od -c

Resolve "util/update_copyrights now needs to handle files with CR LF endings."

See merge request isc-projects/bind9!1802

.gitignore

@@ -1,33 +1,58 @@
-Makefile
-config.log
-config.h
-config.cache
-config.status
-libtool
-/isc-config.sh
-/configure.lineno
-autom4te.cache/
-*.o
-*.lo
-*.so
-*.a
-*.la
-*.gcno
-*.gcda
-*_test
 *-symtbl.c
-timestamp
-ans.run
-lwresd.run
-named.run
-named.memstats
-gen.dSYM/
+*.a
+*.gcda
+*.gcno
+*.la
+*.lo
+*.o
+*.orig
+*.plist/ # ccc-analyzer store its results in .plist directories
+*.rej
+*.so
+*_test
+*~
+.ccache/
+.cproject
 .deps/
 .dirstamp
 .libs/
-# ccc-analyzer store its results in .plist directories
-*.plist/
-*~
 .project
-.cproject
 .settings
+/aclocal.m4
+/ar-lib
+/autom4te.cache/
+/bind.keys.h
+/compile
+/config.cache
+/config.guess
+/config.h
+/config.h.in
+/config.log
+/config.status
+/config.sub
+/configure
+/configure.lineno
+/depcomp
+/install-sh
+/isc-config.sh
+/libltdl/*
+/libtool
+/ltmain.sh
+/m4/libtool.m4
+/m4/ltargz.m4
+/m4/ltdl.m4
+/m4/ltoptions.m4
+/m4/ltsugar.m4
+/m4/ltversion.m4
+/m4/lt~obsolete.m4
+/missing
+/py-compile
+/stamp-h1
+/test-driver
+Makefile
+ans.run
+gen.dSYM/
+kyua.log
+named.memstats
+named.run
+timestamp

.gitlab-ci.yml

@@ -163,10 +163,18 @@ misc:sid:amd64:
     - perl -w util/merge_copyrights
     - diff -urNap util/copyrights util/newcopyrights
     - rm util/newcopyrights
+    - echo XXXXX
+    - od -c win32utils/build.txt
     - perl -w util/update_copyrights < util/copyrights
+    - echo YYYYY
+    - od -c win32utils/build.txt
+    - echo ZZZZZ
+    - git diff
+    - cat .gitattributes
     - if test "$(git status --porcelain | grep -Ev '\?\?' | wc -l)" -gt "0"; then git status --short; exit 1; fi
     - xmllint --noout --nonet `git ls-files '*.xml' '*.docbook'`
     - xmllint --noout --nonet --html `git ls-files '*.html'`
+    - sh util/check-win32util-configure
   artifacts:
     paths:
       - util/newcopyrights

CHANGES

@@ -1,3 +1,83 @@
+5210.	[bug]		When dnstap is enabled and recursion is not
+			available, incoming queries are now logged
+			as "auth". Previously, this depended on whether
+			recursion was requested by the client, not on
+			whether recursion was available. [GL #963]
+
+5208.	[test]		Run valid rdata wire encodings through totext+fromtext
+			and tofmttext+fromtext methods to check these methods.
+			[GL #899]
+
+5207.	[test]		Check delv and dig TTL values. [GL #965]
+
+5205.	[bug]		Enforce that a DS hash exists. [GL #899]
+
+5204.	[test]		Check that dns_rdata_fromtext() produces a record that
+			will be accepted by dns_rdata_fromwire(). [GL #852]
+
+5203.	[bug]		Enforce whether key rdata exists or not in KEY,
+			DNSKEY, CDNSKEY and RKEY. [GL #899]
+
+5197.	[bug]		dig could die in best effort mode on multiple SIG(0)
+			records. Similarly on multiple OPT and multiple TSIG
+			records. [GL #920]
+
+5194.	[bug]		Enforce non empty ZOMEMD hash. [GL #899]
+
+5193.	[bug]		EID and NIMLOC failed to do multi-line output
+			correctly. [GL #899]
+
+5192.	[bug]		configure --fips-mode failed. [GL #946]
+
+5191.	[port]		Darwin: dlzexternal/driver.so was not building.
+			[GL #948]
+
+5189.	[cleanup]	Remove revoked root DNSKEY from bind.keys. [GL #945]
+
+5187.	[test]		Set time zone before running any tests in dnstap_test.
+			[GL #940]
+
+5185.	[bug]		PKCS11 build could fail if ECDSA is not supported.
+			[GL #935]
+
+5184.	[bug]		Missing unlocks in sdlz.c. [GL #936]
+
+5182.	[bug]		Fix a high-load race/crash in handling of
+			isc_socket_close() in resolver. [GL #834]
+
+5180.	[bug]		delv now honors the operating system's preferred
+			ephemeral port range. [GL #925]
+
+5179.	[cleanup]	Replace some vague type declarations with the more
+			specific dns_secalg_t and dns_dsdigest_t.
+			Thanks to Tony Finch. [GL !1498]
+
+5178.	[bug]		Handle EDQUOT (disk quota) and ENOSPC (disk full)
+			errors when writing files. [GL #902]
+
+5176.	[tests]		Remove a dependency on libxml in statschannel system
+			test. [GL #926]
+
+5175.	[bug]		Fixed a problem with file input in dnssec-keymgr,
+			dnssec-coverage and dnssec-checkds when using
+			python3. [GL #882]
+
+5174.	[doc]		Tidy dnssec-keygen manual. [GL !1557]
+
+5172.	[bug]		nsupdate now honors the operating system's preferred
+			ephemeral port range. [GL #905]
+
+5170.	[test]		Added --with-dlz-filesystem to feature-test. [GL !1587]
+
+5168.	[test]		Do not crash on shutdown when RPZ fails to load.  Also,
+			keep previous version of the database if RPZ fails to
+			load. [GL #813]
+
+5167.	[bug]		nxdomain-redirect could sometimes lookup the wrong
+			redirect name. [GL #892]
+
+	--- 9.11.6 released ---
+
 	--- 9.11.6rc1 released ---
 
 5166.	[port]		openbsd: Threads are now enabled by default. [GL !1548]
@@ -135,8 +215,8 @@
 5092.	[bug]		Address memory leak on SIGTERM in nsupdate when using
 			GSS-TSIG. [GL #558]
 
-5090.	[bug]		dig and mdig failed to properly preparse dash value
-			pairs when value was a seperate argument and started
+5090.	[bug]		dig and mdig failed to properly pre-parse dash value
+			pairs when value was a separate argument and started
 			with a dash. [GL #584]
 
 5088.	[bug]		dig/host/nslookup could crash when interrupted close to
@@ -162,7 +242,7 @@
 5072.	[bug]		Add unit tests for isc_buffer_copyregion() and fix its
 			behavior for auto-reallocated buffers. [GL #644]
 
-5071.	[bug]		Comparision of NXT records was broken. [GL #631]
+5071.	[bug]		Comparison of NXT records was broken. [GL #631]
 
 5070.	[bug]		Record types which support a empty rdata field were
 			not handling the empty rdata field case. [GL #638]
@@ -172,7 +252,7 @@
 
 5065.	[bug]		Only set IPV6_USE_MIN_MTU on IPv6. [GL #553]
 
-5064.	[test]		Initalize TZ environment variable before calling
+5064.	[test]		Initialize TZ environment variable before calling
 			dns_test_begin in dnstap_test. [GL #624]
 
 5061.	[protocol]	Add support for EID and NIMLOC. [GL #626]

bin/dnssec/dnssec-dsfromkey.c

@@ -236,7 +236,7 @@ logkey(dns_rdata_t *rdata)
 }
 
 static void
-emit(unsigned int dtype, bool showall, char *lookaside,
+emit(dns_dsdigest_t dtype, bool showall, char *lookaside,
      bool cds, dns_rdata_t *rdata)
 {
 	isc_result_t result;
@@ -351,7 +351,7 @@ main(int argc, char **argv) {
 	char		*lookaside = NULL;
 	char		*endp;
 	int		ch;
-	unsigned int	dtype = DNS_DSDIGEST_SHA1;
+	dns_dsdigest_t	dtype = DNS_DSDIGEST_SHA1;
 	bool	cds = false;
 	bool	both = true;
 	bool	usekeyset = false;

bin/dnssec/dnssec-keygen.docbook

@@ -58,11 +58,10 @@
   <refsynopsisdiv>
     <cmdsynopsis sepchar=" ">
       <command>dnssec-keygen</command>
-      <arg choice="opt" rep="norepeat"><option>-a <replaceable class="parameter">algorithm</replaceable></option></arg>
-      <arg choice="opt" rep="norepeat"><option>-b <replaceable class="parameter">keysize</replaceable></option></arg>
-      <arg choice="opt" rep="norepeat"><option>-n <replaceable class="parameter">nametype</replaceable></option></arg>
       <arg choice="opt" rep="norepeat"><option>-3</option></arg>
       <arg choice="opt" rep="norepeat"><option>-A <replaceable class="parameter">date/offset</replaceable></option></arg>
+      <arg rep="norepeat"><option>-a <replaceable class="parameter">algorithm</replaceable></option></arg>
+      <arg choice="opt" rep="norepeat"><option>-b <replaceable class="parameter">keysize</replaceable></option></arg>
       <arg choice="opt" rep="norepeat"><option>-C</option></arg>
       <arg choice="opt" rep="norepeat"><option>-c <replaceable class="parameter">class</replaceable></option></arg>
       <arg choice="opt" rep="norepeat"><option>-D <replaceable class="parameter">date/offset</replaceable></option></arg>
@@ -77,6 +76,7 @@
       <arg choice="opt" rep="norepeat"><option>-K <replaceable class="parameter">directory</replaceable></option></arg>
       <arg choice="opt" rep="norepeat"><option>-k</option></arg>
       <arg choice="opt" rep="norepeat"><option>-L <replaceable class="parameter">ttl</replaceable></option></arg>
+      <arg choice="opt" rep="norepeat"><option>-n <replaceable class="parameter">nametype</replaceable></option></arg>
       <arg choice="opt" rep="norepeat"><option>-P <replaceable class="parameter">date/offset</replaceable></option></arg>
       <arg choice="opt" rep="norepeat"><option>-P sync <replaceable class="parameter">date/offset</replaceable></option></arg>
       <arg choice="opt" rep="norepeat"><option>-p <replaceable class="parameter">protocol</replaceable></option></arg>
@@ -88,7 +88,6 @@
       <arg choice="opt" rep="norepeat"><option>-t <replaceable class="parameter">type</replaceable></option></arg>
       <arg choice="opt" rep="norepeat"><option>-V</option></arg>
       <arg choice="opt" rep="norepeat"><option>-v <replaceable class="parameter">level</replaceable></option></arg>
-      <arg choice="opt" rep="norepeat"><option>-z</option></arg>
       <arg choice="req" rep="norepeat">name</arg>
     </cmdsynopsis>
   </refsynopsisdiv>
@@ -112,6 +111,20 @@
 
 
     <variablelist>
+
+      <varlistentry>
+	<term>-3</term>
+	<listitem>
+	  <para>
+	    Use an NSEC3-capable algorithm to generate a DNSSEC key.
+	    If this option is used with an algorithm that has both
+	    NSEC and NSEC3 versions, then the NSEC3 version will be
+	    used; for example, <command>dnssec-keygen -3a RSASHA1</command>
+	    specifies the NSEC3RSASHA1 algorithm.
+	  </para>
+	</listitem>
+      </varlistentry>
+
       <varlistentry>
 	<term>-a <replaceable class="parameter">algorithm</replaceable></term>
 	<listitem>
@@ -168,45 +181,16 @@
 	</listitem>
       </varlistentry>
 
-      <varlistentry>
-	<term>-n <replaceable class="parameter">nametype</replaceable></term>
-	<listitem>
-	  <para>
-	    Specifies the owner type of the key.  The value of
-	    <option>nametype</option> must either be ZONE (for a DNSSEC
-	    zone key (KEY/DNSKEY)), HOST or ENTITY (for a key associated with
-	    a host (KEY)),
-	    USER (for a key associated with a user(KEY)) or OTHER (DNSKEY).
-	    These values are case insensitive.  Defaults to ZONE for DNSKEY
-	    generation.
-	  </para>
-	</listitem>
-      </varlistentry>
-
-      <varlistentry>
-	<term>-3</term>
-	<listitem>
-	  <para>
-	    Use an NSEC3-capable algorithm to generate a DNSSEC key.
-	    If this option is used and no algorithm is explicitly
-	    set on the command line, NSEC3RSASHA1 will be used by
-	    default. Note that RSASHA256, RSASHA512, ECCGOST,
-	    ECDSAP256SHA256, ECDSAP384SHA384, ED25519 and ED448
-	    algorithms are NSEC3-capable.
-	  </para>
-	</listitem>
-      </varlistentry>
-
       <varlistentry>
 	<term>-C</term>
 	<listitem>
 	  <para>
-	    Compatibility mode:  generates an old-style key, without
-	    any metadata.  By default, <command>dnssec-keygen</command>
-	    will include the key's creation date in the metadata stored
-	    with the private key, and other dates may be set there as well
-	    (publication date, activation date, etc).  Keys that include
-	    this data may be incompatible with older versions of BIND; the
+	    Compatibility mode: generates an old-style key, without any
+	    timing metadata. By default, <command>dnssec-keygen</command>
+	    will include the key's creation date in the metadata stored with
+	    the private key, and other dates may be set there as well
+	    (publication date, activation date, etc). Keys that include this
+	    data may be incompatible with older versions of BIND; the
 	    <option>-C</option> option suppresses them.
 	  </para>
 	</listitem>
@@ -315,14 +299,28 @@
 	</listitem>
       </varlistentry>
 
+      <varlistentry>
+	<term>-n <replaceable class="parameter">nametype</replaceable></term>
+	<listitem>
+	  <para>
+	    Specifies the owner type of the key.  The value of
+	    <option>nametype</option> must either be ZONE (for a DNSSEC
+	    zone key (KEY/DNSKEY)), HOST or ENTITY (for a key associated
+	    with a host (KEY)), USER (for a key associated with a
+	    user(KEY)) or OTHER (DNSKEY).  These values are case
+	    insensitive.  Defaults to ZONE for DNSKEY generation.
+	  </para>
+	</listitem>
+      </varlistentry>
+
       <varlistentry>
 	<term>-p <replaceable class="parameter">protocol</replaceable></term>
 	<listitem>
 	  <para>
-	    Sets the protocol value for the generated key.  The protocol
-	    is a number between 0 and 255.  The default is 3 (DNSSEC).
-	    Other possible values for this argument are listed in
-	    RFC 2535 and its successors.
+	    Sets the protocol value for the generated key, for use
+	    with <option>-T KEY</option>. The protocol is a number between 0
+	    and 255. The default is 3 (DNSSEC). Other possible values for
+	    this argument are listed in RFC 2535 and its successors.
 	  </para>
 	</listitem>
       </varlistentry>
@@ -409,19 +407,11 @@
 	<term>-t <replaceable class="parameter">type</replaceable></term>
 	<listitem>
 	  <para>
-	    Indicates the use of the key.  <option>type</option> must be
-	    one of AUTHCONF, NOAUTHCONF, NOAUTH, or NOCONF.  The default
-	    is AUTHCONF.  AUTH refers to the ability to authenticate
-	    data, and CONF the ability to encrypt data.
-	  </para>
-	</listitem>
-      </varlistentry>
-
-      <varlistentry>
-	<term>-v <replaceable class="parameter">level</replaceable></term>
-	<listitem>
-	  <para>
-	    Sets the debugging level.
+	    Indicates the use of the key, for use with <option>-T
+	    KEY</option>. <option>type</option> must be one of AUTHCONF,
+	    NOAUTHCONF, NOAUTH, or NOCONF. The default is AUTHCONF. AUTH
+	    refers to the ability to authenticate data, and CONF the ability
+	    to encrypt data.
 	  </para>
 	</listitem>
       </varlistentry>
@@ -435,6 +425,15 @@
 	</listitem>
       </varlistentry>
 
+      <varlistentry>
+	<term>-v <replaceable class="parameter">level</replaceable></term>
+	<listitem>
+	  <para>
+	    Sets the debugging level.
+	  </para>
+	</listitem>
+      </varlistentry>
+
     </variablelist>
   </refsection>
 
@@ -637,6 +636,12 @@
       and
       <filename>Kexample.com.+003+26160.private</filename>.
     </para>
+    <para>
+      To generate a matching key-signing key, issue the command:
+    </para>
+    <para>
+      <userinput>dnssec-keygen -a DSA -b 768 -n ZONE -f KSK example.com</userinput>
+    </para>
   </refsection>
 
   <refsection><info><title>SEE ALSO</title></info>

bin/named/client.c

@@ -2825,8 +2825,9 @@ client_request(isc_task_t *task, isc_event_t *event) {
 				     true) == ISC_R_SUCCESS)
 		ra = true;
 
-	if (ra == true)
+	if (ra == true) {
 		client->attributes |= NS_CLIENTATTR_RA;
+	}
 
 	ns_client_log(client, DNS_LOGCATEGORY_SECURITY, NS_LOGMODULE_CLIENT,
 		      ISC_LOG_DEBUG(3), ra ? "recursion available" :
@@ -2852,10 +2853,11 @@ client_request(isc_task_t *task, isc_event_t *event) {
 	case dns_opcode_query:
 		CTRACE("query");
 #ifdef HAVE_DNSTAP
-		if ((client->message->flags & DNS_MESSAGEFLAG_RD) != 0)
+		if (ra && (client->message->flags & DNS_MESSAGEFLAG_RD) != 0) {
 			dtmsgtype = DNS_DTTYPE_CQ;
-		else
+		} else {
 			dtmsgtype = DNS_DTTYPE_AQ;
+		}
 
 		dns_dt_send(view, dtmsgtype, &client->peeraddr,
 			    &client->destsockaddr, TCP_CLIENT(client), NULL,

bin/named/named.conf.5

@@ -10,12 +10,12 @@
 .\"     Title: named.conf
 .\"    Author: 
 .\" Generator: DocBook XSL Stylesheets v1.78.1 <http://docbook.sf.net/>
-.\"      Date: 2018-06-21
+.\"      Date: 2019-02-20
 .\"    Manual: BIND9
 .\"    Source: ISC
 .\"  Language: English
 .\"
-.TH "NAMED\&.CONF" "5" "2018\-06\-21" "ISC" "BIND9"
+.TH "NAMED\&.CONF" "5" "2019\-02\-20" "ISC" "BIND9"
 .\" -----------------------------------------------------------------
 .\" * Define some portability stuff
 .\" -----------------------------------------------------------------
@@ -232,9 +232,9 @@ options {
 	bindkeys\-file \fIquoted_string\fR;
 	blackhole { \fIaddress_match_element\fR; \&.\&.\&. };
 	cache\-file \fIquoted_string\fR;
-	catalog\-zones { zone \fIquoted_string\fR [ default\-masters [ port
-	    \fIinteger\fR ] [ dscp \fIinteger\fR ] { ( \fImasters\fR | \fIipv4_address\fR [
-	    port \fIinteger\fR ] | \fIipv6_address\fR [ port \fIinteger\fR ] ) [ key
+	catalog\-zones { zone \fIstring\fR [ default\-masters [ port \fIinteger\fR ]
+	    [ dscp \fIinteger\fR ] { ( \fImasters\fR | \fIipv4_address\fR [ port
+	    \fIinteger\fR ] | \fIipv6_address\fR [ port \fIinteger\fR ] ) [ key
 	    \fIstring\fR ]; \&.\&.\&. } ] [ zone\-directory \fIquoted_string\fR ] [
 	    in\-memory \fIboolean\fR ] [ min\-update\-interval \fIinteger\fR ]; \&.\&.\&. };
 	check\-dup\-records ( fail | warn | ignore );
@@ -418,13 +418,13 @@ options {
 	require\-server\-cookie \fIboolean\fR;
 	reserved\-sockets \fIinteger\fR;
 	resolver\-query\-timeout \fIinteger\fR;
-	response\-policy { zone \fIquoted_string\fR [ log \fIboolean\fR ] [
-	    max\-policy\-ttl \fIinteger\fR ] [ policy ( cname | disabled | drop |
-	    given | no\-op | nodata | nxdomain | passthru | tcp\-only
-	    \fIquoted_string\fR ) ] [ recursive\-only \fIboolean\fR ]; \&.\&.\&. } [
-	    break\-dnssec \fIboolean\fR ] [ max\-policy\-ttl \fIinteger\fR ] [
-	    min\-ns\-dots \fIinteger\fR ] [ nsip\-wait\-recurse \fIboolean\fR ] [
-	    qname\-wait\-recurse \fIboolean\fR ] [ recursive\-only \fIboolean\fR ];
+	response\-policy { zone \fIstring\fR [ log \fIboolean\fR ] [ max\-policy\-ttl
+	    \fIinteger\fR ] [ policy ( cname | disabled | drop | given | no\-op
+	    | nodata | nxdomain | passthru | tcp\-only \fIquoted_string\fR ) ] [
+	    recursive\-only \fIboolean\fR ]; \&.\&.\&. } [ break\-dnssec \fIboolean\fR ] [
+	    max\-policy\-ttl \fIinteger\fR ] [ min\-ns\-dots \fIinteger\fR ] [
+	    nsip\-wait\-recurse \fIboolean\fR ] [ qname\-wait\-recurse \fIboolean\fR ]
+	    [ recursive\-only \fIboolean\fR ];
 	root\-delegation\-only [ exclude { \fIquoted_string\fR; \&.\&.\&. } ];
 	root\-key\-sentinel \fIboolean\fR;
 	rrset\-order { [ class \fIstring\fR ] [ type \fIstring\fR ] [ name
@@ -578,9 +578,9 @@ view \fIstring\fR [ \fIclass\fR ] {
 	auth\-nxdomain \fIboolean\fR; // default changed
 	auto\-dnssec ( allow | maintain | off );
 	cache\-file \fIquoted_string\fR;
-	catalog\-zones { zone \fIquoted_string\fR [ default\-masters [ port
-	    \fIinteger\fR ] [ dscp \fIinteger\fR ] { ( \fImasters\fR | \fIipv4_address\fR [
-	    port \fIinteger\fR ] | \fIipv6_address\fR [ port \fIinteger\fR ] ) [ key
+	catalog\-zones { zone \fIstring\fR [ default\-masters [ port \fIinteger\fR ]
+	    [ dscp \fIinteger\fR ] { ( \fImasters\fR | \fIipv4_address\fR [ port
+	    \fIinteger\fR ] | \fIipv6_address\fR [ port \fIinteger\fR ] ) [ key
 	    \fIstring\fR ]; \&.\&.\&. } ] [ zone\-directory \fIquoted_string\fR ] [
 	    in\-memory \fIboolean\fR ] [ min\-update\-interval \fIinteger\fR ]; \&.\&.\&. };
 	check\-dup\-records ( fail | warn | ignore );
@@ -734,13 +734,13 @@ view \fIstring\fR [ \fIclass\fR ] {
 	request\-nsid \fIboolean\fR;
 	require\-server\-cookie \fIboolean\fR;
 	resolver\-query\-timeout \fIinteger\fR;
-	response\-policy { zone \fIquoted_string\fR [ log \fIboolean\fR ] [
-	    max\-policy\-ttl \fIinteger\fR ] [ policy ( cname | disabled | drop |
-	    given | no\-op | nodata | nxdomain | passthru | tcp\-only
-	    \fIquoted_string\fR ) ] [ recursive\-only \fIboolean\fR ]; \&.\&.\&. } [
-	    break\-dnssec \fIboolean\fR ] [ max\-policy\-ttl \fIinteger\fR ] [
-	    min\-ns\-dots \fIinteger\fR ] [ nsip\-wait\-recurse \fIboolean\fR ] [
-	    qname\-wait\-recurse \fIboolean\fR ] [ recursive\-only \fIboolean\fR ];
+	response\-policy { zone \fIstring\fR [ log \fIboolean\fR ] [ max\-policy\-ttl
+	    \fIinteger\fR ] [ policy ( cname | disabled | drop | given | no\-op
+	    | nodata | nxdomain | passthru | tcp\-only \fIquoted_string\fR ) ] [
+	    recursive\-only \fIboolean\fR ]; \&.\&.\&. } [ break\-dnssec \fIboolean\fR ] [
+	    max\-policy\-ttl \fIinteger\fR ] [ min\-ns\-dots \fIinteger\fR ] [
+	    nsip\-wait\-recurse \fIboolean\fR ] [ qname\-wait\-recurse \fIboolean\fR ]
+	    [ recursive\-only \fIboolean\fR ];
 	root\-delegation\-only [ exclude { \fIquoted_string\fR; \&.\&.\&. } ];
 	root\-key\-sentinel \fIboolean\fR;
 	rrset\-order { [ class \fIstring\fR ] [ type \fIstring\fR ] [ name

