correct the configuration of the default allow-notify ACL

Resolve ""invalid RPZ prefix length" log message improperly displays the prefix labels, not length"

Closes #254

See merge request isc-projects/bind9!270

.gitignore

@@ -7,6 +7,8 @@ libtool
 /isc-config.sh
 /configure.lineno
 autom4te.cache/
+*.rej
+*.orig
 *.o
 *.lo
 *.so

CHANGES

@@ -1,5 +1,107 @@
+4977.	[cleanup]	Fixed an inconsistency in setting up the
+			default "allow-notify" ACL. [GL !342]
+
+4976.	[bug]		Log the label with invalid prefix length correctly
+			when loading RPZ zones. [GL #254]
+
+4975.	[bug]		The server cookie computation for sha1 and sha256 did
+			not match the method described in RFC 7873. [GL #356]
+
+4974.	[bug]		Restore default rrset-order to random. [GL #336]
+
+4973.	[func]		verifyzone() and the functions it uses were moved to
+			libdns and refactored to prevent exit() from being
+			called upon failure.  A side effect of that is that
+			dnssec-signzone and dnssec-verify now check for memory
+			leaks upon shutdown. [GL #266]
+
+4972.	[func]		Declare the 'rdata' argument for dns_rdata_tostruct()
+			to be const. [GL #341]
+
+4971.	[bug]		dnssec-signzone and dnssec-verify did not treat records
+			below a DNAME as out-of-zone data. [GL #298]
+
+4970.	[func]		Add QNAME minimization option to resolver. [GL #16]
+
+4969.	[cleanup]	Refactor zone logging functions. [GL #269]
+
+	--- 9.13.1 released ---
+
+4968.	[bug]		If glue records are signed, attempt to validate them.
+			[GL #209]
+
+4967.	[cleanup]	Add "answer-cookie" to the parser, marked obsolete.
+
+4966.	[placeholder]
+
+4965.	[func]		Add support for marking options as deprecated.
+			[GL #322]
+
+4964.	[bug]		Reduce the probabilty of double signature when deleting
+			a DNSKEY by checking if the node is otherwise signed
+			by the algorithm of the key to be deleted. [GL #240]
+
+4963.	[test]		ifconfig.sh now uses "ip" instead of "ifconfig",
+			if available, to configure the test interfaces on
+			linux.  [GL #302]
+
+4962.	[cleanup]	Move 'named -T' processing to its own function.
+			[GL #316]
+
+4961.	[protocol]	Remove support for ECC-GOST (GOST R 34.11-94).
+			[GL #295]
+
+4960.	[security]	When recursion is enabled, but the "allow-recursion"
+			and "allow-query-cache" ACLs are not specified,
+			they should be limited to local networks,
+			but were inadvertently set to match the default
+			"allow-query", thus allowing remote queries.
+			(CVE-2018-5738) [GL #309]
+
+4959.	[func]		NSID logging (enabled by the "request-nsid" option)
+			now has its own "nsid" category, instead of using the
+			"resolver" category. [GL !332]
+
+4958.	[bug]		Remove redundant space from NSEC3 record. [GL #281]
+
+4957.	[func]		The default setting for "dnssec-validation" is now
+			"auto", which activates DNSSEC validation using the
+			IANA root key. (The default can be changed back to
+			"yes", which activates DNSSEC validation only when keys
+			are explicitly configured in named.conf, by building
+			BIND with "configure --disable-auto-validation".)
+			[GL #30]
+
+4956.	[func]		Change isc_random() to be just PRNG using xoshiro128**,
+			and add isc_nonce_buf() that uses CSPRNG. [GL #289]
+
+4955.	[cleanup]	Silence cppcheck warnings in lib/dns/master.c.
+			[GL #286]
+
+4954.	[func]		Messages about serving of stale answers are now
+			directed to the "serve-stale" logging category.
+			Also clarified serve-stale documentation. [GL !323]
+
+4953.	[bug]		Removed the option to build the red black tree
+			database without a hash table; the non-hashing
+			version was buggy and is not needed. [GL #184]
+
+4952.	[func]		Authoritative server support in named for the
+			EDNS CLIENT-SUBNET option (which was experimental
+			and not practical to deploy) has been removed.
+
+			The ECS option is still supported in dig and mdig
+			via the +subnet option, and can be parsed and logged
+			when received by named, but it is no longer used
+			for ACL processing. The "geoip-use-ecs" option
+			is now obsolete; a warning will be logged if it is
+			used in named.conf. "ecs" tags in an ACL definition
+			are also obsolete and will cause the configuration
+			to fail to load.  [GL #32]
+
 4951.	[protocol]	Add "HOME.ARPA" to list of built in empty zones as
 			per RFC 8375. [GL #273]
+
 	--- 9.13.0 released ---
 
 4950.	[bug]		ISC_SOCKEVENTATTR_TRUNC was not be set. [GL #238]

Makefile.in

@@ -22,7 +22,8 @@ MANPAGES =	isc-config.sh.1
 
 HTMLPAGES =	isc-config.sh.html
 
-MANOBJS =	README HISTORY OPTIONS CONTRIBUTING ${MANPAGES} ${HTMLPAGES}
+MANOBJS =	README HISTORY OPTIONS CONTRIBUTING PLATFORMS \
+		${MANPAGES} ${HTMLPAGES}
 
 @BIND9_MAKE_RULES@
 
@@ -114,6 +115,11 @@ CONTRIBUTING: CONTRIBUTING.md
 		${W3M} -dump -cols 75 -O ascii -T text/html | \
 		sed -e '$${/^$$/d;}' > $@
 
+PLATFORMS: PLATFORMS.md
+	${PANDOC} --email-obfuscation=none -s -t html PLATFORMS.md | \
+		${W3M} -dump -cols 75 -O ascii -T text/html | \
+		sed -e '$${/^$$/d;}' > $@
+
 unit::
 	sh ${top_builddir}/unit/unittest.sh
 

PLATFORMS

@@ -0,0 +1,56 @@
+Supported platforms
+
+In general, this version of BIND will build and run on any POSIX-compliant
+system with a C99-compliant C compiler, BSD-style sockets, and the OpenSSL
+cryptography library. To build with multiprocessing support, a
+C11-compliant C compiler will be needed for standard atomics.
+
+ISC regularly tests BIND on many operating systems and architectures, but
+lacks the resources to test all of them. Consequently, ISC is only able to
+offer support on a "best effort" basis for some.
+
+Regularly tested platforms
+
+As of May 2018, BIND 9.13 is tested on the following systems:
+
+  * Debian 8, 9
+  * Ubuntu 16.04, 18.04
+  * Fedora 27, 28
+  * Red Hat/CentOS 6, 7
+  * FreeBSD 10.x, 11.x
+  * OpenBSD 6.3
+
+The amd64, i386, armhf and arm64 CPU architectures are all fully
+supported.
+
+Best effort
+
+The following are platforms on which BIND is known to build and run, but
+on which it is not routinely tested. ISC makes every effort to fix bugs on
+these platforms, but may be unable to do so quickly due to lack of
+hardware, less familiarity on the part of engineering staff, and other
+constraints.
+
+  * Windows 10 / x64
+  * Windows Server 2012 R2, 2016 / x64
+  * macOS 10.12+
+  * Solaris 10
+  * FreeBSD 12+
+  * OpenBSD 6.2
+  * NetBSD
+  * Older or less popular Linux distributions still supported by their
+    vendors, such as:
+      + Ubuntu 14.04, 18.10+
+      + Gentoo
+      + ArchLinux
+      + Alpine Linux
+  * OpenWRT/LEDE 17.0
+  * Other CPU architectures (mips, mipsel, sparc, ...)
+
+Unsupported platforms
+
+These are platforms on which BIND is known not to build or run:
+
+  * Platforms without at least OpenSSL 1.0.2
+  * Windows 10 / x86
+  * Windows Server 2012

PLATFORMS.md

@@ -0,0 +1,64 @@
+<!--
+ - Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ -
+ - This Source Code Form is subject to the terms of the Mozilla Public
+ - License, v. 2.0. If a copy of the MPL was not distributed with this
+ - file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ -
+ - See the COPYRIGHT file distributed with this work for additional
+ - information regarding copyright ownership.
+-->
+## Supported platforms
+
+In general, this version of BIND will build and run on any POSIX-compliant
+system with a C99-compliant C compiler, BSD-style sockets, and the OpenSSL
+cryptography library. To build with multiprocessing support, a
+C11-compliant C compiler will be needed for standard atomics.
+
+ISC regularly tests BIND on many operating systems and architectures, but
+lacks the resources to test all of them. Consequently, ISC is only able to
+offer support on a "best effort" basis for some.
+
+### Regularly tested platforms
+
+As of May 2018, BIND 9.13 is tested on the following systems:
+
+* Debian 8, 9
+* Ubuntu 16.04, 18.04
+* Fedora 27, 28
+* Red Hat/CentOS 6, 7
+* FreeBSD 10.x, 11.x
+* OpenBSD 6.3
+
+The amd64, i386, armhf and arm64 CPU architectures are all fully supported.
+
+### Best effort
+
+The following are platforms on which BIND is known to build and run,
+but on which it is not routinely tested. ISC makes every effort to fix bugs
+on these platforms, but may be unable to do so quickly due to lack of
+hardware, less familiarity on the part of engineering staff, and other
+constraints.
+
+* Windows 10 / x64
+* Windows Server 2012 R2, 2016 / x64
+* macOS 10.12+
+* Solaris 10
+* FreeBSD 12+
+* OpenBSD 6.2
+* NetBSD
+* Older or less popular Linux distributions still supported by their vendors, such as:
+    * Ubuntu 14.04, 18.10+
+    * Gentoo
+    * ArchLinux
+    * Alpine Linux
+* OpenWRT/LEDE 17.0
+* Other CPU architectures (mips, mipsel, sparc, ...)
+
+## Unsupported platforms
+
+These are platforms on which BIND is known *not* to build or run:
+
+* Platforms without at least OpenSSL 1.0.2
+* Windows 10 / x86
+* Windows Server 2012

README

@@ -31,9 +31,9 @@ administrative tools, including the dig and delv DNS lookup tools,
 nsupdate for dynamic DNS zone updates, rndc for remote name server
 administration, and more.
 
-BIND 9 is a complete re-write of the BIND architecture that was used in
-versions 4 and 8. Internet Systems Consortium (https://www.isc.org), a 501
-(c)(3) public benefit corporation dedicated to providing software and
+BIND 9 began as a complete re-write of the BIND architecture that was used
+in versions 4 and 8. Internet Systems Consortium (https://www.isc.org), a
+501(c)(3) public benefit corporation dedicated to providing software and
 services in support of the Internet infrastructure, developed BIND 9 and
 is responsible for its ongoing maintenance and improvement. BIND is open
 source software licenced under the terms of the Mozilla Public License,
@@ -48,6 +48,8 @@ the file CHANGES. See below for details on the CHANGES file format.
 For up-to-date release notes and errata, see http://www.isc.org/software/
 bind9/releasenotes
 
+For information about supported platforms, see PLATFORMS.
+
 Reporting bugs and getting help
 
 To report non-security-sensitive bugs or request new features, you may
@@ -99,11 +101,20 @@ format-patch.
 
 BIND 9.13 features
 
-BIND 9.13.0 is the newest development branch of BIND 9. It includes a
-number of changes from BIND 9.12 and earlier releases. New features
-include:
+BIND 9.13 is the newest development branch of BIND 9. It includes a number
+of changes from BIND 9.12 and earlier releases. New features include:
 
-  * TBD
+  * The default value of "dnssec-validation" is now "auto".
+  * Support for IDNA2008 when linking with libidn2.
+  * "Root key sentinel" support, enabling validating resolvers to indicate
+    via a special query which trust anchors are configured for the root
+    zone.
+
+In addition, cryptographic support has been modernized. BIND now uses the
+best available pseudo-random number generator for the platform on which
+it's built. Very old versions of OpenSSL are no longer supported.
+Cryptography is now mandatory; building BIND without DNSSEC is now longer
+supported.
 
 Building BIND
 

README.md

@@ -41,8 +41,8 @@ administrative tools, including the `dig` and `delv` DNS lookup tools,
 `nsupdate` for dynamic DNS zone updates, `rndc` for remote name server
 administration, and more.
 
-BIND 9 is a complete re-write of the BIND architecture that was used in
-versions 4 and 8.  Internet Systems Consortium
+BIND 9 began as a complete re-write of the BIND architecture that was
+used in versions 4 and 8.  Internet Systems Consortium
 ([https://www.isc.org](https://www.isc.org)), a 501(c)(3) public benefit
 corporation dedicated to providing software and services in support of the
 Internet infrastructure, developed BIND 9 and is responsible for its
@@ -59,6 +59,8 @@ CHANGES file format.
 For up-to-date release notes and errata, see
 [http://www.isc.org/software/bind9/releasenotes](http://www.isc.org/software/bind9/releasenotes)
 
+For information about supported platforms, see [PLATFORMS](PLATFORMS.md).
+
 ### <a name="help"/> Reporting bugs and getting help
 
 To report non-security-sensitive bugs or request new features, you may
@@ -116,11 +118,20 @@ including your patch as an attachment, preferably generated by
 
 ### <a name="features"/> BIND 9.13 features
 
-BIND 9.13.0 is the newest development branch of BIND 9. It includes a
+BIND 9.13 is the newest development branch of BIND 9. It includes a
 number of changes from BIND 9.12 and earlier releases.  New features
 include:
 
-* TBD
+* The default value of "dnssec-validation" is now "auto".
+* Support for IDNA2008 when linking with `libidn2`.
+* "Root key sentinel" support, enabling validating resolvers to indicate
+  via a special query which trust anchors are configured for the root zone.
+
+In addition, cryptographic support has been modernized. BIND now uses the
+best available pseudo-random number generator for the platform on which
+it's built. Very old versions of OpenSSL are no longer supported.
+Cryptography is now mandatory; building BIND without DNSSEC is now
+longer supported.
 
 ### <a name="build"/> Building BIND
 

aclocal.m4

@@ -1,17 +1,295 @@
-sinclude(libtool.m4/libtool.m4)dnl
-sinclude(libtool.m4/ltoptions.m4)dnl
-sinclude(libtool.m4/ltsugar.m4)dnl
-sinclude(libtool.m4/ltversion.m4)dnl
-sinclude(libtool.m4/lt~obsolete.m4)dnl
+# generated automatically by aclocal 1.16.1 -*- Autoconf -*-
 
-m4_divert_text(HELP_CANON, [[
-  NOTE: If PREFIX is not set, then the default values for --sysconfdir
-  and --localstatedir are /etc and /var, respectively.]])
-m4_divert_text(HELP_END, [[
-Professional support for BIND is provided by Internet Systems Consortium,
-Inc.  Information about paid support and training options is available at
-https://www.isc.org/support.
+# Copyright (C) 1996-2018 Free Software Foundation, Inc.
 
