Merge branch 'prep-release' into v9_11

prep for 9.11.11
2019-09-09 14:48:35 +00:00 · 2019-09-09 14:29:59 +00:00 · 2019-09-09 14:22:44 +00:00 · 2019-09-09 02:59:38 -04:00 · 2019-09-09 16:39:43 +10:00 · 2019-09-09 16:27:22 +10:00
1227 changed files with 34218 additions and 138819 deletions
@@ -1,3 +1,5 @@
 *.sln.in eol=crlf
 *.vcxproj.in eol=crlf
 *.vcxproj.filters.in eol=crlf
+*.dsw eol=crlf
+win32utils/**.txt eol=crlf
@@ -1,62 +1,58 @@
-Makefile
-config.log
-config.h
-config.cache
-config.status
-libtool
-/isc-config.sh
-/configure.lineno
-autom4te.cache/
-*.o
-*.lo
-*.so
-*.a
-*.la
-*.gcno
-*.gcda
-*_test
 *-symtbl.c
-timestamp
-ans.run
-lwresd.run
-named.run
-named.memstats
-gen.dSYM/
-.libs/
+*.a
+*.gcda
+*.gcno
+*.la
+*.lo
+*.o
+*.orig
+*.plist/ # ccc-analyzer store its results in .plist directories
+*.rej
+*.so
+*_test
+*~
+.ccache/
+.cproject
 .deps/
 .dirstamp
-unit/atf-src/atf-c++/atf-c++.pc
-unit/atf-src/atf-c/atf-c.pc
-unit/atf-src/atf-c/defs.h
-unit/atf-src/atf-c/detail/process_helpers
-unit/atf-src/atf-config/atf-config
-unit/atf-src/atf-report/atf-report
-unit/atf-src/atf-report/fail_helper
-unit/atf-src/atf-report/misc_helpers
-unit/atf-src/atf-report/pass_helper
-unit/atf-src/atf-run/atf-run
-unit/atf-src/atf-run/bad_metadata_helper
-unit/atf-src/atf-run/expect_helpers
-unit/atf-src/atf-run/misc_helpers
-unit/atf-src/atf-run/pass_helper
-unit/atf-src/atf-run/several_tcs_helper
-unit/atf-src/atf-run/zero_tcs_helper
-unit/atf-src/atf-sh/atf-check
-unit/atf-src/atf-sh/atf-sh
-unit/atf-src/atf-sh/misc_helpers
-unit/atf-src/atf-version/atf-version
-unit/atf-src/atf-version/revision.h
-unit/atf-src/atf-version/revision.h.stamp
-unit/atf-src/bconfig.h
-unit/atf-src/bootstrap/atconfig
-unit/atf-src/doc/atf.7
-unit/atf-src/stamp-h1
-unit/atf-src/test-programs/c_helpers
-unit/atf-src/test-programs/cpp_helpers
-unit/atf-src/test-programs/sh_helpers
-# ccc-analyzer store its results in .plist directories
-*.plist/
-*~
+.libs/
 .project
-.cproject
 .settings
+/aclocal.m4
+/ar-lib
+/autom4te.cache/
+/bind.keys.h
+/compile
+/config.cache
+/config.guess
+/config.h
+/config.h.in
+/config.log
+/config.status
+/config.sub
+/configure
+/configure.lineno
+/depcomp
+/install-sh
+/isc-config.sh
+/libltdl/*
+/libtool
+/ltmain.sh
+/m4/libtool.m4
+/m4/ltargz.m4
+/m4/ltdl.m4
+/m4/ltoptions.m4
+/m4/ltsugar.m4
+/m4/ltversion.m4
+/m4/lt~obsolete.m4
+/missing
+/py-compile
+/stamp-h1
+/test-driver
+Makefile
+ans.run
+gen.dSYM/
+kyua.log
+named.memstats
+named.run
+timestamp
@@ -1,167 +1,227 @@
 variables:
+  # Not normally needed, but may be if some script uses `apt-get install`.
  DEBIAN_FRONTEND: noninteractive
+  # Locale settings do not affect the build, but might affect tests.
  LC_ALL: C
-  DOCKER_DRIVER: overlay2
-  CI_REGISTRY_IMAGE: oerdnj/bind9
+
+  CI_REGISTRY_IMAGE: registry.gitlab.isc.org/isc-projects/images/bind9
  CCACHE_DIR: "/ccache"
+  SOFTHSM2_CONF: "/var/tmp/softhsm2/softhsm2.conf"
+
+  # VirtualBox driver needs to set build_dir to "/builds" in gitlab-runner.toml
+  KYUA_RESULT: "$CI_PROJECT_DIR/kyua.results"
+
+  BUILD_PARALLEL_JOBS: 6
+  TEST_PARALLEL_JOBS: 6

 stages:
  - precheck
  - build
-  - test
+  - unit
+  - system
+  - docs
+  - push
+
+### Runner Tag Templates
+
+.linux-amd64: &linux_amd64
+  tags:
+    - linux
+    - amd64
+
+.linux-i386: &linux_i386
+  tags:
+    - linux
+    - i386
+
+### Docker Image Templates
+
+# Alpine Linux
+
+.alpine-3.10-amd64: &alpine_3_10_amd64_image
+  image: "$CI_REGISTRY_IMAGE:alpine-3.10-amd64"
+  <<: *linux_amd64
+
+# CentOS

 .centos-centos6-amd64: &centos_centos6_amd64_image
  image: "$CI_REGISTRY_IMAGE:centos-centos6-amd64"
-  tags:
-    - linux
-    - docker
-    - amd64
+  <<: *linux_amd64

 .centos-centos7-amd64: &centos_centos7_amd64_image
  image: "$CI_REGISTRY_IMAGE:centos-centos7-amd64"
-  tags:
-    - linux
-    - docker
-    - amd64
+  <<: *linux_amd64
+
+# Debian

 .debian-jessie-amd64: &debian_jessie_amd64_image
  image: "$CI_REGISTRY_IMAGE:debian-jessie-amd64"
-  tags:
-    - linux
-    - docker
-    - amd64
-
-.debian-jessie-i386: &debian_jessie_i386_image
-  image: "$CI_REGISTRY_IMAGE:debian-jessie-i386"
-  tags:
-    - linux
-    - docker
-    - i386
+  <<: *linux_amd64

 .debian-stretch-amd64: &debian_stretch_amd64_image
  image: "$CI_REGISTRY_IMAGE:debian-stretch-amd64"
-  tags:
-    - linux
-    - docker
-    - amd64
+  <<: *linux_amd64

-.debian-stretch-i386:: &debian_stretch_i386_image
+.debian-stretch-i386: &debian_stretch_i386_image
  image: "$CI_REGISTRY_IMAGE:debian-stretch-i386"
-  tags:
-    - linux
-    - docker
-    - i386
+  <<: *linux_i386

 .debian-buster-amd64: &debian_buster_amd64_image
  image: "$CI_REGISTRY_IMAGE:debian-buster-amd64"
-  tags:
-    - linux
-    - docker
-    - amd64
-
-.debian-buster-i386:: &debian_buster_i386_image
-  image: "$CI_REGISTRY_IMAGE:debian-buster-i386"
-  tags:
-    - linux
-    - docker
-    - i386
+  <<: *linux_i386

 .debian-sid-amd64: &debian_sid_amd64_image
  image: "$CI_REGISTRY_IMAGE:debian-sid-amd64"
-  tags:
-    - linux
-    - docker
-    - amd64
+  <<: *linux_amd64

 .debian-sid-i386: &debian_sid_i386_image
  image: "$CI_REGISTRY_IMAGE:debian-sid-i386"
-  tags:
-    - linux
-    - docker
-    - i386
+  <<: *linux_i386

-.ubuntu-trusty-amd64: &ubuntu_trusty_amd64_image
-  image: "$CI_REGISTRY_IMAGE:ubuntu-trusty-amd64"
-  tags:
-    - linux
-    - docker
-    - amd64
+# Fedora

-.ubuntu-trusty-i386: &ubuntu_trusty_i386_image
-  image: "$CI_REGISTRY_IMAGE:ubuntu-trusty-i386"
-  tags:
-    - linux
-    - docker
-    - i386
+.fedora-30-amd64: &fedora_30_amd64_image
+  image: "$CI_REGISTRY_IMAGE:fedora-30-amd64"
+  <<: *linux_amd64
+
+# Ubuntu

 .ubuntu-xenial-amd64: &ubuntu_xenial_amd64_image
  image: "$CI_REGISTRY_IMAGE:ubuntu-xenial-amd64"
-  tags:
-    - linux
-    - docker
-    - amd64
+  <<: *linux_amd64

 .ubuntu-xenial-i386: &ubuntu_xenial_i386_image
  image: "$CI_REGISTRY_IMAGE:ubuntu-xenial-i386"
-  tags:
-    - linux
-    - docker
-    - i386
+  <<: *linux_i386
+
+.ubuntu-bionic-amd64: &ubuntu_bionic_amd64_image
+  image: "$CI_REGISTRY_IMAGE:ubuntu-bionic-amd64"
+  <<: *linux_amd64
+
+.ubuntu-bionic-i386: &ubuntu_bionic_i386_image
+  image: "$CI_REGISTRY_IMAGE:ubuntu-bionic-i386"
+  <<: *linux_i386
+
+### Job Templates
+
+.default-triggering-rules: &default_triggering_rules
+  only:
+    - merge_requests
+    - tags
+    - web
+
+.precheck: &precheck_job
+  <<: *default_triggering_rules
+  <<: *debian_sid_amd64_image
+  stage: precheck
+
+.autoconf: &autoconf_job
+  <<: *default_triggering_rules
+  <<: *debian_sid_amd64_image
+  stage: precheck
+  script:
+    - autoreconf -fi
+  artifacts:
+    untracked: true
+    expire_in: "1 hour"
+
+.configure: &configure |
+    ./configure \
+    --disable-maintainer-mode \
+    --enable-developer \
+    --with-randomdev=/dev/urandom \
+    --with-libtool \
+    --with-geoip2=auto \
+    --disable-static \
+    --with-cmocka \
+    --with-libxml2 \
+    --with-json \
+    --prefix=$HOME/.local \
+    --without-make-clean \
+    $EXTRA_CONFIGURE \
+    || cat config.log

 .build: &build_job
+  <<: *default_triggering_rules
  stage: build
  before_script:
    - test -w "${CCACHE_DIR}" && export PATH="/usr/lib/ccache:${PATH}"
-    - autoreconf -fi
  script:
-    - ./configure --enable-developer --with-libtool --disable-static --with-atf=/usr --with-libidn2 --prefix=$HOME/.local --without-make-clean "${EXTRA_CONFIGURE}" || cat config.log
-    - make -j${PARALLEL_JOBS_BUILD:-1} -k all V=1
+    - *configure
+    - make -j${BUILD_PARALLEL_JOBS:-1} -k all V=1
+    - test -z "${RUN_MAKE_INSTALL}" || make install
+  dependencies:
+    - autoreconf:sid:amd64
+  needs:
+    - autoreconf:sid:amd64
  artifacts:
-    expire_in: '1 hour'
    untracked: true
+    expire_in: "1 hour"

-.install_test: &install_test_job
-  stage: test
-  before_script:
-    - mkdir $HOME/.local
-  script:
-    - make install
+.setup_interfaces: &setup_interfaces |
+    if [ "$(id -u)" -eq "0" ]; then
+      sh -x bin/tests/system/ifconfig.sh up;
+    else
+      sudo sh -x bin/tests/system/ifconfig.sh up;
+    fi
+
+.setup_softhsm: &setup_softhsm |
+    sh -x util/prepare-softhsm2.sh

 .system_test: &system_test_job
-  stage: test
+  <<: *default_triggering_rules
+  stage: system
+  retry: 2
  before_script:
-    - rm -rf .ccache
-    - bash -x bin/tests/system/ifconfig.sh up
+    - *setup_interfaces
+    - *setup_softhsm
  script:
    - ( cd bin/tests && make -j${TEST_PARALLEL_JOBS:-1} -k test V=1 )
    - test -s bin/tests/system/systests.output
  artifacts:
    untracked: true
-    expire_in: '1 week'
+    expire_in: "1 week"
    when: on_failure

+.kyua_report: &kyua_report_html |
+  kyua report-html \
+       --force \
+       --results-file "$KYUA_RESULT" \
+       --results-filter "" \
+       --output kyua_html
+
 .unit_test: &unit_test_job
-  stage: test
+  <<: *default_triggering_rules
+  stage: unit
  before_script:
-    - export KYUA_RESULT="$CI_PROJECT_DIR/kyua.results"
+    - *setup_softhsm
  script:
    - make unit
  after_script:
-    - kyua report-html --force --results-file kyua.results --results-filter "" --output kyua_html
+    - *kyua_report_html
  artifacts:
    paths:
-    - atf.out
-    - kyua.log
-    - kyua.results
-    - kyua_html/
-    expire_in: '1 week'
+      - kyua.log
+      - kyua.results
+      - kyua_html/
+    expire_in: "1 week"
    when: on_failure

-precheck:debian:sid:amd64:
-  <<: *debian_sid_amd64_image
-  stage: precheck
+### Job Definitions
+
+# Jobs in the precheck stage
+
+autoreconf:sid:amd64:
+  <<: *autoconf_job
+
+misc:sid:amd64:
+  <<: *precheck_job
  script:
+    - sh util/check-ans-prereq.sh
    - sh util/checklibs.sh > checklibs.out
+    - sh util/tabify-changes < CHANGES > CHANGES.tmp
+    - diff -urNap CHANGES CHANGES.tmp
+    - rm CHANGES.tmp
    - perl util/check-changes CHANGES
    - perl -w util/merge_copyrights
    - diff -urNap util/copyrights util/newcopyrights
@@ -170,110 +230,435 @@ precheck:debian:sid:amd64:
    - if test "$(git status --porcelain | grep -Ev '\?\?' | wc -l)" -gt "0"; then git status --short; exit 1; fi
    - xmllint --noout --nonet `git ls-files '*.xml' '*.docbook'`
    - xmllint --noout --nonet --html `git ls-files '*.html'`
+    - sh util/check-win32util-configure
  artifacts:
    paths:
-    - util/newcopyrights
-    - checklibs.out
-    expire_in: '1 week'
+      - util/newcopyrights
+      - checklibs.out
+    expire_in: "1 week"
    when: on_failure

-#build:debian:jessie:amd64:
-#  <<: *debian_jessie_amd64_image
-#  <<: *build_job
-#
-#build:debian:jessie:i386:
-#  <<: *debian_jessie_i386_image
-#  <<: *build_job
-#
-#build:debian:stretch:amd64:
-#  <<: *debian_stretch_amd64_image
-#  <<: *build_job
-#
-#build:debian:buster:i386:
-#  <<: *debian_buster_i386_image
-#  <<: *build_job
-#
-#build:ubuntu:trusty:amd64:
-#  <<: *ubuntu_trusty_amd64_image
-#  <<: *build_job
-#
-#build:ubuntu:xenial:i386:
-#  <<: *ubuntu_xenial_i386_image
-#  <<: *build_job
+🐞:sid:amd64:
+  <<: *precheck_job
+  script:
+    - util/check-cocci
+    - if test "$(git status --porcelain | grep -Ev '\?\?' | wc -l)" -gt "0"; then git status --short; exit 1; fi

-build:centos:centos6:amd64:
+# Jobs for doc builds on Debian Sid (amd64)
+
+docs:sid:amd64:
+  <<: *debian_sid_amd64_image
+  stage: docs
+  script:
+    - ./configure || cat config.log
+    - make -C doc/misc docbook
+    - make -C doc/arm Bv9ARM.html
+  dependencies:
+    - autoreconf:sid:amd64
+  needs:
+    - autoreconf:sid:amd64
+  artifacts:
+    paths:
+      - doc/arm/
+    expire_in: "1 month"
+  only:
+    - merge_requests
+    - tags
+    - web
+    - master@isc-projects/bind9
+    - /^v9_[1-9][0-9]$/@isc-projects/bind9
+
+push:docs:sid:amd64:
+  <<: *debian_sid_amd64_image
+  stage: push
+  dependencies: []
+  script:
+    - curl -X POST -F token=$GITLAB_PAGES_DOCS_TRIGGER_TOKEN -F ref=master $GITLAB_PAGES_DOCS_TRIGGER_URL
+  only:
+    - master@isc-projects/bind9
+    - /^v9_[1-9][0-9]$/@isc-projects/bind9
+
+# Jobs for regular GCC builds on Alpine Linux 3.10 (amd64)
+
+gcc:alpine3.10:amd64:
  variables:
    CC: gcc
    CFLAGS: "-Wall -Wextra -O2 -g"
-    EXTRA_CONFIGURE: "--disable-warn-error"
-  <<: *centos_centos6_amd64_image
+    EXTRA_CONFIGURE: "--enable-dnstap"
+  <<: *alpine_3_10_amd64_image
  <<: *build_job

-build:centos:centos7:amd64:
+system:gcc:alpine3.10:amd64:
+  <<: *alpine_3_10_amd64_image
+  <<: *system_test_job
+  dependencies:
+    - gcc:alpine3.10:amd64
+  needs: ["gcc:alpine3.10:amd64"]
+
+unit:gcc:alpine3.10:amd64:
+  <<: *alpine_3_10_amd64_image
+  <<: *unit_test_job
+  dependencies:
+    - gcc:alpine3.10:amd64
+  needs: ["gcc:alpine3.10:amd64"]
+
+# Jobs for regular GCC builds on CentOS 6 (amd64)
+
+gcc:centos6:amd64:
  variables:
    CC: gcc
-    CFLAGS: "-Wall -Wextra -O2 -g -DDIG_SIGCHASE=1"
-  <<: *centos_centos7_amd64_image
-  <<: *build_job
-
-build:debian:sid:amd64:
-  <<: *debian_sid_amd64_image
-  <<: *build_job
-    
-build:debian:sid:i386:
-  <<: *debian_sid_i386_image
-  <<: *build_job
-
-unittest:centos:centos6:amd64:
+    CFLAGS: "-Wall -Wextra -O2 -g"
+    EXTRA_CONFIGURE: "--with-libidn2 --disable-warn-error"
  <<: *centos_centos6_amd64_image
-  <<: *unit_test_job
-  dependencies:
-    - build:centos:centos6:amd64
+  <<: *build_job

-unittest:centos:centos7:amd64:
-  <<: *centos_centos7_amd64_image
-  <<: *unit_test_job
-  dependencies:
-    - build:centos:centos7:amd64
-
-unittest:debian:sid:amd64:
-  <<: *debian_sid_amd64_image
-  <<: *unit_test_job
-  dependencies:
-    - build:debian:sid:amd64
-    
-unittest:debian:sid:i386:
-  <<: *debian_sid_i386_image
-  <<: *unit_test_job
-  dependencies:
-    - build:debian:sid:i386
-
-systemtest:centos:centos6:amd64:
+system:gcc:centos6:amd64:
  <<: *centos_centos6_amd64_image
  <<: *system_test_job
  dependencies:
-    - build:centos:centos6:amd64
+    - gcc:centos6:amd64
+  needs: ["gcc:centos6:amd64"]

-systemtest:centos:centos7:amd64:
+unit:gcc:centos6:amd64:
+  <<: *centos_centos6_amd64_image
+  <<: *unit_test_job
+  dependencies:
+    - gcc:centos6:amd64
+  needs: ["gcc:centos6:amd64"]
+
+# Jobs for regular GCC builds on CentOS 7 (amd64)
+
+gcc:centos7:amd64:
+  variables:
+    CC: gcc
+    CFLAGS: "-Wall -Wextra -O2 -g"
+    EXTRA_CONFIGURE: "--enable-dnstap --with-libidn2"
+  <<: *centos_centos7_amd64_image
+  <<: *build_job
+
+system:gcc:centos7:amd64:
  <<: *centos_centos7_amd64_image
  <<: *system_test_job
  dependencies:
-    - build:centos:centos7:amd64
+    - gcc:centos7:amd64
+  needs: ["gcc:centos7:amd64"]

-systemtest:debian:sid:amd64:
+unit:gcc:centos7:amd64:
+  <<: *centos_centos7_amd64_image
+  <<: *unit_test_job
+  dependencies:
+    - gcc:centos7:amd64
+  needs: ["gcc:centos7:amd64"]
+
+# Jobs for regular GCC builds on Debian 8 Jessie (amd64)
+
+gcc:jessie:amd64:
+  variables:
+    CC: gcc
+    CFLAGS: "-Wall -Wextra -O2 -g"
+    EXTRA_CONFIGURE: "--without-cmocka --with-python --disable-geoip"
+  <<: *debian_jessie_amd64_image
+  <<: *build_job
+
+system:gcc:jessie:amd64:
+  <<: *debian_jessie_amd64_image
+  <<: *system_test_job
+  dependencies:
+    - gcc:jessie:amd64
+  needs: ["gcc:jessie:amd64"]
+
+unit:gcc:jessie:amd64:
+  <<: *debian_jessie_amd64_image
+  <<: *unit_test_job
+  dependencies:
+    - gcc:jessie:amd64
+  needs: ["gcc:jessie:amd64"]
+
+# Jobs for regular GCC builds on Debian 9 Stretch (amd64)
+
+gcc:stretch:amd64:
+  variables:
+    CC: gcc
+    CFLAGS: "-Wall -Wextra -O2 -g"
+  <<: *debian_stretch_amd64_image
+  <<: *build_job
+
+system:gcc:stretch:amd64:
+  <<: *debian_stretch_amd64_image
+  <<: *system_test_job
+  dependencies:
+    - gcc:stretch:amd64
+  needs: ["gcc:stretch:amd64"]
+
+unit:gcc:stretch:amd64:
+  <<: *debian_stretch_amd64_image
+  <<: *unit_test_job
+  dependencies:
+    - gcc:stretch:amd64
+  needs: ["gcc:stretch:amd64"]
+
+# Jobs for regular GCC builds on Debian 10 Buster (amd64)
+
+gcc:buster:amd64:
+  variables:
+    CC: gcc
+    CFLAGS: "-Wall -Wextra -O2 -g"
+  <<: *debian_buster_amd64_image
+  <<: *build_job
+
+system:gcc:buster:amd64:
+  <<: *debian_buster_amd64_image
+  <<: *system_test_job
+  dependencies:
+    - gcc:buster:amd64
+  needs: ["gcc:buster:amd64"]
+
+unit:gcc:buster:amd64:
+  <<: *debian_buster_amd64_image
+  <<: *unit_test_job
+  dependencies:
+    - gcc:buster:amd64
+  needs: ["gcc:buster:amd64"]
+
+# Jobs for regular GCC builds on Debian Sid (amd64)
+
+gcc:sid:amd64:
+  variables:
+    CC: gcc
+    CFLAGS: "-Wall -Wextra -O3 -g"
+    EXTRA_CONFIGURE: "--enable-dnstap --with-libidn2"
+    RUN_MAKE_INSTALL: 1
+  <<: *debian_sid_amd64_image
+  <<: *build_job
+
+system:gcc:sid:amd64:
  <<: *debian_sid_amd64_image
  <<: *system_test_job
  dependencies:
-    - build:debian:sid:amd64
-    
-systemtest:debian:sid:i386:
+    - gcc:sid:amd64
+  needs: ["gcc:sid:amd64"]
+
+unit:gcc:sid:amd64:
+  <<: *debian_sid_amd64_image
+  <<: *unit_test_job
+  dependencies:
+    - gcc:sid:amd64
+  needs: ["gcc:sid:amd64"]
+
+# Jobs for regular GCC builds on Debian Sid (i386)
+
+gcc:sid:i386:
+  variables:
+    CC: gcc
+    CFLAGS: "-Wall -Wextra -O3 -g"
+    EXTRA_CONFIGURE: "--enable-dnstap --with-libidn2 --without-python"
+  <<: *debian_sid_i386_image
+  <<: *build_job
+
+system:gcc:sid:i386:
  <<: *debian_sid_i386_image
  <<: *system_test_job
  dependencies:
-    - build:debian:sid:i386
+    - gcc:sid:i386
+  needs: ["gcc:sid:i386"]

-install:debian:sid:amd64:
-  <<: *debian_sid_amd64_image
-  <<: *install_test_job
+unit:gcc:sid:i386:
+  <<: *debian_sid_i386_image
+  <<: *unit_test_job
  dependencies:
-    - build:debian:sid:amd64
+    - gcc:sid:i386
+  needs: ["gcc:sid:i386"]
+
+# Jobs for regular GCC builds on Fedora 30 (amd64)
+
+gcc:fedora30:amd64:
+  variables:
+    CC: gcc
+    CFLAGS: "-Wall -Wextra -O2 -g"
+    EXTRA_CONFIGURE: "--with-libidn2"
+  <<: *fedora_30_amd64_image
+  <<: *build_job
+
+system:gcc:fedora30:amd64:
+  <<: *fedora_30_amd64_image
+  <<: *system_test_job
+  dependencies:
+    - gcc:fedora30:amd64
+  needs: ["gcc:fedora30:amd64"]
+
+unit:gcc:fedora30:amd64:
+  <<: *fedora_30_amd64_image
+  <<: *unit_test_job
+  dependencies:
+    - gcc:fedora30:amd64
+  needs: ["gcc:fedora30:amd64"]
+
+# Jobs for regular GCC builds on Ubuntu 16.04 Xenial Xerus (amd64)
+
+gcc:xenial:amd64:
+  variables:
+    CC: gcc
+    CFLAGS: "-Wall -Wextra -O2 -g"
+    EXTRA_CONFIGURE: "--disable-geoip"
+  <<: *ubuntu_xenial_amd64_image
+  <<: *build_job
+
+system:gcc:xenial:amd64:
+  <<: *ubuntu_xenial_amd64_image
+  <<: *system_test_job
+  dependencies:
+    - gcc:xenial:amd64
+  needs: ["gcc:xenial:amd64"]
+
+unit:gcc:xenial:amd64:
+  <<: *ubuntu_xenial_amd64_image
+  <<: *unit_test_job
+  dependencies:
+    - gcc:xenial:amd64
+  needs: ["gcc:xenial:amd64"]
+
+# Jobs for regular GCC builds on Ubuntu 18.04 Bionic Beaver (amd64)
+
+gcc:bionic:amd64:
+  variables:
+    CC: gcc
+    CFLAGS: "-Wall -Wextra -O2 -g"
+    EXTRA_CONFIGURE: "--with-libidn2"
+  <<: *ubuntu_bionic_amd64_image
+  <<: *build_job
+
+system:gcc:bionic:amd64:
+  <<: *ubuntu_bionic_amd64_image
+  <<: *system_test_job
+  dependencies:
+    - gcc:bionic:amd64
+  needs: ["gcc:bionic:amd64"]
+
+unit:gcc:bionic:amd64:
+  <<: *ubuntu_bionic_amd64_image
+  <<: *unit_test_job
+  dependencies:
+    - gcc:bionic:amd64
+  needs: ["gcc:bionic:amd64"]
+
+# Jobs for GCC builds with ASAN enabled on Debian Sid (amd64)
+
+asan:sid:amd64:
+  variables:
+    CC: gcc
+    CFLAGS: "-Wall -Wextra -O2 -g -fsanitize=address,undefined -DISC_MEM_USE_INTERNAL_MALLOC=0"
+    LDFLAGS: "-fsanitize=address,undefined"
+    EXTRA_CONFIGURE: "--with-libidn2"
+  <<: *debian_sid_amd64_image
+  <<: *build_job
+
+system:asan:sid:amd64:
+  <<: *debian_sid_amd64_image
+  <<: *system_test_job
+  dependencies:
+    - asan:sid:amd64
+  needs: ["asan:sid:amd64"]
+
+unit:asan:sid:amd64:
+  <<: *debian_sid_amd64_image
+  <<: *unit_test_job
+  dependencies:
+    - asan:sid:amd64
+  needs: ["asan:sid:amd64"]
+
+# Jobs for Clang builds on Debian Stretch (amd64)
+
+clang:stretch:amd64:
+  variables:
+    CC: clang
+    CFLAGS: "-Wall -Wextra -Wenum-conversion -O2 -g"
+    EXTRA_CONFIGURE: "--with-python=python3"
+  <<: *debian_stretch_amd64_image
+  <<: *build_job
+
+unit:clang:stretch:amd64:
+  <<: *debian_stretch_amd64_image
+  <<: *unit_test_job
+  dependencies:
+    - clang:stretch:amd64
+  needs: ["clang:stretch:amd64"]
+
+# Jobs for Clang builds on Debian Stretch (i386)
+
+clang:stretch:i386:
+  variables:
+    CC: clang
+    CFLAGS: "-Wall -Wextra -Wenum-conversion -O2 -g"
+    EXTRA_CONFIGURE: "--with-python=python2"
+  <<: *debian_stretch_i386_image
+  <<: *build_job
+
+# Jobs for nocrypt builds on Debian Sid (amd64)
+
+nocrypto:sid:amd64:
+  variables:
+    CC: gcc
+    CFLAGS: "-Wall -Wextra -O2 -g"
+    EXTRA_CONFIGURE: "--with-openssl=no"
+  <<: *debian_sid_amd64_image
+  <<: *build_job
+
+system:nocrypto:sid:amd64:
+  <<: *debian_sid_amd64_image
+  <<: *system_test_job
+  dependencies:
+    - nocrypto:sid:amd64
+
+unit:nocrypto:sid:amd64:
+  <<: *debian_sid_amd64_image
+  <<: *unit_test_job
+  dependencies:
+    - nocrypto:sid:amd64
+
+# Jobs for PKCS#11-enabled GCC builds on Debian Sid (amd64)
+
+pkcs11:sid:amd64:
+  variables:
+    CC: gcc
+    CFLAGS: "-Wall -Wextra -O2 -g"
+    EXTRA_CONFIGURE: "--enable-native-pkcs11 --with-pkcs11=/usr/lib/softhsm/libsofthsm2.so"
+  <<: *debian_sid_amd64_image
+  <<: *build_job
+
+system:pkcs11:sid:amd64:
+  <<: *debian_sid_amd64_image
+  <<: *system_test_job
+  dependencies:
+    - pkcs11:sid:amd64
+  needs: ["pkcs11:sid:amd64"]
+
+unit:pkcs11:sid:amd64:
+  <<: *debian_sid_amd64_image
+  <<: *unit_test_job
+  dependencies:
+    - pkcs11:sid:amd64
+  needs: ["pkcs11:sid:amd64"]
+
+# Jobs with libtool disabled
+
+nolibtool:sid:amd64:
+  variables:
+    CC: gcc
+    CFLAGS: "-Wall -Wextra -Og -g"
+    EXTRA_CONFIGURE: "--with-libidn2 --without-libtool --with-dlopen"
+  <<: *debian_sid_amd64_image
+  <<: *build_job
+
+system:nolibtool:sid:amd64:
+  <<: *debian_sid_amd64_image
+  <<: *system_test_job
+  dependencies:
+    - nolibtool:sid:amd64
+  needs: ["nolibtool:sid:amd64"]
+
+unit:nolibtool:sid:amd64:
+  <<: *debian_sid_amd64_image
+  <<: *unit_test_job
+  dependencies:
+    - nolibtool:sid:amd64
+  needs: ["nolibtool:sid:amd64"]
@@ -1,5 +0,0 @@
-Content-Type: application/X-atf-atffile; version="1"
-
-prop: test-suite = bind9
-
-tp: lib
@@ -1,28 +1,432 @@
-	--- 9.11.5-P4 released ---
+	--- 9.11.11 released ---

-	--- 9.11.5-P3 released (withdrawn) ---
+5291.	[cleanup]	Revert change #4825 as it was not appropriate for 9.11.
+			[GL #1213]
+
+5290.	[bug]		Address potential NULL pointer dereference in
+			isc_ht_find. [GL #1211]
+
+5287.	[bug]		Address potential NULL pointer dereference. [GL #1208]
+
+5286.	[contrib]	Address potential NULL pointer dereferences in
+			dlz_mysqldyn_mod.c. [GL #1207]
+
+5285.	[port]		win32: implement "-T maxudpXXX". [GL #837]
+
+5282.	[bug]		Fixed a bug in searching for possible wildcard matches
+			for query names in the RPZ summary database. [GL #1146]
+
+5281.	[cleanup]	Don't escape commas when reporting named's command
+			line. [GL #1189]
+
+5280.	[protocol]	Add support for displaying EDNS option LLQ. [GL #1201]
+
+5279.	[bug]		When loading, reject zones containing CDS or CDNSKEY
+			RRsets at the zone apex if they would cause DNSSEC
+			validation failures if published in the parent zone
+			as the DS RRset.  [GL #1187]
+
+	--- 9.11.10 released ---
+
+5275.	[bug]		Mark DS records included in referral messages
+			with trust level "pending" so that they can be
+			validated and cached immediately, with no need to
+			re-query. [GL #964]
+
+5273.	[bug]		Check that bits [64..71] of a dns64 prefix are zero.
+			[GL #1159]
+
+5269.	[port]		cygwin: can return ETIMEDOUT on connect() with a
+			non-blocking socket. [GL #1133]
+
+5268.	[bug]		named could crash during configuration if
+			configured to use "geoip continent" ACLs with
+			legacy GeoIP. [GL #1163]
+
+5266.	[bug]		named-checkconf failed to report dnstap-output
+			missing from named.conf when dnstap was specified.
+			[GL #1136]
+
+5265.	[bug]		DNS64 and RPZ nodata (CNAME *.) rules interacted badly
+			[GL #1106]
+
+5264.	[func]		New DNS Cookie algorithm - siphash24 - has been added to
+			BIND 9. [GL #605]
+
+	--- 9.11.9 released ---
+
+5260.	[bug]		dnstap-read was producing malformed output for large
+			packets. [GL #1093]
+
+5258.	[func]		Added support for the GeoIP2 API from MaxMind,
+			when BIND is compiled using "configure --with-geoip2".
+			The legacy GeoIP API can be enabled by using
+			"configure --with-geoip" instead. These options
+			cannot be used together.
+
+			Certain geoip ACL settings that were available with
+			legacy GeoIP are not available when using GeoIP2.
+			See the ARM for details. [GL #182]
+
+5257.	[bug]		Some statistics data was not being displayed.
+			Add shading to the zone tables. [GL #1030]
+
+5256.	[bug]		Ensure that glue records are included in root
+			priming responses if "minimal-responses" is not
+			set to "yes". [GL #1092]
+
+5255.	[bug]		Errors encountered while reloading inline-signing
+			zones could be ignored, causing the zone content to
+			be left in an incompletely updated state rather than
+			reverted. [GL #1109]
+
+5253.	[port]		Support platforms that don't define ULLONG_MAX.
+			[GL #1098]
+
+5249.	[bug]		Fix a possible underflow in recursion clients
+			statistics when hitting recursive clients
+			soft quota. [GL #1067]
+
+	--- 9.11.8 released ---
+
+5244.	[security]	Fixed a race condition in dns_dispatch_getnext()
+			that could cause an assertion failure if a
+			significant number of incoming packets were
+			rejected. (CVE-2019-6471) [GL #942]
+
+5241.	[bug]		Fix Ed448 private and public key ASN.1 prefix blobs.
+			[GL #225]
+
+5237.	[bug]		Recurse to find the root server list with 'dig +trace'.
+			[GL #1028]
+
+	--- 9.11.7 released ---
+
+5233.	[bug]		Negative trust anchors did not work with "forward only;"
+			to validating resolvers. [GL #997]
+
+5232.	[bug]		Fix a high-load race/crash in isc_socket_cancel().
+			[GL #834]
+
+5231.	[protocol]	Add support for displaying CLIENT-TAG and SERVER-TAG.
+			[GL #960]
+
+5229.	[protocol]	Enforce known SSHFP fingerprint lengths. [GL #852]
+
+5228.	[cleanup]	If trusted-keys and managed-keys are configured
+			simultaneously for the same name, the key cannot
+			be rolled automatically. This configuration now
+			logs a warning. [GL #868]
+
+5224.	[bug]		Only test provide-ixfr on TCP streams. [GL #991]
+
+5222.	[bug]		'delv -t ANY' could leak memory. [GL #983]
+
+5221.	[test]		Enable parallel execution of system tests on
+			Windows. [GL !4101]
+
+5218.	[bug]		Conditionally include <dlfcn.h>. [GL #995]
+
+5214.	[bug]		win32: named now removes its lock file upon shutdown.
+			[GL #979]
+
+5213.	[bug]		win32: Eliminated a race which allowed named.exe running
+			as a service to be killed prematurely during shutdown.
+			[GL #978]
+
+5210.	[bug]		When dnstap is enabled and recursion is not
+			available, incoming queries are now logged
+			as "auth". Previously, this depended on whether
+			recursion was requested by the client, not on
+			whether recursion was available. [GL #963]
+
+5209.	[bug]		When update-check-ksk is true, add_sigs was not
+			considering offline keys, leaving record sets signed
+			with the incorrect type key. [GL #763]
+
+5208.	[test]		Run valid rdata wire encodings through totext+fromtext
+			and tofmttext+fromtext methods to check these methods.
+			[GL #899]
+
+5207.	[test]		Check delv and dig TTL values. [GL #965]
+
+5205.	[bug]		Enforce that a DS hash exists. [GL #899]
+
+5204.	[test]		Check that dns_rdata_fromtext() produces a record that
+			will be accepted by dns_rdata_fromwire(). [GL #852]
+
+5203.	[bug]		Enforce whether key rdata exists or not in KEY,
+			DNSKEY, CDNSKEY and RKEY. [GL #899]
+
+5197.	[bug]		dig could die in best effort mode on multiple SIG(0)
+			records. Similarly on multiple OPT and multiple TSIG
+			records. [GL #920]
+
+5194.	[bug]		Enforce non empty ZOMEMD hash. [GL #899]
+
+5193.	[bug]		EID and NIMLOC failed to do multi-line output
+			correctly. [GL #899]
+
+5192.	[bug]		configure --fips-mode failed. [GL #946]
+
+5191.	[port]		Darwin: dlzexternal/driver.so was not building.
+			[GL #948]
+
+5189.	[cleanup]	Remove revoked root DNSKEY from bind.keys. [GL #945]
+
+5187.	[test]		Set time zone before running any tests in dnstap_test.
+			[GL #940]
+
+5185.	[bug]		PKCS11 build could fail if ECDSA is not supported.
+			[GL #935]
+
+5184.	[bug]		Missing unlocks in sdlz.c. [GL #936]
+
+5182.	[bug]		Fix a high-load race/crash in handling of
+			isc_socket_close() in resolver. [GL #834]
+
+5180.	[bug]		delv now honors the operating system's preferred
+			ephemeral port range. [GL #925]
+
+5179.	[cleanup]	Replace some vague type declarations with the more
+			specific dns_secalg_t and dns_dsdigest_t.
+			Thanks to Tony Finch. [GL !1498]
+
+5178.	[bug]		Handle EDQUOT (disk quota) and ENOSPC (disk full)
+			errors when writing files. [GL #902]
+
+5176.	[tests]		Remove a dependency on libxml in statschannel system
+			test. [GL #926]
+
+5175.	[bug]		Fixed a problem with file input in dnssec-keymgr,
+			dnssec-coverage and dnssec-checkds when using
+			python3. [GL #882]
+
+5174.	[doc]		Tidy dnssec-keygen manual. [GL !1557]
+
+5172.	[bug]		nsupdate now honors the operating system's preferred
+			ephemeral port range. [GL #905]
+
+5170.	[test]		Added --with-dlz-filesystem to feature-test. [GL !1587]
+
+5168.	[test]		Do not crash on shutdown when RPZ fails to load.  Also,
+			keep previous version of the database if RPZ fails to
+			load. [GL #813]
+
+5167.	[bug]		nxdomain-redirect could sometimes lookup the wrong
+			redirect name. [GL #892]
+
+	--- 9.11.6-P1 released ---
+
+5200.	[security]	tcp-clients settings could be exceeded in some cases,
+			which could lead to exhaustion of file descriptors.
+			(CVE-2018-5743) [GL #615]
+
+	--- 9.11.6 released ---
+
+	--- 9.11.6rc1 released ---
+
+5166.	[port]		openbsd: Threads are now enabled by default. [GL !1548]
+
+5164.	[bug]		Correct errno to result translation in dlz filesystem
+			modules. [GL #884]
+
+5163.	[cleanup]	Out-of-tree builds failed --enable-dnstap. [GL #836]
+
+5162.	[cleanup]	Improve dnssec-keymgr manual. Thanks to Tony Finch.
+			[GL !1518]
+
+5160.	[contrib]	Added DNAME support to the DLZ LDAP schema. Also
+			fixed a compilation bug affecting several DLZ
+			modules. [GL #872]
+
+5159.	[bug]		dnssec-coverage was incorrectly ignoring
+			names specified on the command line without
+			trailing dots. [GL !1478]
+
+5158.	[protocol]	Add support for AMTRELAY and ZONEMD. [GL #867]
+
+5157.	[bug]		Nslookup now errors out if there are extra command
+			line arguments. [GL #207]
+
+5154.	[bug]		dig: process_opt could be called twice on the same
+			message leading to a assertion failure. [GL #860]
+
+5148.	[bug]		named did not sign the TKEY response. [GL #821]
+
+5147.	[bug]		dnssec-keymgr: Add a five-minute margin to better
+			handle key events close to 'now'. [GL #848]
+
+5146.	[bug]		Removed an unnecessary assert that could be
+			triggered from PKCS#11 modules during
+			deconstruction. [GL #841]
+
+5143.	[bug]		dnssec-keymgr and dnssec-coverage failed to find
+			key files for zone names ending in ".". [GL #560]

 5141.	[security]	Zone transfer controls for writable DLZ zones were
 			not effective as the allowzonexfr method was not being
 			called for such zones. (CVE-2019-6465) [GL #790]

-	--- 9.11.5-P2 released (withdrawn) ---
+5140.	[bug]		Don't immediately mark existing keys as inactive and
+			deleted when running dnssec-keymgr for the first
+			time. [GL #117]
+
+5139.	[bug]		If possible, don't use forwarders when priming.
+			This ensures we can get root server IP addresses
+			from priming query response glue, which may not
+			be present if the forwarding server is returning
+			minimal responses. [GL #752]
+
+5134.	[bug]		win32: WSAStartup was not called before getservbyname
+			was called. [GL #590]
+
+5133.	[bug]		'rndc managed-keys' didn't handle class and view
+			correctly and failed to add new lines between each
+			view. [GL !1327]
+
+5128.	[bug]		Refreshkeytime was not being updated for managed
+			keys zones. [GL #784]
+
+5127.	[bug]		rcode.c:maybe_numeric failed to handle NUL in text
+			regions. [GL #807]
+
+5126.	[bug]		Named incorrectly accepted empty base64 and hex encoded
+			fields when reading master files. [GL #807]
+
+5125.	[bug]		Allow for up to 100 records or 64k of data when caching
+			a negative response. [GL #804]
+
+5124.	[bug]		Named could incorrectly return FORMERR rather than
+			SERVFAIL. [GL #804]
+
+5123.	[bug]		dig could hang indefinitely after encountering an error
+			before creating a TCP socket. [GL #692]
+
+5122.	[bug]		In a "forward first;" configuration, a forwarder
+			timeout did not prevent that forwarder from being
+			queried again after falling back to full recursive
+			resolution. [GL #315]
+
+5121.	[contrib]	dlz_stub_driver.c fails to return ISC_R_NOTFOUND on none
+			matching zone names. [GL !1299]

 5118.	[security]	Named could crash if it is managing a key with
 			`managed-keys` and the authoritative zone is rolling
 			the key to an unsupported algorithm. (CVE-2018-5745)
 			[GL #780]

+5112.	[bug]		Named/named-checkconf could dump core if there was
+			a missing masters clause and a bad notify clause.
+			[GL #779]
+
+5111.	[bug]		Occluded DNSKEY records could make it into the
+			delegating NSEC/NSEC3 bitmap. [GL #742]
+
 5110.	[security]	Named leaked memory if there were multiple Key Tag
 			EDNS options present. (CVE-2018-5744) [GL #772]

-
-	--- 9.11.5-P1 released ---
-
 5108.	[bug]		Named could fail to determine bottom of zone when
 			removing out of date keys leading to invalid NSEC
 			and NSEC3 records being added to the zone. [GL #771]

+5107.	[bug]		'host -U' did not work. [GL #769]
+
+5104.	[cleanup]	Log clearer informational message when a catz zone
+			is overridden by a zone in named.conf.
+			Thanks to Tony Finch. [GL !1157]
+
+5103.	[bug]		Add missing design by contract tests to dns_catz*.
+			[GL #748]
+
+5102.	[bug]		dnssec-coverage failed to use the default TTL when
+			checking KSK deletion times leading to a exception.
+			[GL #585]
+
+5101.	[bug]		Fix default installation path for Python modules.
+			[GL #730]
+
+5098.	[func]		Failed memory allocations are now fatal. [GL #674]
+
+5097.	[cleanup]	Remove embedded ATF unit testing framework
+			from BIND source distribution.  [GL !875]
+
+5095.	[test]		Converted all unit tests from ATF to CMocka;
+			removed the source code for the ATF libraries.
+			Build with "configure --with-cmocka" to enable
+			unit testing. [GL #620]
+
+5094.	[func]		Add 'dig -r' to disable reading of .digrc. [GL !970]
+
+5092.	[bug]		Address memory leak on SIGTERM in nsupdate when using
+			GSS-TSIG. [GL #558]
+
+5090.	[bug]		dig and mdig failed to properly pre-parse dash value
+			pairs when value was a separate argument and started
+			with a dash. [GL #584]
+
+5088.	[bug]		dig/host/nslookup could crash when interrupted close to
+			a query timeout. [GL #599]
+
+5087.	[test]		Check that result tables are complete. [GL #676]
+
+5086.	[func]		Log of RPZ now includes the QTYPE and QCLASS. [GL #623]
+
+5084.	[func]		Add configure time detection of Utimaco HSM
+			and disable runtime md5/sha1 detection when it
+			compiled with it. [GL #656]
+
+5079.	[func]		Disable IDN processing in dig and nslookup
+			when not on a tty. [GL #653]
+
+5078.	[cleanup]	Require python components to be explicitly disabled if
+			python is not available on unix platforms. [GL #601]
+
+5076.	[bug]		"require-server-cookie" was not effective if
+			"rate-limit" was configured. [GL #617]
+
+5072.	[bug]		Add unit tests for isc_buffer_copyregion() and fix its
+			behavior for auto-reallocated buffers. [GL #644]
+
+5071.	[bug]		Comparison of NXT records was broken. [GL #631]
+
+5070.	[bug]		Record types which support a empty rdata field were
+			not handling the empty rdata field case. [GL #638]
+
+5066.	[cleanup]	Allow unquoted strings to be used as a zone names
+			in response-policy statements. [GL #641]
+
+5065.	[bug]		Only set IPV6_USE_MIN_MTU on IPv6. [GL #553]
+
+5064.	[test]		Initialize TZ environment variable before calling
+			dns_test_begin in dnstap_test. [GL #624]
+
+5061.	[protocol]	Add support for EID and NIMLOC. [GL #626]
+
+5060.	[bug]		GID, UID and UINFO could not be loaded using unknown
+			record format. [GL #627]
+
+5059.	[bug]		Display a per-view list of zones in the web interface.
+			[GL #427]
+
+5057.	[protocol]	Add support for ATMA. [GL #619]
+
+5051.	[doc]		Documentation incorrectly stated that the
+			"server-addresses" static-stub zone option accepts
+			custom port numbers. [GL #582]
+
+5042.	[test]		Make the chained delegations in reclimit behave
+			like they would in a regular name server. [GL  #578]
+
+5041.	[test]		The chain test contains a incomplete delegation.
+			[GL #568]
+
+5039.	[bug]		Named could fail to preserve owner name case of new
+			RRset. [GL #420]
+
+4887.	[test]		Enable the rpzrecurse test to run on Windows.
+			[RT #47093]
+
 	--- 9.11.5 released ---

 	--- 9.11.5rc1 released ---
@@ -548,7 +952,7 @@
 			required by POSIX.  Supply a alternative in
 			isc_file_isdirwritable. [RT #46394]

-4803.   [bug]		Backport parts of RT #45293 and RT #46267, specifically
+4803.	[bug]		Backport parts of RT #45293 and RT #46267, specifically
 			the fix for RT #46055 and mkeys system test
 			improvements. [RT #46430]

@@ -868,7 +1272,7 @@
 4660.	[bug]		Remove spurious "peer" from Windows socket log
 			messages. [RT #45617]

-4659.   [bug]           Remove spurious log message about lmdb-mapsize
+4659.	[bug]		Remove spurious log message about lmdb-mapsize
 			not being supported when parsing builtin
 			configuration file. [RT #45618]

@@ -1,3 +1,5 @@
+CONTRIBUTING
+
 BIND Source Access and Contributor Guidelines

 Feb 22, 2018
@@ -1,3 +1,5 @@
+HISTORY
+
 Functional enhancements from prior major releases of BIND 9

 BIND 9.10.0
@@ -303,11 +305,11 @@ BIND 9.4.0
  * Detect duplicates of UDP queries we are recursing on and drop them.
    New stats category "duplicates".
  * "USE INTERNAL MALLOC" is now runtime selectable.
-  * The lame cache is now done on a basis as some servers only appear to
-    be lame for certain query types.
+  * The lame cache is now done on a <qname,qclass,qtype> basis as some
+    servers only appear to be lame for certain query types.
  * Limit the number of recursive clients that can be waiting for a single
-    query () to resolve. New options clients-per-query and
-    max-clients-per-query.
+    query (<qname,qtype,qclass>) to resolve. New options clients-per-query
+    and max-clients-per-query.
  * dig: report the number of extra bytes still left in the packet after
    processing all the records.
  * Support for IPSECKEY rdata type.
@@ -14,7 +14,7 @@ top_builddir =  @top_builddir@

 VERSION=@BIND9_VERSION@

-SUBDIRS =	make unit lib bin doc
+SUBDIRS =	make lib bin doc
 TARGETS =
 PREREQS =	bind.keys.h

@@ -95,22 +95,22 @@ test-force:
 	exit $$status

 README: README.md
-	${PANDOC} --email-obfuscation=none -s -t html README.md | \
+	${PANDOC} --email-obfuscation=none -s --metadata title="README" -f markdown-smart -t html README.md | \
 		${W3M} -dump -cols 75 -O ascii -T text/html | \
 		sed -e '$${/^$$/d;}' > $@

 HISTORY: HISTORY.md
-	${PANDOC} --email-obfuscation=none -s -t html HISTORY.md | \
+	${PANDOC} --email-obfuscation=none -s --metadata title="HISTORY" -f markdown-smart -t html HISTORY.md | \
 		${W3M} -dump -cols 75 -O ascii -T text/html | \
 		sed -e '$${/^$$/d;}' > $@

 OPTIONS: OPTIONS.md
-	${PANDOC} --email-obfuscation=none -s -t html OPTIONS.md | \
+	${PANDOC} --email-obfuscation=none -s --metadata title="OPTIONS" -f markdown-smart -t html OPTIONS.md | \
 		${W3M} -dump -cols 75 -O ascii -T text/html | \
 		sed -e '$${/^$$/d;}' > $@

 CONTRIBUTING: CONTRIBUTING.md
-	${PANDOC} --email-obfuscation=none -s -t html CONTRIBUTING.md | \
+	${PANDOC} --email-obfuscation=none -s --metadata title="CONTRIBUTING" -f markdown-smart -t html CONTRIBUTING.md | \
 		${W3M} -dump -cols 75 -O ascii -T text/html | \
 		sed -e '$${/^$$/d;}' > $@

@@ -1,10 +1,12 @@
+OPTIONS
+
 Setting the STD_CDEFINES environment variable before running configure can
 be used to enable certain compile-time options that are not explicitly
 defined in configure.

 Some of these settings are:

-Setting                   Description
+         Setting                            Description
                          Don't ovewrite memory when allocating or freeing
 -DISC_MEM_FILL=0          it; this improves performance but makes
                          debugging more difficult.
@@ -1,3 +1,5 @@
+README
+
 BIND 9

 Contents
@@ -8,11 +10,12 @@ Contents
 4. BIND 9.11 features
 5. Building BIND
 6. macOS
- 7. Compile-time options
- 8. Automated testing
- 9. Documentation
-10. Change log
-11. Acknowledgments
+ 7. Dependencies
+ 8. Compile-time options
+ 9. Automated testing
+10. Documentation
+11. Change log
+12. Acknowledgments

 Introduction

@@ -36,9 +39,9 @@ versions 4 and 8. Internet Systems Consortium (https://www.isc.org), a 501
 (c)(3) public benefit corporation dedicated to providing software and
 services in support of the Internet infrastructure, developed BIND 9 and
 is responsible for its ongoing maintenance and improvement. BIND is open
-source software licenced under the terms of ISC License for all versions
+source software licensed under the terms of ISC License for all versions
 up to and including BIND 9.10, and the Mozilla Public License version 2.0
-for all subsequent verisons.
+for all subsequent versions.

 For a summary of features introduced in past major releases of BIND, see
 the file HISTORY.
@@ -127,7 +130,7 @@ releases. New features include:
        fetches-per-server, this value is not self-tuning.)
      + New stats counters have been added to count queries spilled due to
        these quotas.
-  * Added a new dnssec-keymgr key mainenance utility, which can generate
+  * Added a new dnssec-keymgr key maintenance utility, which can generate
    or update keys as needed to ensure that a zone's keys match a defined
    DNSSEC policy.
  * The experimental "SIT" feature in BIND 9.10 has been renamed "COOKIE"
@@ -248,7 +251,9 @@ disclosed in CVE-2017-3145.
 BIND 9.11.4

 BIND 9.11.4 is a maintenance release, and addresses the security flaw
-disclosed in CVE-2018-5738.
+disclosed in CVE-2018-5738. It also introduces "root key sentinel"
+support, enabling validating resolvers to indicate via a special query
+which trust anchors are configured for the root zone.

 BIND 9.11.5

@@ -259,20 +264,34 @@ correcting faulty documentation and introducing the following new feature:
    statements allow updating of subdomains based on a Kerberos or Active
    Directory machine principal.

-BIND 9.11.5-P1
+BIND 9.11.6

-BIND 9.11.5-P1 addresses a potentially serious flaw which could cause
-faulty NSEC3 chains to be regenerated after a change to the DNSSEC signing
-key of a zone.
+BIND 9.11.6 is a maintenance release, and also addresses the security
+flaws disclosed in CVE-2018-5743, CVE-2018-5745, CVE-2018-5744, and
+CVE-2019-6465.

-BIND 9.11.5-P2, 9.11.5-P3
+BIND 9.11.7

-These were both withdrawn prior to release.
+BIND 9.11.7 is a maintenance release, and also addresses the security flaw
+disclosed in CVE-2018-5743.

-BIND 9.11.5-P4
+BIND 9.11.8

-BIND 9.11.5-P4 addresses the security flaws disclosed in CVE-2018-5744,
-CVE-2018-5745 and CVE-2019-6465.
+BIND 9.11.8 is a maintenance release, and also addresses the security flaw
+disclosed in CVE-2019-6471.
+
+BIND 9.11.9
+
+BIND 9.11.9 is a maintenance release, and also adds support for the new
+MaxMind GeoIP2 geolocation API when built with configure --with-geoip2.
+
+BIND 9.11.10
+
+BIND 9.11.10 is a maintenance release.
+
+BIND 9.11.11
+
+BIND 9.11.11 is a maintenance release.

 Building BIND

@@ -296,7 +315,7 @@ make depend. If you're using Emacs, you might find make tags helpful.
 Several environment variables that can be set before running configure
 will affect compilation:

-Variable       Description
+   Variable                            Description
 CC             The C compiler to use. configure tries to figure out the
               right one for supported systems.
               C compiler flags. Defaults to include -g and/or -O2 as
@@ -324,6 +343,14 @@ if you have Xcode already installed you can run "xcode-select --install".
 This will add /usr/include to the system and install the compiler and
 other tools so that they can be easily found.

+Dependencies
+
+Portions of BIND that are written in Python, including dnssec-keymgr,
+dnssec-coverage, dnssec-checkds, and some of the system tests, require the
+'argparse' and 'ply' modules to be available. 'argparse' is a standard
+module as of Python 2.7 and Python 3.2. 'ply' is available from https://
+pypi.python.org/pypi/ply.
+
 Compile-time options

 To see a full list of configuration options, run configure --help.
@@ -341,13 +368,6 @@ may be necessary to specify a user with the -u option when running named.)
 To build shared libraries, specify --with-libtool on the configure command
 line.

-Certain compiled-in constants and default settings can be increased to
-values better suited to large servers with abundant memory resources (e.g,
-64-bit servers with 12G or more of memory) by specifying --with-tuning=
-large on the configure command line. This can improve performance on big
-servers, but will consume more memory and may degrade performance on
-smaller systems.
-
 For the server to support DNSSEC, you need to build it with crypto
 support. To use OpenSSL, you should have OpenSSL 1.0.2e or newer
 installed. If the OpenSSL library is installed in a nonstandard location,
@@ -378,13 +398,14 @@ specify the prefix using "--with-geoip=/prefix".
 For DNSTAP packet logging, you must have installed libfstrm https://
 github.com/farsightsec/fstrm and libprotobuf-c https://
 developers.google.com/protocol-buffers, and BIND must be configured with
-"--enable-dnstap".
+--enable-dnstap.

-Portions of BIND that are written in Python, including dnssec-keymgr,
-dnssec-coverage, dnssec-checkds, and some of the system tests, require the
-'argparse' and 'ply' modules to be available. 'argparse' is a standard
-module as of Python 2.7 and Python 3.2. 'ply' is available from https://
-pypi.python.org/pypi/ply.
+Certain compiled-in constants and default settings can be increased to
+values better suited to large servers with abundant memory resources (e.g,
+64-bit servers with 12G or more of memory) by specifying --with-tuning=
+large on the configure command line. This can improve performance on big
+servers, but will consume more memory and may degrade performance on
+smaller systems.

 On some platforms it is necessary to explicitly request large file support
 to handle files bigger than 2GB. This can be done by using
@@ -399,6 +420,10 @@ If your operating system has integrated support for IPv6, it will be used
 automatically. If you have installed KAME IPv6 separately, use --with-kame
 [=PATH] to specify its location.

+The --enable-querytrace option causes named to log every step of
+processing every query. This should only be enabled when debugging,
+because it has a significant negative impact on query performance.
+
 make install will install named and the various BIND 9 libraries. By
 default, installation is into /usr/local, but this can be changed with the
 --prefix option when running configure.
@@ -424,8 +449,10 @@ and will be skipped if these are not available. Some tests require Python
 and the 'dnspython' module and will be skipped if these are not available.
 See bin/tests/system/README for further details.

-Unit tests are implemented using Automated Testing Framework (ATF). To run
-them, use configure --with-atf, then run make test or make unit.
+Unit tests are implemented using the CMocka unit testing framework. To
+build them, use configure --with-cmocka. Execution of tests is done by the
+Kyua test execution engine; if the kyua command is available, then unit
+tests can be run via make test or make unit.