bin/named/named.conf.docbook

@@ -13,7 +13,7 @@
 
 <refentry xmlns:db="http://docbook.org/ns/docbook" version="5.0" xml:id="man.named.conf">
   <info>
-    <date>2018-06-21</date>
+    <date>2019-02-20</date>
   </info>
   <refentryinfo>
     <corpname>ISC</corpname>
@@ -221,9 +221,9 @@ options {
 	bindkeys-file <replaceable>quoted_string</replaceable>;
 	blackhole { <replaceable>address_match_element</replaceable>; ... };
 	cache-file <replaceable>quoted_string</replaceable>;
-	catalog-zones { zone <replaceable>quoted_string</replaceable> [ default-masters [ port
-	    <replaceable>integer</replaceable> ] [ dscp <replaceable>integer</replaceable> ] { ( <replaceable>masters</replaceable> | <replaceable>ipv4_address</replaceable> [
-	    port <replaceable>integer</replaceable> ] | <replaceable>ipv6_address</replaceable> [ port <replaceable>integer</replaceable> ] ) [ key
+	catalog-zones { zone <replaceable>string</replaceable> [ default-masters [ port <replaceable>integer</replaceable> ]
+	    [ dscp <replaceable>integer</replaceable> ] { ( <replaceable>masters</replaceable> | <replaceable>ipv4_address</replaceable> [ port
+	    <replaceable>integer</replaceable> ] | <replaceable>ipv6_address</replaceable> [ port <replaceable>integer</replaceable> ] ) [ key
 	    <replaceable>string</replaceable> ]; ... } ] [ zone-directory <replaceable>quoted_string</replaceable> ] [
 	    in-memory <replaceable>boolean</replaceable> ] [ min-update-interval <replaceable>integer</replaceable> ]; ... };
 	check-dup-records ( fail | warn | ignore );
@@ -407,13 +407,13 @@ options {
 	require-server-cookie <replaceable>boolean</replaceable>;
 	reserved-sockets <replaceable>integer</replaceable>;
 	resolver-query-timeout <replaceable>integer</replaceable>;
-	response-policy { zone <replaceable>quoted_string</replaceable> [ log <replaceable>boolean</replaceable> ] [
-	    max-policy-ttl <replaceable>integer</replaceable> ] [ policy ( cname | disabled | drop |
-	    given | no-op | nodata | nxdomain | passthru | tcp-only
-	    <replaceable>quoted_string</replaceable> ) ] [ recursive-only <replaceable>boolean</replaceable> ]; ... } [
-	    break-dnssec <replaceable>boolean</replaceable> ] [ max-policy-ttl <replaceable>integer</replaceable> ] [
-	    min-ns-dots <replaceable>integer</replaceable> ] [ nsip-wait-recurse <replaceable>boolean</replaceable> ] [
-	    qname-wait-recurse <replaceable>boolean</replaceable> ] [ recursive-only <replaceable>boolean</replaceable> ];
+	response-policy { zone <replaceable>string</replaceable> [ log <replaceable>boolean</replaceable> ] [ max-policy-ttl
+	    <replaceable>integer</replaceable> ] [ policy ( cname | disabled | drop | given | no-op
+	    | nodata | nxdomain | passthru | tcp-only <replaceable>quoted_string</replaceable> ) ] [
+	    recursive-only <replaceable>boolean</replaceable> ]; ... } [ break-dnssec <replaceable>boolean</replaceable> ] [
+	    max-policy-ttl <replaceable>integer</replaceable> ] [ min-ns-dots <replaceable>integer</replaceable> ] [
+	    nsip-wait-recurse <replaceable>boolean</replaceable> ] [ qname-wait-recurse <replaceable>boolean</replaceable> ]
+	    [ recursive-only <replaceable>boolean</replaceable> ];
 	root-delegation-only [ exclude { <replaceable>quoted_string</replaceable>; ... } ];
 	root-key-sentinel <replaceable>boolean</replaceable>;
 	rrset-order { [ class <replaceable>string</replaceable> ] [ type <replaceable>string</replaceable> ] [ name
@@ -551,9 +551,9 @@ view <replaceable>string</replaceable> [ <replaceable>class</replaceable> ] {
 	auth-nxdomain <replaceable>boolean</replaceable>; // default changed
 	auto-dnssec ( allow | maintain | off );
 	cache-file <replaceable>quoted_string</replaceable>;
-	catalog-zones { zone <replaceable>quoted_string</replaceable> [ default-masters [ port
-	    <replaceable>integer</replaceable> ] [ dscp <replaceable>integer</replaceable> ] { ( <replaceable>masters</replaceable> | <replaceable>ipv4_address</replaceable> [
-	    port <replaceable>integer</replaceable> ] | <replaceable>ipv6_address</replaceable> [ port <replaceable>integer</replaceable> ] ) [ key
+	catalog-zones { zone <replaceable>string</replaceable> [ default-masters [ port <replaceable>integer</replaceable> ]
+	    [ dscp <replaceable>integer</replaceable> ] { ( <replaceable>masters</replaceable> | <replaceable>ipv4_address</replaceable> [ port
+	    <replaceable>integer</replaceable> ] | <replaceable>ipv6_address</replaceable> [ port <replaceable>integer</replaceable> ] ) [ key
 	    <replaceable>string</replaceable> ]; ... } ] [ zone-directory <replaceable>quoted_string</replaceable> ] [
 	    in-memory <replaceable>boolean</replaceable> ] [ min-update-interval <replaceable>integer</replaceable> ]; ... };
 	check-dup-records ( fail | warn | ignore );
@@ -707,13 +707,13 @@ view <replaceable>string</replaceable> [ <replaceable>class</replaceable> ] {
 	request-nsid <replaceable>boolean</replaceable>;
 	require-server-cookie <replaceable>boolean</replaceable>;
 	resolver-query-timeout <replaceable>integer</replaceable>;
-	response-policy { zone <replaceable>quoted_string</replaceable> [ log <replaceable>boolean</replaceable> ] [
-	    max-policy-ttl <replaceable>integer</replaceable> ] [ policy ( cname | disabled | drop |
-	    given | no-op | nodata | nxdomain | passthru | tcp-only
-	    <replaceable>quoted_string</replaceable> ) ] [ recursive-only <replaceable>boolean</replaceable> ]; ... } [
-	    break-dnssec <replaceable>boolean</replaceable> ] [ max-policy-ttl <replaceable>integer</replaceable> ] [
-	    min-ns-dots <replaceable>integer</replaceable> ] [ nsip-wait-recurse <replaceable>boolean</replaceable> ] [
-	    qname-wait-recurse <replaceable>boolean</replaceable> ] [ recursive-only <replaceable>boolean</replaceable> ];
+	response-policy { zone <replaceable>string</replaceable> [ log <replaceable>boolean</replaceable> ] [ max-policy-ttl
+	    <replaceable>integer</replaceable> ] [ policy ( cname | disabled | drop | given | no-op
+	    | nodata | nxdomain | passthru | tcp-only <replaceable>quoted_string</replaceable> ) ] [
+	    recursive-only <replaceable>boolean</replaceable> ]; ... } [ break-dnssec <replaceable>boolean</replaceable> ] [
+	    max-policy-ttl <replaceable>integer</replaceable> ] [ min-ns-dots <replaceable>integer</replaceable> ] [
+	    nsip-wait-recurse <replaceable>boolean</replaceable> ] [ qname-wait-recurse <replaceable>boolean</replaceable> ]
+	    [ recursive-only <replaceable>boolean</replaceable> ];
 	root-delegation-only [ exclude { <replaceable>quoted_string</replaceable>; ... } ];
 	root-key-sentinel <replaceable>boolean</replaceable>;
 	rrset-order { [ class <replaceable>string</replaceable> ] [ type <replaceable>string</replaceable> ] [ name

bin/named/named.conf.html

@@ -209,9 +209,9 @@ options
 	bindkeys-file <em class="replaceable"><code>quoted_string</code></em>;<br>
 	blackhole { <em class="replaceable"><code>address_match_element</code></em>; ... };<br>
 	cache-file <em class="replaceable"><code>quoted_string</code></em>;<br>
-	catalog-zones { zone <em class="replaceable"><code>quoted_string</code></em> [ default-masters [ port<br>
-	    <em class="replaceable"><code>integer</code></em> ] [ dscp <em class="replaceable"><code>integer</code></em> ] { ( <em class="replaceable"><code>masters</code></em> | <em class="replaceable"><code>ipv4_address</code></em> [<br>
-	    port <em class="replaceable"><code>integer</code></em> ] | <em class="replaceable"><code>ipv6_address</code></em> [ port <em class="replaceable"><code>integer</code></em> ] ) [ key<br>
+	catalog-zones { zone <em class="replaceable"><code>string</code></em> [ default-masters [ port <em class="replaceable"><code>integer</code></em> ]<br>
+	    [ dscp <em class="replaceable"><code>integer</code></em> ] { ( <em class="replaceable"><code>masters</code></em> | <em class="replaceable"><code>ipv4_address</code></em> [ port<br>
+	    <em class="replaceable"><code>integer</code></em> ] | <em class="replaceable"><code>ipv6_address</code></em> [ port <em class="replaceable"><code>integer</code></em> ] ) [ key<br>
 	    <em class="replaceable"><code>string</code></em> ]; ... } ] [ zone-directory <em class="replaceable"><code>quoted_string</code></em> ] [<br>
 	    in-memory <em class="replaceable"><code>boolean</code></em> ] [ min-update-interval <em class="replaceable"><code>integer</code></em> ]; ... };<br>
 	check-dup-records ( fail | warn | ignore );<br>
@@ -395,13 +395,13 @@ options
 	require-server-cookie <em class="replaceable"><code>boolean</code></em>;<br>
 	reserved-sockets <em class="replaceable"><code>integer</code></em>;<br>
 	resolver-query-timeout <em class="replaceable"><code>integer</code></em>;<br>
-	response-policy { zone <em class="replaceable"><code>quoted_string</code></em> [ log <em class="replaceable"><code>boolean</code></em> ] [<br>
-	    max-policy-ttl <em class="replaceable"><code>integer</code></em> ] [ policy ( cname | disabled | drop |<br>
-	    given | no-op | nodata | nxdomain | passthru | tcp-only<br>
-	    <em class="replaceable"><code>quoted_string</code></em> ) ] [ recursive-only <em class="replaceable"><code>boolean</code></em> ]; ... } [<br>
-	    break-dnssec <em class="replaceable"><code>boolean</code></em> ] [ max-policy-ttl <em class="replaceable"><code>integer</code></em> ] [<br>
-	    min-ns-dots <em class="replaceable"><code>integer</code></em> ] [ nsip-wait-recurse <em class="replaceable"><code>boolean</code></em> ] [<br>
-	    qname-wait-recurse <em class="replaceable"><code>boolean</code></em> ] [ recursive-only <em class="replaceable"><code>boolean</code></em> ];<br>
+	response-policy { zone <em class="replaceable"><code>string</code></em> [ log <em class="replaceable"><code>boolean</code></em> ] [ max-policy-ttl<br>
+	    <em class="replaceable"><code>integer</code></em> ] [ policy ( cname | disabled | drop | given | no-op<br>
+	    | nodata | nxdomain | passthru | tcp-only <em class="replaceable"><code>quoted_string</code></em> ) ] [<br>
+	    recursive-only <em class="replaceable"><code>boolean</code></em> ]; ... } [ break-dnssec <em class="replaceable"><code>boolean</code></em> ] [<br>
+	    max-policy-ttl <em class="replaceable"><code>integer</code></em> ] [ min-ns-dots <em class="replaceable"><code>integer</code></em> ] [<br>
+	    nsip-wait-recurse <em class="replaceable"><code>boolean</code></em> ] [ qname-wait-recurse <em class="replaceable"><code>boolean</code></em> ]<br>
+	    [ recursive-only <em class="replaceable"><code>boolean</code></em> ];<br>
 	root-delegation-only [ exclude { <em class="replaceable"><code>quoted_string</code></em>; ... } ];<br>
 	root-key-sentinel <em class="replaceable"><code>boolean</code></em>;<br>
 	rrset-order { [ class <em class="replaceable"><code>string</code></em> ] [ type <em class="replaceable"><code>string</code></em> ] [ name<br>
@@ -543,9 +543,9 @@ view
 	auth-nxdomain <em class="replaceable"><code>boolean</code></em>; // default changed<br>
 	auto-dnssec ( allow | maintain | off );<br>
 	cache-file <em class="replaceable"><code>quoted_string</code></em>;<br>
-	catalog-zones { zone <em class="replaceable"><code>quoted_string</code></em> [ default-masters [ port<br>
-	    <em class="replaceable"><code>integer</code></em> ] [ dscp <em class="replaceable"><code>integer</code></em> ] { ( <em class="replaceable"><code>masters</code></em> | <em class="replaceable"><code>ipv4_address</code></em> [<br>
-	    port <em class="replaceable"><code>integer</code></em> ] | <em class="replaceable"><code>ipv6_address</code></em> [ port <em class="replaceable"><code>integer</code></em> ] ) [ key<br>
+	catalog-zones { zone <em class="replaceable"><code>string</code></em> [ default-masters [ port <em class="replaceable"><code>integer</code></em> ]<br>
+	    [ dscp <em class="replaceable"><code>integer</code></em> ] { ( <em class="replaceable"><code>masters</code></em> | <em class="replaceable"><code>ipv4_address</code></em> [ port<br>
+	    <em class="replaceable"><code>integer</code></em> ] | <em class="replaceable"><code>ipv6_address</code></em> [ port <em class="replaceable"><code>integer</code></em> ] ) [ key<br>
 	    <em class="replaceable"><code>string</code></em> ]; ... } ] [ zone-directory <em class="replaceable"><code>quoted_string</code></em> ] [<br>
 	    in-memory <em class="replaceable"><code>boolean</code></em> ] [ min-update-interval <em class="replaceable"><code>integer</code></em> ]; ... };<br>
 	check-dup-records ( fail | warn | ignore );<br>
@@ -699,13 +699,13 @@ view
 	request-nsid <em class="replaceable"><code>boolean</code></em>;<br>
 	require-server-cookie <em class="replaceable"><code>boolean</code></em>;<br>
 	resolver-query-timeout <em class="replaceable"><code>integer</code></em>;<br>
-	response-policy { zone <em class="replaceable"><code>quoted_string</code></em> [ log <em class="replaceable"><code>boolean</code></em> ] [<br>
-	    max-policy-ttl <em class="replaceable"><code>integer</code></em> ] [ policy ( cname | disabled | drop |<br>
-	    given | no-op | nodata | nxdomain | passthru | tcp-only<br>
-	    <em class="replaceable"><code>quoted_string</code></em> ) ] [ recursive-only <em class="replaceable"><code>boolean</code></em> ]; ... } [<br>
-	    break-dnssec <em class="replaceable"><code>boolean</code></em> ] [ max-policy-ttl <em class="replaceable"><code>integer</code></em> ] [<br>
-	    min-ns-dots <em class="replaceable"><code>integer</code></em> ] [ nsip-wait-recurse <em class="replaceable"><code>boolean</code></em> ] [<br>
-	    qname-wait-recurse <em class="replaceable"><code>boolean</code></em> ] [ recursive-only <em class="replaceable"><code>boolean</code></em> ];<br>
+	response-policy { zone <em class="replaceable"><code>string</code></em> [ log <em class="replaceable"><code>boolean</code></em> ] [ max-policy-ttl<br>
+	    <em class="replaceable"><code>integer</code></em> ] [ policy ( cname | disabled | drop | given | no-op<br>
+	    | nodata | nxdomain | passthru | tcp-only <em class="replaceable"><code>quoted_string</code></em> ) ] [<br>
+	    recursive-only <em class="replaceable"><code>boolean</code></em> ]; ... } [ break-dnssec <em class="replaceable"><code>boolean</code></em> ] [<br>
+	    max-policy-ttl <em class="replaceable"><code>integer</code></em> ] [ min-ns-dots <em class="replaceable"><code>integer</code></em> ] [<br>
+	    nsip-wait-recurse <em class="replaceable"><code>boolean</code></em> ] [ qname-wait-recurse <em class="replaceable"><code>boolean</code></em> ]<br>
+	    [ recursive-only <em class="replaceable"><code>boolean</code></em> ];<br>
 	root-delegation-only [ exclude { <em class="replaceable"><code>quoted_string</code></em>; ... } ];<br>
 	root-key-sentinel <em class="replaceable"><code>boolean</code></em>;<br>
 	rrset-order { [ class <em class="replaceable"><code>string</code></em> ] [ type <em class="replaceable"><code>string</code></em> ] [ name<br>

bin/named/query.c

@@ -6568,6 +6568,7 @@ redirect2(ns_client_t *client, dns_name_t *name, dns_rdataset_t *rdataset,
 	dns_dbversion_t *version = NULL;
 	dns_zone_t *zone = NULL;
 	bool is_zone;
+	unsigned int labels;
 	unsigned int options;
 
 	CTRACE(ISC_LOG_DEBUG(3), "redirect2");
@@ -6610,12 +6611,13 @@ redirect2(ns_client_t *client, dns_name_t *name, dns_rdataset_t *rdataset,
 	}
 
 	redirectname = dns_fixedname_initname(&fixedredirect);
-	if (dns_name_countlabels(name) > 1U) {
+	labels = dns_name_countlabels(client->query.qname);
+	if (labels > 1U) {
 		dns_name_t prefix;
-		unsigned int labels = dns_name_countlabels(name) - 1;
 
 		dns_name_init(&prefix, NULL);
-		dns_name_getlabelsequence(name, 0, labels, &prefix);
+		dns_name_getlabelsequence(client->query.qname, 0, labels - 1,
+					  &prefix);
 		result = dns_name_concatenate(&prefix,
 					      client->view->redirectzone,
 					      redirectname, NULL);

bin/nsupdate/nsupdate.c

@@ -33,6 +33,7 @@
 #include <isc/log.h>
 #include <isc/mem.h>
 #include <isc/parseint.h>
+#include <isc/portset.h>
 #include <isc/print.h>
 #include <isc/random.h>
 #include <isc/region.h>
@@ -850,6 +851,34 @@ shutdown_program(isc_task_t *task, isc_event_t *event) {
 	maybeshutdown();
 }
 
+/*
+ * Try honoring the operating system's preferred ephemeral port range.
+ */
+static void
+set_source_ports(dns_dispatchmgr_t *manager) {
+	isc_portset_t *v4portset = NULL, *v6portset = NULL;
+	in_port_t udpport_low, udpport_high;
+	isc_result_t result;
+
+	result = isc_portset_create(gmctx, &v4portset);
+	check_result(result, "isc_portset_create (v4)");
+	result = isc_net_getudpportrange(AF_INET, &udpport_low, &udpport_high);
+	check_result(result, "isc_net_getudpportrange (v4)");
+	isc_portset_addrange(v4portset, udpport_low, udpport_high);
+
+	result = isc_portset_create(gmctx, &v6portset);
+	check_result(result, "isc_portset_create (v6)");
+	result = isc_net_getudpportrange(AF_INET6, &udpport_low, &udpport_high);
+	check_result(result, "isc_net_getudpportrange (v6)");
+	isc_portset_addrange(v6portset, udpport_low, udpport_high);
+
+	result = dns_dispatchmgr_setavailports(manager, v4portset, v6portset);
+	check_result(result, "dns_dispatchmgr_setavailports");
+
+	isc_portset_destroy(gmctx, &v4portset);
+	isc_portset_destroy(gmctx, &v6portset);
+}
+
 static void
 setup_system(void) {
 	isc_result_t result;
@@ -975,6 +1004,8 @@ setup_system(void) {
 	check_result(result, "dst_lib_init");
 	is_dst_up = true;
 