-Help can also often be found on the BIND Users mailing list
-(https://lists.isc.org/mailman/listinfo/bind-users) or in the #bind
-channel of the Freenode IRC service.]])
+# This file is free software; the Free Software Foundation
+# gives unlimited permission to copy and/or distribute it,
+# with or without modifications, as long as this notice is preserved.
+
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY, to the extent permitted by law; without
+# even the implied warranty of MERCHANTABILITY or FITNESS FOR A
+# PARTICULAR PURPOSE.
+
+m4_ifndef([AC_CONFIG_MACRO_DIRS], [m4_defun([_AM_CONFIG_MACRO_DIRS], [])m4_defun([AC_CONFIG_MACRO_DIRS], [_AM_CONFIG_MACRO_DIRS($@)])])
+# pkg.m4 - Macros to locate and utilise pkg-config.   -*- Autoconf -*-
+# serial 12 (pkg-config-0.29.2)
+
+dnl Copyright © 2004 Scott James Remnant <scott@netsplit.com>.
+dnl Copyright © 2012-2015 Dan Nicholson <dbn.lists@gmail.com>
+dnl
+dnl This program is free software; you can redistribute it and/or modify
+dnl it under the terms of the GNU General Public License as published by
+dnl the Free Software Foundation; either version 2 of the License, or
+dnl (at your option) any later version.
+dnl
+dnl This program is distributed in the hope that it will be useful, but
+dnl WITHOUT ANY WARRANTY; without even the implied warranty of
+dnl MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+dnl General Public License for more details.
+dnl
+dnl You should have received a copy of the GNU General Public License
+dnl along with this program; if not, write to the Free Software
+dnl Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA
+dnl 02111-1307, USA.
+dnl
+dnl As a special exception to the GNU General Public License, if you
+dnl distribute this file as part of a program that contains a
+dnl configuration script generated by Autoconf, you may include it under
+dnl the same distribution terms that you use for the rest of that
+dnl program.
+
+dnl PKG_PREREQ(MIN-VERSION)
+dnl -----------------------
+dnl Since: 0.29
+dnl
+dnl Verify that the version of the pkg-config macros are at least
+dnl MIN-VERSION. Unlike PKG_PROG_PKG_CONFIG, which checks the user's
+dnl installed version of pkg-config, this checks the developer's version
+dnl of pkg.m4 when generating configure.
+dnl
+dnl To ensure that this macro is defined, also add:
+dnl m4_ifndef([PKG_PREREQ],
+dnl     [m4_fatal([must install pkg-config 0.29 or later before running autoconf/autogen])])
+dnl
+dnl See the "Since" comment for each macro you use to see what version
+dnl of the macros you require.
+m4_defun([PKG_PREREQ],
+[m4_define([PKG_MACROS_VERSION], [0.29.2])
+m4_if(m4_version_compare(PKG_MACROS_VERSION, [$1]), -1,
+    [m4_fatal([pkg.m4 version $1 or higher is required but ]PKG_MACROS_VERSION[ found])])
+])dnl PKG_PREREQ
+
+dnl PKG_PROG_PKG_CONFIG([MIN-VERSION])
+dnl ----------------------------------
+dnl Since: 0.16
+dnl
+dnl Search for the pkg-config tool and set the PKG_CONFIG variable to
+dnl first found in the path. Checks that the version of pkg-config found
+dnl is at least MIN-VERSION. If MIN-VERSION is not specified, 0.9.0 is
+dnl used since that's the first version where most current features of
+dnl pkg-config existed.
+AC_DEFUN([PKG_PROG_PKG_CONFIG],
+[m4_pattern_forbid([^_?PKG_[A-Z_]+$])
+m4_pattern_allow([^PKG_CONFIG(_(PATH|LIBDIR|SYSROOT_DIR|ALLOW_SYSTEM_(CFLAGS|LIBS)))?$])
+m4_pattern_allow([^PKG_CONFIG_(DISABLE_UNINSTALLED|TOP_BUILD_DIR|DEBUG_SPEW)$])
+AC_ARG_VAR([PKG_CONFIG], [path to pkg-config utility])
+AC_ARG_VAR([PKG_CONFIG_PATH], [directories to add to pkg-config's search path])
+AC_ARG_VAR([PKG_CONFIG_LIBDIR], [path overriding pkg-config's built-in search path])
+
+if test "x$ac_cv_env_PKG_CONFIG_set" != "xset"; then
+	AC_PATH_TOOL([PKG_CONFIG], [pkg-config])
+fi
+if test -n "$PKG_CONFIG"; then
+	_pkg_min_version=m4_default([$1], [0.9.0])
+	AC_MSG_CHECKING([pkg-config is at least version $_pkg_min_version])
+	if $PKG_CONFIG --atleast-pkgconfig-version $_pkg_min_version; then
+		AC_MSG_RESULT([yes])
+	else
+		AC_MSG_RESULT([no])
+		PKG_CONFIG=""
+	fi
+fi[]dnl
+])dnl PKG_PROG_PKG_CONFIG
+
+dnl PKG_CHECK_EXISTS(MODULES, [ACTION-IF-FOUND], [ACTION-IF-NOT-FOUND])
+dnl -------------------------------------------------------------------
+dnl Since: 0.18
+dnl
+dnl Check to see whether a particular set of modules exists. Similar to
+dnl PKG_CHECK_MODULES(), but does not set variables or print errors.
+dnl
+dnl Please remember that m4 expands AC_REQUIRE([PKG_PROG_PKG_CONFIG])
+dnl only at the first occurence in configure.ac, so if the first place
+dnl it's called might be skipped (such as if it is within an "if", you
+dnl have to call PKG_CHECK_EXISTS manually
+AC_DEFUN([PKG_CHECK_EXISTS],
+[AC_REQUIRE([PKG_PROG_PKG_CONFIG])dnl
+if test -n "$PKG_CONFIG" && \
+    AC_RUN_LOG([$PKG_CONFIG --exists --print-errors "$1"]); then
+  m4_default([$2], [:])
+m4_ifvaln([$3], [else
+  $3])dnl
+fi])
+
+dnl _PKG_CONFIG([VARIABLE], [COMMAND], [MODULES])
+dnl ---------------------------------------------
+dnl Internal wrapper calling pkg-config via PKG_CONFIG and setting
+dnl pkg_failed based on the result.
+m4_define([_PKG_CONFIG],
+[if test -n "$$1"; then
+    pkg_cv_[]$1="$$1"
+ elif test -n "$PKG_CONFIG"; then
+    PKG_CHECK_EXISTS([$3],
+                     [pkg_cv_[]$1=`$PKG_CONFIG --[]$2 "$3" 2>/dev/null`
+		      test "x$?" != "x0" && pkg_failed=yes ],
+		     [pkg_failed=yes])
+ else
+    pkg_failed=untried
+fi[]dnl
+])dnl _PKG_CONFIG
+
+dnl _PKG_SHORT_ERRORS_SUPPORTED
+dnl ---------------------------
+dnl Internal check to see if pkg-config supports short errors.
+AC_DEFUN([_PKG_SHORT_ERRORS_SUPPORTED],
+[AC_REQUIRE([PKG_PROG_PKG_CONFIG])
+if $PKG_CONFIG --atleast-pkgconfig-version 0.20; then
+        _pkg_short_errors_supported=yes
+else
+        _pkg_short_errors_supported=no
+fi[]dnl
+])dnl _PKG_SHORT_ERRORS_SUPPORTED
+
+
+dnl PKG_CHECK_MODULES(VARIABLE-PREFIX, MODULES, [ACTION-IF-FOUND],
+dnl   [ACTION-IF-NOT-FOUND])
+dnl --------------------------------------------------------------
+dnl Since: 0.4.0
+dnl
+dnl Note that if there is a possibility the first call to
+dnl PKG_CHECK_MODULES might not happen, you should be sure to include an
+dnl explicit call to PKG_PROG_PKG_CONFIG in your configure.ac
+AC_DEFUN([PKG_CHECK_MODULES],
+[AC_REQUIRE([PKG_PROG_PKG_CONFIG])dnl
+AC_ARG_VAR([$1][_CFLAGS], [C compiler flags for $1, overriding pkg-config])dnl
+AC_ARG_VAR([$1][_LIBS], [linker flags for $1, overriding pkg-config])dnl
+
+pkg_failed=no
+AC_MSG_CHECKING([for $2])
+
+_PKG_CONFIG([$1][_CFLAGS], [cflags], [$2])
+_PKG_CONFIG([$1][_LIBS], [libs], [$2])
+
+m4_define([_PKG_TEXT], [Alternatively, you may set the environment variables $1[]_CFLAGS
+and $1[]_LIBS to avoid the need to call pkg-config.
+See the pkg-config man page for more details.])
+
+if test $pkg_failed = yes; then
+        AC_MSG_RESULT([no])
+        _PKG_SHORT_ERRORS_SUPPORTED
+        if test $_pkg_short_errors_supported = yes; then
+	        $1[]_PKG_ERRORS=`$PKG_CONFIG --short-errors --print-errors --cflags --libs "$2" 2>&1`
+        else
+	        $1[]_PKG_ERRORS=`$PKG_CONFIG --print-errors --cflags --libs "$2" 2>&1`
+        fi
+	# Put the nasty error message in config.log where it belongs
+	echo "$$1[]_PKG_ERRORS" >&AS_MESSAGE_LOG_FD
+
+	m4_default([$4], [AC_MSG_ERROR(
+[Package requirements ($2) were not met:
+
+$$1_PKG_ERRORS
+
+Consider adjusting the PKG_CONFIG_PATH environment variable if you
+installed software in a non-standard prefix.
+
+_PKG_TEXT])[]dnl
+        ])
+elif test $pkg_failed = untried; then
+        AC_MSG_RESULT([no])
+	m4_default([$4], [AC_MSG_FAILURE(
+[The pkg-config script could not be found or is too old.  Make sure it
+is in your PATH or set the PKG_CONFIG environment variable to the full
+path to pkg-config.
+
+_PKG_TEXT
+
+To get pkg-config, see <http://pkg-config.freedesktop.org/>.])[]dnl
+        ])
+else
+	$1[]_CFLAGS=$pkg_cv_[]$1[]_CFLAGS
+	$1[]_LIBS=$pkg_cv_[]$1[]_LIBS
+        AC_MSG_RESULT([yes])
+	$3
+fi[]dnl
+])dnl PKG_CHECK_MODULES
+
+
+dnl PKG_CHECK_MODULES_STATIC(VARIABLE-PREFIX, MODULES, [ACTION-IF-FOUND],
+dnl   [ACTION-IF-NOT-FOUND])
+dnl ---------------------------------------------------------------------
+dnl Since: 0.29
+dnl
+dnl Checks for existence of MODULES and gathers its build flags with
+dnl static libraries enabled. Sets VARIABLE-PREFIX_CFLAGS from --cflags
+dnl and VARIABLE-PREFIX_LIBS from --libs.
+dnl
+dnl Note that if there is a possibility the first call to
+dnl PKG_CHECK_MODULES_STATIC might not happen, you should be sure to
+dnl include an explicit call to PKG_PROG_PKG_CONFIG in your
+dnl configure.ac.
+AC_DEFUN([PKG_CHECK_MODULES_STATIC],
+[AC_REQUIRE([PKG_PROG_PKG_CONFIG])dnl
+_save_PKG_CONFIG=$PKG_CONFIG
+PKG_CONFIG="$PKG_CONFIG --static"
+PKG_CHECK_MODULES($@)
+PKG_CONFIG=$_save_PKG_CONFIG[]dnl
+])dnl PKG_CHECK_MODULES_STATIC
+
+
+dnl PKG_INSTALLDIR([DIRECTORY])
+dnl -------------------------
+dnl Since: 0.27
+dnl
+dnl Substitutes the variable pkgconfigdir as the location where a module
+dnl should install pkg-config .pc files. By default the directory is
+dnl $libdir/pkgconfig, but the default can be changed by passing
+dnl DIRECTORY. The user can override through the --with-pkgconfigdir
+dnl parameter.
+AC_DEFUN([PKG_INSTALLDIR],
+[m4_pushdef([pkg_default], [m4_default([$1], ['${libdir}/pkgconfig'])])
+m4_pushdef([pkg_description],
+    [pkg-config installation directory @<:@]pkg_default[@:>@])
+AC_ARG_WITH([pkgconfigdir],
+    [AS_HELP_STRING([--with-pkgconfigdir], pkg_description)],,
+    [with_pkgconfigdir=]pkg_default)
+AC_SUBST([pkgconfigdir], [$with_pkgconfigdir])
+m4_popdef([pkg_default])
+m4_popdef([pkg_description])
+])dnl PKG_INSTALLDIR
+
+
+dnl PKG_NOARCH_INSTALLDIR([DIRECTORY])
+dnl --------------------------------
+dnl Since: 0.27
+dnl
+dnl Substitutes the variable noarch_pkgconfigdir as the location where a
+dnl module should install arch-independent pkg-config .pc files. By
+dnl default the directory is $datadir/pkgconfig, but the default can be
+dnl changed by passing DIRECTORY. The user can override through the
+dnl --with-noarch-pkgconfigdir parameter.
+AC_DEFUN([PKG_NOARCH_INSTALLDIR],
+[m4_pushdef([pkg_default], [m4_default([$1], ['${datadir}/pkgconfig'])])
+m4_pushdef([pkg_description],
+    [pkg-config arch-independent installation directory @<:@]pkg_default[@:>@])
+AC_ARG_WITH([noarch-pkgconfigdir],
+    [AS_HELP_STRING([--with-noarch-pkgconfigdir], pkg_description)],,
+    [with_noarch_pkgconfigdir=]pkg_default)
+AC_SUBST([noarch_pkgconfigdir], [$with_noarch_pkgconfigdir])
+m4_popdef([pkg_default])
+m4_popdef([pkg_description])
+])dnl PKG_NOARCH_INSTALLDIR
+
+
+dnl PKG_CHECK_VAR(VARIABLE, MODULE, CONFIG-VARIABLE,
+dnl [ACTION-IF-FOUND], [ACTION-IF-NOT-FOUND])
+dnl -------------------------------------------
+dnl Since: 0.28
+dnl
+dnl Retrieves the value of the pkg-config variable for the given module.
+AC_DEFUN([PKG_CHECK_VAR],
+[AC_REQUIRE([PKG_PROG_PKG_CONFIG])dnl
+AC_ARG_VAR([$1], [value of $3 for $2, overriding pkg-config])dnl
+
+_PKG_CONFIG([$1], [variable="][$3]["], [$2])
+AS_VAR_COPY([$1], [pkg_cv_][$1])
+
+AS_VAR_IF([$1], [""], [$5], [$4])dnl
+])dnl PKG_CHECK_VAR
+
+m4_include([libtool.m4/libtool.m4])
+m4_include([libtool.m4/ltoptions.m4])
+m4_include([libtool.m4/ltsugar.m4])
+m4_include([libtool.m4/ltversion.m4])
+m4_include([libtool.m4/lt~obsolete.m4])

bin/dig/dig.c

@@ -1933,7 +1933,7 @@ parse_args(isc_boolean_t is_batchfile, isc_boolean_t config_only,
 			{
 				debug("config line %s", batchline);
 				bargc = split_batchline(batchline, bargv, 62,
-						        ".digrc argv");
+							".digrc argv");
 				bargv[0] = argv[0];
 				argv0 = argv[0];
 				parse_args(ISC_TRUE, ISC_TRUE,

bin/dig/dighost.c

@@ -63,6 +63,7 @@
 #include <isc/log.h>
 #include <isc/netaddr.h>
 #include <isc/netdb.h>
+#include <isc/nonce.h>
 #include <isc/parseint.h>
 #include <isc/print.h>
 #include <isc/random.h>
@@ -1315,7 +1316,7 @@ setup_system(isc_boolean_t ipv4only, isc_boolean_t ipv6only) {
 	else if (keysecret[0] != 0)
 		setup_text_key();
 
-	isc_random_buf(cookie_secret, sizeof(cookie_secret));
+	isc_nonce_buf(cookie_secret, sizeof(cookie_secret));
 }
 
 /*%
@@ -1870,8 +1871,7 @@ followup_lookup(dns_message_t *msg, dig_query_t *query, dns_section_t section)
 		     srv != NULL;
 		     srv = ISC_LIST_HEAD(lookup->my_server_list)) {
 			INSIST(i > 0);
-			j = isc_random();
-			j %= i;
+			j = isc_random_uniform(i);
 			next = ISC_LIST_NEXT(srv, link);
 			while (j-- > 0 && next != NULL) {
 				srv = next;
@@ -2023,7 +2023,6 @@ compute_cookie(unsigned char *clientcookie, size_t len) {
 isc_boolean_t
 setup_lookup(dig_lookup_t *lookup) {
 	isc_result_t result;
-	isc_uint32_t id;
 	unsigned int len;
 	dig_server_t *serv;
 	dig_query_t *query;
@@ -2198,8 +2197,7 @@ setup_lookup(dig_lookup_t *lookup) {
 	dighost_trying(store, lookup);
 	INSIST(dns_name_isabsolute(lookup->name));
 