 Documentation

@@ -450,7 +477,7 @@ development BIND 9 is included in the file CHANGES, with the most recent
 changes listed first. Change notes include tags indicating the category of
 the change that was made; these categories are:

-Category       Description
+   Category                            Description
 [func]         New feature
 [bug]          General bug fix
 [security]     Fix for a significant security flaw
@@ -478,26 +505,46 @@ releases (i.e., those with version numbers ending in zero). Some new
 functionality may be backported to older releases on a case-by-case basis.
 All other change types may be applied to all currently-supported releases.

+Bug report identifiers
+
+Most notes in the CHANGES file include a reference to a bug report or
+issue number. Prior to 2018, these were usually of the form [RT #NNN] and
+referred to entries in the "bind9-bugs" RT database, which was not open to
+the public. More recent entries use the form [GL #NNN] or, less often, [GL
+!NNN], which, respectively, refer to issues or merge requests in the
+Gitlab database. Most of these are publicly readable, unless they include
+information which is confidential or security senstive.
+
+To look up a Gitlab issue by its number, use the URL https://
+gitlab.isc.org/isc-projects/bind9/issues/NNN. To look up a merge request,
+use https://gitlab.isc.org/isc-projects/bind9/merge_requests/NNN.
+
+In rare cases, an issue or merge request number may be followed with the
+letter "P". This indicates that the information is in the private ISC
+Gitlab instance, which is not visible to the public.
+
 Acknowledgments

  * The original development of BIND 9 was underwritten by the following
    organizations:

-    Sun Microsystems, Inc.
-    Hewlett Packard
-    Compaq Computer Corporation
-    IBM
-    Process Software Corporation
-    Silicon Graphics, Inc.
-    Network Associates, Inc.
-    U.S. Defense Information Systems Agency
-    USENIX Association
-    Stichting NLnet - NLnet Foundation
-    Nominum, Inc.
+      Sun Microsystems, Inc.
+      Hewlett Packard
+      Compaq Computer Corporation
+      IBM
+      Process Software Corporation
+      Silicon Graphics, Inc.
+      Network Associates, Inc.
+      U.S. Defense Information Systems Agency
+      USENIX Association
+      Stichting NLnet - NLnet Foundation
+      Nominum, Inc.

  * This product includes software developed by the OpenSSL Project for
    use in the OpenSSL Toolkit. http://www.OpenSSL.org/
+
  * This product includes cryptographic software written by Eric Young
    (eay@cryptsoft.com)
+
  * This product includes software written by Tim Hudson
    (tjh@cryptsoft.com)
@@ -18,6 +18,7 @@
 1. [BIND 9.11 features](#features)
 1. [Building BIND](#build)
 1. [macOS](#macos)
+1. [Dependencies](#dependencies)
 1. [Compile-time options](#opts)
 1. [Automated testing](#testing)
 1. [Documentation](#doc)
@@ -47,9 +48,9 @@ versions 4 and 8.  Internet Systems Consortium
 corporation dedicated to providing software and services in support of the
 Internet infrastructure, developed BIND 9 and is responsible for its
 ongoing maintenance and improvement.  BIND is open source software
-licenced under the terms of ISC License for all versions up to and
+licensed under the terms of ISC License for all versions up to and
 including BIND 9.10, and the Mozilla Public License version 2.0 for all
-subsequent verisons.
+subsequent versions.

 For a summary of features introduced in past major releases of BIND,
 see the file [HISTORY](HISTORY.md).
@@ -145,7 +146,7 @@ releases.  New features include:
      `fetches-per-server`, this value is not self-tuning.)
    * New stats counters have been added to count queries spilled due to
      these quotas.
-* Added a new `dnssec-keymgr` key mainenance utility, which can generate or
+* Added a new `dnssec-keymgr` key maintenance utility, which can generate or
  update keys as needed to ensure that a zone's keys match a defined DNSSEC
  policy.
 * The experimental "SIT" feature in BIND 9.10 has been renamed "COOKIE" and
@@ -264,7 +265,9 @@ disclosed in CVE-2017-3145.
 #### BIND 9.11.4

 BIND 9.11.4 is a maintenance release, and addresses the security flaw
-disclosed in CVE-2018-5738.
+disclosed in CVE-2018-5738. It also introduces "root key sentinel" support,
+enabling validating resolvers to indicate via a special query which trust
+anchors are configured for the root zone.

 #### BIND 9.11.5

@@ -276,20 +279,35 @@ feature:
  statements allow updating of subdomains based on a Kerberos or
  Active Directory machine principal.

-#### BIND 9.11.5-P1
+#### BIND 9.11.6

-BIND 9.11.5-P1 addresses a potentially serious flaw which could
-cause faulty NSEC3 chains to be regenerated after a change to the
-DNSSEC signing key of a zone.
+BIND 9.11.6 is a maintenance release, and also addresses the security
+flaws disclosed in CVE-2018-5743, CVE-2018-5745, CVE-2018-5744,
+and CVE-2019-6465.

-#### BIND 9.11.5-P2, 9.11.5-P3
+#### BIND 9.11.7

-These were both withdrawn prior to release.
+BIND 9.11.7 is a maintenance release, and also addresses the security
+flaw disclosed in CVE-2018-5743.

-#### BIND 9.11.5-P4
+#### BIND 9.11.8

-BIND 9.11.5-P4 addresses the security flaws disclosed in CVE-2018-5744,
-CVE-2018-5745 and CVE-2019-6465.
+BIND 9.11.8 is a maintenance release, and also addresses the security
+flaw disclosed in CVE-2019-6471.
+
+#### BIND 9.11.9
+
+BIND 9.11.9 is a maintenance release, and also adds support for
+the new MaxMind GeoIP2 geolocation API when built with
+`configure --with-geoip2`.
+
+#### BIND 9.11.10
+
+BIND 9.11.10 is a maintenance release.
+
+#### BIND 9.11.11
+
+BIND 9.11.11 is a maintenance release.

 ### <a name="build"/> Building BIND

@@ -334,6 +352,13 @@ or if you have Xcode already installed you can run "xcode-select --install".
 This will add /usr/include to the system and install the compiler and other
 tools so that they can be easily found.

+### <a name="dependencies"/> Dependencies
+
+Portions of BIND that are written in Python, including
+`dnssec-keymgr`, `dnssec-coverage`, `dnssec-checkds`, and some of the
+system tests, require the 'argparse' and 'ply' modules to be available.
+'argparse' is a standard module as of Python 2.7 and Python 3.2.
+'ply' is available from [https://pypi.python.org/pypi/ply](https://pypi.python.org/pypi/ply).

 #### <a name="opts"/> Compile-time options

@@ -352,13 +377,6 @@ specify a user with the -u option when running `named`.)
 To build shared libraries, specify `--with-libtool` on the `configure`
 command line.

-Certain compiled-in constants and default settings can be increased to
-values better suited to large servers with abundant memory resources (e.g,
-64-bit servers with 12G or more of memory) by specifying
-`--with-tuning=large` on the `configure` command line. This can improve
-performance on big servers, but will consume more memory and may degrade
-performance on smaller systems.
-
 For the server to support DNSSEC, you need to build it with crypto support.
 To use OpenSSL, you should have OpenSSL 1.0.2e or newer installed.  If the
 OpenSSL library is installed in a nonstandard location, specify the prefix
@@ -391,13 +409,14 @@ For DNSTAP packet logging, you must have installed libfstrm
 [https://github.com/farsightsec/fstrm](https://github.com/farsightsec/fstrm)
 and libprotobuf-c
 [https://developers.google.com/protocol-buffers](https://developers.google.com/protocol-buffers),
-and BIND must be configured with "--enable-dnstap".
+and BIND must be configured with `--enable-dnstap`.

-Portions of BIND that are written in Python, including
-`dnssec-keymgr`, `dnssec-coverage`, `dnssec-checkds`, and some of the
-system tests, require the 'argparse' and 'ply' modules to be available.
-'argparse' is a standard module as of Python 2.7 and Python 3.2.
-'ply' is available from [https://pypi.python.org/pypi/ply](https://pypi.python.org/pypi/ply).
+Certain compiled-in constants and default settings can be increased to
+values better suited to large servers with abundant memory resources (e.g,
+64-bit servers with 12G or more of memory) by specifying
+`--with-tuning=large` on the `configure` command line. This can improve
+performance on big servers, but will consume more memory and may degrade
+performance on smaller systems.

 On some platforms it is necessary to explicitly request large file support
 to handle files bigger than 2GB.  This can be done by using
@@ -412,6 +431,10 @@ If your operating system has integrated support for IPv6, it will be used
 automatically.  If you have installed KAME IPv6 separately, use
 `--with-kame[=PATH]` to specify its location.

+The `--enable-querytrace` option causes `named` to log every step of
+processing every query. This should only be enabled when debugging, because
+it has a significant negative impact on query performance.
+
 `make install` will install `named` and the various BIND 9 libraries.  By
 default, installation is into /usr/local, but this can be changed with the
 `--prefix` option when running `configure`.
@@ -437,9 +460,10 @@ and will be skipped if these are not available. Some tests require Python
 and the 'dnspython' module and will be skipped if these are not available.
 See bin/tests/system/README for further details.

-Unit tests are implemented using Automated Testing Framework (ATF).
-To run them, use `configure --with-atf`, then run `make test` or
-`make unit`.
+Unit tests are implemented using the CMocka unit testing framework.
+To build them, use `configure --with-cmocka`. Execution of tests is done
+by the Kyua test execution engine; if the `kyua` command is available,
+then unit tests can be run via `make test` or `make unit`.

 ### <a name="doc"/> Documentation

@@ -487,6 +511,25 @@ releases (i.e., those with version numbers ending in zero).  Some new
 functionality may be backported to older releases on a case-by-case basis.
 All other change types may be applied to all currently-supported releases.

+#### Bug report identifiers
+
+Most notes in the CHANGES file include a reference to a bug report or
+issue number. Prior to 2018, these were usually of the form `[RT #NNN]`
+and referred to entries in the "bind9-bugs" RT database, which was not open
+to the public. More recent entries use the form `[GL #NNN]` or, less often,
+`[GL !NNN]`, which, respectively, refer to issues or merge requests in the
+Gitlab database. Most of these are publicly readable, unless they include
+information which is confidential or security senstive.
+
+To look up a Gitlab issue by its number, use the URL
+[https://gitlab.isc.org/isc-projects/bind9/issues/NNN](https://gitlab.isc.org/isc-projects/bind9/issues).
+To look up a merge request, use
+[https://gitlab.isc.org/isc-projects/bind9/merge_requests/NNN](https://gitlab.isc.org/isc-projects/bind9/merge_requests).
+
+In rare cases, an issue or merge request number may be followed with the
+letter "P". This indicates that the information is in the private ISC
+Gitlab instance, which is not visible to the public.
+
 ### <a name="ack"/> Acknowledgments

 * The original development of BIND 9 was underwritten by the
@@ -1,17 +1,297 @@
-sinclude(libtool.m4/libtool.m4)dnl
-sinclude(libtool.m4/ltoptions.m4)dnl
-sinclude(libtool.m4/ltsugar.m4)dnl
-sinclude(libtool.m4/ltversion.m4)dnl
-sinclude(libtool.m4/lt~obsolete.m4)dnl
+# generated automatically by aclocal 1.16.1 -*- Autoconf -*-

-m4_divert_text(HELP_CANON, [[
-  NOTE: If PREFIX is not set, then the default values for --sysconfdir
-  and --localstatedir are /etc and /var, respectively.]])
-m4_divert_text(HELP_END, [[
-Professional support for BIND is provided by Internet Systems Consortium,
-Inc.  Information about paid support and training options is available at
-https://www.isc.org/support.
+# Copyright (C) 1996-2018 Free Software Foundation, Inc.

-Help can also often be found on the BIND Users mailing list
-(https://lists.isc.org/mailman/listinfo/bind-users) or in the #bind
-channel of the Freenode IRC service.]])
+# This file is free software; the Free Software Foundation
+# gives unlimited permission to copy and/or distribute it,
+# with or without modifications, as long as this notice is preserved.
+
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY, to the extent permitted by law; without
+# even the implied warranty of MERCHANTABILITY or FITNESS FOR A
+# PARTICULAR PURPOSE.
+
+m4_ifndef([AC_CONFIG_MACRO_DIRS], [m4_defun([_AM_CONFIG_MACRO_DIRS], [])m4_defun([AC_CONFIG_MACRO_DIRS], [_AM_CONFIG_MACRO_DIRS($@)])])
+# pkg.m4 - Macros to locate and utilise pkg-config.   -*- Autoconf -*-
+# serial 12 (pkg-config-0.29.2)
+
+dnl Copyright © 2004 Scott James Remnant <scott@netsplit.com>.
+dnl Copyright © 2012-2015 Dan Nicholson <dbn.lists@gmail.com>
+dnl
+dnl This program is free software; you can redistribute it and/or modify
+dnl it under the terms of the GNU General Public License as published by
+dnl the Free Software Foundation; either version 2 of the License, or
+dnl (at your option) any later version.
+dnl
+dnl This program is distributed in the hope that it will be useful, but
+dnl WITHOUT ANY WARRANTY; without even the implied warranty of
+dnl MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+dnl General Public License for more details.
+dnl
+dnl You should have received a copy of the GNU General Public License
+dnl along with this program; if not, write to the Free Software
+dnl Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA
+dnl 02111-1307, USA.
+dnl
+dnl As a special exception to the GNU General Public License, if you
+dnl distribute this file as part of a program that contains a
+dnl configuration script generated by Autoconf, you may include it under
+dnl the same distribution terms that you use for the rest of that
+dnl program.
+
+dnl PKG_PREREQ(MIN-VERSION)
+dnl -----------------------
+dnl Since: 0.29
+dnl
+dnl Verify that the version of the pkg-config macros are at least
+dnl MIN-VERSION. Unlike PKG_PROG_PKG_CONFIG, which checks the user's
+dnl installed version of pkg-config, this checks the developer's version
+dnl of pkg.m4 when generating configure.
+dnl
+dnl To ensure that this macro is defined, also add:
+dnl m4_ifndef([PKG_PREREQ],
+dnl     [m4_fatal([must install pkg-config 0.29 or later before running autoconf/autogen])])
+dnl
+dnl See the "Since" comment for each macro you use to see what version
+dnl of the macros you require.
+m4_defun([PKG_PREREQ],
+[m4_define([PKG_MACROS_VERSION], [0.29.2])
+m4_if(m4_version_compare(PKG_MACROS_VERSION, [$1]), -1,
+    [m4_fatal([pkg.m4 version $1 or higher is required but ]PKG_MACROS_VERSION[ found])])
+])dnl PKG_PREREQ
+
+dnl PKG_PROG_PKG_CONFIG([MIN-VERSION])
+dnl ----------------------------------
+dnl Since: 0.16
+dnl
+dnl Search for the pkg-config tool and set the PKG_CONFIG variable to
+dnl first found in the path. Checks that the version of pkg-config found
+dnl is at least MIN-VERSION. If MIN-VERSION is not specified, 0.9.0 is
+dnl used since that's the first version where most current features of
+dnl pkg-config existed.
+AC_DEFUN([PKG_PROG_PKG_CONFIG],
+[m4_pattern_forbid([^_?PKG_[A-Z_]+$])
+m4_pattern_allow([^PKG_CONFIG(_(PATH|LIBDIR|SYSROOT_DIR|ALLOW_SYSTEM_(CFLAGS|LIBS)))?$])
+m4_pattern_allow([^PKG_CONFIG_(DISABLE_UNINSTALLED|TOP_BUILD_DIR|DEBUG_SPEW)$])
+AC_ARG_VAR([PKG_CONFIG], [path to pkg-config utility])
+AC_ARG_VAR([PKG_CONFIG_PATH], [directories to add to pkg-config's search path])
+AC_ARG_VAR([PKG_CONFIG_LIBDIR], [path overriding pkg-config's built-in search path])
+
+if test "x$ac_cv_env_PKG_CONFIG_set" != "xset"; then
+	AC_PATH_TOOL([PKG_CONFIG], [pkg-config])
+fi
+if test -n "$PKG_CONFIG"; then
+	_pkg_min_version=m4_default([$1], [0.9.0])
+	AC_MSG_CHECKING([pkg-config is at least version $_pkg_min_version])
+	if $PKG_CONFIG --atleast-pkgconfig-version $_pkg_min_version; then
+		AC_MSG_RESULT([yes])
+	else
+		AC_MSG_RESULT([no])
+		PKG_CONFIG=""
+	fi
+fi[]dnl
+])dnl PKG_PROG_PKG_CONFIG
+
+dnl PKG_CHECK_EXISTS(MODULES, [ACTION-IF-FOUND], [ACTION-IF-NOT-FOUND])
+dnl -------------------------------------------------------------------
+dnl Since: 0.18
+dnl
+dnl Check to see whether a particular set of modules exists. Similar to
+dnl PKG_CHECK_MODULES(), but does not set variables or print errors.
+dnl
+dnl Please remember that m4 expands AC_REQUIRE([PKG_PROG_PKG_CONFIG])
+dnl only at the first occurence in configure.ac, so if the first place
+dnl it's called might be skipped (such as if it is within an "if", you
+dnl have to call PKG_CHECK_EXISTS manually
+AC_DEFUN([PKG_CHECK_EXISTS],
+[AC_REQUIRE([PKG_PROG_PKG_CONFIG])dnl
+if test -n "$PKG_CONFIG" && \
+    AC_RUN_LOG([$PKG_CONFIG --exists --print-errors "$1"]); then
+  m4_default([$2], [:])
+m4_ifvaln([$3], [else
+  $3])dnl
+fi])
+
+dnl _PKG_CONFIG([VARIABLE], [COMMAND], [MODULES])
+dnl ---------------------------------------------
+dnl Internal wrapper calling pkg-config via PKG_CONFIG and setting
+dnl pkg_failed based on the result.
+m4_define([_PKG_CONFIG],
+[if test -n "$$1"; then
+    pkg_cv_[]$1="$$1"
+ elif test -n "$PKG_CONFIG"; then
+    PKG_CHECK_EXISTS([$3],
+                     [pkg_cv_[]$1=`$PKG_CONFIG --[]$2 "$3" 2>/dev/null`
+		      test "x$?" != "x0" && pkg_failed=yes ],
+		     [pkg_failed=yes])
+ else
+    pkg_failed=untried
+fi[]dnl
+])dnl _PKG_CONFIG
+
+dnl _PKG_SHORT_ERRORS_SUPPORTED
+dnl ---------------------------
+dnl Internal check to see if pkg-config supports short errors.
+AC_DEFUN([_PKG_SHORT_ERRORS_SUPPORTED],
+[AC_REQUIRE([PKG_PROG_PKG_CONFIG])
+if $PKG_CONFIG --atleast-pkgconfig-version 0.20; then
+        _pkg_short_errors_supported=yes
+else
+        _pkg_short_errors_supported=no
+fi[]dnl
+])dnl _PKG_SHORT_ERRORS_SUPPORTED
+
+
+dnl PKG_CHECK_MODULES(VARIABLE-PREFIX, MODULES, [ACTION-IF-FOUND],
+dnl   [ACTION-IF-NOT-FOUND])
+dnl --------------------------------------------------------------
+dnl Since: 0.4.0
+dnl
+dnl Note that if there is a possibility the first call to
+dnl PKG_CHECK_MODULES might not happen, you should be sure to include an
+dnl explicit call to PKG_PROG_PKG_CONFIG in your configure.ac
+AC_DEFUN([PKG_CHECK_MODULES],
+[AC_REQUIRE([PKG_PROG_PKG_CONFIG])dnl
+AC_ARG_VAR([$1][_CFLAGS], [C compiler flags for $1, overriding pkg-config])dnl
+AC_ARG_VAR([$1][_LIBS], [linker flags for $1, overriding pkg-config])dnl
+
+pkg_failed=no
+AC_MSG_CHECKING([for $2])
+
+_PKG_CONFIG([$1][_CFLAGS], [cflags], [$2])
+_PKG_CONFIG([$1][_LIBS], [libs], [$2])
+
+m4_define([_PKG_TEXT], [Alternatively, you may set the environment variables $1[]_CFLAGS
+and $1[]_LIBS to avoid the need to call pkg-config.
+See the pkg-config man page for more details.])
+
+if test $pkg_failed = yes; then
+        AC_MSG_RESULT([no])
+        _PKG_SHORT_ERRORS_SUPPORTED
+        if test $_pkg_short_errors_supported = yes; then
+	        $1[]_PKG_ERRORS=`$PKG_CONFIG --short-errors --print-errors --cflags --libs "$2" 2>&1`
+        else
+	        $1[]_PKG_ERRORS=`$PKG_CONFIG --print-errors --cflags --libs "$2" 2>&1`
+        fi
+	# Put the nasty error message in config.log where it belongs
+	echo "$$1[]_PKG_ERRORS" >&AS_MESSAGE_LOG_FD
+
+	m4_default([$4], [AC_MSG_ERROR(
+[Package requirements ($2) were not met:
+
+$$1_PKG_ERRORS
+
+Consider adjusting the PKG_CONFIG_PATH environment variable if you
+installed software in a non-standard prefix.
+
+_PKG_TEXT])[]dnl
+        ])
+elif test $pkg_failed = untried; then
+        AC_MSG_RESULT([no])
+	m4_default([$4], [AC_MSG_FAILURE(
+[The pkg-config script could not be found or is too old.  Make sure it
+is in your PATH or set the PKG_CONFIG environment variable to the full
+path to pkg-config.
+
+_PKG_TEXT
+
+To get pkg-config, see <http://pkg-config.freedesktop.org/>.])[]dnl
+        ])
+else
+	$1[]_CFLAGS=$pkg_cv_[]$1[]_CFLAGS
+	$1[]_LIBS=$pkg_cv_[]$1[]_LIBS
+        AC_MSG_RESULT([yes])
+	$3
+fi[]dnl
+])dnl PKG_CHECK_MODULES
+
+
+dnl PKG_CHECK_MODULES_STATIC(VARIABLE-PREFIX, MODULES, [ACTION-IF-FOUND],
+dnl   [ACTION-IF-NOT-FOUND])
+dnl ---------------------------------------------------------------------
+dnl Since: 0.29
+dnl
+dnl Checks for existence of MODULES and gathers its build flags with
+dnl static libraries enabled. Sets VARIABLE-PREFIX_CFLAGS from --cflags
+dnl and VARIABLE-PREFIX_LIBS from --libs.
+dnl
+dnl Note that if there is a possibility the first call to
+dnl PKG_CHECK_MODULES_STATIC might not happen, you should be sure to
+dnl include an explicit call to PKG_PROG_PKG_CONFIG in your
+dnl configure.ac.
+AC_DEFUN([PKG_CHECK_MODULES_STATIC],
+[AC_REQUIRE([PKG_PROG_PKG_CONFIG])dnl
+_save_PKG_CONFIG=$PKG_CONFIG
+PKG_CONFIG="$PKG_CONFIG --static"
+PKG_CHECK_MODULES($@)
+PKG_CONFIG=$_save_PKG_CONFIG[]dnl
+])dnl PKG_CHECK_MODULES_STATIC
+
+
+dnl PKG_INSTALLDIR([DIRECTORY])
+dnl -------------------------
+dnl Since: 0.27
+dnl
+dnl Substitutes the variable pkgconfigdir as the location where a module
+dnl should install pkg-config .pc files. By default the directory is
+dnl $libdir/pkgconfig, but the default can be changed by passing
+dnl DIRECTORY. The user can override through the --with-pkgconfigdir
+dnl parameter.
+AC_DEFUN([PKG_INSTALLDIR],
+[m4_pushdef([pkg_default], [m4_default([$1], ['${libdir}/pkgconfig'])])
+m4_pushdef([pkg_description],
+    [pkg-config installation directory @<:@]pkg_default[@:>@])
+AC_ARG_WITH([pkgconfigdir],
+    [AS_HELP_STRING([--with-pkgconfigdir], pkg_description)],,
+    [with_pkgconfigdir=]pkg_default)
+AC_SUBST([pkgconfigdir], [$with_pkgconfigdir])
+m4_popdef([pkg_default])
+m4_popdef([pkg_description])
+])dnl PKG_INSTALLDIR
+
+
+dnl PKG_NOARCH_INSTALLDIR([DIRECTORY])
+dnl --------------------------------
+dnl Since: 0.27
+dnl
+dnl Substitutes the variable noarch_pkgconfigdir as the location where a
+dnl module should install arch-independent pkg-config .pc files. By
+dnl default the directory is $datadir/pkgconfig, but the default can be
+dnl changed by passing DIRECTORY. The user can override through the
+dnl --with-noarch-pkgconfigdir parameter.
+AC_DEFUN([PKG_NOARCH_INSTALLDIR],
+[m4_pushdef([pkg_default], [m4_default([$1], ['${datadir}/pkgconfig'])])
+m4_pushdef([pkg_description],
+    [pkg-config arch-independent installation directory @<:@]pkg_default[@:>@])
+AC_ARG_WITH([noarch-pkgconfigdir],
+    [AS_HELP_STRING([--with-noarch-pkgconfigdir], pkg_description)],,
+    [with_noarch_pkgconfigdir=]pkg_default)
+AC_SUBST([noarch_pkgconfigdir], [$with_noarch_pkgconfigdir])
+m4_popdef([pkg_default])
+m4_popdef([pkg_description])
+])dnl PKG_NOARCH_INSTALLDIR
+
+
+dnl PKG_CHECK_VAR(VARIABLE, MODULE, CONFIG-VARIABLE,
+dnl [ACTION-IF-FOUND], [ACTION-IF-NOT-FOUND])
+dnl -------------------------------------------
+dnl Since: 0.28
+dnl
+dnl Retrieves the value of the pkg-config variable for the given module.
+AC_DEFUN([PKG_CHECK_VAR],
+[AC_REQUIRE([PKG_PROG_PKG_CONFIG])dnl
+AC_ARG_VAR([$1], [value of $3 for $2, overriding pkg-config])dnl
+
+_PKG_CONFIG([$1], [variable="][$3]["], [$2])
+AS_VAR_COPY([$1], [pkg_cv_][$1])
+
+AS_VAR_IF([$1], [""], [$5], [$4])dnl
+])dnl PKG_CHECK_VAR
+
+m4_include([libtool.m4/ax_restore_flags.m4])
+m4_include([libtool.m4/ax_save_flags.m4])
+m4_include([libtool.m4/libtool.m4])
+m4_include([libtool.m4/ltoptions.m4])
+m4_include([libtool.m4/ltsugar.m4])
+m4_include([libtool.m4/ltversion.m4])
+m4_include([libtool.m4/lt~obsolete.m4])
@@ -7,8 +7,6 @@
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.

-# $Id: Makefile.in,v 1.36 2009/12/05 23:31:40 each Exp $
-
 srcdir =	@srcdir@
 VPATH =		@srcdir@
 top_srcdir =	@top_srcdir@
@@ -23,7 +21,7 @@ CINCLUDES =	${BIND9_INCLUDES} ${DNS_INCLUDES} ${ISCCFG_INCLUDES} \
 CDEFINES = 	@CRYPTO@ -DNAMED_CONFFILE=\"${sysconfdir}/named.conf\"
 CWARNINGS =

-DNSLIBS =	../../lib/dns/libdns.@A@ @DNS_CRYPTO_LIBS@
+DNSLIBS =	../../lib/dns/libdns.@A@ ${MAXMINDDB_LIBS} @DNS_CRYPTO_LIBS@
 ISCCFGLIBS =	../../lib/isccfg/libisccfg.@A@
 ISCLIBS =	../../lib/isc/libisc.@A@
 ISCNOSYMLIBS =	../../lib/isc/libisc-nosymtbl.@A@
@@ -265,8 +265,10 @@ configure_zone(const char *vclass, const char *view,
 		} else if (strcasecmp(cfg_obj_asstring(obj), "ignore") == 0) {
 			zone_options &= ~DNS_ZONEOPT_CHECKDUPRR;
 			zone_options &= ~DNS_ZONEOPT_CHECKDUPRRFAIL;
-		} else
+		} else {
 			INSIST(0);
+			ISC_UNREACHABLE();
+		}
 	} else {
 		zone_options |= DNS_ZONEOPT_CHECKDUPRR;
 		zone_options &= ~DNS_ZONEOPT_CHECKDUPRRFAIL;
@@ -283,8 +285,10 @@ configure_zone(const char *vclass, const char *view,
 		} else if (strcasecmp(cfg_obj_asstring(obj), "ignore") == 0) {
 			zone_options &= ~DNS_ZONEOPT_CHECKMX;
 			zone_options &= ~DNS_ZONEOPT_CHECKMXFAIL;
-		} else
+		} else {
 			INSIST(0);
+			ISC_UNREACHABLE();
+		}
 	} else {
 		zone_options |= DNS_ZONEOPT_CHECKMX;
 		zone_options &= ~DNS_ZONEOPT_CHECKMXFAIL;
@@ -310,8 +314,10 @@ configure_zone(const char *vclass, const char *view,
 		} else if (strcasecmp(cfg_obj_asstring(obj), "ignore") == 0) {
 			zone_options |= DNS_ZONEOPT_WARNMXCNAME;
 			zone_options |= DNS_ZONEOPT_IGNOREMXCNAME;
-		} else
+		} else {
 			INSIST(0);
+			ISC_UNREACHABLE();
+		}
 	} else {
 		zone_options |= DNS_ZONEOPT_WARNMXCNAME;
 		zone_options &= ~DNS_ZONEOPT_IGNOREMXCNAME;
@@ -328,8 +334,10 @@ configure_zone(const char *vclass, const char *view,
 		} else if (strcasecmp(cfg_obj_asstring(obj), "ignore") == 0) {
 			zone_options |= DNS_ZONEOPT_WARNSRVCNAME;
 			zone_options |= DNS_ZONEOPT_IGNORESRVCNAME;
-		} else
+		} else {
 			INSIST(0);
+			ISC_UNREACHABLE();
+		}
 	} else {
 		zone_options |= DNS_ZONEOPT_WARNSRVCNAME;
 		zone_options &= ~DNS_ZONEOPT_IGNORESRVCNAME;
@@ -349,8 +357,10 @@ configure_zone(const char *vclass, const char *view,
 			zone_options |= DNS_ZONEOPT_CHECKSPF;
 		} else if (strcasecmp(cfg_obj_asstring(obj), "ignore") == 0) {
 			zone_options &= ~DNS_ZONEOPT_CHECKSPF;
-		} else
+		} else {
 			INSIST(0);
+			ISC_UNREACHABLE();
+		}
 	} else {
 		zone_options |= DNS_ZONEOPT_CHECKSPF;
 	}
@@ -366,8 +376,10 @@ configure_zone(const char *vclass, const char *view,
 		} else if (strcasecmp(cfg_obj_asstring(obj), "ignore") == 0) {
 			zone_options &= ~DNS_ZONEOPT_CHECKNAMES;
 			zone_options &= ~DNS_ZONEOPT_CHECKNAMESFAIL;
-		} else
+		} else {
 			INSIST(0);
+			ISC_UNREACHABLE();
+		}
 	} else {
 	       zone_options |= DNS_ZONEOPT_CHECKNAMES;
 	       zone_options |= DNS_ZONEOPT_CHECKNAMESFAIL;
@@ -377,14 +389,16 @@ configure_zone(const char *vclass, const char *view,
 	fmtobj = NULL;
 	if (get_maps(maps, "masterfile-format", &fmtobj)) {
 		const char *masterformatstr = cfg_obj_asstring(fmtobj);
-		if (strcasecmp(masterformatstr, "text") == 0)
+		if (strcasecmp(masterformatstr, "text") == 0) {
 			masterformat = dns_masterformat_text;
-		else if (strcasecmp(masterformatstr, "raw") == 0)
+		} else if (strcasecmp(masterformatstr, "raw") == 0) {
 			masterformat = dns_masterformat_raw;
-		else if (strcasecmp(masterformatstr, "map") == 0)
+		} else if (strcasecmp(masterformatstr, "map") == 0) {
 			masterformat = dns_masterformat_map;
-		else
+		} else {
 			INSIST(0);
+			ISC_UNREACHABLE();
+		}
 	}

 	obj = NULL;
@@ -141,12 +141,14 @@ main(int argc, char **argv) {
 #define PROGCMP(X) \
 	(strcasecmp(prog_name, X) == 0 || strcasecmp(prog_name, X ".exe") == 0)

-	if (PROGCMP("named-checkzone"))
+	if (PROGCMP("named-checkzone")) {
 		progmode = progmode_check;
-	else if (PROGCMP("named-compilezone"))
+	} else if (PROGCMP("named-compilezone")) {
 		progmode = progmode_compile;
-	else
+	} else {
 		INSIST(0);
+		ISC_UNREACHABLE();
+	}

 	/* Compilation specific defaults */
 	if (progmode == progmode_compile) {
@@ -1,29 +1,29 @@
-Microsoft Developer Studio Workspace File, Format Version 6.00
-# WARNING: DO NOT EDIT OR DELETE THIS WORKSPACE FILE!
-
-###############################################################################
-
-Project: "checktool"=".\checktool.dsp" - Package Owner=<4>
-
-Package=<5>
-{{{
-}}}
-
-Package=<4>
-{{{
-}}}
-
-###############################################################################
-
-Global:
-
-Package=<5>
-{{{
-}}}
-
-Package=<3>
-{{{
-}}}
-
-###############################################################################
-
+Microsoft Developer Studio Workspace File, Format Version 6.00
+# WARNING: DO NOT EDIT OR DELETE THIS WORKSPACE FILE!
+
+###############################################################################
+
+Project: "checktool"=".\checktool.dsp" - Package Owner=<4>
+
+Package=<5>
+{{{
+}}}
+
+Package=<4>
+{{{
+}}}
+
+###############################################################################
+
+Global:
+
+Package=<5>
+{{{
+}}}
+
+Package=<3>
+{{{
+}}}
+
+###############################################################################
+
@@ -7,8 +7,6 @@
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.

-# $Id: Makefile.in,v 1.8 2009/12/05 23:31:40 each Exp $
-
 srcdir =	@srcdir@
 VPATH =		@srcdir@
 top_srcdir =	@top_srcdir@
@@ -31,7 +29,7 @@ ISCCFGLIBS =	../../lib/isccfg/libisccfg.@A@
 ISCCCLIBS =	../../lib/isccc/libisccc.@A@
 ISCLIBS =	../../lib/isc/libisc.@A@
 ISCNOSYMLIBS =	../../lib/isc/libisc-nosymtbl.@A@
-DNSLIBS =	../../lib/dns/libdns.@A@ @DNS_CRYPTO_LIBS@
+DNSLIBS =	../../lib/dns/libdns.@A@ ${MAXMINDDB_LIBS} @DNS_CRYPTO_LIBS@
 BIND9LIBS =	../../lib/bind9/libbind9.@A@

 ISCCFGDEPLIBS =	../../lib/isccfg/libisccfg.@A@
@@ -130,10 +130,12 @@ main(int argc, char **argv) {
 	if (PROGCMP("tsig-keygen")) {
 		progmode = progmode_keygen;
 		quiet = true;
-	} else if (PROGCMP("ddns-confgen"))
+	} else if (PROGCMP("ddns-confgen")) {
 		progmode = progmode_confgen;
-	else
+	} else {
 		INSIST(0);
+		ISC_UNREACHABLE();
+	}

 	isc_commandline_errprint = false;

@@ -1,29 +1,29 @@
-Microsoft Developer Studio Workspace File, Format Version 6.00
-# WARNING: DO NOT EDIT OR DELETE THIS WORKSPACE FILE!
-
-###############################################################################
-
-Project: "confgentool"=".\confgentool.dsp" - Package Owner=<4>
-
-Package=<5>
-{{{
-}}}
-
-Package=<4>
-{{{
-}}}
-
-###############################################################################
-
-Global:
-
-Package=<5>
-{{{
-}}}
-
-Package=<3>
-{{{
-}}}
-
-###############################################################################
-
+Microsoft Developer Studio Workspace File, Format Version 6.00
+# WARNING: DO NOT EDIT OR DELETE THIS WORKSPACE FILE!
+
+###############################################################################
+
+Project: "confgentool"=".\confgentool.dsp" - Package Owner=<4>
+
+Package=<5>
+{{{
+}}}
+
+Package=<4>
+{{{
+}}}
+
+###############################################################################
+
+Global:
+
+Package=<5>
+{{{
+}}}
+
+Package=<3>
+{{{
+}}}
+
+###############################################################################
+
@@ -23,7 +23,7 @@ CDEFINES =	@CRYPTO@ -DVERSION=\"${VERSION}\" \
 CWARNINGS =

 ISCCFGLIBS =	../../lib/isccfg/libisccfg.@A@
-DNSLIBS =	../../lib/dns/libdns.@A@ @DNS_CRYPTO_LIBS@
+DNSLIBS =	../../lib/dns/libdns.@A@ ${MAXMINDDB_LIBS} @DNS_CRYPTO_LIBS@
 ISCNOSYMLIBS =	../../lib/isc/libisc-nosymtbl.@A@
 ISCLIBS =	../../lib/isc/libisc.@A@
 IRSLIBS =	../../lib/irs/libirs.@A@
@@ -765,7 +765,14 @@ setup_dnsseckeys(dns_client_t *client) {
 	if (dlv_validation)
 		dns_client_setdlv(client, dns_rdataclass_in, dlv_anchor);

+
 cleanup:
+	if (bindkeys != NULL) {
+		cfg_obj_destroy(parser, &bindkeys);
+	}
+	if (parser != NULL) {
+		cfg_parser_destroy(&parser);
+	}
 	if (result != ISC_R_SUCCESS)
 		delv_log(ISC_LOG_ERROR, "setup_dnsseckeys: %s",
 			  isc_result_totext(result));
@@ -1179,6 +1186,8 @@ plus_option(char *option) {
 * options: "46a:b:c:d:himp:q:t:vx:";
 */
 static const char *single_dash_opts = "46himv";
+static const char *dash_opts = "46abcdhimpqtvx";
+
 static bool
 dash_option(char *option, char *next, bool *open_type_class) {
 	char opt, *value;
@@ -1236,6 +1245,7 @@ dash_option(char *option, char *next, bool *open_type_class) {
 			/* NOTREACHED */
 		default:
 			INSIST(0);
+			ISC_UNREACHABLE();
 		}
 		if (strlen(option) > 1U)
 			option = &option[1];
@@ -1379,8 +1389,10 @@ preparse_args(int argc, char **argv) {
 	char *option;

 	for (argc--, argv++; argc > 0; argc--, argv++) {
-		if (argv[0][0] != '-')
+		if (argv[0][0] != '-') {
 			continue;
+		}
+
 		option = &argv[0][1];
 		while (strpbrk(option, single_dash_opts) == &option[0]) {
 			switch (option[0]) {
@@ -1403,6 +1415,27 @@ preparse_args(int argc, char **argv) {
 			}
 			option = &option[1];
 		}
+
+		if (strlen(option) == 0U) {
+			continue;
+		}
+
+		/* Look for dash value option. */
+		if (strpbrk(option, dash_opts) != &option[0] ||
+		    strlen(option) > 1U)
+		{
+			/* Error or value in option. */
+			continue;
+		}
+
+		/* Dash value is next argument so we need to skip it. */
+		argc--;
+		argv++;
+
+		/* Handle missing argument */
+		if (argc == 0) {
+			break;
+		}
 	}
 }

@@ -25,7 +25,7 @@ CDEFINES =	-DVERSION=\"${VERSION}\" @CRYPTO@
 CWARNINGS =

 ISCCFGLIBS =	../../lib/isccfg/libisccfg.@A@
-DNSLIBS =	../../lib/dns/libdns.@A@ @DNS_CRYPTO_LIBS@
+DNSLIBS =	../../lib/dns/libdns.@A@ ${MAXMINDDB_LIBS} @DNS_CRYPTO_LIBS@
 BIND9LIBS =	../../lib/bind9/libbind9.@A@
 ISCLIBS =	../../lib/isc/libisc.@A@
 ISCNOSYMLIBS =	../../lib/isc/libisc-nosymtbl.@A@
@@ -74,7 +74,9 @@ will perform an NS query for "\&." (the root)\&.
 It is possible to set per\-user defaults for
 \fBdig\fR
 via
-${HOME}/\&.digrc\&. This file is read and any options in it are applied before the command line arguments\&.
+${HOME}/\&.digrc\&. This file is read and any options in it are applied before the command line arguments\&. The
+\fB\-r\fR
+option disables this feature, for scripts that need predictable behaviour\&.
 .PP
 The IN and CH class names overlap with the IN and CH top level domain names\&. Either use the
 \fB\-t\fR
@@ -208,6 +210,12 @@ The domain name to query\&. This is useful to distinguish the
 from other arguments\&.
 .RE
 .PP
+\-r
+.RS 4
+Do not read options from
+${HOME}/\&.digrc\&. This is useful for scripts that need predictable behaviour\&.
+.RE
+.PP
 \-t \fItype\fR
 .RS 4
 The resource record type to query\&. It can be any valid query type\&. If it is a resource record type supported in BIND 9, it can be given by the type mnemonic (such as "NS" or "AAAA")\&. The default query type is "A", unless the
@@ -360,14 +368,20 @@ Display [do not display] the CLASS when printing the record\&.
 .PP
 \fB+[no]cmd\fR
 .RS 4
-Toggles the printing of the initial comment in the output identifying the version of
+Toggles the printing of the initial comment in the output, identifying the version of
 \fBdig\fR
-and the query options that have been applied\&. This comment is printed by default\&.
+and the query options that have been applied\&. This option always has global effect; it cannot be set globally and then overridden on a per\-lookup basis\&. The default is to print this comment\&.
 .RE
 .PP
 \fB+[no]comments\fR
 .RS 4
-Toggle the display of comment lines in the output\&. The default is to print comments\&.
+Toggles the display of some comment lines in the output, containing information about the packet header and OPT pseudosection, and the names of the response section\&. The default is to print these comments\&.
+.sp
+Other types of comments in the output are not affected by this option, but can be controlled using other command line switches\&. These include
+\fB+[no]cmd\fR,
+\fB+[no]question\fR,
+\fB+[no]stats\fR, and
+\fB+[no]rrcomments\fR\&.
 .RE
 .PP
 \fB+[no]cookie\fR\fB[=####]\fR
@@ -468,12 +482,16 @@ option is enabled\&. If short form answers are requested, the default is not to
 .PP
 \fB+[no]idnin\fR
 .RS 4
-Process [do not process] IDN domain names on input\&. This requires IDN SUPPORT to have been enabled at compile time\&. The default is to process IDN input\&.
+Process [do not process] IDN domain names on input\&. This requires IDN SUPPORT to have been enabled at compile time\&.
+.sp
+The default is to process IDN input when standard output is a tty\&. The IDN processing on input is disabled when dig output is redirected to files, pipes, and other non\-tty file descriptors\&.
 .RE
 .PP
 \fB+[no]idnout\fR
 .RS 4
-Convert [do not convert] puny code on output\&. This requires IDN SUPPORT to have been enabled at compile time\&. The default is to convert output\&.
+Convert [do not convert] puny code on output\&. This requires IDN SUPPORT to have been enabled at compile time\&.
+.sp
+The default is to process puny code on output when standard output is a tty\&. The puny code processing on output is disabled when dig output is redirected to files, pipes, and other non\-tty file descriptors\&.
 .RE
 .PP
 \fB+[no]ignore\fR
@@ -542,12 +560,12 @@ Set [restore] the DNS message opcode to the specified value\&. The default value
 .PP
 \fB+[no]qr\fR
 .RS 4
-Print [do not print] the query as it is sent\&. By default, the query is not printed\&.
+Toggles the display of the query message as it is sent\&. By default, the query is not printed\&.
 .RE
 .PP
 \fB+[no]question\fR
 .RS 4
-Print [do not print] the question section of a query when an answer is returned\&. The default is to print the question section as a comment\&.
+Toggles the display of the question section of a query when an answer is returned\&. The default is to print the question section as a comment\&.
 .RE
 .PP
 \fB+[no]rdflag\fR
@@ -560,11 +578,11 @@ A synonym for
 .RS 4
 Toggle the setting of the RD (recursion desired) bit in the query\&. This bit is set by default, which means
 \fBdig\fR
-normally sends recursive queries\&. Recursion is automatically disabled when the
+normally sends recursive queries\&. Recursion is automatically disabled when using the
 \fI+nssearch\fR
-or
+option, and when using
 \fI+trace\fR
-query options are used\&.
+except for an initial recursive query to get the list of root servers\&.
 .RE
 .PP
 \fB+retry=T\fR
@@ -595,7 +613,7 @@ determines if the name will be treated as relative or not and hence whether a se
 .PP
 \fB+[no]short\fR
 .RS 4
-Provide a terse answer\&. The default is to print the answer in a verbose form\&.
+Provide a terse answer\&. The default is to print the answer in a verbose form\&. This option always has global effect; it cannot be set globally and then overridden on a per\-lookup basis\&.
 .RE
 .PP
 \fB+[no]showsearch\fR
@@ -625,7 +643,7 @@ causes fields not to be split at all\&. The default is 56 characters, or 44 char
 .PP
 \fB+[no]stats\fR
 .RS 4
-This query option toggles the printing of statistics: when the query was made, the size of the reply and so on\&. The default behavior is to print the query statistics\&.
+Toggles the printing of statistics: when the query was made, the size of the reply and so on\&. The default behavior is to print the query statistics as a comment after each lookup\&.
 .RE
 .PP
 \fB+[no]subnet=addr[/prefix\-length]\fR
@@ -69,7 +69,7 @@ static bool short_form = false, printcmd = true,
 	multiline = false, nottl = false, noclass = false,
 	onesoa = false, use_usec = false,
 	nocrypto = false, ttlunits = false,
-	ipv4only = false, ipv6only = false;
+	ipv4only = false, ipv6only = false, digrc = true;
 static uint32_t splitwidth = 0xffffffff;

 /*% rrcomments are neither explicitly enabled nor disabled by default */
@@ -158,6 +158,7 @@ help(void) {
 "                 -m                  (enable memory usage debugging)\n"
 "                 -p port             (specify port number)\n"
 "                 -q name             (specify query name)\n"
+"                 -r                  (do not read ~/.digrc)\n"
 "                 -t type             (specify query type)\n"
 "                 -u                  (display times in usec instead of msec)\n"
 "                 -x dot-notation     (shortcut for reverse lookups)\n"
@@ -175,11 +176,13 @@ help(void) {
 "                 +bufsize=###        (Set EDNS0 Max UDP packet size)\n"
 "                 +[no]cdflag         (Set checking disabled flag in query)\n"
 "                 +[no]class          (Control display of class in records)\n"
-"                 +[no]cmd            (Control display of command line)\n"
-"                 +[no]comments       (Control display of comment lines)\n"
+"                 +[no]cmd            (Control display of command line -\n"
+"                                      global option)\n"
+"                 +[no]comments       (Control display of packet header\n"
+"                                      and section name comments)\n"
 "                 +[no]cookie         (Add a COOKIE option to the request)\n"
-"                 +[no]crypto         (Control display of cryptographic "
-				       "fields in records)\n"
+"                 +[no]crypto         (Control display of cryptographic\n"
+"                                      fields in records)\n"
 "                 +[no]defname        (Use search list (+[no]search))\n"
 "                 +[no]dnssec         (Request DNSSEC records)\n"
 "                 +domain=###         (Set default domainname)\n"
@@ -193,10 +196,14 @@ help(void) {
 "                 +[no]fail           (Don't try next server on SERVFAIL)\n"
 "                 +[no]header-only    (Send query without a question section)\n"
 "                 +[no]identify       (ID responders in short answers)\n"
-"                 +[no]idnin          (Parse IDN names)\n"
-"                 +[no]idnout         (Convert IDN response)\n"
+#ifdef HAVE_LIBIDN2
+"                 +[no]idnin          (Parse IDN names [default=on on tty])\n"
+"                 +[no]idnout         (Convert IDN response "
+					"[default=on on tty])\n"
+#endif
 "                 +[no]ignore         (Don't revert to TCP for TC responses.)\n"
-"                 +[no]keepopen       (Keep the TCP socket open between queries)\n"
+"                 +[no]keepopen       (Keep the TCP socket open between "
+					"queries)\n"
 "                 +[no]mapped         (Allow mapped IPv4 over IPv6)\n"
 "                 +[no]multiline      (Print records in an expanded format)\n"
 "                 +ndots=###          (Set search NDOTS value)\n"
@@ -213,7 +220,7 @@ help(void) {
 					"comments)\n"
 "                 +[no]search         (Set whether to use searchlist)\n"
 "                 +[no]short          (Display nothing except short\n"
-"                                      form of answer)\n"
+"                                      form of answers - global option)\n"
 "                 +[no]showsearch     (Search with intermediate results)\n"
 #ifdef DIG_SIGCHASE
 "                 +[no]sigchase       (Chase DNSSEC signatures)\n"
@@ -226,14 +233,16 @@ help(void) {
 #if defined(DIG_SIGCHASE) && DIG_SIGCHASE_TD
 "                 +[no]topdown        (Do +sigchase in top-down mode)\n"
 #endif
-"                 +[no]trace          (Trace delegation down from root [+dnssec])\n"
+"                 +[no]trace          (Trace delegation down from root "
+					"[+dnssec])\n"
 #ifdef DIG_SIGCHASE
 "                 +trusted-key=####   (Trusted Key to use with +sigchase)\n"
 #endif
 "                 +tries=###          (Set number of UDP attempts) [3]\n"
 "                 +[no]ttlid          (Control display of ttls in records)\n"
 "                 +[no]ttlunits       (Display TTLs in human-readable units)\n"
-"                 +[no]unknownformat  (Print RDATA in RFC 3597 \"unknown\" format)\n"
+"                 +[no]unknownformat  (Print RDATA in RFC 3597 \"unknown\" "
+					"format)\n"
 "                 +[no]vc             (TCP mode (+[no]tcp))\n"
 "                 +[no]zflag          (Set Z flag in query)\n"
 "        global d-opts and servers (before host name) affect all queries.\n"
@@ -562,8 +571,9 @@ printmessage(dig_query_t *query, dns_message_t *msg, bool headers) {
 	check_result(result, "dns_master_stylecreate");

 	if (query->lookup->cmdline[0] != 0) {
-		if (!short_form)
+		if (!short_form && printcmd) {
 			fputs(query->lookup->cmdline, stdout);
+		}
 		query->lookup->cmdline[0]=0;
 	}
 	debug("printmessage(%s %s %s)", headers ? "headers" : "noheaders",
@@ -585,7 +595,7 @@ printmessage(dig_query_t *query, dns_message_t *msg, bool headers) {
 	check_result(result, "isc_buffer_allocate");

 	if (query->lookup->comments && !short_form) {
-		if (query->lookup->cmdline[0] != 0)
+		if (query->lookup->cmdline[0] != 0 && printcmd)
 			printf("; %s\n", query->lookup->cmdline);
 		if (msg == query->lookup->sendmsg)
 			printf(";; Sending:\n");
@@ -1428,7 +1438,7 @@ plus_option(const char *option, bool is_batchfile,
 				lookup->trace = state;
 				lookup->trace_root = state;
 				if (state) {
-					lookup->recurse = false;
+					lookup->recurse = true;
 					lookup->identify = true;
 					lookup->comments = false;
 					rrcomments = 0;
@@ -1525,8 +1535,8 @@ plus_option(const char *option, bool is_batchfile,
 /*%
 * #true returned if value was used
 */
-static const char *single_dash_opts = "46dhimnuv";
-static const char *dash_opts = "46bcdfhikmnptvyx";
+static const char *single_dash_opts = "46dhimnruv";
+static const char *dash_opts = "46bcdfhikmnpqrtvyx";
 static bool
 dash_option(char *option, char *next, dig_lookup_t **lookup,
 	    bool *open_type_class, bool *need_clone,
@@ -1597,6 +1607,10 @@ dash_option(char *option, char *next, dig_lookup_t **lookup,
 		case 'n':
 			/* deprecated */
 			break;
+		case 'r':
+			debug("digrc (late)");
+			digrc = false;
+			break;
 		case 'u':
 			use_usec = true;
 			break;
@@ -1829,11 +1843,23 @@ preparse_args(int argc, char **argv) {
 		option = &rv[0][1];
 		while (strpbrk(option, single_dash_opts) == &option[0]) {
 			switch (option[0]) {
+			case 'd':
+				/* For debugging early startup */
+				debugging = true;
+				break;
 			case 'm':
 				memdebugging = true;
 				isc_mem_debugging = ISC_MEM_DEBUGTRACE |
 					ISC_MEM_DEBUGRECORD;
 				break;
+			case 'r':
+				/*
+				 * Must be done early, because ~/.digrc
+				 * is read before command line parsing
+				 */
+				debug("digrc (early)");
+				digrc = false;
+				break;
 			case '4':
 				if (ipv6only)
 					fatal("only one of -4 and -6 allowed");
@@ -1847,6 +1873,20 @@ preparse_args(int argc, char **argv) {
 			}
 			option = &option[1];
 		}
+		if (strlen(option) == 0U) {
+			continue;
+		}
+		/* Look for dash value option. */
+		if (strpbrk(option, dash_opts) != &option[0] ||
+		    strlen(option) > 1U) {
+			/* Error or value in option. */
+			continue;
+		}
+		/* Dash value is next argument so we need to skip it. */
+		rc--, rv++;
+		/* Handle missing argument */
+		if (rc == 0)
+			break;
 	}
 }

@@ -1899,8 +1939,9 @@ parse_args(bool is_batchfile, bool config_only,
 		 */
 		INSIST(batchfp == NULL);
 		homedir = getenv("HOME");
-		if (homedir != NULL) {
+		if (homedir != NULL && digrc) {
 			unsigned int n;
+			debug("digrc (open)");
 			n = snprintf(rcfile, sizeof(rcfile), "%s/.digrc",
 				     homedir);
 			if (n < sizeof(rcfile))
@@ -132,9 +132,10 @@

    <para>
      It is possible to set per-user defaults for <command>dig</command> via
-      <filename>${HOME}/.digrc</filename>.  This file is read and
-      any options in it
-      are applied before the command line arguments.
+      <filename>${HOME}/.digrc</filename>. This file is read and any
+      options in it are applied before the command line arguments.
+      The <option>-r</option> option disables this feature, for
+      scripts that need predictable behaviour.
    </para>

    <para>
@@ -335,6 +336,16 @@
 	</listitem>
      </varlistentry>

+      <varlistentry>
+	<term>-r</term>
+	<listitem>
+	  <para>
+	    Do not read options from <filename>${HOME}/.digrc</filename>.
+	    This is useful for scripts that need predictable behaviour.
+	  </para>
+	</listitem>
+      </varlistentry>
+
      <varlistentry>
 	<term>-t <replaceable class="parameter">type</replaceable></term>
 	<listitem>
@@ -594,9 +605,11 @@
 	  <listitem>
 	    <para>
 	      Toggles the printing of the initial comment in the
-	      output identifying the version of <command>dig</command>
-	      and the query options that have been applied.  This
-	      comment is printed by default.
+	      output, identifying the version of <command>dig</command>
+	      and the query options that have been applied.  This option
+	      always has global effect; it cannot be set globally
+	      and then overridden on a per-lookup basis.  The default
+	      is to print this comment.
 	    </para>
 	  </listitem>
 	</varlistentry>
@@ -605,8 +618,18 @@
 	  <term><option>+[no]comments</option></term>
 	  <listitem>
 	    <para>
-	      Toggle the display of comment lines in the output.
-	      The default is to print comments.
+	      Toggles the display of some comment lines in the output,
+	      containing information about the packet header and
+	      OPT pseudosection, and the names of the response
+	      section.  The default is to print these comments.
+	    </para>
+	    <para>
+	      Other types of comments in the output are not affected by
+	      this option, but can be controlled using other command
+	      line switches. These include <command>+[no]cmd</command>,
+	      <command>+[no]question</command>,
+	      <command>+[no]stats</command>, and
+	      <command>+[no]rrcomments</command>.
 	    </para>
 	  </listitem>
 	</varlistentry>
@@ -790,7 +813,13 @@
 	    <para>
 	      Process [do not process] IDN domain names on input.
 	      This requires IDN SUPPORT to have been enabled at
-	      compile time.  The default is to process IDN input.
+	      compile time.
+	    </para>
+	    <para>
+	      The default is to process IDN input when standard output
+	      is a tty.  The IDN processing on input is disabled when
+	      dig output is redirected to files, pipes, and other
+	      non-tty file descriptors.
 	    </para>
 	  </listitem>
 	</varlistentry>
@@ -801,7 +830,13 @@
 	    <para>
 	      Convert [do not convert] puny code on output.
 	      This requires IDN SUPPORT to have been enabled at
-	      compile time.  The default is to convert output.
+	      compile time.
+	    </para>
+	    <para>
+	      The default is to process puny code on output when
+	      standard output is a tty.  The puny code processing on
+	      output is disabled when dig output is redirected to
+	      files, pipes, and other non-tty file descriptors.
 	    </para>
 	  </listitem>
 	</varlistentry>
@@ -917,8 +952,8 @@
 	  <term><option>+[no]qr</option></term>
 	  <listitem>
 	    <para>
-	      Print [do not print] the query as it is sent.  By
-	      default, the query is not printed.
+	      Toggles the display of the query message as it is sent.
+	      By default, the query is not printed.
 	    </para>
 	  </listitem>
 	</varlistentry>
@@ -927,7 +962,7 @@
 	  <term><option>+[no]question</option></term>
 	  <listitem>
 	    <para>
-	      Print [do not print] the question section of a query
+	      Toggles the display of the question section of a query
 	      when an answer is returned.  The default is to print
 	      the question section as a comment.
 	    </para>
@@ -951,8 +986,10 @@
 	      in the query.  This bit is set by default, which means
 	      <command>dig</command> normally sends recursive
 	      queries.  Recursion is automatically disabled when
-	      the <parameter>+nssearch</parameter> or
-	      <parameter>+trace</parameter> query options are used.
+	      using the <parameter>+nssearch</parameter> option, and
+	      when using <parameter>+trace</parameter> except for
+	      an initial recursive query to get the list of root
+	      servers.
 	    </para>
 	  </listitem>
 	</varlistentry>
@@ -1005,7 +1042,9 @@
 	  <listitem>
 	    <para>
 	      Provide a terse answer.  The default is to print the
-	      answer in a verbose form.
+	      answer in a verbose form.  This option always has global
+	      effect; it cannot be set globally and then overridden on
+	      a per-lookup basis.
 	    </para>
 	  </listitem>
 	</varlistentry>
@@ -1051,10 +1090,9 @@
 	  <term><option>+[no]stats</option></term>
 	  <listitem>
 	    <para>
-	      This query option toggles the printing of statistics:
-	      when the query was made, the size of the reply and
-	      so on.  The default behavior is to print the query
-	      statistics.
+	      Toggles the printing of statistics: when the query was made,
+	      the size of the reply and so on.  The default behavior is to
+	      print the query statistics as a comment after each lookup.
 	    </para>
 	  </listitem>
 	</varlistentry>
@@ -106,9 +106,10 @@