+	set_source_ports(dispatchmgr);
+
 	attrmask = DNS_DISPATCHATTR_UDP | DNS_DISPATCHATTR_TCP;
 	attrmask |= DNS_DISPATCHATTR_IPV4 | DNS_DISPATCHATTR_IPV6;
 

bin/pkcs11/pkcs11-keygen.c

@@ -373,10 +373,12 @@ main(int argc, char *argv[]) {
 	switch (keyclass) {
 	case key_rsa:
 		op_type = OP_RSA;
-		if (expsize == 0)
+		if (expsize == 0) {
 			expsize = 3;
-		if (bits == 0)
+		}
+		if (bits == 0) {
 			usage();
+		}
 
 		mech.mechanism = CKM_RSA_PKCS_KEY_PAIR_GEN;
 		mech.pParameter = NULL;
@@ -389,9 +391,9 @@ main(int argc, char *argv[]) {
 		/* Set public exponent to F4 or F5 */
 		exponent[0] = 0x01;
 		exponent[1] = 0x00;
-		if (expsize == 3)
+		if (expsize == 3) {
 			exponent[2] = 0x01;
-		else {
+		} else {
 			exponent[2] = 0x00;
 			exponent[3] = 0x00;
 			exponent[4] = 0x01;
@@ -403,10 +405,15 @@ main(int argc, char *argv[]) {
 		public_template[RSA_PUBLIC_EXPONENT].ulValueLen = expsize;
 		break;
 	case key_ecc:
+#if !defined(HAVE_PKCS11_ECDSA)
+		fprintf(stderr,
+			"prime256v1 and secp3841r1 are not supported\n");
+		usage();
+#else
 		op_type = OP_EC;
-		if (bits == 0)
+		if (bits == 0) {
 			bits = 256;
-		else if (bits != 256 && bits != 384) {
+		} else if (bits != 256 && bits != 384) {
 			fprintf(stderr, "ECC keys only support bit sizes of "
 					"256 and 384\n");
 			exit(2);
@@ -429,7 +436,7 @@ main(int argc, char *argv[]) {
 			public_template[4].ulValueLen =
 				sizeof(pk11_ecc_secp384r1);
 		}
-
+#endif
 		break;
 	case key_ecx:
 #if !defined(CKM_EDDSA_KEY_PAIR_GEN)
@@ -437,9 +444,9 @@ main(int argc, char *argv[]) {
 		usage();
 #else
 		op_type = OP_EC;
-		if (bits == 0)
+		if (bits == 0) {
 			bits = 256;
-		else if (bits != 256 && bits != 456) {
+		} else if (bits != 256 && bits != 456) {
 			fprintf(stderr, "ECX keys only support bit sizes of "
 					"256 and 456\n");
 			exit(2);
@@ -570,8 +577,9 @@ main(int argc, char *argv[]) {
 	pk11_result_register();
 
 	/* Initialize the CRYPTOKI library */
-	if (lib_name != NULL)
+	if (lib_name != NULL) {
 		pk11_set_lib_name(lib_name);
+	}
 
 	if (pin == NULL)
 		pin = getpassphrase("Enter Pin: ");
@@ -729,8 +737,9 @@ main(int argc, char *argv[]) {
 	if (rv != CKR_OK) {
 		fprintf(stderr, "C_GenerateKeyPair: Error = 0x%.8lX\n", rv);
 		error = 1;
-	 } else if (!quiet)
+	} else if (!quiet) {
 		printf("Key pair generation complete.\n");
+	}
 
  exit_params:
 	/* Free parameter attributes */

bin/python/isc/checkds.py.in

@@ -37,7 +37,11 @@ class SECRR:
         if not rrtext:
             raise Exception
 
-        fields = rrtext.decode('ascii').split()
+        # 'str' does not have decode method in python3
+        if type(rrtext) is not str:
+            fields = rrtext.decode('ascii').split()
+        else:
+            fields = rrtext.split()
         if len(fields) < 7:
             raise Exception
 
@@ -99,6 +103,8 @@ def check(zone, args, masterfile=None, lookaside=None):
     fp, _ = Popen(cmd, stdout=PIPE).communicate()
 
     for line in fp.splitlines():
+        if type(line) is not str:
+            line = line.decode('ascii')
         rrlist.append(SECRR(line, lookaside))
     rrlist = sorted(rrlist, key=lambda rr: (rr.keyid, rr.keyalg, rr.hashalg))
 
@@ -120,6 +126,8 @@ def check(zone, args, masterfile=None, lookaside=None):
         fp, _ = Popen(cmd, stdin=PIPE, stdout=PIPE).communicate(intods)
 
     for line in fp.splitlines():
+        if type(line) is not str:
+            line = line.decode('ascii')
         klist.append(SECRR(line, lookaside))
 
     if len(klist) < 1:

bin/python/isc/keyzone.py.in

@@ -43,6 +43,8 @@ class keyzone:
         fp, _ = Popen([czpath, "-o", "-", name, filename],
                       stdout=PIPE, stderr=PIPE).communicate()
         for line in fp.splitlines():
+            if type(line) is not str:
+                line = line.decode('ascii')
             if re.search('^[:space:]*;', line):
                 continue
             fields = line.split()

bin/tests/system/Makefile.in

@@ -19,7 +19,7 @@ SUBDIRS =	dlzexternal dyndb lwresd pipelined rndc rsabigexponent tkey
 
 CINCLUDES =	${ISC_INCLUDES} ${DNS_INCLUDES}
 
-CDEFINES =	@USE_GSSAPI@
+CDEFINES =	@USE_GSSAPI@ @CONTRIB_DLZ@
 CWARNINGS =
 
 DNSLIBS =

bin/tests/system/addzone/setup.sh

@@ -18,7 +18,3 @@ copy_setports ns1/named.conf.in ns1/named.conf
 copy_setports ns2/named1.conf.in ns2/named.conf
 cp -f ns2/default.nzf.in ns2/3bf305731dd26307.nzf
 copy_setports ns3/named1.conf.in ns3/named.conf
-
-rm -f ns3/*.nzf ns3/*.nzf~
-rm -f ns3/*.nzd ns3/*.nzd-lock
-rm -f ns3/inlineslave.db

bin/tests/system/allow-query/setup.sh

@@ -12,6 +12,8 @@
 SYSTEMTESTTOP=..
 . $SYSTEMTESTTOP/conf.sh
 
+$SHELL clean.sh
+
 copy_setports ../common/controls.conf.in ns2/controls.conf
 copy_setports  ns1/named.conf.in ns1/named.conf
 copy_setports  ns2/named01.conf.in ns2/named.conf

bin/tests/system/autosign/setup.sh

@@ -12,7 +12,7 @@
 SYSTEMTESTTOP=..
 . $SYSTEMTESTTOP/conf.sh
 
-. ./clean.sh
+$SHELL clean.sh
 
 test -r $RANDFILE || $GENRANDOM $RANDOMSIZE $RANDFILE
 

bin/tests/system/autosign/tests.sh

@@ -1379,8 +1379,12 @@ for i in 0 1 2 3 4 5 6 7 8 9; do
 	$DIG $DIGOPTS delzsk.example NSEC3PARAM @10.53.0.3 > dig.out.ns3.1.test$n 2>&1 || ret=1
 	grep "NSEC3PARAM.*12345678" dig.out.ns3.1.test$n > /dev/null 2>&1
 	if [ $? -eq 0 ]; then
-		_ret=0
-		break
+		$RNDCCMD 10.53.0.3 signing -list delzsk.example > signing.out.2.test$n 2>&1
+		grep "Creating NSEC3 chain " signing.out.2.test$n > /dev/null 2>&1
+		if [ $? -ne 0 ]; then
+			_ret=0
+			break
+		fi
 	fi
 	sleep 1
 done
@@ -1395,10 +1399,10 @@ $SETTIME -D now-1h $file > settime.out.test$n 2>&1 || ret=1
 $RNDCCMD 10.53.0.3 loadkeys delzsk.example 2>&1 | sed 's/^/ns3 /' | cat_i
 for i in 0 1 2 3 4 5 6 7 8 9; do
 	_ret=1
-	$RNDCCMD 10.53.0.3 signing -list delzsk.example > signing.out.2.test$n 2>&1
-	grep "Signing " signing.out.2.test$n > /dev/null 2>&1
+	$RNDCCMD 10.53.0.3 signing -list delzsk.example > signing.out.3.test$n 2>&1
+	grep "Signing " signing.out.3.test$n > /dev/null 2>&1
 	if [ $? -ne 0 ]; then
-		if [ `cat signing.out.2.test$n | wc -l` -eq 2 ]; then
+		if [ `grep "Done signing " signing.out.3.test$n | wc -l` -eq 2 ]; then
 			_ret=0
 			break
 		fi

bin/tests/system/case/setup.sh

@@ -10,7 +10,8 @@
 SYSTEMTESTTOP=..
 . $SYSTEMTESTTOP/conf.sh
 
-${SHELL} clean.sh
+$SHELL clean.sh
+
 cp -f ns1/dynamic.db.in ns1/dynamic.db
 copy_setports ns1/named.conf.in ns1/named.conf
 copy_setports ns2/named.conf.in ns2/named.conf

bin/tests/system/checkconf/setup.sh

@@ -0,0 +1,15 @@
+#!/bin/sh
+#
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+# shellcheck source=conf.sh
+. "$SYSTEMTESTTOP/conf.sh"
+
+$SHELL clean.sh

bin/tests/system/checkzone/setup.sh

@@ -10,7 +10,8 @@
 SYSTEMTESTTOP=..
 . $SYSTEMTESTTOP/conf.sh
 
-rm -f named-compilezone
+$SHELL clean.sh
+
 ln -s $CHECKZONE named-compilezone
 
 ./named-compilezone -D -F raw -o good1.db.raw example \

bin/tests/system/coverage/setup.sh

@@ -20,8 +20,6 @@ ln -s $CHECKZONE named-compilezone
 
 # Test 1: KSK goes inactive before successor is active
 dir=01-ksk-inactive
-rm -f $dir/K*.key
-rm -f $dir/K*.private
 ksk1=`$KEYGEN -q -K $dir -3fk example.com`
 $SETTIME -K $dir -I +9mo -D +1y $ksk1 > /dev/null 2>&1
 ksk2=`$KEYGEN -q -K $dir -S $ksk1`
@@ -30,8 +28,6 @@ zsk1=`$KEYGEN -q -K $dir -3 example.com`
 
 # Test 2: ZSK goes inactive before successor is active
 dir=02-zsk-inactive
-rm -f $dir/K*.key
-rm -f $dir/K*.private
 zsk1=`$KEYGEN -q -K $dir -3 example.com`
 $SETTIME -K $dir -I +9mo -D +1y $zsk1 > /dev/null 2>&1
 zsk2=`$KEYGEN -q -K $dir -S $zsk1`
@@ -40,8 +36,6 @@ ksk1=`$KEYGEN -q -K $dir -3fk example.com`
 
 # Test 3: KSK is unpublished before its successor is published
 dir=03-ksk-unpublished
-rm -f $dir/K*.key
-rm -f $dir/K*.private
 ksk1=`$KEYGEN -q -K $dir -3fk example.com`
 $SETTIME -K $dir -I +9mo -D +1y $ksk1 > /dev/null 2>&1
 ksk2=`$KEYGEN -q -K $dir -S $ksk1`
@@ -50,8 +44,6 @@ zsk1=`$KEYGEN -q -K $dir -3 example.com`
 
 # Test 4: ZSK is unpublished before its successor is published
 dir=04-zsk-unpublished
-rm -f $dir/K*.key
-rm -f $dir/K*.private
 zsk1=`$KEYGEN -q -K $dir -3 example.com`
 $SETTIME -K $dir -I +9mo -D +1y $zsk1 > /dev/null 2>&1
 zsk2=`$KEYGEN -q -K $dir -S $zsk1`
@@ -61,8 +53,6 @@ ksk1=`$KEYGEN -q -K $dir -3fk example.com`
 # Test 5: KSK deleted and successor published before KSK is deactivated
 # and successor activated.
 dir=05-ksk-unpub-active
-rm -f $dir/K*.key
-rm -f $dir/K*.private
 ksk1=`$KEYGEN -q -K $dir -3fk example.com`
 $SETTIME -K $dir -I +9mo -D +8mo $ksk1 > /dev/null 2>&1
 ksk2=`$KEYGEN -q -K $dir -S $ksk1`
@@ -71,8 +61,6 @@ zsk1=`$KEYGEN -q -K $dir -3 example.com`
 # Test 6: ZSK deleted and successor published before ZSK is deactivated
 # and successor activated.
 dir=06-zsk-unpub-active
-rm -f $dir/K*.key
-rm -f $dir/K*.private
 zsk1=`$KEYGEN -q -K $dir -3 example.com`
 $SETTIME -K $dir -I +9mo -D +8mo $zsk1 > /dev/null 2>&1
 zsk2=`$KEYGEN -q -K $dir -S $zsk1`
@@ -80,8 +68,6 @@ ksk1=`$KEYGEN -q -K $dir -3fk example.com`
 
 # Test 7: KSK rolled with insufficient delay after prepublication.
 dir=07-ksk-ttl
-rm -f $dir/K*.key
-rm -f $dir/K*.private
 ksk1=`$KEYGEN -q -K $dir -3fk example.com`
 $SETTIME -K $dir -I +9mo -D +1y $ksk1 > /dev/null 2>&1
 ksk2=`$KEYGEN -q -K $dir -S $ksk1`
@@ -91,8 +77,6 @@ zsk1=`$KEYGEN -q -K $dir -3 example.com`
 
 # Test 8: ZSK rolled with insufficient delay after prepublication.
 dir=08-zsk-ttl
-rm -f $dir/K*.key
-rm -f $dir/K*.private
 zsk1=`$KEYGEN -q -K $dir -3 example.com`
 $SETTIME -K $dir -I +9mo -D +1y $zsk1 > /dev/null 2>&1
 zsk2=`$KEYGEN -q -K $dir -S $zsk1`
@@ -102,8 +86,6 @@ ksk1=`$KEYGEN -q -K $dir -3fk example.com`
 
 # Test 9: KSK goes inactive before successor is active, but checking ZSKs
 dir=09-check-zsk
-rm -f $dir/K*.key
-rm -f $dir/K*.private
 ksk1=`$KEYGEN -q -K $dir -3fk example.com`
 $SETTIME -K $dir -I +9mo -D +1y $ksk1 > /dev/null 2>&1
 ksk2=`$KEYGEN -q -K $dir -S $ksk1`
@@ -112,8 +94,6 @@ zsk1=`$KEYGEN -q -K $dir -3 example.com`
 
 # Test 10: ZSK goes inactive before successor is active, but checking KSKs
 dir=10-check-ksk
-rm -f $dir/K*.key
-rm -f $dir/K*.private
 zsk1=`$KEYGEN -q -K $dir -3 example.com`
 $SETTIME -K $dir -I +9mo -D +1y $zsk1 > /dev/null 2>&1
 zsk2=`$KEYGEN -q -K $dir -S $zsk1`
@@ -122,8 +102,6 @@ ksk1=`$KEYGEN -q -K $dir -3fk example.com`
 
 # Test 11: ZSK goes inactive before successor is active, but after cutoff
 dir=11-cutoff
-rm -f $dir/K*.key
-rm -f $dir/K*.private
 zsk1=`$KEYGEN -q -K $dir -3 example.com`
 $SETTIME -K $dir -I +18mo -D +2y $zsk1 > /dev/null 2>&1
 zsk2=`$KEYGEN -q -K $dir -S $zsk1`

bin/tests/system/dialup/clean.sh

@@ -0,0 +1,14 @@
+#!/bin/sh
+#
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+rm -f ns2/example.bk
+rm -f ns3/example.bk
+rm -f */named.memstats */named.run

bin/tests/system/dialup/setup.sh

@@ -7,5 +7,7 @@
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.
 
-rm -f ns2/example.bk
-rm -f ns3/example.bk
+# shellcheck source=conf.sh
+. "$SYSTEMTESTTOP/conf.sh"
+
+$SHELL clean.sh

bin/tests/system/digdelv/tests.sh

@@ -15,7 +15,30 @@ n=0
 DIGOPTS="-p ${PORT}"
 SENDCMD="$PERL $SYSTEMTESTTOP/send.pl 10.53.0.4 ${EXTRAPORT1}"
 
-if [ -x ${DIG} ] ; then
+# Check if response in file $1 has the correct TTL range.
+# The response record must have RRtype $2 and class IN (CLASS1).
+# Maximum TTL is given by $3.  This works in most cases where TTL is
+# the second word on the line.  TTL position can be adjusted with
+# setting the position $4, but that requires updating this function.
+check_ttl_range() {
+    file=$1
+    pos=$4
+
+    case "$pos" in
+    "3")
+    awk -v rrtype="$2" -v ttl="$3" '($4 == "IN" || $4 == "CLASS1" ) && $5 == rrtype { if ($3 <= ttl) { ok=1 } } END { exit(ok?0:1) }' < $file
+    ;;
+    *)
+    awk -v rrtype="$2" -v ttl="$3" '($3 == "IN" || $3 == "CLASS1" ) && $4 == rrtype { if ($2 <= ttl) { ok=1 } } END { exit(ok?0:1) }' < $file
+    ;;
+    esac
+
+   result=$?
+   [ $result -eq 0 ] || echo_i "ttl check failed"
+   return $result
+}
+
+if [ -x "$DIG" ] ; then
   n=`expr $n + 1`
   echo_i "checking dig short form works ($n)"
   ret=0
@@ -29,6 +52,7 @@ if [ -x ${DIG} ] ; then
   ret=0
   $DIG $DIGOPTS @10.53.0.3 +split=4 -t sshfp foo.example > dig.out.test$n || ret=1
   grep " 9ABC DEF6 7890 " < dig.out.test$n > /dev/null || ret=1
+  check_ttl_range dig.out.test$n "SSHFP" 300 || ret=1
   if [ $ret != 0 ]; then echo_i "failed"; fi
   status=`expr $status + $ret`
 
@@ -37,6 +61,7 @@ if [ -x ${DIG} ] ; then
   ret=0
   $DIG $DIGOPTS @10.53.0.3 +unknownformat a a.example > dig.out.test$n || ret=1
   grep "CLASS1[ 	][ 	]*TYPE1[ 	][ 	]*\\\\# 4 0A000001" < dig.out.test$n > /dev/null || ret=1
+  check_ttl_range dig.out.test$n "TYPE1" 300 || ret=1
   if [ $ret != 0 ]; then echo_i "failed"; fi
   status=`expr $status + $ret`
 
@@ -45,7 +70,8 @@ if [ -x ${DIG} ] ; then
   ret=0
   $DIG $DIGOPTS @10.53.0.3 -x 127.0.0.1 > dig.out.test$n 2>&1 || ret=1
   # doesn't matter if has answer
-  grep -i "127\.in-addr\.arpa\." < dig.out.test$n > /dev/null || ret=1
+  grep -i "127\\.in-addr\\.arpa\\." < dig.out.test$n > /dev/null || ret=1
+  check_ttl_range dig.out.test$n "SOA" 86400 || ret=1
   if [ $ret != 0 ]; then echo_i "failed"; fi
   status=`expr $status + $ret`
 
@@ -53,7 +79,8 @@ if [ -x ${DIG} ] ; then
   echo_i "checking dig over TCP works ($n)"
   ret=0
   $DIG $DIGOPTS +tcp @10.53.0.3 a a.example > dig.out.test$n || ret=1
-  grep "10\.0\.0\.1$" < dig.out.test$n > /dev/null || ret=1
+  grep "10\\.0\\.0\\.1$" < dig.out.test$n > /dev/null || ret=1
+  check_ttl_range dig.out.test$n "A" 300 || ret=1
   if [ $ret != 0 ]; then echo_i "failed"; fi
   status=`expr $status + $ret`
 
@@ -62,6 +89,7 @@ if [ -x ${DIG} ] ; then
   ret=0
   $DIG $DIGOPTS +tcp @10.53.0.3 +multi +norrcomments DNSKEY dnskey.example > dig.out.test$n || ret=1
   grep "; ZSK; alg = RSAMD5 ; key id = 30795" < dig.out.test$n > /dev/null && ret=1
+  check_ttl_range dig.out.test$n "DNSKEY" 300 || ret=1
   if [ $ret != 0 ]; then echo_i "failed"; fi
   status=`expr $status + $ret`
 
@@ -70,6 +98,7 @@ if [ -x ${DIG} ] ; then
   ret=0
   $DIG $DIGOPTS +tcp @10.53.0.3 +multi +norrcomments SOA example > dig.out.test$n || ret=1
   grep "; ZSK; alg = RSAMD5 ; key id = 30795" < dig.out.test$n > /dev/null && ret=1
+  check_ttl_range dig.out.test$n "SOA" 300 || ret=1
   if [ $ret != 0 ]; then echo_i "failed"; fi
   status=`expr $status + $ret`
 
@@ -78,6 +107,7 @@ if [ -x ${DIG} ] ; then
   ret=0
   $DIG $DIGOPTS +tcp @10.53.0.3 +rrcomments DNSKEY dnskey.example > dig.out.test$n || ret=1
   grep "; ZSK; alg = RSAMD5 ; key id = 30795" < dig.out.test$n > /dev/null || ret=1
+  check_ttl_range dig.out.test$n "DNSKEY" 300 || ret=1
   if [ $ret != 0 ]; then echo_i "failed"; fi
   status=`expr $status + $ret`
 
@@ -110,6 +140,7 @@ if [ -x ${DIG} ] ; then
   ret=0
   $DIG $DIGOPTS +tcp @10.53.0.3 +noheader-only A example > dig.out.test$n || ret=1
   grep "Got answer:" < dig.out.test$n > /dev/null || ret=1
+  check_ttl_range dig.out.test$n "SOA" 300 || ret=1
   if [ $ret != 0 ]; then echo_i "failed"; fi
   status=`expr $status + $ret`
 