-	id = isc_random();
-	lookup->sendmsg->id = (unsigned short)id & 0xFFFF;
+	lookup->sendmsg->id = (dns_messageid_t)isc_random16();
 	lookup->sendmsg->opcode = lookup->opcode;
 	lookup->msgcounter = 0;
 	/*

bin/dnssec/dnssec-cds.8

@@ -102,7 +102,7 @@ Specify a digest algorithm to use when converting CDNSKEY records to DS records\
 .sp
 The
 \fIalgorithm\fR
-must be one of SHA\-1 (SHA1), SHA\-256 (SHA256), GOST, or SHA\-384 (SHA384)\&. These values are case insensitive\&. If no algorithm is specified, the default is SHA\-256\&.
+must be one of SHA\-1 (SHA1), SHA\-256 (SHA256), or SHA\-384 (SHA384)\&. These values are case insensitive\&. If no algorithm is specified, the default is SHA\-256\&.
 .RE
 .PP
 \-c \fIclass\fR

bin/dnssec/dnssec-cds.c

@@ -1115,7 +1115,7 @@ usage(void) {
 		program);
 	fprintf(stderr, "Version: %s\n", VERSION);
 	fprintf(stderr, "Options:\n"
-"    -a <algorithm>     digest algorithm (SHA-1 / SHA-256 / GOST / SHA-384)\n"
+"    -a <algorithm>     digest algorithm (SHA-1 / SHA-256 / SHA-384)\n"
 "    -c <class>         of domain (default IN)\n"
 "    -D                 prefer CDNSKEY records instead of CDS\n"
 "    -d <file|dir>      where to find parent dsset- file\n"

bin/dnssec/dnssec-cds.docbook

@@ -144,7 +144,7 @@
           </para>
           <para>
 	    The <replaceable>algorithm</replaceable> must be one of SHA-1
-	    (SHA1), SHA-256 (SHA256), GOST, or SHA-384 (SHA384). These
+	    (SHA1), SHA-256 (SHA256), or SHA-384 (SHA384). These
 	    values are case insensitive. If no algorithm is specified,
 	    the default is SHA-256.
           </para>

bin/dnssec/dnssec-cds.html

@@ -130,7 +130,7 @@
           </p>
           <p>
 	    The <em class="replaceable"><code>algorithm</code></em> must be one of SHA-1
-	    (SHA1), SHA-256 (SHA256), GOST, or SHA-384 (SHA384). These
+	    (SHA1), SHA-256 (SHA256), or SHA-384 (SHA384). These
 	    values are case insensitive. If no algorithm is specified,
 	    the default is SHA-256.
           </p>

bin/dnssec/dnssec-dsfromkey.8

@@ -64,7 +64,7 @@ Use SHA\-256 as the digest algorithm\&.
 .RS 4
 Select the digest algorithm\&. The value of
 \fBalgorithm\fR
-must be one of SHA\-1 (SHA1), SHA\-256 (SHA256), GOST or SHA\-384 (SHA384)\&. These values are case insensitive\&.
+must be one of SHA\-1 (SHA1), SHA\-256 (SHA256) or SHA\-384 (SHA384)\&. These values are case insensitive\&.
 .RE
 .PP
 \-C

bin/dnssec/dnssec-dsfromkey.docbook

@@ -117,7 +117,7 @@
 	  <para>
 	    Select the digest algorithm. The value of
 	    <option>algorithm</option> must be one of SHA-1 (SHA1),
-	    SHA-256 (SHA256), GOST or SHA-384 (SHA384).
+	    SHA-256 (SHA256) or SHA-384 (SHA384).
 	    These values are case insensitive.
 	  </para>
 	</listitem>

bin/dnssec/dnssec-dsfromkey.html

@@ -97,7 +97,7 @@
 	  <p>
 	    Select the digest algorithm. The value of
 	    <code class="option">algorithm</code> must be one of SHA-1 (SHA1),
-	    SHA-256 (SHA256), GOST or SHA-384 (SHA384).
+	    SHA-256 (SHA256) or SHA-384 (SHA384).
 	    These values are case insensitive.
 	  </p>
 	</dd>

bin/dnssec/dnssec-keyfromlabel.8

@@ -55,7 +55,7 @@ of the key is specified on the command line\&. This must match the name of the z
 .RS 4
 Selects the cryptographic algorithm\&. The value of
 \fBalgorithm\fR
-must be one of RSAMD5, RSASHA1, DSA, NSEC3RSASHA1, NSEC3DSA, RSASHA256, RSASHA512, ECCGOST, ECDSAP256SHA256, ECDSAP384SHA384, ED25519 or ED448\&.
+must be one of RSAMD5, RSASHA1, DSA, NSEC3RSASHA1, NSEC3DSA, RSASHA256, RSASHA512, ECDSAP256SHA256, ECDSAP384SHA384, ED25519 or ED448\&.
 .sp
 If no algorithm is specified, then RSASHA1 will be used by default, unless the
 \fB\-3\fR

bin/dnssec/dnssec-keyfromlabel.c

@@ -64,7 +64,7 @@ usage(void) {
 	fprintf(stderr, "    -a algorithm: \n"
 			"        RSA | RSAMD5 | DH | DSA | RSASHA1 |\n"
 			"        NSEC3DSA | NSEC3RSASHA1 |\n"
-			"        RSASHA256 | RSASHA512 | ECCGOST |\n"
+			"        RSASHA256 | RSASHA512 |\n"
 			"        ECDSAP256SHA256 | ECDSAP384SHA384\n");
 	fprintf(stderr, "    -3: use NSEC3-capable algorithm\n");
 	fprintf(stderr, "    -c class (default: IN)\n");
@@ -427,7 +427,6 @@ main(int argc, char **argv) {
 			case DST_ALG_NSEC3RSASHA1:
 			case DST_ALG_RSASHA256:
 			case DST_ALG_RSASHA512:
-			case DST_ALG_ECCGOST:
 			case DST_ALG_ECDSA256:
 			case DST_ALG_ECDSA384:
 			case DST_ALG_ED25519:

bin/dnssec/dnssec-keyfromlabel.docbook

@@ -106,7 +106,7 @@
 	  <para>
 	    Selects the cryptographic algorithm.  The value of
 	    <option>algorithm</option> must be one of RSAMD5, RSASHA1,
-	    DSA, NSEC3RSASHA1, NSEC3DSA, RSASHA256, RSASHA512, ECCGOST,
+	    DSA, NSEC3RSASHA1, NSEC3DSA, RSASHA256, RSASHA512,
 	    ECDSAP256SHA256, ECDSAP384SHA384, ED25519 or ED448.
 	  </para>
 	  <para>

bin/dnssec/dnssec-keyfromlabel.html

@@ -90,7 +90,7 @@
 	  <p>
 	    Selects the cryptographic algorithm.  The value of
 	    <code class="option">algorithm</code> must be one of RSAMD5, RSASHA1,
-	    DSA, NSEC3RSASHA1, NSEC3DSA, RSASHA256, RSASHA512, ECCGOST,
+	    DSA, NSEC3RSASHA1, NSEC3DSA, RSASHA256, RSASHA512,
 	    ECDSAP256SHA256, ECDSAP384SHA384, ED25519 or ED448.
 	  </p>
 	  <p>

bin/dnssec/dnssec-keygen.8

@@ -62,7 +62,7 @@ may be preferable to direct use of
 .RS 4
 Selects the cryptographic algorithm\&. For DNSSEC keys, the value of
 \fBalgorithm\fR
-must be one of RSAMD5, RSASHA1, DSA, NSEC3RSASHA1, NSEC3DSA, RSASHA256, RSASHA512, ECCGOST, ECDSAP256SHA256, ECDSAP384SHA384, ED25519 or ED448\&. For TKEY, the value must be DH (Diffie Hellman); specifying his value will automatically set the
+must be one of RSAMD5, RSASHA1, DSA, NSEC3RSASHA1, NSEC3DSA, RSASHA256, RSASHA512, ECDSAP256SHA256, ECDSAP384SHA384, ED25519 or ED448\&. For TKEY, the value must be DH (Diffie Hellman); specifying his value will automatically set the
 \fB\-T KEY\fR
 option as well\&.
 .sp

bin/dnssec/dnssec-keygen.c

@@ -79,7 +79,7 @@ usage(void) {
 	fprintf(stderr, "    -a <algorithm>:\n");
 	fprintf(stderr, "        RSA | RSAMD5 | DSA | RSASHA1 | NSEC3RSASHA1"
 				" | NSEC3DSA |\n");
-	fprintf(stderr, "        RSASHA256 | RSASHA512 | ECCGOST |\n");
+	fprintf(stderr, "        RSASHA256 | RSASHA512 |\n");
 	fprintf(stderr, "        ECDSAP256SHA256 | ECDSAP384SHA384 |\n");
 	fprintf(stderr, "        ED25519 | ED448 | DH\n");
 	fprintf(stderr, "    -3: use NSEC3-capable algorithm\n");

bin/dnssec/dnssec-keygen.docbook

@@ -123,7 +123,7 @@
 	  <para>
 	    Selects the cryptographic algorithm.  For DNSSEC keys, the value
 	    of <option>algorithm</option> must be one of RSAMD5, RSASHA1,
-	    DSA, NSEC3RSASHA1, NSEC3DSA, RSASHA256, RSASHA512, ECCGOST,
+	    DSA, NSEC3RSASHA1, NSEC3DSA, RSASHA256, RSASHA512,
 	    ECDSAP256SHA256, ECDSAP384SHA384, ED25519 or ED448.  For
 	    TKEY, the value must be DH (Diffie Hellman); specifying
 	    his value will automatically set the <option>-T KEY</option>

bin/dnssec/dnssec-keygen.html

@@ -100,7 +100,7 @@
 	  <p>
 	    Selects the cryptographic algorithm.  For DNSSEC keys, the value
 	    of <code class="option">algorithm</code> must be one of RSAMD5, RSASHA1,
-	    DSA, NSEC3RSASHA1, NSEC3DSA, RSASHA256, RSASHA512, ECCGOST,
+	    DSA, NSEC3RSASHA1, NSEC3DSA, RSASHA256, RSASHA512,
 	    ECDSAP256SHA256, ECDSAP384SHA384, ED25519 or ED448.  For
 	    TKEY, the value must be DH (Diffie Hellman); specifying
 	    his value will automatically set the <code class="option">-T KEY</code>

bin/dnssec/dnssec-signzone.c

@@ -76,6 +76,7 @@
 #include <dns/soa.h>
 #include <dns/time.h>
 #include <dns/update.h>
+#include <dns/zoneverify.h>
 
 #include <dst/dst.h>
 
@@ -96,6 +97,10 @@ typedef struct hashlist hashlist_t;
 
 static int nsec_datatype = dns_rdatatype_nsec;
 
+#define check_dns_dbiterator_current(result) \
+	check_result((result == DNS_R_NEWORIGIN) ? ISC_R_SUCCESS : result, \
+		     "dns_dbiterator_current()")
+
 #define IS_NSEC3	(nsec_datatype == dns_rdatatype_nsec3)
 #define OPTOUT(x)	(((x) & DNS_NSEC3FLAG_OPTOUT) != 0)
 
@@ -189,6 +194,19 @@ static dns_ttl_t maxttl = 0;
 static void
 sign(isc_task_t *task, isc_event_t *event);
 
+/*%
+ * Store a copy of 'name' in 'fzonecut' and return a pointer to that copy.
+ */
+static dns_name_t *
+savezonecut(dns_fixedname_t *fzonecut, dns_name_t *name) {
+	dns_name_t *result;
+
+	result = dns_fixedname_initname(fzonecut);
+	dns_name_copy(name, result, NULL);
+
+	return (result);
+}
+
 static void
 dumpnode(dns_name_t *name, dns_dbnode_t *node) {
 	dns_rdataset_t rds;
@@ -485,11 +503,11 @@ signset(dns_diff_t *del, dns_diff_t *add, dns_dbnode_t *node, dns_name_t *name,
 	dns_ttl_t ttl;
 	int i;
 	char namestr[DNS_NAME_FORMATSIZE];
-	char typestr[TYPE_FORMATSIZE];
+	char typestr[DNS_RDATATYPE_FORMATSIZE];
 	char sigstr[SIG_FORMATSIZE];
 
 	dns_name_format(name, namestr, sizeof(namestr));
-	type_format(set->type, typestr, sizeof(typestr));
+	dns_rdatatype_format(set->type, typestr, sizeof(typestr));
 
 	ttl = ISC_MIN(set->ttl, endtime - starttime);
 
@@ -1029,6 +1047,47 @@ secure(dns_name_t *name, dns_dbnode_t *node) {
 	return (ISC_TF(result == ISC_R_SUCCESS));
 }
 
+static isc_boolean_t
+is_delegation(dns_db_t *db, dns_dbversion_t *ver, dns_name_t *origin,
+	      dns_name_t *name, dns_dbnode_t *node, isc_uint32_t *ttlp)
+{
+	dns_rdataset_t nsset;
+	isc_result_t result;
+
+	if (dns_name_equal(name, origin))
+		return (ISC_FALSE);
+
+	dns_rdataset_init(&nsset);
+	result = dns_db_findrdataset(db, node, ver, dns_rdatatype_ns,
+				     0, 0, &nsset, NULL);
+	if (dns_rdataset_isassociated(&nsset)) {
+		if (ttlp != NULL)
+			*ttlp = nsset.ttl;
+		dns_rdataset_disassociate(&nsset);
+	}
+
+	return (ISC_TF(result == ISC_R_SUCCESS));
+}
+
+/*%
+ * Return ISC_TRUE if version 'ver' of database 'db' contains a DNAME RRset at
+ * 'node'; return ISC_FALSE otherwise.
+ */
+static isc_boolean_t
+has_dname(dns_db_t *db, dns_dbversion_t *ver, dns_dbnode_t *node) {
+	dns_rdataset_t dnameset;
+	isc_result_t result;
+
+	dns_rdataset_init(&dnameset);
+	result = dns_db_findrdataset(db, node, ver, dns_rdatatype_dname, 0, 0,
+				     &dnameset, NULL);
+	if (dns_rdataset_isassociated(&dnameset)) {
+		dns_rdataset_disassociate(&dnameset);
+	}
+
+	return (ISC_TF(result == ISC_R_SUCCESS));
+}
+
 /*%
  * Signs all records at a name.
  */
@@ -1485,14 +1544,19 @@ assignwork(isc_task_t *task, isc_task_t *worker) {
 			if (dns_name_issubdomain(name, gorigin) &&
 			    (zonecut == NULL ||
 			     !dns_name_issubdomain(name, zonecut))) {
-				if (is_delegation(gdb, gversion, gorigin, name, node, NULL)) {
-					zonecut = dns_fixedname_initname(&fzonecut);
-					dns_name_copy(name, zonecut, NULL);
+				if (is_delegation(gdb, gversion, gorigin,
+						  name, node, NULL))
+				{
+					zonecut = savezonecut(&fzonecut, name);
 					if (!OPTOUT(nsec3flags) ||
 					    secure(name, node))
 						found = ISC_TRUE;
-				} else
+				} else if (has_dname(gdb, gversion, node)) {
+					zonecut = savezonecut(&fzonecut, name);
 					found = ISC_TRUE;
+				} else {
+					found = ISC_TRUE;
+				}
 			}
 		}
 
@@ -1731,7 +1795,6 @@ nsecify(void) {
 	dns_rdataset_init(&rdataset);
 	name = dns_fixedname_initname(&fname);
 	nextname = dns_fixedname_initname(&fnextname);
-	dns_fixedname_init(&fzonecut);
 	zonecut = NULL;
 
 	/*
@@ -1793,11 +1856,12 @@ nsecify(void) {
 		}
 
 		if (is_delegation(gdb, gversion, gorigin, name, node, &nsttl)) {
-			zonecut = dns_fixedname_name(&fzonecut);
-			dns_name_copy(name, zonecut, NULL);
+			zonecut = savezonecut(&fzonecut, name);
 			remove_sigs(node, ISC_TRUE, 0);
 			if (generateds)
 				add_ds(name, node, nsttl);
+		} else if (has_dname(gdb, gversion, node)) {
+			zonecut = savezonecut(&fzonecut, name);
 		}
 
 		result = dns_dbiterator_next(dbiter);
@@ -2072,10 +2136,10 @@ rrset_cleanup(dns_name_t *name, dns_rdataset_t *rdataset,
 	unsigned int count1 = 0;
 	dns_rdataset_t tmprdataset;
 	char namestr[DNS_NAME_FORMATSIZE];
-	char typestr[TYPE_FORMATSIZE];
+	char typestr[DNS_RDATATYPE_FORMATSIZE];
 
 	dns_name_format(name, namestr, sizeof(namestr));
-	type_format(rdataset->type, typestr, sizeof(typestr));
+	dns_rdatatype_format(rdataset->type, typestr, sizeof(typestr));
 
 	dns_rdataset_init(&tmprdataset);
 	for (result = dns_rdataset_first(rdataset);
@@ -2204,7 +2268,6 @@ nsec3ify(unsigned int hashalg, dns_iterations_t iterations,
 	dns_rdataset_init(&rdataset);
 	name = dns_fixedname_initname(&fname);
 	nextname = dns_fixedname_initname(&fnextname);
-	dns_fixedname_init(&fzonecut);
 	zonecut = NULL;
 
 	/*
@@ -2238,6 +2301,10 @@ nsec3ify(unsigned int hashalg, dns_iterations_t iterations,
 			(void)active_node(node);
 		}
 
+		if (has_dname(gdb, gversion, node)) {
+			zonecut = savezonecut(&fzonecut, name);
+		}
+
 		result = dns_dbiterator_next(dbiter);
 		nextnode = NULL;
 		while (result == ISC_R_SUCCESS) {
@@ -2261,8 +2328,7 @@ nsec3ify(unsigned int hashalg, dns_iterations_t iterations,
 			if (is_delegation(gdb, gversion, gorigin,
 					  nextname, nextnode, &nsttl))
 			{
-				zonecut = dns_fixedname_name(&fzonecut);
-				dns_name_copy(nextname, zonecut, NULL);
+				zonecut = savezonecut(&fzonecut, nextname);
 				remove_sigs(nextnode, ISC_TRUE, 0);
 				if (generateds)
 					add_ds(nextname, nextnode, nsttl);
@@ -2272,6 +2338,8 @@ nsec3ify(unsigned int hashalg, dns_iterations_t iterations,
 					result = dns_dbiterator_next(dbiter);
 					continue;
 				}
+			} else if (has_dname(gdb, gversion, nextnode)) {
+				zonecut = savezonecut(&fzonecut, nextname);
 			}
 			dns_db_detachnode(gdb, &nextnode);
 			break;
@@ -2370,6 +2438,11 @@ nsec3ify(unsigned int hashalg, dns_iterations_t iterations,
 			dns_db_detachnode(gdb, &node);
 			continue;
 		}
+
+		if (has_dname(gdb, gversion, node)) {
+			zonecut = savezonecut(&fzonecut, name);
+		}
+
 		result = dns_dbiterator_next(dbiter);
 		nextnode = NULL;
 		while (result == ISC_R_SUCCESS) {
@@ -2392,14 +2465,15 @@ nsec3ify(unsigned int hashalg, dns_iterations_t iterations,
 			if (is_delegation(gdb, gversion, gorigin,
 					  nextname, nextnode, NULL))
 			{
-				zonecut = dns_fixedname_name(&fzonecut);
-				dns_name_copy(nextname, zonecut, NULL);
+				zonecut = savezonecut(&fzonecut, nextname);
 				if (OPTOUT(nsec3flags) &&
 				    !secure(nextname, nextnode)) {
 					dns_db_detachnode(gdb, &nextnode);
 					result = dns_dbiterator_next(dbiter);
 					continue;
 				}
+			} else if (has_dname(gdb, gversion, nextnode)) {
+				zonecut = savezonecut(&fzonecut, nextname);
 			}
 			dns_db_detachnode(gdb, &nextnode);
 			break;
@@ -3153,7 +3227,7 @@ main(int argc, char *argv[]) {
 	isc_time_t timer_start, timer_finish;
 	isc_time_t sign_start, sign_finish;
 	dns_dnsseckey_t *key;
-	isc_result_t result;
+	isc_result_t result, vresult;
 	isc_log_t *log = NULL;
 #ifdef USE_PKCS11
 	const char *engine = PKCS11_ENGINE;
@@ -3838,9 +3912,18 @@ main(int argc, char *argv[]) {
 	postsign();
 	TIME_NOW(&sign_finish);
 