    <p>
      It is possible to set per-user defaults for <span class="command"><strong>dig</strong></span> via
-      <code class="filename">${HOME}/.digrc</code>.  This file is read and
-      any options in it
-      are applied before the command line arguments.
+      <code class="filename">${HOME}/.digrc</code>. This file is read and any
+      options in it are applied before the command line arguments.
+      The <code class="option">-r</code> option disables this feature, for
+      scripts that need predictable behaviour.
    </p>

    <p>
@@ -274,6 +275,13 @@
 	    the <em class="parameter"><code>name</code></em> from other arguments.
 	  </p>
 	</dd>
+<dt><span class="term">-r</span></dt>
+<dd>
+	  <p>
+	    Do not read options from <code class="filename">${HOME}/.digrc</code>.
+	    This is useful for scripts that need predictable behaviour.
+	  </p>
+	</dd>
 <dt><span class="term">-t <em class="replaceable"><code>type</code></em></span></dt>
 <dd>
 	  <p>
@@ -482,16 +490,28 @@
 <dd>
 	    <p>
 	      Toggles the printing of the initial comment in the
-	      output identifying the version of <span class="command"><strong>dig</strong></span>
-	      and the query options that have been applied.  This
-	      comment is printed by default.
+	      output, identifying the version of <span class="command"><strong>dig</strong></span>
+	      and the query options that have been applied.  This option
+	      always has global effect; it cannot be set globally
+	      and then overridden on a per-lookup basis.  The default
+	      is to print this comment.
 	    </p>
 	  </dd>
 <dt><span class="term"><code class="option">+[no]comments</code></span></dt>
 <dd>
 	    <p>
-	      Toggle the display of comment lines in the output.
-	      The default is to print comments.
+	      Toggles the display of some comment lines in the output,
+	      containing information about the packet header and
+	      OPT pseudosection, and the names of the response
+	      section.  The default is to print these comments.
+	    </p>
+	    <p>
+	      Other types of comments in the output are not affected by
+	      this option, but can be controlled using other command
+	      line switches. These include <span class="command"><strong>+[no]cmd</strong></span>,
+	      <span class="command"><strong>+[no]question</strong></span>,
+	      <span class="command"><strong>+[no]stats</strong></span>, and
+	      <span class="command"><strong>+[no]rrcomments</strong></span>.
 	    </p>
 	  </dd>
 <dt><span class="term"><code class="option">+[no]cookie[<span class="optional">=####</span>]</code></span></dt>
@@ -631,7 +651,13 @@
 	    <p>
 	      Process [do not process] IDN domain names on input.
 	      This requires IDN SUPPORT to have been enabled at
-	      compile time.  The default is to process IDN input.
+	      compile time.
+	    </p>
+	    <p>
+	      The default is to process IDN input when standard output
+	      is a tty.  The IDN processing on input is disabled when
+	      dig output is redirected to files, pipes, and other
+	      non-tty file descriptors.
 	    </p>
 	  </dd>
 <dt><span class="term"><code class="option">+[no]idnout</code></span></dt>
@@ -639,7 +665,13 @@
 	    <p>
 	      Convert [do not convert] puny code on output.
 	      This requires IDN SUPPORT to have been enabled at
-	      compile time.  The default is to convert output.
+	      compile time.
+	    </p>
+	    <p>
+	      The default is to process puny code on output when
+	      standard output is a tty.  The puny code processing on
+	      output is disabled when dig output is redirected to
+	      files, pipes, and other non-tty file descriptors.
 	    </p>
 	  </dd>
 <dt><span class="term"><code class="option">+[no]ignore</code></span></dt>
@@ -725,14 +757,14 @@
 <dt><span class="term"><code class="option">+[no]qr</code></span></dt>
 <dd>
 	    <p>
-	      Print [do not print] the query as it is sent.  By
-	      default, the query is not printed.
+	      Toggles the display of the query message as it is sent.
+	      By default, the query is not printed.
 	    </p>
 	  </dd>
 <dt><span class="term"><code class="option">+[no]question</code></span></dt>
 <dd>
 	    <p>
-	      Print [do not print] the question section of a query
+	      Toggles the display of the question section of a query
 	      when an answer is returned.  The default is to print
 	      the question section as a comment.
 	    </p>
@@ -750,8 +782,10 @@
 	      in the query.  This bit is set by default, which means
 	      <span class="command"><strong>dig</strong></span> normally sends recursive
 	      queries.  Recursion is automatically disabled when
-	      the <em class="parameter"><code>+nssearch</code></em> or
-	      <em class="parameter"><code>+trace</code></em> query options are used.
+	      using the <em class="parameter"><code>+nssearch</code></em> option, and
+	      when using <em class="parameter"><code>+trace</code></em> except for
+	      an initial recursive query to get the list of root
+	      servers.
 	    </p>
 	  </dd>
 <dt><span class="term"><code class="option">+retry=T</code></span></dt>
@@ -792,7 +826,9 @@
 <dd>
 	    <p>
 	      Provide a terse answer.  The default is to print the
-	      answer in a verbose form.
+	      answer in a verbose form.  This option always has global
+	      effect; it cannot be set globally and then overridden on
+	      a per-lookup basis.
 	    </p>
 	  </dd>
 <dt><span class="term"><code class="option">+[no]showsearch</code></span></dt>
@@ -826,10 +862,9 @@
 <dt><span class="term"><code class="option">+[no]stats</code></span></dt>
 <dd>
 	    <p>
-	      This query option toggles the printing of statistics:
-	      when the query was made, the size of the reply and
-	      so on.  The default behavior is to print the query
-	      statistics.
+	      Toggles the printing of statistics: when the query was made,
+	      the size of the reply and so on.  The default behavior is to
+	      print the query statistics as a comment after each lookup.
 	    </p>
 	  </dd>
 <dt><span class="term"><code class="option">+[no]subnet=addr[/prefix-length]</code></span></dt>
@@ -824,12 +824,12 @@ make_empty_lookup(void) {
 	looknew->seenbadcookie = false;
 	looknew->badcookie = true;
 #ifdef WITH_IDN_SUPPORT
-	looknew->idnin = true;
+	looknew->idnin = isatty(1)?(getenv("IDN_DISABLE") == NULL):false;
 #else
 	looknew->idnin = false;
 #endif
 #ifdef WITH_IDN_OUT_SUPPORT
-	looknew->idnout = true;
+	looknew->idnout = looknew->idnin;
 #else
 	looknew->idnout = false;
 #endif
@@ -1670,6 +1670,7 @@ typedef struct dig_ednsoptname {
 } dig_ednsoptname_t;

 dig_ednsoptname_t optnames[] = {
+	{ 1, "LLQ" },		/* draft-sekar-dns-llq */
 	{ 3, "NSID" },		/* RFC 5001 */
 	{ 5, "DAU" },		/* RFC 6975 */
 	{ 6, "DHU" },		/* RFC 6975 */
@@ -1682,6 +1683,8 @@ dig_ednsoptname_t optnames[] = {
 	{ 12, "PAD" },		/* shorthand */
 	{ 13, "CHAIN" },	/* RFC 7901 */
 	{ 14, "KEY-TAG" },	/* RFC 8145 */
+	{ 16, "CLIENT-TAG" },	/* draft-bellis-dnsop-edns-tags */
+	{ 17, "SERVER-TAG" },	/* draft-bellis-dnsop-edns-tags */
 	{ 26946, "DEVICEID" },	/* Brian Hartvigsen */
 };

@@ -2540,12 +2543,14 @@ setup_lookup(dig_lookup_t *lookup) {
 	lookup->sendmsg->id = (unsigned short)id & 0xFFFF;
 	lookup->sendmsg->opcode = lookup->opcode;
 	lookup->msgcounter = 0;
+
 	/*
-	 * If this is a trace request, completely disallow recursion, since
-	 * it's meaningless for traces.
+	 * If this is a trace request, completely disallow recursion after
+	 * looking up the root name servers, since it's meaningless for traces.
 	 */
-	if (lookup->trace || (lookup->ns_search_only && !lookup->trace_root))
+	if ((lookup->trace || lookup->ns_search_only) && !lookup->trace_root) {
 		lookup->recurse = false;
+	}

 	if (lookup->recurse &&
 	    lookup->rdtype != dns_rdatatype_axfr &&
@@ -2648,7 +2653,7 @@ setup_lookup(dig_lookup_t *lookup) {

 		if (lookup->ecs_addr != NULL) {
 			uint8_t addr[16];
-			uint16_t family;
+			uint16_t family = 0;
 			uint32_t plen;
 			struct sockaddr *sa;
 			struct sockaddr_in *sin;
@@ -2705,6 +2710,7 @@ setup_lookup(dig_lookup_t *lookup) {
 				break;
 			default:
 				INSIST(0);
+				ISC_UNREACHABLE();
 			}

 			isc_buffer_init(&b, ecsbuf, sizeof(ecsbuf));
@@ -3035,27 +3041,6 @@ send_tcp_connect(dig_query_t *query) {
 		return;
 	}

-	if (specified_source &&
-	    (isc_sockaddr_pf(&query->sockaddr) !=
-	     isc_sockaddr_pf(&bind_address))) {
-		printf(";; Skipping server %s, incompatible "
-		       "address family\n", query->servname);
-		query->waiting_connect = false;
-		if (ISC_LINK_LINKED(query, link))
-			next = ISC_LIST_NEXT(query, link);
-		else
-			next = NULL;
-		l = query->lookup;
-		clear_query(query);
-		if (next == NULL) {
-			printf(";; No acceptable nameservers\n");
-			check_next_lookup(l);
-			return;
-		}
-		send_tcp_connect(next);
-		return;
-	}
-
 	INSIST(query->sock == NULL);

 	if (keep != NULL && isc_sockaddr_equal(&keepaddr, &query->sockaddr)) {
@@ -3217,6 +3202,36 @@ send_udp(dig_query_t *query) {
 	sendcount++;
 }

+/*%
+ * If there are more servers available for querying within 'lookup', initiate a
+ * TCP or UDP query to the next available server and return true; otherwise,
+ * return false.
+ */
+static bool
+try_next_server(dig_lookup_t *lookup) {
+	dig_query_t *current_query, *next_query;
+
+	current_query = lookup->current_query;
+	if (current_query == NULL || !ISC_LINK_LINKED(current_query, link)) {
+		return (false);
+	}
+
+	next_query = ISC_LIST_NEXT(current_query, link);
+	if (next_query == NULL) {
+		return (false);
+	}
+
+	debug("trying next server...");
+
+	if (lookup->tcp_mode) {
+		send_tcp_connect(next_query);
+	} else {
+		send_udp(next_query);
+	}
+
+	return (true);
+}
+
 /*%
 * IO timeout handler, used for both connect and recv timeouts.  If
 * retries are still allowed, either resend the UDP packet or queue a
@@ -3225,7 +3240,7 @@ send_udp(dig_query_t *query) {
 static void
 connect_timeout(isc_task_t *task, isc_event_t *event) {
 	dig_lookup_t *l = NULL;
-	dig_query_t *query = NULL, *cq;
+	dig_query_t *query = NULL;

 	UNUSED(task);
 	REQUIRE(event->ev_type == ISC_TIMEREVENT_IDLE);
@@ -3239,18 +3254,19 @@ connect_timeout(isc_task_t *task, isc_event_t *event) {

 	INSIST(!free_now);

-	if ((query != NULL) && (query->lookup->current_query != NULL) &&
-	    ISC_LINK_LINKED(query->lookup->current_query, link) &&
-	    (ISC_LIST_NEXT(query->lookup->current_query, link) != NULL)) {
-		debug("trying next server...");
-		cq = query->lookup->current_query;
-		if (!l->tcp_mode)
-			send_udp(ISC_LIST_NEXT(cq, link));
-		else {
-			if (query->sock != NULL)
+	if (cancel_now) {
+		UNLOCK_LOOKUP;
+		return;
+	}
+
+	if (try_next_server(l)) {
+		if (l->tcp_mode) {
+			if (query->sock != NULL) {
 				isc_socket_cancel(query->sock, NULL,
 						  ISC_SOCKCANCEL_ALL);
-			send_tcp_connect(ISC_LIST_NEXT(cq, link));
+			} else {
+				clear_query(query);
+			}
 		}
 		UNLOCK_LOOKUP;
 		return;
@@ -3705,7 +3721,7 @@ process_cookie(dig_lookup_t *l, dns_message_t *msg,
 	}

 	INSIST(msg->cc_ok == 0 && msg->cc_bad == 0);
-	if (optlen >= len && optlen >= 8U) {
+	if (len >= 8 && optlen >= 8U) {
 		if (isc_safe_memequal(isc_buffer_current(optbuf), sent, 8)) {
 			msg->cc_ok = 1;
 		} else {
@@ -3795,6 +3811,7 @@ recv_done(isc_task_t *task, isc_event_t *event) {
 	dig_lookup_t *n, *l;
 	bool docancel = false;
 	bool match = true;
+	bool done_process_opt = false;
 	unsigned int parseflags;
 	dns_messageid_t id;
 	unsigned int msgflags;
@@ -4105,6 +4122,7 @@ recv_done(isc_task_t *task, isc_event_t *event) {
 			UNLOCK_LOOKUP;
 			return;
 		}
+		done_process_opt = true;
 	}
 	if ((msg->rcode == dns_rcode_servfail && !l->servfail_stops) ||
 	    (check_ra && (msg->flags & DNS_MESSAGEFLAG_RA) == 0 && l->recurse))
@@ -4194,13 +4212,17 @@ recv_done(isc_task_t *task, isc_event_t *event) {
 		}
 	}

-	if (l->cookie != NULL) {
-		if (msg->opt == NULL)
-			printf(";; expected opt record in response\n");
-		else
+	if (!done_process_opt) {
+		if (l->cookie != NULL) {
+			if (msg->opt == NULL) {
+				printf(";; expected opt record in response\n");
+			} else {
+				process_opt(l, msg);
+			}
+		} else if (l->sendcookie && msg->opt != NULL) {
 			process_opt(l, msg);
-	} else if (l->sendcookie && msg->opt != NULL)
-		process_opt(l, msg);
+		}
+	}
 	if (!l->doing_xfr || l->xfr_q == query) {
 		if (msg->rcode == dns_rcode_nxdomain &&
 		    (l->origin != NULL || l->need_search)) {
@@ -5370,7 +5392,7 @@ child_of_zone(dns_name_t * name, dns_name_t * zone_name,

 	name_reln = dns_name_fullcompare(name, zone_name, &orderp, &nlabelsp);
 	if (name_reln != dns_namereln_subdomain ||
-	    dns_name_countlabels(name) <= dns_name_countlabels(zone_name) + 1) {
+	    dns_name_countlabels(name) < dns_name_countlabels(zone_name) + 1) {
 		printf("\n;; ERROR : ");
 		dns_name_print(name, stdout);
 		printf(" is not a subdomain of: ");
@@ -5962,6 +5984,8 @@ sigchase_td(dns_message_t *msg)
 			dns_name_init(&tmp_name, NULL);
 			result = child_of_zone(&chase_name, &chase_current_name,
 					       &tmp_name);
+			if (result != ISC_R_SUCCESS)
+				goto cleanandgo;
 			if (dns_name_dynamic(&chase_authority_name))
 				free_name(&chase_authority_name);
 			dup_name(&tmp_name, &chase_authority_name);
@@ -158,6 +158,7 @@ show_usage(void) {
 "       -s a SERVFAIL response should stop query\n"
 "       -t specifies the query type\n"
 "       -T enables TCP/IP mode\n"
+"       -U enables UDP mode\n"
 "       -v enables verbose output\n"
 "       -V print version number and exit\n"
 "       -w specifies to wait forever for a reply\n"
@@ -635,28 +636,29 @@ pre_parse_args(int argc, char **argv) {
 			break;
 		case 'a': break;
 		case 'c': break;
+		case 'C': break;
 		case 'd': break;
+		case 'D':
+			if (debugging)
+				debugtiming = true;
+			debugging = true;
+			break;
 		case 'i': break;
 		case 'l': break;
 		case 'n': break;
+		case 'N': break;
 		case 'r': break;
+		case 'R': break;
 		case 's': break;
 		case 't': break;
+		case 'T': break;
+		case 'U': break;
 		case 'v': break;
 		case 'V':
 			  version();
 			  exit(0);
 			  break;
 		case 'w': break;
-		case 'C': break;
-		case 'D':
-			if (debugging)
-				debugtiming = true;
-			debugging = true;
-			break;
-		case 'N': break;
-		case 'R': break;
-		case 'T': break;
 		case 'W': break;
 		default:
 			show_usage();
@@ -277,6 +277,17 @@ Try the next nameserver if a nameserver responds with SERVFAIL or a referral (no
 .PP
 \fBnslookup\fR
 returns with an exit status of 1 if any query failed, and 0 otherwise\&.
+.SH "IDN SUPPORT"
+.PP
+If
+\fBnslookup\fR
+has been built with IDN (internationalized domain name) support, it can accept and display non\-ASCII domain names\&.
+\fBnslookup\fR
+appropriately converts character encoding of domain name before sending a request to DNS server or displaying a reply from the server\&. If you\*(Aqd like to turn off the IDN support for some reason, define the
+\fBIDN_DISABLE\fR
+environment variable\&. The IDN support is disabled if the variable is set when
+\fBnslookup\fR
+runs or when the standard output is not a tty\&.
 .SH "FILES"
 .PP
 /etc/resolv\&.conf
@@ -891,12 +891,29 @@ get_next_command(void) {
 	isc_mem_free(mctx, buf);
 }

+ISC_PLATFORM_NORETURN_PRE static void
+usage(void) ISC_PLATFORM_NORETURN_POST;
+
+static void
+usage(void) {
+    fprintf(stderr, "Usage:\n");
+    fprintf(stderr,
+"   nslookup [-opt ...]             # interactive mode using default server\n");
+    fprintf(stderr,
+"   nslookup [-opt ...] - server    # interactive mode using 'server'\n");
+    fprintf(stderr,
+"   nslookup [-opt ...] host        # just look up 'host' using default server\n");
+    fprintf(stderr,
+"   nslookup [-opt ...] host server # just look up 'host' using 'server'\n");
+    exit(1);
+}
+
 static void
 parse_args(int argc, char **argv) {
 	bool have_lookup = false;

 	usesearch = true;
-	for (argc--, argv++; argc > 0; argc--, argv++) {
+	for (argc--, argv++; argc > 0 && argv[0] != NULL; argc--, argv++) {
 		debug("main parsing %s", argv[0]);
 		if (argv[0][0] == '-') {
 			if (strncasecmp(argv[0], "-ver", 4) == 0) {
@@ -912,6 +929,9 @@ parse_args(int argc, char **argv) {
 				in_use = true;
 				addlookup(argv[0]);
 			} else {
+				if (argv[1] != NULL) {
+					usage();
+				}
 				set_nameserver(argv[0]);
 				check_ra = false;
 			}
@@ -479,6 +479,22 @@ nslookup -query=hinfo  -timeout=10
    </para>
  </refsection>

+  <refsection><info><title>IDN SUPPORT</title></info>
+
+    <para>
+      If <command>nslookup</command> has been built with IDN (internationalized
+      domain name) support, it can accept and display non-ASCII domain names.
+      <command>nslookup</command> appropriately converts character encoding of
+      domain name before sending a request to DNS server or displaying a
+      reply from the server.
+      If you'd like to turn off the IDN support for some reason, define
+      the <envar>IDN_DISABLE</envar> environment variable.
+      The IDN support is disabled if the variable is set when
+      <command>nslookup</command> runs or when the standard output is not
+      a tty.
+    </para>
+  </refsection>
+
  <refsection><info><title>FILES</title></info>

    <para><filename>/etc/resolv.conf</filename>
@@ -362,14 +362,31 @@ nslookup -query=hinfo  -timeout=10
  </div>

  <div class="refsection">
-<a name="id-1.11"></a><h2>FILES</h2>
+<a name="id-1.11"></a><h2>IDN SUPPORT</h2>
+
+    <p>
+      If <span class="command"><strong>nslookup</strong></span> has been built with IDN (internationalized
+      domain name) support, it can accept and display non-ASCII domain names.
+      <span class="command"><strong>nslookup</strong></span> appropriately converts character encoding of
+      domain name before sending a request to DNS server or displaying a
+      reply from the server.
+      If you'd like to turn off the IDN support for some reason, define
+      the <code class="envar">IDN_DISABLE</code> environment variable.
+      The IDN support is disabled if the variable is set when
+      <span class="command"><strong>nslookup</strong></span> runs or when the standard output is not
+      a tty.
+    </p>
+  </div>
+
+  <div class="refsection">
+<a name="id-1.12"></a><h2>FILES</h2>

    <p><code class="filename">/etc/resolv.conf</code>
    </p>
  </div>

  <div class="refsection">
-<a name="id-1.12"></a><h2>SEE ALSO</h2>
+<a name="id-1.13"></a><h2>SEE ALSO</h2>

    <p><span class="citerefentry">
        <span class="refentrytitle">dig</span>(1)
@@ -1,29 +1,29 @@
-Microsoft Developer Studio Workspace File, Format Version 6.00
-# WARNING: DO NOT EDIT OR DELETE THIS WORKSPACE FILE!
-
-###############################################################################
-
-Project: "dighost"=".\dighost.dsp" - Package Owner=<4>
-
-Package=<5>
-{{{
-}}}
-
-Package=<4>
-{{{
-}}}
-
-###############################################################################
-
-Global:
-
-Package=<5>
-{{{
-}}}
-
-Package=<3>
-{{{
-}}}
-
-###############################################################################
-
+Microsoft Developer Studio Workspace File, Format Version 6.00
+# WARNING: DO NOT EDIT OR DELETE THIS WORKSPACE FILE!
+
+###############################################################################
+
+Project: "dighost"=".\dighost.dsp" - Package Owner=<4>
+
+Package=<5>
+{{{
+}}}
+
+Package=<4>
+{{{
+}}}
+
+###############################################################################
+
+Global:
+
+Package=<5>
+{{{
+}}}
+
+Package=<3>
+{{{
+}}}
+
+###############################################################################
+
@@ -7,8 +7,6 @@
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.

-# $Id: Makefile.in,v 1.42.332.1 2011/03/16 06:37:51 each Exp $
-
 srcdir =	@srcdir@
 VPATH =		@srcdir@
 top_srcdir =	@top_srcdir@
@@ -23,7 +21,7 @@ CDEFINES =	-DVERSION=\"${VERSION}\" @USE_PKCS11@ @PKCS11_ENGINE@ \
 		@CRYPTO@ -DPK11_LIB_LOCATION=\"@PKCS11_PROVIDER@\"
 CWARNINGS =

-DNSLIBS =	../../lib/dns/libdns.@A@ @DNS_CRYPTO_LIBS@
+DNSLIBS =	../../lib/dns/libdns.@A@ ${MAXMINDDB_LIBS} @DNS_CRYPTO_LIBS@
 ISCLIBS =	../../lib/isc/libisc.@A@
 ISCNOSYMLIBS =	../../lib/isc/libisc-nosymtbl.@A@

@@ -39,61 +39,103 @@
 dnssec-dsfromkey \- DNSSEC DS RR generation tool
 .SH "SYNOPSIS"
 .HP \w'\fBdnssec\-dsfromkey\fR\ 'u
-\fBdnssec\-dsfromkey\fR [\fB\-v\ \fR\fB\fIlevel\fR\fR] [\fB\-1\fR] [\fB\-2\fR] [\fB\-a\ \fR\fB\fIalg\fR\fR] [\fB\-C\fR] [\fB\-l\ \fR\fB\fIdomain\fR\fR] [\fB\-T\ \fR\fB\fITTL\fR\fR] {keyfile}
+\fBdnssec\-dsfromkey\fR [\fB\-1\fR | \fB\-2\fR | \fB\-a\ \fR\fB\fIalg\fR\fR] [\fB\-C\fR | \fB\-l\ \fR\fB\fIdomain\fR\fR] [\fB\-T\ \fR\fB\fITTL\fR\fR] [\fB\-v\ \fR\fB\fIlevel\fR\fR] [\fB\-K\ \fR\fB\fIdirectory\fR\fR] {keyfile}
 .HP \w'\fBdnssec\-dsfromkey\fR\ 'u
-\fBdnssec\-dsfromkey\fR {\-s} [\fB\-1\fR] [\fB\-2\fR] [\fB\-a\ \fR\fB\fIalg\fR\fR] [\fB\-K\ \fR\fB\fIdirectory\fR\fR] [\fB\-l\ \fR\fB\fIdomain\fR\fR] [\fB\-s\fR] [\fB\-c\ \fR\fB\fIclass\fR\fR] [\fB\-T\ \fR\fB\fITTL\fR\fR] [\fB\-f\ \fR\fB\fIfile\fR\fR] [\fB\-A\fR] [\fB\-v\ \fR\fB\fIlevel\fR\fR] {dnsname}
+\fBdnssec\-dsfromkey\fR [\fB\-1\fR | \fB\-2\fR | \fB\-a\ \fR\fB\fIalg\fR\fR] [\fB\-C\fR | \fB\-l\ \fR\fB\fIdomain\fR\fR] [\fB\-T\ \fR\fB\fITTL\fR\fR] [\fB\-v\ \fR\fB\fIlevel\fR\fR] [\fB\-c\ \fR\fB\fIclass\fR\fR] [\fB\-A\fR] {\fB\-f\ \fR\fB\fIfile\fR\fR} [dnsname]
 .HP \w'\fBdnssec\-dsfromkey\fR\ 'u
-\fBdnssec\-dsfromkey\fR [\fB\-h\fR] [\fB\-V\fR]
+\fBdnssec\-dsfromkey\fR [\fB\-1\fR | \fB\-2\fR | \fB\-a\ \fR\fB\fIalg\fR\fR] [\fB\-C\fR | \fB\-l\ \fR\fB\fIdomain\fR\fR] [\fB\-T\ \fR\fB\fITTL\fR\fR] [\fB\-v\ \fR\fB\fIlevel\fR\fR] [\fB\-c\ \fR\fB\fIclass\fR\fR] [\fB\-K\ \fR\fB\fIdirectory\fR\fR] {\-s} {dnsname}
+.HP \w'\fBdnssec\-dsfromkey\fR\ 'u
+\fBdnssec\-dsfromkey\fR [\fB\-h\fR | \fB\-V\fR]
 .SH "DESCRIPTION"
 .PP
+The
 \fBdnssec\-dsfromkey\fR
-outputs the Delegation Signer (DS) resource record (RR), as defined in RFC 3658 and RFC 4509, for the given key(s)\&.
+command outputs DS (Delegation Signer) resource records (RRs) and other similarly\-constructed RRs: with the
+\fB\-l\fR
+option it outputs DLV (DNSSEC Lookaside Validation) RRs; or with the
+\fB\-C\fR
+it outputs CDS (Child DS) RRs\&.
+.PP
+The input keys can be specified in a number of ways:
+.PP
+By default,
+\fBdnssec\-dsfromkey\fR
+reads a key file named like
+Knnnn\&.+aaa+iiiii\&.key, as generated by
+\fBdnssec\-keygen\fR\&.
+.PP
+With the
+\fB\-f \fR\fB\fIfile\fR\fR
+option,
+\fBdnssec\-dsfromkey\fR
+reads keys from a zone file or partial zone file (which can contain just the DNSKEY records)\&.
+.PP
+With the
+\fB\-s\fR
+option,
+\fBdnssec\-dsfromkey\fR
+reads a
+keyset\-
+file, as generated by
+\fBdnssec\-keygen\fR\fB\-C\fR\&.
 .SH "OPTIONS"
 .PP
 \-1
 .RS 4
-Use SHA\-1 as the digest algorithm (the default is to use both SHA\-1 and SHA\-256)\&.
+An abbreviation for
+\fB\-a SHA1\fR
 .RE
 .PP
 \-2
 .RS 4
-Use SHA\-256 as the digest algorithm\&.
+An abbreviation for
+\fB\-a SHA\-256\fR
 .RE
 .PP
 \-a \fIalgorithm\fR
 .RS 4
-Select the digest algorithm\&. The value of
-\fBalgorithm\fR
-must be one of SHA\-1 (SHA1), SHA\-256 (SHA256), GOST or SHA\-384 (SHA384)\&. These values are case insensitive\&.
+Specify a digest algorithm to use when converting DNSKEY records to DS records\&. This option can be repeated, so that multiple DS records are created for each DNSKEY record\&.
+.sp
+The
+\fIalgorithm\fR
+must be one of SHA\-1, SHA\-256, or SHA\-384\&. These values are case insensitive, and the hyphen may be omitted\&. If no algorithm is specified, the default is SHA\-256\&.
+.RE
+.PP
+\-A
+.RS 4
+Include ZSKs when generating DS records\&. Without this option, only keys which have the KSK flag set will be converted to DS records and printed\&. Useful only in
+\fB\-f\fR
+zone file mode\&.
+.RE
+.PP
+\-c \fIclass\fR
+.RS 4
+Specifies the DNS class (default is IN)\&. Useful only in
+\fB\-s\fR
+keyset or
+\fB\-f\fR
+zone file mode\&.
 .RE
 .PP
 \-C
 .RS 4
-Generate CDS records rather than DS records\&. This is mutually exclusive with generating lookaside records\&.
-.RE
-.PP
-\-T \fITTL\fR
-.RS 4
-Specifies the TTL of the DS records\&.
-.RE
-.PP
-\-K \fIdirectory\fR
-.RS 4
-Look for key files (or, in keyset mode,
-keyset\-
-files) in
-\fBdirectory\fR\&.
+Generate CDS records rather than DS records\&. This is mutually exclusive with the
+\fB\-l\fR
+option for generating DLV records\&.
 .RE
 .PP
 \-f \fIfile\fR
 .RS 4
-Zone file mode: in place of the keyfile name, the argument is the DNS domain name of a zone master file, which can be read from
+Zone file mode:
+\fBdnssec\-dsfromkey\fR\*(Aqs final
+\fIdnsname\fR
+argument is the DNS domain name of a zone whose master file can be read from
 \fBfile\fR\&. If the zone name is the same as
 \fBfile\fR, then it may be omitted\&.
 .sp
 If
-\fBfile\fR
-is set to
+\fIfile\fR
+is
 "\-", then the zone data is read from the standard input\&. This makes it possible to use the output of the
 \fBdig\fR
 command as input, as in:
@@ -101,26 +143,41 @@ command as input, as in:
 \fBdig dnskey example\&.com | dnssec\-dsfromkey \-f \- example\&.com\fR
 .RE
 .PP
-\-A
+\-h
 .RS 4
-Include ZSKs when generating DS records\&. Without this option, only keys which have the KSK flag set will be converted to DS records and printed\&. Useful only in zone file mode\&.
+Prints usage information\&.
+.RE
+.PP
+\-K \fIdirectory\fR
+.RS 4
+Look for key files or
+keyset\-
+files in
+\fBdirectory\fR\&.
 .RE
 .PP
 \-l \fIdomain\fR
 .RS 4
 Generate a DLV set instead of a DS set\&. The specified
-\fBdomain\fR
-is appended to the name for each record in the set\&. The DNSSEC Lookaside Validation (DLV) RR is described in RFC 4431\&. This is mutually exclusive with generating CDS records\&.
+\fIdomain\fR
+is appended to the name for each record in the set\&. This is mutually exclusive with the
+\fB\-C\fR
+option for generating CDS records\&.
 .RE
 .PP
 \-s
 .RS 4
-Keyset mode: in place of the keyfile name, the argument is the DNS domain name of a keyset file\&.
+Keyset mode:
+\fBdnssec\-dsfromkey\fR\*(Aqs final
+\fIdnsname\fR
+argument is the DNS domain name used to locate a
+keyset\-
+file\&.
 .RE
 .PP
-\-c \fIclass\fR
+\-T \fITTL\fR
 .RS 4
-Specifies the DNS class (default is IN)\&. Useful only in keyset or zone file mode\&.
+Specifies the TTL of the DS records\&. By default the TTL is omitted\&.
 .RE
 .PP
 \-v \fIlevel\fR
@@ -128,11 +185,6 @@ Specifies the DNS class (default is IN)\&. Useful only in keyset or zone file mo
 Sets the debugging level\&.
 .RE
 .PP
-\-h
-.RS 4
-Prints usage information\&.
-.RE
-.PP
 \-V
 .RS 4
 Prints version information\&.
@@ -141,16 +193,16 @@ Prints version information\&.
 .PP
 To build the SHA\-256 DS RR from the
 \fBKexample\&.com\&.+003+26160\fR
-keyfile name, the following command would be issued:
+keyfile name, you can issue the following command:
 .PP
 \fBdnssec\-dsfromkey \-2 Kexample\&.com\&.+003+26160\fR
 .PP
 The command would print something like:
 .PP
-\fBexample\&.com\&. IN DS 26160 5 2 3A1EADA7A74B8D0BA86726B0C227AA85AB8BBD2B2004F41A868A54F0 C5EA0B94\fR
+\fBexample\&.com\&. IN DS 26160 5 2 3A1EADA7A74B8D0BA86726B0C227AA85AB8BBD2B2004F41A868A54F0C5EA0B94\fR
 .SH "FILES"
 .PP
-The keyfile can be designed by the key identification
+The keyfile can be designated by the key identification
 Knnnn\&.+aaa+iiiii
 or the full file name
 Knnnn\&.+aaa+iiiii\&.key
@@ -170,9 +222,16 @@ A keyfile error can give a "file not found" even if the file exists\&.
 \fBdnssec-keygen\fR(8),
 \fBdnssec-signzone\fR(8),
 BIND 9 Administrator Reference Manual,
-RFC 3658,
-RFC 4431\&.
-RFC 4509\&.
+RFC 3658
+(DS RRs),
+RFC 4431
+(DLV RRs),
+RFC 4509
+(SHA\-256 for DS RRs),
+RFC 6605
+(SHA\-384 for DS RRs),
+RFC 7344
+(CDS and CDNSKEY RRs)\&.
 .SH "AUTHOR"
 .PP
 \fBInternet Systems Consortium, Inc\&.\fR
@@ -236,7 +236,7 @@ logkey(dns_rdata_t *rdata)
 }

 static void
-emit(unsigned int dtype, bool showall, char *lookaside,
+emit(dns_dsdigest_t dtype, bool showall, char *lookaside,
     bool cds, dns_rdata_t *rdata)
 {
 	isc_result_t result;
@@ -319,30 +319,27 @@ usage(void) ISC_PLATFORM_NORETURN_POST;
 static void
 usage(void) {
 	fprintf(stderr, "Usage:\n");
-	fprintf(stderr,	"    %s options [-K dir] keyfile\n\n", program);
-	fprintf(stderr, "    %s options [-K dir] [-c class] -s dnsname\n\n",
-		program);
-	fprintf(stderr, "    %s options -f zonefile (as zone name)\n\n", program);
-	fprintf(stderr, "    %s options -f zonefile zonename\n\n", program);
+	fprintf(stderr,	"    %s [options] keyfile\n\n", program);
+	fprintf(stderr, "    %s [options] -f zonefile [zonename]\n\n", program);
+	fprintf(stderr, "    %s [options] -s dnsname\n\n", program);
+	fprintf(stderr, "    %s [-h|-V]\n\n", program);
 	fprintf(stderr, "Version: %s\n", VERSION);
-	fprintf(stderr, "Options:\n");
-	fprintf(stderr, "    -v <verbose level>\n");
-	fprintf(stderr, "    -V: print version information\n");
-	fprintf(stderr, "    -K <directory>: directory in which to find "
-			"key file or keyset file\n");
-	fprintf(stderr, "    -a algorithm: digest algorithm "
-			"(SHA-1, SHA-256, GOST or SHA-384)\n");
-	fprintf(stderr, "    -1: use SHA-1\n");
-	fprintf(stderr, "    -2: use SHA-256\n");
-	fprintf(stderr, "    -C: print CDS record\n");
-	fprintf(stderr, "    -l: add lookaside zone and print DLV records\n");
-	fprintf(stderr, "    -s: read keyset from keyset-<dnsname> file\n");
-	fprintf(stderr, "    -c class: rdata class for DS set (default: IN)\n");
-	fprintf(stderr, "    -T TTL\n");
-	fprintf(stderr, "    -f file: read keyset from zone file\n");
-	fprintf(stderr, "    -A: when used with -f, "
-			"include all keys in DS set, not just KSKs\n");
-	fprintf(stderr, "Output: DS or DLV RRs\n");
+	fprintf(stderr, "Options:\n"
+"    -1: digest algorithm SHA-1\n"
+"    -2: digest algorithm SHA-256\n"
+"    -a algorithm: digest algorithm (SHA-1, SHA-256, SHA-384 or GOST)\n"
+"    -A: include all keys in DS set, not just KSKs (-f only)\n"
+"    -c class: rdata class for DS set (default IN) (-f or -s only)\n"
+"    -C: print CDS records\n"
+"    -f zonefile: read keys from a zone file\n"
+"    -h: print help information\n"
+"    -K directory: where to find key or keyset files\n"
+"    -l zone: print DLV records in the given lookaside zone\n"
+"    -s: read keys from keyset-<dnsname> file\n"
+"    -T: TTL of output records (omitted by default)\n"
+"    -v level: verbosity\n"
+"    -V: print version information\n");
+	fprintf(stderr, "Output: DS, DLV, or CDS RRs\n");

 	exit (-1);
 }
@@ -354,7 +351,7 @@ main(int argc, char **argv) {
 	char		*lookaside = NULL;
 	char		*endp;
 	int		ch;
-	unsigned int	dtype = DNS_DSDIGEST_SHA1;
+	dns_dsdigest_t	dtype = DNS_DSDIGEST_SHA1;
 	bool	cds = false;
 	bool	both = true;
 	bool	usekeyset = false;
@@ -49,56 +49,108 @@
  <refsynopsisdiv>
    <cmdsynopsis sepchar=" ">
      <command>dnssec-dsfromkey</command>
-      <arg choice="opt" rep="norepeat"><option>-v <replaceable class="parameter">level</replaceable></option></arg>
-      <arg choice="opt" rep="norepeat"><option>-1</option></arg>
-      <arg choice="opt" rep="norepeat"><option>-2</option></arg>
-      <arg choice="opt" rep="norepeat"><option>-a <replaceable class="parameter">alg</replaceable></option></arg>
-      <arg choice="opt" rep="norepeat"><option>-C</option></arg>
-      <arg choice="opt" rep="norepeat"><option>-l <replaceable class="parameter">domain</replaceable></option></arg>
+      <group choice="opt">
+	<arg choice="plain"><option>-1</option></arg>
+	<arg choice="plain"><option>-2</option></arg>
+	<arg choice="plain"><option>-a <replaceable class="parameter">alg</replaceable></option></arg>
+      </group>
+      <group>
+	<arg choice="plain" rep="norepeat"><option>-C</option></arg>
+	<arg choice="plain" rep="norepeat"><option>-l <replaceable class="parameter">domain</replaceable></option></arg>
+      </group>
      <arg choice="opt" rep="norepeat"><option>-T <replaceable class="parameter">TTL</replaceable></option></arg>
+      <arg choice="opt" rep="norepeat"><option>-v <replaceable class="parameter">level</replaceable></option></arg>
+      <arg choice="opt" rep="norepeat"><option>-K <replaceable class="parameter">directory</replaceable></option></arg>
      <arg choice="req" rep="norepeat">keyfile</arg>
    </cmdsynopsis>
    <cmdsynopsis sepchar=" ">
      <command>dnssec-dsfromkey</command>
-      <arg choice="req" rep="norepeat">-s</arg>
-      <arg choice="opt" rep="norepeat"><option>-1</option></arg>
-      <arg choice="opt" rep="norepeat"><option>-2</option></arg>
-      <arg choice="opt" rep="norepeat"><option>-a <replaceable class="parameter">alg</replaceable></option></arg>
-      <arg choice="opt" rep="norepeat"><option>-K <replaceable class="parameter">directory</replaceable></option></arg>
-      <arg choice="opt" rep="norepeat"><option>-l <replaceable class="parameter">domain</replaceable></option></arg>
-      <arg choice="opt" rep="norepeat"><option>-s</option></arg>
-      <arg choice="opt" rep="norepeat"><option>-c <replaceable class="parameter">class</replaceable></option></arg>
+      <group choice="opt">
+	<arg choice="plain"><option>-1</option></arg>
+	<arg choice="plain"><option>-2</option></arg>
+	<arg choice="plain"><option>-a <replaceable class="parameter">alg</replaceable></option></arg>
+      </group>
+      <group>
+	<arg choice="plain" rep="norepeat"><option>-C</option></arg>
+	<arg choice="plain" rep="norepeat"><option>-l <replaceable class="parameter">domain</replaceable></option></arg>
+      </group>
      <arg choice="opt" rep="norepeat"><option>-T <replaceable class="parameter">TTL</replaceable></option></arg>
-      <arg choice="opt" rep="norepeat"><option>-f <replaceable class="parameter">file</replaceable></option></arg>
-      <arg choice="opt" rep="norepeat"><option>-A</option></arg>
      <arg choice="opt" rep="norepeat"><option>-v <replaceable class="parameter">level</replaceable></option></arg>
-      <arg choice="req" rep="norepeat">dnsname</arg>
-   </cmdsynopsis>
+      <arg choice="opt" rep="norepeat"><option>-c <replaceable class="parameter">class</replaceable></option></arg>
+      <arg choice="opt" rep="norepeat"><option>-A</option></arg>
+      <arg choice="req" rep="norepeat"><option>-f <replaceable class="parameter">file</replaceable></option></arg>
+      <arg choice="opt" rep="norepeat">dnsname</arg>
+    </cmdsynopsis>
    <cmdsynopsis sepchar=" ">
      <command>dnssec-dsfromkey</command>
-      <arg choice="opt" rep="norepeat"><option>-h</option></arg>
-      <arg choice="opt" rep="norepeat"><option>-V</option></arg>
-   </cmdsynopsis>
+      <group choice="opt">
+	<arg choice="plain"><option>-1</option></arg>
+	<arg choice="plain"><option>-2</option></arg>
+	<arg choice="plain"><option>-a <replaceable class="parameter">alg</replaceable></option></arg>
+      </group>
+      <group>
+	<arg choice="plain" rep="norepeat"><option>-C</option></arg>
+	<arg choice="plain" rep="norepeat"><option>-l <replaceable class="parameter">domain</replaceable></option></arg>
+      </group>
+      <arg choice="opt" rep="norepeat"><option>-T <replaceable class="parameter">TTL</replaceable></option></arg>
+      <arg choice="opt" rep="norepeat"><option>-v <replaceable class="parameter">level</replaceable></option></arg>
+      <arg choice="opt" rep="norepeat"><option>-c <replaceable class="parameter">class</replaceable></option></arg>
+      <arg choice="opt" rep="norepeat"><option>-K <replaceable class="parameter">directory</replaceable></option></arg>
+      <arg choice="req" rep="norepeat">-s</arg>
+      <arg choice="req" rep="norepeat">dnsname</arg>
+    </cmdsynopsis>
+    <cmdsynopsis sepchar=" ">
+      <command>dnssec-dsfromkey</command>
+      <group choice="opt">
+	<arg choice="plain" rep="norepeat"><option>-h</option></arg>
+	<arg choice="plain" rep="norepeat"><option>-V</option></arg>
+      </group>
+    </cmdsynopsis>
  </refsynopsisdiv>

  <refsection><info><title>DESCRIPTION</title></info>

-    <para><command>dnssec-dsfromkey</command>
-      outputs the Delegation Signer (DS) resource record (RR), as defined in
-      RFC 3658 and RFC 4509, for the given key(s).
+    <para>
+      The <command>dnssec-dsfromkey</command> command outputs DS (Delegation
+      Signer) resource records (RRs) and other similarly-constructed RRs:
+      with the <option>-l</option> option it outputs DLV (DNSSEC Lookaside
+      Validation) RRs; or with the <option>-C</option> it outputs CDS (Child
+      DS) RRs.
    </para>
+
+    <para>
+      The input keys can be specified in a number of ways:
+    </para>
+
+    <para>
+      By default, <command>dnssec-dsfromkey</command> reads a key file
+      named like <filename>Knnnn.+aaa+iiiii.key</filename>, as generated
+      by <command>dnssec-keygen</command>.
+    </para>
+
+    <para>
+      With the <option>-f <replaceable>file</replaceable></option>
+      option, <command>dnssec-dsfromkey</command> reads keys from a zone file
+      or partial zone file (which can contain just the DNSKEY records).
+    </para>
+
+    <para>
+      With the <option>-s</option>
+      option, <command>dnssec-dsfromkey</command> reads
+      a <filename>keyset-</filename> file, as generated
+      by <command>dnssec-keygen</command> <option>-C</option>.
+    </para>
+
  </refsection>

  <refsection><info><title>OPTIONS</title></info>

-
    <variablelist>
      <varlistentry>
 	<term>-1</term>
 	<listitem>
 	  <para>
-	    Use SHA-1 as the digest algorithm (the default is to use
-	    both SHA-1 and SHA-256).
+	    An abbreviation for <option>-a SHA1</option>
 	  </para>
 	</listitem>
      </varlistentry>
@@ -107,7 +159,7 @@
 	<term>-2</term>
 	<listitem>
 	  <para>
-	    Use SHA-256 as the digest algorithm.
+	    An abbreviation for <option>-a SHA-256</option>
 	  </para>
 	</listitem>
      </varlistentry>
@@ -116,40 +168,49 @@
 	<term>-a <replaceable class="parameter">algorithm</replaceable></term>
 	<listitem>
 	  <para>
-	    Select the digest algorithm. The value of
-	    <option>algorithm</option> must be one of SHA-1 (SHA1),
-	    SHA-256 (SHA256), GOST or SHA-384 (SHA384).
-	    These values are case insensitive.
+	    Specify a digest algorithm to use when converting DNSKEY
+	    records to DS records. This option can be repeated, so
+	    that multiple DS records are created for each DNSKEY
+	    record.
+          </para>
+          <para>
+	    The <replaceable>algorithm</replaceable> must be one of
+	    SHA-1, SHA-256, or SHA-384.  These values are case insensitive,
+	    and the hyphen may be omitted.  If no algorithm is specified,
+	    the default is SHA-256.
 	  </para>
 	</listitem>
      </varlistentry>

+      <varlistentry>
+        <term>-A</term>
+        <listitem>
+          <para>
+            Include ZSKs when generating DS records. Without this option, only
+            keys which have the KSK flag set will be converted to DS records
+            and printed. Useful only in <option>-f</option> zone file mode.
+          </para>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry>
+	<term>-c <replaceable class="parameter">class</replaceable></term>
+	<listitem>
+	  <para>
+	    Specifies the DNS class (default is IN). Useful only
+	    in <option>-s</option> keyset or <option>-f</option>
+	    zone file mode.
+	  </para>
+	  </listitem>
+      </varlistentry>
+
      <varlistentry>
 	<term>-C</term>
 	<listitem>
 	  <para>
-	    Generate CDS records rather than DS records.  This is mutually
-	    exclusive with generating lookaside records.
-	  </para>
-	</listitem>
-      </varlistentry>
-
-      <varlistentry>
-	<term>-T <replaceable class="parameter">TTL</replaceable></term>
-	<listitem>
-	  <para>
-	    Specifies the TTL of the DS records.
-	  </para>
-	  </listitem>
-      </varlistentry>
-
-      <varlistentry>
-	<term>-K <replaceable class="parameter">directory</replaceable></term>
-	<listitem>
-	  <para>
-	    Look for key files (or, in keyset mode,
-	    <filename>keyset-</filename> files) in
-	    <option>directory</option>.
+	    Generate CDS records rather than DS records. This is mutually
+	    exclusive with the <option>-l</option> option for generating DLV
+	    records.
 	  </para>
 	</listitem>
      </varlistentry>
@@ -158,13 +219,14 @@
 	<term>-f <replaceable class="parameter">file</replaceable></term>
 	<listitem>
 	  <para>
-	    Zone file mode: in place of the keyfile name, the argument is
-	    the DNS domain name of a zone master file, which can be read
+	    Zone file mode: <command>dnssec-dsfromkey</command>'s
+	    final <replaceable>dnsname</replaceable> argument is
+	    the DNS domain name of a zone whose master file can be read
 	    from <option>file</option>.  If the zone name is the same as
 	    <option>file</option>, then it may be omitted.
 	  </para>
 	  <para>
-	    If <option>file</option> is set to <literal>"-"</literal>, then
+	    If <replaceable>file</replaceable> is <literal>"-"</literal>, then
 	    the zone data is read from the standard input.  This makes it
 	    possible to use the output of the <command>dig</command>
 	    command as input, as in:
@@ -176,26 +238,33 @@
      </varlistentry>

      <varlistentry>
-        <term>-A</term>
-        <listitem>
-          <para>
-            Include ZSKs when generating DS records.  Without this option,
-            only keys which have the KSK flag set will be converted to DS
-            records and printed.  Useful only in zone file mode.
-          </para>
-        </listitem>
+	<term>-h</term>
+	<listitem>
+	  <para>
+	    Prints usage information.
+	  </para>
+	</listitem>
+      </varlistentry>
+
+      <varlistentry>
+	<term>-K <replaceable class="parameter">directory</replaceable></term>
+	<listitem>
+	  <para>
+	    Look for key files or <filename>keyset-</filename> files in
+	    <option>directory</option>.
+	  </para>
+	</listitem>
      </varlistentry>

      <varlistentry>
 	<term>-l <replaceable class="parameter">domain</replaceable></term>
 	<listitem>
 	  <para>
-	    Generate a DLV set instead of a DS set.  The specified
-	    <option>domain</option> is appended to the name for each
+	    Generate a DLV set instead of a DS set. The specified
+	    <replaceable>domain</replaceable> is appended to the name for each
 	    record in the set.
-	    The DNSSEC Lookaside Validation (DLV) RR is described
-	    in RFC 4431.  This is mutually exclusive with generating
-	    CDS records.
+	    This is mutually exclusive with the <option>-C</option> option
+	    for generating CDS records.
 	  </para>
 	</listitem>
      </varlistentry>
@@ -204,18 +273,18 @@
 	<term>-s</term>
 	<listitem>
 	  <para>
-	    Keyset mode: in place of the keyfile name, the argument is
-	    the DNS domain name of a keyset file.
+	    Keyset mode: <command>dnssec-dsfromkey</command>'s
+	    final <replaceable>dnsname</replaceable> argument is the DNS
+	    domain name used to locate a <filename>keyset-</filename> file.
 	  </para>
 	</listitem>
      </varlistentry>

      <varlistentry>
-	<term>-c <replaceable class="parameter">class</replaceable></term>
+	<term>-T <replaceable class="parameter">TTL</replaceable></term>
 	<listitem>
 	  <para>
-	    Specifies the DNS class (default is IN).  Useful only
-	    in keyset or zone file mode.
+	    Specifies the TTL of the DS records. By default the TTL is omitted.
 	  </para>
 	  </listitem>
      </varlistentry>
@@ -229,15 +298,6 @@
 	</listitem>
      </varlistentry>

-      <varlistentry>
-	<term>-h</term>
-	<listitem>
-	  <para>
-	    Prints usage information.
-	  </para>
-	</listitem>
-      </varlistentry>
-
      <varlistentry>
 	<term>-V</term>
 	<listitem>
@@ -254,21 +314,22 @@
    <para>
      To build the SHA-256 DS RR from the
      <userinput>Kexample.com.+003+26160</userinput>
-      keyfile name, the following command would be issued:
+      keyfile name, you can issue the following command:
    </para>
    <para><userinput>dnssec-dsfromkey -2 Kexample.com.+003+26160</userinput>
    </para>
    <para>
      The command would print something like:
    </para>
-    <para><userinput>example.com. IN DS 26160 5 2 3A1EADA7A74B8D0BA86726B0C227AA85AB8BBD2B2004F41A868A54F0 C5EA0B94</userinput>
+    <para><userinput>example.com. IN DS 26160 5 2 3A1EADA7A74B8D0BA86726B0C227AA85AB8BBD2B2004F41A868A54F0C5EA0B94</userinput>
    </para>
+
  </refsection>

  <refsection><info><title>FILES</title></info>

    <para>
-      The keyfile can be designed by the key identification
+      The keyfile can be designated by the key identification
      <filename>Knnnn.+aaa+iiiii</filename> or the full file name
      <filename>Knnnn.+aaa+iiiii.key</filename> as generated by
      <refentrytitle>dnssec-keygen</refentrytitle><manvolnum>8</manvolnum>.
@@ -296,9 +357,11 @@
 	<refentrytitle>dnssec-signzone</refentrytitle><manvolnum>8</manvolnum>
      </citerefentry>,
      <citetitle>BIND 9 Administrator Reference Manual</citetitle>,
-      <citetitle>RFC 3658</citetitle>,
-      <citetitle>RFC 4431</citetitle>.
-      <citetitle>RFC 4509</citetitle>.
+      <citetitle>RFC 3658</citetitle> (DS RRs),
+      <citetitle>RFC 4431</citetitle> (DLV RRs),
+      <citetitle>RFC 4509</citetitle> (SHA-256 for DS RRs),
+      <citetitle>RFC 6605</citetitle> (SHA-384 for DS RRs),
+      <citetitle>RFC 7344</citetitle> (CDS and CDNSKEY RRs).
    </para>
  </refsection>

@@ -33,105 +33,167 @@
 <h2>Synopsis</h2>
    <div class="cmdsynopsis"><p>
      <code class="command">dnssec-dsfromkey</code> 
-       [<code class="option">-v <em class="replaceable"><code>level</code></em></code>]
-       [<code class="option">-1</code>]
-       [<code class="option">-2</code>]
-       [<code class="option">-a <em class="replaceable"><code>alg</code></em></code>]
-       [<code class="option">-C</code>]
-       [<code class="option">-l <em class="replaceable"><code>domain</code></em></code>]
+       [
+	 <code class="option">-1</code> 
+	 |   <code class="option">-2</code> 
+	 |   <code class="option">-a <em class="replaceable"><code>alg</code></em></code> 
+      ]
+       [
+	 <code class="option">-C</code> 
+	 |   <code class="option">-l <em class="replaceable"><code>domain</code></em></code> 
+      ]
       [<code class="option">-T <em class="replaceable"><code>TTL</code></em></code>]
+       [<code class="option">-v <em class="replaceable"><code>level</code></em></code>]
+       [<code class="option">-K <em class="replaceable"><code>directory</code></em></code>]
       {keyfile}
    </p></div>
    <div class="cmdsynopsis"><p>
      <code class="command">dnssec-dsfromkey</code> 
-       {-s}
-       [<code class="option">-1</code>]
-       [<code class="option">-2</code>]
-       [<code class="option">-a <em class="replaceable"><code>alg</code></em></code>]
-       [<code class="option">-K <em class="replaceable"><code>directory</code></em></code>]
-       [<code class="option">-l <em class="replaceable"><code>domain</code></em></code>]
-       [<code class="option">-s</code>]
-       [<code class="option">-c <em class="replaceable"><code>class</code></em></code>]
+       [
+	 <code class="option">-1</code> 
+	 |   <code class="option">-2</code> 
+	 |   <code class="option">-a <em class="replaceable"><code>alg</code></em></code> 
+      ]
+       [
+	 <code class="option">-C</code> 
+	 |   <code class="option">-l <em class="replaceable"><code>domain</code></em></code> 
+      ]
       [<code class="option">-T <em class="replaceable"><code>TTL</code></em></code>]
-       [<code class="option">-f <em class="replaceable"><code>file</code></em></code>]
-       [<code class="option">-A</code>]
       [<code class="option">-v <em class="replaceable"><code>level</code></em></code>]
-       {dnsname}
-   </p></div>
+       [<code class="option">-c <em class="replaceable"><code>class</code></em></code>]
+       [<code class="option">-A</code>]
+       {<code class="option">-f <em class="replaceable"><code>file</code></em></code>}
+       [dnsname]
+    </p></div>
    <div class="cmdsynopsis"><p>
      <code class="command">dnssec-dsfromkey</code> 
-       [<code class="option">-h</code>]
-       [<code class="option">-V</code>]
-   </p></div>
+       [
+	 <code class="option">-1</code> 
+	 |   <code class="option">-2</code> 
+	 |   <code class="option">-a <em class="replaceable"><code>alg</code></em></code> 
+      ]
+       [
+	 <code class="option">-C</code> 
+	 |   <code class="option">-l <em class="replaceable"><code>domain</code></em></code> 
+      ]
+       [<code class="option">-T <em class="replaceable"><code>TTL</code></em></code>]
+       [<code class="option">-v <em class="replaceable"><code>level</code></em></code>]
+       [<code class="option">-c <em class="replaceable"><code>class</code></em></code>]
+       [<code class="option">-K <em class="replaceable"><code>directory</code></em></code>]
+       {-s}
+       {dnsname}
+    </p></div>
+    <div class="cmdsynopsis"><p>
+      <code class="command">dnssec-dsfromkey</code> 
+       [
+	 <code class="option">-h</code> 
+	 |   <code class="option">-V</code> 
+      ]
+    </p></div>
  </div>

  <div class="refsection">
 <a name="id-1.7"></a><h2>DESCRIPTION</h2>

-    <p><span class="command"><strong>dnssec-dsfromkey</strong></span>
-      outputs the Delegation Signer (DS) resource record (RR), as defined in
-      RFC 3658 and RFC 4509, for the given key(s).
+    <p>
+      The <span class="command"><strong>dnssec-dsfromkey</strong></span> command outputs DS (Delegation
+      Signer) resource records (RRs) and other similarly-constructed RRs:
+      with the <code class="option">-l</code> option it outputs DLV (DNSSEC Lookaside
+      Validation) RRs; or with the <code class="option">-C</code> it outputs CDS (Child
+      DS) RRs.
    </p>
+
+    <p>
+      The input keys can be specified in a number of ways:
+    </p>
+
+    <p>
+      By default, <span class="command"><strong>dnssec-dsfromkey</strong></span> reads a key file
+      named like <code class="filename">Knnnn.+aaa+iiiii.key</code>, as generated
+      by <span class="command"><strong>dnssec-keygen</strong></span>.
+    </p>
+
+    <p>
+      With the <code class="option">-f <em class="replaceable"><code>file</code></em></code>
+      option, <span class="command"><strong>dnssec-dsfromkey</strong></span> reads keys from a zone file
+      or partial zone file (which can contain just the DNSKEY records).
+    </p>
+
+    <p>
+      With the <code class="option">-s</code>
+      option, <span class="command"><strong>dnssec-dsfromkey</strong></span> reads
+      a <code class="filename">keyset-</code> file, as generated
+      by <span class="command"><strong>dnssec-keygen</strong></span> <code class="option">-C</code>.
+    </p>
+
  </div>