@@ -144,6 +175,7 @@ if [ -x ${DIG} ] ; then
   $DIG $DIGOPTS +tcp @10.53.0.3 +zflag +qr A example > dig.out.test$n || ret=1
   sed -n '/Sending:/,/Got answer:/p' dig.out.test$n | grep "^;; flags: rd ad; MBZ: 0x4;" > /dev/null || ret=1
   sed -n '/Got answer:/,/AUTHORITY SECTION:/p' dig.out.test$n | grep "^;; flags: qr rd ra; QUERY: 1" > /dev/null || ret=1
+  check_ttl_range dig.out.test$n "SOA" 300 || ret=1
   if [ $ret != 0 ]; then echo_i "failed"; fi
   status=`expr $status + $ret`
 
@@ -156,6 +188,7 @@ if [ -x ${DIG} ] ; then
   if [ $ret != 0 ]; then echo_i "failed"; fi
   status=`expr $status + $ret`
 
+  n=`expr $n + 1`
   echo_i "checking dig +ttlunits works ($n)"
   ret=0
   $DIG $DIGOPTS +tcp @10.53.0.2 +ttlunits A weeks.example > dig.out.test$n || ret=1
@@ -263,6 +296,7 @@ if [ -x ${DIG} ] ; then
   ret=0
   $DIG $DIGOPTS +tcp @10.53.0.2 +subnet=127.0.0.1 A a.example > dig.out.test$n 2>&1 || ret=1
   grep "CLIENT-SUBNET: 127.0.0.1/32/0" < dig.out.test$n > /dev/null || ret=1
+  check_ttl_range dig.out.test$n "A" 300 || ret=1
   if [ $ret != 0 ]; then echo_i "failed"; fi
   status=`expr $status + $ret`
 
@@ -271,6 +305,7 @@ if [ -x ${DIG} ] ; then
   ret=0
   $DIG $DIGOPTS +tcp @10.53.0.2 +subnet=127.0.0.0 +subnet=127.0.0.1 A a.example > dig.out.test$n 2>&1 || ret=1
   grep "CLIENT-SUBNET: 127.0.0.1/32/0" < dig.out.test$n > /dev/null || ret=1
+  check_ttl_range dig.out.test$n "A" 300 || ret=1
   if [ $ret != 0 ]; then echo_i "failed"; fi
   status=`expr $status + $ret`
 
@@ -296,6 +331,7 @@ if [ -x ${DIG} ] ; then
       esac
       grep "FORMERR" < dig.out.$i.test$n > /dev/null && ret=1
       grep "CLIENT-SUBNET: $addr/$i/0" < dig.out.$i.test$n > /dev/null || ret=1
+      check_ttl_range dig.out.$i.test$n "A" 300 || ret=1
   done
   if [ $ret != 0 ]; then echo_i "failed"; fi
   status=`expr $status + $ret`
@@ -307,6 +343,7 @@ if [ -x ${DIG} ] ; then
   grep "status: NOERROR" < dig.out.test$n > /dev/null || ret=1
   grep "CLIENT-SUBNET: 0.0.0.0/0/0" < dig.out.test$n > /dev/null || ret=1
   grep "10.0.0.1" < dig.out.test$n > /dev/null || ret=1
+  check_ttl_range dig.out.test$n "A" 300 || ret=1
   if [ $ret != 0 ]; then echo_i "failed"; fi
   status=`expr $status + $ret`
 
@@ -317,6 +354,7 @@ if [ -x ${DIG} ] ; then
   grep "status: NOERROR" < dig.out.test$n > /dev/null || ret=1
   grep "CLIENT-SUBNET: 0.0.0.0/0/0" < dig.out.test$n > /dev/null || ret=1
   grep "10.0.0.1" < dig.out.test$n > /dev/null || ret=1
+  check_ttl_range dig.out.test$n "A" 300 || ret=1
   if [ $ret != 0 ]; then echo_i "failed"; fi
   status=`expr $status + $ret`
 
@@ -327,6 +365,7 @@ if [ -x ${DIG} ] ; then
   grep "status: NOERROR" < dig.out.test$n > /dev/null || ret=1
   grep "CLIENT-SUBNET: ::/0/0" < dig.out.test$n > /dev/null || ret=1
   grep "10.0.0.1" < dig.out.test$n > /dev/null || ret=1
+  check_ttl_range dig.out.test$n "A" 300 || ret=1
   if [ $ret != 0 ]; then echo_i "failed"; fi
   status=`expr $status + $ret`
 
@@ -337,6 +376,7 @@ if [ -x ${DIG} ] ; then
   grep "status: NOERROR" < dig.out.test$n > /dev/null || ret=1
   grep "CLIENT-SUBNET: 0/0/0" < dig.out.test$n > /dev/null || ret=1
   grep "10.0.0.1" < dig.out.test$n > /dev/null || ret=1
+  check_ttl_range dig.out.test$n "A" 300 || ret=1
   if [ $ret != 0 ]; then echo_i "failed"; fi
   status=`expr $status + $ret`
 
@@ -358,6 +398,7 @@ ret=0
     $DIG $DIGOPTS +tcp @10.53.0.2 +subnet=10.53/$p A a.example > dig.out.test.$p.$n 2>&1 || ret=1
     grep "FORMERR" < dig.out.test.$p.$n > /dev/null && ret=1
     grep "CLIENT-SUBNET.*/$p/0" < dig.out.test.$p.$n > /dev/null || ret=1
+    check_ttl_range dig.out.test.$p.$n "A" 300 || ret=1
   done
   if [ $ret != 0 ]; then echo_i "failed"; fi
   status=`expr $status + $ret`
@@ -367,6 +408,7 @@ ret=0
   ret=0
   $DIG $DIGOPTS @10.53.0.3 +sp=4 -t sshfp foo.example > dig.out.test$n || ret=1
   grep " 9ABC DEF6 7890 " < dig.out.test$n > /dev/null || ret=1
+  check_ttl_range dig.out.test$n "SSHFP" 300 || ret=1
   if [ $ret != 0 ]; then echo_i "failed"; fi
   status=`expr $status + $ret`
 
@@ -394,6 +436,7 @@ ret=0
   ret=0
   $DIG $DIGOPTS @10.53.0.3 +ednsopt=3 a.example > dig.out.test$n 2>&1 || ret=1
   grep 'NSID: .* ("ns3")' dig.out.test$n > /dev/null || ret=1
+  check_ttl_range dig.out.test$n "A" 300 || ret=1
   if [ $ret != 0 ]; then echo_i "failed"; fi
   status=`expr $status + $ret`
 
@@ -402,6 +445,7 @@ ret=0
   ret=0
   $DIG $DIGOPTS @10.53.0.3 +ednsopt=nsid a.example > dig.out.test$n 2>&1 || ret=1
   grep 'NSID: .* ("ns3")' dig.out.test$n > /dev/null || ret=1
+  check_ttl_range dig.out.test$n "A" 300 || ret=1
   if [ $ret != 0 ]; then echo_i "failed"; fi
   status=`expr $status + $ret`
 
@@ -426,6 +470,7 @@ ret=0
   $DIG $DIGOPTS @10.53.0.3 +ednsopt=key-tag:00010002 a.example +qr > dig.out.test$n 2>&1 || ret=1
   grep "; KEY-TAG: 1, 2$" dig.out.test$n > /dev/null || ret=1
   grep "status: FORMERR" dig.out.test$n > /dev/null && ret=1
+  check_ttl_range dig.out.test$n "A" 300 || ret=1
   if [ $ret != 0 ]; then echo_i "failed"; fi
   status=`expr $status + $ret`
 
@@ -488,6 +533,7 @@ if [ -x ${DELV} ] ; then
   ret=0
   $DELV $DELVOPTS @10.53.0.3 +split=4 -t sshfp foo.example > delv.out.test$n || ret=1
   grep " 9ABC DEF6 7890 " < delv.out.test$n > /dev/null || ret=1
+  check_ttl_range delv.out.test$n "SSHFP" 300 || ret=1
   if [ $ret != 0 ]; then echo_i "failed"; fi
   status=`expr $status + $ret`
 
@@ -496,6 +542,7 @@ if [ -x ${DELV} ] ; then
   ret=0
   $DELV $DELVOPTS @10.53.0.3 +unknownformat a a.example > delv.out.test$n || ret=1
   grep "CLASS1[ 	][ 	]*TYPE1[ 	][ 	]*\\\\# 4 0A000001" < delv.out.test$n > /dev/null || ret=1
+  check_ttl_range delv.out.test$n "TYPE1" 300 || ret=1
   if [ $ret != 0 ]; then echo_i "failed"; fi
   status=`expr $status + $ret`
 
@@ -549,6 +596,7 @@ if [ -x ${DELV} ] ; then
   $DELV $DELVOPTS @10.53.0.3 -x 127.0.0.1 > delv.out.test$n 2>&1 || ret=1
   # doesn't matter if has answer
   grep -i "127\.in-addr\.arpa\." < delv.out.test$n > /dev/null || ret=1
+  check_ttl_range delv.out.test$n '\\-ANY' 10800 3 || ret=1
   if [ $ret != 0 ]; then echo_i "failed"; fi
   status=`expr $status + $ret`
 
@@ -557,6 +605,7 @@ if [ -x ${DELV} ] ; then
   ret=0
   $DELV $DELVOPTS +tcp @10.53.0.3 a a.example > delv.out.test$n || ret=1
   grep "10\.0\.0\.1$" < delv.out.test$n > /dev/null || ret=1
+  check_ttl_range delv.out.test$n "A" 300 || ret=1
   if [ $ret != 0 ]; then echo_i "failed"; fi
   status=`expr $status + $ret`
 
@@ -565,6 +614,7 @@ if [ -x ${DELV} ] ; then
   ret=0
   $DELV $DELVOPTS +tcp @10.53.0.3 +multi +norrcomments DNSKEY dnskey.example > delv.out.test$n || ret=1
   grep "; ZSK; alg = RSAMD5 ; key id = 30795" < delv.out.test$n > /dev/null && ret=1
+  check_ttl_range delv.out.test$n "DNSKEY" 300 || ret=1
   if [ $ret != 0 ]; then echo_i "failed"; fi
   status=`expr $status + $ret`
 
@@ -573,6 +623,7 @@ if [ -x ${DELV} ] ; then
   ret=0
   $DELV $DELVOPTS +tcp @10.53.0.3 +multi +norrcomments SOA example > delv.out.test$n || ret=1
   grep "; ZSK; alg = RSAMD5 ; key id = 30795" < delv.out.test$n > /dev/null && ret=1
+  check_ttl_range delv.out.test$n "SOA" 300 || ret=1
   if [ $ret != 0 ]; then echo_i "failed"; fi
   status=`expr $status + $ret`
 
@@ -581,6 +632,7 @@ if [ -x ${DELV} ] ; then
   ret=0
   $DELV $DELVOPTS +tcp @10.53.0.3 +rrcomments DNSKEY dnskey.example > delv.out.test$n || ret=1
   grep "; ZSK; alg = RSAMD5 ; key id = 30795" < delv.out.test$n > /dev/null || ret=1
+  check_ttl_range delv.out.test$n "DNSKEY" 300 || ret=1
   if [ $ret != 0 ]; then echo_i "failed"; fi
   status=`expr $status + $ret`
 
@@ -627,6 +679,7 @@ if [ -x ${DELV} ] ; then
   ret=0
   $DELV $DELVOPTS @10.53.0.3 +sp=4 -t sshfp foo.example > delv.out.test$n || ret=1
   grep " 9ABC DEF6 7890 " < delv.out.test$n > /dev/null || ret=1
+  check_ttl_range delv.out.test$n "SSHFP" 300 || ret=1
   if [ $ret != 0 ]; then echo_i "failed"; fi
   status=`expr $status + $ret`
 
@@ -643,6 +696,7 @@ if [ -x ${DELV} ] ; then
   ret=0
   $DELV $DELVOPTS @10.53.0.3 -c IN -t a a.example > delv.out.test$n || ret=1
   grep "a.example." < delv.out.test$n > /dev/null || ret=1
+  check_ttl_range delv.out.test$n "A" 300 || ret=1
   if [ $ret != 0 ]; then echo_i "failed"; fi
   status=`expr $status + $ret`
 
@@ -651,6 +705,7 @@ if [ -x ${DELV} ] ; then
   ret=0
   $DELV $DELVOPTS @10.53.0.3 -c CH -t a a.example > delv.out.test$n || ret=1
   grep "a.example." < delv.out.test$n > /dev/null || ret=1
+  check_ttl_range delv.out.test$n "A" 300 || ret=1
   if [ $ret != 0 ]; then echo_i "failed"; fi
   status=`expr $status + $ret`
 
@@ -659,6 +714,7 @@ if [ -x ${DELV} ] ; then
   ret=0
   $DELV $DELVOPTS @10.53.0.3 -c CH -t a a.example > delv.out.test$n || ret=1
   grep "a.example." < delv.out.test$n > /dev/null || ret=1
+  check_ttl_range delv.out.test$n "A" 300 || ret=1
   if [ $ret != 0 ]; then echo_i "failed"; fi
   status=`expr $status + $ret`
 
@@ -669,6 +725,7 @@ if [ -x ${DELV} ] ; then
   grep '^; -m\..*[0-9]*.*IN.*ANY.*;' delv.out.test$n > /dev/null || ret=1
   grep "^add " delv.out.test$n > /dev/null && ret=1
   grep "^del " delv.out.test$n > /dev/null && ret=1
+  check_ttl_range delv.out.test$n '\\-ANY' 300 3 || ret=1
   if [ $ret != 0 ]; then echo_i "failed"; fi
   status=`expr $status + $ret`
 else

bin/tests/system/dlv/ns2/sign.sh

@@ -32,6 +32,6 @@ cat $infile $keyname1.key $keyname2.key >$zonefile
 $SIGNER -r $RANDFILE -l $dlvzone -g -o $zone -f $outfile $zonefile > /dev/null 2> signer.err || cat signer.err
 
 $CHECKZONE -q -D -i none druz druz.pre |
-sed '/IN DNSKEY/s/\([a-z0-9A-Z/]\{10\}\)[a-z0-9A-Z/]\{16\}/\1XXXXXXXXXXXXXXXX/'> druz.signed
+sed '/IN DNSKEY/s/\([a-z0-9A-Z+/]\{10\}\)[a-z0-9A-Z+/]\{16\}/\1XXXXXXXXXXXXXXXX/'> druz.signed
 
 echo_i "signed $zone"

bin/tests/system/dlv/setup.sh

@@ -12,6 +12,8 @@
 SYSTEMTESTTOP=..
 . $SYSTEMTESTTOP/conf.sh
 
+$SHELL clean.sh
+
 test -r $RANDFILE || $GENRANDOM $RANDOMSIZE $RANDFILE
 
 copy_setports ns1/named.conf.in ns1/named.conf

bin/tests/system/dlz/prereq.sh

@@ -12,7 +12,7 @@
 SYSTEMTESTTOP=..
 . $SYSTEMTESTTOP/conf.sh
 
-if [ "@DLZ_SYSTEM_TEST@" != "filesystem" ]; then
+if ! $FEATURETEST --with-dlz-filesystem; then
         echo_i "DLZ filesystem driver not supported"
         exit 255
 fi

bin/tests/system/dlzexternal/driver.c

@@ -48,6 +48,13 @@
 			goto failure; \
 	} while (0)
 
+#define loginfo(...) \
+	({ if ((state != NULL) && (state->log != NULL)) \
+		 state->log(ISC_LOG_INFO, __VA_ARGS__); })
+#define logerr(...) \
+	({ if ((state != NULL) && (state->log != NULL)) \
+		 state->log(ISC_LOG_ERROR, __VA_ARGS__); })
+
 /* For this simple example, use fixed sized strings */
 struct record {
 	char name[100];
@@ -117,9 +124,7 @@ add_name(struct dlz_example_data *state, struct record *list,
 		i = first_empty;
 	}
 	if (i == MAX_RECORDS) {
-		if (state->log != NULL)
-			state->log(ISC_LOG_ERROR,
-				   "dlz_example: out of record space");
+		logerr("dlz_example: out of record space");
 		return (ISC_R_FAILURE);
 	}
 
@@ -249,9 +254,7 @@ dlz_create(const char *dlzname, unsigned int argc, char *argv[],
 	va_end(ap);
 
 	if (argc < 2 || argv[1][0] == '\0') {
-		if (state->log != NULL)
-			state->log(ISC_LOG_ERROR,
-				   "dlz_example: please specify a zone name");
+		logerr("dlz_example: please specify a zone name");
 		dlz_destroy(state);
 		return (ISC_R_FAILURE);
 	}
@@ -287,9 +290,7 @@ dlz_create(const char *dlzname, unsigned int argc, char *argv[],
 	add_name(state, &state->current[0], state->zone_name,
 		 "a", 1800, "10.53.0.1");
 
-	if (state->log != NULL)
-		state->log(ISC_LOG_INFO, "dlz_example: started for zone %s",
-			   state->zone_name);
+	loginfo("dlz_example: started for zone %s", state->zone_name);
 
 	*dbdata = state;
 	return (ISC_R_SUCCESS);
@@ -307,10 +308,7 @@ void
 dlz_destroy(void *dbdata) {
 	struct dlz_example_data *state = (struct dlz_example_data *)dbdata;
 
-	if (state->log != NULL)
-		state->log(ISC_LOG_INFO,
-			   "dlz_example: shutting down zone %s",
-			   state->zone_name);
+	loginfo("dlz_example: shutting down zone %s", state->zone_name);
 	free(state->zone_name);
 	free(state);
 }
@@ -338,10 +336,8 @@ dlz_findzonedb(void *dbdata, const char *name,
 		fmt_address(src, addrbuf, sizeof(addrbuf));
 	}
 
-	state->log(ISC_LOG_INFO,
-		   "dlz_example: dlz_findzonedb called with name '%s' "
-		   "in zone DB '%s' from %s",
-		   name, state->zone_name, addrbuf);
+	loginfo("dlz_example: dlz_findzonedb called with name '%s' "
+		"in zone DB '%s' from %s", name, state->zone_name, addrbuf);
 
 	/*
 	 * Returning ISC_R_NOTFOUND will cause the query logic to
@@ -441,7 +437,7 @@ dlz_lookup(const char *zone, const char *name, void *dbdata,
 		count = 1;
 		memcpy(last, full_name, size + 1);
 	}
-	state->log(ISC_LOG_INFO, "lookup #%d for %s", count, full_name);
+	loginfo("lookup #%d for %s", count, full_name);
 
 	/*
 	 * If we need to know the database version (as set in
@@ -461,10 +457,9 @@ dlz_lookup(const char *zone, const char *name, void *dbdata,
 	if (clientinfo != NULL &&
 	    clientinfo->version >= DNS_CLIENTINFO_VERSION) {
 		dbversion = clientinfo->dbversion;
-		if (dbversion != NULL && *(bool *)dbversion)
-			state->log(ISC_LOG_INFO,
-				   "dlz_example: lookup against live "
-				   "transaction");
+		if (dbversion != NULL && *(bool *)dbversion) {
+			loginfo("dlz_example: lookup against live transaction");
+		}
 	}
 
 	if (strcmp(name, "source-addr") == 0) {
@@ -479,8 +474,7 @@ dlz_lookup(const char *zone, const char *name, void *dbdata,
 			fmt_address(src, buf, sizeof(buf));
 		}
 
-		state->log(ISC_LOG_INFO,
-			   "dlz_example: lookup connection from %s", buf);
+		loginfo("dlz_example: lookup connection from %s", buf);
 
 		found = true;
 		result = state->putrr(lookup, "TXT", 0, buf);
@@ -541,10 +535,15 @@ dlz_lookup(const char *zone, const char *name, void *dbdata,
  */
 isc_result_t
 dlz_allowzonexfr(void *dbdata, const char *name, const char *client) {
+	struct dlz_example_data *state = (struct dlz_example_data *)dbdata;
 	isc_result_t result;
 
+	loginfo("dlz_example: dlz_allowzonexfr called for %s", name);
+
 	result = dlz_findzonedb(dbdata, name, NULL, NULL);
 	if (result != ISC_R_SUCCESS) {
+		loginfo("dlz_example: findzonedb returned %s",
+			isc_result_totext(result));
 		return (result);
 	}
 
@@ -553,9 +552,12 @@ dlz_allowzonexfr(void *dbdata, const char *name, const char *client) {
 	 * is effective.
 	 */
 	if (strcmp(client, "10.53.0.5") == 0) {
+		loginfo("dlz_example: disallow transfer to 10.53.0.5");
 		return (ISC_R_NOPERM);
 	}
 
+	loginfo("dlz_example: transfer allowed for %s", name);
+
 	return (ISC_R_SUCCESS);
 }
 
@@ -597,10 +599,8 @@ dlz_newversion(const char *zone, void *dbdata, void **versionp) {
 	struct dlz_example_data *state = (struct dlz_example_data *)dbdata;
 
 	if (state->transaction_started) {
-		if (state->log != NULL)
-			state->log(ISC_LOG_INFO,
-				   "dlz_example: transaction already "
-				   "started for zone %s", zone);
+		loginfo("dlz_example: transaction already started for zone %s",
+			zone);
 		return (ISC_R_FAILURE);
 	}
 
@@ -620,9 +620,8 @@ dlz_closeversion(const char *zone, bool commit,
 	struct dlz_example_data *state = (struct dlz_example_data *)dbdata;
 
 	if (!state->transaction_started) {
-		if (state->log != NULL)
-			state->log(ISC_LOG_INFO, "dlz_example: transaction not "
-				   "started for zone %s", zone);
+		loginfo("dlz_example: transaction not started for zone %s",
+			zone);
 		*versionp = NULL;
 		return;
 	}
@@ -633,9 +632,7 @@ dlz_closeversion(const char *zone, bool commit,
 
 	if (commit) {
 		int i;
-		if (state->log != NULL)
-			state->log(ISC_LOG_INFO, "dlz_example: committing "
-				   "transaction on zone %s", zone);
+		loginfo("dlz_example: committing transaction on zone %s", zone);
 		for (i = 0; i < MAX_RECORDS; i++) {
 			if (strlen(state->deletes[i].name) > 0U) {
 				(void)del_name(state, &state->current[0],
@@ -655,9 +652,7 @@ dlz_closeversion(const char *zone, bool commit,
 			}
 		}
 	} else {
-		if (state->log != NULL)
-			state->log(ISC_LOG_INFO, "dlz_example: cancelling "
-				   "transaction on zone %s", zone);
+		loginfo("dlz_example: cancelling transaction on zone %s", zone);
 	}
 	memset(state->adds, 0, sizeof(state->adds));
 	memset(state->deletes, 0, sizeof(state->deletes));
@@ -672,27 +667,21 @@ dlz_configure(dns_view_t *view, dns_dlzdb_t *dlzdb, void *dbdata) {
 	struct dlz_example_data *state = (struct dlz_example_data *)dbdata;
 	isc_result_t result;
 