-	if (!disable_zone_check)
-		verifyzone(gdb, gversion, gorigin, mctx,
-			   ignore_kskflag, keyset_kskonly);
+	if (disable_zone_check) {
+		vresult = ISC_R_SUCCESS;
+	} else {
+		vresult = dns_zoneverify_dnssec(NULL, gdb, gversion, gorigin,
+						mctx, ignore_kskflag,
+						keyset_kskonly);
+		if (vresult != ISC_R_SUCCESS) {
+			fprintf(output_stdout ? stderr : stdout,
+				"Zone verification failed (%s)\n",
+				isc_result_totext(vresult));
+		}
+	}
 
 	if (outputformat != dns_masterformat_text) {
 		dns_masterrawheader_t header;
@@ -3866,12 +3949,16 @@ main(int argc, char *argv[]) {
 		check_result(result, "isc_stdio_close");
 		removefile = ISC_FALSE;
 
-		result = isc_file_rename(tempfile, output);
-		if (result != ISC_R_SUCCESS)
-			fatal("failed to rename temp file to %s: %s",
-			      output, isc_result_totext(result));
-
-		printf("%s\n", output);
+		if (vresult == ISC_R_SUCCESS) {
+			result = isc_file_rename(tempfile, output);
+			if (result != ISC_R_SUCCESS) {
+				fatal("failed to rename temp file to %s: %s",
+				      output, isc_result_totext(result));
+			}
+			printf("%s\n", output);
+		} else {
+			isc_file_remove(tempfile);
+		}
 	}
 
 	dns_db_closeversion(gdb, &gversion, ISC_FALSE);
@@ -3911,5 +3998,5 @@ main(int argc, char *argv[]) {
 #ifdef _WIN32
 	DestroySockets();
 #endif
-	return (0);
+	return (vresult == ISC_R_SUCCESS ? 0 : 1);
 }

bin/dnssec/dnssec-verify.c

@@ -58,6 +58,7 @@
 #include <dns/result.h>
 #include <dns/soa.h>
 #include <dns/time.h>
+#include <dns/zoneverify.h>
 
 #include <dst/dst.h>
 
@@ -322,8 +323,8 @@ main(int argc, char *argv[]) {
 	result = dns_db_newversion(gdb, &gversion);
 	check_result(result, "dns_db_newversion()");
 
-	verifyzone(gdb, gversion, gorigin, mctx,
-		   ignore_kskflag, keyset_kskonly);
+	result = dns_zoneverify_dnssec(NULL, gdb, gversion, gorigin, mctx,
+				       ignore_kskflag, keyset_kskonly);
 
 	dns_db_closeversion(gdb, &gversion, ISC_FALSE);
 	dns_db_detach(&gdb);
@@ -337,5 +338,5 @@ main(int argc, char *argv[]) {
 
 	(void) isc_app_finish();
 
-	return (0);
+	return (result == ISC_R_SUCCESS ? 0 : 1);
 }

bin/dnssec/dnssectool.h

@@ -18,11 +18,6 @@
 #include <dns/rdatastruct.h>
 #include <dst/dst.h>
 
-#define check_dns_dbiterator_current(result) \
-	check_result((result == DNS_R_NEWORIGIN) ? ISC_R_SUCCESS : result, \
-		     "dns_dbiterator_current()")
-
-
 typedef void (fatalcallback_t)(void);
 
 ISC_PLATFORM_NORETURN_PRE void
@@ -41,10 +36,6 @@ vbprintf(int level, const char *fmt, ...) ISC_FORMAT_PRINTF(2, 3);
 ISC_PLATFORM_NORETURN_PRE void
 version(const char *program) ISC_PLATFORM_NORETURN_POST;
 
-void
-type_format(const dns_rdatatype_t type, char *cp, unsigned int size);
-#define TYPE_FORMATSIZE 20
-
 void
 sig_format(dns_rdata_rrsig_t *sig, char *cp, unsigned int size);
 #define SIG_FORMATSIZE (DNS_NAME_FORMATSIZE + DNS_SECALG_FORMATSIZE + sizeof("65535"))
@@ -80,15 +71,6 @@ isc_boolean_t
 key_collision(dst_key_t *key, dns_name_t *name, const char *dir,
 	      isc_mem_t *mctx, isc_boolean_t *exact);
 
-isc_boolean_t
-is_delegation(dns_db_t *db, dns_dbversion_t *ver, dns_name_t *origin,
-		      dns_name_t *name, dns_dbnode_t *node, isc_uint32_t *ttlp);
-
-void
-verifyzone(dns_db_t *db, dns_dbversion_t *ver,
-		   dns_name_t *origin, isc_mem_t *mctx,
-		   isc_boolean_t ignore_kskflag, isc_boolean_t keyset_kskonly);
-
 isc_boolean_t
 isoptarg(const char *arg, char **argv, void (*usage)(void));
 

bin/named/config.c

@@ -27,6 +27,7 @@
 
 #include <pk11/site.h>
 
+#include <isccfg/grammar.h>
 #include <isccfg/namedconf.h>
 
 #include <dns/fixedname.h>
@@ -46,6 +47,7 @@
 /*% default configuration */
 static char defaultconf[] = "\
 options {\n\
+#	answer-cookie <obsolete>;\n\
 	automatic-interface-scan yes;\n\
 	bindkeys-file \"" NAMED_SYSCONFDIR "/bind.keys\";\n\
 #	blackhole {none;};\n"
@@ -94,6 +96,7 @@ options {\n\
 	request-nsid false;\n\
 	reserved-sockets 512;\n\
 	resolver-query-timeout 10;\n\
+	rrset-order { order random; };\n\
 	secroots-file \"named.secroots\";\n\
 	send-cookie true;\n\
 #	serial-queries <obsolete>;\n\
@@ -146,7 +149,7 @@ options {\n\
 	clients-per-query 10;\n\
 	dnssec-accept-expired no;\n\
 	dnssec-enable yes;\n\
-	dnssec-validation yes; \n"
+	dnssec-validation " VALIDATION_DEFAULT "; \n"
 #ifdef HAVE_DNSTAP
 "	dnstap-identity hostname;\n"
 #endif
@@ -181,6 +184,7 @@ options {\n\
 	notify-source-v6 *;\n\
 	nsec3-test-zone no;\n\
 	provide-ixfr true;\n\
+	qname-minimization relaxed;\n\
 	query-source address *;\n\
 	query-source-v6 address *;\n\
 	recursion true;\n\
@@ -308,8 +312,9 @@ named_config_parsedefaults(cfg_parser_t *parser, cfg_obj_t **conf) {
 
 	isc_buffer_init(&b, defaultconf, sizeof(defaultconf) - 1);
 	isc_buffer_add(&b, sizeof(defaultconf) - 1);
-	return (cfg_parse_buffer3(parser, &b, __FILE__, 0,
-				  &cfg_type_namedconf, conf));
+	return (cfg_parse_buffer4(parser, &b, __FILE__, 0,
+				  &cfg_type_namedconf,
+				  CFG_PCTX_NODEPRECATED, conf));
 }
 
 isc_result_t

bin/named/controlconf.c

@@ -20,6 +20,7 @@
 #include <isc/mem.h>
 #include <isc/net.h>
 #include <isc/netaddr.h>
+#include <isc/nonce.h>
 #include <isc/random.h>
 #include <isc/result.h>
 #include <isc/stdtime.h>
@@ -230,13 +231,12 @@ address_ok(isc_sockaddr_t *sockaddr, dns_acl_t *acl) {
 
 	isc_netaddr_fromsockaddr(&netaddr, sockaddr);
 
-	result = dns_acl_match(&netaddr, NULL, NULL, 0, NULL, acl, env, &match,
-			       NULL);
-
-	if (result != ISC_R_SUCCESS || match <= 0)
+	result = dns_acl_match(&netaddr, NULL, acl, env, &match, NULL);
+	if (result != ISC_R_SUCCESS || match <= 0) {
 		return (ISC_FALSE);
-	else
+	} else {
 		return (ISC_TRUE);
+	}
 }
 
 static isc_result_t
@@ -458,7 +458,7 @@ control_recvmessage(isc_task_t *task, isc_event_t *event) {
 	 */
 	if (conn->nonce == 0) {
 		while (conn->nonce == 0) {
-			isc_random_buf(&conn->nonce, sizeof(conn->nonce));
+			isc_nonce_buf(&conn->nonce, sizeof(conn->nonce));
 		}
 		eresult = ISC_R_SUCCESS;
 	} else

bin/named/main.c

@@ -129,6 +129,7 @@ static unsigned int delay = 0;
 static isc_boolean_t nonearest = ISC_FALSE;
 static isc_boolean_t notcp = ISC_FALSE;
 static isc_boolean_t fixedlocal = ISC_FALSE;
+static isc_boolean_t sigvalinsecs = ISC_FALSE;
 
 /*
  * -4 and -6
@@ -464,12 +465,97 @@ parse_fuzz_arg(void) {
 	}
 }
 
+static void
+parse_T_opt(char *option) {
+	const char *p;
+	char *last = NULL;
+	/*
+	 * force the server to behave (or misbehave) in
+	 * specified ways for testing purposes.
+	 *
+	 * clienttest: make clients single shot with their
+	 * 	       own memory context.
+	 * delay=xxxx: delay client responses by xxxx ms to
+	 *	       simulate remote servers.
+	 * dscp=x:     check that dscp values are as
+	 * 	       expected and assert otherwise.
+	 */
+	if (!strcmp(option, "clienttest")) {
+		clienttest = ISC_TRUE;
+	} else if (!strncmp(option, "delay=", 6)) {
+		delay = atoi(option + 6);
+	} else if (!strcmp(option, "dropedns")) {
+		dropedns = ISC_TRUE;
+	} else if (!strncmp(option, "dscp=", 5)) {
+		isc_dscp_check_value = atoi(option + 5);
+	} else if (!strcmp(option, "fixedlocal")) {
+		fixedlocal = ISC_TRUE;
+	} else if (!strcmp(option, "keepstderr")) {
+		named_g_keepstderr = ISC_TRUE;
+	} else if (!strcmp(option, "noaa")) {
+		noaa = ISC_TRUE;
+	} else if (!strcmp(option, "noedns")) {
+		noedns = ISC_TRUE;
+	} else if (!strcmp(option, "nonearest")) {
+		nonearest = ISC_TRUE;
+	} else if (!strcmp(option, "nosoa")) {
+		nosoa = ISC_TRUE;
+	} else if (!strcmp(option, "nosyslog")) {
+		named_g_nosyslog = ISC_TRUE;
+	} else if (!strcmp(option, "notcp")) {
+		notcp = ISC_TRUE;
+	} else if (!strcmp(option, "maxudp512")) {
+		maxudp = 512;
+	} else if (!strcmp(option, "maxudp1460")) {
+		maxudp = 1460;
+	} else if (!strncmp(option, "maxudp=", 7)) {
+		maxudp = atoi(option + 7);
+	} else if (!strncmp(option, "mkeytimers=", 11)) {
+		p = strtok_r(option + 11, "/", &last);
+		if (p == NULL) {
+			named_main_earlyfatal("bad mkeytimer");
+		}
+
+		dns_zone_mkey_hour = atoi(p);
+		if (dns_zone_mkey_hour == 0) {
+			named_main_earlyfatal("bad mkeytimer");
+		}
+
+		p = strtok_r(NULL, "/", &last);
+		if (p == NULL) {
+			dns_zone_mkey_day = (24 * dns_zone_mkey_hour);
+			dns_zone_mkey_month = (30 * dns_zone_mkey_day);
+			return;
+		}
+
+		dns_zone_mkey_day = atoi(p);
+		if (dns_zone_mkey_day < dns_zone_mkey_hour)
+			named_main_earlyfatal("bad mkeytimer");
+
+		p = strtok_r(NULL, "/", &last);
+		if (p == NULL) {
+			dns_zone_mkey_month = (30 * dns_zone_mkey_day);
+			return;
+		}
+
+		dns_zone_mkey_month = atoi(p);
+		if (dns_zone_mkey_month < dns_zone_mkey_day) {
+			named_main_earlyfatal("bad mkeytimer");
+		}
+	} else if (!strcmp(option, "sigvalinsecs")) {
+		sigvalinsecs = ISC_TRUE;
+	} else if (!strncmp(option, "tat=", 4)) {
+		named_g_tat_interval = atoi(option + 4);
+	} else {
+		fprintf(stderr, "unknown -T flag '%s\n", option);
+	}
+}
+
 static void
 parse_command_line(int argc, char *argv[]) {
 	int ch;
 	int port;
 	const char *p;
-	char *last;
 
 	save_command_line(argc, argv);
 
@@ -564,95 +650,7 @@ parse_command_line(int argc, char *argv[]) {
 			named_g_chrootdir = isc_commandline_argument;
 			break;
 		case 'T':	/* NOT DOCUMENTED */
-			/*
-			 * force the server to behave (or misbehave) in
-			 * specified ways for testing purposes.
-			 *
-			 * clienttest: make clients single shot with their
-			 * 	       own memory context.
-			 * delay=xxxx: delay client responses by xxxx ms to
-			 *	       simulate remote servers.
-			 * dscp=x:     check that dscp values are as
-			 * 	       expected and assert otherwise.
-			 */
-			if (!strcmp(isc_commandline_argument, "clienttest"))
-				clienttest = ISC_TRUE;
-			else if (!strcmp(isc_commandline_argument, "nosoa"))
-				nosoa = ISC_TRUE;
-			else if (!strcmp(isc_commandline_argument, "noaa"))
-				noaa = ISC_TRUE;
-			else if (!strcmp(isc_commandline_argument,
-					 "maxudp512"))
-				maxudp = 512;
-			else if (!strcmp(isc_commandline_argument,
-					 "maxudp1460"))
-				maxudp = 1460;
-			else if (!strcmp(isc_commandline_argument, "dropedns"))
-				dropedns = ISC_TRUE;
-			else if (!strcmp(isc_commandline_argument, "noedns"))
-				noedns = ISC_TRUE;
-			else if (!strncmp(isc_commandline_argument,
-					  "maxudp=", 7))
-				maxudp = atoi(isc_commandline_argument + 7);
-			else if (!strncmp(isc_commandline_argument,
-					  "delay=", 6))
-				delay = atoi(isc_commandline_argument + 6);
-			else if (!strcmp(isc_commandline_argument, "nosyslog"))
-				named_g_nosyslog = ISC_TRUE;
-			else if (!strcmp(isc_commandline_argument, "nonearest"))
-				nonearest = ISC_TRUE;
-			else if (!strncmp(isc_commandline_argument, "dscp=", 5))
-				isc_dscp_check_value =
-					   atoi(isc_commandline_argument + 5);
-			else if (!strncmp(isc_commandline_argument,
-					  "mkeytimers=", 11))
-			{
-				p = strtok_r(isc_commandline_argument + 11, "/", &last);
-				if (p == NULL)
-					named_main_earlyfatal("bad mkeytimer");
-				dns_zone_mkey_hour = atoi(p);
-				if (dns_zone_mkey_hour == 0)
-					named_main_earlyfatal("bad mkeytimer");
-
-				p = strtok_r(NULL, "/", &last);
-				if (p == NULL) {
-					dns_zone_mkey_day =
-						(24 * dns_zone_mkey_hour);
-					dns_zone_mkey_month =
-						(30 * dns_zone_mkey_day);
-					break;
-				}
-				dns_zone_mkey_day = atoi(p);
-				if (dns_zone_mkey_day < dns_zone_mkey_hour)
-					named_main_earlyfatal("bad mkeytimer");
-
-				p = strtok_r(NULL, "/", &last);
-				if (p == NULL) {
-					dns_zone_mkey_month =
-						(30 * dns_zone_mkey_day);
-					break;
-				}
-				dns_zone_mkey_month = atoi(p);
-				if (dns_zone_mkey_month < dns_zone_mkey_day)
-					named_main_earlyfatal("bad mkeytimer");
-			} else if (!strcmp(isc_commandline_argument, "notcp"))
-				notcp = ISC_TRUE;
-			else if (!strncmp(isc_commandline_argument, "tat=", 4))
-			{
-				named_g_tat_interval =
-					   atoi(isc_commandline_argument + 4);
-			} else if (!strcmp(isc_commandline_argument,
-					 "keepstderr"))
-			{
-				named_g_keepstderr = ISC_TRUE;
-			} else if (!strcmp(isc_commandline_argument,
-					   "fixedlocal"))
-			{
-				fixedlocal = ISC_TRUE;
-			} else {
-				fprintf(stderr, "unknown -T flag '%s\n",
-					isc_commandline_argument);
-			}
+			parse_T_opt(isc_commandline_argument);
 			break;
 		case 'U':
 			named_g_udpdisp = parse_int(isc_commandline_argument,
@@ -1116,6 +1114,8 @@ setup(void) {
 		ns_server_setoption(sctx, NS_SERVER_DISABLE4, ISC_TRUE);
 	if (disable6)
 		ns_server_setoption(sctx, NS_SERVER_DISABLE6, ISC_TRUE);
+	if (sigvalinsecs)
+		ns_server_setoption(sctx, NS_SERVER_SIGVALINSECS, ISC_TRUE);
 