  <div class="refsection">
 <a name="id-1.8"></a><h2>OPTIONS</h2>

-
    <div class="variablelist"><dl class="variablelist">
 <dt><span class="term">-1</span></dt>
 <dd>
 	  <p>
-	    Use SHA-1 as the digest algorithm (the default is to use
-	    both SHA-1 and SHA-256).
+	    An abbreviation for <code class="option">-a SHA1</code>
 	  </p>
 	</dd>
 <dt><span class="term">-2</span></dt>
 <dd>
 	  <p>
-	    Use SHA-256 as the digest algorithm.
+	    An abbreviation for <code class="option">-a SHA-256</code>
 	  </p>
 	</dd>
 <dt><span class="term">-a <em class="replaceable"><code>algorithm</code></em></span></dt>
 <dd>
 	  <p>
-	    Select the digest algorithm. The value of
-	    <code class="option">algorithm</code> must be one of SHA-1 (SHA1),
-	    SHA-256 (SHA256), GOST or SHA-384 (SHA384).
-	    These values are case insensitive.
+	    Specify a digest algorithm to use when converting DNSKEY
+	    records to DS records. This option can be repeated, so
+	    that multiple DS records are created for each DNSKEY
+	    record.
+          </p>
+          <p>
+	    The <em class="replaceable"><code>algorithm</code></em> must be one of
+	    SHA-1, SHA-256, or SHA-384.  These values are case insensitive,
+	    and the hyphen may be omitted.  If no algorithm is specified,
+	    the default is SHA-256.
 	  </p>
 	</dd>
+<dt><span class="term">-A</span></dt>
+<dd>
+          <p>
+            Include ZSKs when generating DS records. Without this option, only
+            keys which have the KSK flag set will be converted to DS records
+            and printed. Useful only in <code class="option">-f</code> zone file mode.
+          </p>
+        </dd>
+<dt><span class="term">-c <em class="replaceable"><code>class</code></em></span></dt>
+<dd>
+	  <p>
+	    Specifies the DNS class (default is IN). Useful only
+	    in <code class="option">-s</code> keyset or <code class="option">-f</code>
+	    zone file mode.
+	  </p>
+	  </dd>
 <dt><span class="term">-C</span></dt>
 <dd>
 	  <p>
-	    Generate CDS records rather than DS records.  This is mutually
-	    exclusive with generating lookaside records.
-	  </p>
-	</dd>
-<dt><span class="term">-T <em class="replaceable"><code>TTL</code></em></span></dt>
-<dd>
-	  <p>
-	    Specifies the TTL of the DS records.
-	  </p>
-	  </dd>
-<dt><span class="term">-K <em class="replaceable"><code>directory</code></em></span></dt>
-<dd>
-	  <p>
-	    Look for key files (or, in keyset mode,
-	    <code class="filename">keyset-</code> files) in
-	    <code class="option">directory</code>.
+	    Generate CDS records rather than DS records. This is mutually
+	    exclusive with the <code class="option">-l</code> option for generating DLV
+	    records.
 	  </p>
 	</dd>
 <dt><span class="term">-f <em class="replaceable"><code>file</code></em></span></dt>
 <dd>
 	  <p>
-	    Zone file mode: in place of the keyfile name, the argument is
-	    the DNS domain name of a zone master file, which can be read
+	    Zone file mode: <span class="command"><strong>dnssec-dsfromkey</strong></span>'s
+	    final <em class="replaceable"><code>dnsname</code></em> argument is
+	    the DNS domain name of a zone whose master file can be read
 	    from <code class="option">file</code>.  If the zone name is the same as
 	    <code class="option">file</code>, then it may be omitted.
 	  </p>
 	  <p>
-	    If <code class="option">file</code> is set to <code class="literal">"-"</code>, then
+	    If <em class="replaceable"><code>file</code></em> is <code class="literal">"-"</code>, then
 	    the zone data is read from the standard input.  This makes it
 	    possible to use the output of the <span class="command"><strong>dig</strong></span>
 	    command as input, as in:
@@ -140,37 +202,41 @@
 	    <strong class="userinput"><code>dig dnskey example.com | dnssec-dsfromkey -f - example.com</code></strong>
 	  </p>
 	</dd>
-<dt><span class="term">-A</span></dt>
+<dt><span class="term">-h</span></dt>
 <dd>
-          <p>
-            Include ZSKs when generating DS records.  Without this option,
-            only keys which have the KSK flag set will be converted to DS
-            records and printed.  Useful only in zone file mode.
-          </p>
-        </dd>
+	  <p>
+	    Prints usage information.
+	  </p>
+	</dd>
+<dt><span class="term">-K <em class="replaceable"><code>directory</code></em></span></dt>
+<dd>
+	  <p>
+	    Look for key files or <code class="filename">keyset-</code> files in
+	    <code class="option">directory</code>.
+	  </p>
+	</dd>
 <dt><span class="term">-l <em class="replaceable"><code>domain</code></em></span></dt>
 <dd>
 	  <p>
-	    Generate a DLV set instead of a DS set.  The specified
-	    <code class="option">domain</code> is appended to the name for each
+	    Generate a DLV set instead of a DS set. The specified
+	    <em class="replaceable"><code>domain</code></em> is appended to the name for each
 	    record in the set.
-	    The DNSSEC Lookaside Validation (DLV) RR is described
-	    in RFC 4431.  This is mutually exclusive with generating
-	    CDS records.
+	    This is mutually exclusive with the <code class="option">-C</code> option
+	    for generating CDS records.
 	  </p>
 	</dd>
 <dt><span class="term">-s</span></dt>
 <dd>
 	  <p>
-	    Keyset mode: in place of the keyfile name, the argument is
-	    the DNS domain name of a keyset file.
+	    Keyset mode: <span class="command"><strong>dnssec-dsfromkey</strong></span>'s
+	    final <em class="replaceable"><code>dnsname</code></em> argument is the DNS
+	    domain name used to locate a <code class="filename">keyset-</code> file.
 	  </p>
 	</dd>
-<dt><span class="term">-c <em class="replaceable"><code>class</code></em></span></dt>
+<dt><span class="term">-T <em class="replaceable"><code>TTL</code></em></span></dt>
 <dd>
 	  <p>
-	    Specifies the DNS class (default is IN).  Useful only
-	    in keyset or zone file mode.
+	    Specifies the TTL of the DS records. By default the TTL is omitted.
 	  </p>
 	  </dd>
 <dt><span class="term">-v <em class="replaceable"><code>level</code></em></span></dt>
@@ -179,12 +245,6 @@
 	    Sets the debugging level.
 	  </p>
 	</dd>
-<dt><span class="term">-h</span></dt>
-<dd>
-	  <p>
-	    Prints usage information.
-	  </p>
-	</dd>
 <dt><span class="term">-V</span></dt>
 <dd>
 	  <p>
@@ -200,22 +260,23 @@
    <p>
      To build the SHA-256 DS RR from the
      <strong class="userinput"><code>Kexample.com.+003+26160</code></strong>
-      keyfile name, the following command would be issued:
+      keyfile name, you can issue the following command:
    </p>
    <p><strong class="userinput"><code>dnssec-dsfromkey -2 Kexample.com.+003+26160</code></strong>
    </p>
    <p>
      The command would print something like:
    </p>
-    <p><strong class="userinput"><code>example.com. IN DS 26160 5 2 3A1EADA7A74B8D0BA86726B0C227AA85AB8BBD2B2004F41A868A54F0 C5EA0B94</code></strong>
+    <p><strong class="userinput"><code>example.com. IN DS 26160 5 2 3A1EADA7A74B8D0BA86726B0C227AA85AB8BBD2B2004F41A868A54F0C5EA0B94</code></strong>
    </p>
+
  </div>

  <div class="refsection">
 <a name="id-1.10"></a><h2>FILES</h2>

    <p>
-      The keyfile can be designed by the key identification
+      The keyfile can be designated by the key identification
      <code class="filename">Knnnn.+aaa+iiiii</code> or the full file name
      <code class="filename">Knnnn.+aaa+iiiii.key</code> as generated by
      <span class="refentrytitle">dnssec-keygen</span>(8).
@@ -245,9 +306,11 @@
 	<span class="refentrytitle">dnssec-signzone</span>(8)
      </span>,
      <em class="citetitle">BIND 9 Administrator Reference Manual</em>,
-      <em class="citetitle">RFC 3658</em>,
-      <em class="citetitle">RFC 4431</em>.
-      <em class="citetitle">RFC 4509</em>.
+      <em class="citetitle">RFC 3658</em> (DS RRs),
+      <em class="citetitle">RFC 4431</em> (DLV RRs),
+      <em class="citetitle">RFC 4509</em> (SHA-256 for DS RRs),
+      <em class="citetitle">RFC 6605</em> (SHA-384 for DS RRs),
+      <em class="citetitle">RFC 7344</em> (CDS and CDNSKEY RRs).
    </p>
  </div>

@@ -674,10 +674,10 @@ main(int argc, char **argv) {

 		if (setdel)
 			dst_key_settime(key, DST_TIME_DELETE, deltime);
-	if (setsyncadd)
-		dst_key_settime(key, DST_TIME_SYNCPUBLISH, syncadd);
-	if (setsyncdel)
-		dst_key_settime(key, DST_TIME_SYNCDELETE, syncdel);
+		if (setsyncadd)
+			dst_key_settime(key, DST_TIME_SYNCPUBLISH, syncadd);
+		if (setsyncdel)
+			dst_key_settime(key, DST_TIME_SYNCDELETE, syncdel);

 	} else {
 		if (setpub || setact || setrev || setinact ||
@@ -39,7 +39,7 @@
 dnssec-keygen \- DNSSEC key generation tool
 .SH "SYNOPSIS"
 .HP \w'\fBdnssec\-keygen\fR\ 'u
-\fBdnssec\-keygen\fR [\fB\-a\ \fR\fB\fIalgorithm\fR\fR] [\fB\-b\ \fR\fB\fIkeysize\fR\fR] [\fB\-n\ \fR\fB\fInametype\fR\fR] [\fB\-3\fR] [\fB\-A\ \fR\fB\fIdate/offset\fR\fR] [\fB\-C\fR] [\fB\-c\ \fR\fB\fIclass\fR\fR] [\fB\-D\ \fR\fB\fIdate/offset\fR\fR] [\fB\-D\ sync\ \fR\fB\fIdate/offset\fR\fR] [\fB\-E\ \fR\fB\fIengine\fR\fR] [\fB\-f\ \fR\fB\fIflag\fR\fR] [\fB\-G\fR] [\fB\-g\ \fR\fB\fIgenerator\fR\fR] [\fB\-h\fR] [\fB\-I\ \fR\fB\fIdate/offset\fR\fR] [\fB\-i\ \fR\fB\fIinterval\fR\fR] [\fB\-K\ \fR\fB\fIdirectory\fR\fR] [\fB\-k\fR] [\fB\-L\ \fR\fB\fIttl\fR\fR] [\fB\-P\ \fR\fB\fIdate/offset\fR\fR] [\fB\-P\ sync\ \fR\fB\fIdate/offset\fR\fR] [\fB\-p\ \fR\fB\fIprotocol\fR\fR] [\fB\-q\fR] [\fB\-R\ \fR\fB\fIdate/offset\fR\fR] [\fB\-r\ \fR\fB\fIrandomdev\fR\fR] [\fB\-S\ \fR\fB\fIkey\fR\fR] [\fB\-s\ \fR\fB\fIstrength\fR\fR] [\fB\-t\ \fR\fB\fItype\fR\fR] [\fB\-V\fR] [\fB\-v\ \fR\fB\fIlevel\fR\fR] [\fB\-z\fR] {name}
+\fBdnssec\-keygen\fR [\fB\-3\fR] [\fB\-A\ \fR\fB\fIdate/offset\fR\fR] [\fB\-a\ \fR\fB\fIalgorithm\fR\fR] [\fB\-b\ \fR\fB\fIkeysize\fR\fR] [\fB\-C\fR] [\fB\-c\ \fR\fB\fIclass\fR\fR] [\fB\-D\ \fR\fB\fIdate/offset\fR\fR] [\fB\-D\ sync\ \fR\fB\fIdate/offset\fR\fR] [\fB\-E\ \fR\fB\fIengine\fR\fR] [\fB\-f\ \fR\fB\fIflag\fR\fR] [\fB\-G\fR] [\fB\-g\ \fR\fB\fIgenerator\fR\fR] [\fB\-h\fR] [\fB\-I\ \fR\fB\fIdate/offset\fR\fR] [\fB\-i\ \fR\fB\fIinterval\fR\fR] [\fB\-K\ \fR\fB\fIdirectory\fR\fR] [\fB\-k\fR] [\fB\-L\ \fR\fB\fIttl\fR\fR] [\fB\-n\ \fR\fB\fInametype\fR\fR] [\fB\-P\ \fR\fB\fIdate/offset\fR\fR] [\fB\-P\ sync\ \fR\fB\fIdate/offset\fR\fR] [\fB\-p\ \fR\fB\fIprotocol\fR\fR] [\fB\-q\fR] [\fB\-R\ \fR\fB\fIdate/offset\fR\fR] [\fB\-r\ \fR\fB\fIrandomdev\fR\fR] [\fB\-S\ \fR\fB\fIkey\fR\fR] [\fB\-s\ \fR\fB\fIstrength\fR\fR] [\fB\-t\ \fR\fB\fItype\fR\fR] [\fB\-V\fR] [\fB\-v\ \fR\fB\fIlevel\fR\fR] {name}
 .SH "DESCRIPTION"
 .PP
 \fBdnssec\-keygen\fR
@@ -50,6 +50,13 @@ The
 of the key is specified on the command line\&. For DNSSEC keys, this must match the name of the zone for which the key is being generated\&.
 .SH "OPTIONS"
 .PP
+\-3
+.RS 4
+Use an NSEC3\-capable algorithm to generate a DNSSEC key\&. If this option is used with an algorithm that has both NSEC and NSEC3 versions, then the NSEC3 version will be used; for example,
+\fBdnssec\-keygen \-3a RSASHA1\fR
+specifies the NSEC3RSASHA1 algorithm\&.
+.RE
+.PP
 \-a \fIalgorithm\fR
 .RS 4
 Selects the cryptographic algorithm\&. For DNSSEC keys, the value of
@@ -78,21 +85,9 @@ The key size does not need to be specified if using a default algorithm\&. The d
 must be used\&.
 .RE
 .PP
-\-n \fInametype\fR
-.RS 4
-Specifies the owner type of the key\&. The value of
-\fBnametype\fR
-must either be ZONE (for a DNSSEC zone key (KEY/DNSKEY)), HOST or ENTITY (for a key associated with a host (KEY)), USER (for a key associated with a user(KEY)) or OTHER (DNSKEY)\&. These values are case insensitive\&. Defaults to ZONE for DNSKEY generation\&.
-.RE
-.PP
-\-3
-.RS 4
-Use an NSEC3\-capable algorithm to generate a DNSSEC key\&. If this option is used and no algorithm is explicitly set on the command line, NSEC3RSASHA1 will be used by default\&. Note that RSASHA256, RSASHA512, ECCGOST, ECDSAP256SHA256, ECDSAP384SHA384, ED25519 and ED448 algorithms are NSEC3\-capable\&.
-.RE
-.PP
 \-C
 .RS 4
-Compatibility mode: generates an old\-style key, without any metadata\&. By default,
+Compatibility mode: generates an old\-style key, without any timing metadata\&. By default,
 \fBdnssec\-keygen\fR
 will include the key\*(Aqs creation date in the metadata stored with the private key, and other dates may be set there as well (publication date, activation date, etc)\&. Keys that include this data may be incompatible with older versions of BIND; the
 \fB\-C\fR
@@ -151,9 +146,17 @@ none
 is the same as leaving it unset\&.
 .RE
 .PP
+\-n \fInametype\fR
+.RS 4
+Specifies the owner type of the key\&. The value of
+\fBnametype\fR
+must either be ZONE (for a DNSSEC zone key (KEY/DNSKEY)), HOST or ENTITY (for a key associated with a host (KEY)), USER (for a key associated with a user(KEY)) or OTHER (DNSKEY)\&. These values are case insensitive\&. Defaults to ZONE for DNSKEY generation\&.
+.RE
+.PP
 \-p \fIprotocol\fR
 .RS 4
-Sets the protocol value for the generated key\&. The protocol is a number between 0 and 255\&. The default is 3 (DNSSEC)\&. Other possible values for this argument are listed in RFC 2535 and its successors\&.
+Sets the protocol value for the generated key, for use with
+\fB\-T KEY\fR\&. The protocol is a number between 0 and 255\&. The default is 3 (DNSSEC)\&. Other possible values for this argument are listed in RFC 2535 and its successors\&.
 .RE
 .PP
 \-q
@@ -196,20 +199,21 @@ Using any TSIG algorithm (HMAC\-* or DH) forces this option to KEY\&.
 .PP
 \-t \fItype\fR
 .RS 4
-Indicates the use of the key\&.
+Indicates the use of the key, for use with
+\fB\-T KEY\fR\&.
 \fBtype\fR
 must be one of AUTHCONF, NOAUTHCONF, NOAUTH, or NOCONF\&. The default is AUTHCONF\&. AUTH refers to the ability to authenticate data, and CONF the ability to encrypt data\&.
 .RE
 .PP
-\-v \fIlevel\fR
-.RS 4
-Sets the debugging level\&.
-.RE
-.PP
 \-V
 .RS 4
 Prints version information\&.
 .RE
+.PP
+\-v \fIlevel\fR
+.RS 4
+Sets the debugging level\&.
+.RE
 .SH "TIMING OPTIONS"
 .PP
 Dates can be expressed in the format YYYYMMDD or YYYYMMDDHHMMSS\&. If the argument begins with a \*(Aq+\*(Aq or \*(Aq\-\*(Aq, it is interpreted as an offset from the present time\&. For convenience, if such an offset is followed by one of the suffixes \*(Aqy\*(Aq, \*(Aqmo\*(Aq, \*(Aqw\*(Aq, \*(Aqd\*(Aq, \*(Aqh\*(Aq, or \*(Aqmi\*(Aq, then the offset is computed in years (defined as 365 24\-hour days, ignoring leap years), months (defined as 30 24\-hour days), weeks, days, hours, or minutes, respectively\&. Without a suffix, the offset is computed in seconds\&. To explicitly prevent a date from being set, use \*(Aqnone\*(Aq or \*(Aqnever\*(Aq\&.
@@ -338,6 +342,10 @@ creates the files
 Kexample\&.com\&.+003+26160\&.key
 and
 Kexample\&.com\&.+003+26160\&.private\&.
+.PP
+To generate a matching key\-signing key, issue the command:
+.PP
+\fBdnssec\-keygen \-a DSA \-b 768 \-n ZONE \-f KSK example\&.com\fR
 .SH "SEE ALSO"
 .PP
 \fBdnssec-signzone\fR(8),
@@ -58,11 +58,10 @@
  <refsynopsisdiv>
    <cmdsynopsis sepchar=" ">
      <command>dnssec-keygen</command>
-      <arg choice="opt" rep="norepeat"><option>-a <replaceable class="parameter">algorithm</replaceable></option></arg>
-      <arg choice="opt" rep="norepeat"><option>-b <replaceable class="parameter">keysize</replaceable></option></arg>
-      <arg choice="opt" rep="norepeat"><option>-n <replaceable class="parameter">nametype</replaceable></option></arg>
      <arg choice="opt" rep="norepeat"><option>-3</option></arg>
      <arg choice="opt" rep="norepeat"><option>-A <replaceable class="parameter">date/offset</replaceable></option></arg>
+      <arg rep="norepeat"><option>-a <replaceable class="parameter">algorithm</replaceable></option></arg>
+      <arg choice="opt" rep="norepeat"><option>-b <replaceable class="parameter">keysize</replaceable></option></arg>
      <arg choice="opt" rep="norepeat"><option>-C</option></arg>
      <arg choice="opt" rep="norepeat"><option>-c <replaceable class="parameter">class</replaceable></option></arg>
      <arg choice="opt" rep="norepeat"><option>-D <replaceable class="parameter">date/offset</replaceable></option></arg>
@@ -77,6 +76,7 @@
      <arg choice="opt" rep="norepeat"><option>-K <replaceable class="parameter">directory</replaceable></option></arg>
      <arg choice="opt" rep="norepeat"><option>-k</option></arg>
      <arg choice="opt" rep="norepeat"><option>-L <replaceable class="parameter">ttl</replaceable></option></arg>
+      <arg choice="opt" rep="norepeat"><option>-n <replaceable class="parameter">nametype</replaceable></option></arg>
      <arg choice="opt" rep="norepeat"><option>-P <replaceable class="parameter">date/offset</replaceable></option></arg>
      <arg choice="opt" rep="norepeat"><option>-P sync <replaceable class="parameter">date/offset</replaceable></option></arg>
      <arg choice="opt" rep="norepeat"><option>-p <replaceable class="parameter">protocol</replaceable></option></arg>
@@ -88,7 +88,6 @@
      <arg choice="opt" rep="norepeat"><option>-t <replaceable class="parameter">type</replaceable></option></arg>
      <arg choice="opt" rep="norepeat"><option>-V</option></arg>
      <arg choice="opt" rep="norepeat"><option>-v <replaceable class="parameter">level</replaceable></option></arg>
-      <arg choice="opt" rep="norepeat"><option>-z</option></arg>
      <arg choice="req" rep="norepeat">name</arg>
    </cmdsynopsis>
  </refsynopsisdiv>
@@ -112,6 +111,20 @@


    <variablelist>
+
+      <varlistentry>
+	<term>-3</term>
+	<listitem>
+	  <para>
+	    Use an NSEC3-capable algorithm to generate a DNSSEC key.
+	    If this option is used with an algorithm that has both
+	    NSEC and NSEC3 versions, then the NSEC3 version will be
+	    used; for example, <command>dnssec-keygen -3a RSASHA1</command>
+	    specifies the NSEC3RSASHA1 algorithm.
+	  </para>
+	</listitem>
+      </varlistentry>
+
      <varlistentry>
 	<term>-a <replaceable class="parameter">algorithm</replaceable></term>
 	<listitem>
@@ -168,45 +181,16 @@
 	</listitem>
      </varlistentry>

-      <varlistentry>
-	<term>-n <replaceable class="parameter">nametype</replaceable></term>
-	<listitem>
-	  <para>
-	    Specifies the owner type of the key.  The value of
-	    <option>nametype</option> must either be ZONE (for a DNSSEC
-	    zone key (KEY/DNSKEY)), HOST or ENTITY (for a key associated with
-	    a host (KEY)),
-	    USER (for a key associated with a user(KEY)) or OTHER (DNSKEY).
-	    These values are case insensitive.  Defaults to ZONE for DNSKEY
-	    generation.
-	  </para>
-	</listitem>
-      </varlistentry>
-
-      <varlistentry>
-	<term>-3</term>
-	<listitem>
-	  <para>
-	    Use an NSEC3-capable algorithm to generate a DNSSEC key.
-	    If this option is used and no algorithm is explicitly
-	    set on the command line, NSEC3RSASHA1 will be used by
-	    default. Note that RSASHA256, RSASHA512, ECCGOST,
-	    ECDSAP256SHA256, ECDSAP384SHA384, ED25519 and ED448
-	    algorithms are NSEC3-capable.
-	  </para>
-	</listitem>
-      </varlistentry>
-
      <varlistentry>
 	<term>-C</term>
 	<listitem>
 	  <para>
-	    Compatibility mode:  generates an old-style key, without
-	    any metadata.  By default, <command>dnssec-keygen</command>
-	    will include the key's creation date in the metadata stored
-	    with the private key, and other dates may be set there as well
-	    (publication date, activation date, etc).  Keys that include
-	    this data may be incompatible with older versions of BIND; the
+	    Compatibility mode: generates an old-style key, without any
+	    timing metadata. By default, <command>dnssec-keygen</command>
+	    will include the key's creation date in the metadata stored with
+	    the private key, and other dates may be set there as well
+	    (publication date, activation date, etc). Keys that include this
+	    data may be incompatible with older versions of BIND; the
 	    <option>-C</option> option suppresses them.
 	  </para>
 	</listitem>
@@ -315,14 +299,28 @@
 	</listitem>
      </varlistentry>

+      <varlistentry>
+	<term>-n <replaceable class="parameter">nametype</replaceable></term>
+	<listitem>
+	  <para>
+	    Specifies the owner type of the key.  The value of
+	    <option>nametype</option> must either be ZONE (for a DNSSEC
+	    zone key (KEY/DNSKEY)), HOST or ENTITY (for a key associated
+	    with a host (KEY)), USER (for a key associated with a
+	    user(KEY)) or OTHER (DNSKEY).  These values are case
+	    insensitive.  Defaults to ZONE for DNSKEY generation.
+	  </para>
+	</listitem>
+      </varlistentry>
+
      <varlistentry>
 	<term>-p <replaceable class="parameter">protocol</replaceable></term>
 	<listitem>
 	  <para>
-	    Sets the protocol value for the generated key.  The protocol
-	    is a number between 0 and 255.  The default is 3 (DNSSEC).
-	    Other possible values for this argument are listed in
-	    RFC 2535 and its successors.
+	    Sets the protocol value for the generated key, for use
+	    with <option>-T KEY</option>. The protocol is a number between 0
+	    and 255. The default is 3 (DNSSEC). Other possible values for
+	    this argument are listed in RFC 2535 and its successors.
 	  </para>
 	</listitem>
      </varlistentry>
@@ -409,19 +407,11 @@
 	<term>-t <replaceable class="parameter">type</replaceable></term>
 	<listitem>
 	  <para>
-	    Indicates the use of the key.  <option>type</option> must be
-	    one of AUTHCONF, NOAUTHCONF, NOAUTH, or NOCONF.  The default
-	    is AUTHCONF.  AUTH refers to the ability to authenticate
-	    data, and CONF the ability to encrypt data.
-	  </para>
-	</listitem>
-      </varlistentry>
-
-      <varlistentry>
-	<term>-v <replaceable class="parameter">level</replaceable></term>
-	<listitem>
-	  <para>
-	    Sets the debugging level.
+	    Indicates the use of the key, for use with <option>-T
+	    KEY</option>. <option>type</option> must be one of AUTHCONF,
+	    NOAUTHCONF, NOAUTH, or NOCONF. The default is AUTHCONF. AUTH
+	    refers to the ability to authenticate data, and CONF the ability
+	    to encrypt data.
 	  </para>
 	</listitem>
      </varlistentry>
@@ -435,6 +425,15 @@
 	</listitem>
      </varlistentry>

+      <varlistentry>
+	<term>-v <replaceable class="parameter">level</replaceable></term>
+	<listitem>
+	  <para>
+	    Sets the debugging level.
+	  </para>
+	</listitem>
+      </varlistentry>
+
    </variablelist>
  </refsection>

@@ -637,6 +636,12 @@
      and
      <filename>Kexample.com.+003+26160.private</filename>.
    </para>
+    <para>
+      To generate a matching key-signing key, issue the command:
+    </para>
+    <para>
+      <userinput>dnssec-keygen -a DSA -b 768 -n ZONE -f KSK example.com</userinput>
+    </para>
  </refsection>

  <refsection><info><title>SEE ALSO</title></info>
@@ -33,11 +33,10 @@
 <h2>Synopsis</h2>
    <div class="cmdsynopsis"><p>
      <code class="command">dnssec-keygen</code> 
-       [<code class="option">-a <em class="replaceable"><code>algorithm</code></em></code>]
-       [<code class="option">-b <em class="replaceable"><code>keysize</code></em></code>]
-       [<code class="option">-n <em class="replaceable"><code>nametype</code></em></code>]
       [<code class="option">-3</code>]
       [<code class="option">-A <em class="replaceable"><code>date/offset</code></em></code>]
+       [<code class="option">-a <em class="replaceable"><code>algorithm</code></em></code>]
+       [<code class="option">-b <em class="replaceable"><code>keysize</code></em></code>]
       [<code class="option">-C</code>]
       [<code class="option">-c <em class="replaceable"><code>class</code></em></code>]
       [<code class="option">-D <em class="replaceable"><code>date/offset</code></em></code>]
@@ -52,6 +51,7 @@
       [<code class="option">-K <em class="replaceable"><code>directory</code></em></code>]
       [<code class="option">-k</code>]
       [<code class="option">-L <em class="replaceable"><code>ttl</code></em></code>]
+       [<code class="option">-n <em class="replaceable"><code>nametype</code></em></code>]
       [<code class="option">-P <em class="replaceable"><code>date/offset</code></em></code>]
       [<code class="option">-P sync <em class="replaceable"><code>date/offset</code></em></code>]
       [<code class="option">-p <em class="replaceable"><code>protocol</code></em></code>]
@@ -63,7 +63,6 @@
       [<code class="option">-t <em class="replaceable"><code>type</code></em></code>]
       [<code class="option">-V</code>]
       [<code class="option">-v <em class="replaceable"><code>level</code></em></code>]
-       [<code class="option">-z</code>]
       {name}
    </p></div>
  </div>
@@ -89,6 +88,16 @@


    <div class="variablelist"><dl class="variablelist">
+<dt><span class="term">-3</span></dt>
+<dd>
+	  <p>
+	    Use an NSEC3-capable algorithm to generate a DNSSEC key.
+	    If this option is used with an algorithm that has both
+	    NSEC and NSEC3 versions, then the NSEC3 version will be
+	    used; for example, <span class="command"><strong>dnssec-keygen -3a RSASHA1</strong></span>
+	    specifies the NSEC3RSASHA1 algorithm.
+	  </p>
+	</dd>
 <dt><span class="term">-a <em class="replaceable"><code>algorithm</code></em></span></dt>
 <dd>
 	  <p>
@@ -139,38 +148,15 @@
 	    must be used.
 	  </p>
 	</dd>
-<dt><span class="term">-n <em class="replaceable"><code>nametype</code></em></span></dt>
-<dd>
-	  <p>
-	    Specifies the owner type of the key.  The value of
-	    <code class="option">nametype</code> must either be ZONE (for a DNSSEC
-	    zone key (KEY/DNSKEY)), HOST or ENTITY (for a key associated with
-	    a host (KEY)),
-	    USER (for a key associated with a user(KEY)) or OTHER (DNSKEY).
-	    These values are case insensitive.  Defaults to ZONE for DNSKEY
-	    generation.
-	  </p>
-	</dd>
-<dt><span class="term">-3</span></dt>
-<dd>
-	  <p>
-	    Use an NSEC3-capable algorithm to generate a DNSSEC key.
-	    If this option is used and no algorithm is explicitly
-	    set on the command line, NSEC3RSASHA1 will be used by
-	    default. Note that RSASHA256, RSASHA512, ECCGOST,
-	    ECDSAP256SHA256, ECDSAP384SHA384, ED25519 and ED448
-	    algorithms are NSEC3-capable.
-	  </p>
-	</dd>
 <dt><span class="term">-C</span></dt>
 <dd>
 	  <p>
-	    Compatibility mode:  generates an old-style key, without
-	    any metadata.  By default, <span class="command"><strong>dnssec-keygen</strong></span>
-	    will include the key's creation date in the metadata stored
-	    with the private key, and other dates may be set there as well
-	    (publication date, activation date, etc).  Keys that include
-	    this data may be incompatible with older versions of BIND; the
+	    Compatibility mode: generates an old-style key, without any
+	    timing metadata. By default, <span class="command"><strong>dnssec-keygen</strong></span>
+	    will include the key's creation date in the metadata stored with
+	    the private key, and other dates may be set there as well
+	    (publication date, activation date, etc). Keys that include this
+	    data may be incompatible with older versions of BIND; the
 	    <code class="option">-C</code> option suppresses them.
 	  </p>
 	</dd>
@@ -250,13 +236,24 @@
 	    or <code class="literal">none</code> is the same as leaving it unset.
 	  </p>
 	</dd>
+<dt><span class="term">-n <em class="replaceable"><code>nametype</code></em></span></dt>
+<dd>
+	  <p>
+	    Specifies the owner type of the key.  The value of
+	    <code class="option">nametype</code> must either be ZONE (for a DNSSEC
+	    zone key (KEY/DNSKEY)), HOST or ENTITY (for a key associated
+	    with a host (KEY)), USER (for a key associated with a
+	    user(KEY)) or OTHER (DNSKEY).  These values are case
+	    insensitive.  Defaults to ZONE for DNSKEY generation.
+	  </p>
+	</dd>
 <dt><span class="term">-p <em class="replaceable"><code>protocol</code></em></span></dt>
 <dd>
 	  <p>
-	    Sets the protocol value for the generated key.  The protocol
-	    is a number between 0 and 255.  The default is 3 (DNSSEC).
-	    Other possible values for this argument are listed in
-	    RFC 2535 and its successors.
+	    Sets the protocol value for the generated key, for use
+	    with <code class="option">-T KEY</code>. The protocol is a number between 0
+	    and 255. The default is 3 (DNSSEC). Other possible values for
+	    this argument are listed in RFC 2535 and its successors.
 	  </p>
 	</dd>
 <dt><span class="term">-q</span></dt>
@@ -327,16 +324,11 @@
 <dt><span class="term">-t <em class="replaceable"><code>type</code></em></span></dt>
 <dd>
 	  <p>
-	    Indicates the use of the key.  <code class="option">type</code> must be
-	    one of AUTHCONF, NOAUTHCONF, NOAUTH, or NOCONF.  The default
-	    is AUTHCONF.  AUTH refers to the ability to authenticate
-	    data, and CONF the ability to encrypt data.
-	  </p>
-	</dd>
-<dt><span class="term">-v <em class="replaceable"><code>level</code></em></span></dt>
-<dd>
-	  <p>
-	    Sets the debugging level.
+	    Indicates the use of the key, for use with <code class="option">-T
+	    KEY</code>. <code class="option">type</code> must be one of AUTHCONF,
+	    NOAUTHCONF, NOAUTH, or NOCONF. The default is AUTHCONF. AUTH
+	    refers to the ability to authenticate data, and CONF the ability
+	    to encrypt data.
 	  </p>
 	</dd>
 <dt><span class="term">-V</span></dt>
@@ -345,6 +337,12 @@
 	    Prints version information.
 	  </p>
 	</dd>
+<dt><span class="term">-v <em class="replaceable"><code>level</code></em></span></dt>
+<dd>
+	  <p>
+	    Sets the debugging level.
+	  </p>
+	</dd>
 </dl></div>
  </div>

@@ -526,6 +524,12 @@
      and
      <code class="filename">Kexample.com.+003+26160.private</code>.
    </p>
+    <p>
+      To generate a matching key-signing key, issue the command:
+    </p>
+    <p>
+      <strong class="userinput"><code>dnssec-keygen -a DSA -b 768 -n ZONE -f KSK example.com</code></strong>
+    </p>
  </div>

  <div class="refsection">
@@ -61,13 +61,13 @@ usage(void) {
 #else
 	fprintf(stderr, "    -E engine:    specify OpenSSL engine\n");
 #endif
-	fprintf(stderr, "    -f:	   force overwrite\n");
+	fprintf(stderr, "    -f:           force overwrite\n");
+	fprintf(stderr, "    -h:           help\n");
 	fprintf(stderr, "    -K directory: use directory for key files\n");
-	fprintf(stderr, "    -h:	   help\n");
-	fprintf(stderr, "    -r:	   remove old keyfiles after "
+	fprintf(stderr, "    -r:           remove old keyfiles after "
 					   "creating revoked version\n");
-	fprintf(stderr, "    -v level:	   set level of verbosity\n");
-	fprintf(stderr, "    -V: print version information\n");
+	fprintf(stderr, "    -v level:     set level of verbosity\n");
+	fprintf(stderr, "    -V:           print version information\n");
 	fprintf(stderr, "Output:\n");
 	fprintf(stderr, "     K<name>+<alg>+<new id>.key, "
 			     "K<name>+<alg>+<new id>.private\n");
@@ -1,29 +1,29 @@
-Microsoft Developer Studio Workspace File, Format Version 6.00
-# WARNING: DO NOT EDIT OR DELETE THIS WORKSPACE FILE!
-
-###############################################################################
-
-Project: "dnssectool"=".\dnssectool.dsp" - Package Owner=<4>
-
-Package=<5>
-{{{
-}}}
-
-Package=<4>
-{{{
-}}}
-
-###############################################################################
-
-Global:
-
-Package=<5>
-{{{
-}}}
-
-Package=<3>
-{{{
-}}}
-
-###############################################################################
-
+Microsoft Developer Studio Workspace File, Format Version 6.00
+# WARNING: DO NOT EDIT OR DELETE THIS WORKSPACE FILE!
+
+###############################################################################
+
+Project: "dnssectool"=".\dnssectool.dsp" - Package Owner=<4>
+
+Package=<5>
+{{{
+}}}
+
+Package=<4>
+{{{
+}}}
+
+###############################################################################
+
+Global:
+
+Package=<5>
+{{{
+}}}
+
+Package=<3>
+{{{
+}}}
+
+###############################################################################
+
@@ -45,13 +45,14 @@ DLZDRIVER_LIBS =	@DLZ_DRIVER_LIBS@
 CINCLUDES =	-I${srcdir}/include -I${srcdir}/unix/include -I. \
 		${LWRES_INCLUDES} ${DNS_INCLUDES} ${BIND9_INCLUDES} \
 		${ISCCFG_INCLUDES} ${ISCCC_INCLUDES} ${ISC_INCLUDES} \
-		${DLZDRIVER_INCLUDES} ${DBDRIVER_INCLUDES} @DST_OPENSSL_INC@
+		${DLZDRIVER_INCLUDES} ${DBDRIVER_INCLUDES} ${MAXMINDDB_CFLAGS} \
+		@DST_OPENSSL_INC@

 CDEFINES =      @CONTRIB_DLZ@ @USE_PKCS11@ @PKCS11_ENGINE@ @CRYPTO@

 CWARNINGS =

-DNSLIBS =	../../lib/dns/libdns.@A@ @DNS_CRYPTO_LIBS@
+DNSLIBS =	../../lib/dns/libdns.@A@ ${MAXMINDDB_LIBS} @DNS_CRYPTO_LIBS@
 ISCCFGLIBS =	../../lib/isccfg/libisccfg.@A@
 ISCCCLIBS =	../../lib/isccc/libisccc.@A@
 ISCLIBS =	../../lib/isc/libisc.@A@
@@ -82,10 +83,13 @@ SUBDIRS =	unix
 TARGETS =	named@EXEEXT@ lwresd@EXEEXT@

 GEOIPLINKOBJS = geoip.@O@
+GEOIP2LINKOBJS = geoip.@O@

 OBJS =		builtin.@O@ client.@O@ config.@O@ control.@O@ \
-		controlconf.@O@ fuzz.@O@ @GEOIPLINKOBJS@ interfacemgr.@O@ \
-		listenlist.@O@ log.@O@ logconf.@O@ main.@O@ notify.@O@ \
+		controlconf.@O@ fuzz.@O@ \
+		@GEOIPLINKOBJS@ @GEOIP2LINKOBJS@ \
+		interfacemgr.@O@ listenlist.@O@ log.@O@ logconf.@O@ \
+		main.@O@ notify.@O@ \
 		query.@O@ server.@O@ sortlist.@O@ statschannel.@O@ \
 		tkeyconf.@O@ tsigconf.@O@ update.@O@ xfrout.@O@ \
 		zoneconf.@O@ \
@@ -98,10 +102,13 @@ UOBJS =		unix/os.@O@ unix/dlz_dlopen_driver.@O@
 SYMOBJS =	symtbl.@O@

 GEOIPLINKSRCS = geoip.c
+GEOIP2LINKSRCS = geoip.c

 SRCS =		builtin.c client.c config.c control.c \
-		controlconf.c fuzz.c @GEOIPLINKSRCS@ interfacemgr.c \
-		listenlist.c log.c logconf.c main.c notify.c \
+		controlconf.c fuzz.c \
+		@GEOIPLINKSRCS@ @GEOIP2LINKSRCS@ \
+		interfacemgr.c \ listenlist.c log.c logconf.c \
+		main.c notify.c \
 		query.c server.c sortlist.c statschannel.c \
 		tkeyconf.c tsigconf.c update.c xfrout.c \
 		zoneconf.c \
@@ -135,6 +142,7 @@ config.@O@: config.c
 		-DDYNDB_LIBDIR=\"@libdir@/bind\" \
 		-DNS_LOCALSTATEDIR=\"${localstatedir}\" \
 		-DNS_SYSCONFDIR=\"${sysconfdir}\" \
+		-DMAXMINDDB_PREFIX=\"@MAXMINDDB_PREFIX@\" \
 		-c ${srcdir}/config.c

 server.@O@: server.c
@@ -15,6 +15,15 @@
  <xsl:template match="statistics[@version=&quot;3.8&quot;]">
    <html>
      <head>
+        <script type="text/javascript" src="https://ajax.googleapis.com/ajax/libs/jquery/3.4.1/jquery.min.js"></script>
+        <script type="text/javascript">
+          $(function($) {
+              var wid=0;
+              $('table.zones').each(function(i) { if( $(this).width() > wid ) wid = $(this).width(); return true; });
+              $('table.zones').css('min-width', wid );
+          });
+        </script>
+
        <xsl:if test="system-property('xsl:vendor')!='Transformiix'">
          <!-- Non Mozilla specific markup -->
          <script type="text/javascript" src="https://www.google.com/jsapi"/>
@@ -198,10 +207,45 @@
      background-color: #99ddff;
     }

+     table.zones {
+      border: 1px solid grey;
+      width: 500px;
+     }
+     table.zones th {
+      text-align: center;
+      border: 1px solid grey;
+     }
+     table.zones td {
+      text-align: center;
+      font-family: monospace;
+     }
+     table.zones td:nth-child(1) {
+      text-align: right;
+     }
+     table.zones td:nth-child(4) {
+      text-align: right;
+     }
+
     .totals {
      background-color: rgb(1,169,206);
      color: #ffffff;
     }
+     table.zones {
+       border: 1px solid grey;
+     }
+     table.zones td {
+       text-align: right;
+       font-family: monospace;
+     }
+     table.zones td:nth-child(2) {
+       text-align: center;
+     }
+     table.zones td:nth-child(3) {
+       text-align: left;
+     }
+     table.zones tr:hover{
+      background-color: #99ddff;
+     }

     td, th {
      padding-right: 5px;
@@ -274,25 +318,25 @@
        <hr/>
        <h2>Server Status</h2>
        <table class="info">
-          <tr>
+          <tr class="odd">
            <th>Boot time:</th>
            <td>
              <xsl:value-of select="server/boot-time"/>
            </td>
          </tr>
-          <tr>
+          <tr class="even">
            <th>Last reconfigured:</th>
            <td>
              <xsl:value-of select="server/config-time"/>
            </td>
          </tr>
-          <tr>
+          <tr class="odd">
            <th>Current time:</th>
            <td>
              <xsl:value-of select="server/current-time"/>
            </td>
          </tr>
-          <tr>
+          <tr class="even">
            <th>Server version:</th>
            <td>
              <xsl:value-of select="server/version"/>
@@ -311,7 +355,13 @@
          <table class="counters">
            <xsl:for-each select="server/counters[@type=&quot;opcode&quot;]/counter[. &gt; 0 or substring(@name,1,3) != 'RES']">
              <xsl:sort select="." data-type="number" order="descending"/>
-              <tr>
+                <xsl:variable name="css-class0">
+                  <xsl:choose>
+                    <xsl:when test="position() mod 2 = 0">even</xsl:when>
+                    <xsl:otherwise>odd</xsl:otherwise>
+                  </xsl:choose>
+                </xsl:variable>
+                <tr class="{$css-class0}">
                <th>
                  <xsl:value-of select="@name"/>
                </th>
@@ -592,13 +642,13 @@
            <br/>
          </xsl:if>
        </xsl:for-each>
-        <xsl:if test="traffic/udp/counters[@type=&quot;request-size&quot;]/counter[.&gt;0] or traffic/udp/counters[@type=&quot;response-size&quot;]/counter[.&gt;0] or traffic/tcp/counters[@type=&quot;request-size&quot;]/counter[.&gt;0] or traffic/tcp/counters[@type=&quot;response-size&quot;]/counter[.&gt;0]">
+        <xsl:if test="traffic//udp/counters[@type=&quot;request-size&quot;]/counter[.&gt;0] or traffic//udp/counters[@type=&quot;response-size&quot;]/counter[.&gt;0] or traffic//tcp/counters[@type=&quot;request-size&quot;]/counter[.&gt;0] or traffic//tcp/counters[@type=&quot;response-size&quot;]/counter[.&gt;0]">
          <h2>Traffic Size Statistics</h2>
        </xsl:if>
-        <xsl:if test="traffic/udp/counters[@type=&quot;request-size&quot;]/counter[.&gt;0]">
+        <xsl:if test="traffic//udp/counters[@type=&quot;request-size&quot;]/counter[.&gt;0]">
          <h4>UDP Requests Received</h4>
          <table class="counters">
-            <xsl:for-each select="traffic/udp/counters[@type=&quot;request-size&quot;]/counter[.&gt;0]">
+            <xsl:for-each select="traffic//udp/counters[@type=&quot;request-size&quot;]/counter[.&gt;0]">
              <xsl:variable name="css-class7">
                <xsl:choose>
                  <xsl:when test="position() mod 2 = 0">even</xsl:when>
@@ -606,6 +656,7 @@
                </xsl:choose>
              </xsl:variable>
              <tr class="{$css-class7}">
+                <th><xsl:value-of select="local-name(../../..)"/></th>
                <th>
                  <xsl:value-of select="@name"/>
                </th>
@@ -617,10 +668,10 @@
          </table>
          <br/>
        </xsl:if>
-        <xsl:if test="traffic/udp/counters[@type=&quot;response-size&quot;]/counter[.&gt;0]">
+        <xsl:if test="traffic//udp/counters[@type=&quot;response-size&quot;]/counter[.&gt;0]">
          <h4>UDP Responses Sent</h4>
          <table class="counters">
-            <xsl:for-each select="traffic/udp/counters[@type=&quot;response-size&quot;]/counter[.&gt;0]">
+            <xsl:for-each select="traffic//udp/counters[@type=&quot;response-size&quot;]/counter[.&gt;0]">
              <xsl:variable name="css-class7">
                <xsl:choose>
                  <xsl:when test="position() mod 2 = 0">even</xsl:when>
@@ -628,6 +679,7 @@
                </xsl:choose>
              </xsl:variable>
              <tr class="{$css-class7}">
+                <th><xsl:value-of select="local-name(../../..)"/></th>
                <th>
                  <xsl:value-of select="@name"/>
                </th>
@@ -639,10 +691,10 @@
          </table>
          <br/>
        </xsl:if>
-        <xsl:if test="traffic/tcp/counters[@type=&quot;request-size&quot;]/counter[.&gt;0]">
+        <xsl:if test="traffic//tcp/counters[@type=&quot;request-size&quot;]/counter[.&gt;0]">
          <h4>TCP Requests Received</h4>
          <table class="counters">
-            <xsl:for-each select="traffic/tcp/counters[@type=&quot;request-size&quot;]/counter[.&gt;0]">
+            <xsl:for-each select="traffic//tcp/counters[@type=&quot;request-size&quot;]/counter[.&gt;0]">
              <xsl:variable name="css-class7">
                <xsl:choose>
                  <xsl:when test="position() mod 2 = 0">even</xsl:when>
@@ -650,6 +702,7 @@
                </xsl:choose>
              </xsl:variable>
              <tr class="{$css-class7}">
+                <th><xsl:value-of select="local-name(../../..)"/></th>
                <th>
                  <xsl:value-of select="@name"/>
                </th>
@@ -661,10 +714,10 @@
          </table>
          <br/>
        </xsl:if>
-        <xsl:if test="traffic/tcp/counters[@type=&quot;response-size&quot;]/counter[.&gt;0]">
+        <xsl:if test="traffic//tcp/counters[@type=&quot;response-size&quot;]/counter[.&gt;0]">
          <h4>TCP Responses Sent</h4>
          <table class="counters">
-            <xsl:for-each select="traffic/tcp/counters[@type=&quot;response-size&quot;]/counter[.&gt;0]">
+            <xsl:for-each select="traffic//tcp/counters[@type=&quot;response-size&quot;]/counter[.&gt;0]">
              <xsl:variable name="css-class7">
                <xsl:choose>
                  <xsl:when test="position() mod 2 = 0">even</xsl:when>
@@ -672,6 +725,7 @@
                </xsl:choose>
              </xsl:variable>
              <tr class="{$css-class7}">
+                <th><xsl:value-of select="local-name(../../..)"/></th>
                <th>
                  <xsl:value-of select="@name"/>
                </th>
@@ -705,6 +759,29 @@
          </table>
          <br/>
        </xsl:if>
+        <xsl:if test="views/view/zones/zone">
+          <xsl:for-each select="views/view">
+            <h3>Zones for View <xsl:value-of select="@name"/></h3>
+            <table class="zones">
+              <thead><tr><th>Name</th><th>Class</th><th>Type</th><th>Serial</th></tr></thead>
+              <tbody>
+                <xsl:for-each select="zones/zone">
+                  <xsl:variable name="css-class15">
+                    <xsl:choose>
+                      <xsl:when test="position() mod 2 = 0">even</xsl:when>
+                      <xsl:otherwise>odd</xsl:otherwise>
+                    </xsl:choose>
+                  </xsl:variable>
+                  <tr class="{$css-class15}">
+                      <td><xsl:value-of select="@name"/></td>
+                      <td><xsl:value-of select="@rdataclass"/></td>
+                      <td><xsl:value-of select="type"/></td>
+                      <td><xsl:value-of select="serial"/></td></tr>
+                </xsl:for-each>
+              </tbody>
+            </table>
+          </xsl:for-each>
+        </xsl:if>
        <xsl:if test="views/view[zones/zone/counters[@type=&quot;qtype&quot;]/counter &gt;0]">
          <h2>Received QTYPES per view/zone</h2>
          <xsl:for-each select="views/view[zones/zone/counters[@type=&quot;qtype&quot;]/counter &gt;0]">
@@ -20,6 +20,15 @@ static char xslmsg[] =
 	" <xsl:template match=\"statistics[@version=&quot;3.8&quot;]\">\n"
 	" <html>\n"
 	" <head>\n"
+	" <script type=\"text/javascript\" src=\"https://ajax.googleapis.com/ajax/libs/jquery/3.4.1/jquery.min.js\"></script>\n"
+	" <script type=\"text/javascript\">\n"
+	" $(function($) {\n"
+	" var wid=0;\n"
+	" $('table.zones').each(function(i) { if( $(this).width() > wid ) wid = $(this).width(); return true; });\n"
+	" $('table.zones').css('min-width', wid );\n"
+	" });\n"
+	" </script>\n"
+	"\n"
 	" <xsl:if test=\"system-property('xsl:vendor')!='Transformiix'\">\n"
 	" <!-- Non Mozilla specific markup -->\n"
 	" <script type=\"text/javascript\" src=\"https://www.google.com/jsapi\"/>\n"
@@ -203,10 +212,45 @@ static char xslmsg[] =
 	" background-color: #99ddff;\n"
 	" }\n"
 	"\n"
+	" table.zones {\n"
+	" border: 1px solid grey;\n"
+	" width: 500px;\n"
+	" }\n"
+	" table.zones th {\n"
+	" text-align: center;\n"
+	" border: 1px solid grey;\n"
+	" }\n"
+	" table.zones td {\n"
+	" text-align: center;\n"
+	" font-family: monospace;\n"
+	" }\n"
+	" table.zones td:nth-child(1) {\n"
+	" text-align: right;\n"
+	" }\n"
+	" table.zones td:nth-child(4) {\n"
+	" text-align: right;\n"
+	" }\n"
+	"\n"
 	" .totals {\n"
 	" background-color: rgb(1,169,206);\n"
 	" color: #ffffff;\n"
 	" }\n"
+	" table.zones {\n"
+	" border: 1px solid grey;\n"
+	" }\n"
+	" table.zones td {\n"
+	" text-align: right;\n"
+	" font-family: monospace;\n"
+	" }\n"
+	" table.zones td:nth-child(2) {\n"
+	" text-align: center;\n"
+	" }\n"
+	" table.zones td:nth-child(3) {\n"
+	" text-align: left;\n"
+	" }\n"
+	" table.zones tr:hover{\n"
+	" background-color: #99ddff;\n"
+	" }\n"
 	"\n"
 	" td, th {\n"
 	" padding-right: 5px;\n"
@@ -279,25 +323,25 @@ static char xslmsg[] =
 	" <hr/>\n"
 	" <h2>Server Status</h2>\n"
 	" <table class=\"info\">\n"
-	" <tr>\n"
+	" <tr class=\"odd\">\n"
 	" <th>Boot time:</th>\n"
 	" <td>\n"
 	" <xsl:value-of select=\"server/boot-time\"/>\n"
 	" </td>\n"
 	" </tr>\n"
-	" <tr>\n"
+	" <tr class=\"even\">\n"
 	" <th>Last reconfigured:</th>\n"
 	" <td>\n"
 	" <xsl:value-of select=\"server/config-time\"/>\n"
 	" </td>\n"
 	" </tr>\n"
-	" <tr>\n"
+	" <tr class=\"odd\">\n"
 	" <th>Current time:</th>\n"
 	" <td>\n"
 	" <xsl:value-of select=\"server/current-time\"/>\n"
 	" </td>\n"
 	" </tr>\n"
-	" <tr>\n"
+	" <tr class=\"even\">\n"
 	" <th>Server version:</th>\n"
 	" <td>\n"
 	" <xsl:value-of select=\"server/version\"/>\n"
@@ -316,7 +360,13 @@ static char xslmsg[] =
 	" <table class=\"counters\">\n"
 	" <xsl:for-each select=\"server/counters[@type=&quot;opcode&quot;]/counter[. &gt; 0 or substring(@name,1,3) != 'RES']\">\n"
 	" <xsl:sort select=\".\" data-type=\"number\" order=\"descending\"/>\n"
-	" <tr>\n"
+	" <xsl:variable name=\"css-class0\">\n"
+	" <xsl:choose>\n"
+	" <xsl:when test=\"position() mod 2 = 0\">even</xsl:when>\n"
+	" <xsl:otherwise>odd</xsl:otherwise>\n"
+	" </xsl:choose>\n"
+	" </xsl:variable>\n"
+	" <tr class=\"{$css-class0}\">\n"
 	" <th>\n"
 	" <xsl:value-of select=\"@name\"/>\n"
 	" </th>\n"
@@ -597,13 +647,13 @@ static char xslmsg[] =
 	" <br/>\n"
 	" </xsl:if>\n"
 	" </xsl:for-each>\n"
-	" <xsl:if test=\"traffic/udp/counters[@type=&quot;request-size&quot;]/counter[.&gt;0] or traffic/udp/counters[@type=&quot;response-size&quot;]/counter[.&gt;0] or traffic/tcp/counters[@type=&quot;request-size&quot;]/counter[.&gt;0] or traffic/tcp/counters[@type=&quot;response-size&quot;]/counter[.&gt;0]\">\n"
+	" <xsl:if test=\"traffic//udp/counters[@type=&quot;request-size&quot;]/counter[.&gt;0] or traffic//udp/counters[@type=&quot;response-size&quot;]/counter[.&gt;0] or traffic//tcp/counters[@type=&quot;request-size&quot;]/counter[.&gt;0] or traffic//tcp/counters[@type=&quot;response-size&quot;]/counter[.&gt;0]\">\n"
 	" <h2>Traffic Size Statistics</h2>\n"
 	" </xsl:if>\n"
-	" <xsl:if test=\"traffic/udp/counters[@type=&quot;request-size&quot;]/counter[.&gt;0]\">\n"
+	" <xsl:if test=\"traffic//udp/counters[@type=&quot;request-size&quot;]/counter[.&gt;0]\">\n"
 	" <h4>UDP Requests Received</h4>\n"
 	" <table class=\"counters\">\n"
-	" <xsl:for-each select=\"traffic/udp/counters[@type=&quot;request-size&quot;]/counter[.&gt;0]\">\n"
+	" <xsl:for-each select=\"traffic//udp/counters[@type=&quot;request-size&quot;]/counter[.&gt;0]\">\n"
 	" <xsl:variable name=\"css-class7\">\n"
 	" <xsl:choose>\n"
 	" <xsl:when test=\"position() mod 2 = 0\">even</xsl:when>\n"
@@ -611,6 +661,7 @@ static char xslmsg[] =
 	" </xsl:choose>\n"
 	" </xsl:variable>\n"
 	" <tr class=\"{$css-class7}\">\n"
+	" <th><xsl:value-of select=\"local-name(../../..)\"/></th>\n"
 	" <th>\n"
 	" <xsl:value-of select=\"@name\"/>\n"
 	" </th>\n"
@@ -622,10 +673,10 @@ static char xslmsg[] =
 	" </table>\n"
 	" <br/>\n"
 	" </xsl:if>\n"
-	" <xsl:if test=\"traffic/udp/counters[@type=&quot;response-size&quot;]/counter[.&gt;0]\">\n"
+	" <xsl:if test=\"traffic//udp/counters[@type=&quot;response-size&quot;]/counter[.&gt;0]\">\n"
 	" <h4>UDP Responses Sent</h4>\n"
 	" <table class=\"counters\">\n"
-	" <xsl:for-each select=\"traffic/udp/counters[@type=&quot;response-size&quot;]/counter[.&gt;0]\">\n"
+	" <xsl:for-each select=\"traffic//udp/counters[@type=&quot;response-size&quot;]/counter[.&gt;0]\">\n"
 	" <xsl:variable name=\"css-class7\">\n"
 	" <xsl:choose>\n"
 	" <xsl:when test=\"position() mod 2 = 0\">even</xsl:when>\n"
@@ -633,6 +684,7 @@ static char xslmsg[] =
 	" </xsl:choose>\n"
 	" </xsl:variable>\n"
 	" <tr class=\"{$css-class7}\">\n"
+	" <th><xsl:value-of select=\"local-name(../../..)\"/></th>\n"
 	" <th>\n"
 	" <xsl:value-of select=\"@name\"/>\n"
 	" </th>\n"
@@ -644,10 +696,10 @@ static char xslmsg[] =
 	" </table>\n"
 	" <br/>\n"
 	" </xsl:if>\n"
-	" <xsl:if test=\"traffic/tcp/counters[@type=&quot;request-size&quot;]/counter[.&gt;0]\">\n"
+	" <xsl:if test=\"traffic//tcp/counters[@type=&quot;request-size&quot;]/counter[.&gt;0]\">\n"
 	" <h4>TCP Requests Received</h4>\n"
 	" <table class=\"counters\">\n"
-	" <xsl:for-each select=\"traffic/tcp/counters[@type=&quot;request-size&quot;]/counter[.&gt;0]\">\n"
+	" <xsl:for-each select=\"traffic//tcp/counters[@type=&quot;request-size&quot;]/counter[.&gt;0]\">\n"
 	" <xsl:variable name=\"css-class7\">\n"
 	" <xsl:choose>\n"
 	" <xsl:when test=\"position() mod 2 = 0\">even</xsl:when>\n"
@@ -655,6 +707,7 @@ static char xslmsg[] =
 	" </xsl:choose>\n"
 	" </xsl:variable>\n"
 	" <tr class=\"{$css-class7}\">\n"
+	" <th><xsl:value-of select=\"local-name(../../..)\"/></th>\n"
 	" <th>\n"
 	" <xsl:value-of select=\"@name\"/>\n"
 	" </th>\n"
@@ -666,10 +719,10 @@ static char xslmsg[] =
 	" </table>\n"
 	" <br/>\n"
 	" </xsl:if>\n"
-	" <xsl:if test=\"traffic/tcp/counters[@type=&quot;response-size&quot;]/counter[.&gt;0]\">\n"
+	" <xsl:if test=\"traffic//tcp/counters[@type=&quot;response-size&quot;]/counter[.&gt;0]\">\n"
 	" <h4>TCP Responses Sent</h4>\n"
 	" <table class=\"counters\">\n"
-	" <xsl:for-each select=\"traffic/tcp/counters[@type=&quot;response-size&quot;]/counter[.&gt;0]\">\n"
+	" <xsl:for-each select=\"traffic//tcp/counters[@type=&quot;response-size&quot;]/counter[.&gt;0]\">\n"
 	" <xsl:variable name=\"css-class7\">\n"
 	" <xsl:choose>\n"
 	" <xsl:when test=\"position() mod 2 = 0\">even</xsl:when>\n"
@@ -677,6 +730,7 @@ static char xslmsg[] =
 	" </xsl:choose>\n"
 	" </xsl:variable>\n"
 	" <tr class=\"{$css-class7}\">\n"
+	" <th><xsl:value-of select=\"local-name(../../..)\"/></th>\n"
 	" <th>\n"
 	" <xsl:value-of select=\"@name\"/>\n"
 	" </th>\n"
@@ -710,6 +764,29 @@ static char xslmsg[] =
 	" </table>\n"
 	" <br/>\n"
 	" </xsl:if>\n"
+	" <xsl:if test=\"views/view/zones/zone\">\n"
+	" <xsl:for-each select=\"views/view\">\n"
+	" <h3>Zones for View <xsl:value-of select=\"@name\"/></h3>\n"
+	" <table class=\"zones\">\n"
+	" <thead><tr><th>Name</th><th>Class</th><th>Type</th><th>Serial</th></tr></thead>\n"
+	" <tbody>\n"
+	" <xsl:for-each select=\"zones/zone\">\n"
+	" <xsl:variable name=\"css-class15\">\n"
+	" <xsl:choose>\n"
+	" <xsl:when test=\"position() mod 2 = 0\">even</xsl:when>\n"
+	" <xsl:otherwise>odd</xsl:otherwise>\n"
+	" </xsl:choose>\n"
+	" </xsl:variable>\n"
+	" <tr class=\"{$css-class15}\">\n"
+	" <td><xsl:value-of select=\"@name\"/></td>\n"
+	" <td><xsl:value-of select=\"@rdataclass\"/></td>\n"
+	" <td><xsl:value-of select=\"type\"/></td>\n"
+	" <td><xsl:value-of select=\"serial\"/></td></tr>\n"
+	" </xsl:for-each>\n"
+	" </tbody>\n"
+	" </table>\n"
+	" </xsl:for-each>\n"
+	" </xsl:if>\n"
 	" <xsl:if test=\"views/view[zones/zone/counters[@type=&quot;qtype&quot;]/counter &gt;0]\">\n"
 	" <h2>Received QTYPES per view/zone</h2>\n"
 	" <xsl:for-each select=\"views/view[zones/zone/counters[@type=&quot;qtype&quot;]/counter &gt;0]\">\n"
@@ -25,6 +25,7 @@
 #include <isc/random.h>
 #include <isc/safe.h>
 #include <isc/serial.h>
+#include <isc/siphash.h>
 #include <isc/stats.h>
 #include <isc/stdio.h>
 #include <isc/string.h>
@@ -246,10 +247,11 @@ static void ns_client_dumpmessage(ns_client_t *client, const char *reason);
 static isc_result_t get_client(ns_clientmgr_t *manager, ns_interface_t *ifp,
 			       dns_dispatch_t *disp, bool tcp);
 static isc_result_t get_worker(ns_clientmgr_t *manager, ns_interface_t *ifp,
-			       isc_socket_t *sock);
+			       isc_socket_t *sock, ns_client_t *oldclient);
 static inline bool
-allowed(isc_netaddr_t *addr, dns_name_t *signer, isc_netaddr_t *ecs_addr,
-	uint8_t ecs_addrlen, uint8_t *ecs_scope, dns_acl_t *acl);
+allowed(isc_netaddr_t *addr, dns_name_t *signer,
+	isc_netaddr_t *ecs_addr, uint8_t ecs_addrlen,
+	uint8_t *ecs_scope, dns_acl_t *acl);
 static void compute_cookie(ns_client_t *client, uint32_t when,
 			   uint32_t nonce, const unsigned char *secret,
 			   isc_buffer_t *buf);
@@ -298,6 +300,121 @@ ns_client_settimeout(ns_client_t *client, unsigned int seconds) {
 	}
 }