-	if (state->log != NULL)
-		state->log(ISC_LOG_INFO, "dlz_example: starting configure");
+	loginfo("dlz_example: starting configure");
 
 	if (state->writeable_zone == NULL) {
-		if (state->log != NULL)
-			state->log(ISC_LOG_INFO, "dlz_example: no "
-				   "writeable_zone method available");
+		loginfo("dlz_example: no writeable_zone method available");
 		return (ISC_R_FAILURE);
 	}
 
 	result = state->writeable_zone(view, dlzdb, state->zone_name);
 	if (result != ISC_R_SUCCESS) {
-		if (state->log != NULL)
-			state->log(ISC_LOG_ERROR, "dlz_example: failed to "
-				   "configure zone %s", state->zone_name);
+		loginfo("dlz_example: failed to configure zone %s",
+			state->zone_name);
 		return (result);
 	}
 
-	if (state->log != NULL)
-		state->log(ISC_LOG_INFO, "dlz_example: configured writeable "
-			   "zone %s", state->zone_name);
+	loginfo("dlz_example: configured writeable zone %s", state->zone_name);
 	return (ISC_R_SUCCESS);
 }
 
@@ -713,14 +702,11 @@ dlz_ssumatch(const char *signer, const char *name, const char *tcpaddr,
 	UNUSED(keydata);
 
 	if (strncmp(name, "deny.", 5) == 0) {
-		if (state->log != NULL)
-			state->log(ISC_LOG_INFO, "dlz_example: denying update "
-				   "of name=%s by %s", name, signer);
+		loginfo("dlz_example: denying update of name=%s by %s",
+			name, signer);
 		return (false);
 	}
-	if (state->log != NULL)
-		state->log(ISC_LOG_INFO, "dlz_example: allowing update of "
-			   "name=%s by %s", name, signer);
+	loginfo("dlz_example: allowing update of name=%s by %s", name, signer);
 	return (true);
 }
 
@@ -793,9 +779,7 @@ dlz_addrdataset(const char *name, const char *rdatastr,
 	if (version != (void *) &state->transaction_started)
 		return (ISC_R_FAILURE);
 
-	if (state->log != NULL)
-		state->log(ISC_LOG_INFO, "dlz_example: adding rdataset %s '%s'",
-			   name, rdatastr);
+	loginfo("dlz_example: adding rdataset %s '%s'", name, rdatastr);
 
 	return (modrdataset(state, name, rdatastr, &state->adds[0]));
 }
@@ -809,9 +793,7 @@ dlz_subrdataset(const char *name, const char *rdatastr,
 	if (version != (void *) &state->transaction_started)
 		return (ISC_R_FAILURE);
 
-	if (state->log != NULL)
-		state->log(ISC_LOG_INFO, "dlz_example: subtracting rdataset "
-			   "%s '%s'", name, rdatastr);
+	loginfo("dlz_example: subtracting rdataset %s '%s'", name, rdatastr);
 
 	return (modrdataset(state, name, rdatastr, &state->deletes[0]));
 }
@@ -825,9 +807,7 @@ dlz_delrdataset(const char *name, const char *type,
 	if (version != (void *) &state->transaction_started)
 		return (ISC_R_FAILURE);
 
-	if (state->log != NULL)
-		state->log(ISC_LOG_INFO, "dlz_example: deleting rdataset %s "
-			   "of type %s", name, type);
+	loginfo("dlz_example: deleting rdataset %s of type %s", name, type);
 
 	return (ISC_R_SUCCESS);
 }

bin/tests/system/dlzexternal/setup.sh

@@ -12,6 +12,8 @@
 SYSTEMTESTTOP=..
 . $SYSTEMTESTTOP/conf.sh
 
+$SHELL clean.sh
+
 test -r $RANDFILE || $GENRANDOM $RANDOMSIZE $RANDFILE
 
 $DDNSCONFGEN -q -r $RANDFILE -z example.nil > ns1/ddns.key

bin/tests/system/dnssec/ns3/sign.sh

@@ -219,11 +219,11 @@ zone=dnskey-unsupported.example.
 infile=dnskey-unsupported.example.db.in
 zonefile=dnskey-unsupported.example.db
 
-keyname=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone")
+keyname=$("$KEYGEN" -q -r $RANDFILE -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone")
 
 cat "$infile" "$keyname.key" > "$zonefile"
 
-"$SIGNER" -P -3 - -o "$zone" -O full -f ${zonefile}.tmp "$zonefile" > /dev/null 2>&1
+"$SIGNER" -P -3 - -r $RANDFILE -o "$zone" -O full -f ${zonefile}.tmp "$zonefile" > /dev/null 2>&1
 
 awk '$4 == "DNSKEY" { $7 = 255; print } $4 == "RRSIG" { $6 = 255; print } { print }' ${zonefile}.tmp > ${zonefile}.signed
 
@@ -238,13 +238,12 @@ zone=dnskey-unsupported-2.example.
 infile=dnskey-unsupported-2.example.db.in
 zonefile=dnskey-unsupported-2.example.db
 
-ksk=$("$KEYGEN" -f KSK -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone")
-zsk=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone")
+ksk=$("$KEYGEN" -f KSK -q -r $RANDFILE -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone")
+zsk=$("$KEYGEN" -q -r $RANDFILE -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone")
 
 cat "$infile" "$ksk.key" "$zsk.key" unsupported-algorithm.key > "$zonefile"
 
-# "$SIGNER" -P -3 - -o "$zone" -f ${zonefile}.signed "$zonefile" > /dev/null 2>&1
-"$SIGNER" -P -3 - -o "$zone" -f ${zonefile}.signed "$zonefile"
+"$SIGNER" -P -3 - -r $RANDFILE -o "$zone" -f ${zonefile}.signed "$zonefile" > /dev/null 2>&1
 
 #
 # A zone with a unknown DNSKEY algorithm + unknown NSEC3 hash algorithm (-U).

bin/tests/system/dnssec/tests.sh

@@ -1381,6 +1381,19 @@ n=`expr $n + 1`
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
 
+get_rsasha1_key_ids_from_sigs() {
+	awk '
+		NF < 8 { next }
+		$(NF-5) != "RRSIG" { next }
+		$(NF-3) != "5" { next }
+		$NF != "(" { next }
+		{
+			getline;
+			print $3;
+		}
+	' signer/example.db.signed | sort -u
+}
+
 echo_i "checking that we can sign a zone with out-of-zone records ($n)"
 ret=0
 zone=example
@@ -1481,8 +1494,8 @@ cat example.db.in $key1.key $key3.key > example.db
 echo '$INCLUDE "example.db.signed"' >> example.db
 $SIGNER -D -o example example.db > /dev/null 2>&1
 ) || ret=1
-grep " $keyid2 " signer/example.db.signed > /dev/null 2>&1 || ret=1
-grep " $keyid3 " signer/example.db.signed > /dev/null 2>&1 || ret=1
+get_rsasha1_key_ids_from_sigs | grep "^$keyid2$" > /dev/null || ret=1
+get_rsasha1_key_ids_from_sigs | grep "^$keyid3$" > /dev/null || ret=1
 n=`expr $n + 1`
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
@@ -1493,8 +1506,8 @@ ret=0
 cd signer
 $SIGNER -RD -o example example.db > /dev/null 2>&1
 ) || ret=1
-grep " $keyid2 " signer/example.db.signed > /dev/null 2>&1 && ret=1
-grep " $keyid3 " signer/example.db.signed > /dev/null 2>&1 || ret=1
+get_rsasha1_key_ids_from_sigs | grep "^$keyid2$" > /dev/null && ret=1
+get_rsasha1_key_ids_from_sigs | grep "^$keyid3$" > /dev/null || ret=1
 n=`expr $n + 1`
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
@@ -1511,8 +1524,8 @@ echo '$INCLUDE "example.db.signed"' >> example.db
 $SETTIME -I now $key2 > /dev/null 2>&1
 $SIGNER -SD -o example example.db > /dev/null 2>&1
 ) || ret=1
-grep " $keyid2 " signer/example.db.signed > /dev/null 2>&1 || ret=1
-grep " $keyid3 " signer/example.db.signed > /dev/null 2>&1 || ret=1
+get_rsasha1_key_ids_from_sigs | grep "^$keyid2$" > /dev/null || ret=1
+get_rsasha1_key_ids_from_sigs | grep "^$keyid3$" > /dev/null || ret=1
 n=`expr $n + 1`
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
@@ -1523,8 +1536,8 @@ ret=0
 cd signer
 $SIGNER -SDQ -o example example.db > /dev/null 2>&1
 ) || ret=1
-grep " $keyid2 " signer/example.db.signed > /dev/null 2>&1 && ret=1
-grep " $keyid3 " signer/example.db.signed > /dev/null 2>&1 || ret=1
+get_rsasha1_key_ids_from_sigs | grep "^$keyid2$" > /dev/null && ret=1
+get_rsasha1_key_ids_from_sigs | grep "^$keyid3$" > /dev/null || ret=1
 n=`expr $n + 1`
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
@@ -1845,8 +1858,8 @@ echo_i "waiting for NTA rechecks/expirations"
 
 #
 # secure.example and badds.example used default nta-duration
-# (configured as 10s in ns4/named1.conf), but nta recheck interval
-# is configured to 7s, so at t=8 the NTAs for secure.example and
+# (configured as 12s in ns4/named1.conf), but nta recheck interval
+# is configured to 9s, so at t=10 the NTAs for secure.example and
 # fakenode.secure.example should both be lifted, but badds.example
 # should still be going.
 #
@@ -1866,9 +1879,9 @@ status=`expr $status + $ret`
 ret=0
 
 #
-# bogus.example was set to expire in 20s, so at t=11
+# bogus.example was set to expire in 20s, so at t=13
 # it should still be NTA'd, but badds.example used the default
-# lifetime of 10s, so it should revert to SERVFAIL now.
+# lifetime of 12s, so it should revert to SERVFAIL now.
 #
 $PERL -e 'my $delay = '$start' + 13 - time(); select(undef, undef, undef, $delay) if ($delay > 0);'
 # check nta table
@@ -2067,10 +2080,10 @@ else
         exit 1
 fi
 
-# nta-recheck is configured as 7s, so at t=10 the NTAs for
+# nta-recheck is configured as 9s, so at t=12 the NTAs for
 # secure.example. should be lifted as it is not a forced NTA.
-echo_i "waiting till 10s have passed after ns4 was restarted"
-$PERL -e 'my $delay = '$start' + 10 - time(); select(undef, undef, undef, $delay) if ($delay > 0);'
+echo_i "waiting till 12s have passed after ns4 was restarted"
+$PERL -e 'my $delay = '$start' + 12 - time(); select(undef, undef, undef, $delay) if ($delay > 0);'
 
 # secure.example. should now return an AD=1 answer (still validates) as
 # the NTA has been lifted.
@@ -2124,10 +2137,10 @@ else
         exit 1
 fi
 
-# nta-recheck is configured as 7s, but even at t=10 the NTAs for
+# nta-recheck is configured as 9s, but even at t=12 the NTAs for
 # secure.example. should not be lifted as it is a forced NTA.
-echo_i "waiting till 10s have passed after ns4 was restarted"
-$PERL -e 'my $delay = '$start' + 10 - time(); select(undef, undef, undef, $delay) if ($delay > 0);'
+echo_i "waiting till 12s have passed after ns4 was restarted"
+$PERL -e 'my $delay = '$start' + 12 - time(); select(undef, undef, undef, $delay) if ($delay > 0);'
 
 # secure.example. should now return an AD=0 answer (non-authenticated)
 # as the NTA is still there.
@@ -2770,10 +2783,10 @@ $DIG $ANSWEROPTS expiring.example soa @10.53.0.4 > dig.out.ns4.2.$n
 ttls=`awk '$1 != ";;" {print $2}' dig.out.ns4.1.$n`
 ttls2=`awk '$1 != ";;" {print $2}' dig.out.ns4.2.$n`
 for ttl in ${ttls:-0}; do
-    [ ${ttl:-0} -eq 300 ] || ret=1
+    [ "${ttl}" -eq 300 ] || ret=1
 done
 for ttl in ${ttls2:-0}; do
-    [ ${ttl:-0} -le 60 ] || ret=1
+    [ "${ttl}" -le 60 ] || ret=1
 done
 n=`expr $n + 1`
 if [ $ret != 0 ]; then echo_i "failed"; fi
@@ -2788,10 +2801,10 @@ $DIG $ADDITIONALOPTS expiring.example ns @10.53.0.4 > dig.out.ns4.2.$n
 ttls=`awk '$1 != ";;" {print $2}' dig.out.ns4.1.$n`
 ttls2=`awk '$1 != ";;" {print $2}' dig.out.ns4.2.$n`
 for ttl in ${ttls:-300}; do
-    [ ${ttl:-0} -eq 300 ] || ret=1
+    [ "$ttl" -le 300 ] && [ "$ttl" -gt 240 ] || ret=1
 done
 for ttl in ${ttls2:-0}; do
-    [ ${ttl:-0} -le 60 ] || ret=1
+    [ "$ttl" -le 60 ] || ret=1
 done
 n=`expr $n + 1`
 if [ $ret != 0 ]; then echo_i "failed"; fi
@@ -2806,10 +2819,10 @@ $DIG $ADDITIONALOPTS expiring.example mx @10.53.0.4 > dig.out.ns4.2.$n
 ttls=`awk '$1 != ";;" {print $2}' dig.out.ns4.1.$n`
 ttls2=`awk '$1 != ";;" {print $2}' dig.out.ns4.2.$n`
 for ttl in ${ttls:-300}; do
-    [ ${ttl:-0} -eq 300 ] || ret=1
+    [ "$ttl" -le 300 ] && [ "$ttl" -gt 240 ] || ret=1
 done
 for ttl in ${ttls2:-0}; do
-    [ ${ttl:-0} -le 60 ] || ret=1
+    [ "$ttl" -le 60 ] || ret=1
 done
 n=`expr $n + 1`
 if [ $ret != 0 ]; then echo_i "failed"; fi
@@ -2830,7 +2843,7 @@ for ttl in ${ttls:-0}; do
     [ $ttl -eq 300 ] || ret=1
 done
 for ttl in ${ttls2:-0}; do
-    [ $ttl -le 120 -a $ttl -gt 60 ] || ret=1
+    [ "$ttl" -eq 120 ] || ret=1
 done
 n=`expr $n + 1`
 if [ $ret != 0 ]; then echo_i "failed"; fi
@@ -2846,7 +2859,7 @@ for ttl in ${ttls:-0}; do
     [ $ttl -eq 300 ] || ret=1
 done
 for ttl in ${ttls2:-0}; do
-    [ $ttl -le 120 -a $ttl -gt 60 ] || ret=1
+    [ "$ttl" -eq 120 ] || ret=1
 done
 n=`expr $n + 1`
 if [ $ret != 0 ]; then echo_i "failed"; fi
@@ -2864,7 +2877,7 @@ $DIG $ADDITIONALOPTS  expiring.example mx @10.53.0.4 > dig.out.ns4.2.$n
 ttls=`awk '$1 != ";;" {print $2}' dig.out.ns4.1.$n`
 ttls2=`awk '$1 != ";;" {print $2}' dig.out.ns4.2.$n`
 for ttl in ${ttls:-300}; do
-    [ $ttl -eq 300 ] || ret=1
+    [ "$ttl" -le 300 ] && [ "$ttl" -gt 240 ] || ret=1
 done
 for ttl in ${ttls2:-0}; do
     [ $ttl -le 120  -a $ttl -gt 60 ] || ret=1
@@ -2881,7 +2894,7 @@ $DIG $ADDITIONALOPTS expiring.example mx @10.53.0.4 > dig.out.ns4.2.$n
 ttls=`awk '$1 != ";;" {print $2}' dig.out.ns4.1.$n`
 ttls2=`awk '$1 != ";;" {print $2}' dig.out.ns4.2.$n`
 for ttl in ${ttls:-300}; do
-    [ $ttl -eq 300 ] || ret=1
+    [ "$ttl" -le 300 ] && [ "$ttl" -gt 240 ] || ret=1
 done
 for ttl in ${ttls2:-0}; do
     [ $ttl -le 120  -a $ttl -gt 60 ] || ret=1

bin/tests/system/dnstap/tests.sh

@@ -131,16 +131,16 @@ status=`expr $status + $ret`
 
 echo_i "checking AUTH_QUERY message counts"
 ret=0
-[ $aq1 -eq 2 ] || {
-	echo_i "ns1 $aq1 exepcted 2"
+[ $aq1 -eq 3 ] || {
+	echo_i "ns1 $aq1 exepcted 3"
 	ret=1
 }
-[ $aq2 -eq 1 ] || {
-	echo_i "ns2 $aq2 expected 1"
+[ $aq2 -eq 2 ] || {
+	echo_i "ns2 $aq2 expected 2"
 	ret=1
 }
-[ $aq3 -eq 0 ] || {
-	echo_i "ns3 $aq3 expected 0"
+[ $aq3 -eq 1 ] || {
+	echo_i "ns3 $aq3 expected 1"
 	ret=1
 }
 if [ $ret != 0 ]; then echo_i "failed"; fi
@@ -165,16 +165,16 @@ status=`expr $status + $ret`
 
 echo_i "checking CLIENT_QUERY message counts"
 ret=0
-[ $cq1 -eq 1 ] || {
-	echo_i "ns1 $cq1 expected 1"
+[ $cq1 -eq 0 ] || {
+	echo_i "ns1 $cq1 expected 0"
 	ret=1
 }
-[ $cq2 -eq 1 ] || {
-	echo_i "ns2 $cq2 expected 1"
+[ $cq2 -eq 0 ] || {
+	echo_i "ns2 $cq2 expected 0"
 	ret=1
 }
-[ $cq3 -eq 2 ] || {
-	echo_i "ns3 $cq3 expected 2"
+[ $cq3 -eq 1 ] || {
+	echo_i "ns3 $cq3 expected 1"
 	ret=1
 }
 if [ $ret != 0 ]; then echo_i "failed"; fi

bin/tests/system/dsdigest/setup.sh

@@ -12,6 +12,8 @@
 SYSTEMTESTTOP=..
 . $SYSTEMTESTTOP/conf.sh
 
+$SHELL clean.sh
+
 test -r $RANDFILE || $GENRANDOM $RANDOMSIZE $RANDFILE
 
 copy_setports ns1/named.conf.in ns1/named.conf

bin/tests/system/dupsigs/ns1/reset_keys.sh

@@ -22,6 +22,8 @@ timetodnssec() {
 }
 
 KEYDIR=keys/signing.test
+KEYGEN="$KEYGEN -r $RANDFILE"
+
 KSK=`$KEYGEN -a RSASHA256 -b 1024 -K $KEYDIR -q -f KSK $zone`
 
 ZSK0=`$KEYGEN -a RSASHA256 -b 1024 -K $KEYDIR -q $zone`

bin/tests/system/dupsigs/setup.sh

@@ -10,7 +10,7 @@
 SYSTEMTESTTOP=..
 . $SYSTEMTESTTOP/conf.sh
 
-test -f clean.sh && $SHELL clean.sh
+$SHELL clean.sh
 
 test -r $RANDFILE || $GENRANDOM $RANDOMSIZE $RANDFILE
 

bin/tests/system/ecdsa/setup.sh

@@ -12,6 +12,8 @@
 SYSTEMTESTTOP=..
 . $SYSTEMTESTTOP/conf.sh
 
+$SHELL clean.sh
+
 test -r $RANDFILE || $GENRANDOM $RANDOMSIZE $RANDFILE
 
 cd ns1 && $SHELL sign.sh

bin/tests/system/eddsa/setup.sh

@@ -12,6 +12,8 @@
 SYSTEMTESTTOP=..
 . $SYSTEMTESTTOP/conf.sh
 
+$SHELL clean.sh
+
 test -r $RANDFILE || $GENRANDOM $RANDOMSIZE $RANDFILE
 
 cd ns1 && $SHELL sign.sh

bin/tests/system/feature-test.c

@@ -49,6 +49,7 @@ usage() {
 	fprintf(stderr, "	--rpz-nsip\n");
 	fprintf(stderr, "	--with-idn\n");
 	fprintf(stderr, "	--with-lmdb\n");
+	fprintf(stderr, "	--with-dlz-filesystem\n");
 }
 
 int
@@ -168,6 +169,14 @@ main(int argc, char **argv) {
 #endif
 	}
 
+	if (strcmp(argv[1], "--with-dlz-filesystem") == 0) {
+#ifdef DLZ_FILESYSTEM
+		return (0);
+#else
+		return (1);
+#endif
+	}
+
 	if (strcmp(argv[1], "--ipv6only=no") == 0) {
 #ifdef WIN32
 		return (0);

bin/tests/system/genzone.sh

@@ -337,7 +337,7 @@ ninfo14			NINFO	"foo\;"
 ninfo15			NINFO	"bar\\;"
 
 ; type 57
-rkey01			RKEY	512 ( 255 1 AQMFD5raczCJHViKtLYhWGz8hMY
+rkey01			RKEY	0 ( 255 1 AQMFD5raczCJHViKtLYhWGz8hMY
 				9UGRuniJDBzC7w0aRyzWZriO6i2odGWWQVucZqKV
 				sENW91IOW4vqudngPZsY3GvQ/xVA8/7pyFj6b7Esg
 				a60zyGW6LFe9r8n6paHrlG5ojqf0BaqHT+8= )

bin/tests/system/gost/setup.sh

@@ -12,6 +12,8 @@
 SYSTEMTESTTOP=..
 . $SYSTEMTESTTOP/conf.sh
 
+$SHELL clean.sh
+
 test -r $RANDFILE || $GENRANDOM $RANDOMSIZE $RANDFILE
 
 cd ns1 && $SHELL sign.sh

bin/tests/system/gost/tests.sh

@@ -17,7 +17,7 @@ n=0
 
 rm -f dig.out.*
 
-DIGOPTS="+tcp +noadd +nosea +nostat +nocmd +dnssec -p 5300"
+DIGOPTS="+tcp +noadd +noauth +nosea +nostat +nocmd +dnssec -p 5300"
 
 # Check the example. domain
 

bin/tests/system/ifconfig.sh

@@ -21,7 +21,7 @@
 #
 
 config_guess=""
-for f in ./config.guess ../../../config.guess
+for f in ./config.guess ../../../config.guess /usr/share/automake*/config.guess
 do
 	if test -f $f
 	then

bin/tests/system/inline/setup.sh

@@ -15,7 +15,6 @@ $SHELL clean.sh
 test -r $RANDFILE || $GENRANDOM $RANDOMSIZE $RANDFILE
 
 cp ns1/root.db.in ns1/root.db
-rm -f ns1/root.db.signed
 
 touch ns2/trusted.conf
 cp ns2/nsec3-loop.db.in ns2/nsec3-loop.db
@@ -26,7 +25,6 @@ cp ns2/bits.db.in ns2/nokeys.db
 cp ns2/bits.db.in ns2/removedkeys-secondary.db
 cp ns2/bits.db.in ns2/retransfer.db
 cp ns2/bits.db.in ns2/retransfer3.db
-rm -f ns2/bits.db.jnl
 
 cp ns3/master.db.in ns3/master.db
 cp ns3/master.db.in ns3/dynamic.db
@@ -41,7 +39,6 @@ mkdir ns3/removedkeys
 
 touch ns4/trusted.conf
 cp ns4/noixfr.db.in ns4/noixfr.db
-rm -f ns4/noixfr.db.jnl
 
 copy_setports ns1/named.conf.in ns1/named.conf
 copy_setports ns2/named.conf.in ns2/named.conf

bin/tests/system/ixfr/clean.sh

@@ -9,7 +9,7 @@
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.
 
