_sha512_init(&sha512ctx);
+			isc_sha512_update(&sha512ctx, r.base, r.length);
+			isc_sha512_final(key, &sha512ctx);
+
+			r.base = key;
+			r.length = ISC_SHA512_DIGESTLENGTH;
+		}
+	} else {
+		fprintf(stderr, "unknown hmac/digest algorithm: %s\n", argv[1]);
+		return (1);
+	}
+
+	isc_buffer_init(&buf, base64, sizeof(base64));
+	result = isc_base64_totext(&r, 0, "", &buf);
+	if (result != ISC_R_SUCCESS) {
+		fprintf(stderr, "error: %s\n", isc_result_totext(result));
+		return (1);
+	}
+	fprintf(stdout, "%.*s\n", (int)isc_buffer_usedlength(&buf), base64);
+	return (0);
+}
@@ -0,0 +1,96 @@
+<!--
+ - Copyright (C) 2010, 2013-2016  Internet Systems Consortium, Inc. ("ISC")
+ -
+ - This Source Code Form is subject to the terms of the Mozilla Public
+ - License, v. 2.0. If a copy of the MPL was not distributed with this
+ - file, You can obtain one at http://mozilla.org/MPL/2.0/.
+-->
+
+<!-- Converted by db4-upgrade version 1.0 -->
+<refentry xmlns:db="http://docbook.org/ns/docbook" version="5.0" xml:id="man.isc-hmac-fixup">
+  <info>
+    <date>2013-04-28</date>
+  </info>
+  <refentryinfo>
+    <corpname>ISC</corpname>
+    <corpauthor>Internet Systems Consortium, Inc.</corpauthor>
+  </refentryinfo>
+
+  <refmeta>
+    <refentrytitle><application>isc-hmac-fixup</application></refentrytitle>
+    <manvolnum>8</manvolnum>
+    <refmiscinfo>BIND9</refmiscinfo>
+  </refmeta>
+
+  <refnamediv>
+    <refname><application>isc-hmac-fixup</application></refname>
+    <refpurpose>fixes HMAC keys generated by older versions of BIND</refpurpose>
+  </refnamediv>
+
+  <docinfo>
+    <copyright>
+      <year>2010</year>
+      <year>2013</year>
+      <year>2014</year>
+      <year>2015</year>
+      <year>2016</year>
+      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
+    </copyright>
+  </docinfo>
+
+  <refsynopsisdiv>
+    <cmdsynopsis sepchar=" ">
+      <command>isc-hmac-fixup</command>
+      <arg choice="req" rep="norepeat"><replaceable class="parameter">algorithm</replaceable></arg>
+      <arg choice="req" rep="norepeat"><replaceable class="parameter">secret</replaceable></arg>
+    </cmdsynopsis>
+  </refsynopsisdiv>
+
+  <refsection><info><title>DESCRIPTION</title></info>
+
+    <para>
+      Versions of BIND 9 up to and including BIND 9.6 had a bug causing
+      HMAC-SHA* TSIG keys which were longer than the digest length of the
+      hash algorithm (i.e., SHA1 keys longer than 160 bits, SHA256 keys
+      longer than 256 bits, etc) to be used incorrectly, generating a
+      message authentication code that was incompatible with other DNS
+      implementations.
+    </para>
+    <para>
+      This bug has been fixed in BIND 9.7.  However, the fix may
+      cause incompatibility between older and newer versions of
+      BIND, when using long keys.  <command>isc-hmac-fixup</command>
+      modifies those keys to restore compatibility.
+    </para>
+    <para>
+      To modify a key, run <command>isc-hmac-fixup</command> and
+      specify the key's algorithm and secret on the command line.  If the
+      secret is longer than the digest length of the algorithm (64 bytes
+      for SHA1 through SHA256, or 128 bytes for SHA384 and SHA512), then a
+      new secret will be generated consisting of a hash digest of the old
+      secret.  (If the secret did not require conversion, then it will be
+      printed without modification.)
+    </para>
+  </refsection>
+
+  <refsection><info><title>SECURITY CONSIDERATIONS</title></info>
+
+    <para>
+      Secrets that have been converted by <command>isc-hmac-fixup</command>
+      are shortened, but as this is how the HMAC protocol works in
+      operation anyway, it does not affect security.  RFC 2104 notes,
+      "Keys longer than [the digest length] are acceptable but the
+      extra length would not significantly increase the function
+      strength."
+    </para>
+  </refsection>
+
+  <refsection><info><title>SEE ALSO</title></info>
+
+    <para>
+      <citetitle>BIND 9 Administrator Reference Manual</citetitle>,
+      <citetitle>RFC 2104</citetitle>.
+    </para>
+  </refsection>
+
+</refentry>
@@ -0,0 +1,92 @@
+<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
+<!--
+ - Copyright (C) 2010, 2013-2016 Internet Systems Consortium, Inc. ("ISC")
+ - 
+ - This Source Code Form is subject to the terms of the Mozilla Public
+ - License, v. 2.0. If a copy of the MPL was not distributed with this
+ - file, You can obtain one at http://mozilla.org/MPL/2.0/.