+/*%
+ * Allocate a reference-counted object that will maintain a single pointer to
+ * the (also reference-counted) TCP client quota, shared between all the
+ * clients processing queries on a single TCP connection, so that all
+ * clients sharing the one socket will together consume only one slot in
+ * the 'tcp-clients' quota.
+ */
+static isc_result_t
+tcpconn_init(ns_client_t *client, bool force) {
+	isc_result_t result;
+	isc_quota_t *quota = NULL;
+	ns_tcpconn_t *tconn = NULL;
+
+	REQUIRE(client->tcpconn == NULL);
+
+	/*
+	 * Try to attach to the quota first, so we won't pointlessly
+	 * allocate memory for a tcpconn object if we can't get one.
+	 */
+	if (force) {
+		result = isc_quota_force(&ns_g_server->tcpquota, &quota);
+	} else {
+		result = isc_quota_attach(&ns_g_server->tcpquota, &quota);
+	}
+	if (result != ISC_R_SUCCESS) {
+		return (result);
+	}
+
+	/*
+	 * A global memory context is used for the allocation as different
+	 * client structures may have different memory contexts assigned and a
+	 * reference counter allocated here might need to be freed by a
+	 * different client.  The performance impact caused by memory context
+	 * contention here is expected to be negligible, given that this code
+	 * is only executed for TCP connections.
+	 */
+	tconn = isc_mem_allocate(ns_g_mctx, sizeof(*tconn));
+	if (tconn == NULL) {
+		isc_quota_detach(&quota);
+		return (ISC_R_NOMEMORY);
+	}
+
+	isc_refcount_init(&tconn->refs, 1);
+	tconn->tcpquota = quota;
+	quota = NULL;
+	tconn->pipelined = false;
+
+	client->tcpconn = tconn;
+
+	return (ISC_R_SUCCESS);
+}
+
+/*%
+ * Increase the count of client structures sharing the TCP connection
+ * that 'source' is associated with; add a pointer to the same tcpconn
+ * to 'target', thus associating it with the same TCP connection.
+ */
+static void
+tcpconn_attach(ns_client_t *source, ns_client_t *target) {
+	int refs;
+
+	REQUIRE(source->tcpconn != NULL);
+	REQUIRE(target->tcpconn == NULL);
+	REQUIRE(source->tcpconn->pipelined);
+
+	isc_refcount_increment(&source->tcpconn->refs, &refs);
+	INSIST(refs > 1);
+	target->tcpconn = source->tcpconn;
+}
+
+/*%
+ * Decrease the count of client structures sharing the TCP connection that
+ * 'client' is associated with.  If this is the last client using this TCP
+ * connection, we detach from the TCP quota and free the tcpconn
+ * object. Either way, client->tcpconn is set to NULL.
+ */
+static void
+tcpconn_detach(ns_client_t *client) {
+	ns_tcpconn_t *tconn = NULL;
+	int refs;
+
+	REQUIRE(client->tcpconn != NULL);
+
+	tconn = client->tcpconn;
+	client->tcpconn = NULL;
+
+	isc_refcount_decrement(&tconn->refs, &refs);
+	if (refs == 0) {
+		isc_quota_detach(&tconn->tcpquota);
+		isc_mem_free(ns_g_mctx, tconn);
+	}
+}
+
+/*%
+ * Mark a client as active and increment the interface's 'ntcpactive'
+ * counter, as a signal that there is at least one client servicing
+ * TCP queries for the interface. If we reach the TCP client quota at
+ * some point, this will be used to determine whether a quota overrun
+ * should be permitted.
+ *
+ * Marking the client active with the 'tcpactive' flag ensures proper
+ * accounting, by preventing us from incrementing or decrementing
+ * 'ntcpactive' more than once per client.
+ */
+static void
+mark_tcp_active(ns_client_t *client, bool active) {
+	if (active && !client->tcpactive) {
+		isc_refcount_increment0(&client->interface->ntcpactive, NULL);
+		client->tcpactive = active;
+	} else if (!active && client->tcpactive) {
+		isc_refcount_decrement(&client->interface->ntcpactive, NULL);
+		client->tcpactive = active;
+	}
+}
+
 /*%
 * Check for a deactivation or shutdown request and take appropriate
 * action.  Returns true if either is in progress; in this case
@@ -387,7 +504,8 @@ exit_check(ns_client_t *client) {
 		INSIST(client->recursionquota == NULL);

 		if (NS_CLIENTSTATE_READING == client->newstate) {
-			if (!client->pipelined) {
+			INSIST(client->tcpconn != NULL);
+			if (!client->tcpconn->pipelined) {
 				client_read(client);
 				client->newstate = NS_CLIENTSTATE_MAX;
 				return (true); /* We're done. */
@@ -405,10 +523,13 @@ exit_check(ns_client_t *client) {
 		 */
 		INSIST(client->recursionquota == NULL);
 		INSIST(client->newstate <= NS_CLIENTSTATE_READY);
-		if (client->nreads > 0)
+
+		if (client->nreads > 0) {
 			dns_tcpmsg_cancelread(&client->tcpmsg);
-		if (client->nreads != 0) {
-			/* Still waiting for read cancel completion. */
+		}
+
+		/* Still waiting for read cancel completion. */
+		if (client->nreads > 0) {
 			return (true);
 		}

@@ -416,14 +537,49 @@ exit_check(ns_client_t *client) {
 			dns_tcpmsg_invalidate(&client->tcpmsg);
 			client->tcpmsg_valid = false;
 		}
+
+		/*
+		 * Soon the client will be ready to accept a new TCP
+		 * connection or UDP request, but we may have enough
+		 * clients doing that already.  Check whether this client
+		 * needs to remain active and allow it go inactive if
+		 * not.
+		 *
+		 * UDP clients always go inactive at this point, but a TCP
+		 * client may need to stay active and return to READY
+		 * state if no other clients are available to listen
+		 * for TCP requests on this interface.
+		 *
+		 * Regardless, if we're going to FREED state, that means
+		 * the system is shutting down and we don't need to
+		 * retain clients.
+		 */
+		if (client->mortal && TCP_CLIENT(client) &&
+		    client->newstate != NS_CLIENTSTATE_FREED &&
+		    !ns_g_clienttest &&
+		    isc_refcount_current(&client->interface->ntcpaccepting) == 0)
+		{
+			/* Nobody else is accepting */
+			client->mortal = false;
+			client->newstate = NS_CLIENTSTATE_READY;
+		}
+
+		/*
+		 * Detach from TCP connection and TCP client quota,
+		 * if appropriate. If this is the last reference to
+		 * the TCP connection in our pipeline group, the
+		 * TCP quota slot will be released.
+		 */
+		if (client->tcpconn) {
+			tcpconn_detach(client);
+		}
+
 		if (client->tcpsocket != NULL) {
 			CTRACE("closetcp");
 			isc_socket_detach(&client->tcpsocket);
+			mark_tcp_active(client, false);
 		}

-		if (client->tcpquota != NULL)
-			isc_quota_detach(&client->tcpquota);
-
 		if (client->timerset) {
 			(void)isc_timer_reset(client->timer,
 					      isc_timertype_inactive,
@@ -431,45 +587,26 @@ exit_check(ns_client_t *client) {
 			client->timerset = false;
 		}

-		client->pipelined = false;
-
 		client->peeraddr_valid = false;

 		client->state = NS_CLIENTSTATE_READY;
-		INSIST(client->recursionquota == NULL);
-
-		/*
-		 * Now the client is ready to accept a new TCP connection
-		 * or UDP request, but we may have enough clients doing
-		 * that already.  Check whether this client needs to remain
-		 * active and force it to go inactive if not.
-		 *
-		 * UDP clients go inactive at this point, but TCP clients
-		 * may remain active if we have fewer active TCP client
-		 * objects than desired due to an earlier quota exhaustion.
-		 */
-		if (client->mortal && TCP_CLIENT(client) && !ns_g_clienttest) {
-			LOCK(&client->interface->lock);
-			if (client->interface->ntcpcurrent <
-				    client->interface->ntcptarget)
-				client->mortal = false;
-			UNLOCK(&client->interface->lock);
-		}

 		/*
 		 * We don't need the client; send it to the inactive
 		 * queue for recycling.
 		 */
 		if (client->mortal) {
-			if (client->newstate > NS_CLIENTSTATE_INACTIVE)
+			if (client->newstate > NS_CLIENTSTATE_INACTIVE) {
 				client->newstate = NS_CLIENTSTATE_INACTIVE;
+			}
 		}

 		if (NS_CLIENTSTATE_READY == client->newstate) {
 			if (TCP_CLIENT(client)) {
 				client_accept(client);
-			} else
+			} else {
 				client_udprecv(client);
+			}
 			client->newstate = NS_CLIENTSTATE_MAX;
 			return (true);
 		}
@@ -481,41 +618,50 @@ exit_check(ns_client_t *client) {
 		/*
 		 * We are trying to enter the inactive state.
 		 */
-		if (client->naccepts > 0)
+		if (client->naccepts > 0) {
 			isc_socket_cancel(client->tcplistener, client->task,
 					  ISC_SOCKCANCEL_ACCEPT);
+		}

 		/* Still waiting for accept cancel completion. */
-		if (! (client->naccepts == 0))
+		if (client->naccepts > 0) {
 			return (true);
+		}

 		/* Accept cancel is complete. */
-		if (client->nrecvs > 0)
+		if (client->nrecvs > 0) {
 			isc_socket_cancel(client->udpsocket, client->task,
 					  ISC_SOCKCANCEL_RECV);
+		}

 		/* Still waiting for recv cancel completion. */
-		if (! (client->nrecvs == 0))
+		if (client->nrecvs > 0) {
 			return (true);
+		}

 		/* Still waiting for control event to be delivered */
-		if (client->nctls > 0)
+		if (client->nctls > 0) {
 			return (true);
-
-		/* Deactivate the client. */
-		if (client->interface)
-			ns_interface_detach(&client->interface);
+		}

 		INSIST(client->naccepts == 0);
 		INSIST(client->recursionquota == NULL);
-		if (client->tcplistener != NULL)
+		if (client->tcplistener != NULL) {
 			isc_socket_detach(&client->tcplistener);
-
-		if (client->udpsocket != NULL)
+			mark_tcp_active(client, false);
+		}
+		if (client->udpsocket != NULL) {
 			isc_socket_detach(&client->udpsocket);
+		}

-		if (client->dispatch != NULL)
+		/* Deactivate the client. */
+		if (client->interface != NULL) {
+			ns_interface_detach(&client->interface);
+		}
+
+		if (client->dispatch != NULL) {
 			dns_dispatch_detach(&client->dispatch);
+		}

 		client->attributes = 0;
 		client->mortal = false;
@@ -540,10 +686,13 @@ exit_check(ns_client_t *client) {
 			client->newstate = NS_CLIENTSTATE_MAX;
 			if (!ns_g_clienttest && manager != NULL &&
 			    !manager->exiting)
+			{
 				ISC_QUEUE_PUSH(manager->inactive, client,
 					       ilink);
-			if (client->needshutdown)
+			}
+			if (client->needshutdown) {
 				isc_task_shutdown(client->task);
+			}
 			return (true);
 		}
 	}
@@ -617,6 +766,7 @@ exit_check(ns_client_t *client) {
 		if (ns_g_clienttest && isc_mem_references(client->mctx) != 1) {
 			isc_mem_stats(client->mctx, stderr);
 			INSIST(0);
+			ISC_UNREACHABLE();
 		}

 		/*
@@ -653,7 +803,7 @@ client_start(isc_task_t *task, isc_event_t *event) {
 		return;

 	if (TCP_CLIENT(client)) {
-		if (client->pipelined) {
+		if (client->tcpconn != NULL) {
 			client_read(client);
 		} else {
 			client_accept(client);
@@ -663,7 +813,6 @@ client_start(isc_task_t *task, isc_event_t *event) {
 	}
 }

-
 /*%
 * The client's task has received a shutdown event.
 */
@@ -1230,7 +1379,7 @@ client_send(ns_client_t *client) {
 			break;
 		default:
 			INSIST(0);
-			break;
+			ISC_UNREACHABLE();
 		}
 	} else {
 		respsize = isc_buffer_usedlength(&buffer);
@@ -1256,7 +1405,7 @@ client_send(ns_client_t *client) {
 			break;
 		default:
 			INSIST(0);
-			break;
+			ISC_UNREACHABLE();
 		}
 	}

@@ -1638,7 +1787,7 @@ ns_client_addopt(ns_client_t *client, dns_message_t *message,
 		isc_buffer_t buf;
 		uint8_t addr[16];
 		uint32_t plen, addrl;
-		uint16_t family;
+		uint16_t family = 0;

 		/* Add CLIENT-SUBNET option. */

@@ -1664,6 +1813,7 @@ ns_client_addopt(ns_client_t *client, dns_message_t *message,
 			break;
 		default:
 			INSIST(0);
+			ISC_UNREACHABLE();
 		}

 		isc_buffer_init(&buf, ecs, sizeof(ecs));
@@ -1783,6 +1933,42 @@ compute_cookie(ns_client_t *client, uint32_t when, uint32_t nonce,
 	       const unsigned char *secret, isc_buffer_t *buf)
 {
 	switch (ns_g_server->cookiealg) {
+	case ns_cookiealg_siphash24: {
+		unsigned char digest[ISC_SIPHASH24_TAG_LENGTH] = { 0 };
+		unsigned char input[16 + 16] = { 0 };
+		size_t inputlen = 0;
+		isc_netaddr_t netaddr;
+		unsigned char *cp;
+
+		cp = isc_buffer_used(buf);
+		isc_buffer_putmem(buf, client->cookie, 8);
+		isc_buffer_putuint8(buf, NS_COOKIE_VERSION_1);
+		isc_buffer_putuint24(buf, 0); /* Reserved */
+		isc_buffer_putuint32(buf, when);
+
+		memmove(input, cp, 16);
+
+		isc_netaddr_fromsockaddr(&netaddr, &client->peeraddr);
+		switch (netaddr.family) {
+		case AF_INET:
+			cp = (unsigned char *)&netaddr.type.in;
+			memmove(input + 16, cp, 4);
+			inputlen = 20;
+			break;
+		case AF_INET6:
+			cp = (unsigned char *)&netaddr.type.in6;
+			memmove(input + 16, cp, 16);
+			inputlen = 32;
+			break;
+		default:
+			INSIST(0);
+			ISC_UNREACHABLE();
+		}
+
+		isc_siphash24(secret, input, inputlen, digest);
+		isc_buffer_putmem(buf, digest, 8);
+		break;
+	}
 #if defined(HAVE_OPENSSL_AES) || defined(HAVE_OPENSSL_EVP_AES)
 	case ns_cookiealg_aes: {
 		unsigned char digest[ISC_AES_BLOCK_LENGTH];
@@ -1791,15 +1977,15 @@ compute_cookie(ns_client_t *client, uint32_t when, uint32_t nonce,
 		unsigned char *cp;
 		unsigned int i;

-		memset(input, 0, sizeof(input));
 		cp = isc_buffer_used(buf);
 		isc_buffer_putmem(buf, client->cookie, 8);
 		isc_buffer_putuint32(buf, nonce);
 		isc_buffer_putuint32(buf, when);
 		memmove(input, cp, 16);
 		isc_aes128_crypt(secret, input, digest);
-		for (i = 0; i < 8; i++)
+		for (i = 0; i < 8; i++) {
 			input[i] = digest[i] ^ digest[i + 8];
+		}
 		isc_netaddr_fromsockaddr(&netaddr, &client->peeraddr);
 		switch (netaddr.family) {
 		case AF_INET:
@@ -1812,14 +1998,19 @@ compute_cookie(ns_client_t *client, uint32_t when, uint32_t nonce,
 			cp = (unsigned char *)&netaddr.type.in6;
 			memmove(input + 8, cp, 16);
 			isc_aes128_crypt(secret, input, digest);
-			for (i = 0; i < 8; i++)
+			for (i = 0; i < 8; i++) {
 				input[i + 8] = digest[i] ^ digest[i + 8];
+			}
 			isc_aes128_crypt(ns_g_server->secret, input + 8,
 					 digest);
 			break;
+		default:
+			INSIST(0);
+			ISC_UNREACHABLE();
 		}
-		for (i = 0; i < 8; i++)
+		for (i = 0; i < 8; i++) {
 			digest[i] ^= digest[i + 8];
+		}
 		isc_buffer_putmem(buf, digest, 8);
 		break;
 	}
@@ -1851,6 +2042,7 @@ compute_cookie(ns_client_t *client, uint32_t when, uint32_t nonce,
 			break;
 		default:
 			INSIST(0);
+			ISC_UNREACHABLE();
 		}
 		isc_hmacsha1_update(&hmacsha1, cp, length);
 		isc_hmacsha1_sign(&hmacsha1, digest, sizeof(digest));
@@ -1886,6 +2078,7 @@ compute_cookie(ns_client_t *client, uint32_t when, uint32_t nonce,
 			break;
 		default:
 			INSIST(0);
+			ISC_UNREACHABLE();
 		}
 		isc_hmacsha256_update(&hmacsha256, cp, length);
 		isc_hmacsha256_sign(&hmacsha256, digest, sizeof(digest));
@@ -1895,6 +2088,7 @@ compute_cookie(ns_client_t *client, uint32_t when, uint32_t nonce,
 	}
 	default:
 		INSIST(0);
+		ISC_UNREACHABLE();
 	}
 }

@@ -2304,6 +2498,7 @@ client_request(isc_task_t *task, isc_event_t *event) {
 		client->nrecvs--;
 	} else {
 		INSIST(TCP_CLIENT(client));
+		INSIST(client->tcpconn != NULL);
 		REQUIRE(event->ev_type == DNS_EVENT_TCPMSG);
 		REQUIRE(event->ev_sender == &client->tcpmsg);
 		buffer = &client->tcpmsg.buffer;
@@ -2445,7 +2640,7 @@ client_request(isc_task_t *task, isc_event_t *event) {
 			break;
 		default:
 			INSIST(0);
-			break;
+			ISC_UNREACHABLE();
 		}
 	} else {
 		switch (isc_sockaddr_pf(&client->peeraddr)) {
@@ -2459,7 +2654,7 @@ client_request(isc_task_t *task, isc_event_t *event) {
 			break;
 		default:
 			INSIST(0);
-			break;
+			ISC_UNREACHABLE();
 		}
 	}

@@ -2472,14 +2667,18 @@ client_request(isc_task_t *task, isc_event_t *event) {
 		 * Parsing the request failed.  Send a response
 		 * (typically FORMERR or SERVFAIL).
 		 */
-		if (result == DNS_R_OPTERR)
+		if (result == DNS_R_OPTERR) {
 			(void)ns_client_addopt(client, client->message,
 					       &client->opt);
+		}

 		ns_client_log(client, NS_LOGCATEGORY_CLIENT,
 			      NS_LOGMODULE_CLIENT, ISC_LOG_DEBUG(1),
 			      "message parsing failed: %s",
 			      isc_result_totext(result));
+		if (result == ISC_R_NOSPACE) {
+			result = DNS_R_FORMERR;
+		}
 		ns_client_error(client, result);
 		goto cleanup;
 	}
@@ -2487,18 +2686,27 @@ client_request(isc_task_t *task, isc_event_t *event) {
 	/*
 	 * Pipeline TCP query processing.
 	 */
-	if (client->message->opcode != dns_opcode_query)
-		client->pipelined = false;
-	if (TCP_CLIENT(client) && client->pipelined) {
-		result = isc_quota_reserve(&ns_g_server->tcpquota);
-		if (result == ISC_R_SUCCESS)
-			result = ns_client_replace(client);
+	if (TCP_CLIENT(client) &&
+	    client->message->opcode != dns_opcode_query)
+	{
+		client->tcpconn->pipelined = false;
+	}
+	if (TCP_CLIENT(client) && client->tcpconn->pipelined) {
+		/*
+		 * We're pipelining. Replace the client; the
+		 * replacement can read the TCP socket looking
+		 * for new messages and this one can process the
+		 * current message asynchronously.
+		 *
+		 * There will now be at least three clients using this
+		 * TCP socket - one accepting new connections,
+		 * one reading an existing connection to get new
+		 * messages, and one answering the message already
+		 * received.
+		 */
+		result = ns_client_replace(client);
 		if (result != ISC_R_SUCCESS) {
-			ns_client_log(client, NS_LOGCATEGORY_CLIENT,
-				      NS_LOGMODULE_CLIENT, ISC_LOG_WARNING,
-				      "no more TCP clients(read): %s",
-				      isc_result_totext(result));
-			client->pipelined = false;
+			client->tcpconn->pipelined = false;
 		}
 	}

@@ -2534,6 +2742,31 @@ client_request(isc_task_t *task, isc_event_t *event) {
 	client->ecs_scope = 0;

 	if (opt != NULL) {
+		/*
+		 * Are returning FORMERR to all EDNS queries?
+		 * Simulate a STD13 compliant server.
+		 */
+		if (ns_g_ednsformerr) {
+			ns_client_error(client, DNS_R_FORMERR);
+			return;
+		}
+
+		/*
+		 * Are returning NOTIMP to all EDNS queries?
+		 */
+		if (ns_g_ednsnotimp) {
+			ns_client_error(client, DNS_R_NOTIMP);
+			return;
+		}
+
+		/*
+		 * Are returning REFUSED to all EDNS queries?
+		 */
+		if (ns_g_ednsrefused) {
+			ns_client_error(client, DNS_R_REFUSED);
+			return;
+		}
+
 		/*
 		 * Are we dropping all EDNS queries?
 		 */
@@ -2541,6 +2774,7 @@ client_request(isc_task_t *task, isc_event_t *event) {
 			ns_client_next(client, ISC_R_SUCCESS);
 			goto cleanup;
 		}
+
 		result = process_opt(client, opt);
 		if (result != ISC_R_SUCCESS)
 			goto cleanup;
@@ -2816,8 +3050,9 @@ client_request(isc_task_t *task, isc_event_t *event) {
 				     true) == ISC_R_SUCCESS)
 		ra = true;

-	if (ra == true)
+	if (ra == true) {
 		client->attributes |= NS_CLIENTATTR_RA;
+	}

 	ns_client_log(client, DNS_LOGCATEGORY_SECURITY, NS_LOGMODULE_CLIENT,
 		      ISC_LOG_DEBUG(3), ra ? "recursion available" :
@@ -2843,10 +3078,11 @@ client_request(isc_task_t *task, isc_event_t *event) {
 	case dns_opcode_query:
 		CTRACE("query");
 #ifdef HAVE_DNSTAP
-		if ((client->message->flags & DNS_MESSAGEFLAG_RD) != 0)
+		if (ra && (client->message->flags & DNS_MESSAGEFLAG_RD) != 0) {
 			dtmsgtype = DNS_DTTYPE_CQ;
-		else
+		} else {
 			dtmsgtype = DNS_DTTYPE_AQ;
+		}

 		dns_dt_send(view, dtmsgtype, &client->peeraddr,
 			    &client->destsockaddr, TCP_CLIENT(client), NULL,
@@ -3054,8 +3290,7 @@ client_create(ns_clientmgr_t *manager, ns_client_t **clientp) {
 	client->signer = NULL;
 	dns_name_init(&client->signername, NULL);
 	client->mortal = false;
-	client->pipelined = false;
-	client->tcpquota = NULL;
+	client->tcpconn = NULL;
 	client->recursionquota = NULL;
 	client->interface = NULL;
 	client->peeraddr_valid = false;
@@ -3065,6 +3300,7 @@ client_create(ns_clientmgr_t *manager, ns_client_t **clientp) {
 	client->filter_aaaa = dns_aaaa_ok;
 #endif
 	client->needshutdown = ns_g_clienttest;
+	client->tcpactive = false;

 	ISC_EVENT_INIT(&client->ctlevent, sizeof(client->ctlevent), 0, NULL,
 		       NS_EVENT_CLIENTCONTROL, client_start, client, client,
@@ -3159,9 +3395,9 @@ client_read(ns_client_t *client) {

 static void
 client_newconn(isc_task_t *task, isc_event_t *event) {
+	isc_result_t result;
 	ns_client_t *client = event->ev_arg;
 	isc_socket_newconnev_t *nevent = (isc_socket_newconnev_t *)event;
-	isc_result_t result;

 	REQUIRE(event->ev_type == ISC_SOCKEVENT_NEWCONN);
 	REQUIRE(NS_CLIENT_VALID(client));
@@ -3171,13 +3407,17 @@ client_newconn(isc_task_t *task, isc_event_t *event) {

 	INSIST(client->state == NS_CLIENTSTATE_READY);

+	/*
+	 * The accept() was successful and we're now establishing a new
+	 * connection. We need to make note of it in the client and
+	 * interface objects so client objects can do the right thing
+	 * when going inactive in exit_check() (see comments in
+	 * client_accept() for details).
+	 */
 	INSIST(client->naccepts == 1);
 	client->naccepts--;

-	LOCK(&client->interface->lock);
-	INSIST(client->interface->ntcpcurrent > 0);
-	client->interface->ntcpcurrent--;
-	UNLOCK(&client->interface->lock);
+	isc_refcount_decrement(&client->interface->ntcpaccepting, NULL);

 	/*
 	 * We must take ownership of the new socket before the exit
@@ -3210,6 +3450,7 @@ client_newconn(isc_task_t *task, isc_event_t *event) {
 			      NS_LOGMODULE_CLIENT, ISC_LOG_DEBUG(3),
 			      "accept failed: %s",
 			      isc_result_totext(nevent->result));
+		tcpconn_detach(client);
 	}

 	if (exit_check(client))
@@ -3247,20 +3488,13 @@ client_newconn(isc_task_t *task, isc_event_t *event) {
 		 * telnetting to port 53 (once per CPU) will
 		 * deny service to legitimate TCP clients.
 		 */
-		client->pipelined = false;
-		result = isc_quota_attach(&ns_g_server->tcpquota,
-					  &client->tcpquota);
-		if (result == ISC_R_SUCCESS)
-			result = ns_client_replace(client);
-		if (result != ISC_R_SUCCESS) {
-			ns_client_log(client, NS_LOGCATEGORY_CLIENT,
-				      NS_LOGMODULE_CLIENT, ISC_LOG_WARNING,
-				      "no more TCP clients(accept): %s",
-				      isc_result_totext(result));
-		} else if (ns_g_server->keepresporder == NULL ||
-			   !allowed(&netaddr, NULL, NULL, 0, NULL,
-				    ns_g_server->keepresporder)) {
-			client->pipelined = true;
+		result = ns_client_replace(client);
+		if (result == ISC_R_SUCCESS &&
+		    (ns_g_server->keepresporder == NULL ||
+		     !allowed(&netaddr, NULL, NULL, 0, NULL,
+			      ns_g_server->keepresporder)))
+		{
+			client->tcpconn->pipelined = true;
 		}

 		client_read(client);
@@ -3276,12 +3510,66 @@ client_accept(ns_client_t *client) {

 	CTRACE("accept");

+	/*
+	 * Set up a new TCP connection. This means try to attach to the
+	 * TCP client quota (tcp-clients), but fail if we're over quota.
+	 */
+	result = tcpconn_init(client, false);
+	if (result != ISC_R_SUCCESS) {
+		bool exit;
+
+		ns_client_log(client, NS_LOGCATEGORY_CLIENT,
+			      NS_LOGMODULE_CLIENT, ISC_LOG_WARNING,
+			      "TCP client quota reached: %s",
+			      isc_result_totext(result));
+
+		/*
+		 * We have exceeded the system-wide TCP client quota.  But,
+		 * we can't just block this accept in all cases, because if
+		 * we did, a heavy TCP load on other interfaces might cause
+		 * this interface to be starved, with no clients able to
+		 * accept new connections.
+		 *
+		 * So, we check here to see if any other clients are
+		 * already servicing TCP queries on this interface (whether
+		 * accepting, reading, or processing). If we find that at
+		 * least one client other than this one is active, then
+		 * it's okay *not* to call accept - we can let this
+		 * client go inactive and another will take over when it's
+		 * done.
+		 *
+		 * If there aren't enough active clients on the interface,
+		 * then we can be a little bit flexible about the quota.
+		 * We'll allow *one* extra client through to ensure we're
+		 * listening on every interface; we do this by setting the
+		 * 'force' option to tcpconn_init().
+		 *
+		 * (Note: In practice this means that the real TCP client
+		 * quota is tcp-clients plus the number of listening
+		 * interfaces plus 1.)
+		 */
+		exit = (isc_refcount_current(&client->interface->ntcpactive) >
+			(client->tcpactive ? 1U : 0U));
+		if (exit) {
+			client->newstate = NS_CLIENTSTATE_INACTIVE;
+			(void)exit_check(client);
+			return;
+		}
+
+		result = tcpconn_init(client, true);
+		RUNTIME_CHECK(result == ISC_R_SUCCESS);
+	}
+
+	/*
+	 * If this client was set up using get_client() or get_worker(),
+	 * then TCP is already marked active. However, if it was restarted
+	 * from exit_check(), it might not be, so we take care of it now.
+	 */
+	mark_tcp_active(client, true);
+
 	result = isc_socket_accept(client->tcplistener, client->task,
 				   client_newconn, client);
 	if (result != ISC_R_SUCCESS) {
-		UNEXPECTED_ERROR(__FILE__, __LINE__,
-				 "isc_socket_accept() failed: %s",
-				 isc_result_totext(result));
 		/*
 		 * XXXRTH  What should we do?  We're trying to accept but
 		 *	   it didn't work.  If we just give up, then TCP
@@ -3289,13 +3577,37 @@ client_accept(ns_client_t *client) {
 		 *
 		 *	   For now, we just go idle.
 		 */
+		UNEXPECTED_ERROR(__FILE__, __LINE__,
+				 "isc_socket_accept() failed: %s",
+				 isc_result_totext(result));
+
+		tcpconn_detach(client);
+		mark_tcp_active(client, false);
 		return;
 	}
+
+	/*
+	 * The client's 'naccepts' counter indicates that this client has
+	 * called accept() and is waiting for a new connection. It should
+	 * never exceed 1.
+	 */
 	INSIST(client->naccepts == 0);
 	client->naccepts++;
-	LOCK(&client->interface->lock);
-	client->interface->ntcpcurrent++;
-	UNLOCK(&client->interface->lock);
+
+	/*
+	 * The interface's 'ntcpaccepting' counter is incremented when
+	 * any client calls accept(), and decremented in client_newconn()
+	 * once the connection is established.
+	 *
+	 * When the client object is shutting down after handling a TCP
+	 * request (see exit_check()), if this value is at least one, that
+	 * means another client has called accept() and is waiting to
+	 * establish the next connection. That means the client may be
+	 * be free to become inactive; otherwise it may need to start
+	 * listening for connections itself to prevent the interface
+	 * going dead.
+	 */
+	isc_refcount_increment0(&client->interface->ntcpaccepting, NULL);
 }

 static void
@@ -3366,15 +3678,17 @@ ns_client_replace(ns_client_t *client) {
 	REQUIRE(client->manager != NULL);

 	tcp = TCP_CLIENT(client);
-	if (tcp && client->pipelined) {
+	if (tcp && client->tcpconn != NULL && client->tcpconn->pipelined) {
 		result = get_worker(client->manager, client->interface,
-				    client->tcpsocket);
+				    client->tcpsocket, client);
 	} else {
 		result = get_client(client->manager, client->interface,
 				    client->dispatch, tcp);
+
 	}
-	if (result != ISC_R_SUCCESS)
+	if (result != ISC_R_SUCCESS) {
 		return (result);
+	}

 	/*
 	 * The responsibility for listening for new requests is hereby
@@ -3560,9 +3874,12 @@ get_client(ns_clientmgr_t *manager, ns_interface_t *ifp,
 	client->dscp = ifp->dscp;

 	if (tcp) {
+		mark_tcp_active(client, true);
+
 		client->attributes |= NS_CLIENTATTR_TCP;
 		isc_socket_attach(ifp->tcpsocket,
 				  &client->tcplistener);
+
 	} else {
 		isc_socket_t *sock;

@@ -3580,7 +3897,8 @@ get_client(ns_clientmgr_t *manager, ns_interface_t *ifp,
 }

 static isc_result_t
-get_worker(ns_clientmgr_t *manager, ns_interface_t *ifp, isc_socket_t *sock)
+get_worker(ns_clientmgr_t *manager, ns_interface_t *ifp, isc_socket_t *sock,
+	   ns_client_t *oldclient)
 {
 	isc_result_t result = ISC_R_SUCCESS;
 	isc_event_t *ev;
@@ -3588,6 +3906,7 @@ get_worker(ns_clientmgr_t *manager, ns_interface_t *ifp, isc_socket_t *sock)
 	MTRACE("get worker");

 	REQUIRE(manager != NULL);
+	REQUIRE(oldclient != NULL);

 	if (manager->exiting)
 		return (ISC_R_SHUTTINGDOWN);
@@ -3620,14 +3939,15 @@ get_worker(ns_clientmgr_t *manager, ns_interface_t *ifp, isc_socket_t *sock)
 	ns_interface_attach(ifp, &client->interface);
 	client->newstate = client->state = NS_CLIENTSTATE_WORKING;
 	INSIST(client->recursionquota == NULL);
-	client->tcpquota = &ns_g_server->tcpquota;

 	client->dscp = ifp->dscp;

 	client->attributes |= NS_CLIENTATTR_TCP;
-	client->pipelined = true;
 	client->mortal = true;

+	tcpconn_attach(oldclient, client);
+	mark_tcp_active(client, true);
+
 	isc_socket_attach(ifp->tcpsocket, &client->tcplistener);
 	isc_socket_attach(sock, &client->tcpsocket);
 	isc_socket_setname(client->tcpsocket, "worker-tcp", NULL);
@@ -70,6 +70,11 @@ options {\n\
 #ifndef WIN32
 "	files unlimited;\n"
 #endif
+#if defined(HAVE_GEOIP2) && !defined(WIN32)
+"	geoip-directory \"" MAXMINDDB_PREFIX "/share/GeoIP2\";\n"
+#elif defined(HAVE_GEOIP2)
+"	geoip-directory \".\";\n"
+#endif
 "\
 #	has-old-clients <obsolete>;\n\
 	heartbeat-interval 60;\n\
@@ -167,7 +172,7 @@ options {\n\
 	filter-aaaa-on-v6 no;\n\
 	filter-aaaa { any; };\n"
 #endif
-#ifdef HAVE_GEOIP
+#if defined(HAVE_GEOIP) || defined(HAVE_GEOIP2)
 "	geoip-use-ecs yes;\n"
 #endif
 "	lame-ttl 600;\n"
@@ -423,18 +428,20 @@ ns_config_getzonetype(const cfg_obj_t *zonetypeobj) {
 	const char *str;

 	str = cfg_obj_asstring(zonetypeobj);
-	if (strcasecmp(str, "master") == 0)
+	if (strcasecmp(str, "master") == 0) {
 		ztype = dns_zone_master;
-	else if (strcasecmp(str, "slave") == 0)
+	} else if (strcasecmp(str, "slave") == 0) {
 		ztype = dns_zone_slave;
-	else if (strcasecmp(str, "stub") == 0)
+	} else if (strcasecmp(str, "stub") == 0) {
 		ztype = dns_zone_stub;
-	else if (strcasecmp(str, "static-stub") == 0)
+	} else if (strcasecmp(str, "static-stub") == 0) {
 		ztype = dns_zone_staticstub;
-	else if (strcasecmp(str, "redirect") == 0)
+	} else if (strcasecmp(str, "redirect") == 0) {
 		ztype = dns_zone_redirect;
-	else
+	} else {
 		INSIST(0);
+		ISC_UNREACHABLE();
+	}
 	return (ztype);
 }

@@ -857,6 +864,7 @@ ns_config_getipandkeylist(const cfg_obj_t *config, const cfg_obj_t *list,
 		isc_mem_put(mctx, stack, stackcount * sizeof(*stack));

 	INSIST(keycount == addrcount);
+	INSIST(keycount == dscpcount);

 	ipkl->addrs = addrs;
 	ipkl->dscps = dscps;
@@ -1008,6 +1016,7 @@ ns_config_getkeyalgorithm2(const char *str, dns_name_t **name,
 		case hmacsha512: *name = dns_tsig_hmacsha512_name; break;
 		default:
 			INSIST(0);
+			ISC_UNREACHABLE();
 		}
 	}
 	if (typep != NULL)
@@ -116,7 +116,8 @@ ns_control_docommand(isccc_sexpr_t *message, bool readonly,
 	/*
 	 * Compare the 'command' parameter against all known control commands.
 	 */
-	if (command_compare(command, NS_COMMAND_NULL) ||
+	if ((command_compare(command, NS_COMMAND_NULL) &&
+	     strlen(cmdline) == 4) ||
 	    command_compare(command, NS_COMMAND_STATUS))
 	{
 		log_level = ISC_LOG_DEBUG(1);
@@ -150,16 +151,11 @@ ns_control_docommand(isccc_sexpr_t *message, bool readonly,
 		      "received control channel command '%s'",
 		      cmdline);

-	if (command_compare(command, NS_COMMAND_RELOAD)) {
-		result = ns_server_reloadcommand(ns_g_server, lex, text);
-	} else if (command_compare(command, NS_COMMAND_RECONFIG)) {
-		result = ns_server_reconfigcommand(ns_g_server);
-	} else if (command_compare(command, NS_COMMAND_REFRESH)) {
-		result = ns_server_refreshcommand(ns_g_server, lex, text);
-	} else if (command_compare(command, NS_COMMAND_RETRANSFER)) {
-		result = ns_server_retransfercommand(ns_g_server,
-						     lex, text);
-	} else if (command_compare(command, NS_COMMAND_HALT)) {
+	/*
+	 * After the lengthy "halt" and "stop", the commands are
+	 * handled in alphabetical order of the NS_COMMAND_ macros.
+	 */
+	if (command_compare(command, NS_COMMAND_HALT)) {
 #ifdef HAVE_LIBSCF
 		/*
 		 * If we are managed by smf(5), AND in chroot, then
@@ -204,79 +200,88 @@ ns_control_docommand(isccc_sexpr_t *message, bool readonly,
 		ns_os_shutdownmsg(cmdline, *text);
 		isc_app_shutdown();
 		result = ISC_R_SUCCESS;
-	} else if (command_compare(command, NS_COMMAND_DUMPSTATS)) {
-		result = ns_server_dumpstats(ns_g_server);
-	} else if (command_compare(command, NS_COMMAND_QUERYLOG)) {
-		result = ns_server_togglequerylog(ns_g_server, lex);
+	} else if (command_compare(command, NS_COMMAND_ADDZONE) ||
+		   command_compare(command, NS_COMMAND_MODZONE)) {
+		result = ns_server_changezone(ns_g_server, cmdline, text);
+	} else if (command_compare(command, NS_COMMAND_DELZONE)) {
+		result = ns_server_delzone(ns_g_server, lex, text);
+	} else if (command_compare(command, NS_COMMAND_DNSTAP) ||
+		   command_compare(command, NS_COMMAND_DNSTAPREOPEN)) {
+		result = ns_server_dnstap(ns_g_server, lex, text);
 	} else if (command_compare(command, NS_COMMAND_DUMPDB)) {
 		ns_server_dumpdb(ns_g_server, lex, text);
 		result = ISC_R_SUCCESS;
-	} else if (command_compare(command, NS_COMMAND_SECROOTS)) {
-		result = ns_server_dumpsecroots(ns_g_server, lex, text);
-	} else if (command_compare(command, NS_COMMAND_TRACE)) {
-		result = ns_server_setdebuglevel(ns_g_server, lex);
-	} else if (command_compare(command, NS_COMMAND_NOTRACE)) {
-		ns_g_debuglevel = 0;
-		isc_log_setdebuglevel(ns_g_lctx, ns_g_debuglevel);
-		result = ISC_R_SUCCESS;
+	} else if (command_compare(command, NS_COMMAND_DUMPSTATS)) {
+		result = ns_server_dumpstats(ns_g_server);
 	} else if (command_compare(command, NS_COMMAND_FLUSH)) {
 		result = ns_server_flushcache(ns_g_server, lex);
 	} else if (command_compare(command, NS_COMMAND_FLUSHNAME)) {
 		result = ns_server_flushnode(ns_g_server, lex, false);
 	} else if (command_compare(command, NS_COMMAND_FLUSHTREE)) {
 		result = ns_server_flushnode(ns_g_server, lex, true);
-	} else if (command_compare(command, NS_COMMAND_STATUS)) {
-		result = ns_server_status(ns_g_server, text);
-	} else if (command_compare(command, NS_COMMAND_TSIGLIST)) {
-		result = ns_server_tsiglist(ns_g_server, text);
-	} else if (command_compare(command, NS_COMMAND_TSIGDELETE)) {
-		result = ns_server_tsigdelete(ns_g_server, lex, text);
 	} else if (command_compare(command, NS_COMMAND_FREEZE)) {
 		result = ns_server_freeze(ns_g_server, true, lex,
 					  text);
-	} else if (command_compare(command, NS_COMMAND_UNFREEZE) ||
-		   command_compare(command, NS_COMMAND_THAW)) {
-		result = ns_server_freeze(ns_g_server, false, lex,
-					  text);
+	} else if (command_compare(command, NS_COMMAND_LOADKEYS) ||
+		   command_compare(command, NS_COMMAND_SIGN)) {
+		result = ns_server_rekey(ns_g_server, lex, text);
+	} else if (command_compare(command, NS_COMMAND_MKEYS)) {
+		result = ns_server_mkeys(ns_g_server, lex, text);
+	} else if (command_compare(command, NS_COMMAND_NOTIFY)) {
+		result = ns_server_notifycommand(ns_g_server, lex, text);
+	} else if (command_compare(command, NS_COMMAND_NOTRACE)) {
+		ns_g_debuglevel = 0;
+		isc_log_setdebuglevel(ns_g_lctx, ns_g_debuglevel);
+		result = ISC_R_SUCCESS;
+	} else if (command_compare(command, NS_COMMAND_NTA)) {
+		result = ns_server_nta(ns_g_server, lex, readonly, text);
+	} else if (command_compare(command, NS_COMMAND_NULL)) {
+		result = ISC_R_SUCCESS;
+	} else if (command_compare(command, NS_COMMAND_QUERYLOG)) {
+		result = ns_server_togglequerylog(ns_g_server, lex);
+	} else if (command_compare(command, NS_COMMAND_RECONFIG)) {
+		result = ns_server_reconfigcommand(ns_g_server);
+	} else if (command_compare(command, NS_COMMAND_RECURSING)) {
+		result = ns_server_dumprecursing(ns_g_server);
+	} else if (command_compare(command, NS_COMMAND_REFRESH)) {
+		result = ns_server_refreshcommand(ns_g_server, lex, text);
+	} else if (command_compare(command, NS_COMMAND_RELOAD)) {
+		result = ns_server_reloadcommand(ns_g_server, lex, text);
+	} else if (command_compare(command, NS_COMMAND_RETRANSFER)) {
+		result = ns_server_retransfercommand(ns_g_server,
+						     lex, text);
 	} else if (command_compare(command, NS_COMMAND_SCAN)) {
 		result = ISC_R_SUCCESS;
 		ns_server_scan_interfaces(ns_g_server);
+	} else if (command_compare(command, NS_COMMAND_SECROOTS)) {
+		result = ns_server_dumpsecroots(ns_g_server, lex, text);
+	} else if (command_compare(command, NS_COMMAND_SIGNING)) {
+		result = ns_server_signing(ns_g_server, lex, text);
+	} else if (command_compare(command, NS_COMMAND_SHOWZONE)) {
+		result = ns_server_showzone(ns_g_server, lex, text);
+	} else if (command_compare(command, NS_COMMAND_STATUS)) {
+		result = ns_server_status(ns_g_server, text);
 	} else if (command_compare(command, NS_COMMAND_SYNC)) {
 		result = ns_server_sync(ns_g_server, lex, text);
-	} else if (command_compare(command, NS_COMMAND_RECURSING)) {
-		result = ns_server_dumprecursing(ns_g_server);
+	} else if (command_compare(command, NS_COMMAND_THAW) ||
+		   command_compare(command, NS_COMMAND_UNFREEZE)) {
+		result = ns_server_freeze(ns_g_server, false, lex,
+					  text);
+	} else if (command_compare(command, NS_COMMAND_TESTGEN)) {
+		result = ns_server_testgen(lex, text);
 	} else if (command_compare(command, NS_COMMAND_TIMERPOKE)) {
 		result = ISC_R_SUCCESS;
 		isc_timermgr_poke(ns_g_timermgr);
-	} else if (command_compare(command, NS_COMMAND_NULL)) {
-		result = ISC_R_SUCCESS;
-	} else if (command_compare(command, NS_COMMAND_NOTIFY)) {
-		result = ns_server_notifycommand(ns_g_server, lex, text);
+	} else if (command_compare(command, NS_COMMAND_TRACE)) {
+		result = ns_server_setdebuglevel(ns_g_server, lex);
+	} else if (command_compare(command, NS_COMMAND_TSIGDELETE)) {
+		result = ns_server_tsigdelete(ns_g_server, lex, text);
+	} else if (command_compare(command, NS_COMMAND_TSIGLIST)) {
+		result = ns_server_tsiglist(ns_g_server, text);
 	} else if (command_compare(command, NS_COMMAND_VALIDATION)) {
 		result = ns_server_validation(ns_g_server, lex, text);
-	} else if (command_compare(command, NS_COMMAND_SIGN) ||
-		   command_compare(command, NS_COMMAND_LOADKEYS)) {
-		result = ns_server_rekey(ns_g_server, lex, text);
-	} else if (command_compare(command, NS_COMMAND_ADDZONE) ||
-		   command_compare(command, NS_COMMAND_MODZONE)) {
-		result = ns_server_changezone(ns_g_server, cmdline, text);
-	} else if (command_compare(command, NS_COMMAND_DELZONE)) {
-		result = ns_server_delzone(ns_g_server, lex, text);
-	} else if (command_compare(command, NS_COMMAND_SHOWZONE)) {
-		result = ns_server_showzone(ns_g_server, lex, text);
-	} else if (command_compare(command, NS_COMMAND_SIGNING)) {
-		result = ns_server_signing(ns_g_server, lex, text);
 	} else if (command_compare(command, NS_COMMAND_ZONESTATUS)) {
 		result = ns_server_zonestatus(ns_g_server, lex, text);
-	} else if (command_compare(command, NS_COMMAND_NTA)) {
-		result = ns_server_nta(ns_g_server, lex, readonly, text);
-	} else if (command_compare(command, NS_COMMAND_TESTGEN)) {
-		result = ns_server_testgen(lex, text);
-	} else if (command_compare(command, NS_COMMAND_MKEYS)) {
-		result = ns_server_mkeys(ns_g_server, lex, text);
-	} else if (command_compare(command, NS_COMMAND_DNSTAP) ||
-		   command_compare(command, NS_COMMAND_DNSTAPREOPEN)) {
-		result = ns_server_dnstap(ns_g_server, lex, text);
 	} else {
 		isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
 			      NS_LOGMODULE_CONTROL, ISC_LOG_WARNING,
@@ -19,7 +19,7 @@
 #ifdef ENABLE_AFL
 #include <named/globals.h>
 #include <named/server.h>
-#include <sys/errno.h>
+#include <errno.h>

 #include <isc/app.h>
 #include <isc/condition.h>
@@ -13,20 +13,27 @@

 #include <config.h>

+#if defined(HAVE_GEOIP2)
+#include <maxminddb.h>
+#elif defined(HAVE_GEOIP)
+#include <GeoIP.h>
+#include <GeoIPCity.h>
+#endif
+
+#include <isc/print.h>
+#include <isc/string.h>
 #include <isc/util.h>

+#include <dns/geoip.h>
+
 #include <named/log.h>
 #include <named/geoip.h>

-#include <dns/geoip.h>
-
-#ifdef HAVE_GEOIP
-static dns_geoip_databases_t geoip_table = {
-	NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL
-};
+static dns_geoip_databases_t geoip_table;

+#if defined(HAVE_GEOIP)
 static void
-init_geoip_db(GeoIP **dbp, GeoIPDBTypes edition, GeoIPDBTypes fallback,
+init_geoip_db(void **dbp, GeoIPDBTypes edition, GeoIPDBTypes fallback,
 	      GeoIPOptions method, const char *name)
 {
 	char *info;
@@ -34,7 +41,7 @@ init_geoip_db(GeoIP **dbp, GeoIPDBTypes edition, GeoIPDBTypes fallback,

 	REQUIRE(dbp != NULL);

-	db = *dbp;
+	db = (GeoIP *)*dbp;

 	if (db != NULL) {
 		GeoIP_delete(db);
@@ -72,32 +79,96 @@ init_geoip_db(GeoIP **dbp, GeoIPDBTypes edition, GeoIPDBTypes fallback,

 	*dbp = db;
 	return;
+
 fail:
-	if (fallback != 0)
+	if (fallback != 0) {
 		init_geoip_db(dbp, fallback, 0, method, name);
+	}

 }
-#endif /* HAVE_GEOIP */
+#elif defined(HAVE_GEOIP2)
+static MMDB_s geoip_country, geoip_city, geoip_as, geoip_isp, geoip_domain;
+
+static MMDB_s *
+open_geoip2(const char *dir, const char *dbfile, MMDB_s *mmdb) {
+	char pathbuf[PATH_MAX];
+	unsigned int n;
+	int ret;
+
+	n = snprintf(pathbuf, sizeof(pathbuf), "%s/%s", dir, dbfile);
+	if (n >= sizeof(pathbuf)) {
+		isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
+			      NS_LOGMODULE_SERVER, ISC_LOG_ERROR,
+			      "GeoIP2 database '%s/%s': path too long",
+			      dir, dbfile);
+		return (NULL);
+	}
+
+	ret = MMDB_open(pathbuf, MMDB_MODE_MMAP, mmdb);
+	if (ret == MMDB_SUCCESS) {
+		isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
+			      NS_LOGMODULE_SERVER, ISC_LOG_INFO,
+			      "opened GeoIP2 database '%s'", pathbuf);
+		return (mmdb);
+	}
+
+	isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
+		      NS_LOGMODULE_SERVER, ISC_LOG_DEBUG(1),
+		      "unable to open GeoIP2 database '%s' (status %d)",
+		      pathbuf, ret);
+
+	return (NULL);
+}
+#endif /* HAVE_GEOIP2 */
+

 void
 ns_geoip_init(void) {
-#ifndef HAVE_GEOIP
-	return;
-#else
-	GeoIP_cleanup();
-	if (ns_g_geoip == NULL)
+#if defined(HAVE_GEOIP) || defined(HAVE_GEOIP2)
+	if (ns_g_geoip == NULL) {
 		ns_g_geoip = &geoip_table;
+	}
+#if defined(HAVE_GEOIP)
+	GeoIP_cleanup();
+#endif
+#else
+	return;
 #endif
 }

 void
 ns_geoip_load(char *dir) {
-#ifndef HAVE_GEOIP
+#if defined(HAVE_GEOIP2)
+	REQUIRE(dir != NULL);

-	UNUSED(dir);
+	isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
+		      NS_LOGMODULE_SERVER, ISC_LOG_INFO,
+		      "looking for GeoIP2 databases in '%s'", dir);

-	return;
-#else
+	ns_g_geoip->country = open_geoip2(dir, "GeoIP2-Country.mmdb",
+					  &geoip_country);
+	if (ns_g_geoip->country == NULL) {
+		ns_g_geoip->country = open_geoip2(dir,
+						  "GeoLite2-Country.mmdb",
+						  &geoip_country);
+	}
+
+	ns_g_geoip->city = open_geoip2(dir, "GeoIP2-City.mmdb", &geoip_city);
+	if (ns_g_geoip->city == NULL) {
+		ns_g_geoip->city = open_geoip2(dir, "GeoLite2-City.mmdb",
+					       &geoip_city);
+	}
+
+	ns_g_geoip->as = open_geoip2(dir, "GeoIP2-ASN.mmdb", &geoip_as);
+	if (ns_g_geoip->as == NULL) {
+		ns_g_geoip->as = open_geoip2(dir, "GeoLite2-ASN.mmdb",
+					     &geoip_as);
+	}
+
+	ns_g_geoip->isp = open_geoip2(dir, "GeoIP2-ISP.mmdb", &geoip_isp);
+	ns_g_geoip->domain = open_geoip2(dir, "GeoIP2-Domain.mmdb",
+					 &geoip_domain);
+#elif defined(HAVE_GEOIP)
 	GeoIPOptions method;

 #ifdef _WIN32
@@ -141,5 +212,37 @@ ns_geoip_load(char *dir) {
 		      method, "Domain");
 	init_geoip_db(&ns_g_geoip->netspeed, GEOIP_NETSPEED_EDITION, 0,
 		      method, "NetSpeed");
-#endif /* HAVE_GEOIP */
+#else
+	UNUSED(dir);
+
+	return;
+#endif
+}
+
+void
+ns_geoip_shutdown(void) {
+#ifdef HAVE_GEOIP2
+	if (ns_g_geoip->country != NULL) {
+		MMDB_close(ns_g_geoip->country);
+		ns_g_geoip->country = NULL;
+	}
+	if (ns_g_geoip->city != NULL) {
+		MMDB_close(ns_g_geoip->city);
+		ns_g_geoip->city = NULL;
+	}
+	if (ns_g_geoip->as != NULL) {
+		MMDB_close(ns_g_geoip->as);
+		ns_g_geoip->as = NULL;
+	}
+	if (ns_g_geoip->isp != NULL) {
+		MMDB_close(ns_g_geoip->isp);
+		ns_g_geoip->isp = NULL;
+	}
+	if (ns_g_geoip->domain != NULL) {
+		MMDB_close(ns_g_geoip->domain);
+		ns_g_geoip->domain = NULL;
+	}
+#endif /* HAVE_GEOIP2 */
+
+	dns_geoip_shutdown();
 }
@@ -9,8 +9,6 @@
 * information regarding copyright ownership.
 */

-/* $Id: client.h,v 1.96 2012/01/31 23:47:31 tbox Exp $ */
-
 #ifndef NAMED_CLIENT_H
 #define NAMED_CLIENT_H 1