-rm -f ns1/myftp.db
+rm -f ns1/*.db ns1/*.jnl
 rm -f ns3/*.jnl ns3/mytest.db ns3/subtest.db
 rm -f ns4/*.jnl ns4/*.db
 rm -f */named.memstats

bin/tests/system/ixfr/setup.sh

@@ -12,7 +12,7 @@
 SYSTEMTESTTOP=..
 . $SYSTEMTESTTOP/conf.sh
 
-rm -f ns1/*.db ns1/*.jnl ns3/*.jnl ns4/*.db ns4/*.jnl
+$SHELL clean.sh
 
 cat <<EOF >ns1/named.conf
 options {

bin/tests/system/keymgr/setup.sh

@@ -19,8 +19,6 @@ $SHELL clean.sh
 # Test 1: KSK goes inactive before successor is active
 dir=01-ksk-inactive
 echo_i "set up $dir"
-rm -f $dir/K*.key
-rm -f $dir/K*.private
 ksk1=`$KEYGEN -K $dir -3fk example.com`
 $SETTIME -K $dir -I +9mo -D +1y $ksk1 > /dev/null 2>&1
 ksk2=`$KEYGEN -K $dir -S $ksk1`
@@ -30,8 +28,6 @@ zsk1=`$KEYGEN -K $dir -3 example.com`
 # Test 2: ZSK goes inactive before successor is active
 dir=02-zsk-inactive
 echo_i "set up $dir"
-rm -f $dir/K*.key
-rm -f $dir/K*.private
 zsk1=`$KEYGEN -K $dir -3 example.com`
 $SETTIME -K $dir -I +9mo -D +1y $zsk1 > /dev/null 2>&1
 zsk2=`$KEYGEN -K $dir -S $zsk1`
@@ -41,8 +37,6 @@ ksk1=`$KEYGEN -K $dir -3fk example.com`
 # Test 3: KSK is unpublished before its successor is published
 dir=03-ksk-unpublished
 echo_i "set up $dir"
-rm -f $dir/K*.key
-rm -f $dir/K*.private
 ksk1=`$KEYGEN -K $dir -3fk example.com`
 $SETTIME -K $dir -I +9mo -D +1y $ksk1 > /dev/null 2>&1
 ksk2=`$KEYGEN -K $dir -S $ksk1`
@@ -52,8 +46,6 @@ zsk1=`$KEYGEN -K $dir -3 example.com`
 # Test 4: ZSK is unpublished before its successor is published
 dir=04-zsk-unpublished
 echo_i "set up $dir"
-rm -f $dir/K*.key
-rm -f $dir/K*.private
 zsk1=`$KEYGEN -K $dir -3 example.com`
 $SETTIME -K $dir -I +9mo -D +1y $zsk1 > /dev/null 2>&1
 zsk2=`$KEYGEN -K $dir -S $zsk1`
@@ -64,8 +56,6 @@ ksk1=`$KEYGEN -K $dir -3fk example.com`
 # and successor activated.
 dir=05-ksk-unpub-active
 echo_i "set up $dir"
-rm -f $dir/K*.key
-rm -f $dir/K*.private
 ksk1=`$KEYGEN -K $dir -3fk example.com`
 $SETTIME -K $dir -I +9mo -D +8mo $ksk1 > /dev/null 2>&1
 ksk2=`$KEYGEN -K $dir -S $ksk1`
@@ -75,8 +65,6 @@ zsk1=`$KEYGEN -K $dir -3 example.com`
 # and successor activated.
 dir=06-zsk-unpub-active
 echo_i "set up $dir"
-rm -f $dir/K*.key
-rm -f $dir/K*.private
 zsk1=`$KEYGEN -K $dir -3 example.com`
 $SETTIME -K $dir -I +9mo -D +8mo $zsk1 > /dev/null 2>&1
 zsk2=`$KEYGEN -K $dir -S $zsk1`
@@ -85,8 +73,6 @@ ksk1=`$KEYGEN -K $dir -3fk example.com`
 # Test 7: KSK rolled with insufficient delay after prepublication.
 dir=07-ksk-ttl
 echo_i "set up $dir"
-rm -f $dir/K*.key
-rm -f $dir/K*.private
 ksk1=`$KEYGEN -K $dir -3fk example.com`
 $SETTIME -K $dir -I +9mo -D +1y $ksk1 > /dev/null 2>&1
 ksk2=`$KEYGEN -K $dir -S $ksk1`
@@ -96,8 +82,6 @@ zsk1=`$KEYGEN -K $dir -3 example.com`
 # Test 8: ZSK rolled with insufficient delay after prepublication.
 dir=08-zsk-ttl
 echo_i "set up $dir"
-rm -f $dir/K*.key
-rm -f $dir/K*.private
 zsk1=`$KEYGEN -K $dir -3 example.com`
 $SETTIME -K $dir -I +9mo -D +1y $zsk1 > /dev/null 2>&1
 zsk2=`$KEYGEN -K $dir -S $zsk1`
@@ -106,14 +90,10 @@ $SETTIME -K $dir -P +269d $zsk2 > /dev/null 2>&1
 ksk1=`$KEYGEN -K $dir -3fk example.com`
 
 # Test 9: No special preparation needed
-rm -f $dir/K*.key
-rm -f $dir/K*.private
 
 # Test 10: Valid key set, but rollover period has changed
 dir=10-change-roll
 echo_i "set up $dir"
-rm -f $dir/K*.key
-rm -f $dir/K*.private
 ksk1=`$KEYGEN -K $dir -3fk example.com`
 zsk1=`$KEYGEN -K $dir -3 example.com`
 $SETTIME -K $dir -I +3mo -D +4mo $zsk1 > /dev/null 2>&1
@@ -122,8 +102,6 @@ zsk2=`$KEYGEN -K $dir -S $zsk1`
 # Test 11: Many keys all simultaneously scheduled to be active in the future
 dir=11-many-simul
 echo_i "set up $dir"
-rm -f $dir/K*.key
-rm -f $dir/K*.private
 k1=`$KEYGEN -K $dir -q3fk -P now+1mo -A now+1mo example.com`
 z1=`$KEYGEN -K $dir -q3 -P now+1mo -A now+1mo example.com`
 z2=`$KEYGEN -K $dir -q3 -P now+1mo -A now+1mo example.com`
@@ -133,8 +111,6 @@ z4=`$KEYGEN -K $dir -q3 -P now+1mo -A now+1mo example.com`
 # Test 12: Many keys all simultaneously scheduled to be active in the past
 dir=12-many-active
 echo_i "set up $dir"
-rm -f $dir/K*.key
-rm -f $dir/K*.private
 k1=`$KEYGEN -K $dir -q3fk example.com`
 z1=`$KEYGEN -K $dir -q3 example.com`
 z2=`$KEYGEN -K $dir -q3 example.com`
@@ -144,8 +120,6 @@ z4=`$KEYGEN -K $dir -q3 example.com`
 # Test 13: Multiple simultaneous keys with no configured roll period
 dir=13-noroll
 echo_i "set up $dir"
-rm -f $dir/K*.key
-rm -f $dir/K*.private
 k1=`$KEYGEN -K $dir -q3fk example.com`
 k2=`$KEYGEN -K $dir -q3fk example.com`
 k3=`$KEYGEN -K $dir -q3fk example.com`
@@ -154,8 +128,6 @@ z1=`$KEYGEN -K $dir -q3 example.com`
 # Test 14: Keys exist but have the wrong algorithm
 dir=14-wrongalg
 echo_i "set up $dir"
-rm -f $dir/K*.key
-rm -f $dir/K*.private
 k1=`$KEYGEN -K $dir -qfk example.com`
 z1=`$KEYGEN -K $dir -q example.com`
 $SETTIME -K $dir -I now+6mo -D now+8mo $z1 > /dev/null
@@ -168,8 +140,6 @@ z4=`$KEYGEN -K $dir -q -S ${z3}.key`
 # Test 15: No zones specified; just search the directory for keys
 dir=15-unspec
 echo_i "set up $dir"
-rm -f $dir/K*.key
-rm -f $dir/K*.private
 k1=`$KEYGEN -K $dir -q3fk example.com`
 z1=`$KEYGEN -K $dir -q3 example.com`
 $SETTIME -K $dir -I now+6mo -D now+8mo $z1 > /dev/null
@@ -183,8 +153,6 @@ z4=`$KEYGEN -K $dir -q -S ${z3}.key`
 # keys have the wrong algorithm for their policies
 dir=16-wrongalg-unspec
 echo_i "set up $dir"
-rm -f $dir/K*.key
-rm -f $dir/K*.private
 k1=`$KEYGEN -K $dir -qfk example.com`
 z1=`$KEYGEN -K $dir -q example.com`
 $SETTIME -K $dir -I now+6mo -D now+8mo $z1 > /dev/null
@@ -198,8 +166,6 @@ z4=`$KEYGEN -K $dir -q -S ${z3}.key`
 # flag (this should fail)
 dir=17-noforce
 echo_i "set up $dir"
-rm -f $dir/K*.key
-rm -f $dir/K*.private
 k1=`$KEYGEN -K $dir -q3fk example.com`
 z1=`$KEYGEN -K $dir -q3 example.com`
 z2=`$KEYGEN -K $dir -q3 example.com`
@@ -209,8 +175,6 @@ z4=`$KEYGEN -K $dir -q3 example.com`
 # Test 18: Prepublication interval is set to a nonstandard value
 dir=18-nonstd-prepub
 echo_i "set up $dir"
-rm -f $dir/K*.key
-rm -f $dir/K*.private
 ksk1=`$KEYGEN -K $dir -3fk example.com`
 zsk1=`$KEYGEN -K $dir -3 example.com`
 $SETTIME -K $dir -I now+2mo -D now+3mo $zsk1 > /dev/null
@@ -218,8 +182,6 @@ $SETTIME -K $dir -I now+2mo -D now+3mo $zsk1 > /dev/null
 # Test 19: Key has been published/active a long time
 dir=19-old-keys
 echo_i "set up $dir"
-rm -f $dir/K*.key
-rm -f $dir/K*.private
 ksk1=`$KEYGEN -K $dir -3fk example.com`
 zsk1=`$KEYGEN -K $dir -3 example.com`
 $SETTIME -K $dir -P now-2y -A now-2y $ksk1 > /dev/null

bin/tests/system/keymgr/tests.sh

@@ -116,16 +116,16 @@ done
 
 echo_i "checking domains ending in . ($n)"
 ret=0
-$KEYMGR -g $KEYGEN -s $SETTIME . > keymgr.1.$n 2>&1
+$KEYMGR -g $KEYGEN -r $RANDFILE -s $SETTIME . > keymgr.1.$n 2>&1
 nkeys=`grep dnssec-keygen keymgr.1.$n | wc -l`
 [ "$nkeys" -eq 2 ] || ret=1
-$KEYMGR -g $KEYGEN -s $SETTIME . > keymgr.2.$n 2>&1
+$KEYMGR -g $KEYGEN -r $RANDFILE -s $SETTIME . > keymgr.2.$n 2>&1
 nkeys=`grep dnssec-keygen keymgr.2.$n | wc -l`
 [ "$nkeys" -eq 0 ] || ret=1
-$KEYMGR -g $KEYGEN -s $SETTIME example.com. > keymgr.3.$n 2>&1
+$KEYMGR -g $KEYGEN -r $RANDFILE -s $SETTIME example.com. > keymgr.3.$n 2>&1
 nkeys=`grep dnssec-keygen keymgr.3.$n | wc -l`
 [ "$nkeys" -eq 2 ] || ret=1
-$KEYMGR -g $KEYGEN -s $SETTIME example.com. > keymgr.4.$n 2>&1
+$KEYMGR -g $KEYGEN -r $RANDFILE -s $SETTIME example.com. > keymgr.4.$n 2>&1
 nkeys=`grep dnssec-keygen keymgr.4.$n | wc -l`
 [ "$nkeys" -eq 0 ] || ret=1
 status=`expr $status + $ret`

bin/tests/system/legacy/tests.sh

@@ -12,7 +12,7 @@
 SYSTEMTESTTOP=..
 . $SYSTEMTESTTOP/conf.sh
 
-DIGOPTS="-p ${PORT}"
+DIGOPTS="-p ${PORT} +tries=3 +time=5"
 
 status=0
 n=0

bin/tests/system/lwresd/setup.sh

@@ -0,0 +1,15 @@
+#!/bin/sh
+#
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+# shellcheck source=conf.sh
+. "$SYSTEMTESTTOP/conf.sh"
+
+$SHELL clean.sh

bin/tests/system/masterformat/setup.sh

@@ -12,13 +12,14 @@
 # shellcheck source=conf.sh
 . "$SYSTEMTESTTOP/conf.sh"
 
+$SHELL clean.sh
+
 test -r $RANDFILE || $GENRANDOM $RANDOMSIZE $RANDFILE
 
 copy_setports ns1/named.conf.in ns1/named.conf
 copy_setports ns2/named.conf.in ns2/named.conf
 copy_setports ns3/named.conf.in ns3/named.conf
 
-rm -f ns1/example.db.raw
 cp ns1/example.db ns2/
 cp ns2/formerly-text.db.in ns2/formerly-text.db
 cp ns1/large.db.in ns1/large.db

bin/tests/system/metadata/setup.sh

@@ -12,7 +12,7 @@
 SYSTEMTESTTOP=..
 . $SYSTEMTESTTOP/conf.sh
 
-$SHELL ./clean.sh
+$SHELL clean.sh
 
 test -r $RANDFILE || $GENRANDOM $RANDOMSIZE $RANDFILE
 

bin/tests/system/mkeys/ns5/named.conf.in

@@ -24,6 +24,7 @@ options {
 	dnssec-enable yes;
 	dnssec-validation auto;
 	bindkeys-file "managed.conf";
+	servfail-ttl 0;
 };
 
 key rndc_key {

bin/tests/system/mkeys/ns6/setup.sh

@@ -16,7 +16,7 @@ zone=.
 zonefile=root.db
 
 # an RSA key
-rsakey=`$KEYGEN -a rsasha256 -b 2048 -qfk rsasha256.`
+rsakey=`$KEYGEN -a rsasha256 -b 2048 -r $RANDFILE -qfk rsasha256.`
 
 # a key with unsupported algorithm
 unsupportedkey=Kunknown.+255+00000

bin/tests/system/nsupdate/setup.sh

@@ -14,7 +14,11 @@ SYSTEMTESTTOP=..
 
 test -r $RANDFILE || $GENRANDOM $RANDOMSIZE $RANDFILE
 
+#
+# jnl and database files MUST be removed before we start
+#
 $SHELL clean.sh
+
 copy_setports ns1/named.conf.in ns1/named.conf
 copy_setports ns2/named.conf.in ns2/named.conf
 copy_setports ns3/named.conf.in ns3/named.conf
@@ -27,15 +31,6 @@ copy_setports ns10/named.conf.in ns10/named.conf
 
 copy_setports verylarge.in verylarge
 
-#
-# jnl and database files MUST be removed before we start
-#
-
-rm -f ns1/*.jnl ns1/example.db ns2/*.jnl ns2/example.bk
-rm -f ns2/update.bk ns2/update.alt.bk
-rm -f ns3/example.db.jnl
-rm -f ns3/too-big.test.db.jnl
-
 cp -f ns1/example1.db ns1/example.db
 sed 's/example.nil/other.nil/g' ns1/example1.db > ns1/other.db
 sed 's/example.nil/unixtime.nil/g' ns1/example1.db > ns1/unixtime.db
@@ -73,7 +68,6 @@ $DDNSCONFGEN -q -r $RANDFILE -a hmac-sha512 -k sha512-key -z keytests.nil > ns1/
 (cd ns3; $SHELL -e sign.sh)
 
 cp -f ns1/many.test.db.in ns1/many.test.db
-rm -f ns1/many.test.db.jnl
 
 cp ns1/sample.db.in ns1/sample.db
 cp ns2/sample.db.in ns2/sample.db

bin/tests/system/pending/setup.sh

@@ -12,6 +12,8 @@
 SYSTEMTESTTOP=..
 . $SYSTEMTESTTOP/conf.sh
 
+$SHELL clean.sh
+
 test -r $RANDFILE || $GENRANDOM $RANDOMSIZE $RANDFILE
 
 copy_setports ns1/named.conf.in ns1/named.conf

bin/tests/system/pkcs11/setup.sh

@@ -12,6 +12,8 @@
 SYSTEMTESTTOP=..
 . $SYSTEMTESTTOP/conf.sh
 
+$SHELL clean.sh
+
 infile=ns1/example.db.in
 
 /bin/echo -n ${HSMPIN:-1234}> pin

bin/tests/system/pkcs11ssl/setup.sh

@@ -12,6 +12,8 @@
 SYSTEMTESTTOP=..
 . $SYSTEMTESTTOP/conf.sh
 
+$SHELL clean.sh
+
 infile=ns1/example.db.in
 
 /bin/echo -n ${HSMPIN:-1234}> pin

bin/tests/system/resolver/setup.sh

@@ -12,6 +12,8 @@
 SYSTEMTESTTOP=..
 . $SYSTEMTESTTOP/conf.sh
 
+$SHELL clean.sh
+
 test -r $RANDFILE || $GENRANDOM $RANDOMSIZE $RANDFILE
 
 cp ns4/tld1.db ns4/tld.db

bin/tests/system/resolver/tests.sh

@@ -762,20 +762,20 @@ status=`expr $status + $ret`
 n=`expr $n + 1`
 echo_i "check that the resolver accepts a reply with empty question section with TC=1 and retries over TCP ($n)"
 ret=0
-$DIG $DIGOPTS @10.53.0.5 truncated.no-questions. a > dig.ns5.out.${n} || ret=1
+$DIG $DIGOPTS @10.53.0.5 truncated.no-questions. a +tries=3 +time=5 > dig.ns5.out.${n} || ret=1
 grep "status: NOERROR" dig.ns5.out.${n} > /dev/null || ret=1
 grep "ANSWER: 1," dig.ns5.out.${n} > /dev/null || ret=1
-grep "1.2.3.4" dig.ns5.out.${n} > /dev/null || ret=1
+grep "1\.2\.3\.4" dig.ns5.out.${n} > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
 
 n=`expr $n + 1`
 echo_i "check that the resolver rejects a reply with empty question section with TC=0 ($n)"
 ret=0
-$DIG $DIGOPTS @10.53.0.5 not-truncated.no-questions. a > dig.ns5.out.${n} || ret=1
+$DIG $DIGOPTS @10.53.0.5 not-truncated.no-questions. a +tries=3 +time=5 > dig.ns5.out.${n} || ret=1
 grep "status: NOERROR" dig.ns5.out.${n} > /dev/null && ret=1
 grep "ANSWER: 1," dig.ns5.out.${n} > /dev/null && ret=1
-grep "1.2.3.4" dig.ns5.out.${n} > /dev/null && ret=1
+grep "1\.2\.3\.4" dig.ns5.out.${n} > /dev/null && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
 

bin/tests/system/rpz/README

@@ -0,0 +1,28 @@
+Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+
+See COPYRIGHT in the source root or http://isc.org/copyright.html for terms.
+
+The test setup for the RPZ tests prepares a query perf tool and sets up
+policy zones.
+
+Name servers
+------------
+
+ns1 is the root server.
+
+ns2 and ns4 are authoritative servers for the various test domains.
+
+ns3 is the main rewriting resolver.
+
+ns5 and ns7 are additional rewriting resolvers.
+
+ns6 is a forwarding server.
+
+Updating the response policy zones
+----------------------------------
+
+test1, test2, test3, test4, test5, and test6 are dynamic update files.  These
+updates are made against ns3.  The script function "start_group" is called to
+start an new batch of tests that may depend on certain server updates.  The
+function takes an optional file name and if provided the server updates are
+performed before executing the test batch.