 	named_g_server->sctx->delay = delay;
 }

bin/named/named.conf.docbook

@@ -13,7 +13,7 @@
 
 <refentry xmlns:db="http://docbook.org/ns/docbook" version="5.0" xml:id="man.named.conf">
   <info>
-    <date>2018-01-22</date>
+    <date>2018-05-29</date>
   </info>
   <refentryinfo>
     <corpname>ISC</corpname>
@@ -205,7 +205,7 @@ options {
 	    <replaceable>integer</replaceable> ] [ dscp <replaceable>integer</replaceable> ] { ( <replaceable>masters</replaceable> | <replaceable>ipv4_address</replaceable> [
 	    port <replaceable>integer</replaceable> ] | <replaceable>ipv6_address</replaceable> [ port <replaceable>integer</replaceable> ] ) [ key
 	    <replaceable>string</replaceable> ]; ... } ] [ zone-directory <replaceable>quoted_string</replaceable> ] [
-	    in-memory <replaceable>boolean</replaceable> ] [ min-update-interval <replaceable>integer</replaceable> ]; ... };
+	    in-memory <replaceable>boolean</replaceable> ] [ min-update-interval <replaceable>ttlval</replaceable> ]; ... };
 	check-dup-records ( fail | warn | ignore );
 	check-integrity <replaceable>boolean</replaceable>;
 	check-mx ( fail | warn | ignore );
@@ -244,6 +244,7 @@ options {
 	};
 	dns64-contact <replaceable>string</replaceable>;
 	dns64-server <replaceable>string</replaceable>;
+	dnskey-sig-validity <replaceable>integer</replaceable>;
 	dnsrps-enable <replaceable>boolean</replaceable>;
 	dnsrps-options { <replaceable>unspecified-text</replaceable> };
 	dnssec-accept-expired <replaceable>boolean</replaceable>;
@@ -292,14 +293,13 @@ options {
 	fstrm-set-output-notify-threshold <replaceable>integer</replaceable>;
 	fstrm-set-output-queue-model ( mpsc | spsc );
 	fstrm-set-output-queue-size <replaceable>integer</replaceable>;
-	fstrm-set-reopen-interval <replaceable>integer</replaceable>;
+	fstrm-set-reopen-interval <replaceable>ttlval</replaceable>;
 	geoip-directory ( <replaceable>quoted_string</replaceable> | none );
-	geoip-use-ecs <replaceable>boolean</replaceable>;
 	glue-cache <replaceable>boolean</replaceable>;
 	heartbeat-interval <replaceable>integer</replaceable>;
 	hostname ( <replaceable>quoted_string</replaceable> | none );
 	inline-signing <replaceable>boolean</replaceable>;
-	interface-interval <replaceable>integer</replaceable>;
+	interface-interval <replaceable>ttlval</replaceable>;
 	ixfr-from-differences ( primary | master | secondary | slave |
 	    <replaceable>boolean</replaceable> );
 	keep-response-order { <replaceable>address_match_element</replaceable>; ... };
@@ -318,10 +318,10 @@ options {
 	masterfile-style ( full | relative );
 	match-mapped-addresses <replaceable>boolean</replaceable>;
 	max-cache-size ( default | unlimited | <replaceable>sizeval</replaceable> | <replaceable>percentage</replaceable> );
-	max-cache-ttl <replaceable>integer</replaceable>;
+	max-cache-ttl <replaceable>ttlval</replaceable>;
 	max-clients-per-query <replaceable>integer</replaceable>;
 	max-journal-size ( default | unlimited | <replaceable>sizeval</replaceable> );
-	max-ncache-ttl <replaceable>integer</replaceable>;
+	max-ncache-ttl <replaceable>ttlval</replaceable>;
 	max-records <replaceable>integer</replaceable>;
 	max-recursion-depth <replaceable>integer</replaceable>;
 	max-recursion-queries <replaceable>integer</replaceable>;
@@ -362,6 +362,7 @@ options {
 	preferred-glue <replaceable>string</replaceable>;
 	prefetch <replaceable>integer</replaceable> [ <replaceable>integer</replaceable> ];
 	provide-ixfr <replaceable>boolean</replaceable>;
+	qname-minimization ( strict | relaxed | disabled );
 	query-source ( ( [ address ] ( <replaceable>ipv4_address</replaceable> | * ) [ port (
 	    <replaceable>integer</replaceable> | * ) ] ) | ( [ [ address ] ( <replaceable>ipv4_address</replaceable> | * ) ]
 	    port ( <replaceable>integer</replaceable> | * ) ) ) [ dscp <replaceable>integer</replaceable> ];
@@ -401,18 +402,19 @@ options {
 	response-padding { <replaceable>address_match_element</replaceable>; ... } block-size
 	    <replaceable>integer</replaceable>;
 	response-policy { zone <replaceable>quoted_string</replaceable> [ log <replaceable>boolean</replaceable> ] [
-	    max-policy-ttl <replaceable>integer</replaceable> ] [ min-update-interval <replaceable>integer</replaceable> ] [
+	    max-policy-ttl <replaceable>ttlval</replaceable> ] [ min-update-interval <replaceable>ttlval</replaceable> ] [
 	    policy ( cname | disabled | drop | given | no-op | nodata |
 	    nxdomain | passthru | tcp-only <replaceable>quoted_string</replaceable> ) ] [
 	    recursive-only <replaceable>boolean</replaceable> ] [ nsip-enable <replaceable>boolean</replaceable> ] [
 	    nsdname-enable <replaceable>boolean</replaceable> ]; ... } [ break-dnssec <replaceable>boolean</replaceable> ] [
-	    max-policy-ttl <replaceable>integer</replaceable> ] [ min-update-interval <replaceable>integer</replaceable> ] [
+	    max-policy-ttl <replaceable>ttlval</replaceable> ] [ min-update-interval <replaceable>ttlval</replaceable> ] [
 	    min-ns-dots <replaceable>integer</replaceable> ] [ nsip-wait-recurse <replaceable>boolean</replaceable> ] [
 	    qname-wait-recurse <replaceable>boolean</replaceable> ] [ recursive-only <replaceable>boolean</replaceable> ] [
 	    nsip-enable <replaceable>boolean</replaceable> ] [ nsdname-enable <replaceable>boolean</replaceable> ] [
 	    dnsrps-enable <replaceable>boolean</replaceable> ] [ dnsrps-options { <replaceable>unspecified-text</replaceable>
 	    } ];
 	root-delegation-only [ exclude { <replaceable>quoted_string</replaceable>; ... } ];
+	root-key-sentinel <replaceable>boolean</replaceable>;
 	rrset-order { [ class <replaceable>string</replaceable> ] [ type <replaceable>string</replaceable> ] [ name
 	    <replaceable>quoted_string</replaceable> ] <replaceable>string</replaceable> <replaceable>string</replaceable>; ... };
 	secroots-file <replaceable>quoted_string</replaceable>;
@@ -557,7 +559,7 @@ view <replaceable>string</replaceable> [ <replaceable>class</replaceable> ] {
 	    <replaceable>integer</replaceable> ] [ dscp <replaceable>integer</replaceable> ] { ( <replaceable>masters</replaceable> | <replaceable>ipv4_address</replaceable> [
 	    port <replaceable>integer</replaceable> ] | <replaceable>ipv6_address</replaceable> [ port <replaceable>integer</replaceable> ] ) [ key
 	    <replaceable>string</replaceable> ]; ... } ] [ zone-directory <replaceable>quoted_string</replaceable> ] [
-	    in-memory <replaceable>boolean</replaceable> ] [ min-update-interval <replaceable>integer</replaceable> ]; ... };
+	    in-memory <replaceable>boolean</replaceable> ] [ min-update-interval <replaceable>ttlval</replaceable> ]; ... };
 	check-dup-records ( fail | warn | ignore );
 	check-integrity <replaceable>boolean</replaceable>;
 	check-mx ( fail | warn | ignore );
@@ -595,6 +597,7 @@ view <replaceable>string</replaceable> [ <replaceable>class</replaceable> ] {
 	};
 	dns64-contact <replaceable>string</replaceable>;
 	dns64-server <replaceable>string</replaceable>;
+	dnskey-sig-validity <replaceable>integer</replaceable>;
 	dnsrps-enable <replaceable>boolean</replaceable>;
 	dnsrps-options { <replaceable>unspecified-text</replaceable> };
 	dnssec-accept-expired <replaceable>boolean</replaceable>;
@@ -648,10 +651,10 @@ view <replaceable>string</replaceable> [ <replaceable>class</replaceable> ] {
 	match-destinations { <replaceable>address_match_element</replaceable>; ... };
 	match-recursive-only <replaceable>boolean</replaceable>;
 	max-cache-size ( default | unlimited | <replaceable>sizeval</replaceable> | <replaceable>percentage</replaceable> );
-	max-cache-ttl <replaceable>integer</replaceable>;
+	max-cache-ttl <replaceable>ttlval</replaceable>;
 	max-clients-per-query <replaceable>integer</replaceable>;
 	max-journal-size ( default | unlimited | <replaceable>sizeval</replaceable> );
-	max-ncache-ttl <replaceable>integer</replaceable>;
+	max-ncache-ttl <replaceable>ttlval</replaceable>;
 	max-records <replaceable>integer</replaceable>;
 	max-recursion-depth <replaceable>integer</replaceable>;
 	max-recursion-queries <replaceable>integer</replaceable>;
@@ -686,6 +689,7 @@ view <replaceable>string</replaceable> [ <replaceable>class</replaceable> ] {
 	preferred-glue <replaceable>string</replaceable>;
 	prefetch <replaceable>integer</replaceable> [ <replaceable>integer</replaceable> ];
 	provide-ixfr <replaceable>boolean</replaceable>;
+	qname-minimization ( strict | relaxed | disabled );
 	query-source ( ( [ address ] ( <replaceable>ipv4_address</replaceable> | * ) [ port (
 	    <replaceable>integer</replaceable> | * ) ] ) | ( [ [ address ] ( <replaceable>ipv4_address</replaceable> | * ) ]
 	    port ( <replaceable>integer</replaceable> | * ) ) ) [ dscp <replaceable>integer</replaceable> ];
@@ -720,18 +724,19 @@ view <replaceable>string</replaceable> [ <replaceable>class</replaceable> ] {
 	response-padding { <replaceable>address_match_element</replaceable>; ... } block-size
 	    <replaceable>integer</replaceable>;
 	response-policy { zone <replaceable>quoted_string</replaceable> [ log <replaceable>boolean</replaceable> ] [
-	    max-policy-ttl <replaceable>integer</replaceable> ] [ min-update-interval <replaceable>integer</replaceable> ] [
+	    max-policy-ttl <replaceable>ttlval</replaceable> ] [ min-update-interval <replaceable>ttlval</replaceable> ] [
 	    policy ( cname | disabled | drop | given | no-op | nodata |
 	    nxdomain | passthru | tcp-only <replaceable>quoted_string</replaceable> ) ] [
 	    recursive-only <replaceable>boolean</replaceable> ] [ nsip-enable <replaceable>boolean</replaceable> ] [
 	    nsdname-enable <replaceable>boolean</replaceable> ]; ... } [ break-dnssec <replaceable>boolean</replaceable> ] [
-	    max-policy-ttl <replaceable>integer</replaceable> ] [ min-update-interval <replaceable>integer</replaceable> ] [
+	    max-policy-ttl <replaceable>ttlval</replaceable> ] [ min-update-interval <replaceable>ttlval</replaceable> ] [
 	    min-ns-dots <replaceable>integer</replaceable> ] [ nsip-wait-recurse <replaceable>boolean</replaceable> ] [
 	    qname-wait-recurse <replaceable>boolean</replaceable> ] [ recursive-only <replaceable>boolean</replaceable> ] [
 	    nsip-enable <replaceable>boolean</replaceable> ] [ nsdname-enable <replaceable>boolean</replaceable> ] [
 	    dnsrps-enable <replaceable>boolean</replaceable> ] [ dnsrps-options { <replaceable>unspecified-text</replaceable>
 	    } ];
 	root-delegation-only [ exclude { <replaceable>quoted_string</replaceable>; ... } ];
+	root-key-sentinel <replaceable>boolean</replaceable>;
 	rrset-order { [ class <replaceable>string</replaceable> ] [ type <replaceable>string</replaceable> ] [ name
 	    <replaceable>quoted_string</replaceable> ] <replaceable>string</replaceable> <replaceable>string</replaceable>; ... };
 	send-cookie <replaceable>boolean</replaceable>;
@@ -824,6 +829,7 @@ view <replaceable>string</replaceable> [ <replaceable>class</replaceable> ] {
 		dialup ( notify | notify-passive | passive | refresh |
 		    <replaceable>boolean</replaceable> );
 		dlz <replaceable>string</replaceable>;
+		dnskey-sig-validity <replaceable>integer</replaceable>;
 		dnssec-dnskey-kskonly <replaceable>boolean</replaceable>;
 		dnssec-loadkeys-interval <replaceable>integer</replaceable>;
 		dnssec-secure-to-insecure <replaceable>boolean</replaceable>;
@@ -930,6 +936,7 @@ zone <replaceable>string</replaceable> [ <replaceable>class</replaceable> ] {
 	delegation-only <replaceable>boolean</replaceable>;
 	dialup ( notify | notify-passive | passive | refresh | <replaceable>boolean</replaceable> );
 	dlz <replaceable>string</replaceable>;
+	dnskey-sig-validity <replaceable>integer</replaceable>;
 	dnssec-dnskey-kskonly <replaceable>boolean</replaceable>;
 	dnssec-loadkeys-interval <replaceable>integer</replaceable>;
 	dnssec-secure-to-insecure <replaceable>boolean</replaceable>;

bin/named/server.c

@@ -32,11 +32,11 @@
 #include <isc/httpd.h>
 #include <isc/lex.h>
 #include <isc/meminfo.h>
+#include <isc/nonce.h>
 #include <isc/parseint.h>
 #include <isc/platform.h>
 #include <isc/portset.h>
 #include <isc/print.h>
-#include <isc/random.h>
 #include <isc/refcount.h>
 #include <isc/resource.h>
 #include <isc/sha2.h>
@@ -3613,8 +3613,7 @@ create_mapped_acl(void) {
 	if (result != ISC_R_SUCCESS)
 		return (result);
 
-	result = dns_iptable_addprefix(acl->iptable, &addr, 96,
-				       ISC_TRUE, ISC_FALSE);
+	result = dns_iptable_addprefix(acl->iptable, &addr, 96, ISC_TRUE);
 	if (result == ISC_R_SUCCESS)
 		dns_acl_attach(acl, &named_g_mapped);
 	dns_acl_detach(&acl);
@@ -3691,6 +3690,7 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
 	isc_dscp_t dscp4 = -1, dscp6 = -1;
 	dns_dyndbctx_t *dctx = NULL;
 	unsigned int resolver_param;
+	const char *qminmode = NULL;
 
 	REQUIRE(DNS_VIEW_VALID(view));
 
@@ -3726,10 +3726,6 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
 	CHECKM(named_config_getport(config, &port), "port");
 	dns_view_setdstport(view, port);
 
-	CHECK(configure_view_acl(vconfig, config, named_g_config,
-				 "allow-query", NULL, actx,
-				 named_g_mctx, &view->queryacl));
-
 	/*
 	 * Make the list of response policy zone names for a view that
 	 * is used for real lookups and so cares about hints.
@@ -4094,7 +4090,7 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
 	obj = NULL;
 	result = named_config_get(maps, "max-stale-ttl", &obj);
 	INSIST(result == ISC_R_SUCCESS);
-	max_stale_ttl = cfg_obj_asuint32(obj);
+	max_stale_ttl = ISC_MAX(cfg_obj_asuint32(obj), 1);
 
 	obj = NULL;
 	result = named_config_get(maps, "stale-answer-enable", &obj);
@@ -4640,6 +4636,22 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
 	INSIST(result == ISC_R_SUCCESS);
 	view->recursion = cfg_obj_asboolean(obj);
 