@@ -80,6 +78,13 @@
 *** Types
 ***/

+/*% reference-counted TCP connection object */
+typedef struct ns_tcpconn {
+	isc_refcount_t		refs;
+	isc_quota_t		*tcpquota;
+	bool			pipelined;
+} ns_tcpconn_t;
+
 /*% nameserver client structure */
 struct ns_client {
 	unsigned int		magic;
@@ -94,7 +99,8 @@ struct ns_client {
 	int			nupdates;
 	int			nctls;
 	int			references;
-	bool		needshutdown; 	/*
+	bool			tcpactive;
+	bool			needshutdown; 	/*
 						 * Used by clienttest to get
 						 * the client to go from
 						 * inactive to free state
@@ -130,10 +136,9 @@ struct ns_client {
 	isc_stdtime_t		now;
 	isc_time_t		tnow;
 	dns_name_t		signername;   /*%< [T]SIG key name */
-	dns_name_t *		signer;	      /*%< NULL if not valid sig */
-	bool		mortal;	      /*%< Die after handling request */
-	bool		pipelined;   /*%< TCP queries not in sequence */
-	isc_quota_t		*tcpquota;
+	dns_name_t		*signer;      /*%< NULL if not valid sig */
+	bool			mortal;	      /*%< Die after handling request */
+	ns_tcpconn_t		*tcpconn;
 	isc_quota_t		*recursionquota;
 	ns_interface_t		*interface;

@@ -143,8 +148,8 @@ struct ns_client {
 	isc_sockaddr_t		destsockaddr;

 	isc_netaddr_t		ecs_addr;	/*%< EDNS client subnet */
-	uint8_t		ecs_addrlen;
-	uint8_t		ecs_scope;
+	uint8_t			ecs_addrlen;
+	uint8_t			ecs_scope;

 	struct in6_pktinfo	pktinfo;
 	isc_dscp_t		dscp;
@@ -12,15 +12,14 @@
 #ifndef _GEOIP_H
 #define _GEOIP_H

-#ifdef HAVE_GEOIP
-#include <GeoIP.h>
-#include <GeoIPCity.h>
-#endif /* HAVE_GEOIP */
-
-void ns_geoip_init(void);
-void ns_geoip_load(char *dir);
-
-#ifdef HAVE_GEOIP
 extern dns_geoip_databases_t *ns_g_geoip;
-#endif /* HAVE_GEOIP */
+
+void
+ns_geoip_init(void);
+
+void
+ns_geoip_load(char *dir);
+
+void
+ns_geoip_shutdown(void);
 #endif
@@ -77,7 +77,7 @@ EXTERN in_port_t		lwresd_g_listenport	INIT(0);

 EXTERN ns_server_t *		ns_g_server		INIT(NULL);

-EXTERN bool		ns_g_lwresdonly		INIT(false);
+EXTERN bool			ns_g_lwresdonly		INIT(false);

 /*
 * Logging.
@@ -105,9 +105,9 @@ EXTERN const char *		lwresd_g_conffile	INIT(NS_SYSCONFDIR
 							     "/lwresd.conf");
 EXTERN const char *		lwresd_g_resolvconffile	INIT("/etc"
 							     "/resolv.conf");
-EXTERN bool		ns_g_conffileset	INIT(false);
-EXTERN bool		lwresd_g_useresolvconf	INIT(false);
-EXTERN uint16_t		ns_g_udpsize		INIT(4096);
+EXTERN bool			ns_g_conffileset	INIT(false);
+EXTERN bool			lwresd_g_useresolvconf	INIT(false);
+EXTERN uint16_t			ns_g_udpsize		INIT(4096);
 EXTERN cfg_aclconfctx_t *	ns_g_aclconfctx		INIT(NULL);

 /*
@@ -121,11 +121,11 @@ EXTERN isc_resourcevalue_t	ns_g_initopenfiles	INIT(0);
 /*
 * Misc.
 */
-EXTERN bool		ns_g_coreok		INIT(true);
+EXTERN bool			ns_g_coreok		INIT(true);
 EXTERN const char *		ns_g_chrootdir		INIT(NULL);
-EXTERN bool		ns_g_foreground		INIT(false);
-EXTERN bool		ns_g_logstderr		INIT(false);
-EXTERN bool		ns_g_nosyslog		INIT(false);
+EXTERN bool			ns_g_foreground		INIT(false);
+EXTERN bool			ns_g_logstderr		INIT(false);
+EXTERN bool			ns_g_nosyslog		INIT(false);
 EXTERN const char *		ns_g_logfile		INIT(NULL);

 EXTERN const char *		ns_g_defaultsessionkeyfile
@@ -134,7 +134,7 @@ EXTERN const char *		ns_g_defaultsessionkeyfile
 EXTERN const char *		ns_g_defaultlockfile	INIT(NS_LOCALSTATEDIR
 							     "/run/named/"
 							     "named.lock");
-EXTERN bool		ns_g_forcelock		INIT(false);
+EXTERN bool			ns_g_forcelock		INIT(false);

 #if NS_RUN_PID_DIR
 EXTERN const char *		ns_g_defaultpidfile 	INIT(NS_LOCALSTATEDIR
@@ -169,23 +169,26 @@ EXTERN const char *		ns_g_engine		INIT(NULL);
 EXTERN int			ns_g_listen		INIT(3);
 EXTERN isc_time_t		ns_g_boottime;
 EXTERN isc_time_t		ns_g_configtime;
-EXTERN bool		ns_g_memstatistics	INIT(false);
-EXTERN bool		ns_g_clienttest		INIT(false);
-EXTERN bool		ns_g_dropedns		INIT(false);
-EXTERN bool		ns_g_noedns		INIT(false);
-EXTERN bool		ns_g_nosoa		INIT(false);
-EXTERN bool		ns_g_noaa		INIT(false);
-EXTERN bool		ns_g_keepstderr		INIT(false);
+EXTERN bool			ns_g_memstatistics	INIT(false);
+EXTERN bool			ns_g_clienttest		INIT(false);
+EXTERN bool			ns_g_dropedns		INIT(false);
+EXTERN bool			ns_g_ednsformerr	INIT(false);
+EXTERN bool			ns_g_ednsnotimp		INIT(false);
+EXTERN bool			ns_g_ednsrefused	INIT(false);
+EXTERN bool			ns_g_noedns		INIT(false);
+EXTERN bool			ns_g_nosoa		INIT(false);
+EXTERN bool			ns_g_noaa		INIT(false);
+EXTERN bool			ns_g_keepstderr		INIT(false);
 EXTERN unsigned int		ns_g_delay		INIT(0);
-EXTERN bool		ns_g_nonearest		INIT(false);
-EXTERN bool		ns_g_notcp		INIT(false);
-EXTERN bool		ns_g_disable6		INIT(false);
-EXTERN bool		ns_g_disable4		INIT(false);
+EXTERN bool			ns_g_nonearest		INIT(false);
+EXTERN bool			ns_g_notcp		INIT(false);
+EXTERN bool			ns_g_disable6		INIT(false);
+EXTERN bool			ns_g_disable4		INIT(false);
 EXTERN unsigned int		ns_g_tat_interval	INIT(24*3600);
-EXTERN bool		ns_g_fixedlocal		INIT(false);
-EXTERN bool		ns_g_sigvalinsecs	INIT(false);
+EXTERN bool			ns_g_fixedlocal		INIT(false);
+EXTERN bool			ns_g_sigvalinsecs	INIT(false);

-#ifdef HAVE_GEOIP
+#if defined(HAVE_GEOIP) || defined(HAVE_GEOIP2)
 EXTERN dns_geoip_databases_t	*ns_g_geoip		INIT(NULL);
 #endif

@@ -9,8 +9,6 @@
 * information regarding copyright ownership.
 */

-/* $Id: interfacemgr.h,v 1.35 2011/07/28 23:47:58 tbox Exp $ */
-
 #ifndef NAMED_INTERFACEMGR_H
 #define NAMED_INTERFACEMGR_H 1

@@ -47,6 +45,7 @@
 #include <isc/magic.h>
 #include <isc/mem.h>
 #include <isc/socket.h>
+#include <isc/refcount.h>

 #include <dns/result.h>

@@ -77,9 +76,14 @@ struct ns_interface {
 						/*%< UDP dispatchers. */
 	isc_socket_t *		tcpsocket;	/*%< TCP socket. */
 	isc_dscp_t		dscp;		/*%< "listen-on" DSCP value */
-	int			ntcptarget;	/*%< Desired number of concurrent
-						     TCP accepts */
-	int			ntcpcurrent;	/*%< Current ditto, locked */
+	isc_refcount_t		ntcpaccepting;	/*%< Number of clients
+						     ready to accept new
+						     TCP connections on this
+						     interface */
+	isc_refcount_t		ntcpactive;	/*%< Number of clients
+						     servicing TCP queries
+						     (whether accepting or
+						     connected) */
 	int			nudpdispatch;	/*%< Number of UDP dispatches */
 	ns_clientmgr_t *	clientmgr;	/*%< Client manager. */
 	ISC_LINK(ns_interface_t) link;
@@ -43,7 +43,10 @@ typedef ISC_LIST(ns_altsecret_t)	ns_altsecretlist_t;
 typedef enum {
 	ns_cookiealg_aes,
 	ns_cookiealg_sha1,
-	ns_cookiealg_sha256
+	ns_cookiealg_sha256,
+	ns_cookiealg_siphash24
 } ns_cookiealg_t;

+#define NS_COOKIE_VERSION_1 1
+
 #endif /* NAMED_TYPES_H */
@@ -211,7 +211,7 @@ ns_interfacemgr_create(isc_mem_t *mctx, isc_taskmgr_t *taskmgr,
 	result = dns_aclenv_init(mctx, &mgr->aclenv);
 	if (result != ISC_R_SUCCESS)
 		goto cleanup_listenon;
-#ifdef HAVE_GEOIP
+#if defined(HAVE_GEOIP) || defined(HAVE_GEOIP2)
 	mgr->aclenv.geoip = ns_g_geoip;
 #endif

@@ -386,8 +386,9 @@ ns_interface_create(ns_interfacemgr_t *mgr, isc_sockaddr_t *addr,
 	 * connections will be handled in parallel even though there is
 	 * only one client initially.
 	 */
-	ifp->ntcptarget = 1;
-	ifp->ntcpcurrent = 0;
+	isc_refcount_init(&ifp->ntcpaccepting, 0);
+	isc_refcount_init(&ifp->ntcpactive, 0);
+
 	ifp->nudpdispatch = 0;

 	ifp->dscp = -1;
@@ -522,9 +523,7 @@ ns_interface_accepttcp(ns_interface_t *ifp) {
 	 */
 	(void)isc_socket_filter(ifp->tcpsocket, "dataready");

-	result = ns_clientmgr_createclients(ifp->clientmgr,
-					    ifp->ntcptarget, ifp,
-					    true);
+	result = ns_clientmgr_createclients(ifp->clientmgr, 1, ifp, true);
 	if (result != ISC_R_SUCCESS) {
 		UNEXPECTED_ERROR(__FILE__, __LINE__,
 				 "TCP ns_clientmgr_createclients(): %s",
@@ -619,6 +618,9 @@ ns_interface_destroy(ns_interface_t *ifp) {

 	ns_interfacemgr_detach(&ifp->mgr);

+	isc_refcount_destroy(&ifp->ntcpactive);
+	isc_refcount_destroy(&ifp->ntcpaccepting);
+
 	ifp->magic = 0;
 	isc_mem_put(mctx, ifp, sizeof(*ifp));
 }
@@ -157,6 +157,7 @@ channel_fromconf(const cfg_obj_t *channel, isc_logconfig_t *logconfig)
 			break;
 		default:
 			INSIST(0);
+			ISC_UNREACHABLE();
 		}

 		type = ISC_LOG_TOFILE;
@@ -356,7 +356,7 @@ save_command_line(int argc, char *argv[]) {
 			 * nearly always be fine.
 			 */
 			if (quoted || isalnum(*src & 0xff) ||
-			    *src == '-' || *src == '_' ||
+			    *src == ',' || *src == '-' || *src == '_' ||
 			    *src == '.' || *src == '/') {
 				*dst++ = *src++;
 				quoted = false;
@@ -479,6 +479,12 @@ parse_T_opt(char *option) {
 		ns_g_dropedns = true;
 	} else if (!strncmp(option, "dscp=", 5)) {
 		isc_dscp_check_value = atoi(option + 5);
+	} else if (!strcmp(option, "ednsformerr")) {
+		ns_g_ednsformerr = true;
+	} else if (!strcmp(option, "ednsnotimp")) {
+		ns_g_ednsnotimp = true;
+	} else if (!strcmp(option, "ednsrefused")) {
+		ns_g_ednsrefused = true;
 	} else if (!strcmp(option, "fixedlocal")) {
 		ns_g_fixedlocal = true;
 	} else if (!strcmp(option, "keepstderr")) {
@@ -501,6 +507,9 @@ parse_T_opt(char *option) {
 		maxudp = 1460;
 	} else if (!strncmp(option, "maxudp=", 7)) {
 		maxudp = atoi(option + 7);
+		if (maxudp <= 0) {
+			ns_main_earlyfatal("bad maxudp");
+		}
 	} else if (!strncmp(option, "mkeytimers=", 11)) {
 		p = strtok(option + 11, "/");
 		if (p == NULL) {
@@ -538,7 +547,7 @@ parse_T_opt(char *option) {
 	} else if (!strncmp(option, "tat=", 4)) {
 		ns_g_tat_interval = atoi(option + 4);
 	} else {
-		fprintf(stderr, "unknown -T flag '%s\n", option);
+		fprintf(stderr, "unknown -T flag '%s'\n", option);
 	}
 }

@@ -1423,9 +1432,6 @@ main(int argc, char *argv[]) {
 	if (strcmp(program_name, "lwresd") == 0)
 		ns_g_lwresdonly = true;

-	if (result != ISC_R_SUCCESS)
-		ns_main_earlyfatal("failed to build internal symbol table");
-
 	isc_assertion_setcallback(assertion_failed);
 	isc_error_setfatal(library_fatal_error);
 	isc_error_setunexpected(library_unexpected_error);
@@ -10,12 +10,12 @@
 .\"     Title: named.conf
 .\"    Author: 
 .\" Generator: DocBook XSL Stylesheets v1.78.1 <http://docbook.sf.net/>
-.\"      Date: 2018-06-21
+.\"      Date: 2019-07-22
 .\"    Manual: BIND9
 .\"    Source: ISC
 .\"  Language: English
 .\"
-.TH "NAMED\&.CONF" "5" "2018\-06\-21" "ISC" "BIND9"
+.TH "NAMED\&.CONF" "5" "2019\-07\-22" "ISC" "BIND9"
 .\" -----------------------------------------------------------------
 .\" * Define some portability stuff
 .\" -----------------------------------------------------------------
@@ -232,9 +232,9 @@ options {
 	bindkeys\-file \fIquoted_string\fR;
 	blackhole { \fIaddress_match_element\fR; \&.\&.\&. };
 	cache\-file \fIquoted_string\fR;
-	catalog\-zones { zone \fIquoted_string\fR [ default\-masters [ port
-	    \fIinteger\fR ] [ dscp \fIinteger\fR ] { ( \fImasters\fR | \fIipv4_address\fR [
-	    port \fIinteger\fR ] | \fIipv6_address\fR [ port \fIinteger\fR ] ) [ key
+	catalog\-zones { zone \fIstring\fR [ default\-masters [ port \fIinteger\fR ]
+	    [ dscp \fIinteger\fR ] { ( \fImasters\fR | \fIipv4_address\fR [ port
+	    \fIinteger\fR ] | \fIipv6_address\fR [ port \fIinteger\fR ] ) [ key
 	    \fIstring\fR ]; \&.\&.\&. } ] [ zone\-directory \fIquoted_string\fR ] [
 	    in\-memory \fIboolean\fR ] [ min\-update\-interval \fIinteger\fR ]; \&.\&.\&. };
 	check\-dup\-records ( fail | warn | ignore );
@@ -249,7 +249,7 @@ options {
 	check\-wildcard \fIboolean\fR;
 	cleaning\-interval \fIinteger\fR;
 	clients\-per\-query \fIinteger\fR;
-	cookie\-algorithm ( aes | sha1 | sha256 );
+	cookie\-algorithm ( aes | sha1 | sha256 | siphash24 );
 	cookie\-secret \fIstring\fR;
 	coresize ( default | unlimited | \fIsizeval\fR );
 	datasize ( default | unlimited | \fIsizeval\fR );
@@ -418,13 +418,13 @@ options {
 	require\-server\-cookie \fIboolean\fR;
 	reserved\-sockets \fIinteger\fR;
 	resolver\-query\-timeout \fIinteger\fR;
-	response\-policy { zone \fIquoted_string\fR [ log \fIboolean\fR ] [
-	    max\-policy\-ttl \fIinteger\fR ] [ policy ( cname | disabled | drop |
-	    given | no\-op | nodata | nxdomain | passthru | tcp\-only
-	    \fIquoted_string\fR ) ] [ recursive\-only \fIboolean\fR ]; \&.\&.\&. } [
-	    break\-dnssec \fIboolean\fR ] [ max\-policy\-ttl \fIinteger\fR ] [
-	    min\-ns\-dots \fIinteger\fR ] [ nsip\-wait\-recurse \fIboolean\fR ] [
-	    qname\-wait\-recurse \fIboolean\fR ] [ recursive\-only \fIboolean\fR ];
+	response\-policy { zone \fIstring\fR [ log \fIboolean\fR ] [ max\-policy\-ttl
+	    \fIinteger\fR ] [ policy ( cname | disabled | drop | given | no\-op
+	    | nodata | nxdomain | passthru | tcp\-only \fIquoted_string\fR ) ] [
+	    recursive\-only \fIboolean\fR ]; \&.\&.\&. } [ break\-dnssec \fIboolean\fR ] [
+	    max\-policy\-ttl \fIinteger\fR ] [ min\-ns\-dots \fIinteger\fR ] [
+	    nsip\-wait\-recurse \fIboolean\fR ] [ qname\-wait\-recurse \fIboolean\fR ]
+	    [ recursive\-only \fIboolean\fR ];
 	root\-delegation\-only [ exclude { \fIquoted_string\fR; \&.\&.\&. } ];
 	root\-key\-sentinel \fIboolean\fR;
 	rrset\-order { [ class \fIstring\fR ] [ type \fIstring\fR ] [ name
@@ -578,9 +578,9 @@ view \fIstring\fR [ \fIclass\fR ] {
 	auth\-nxdomain \fIboolean\fR; // default changed
 	auto\-dnssec ( allow | maintain | off );
 	cache\-file \fIquoted_string\fR;
-	catalog\-zones { zone \fIquoted_string\fR [ default\-masters [ port
-	    \fIinteger\fR ] [ dscp \fIinteger\fR ] { ( \fImasters\fR | \fIipv4_address\fR [
-	    port \fIinteger\fR ] | \fIipv6_address\fR [ port \fIinteger\fR ] ) [ key
+	catalog\-zones { zone \fIstring\fR [ default\-masters [ port \fIinteger\fR ]
+	    [ dscp \fIinteger\fR ] { ( \fImasters\fR | \fIipv4_address\fR [ port
+	    \fIinteger\fR ] | \fIipv6_address\fR [ port \fIinteger\fR ] ) [ key
 	    \fIstring\fR ]; \&.\&.\&. } ] [ zone\-directory \fIquoted_string\fR ] [
 	    in\-memory \fIboolean\fR ] [ min\-update\-interval \fIinteger\fR ]; \&.\&.\&. };
 	check\-dup\-records ( fail | warn | ignore );
@@ -734,13 +734,13 @@ view \fIstring\fR [ \fIclass\fR ] {
 	request\-nsid \fIboolean\fR;
 	require\-server\-cookie \fIboolean\fR;
 	resolver\-query\-timeout \fIinteger\fR;
-	response\-policy { zone \fIquoted_string\fR [ log \fIboolean\fR ] [
-	    max\-policy\-ttl \fIinteger\fR ] [ policy ( cname | disabled | drop |
-	    given | no\-op | nodata | nxdomain | passthru | tcp\-only
-	    \fIquoted_string\fR ) ] [ recursive\-only \fIboolean\fR ]; \&.\&.\&. } [
-	    break\-dnssec \fIboolean\fR ] [ max\-policy\-ttl \fIinteger\fR ] [
-	    min\-ns\-dots \fIinteger\fR ] [ nsip\-wait\-recurse \fIboolean\fR ] [
-	    qname\-wait\-recurse \fIboolean\fR ] [ recursive\-only \fIboolean\fR ];
+	response\-policy { zone \fIstring\fR [ log \fIboolean\fR ] [ max\-policy\-ttl
+	    \fIinteger\fR ] [ policy ( cname | disabled | drop | given | no\-op
+	    | nodata | nxdomain | passthru | tcp\-only \fIquoted_string\fR ) ] [
+	    recursive\-only \fIboolean\fR ]; \&.\&.\&. } [ break\-dnssec \fIboolean\fR ] [
+	    max\-policy\-ttl \fIinteger\fR ] [ min\-ns\-dots \fIinteger\fR ] [
+	    nsip\-wait\-recurse \fIboolean\fR ] [ qname\-wait\-recurse \fIboolean\fR ]
+	    [ recursive\-only \fIboolean\fR ];
 	root\-delegation\-only [ exclude { \fIquoted_string\fR; \&.\&.\&. } ];
 	root\-key\-sentinel \fIboolean\fR;
 	rrset\-order { [ class \fIstring\fR ] [ type \fIstring\fR ] [ name
@@ -875,8 +875,7 @@ view \fIstring\fR [ \fIclass\fR ] {
 		request\-expire \fIboolean\fR;
 		request\-ixfr \fIboolean\fR;
 		serial\-update\-method ( date | increment | unixtime );
-		server\-addresses { ( \fIipv4_address\fR | \fIipv6_address\fR ) [
-		    port \fIinteger\fR ]; \&.\&.\&. };
+		server\-addresses { ( \fIipv4_address\fR | \fIipv6_address\fR ); \&.\&.\&. };
 		server\-names { \fIquoted_string\fR; \&.\&.\&. };
 		sig\-signing\-nodes \fIinteger\fR;
 		sig\-signing\-signatures \fIinteger\fR;
@@ -980,8 +979,7 @@ zone \fIstring\fR [ \fIclass\fR ] {
 	request\-expire \fIboolean\fR;
 	request\-ixfr \fIboolean\fR;
 	serial\-update\-method ( date | increment | unixtime );
-	server\-addresses { ( \fIipv4_address\fR | \fIipv6_address\fR ) [ port
-	    \fIinteger\fR ]; \&.\&.\&. };
+	server\-addresses { ( \fIipv4_address\fR | \fIipv6_address\fR ); \&.\&.\&. };
 	server\-names { \fIquoted_string\fR; \&.\&.\&. };
 	sig\-signing\-nodes \fIinteger\fR;
 	sig\-signing\-signatures \fIinteger\fR;
@@ -13,7 +13,7 @@

 <refentry xmlns:db="http://docbook.org/ns/docbook" version="5.0" xml:id="man.named.conf">
  <info>
-    <date>2018-06-21</date>
+    <date>2019-07-22</date>
  </info>
  <refentryinfo>
    <corpname>ISC</corpname>
@@ -221,9 +221,9 @@ options {
 	bindkeys-file <replaceable>quoted_string</replaceable>;
 	blackhole { <replaceable>address_match_element</replaceable>; ... };
 	cache-file <replaceable>quoted_string</replaceable>;
-	catalog-zones { zone <replaceable>quoted_string</replaceable> [ default-masters [ port
-	    <replaceable>integer</replaceable> ] [ dscp <replaceable>integer</replaceable> ] { ( <replaceable>masters</replaceable> | <replaceable>ipv4_address</replaceable> [
-	    port <replaceable>integer</replaceable> ] | <replaceable>ipv6_address</replaceable> [ port <replaceable>integer</replaceable> ] ) [ key
+	catalog-zones { zone <replaceable>string</replaceable> [ default-masters [ port <replaceable>integer</replaceable> ]
+	    [ dscp <replaceable>integer</replaceable> ] { ( <replaceable>masters</replaceable> | <replaceable>ipv4_address</replaceable> [ port
+	    <replaceable>integer</replaceable> ] | <replaceable>ipv6_address</replaceable> [ port <replaceable>integer</replaceable> ] ) [ key
 	    <replaceable>string</replaceable> ]; ... } ] [ zone-directory <replaceable>quoted_string</replaceable> ] [
 	    in-memory <replaceable>boolean</replaceable> ] [ min-update-interval <replaceable>integer</replaceable> ]; ... };
 	check-dup-records ( fail | warn | ignore );
@@ -238,7 +238,7 @@ options {
 	check-wildcard <replaceable>boolean</replaceable>;
 	cleaning-interval <replaceable>integer</replaceable>;
 	clients-per-query <replaceable>integer</replaceable>;
-	cookie-algorithm ( aes | sha1 | sha256 );
+	cookie-algorithm ( aes | sha1 | sha256 | siphash24 );
 	cookie-secret <replaceable>string</replaceable>;
 	coresize ( default | unlimited | <replaceable>sizeval</replaceable> );
 	datasize ( default | unlimited | <replaceable>sizeval</replaceable> );
@@ -407,13 +407,13 @@ options {
 	require-server-cookie <replaceable>boolean</replaceable>;
 	reserved-sockets <replaceable>integer</replaceable>;
 	resolver-query-timeout <replaceable>integer</replaceable>;
-	response-policy { zone <replaceable>quoted_string</replaceable> [ log <replaceable>boolean</replaceable> ] [
-	    max-policy-ttl <replaceable>integer</replaceable> ] [ policy ( cname | disabled | drop |
-	    given | no-op | nodata | nxdomain | passthru | tcp-only
-	    <replaceable>quoted_string</replaceable> ) ] [ recursive-only <replaceable>boolean</replaceable> ]; ... } [
-	    break-dnssec <replaceable>boolean</replaceable> ] [ max-policy-ttl <replaceable>integer</replaceable> ] [
-	    min-ns-dots <replaceable>integer</replaceable> ] [ nsip-wait-recurse <replaceable>boolean</replaceable> ] [
-	    qname-wait-recurse <replaceable>boolean</replaceable> ] [ recursive-only <replaceable>boolean</replaceable> ];
+	response-policy { zone <replaceable>string</replaceable> [ log <replaceable>boolean</replaceable> ] [ max-policy-ttl
+	    <replaceable>integer</replaceable> ] [ policy ( cname | disabled | drop | given | no-op
+	    | nodata | nxdomain | passthru | tcp-only <replaceable>quoted_string</replaceable> ) ] [
+	    recursive-only <replaceable>boolean</replaceable> ]; ... } [ break-dnssec <replaceable>boolean</replaceable> ] [
+	    max-policy-ttl <replaceable>integer</replaceable> ] [ min-ns-dots <replaceable>integer</replaceable> ] [
+	    nsip-wait-recurse <replaceable>boolean</replaceable> ] [ qname-wait-recurse <replaceable>boolean</replaceable> ]
+	    [ recursive-only <replaceable>boolean</replaceable> ];
 	root-delegation-only [ exclude { <replaceable>quoted_string</replaceable>; ... } ];
 	root-key-sentinel <replaceable>boolean</replaceable>;
 	rrset-order { [ class <replaceable>string</replaceable> ] [ type <replaceable>string</replaceable> ] [ name
@@ -551,9 +551,9 @@ view <replaceable>string</replaceable> [ <replaceable>class</replaceable> ] {
 	auth-nxdomain <replaceable>boolean</replaceable>; // default changed
 	auto-dnssec ( allow | maintain | off );
 	cache-file <replaceable>quoted_string</replaceable>;
-	catalog-zones { zone <replaceable>quoted_string</replaceable> [ default-masters [ port
-	    <replaceable>integer</replaceable> ] [ dscp <replaceable>integer</replaceable> ] { ( <replaceable>masters</replaceable> | <replaceable>ipv4_address</replaceable> [
-	    port <replaceable>integer</replaceable> ] | <replaceable>ipv6_address</replaceable> [ port <replaceable>integer</replaceable> ] ) [ key
+	catalog-zones { zone <replaceable>string</replaceable> [ default-masters [ port <replaceable>integer</replaceable> ]
+	    [ dscp <replaceable>integer</replaceable> ] { ( <replaceable>masters</replaceable> | <replaceable>ipv4_address</replaceable> [ port
+	    <replaceable>integer</replaceable> ] | <replaceable>ipv6_address</replaceable> [ port <replaceable>integer</replaceable> ] ) [ key
 	    <replaceable>string</replaceable> ]; ... } ] [ zone-directory <replaceable>quoted_string</replaceable> ] [
 	    in-memory <replaceable>boolean</replaceable> ] [ min-update-interval <replaceable>integer</replaceable> ]; ... };
 	check-dup-records ( fail | warn | ignore );
@@ -707,13 +707,13 @@ view <replaceable>string</replaceable> [ <replaceable>class</replaceable> ] {
 	request-nsid <replaceable>boolean</replaceable>;
 	require-server-cookie <replaceable>boolean</replaceable>;
 	resolver-query-timeout <replaceable>integer</replaceable>;
-	response-policy { zone <replaceable>quoted_string</replaceable> [ log <replaceable>boolean</replaceable> ] [
-	    max-policy-ttl <replaceable>integer</replaceable> ] [ policy ( cname | disabled | drop |
-	    given | no-op | nodata | nxdomain | passthru | tcp-only
-	    <replaceable>quoted_string</replaceable> ) ] [ recursive-only <replaceable>boolean</replaceable> ]; ... } [
-	    break-dnssec <replaceable>boolean</replaceable> ] [ max-policy-ttl <replaceable>integer</replaceable> ] [
-	    min-ns-dots <replaceable>integer</replaceable> ] [ nsip-wait-recurse <replaceable>boolean</replaceable> ] [
-	    qname-wait-recurse <replaceable>boolean</replaceable> ] [ recursive-only <replaceable>boolean</replaceable> ];
+	response-policy { zone <replaceable>string</replaceable> [ log <replaceable>boolean</replaceable> ] [ max-policy-ttl
+	    <replaceable>integer</replaceable> ] [ policy ( cname | disabled | drop | given | no-op
+	    | nodata | nxdomain | passthru | tcp-only <replaceable>quoted_string</replaceable> ) ] [
+	    recursive-only <replaceable>boolean</replaceable> ]; ... } [ break-dnssec <replaceable>boolean</replaceable> ] [
+	    max-policy-ttl <replaceable>integer</replaceable> ] [ min-ns-dots <replaceable>integer</replaceable> ] [
+	    nsip-wait-recurse <replaceable>boolean</replaceable> ] [ qname-wait-recurse <replaceable>boolean</replaceable> ]
+	    [ recursive-only <replaceable>boolean</replaceable> ];
 	root-delegation-only [ exclude { <replaceable>quoted_string</replaceable>; ... } ];
 	root-key-sentinel <replaceable>boolean</replaceable>;
 	rrset-order { [ class <replaceable>string</replaceable> ] [ type <replaceable>string</replaceable> ] [ name
@@ -848,8 +848,7 @@ view <replaceable>string</replaceable> [ <replaceable>class</replaceable> ] {
 		request-expire <replaceable>boolean</replaceable>;
 		request-ixfr <replaceable>boolean</replaceable>;
 		serial-update-method ( date | increment | unixtime );
-		server-addresses { ( <replaceable>ipv4_address</replaceable> | <replaceable>ipv6_address</replaceable> ) [
-		    port <replaceable>integer</replaceable> ]; ... };
+		server-addresses { ( <replaceable>ipv4_address</replaceable> | <replaceable>ipv6_address</replaceable> ); ... };
 		server-names { <replaceable>quoted_string</replaceable>; ... };
 		sig-signing-nodes <replaceable>integer</replaceable>;
 		sig-signing-signatures <replaceable>integer</replaceable>;
@@ -949,8 +948,7 @@ zone <replaceable>string</replaceable> [ <replaceable>class</replaceable> ] {
 	request-expire <replaceable>boolean</replaceable>;
 	request-ixfr <replaceable>boolean</replaceable>;
 	serial-update-method ( date | increment | unixtime );
-	server-addresses { ( <replaceable>ipv4_address</replaceable> | <replaceable>ipv6_address</replaceable> ) [ port
-	    <replaceable>integer</replaceable> ]; ... };
+	server-addresses { ( <replaceable>ipv4_address</replaceable> | <replaceable>ipv6_address</replaceable> ); ... };
 	server-names { <replaceable>quoted_string</replaceable>; ... };
 	sig-signing-nodes <replaceable>integer</replaceable>;
 	sig-signing-signatures <replaceable>integer</replaceable>;
@@ -209,9 +209,9 @@ options
 	bindkeys-file <em class="replaceable"><code>quoted_string</code></em>;<br>
 	blackhole { <em class="replaceable"><code>address_match_element</code></em>; ... };<br>
 	cache-file <em class="replaceable"><code>quoted_string</code></em>;<br>
-	catalog-zones { zone <em class="replaceable"><code>quoted_string</code></em> [ default-masters [ port<br>
-	    <em class="replaceable"><code>integer</code></em> ] [ dscp <em class="replaceable"><code>integer</code></em> ] { ( <em class="replaceable"><code>masters</code></em> | <em class="replaceable"><code>ipv4_address</code></em> [<br>
-	    port <em class="replaceable"><code>integer</code></em> ] | <em class="replaceable"><code>ipv6_address</code></em> [ port <em class="replaceable"><code>integer</code></em> ] ) [ key<br>
+	catalog-zones { zone <em class="replaceable"><code>string</code></em> [ default-masters [ port <em class="replaceable"><code>integer</code></em> ]<br>
+	    [ dscp <em class="replaceable"><code>integer</code></em> ] { ( <em class="replaceable"><code>masters</code></em> | <em class="replaceable"><code>ipv4_address</code></em> [ port<br>
+	    <em class="replaceable"><code>integer</code></em> ] | <em class="replaceable"><code>ipv6_address</code></em> [ port <em class="replaceable"><code>integer</code></em> ] ) [ key<br>
 	    <em class="replaceable"><code>string</code></em> ]; ... } ] [ zone-directory <em class="replaceable"><code>quoted_string</code></em> ] [<br>
 	    in-memory <em class="replaceable"><code>boolean</code></em> ] [ min-update-interval <em class="replaceable"><code>integer</code></em> ]; ... };<br>
 	check-dup-records ( fail | warn | ignore );<br>
@@ -226,7 +226,7 @@ options
 	check-wildcard <em class="replaceable"><code>boolean</code></em>;<br>
 	cleaning-interval <em class="replaceable"><code>integer</code></em>;<br>
 	clients-per-query <em class="replaceable"><code>integer</code></em>;<br>
-	cookie-algorithm ( aes | sha1 | sha256 );<br>
+	cookie-algorithm ( aes | sha1 | sha256 | siphash24 );<br>
 	cookie-secret <em class="replaceable"><code>string</code></em>;<br>
 	coresize ( default | unlimited | <em class="replaceable"><code>sizeval</code></em> );<br>
 	datasize ( default | unlimited | <em class="replaceable"><code>sizeval</code></em> );<br>
@@ -395,13 +395,13 @@ options
 	require-server-cookie <em class="replaceable"><code>boolean</code></em>;<br>
 	reserved-sockets <em class="replaceable"><code>integer</code></em>;<br>
 	resolver-query-timeout <em class="replaceable"><code>integer</code></em>;<br>
-	response-policy { zone <em class="replaceable"><code>quoted_string</code></em> [ log <em class="replaceable"><code>boolean</code></em> ] [<br>
-	    max-policy-ttl <em class="replaceable"><code>integer</code></em> ] [ policy ( cname | disabled | drop |<br>
-	    given | no-op | nodata | nxdomain | passthru | tcp-only<br>
-	    <em class="replaceable"><code>quoted_string</code></em> ) ] [ recursive-only <em class="replaceable"><code>boolean</code></em> ]; ... } [<br>
-	    break-dnssec <em class="replaceable"><code>boolean</code></em> ] [ max-policy-ttl <em class="replaceable"><code>integer</code></em> ] [<br>
-	    min-ns-dots <em class="replaceable"><code>integer</code></em> ] [ nsip-wait-recurse <em class="replaceable"><code>boolean</code></em> ] [<br>
-	    qname-wait-recurse <em class="replaceable"><code>boolean</code></em> ] [ recursive-only <em class="replaceable"><code>boolean</code></em> ];<br>
+	response-policy { zone <em class="replaceable"><code>string</code></em> [ log <em class="replaceable"><code>boolean</code></em> ] [ max-policy-ttl<br>
+	    <em class="replaceable"><code>integer</code></em> ] [ policy ( cname | disabled | drop | given | no-op<br>
+	    | nodata | nxdomain | passthru | tcp-only <em class="replaceable"><code>quoted_string</code></em> ) ] [<br>
+	    recursive-only <em class="replaceable"><code>boolean</code></em> ]; ... } [ break-dnssec <em class="replaceable"><code>boolean</code></em> ] [<br>
+	    max-policy-ttl <em class="replaceable"><code>integer</code></em> ] [ min-ns-dots <em class="replaceable"><code>integer</code></em> ] [<br>
+	    nsip-wait-recurse <em class="replaceable"><code>boolean</code></em> ] [ qname-wait-recurse <em class="replaceable"><code>boolean</code></em> ]<br>
+	    [ recursive-only <em class="replaceable"><code>boolean</code></em> ];<br>
 	root-delegation-only [ exclude { <em class="replaceable"><code>quoted_string</code></em>; ... } ];<br>
 	root-key-sentinel <em class="replaceable"><code>boolean</code></em>;<br>
 	rrset-order { [ class <em class="replaceable"><code>string</code></em> ] [ type <em class="replaceable"><code>string</code></em> ] [ name<br>
@@ -543,9 +543,9 @@ view
 	auth-nxdomain <em class="replaceable"><code>boolean</code></em>; // default changed<br>
 	auto-dnssec ( allow | maintain | off );<br>
 	cache-file <em class="replaceable"><code>quoted_string</code></em>;<br>
-	catalog-zones { zone <em class="replaceable"><code>quoted_string</code></em> [ default-masters [ port<br>
-	    <em class="replaceable"><code>integer</code></em> ] [ dscp <em class="replaceable"><code>integer</code></em> ] { ( <em class="replaceable"><code>masters</code></em> | <em class="replaceable"><code>ipv4_address</code></em> [<br>
-	    port <em class="replaceable"><code>integer</code></em> ] | <em class="replaceable"><code>ipv6_address</code></em> [ port <em class="replaceable"><code>integer</code></em> ] ) [ key<br>
+	catalog-zones { zone <em class="replaceable"><code>string</code></em> [ default-masters [ port <em class="replaceable"><code>integer</code></em> ]<br>
+	    [ dscp <em class="replaceable"><code>integer</code></em> ] { ( <em class="replaceable"><code>masters</code></em> | <em class="replaceable"><code>ipv4_address</code></em> [ port<br>
+	    <em class="replaceable"><code>integer</code></em> ] | <em class="replaceable"><code>ipv6_address</code></em> [ port <em class="replaceable"><code>integer</code></em> ] ) [ key<br>
 	    <em class="replaceable"><code>string</code></em> ]; ... } ] [ zone-directory <em class="replaceable"><code>quoted_string</code></em> ] [<br>
 	    in-memory <em class="replaceable"><code>boolean</code></em> ] [ min-update-interval <em class="replaceable"><code>integer</code></em> ]; ... };<br>
 	check-dup-records ( fail | warn | ignore );<br>
@@ -699,13 +699,13 @@ view
 	request-nsid <em class="replaceable"><code>boolean</code></em>;<br>
 	require-server-cookie <em class="replaceable"><code>boolean</code></em>;<br>
 	resolver-query-timeout <em class="replaceable"><code>integer</code></em>;<br>
-	response-policy { zone <em class="replaceable"><code>quoted_string</code></em> [ log <em class="replaceable"><code>boolean</code></em> ] [<br>
-	    max-policy-ttl <em class="replaceable"><code>integer</code></em> ] [ policy ( cname | disabled | drop |<br>
-	    given | no-op | nodata | nxdomain | passthru | tcp-only<br>
-	    <em class="replaceable"><code>quoted_string</code></em> ) ] [ recursive-only <em class="replaceable"><code>boolean</code></em> ]; ... } [<br>
-	    break-dnssec <em class="replaceable"><code>boolean</code></em> ] [ max-policy-ttl <em class="replaceable"><code>integer</code></em> ] [<br>
-	    min-ns-dots <em class="replaceable"><code>integer</code></em> ] [ nsip-wait-recurse <em class="replaceable"><code>boolean</code></em> ] [<br>
-	    qname-wait-recurse <em class="replaceable"><code>boolean</code></em> ] [ recursive-only <em class="replaceable"><code>boolean</code></em> ];<br>
+	response-policy { zone <em class="replaceable"><code>string</code></em> [ log <em class="replaceable"><code>boolean</code></em> ] [ max-policy-ttl<br>
+	    <em class="replaceable"><code>integer</code></em> ] [ policy ( cname | disabled | drop | given | no-op<br>
+	    | nodata | nxdomain | passthru | tcp-only <em class="replaceable"><code>quoted_string</code></em> ) ] [<br>
+	    recursive-only <em class="replaceable"><code>boolean</code></em> ]; ... } [ break-dnssec <em class="replaceable"><code>boolean</code></em> ] [<br>
+	    max-policy-ttl <em class="replaceable"><code>integer</code></em> ] [ min-ns-dots <em class="replaceable"><code>integer</code></em> ] [<br>
+	    nsip-wait-recurse <em class="replaceable"><code>boolean</code></em> ] [ qname-wait-recurse <em class="replaceable"><code>boolean</code></em> ]<br>
+	    [ recursive-only <em class="replaceable"><code>boolean</code></em> ];<br>
 	root-delegation-only [ exclude { <em class="replaceable"><code>quoted_string</code></em>; ... } ];<br>
 	root-key-sentinel <em class="replaceable"><code>boolean</code></em>;<br>
 	rrset-order { [ class <em class="replaceable"><code>string</code></em> ] [ type <em class="replaceable"><code>string</code></em> ] [ name<br>
@@ -840,8 +840,7 @@ view
 		request-expire <em class="replaceable"><code>boolean</code></em>;<br>
 		request-ixfr <em class="replaceable"><code>boolean</code></em>;<br>
 		serial-update-method ( date | increment | unixtime );<br>
-		server-addresses { ( <em class="replaceable"><code>ipv4_address</code></em> | <em class="replaceable"><code>ipv6_address</code></em> ) [<br>
-		    port <em class="replaceable"><code>integer</code></em> ]; ... };<br>
+		server-addresses { ( <em class="replaceable"><code>ipv4_address</code></em> | <em class="replaceable"><code>ipv6_address</code></em> ); ... };<br>
 		server-names { <em class="replaceable"><code>quoted_string</code></em>; ... };<br>
 		sig-signing-nodes <em class="replaceable"><code>integer</code></em>;<br>
 		sig-signing-signatures <em class="replaceable"><code>integer</code></em>;<br>
@@ -942,8 +941,7 @@ zone
 	request-expire <em class="replaceable"><code>boolean</code></em>;<br>
 	request-ixfr <em class="replaceable"><code>boolean</code></em>;<br>
 	serial-update-method ( date | increment | unixtime );<br>
-	server-addresses { ( <em class="replaceable"><code>ipv4_address</code></em> | <em class="replaceable"><code>ipv6_address</code></em> ) [ port<br>
-	    <em class="replaceable"><code>integer</code></em> ]; ... };<br>
+	server-addresses { ( <em class="replaceable"><code>ipv4_address</code></em> | <em class="replaceable"><code>ipv6_address</code></em> ); ... };<br>
 	server-names { <em class="replaceable"><code>quoted_string</code></em>; ... };<br>
 	sig-signing-nodes <em class="replaceable"><code>integer</code></em>;<br>
 	sig-signing-signatures <em class="replaceable"><code>integer</code></em>;<br>
@@ -979,12 +979,15 @@ rpz_log_rewrite(ns_client_t *client, bool disabled,
 		dns_zone_t *p_zone, dns_name_t *p_name,
 		dns_name_t *cname, dns_rpz_num_t rpz_num)
 {
-	isc_stats_t *zonestats;
-	char qname_buf[DNS_NAME_FORMATSIZE];
-	char p_name_buf[DNS_NAME_FORMATSIZE];
 	char cname_buf[DNS_NAME_FORMATSIZE] = { 0 };
+	char p_name_buf[DNS_NAME_FORMATSIZE];
+	char qname_buf[DNS_NAME_FORMATSIZE];
+	char classbuf[DNS_RDATACLASS_FORMATSIZE];
+	char typebuf[DNS_RDATATYPE_FORMATSIZE];
 	const char *s1 = cname_buf, *s2 = cname_buf;
+	dns_rdataset_t *rdataset;
 	dns_rpz_st_t *st;
+	isc_stats_t *zonestats;

 	/*
 	 * Count enabled rewrites in the global counter.
@@ -1016,11 +1019,29 @@ rpz_log_rewrite(ns_client_t *client, bool disabled,
 		s2 = ")";
 	}

+	/*
+	 *  Log Qclass and Qtype in addition to existing
+	 *  fields.
+	 */
+	rdataset = ISC_LIST_HEAD(client->query.origqname->list);
+	INSIST(rdataset != NULL);
+	dns_rdataclass_format(rdataset->rdclass, classbuf, sizeof(classbuf));
+	dns_rdatatype_format(rdataset->type, typebuf, sizeof(typebuf));
+
 	ns_client_log(client, DNS_LOGCATEGORY_RPZ, NS_LOGMODULE_QUERY,
-		      DNS_RPZ_INFO_LEVEL, "%srpz %s %s rewrite %s via %s%s%s%s",
+		      DNS_RPZ_INFO_LEVEL,
+#ifdef RPZ_LOG_QTYPE_QCLASS
+		      "%srpz %s %s rewrite %s/%s/%s via %s%s%s%s",
+#else /* RPZ_LOG_QTYPE_QCLASS */
+		      "%srpz %s %s rewrite %s via %s%s%s%s",
+#endif /* RPZ_LOG_QTYPE_QCLASS */
 		      disabled ? "disabled " : "",
 		      dns_rpz_type2str(type), dns_rpz_policy2str(policy),
-		      qname_buf, p_name_buf, s1, cname_buf, s2);
+		      qname_buf,
+#ifdef RPZ_LOG_QTYPE_QCLASS
+		      typebuf, classbuf,
+#endif /* RPZ_LOG_QTYPE_QCLASS */
+		      p_name_buf, s1, cname_buf, s2);
 }

 static void
@@ -2879,8 +2900,7 @@ query_addsoa(ns_client_t *client, dns_db_t *db, dns_dbversion_t *version,
 		RUNTIME_CHECK(result == ISC_R_SUCCESS);
 		dns_rdataset_current(rdataset, &rdata);
 		result = dns_rdata_tostruct(&rdata, &soa, NULL);
-		if (result != ISC_R_SUCCESS)
-			goto cleanup;
+		RUNTIME_CHECK(result == ISC_R_SUCCESS);

 		if (override_ttl != UINT32_MAX &&
 		    override_ttl < rdataset->ttl) {
@@ -3291,8 +3311,7 @@ validate(ns_client_t *client, dns_db_t *db, dns_name_t *name,
 		dns_rdata_reset(&rdata);
 		dns_rdataset_current(sigrdataset, &rdata);
 		result = dns_rdata_tostruct(&rdata, &rrsig, NULL);
-		if (result != ISC_R_SUCCESS)
-			return (false);
+		RUNTIME_CHECK(result == ISC_R_SUCCESS);
 		if (!dns_resolver_algorithm_supported(client->view->resolver,
 						      name, rrsig.algorithm))
 			continue;
@@ -3858,8 +3877,7 @@ query_addwildcardproof(ns_client_t *client, dns_db_t *db,
 		if (result == ISC_R_SUCCESS) {
 			dns_rdataset_current(rdataset, &rdata);
 			result = dns_rdata_tostruct(&rdata, &nsec, NULL);
-		}
-		if (result == ISC_R_SUCCESS) {
+			RUNTIME_CHECK(result == ISC_R_SUCCESS);
 			(void)dns_name_fullcompare(name, fname, &order,
 						   &olabels);
 			(void)dns_name_fullcompare(name, &nsec.next, &order,
@@ -3939,8 +3957,7 @@ query_addnxrrsetnsec(ns_client_t *client, dns_db_t *db,
 	dns_rdata_init(&sigrdata);
 	dns_rdataset_current(sigrdataset, &sigrdata);
 	result = dns_rdata_tostruct(&sigrdata, &sig, NULL);
-	if (result != ISC_R_SUCCESS)
-		return;
+	RUNTIME_CHECK(result == ISC_R_SUCCESS);

 	labels = dns_name_countlabels(name);
 	if ((unsigned int)sig.labels + 1 >= labels)
@@ -4203,12 +4220,14 @@ query_prefetch(ns_client_t *client, dns_name_t *qname,
 	if (client->recursionquota == NULL) {
 		result = isc_quota_attach(&ns_g_server->recursionquota,
 					  &client->recursionquota);
+		if (result == ISC_R_SUCCESS || result == ISC_R_SOFTQUOTA) {
+			isc_stats_increment(ns_g_server->nsstats,
+					    dns_nsstatscounter_recursclients);
+		}
 		if (result == ISC_R_SUCCESS && !client->mortal && !TCP(client))
 			result = ns_client_replace(client);
 		if (result != ISC_R_SUCCESS)
 			return;
-		isc_stats_increment(ns_g_server->nsstats,
-				    dns_nsstatscounter_recursclients);
 	}

 	tmprdataset = query_newrdataset(client);
@@ -4260,8 +4279,10 @@ query_recurse(ns_client_t *client, dns_rdatatype_t qtype, dns_name_t *qname,
 		result = isc_quota_attach(&ns_g_server->recursionquota,
 					  &client->recursionquota);

-		isc_stats_increment(ns_g_server->nsstats,
-				    dns_nsstatscounter_recursclients);
+		if (result == ISC_R_SUCCESS || result == ISC_R_SOFTQUOTA) {
+			isc_stats_increment(ns_g_server->nsstats,
+					    dns_nsstatscounter_recursclients);
+		}

 		if  (result == ISC_R_SOFTQUOTA) {
 			static isc_stdtime_t last = 0;
@@ -4475,6 +4496,7 @@ rpz_get_zbits(ns_client_t *client,
 		break;
 	default:
 		INSIST(0);
+		ISC_UNREACHABLE();
 		break;
 	}

@@ -4517,12 +4539,14 @@ query_rpzfetch(ns_client_t *client, dns_name_t *qname, dns_rdatatype_t type) {
 	if (client->recursionquota == NULL) {
 		result = isc_quota_attach(&ns_g_server->recursionquota,
 					  &client->recursionquota);
+		if (result == ISC_R_SUCCESS || result == ISC_R_SOFTQUOTA) {
+			isc_stats_increment(ns_g_server->nsstats,
+					    dns_nsstatscounter_recursclients);
+		}
 		if (result == ISC_R_SUCCESS && !client->mortal && !TCP(client))
 			result = ns_client_replace(client);
 		if (result != ISC_R_SUCCESS)
 			return;
-		isc_stats_increment(ns_g_server->nsstats,
-				    dns_nsstatscounter_recursclients);
 	}

 	tmprdataset = query_newrdataset(client);
@@ -4699,6 +4723,7 @@ rpz_get_p_name(ns_client_t *client, dns_name_t *p_name,
 		break;
 	default:
 		INSIST(0);
+		ISC_UNREACHABLE();
 	}

 	/*
@@ -4758,6 +4783,7 @@ rpz_find_p(ns_client_t *client, dns_name_t *self_name, dns_rdatatype_t qtype,
 	isc_result_t result;
 	dns_clientinfomethods_t cm;
 	dns_clientinfo_t ci;
+	bool found_a = false;

 	REQUIRE(nodep != NULL);

@@ -4801,6 +4827,18 @@ rpz_find_p(ns_client_t *client, dns_name_t *self_name, dns_rdatatype_t qtype,
 			       "rpz_find_p: allrdatasets failed");
 			return (DNS_R_SERVFAIL);
 		}
+		if (qtype == dns_rdatatype_aaaa &&
+		    !ISC_LIST_EMPTY(client->view->dns64)) {
+			for (result = dns_rdatasetiter_first(rdsiter);
+			     result == ISC_R_SUCCESS;
+			     result = dns_rdatasetiter_next(rdsiter)) {
+				dns_rdatasetiter_current(rdsiter, *rdatasetp);
+				if ((*rdatasetp)->type == dns_rdatatype_a) {
+					found_a = true;
+				}
+				dns_rdataset_disassociate(*rdatasetp);
+			}
+		}
 		for (result = dns_rdatasetiter_first(rdsiter);
 		     result == ISC_R_SUCCESS;
 		     result = dns_rdatasetiter_next(rdsiter)) {
@@ -4853,7 +4891,11 @@ rpz_find_p(ns_client_t *client, dns_name_t *self_name, dns_rdatatype_t qtype,
 		}
 		return (ISC_R_SUCCESS);
 	case DNS_R_NXRRSET:
-		*policyp = DNS_RPZ_POLICY_NODATA;
+		if (found_a) {
+			*policyp = DNS_RPZ_POLICY_DNS64;
+		} else {
+			*policyp = DNS_RPZ_POLICY_NODATA;
+		}
 		return (result);
 	case DNS_R_DNAME:
 		/*
@@ -5717,14 +5759,8 @@ rpz_rewrite(ns_client_t *client, dns_rdatatype_t qtype,

 			dns_rdataset_current(st->r.ns_rdataset, &nsrdata);
 			result = dns_rdata_tostruct(&nsrdata, &ns, NULL);
+			RUNTIME_CHECK(result == ISC_R_SUCCESS);
 			dns_rdata_reset(&nsrdata);
-			if (result != ISC_R_SUCCESS) {
-				rpz_log_fail(client, DNS_RPZ_ERROR_LEVEL,
-					     nsname, DNS_RPZ_TYPE_NSIP,
-					     " rdata_tostruct()", result);
-				st->m.policy = DNS_RPZ_POLICY_ERROR;
-				goto cleanup;
-			}
 			/*
 			 * Do nothing about "NS ."
 			 */
@@ -6019,6 +6055,7 @@ setup_query_sortlist(ns_client_t *client) {
 		break;
 	default:
 		INSIST(0);
+		ISC_UNREACHABLE();
 		break;
 	}
 	dns_message_setsortorder(client->message, order, order_arg);
@@ -6271,7 +6308,8 @@ query_findclosestnsec3(dns_name_t *qname, dns_db_t *db,
 		result = dns_rdataset_first(rdataset);
 		INSIST(result == ISC_R_SUCCESS);
 		dns_rdataset_current(rdataset, &rdata);
-		dns_rdata_tostruct(&rdata, &nsec3, NULL);
+		result = dns_rdata_tostruct(&rdata, &nsec3, NULL);
+		RUNTIME_CHECK(result == ISC_R_SUCCESS);
 		dns_rdata_reset(&rdata);
 		optout = (nsec3.flags & DNS_NSEC3FLAG_OPTOUT);
 		if (found != NULL && optout &&
@@ -6553,6 +6591,7 @@ redirect2(ns_client_t *client, dns_name_t *name, dns_rdataset_t *rdataset,
 	dns_dbversion_t *version = NULL;
 	dns_zone_t *zone = NULL;
 	bool is_zone;
+	unsigned int labels;
 	unsigned int options;

 	CTRACE(ISC_LOG_DEBUG(3), "redirect2");
@@ -6595,12 +6634,13 @@ redirect2(ns_client_t *client, dns_name_t *name, dns_rdataset_t *rdataset,
 	}

 	redirectname = dns_fixedname_initname(&fixedredirect);
-	if (dns_name_countlabels(name) > 1U) {
+	labels = dns_name_countlabels(client->query.qname);
+	if (labels > 1U) {
 		dns_name_t prefix;
-		unsigned int labels = dns_name_countlabels(name) - 1;

 		dns_name_init(&prefix, NULL);
-		dns_name_getlabelsequence(name, 0, labels, &prefix);
+		dns_name_getlabelsequence(client->query.qname, 0, labels - 1,
+					  &prefix);
 		result = dns_name_concatenate(&prefix,
 					      client->view->redirectzone,
 					      redirectname, NULL);
@@ -6749,7 +6789,7 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
 	bool failcache;
 	uint32_t flags;
 #ifdef WANT_QUERYTRACE
-	char mbuf[BUFSIZ];
+	char mbuf[4 * DNS_NAME_FORMATSIZE];
 	char qbuf[DNS_NAME_FORMATSIZE];
 	char tbuf[DNS_RDATATYPE_FORMATSIZE];
 #endif
@@ -7018,17 +7058,17 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
 		{
 			if (isc_log_wouldlog(ns_g_lctx, ISC_LOG_DEBUG(1))) {
 				char namebuf[DNS_NAME_FORMATSIZE];
-				char typename[DNS_RDATATYPE_FORMATSIZE];
+				char typebuf[DNS_RDATATYPE_FORMATSIZE];

 				dns_name_format(client->query.qname,
 						namebuf, sizeof(namebuf));
-				dns_rdatatype_format(qtype, typename,
-						     sizeof(typename));
+				dns_rdatatype_format(qtype, typebuf,
+						     sizeof(typebuf));
 				ns_client_log(client, NS_LOGCATEGORY_CLIENT,
 					      NS_LOGMODULE_QUERY,
 					      ISC_LOG_DEBUG(1),
 					      "servfail cache hit %s/%s (%s)",
-					      namebuf, typename,
+					      namebuf, typebuf,
 					      ((flags & NS_FAILCACHE_CD) != 0)
 					       ? "CD=1"
 					       : "CD=0");
@@ -7056,22 +7096,35 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
 	need_wildcardproof = false;
 	rpz = false;