bin/tests/system/rpz/clean.sh

@@ -9,13 +9,43 @@
 
 # Clean up after rpz tests.
 
-rm -f proto.* dsset-* trusted.conf dig.out* nsupdate.tmp ns*/*tmp
-rm -f ns*/*.key ns*/*.private ns2/tld2s.db ns2/bl.tld2.db
-rm -f ns3/bl*.db ns*/*switch ns*/empty.db ns*/empty.db.jnl
-rm -f ns5/requests ns5/example.db ns5/bl.db ns5/*.perf
-rm -f */named.memstats */named.run */named.stats */session.key
-rm -f */*.jnl */*.core */*.pid
+USAGE="$0: [-Px]"
+DEBUG=
+while getopts "Px" c; do
+    case $c in
+	x) set -x ;;
+	P) PARTIAL=set ;;
+	*) echo "$USAGE" 1>&2; exit 1;;
+    esac
+done
+shift `expr $OPTIND - 1 || true`
+if test "$#" -ne 0; then
+    echo "$USAGE" 1>&2
+    exit 1
+fi
+
+# this might be called from setup.sh to partially clean up the files
+# from the first test pass so the second pass can be set up correctly.
+# remove those files first, then decide whether to remove the others.
+rm -f ns*/*.key ns*/*.private
+rm -f ns2/tld2s.db ns2/bl.tld2.db
+rm -f ns3/bl*.db ns*/empty.db
+rm -f ns3/manual-update-rpz.db
+rm -f ns5/example.db ns5/bl.db
 rm -f */policy2.db
-rm -f ns*/named.lock
-rm -f ns*/named.conf
-rm -f tmp
+rm -f */*.jnl
+
+if [ ${PARTIAL:-unset} = unset ]; then
+    rm -f proto.* dsset-* trusted.conf dig.out* nsupdate.tmp ns*/*tmp
+    rm -f ns5/requests ns5/*.perf
+    rm -f */named.memstats */*.run */*.run.prev */named.stats */session.key
+    rm -f */*.log */*core */*.pid
+    rm -f ns*/named.lock
+    rm -f ns*/named.conf
+    rm -f ns*/*switch ns*/empty.db.jnl
+    rm -f dnsrps*.conf
+    rm -f dnsrpzd.conf
+    rm -f dnsrpzd-license-cur.conf dnsrpzd.rpzf dnsrpzd.sock dnsrpzd.pid
+    rm -f ns*/managed-keys.bind*
+    rm -f tmp
+fi

bin/tests/system/rpz/ns3/broken.db.in

@@ -0,0 +1,16 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0. If a copy of the MPL was not distributed with this
+; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+; RPZ test
+;   This basic file is copied to several zone files before being used.
+;   Its contents are also changed with nsupdate
+
+
+; broken zone
+foobar

bin/tests/system/rpz/ns3/manual-update-rpz-2.db.in

@@ -0,0 +1,20 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0. If a copy of the MPL was not distributed with this
+; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+; RPZ test
+;   This basic file is copied to several zone files before being used.
+;   Its contents are also changed with nsupdate
+
+
+$TTL 300
+@				SOA	bl-reload.  hostmaster.ns.bl-reload. ( 2 3600 1200 604800 60 )
+				NS	ns.tld3.
+
+walled.tld2.bl-reload.	 300	A	10.0.0.2
+

bin/tests/system/rpz/ns3/manual-update-rpz.db.in

@@ -0,0 +1,20 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0. If a copy of the MPL was not distributed with this
+; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+; RPZ test
+;   This basic file is copied to several zone files before being used.
+;   Its contents are also changed with nsupdate
+
+
+$TTL 300
+@					SOA	manual-update-rpz.  hostmaster.ns.manual-rpz-update. ( 1 3600 1200 604800 60 )
+					NS	ns.tld3.
+
+walled.tld2.manual-update-rpz.	 300	A	10.0.0.1
+

bin/tests/system/rpz/ns3/named.conf.in

@@ -40,6 +40,7 @@ options {
 	    zone "bl-drop"	policy drop;
 	    zone "bl-tcp-only"	policy tcp-only;
 	    zone "bl.tld2";
+	    zone "manual-update-rpz";
 	}
 	min-ns-dots 0
 	qname-wait-recurse yes
@@ -87,5 +88,11 @@ zone "bl-tcp-only."	{type master; file "bl-tcp-only.db";
 zone "bl.tld2."		{type slave; file "bl.tld2.db"; masters {10.53.0.2;};
 				request-ixfr no; masterfile-format text;};
 
-zone "crash1.tld2"	{type master; file "crash1";};
-zone "crash2.tld3."	{type master; file "crash2";};
+zone "crash1.tld2"	{type master; file "crash1"; notify no;};
+zone "crash2.tld3."	{type master; file "crash2"; notify no;};
+
+zone "manual-update-rpz." {
+	type master;
+	file "manual-update-rpz.db";
+	notify no;
+};

bin/tests/system/rpz/setup.sh

@@ -35,11 +35,13 @@ copy_setports ns7/named.conf.in ns7/named.conf
 for NM in '' -2 -given -disabled -passthru -no-op -nodata -nxdomain -cname -wildcname -garden -drop -tcp-only; do
     sed -e "/SOA/s/blx/bl$NM/g" ns3/base.db >ns3/bl$NM.db
 done
+#  bl zones are dynamically updated.  Add one zone that is updated manually.
+cp ns3/manual-update-rpz.db.in ns3/manual-update-rpz.db
 
-# sign the root and a zone in ns2
-test -r $RANDFILE || $GENRANDOM $RANDOMSIZE $RANDFILE
-
-# $1=directory, $2=domain name, $3=input zone file, $4=output file
+# $1=directory
+# $2=domain name
+# $3=input zone file
+# $4=output file
 signzone () {
     KEYNAME=`$KEYGEN -q -r $RANDFILE -b 512 -K $1 $2`
     cat $1/$3 $1/$KEYNAME.key > $1/tmp
@@ -48,8 +50,10 @@ signzone () {
     DSFILENAME=dsset-`echo $2 |sed -e "s/\.$//g"`$TP
     rm $DSFILENAME $1/tmp
 }
-signzone ns2 tld2s. base-tld2s.db tld2s.db
 
+# sign the root and a zone in ns2
+test -r $RANDFILE || $GENRANDOM $RANDOMSIZE $RANDFILE
+signzone ns2 tld2s. base-tld2s.db tld2s.db
 
 # Performance and a few other checks.
 cat <<EOF >ns5/rpz-switch

bin/tests/system/rpz/tests.sh

@@ -24,6 +24,7 @@ ns7=$ns.7		# another rewriting resolver
 HAVE_CORE=
 SAVE_RESULTS=
 
+status=0
 
 USAGE="$0: [-x]"
 while getopts "x" c; do
@@ -83,6 +84,76 @@ setret () {
     echo_i "$*"
 }
 
+# set $SN to the SOA serial number of a zone
+# $1=domain
+# $2=DNS server and client IP address
+get_sn() {
+    SOA=`$DIG -p ${PORT} +short +norecurse soa "$1" "@$2" "-b$2"`
+    SN=`expr "$SOA" : '[^ ]* [^ ]* \([^ ]*\) .*'`
+    test "$SN" != "" && return
+    echo_i "no serial number from \`dig -p ${PORT} soa $1 @$2\` in \"$SOA\""
+    exit 1
+}
+
+get_sn_fast () {
+    RSN=`$DNSRPSCMD -n "$1"`
+    #echo "dnsrps serial for $1 is $RSN"
+    if test -z "$RSN"; then
+	echo_i "dnsrps failed to get SOA serial number for $1"
+	exit 1
+    fi
+}
+
+# check that dnsrpzd has loaded its zones
+# $1=domain
+# $2=DNS server IP address
+FZONES=`sed -n -e 's/^zone "\(.*\)".*\(10.53.0..\).*/Z=\1;M=\2/p' dnsrpzd.conf`
+dnsrps_loaded() {
+    test "$mode" = dnsrps || return
+    n=0
+    for V in $FZONES; do
+	eval "$V"
+	get_sn $Z $M
+	while true; do
+	    get_sn_fast "$Z"
+	    if test "$SN" -eq "0$RSN"; then
+		#echo "$Z @$M serial=$SN"
+		break
+	    fi
+	    n=`expr $n + 1`
+	    if test "$n" -gt $TEN_SECS; then
+		echo_i "dnsrps serial for $Z is $RSN instead of $SN"
+		exit 1
+	    fi
+	    $WAIT_CMD
+	done
+    done
+}
+
+# check the serial number in an SOA to ensure that a policy zone has
+#   been (re)loaded
+# $1=serial number
+# $2=domain
+# $3=DNS server
+ck_soa() {
+    n=0
+    while true; do
+	if test "$mode" = dnsrps; then
+	    get_sn_fast "$2"
+	    test "$RSN" -eq "$1" && return
+	else
+	    get_sn "$2" "$3"
+	    test "$SN" -eq "$1" && return
+	fi
+	n=`expr $n + 1`
+	if test "$n" -gt $TEN_SECS; then
+	    echo_i "got serial number \"$SN\" instead of \"$1\" from $2 @$3"
+	    return
+	fi
+	$WAIT_CMD
+    done
+}
+
 # (re)load the reponse policy zones with the rules in the file $TEST_FILE
 load_db () {
     if test -n "$TEST_FILE"; then
@@ -98,6 +169,9 @@ load_db () {
     fi
 }
 
+# restart name server
+# $1 ns number
+# $2 rebuild bl rpz zones if "rebuild-bl-rpz"
 restart () {
     # try to ensure that the server really has stopped
     # and won't mess with ns$1/name.pid
@@ -113,16 +187,19 @@ restart () {
 	fi
     fi
     rm -f ns$1/*.jnl
-    if test -f ns$1/base.db; then
-	for NM in ns$1/bl*.db; do
-	    cp -f ns$1/base.db $NM
-	done
+    if [ "$2" == "rebuild-bl-rpz" ]; then
+        if test -f ns$1/base.db; then
+	    for NM in ns$1/bl*.db; do
+	        cp -f ns$1/base.db $NM
+            done
+        fi
     fi
     $PERL $SYSTEMTESTTOP/start.pl --noclean --restart --port ${PORT} rpz ns$1
     load_db
 }
 
-# $1=server and irrelevant args  $2=error message
+# $1=server and irrelevant args
+# $2=error message
 ckalive () {
     CKALIVE_NS=`expr "$1" : '.*@ns\([1-9]\).*'`
     if test -z "$CKALIVE_NS"; then
@@ -133,7 +210,7 @@ ckalive () {
     HAVE_CORE=yes
     setret "$2"
     # restart the server to avoid stalling waiting for it to stop
-    restart $CKALIVE_NS
+    restart $CKALIVE_NS "rebuild-bl-rpz"
     return 1
 }
 
@@ -170,7 +247,8 @@ ckstatsrange () {
     eval "${NSDIR}_CNT=$NEW_CNT"
 }
 
-# $1=message  $2=optional test file name
+# $1=message
+# $2=optional test file name
 start_group () {
     ret=0
     t=`expr $t + 1`
@@ -203,7 +281,8 @@ clean_result () {
     fi
 }
 
-# $1=dig args $2=other dig output file
+# $1=dig args
+# $2=other dig output file
 ckresult () {
     #ckalive "$1" "server crashed by 'dig $1'" || return 1
     if grep "flags:.* aa .*ad;" $DIGNM; then
@@ -226,7 +305,8 @@ ckresult () {
 }
 
 # check only that the server does not crash
-# $1=target domain  $2=optional query type
+# $1=target domain
+# $2=optional query type
 nocrash () {
     digcmd $* >/dev/null
     ckalive "$*" "server crashed by 'dig $*'"
@@ -234,7 +314,8 @@ nocrash () {
 
 
 # check rewrite to NXDOMAIN
-# $1=target domain  $2=optional query type
+# $1=target domain
+# $2=optional query type
 nxdomain () {
     make_dignm
     digcmd $*								\
@@ -245,7 +326,8 @@ nxdomain () {
 }
 
 # check rewrite to NODATA
-# $1=target domain  $2=optional query type
+# $1=target domain
+# $2=optional query type
 nodata () {
     make_dignm
     digcmd $*								\
@@ -255,7 +337,9 @@ nodata () {
 
 # check rewrite to an address
 #   modify the output so that it is easily compared, but save the original line
-# $1=IPv4 address  $2=digcmd args  $3=optional TTL
+# $1=IPv4 address
+# $2=digcmd args
+# $3=optional TTL
 addr () {
     ADDR=$1
     make_dignm
@@ -277,7 +361,8 @@ addr () {
 # Check that a response is not rewritten
 #   Use $ns1 instead of the authority for most test domains, $ns2 to prevent
 #   spurious differences for `dig +norecurse`
-# $1=optional "TCP"  remaining args for dig
+# $1=optional "TCP"
+# remaining args for dig
 nochange () {
     make_dignm
     digcmd $* >$DIGNM
@@ -306,239 +391,281 @@ drop () {
     return 1
 }
 
+nsd() {
+  $NSUPDATE -p ${PORT} << EOF
+  server $1
+  ttl 300
+  update $2 $3 IN CNAME .
+  update $2 $4 IN CNAME .
+  send
+EOF
+  sleep 2
+}
 
-# make prototype files to check against rewritten results
-digcmd nonexistent @$ns2 >proto.nxdomain
-digcmd txt-only.tld2 @$ns2 >proto.nodata
+for mode in native dnsrps; do
+  status=0
+  case ${mode} in
+  native)
+    if [ -e dnsrps-only ] ; then
+      echo_i "'dnsrps-only' found: skipping native RPZ sub-test"
+      continue
+    else
+      echo_i "running native RPZ sub-test"
+    fi
+    ;;
+  dnsrps)
+    if [ -e dnsrps-off ] ; then
+      echo_i "'dnsrps-off' found: skipping DNSRPS sub-test"
+      continue
+    fi
+    echo_i "attempting to configure servers with DNSRPS..."
+    $PERL $SYSTEMTESTTOP/stop.pl --use-rndc --port ${CONTROLPORT} rpz
+    $SHELL ./setup.sh -N -D $DEBUG
+    for server in ns*; do
+      resetstats $server
+    done
+    sed -n 's/^## //p' dnsrps.conf | cat_i
+    if grep '^#fail' dnsrps.conf >/dev/null; then
+      echo_i "exit status: 1"
+      exit 1
+    fi
+    if grep '^#skip' dnsrps.conf > /dev/null; then
+      echo_i "DNSRPS sub-test skipped"
+      continue
+    else
+      echo_i "running DNSRPS sub-test"
+      $PERL $SYSTEMTESTTOP/start.pl --noclean --restart --port ${PORT} rpz
+    fi
+    ;;
+  esac
 
+  # make prototype files to check against rewritten results
+  digcmd nonexistent @$ns2 >proto.nxdomain
+  digcmd txt-only.tld2 @$ns2 >proto.nodata
 
-status=0
-
-start_group "QNAME rewrites" test1
-nochange .				# 1 do not crash or rewrite root
-nxdomain a0-1.tld2			# 2
-nodata a3-1.tld2			# 3
-nodata a3-2.tld2			# 4 nodata at DNAME itself
-nochange sub.a3-2.tld2			# 5 miss where DNAME might work
-nxdomain a4-2.tld2			# 6 rewrite based on CNAME target
-nxdomain a4-2-cname.tld2		# 7
-nodata a4-3-cname.tld2			# 8
-addr 12.12.12.12  a4-1.sub1.tld2	# 9 A replacement
-addr 12.12.12.12  a4-1.sub2.tld2	# 10 A replacement with wildcard
-addr 12.12.12.12  nxc1.sub1.tld2	# 11 replace NXDOMAIN with CNAME
-addr 12.12.12.12  nxc2.sub1.tld2	# 12 replace NXDOMAIN with CNAME chain
-addr 127.4.4.1	  a4-4.tld2		# 13 prefer 1st conflicting QNAME zone
-nochange a6-1.tld2			# 14
-addr 127.6.2.1	  a6-2.tld2		# 15
-addr 56.56.56.56  a3-6.tld2		# 16 wildcard CNAME
-addr 57.57.57.57  a3-7.sub1.tld2	# 17 wildcard CNAME
-addr 127.0.0.16	  a4-5-cname3.tld2	# 18 CNAME chain
-addr 127.0.0.17	  a4-6-cname3.tld2	# 19 stop short in CNAME chain
-nochange a5-2.tld2	    +norecurse	# 20 check that RD=1 is required
-nochange a5-3.tld2	    +norecurse	# 21
-nochange a5-4.tld2	    +norecurse	# 22
-nochange sub.a5-4.tld2	    +norecurse	# 23
-nxdomain c1.crash2.tld3			# 24 assert in rbtdb.c
-nxdomain a0-1.tld2	    +dnssec	# 25 simple DO=1 without signatures
-nxdomain a0-1.tld2s	    +nodnssec	# 26 simple DO=0 with signatures
-nochange a0-1.tld2s	    +dnssec	# 27 simple DO=1 with signatures
-nxdomain a0-1s-cname.tld2s  +dnssec	# 28 DNSSEC too early in CNAME chain
-nochange a0-1-scname.tld2   +dnssec	# 29 DNSSEC on target in CNAME chain
-nochange a0-1.tld2s srv +auth +dnssec	# 30 no write for DNSSEC and no record
-nxdomain a0-1.tld2s srv	    +nodnssec	# 31
-drop a3-8.tld2 any			# 32 drop
-nochange tcp a3-9.tld2			# 33 tcp-only
-here x.servfail <<'EOF'			# 34 qname-wait-recurse yes
+  start_group "QNAME rewrites" test1
+  nochange .					# 1 do not crash or rewrite root
+  nxdomain a0-1.tld2				# 2
+  nodata a3-1.tld2				# 3
+  nodata a3-2.tld2				# 4 nodata at DNAME itself
+  nochange sub.a3-2.tld2			# 5 miss where DNAME might work
+  nxdomain a4-2.tld2				# 6 rewrite based on CNAME target
+  nxdomain a4-2-cname.tld2			# 7
+  nodata a4-3-cname.tld2			# 8
+  addr 12.12.12.12  a4-1.sub1.tld2		# 9 A replacement
+  addr 12.12.12.12  a4-1.sub2.tld2		# 10 A replacement with wildcard
+  addr 12.12.12.12  nxc1.sub1.tld2		# 11 replace NXDOMAIN with CNAME
+  addr 12.12.12.12  nxc2.sub1.tld2		# 12 replace NXDOMAIN with CNAME chain
+  addr 127.4.4.1    a4-4.tld2			# 13 prefer 1st conflicting QNAME zone
+  nochange a6-1.tld2				# 14
+  addr 127.6.2.1    a6-2.tld2			# 15
+  addr 56.56.56.56  a3-6.tld2			# 16 wildcard CNAME
+  addr 57.57.57.57  a3-7.sub1.tld2		# 17 wildcard CNAME
+  addr 127.0.0.16   a4-5-cname3.tld2		# 18 CNAME chain
+  addr 127.0.0.17   a4-6-cname3.tld2		# 19 stop short in CNAME chain
+  nochange a5-2.tld2 +norecurse			# 20 check that RD=1 is required
+  nochange a5-3.tld2 +norecurse			# 21
+  nochange a5-4.tld2 +norecurse			# 22
+  nochange sub.a5-4.tld2 +norecurse		# 23
+  nxdomain c1.crash2.tld3			# 24 assert in rbtdb.c
+  nxdomain a0-1.tld2 +dnssec			# 25 simple DO=1 without signatures
+  nxdomain a0-1.tld2s +nodnssec			# 26 simple DO=0 with signatures
+  nochange a0-1.tld2s +dnssec			# 27 simple DO=1 with signatures
+  nxdomain a0-1s-cname.tld2s  +dnssec		# 28 DNSSEC too early in CNAME chain
+  nochange a0-1-scname.tld2   +dnssec		# 29 DNSSEC on target in CNAME chain
+  nochange a0-1.tld2s srv +auth +dnssec		# 30 no write for DNSSEC and no record
+  nxdomain a0-1.tld2s srv +nodnssec		# 31
+  drop a3-8.tld2 any				# 32 drop
+  nochange tcp a3-9.tld2			# 33 tcp-only
+  here x.servfail <<'EOF'			# 34 qname-wait-recurse yes
     ;; status: SERVFAIL, x
 EOF
-addr 35.35.35.35 "x.servfail @$ns5"	# 35 qname-wait-recurse no
-end_group
-ckstats $ns3 test1 ns3 22
-ckstats $ns5 test1 ns5 1
-ckstats $ns6 test1 ns6 0
+  addr 35.35.35.35 "x.servfail @$ns5"		# 35 qname-wait-recurse no
+  end_group
+  ckstats $ns3 test1 ns3 22
+  ckstats $ns5 test1 ns5 1
+  ckstats $ns6 test1 ns6 0
 
-start_group "NXDOMAIN/NODATA action on QNAME trigger" test1
-nxdomain a0-1.tld2 @$ns6                   # 1
-nodata a3-1.tld2 @$ns6                     # 2
-nodata a3-2.tld2 @$ns6                     # 3 nodata at DNAME itself
-nxdomain a4-2.tld2 @$ns6                   # 4 rewrite based on CNAME target
-nxdomain a4-2-cname.tld2 @$ns6             # 5
-nodata a4-3-cname.tld2 @$ns6               # 6
-addr 12.12.12.12  "a4-1.sub1.tld2 @$ns6"   # 7 A replacement
-addr 12.12.12.12  "a4-1.sub2.tld2 @$ns6"   # 8 A replacement with wildcard
-addr 127.4.4.1    "a4-4.tld2 @$ns6"        # 9 prefer 1st conflicting QNAME zone
-addr 12.12.12.12  "nxc1.sub1.tld2 @$ns6"   # 10 replace NXDOMAIN w/ CNAME
-addr 12.12.12.12  "nxc2.sub1.tld2 @$ns6"   # 11 replace NXDOMAIN w/ CNAME chain
-addr 127.6.2.1    "a6-2.tld2 @$ns6"        # 12
-addr 56.56.56.56  "a3-6.tld2 @$ns6"        # 13 wildcard CNAME
-addr 57.57.57.57  "a3-7.sub1.tld2 @$ns6"   # 14 wildcard CNAME
-addr 127.0.0.16   "a4-5-cname3.tld2 @$ns6" # 15 CNAME chain
-addr 127.0.0.17   "a4-6-cname3.tld2 @$ns6" # 16 stop short in CNAME chain
-nxdomain c1.crash2.tld3 @$ns6              # 17 assert in rbtdb.c
-nxdomain a0-1.tld2 +dnssec @$ns6           # 18 simple DO=1 without sigs
-nxdomain a0-1s-cname.tld2s  +dnssec @$ns6  # 19
-drop a3-8.tld2 any @$ns6                   # 20 drop
+  start_group "NXDOMAIN/NODATA action on QNAME trigger" test1
+  nxdomain a0-1.tld2 @$ns6			# 1
+  nodata a3-1.tld2 @$ns6			# 2
+  nodata a3-2.tld2 @$ns6			# 3 nodata at DNAME itself
+  nxdomain a4-2.tld2 @$ns6			# 4 rewrite based on CNAME target
+  nxdomain a4-2-cname.tld2 @$ns6		# 5
+  nodata a4-3-cname.tld2 @$ns6			# 6
+  addr 12.12.12.12  "a4-1.sub1.tld2 @$ns6"	# 7 A replacement
+  addr 12.12.12.12  "a4-1.sub2.tld2 @$ns6"	# 8 A replacement with wildcard
+  addr 127.4.4.1    "a4-4.tld2 @$ns6"		# 9 prefer 1st conflicting QNAME zone
+  addr 12.12.12.12  "nxc1.sub1.tld2 @$ns6"	# 10 replace NXDOMAIN w/ CNAME
+  addr 12.12.12.12  "nxc2.sub1.tld2 @$ns6"	# 11 replace NXDOMAIN w/ CNAME chain
+  addr 127.6.2.1    "a6-2.tld2 @$ns6"		# 12
+  addr 56.56.56.56  "a3-6.tld2 @$ns6"		# 13 wildcard CNAME
+  addr 57.57.57.57  "a3-7.sub1.tld2 @$ns6"	# 14 wildcard CNAME
+  addr 127.0.0.16   "a4-5-cname3.tld2 @$ns6"	# 15 CNAME chain
+  addr 127.0.0.17   "a4-6-cname3.tld2 @$ns6"	# 16 stop short in CNAME chain
+  nxdomain c1.crash2.tld3 @$ns6			# 17 assert in rbtdb.c
+  nxdomain a0-1.tld2 +dnssec @$ns6		# 18 simple DO=1 without sigs
+  nxdomain a0-1s-cname.tld2s  +dnssec @$ns6	# 19
+  drop a3-8.tld2 any @$ns6			# 20 drop
+  end_group
+  ckstatsrange $ns3 test1 ns3 22 28
+  ckstats $ns5 test1 ns5 0
+  ckstats $ns6 test1 ns6 0
 