+	obj = NULL;
+	result = named_config_get(maps, "qname-minimization", &obj);
+	INSIST(result == ISC_R_SUCCESS);
+	qminmode = cfg_obj_asstring(obj);
+	INSIST(qminmode != NULL);
+	if (!strcmp(qminmode, "strict")) {
+		view->qminimization = ISC_TRUE;
+		view->qmin_strict = ISC_TRUE;
+	} else if (!strcmp(qminmode, "relaxed")) {
+		view->qminimization = ISC_TRUE;
+		view->qmin_strict = ISC_FALSE;
+	} else { /* "disabled" or "off" */
+		view->qminimization = ISC_FALSE;
+		view->qmin_strict = ISC_FALSE;
+	}
+
 	obj = NULL;
 	result = named_config_get(maps, "auth-nxdomain", &obj);
 	INSIST(result == ISC_R_SUCCESS);
@@ -4698,21 +4710,35 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
 				 "allow-query-cache-on", NULL, actx,
 				 named_g_mctx, &view->cacheonacl));
 	/*
-	 * Set "allow-query-cache", "allow-recursion", and
-	 * "allow-recursion-on" acls if configured in named.conf.
-	 * (Ignore the global defaults for now, because these ACLs
-	 * can inherit from each other when only some of them set at
-	 * the options/view level.)
+	 * Set the "allow-query", "allow-query-cache", "allow-recursion",
+	 * and "allow-recursion-on" ACLs if configured in named.conf, but
+	 * NOT from the global defaults. This is done by leaving the third
+	 * argument to configure_view_acl() NULL.
+	 *
+	 * We ignore the global defaults here because these ACLs
+	 * can inherit from each other.  If any are still unset after
+	 * applying the inheritance rules, we'll look up the defaults at
+	 * that time.
 	 */
-	CHECK(configure_view_acl(vconfig, config, NULL, "allow-query-cache",
-				 NULL, actx, named_g_mctx, &view->cacheacl));
+
+	/* named.conf only */
+	CHECK(configure_view_acl(vconfig, config, NULL,
+				 "allow-query", NULL, actx,
+				 named_g_mctx, &view->queryacl));
+
+	/* named.conf only */
+	CHECK(configure_view_acl(vconfig, config, NULL,
+				 "allow-query-cache", NULL, actx,
+				 named_g_mctx, &view->cacheacl));
 
 	if (strcmp(view->name, "_bind") != 0 &&
 	    view->rdclass != dns_rdataclass_chaos)
 	{
+		/* named.conf only */
 		CHECK(configure_view_acl(vconfig, config, NULL,
 					 "allow-recursion", NULL, actx,
 					 named_g_mctx, &view->recursionacl));
+		/* named.conf only */
 		CHECK(configure_view_acl(vconfig, config, NULL,
 					 "allow-recursion-on", NULL, actx,
 					 named_g_mctx, &view->recursiononacl));
@@ -4750,18 +4776,21 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
 		 * the global config.
 		 */
 		if (view->recursionacl == NULL) {
+			/* global default only */
 			CHECK(configure_view_acl(NULL, NULL, named_g_config,
 						 "allow-recursion", NULL,
 						 actx, named_g_mctx,
 						 &view->recursionacl));
 		}
 		if (view->recursiononacl == NULL) {
+			/* global default only */
 			CHECK(configure_view_acl(NULL, NULL, named_g_config,
 						 "allow-recursion-on", NULL,
 						 actx, named_g_mctx,
 						 &view->recursiononacl));
 		}
 		if (view->cacheacl == NULL) {
+			/* global default only */
 			CHECK(configure_view_acl(NULL, NULL, named_g_config,
 						 "allow-query-cache", NULL,
 						 actx, named_g_mctx,
@@ -4775,6 +4804,14 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
 		CHECK(dns_acl_none(mctx, &view->cacheacl));
 	}
 
+	if (view->queryacl == NULL) {
+		/* global default only */
+		CHECK(configure_view_acl(NULL, NULL, named_g_config,
+					 "allow-query", NULL,
+					 actx, named_g_mctx,
+					 &view->queryacl));
+	}
+
 	/*
 	 * Ignore case when compressing responses to the specified
 	 * clients. This causes case not always to be preserved,
@@ -4827,7 +4864,7 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
 	 * options/view level.)
 	 */
 	if (view->notifyacl == NULL) {
-		CHECK(configure_view_acl(vconfig, config, named_g_config,
+		CHECK(configure_view_acl(NULL, NULL, named_g_config,
 					 "allow-notify", NULL, actx,
 					 named_g_mctx, &view->notifyacl));
 	}
@@ -5671,7 +5708,7 @@ create_view(const cfg_obj_t *vconfig, dns_viewlist_t *viewlist,
 	if (result != ISC_R_SUCCESS)
 		return (result);
 
-	isc_random_buf(view->secret, sizeof(view->secret));
+	isc_nonce_buf(view->secret, sizeof(view->secret));
 
 	ISC_LIST_APPEND(*viewlist, view, link);
 	dns_view_attach(view, viewp);
@@ -6262,7 +6299,7 @@ add_listenelt(isc_mem_t *mctx, ns_listenlist_t *list, isc_sockaddr_t *addr,
 			return (result);
 
 		result = dns_iptable_addprefix(src_acl->iptable, &netaddr,
-					       128, ISC_TRUE, ISC_FALSE);
+					       128, ISC_TRUE);
 		if (result != ISC_R_SUCCESS)
 			goto clean;
 
@@ -7910,11 +7947,6 @@ load_configuration(const char *filename, named_server_t *server,
 		named_geoip_load(NULL);
 	}
 	named_g_aclconfctx->geoip = named_g_geoip;
-
-	obj = NULL;
-	result = named_config_get(maps, "geoip-use-ecs", &obj);
-	INSIST(result == ISC_R_SUCCESS);
-	env->geoip_use_ecs = cfg_obj_asboolean(obj);
 #endif /* HAVE_GEOIP */
 
 	/*
@@ -8851,8 +8883,8 @@ load_configuration(const char *filename, named_server_t *server,
 			}
 		}
 	} else {
-		isc_random_buf(server->sctx->secret,
-			       sizeof(server->sctx->secret));
+		isc_nonce_buf(server->sctx->secret,
+			      sizeof(server->sctx->secret));
 	}
 
 	/*
@@ -9266,7 +9298,7 @@ shutdown_server(isc_task_t *task, isc_event_t *event) {
  */
 static isc_result_t
 get_matching_view(isc_netaddr_t *srcaddr, isc_netaddr_t *destaddr,
-		  dns_message_t *message, dns_aclenv_t *env, dns_ecs_t *ecs,
+		  dns_message_t *message, dns_aclenv_t *env,
 		  isc_result_t *sigresult, dns_view_t **viewp)
 {
 	dns_view_t *view;
@@ -9283,9 +9315,6 @@ get_matching_view(isc_netaddr_t *srcaddr, isc_netaddr_t *destaddr,
 		    message->rdclass == dns_rdataclass_any)
 		{
 			dns_name_t *tsig = NULL;
-			isc_netaddr_t *addr = NULL;
-			isc_uint8_t *scope = NULL;
-			isc_uint8_t source = 0;
 
 			*sigresult = dns_message_rechecksig(message, view);
 			if (*sigresult == ISC_R_SUCCESS) {
@@ -9295,15 +9324,9 @@ get_matching_view(isc_netaddr_t *srcaddr, isc_netaddr_t *destaddr,
 				tsig = dns_tsigkey_identity(tsigkey);
 			}
 
-			if (ecs != NULL) {
-				addr = &ecs->addr;
-				source = ecs->source;
-				scope = &ecs->scope;
-			}
-
-			if (dns_acl_allowed(srcaddr, tsig, addr, source,
-					    scope, view->matchclients, env) &&
-			    dns_acl_allowed(destaddr, tsig, NULL, 0, NULL,
+			if (dns_acl_allowed(srcaddr, tsig,
+					    view->matchclients, env) &&
+			    dns_acl_allowed(destaddr, tsig,
 					    view->matchdestinations, env) &&
 			    !(view->matchrecursiveonly &&
 			      (message->flags & DNS_MESSAGEFLAG_RD) == 0))
@@ -13528,7 +13551,7 @@ generate_salt(unsigned char *salt, size_t saltlen) {
 	if (saltlen > 256U)
 		return (ISC_R_RANGE);
 
-	isc_random_buf(salt, saltlen);
+	isc_nonce_buf(salt, saltlen);
 
 	r.base = salt;
 	r.length = (unsigned int) saltlen;
@@ -14420,7 +14443,6 @@ mkey_destroy(named_server_t *server, dns_view_t *view, isc_buffer_t **text) {
 	return (result);
 }
 
-
 static isc_result_t
 mkey_dumpzone(dns_view_t *view, isc_buffer_t **text) {
 	isc_result_t result;

bin/named/statschannel.c

@@ -3196,8 +3196,8 @@ client_ok(const isc_sockaddr_t *fromaddr, void *arg) {
 	isc_netaddr_fromsockaddr(&netaddr, fromaddr);
 
 	LOCK(&listener->lock);
-	if (dns_acl_match(&netaddr, NULL, NULL, 0, NULL, listener->acl, env,
-			  &match, NULL) == ISC_R_SUCCESS && match > 0)
+	if ((dns_acl_match(&netaddr, NULL, listener->acl, env,
+			   &match, NULL) == ISC_R_SUCCESS) && match > 0)
 	{
 		UNLOCK(&listener->lock);
 		return (ISC_TRUE);

bin/named/zoneconf.c

@@ -815,11 +815,12 @@ isself(dns_view_t *myview, dns_tsigkey_t *mykey,
 			tsig = dns_tsigkey_identity(mykey);
 		}
 
-		if (dns_acl_allowed(&netsrc, tsig, NULL, 0, NULL,
-				    view->matchclients, env) &&
-		    dns_acl_allowed(&netdst, tsig, NULL, 0, NULL,
-				    view->matchdestinations, env))
+		if (dns_acl_allowed(&netsrc, tsig, view->matchclients, env) &&
+		    dns_acl_allowed(&netdst, tsig, view->matchdestinations,
+				    env))
+		{
 			break;
+		}
 	}
 	return (ISC_TF(view == myview));
 }
@@ -1438,7 +1439,9 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 	}
 
 	if (ztype == dns_zone_master || raw != NULL) {
+		const cfg_obj_t *validity, *resign;
 		isc_boolean_t allow = ISC_FALSE, maint = ISC_FALSE;
+		isc_boolean_t sigvalinsecs;
 
 		obj = NULL;
 		result = named_config_get(maps, "dnskey-sig-validity", &obj);
@@ -1449,26 +1452,29 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 		obj = NULL;
 		result = named_config_get(maps, "sig-validity-interval", &obj);
 		INSIST(result == ISC_R_SUCCESS && obj != NULL);
-		{
-			const cfg_obj_t *validity, *resign;
 
-			validity = cfg_tuple_get(obj, "validity");
-			seconds = cfg_obj_asuint32(validity) * 86400;
-			dns_zone_setsigvalidityinterval(zone, seconds);
-
-			resign = cfg_tuple_get(obj, "re-sign");
-			if (cfg_obj_isvoid(resign)) {
-				seconds /= 4;
-			} else {
-				if (seconds > 7 * 86400)
-					seconds = cfg_obj_asuint32(resign) *
-							86400;
-				else
-					seconds = cfg_obj_asuint32(resign) *
-							3600;
-			}
-			dns_zone_setsigresigninginterval(zone, seconds);
+		sigvalinsecs = ns_server_getoption(named_g_server->sctx,
+						   NS_SERVER_SIGVALINSECS);
+		validity = cfg_tuple_get(obj, "validity");
+		seconds = cfg_obj_asuint32(validity);
+		if (!sigvalinsecs) {
+			seconds *= 86400;
 		}
+		dns_zone_setsigvalidityinterval(zone, seconds);
+
+		resign = cfg_tuple_get(obj, "re-sign");
+		if (cfg_obj_isvoid(resign)) {
+			seconds /= 4;
+		} else if (!sigvalinsecs) {
+			if (seconds > 7 * 86400) {
+				seconds = cfg_obj_asuint32(resign) * 86400;
+			} else {
+				seconds = cfg_obj_asuint32(resign) * 3600;
+			}
+		} else {
+			seconds = cfg_obj_asuint32(resign);
+		}
+		dns_zone_setsigresigninginterval(zone, seconds);
 
 		obj = NULL;
 		result = named_config_get(maps, "key-directory", &obj);

bin/nsupdate/nsupdate.c

@@ -29,6 +29,7 @@
 #include <isc/lex.h>
 #include <isc/log.h>
 #include <isc/mem.h>
+#include <isc/nonce.h>
 #include <isc/parseint.h>
 #include <isc/print.h>
 #include <isc/platform.h>
@@ -2829,14 +2830,16 @@ start_gssrequest(dns_name_t *master) {
 			fatal("out of memory");
 	}
 
-	memmove(kserver, &master_servers[master_inuse], sizeof(isc_sockaddr_t));
+	memmove(kserver, &master_servers[master_inuse],
+		sizeof(isc_sockaddr_t));
 
 	servname = dns_fixedname_initname(&fname);
 
 	if (realm == NULL)
 		get_ticket_realm(gmctx);
 
-	result = snprintf(servicename, sizeof(servicename), "DNS/%s%s", namestr, realm ? realm : "");
+	result = snprintf(servicename, sizeof(servicename), "DNS/%s%s",
+			  namestr, realm ? realm : "");
 	RUNTIME_CHECK(result < sizeof(servicename));
 	isc_buffer_init(&buf, servicename, strlen(servicename));
 	isc_buffer_add(&buf, strlen(servicename));
@@ -2848,9 +2851,10 @@ start_gssrequest(dns_name_t *master) {
 
 	keyname = dns_fixedname_initname(&fkname);
 
-	val = isc_random();
+	isc_nonce_buf(&val, sizeof(val));
 
-	result = snprintf(mykeystr, sizeof(mykeystr), "%u.sig-%s", val, namestr);
+	result = snprintf(mykeystr, sizeof(mykeystr), "%u.sig-%s", val,
+			  namestr);
 	RUNTIME_CHECK(result <= sizeof(mykeystr));
 
 	isc_buffer_init(&buf, mykeystr, strlen(mykeystr));

bin/python/isc/dnskey.py.in

@@ -32,7 +32,7 @@ class dnskey:
 
     _ALGNAMES = (None, 'RSAMD5', 'DH', 'DSA', 'ECC', 'RSASHA1',
                  'NSEC3DSA', 'NSEC3RSASHA1', 'RSASHA256', None,
-                 'RSASHA512', None, 'ECCGOST', 'ECDSAP256SHA256',
+                 'RSASHA512', None, None, 'ECDSAP256SHA256',
                  'ECDSAP384SHA384', 'ED25519', 'ED448')
 
     def __init__(self, key, directory=None, keyttl=None):

bin/python/isc/policy.py.in

@@ -71,7 +71,7 @@ class PolicyLex:
         return t
 
     def t_ALGNAME(self, t):
-        r'(?i)\b(RSAMD5|DH|DSA|NSEC3DSA|ECC|RSASHA1|NSEC3RSASHA1|RSASHA256|RSASHA512|ECCGOST|ECDSAP256SHA256|ECDSAP384SHA384|ED25519|ED448)\b'
+        r'(?i)\b(RSAMD5|DH|DSA|NSEC3DSA|ECC|RSASHA1|NSEC3RSASHA1|RSASHA256|RSASHA512|ECDSAP256SHA256|ECDSAP384SHA384|ED25519|ED448)\b'
         t.value = t.value.upper()
         return t
 
@@ -139,7 +139,6 @@ class Policy:
                              'NSEC3RSASHA1': [512, 4096],
                              'RSASHA256': [1024, 4096],
                              'RSASHA512': [1024, 4096],
-                             'ECCGOST': None,
                              'ECDSAP256SHA256': None,
                              'ECDSAP384SHA384': None,
                              'ED25519': None,
@@ -278,8 +277,7 @@ class Policy:
                         ('ZSK key size %d not divisible by 64 ' +
                          'as required for DSA') % self.zsk_keysize
 
-            if self.algorithm in ['ECCGOST', \
-                                  'ECDSAP256SHA256', \
+            if self.algorithm in ['ECDSAP256SHA256', \
                                   'ECDSAP384SHA384', \
                                   'ED25519', \
                                   'ED448']:
@@ -369,10 +367,6 @@ class dnssec_policy:
         self.alg_policy['RSASHA512'].algorithm = "RSASHA512"
         self.alg_policy['RSASHA512'].name = "RSASHA512"
 
-        self.alg_policy['ECCGOST'] = copy(p)
-        self.alg_policy['ECCGOST'].algorithm = "ECCGOST"
-        self.alg_policy['ECCGOST'].name = "ECCGOST"
-
         self.alg_policy['ECDSAP256SHA256'] = copy(p)
         self.alg_policy['ECDSAP256SHA256'].algorithm = "ECDSAP256SHA256"
         self.alg_policy['ECDSAP256SHA256'].name = "ECDSAP256SHA256"

bin/rndc/rndc.8

@@ -524,13 +524,25 @@ See also
 \fBrndc managed\-keys\fR\&.
 .RE
 .PP
-\fBserve\-stale ( on | off | status | reset ) \fR\fB[\fIclass\fR [\fIview\fR]]\fR
+\fBserve\-stale ( on | off | reset | status ) \fR\fB[\fIclass\fR [\fIview\fR]]\fR
 .RS 4
-Enable, disable, or reset the serving of stale answers as configured in named\&.conf\&. Serving of stale answers will remain disabled across
-named\&.conf
-reloads if disabled via rndc until it is reset via rndc\&.
+Enable, disable, reset, or report the current status of the serving of stale answers as configured in
+named\&.conf\&.
 .sp
-Status will report whether serving of stale answers is currently enabled, disabled or not configured for a view\&. If serving of stale records is configured then the values of stale\-answer\-ttl and max\-stale\-ttl are reported\&.
+If serving of stale answers is disabled by
+\fBrndc\-serve\-stale off\fR, then it will remain disabled even if
+\fBnamed\fR
+is reloaded or reconfigured\&.
+\fBrndc serve\-stale reset\fR
+restores the setting as configured in
+named\&.conf\&.
+.sp
+\fBrndc serve\-stale status\fR
+will report whether serving of stale answers is currently enabled, disabled by the configuration, or disabled by
+\fBrndc\fR\&. It will also report the values of
+\fBstale\-answer\-ttl\fR
+and
+\fBmax\-stale\-ttl\fR\&.
 .RE
 .PP
 \fBshowzone \fR\fB\fIzone\fR\fR\fB \fR\fB[\fIclass\fR [\fIview\fR]]\fR\fB \fR

bin/rndc/rndc.c

@@ -930,7 +930,7 @@ main(int argc, char **argv) {
 	if (argc < 1)
 		usage(1);
 