+	/*
+	 * If we require a server cookie then send back BADCOOKIE
+	 * before we have done too much work.
+	 */
+	if (!TCP(client) && client->view->requireservercookie &&
+	    WANTCOOKIE(client) && !HAVECOOKIE(client))
+	{
+		client->message->flags &= ~DNS_MESSAGEFLAG_AA;
+		client->message->flags &= ~DNS_MESSAGEFLAG_AD;
+		client->message->rcode = dns_rcode_badcookie;
+		goto cleanup;
+	}
+
 	if (client->view->checknames &&
 	    !dns_rdata_checkowner(client->query.qname,
 				  client->message->rdclass,
 				  qtype, false)) {
 		char namebuf[DNS_NAME_FORMATSIZE];
-		char typename[DNS_RDATATYPE_FORMATSIZE];
-		char classname[DNS_RDATACLASS_FORMATSIZE];
+		char typebuf[DNS_RDATATYPE_FORMATSIZE];
+		char classbuf[DNS_RDATACLASS_FORMATSIZE];

 		dns_name_format(client->query.qname, namebuf, sizeof(namebuf));
-		dns_rdatatype_format(qtype, typename, sizeof(typename));
-		dns_rdataclass_format(client->message->rdclass, classname,
-				      sizeof(classname));
+		dns_rdatatype_format(qtype, typebuf, sizeof(typebuf));
+		dns_rdataclass_format(client->message->rdclass, classbuf,
+				      sizeof(classbuf));
 		ns_client_log(client, DNS_LOGCATEGORY_SECURITY,
 			      NS_LOGMODULE_QUERY, ISC_LOG_ERROR,
 			      "check-names failure %s/%s/%s", namebuf,
-			      typename, classname);
+			      typebuf, classbuf);
 		QUERY_ERROR(DNS_R_REFUSED);
 		goto cleanup;
 	}
@@ -7472,8 +7525,10 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
 				rpz = true;
 				break;
 			case DNS_RPZ_POLICY_NODATA:
-				result = DNS_R_NXRRSET;
 				nxrewrite = true;
+				/* FALLTHROUGH */
+			case DNS_RPZ_POLICY_DNS64:
+				result = DNS_R_NXRRSET;
 				rpz = true;
 				break;
 			case DNS_RPZ_POLICY_RECORD:
@@ -7934,6 +7989,7 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
 #endif
 		} else if (result == DNS_R_NXRRSET &&
 			   !ISC_LIST_EMPTY(client->view->dns64) &&
+			   !nxrewrite &&
 			   client->message->rdclass == dns_rdataclass_in &&
 			   qtype == dns_rdatatype_aaaa)
 		{
@@ -8432,11 +8488,8 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
 		}
 		dns_rdataset_current(trdataset, &rdata);
 		result = dns_rdata_tostruct(&rdata, &cname, NULL);
+		RUNTIME_CHECK(result == ISC_R_SUCCESS);
 		dns_rdata_reset(&rdata);
-		if (result != ISC_R_SUCCESS) {
-			dns_message_puttempname(client->message, &tname);
-			goto cleanup;
-		}
 		dns_name_init(tname, NULL);
 		result = dns_name_dup(&cname.cname, client->mctx, tname);
 		if (result != ISC_R_SUCCESS) {
@@ -8503,11 +8556,8 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
 		}
 		dns_rdataset_current(trdataset, &rdata);
 		result = dns_rdata_tostruct(&rdata, &dname, NULL);
+		RUNTIME_CHECK(result == ISC_R_SUCCESS);
 		dns_rdata_reset(&rdata);
-		if (result != ISC_R_SUCCESS) {
-			dns_message_puttempname(client->message, &tname);
-			goto cleanup;
-		}
 		dns_name_clone(&dname.dname, tname);
 		dns_rdata_freestruct(&dname);
 		/*
@@ -8998,11 +9048,13 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
 			}

 			/*
-			 * BIND 8 priming queries need the additional section.
+			 * Always add glue for root priming queries, regardless
+			 * of "minimal-responses" setting.
 			 */
 			if (dns_name_equal(client->query.qname, dns_rootname)) {
 				client->query.attributes &=
 					~NS_QUERYATTR_NOADDITIONAL;
+				dns_db_attach(db, &client->query.gluedb);
 			}
 		}

@@ -9154,6 +9206,10 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
 		free_devent(client, ISC_EVENT_PTR(&event), &event);
 	}

+	if (client->query.gluedb != NULL) {
+		dns_db_detach(&client->query.gluedb);
+	}
+
 	/*
 	 * AA bit.
 	 */
@@ -9239,7 +9295,7 @@ static inline void
 log_tat(ns_client_t *client) {
 	char namebuf[DNS_NAME_FORMATSIZE];
 	char clientbuf[ISC_NETADDR_FORMATSIZE];
-	char classname[DNS_RDATACLASS_FORMATSIZE];
+	char classbuf[DNS_RDATACLASS_FORMATSIZE];
 	isc_netaddr_t netaddr;
 	char *tags = NULL;
 	size_t taglen = 0;
@@ -9259,8 +9315,8 @@ log_tat(ns_client_t *client) {
 	isc_netaddr_fromsockaddr(&netaddr, &client->peeraddr);
 	dns_name_format(client->query.qname, namebuf, sizeof(namebuf));
 	isc_netaddr_format(&netaddr, clientbuf, sizeof(clientbuf));
-	dns_rdataclass_format(client->view->rdclass, classname,
-			      sizeof(classname));
+	dns_rdataclass_format(client->view->rdclass, classbuf,
+			      sizeof(classbuf));

 	if (client->query.qtype == dns_rdatatype_dnskey) {
 		uint16_t keytags = client->keytag_len / 2;
@@ -9289,7 +9345,7 @@ log_tat(ns_client_t *client) {

 	isc_log_write(ns_g_lctx, NS_LOGCATEGORY_TAT, NS_LOGMODULE_QUERY,
 		      ISC_LOG_INFO, "trust-anchor-telemetry '%s/%s' from %s%s",
-		      namebuf, classname, clientbuf, tags != NULL? tags : "");
+		      namebuf, classbuf, clientbuf, tags != NULL? tags : "");
 	if (tags != NULL) {
 		isc_mem_put(client->mctx, tags, taglen);
 	}
@@ -9298,8 +9354,8 @@ log_tat(ns_client_t *client) {
 static inline void
 log_query(ns_client_t *client, unsigned int flags, unsigned int extflags) {
 	char namebuf[DNS_NAME_FORMATSIZE];
-	char typename[DNS_RDATATYPE_FORMATSIZE];
-	char classname[DNS_RDATACLASS_FORMATSIZE];
+	char typebuf[DNS_RDATATYPE_FORMATSIZE];
+	char classbuf[DNS_RDATACLASS_FORMATSIZE];
 	char onbuf[ISC_NETADDR_FORMATSIZE];
 	char ednsbuf[sizeof("E(65535)")] = { 0 };
 	dns_rdataset_t *rdataset;
@@ -9311,8 +9367,8 @@ log_query(ns_client_t *client, unsigned int flags, unsigned int extflags) {
 	rdataset = ISC_LIST_HEAD(client->query.qname->list);
 	INSIST(rdataset != NULL);
 	dns_name_format(client->query.qname, namebuf, sizeof(namebuf));
-	dns_rdataclass_format(rdataset->rdclass, classname, sizeof(classname));
-	dns_rdatatype_format(rdataset->type, typename, sizeof(typename));
+	dns_rdataclass_format(rdataset->rdclass, classbuf, sizeof(classbuf));
+	dns_rdatatype_format(rdataset->type, typebuf, sizeof(typebuf));
 	isc_netaddr_format(&client->destaddr, onbuf, sizeof(onbuf));

 	if (client->ednsversion >= 0)
@@ -9321,7 +9377,7 @@ log_query(ns_client_t *client, unsigned int flags, unsigned int extflags) {

 	ns_client_log(client, NS_LOGCATEGORY_QUERIES, NS_LOGMODULE_QUERY,
 		      level, "query: %s %s %s %s%s%s%s%s%s%s (%s)", namebuf,
-		      classname, typename, WANTRECURSION(client) ? "+" : "-",
+		      classbuf, typebuf, WANTRECURSION(client) ? "+" : "-",
 		      (client->signer != NULL) ? "S" : "", ednsbuf,
 		      TCP(client) ? "T" : "",
 		      ((extflags & DNS_MESSAGEEXTFLAG_DO) != 0) ? "D" : "",
@@ -9333,8 +9389,8 @@ log_query(ns_client_t *client, unsigned int flags, unsigned int extflags) {
 static inline void
 log_queryerror(ns_client_t *client, isc_result_t result, int line, int level) {
 	char namebuf[DNS_NAME_FORMATSIZE];
-	char typename[DNS_RDATATYPE_FORMATSIZE];
-	char classname[DNS_RDATACLASS_FORMATSIZE];
+	char typebuf[DNS_RDATATYPE_FORMATSIZE];
+	char classbuf[DNS_RDATACLASS_FORMATSIZE];
 	const char *namep, *typep, *classp, *sep1, *sep2;
 	dns_rdataset_t *rdataset;

@@ -9356,12 +9412,12 @@ log_queryerror(ns_client_t *client, isc_result_t result, int line, int level) {

 		rdataset = ISC_LIST_HEAD(client->query.origqname->list);
 		if (rdataset != NULL) {
-			dns_rdataclass_format(rdataset->rdclass, classname,
-					      sizeof(classname));
-			classp = classname;
-			dns_rdatatype_format(rdataset->type, typename,
-					     sizeof(typename));
-			typep = typename;
+			dns_rdataclass_format(rdataset->rdclass, classbuf,
+					      sizeof(classbuf));
+			classp = classbuf;
+			dns_rdatatype_format(rdataset->type, typebuf,
+					     sizeof(typebuf));
+			typep = typebuf;
 			sep2 = "/";
 		}
 	}
@@ -9561,7 +9617,7 @@ ns_query_start(ns_client_t *client) {
 	 * We don't need to set DNS_DBFIND_PENDINGOK when validation is
 	 * disabled as there will be no pending data.
 	 */
-	if (message->flags & DNS_MESSAGEFLAG_CD ||
+	if ((message->flags & DNS_MESSAGEFLAG_CD) != 0 ||
 	    qtype == dns_rdatatype_rrsig)
 	{
 		client->query.dboptions |= DNS_DBFIND_PENDINGOK;
@@ -9573,8 +9629,9 @@ ns_query_start(ns_client_t *client) {
 	 * Allow glue NS records to be added to the authority section
 	 * if the answer is secure.
 	 */
-	if (message->flags & DNS_MESSAGEFLAG_CD)
+	if ((message->flags & DNS_MESSAGEFLAG_CD) != 0) {
 		client->query.attributes &= ~NS_QUERYATTR_SECURE;
+	}

 	/*
 	 * Set NS_CLIENTATTR_WANTAD if the client has set AD in the query.
@@ -42,6 +42,7 @@
 #include <isc/refcount.h>
 #include <isc/resource.h>
 #include <isc/sha2.h>
+#include <isc/siphash.h>
 #include <isc/socket.h>
 #include <isc/stat.h>
 #include <isc/stats.h>
@@ -105,9 +106,9 @@
 #include <named/client.h>
 #include <named/config.h>
 #include <named/control.h>
-#ifdef HAVE_GEOIP
+#if defined(HAVE_GEOIP) || defined(HAVE_GEOIP2)
 #include <named/geoip.h>
-#endif /* HAVE_GEOIP */
+#endif /* HAVE_GEOIP || HAVE_GEOIP2 */
 #include <named/interfacemgr.h>
 #include <named/log.h>
 #include <named/logconf.h>
@@ -303,6 +304,13 @@ typedef struct catz_chgzone_event {
 	bool mod;
 } catz_chgzone_event_t;

+typedef struct {
+	unsigned int magic;
+#define DZARG_MAGIC		ISC_MAGIC('D', 'z', 'a', 'r')
+	isc_buffer_t **text;
+	isc_result_t result;
+} ns_dzarg_t;
+
 /*
 * These zones should not leak onto the Internet.
 */
@@ -837,7 +845,7 @@ load_view_keys(const cfg_obj_t *keys, const cfg_obj_t *vconfig,
 			key = cfg_listelt_value(elt2);
 			result = dstkey_fromconfig(vconfig, key, managed,
 						   &dstkey, mctx);
-			if (result ==  DST_R_UNSUPPORTEDALG) {
+			if (result == DST_R_UNSUPPORTEDALG) {
 				result = ISC_R_SUCCESS;
 				continue;
 			}
@@ -1148,6 +1156,7 @@ get_view_querysource_dispatch(const cfg_obj_t **maps, int af,
 		break;
 	default:
 		INSIST(0);
+		ISC_UNREACHABLE();
 	}

 	sa = *(cfg_obj_assockaddr(obj));
@@ -1169,6 +1178,7 @@ get_view_querysource_dispatch(const cfg_obj_t **maps, int af,
 		break;
 	default:
 		INSIST(0);
+		ISC_UNREACHABLE();
 	}
 	if (result != ISC_R_SUCCESS)
 		return (ISC_R_SUCCESS);
@@ -1276,18 +1286,20 @@ configure_order(dns_order_t *order, const cfg_obj_t *ent) {
 	obj = cfg_tuple_get(ent, "ordering");
 	INSIST(cfg_obj_isstring(obj));
 	str = cfg_obj_asstring(obj);
-	if (!strcasecmp(str, "fixed"))
+	if (!strcasecmp(str, "fixed")) {
 #if DNS_RDATASET_FIXED
 		mode = DNS_RDATASETATTR_FIXEDORDER;
 #else
 		mode = 0;
 #endif /* DNS_RDATASET_FIXED */
-	else if (!strcasecmp(str, "random"))
+	} else if (!strcasecmp(str, "random")) {
 		mode = DNS_RDATASETATTR_RANDOMIZE;
-	else if (!strcasecmp(str, "cyclic"))
+	} else if (!strcasecmp(str, "cyclic")) {
 		mode = 0;
-	else
+	} else {
 		INSIST(0);
+		ISC_UNREACHABLE();
+	}

 	/*
 	 * "*" should match everything including the root (BIND 8 compat).
@@ -1401,14 +1413,16 @@ configure_peer(const cfg_obj_t *cpeer, isc_mem_t *mctx, dns_peer_t **peerp) {
 	(void)cfg_map_get(cpeer, "transfer-format", &obj);
 	if (obj != NULL) {
 		str = cfg_obj_asstring(obj);
-		if (strcasecmp(str, "many-answers") == 0)
+		if (strcasecmp(str, "many-answers") == 0) {
 			CHECK(dns_peer_settransferformat(peer,
 							 dns_many_answers));
-		else if (strcasecmp(str, "one-answer") == 0)
+		} else if (strcasecmp(str, "one-answer") == 0) {
 			CHECK(dns_peer_settransferformat(peer,
 							 dns_one_answer));
-		else
+		} else {
 			INSIST(0);
+			ISC_UNREACHABLE();
+		}
 	}

 	obj = NULL;
@@ -2181,7 +2195,15 @@ catz_addmodzone_taskaction(isc_task_t *task, isc_event_t *event0) {
 		}

 	} else {
-		if (result != ISC_R_NOTFOUND && result != DNS_R_PARTIALMATCH) {
+		if (result == ISC_R_SUCCESS) {
+			isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
+				      NS_LOGMODULE_SERVER, ISC_LOG_INFO,
+				      "catz: zone \"%s\" is overridden "
+				      "by explicitly configured zone",
+				      nameb);
+			goto cleanup;
+		} else if (result != ISC_R_NOTFOUND &&
+			   result != DNS_R_PARTIALMATCH) {
 			isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
 				      NS_LOGMODULE_SERVER, ISC_LOG_WARNING,
 				      "catz: error \"%s\" while trying to "
@@ -2361,7 +2383,7 @@ catz_create_chg_task(dns_catz_entry_t *entry, dns_catz_zone_t *origin,
 	catz_chgzone_event_t *event;
 	isc_task_t *task;
 	isc_result_t result;
-	isc_taskaction_t action;
+	isc_taskaction_t action = NULL;

 	switch (type) {
 	case DNS_EVENT_CATZADDZONE:
@@ -3561,8 +3583,10 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
 		view->checknames = false;
 	} else if (strcasecmp(str, "ignore") == 0) {
 		view->checknames = false;
-	} else
+	} else {
 		INSIST(0);
+		ISC_UNREACHABLE();
+	}

 	obj = NULL;
 	result = ns_config_get(maps, "zero-no-soa-ttl-cache", &obj);
@@ -3920,14 +3944,16 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
 		obj2 = cfg_tuple_get(obj, "response");
 		if (!cfg_obj_isvoid(obj2)) {
 			const char *resp = cfg_obj_asstring(obj2);
-			isc_result_t r;
+			isc_result_t r = DNS_R_SERVFAIL;

-			if (strcasecmp(resp, "drop") == 0)
+			if (strcasecmp(resp, "drop") == 0) {
 				r = DNS_R_DROP;
-			else if (strcasecmp(resp, "fail") == 0)
+			} else if (strcasecmp(resp, "fail") == 0) {
 				r = DNS_R_SERVFAIL;
-			else
+			} else {
 				INSIST(0);
+				ISC_UNREACHABLE();
+			}

 			dns_resolver_setquotaresponse(view->resolver,
 						      dns_quotatype_server, r);
@@ -4234,20 +4260,24 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
 			view->minimalresponses = dns_minimal_noauth;
 		} else if (strcasecmp(str, "no-auth-recursive") == 0) {
 			view->minimalresponses = dns_minimal_noauthrec;
-		} else
+		} else {
 			INSIST(0);
+			ISC_UNREACHABLE();
+		}
 	}

 	obj = NULL;
 	result = ns_config_get(maps, "transfer-format", &obj);
 	INSIST(result == ISC_R_SUCCESS);
 	str = cfg_obj_asstring(obj);
-	if (strcasecmp(str, "many-answers") == 0)
+	if (strcasecmp(str, "many-answers") == 0) {
 		view->transfer_format = dns_many_answers;
-	else if (strcasecmp(str, "one-answer") == 0)
+	} else if (strcasecmp(str, "one-answer") == 0) {
 		view->transfer_format = dns_one_answer;
-	else
+	} else {
 		INSIST(0);
+		ISC_UNREACHABLE();
+	}

 	obj = NULL;
 	result = ns_config_get(maps, "trust-anchor-telemetry", &obj);
@@ -4524,14 +4554,16 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
 	obj2 = cfg_tuple_get(obj, "response");
 	if (!cfg_obj_isvoid(obj2)) {
 		const char *resp = cfg_obj_asstring(obj2);
-		isc_result_t r;
+		isc_result_t r = DNS_R_SERVFAIL;

-		if (strcasecmp(resp, "drop") == 0)
+		if (strcasecmp(resp, "drop") == 0) {
 			r = DNS_R_DROP;
-		else if (strcasecmp(resp, "fail") == 0)
+		} else if (strcasecmp(resp, "fail") == 0) {
 			r = DNS_R_SERVFAIL;
-		else
+		} else {
 			INSIST(0);
+			ISC_UNREACHABLE();
+		}

 		dns_resolver_setquotaresponse(view->resolver,
 					      dns_quotatype_zone, r);
@@ -4548,10 +4580,12 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
 			view->v4_aaaa = dns_aaaa_ok;
 	} else {
 		const char *v4_aaaastr = cfg_obj_asstring(obj);
-		if (strcasecmp(v4_aaaastr, "break-dnssec") == 0)
+		if (strcasecmp(v4_aaaastr, "break-dnssec") == 0) {
 			view->v4_aaaa = dns_aaaa_break_dnssec;
-		else
+		} else {
 			INSIST(0);
+			ISC_UNREACHABLE();
+		}
 	}

 	obj = NULL;
@@ -4564,10 +4598,12 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
 			view->v6_aaaa = dns_aaaa_ok;
 	} else {
 		const char *v6_aaaastr = cfg_obj_asstring(obj);
-		if (strcasecmp(v6_aaaastr, "break-dnssec") == 0)
+		if (strcasecmp(v6_aaaastr, "break-dnssec") == 0) {
 			view->v6_aaaa = dns_aaaa_break_dnssec;
-		else
+		} else {
 			INSIST(0);
+			ISC_UNREACHABLE();
+		}
 	}

 	CHECK(configure_view_acl(vconfig, config, ns_g_config,
@@ -4775,7 +4811,7 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
 		const char *empty_dbtype[4] =
 				    { "_builtin", "empty", NULL, NULL };
 		int empty_dbtypec = 4;
-		dns_zonestat_level_t statlevel;
+		dns_zonestat_level_t statlevel = dns_zonestat_none;

 		name = dns_fixedname_initname(&fixed);

@@ -4813,14 +4849,16 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
 				statlevel = dns_zonestat_none;
 		} else {
 			const char *levelstr = cfg_obj_asstring(obj);
-			if (strcasecmp(levelstr, "full") == 0)
+			if (strcasecmp(levelstr, "full") == 0) {
 				statlevel = dns_zonestat_full;
-			else if (strcasecmp(levelstr, "terse") == 0)
+			} else if (strcasecmp(levelstr, "terse") == 0) {
 				statlevel = dns_zonestat_terse;
-			else if (strcasecmp(levelstr, "none") == 0)
+			} else if (strcasecmp(levelstr, "none") == 0) {
 				statlevel = dns_zonestat_none;
-			else
+			} else {
 				INSIST(0);
+				ISC_UNREACHABLE();
+			}
 		}

 		for (empty = empty_zones[empty_zone];
@@ -5139,16 +5177,18 @@ configure_forward(const cfg_obj_t *config, dns_view_t *view, dns_name_t *origin,
 				    "forwarding");
 		fwdpolicy = dns_fwdpolicy_none;
 	} else {
-		if (forwardtype == NULL)
+		if (forwardtype == NULL) {
 			fwdpolicy = dns_fwdpolicy_first;
-		else {
+		} else {
 			const char *forwardstr = cfg_obj_asstring(forwardtype);
-			if (strcasecmp(forwardstr, "first") == 0)
+			if (strcasecmp(forwardstr, "first") == 0) {
 				fwdpolicy = dns_fwdpolicy_first;
-			else if (strcasecmp(forwardstr, "only") == 0)
+			} else if (strcasecmp(forwardstr, "only") == 0) {
 				fwdpolicy = dns_fwdpolicy_only;
-			else
+			} else {
 				INSIST(0);
+				ISC_UNREACHABLE();
+			}
 		}
 	}

@@ -7025,11 +7065,11 @@ data_to_cfg(dns_view_t *view, MDB_val *key, MDB_val *data,
 		goto cleanup;
 	}

-	putstr(text, "zone ");
-	putmem(text, (const void *) zone_name, zone_name_len);
-	putstr(text, " ");
-	putmem(text, (const void *) zone_config, zone_config_len);
-	putstr(text, ";\n");
+	CHECK(putstr(text, "zone "));
+	CHECK(putmem(text, (const void *) zone_name, zone_name_len));
+	CHECK(putstr(text, " "));
+	CHECK(putmem(text, (const void *) zone_config, zone_config_len));
+	CHECK(putstr(text, ";\n"));

 	cfg_parser_reset(ns_g_addparser);
 	result = cfg_parse_buffer3(ns_g_addparser, *text, zone_name, 0,
@@ -7592,7 +7632,7 @@ load_configuration(const char *filename, ns_server_t *server,
 	}
 	isc__socketmgr_setreserved(ns_g_socketmgr, reserved);

-#ifdef HAVE_GEOIP
+#if defined(HAVE_GEOIP) || defined(HAVE_GEOIP2)
 	/*
 	 * Initialize GeoIP databases from the configured location.
 	 * This should happen before configuring any ACLs, so that we
@@ -7605,8 +7645,6 @@ load_configuration(const char *filename, ns_server_t *server,
 		char *dir;
 		DE_CONST(cfg_obj_asstring(obj), dir);
 		ns_geoip_load(dir);
-	} else {
-		ns_geoip_load(NULL);
 	}
 	ns_g_aclconfctx->geoip = ns_g_geoip;

@@ -7614,7 +7652,7 @@ load_configuration(const char *filename, ns_server_t *server,
 	result = ns_config_get(maps, "geoip-use-ecs", &obj);
 	INSIST(result == ISC_R_SUCCESS);
 	ns_g_server->aclenv.geoip_use_ecs = cfg_obj_asboolean(obj);
-#endif /* HAVE_GEOIP */
+#endif /* HAVE_GEOIP || HAVE_GEOIP2 */

 	/*
 	 * Configure various server options.
@@ -8358,7 +8396,8 @@ load_configuration(const char *filename, ns_server_t *server,
 	    cfg_map_get(options, "memstatistics", &obj) == ISC_R_SUCCESS) {
 		ns_g_memstatistics = cfg_obj_asboolean(obj);
 	} else {
-		ns_g_memstatistics = (isc_mem_debugging & ISC_MEM_DEBUGRECORD);
+		ns_g_memstatistics =
+			((isc_mem_debugging & ISC_MEM_DEBUGRECORD) != 0);
 	}

 	obj = NULL;
@@ -8444,11 +8483,14 @@ load_configuration(const char *filename, ns_server_t *server,
 	obj = NULL;
 	result = ns_config_get(maps, "cookie-algorithm", &obj);
 	INSIST(result == ISC_R_SUCCESS);
-	if (strcasecmp(cfg_obj_asstring(obj), "aes") == 0) {
+	if (strcasecmp(cfg_obj_asstring(obj), "siphash24") == 0) {
+		server->cookiealg = ns_cookiealg_siphash24;
+	} else if (strcasecmp(cfg_obj_asstring(obj), "aes") == 0) {
 #if defined(HAVE_OPENSSL_AES) || defined(HAVE_OPENSSL_EVP_AES)
 		server->cookiealg = ns_cookiealg_aes;
 #else
 		INSIST(0);
+		ISC_UNREACHABLE();
 #endif
 	} else if (strcasecmp(cfg_obj_asstring(obj), "sha1") == 0) {
 		server->cookiealg = ns_cookiealg_sha1;
@@ -8456,6 +8498,7 @@ load_configuration(const char *filename, ns_server_t *server,
 		server->cookiealg = ns_cookiealg_sha256;
 	} else {
 		INSIST(0);
+		ISC_UNREACHABLE();
 	}

 	obj = NULL;
@@ -8505,11 +8548,16 @@ load_configuration(const char *filename, ns_server_t *server,

 			usedlength = isc_buffer_usedlength(&b);
 			switch (server->cookiealg) {
+			case ns_cookiealg_siphash24:
+				if (usedlength != ISC_SIPHASH24_KEY_LENGTH) {
+					CHECKM(ISC_R_RANGE,
+					       "SipHash-2-4 cookie-secret must be 128 bits");
+				}
+				break;
 			case ns_cookiealg_aes:
 				if (usedlength != ISC_AES128_KEYLENGTH) {
 					CHECKM(ISC_R_RANGE,
-					       "AES cookie-secret must be "
-					       "128 bits");
+					       "AES cookie-secret must be 128 bits");
 				}
 				break;
 			case ns_cookiealg_sha1:
@@ -8918,9 +8966,9 @@ shutdown_server(isc_task_t *task, isc_event_t *event) {
 #ifdef HAVE_DNSTAP
 	dns_dt_shutdown();
 #endif
-#ifdef HAVE_GEOIP
-	dns_geoip_shutdown();
-#endif
+#if defined(HAVE_GEOIP) || defined(HAVE_GEOIP2)
+	ns_geoip_shutdown();
+#endif /* HAVE_GEOIP || HAVE_GEOIP2 */

 	dns_db_detach(&server->in_roothints);

@@ -8953,7 +9001,7 @@ ns_server_create(isc_mem_t *mctx, ns_server_t **serverp) {
 	result = dns_aclenv_init(mctx, &server->aclenv);
 	RUNTIME_CHECK(result == ISC_R_SUCCESS);

-#ifdef HAVE_GEOIP
+#if defined(HAVE_GEOIP) || defined(HAVE_GEOIP2)
 	/* Initialize GeoIP before using ACL environment */
 	ns_geoip_init();
 	server->aclenv.geoip = ns_g_geoip;
@@ -10214,10 +10262,10 @@ ns_server_dumpdb(ns_server_t *server, isc_lex_t *lex, isc_buffer_t **text) {
 	}
 	if (ptr != NULL) {
 		if (!found) {
-			putstr(text, "view '");
-			putstr(text, ptr);
-			putstr(text, "' not found");
-			putnull(text);
+			CHECK(putstr(text, "view '"));
+			CHECK(putstr(text, ptr));
+			CHECK(putstr(text, "' not found"));
+			CHECK(putnull(text));
 			result = ISC_R_NOTFOUND;
 			dumpdone(dctx, result);
 			return (result);
@@ -11501,9 +11549,15 @@ nzd_setkey(MDB_val *key, dns_name_t *name, char *namebuf, size_t buflen) {

 static void
 dumpzone(void *arg, const char *buf, int len) {
-	isc_buffer_t **text = arg;
+	ns_dzarg_t *dzarg = arg;
+	isc_result_t result;

-	putmem(text, buf, len);
+	REQUIRE(dzarg != NULL && ISC_MAGIC_VALID(dzarg, DZARG_MAGIC));
+
+	result = putmem(dzarg->text, buf, len);
+	if (result != ISC_R_SUCCESS && dzarg->result == ISC_R_SUCCESS) {
+		dzarg->result = result;
+	}
 }

 static isc_result_t
@@ -11517,6 +11571,7 @@ nzd_save(MDB_txn **txnp, MDB_dbi dbi, dns_zone_t *zone,
 	isc_buffer_t *text = NULL;
 	char namebuf[1024];
 	MDB_val key, data;
+	ns_dzarg_t dzarg;

 	view = dns_zone_getview(zone);

@@ -11568,7 +11623,21 @@ nzd_save(MDB_txn **txnp, MDB_dbi dbi, dns_zone_t *zone,
 			goto cleanup;
 		}

-		cfg_printx(zoptions, CFG_PRINTER_ONELINE, dumpzone, &text);
+		dzarg.magic = DZARG_MAGIC;
+		dzarg.text = &text;
+		dzarg.result = ISC_R_SUCCESS;
+		cfg_printx(zoptions, CFG_PRINTER_ONELINE, dumpzone, &dzarg);
+		if (dzarg.result != ISC_R_SUCCESS) {
+			isc_log_write(ns_g_lctx,
+				      NS_LOGCATEGORY_GENERAL,
+				      NS_LOGMODULE_SERVER,
+				      ISC_LOG_ERROR,
+				      "Error writing zone config to "
+				      "buffer in nzd_save(): %s",
+				      isc_result_totext(result));
+			result = dzarg.result;
+			goto cleanup;
+		}

 		data.mv_data = isc_buffer_base(text);
 		data.mv_size = isc_buffer_usedlength(text);
@@ -11847,6 +11916,7 @@ migrate_nzf(dns_view_t *view) {
 	MDB_txn *txn = NULL;
 	MDB_dbi dbi;
 	MDB_val key, data;
+	ns_dzarg_t dzarg;

 	/*
 	 * If NZF file doesn't exist, or NZD DB exists and already
@@ -11936,7 +12006,21 @@ migrate_nzf(dns_view_t *view) {
 		}

 		isc_buffer_clear(text);
-		cfg_printx(zoptions, CFG_PRINTER_ONELINE, dumpzone, &text);
+		dzarg.magic = DZARG_MAGIC;
+		dzarg.text = &text;
+		dzarg.result = ISC_R_SUCCESS;
+		cfg_printx(zoptions, CFG_PRINTER_ONELINE, dumpzone, &dzarg);
+		if (dzarg.result != ISC_R_SUCCESS) {
+			isc_log_write(ns_g_lctx,
+				      NS_LOGCATEGORY_GENERAL,
+				      NS_LOGMODULE_SERVER,
+				      ISC_LOG_ERROR,
+				      "Error writing zone config to "
+				      "buffer in migrate_nzf(): %s",
+				      isc_result_totext(result));
+			result = dzarg.result;
+			goto cleanup;
+		}

 		data.mv_data = isc_buffer_base(text);
 		data.mv_size = isc_buffer_usedlength(text);
@@ -12005,7 +12089,7 @@ newzone_parse(ns_server_t *server, char *command, dns_view_t **viewp,
 	const char *viewname = NULL;
 	dns_rdataclass_t rdclass;
 	dns_view_t *view = NULL;
-	const char *bn;
+	const char *bn = NULL;

 	REQUIRE(viewp != NULL && *viewp == NULL);
 	REQUIRE(zoneobjp != NULL && *zoneobjp == NULL);
@@ -12015,12 +12099,14 @@ newzone_parse(ns_server_t *server, char *command, dns_view_t **viewp,
 	isc_buffer_init(&argbuf, command, (unsigned int) strlen(command));
 	isc_buffer_add(&argbuf, strlen(command));

-	if (strncasecmp(command, "add", 3) == 0)
+	if (strncasecmp(command, "add", 3) == 0) {
 		bn = "addzone";
-	else if (strncasecmp(command, "mod", 3) == 0)
+	} else if (strncasecmp(command, "mod", 3) == 0) {
 		bn = "modzone";
-	else
+	} else {
 		INSIST(0);
+		ISC_UNREACHABLE();
+	}

 	/*
 	 * Convert the "addzone" or "modzone" to just "zone", for
@@ -12978,8 +13064,14 @@ find_name_in_list_from_map(const cfg_obj_t *config,

 static void
 emitzone(void *arg, const char *buf, int len) {
-	isc_buffer_t **tpp = arg;
-	putmem(tpp, buf, len);
+	ns_dzarg_t *dzarg = arg;
+	isc_result_t result;
+
+	REQUIRE(dzarg != NULL && ISC_MAGIC_VALID(dzarg, DZARG_MAGIC));
+	result = putmem(dzarg->text, buf, len);
+	if (result != ISC_R_SUCCESS && dzarg->result == ISC_R_SUCCESS) {
+		dzarg->result = result;
+	}
 }

 /*
@@ -12998,6 +13090,7 @@ ns_server_showzone(ns_server_t *server, isc_lex_t *lex, isc_buffer_t **text) {
 #ifdef HAVE_LMDB
 	cfg_obj_t *nzconfig = NULL;
 #endif /* HAVE_LMDB */
+	ns_dzarg_t dzarg;

 	/* Parse parameters */
 	CHECK(zone_from_args(server, lex, NULL, &zone, zonename,
@@ -13050,9 +13143,14 @@ ns_server_showzone(ns_server_t *server, isc_lex_t *lex, isc_buffer_t **text) {
 	if (zconfig == NULL)
 		CHECK(ISC_R_NOTFOUND);

-	putstr(text, "zone ");
-	cfg_printx(zconfig, CFG_PRINTER_ONELINE, emitzone, text);
-	putstr(text, ";");
+	CHECK(putstr(text, "zone "));
+	dzarg.magic = DZARG_MAGIC;
+	dzarg.text = text;
+	dzarg.result = ISC_R_SUCCESS;
+	cfg_printx(zconfig, CFG_PRINTER_ONELINE, emitzone, &dzarg);
+	CHECK(dzarg.result);
+
+	CHECK(putstr(text, ";"));

 	result = ISC_R_SUCCESS;

@@ -13442,8 +13540,8 @@ ns_server_zonestatus(ns_server_t *server, isc_lex_t *lex,

 	/* Security */
 	secure = dns_db_issecure(db);
-	allow = (dns_zone_getkeyopts(zone) & DNS_ZONEKEY_ALLOW);
-	maintain = (dns_zone_getkeyopts(zone) & DNS_ZONEKEY_MAINTAIN);
+	allow = ((dns_zone_getkeyopts(zone) & DNS_ZONEKEY_ALLOW) != 0);
+	maintain = ((dns_zone_getkeyopts(zone) & DNS_ZONEKEY_MAINTAIN) != 0);

 	/* Master files */
 	file = dns_zone_getfile(mayberaw);
@@ -13888,7 +13986,7 @@ ns_server_nta(ns_server_t *server, isc_lex_t *lex, bool readonly,
 		}
 	}

-	CHECK(putnull(text));
+	(void) putnull(text);

 cleanup:
 	if (msg != NULL) {
@@ -14030,7 +14128,7 @@ mkey_dumpzone(dns_view_t *view, isc_buffer_t **text) {
 			snprintf(buf, sizeof(buf), "\n\talgorithm: %s", alg);
 			CHECK(putstr(text, buf));

-			revoked = (kd.flags & DNS_KEYFLAG_REVOKE);
+			revoked = ((kd.flags & DNS_KEYFLAG_REVOKE) != 0);
 			snprintf(buf, sizeof(buf), "\n\tflags:%s%s%s",
 				 revoked ? " REVOKE" : "",
 				 ((kd.flags & DNS_KEYFLAG_KSK) != 0)
@@ -14122,21 +14220,23 @@ ns_server_mkeys(ns_server_t *server, isc_lex_t *lex, isc_buffer_t **text) {

 	/* Skip rndc command name */
 	cmd = next_token(lex, text);
-	if (cmd == NULL)
+	if (cmd == NULL) {
 		return (ISC_R_UNEXPECTEDEND);
+	}

 	/* Get managed-keys subcommand */
 	cmd = next_token(lex, text);
-	if (cmd == NULL)
+	if (cmd == NULL) {
 		return (ISC_R_UNEXPECTEDEND);
+	}

-	if (strcasecmp(cmd, "status") == 0)
+	if (strcasecmp(cmd, "status") == 0) {
 		opt = STATUS;
-	else if (strcasecmp(cmd, "refresh") == 0)
+	} else if (strcasecmp(cmd, "refresh") == 0) {
 		opt = REFRESH;
-	else if (strcasecmp(cmd, "sync") == 0)
+	} else if (strcasecmp(cmd, "sync") == 0) {
 		opt = SYNC;
-	else {
+	} else {
 		snprintf(msg, sizeof(msg), "unknown command '%s'", cmd);
 		(void) putstr(text, msg);
 		result = ISC_R_UNEXPECTED;
@@ -14146,29 +14246,17 @@ ns_server_mkeys(ns_server_t *server, isc_lex_t *lex, isc_buffer_t **text) {
 	/* Look for the optional class name. */
 	classtxt = next_token(lex, text);
 	if (classtxt != NULL) {
-		/* Look for the optional view name. */
-		viewtxt = next_token(lex, text);
-	}
-
-	if (classtxt == NULL) {
-		rdclass = dns_rdataclass_in;
-	} else {
 		isc_textregion_t r;
 		r.base = classtxt;
 		r.length = strlen(classtxt);
 		result = dns_rdataclass_fromtext(&rdclass, &r);
 		if (result != ISC_R_SUCCESS) {
-			if (viewtxt == NULL) {
-				rdclass = dns_rdataclass_in;
-				viewtxt = classtxt;
-				result = ISC_R_SUCCESS;
-			} else {
-				snprintf(msg, sizeof(msg),
-					 "unknown class '%s'", classtxt);
-				(void) putstr(text, msg);
-				goto cleanup;
-			}
+			snprintf(msg, sizeof(msg),
+				 "unknown class '%s'", classtxt);
+			(void) putstr(text, msg);
+			goto cleanup;
 		}
+		viewtxt = next_token(lex, text);
 	}

 	for (view = ISC_LIST_HEAD(server->viewlist);
@@ -14178,7 +14266,9 @@ ns_server_mkeys(ns_server_t *server, isc_lex_t *lex, isc_buffer_t **text) {
 		if (viewtxt != NULL &&
 		    (rdclass != view->rdclass ||
 		     strcmp(view->name, viewtxt) != 0))
+		{
 			continue;
+		}

 		if (view->managed_keys == NULL) {
 			if (viewtxt != NULL) {
@@ -14186,35 +14276,44 @@ ns_server_mkeys(ns_server_t *server, isc_lex_t *lex, isc_buffer_t **text) {
 					 "view '%s': no managed keys", viewtxt);
 				CHECK(putstr(text, msg));
 				goto cleanup;
-			} else
+			} else {
 				continue;
+			}
 		}

 		found = true;

 		switch (opt) {
 		case REFRESH:
+			if (!first) {
+				CHECK(putstr(text, "\n"));
+			}
 			CHECK(mkey_refresh(view, text));
 			break;
 		case STATUS:
-			if (!first)
+			if (!first) {
 				CHECK(putstr(text, "\n\n"));
+			}
 			CHECK(mkey_status(view, text));
-			first = false;
 			break;
 		case SYNC:
 			CHECK(dns_zone_flush(view->managed_keys));
 			break;
 		default:
 			INSIST(0);
+			ISC_UNREACHABLE();
 		}

-		if (viewtxt != NULL)
+		if (viewtxt != NULL) {
 			break;
+		}
+
+		first = false;
 	}

-	if (!found)
+	if (!found) {
 		CHECK(putstr(text, "no views with managed keys"));
+	}

 cleanup:
 	if (isc_buffer_usedlength(*text) > 0)
@@ -17,7 +17,9 @@
 #include <stdbool.h>
 #include <stdlib.h>
 #include <string.h>
+#if HAVE_DLFCN_H
 #include <dlfcn.h>
+#endif

 #include <dns/log.h>
 #include <dns/result.h>
@@ -259,7 +261,7 @@ dlopen_dlz_create(const char *dlzname, unsigned int argc, char *argv[],
 	/* Open the library */
 	dlopen_flags = RTLD_NOW|RTLD_GLOBAL;

-#ifdef RTLD_DEEPBIND
+#if defined(RTLD_DEEPBIND) && !__SANITIZE_ADDRESS__
 	/*
 	 * If RTLD_DEEPBIND is available then use it. This can avoid
 	 * issues with a module using a different version of a system
@@ -267,24 +267,34 @@ update_log(ns_client_t *client, dns_zone_t *zone,
 	char namebuf[DNS_NAME_FORMATSIZE];
 	char classbuf[DNS_RDATACLASS_FORMATSIZE];

-	if (client == NULL || zone == NULL)
+	if (client == NULL) {
 		return;
+	}

-	if (isc_log_wouldlog(ns_g_lctx, level) == false)
+	if (isc_log_wouldlog(ns_g_lctx, level) == false) {
 		return;
-
-	dns_name_format(dns_zone_getorigin(zone), namebuf,
-			sizeof(namebuf));
-	dns_rdataclass_format(dns_zone_getclass(zone), classbuf,
-			      sizeof(classbuf));
+	}

 	va_start(ap, fmt);
 	vsnprintf(message, sizeof(message), fmt, ap);
 	va_end(ap);

-	ns_client_log(client, NS_LOGCATEGORY_UPDATE, NS_LOGMODULE_UPDATE,
-		      level, "updating zone '%s/%s': %s",
-		      namebuf, classbuf, message);
+	if (zone != NULL) {
+		dns_name_format(dns_zone_getorigin(zone), namebuf,
+				sizeof(namebuf));
+		dns_rdataclass_format(dns_zone_getclass(zone), classbuf,
+				      sizeof(classbuf));
+
+		ns_client_log(client, NS_LOGCATEGORY_UPDATE,
+			      NS_LOGMODULE_UPDATE,
+			      level, "updating zone '%s/%s': %s",
+			      namebuf, classbuf, message);
+	} else {
+		ns_client_log(client, NS_LOGCATEGORY_UPDATE,
+			      NS_LOGMODULE_UPDATE,
+			      level, "%s", message);
+	}
+
 }

 static void
@@ -786,8 +796,10 @@ static isc_result_t
 cname_compatibility_action(void *data, dns_rdataset_t *rrset) {
 	UNUSED(data);
 	if (rrset->type != dns_rdatatype_cname &&
-	    ! dns_rdatatype_isdnssec(rrset->type))
+	    ! dns_rdatatype_atcname(rrset->type))
+	{
 		return (ISC_R_EXISTS);
+	}
 	return (ISC_R_SUCCESS);
 }

@@ -2834,7 +2846,7 @@ update_action(isc_task_t *task, isc_event_t *event) {
 						   dns_rdatatype_cname, 0,
 						   &flag));
 				if (flag &&
-				    ! dns_rdatatype_isdnssec(rdata.type))
+				    ! dns_rdatatype_atcname(rdata.type))
 				{
 					update_log(client, zone,
 						   LOGLEVEL_PROTOCOL,
@@ -44,6 +44,11 @@
      <Filter>Source Files</Filter>
    </ClCompile>
@END GEOIP
+@IF GEOIPLEGACY
+    <ClCompile Include="..\geoip.c">
+      <Filter>Source Files</Filter>
+    </ClCompile>
+@END GEOIPLEGACY
    <ClCompile Include="..\interfacemgr.c">
      <Filter>Source Files</Filter>
    </ClCompile>
@@ -141,6 +146,11 @@
      <Filter>Header Files</Filter>
    </ClInclude>
@END GEOIP
+@IF GEOIPLEGACY
+    <ClInclude Include="..\include\named\geoip.h">
+      <Filter>Header Files</Filter>
+    </ClInclude>
+@END GEOIPLEGACY
    <ClInclude Include="..\include\named\globals.h">
      <Filter>Header Files</Filter>
    </ClInclude>
@@ -110,6 +110,9 @@
@IF GEOIP
    <ClCompile Include="..\geoip.c" />
@END GEOIP
+@IF GEOIPLEGACY
+    <ClCompile Include="..\geoip.c" />
+@END GEOIPLEGACY
    <ClCompile Include="..\interfacemgr.c" />
    <ClCompile Include="..\listenlist.c" />
    <ClCompile Include="..\log.c" />
@@ -146,6 +149,9 @@
@IF GEOIP
    <ClInclude Include="..\include\named\geoip.h" />
@END GEOIP
+@IF GEOIPLEGACY
+    <ClInclude Include="..\include\named\geoip.h" />
+@END GEOIPLEGACY
    <ClInclude Include="..\include\named\globals.h" />
    <ClInclude Include="..\include\named\interfacemgr.h" />
    <ClInclude Include="..\include\named\listenlist.h" />
@@ -82,7 +82,7 @@ ServiceControl(DWORD dwCtrlCode) {
 	case SERVICE_CONTROL_STOP:
 		ns_server_flushonshutdown(ns_g_server, true);
 		isc_app_shutdown();
-		UpdateSCM(SERVICE_STOPPED);
+		UpdateSCM(SERVICE_STOP_PENDING);
 		break;
 	default:
 		break;
@@ -350,9 +350,9 @@ ns_os_shutdown(void) {
 	if (lockfilefd != -1) {
 		(void) UnlockFile((HANDLE) _get_osfhandle(lockfilefd),
 				  0, 0, 0, 1);
-		close(lockfilefd);
-		lockfilefd = -1;
 	}
+	cleanup_lockfile();
+
 	ntservice_shutdown();	/* This MUST be the last thing done */
 }

@@ -9,8 +9,6 @@
 * information regarding copyright ownership.
 */

-/* $Id$ */
-
 #include <config.h>

 #include <inttypes.h>
@@ -765,7 +763,7 @@ ns_xfr_start(ns_client_t *client, dns_rdatatype_t reqtype) {
 		break;
 	default:
 		INSIST(0);
-		break;
+		ISC_UNREACHABLE();
 	}

 	ns_client_log(client,
@@ -797,11 +795,13 @@ ns_xfr_start(ns_client_t *client, dns_rdatatype_t reqtype) {
 	question_rdataset = ISC_LIST_HEAD(question_name->list);
 	question_class = question_rdataset->rdclass;
 	INSIST(question_rdataset->type == reqtype);
-	if (ISC_LIST_NEXT(question_rdataset, link) != NULL)
+	if (ISC_LIST_NEXT(question_rdataset, link) != NULL) {
 		FAILC(DNS_R_FORMERR, "multiple questions");
+	}
 	result = dns_message_nextname(request, DNS_SECTION_QUESTION);
-	if (result != ISC_R_NOMORE)
+	if (result != ISC_R_NOMORE) {
 		FAILC(DNS_R_FORMERR, "multiple questions");
+	}

 	result = dns_zt_find(client->view->zonetable, question_name, 0, NULL,
 			     &zone);
@@ -880,8 +880,9 @@ ns_xfr_start(ns_client_t *client, dns_rdatatype_t reqtype) {
 		/*
 		 * Ignore data whose owner name is not the zone apex.
 		 */
-		if (! dns_name_equal(soa_name, question_name))
+		if (! dns_name_equal(soa_name, question_name)) {
 			continue;
+		}

 		for (soa_rdataset = ISC_LIST_HEAD(soa_name->list);
 		     soa_rdataset != NULL;
@@ -890,25 +891,29 @@ ns_xfr_start(ns_client_t *client, dns_rdatatype_t reqtype) {
 			/*
 			 * Ignore non-SOA data.
 			 */
-			if (soa_rdataset->type != dns_rdatatype_soa)
+			if (soa_rdataset->type != dns_rdatatype_soa) {
 				continue;
-			if (soa_rdataset->rdclass != question_class)
+			}
+			if (soa_rdataset->rdclass != question_class) {
 				continue;
+			}

 			CHECK(dns_rdataset_first(soa_rdataset));
 			dns_rdataset_current(soa_rdataset, &soa_rdata);
 			result = dns_rdataset_next(soa_rdataset);
-			if (result == ISC_R_SUCCESS)
+			if (result == ISC_R_SUCCESS) {
 				FAILC(DNS_R_FORMERR,
 				      "IXFR authority section "
 				      "has multiple SOAs");
+			}
 			have_soa = true;
 			goto got_soa;
 		}
 	}
 got_soa:
-	if (result != ISC_R_NOMORE)
+	if (result != ISC_R_NOMORE) {
 		CHECK(result);
+	}

 	xfrout_log1(client, question_name, question_class, ISC_LOG_DEBUG(6),
 		    "%s authority section OK", mnemonic);
@@ -928,8 +933,9 @@ ns_xfr_start(ns_client_t *client, dns_rdatatype_t reqtype) {
 	 * AXFR over UDP is not possible.
 	 */
 	if (reqtype == dns_rdatatype_axfr &&
-	    (client->attributes & NS_CLIENTATTR_TCP) == 0)
+	    (client->attributes & NS_CLIENTATTR_TCP) == 0) {
 		FAILC(DNS_R_FORMERR, "attempted AXFR over UDP");
+	}

 	/*
 	 * Look up the requesting server in the peer table.
@@ -940,8 +946,9 @@ ns_xfr_start(ns_client_t *client, dns_rdatatype_t reqtype) {
 	/*
 	 * Decide on the transfer format (one-answer or many-answers).
 	 */
-	if (peer != NULL)
+	if (peer != NULL) {
 		(void)dns_peer_gettransferformat(peer, &format);
+	}

 	/*
 	 * Get a dynamically allocated copy of the current SOA.
@@ -954,21 +961,27 @@ ns_xfr_start(ns_client_t *client, dns_rdatatype_t reqtype) {

 	current_serial = dns_soa_getserial(&current_soa_tuple->rdata);
 	if (reqtype == dns_rdatatype_ixfr) {
-		bool provide_ixfr;
-
 		/*
 		 * Outgoing IXFR may have been disabled for this peer
 		 * or globally.
 		 */
-		provide_ixfr = client->view->provideixfr;
-		if (peer != NULL)
-			(void) dns_peer_getprovideixfr(peer, &provide_ixfr);
-		if (provide_ixfr == false)
-			goto axfr_fallback;
+		if ((client->attributes & NS_CLIENTATTR_TCP) != 0) {
+			bool provide_ixfr;

-		if (! have_soa)
+			provide_ixfr = client->view->provideixfr;
+			if (peer != NULL) {
+				(void) dns_peer_getprovideixfr(peer,
+							       &provide_ixfr);
+			}
+			if (provide_ixfr == false) {
+				goto axfr_fallback;
+			}
+		}
+
+		if (! have_soa) {
 			FAILC(DNS_R_FORMERR,
 			      "IXFR request missing SOA");
+		}

 		begin_serial = dns_soa_getserial(&soa_rdata);

@@ -991,16 +1004,16 @@ ns_xfr_start(ns_client_t *client, dns_rdatatype_t reqtype) {
 			goto have_stream;
 		}
 		journalfile = is_dlz ? NULL : dns_zone_getjournal(zone);
-		if (journalfile != NULL)
+		if (journalfile != NULL) {
 			result = ixfr_rrstream_create(mctx,
 						      journalfile,
 						      begin_serial,
 						      current_serial,
 						      &data_stream);
-		else
+		} else {
 			result = ISC_R_NOTFOUND;
-		if (result == ISC_R_NOTFOUND ||
-		    result == ISC_R_RANGE) {
+		}
+		if (result == ISC_R_NOTFOUND || result == ISC_R_RANGE) {
 			xfrout_log1(client, question_name, question_class,
 				    ISC_LOG_DEBUG(4),
 				    "IXFR version not in journal, "
@@ -1033,7 +1046,7 @@ ns_xfr_start(ns_client_t *client, dns_rdatatype_t reqtype) {



-	if (is_dlz)
+	if (is_dlz) {
 		CHECK(xfrout_ctx_create(mctx, client, request->id,
 					question_name, reqtype, question_class,
 					zone, db, ver, quota, stream,
@@ -1045,7 +1058,7 @@ ns_xfr_start(ns_client_t *client, dns_rdatatype_t reqtype) {
 					(format == dns_many_answers) ?
 					true : false,
 					&xfr));
-	else
+	} else {
 		CHECK(xfrout_ctx_create(mctx, client, request->id,
 					question_name, reqtype, question_class,
 					zone, db, ver, quota, stream,
@@ -1057,6 +1070,7 @@ ns_xfr_start(ns_client_t *client, dns_rdatatype_t reqtype) {
 					(format == dns_many_answers) ?
 					true : false,
 					&xfr));
+	}

 	xfr->mnemonic = mnemonic;
 	stream = NULL;
@@ -1064,24 +1078,26 @@ ns_xfr_start(ns_client_t *client, dns_rdatatype_t reqtype) {

 	CHECK(xfr->stream->methods->first(xfr->stream));

-	if (xfr->tsigkey != NULL)
+	if (xfr->tsigkey != NULL) {
 		dns_name_format(&xfr->tsigkey->name, keyname, sizeof(keyname));
-	else
+	} else {
 		keyname[0] = '\0';
-	if (is_poll)
+	}
+	if (is_poll) {
 		xfrout_log1(client, question_name, question_class,
 			    ISC_LOG_DEBUG(1), "IXFR poll up to date%s%s",
 			    (xfr->tsigkey != NULL) ? ": TSIG " : "", keyname);
-	else if (is_ixfr)
+	} else if (is_ixfr) {
 		xfrout_log1(client, question_name, question_class,
 			    ISC_LOG_INFO, "%s started%s%s (serial %u -> %u)",
 			    mnemonic, (xfr->tsigkey != NULL) ? ": TSIG " : "",
 			    keyname, begin_serial, current_serial);
-	else
+	} else {
 		xfrout_log1(client, question_name, question_class,
 			    ISC_LOG_INFO, "%s started%s%s (serial %u)",
 			    mnemonic, (xfr->tsigkey != NULL) ? ": TSIG " : "",
 			    keyname, current_serial);
+	}


 	if (zone != NULL) {
@@ -1098,8 +1114,9 @@ ns_xfr_start(ns_client_t *client, dns_rdatatype_t reqtype) {
 				client->expire = secs - client->now;
 			}
 		}
-		if (raw != NULL)
+		if (raw != NULL) {
 			dns_zone_detach(&raw);
+		}
 	}

 	/*
@@ -1113,24 +1130,33 @@ ns_xfr_start(ns_client_t *client, dns_rdatatype_t reqtype) {
 	result = ISC_R_SUCCESS;

 failure:
-	if (result == DNS_R_REFUSED)
+	if (result == DNS_R_REFUSED) {
 		inc_stats(zone, dns_nsstatscounter_xfrrej);
-	if (quota != NULL)
+	}
+	if (quota != NULL) {
 		isc_quota_detach(&quota);
-	if (current_soa_tuple != NULL)
+	}
+	if (current_soa_tuple != NULL) {
 		dns_difftuple_free(&current_soa_tuple);
-	if (stream != NULL)
+	}
+	if (stream != NULL) {
 		stream->methods->destroy(&stream);
-	if (soa_stream != NULL)
+	}
+	if (soa_stream != NULL) {
 		soa_stream->methods->destroy(&soa_stream);
-	if (data_stream != NULL)
+	}
+	if (data_stream != NULL) {
 		data_stream->methods->destroy(&data_stream);
-	if (ver != NULL)
+	}
+	if (ver != NULL) {
 		dns_db_closeversion(db, &ver, false);
-	if (db != NULL)
+	}
+	if (db != NULL) {
 		dns_db_detach(&db);
-	if (zone != NULL)
+	}
+	if (zone != NULL) {
 		dns_zone_detach(&zone);
+	}
 	/* XXX kludge */
 	if (xfr != NULL) {
 		xfrout_fail(xfr, result, "setting up zone transfer");
@@ -1281,7 +1307,7 @@ sendstream(xfrout_ctx_t *xfr) {
 	isc_buffer_clear(&xfr->txlenbuf);
 	isc_buffer_clear(&xfr->txbuf);

-	is_tcp = (xfr->client->attributes & NS_CLIENTATTR_TCP);
+	is_tcp = ((xfr->client->attributes & NS_CLIENTATTR_TCP) != 0);
 	if (!is_tcp) {
 		/*
 		 * In the UDP case, we put the response data directly into
@@ -122,7 +122,7 @@ configure_zone_acl(const cfg_obj_t *zconfig, const cfg_obj_t *vconfig,
 		break;
 	    default:
 		INSIST(0);
-		return (ISC_R_FAILURE);
+		ISC_UNREACHABLE();
 	}

 	/* First check to see if ACL is defined within the zone */
@@ -228,12 +228,14 @@ configure_zone_ssutable(const cfg_obj_t *zconfig, dns_zone_t *zone,
 		unsigned int i, n;

 		str = cfg_obj_asstring(mode);
-		if (strcasecmp(str, "grant") == 0)
+		if (strcasecmp(str, "grant") == 0) {
 			grant = true;
-		else if (strcasecmp(str, "deny") == 0)
+		} else if (strcasecmp(str, "deny") == 0) {
 			grant = false;
-		else
+		} else {
 			INSIST(0);
+			ISC_UNREACHABLE();
+		}

 		str = cfg_obj_asstring(matchtype);
 		CHECK(dns_ssu_mtypefromstring(str, &mtype));
@@ -753,6 +755,7 @@ checknames(dns_zonetype_t ztype, const cfg_obj_t **maps,
 	case dns_zone_master: zone = "master"; break;
 	default:
 		INSIST(0);
+		ISC_UNREACHABLE();
 	}
 	result = ns_checknames_get(maps, zone, objp);
 	INSIST(result == ISC_R_SUCCESS && objp != NULL && *objp != NULL);
@@ -796,7 +799,7 @@ ns_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 	const dns_master_style_t *masterstyle = &dns_master_style_default;
 	isc_stats_t *zoneqrystats;
 	dns_stats_t *rcvquerystats;
-	dns_zonestat_level_t statlevel;
+	dns_zonestat_level_t statlevel = dns_zonestat_none;
 	int seconds;
 	dns_zone_t *mayberaw = (raw != NULL) ? raw : zone;
 	isc_dscp_t dscp;
@@ -920,14 +923,16 @@ ns_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 	if (result == ISC_R_SUCCESS) {
 		const char *masterformatstr = cfg_obj_asstring(obj);

-		if (strcasecmp(masterformatstr, "text") == 0)
+		if (strcasecmp(masterformatstr, "text") == 0) {
 			masterformat = dns_masterformat_text;
-		else if (strcasecmp(masterformatstr, "raw") == 0)
+		} else if (strcasecmp(masterformatstr, "raw") == 0) {
 			masterformat = dns_masterformat_raw;
-		else if (strcasecmp(masterformatstr, "map") == 0)
+		} else if (strcasecmp(masterformatstr, "map") == 0) {
 			masterformat = dns_masterformat_map;
-		else
+		} else {
 			INSIST(0);
+			ISC_UNREACHABLE();
+		}
 	}

 	obj = NULL;
@@ -943,12 +948,14 @@ ns_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 			return (ISC_R_FAILURE);
 		}

-		if (strcasecmp(masterstylestr, "full") == 0)
+		if (strcasecmp(masterstylestr, "full") == 0) {
 			masterstyle = &dns_master_style_full;
-		else if (strcasecmp(masterstylestr, "relative") == 0)
+		} else if (strcasecmp(masterstylestr, "relative") == 0) {
 			masterstyle = &dns_master_style_default;
-		else
+		} else {
 			INSIST(0);
+			ISC_UNREACHABLE();
+		}
 	}

 	obj = NULL;
@@ -1034,16 +1041,18 @@ ns_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 			dialup = dns_dialuptype_no;
 	} else {
 		const char *dialupstr = cfg_obj_asstring(obj);
-		if (strcasecmp(dialupstr, "notify") == 0)
+		if (strcasecmp(dialupstr, "notify") == 0) {
 			dialup = dns_dialuptype_notify;
-		else if (strcasecmp(dialupstr, "notify-passive") == 0)
+		} else if (strcasecmp(dialupstr, "notify-passive") == 0) {
 			dialup = dns_dialuptype_notifypassive;
-		else if (strcasecmp(dialupstr, "refresh") == 0)
+		} else if (strcasecmp(dialupstr, "refresh") == 0) {
 			dialup = dns_dialuptype_refresh;
-		else if (strcasecmp(dialupstr, "passive") == 0)
+		} else if (strcasecmp(dialupstr, "passive") == 0) {
 			dialup = dns_dialuptype_passive;
-		else
+		} else {
 			INSIST(0);
+			ISC_UNREACHABLE();
+		}
 	}
 	if (raw != NULL)
 		dns_zone_setdialup(raw, dialup);
@@ -1059,14 +1068,16 @@ ns_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 			statlevel = dns_zonestat_none;
 	} else {
 		const char *levelstr = cfg_obj_asstring(obj);
-		if (strcasecmp(levelstr, "full") == 0)
+		if (strcasecmp(levelstr, "full") == 0) {
 			statlevel = dns_zonestat_full;
-		else if (strcasecmp(levelstr, "terse") == 0)
+		} else if (strcasecmp(levelstr, "terse") == 0) {
 			statlevel = dns_zonestat_terse;
-		else if (strcasecmp(levelstr, "none") == 0)
+		} else if (strcasecmp(levelstr, "none") == 0) {
 			statlevel = dns_zonestat_none;
-		else
+		} else {
 			INSIST(0);
+			ISC_UNREACHABLE();
+		}
 	}
 	dns_zone_setstatlevel(zone, statlevel);

@@ -1104,12 +1115,14 @@ ns_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 				notifytype = dns_notifytype_no;
 		} else {
 			const char *notifystr = cfg_obj_asstring(obj);
-			if (strcasecmp(notifystr, "explicit") == 0)
+			if (strcasecmp(notifystr, "explicit") == 0) {
 				notifytype = dns_notifytype_explicit;
-			else if (strcasecmp(notifystr, "master-only") == 0)
+			} else if (strcasecmp(notifystr, "master-only") == 0) {
 				notifytype = dns_notifytype_masteronly;
-			else
+			} else {
 				INSIST(0);
+				ISC_UNREACHABLE();
+			}
 		}
 		if (raw != NULL)
 			dns_zone_setnotifytype(raw, dns_notifytype_no);
@@ -1250,8 +1263,10 @@ ns_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 			fail = check = true;
 		} else if (strcasecmp(cfg_obj_asstring(obj), "ignore") == 0) {
 			fail = check = false;
-		} else
+		} else {
 			INSIST(0);
+			ISC_UNREACHABLE();
+		}
 		if (raw != NULL) {
 			dns_zone_setoption(raw, DNS_ZONEOPT_CHECKNAMES,
 					   check);
@@ -1286,8 +1301,10 @@ ns_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 			check = true;
 		} else if (strcasecmp(cfg_obj_asstring(obj), "ignore") == 0) {
 			check = false;
-		} else
+		} else {
 			INSIST(0);
+			ISC_UNREACHABLE();
+		}
 		dns_zone_setoption(zone, DNS_ZONEOPT_CHECKSPF, check);

 		obj = NULL;
@@ -1424,14 +1441,16 @@ ns_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 		result = cfg_map_get(zoptions, "auto-dnssec", &obj);
 		if (result == ISC_R_SUCCESS) {
 			const char *arg = cfg_obj_asstring(obj);
-			if (strcasecmp(arg, "allow") == 0)
+			if (strcasecmp(arg, "allow") == 0) {
 				allow = true;
-			else if (strcasecmp(arg, "maintain") == 0)
+			} else if (strcasecmp(arg, "maintain") == 0) {
 				allow = maint = true;
-			else if (strcasecmp(arg, "off") == 0)
+			} else if (strcasecmp(arg, "off") == 0) {
 				;
-			else
+			} else {
 				INSIST(0);
+				ISC_UNREACHABLE();
+			}
 			dns_zone_setkeyopt(zone, DNS_ZONEKEY_ALLOW, allow);
 			dns_zone_setkeyopt(zone, DNS_ZONEKEY_MAINTAIN, maint);
 		}
@@ -1482,8 +1501,10 @@ ns_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 			fail = check = true;
 		} else if (strcasecmp(dupcheck, "ignore") == 0) {
 			fail = check = false;
-		} else
+		} else {
 			INSIST(0);
+			ISC_UNREACHABLE();
+		}
 		dns_zone_setoption(mayberaw, DNS_ZONEOPT_CHECKDUPRR, check);
 		dns_zone_setoption(mayberaw, DNS_ZONEOPT_CHECKDUPRRFAIL, fail);

@@ -1497,8 +1518,10 @@ ns_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 			fail = check = true;
 		} else if (strcasecmp(cfg_obj_asstring(obj), "ignore") == 0) {
 			fail = check = false;
-		} else
+		} else {
 			INSIST(0);
+			ISC_UNREACHABLE();
+		}
 		dns_zone_setoption(mayberaw, DNS_ZONEOPT_CHECKMX, check);
 		dns_zone_setoption(mayberaw, DNS_ZONEOPT_CHECKMXFAIL, fail);

@@ -1533,8 +1556,10 @@ ns_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 			warn = ignore = false;
 		} else if (strcasecmp(cfg_obj_asstring(obj), "ignore") == 0) {
 			warn = ignore = true;
-		} else
+		} else {
 			INSIST(0);
+			ISC_UNREACHABLE();
+		}
 		dns_zone_setoption(mayberaw, DNS_ZONEOPT_WARNMXCNAME, warn);
 		dns_zone_setoption(mayberaw, DNS_ZONEOPT_IGNOREMXCNAME, ignore);

@@ -1548,8 +1573,10 @@ ns_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 			warn = ignore = false;
 		} else if (strcasecmp(cfg_obj_asstring(obj), "ignore") == 0) {
 			warn = ignore = true;
-		} else
+		} else {
 			INSIST(0);
+			ISC_UNREACHABLE();
+		}
 		dns_zone_setoption(mayberaw, DNS_ZONEOPT_WARNSRVCNAME, warn);
 		dns_zone_setoption(mayberaw, DNS_ZONEOPT_IGNORESRVCNAME,
 				   ignore);
@@ -1564,13 +1591,15 @@ ns_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 		result = cfg_map_get(zoptions, "dnssec-update-mode", &obj);
 		if (result == ISC_R_SUCCESS) {
 			const char *arg = cfg_obj_asstring(obj);
-			if (strcasecmp(arg, "no-resign") == 0)
+			if (strcasecmp(arg, "no-resign") == 0) {
 				dns_zone_setkeyopt(zone, DNS_ZONEKEY_NORESIGN,
 						   true);
-			else if (strcasecmp(arg, "maintain") == 0)
+			} else if (strcasecmp(arg, "maintain") == 0) {
 				;
-			else
+			} else {
 				INSIST(0);
+				ISC_UNREACHABLE();
+			}
 		}

 		obj = NULL;
@@ -7,8 +7,6 @@
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.