+-->
+<html lang="en">
+<head>
+<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
+<title>isc-hmac-fixup</title>
+<meta name="generator" content="DocBook XSL Stylesheets V1.78.1">
+</head>
+<body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="refentry">
+<a name="man.isc-hmac-fixup"></a><div class="titlepage"></div>
+  
+  
+
+  
+
+  <div class="refnamediv">
+<h2>Name</h2>
+<p>
+    <span class="application">isc-hmac-fixup</span>
+     &#8212; fixes HMAC keys generated by older versions of BIND
+  </p>
+</div>
+
+  
+
+  <div class="refsynopsisdiv">
+<h2>Synopsis</h2>
+    <div class="cmdsynopsis"><p>
+      <code class="command">isc-hmac-fixup</code> 
+       {<em class="replaceable"><code>algorithm</code></em>}
+       {<em class="replaceable"><code>secret</code></em>}
+    </p></div>
+  </div>
+
+  <div class="refsection">
+<a name="id-1.7"></a><h2>DESCRIPTION</h2>
+
+    <p>
+      Versions of BIND 9 up to and including BIND 9.6 had a bug causing
+      HMAC-SHA* TSIG keys which were longer than the digest length of the
+      hash algorithm (i.e., SHA1 keys longer than 160 bits, SHA256 keys
+      longer than 256 bits, etc) to be used incorrectly, generating a
+      message authentication code that was incompatible with other DNS
+      implementations.
+    </p>
+    <p>
+      This bug has been fixed in BIND 9.7.  However, the fix may
+      cause incompatibility between older and newer versions of
+      BIND, when using long keys.  <span class="command"><strong>isc-hmac-fixup</strong></span>
+      modifies those keys to restore compatibility.
+    </p>
+    <p>
+      To modify a key, run <span class="command"><strong>isc-hmac-fixup</strong></span> and
+      specify the key's algorithm and secret on the command line.  If the
+      secret is longer than the digest length of the algorithm (64 bytes
+      for SHA1 through SHA256, or 128 bytes for SHA384 and SHA512), then a
+      new secret will be generated consisting of a hash digest of the old
+      secret.  (If the secret did not require conversion, then it will be
+      printed without modification.)
+    </p>
+  </div>
+
+  <div class="refsection">
+<a name="id-1.8"></a><h2>SECURITY CONSIDERATIONS</h2>
+
+    <p>
+      Secrets that have been converted by <span class="command"><strong>isc-hmac-fixup</strong></span>
+      are shortened, but as this is how the HMAC protocol works in
+      operation anyway, it does not affect security.  RFC 2104 notes,
+      "Keys longer than [the digest length] are acceptable but the
+      extra length would not significantly increase the function
+      strength."
+    </p>
+  </div>
+
+  <div class="refsection">
+<a name="id-1.9"></a><h2>SEE ALSO</h2>
+
+    <p>
+      <em class="citetitle">BIND 9 Administrator Reference Manual</em>,
+      <em class="citetitle">RFC 2104</em>.
+    </p>
+  </div>
+
+</div></body>
+</html>
@@ -0,0 +1,18 @@
+<?xml version="1.0" encoding="utf-8"?>
+<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+  <ItemGroup>
+    <Filter Include="Source Files">
+      <UniqueIdentifier>{4FC737F1-C7A5-4376-A066-2A32D752A2FF}</UniqueIdentifier>
+      <Extensions>cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx</Extensions>
+    </Filter>
+    <Filter Include="Resource Files">
+      <UniqueIdentifier>{67DA6AB6-F800-4c08-8B7A-83BB121AAD01}</UniqueIdentifier>
+      <Extensions>rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms</Extensions>
+    </Filter>
+  </ItemGroup>
+  <ItemGroup>
+    <ClCompile Include="..\isc-hmac-fixup.c">
+      <Filter>Source Files</Filter>
+    </ClCompile>
+  </ItemGroup>
+</Project>
@@ -0,0 +1,112 @@
+<?xml version="1.0" encoding="utf-8"?>
+<Project DefaultTargets="Build" ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+  <ItemGroup Label="ProjectConfigurations">
+    <ProjectConfiguration Include="Debug|@PLATFORM@">
+      <Configuration>Debug</Configuration>
+      <Platform>@PLATFORM@</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="Release|@PLATFORM@">
+      <Configuration>Release</Configuration>
+      <Platform>@PLATFORM@</Platform>
+    </ProjectConfiguration>
+  </ItemGroup>
+  <PropertyGroup Label="Globals">
+    <ProjectGuid>{70F2F0DF-665D-4444-A982-AEA31A861A22}</ProjectGuid>
+    <Keyword>Win32Proj</Keyword>
+    <RootNamespace>ischmacfixup</RootNamespace>
+  </PropertyGroup>
+  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|@PLATFORM@'" Label="Configuration">
+    <ConfigurationType>Application</ConfigurationType>
+    <UseDebugLibraries>true</UseDebugLibraries>
+    <CharacterSet>MultiByte</CharacterSet>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'" Label="Configuration">
+    <ConfigurationType>Application</ConfigurationType>