-	serial = isc_random();
+	serial = isc_random32();
 
 	DO("create memory context", isc_mem_create(0, 0, &rndc_mctx));
 	DO("create socket manager", isc_socketmgr_create(rndc_mctx, &socketmgr));

bin/rndc/rndc.docbook

@@ -785,20 +785,28 @@
       </varlistentry>
 
       <varlistentry>
-	<term><userinput>serve-stale ( on | off | status | reset ) <optional><replaceable>class</replaceable> <optional><replaceable>view</replaceable></optional></optional></userinput></term>
+	<term><userinput>serve-stale ( on | off | reset | status ) <optional><replaceable>class</replaceable> <optional><replaceable>view</replaceable></optional></optional></userinput></term>
 	<listitem>
 	  <para>
-	    Enable, disable, or reset the serving of stale answers
-	    as configured in named.conf. Serving of stale answers
-	    will remain disabled across <filename>named.conf</filename>
-	    reloads if disabled via rndc until it is reset via rndc.
+	    Enable, disable, reset, or report the current status
+            of the serving of stale answers as configured in
+            <filename>named.conf</filename>.
 	  </para>
 	  <para>
-	    Status will report whether serving of stale answers is
-	    currently enabled, disabled or not configured for a
-	    view.  If serving of stale records is configured then
-	    the values of stale-answer-ttl and max-stale-ttl are
-	    reported.
+            If serving of stale answers is disabled by
+            <command>rndc-serve-stale off</command>, then it
+	    will remain disabled even if <command>named</command>
+            is reloaded or reconfigured.
+            <command>rndc serve-stale reset</command> restores
+            the setting as configured in <filename>named.conf</filename>.
+	  </para>
+	  <para>
+	    <command>rndc serve-stale status</command> will report
+            whether serving of stale answers is currently enabled,
+            disabled by the configuration, or disabled by
+            <command>rndc</command>.  It will also report the
+	    values of <command>stale-answer-ttl</command> and
+	    <command>max-stale-ttl</command>.
 	  </para>
 	</listitem>
       </varlistentry>

bin/rndc/rndc.html

@@ -664,20 +664,28 @@
 	    See also <span class="command"><strong>rndc managed-keys</strong></span>.
 	  </p>
 	</dd>
-<dt><span class="term"><strong class="userinput"><code>serve-stale ( on | off | status | reset ) [<span class="optional"><em class="replaceable"><code>class</code></em> [<span class="optional"><em class="replaceable"><code>view</code></em></span>]</span>]</code></strong></span></dt>
+<dt><span class="term"><strong class="userinput"><code>serve-stale ( on | off | reset | status ) [<span class="optional"><em class="replaceable"><code>class</code></em> [<span class="optional"><em class="replaceable"><code>view</code></em></span>]</span>]</code></strong></span></dt>
 <dd>
 	  <p>
-	    Enable, disable, or reset the serving of stale answers
-	    as configured in named.conf. Serving of stale answers
-	    will remain disabled across <code class="filename">named.conf</code>
-	    reloads if disabled via rndc until it is reset via rndc.
+	    Enable, disable, reset, or report the current status
+            of the serving of stale answers as configured in
+            <code class="filename">named.conf</code>.
 	  </p>
 	  <p>
-	    Status will report whether serving of stale answers is
-	    currently enabled, disabled or not configured for a
-	    view.  If serving of stale records is configured then
-	    the values of stale-answer-ttl and max-stale-ttl are
-	    reported.
+            If serving of stale answers is disabled by
+            <span class="command"><strong>rndc-serve-stale off</strong></span>, then it
+	    will remain disabled even if <span class="command"><strong>named</strong></span>
+            is reloaded or reconfigured.
+            <span class="command"><strong>rndc serve-stale reset</strong></span> restores
+            the setting as configured in <code class="filename">named.conf</code>.
+	  </p>
+	  <p>
+	    <span class="command"><strong>rndc serve-stale status</strong></span> will report
+            whether serving of stale answers is currently enabled,
+            disabled by the configuration, or disabled by
+            <span class="command"><strong>rndc</strong></span>.  It will also report the
+	    values of <span class="command"><strong>stale-answer-ttl</strong></span> and
+	    <span class="command"><strong>max-stale-ttl</strong></span>.
 	  </p>
 	</dd>
 <dt><span class="term"><strong class="userinput"><code>showzone <em class="replaceable"><code>zone</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em> [<span class="optional"><em class="replaceable"><code>view</code></em></span>]</span>] </code></strong></span></dt>

bin/tests/optional/.gitignore

@@ -0,0 +1,5 @@
+/backtrace_test.dSYM/
+/backtrace_test0.dSYM/
+/backtrace_test_nosymtbl
+/backtrace_test_nosymtbl.dSYM/
+/nsecify

bin/tests/system/Makefile.in

@@ -64,7 +64,7 @@ PARALLEL = rpzrecurse serve-stale dnssec \
 	   legacy limits logfileconfig \
 	   masterfile masterformat metadata mkeys \
 	   names notify nslookup nsupdate nzd2nzf \
-	   padding pending pipelined \
+	   padding pending pipelined qmin \
 	   reclimit redirect resolver rndc rootkeysentinel rpz \
 	   rrchecker rrl rrsetorder rsabigexponent runtime \
 	   sfcache smartsign sortlist \

bin/tests/system/acl/clean.sh

@@ -21,3 +21,4 @@ rm -f */named.run
 rm -f ns*/named.lock
 rm -f ns*/_default.nzf
 rm -f ns*/_default.nzd*
+rm -f ns*/managed-keys.bind* ns*/*.mkeys*

bin/tests/system/acl/ns2/named7.conf.in

@@ -1,60 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-key rndc_key {
-	secret "1234abcd8765";
-	algorithm hmac-sha256;
-};
-
-controls {
-	inet 10.53.0.2 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
-};
-
-options {
-	query-source address 10.53.0.2;
-	notify-source 10.53.0.2;
-	transfer-source 10.53.0.2;
-	port @PORT@;
-	pid-file "named.pid";
-	listen-on { 10.53.0.2; };
-	listen-on-v6 { none; };
-	recursion no;
-	notify yes;
-	ixfr-from-differences yes;
-	check-integrity no;
-	allow-query-on { 10.53.0.2; };
-};
-
-view one {
-	match-clients { ecs 192.0.2/24; };
-
-	zone "." {
-		type hint;
-		file "../../common/root.hint";
-	};
-
-	zone "example" {
-		type master;
-		file "example.db";
-	};
-};
-
-view two {
-	zone "." {
-		type hint;
-		file "../../common/root.hint";
-	};
-
-	zone "example" {
-		type master;
-		file "example.db";
-	};
-};

bin/tests/system/acl/tests.sh

@@ -144,36 +144,6 @@ $DIG -p ${PORT} +tcp soa example. \
 	@10.53.0.2 -b 10.53.0.3 > dig.out.${t}
 grep "status: NOERROR" dig.out.${t} > /dev/null 2>&1 || { echo_i "test $t failed" ; status=1; }
 
-echo_i "testing EDNS client-subnet ACL processing"
-copy_setports ns2/named6.conf.in ns2/named.conf
-$RNDCCMD 10.53.0.2 reload 2>&1 | sed 's/^/ns2 /' | cat_i
-sleep 5
-
-# should fail
-t=`expr $t + 1`
-$DIG $DIGOPTS tsigzone. \
-	@10.53.0.2 -b 10.53.0.2 axfr > dig.out.${t}
-grep "^;" dig.out.${t} > /dev/null 2>&1 || { echo_i "test $t failed" ; status=1; }
-
-# should succeed
-t=`expr $t + 1`
-$DIG $DIGOPTS tsigzone. \
-	@10.53.0.2 -b 10.53.0.2 +subnet="10.53.0/24" axfr > dig.out.${t}
-grep "^;" dig.out.${t} > /dev/null 2>&1 && { echo_i "test $t failed" ; status=1; }
-
-echo_i "testing EDNS client-subnet response scope"
-copy_setports ns2/named7.conf.in ns2/named.conf
-$RNDCCMD 10.53.0.2 reload 2>&1 | sed 's/^/ns2 /' | cat_i
-sleep 5
-
-t=`expr $t + 1`
-$DIG -p ${PORT} example. soa @10.53.0.2 +subnet="10.53.0.1/32" > dig.out.${t}
-grep "CLIENT-SUBNET.*10.53.0.1/32/0" dig.out.${t} > /dev/null || { echo_i "test $t failed" ; status=1; }
-
-t=`expr $t + 1`
-$DIG -p ${PORT} example. soa @10.53.0.2 +subnet="192.0.2.128/32" > dig.out.${t}
-grep "CLIENT-SUBNET.*192.0.2.128/32/24" dig.out.${t} > /dev/null || { echo_i "test $t failed" ; status=1; }
-
 # AXFR tests against ns3
 
 echo_i "testing allow-transfer ACLs against ns3 (no existing zones)"

bin/tests/system/additional/clean.sh

@@ -18,3 +18,4 @@ rm -f */named.memstats
 rm -f */named.conf
 rm -f */named.run
 rm -f ns*/named.lock
+rm -f ns*/managed-keys.bind*

bin/tests/system/additional/ns1/named1.conf.in

@@ -14,6 +14,7 @@ options {
 	notify-source 10.53.0.1;
 	transfer-source 10.53.0.1;
 	recursion no;
+	dnssec-validation no;
 	port @PORT@;
 	pid-file "named.pid";
 	listen-on { 10.53.0.1; };

bin/tests/system/additional/ns1/named2.conf.in

@@ -14,6 +14,7 @@ options {
 	notify-source 10.53.0.1;
 	transfer-source 10.53.0.1;
 	recursion no;
+	dnssec-validation no;
 	port @PORT@;
 	pid-file "named.pid";
 	listen-on { 10.53.0.1; };

bin/tests/system/additional/ns1/named3.conf.in

@@ -14,6 +14,7 @@ options {
 	notify-source 10.53.0.1;
 	transfer-source 10.53.0.1;
 	recursion no;
+	dnssec-validation no;
 	port @PORT@;
 	pid-file "named.pid";
 	listen-on { 10.53.0.1; };

bin/tests/system/additional/ns1/named4.conf.in

@@ -14,6 +14,7 @@ options {
 	notify-source 10.53.0.1;
 	transfer-source 10.53.0.1;
 	recursion no;
+	dnssec-validation no;
 	port @PORT@;
 	pid-file "named.pid";
 	listen-on { 10.53.0.1; };

bin/tests/system/additional/ns2/named.conf.in

@@ -9,27 +9,20 @@
  * information regarding copyright ownership.
  */
 
-// NS2
-
-controls { /* empty */ };
-
 options {
 	query-source address 10.53.0.2;
 	notify-source 10.53.0.2;
 	transfer-source 10.53.0.2;
-	port 5300;
+	recursion no;
+	port @PORT@;
 	pid-file "named.pid";
 	listen-on { 10.53.0.2; };
 	listen-on-v6 { none; };
-	recursion yes;
-	notify yes;
-	dnssec-enable yes;
-	dnssec-validation yes;
+	notify no;
+	minimal-responses yes;
 };
 
 zone "." {
-	type hint;
-	file "../../common/root.hint";
+	type master;
+	file "root.db";
 };
-
-include "trusted.conf";

bin/tests/system/additional/ns2/root.db

@@ -0,0 +1,19 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0. If a copy of the MPL was not distributed with this
+; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+. IN SOA ns2. hostmaster ( 2 8H 2H 4W 1D);
+. NS ns2.
+ns1. A 10.53.0.1
+ns2. A 10.53.0.2
+rt.example. NS ns1.
+naptr.example. NS ns1.
+rt2.example. NS ns1.
+naptr2.example. NS ns1.
+nid.example. NS ns1.
+

bin/tests/system/additional/ns3/named.conf.in

@@ -20,6 +20,7 @@ options {
 	listen-on { 10.53.0.3; };
 	listen-on-v6 { none; };
 	recursion yes;
+	dnssec-validation yes;
 };
 
 zone "." {

bin/tests/system/additional/ns3/root.hint

@@ -7,5 +7,5 @@
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
 
-. NS ns1.
-ns1. A 10.53.0.1
+. NS ns2.
+ns2. A 10.53.0.2

bin/tests/system/additional/setup.sh

@@ -14,4 +14,5 @@ SYSTEMTESTTOP=..
 
 $SHELL clean.sh
 copy_setports ns1/named1.conf.in ns1/named.conf
+copy_setports ns2/named.conf.in ns2/named.conf
 copy_setports ns3/named.conf.in ns3/named.conf

bin/tests/system/addzone/clean.sh

@@ -37,3 +37,4 @@ rm -f ns1/redirect.db
 rm -f ns2/redirect.db
 rm -f ns2/redirect.bk
 rm -f ns3/redirect.db
+rm -f ns*/managed-keys.bind* ns*/*.mkeys*

bin/tests/system/allow-query/clean.sh

@@ -14,7 +14,9 @@
 #
 
 rm -f dig.out.*
-rm -f ns2/named.conf ns2/controls.conf
+rm -f ns*/named.conf
+rm -f ns2/controls.conf
 rm -f */named.memstats
 rm -f ns*/named.lock
 rm -f ns*/named.run ns*/named.run.prev
+rm -f ns*/managed-keys.bind* ns*/*.mkeys*

bin/tests/system/allow-query/ns1/named.conf.in

@@ -0,0 +1,23 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+options {
+	port @PORT@;
+	pid-file "named.pid";
+	listen-on { 10.53.0.1; };
+	listen-on-v6 { none; };
+	recursion no;
+};
+
+zone "." {
+	type master;
+	file "root.db";
+};

bin/tests/system/allow-query/ns1/root.db

@@ -0,0 +1,16 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0. If a copy of the MPL was not distributed with this
+; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 300
+@			SOA	ns1. hostmaster.localhost. 1 3600 1200 604800 3600
+			NS	ns1.
+ns1.			A	10.53.0.1
+
+normal.example.		NS	ns2.normal.example.
+ns2.normal.example.	A	10.53.0.2

bin/tests/system/allow-query/ns3/named.args

@@ -0,0 +1,2 @@
+# this server only has 127.0.0.1 in its localhost/localnets ACLs
+-m record,size,mctx -c named.conf -d 99 -X named.lock -g -T clienttest -T fixedlocal

bin/tests/system/allow-query/ns3/named.conf.in

@@ -0,0 +1,24 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+options {
+	port @PORT@;
+	pid-file "named.pid";
+	listen-on { 10.53.0.3; };
+	listen-on-v6 { none; };
+	recursion yes;
+	dnssec-validation no;
+};
+
+zone "." {
+	type hint;
+	file "../../common/root.hint";
+};

bin/tests/system/allow-query/setup.sh

@@ -13,4 +13,6 @@ SYSTEMTESTTOP=..
 . $SYSTEMTESTTOP/conf.sh
 
 copy_setports ../common/controls.conf.in ns2/controls.conf
+copy_setports  ns1/named.conf.in ns1/named.conf
 copy_setports  ns2/named01.conf.in ns2/named.conf
+copy_setports  ns3/named.conf.in ns3/named.conf

bin/tests/system/allow-query/tests.sh

@@ -602,5 +602,16 @@ grep '^a.aclnotallow.example' dig.out.ns2.2.$n > /dev/null && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
 
+# Test 58 - allow-recursion inheritance
+n=`expr $n + 1`
+echo_i "test $n: default recursion configuration"
+ret=0
+$DIG -p ${PORT} @10.53.0.3 -b 127.0.0.1 a.normal.example a > dig.out.ns3.1.$n
+grep 'status: NOERROR' dig.out.ns3.1.$n > /dev/null || ret=1
+$DIG -p ${PORT} @10.53.0.3 -b 10.53.0.1 a.normal.example a > dig.out.ns3.2.$n
+grep 'status: REFUSED' dig.out.ns3.2.$n > /dev/null || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=`expr $status + $ret`
+
 echo_i "exit status: $status"
 [ $status -eq 0 ] || exit 1

bin/tests/system/auth/clean.sh

@@ -13,3 +13,4 @@ rm -f */named.conf
 rm -f dig.out.test*
 rm -f ns2/example.com.bk
 rm -f ns2/example.net.bk
+rm -f ns*/managed-keys.bind*

bin/tests/system/autosign/clean.sh

@@ -63,3 +63,4 @@ rm -f nsupdate.out
 rm -f settime.out.*
 rm -f signing.out.*
 rm -f sync.key
+rm -f ns*/managed-keys.bind*

bin/tests/system/autosign/ns1/keygen.sh

@@ -33,28 +33,12 @@ rm $zsknopriv.private
 ksksby=`$KEYGEN -3 -a RSASHA1 -q -P now -A now+15s -fk $zone`
 kskrev=`$KEYGEN -3 -a RSASHA1 -q -R now+15s -fk $zone`
 