-# $Id: Makefile.in,v 1.36 2009/12/05 23:31:40 each Exp $
-
 srcdir =	@srcdir@
 VPATH =		@srcdir@
 top_srcdir =	@top_srcdir@
@@ -29,7 +27,7 @@ CDEFINES =	-DVERSION=\"${VERSION}\" @CRYPTO@ @USE_GSSAPI@
 CWARNINGS =

 LWRESLIBS =	../../lib/lwres/liblwres.@A@
-DNSLIBS =	../../lib/dns/libdns.@A@ @DNS_CRYPTO_LIBS@
+DNSLIBS =	../../lib/dns/libdns.@A@ ${MAXMINDDB_LIBS} @DNS_CRYPTO_LIBS@
 BIND9LIBS =	../../lib/bind9/libbind9.@A@
 ISCLIBS =	../../lib/isc/libisc.@A@
 ISCNOSYMLIBS =	../../lib/isc/libisc-nosymtbl.@A@
@@ -33,6 +33,7 @@
 #include <isc/log.h>
 #include <isc/mem.h>
 #include <isc/parseint.h>
+#include <isc/portset.h>
 #include <isc/print.h>
 #include <isc/random.h>
 #include <isc/region.h>
@@ -158,8 +159,8 @@ static dns_fixedname_t fuserzone;
 static dns_fixedname_t fzname;
 static dns_name_t *userzone = NULL;
 static dns_name_t *zname = NULL;
-static dns_name_t tmpzonename;
-static dns_name_t restart_master;
+static dns_name_t tmpzonename = DNS_NAME_INITEMPTY;
+static dns_name_t restart_master = DNS_NAME_INITEMPTY;
 static dns_tsig_keyring_t *gssring = NULL;
 static dns_tsigkey_t *tsigkey = NULL;
 static dst_key_t *sig0key = NULL;
@@ -850,6 +851,34 @@ shutdown_program(isc_task_t *task, isc_event_t *event) {
 	maybeshutdown();
 }

+/*
+ * Try honoring the operating system's preferred ephemeral port range.
+ */
+static void
+set_source_ports(dns_dispatchmgr_t *manager) {
+	isc_portset_t *v4portset = NULL, *v6portset = NULL;
+	in_port_t udpport_low, udpport_high;
+	isc_result_t result;
+
+	result = isc_portset_create(gmctx, &v4portset);
+	check_result(result, "isc_portset_create (v4)");
+	result = isc_net_getudpportrange(AF_INET, &udpport_low, &udpport_high);
+	check_result(result, "isc_net_getudpportrange (v4)");
+	isc_portset_addrange(v4portset, udpport_low, udpport_high);
+
+	result = isc_portset_create(gmctx, &v6portset);
+	check_result(result, "isc_portset_create (v6)");
+	result = isc_net_getudpportrange(AF_INET6, &udpport_low, &udpport_high);
+	check_result(result, "isc_net_getudpportrange (v6)");
+	isc_portset_addrange(v6portset, udpport_low, udpport_high);
+
+	result = dns_dispatchmgr_setavailports(manager, v4portset, v6portset);
+	check_result(result, "dns_dispatchmgr_setavailports");
+
+	isc_portset_destroy(gmctx, &v4portset);
+	isc_portset_destroy(gmctx, &v6portset);
+}
+
 static void
 setup_system(void) {
 	isc_result_t result;
@@ -975,6 +1004,8 @@ setup_system(void) {
 	check_result(result, "dst_lib_init");
 	is_dst_up = true;

+	set_source_ports(dispatchmgr);
+
 	attrmask = DNS_DISPATCHATTR_UDP | DNS_DISPATCHATTR_TCP;
 	attrmask |= DNS_DISPATCHATTR_IPV4 | DNS_DISPATCHATTR_IPV6;

@@ -2403,6 +2434,8 @@ update_completed(isc_task_t *task, isc_event_t *event) {
 	if (usegsstsig) {
 		dns_name_free(&tmpzonename, gmctx);
 		dns_name_free(&restart_master, gmctx);
+		dns_name_init(&tmpzonename, 0);
+		dns_name_init(&restart_master, 0);
 	}
 	isc_event_free(&event);
 	done_update();
@@ -2818,6 +2851,8 @@ failed_gssrequest() {

 	dns_name_free(&tmpzonename, gmctx);
 	dns_name_free(&restart_master, gmctx);
+	dns_name_init(&tmpzonename, NULL);
+	dns_name_init(&restart_master, NULL);

 	done_update();
 }
@@ -3226,6 +3261,12 @@ cleanup(void) {
 		isc_mem_free(gmctx, realm);
 		realm = NULL;
 	}
+	if (dns_name_dynamic(&tmpzonename)) {
+		dns_name_free(&tmpzonename, gmctx);
+	}
+	if (dns_name_dynamic(&restart_master)) {
+		dns_name_free(&restart_master, gmctx);
+	}
 #endif

 	if (sig0key != NULL)
@@ -43,7 +43,7 @@
 * Create a key in the keystore of an HSM
 *
 * The calculation of key tag is left to the script
- * that converts the key into a DNSKEY RR and inserts 
+ * that converts the key into a DNSKEY RR and inserts
 * it into a zone file.
 *
 * usage:
@@ -373,10 +373,12 @@ main(int argc, char *argv[]) {
 	switch (keyclass) {
 	case key_rsa:
 		op_type = OP_RSA;
-		if (expsize == 0)
+		if (expsize == 0) {
 			expsize = 3;
-		if (bits == 0)
+		}
+		if (bits == 0) {
 			usage();
+		}

 		mech.mechanism = CKM_RSA_PKCS_KEY_PAIR_GEN;
 		mech.pParameter = NULL;
@@ -389,9 +391,9 @@ main(int argc, char *argv[]) {
 		/* Set public exponent to F4 or F5 */
 		exponent[0] = 0x01;
 		exponent[1] = 0x00;
-		if (expsize == 3)
+		if (expsize == 3) {
 			exponent[2] = 0x01;
-		else {
+		} else {
 			exponent[2] = 0x00;
 			exponent[3] = 0x00;
 			exponent[4] = 0x01;
@@ -403,10 +405,15 @@ main(int argc, char *argv[]) {
 		public_template[RSA_PUBLIC_EXPONENT].ulValueLen = expsize;
 		break;
 	case key_ecc:
+#if !defined(HAVE_PKCS11_ECDSA)
+		fprintf(stderr,
+			"prime256v1 and secp3841r1 are not supported\n");
+		usage();
+#else
 		op_type = OP_EC;
-		if (bits == 0)
+		if (bits == 0) {
 			bits = 256;
-		else if (bits != 256 && bits != 384) {
+		} else if (bits != 256 && bits != 384) {
 			fprintf(stderr, "ECC keys only support bit sizes of "
 					"256 and 384\n");
 			exit(2);
@@ -429,17 +436,17 @@ main(int argc, char *argv[]) {
 			public_template[4].ulValueLen =
 				sizeof(pk11_ecc_secp384r1);
 		}
-
+#endif
 		break;
 	case key_ecx:
-#ifndef CKM_EDDSA_KEY_PAIR_GEN
+#if !defined(CKM_EDDSA_KEY_PAIR_GEN)
 		fprintf(stderr, "CKM_EDDSA_KEY_PAIR_GEN is not defined\n");
 		usage();
-#endif
+#else
 		op_type = OP_EC;
-		if (bits == 0)
+		if (bits == 0) {
 			bits = 256;
-		else if (bits != 256 && bits != 456) {
+		} else if (bits != 256 && bits != 456) {
 			fprintf(stderr, "ECX keys only support bit sizes of "
 					"256 and 456\n");
 			exit(2);
@@ -454,16 +461,27 @@ main(int argc, char *argv[]) {
 		id_offset = ECC_ID;

 		if (bits == 256) {
+#if HAVE_PKCS11_ED25519
 			public_template[4].pValue = pk11_ecc_ed25519;
 			public_template[4].ulValueLen =
 				sizeof(pk11_ecc_ed25519);
+#else
+			fprintf(stderr, "Ed25519 is not supported\n");
+			usage();
+#endif
 		} else {
+#if HAVE_PKCS11_ED448
 			public_template[4].pValue = pk11_ecc_ed448;
 			public_template[4].ulValueLen =
 				sizeof(pk11_ecc_ed448);
+#else
+			fprintf(stderr, "Ed449 is not supported\n");
+			usage();
+#endif
 		}

 		break;
+#endif /* !defined(CKM_EDDSA_KEY_PAIR_GEN) */
 	case key_dsa:
 		op_type = OP_DSA;
 		if (bits == 0)
@@ -527,7 +545,7 @@ main(int argc, char *argv[]) {
 	case key_unknown:
 		usage();
 	}
-	
+
 	search_template[0].pValue = label;
 	search_template[0].ulValueLen = strlen((char *)label);
 	public_template[0].pValue = label;
@@ -559,8 +577,9 @@ main(int argc, char *argv[]) {
 	pk11_result_register();

 	/* Initialize the CRYPTOKI library */
-	if (lib_name != NULL)
+	if (lib_name != NULL) {
 		pk11_set_lib_name(lib_name);
+	}

 	if (pin == NULL)
 		pin = getpassphrase("Enter Pin: ");
@@ -584,7 +603,7 @@ main(int argc, char *argv[]) {
 	hSession = pctx.session;

 	/* check if a key with the same id already exists */
-	rv = pkcs_C_FindObjectsInit(hSession, search_template, 1); 
+	rv = pkcs_C_FindObjectsInit(hSession, search_template, 1);
 	if (rv != CKR_OK) {
 		fprintf(stderr, "C_FindObjectsInit: Error = 0x%.8lX\n", rv);
 		error = 1;
@@ -714,13 +733,14 @@ main(int argc, char *argv[]) {
 			       public_template, public_attrcnt,
 			       private_template, private_attrcnt,
 			       &publickey, &privatekey);
-	
+
 	if (rv != CKR_OK) {
 		fprintf(stderr, "C_GenerateKeyPair: Error = 0x%.8lX\n", rv);
 		error = 1;
-	 } else if (!quiet)
+	} else if (!quiet) {
 		printf("Key pair generation complete.\n");
-	
+	}
+
 exit_params:
 	/* Free parameter attributes */
 	if (keyclass == key_dsa || keyclass == key_dh) {
@@ -1,29 +1,29 @@
-Microsoft Developer Studio Workspace File, Format Version 6.00
-# WARNING: DO NOT EDIT OR DELETE THIS WORKSPACE FILE!
-
-###############################################################################
-
-Project: "pk11destroy"=".\pk11destroy.dsp" - Package Owner=<4>
-
-Package=<5>
-{{{
-}}}
-
-Package=<4>
-{{{
-}}}
-
-###############################################################################
-
-Global:
-
-Package=<5>
-{{{
-}}}
-
-Package=<3>
-{{{
-}}}
-
-###############################################################################
-
+Microsoft Developer Studio Workspace File, Format Version 6.00
+# WARNING: DO NOT EDIT OR DELETE THIS WORKSPACE FILE!
+
+###############################################################################
+
+Project: "pk11destroy"=".\pk11destroy.dsp" - Package Owner=<4>
+
+Package=<5>
+{{{
+}}}
+
+Package=<4>
+{{{
+}}}
+
+###############################################################################
+
+Global:
+
+Package=<5>
+{{{
+}}}
+
+Package=<3>
+{{{
+}}}
+
+###############################################################################
+
@@ -1,29 +1,29 @@
-Microsoft Developer Studio Workspace File, Format Version 6.00
-# WARNING: DO NOT EDIT OR DELETE THIS WORKSPACE FILE!
-
-###############################################################################
-
-Project: "pk11keygen"=".\pk11keygen.dsp" - Package Owner=<4>
-
-Package=<5>
-{{{
-}}}
-
-Package=<4>
-{{{
-}}}
-
-###############################################################################
-
-Global:
-
-Package=<5>
-{{{
-}}}
-
-Package=<3>
-{{{
-}}}
-
-###############################################################################
-
+Microsoft Developer Studio Workspace File, Format Version 6.00
+# WARNING: DO NOT EDIT OR DELETE THIS WORKSPACE FILE!
+
+###############################################################################
+
+Project: "pk11keygen"=".\pk11keygen.dsp" - Package Owner=<4>
+
+Package=<5>
+{{{
+}}}
+
+Package=<4>
+{{{
+}}}
+
+###############################################################################
+
+Global:
+
+Package=<5>
+{{{
+}}}
+
+Package=<3>
+{{{
+}}}
+
+###############################################################################
+
@@ -1,29 +1,29 @@
-Microsoft Developer Studio Workspace File, Format Version 6.00
-# WARNING: DO NOT EDIT OR DELETE THIS WORKSPACE FILE!
-
-###############################################################################
-
-Project: "pk11list"=".\pk11list.dsp" - Package Owner=<4>
-
-Package=<5>
-{{{
-}}}
-
-Package=<4>
-{{{
-}}}
-
-###############################################################################
-
-Global:
-
-Package=<5>
-{{{
-}}}
-
-Package=<3>
-{{{
-}}}
-
-###############################################################################
-
+Microsoft Developer Studio Workspace File, Format Version 6.00
+# WARNING: DO NOT EDIT OR DELETE THIS WORKSPACE FILE!
+
+###############################################################################
+
+Project: "pk11list"=".\pk11list.dsp" - Package Owner=<4>
+
+Package=<5>
+{{{
+}}}
+
+Package=<4>
+{{{
+}}}
+
+###############################################################################
+
+Global:
+
+Package=<5>
+{{{
+}}}
+
+Package=<3>
+{{{
+}}}
+
+###############################################################################
+
@@ -1,29 +1,29 @@
-Microsoft Developer Studio Workspace File, Format Version 6.00
-# WARNING: DO NOT EDIT OR DELETE THIS WORKSPACE FILE!
-
-###############################################################################
-
-Project: "pk11tokens"=".\pk11tokens.dsp" - Package Owner=<4>
-
-Package=<5>
-{{{
-}}}
-
-Package=<4>
-{{{
-}}}
-
-###############################################################################
-
-Global:
-
-Package=<5>
-{{{
-}}}
-
-Package=<3>
-{{{
-}}}
-
-###############################################################################
-
+Microsoft Developer Studio Workspace File, Format Version 6.00
+# WARNING: DO NOT EDIT OR DELETE THIS WORKSPACE FILE!
+
+###############################################################################
+
+Project: "pk11tokens"=".\pk11tokens.dsp" - Package Owner=<4>
+
+Package=<5>
+{{{
+}}}
+
+Package=<4>
+{{{
+}}}
+
+###############################################################################
+
+Global:
+
+Package=<5>
+{{{
+}}}
+
+Package=<3>
+{{{
+}}}
+
+###############################################################################
+
@@ -49,7 +49,7 @@ and
 \fBdnssec\-settime\fR\&.
 .PP
 DNSSEC policy can be read from a configuration file (default
-/etc/dnssec\-policy\&.conf), from which the key parameters, publication and rollover schedule, and desired coverage duration for any given zone can be determined\&. This file may be used to define individual DNSSEC policies on a per\-zone basis, or to set a default policy used for all zones\&.
+/etc/dnssec\-policy\&.conf), from which the key parameters, publication and rollover schedule, and desired coverage duration for any given zone can be determined\&. This file may be used to define individual DNSSEC policies on a per\-zone basis, or to set a "default" policy used for all zones\&.
 .PP
 When
 \fBdnssec\-keymgr\fR
@@ -69,6 +69,10 @@ will search the key directory (either the current working directory or the direc
 \fB\-K\fR
 option), and check the keys for all the zones represented in the directory\&.
 .PP
+Key times that are in the past will not be updated unless the
+\fB\-f\fR
+is used (see below)\&. Key inactivation and deletion times that are less than five minutes in the future will be delayed by five minutes\&.
+.PP
 It is expected that this tool will be run automatically and unattended (for example, by
 \fBcron\fR)\&.
 .SH "OPTIONS"
@@ -186,7 +190,8 @@ would be used for zones that had unusually high security needs\&.
 .sp -1
 .IP \(bu 2.3
 .\}
-Algorithm policies: (\fBalgorithm\-policy \fR\fB\fIalgorithm\fR\fR\fB { \&.\&.\&. };\fR
+\fIAlgorithm policies:\fR
+(\fBalgorithm\-policy \fR\fB\fIalgorithm\fR\fR\fB { \&.\&.\&. };\fR
 ) override default per\-algorithm settings\&. For example, by default, RSASHA256 keys use 2048\-bit key sizes for both KSK and ZSK\&. This can be modified using
 \fBalgorithm\-policy\fR, and the new key sizes would then be used for any key of type RSASHA256\&.
 .RE
@@ -199,59 +204,60 @@ Algorithm policies: (\fBalgorithm\-policy \fR\fB\fIalgorithm\fR\fR\fB { \&.\&.\&
 .sp -1
 .IP \(bu 2.3
 .\}
-Zone policies: (\fBzone \fR\fB\fIname\fR\fR\fB { \&.\&.\&. };\fR
+\fIZone policies:\fR
+(\fBzone \fR\fB\fIname\fR\fR\fB { \&.\&.\&. };\fR
 ) set policy for a single zone by name\&. A zone policy can inherit a policy class by including a
 \fBpolicy\fR
-option\&. Zone names beginning with digits (i\&.e\&., 0\-9) must be quoted\&.
+option\&. Zone names beginning with digits (i\&.e\&., 0\-9) must be quoted\&. If a zone does not have its own policy then the "default" policy applies\&.
 .RE
 .PP
 Options that can be specified in policies:
 .PP
-\fBalgorithm\fR
+\fBalgorithm\fR \fIname\fR;
 .RS 4
 The key algorithm\&. If no policy is defined, the default is RSASHA256\&.
 .RE
 .PP
-\fBcoverage\fR
+\fBcoverage\fR \fIduration\fR;
 .RS 4
 The length of time to ensure that keys will be correct; no action will be taken to create new keys to be activated after this time\&. This can be represented as a number of seconds, or as a duration using human\-readable units (examples: "1y" or "6 months")\&. A default value for this option can be set in algorithm policies as well as in policy classes or zone policies\&. If no policy is configured, the default is six months\&.
 .RE
 .PP
-\fBdirectory\fR
+\fBdirectory\fR \fIpath\fR;
 .RS 4
 Specifies the directory in which keys should be stored\&.
 .RE
 .PP
-\fBkey\-size\fR
+\fBkey\-size\fR \fIkeytype\fR \fIsize\fR;
 .RS 4
-Specifies the number of bits to use in creating keys\&. Takes two arguments: keytype (eihter "zsk" or "ksk") and size\&. A default value for this option can be set in algorithm policies as well as in policy classes or zone policies\&. If no policy is configured, the default is 1024 bits for DSA keys and 2048 for RSA\&.
+Specifies the number of bits to use in creating keys\&. The keytype is either "zsk" or "ksk"\&. A default value for this option can be set in algorithm policies as well as in policy classes or zone policies\&. If no policy is configured, the default is 1024 bits for DSA keys and 2048 for RSA\&.
 .RE
 .PP
-\fBkeyttl\fR
+\fBkeyttl\fR \fIduration\fR;
 .RS 4
 The key TTL\&. If no policy is defined, the default is one hour\&.
 .RE
 .PP
-\fBpost\-publish\fR
+\fBpost\-publish\fR \fIkeytype\fR \fIduration\fR;
 .RS 4
 How long after inactivation a key should be deleted from the zone\&. Note: If
 \fBroll\-period\fR
-is not set, this value is ignored\&. Takes two arguments: keytype (eihter "zsk" or "ksk") and a duration\&. A default value for this option can be set in algorithm policies as well as in policy classes or zone policies\&. The default is one month\&.
+is not set, this value is ignored\&. The keytype is either "zsk" or "ksk"\&. A default duration for this option can be set in algorithm policies as well as in policy classes or zone policies\&. The default is one month\&.
 .RE
 .PP
-\fBpre\-publish\fR
+\fBpre\-publish\fR \fIkeytype\fR \fIduration\fR;
 .RS 4
 How long before activation a key should be published\&. Note: If
 \fBroll\-period\fR
-is not set, this value is ignored\&. Takes two arguments: keytype (either "zsk" or "ksk") and a duration\&. A default value for this option can be set in algorithm policies as well as in policy classes or zone policies\&. The default is one month\&.
+is not set, this value is ignored\&. The keytype is either "zsk" or "ksk"\&. A default duration for this option can be set in algorithm policies as well as in policy classes or zone policies\&. The default is one month\&.
 .RE
 .PP
-\fBroll\-period\fR
+\fBroll\-period\fR \fIkeytype\fR \fIduration\fR;
 .RS 4
-How frequently keys should be rolled over\&. Takes two arguments: keytype (eihter "zsk" or "ksk") and a duration\&. A default value for this option can be set in algorithm policies as well as in policy classes or zone policies\&. If no policy is configured, the default is one year for ZSK\*(Aqs\&. KSK\*(Aqs do not roll over by default\&.
+How frequently keys should be rolled over\&. The keytype is either "zsk" or "ksk"\&. A default duration for this option can be set in algorithm policies as well as in policy classes or zone policies\&. If no policy is configured, the default is one year for ZSKs\&. KSKs do not roll over by default\&.
 .RE
 .PP
-\fBstandby\fR
+\fBstandby\fR \fIkeytype\fR \fInumber\fR;
 .RS 4
 Not yet implemented\&.
 .RE
@@ -66,11 +66,12 @@
    </para>
    <para>
      DNSSEC policy can be read from a configuration file (default
-      <filename>/etc/dnssec-policy.conf</filename>), from which the key
-      parameters, publication and rollover schedule, and desired
-      coverage duration for any given zone can be determined.  This
+      <filename>/etc/dnssec-policy.conf</filename>), from which the
+      key parameters, publication and rollover schedule, and desired
+      coverage duration for any given zone can be determined. This
      file may be used to define individual DNSSEC policies on a
-      per-zone basis, or to set a default policy used for all zones.
+      per-zone basis, or to set a "<literal>default</literal>" policy
+      used for all zones.
    </para>
    <para>
      When <command>dnssec-keymgr</command> runs, it examines the DNSSEC
@@ -100,6 +101,12 @@
      set by the <option>-K</option> option), and check the keys for
      all the zones represented in the directory.
    </para>
+    <para>
+      Key times that are in the past will not be updated unless
+      the <option>-f</option> is used (see below).  Key inactivation
+      and deletion times that are less than five minutes in the future
+      will be delayed by five minutes.
+    </para>
    <para>
      It is expected that this tool will be run automatically and
      unattended (for example, by <command>cron</command>).
@@ -252,7 +259,7 @@
      </listitem>
      <listitem>
 	<para>
-	  Algorithm policies:
+	  <emphasis>Algorithm policies:</emphasis>
 	  (<option>algorithm-policy <replaceable>algorithm</replaceable> { ... };</option> )
 	  override default per-algorithm settings.  For example, by default,
 	  RSASHA256 keys use 2048-bit key sizes for both KSK and ZSK. This
@@ -262,11 +269,13 @@
      </listitem>
      <listitem>
 	<para>
-	  Zone policies:
+	  <emphasis>Zone policies:</emphasis>
 	  (<option>zone <replaceable>name</replaceable> { ... };</option> )
 	  set policy for a single zone by name. A zone policy can inherit
 	  a policy class by including a <option>policy</option> option.
 	  Zone names beginning with digits (i.e., 0-9) must be quoted.
+	  If a zone does not have its own policy then the
+	  "<literal>default</literal>" policy applies.
 	</para>
      </listitem>
    </itemizedlist>
@@ -275,7 +284,8 @@
    </para>
    <variablelist>
      <varlistentry>
-	<term><command>algorithm</command></term>
+	<term><command>algorithm</command>
+	  <replaceable>name</replaceable><literal>;</literal></term>
 	<listitem>
 	  <para>
 	    The key algorithm. If no policy is defined, the default is
@@ -284,13 +294,14 @@
 	</listitem>
      </varlistentry>
      <varlistentry>
-	<term><command>coverage</command></term>
+	<term><command>coverage</command>
+	  <replaceable>duration</replaceable><literal>;</literal></term>
 	<listitem>
 	  <para>
 	    The length of time to ensure that keys will be correct; no action
 	    will be taken to create new keys to be activated after this time.
-	    This can be represented as a number of seconds, or as a duration using
-	    human-readable units (examples: "1y" or "6 months").
+	    This can be represented as a number of seconds, or as a duration
+	    using human-readable units (examples: "1y" or "6 months").
 	    A default value for this option can be set in algorithm policies
 	    as well as in policy classes or zone policies.
 	    If no policy is configured, the default is six months.
@@ -298,7 +309,8 @@
 	</listitem>
      </varlistentry>
      <varlistentry>
-	<term><command>directory</command></term>
+	<term><command>directory</command>
+	  <replaceable>path</replaceable><literal>;</literal></term>
 	<listitem>
 	  <para>
 	    Specifies the directory in which keys should be stored.
@@ -306,11 +318,12 @@
 	</listitem>
      </varlistentry>
      <varlistentry>
-	<term><command>key-size</command></term>
+	<term><command>key-size</command> <replaceable>keytype</replaceable>
+	  <replaceable>size</replaceable><literal>;</literal></term>
 	<listitem>
 	  <para>
 	    Specifies the number of bits to use in creating keys.
-	    Takes two arguments: keytype (eihter "zsk" or "ksk") and size.
+	    The keytype is either "zsk" or "ksk".
 	    A default value for this option can be set in algorithm policies
 	    as well as in policy classes or zone policies. If no policy is
 	    configured, the default is 1024 bits for DSA keys and 2048 for
@@ -319,7 +332,8 @@
 	</listitem>
      </varlistentry>
      <varlistentry>
-	<term><command>keyttl</command></term>
+	<term><command>keyttl</command>
+	  <replaceable>duration</replaceable><literal>;</literal></term>
 	<listitem>
 	  <para>
 	    The key TTL. If no policy is defined, the default is one hour.
@@ -327,46 +341,50 @@
 	</listitem>
      </varlistentry>
      <varlistentry>
-	<term><command>post-publish</command></term>
+	<term><command>post-publish</command> <replaceable>keytype</replaceable>
+	  <replaceable>duration</replaceable><literal>;</literal></term>
 	<listitem>
 	  <para>
 	    How long after inactivation a key should be deleted from the zone.
 	    Note: If <option>roll-period</option> is not set, this value is
-	    ignored. Takes two arguments: keytype (eihter "zsk" or "ksk") and a
-	    duration. A default value for this option can be set in algorithm
+	    ignored. The keytype is either "zsk" or "ksk".
+	    A default duration for this option can be set in algorithm
 	    policies as well as in policy classes or zone policies. The default
 	    is one month.
 	  </para>
 	</listitem>
      </varlistentry>
      <varlistentry>
-	<term><command>pre-publish</command></term>
+	<term><command>pre-publish</command> <replaceable>keytype</replaceable>
+	  <replaceable>duration</replaceable><literal>;</literal></term>
 	<listitem>
 	  <para>
 	    How long before activation a key should be published.  Note: If
 	    <option>roll-period</option> is not set, this value is ignored.
-	    Takes two arguments: keytype (either "zsk" or "ksk") and a duration.
-	    A default value for this option can be set in algorithm policies
+	    The keytype is either "zsk" or "ksk".
+	    A default duration for this option can be set in algorithm policies
 	    as well as in policy classes or zone policies.  The default is
 	    one month.
 	  </para>
 	</listitem>
      </varlistentry>
      <varlistentry>
-	<term><command>roll-period</command></term>
+	<term><command>roll-period</command> <replaceable>keytype</replaceable>
+	  <replaceable>duration</replaceable><literal>;</literal></term>
 	<listitem>
 	  <para>
 	    How frequently keys should be rolled over.
-	    Takes two arguments: keytype (eihter "zsk" or "ksk") and a duration.
-	    A default value for this option can be set in algorithm policies
+	    The keytype is either "zsk" or "ksk".
+	    A default duration for this option can be set in algorithm policies
 	    as well as in policy classes or zone policies.  If no policy is
-	    configured, the default is one year for ZSK's. KSK's do not
+	    configured, the default is one year for ZSKs. KSKs do not
 	    roll over by default.
 	  </para>
 	</listitem>
      </varlistentry>
      <varlistentry>
-	<term><command>standby</command></term>
+	<term><command>standby</command> <replaceable>keytype</replaceable>
+	  <replaceable>number</replaceable><literal>;</literal></term>
 	<listitem>
 	  <para>
 	    Not yet implemented.
@@ -58,11 +58,12 @@
    </p>
    <p>
      DNSSEC policy can be read from a configuration file (default
-      <code class="filename">/etc/dnssec-policy.conf</code>), from which the key
-      parameters, publication and rollover schedule, and desired
-      coverage duration for any given zone can be determined.  This
+      <code class="filename">/etc/dnssec-policy.conf</code>), from which the
+      key parameters, publication and rollover schedule, and desired
+      coverage duration for any given zone can be determined. This
      file may be used to define individual DNSSEC policies on a
-      per-zone basis, or to set a default policy used for all zones.
+      per-zone basis, or to set a "<code class="literal">default</code>" policy
+      used for all zones.
    </p>
    <p>
      When <span class="command"><strong>dnssec-keymgr</strong></span> runs, it examines the DNSSEC
@@ -92,6 +93,12 @@
      set by the <code class="option">-K</code> option), and check the keys for
      all the zones represented in the directory.
    </p>
+    <p>
+      Key times that are in the past will not be updated unless
+      the <code class="option">-f</code> is used (see below).  Key inactivation
+      and deletion times that are less than five minutes in the future
+      will be delayed by five minutes.
+    </p>
    <p>
      It is expected that this tool will be run automatically and
      unattended (for example, by <span class="command"><strong>cron</strong></span>).
@@ -214,7 +221,7 @@
      </li>
 <li class="listitem">
 	<p>
-	  Algorithm policies:
+	  <span class="emphasis"><em>Algorithm policies:</em></span>
 	  (<code class="option">algorithm-policy <em class="replaceable"><code>algorithm</code></em> { ... };</code> )
 	  override default per-algorithm settings.  For example, by default,
 	  RSASHA256 keys use 2048-bit key sizes for both KSK and ZSK. This
@@ -224,11 +231,13 @@
      </li>
 <li class="listitem">
 	<p>
-	  Zone policies:
+	  <span class="emphasis"><em>Zone policies:</em></span>
 	  (<code class="option">zone <em class="replaceable"><code>name</code></em> { ... };</code> )
 	  set policy for a single zone by name. A zone policy can inherit
 	  a policy class by including a <code class="option">policy</code> option.
 	  Zone names beginning with digits (i.e., 0-9) must be quoted.
+	  If a zone does not have its own policy then the
+	  "<code class="literal">default</code>" policy applies.
 	</p>
      </li>
 </ul></div>
@@ -236,82 +245,91 @@
      Options that can be specified in policies:
    </p>
    <div class="variablelist"><dl class="variablelist">
-<dt><span class="term"><span class="command"><strong>algorithm</strong></span></span></dt>
+<dt><span class="term"><span class="command"><strong>algorithm</strong></span>
+	  <em class="replaceable"><code>name</code></em><code class="literal">;</code></span></dt>
 <dd>
 	  <p>
 	    The key algorithm. If no policy is defined, the default is
 	    RSASHA256.
 	  </p>
 	</dd>
-<dt><span class="term"><span class="command"><strong>coverage</strong></span></span></dt>
+<dt><span class="term"><span class="command"><strong>coverage</strong></span>
+	  <em class="replaceable"><code>duration</code></em><code class="literal">;</code></span></dt>
 <dd>
 	  <p>
 	    The length of time to ensure that keys will be correct; no action
 	    will be taken to create new keys to be activated after this time.
-	    This can be represented as a number of seconds, or as a duration using
-	    human-readable units (examples: "1y" or "6 months").
+	    This can be represented as a number of seconds, or as a duration
+	    using human-readable units (examples: "1y" or "6 months").
 	    A default value for this option can be set in algorithm policies
 	    as well as in policy classes or zone policies.
 	    If no policy is configured, the default is six months.
 	  </p>
 	</dd>
-<dt><span class="term"><span class="command"><strong>directory</strong></span></span></dt>
+<dt><span class="term"><span class="command"><strong>directory</strong></span>
+	  <em class="replaceable"><code>path</code></em><code class="literal">;</code></span></dt>
 <dd>
 	  <p>
 	    Specifies the directory in which keys should be stored.
 	  </p>
 	</dd>
-<dt><span class="term"><span class="command"><strong>key-size</strong></span></span></dt>
+<dt><span class="term"><span class="command"><strong>key-size</strong></span> <em class="replaceable"><code>keytype</code></em>
+	  <em class="replaceable"><code>size</code></em><code class="literal">;</code></span></dt>
 <dd>
 	  <p>
 	    Specifies the number of bits to use in creating keys.
-	    Takes two arguments: keytype (eihter "zsk" or "ksk") and size.
+	    The keytype is either "zsk" or "ksk".
 	    A default value for this option can be set in algorithm policies
 	    as well as in policy classes or zone policies. If no policy is
 	    configured, the default is 1024 bits for DSA keys and 2048 for
 	    RSA.
 	  </p>
 	</dd>
-<dt><span class="term"><span class="command"><strong>keyttl</strong></span></span></dt>
+<dt><span class="term"><span class="command"><strong>keyttl</strong></span>
+	  <em class="replaceable"><code>duration</code></em><code class="literal">;</code></span></dt>
 <dd>
 	  <p>
 	    The key TTL. If no policy is defined, the default is one hour.
 	  </p>
 	</dd>
-<dt><span class="term"><span class="command"><strong>post-publish</strong></span></span></dt>
+<dt><span class="term"><span class="command"><strong>post-publish</strong></span> <em class="replaceable"><code>keytype</code></em>
+	  <em class="replaceable"><code>duration</code></em><code class="literal">;</code></span></dt>
 <dd>
 	  <p>
 	    How long after inactivation a key should be deleted from the zone.
 	    Note: If <code class="option">roll-period</code> is not set, this value is
-	    ignored. Takes two arguments: keytype (eihter "zsk" or "ksk") and a
-	    duration. A default value for this option can be set in algorithm
+	    ignored. The keytype is either "zsk" or "ksk".
+	    A default duration for this option can be set in algorithm
 	    policies as well as in policy classes or zone policies. The default
 	    is one month.
 	  </p>
 	</dd>
-<dt><span class="term"><span class="command"><strong>pre-publish</strong></span></span></dt>
+<dt><span class="term"><span class="command"><strong>pre-publish</strong></span> <em class="replaceable"><code>keytype</code></em>
+	  <em class="replaceable"><code>duration</code></em><code class="literal">;</code></span></dt>
 <dd>
 	  <p>
 	    How long before activation a key should be published.  Note: If
 	    <code class="option">roll-period</code> is not set, this value is ignored.
-	    Takes two arguments: keytype (either "zsk" or "ksk") and a duration.
-	    A default value for this option can be set in algorithm policies
+	    The keytype is either "zsk" or "ksk".
+	    A default duration for this option can be set in algorithm policies
 	    as well as in policy classes or zone policies.  The default is
 	    one month.
 	  </p>
 	</dd>
-<dt><span class="term"><span class="command"><strong>roll-period</strong></span></span></dt>
+<dt><span class="term"><span class="command"><strong>roll-period</strong></span> <em class="replaceable"><code>keytype</code></em>
+	  <em class="replaceable"><code>duration</code></em><code class="literal">;</code></span></dt>
 <dd>
 	  <p>
 	    How frequently keys should be rolled over.
-	    Takes two arguments: keytype (eihter "zsk" or "ksk") and a duration.
-	    A default value for this option can be set in algorithm policies
+	    The keytype is either "zsk" or "ksk".
+	    A default duration for this option can be set in algorithm policies
 	    as well as in policy classes or zone policies.  If no policy is
-	    configured, the default is one year for ZSK's. KSK's do not
+	    configured, the default is one year for ZSKs. KSKs do not
 	    roll over by default.
 	  </p>
 	</dd>
-<dt><span class="term"><span class="command"><strong>standby</strong></span></span></dt>
+<dt><span class="term"><span class="command"><strong>standby</strong></span> <em class="replaceable"><code>keytype</code></em>
+	  <em class="replaceable"><code>number</code></em><code class="literal">;</code></span></dt>
 <dd>
 	  <p>
 	    Not yet implemented.
@@ -37,7 +37,11 @@ class SECRR:
        if not rrtext:
            raise Exception

-        fields = rrtext.decode('ascii').split()
+        # 'str' does not have decode method in python3
+        if type(rrtext) is not str:
+            fields = rrtext.decode('ascii').split()
+        else:
+            fields = rrtext.split()
        if len(fields) < 7:
            raise Exception

@@ -99,6 +103,8 @@ def check(zone, args, masterfile=None, lookaside=None):
    fp, _ = Popen(cmd, stdout=PIPE).communicate()

    for line in fp.splitlines():
+        if type(line) is not str:
+            line = line.decode('ascii')
        rrlist.append(SECRR(line, lookaside))
    rrlist = sorted(rrlist, key=lambda rr: (rr.keyid, rr.keyalg, rr.hashalg))

@@ -120,6 +126,8 @@ def check(zone, args, masterfile=None, lookaside=None):
        fp, _ = Popen(cmd, stdin=PIPE, stdout=PIPE).communicate(intods)

    for line in fp.splitlines():
+        if type(line) is not str:
+            line = line.decode('ascii')
        klist.append(SECRR(line, lookaside))

    if len(klist) < 1:
@@ -164,7 +172,7 @@ def parse_args():
    parser.add_argument('-D', '--dsfromkey', dest='dsfromkey',
                        default=os.path.join(prefix(sbindir),
                                             'dnssec-dsfromkey'),
-                        type=str, help='path to \'dig\'')
+                        type=str, help='path to \'dnssec-dsfromkey\'')
    parser.add_argument('-v', '--version', action='version',
                        version=version)
    args = parser.parse_args()
@@ -188,6 +188,10 @@ def parse_args():
    if args.filename and len(args.zone) > 1:
        fatal("ERROR: -f can only be used with one zone.")

+    # strip trailing dots if any
+    args.zone = [x[:-1] if (len(x) > 1 and x[-1] == '.') else x
+                        for x in args.zone]
+
    # convert from time arguments to seconds
    try:
        if args.maxttl:
@@ -251,7 +255,7 @@ def main():
    print("PHASE 1--Loading keys to check for internal timing problems")

    try:
-        kd = keydict(path=args.path, zone=args.zone, keyttl=args.keyttl)
+        kd = keydict(path=args.path, zones=args.zone, keyttl=args.keyttl)
    except Exception as e:
        fatal('ERROR: Unable to build key dictionary: ' + str(e))

@@ -452,6 +452,10 @@ class dnskey:
        if timespan is None:
            timespan = self.ttl

+        if timespan is None:
+            output("WARNING: Key %s using default TTL." % repr(self))
+            timespan = (60*60*24)
+
        now = time.time()
        d = self.delete()
        i = self.inactive()
@@ -73,7 +73,7 @@ class eventlist:
                    kok = self.checkzone(z, "KSK", until, output)
                if not no_zsk and z in self._Z.keys():
                    found = True
-                    kok = self.checkzone(z, "ZSK", until, output)
+                    zok = self.checkzone(z, "ZSK", until, output)

        if not found:
            output("ERROR: No key events found")
@@ -49,15 +49,18 @@ class keydict:
            self._keydict[key.name][key.alg][key.keyid] = key

    def readone(self, path, zone):
-        match='K' + zone + '.+*.private'
+        if not zone.endswith('.'):
+            zone += '.'
+        match='K' + zone + '+*.private'
        files = glob.glob(os.path.join(path, match))

        found = False
        for infile in files:
            key = dnskey(infile, path, self._defttl)
-            if key.name != zone: # shouldn't ever happen
+            if key.fullname != zone: # shouldn't ever happen
                continue
-            self._keydict[key.name][key.alg][key.keyid] = key
+            keyname=key.name if zone != '.' else '.'
+            self._keydict[keyname][key.alg][key.keyid] = key
            found = True

        return found
@@ -77,15 +77,44 @@ class keyseries:
        a = key.activate()
        if not p or p > now:
            key.setpublish(now)
+            p = now
        if not a or a > now:
            key.setactivate(now)
+            a = now

+        i = key.inactive()
+        fudge = 300
        if not rp:
            key.setinactive(None, **kwargs)
            key.setdelete(None, **kwargs)
+        elif not i or a + rp != i:
+            if not i and a + rp > now + prepub + fudge:
+                key.setinactive(a + rp, **kwargs)
+                key.setdelete(a + rp + postpub, **kwargs)
+            elif not i:
+                key.setinactive(now + prepub + fudge, **kwargs)
+                key.setdelete(now + prepub + postpub + fudge, **kwargs)
+            elif i < now:
+                pass
+            elif a + rp > i:
+                key.setinactive(a + rp, **kwargs)
+                key.setdelete(a + rp + postpub, **kwargs)
+            elif a + rp > now + prepub + fudge:
+                key.setinactive(a + rp, **kwargs)
+                key.setdelete(a + rp + postpub, **kwargs)
+            else:
+                key.setinactive(now + prepub + fudge, **kwargs)
+                key.setdelete(now + prepub + postpub + fudge, **kwargs)
        else:
-            key.setinactive(a + rp, **kwargs)
-            key.setdelete(a + rp + postpub, **kwargs)
+            d = key.delete()
+            if not d or i + postpub > now + fudge:
+                key.setdelete(i + postpub, **kwargs)
+            elif not d:
+                key.setdelete(now + postpub + fudge, **kwargs)
+            elif d < now + fudge:
+                pass
+            elif d < i + postpub:
+                key.setdelete(i + postpub, **kwargs)

        if policy.keyttl != key.ttl:
            key.setttl(policy.keyttl)
@@ -43,6 +43,8 @@ class keyzone:
        fp, _ = Popen([czpath, "-o", "-", name, filename],
                      stdout=PIPE, stderr=PIPE).communicate()
        for line in fp.splitlines():
+            if type(line) is not str:
+                line = line.decode('ascii')
            if re.search('^[:space:]*;', line):
                continue
            fields = line.split()
@@ -7,8 +7,6 @@
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.

-# $Id: Makefile.in,v 1.49 2009/12/05 23:31:40 each Exp $
-
 srcdir =	@srcdir@
 VPATH =		@srcdir@
 top_srcdir =	@top_srcdir@
@@ -27,7 +25,7 @@ ISCCFGLIBS =	../../lib/isccfg/libisccfg.@A@
 ISCCCLIBS =	../../lib/isccc/libisccc.@A@
 ISCLIBS =	../../lib/isc/libisc.@A@
 ISCNOSYMLIBS =	../../lib/isc/libisc-nosymtbl.@A@
-DNSLIBS =	../../lib/dns/libdns.@A@ @DNS_CRYPTO_LIBS@
+DNSLIBS =	../../lib/dns/libdns.@A@ ${MAXMINDDB_LIBS} @DNS_CRYPTO_LIBS@
 BIND9LIBS =	../../lib/bind9/libbind9.@A@

 ISCCFGDEPLIBS =	../../lib/isccfg/libisccfg.@A@
@@ -584,7 +584,7 @@ Delete a given TKEY\-negotiated key from the server\&. (This does not apply to s
 .RS 4
 List the names of all TSIG keys currently configured for use by
 \fBnamed\fR
-in each view\&. The list both statically configured keys and dynamic TKEY\-negotiated keys\&.
+in each view\&. The list includes both statically configured keys and dynamic TKEY\-negotiated keys\&.
 .RE
 .PP
 \fBvalidation ( on | off | status ) \fR\fB[\fIview \&.\&.\&.\fR]\fR\fB \fR
@@ -936,7 +936,7 @@
 	  <para>
 	    List the names of all TSIG keys currently configured
 	    for use by <command>named</command> in each view.  The
-	    list both statically configured keys and dynamic
+	    list includes both statically configured keys and dynamic
 	    TKEY-negotiated keys.
 	  </para>
 	</listitem>
@@ -787,7 +787,7 @@
 	  <p>
 	    List the names of all TSIG keys currently configured
 	    for use by <span class="command"><strong>named</strong></span> in each view.  The
-	    list both statically configured keys and dynamic
+	    list includes both statically configured keys and dynamic
 	    TKEY-negotiated keys.
 	  </p>
 	</dd>
@@ -1,29 +1,29 @@
-Microsoft Developer Studio Workspace File, Format Version 6.00
-# WARNING: DO NOT EDIT OR DELETE THIS WORKSPACE FILE!
-
-###############################################################################
-
-Project: "rndcutil"=".\rndcutil.dsp" - Package Owner=<4>
-
-Package=<5>
-{{{
-}}}
-
-Package=<4>
-{{{
-}}}
-
-###############################################################################
-
-Global:
-
-Package=<5>
-{{{
-}}}
-
-Package=<3>
-{{{
-}}}
-
-###############################################################################
-
+Microsoft Developer Studio Workspace File, Format Version 6.00
+# WARNING: DO NOT EDIT OR DELETE THIS WORKSPACE FILE!
+
+###############################################################################
+
+Project: "rndcutil"=".\rndcutil.dsp" - Package Owner=<4>
+
+Package=<5>
+{{{
+}}}
+
+Package=<4>
+{{{
+}}}
+
+###############################################################################
+
+Global:
+
+Package=<5>
+{{{
+}}}
+
+Package=<3>
+{{{
+}}}
+
+###############################################################################
+
@@ -20,7 +20,7 @@ CDEFINES =	@CRYPTO@
 CWARNINGS =
 BACKTRACECFLAGS = @BACKTRACECFLAGS@

-DNSLIBS =	../../lib/dns/libdns.@A@ @DNS_CRYPTO_LIBS@
+DNSLIBS =	../../lib/dns/libdns.@A@ ${MAXMINDDB_LIBS} @DNS_CRYPTO_LIBS@
 ISCLIBS =	../../lib/isc/libisc.@A@ @ISC_OPENSSL_LIBS@
 ISCNOSYMLIBS =	../../lib/isc/libisc-nosymtbl.@A@ @ISC_OPENSSL_LIBS@
 ISCCFGLIBS = 	../../lib/isccfg/libisccfg.@A@
@@ -21,7 +21,7 @@ CDEFINES =	@CRYPTO@ @USE_GSSAPI@
 CWARNINGS =
 BACKTRACECFLAGS = @BACKTRACECFLAGS@

-DNSLIBS =	../../../lib/dns/libdns.@A@ @DNS_CRYPTO_LIBS@
+DNSLIBS =	../../../lib/dns/libdns.@A@ ${MAXMINDDB_LIBS} @DNS_CRYPTO_LIBS@
 ISCLIBS =	../../../lib/isc/libisc.@A@ @ISC_OPENSSL_LIBS@
 ISCNOSYMLIBS =	../../../lib/isc/libisc-nosymtbl.@A@ @ISC_OPENSSL_LIBS@
 ISCCFGLIBS = 	../../../lib/isccfg/libisccfg.@A@
@@ -19,7 +19,7 @@ SUBDIRS =	dlzexternal dyndb lwresd pipelined rndc rsabigexponent tkey

 CINCLUDES =	${ISC_INCLUDES} ${DNS_INCLUDES}

-CDEFINES =	@USE_GSSAPI@
+CDEFINES =	@USE_GSSAPI@ @CONTRIB_DLZ@
 CWARNINGS =

 DNSLIBS =
@@ -47,32 +47,6 @@ feature-test@EXEEXT@: feature-test.@O@
 # Running the scripts below is bypassed when a separate build directory is
 # used.

-# Define the tests that can be run in parallel.  This should be identical to
-# the definition of PARALLELDIRS in conf.sh. Note: longer-running tests
-# such as serve-stale and rpzrecurse are scheduled first to get more
-# benefit from parallelism.
-PARALLEL = rpzrecurse dnssec \
-	   acl additional addzone allow-query autosign \
-	   builtin cacheclean case catz chain \
-	   checkconf checknames checkzone \
-	   @CHECKDS@ @COVERAGE@ @KEYMGR@ \
-	   cookie database digdelv dlv dlz dlzexternal \
-	   dns64 @DNSTAP@ dscp dsdigest dyndb \
-	   ednscompliance emptyzones \
-	   fetchlimit filter-aaaa formerr forward \
-	   geoip glue idna inline integrity ixfr \
-	   legacy limits logfileconfig \
-	   masterfile masterformat metadata mkeys \
-	   names notify nslookup nsupdate nzd2nzf \
-	   pending pipelined \
-	   reclimit redirect resolver rndc rootkeysentinel rpz \
-	   rrchecker rrl rrsetorder rsabigexponent runtime \
-	   sfcache smartsign sortlist \
-	   spf staticstub statistics statschannel stub \
-	   tcp tsig tsiggss \
-	   unknown upforwd verify views wildcard \
-	   xfer xferquota zero zonechecks
-
 # Produce intermediate makefile that assigns unique port numbers to each
 # parallel test.  The start port number of 5,000 is arbitrary - it must just
 # be greater than the highest privileged port, 1024.
@@ -84,26 +58,7 @@ PARALLEL = rpzrecurse dnssec \
 .PHONY: parallel.mk

 parallel.mk:
-	@PARALLEL_SANITIZED=`echo $(PARALLEL) | sed "s|\([^ ][^ ]*\)|test-\1|g;" | tr _ -` ; \
-	echo ".PHONY: $$PARALLEL_SANITIZED" > $@ ; \
-	echo "" >> $@ ; \
-	echo "check_interfaces:" >> $@ ; \
-	echo "	@${PERL} testsock.pl > /dev/null 2>&1 || { \\" >> $@ ; \
-	echo "		echo \"I:NOTE: System tests were skipped because they require that the\"; \\" >> $@ ; \
-	echo "		echo \"I:      IP addresses 10.53.0.1 through 10.53.0.8 be configured\"; \\" >> $@ ; \
-	echo "		echo \"I:      as alias addresses on the loopback interface.  Please run\"; \\" >> $@ ; \
-	echo "		echo \"I:      \"bin/tests/system/ifconfig.sh up\" as root to configure them.\"; \\" >> $@ ; \
-	echo "		exit 1; \\" >> $@ ; \
-	echo "	}" >> $@ ; \
-	echo "" >> $@ ; \
-	echo "test check: $$PARALLEL_SANITIZED" >> $@ ; \
-	port=$${STARTPORT:-5000} ; \
-	for directory in $(PARALLEL) ; do \
-		echo "" >> $@ ; \
-		echo "test-`echo $$directory | tr _ -`: check_interfaces" >> $@ ; \
-		echo "	@$(SHELL) ./run.sh -r -p $$port $$directory 2>&1 | tee $$directory/test.output" >> $@ ; \
-		port=`expr $$port + 100` ; \
-	done
+	$(SHELL) parallel.sh > parallel.mk

 # Targets to run the tests.

@@ -1,2 +1,2 @@
 # this server runs named with only one worker thread
-m record,size,mctx -c named.conf -d 99 -X named.lock -g -T clienttest -n 1
+-m record,size,mctx -c named.conf -d 99 -D additional-ns1 -X named.lock -g -T clienttest -n 1
@@ -29,6 +29,11 @@ controls {
 	inet 10.53.0.1 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
 };

+zone "." {
+	type master;
+	file "root.db";
+};
+
 zone "rt.example" {
 	type master;
 	file "rt.db";
--- a/Show More
+++ b/Show More