+    <UseDebugLibraries>false</UseDebugLibraries>
+    <WholeProgramOptimization>true</WholeProgramOptimization>
+    <CharacterSet>MultiByte</CharacterSet>
+  </PropertyGroup>
+  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
+  <ImportGroup Label="ExtensionSettings">
+  </ImportGroup>
+  <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|@PLATFORM@'">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <PropertyGroup Label="UserMacros" />
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|@PLATFORM@'">
+    <LinkIncremental>true</LinkIncremental>
+    <OutDir>..\..\..\Build\$(Configuration)\</OutDir>
+    <IntDir>.\$(Configuration)\</IntDir>
+    <TargetName>isc-hmac-fixup</TargetName>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'">
+    <LinkIncremental>false</LinkIncremental>
+    <OutDir>..\..\..\Build\$(Configuration)\</OutDir>
+    <IntDir>.\$(Configuration)\</IntDir>
+    <TargetName>isc-hmac-fixup</TargetName>
+  </PropertyGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|@PLATFORM@'">
+    <ClCompile>
+      <PrecompiledHeader>
+      </PrecompiledHeader>
+      <WarningLevel>Level3</WarningLevel>
+      <Optimization>Disabled</Optimization>
+      <PreprocessorDefinitions>WIN32;@CRYPTO@_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <FunctionLevelLinking>true</FunctionLevelLinking>
+      <PrecompiledHeaderOutputFile>.\$(Configuration)\$(ProjectName).pch</PrecompiledHeaderOutputFile>
+      <AssemblerListingLocation>.\$(Configuration)\</AssemblerListingLocation>
+      <ObjectFileName>.\$(Configuration)\</ObjectFileName>
+      <ProgramDataBaseFileName>$(OutDir)$(TargetName).pdb</ProgramDataBaseFileName>
+      <BrowseInformation>true</BrowseInformation>
+      <AdditionalIncludeDirectories>.\;..\..\..\;@LIBXML2_INC@@OPENSSL_INC@..\..\..\lib\isc\win32;..\..\..\lib\isc\win32\include;..\..\..\lib\isc\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+      <CompileAs>CompileAsC</CompileAs>
+    </ClCompile>
+    <Link>
+      <SubSystem>Console</SubSystem>
+      <GenerateDebugInformation>true</GenerateDebugInformation>
+      <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
+      <AdditionalLibraryDirectories>..\..\..\lib\isc\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
+      <AdditionalDependencies>libisc.lib;%(AdditionalDependencies)</AdditionalDependencies>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'">
+    <ClCompile>
+      <WarningLevel>Level3</WarningLevel>
+      <PrecompiledHeader>
+      </PrecompiledHeader>
+      <Optimization>MaxSpeed</Optimization>
+      <FunctionLevelLinking>true</FunctionLevelLinking>
+      <IntrinsicFunctions>@INTRINSIC@</IntrinsicFunctions>
+      <PreprocessorDefinitions>WIN32;@CRYPTO@NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
+      <WholeProgramOptimization>false</WholeProgramOptimization>
+      <StringPooling>true</StringPooling>
+      <PrecompiledHeaderOutputFile>.\$(Configuration)\$(ProjectName).pch</PrecompiledHeaderOutputFile>
+      <AssemblerListingLocation>.\$(Configuration)\</AssemblerListingLocation>
+      <ObjectFileName>.\$(Configuration)\</ObjectFileName>
+      <ProgramDataBaseFileName>$(OutDir)$(TargetName).pdb</ProgramDataBaseFileName>
+      <AdditionalIncludeDirectories>.\;..\..\..\;@LIBXML2_INC@@OPENSSL_INC@..\..\..\lib\isc\win32;..\..\..\lib\isc\win32\include;..\..\..\lib\isc\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+      <CompileAs>CompileAsC</CompileAs>
+    </ClCompile>
+    <Link>
+      <SubSystem>Console</SubSystem>
+      <GenerateDebugInformation>false</GenerateDebugInformation>
+      <EnableCOMDATFolding>true</EnableCOMDATFolding>
+      <OptimizeReferences>true</OptimizeReferences>
+      <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
+      <LinkTimeCodeGeneration>Default</LinkTimeCodeGeneration>
+      <AdditionalLibraryDirectories>..\..\..\lib\isc\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
+      <AdditionalDependencies>libisc.lib;%(AdditionalDependencies)</AdditionalDependencies>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemGroup>
+    <ClCompile Include="..\isc-hmac-fixup.c" />
+  </ItemGroup>
+  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
+  <ImportGroup Label="ExtensionTargets">
+  </ImportGroup>
+</Project>
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Evan Hunt	150deb0126	[rt42272] stronger wording	2017-10-24 10:36:00 -07:00
Evan Hunt	894ce6081a	[rt42272] also warn on use of MD5 for rndc keys	2017-10-23 10:35:08 -07:00
Evan Hunt	5cdcb725a9	[rt42272] add a "deprecated" warning when generating hmac keys	2017-10-22 23:37:57 -07:00
				`@@ -1 +0,0 @@`
				`-m record,size,mctx -T clienttest -c named.conf -d 99 -X named.lock -g`