-cat $ksksby.key | grep -v '^; ' | $PERL -n -e '
-local ($dn, $class, $type, $flags, $proto, $alg, @rest) = split;
-local $key = join("", @rest);
-print <<EOF
-trusted-keys {
-    "$dn" $flags $proto $alg "$key";
-};
-EOF
-' > trusted.conf
+keyfile_to_trusted_keys $ksksby > trusted.conf
 cp trusted.conf ../ns2/trusted.conf
 cp trusted.conf ../ns3/trusted.conf
 cp trusted.conf ../ns4/trusted.conf
 
-cat $kskrev.key | grep -v '^; ' | $PERL -n -e '
-local ($dn, $class, $type, $flags, $proto, $alg, @rest) = split;
-local $key = join("", @rest);
-print <<EOF
-trusted-keys {
-    "$dn" $flags $proto $alg "$key";
-};
-EOF
-' > trusted.conf
+keyfile_to_trusted_keys $kskrev > trusted.conf
 cp trusted.conf ../ns5/trusted.conf
 
 echo $zskact > ../active.key

bin/tests/system/autosign/ns2/keygen.sh

@@ -36,15 +36,7 @@ zonefile="${zone}.db"
 infile="${zonefile}.in"
 ksk=`$KEYGEN -a RSASHA1 -3 -q -fk $zone`
 $KEYGEN -a RSASHA1 -3 -q $zone > /dev/null
-cat $ksk.key | grep -v '^; ' | $PERL -n -e '
-local ($dn, $class, $type, $flags, $proto, $alg, @rest) = split;
-local $key = join("", @rest);
-print <<EOF
-trusted-keys {
-    "$dn" $flags $proto $alg "$key";
-};
-EOF
-' > private.conf
+keyfile_to_trusted_keys $ksk > private.conf
 cp private.conf ../ns4/private.conf
 $SIGNER -S -3 beef -A -o $zone -f $zonefile $infile > /dev/null 2>&1
 

bin/tests/system/builtin/clean.sh

@@ -15,3 +15,4 @@ rm -f ns?/named.conf
 rm -f rndc.status.ns*
 rm -f dig.out.ns*
 rm -f ns*/named.lock
+rm -f ns*/managed-keys.bind*

bin/tests/system/cacheclean/clean.sh

@@ -21,3 +21,4 @@ rm -f */named.run
 rm -f */named.conf
 rm -f ns2/named_dump.db.*
 rm -f ns*/named.lock
+rm -f ns*/managed-keys.bind*

bin/tests/system/cacheclean/ns1/named.conf.in

@@ -18,6 +18,7 @@ options {
 	listen-on { 10.53.0.1; };
 	listen-on-v6 { none; };
 	recursion no;
+	dnssec-validation no;
 	notify yes;
 	check-integrity no;
 	minimal-responses no;

bin/tests/system/cacheclean/ns2/named.conf.in

@@ -20,6 +20,8 @@ options {
 	notify yes;
 	max-cache-size 80%;
 	disable-empty-zone 127.IN-ADDR.ARPA;
+	recursion yes;
+	dnssec-validation yes;
 };
 
 key rndc_key {

bin/tests/system/case/clean.sh

@@ -19,3 +19,4 @@ rm -f ns1/dynamic.db.jnl
 rm -f ns2/dynamic.bk
 rm -f ns2/dynamic.bk.jnl
 rm -f ns2/example.bk
+rm -f ns*/managed-keys.bind*

bin/tests/system/catz/clean.sh

@@ -17,8 +17,9 @@ rm -f ns*/named.run
 rm -f ns1/*dom*example.db
 rm -f ns2/__catz__*db
 rm -f ns2/named.conf.tmp
-rm -f ns3/dom{13,14}.example.db
+rm -f ns3/dom13.example.db ns3/dom14.example.db
 rm -f nsupdate.out.*
-rm -f ns{1,2,3}/catalog{1,2,3,4}.example.db
+rm -f ns[123]/catalog[1234].example.db
 rm -rf ns2/zonedir
 rm -f ns*/*.nzd ns*/*.nzd-lock
+rm -f ns*/managed-keys.bind*

bin/tests/system/chain/clean.sh

@@ -13,3 +13,4 @@ rm -f dig.out.* named*.pid
 rm -f ns*/named.conf
 rm -f */named.memstats */named.recursing */named.lock */named.run */ans.run
 rm -f ns2/K* ns2/dsset-* ns2/example.db.signed
+rm -f ns*/managed-keys.bind*

bin/tests/system/chain/ns1/named.conf.in

@@ -18,8 +18,8 @@ options {
 	listen-on { 10.53.0.1; };
 	listen-on-v6 { none; };
 	recursion no;
+	dnssec-validation yes;
 	notify yes;
-	dnssec-enable yes;
 };
 
 zone "." { type master; file "root.db"; };

bin/tests/system/chain/ns2/named.conf.in

@@ -20,6 +20,7 @@ options {
 	listen-on { 10.53.0.2; };
 	listen-on-v6 { none; };
 	recursion no;
+	dnssec-validation no;
 	notify yes;
 };
 

bin/tests/system/chain/ns5/named.conf.in

@@ -20,6 +20,7 @@ options {
 	listen-on { 10.53.0.5; };
 	listen-on-v6 { none; };
 	recursion no;
+	dnssec-validation no;
 	notify yes;
 };
 

bin/tests/system/chain/ns7/named.conf.in

@@ -20,6 +20,7 @@ options {
 	listen-on-v6 { fd92:7065:b8e:ffff::7; };
 	recursion yes;
 	allow-recursion { any; };
+	dnssec-validation yes;
 };
 
 key rndc_key {

bin/tests/system/checkconf/bad-geoip-use-ecs.conf

@@ -0,0 +1,14 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+options {
+	geoip-use-ecs yes;
+};

bin/tests/system/checkconf/tests.sh

@@ -396,5 +396,13 @@ grep "trusted-key for dlv.isc.org still present" checkconf.out$n > /dev/null ||
 if [ $ret != 0 ]; then echo_i "failed"; ret=1; fi
 status=`expr $status + $ret`
 
+echo_i "check that 'geoip-use-ecs no' generates a warning ($n)"
+ret=0
+$CHECKCONF warn-geoip-use-ecs.conf > checkconf.out$n 2>/dev/null || ret=1
+[ -s checkconf.out$n ] || ret=1
+grep "'geoip-use-ecs' is obsolete" checkconf.out$n > /dev/null || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; ret=1; fi
+status=`expr $status + $ret`
+
 echo_i "exit status: $status"
 [ $status -eq 0 ] || exit 1

bin/tests/system/checkconf/warn-geoip-use-ecs.conf

@@ -0,0 +1,14 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+options {
+	geoip-use-ecs no;
+};

bin/tests/system/checknames/clean.sh

@@ -20,3 +20,4 @@ rm -f ns4/*.update.db.jnl
 rm -f */named.memstats
 rm -f */named.run
 rm -f ns*/named.lock
+rm -f ns*/managed-keys.bind*

bin/tests/system/checknames/ns1/named.conf.in

@@ -18,6 +18,7 @@ options {
 	listen-on { 10.53.0.1; };
 	listen-on-v6 { none; };
 	recursion no;
+	dnssec-validation no;
 	notify yes;
 	check-integrity no;
 };

bin/tests/system/checknames/ns2/named.conf.in

@@ -18,6 +18,7 @@ options {
 	listen-on { 10.53.0.2; };
 	listen-on-v6 { none; };
 	recursion yes;
+	dnssec-validation yes;
 	check-names response warn;
 	notify yes;
 };

bin/tests/system/checknames/ns3/named.conf.in

@@ -18,6 +18,7 @@ options {
 	listen-on { 10.53.0.3; };
 	listen-on-v6 { none; };
 	recursion yes;
+	dnssec-validation yes;
 	check-names response fail;
 	notify yes;
 };

bin/tests/system/checknames/ns4/named.conf.in

@@ -18,6 +18,7 @@ options {
 	listen-on { 10.53.0.4; };
 	listen-on-v6 { none; };
 	recursion yes;
+	dnssec-validation yes;
 	check-names master ignore;
 	notify yes;
 };

bin/tests/system/conf.sh.in

@@ -71,12 +71,12 @@ KRB5_CONFIG=/dev/null
 
 # The "stress" test is not run by default since it creates enough
 # load on the machine to make it unusable to other users.
-# The "dialup" and "delzone" tests are also not run by default because
-# they take a very long time to complete.
+# The "dialup", "delzone", and "dupsigs" tests are also not run by
+# default because they take a very long time to complete.
 #
 # List of tests hard-coded to use ports 5300 and 9953. For this
 # reason, these must be run sequentially.
-SEQUENTIALDIRS="ecdsa eddsa gost @PKCS11_TEST@ tkey"
+SEQUENTIALDIRS="ecdsa eddsa @PKCS11_TEST@ tkey"
 
 # List of tests that use ports assigned by caller (other than 5300
 # and 9953). Because separate blocks of ports can be used for teach
@@ -95,7 +95,7 @@ PARALLELDIRS="acl additional addzone allow-query auth autosign \
 	legacy limits logfileconfig \
 	masterfile masterformat metadata mkeys \
 	names notify nslookup nsupdate nzd2nzf \
-	padding pending pipelined \
+	padding pending pipelined qmin \
 	reclimit redirect resolver rndc rootkeysentinel rpz rpzrecurse \
 	rrchecker rrl rrsetorder rsabigexponent runtime \
 	serve-stale sfcache smartsign sortlist \
@@ -163,7 +163,7 @@ NZD=@NZD_TOOLS@
 #
 # Set up color-coded test output
 #
-if [ ${SYSTEMTEST_FORCE_COLOR:-0} -eq 1 ] || test -t 1 && type tput > /dev/null 2>&1 ; then
+if [ ${SYSTEMTEST_FORCE_COLOR:-0} -eq 1 ] || test -t 1 && type tput > /dev/null 2>&1 && tput setaf 7 > /dev/null 2>&1 ; then
     COLOR_END=`tput setaf 4`    # blue
     COLOR_FAIL=`tput setaf 1`   # red
     COLOR_INFO=`tput bold`      # bold
@@ -254,6 +254,41 @@ digcomp() {
 # Useful functions in test scripts
 #
 
+# keyfile_to_keys_section: helper function for keyfile_to_*_keys() which
+# converts keyfile data into a configuration section using the supplied
+# parameters
+keyfile_to_keys_section() {
+    section_name=$1
+    key_prefix=$2
+    shift
+    shift
+    echo "$section_name {"
+    for keyname in $*; do
+        awk '!/^; /{
+            printf "\t\""$1"\" "
+            printf "'"$key_prefix"'"
+            printf $4 " " $5 " " $6 " \""
+            for (i=7; i<=NF; i++) printf $i
+            printf "\";\n"
+        }' $keyname.key
+    done
+    echo "};"
+}
+
+# keyfile_to_trusted_keys: convert key data contained in the keyfile(s)
+# provided to a "trusted-keys" section suitable for including in a
+# resolver's configuration file
+keyfile_to_trusted_keys() {
+    keyfile_to_keys_section "trusted-keys" "" $*
+}
+
+# keyfile_to_managed_keys: convert key data contained in the keyfile(s)
+# provided to a "managed-keys" section suitable for including in a
+# resolver's configuration file
+keyfile_to_managed_keys() {
+    keyfile_to_keys_section "managed-keys" "initial-key " $*
+}
+
 # nextpart: read everything that's been appended to a file since the
 # last time 'nextpart' was called.
 nextpart () {

bin/tests/system/conf.sh.win32

@@ -77,7 +77,8 @@ KRB5_CONFIG=NUL
 
 # The "stress" test is not run by default since it creates enough
 # load on the machine to make it unusable to other users.
-# v6synth
+# The "dialup", "delzone", and "dupsigs" tests are also not run by
+# default because they take a very long time to complete.
 #
 # List of tests that use ports 5300 and 9953.  For this reason, these must
 # be run sequentially.
@@ -87,11 +88,11 @@ SEQUENTIALDIRS="acl additional addzone autosign builtin \
 	 database digdelv dlv dlvauto dlz dlzexternal dname \
 	 dns64 dnssec @DNSTAP@ dscp dsdigest dyndb ecdsa eddsa \
 	 ednscompliance emptyzones \
-	 fetchlimit filter-aaaa formerr forward geoip glue gost idna inline ixfr \
+	 fetchlimit filter-aaaa formerr forward geoip glue idna inline ixfr \
 	 keepalive @KEYMGR@ legacy limits logfileconfig masterfile \
 	 masterformat metadata mkeys names notify nslookup nsupdate \
-	 nzd2nzf padding pending pipelined @PKCS11_TEST@ reclimit \
-	 redirect resolver rndc rpz rrchecker rrl \
+	 nzd2nzf padding pending pipelined @PKCS11_TEST@ qmin \
+	 reclimit redirect resolver rndc rpz rrchecker rrl \
 	 rrsetorder rsabigexponent runtime sfcache smartsign sortlist \
 	 spf staticstub statistics statschannel stub tcp tkey tsig \
 	 tsiggss unknown upforwd verify views wildcard xfer xferquota \
@@ -199,11 +200,17 @@ echoend () {
         printf "${COLOR_END}%s${COLOR_NONE}\n" "$*"
 }
 
-TESTNAME="`basename $PWD`"
+SYSTESTDIR="`basename $PWD`"
 
 echo_i() {
     echo "$@" | while read LINE ; do
-       echoinfo "I:$TESTNAME:$LINE"
+       echoinfo "I:$SYSTESTDIR:$LINE"
+    done
+}
+
+echo_ic() {
+    echo "$@" | while read LINE ; do
+       echoinfo "I:$SYSTESTDIR:  $LINE"
     done
 }
 
@@ -224,6 +231,41 @@ digcomp() {
 # Useful functions in test scripts
 #
 
+# keyfile_to_keys_section: helper function for keyfile_to_*_keys() which
+# converts keyfile data into a configuration section using the supplied
+# parameters
+keyfile_to_keys_section() {
+    section_name=$1
+    key_prefix=$2
+    shift
+    shift
+    echo "$section_name {"
+    for keyname in $*; do
+        awk '!/^; /{
+            printf "\t\""$1"\" "
+            printf "'"$key_prefix"'"
+            printf $4 " " $5 " " $6 " \""
+            for (i=7; i<=NF; i++) printf $i
+            printf "\";\n"
+        }' $keyname.key
+    done
+    echo "};"
+}
+
+# keyfile_to_trusted_keys: convert key data contained in the keyfile(s)
+# provided to a "trusted-keys" section suitable for including in a
+# resolver's configuration file
+keyfile_to_trusted_keys() {
+    keyfile_to_keys_section "trusted-keys" "" $*
+}
+
+# keyfile_to_managed_keys: convert key data contained in the keyfile(s)
+# provided to a "managed-keys" section suitable for including in a
+# resolver's configuration file
+keyfile_to_managed_keys() {
+    keyfile_to_keys_section "managed-keys" "initial-key " $*
+}
+
 # nextpart: read everything that's been appended to a file since the
 # last time 'nextpart' was called.
 nextpart () {

bin/tests/system/cookie/clean.sh

@@ -13,3 +13,4 @@ rm -f ns1/named_dump.db
 rm -f ns*/named.memstats
 rm -f ns*/named.run
 rm -f ns*/named.lock
+rm -f ns*/managed-keys.bind*

bin/tests/system/cookie/ns1/named.conf.in

@@ -27,6 +27,7 @@ options {
 	listen-on { 10.53.0.1; };
 	listen-on-v6 { none; };
 	recursion yes;
+	dnssec-validation yes;
 	deny-answer-addresses { 192.0.2.0/24; 2001:db8:beef::/48; }
 		 except-from { "example.org"; };
 	deny-answer-aliases { "example.org"; }

bin/tests/system/cookie/ns2/named.conf.in

@@ -18,6 +18,7 @@ options {
 	listen-on { 10.53.0.2; };
 	listen-on-v6 { none; };
 	recursion no;
+	dnssec-validation no;
 	send-cookie yes;
 	nocookie-udp-size 512;
 };

bin/tests/system/cookie/ns3/named.conf.in

@@ -27,6 +27,7 @@ options {
 	listen-on { 10.53.0.3; };
 	listen-on-v6 { none; };
 	recursion yes;
+	dnssec-validation yes;
 	deny-answer-addresses { 192.0.2.0/24; 2001:db8:beef::/48; }
 		 except-from { "example.org"; };
 	deny-answer-aliases { "example.org"; }

bin/tests/system/cookie/ns4/named.conf.in

@@ -27,6 +27,7 @@ options {
 	listen-on { 10.53.0.4; };
 	listen-on-v6 { none; };
 	recursion yes;
+	dnssec-validation yes;
 	cookie-algorithm sha1;
 	cookie-secret "569d36a6cc27d6bf55502183302ba352745255a2";
 	require-server-cookie yes;