-end_group
-ckstatsrange $ns3 test1 ns3 22 28
-ckstats $ns5 test1 ns5 0
-ckstats $ns6 test1 ns6 0
-
-start_group "IP rewrites" test2
-nodata a3-1.tld2			# 1 NODATA
-nochange a3-2.tld2			# 2 no policy record so no change
-nochange a4-1.tld2			# 3 obsolete PASSTHRU record style
-nxdomain a4-2.tld2			# 4
-nochange a4-2.tld2 -taaaa		# 5 no A => no policy rewrite
-nochange a4-2.tld2 -ttxt		# 6 no A => no policy rewrite
-nxdomain a4-2.tld2 -tany		# 7 no A => no policy rewrite
-nodata a4-3.tld2			# 8
-nxdomain a3-1.tld2 -taaaa		# 9 IPv6 policy
-nochange a4-1-aaaa.tld2 -taaaa		# 10
-addr 127.0.0.1	 a5-1-2.tld2		# 11 prefer smallest policy address
-addr 127.0.0.1	 a5-3.tld2		# 12 prefer first conflicting IP zone
-nochange a5-4.tld2	    +norecurse	# 13 check that RD=1 is required for #14
-addr 14.14.14.14 a5-4.tld2		# 14 prefer QNAME to IP
-nochange a4-4.tld2			# 15 PASSTHRU
-nxdomain c2.crash2.tld3			# 16 assert in rbtdb.c
-addr 127.0.0.17 "a4-4.tld2 -b $ns1"	# 17 client-IP address trigger
-nxdomain a7-1.tld2			# 18 slave policy zone (RT34450)
-cp ns2/blv2.tld2.db.in ns2/bl.tld2.db
-$RNDCCMD 10.53.0.2 reload bl.tld2
-goodsoa="rpz.tld2. hostmaster.ns.tld2. 2 3600 1200 604800 60"
-for i in 0 1 2 3 4 5 6 7 8 9 10
-do
+  start_group "IP rewrites" test2
+  nodata a3-1.tld2				# 1 NODATA
+  nochange a3-2.tld2				# 2 no policy record so no change
+  nochange a4-1.tld2				# 3 obsolete PASSTHRU record style
+  nxdomain a4-2.tld2				# 4
+  nochange a4-2.tld2 -taaaa			# 5 no A => no policy rewrite
+  nochange a4-2.tld2 -ttxt			# 6 no A => no policy rewrite
+  nxdomain a4-2.tld2 -tany			# 7 no A => no policy rewrite
+  nodata a4-3.tld2				# 8
+  nxdomain a3-1.tld2 -taaaa			# 9 IPv6 policy
+  nochange a4-1-aaaa.tld2 -taaaa		# 10
+  addr 127.0.0.1 a5-1-2.tld2			# 11 prefer smallest policy address
+  addr 127.0.0.1 a5-3.tld2			# 12 prefer first conflicting IP zone
+  nochange a5-4.tld2 +norecurse			# 13 check that RD=1 is required for #14
+  addr 14.14.14.14 a5-4.tld2			# 14 prefer QNAME to IP
+  nochange a4-4.tld2				# 15 PASSTHRU
+  nxdomain c2.crash2.tld3			# 16 assert in rbtdb.c
+  addr 127.0.0.17 "a4-4.tld2 -b $ns1"		# 17 client-IP address trigger
+  nxdomain a7-1.tld2				# 18 slave policy zone (RT34450)
+  # updating an response zone policy
+  cp ns2/blv2.tld2.db.in ns2/bl.tld2.db
+  $RNDCCMD 10.53.0.2 reload bl.tld2
+  goodsoa="rpz.tld2. hostmaster.ns.tld2. 2 3600 1200 604800 60"
+  for i in 0 1 2 3 4 5 6 7 8 9 10
+  do
 	soa=`$DIG -p ${PORT} +short soa bl.tld2 @10.53.0.3 -b10.53.0.3`
 	test "$soa" = "$goodsoa" && break
 	sleep 1
-done
-nochange a7-1.tld2			# 19 PASSTHRU
-sleep 1	# ensure that a clock tick has occured so that the reload takes effect
-cp ns2/blv3.tld2.db.in ns2/bl.tld2.db
-goodsoa="rpz.tld2. hostmaster.ns.tld2. 3 3600 1200 604800 60"
-$RNDCCMD 10.53.0.2 reload bl.tld2
-for i in 0 1 2 3 4 5 6 7 8 9 10
-do
+  done
+  nochange a7-1.tld2				# 19 PASSTHRU
+  # ensure that a clock tick has occured so that the reload takes effect
+  sleep 1
+  cp ns2/blv3.tld2.db.in ns2/bl.tld2.db
+  goodsoa="rpz.tld2. hostmaster.ns.tld2. 3 3600 1200 604800 60"
+  $RNDCCMD 10.53.0.2 reload bl.tld2
+  for i in 0 1 2 3 4 5 6 7 8 9 10
+  do
 	soa=`$DIG -p ${PORT} +short soa bl.tld2 @10.53.0.3 -b10.53.0.3`
 	test "$soa" = "$goodsoa" && break
 	sleep 1
-done
-nxdomain a7-1.tld2			# 20 slave policy zone (RT34450)
-end_group
-ckstats $ns3 test2 ns3 12
+  done
+  nxdomain a7-1.tld2				# 20 slave policy zone (RT34450)
+  end_group
+  ckstats $ns3 test2 ns3 12
 
-# check that IP addresses for previous group were deleted from the radix tree
-start_group "radix tree deletions"
-nochange a3-1.tld2
-nochange a3-2.tld2
-nochange a4-1.tld2
-nochange a4-2.tld2
-nochange a4-2.tld2 -taaaa
-nochange a4-2.tld2 -ttxt
-nochange a4-2.tld2 -tany
-nochange a4-3.tld2
-nochange a3-1.tld2 -tAAAA
-nochange a4-1-aaaa.tld2 -tAAAA
-nochange a5-1-2.tld2
-end_group
-ckstats $ns3 'radix tree deletions' ns3 0
+  # check that IP addresses for previous group were deleted from the radix tree
+  start_group "radix tree deletions"
+  nochange a3-1.tld2
+  nochange a3-2.tld2
+  nochange a4-1.tld2
+  nochange a4-2.tld2
+  nochange a4-2.tld2 -taaaa
+  nochange a4-2.tld2 -ttxt
+  nochange a4-2.tld2 -tany
+  nochange a4-3.tld2
+  nochange a3-1.tld2 -tAAAA
+  nochange a4-1-aaaa.tld2 -tAAAA
+  nochange a5-1-2.tld2
+  end_group
+  ckstats $ns3 'radix tree deletions' ns3 0
 
-if $FEATURETEST --rpz-nsdname; then
+  if $FEATURETEST --rpz-nsdname; then
     # these tests assume "min-ns-dots 0"
     start_group "NSDNAME rewrites" test3
-    nochange a3-1.tld2			# 1
-    nochange a3-1.tld2	    +dnssec	# 2 this once caused problems
-    nxdomain a3-1.sub1.tld2		# 3 NXDOMAIN *.sub1.tld2 by NSDNAME
-    nxdomain a3-1.subsub.sub1.tld2
-    nxdomain a3-1.subsub.sub1.tld2 -tany
-    addr 12.12.12.12 a4-2.subsub.sub2.tld2 # 6 walled garden for *.sub2.tld2
-    nochange a3-2.tld2.			# 7 exempt rewrite by name
-    nochange a0-1.tld2.			# 8 exempt rewrite by address block
-    addr 12.12.12.12 a4-1.tld2		# 9 prefer QNAME policy to NSDNAME
-    addr 127.0.0.1 a3-1.sub3.tld2	# 10 prefer policy for largest NSDNAME
-    addr 127.0.0.2 a3-1.subsub.sub3.tld2
-    nxdomain xxx.crash1.tld2		# 12 dns_db_detachnode() crash
+    nochange a3-1.tld2				# 1
+    nochange a3-1.tld2 +dnssec			# 2 this once caused problems
+    nxdomain a3-1.sub1.tld2			# 3 NXDOMAIN *.sub1.tld2 by NSDNAME
+    nxdomain a3-1.subsub.sub1.tld2		# 4
+    nxdomain a3-1.subsub.sub1.tld2 -tany	# 5
+    addr 12.12.12.12 a4-2.subsub.sub2.tld2	# 6 walled garden for *.sub2.tld2
+    nochange a3-2.tld2.				# 7 exempt rewrite by name
+    nochange a0-1.tld2.				# 8 exempt rewrite by address block
+    addr 12.12.12.12 a4-1.tld2			# 9 prefer QNAME policy to NSDNAME
+    addr 127.0.0.1 a3-1.sub3.tld2		# 10 prefer policy for largest NSDNAME
+    addr 127.0.0.2 a3-1.subsub.sub3.tld2	# 11
+    nxdomain xxx.crash1.tld2			# 12 dns_db_detachnode() crash
     end_group
     ckstats $ns3 test3 ns3 7
-else
+  else
     echo_i "NSDNAME not checked; named configured with --disable-rpz-nsdname"
-fi
+  fi
 
-if $FEATURETEST --rpz-nsip; then
+  if $FEATURETEST --rpz-nsip; then
     # these tests assume "min-ns-dots 0"
     start_group "NSIP rewrites" test4
-    nxdomain a3-1.tld2			# 1 NXDOMAIN for all of tld2
-    nochange a3-2.tld2.			# 2 exempt rewrite by name
-    nochange a0-1.tld2.			# 3 exempt rewrite by address block
-    nochange a3-1.tld4			# 4 different NS IP address
+    nxdomain a3-1.tld2				# 1 NXDOMAIN for all of tld2
+    nochange a3-2.tld2.				# 2 exempt rewrite by name
+    nochange a0-1.tld2.				# 3 exempt rewrite by address block
+    nochange a3-1.tld4				# 4 different NS IP address
     end_group
 
     start_group "walled garden NSIP rewrites" test4a
-    addr 41.41.41.41 a3-1.tld2		# 1 walled garden for all of tld2
-    addr 2041::41   'a3-1.tld2 AAAA'	# 2 walled garden for all of tld2
-    here a3-1.tld2 TXT <<'EOF'		# 3 text message for all of tld2
+    addr 41.41.41.41 a3-1.tld2			# 1 walled garden for all of tld2
+    addr 2041::41   'a3-1.tld2 AAAA'		# 2 walled garden for all of tld2
+    here a3-1.tld2 TXT <<'EOF'			# 3 text message for all of tld2
     ;; status: NOERROR, x
     a3-1.tld2.	    x	IN	TXT   "NSIP walled garden"
 EOF
     end_group
     ckstats $ns3 test4 ns3 4
-else
+  else
     echo_i "NSIP not checked; named configured with --disable-rpz-nsip"
-fi
+  fi
 
-# policies in ./test5 overridden by response-policy{} in ns3/named.conf
-#   and in ns5/named.conf
-start_group "policy overrides" test5
-addr 127.0.0.1 a3-1.tld2		# 1 bl-given
-nochange a3-2.tld2			# 2 bl-passthru
-nochange a3-3.tld2			# 3 bl-no-op	obsolete for passthru
-nochange a3-4.tld2			# 4 bl-disabled
-nodata a3-5.tld2			# 5 bl-nodata	zone recursive-only no
-nodata a3-5.tld2    +norecurse		# 6 bl-nodata	zone recursive-only no
-nodata a3-5.tld2			# 7 bl-nodata		not needed
-nxdomain a3-5.tld2  +norecurse	@$ns5	# 8 bl-nodata	global recursive-only no
-nxdomain a3-5.tld2s		@$ns5	# 9 bl-nodata	global break-dnssec
-nxdomain a3-5.tld2s +dnssec	@$ns5	# 10 bl-nodata	global break-dnssec
-nxdomain a3-6.tld2			# 11 bl-nxdomain
-here a3-7.tld2 -tany <<'EOF'
+  # policies in ./test5 overridden by response-policy{} in ns3/named.conf
+  # and in ns5/named.conf
+  start_group "policy overrides" test5
+  addr 127.0.0.1 a3-1.tld2			# 1 bl-given
+  nochange a3-2.tld2				# 2 bl-passthru
+  nochange a3-3.tld2				# 3 bl-no-op obsolete for passthru
+  nochange a3-4.tld2				# 4 bl-disabled
+  nodata a3-5.tld2				# 5 bl-nodata zone recursive-only no
+  nodata a3-5.tld2 +norecurse			# 6 bl-nodata zone recursive-only no
+  nodata a3-5.tld2				# 7 bl-nodata not needed
+  nxdomain a3-5.tld2 +norecurse @$ns5		# 8 bl-nodata global recursive-only no
+  nxdomain a3-5.tld2s @$ns5			# 9 bl-nodata global break-dnssec
+  nxdomain a3-5.tld2s +dnssec @$ns5		# 10 bl-nodata	global break-dnssec
+  nxdomain a3-6.tld2				# 11 bl-nxdomain
+  here a3-7.tld2 -tany <<'EOF'			# 12
     ;; status: NOERROR, x
     a3-7.tld2.	    x	IN	CNAME   txt-only.tld2.
     txt-only.tld2.  x	IN	TXT     "txt-only-tld2"
 EOF
-addr 58.58.58.58 a3-8.tld2		# 13 bl_wildcname
-addr 59.59.59.59 a3-9.sub9.tld2		# 14 bl_wildcname
-addr 12.12.12.12 a3-15.tld2		# 15 bl-garden	via CNAME to a12.tld2
-addr 127.0.0.16 a3-16.tld2	    100	# 16 bl		    max-policy-ttl 100
-addr 17.17.17.17 "a3-17.tld2 @$ns5" 90	# 17 ns5 bl	    max-policy-ttl 90
-drop a3-18.tld2 any			# 18 bl-drop
-nxdomain TCP a3-19.tld2			# 19 bl-tcp-only
-end_group
-ckstats $ns3 test5 ns3 12
-ckstats $ns5 test5 ns5 4
+  addr 58.58.58.58 a3-8.tld2			# 13 bl_wildcname
+  addr 59.59.59.59 a3-9.sub9.tld2		# 14 bl_wildcname
+  addr 12.12.12.12 a3-15.tld2			# 15 bl-garden via CNAME to a12.tld2
+  addr 127.0.0.16 a3-16.tld2 100		# 16 bl max-policy-ttl 100
+  addr 17.17.17.17 "a3-17.tld2 @$ns5" 90	# 17 ns5 bl max-policy-ttl 90
+  drop a3-18.tld2 any				# 18 bl-drop
+  nxdomain TCP a3-19.tld2			# 19 bl-tcp-only
+  end_group
+  ckstats $ns3 test5 ns3 12
+  ckstats $ns5 test5 ns5 4
 
-
-# check that miscellaneous bugs are still absent
-start_group "crashes" test6
-for Q in RRSIG SIG ANY 'ANY +dnssec'; do
+  # check that miscellaneous bugs are still absent
+  start_group "crashes" test6
+  for Q in RRSIG SIG ANY 'ANY +dnssec'; do
     nocrash a3-1.tld2 -t$Q
     nocrash a3-2.tld2 -t$Q
     nocrash a3-5.tld2 -t$Q
     nocrash www.redirect -t$Q
     nocrash www.credirect -t$Q
-done
+  done
 
-# This is not a bug, because any data leaked by writing 24.4.3.2.10.rpz-ip
-# (or whatever) is available by publishing "foo A 10.2.3.4" and then
-# resolving foo.
-# nxdomain 32.3.2.1.127.rpz-ip
-end_group
-ckstats $ns3 bugs ns3 8
+  # This is not a bug, because any data leaked by writing 24.4.3.2.10.rpz-ip
+  # (or whatever) is available by publishing "foo A 10.2.3.4" and then
+  # resolving foo.
+  # nxdomain 32.3.2.1.127.rpz-ip
+  end_group
+  ckstats $ns3 bugs ns3 8
 
-
-
-# superficial test for major performance bugs
-QPERF=`sh qperf.sh`
-if test -n "$QPERF"; then
+  # superficial test for major performance bugs
+  QPERF=`sh qperf.sh`
+  if test -n "$QPERF"; then
     perf () {
 	date "+${TS}checking performance $1" | cat_i
 	# Dry run to prime everything
@@ -583,64 +710,78 @@ if test -n "$QPERF"; then
     fi
 
     ckstats $ns5 performance ns5 200
-else
+  else
     echo_i "performance not checked; queryperf not available"
-fi
+  fi
 
-
-# restart the main test RPZ server to see if that creates a core file
-if test -z "$HAVE_CORE"; then
+  # restart the main test RPZ server to see if that creates a core file
+  if test -z "$HAVE_CORE"; then
     $PERL $SYSTEMTESTTOP/stop.pl --use-rndc --port ${CONTROLPORT} rpz ns3
-    restart 3
+    restart 3 "rebuild-bl-rpz"
     HAVE_CORE=`find ns* -name '*core*' -print`
     test -z "$HAVE_CORE" || setret "found $HAVE_CORE; memory leak?"
-fi
+  fi
 
-# look for complaints from lib/dns/rpz.c and bin/name/query.c
-EMSGS=`egrep -l 'invalid rpz|rpz.*failed' ns*/named.run`
-if test -n "$EMSGS"; then
+  # look for complaints from lib/dns/rpz.c and bin/name/query.c
+  EMSGS=`egrep -l 'invalid rpz|rpz.*failed' ns*/named.run`
+  if test -n "$EMSGS"; then
     setret "error messages in $EMSGS starting with:"
     egrep 'invalid rpz|rpz.*failed' ns*/named.run | sed -e '10,$d' | cat_i
-fi
+  fi
 
-echo_i "checking that ttl values are not zeroed when qtype is '*'"
-$DIG +noall +answer -p ${PORT} @$ns3 any a3-2.tld2 > dig.out.any
-ttl=`awk '/a3-2 tld2 text/ {print $2}' dig.out.any`
-if test ${ttl:=0} -eq 0; then setret "failed"; fi
+  # restart the main test RPZ server with a bad zone.
+  t=`expr $t + 1`
+  echo_i "checking that ns3 with broken rpz does not crash (${t})"
+  $PERL $SYSTEMTESTTOP/stop.pl --use-rndc --port ${CONTROLPORT} rpz ns3
+  cp ns3/broken.db.in ns3/bl.db
+  restart 3 # do not rebuild rpz zones
+  nocrash a3-1.tld2 -tA
+  $PERL $SYSTEMTESTTOP/stop.pl --use-rndc --port ${CONTROLPORT} rpz ns3
+  restart 3 "rebuild-bl-rpz"
 
-echo_i "checking rpz updates/transfers with parent nodes added after children"
-# regression test for RT #36272: the success condition
-# is the slave server not crashing.
-nsd() {
-    $NSUPDATE -p ${PORT} << EOF
-server $1
-ttl 300
-update $2 $3 IN CNAME .
-update $2 $4 IN CNAME .
-send
-EOF
-    sleep 2
-}
+  # reload a RPZ zone that is now deliberately broken.
+  t=`expr $t + 1`
+  echo_i "checking rpz failed update will keep previous rpz rules (${t})"
+  $DIG -p ${PORT} @$ns3 walled.tld2 > dig.out.$t.before
+  grep "walled\.tld2\..*IN.*A.*10\.0\.0\.1" dig.out.$t.before > /dev/null || setret "failed"
+  cp ns3/broken.db.in ns3/manual-update-rpz.db
+  rndc_reload ns3 $ns3 manual-update-rpz
+  sleep 1
+  # ensure previous RPZ rules still apply.
+  $DIG -p ${PORT} @$ns3 walled.tld2 > dig.out.$t.after
+  grep "walled\.tld2\..*IN.*A.*10\.0\.0\.1" dig.out.$t.after > /dev/null || setret "failed"
 
-for i in 1 2 3 4 5; do
+  t=`expr $t + 1`
+  echo_i "checking that ttl values are not zeroed when qtype is '*' (${t})"
+  $DIG +noall +answer -p ${PORT} @$ns3 any a3-2.tld2 > dig.out.$t
+  ttl=`awk '/a3-2 tld2 text/ {print $2}' dig.out.$t`
+  if test ${ttl:=0} -eq 0; then setret "failed"; fi
+
+  t=`expr $t + 1`
+  echo_i "checking rpz updates/transfers with parent nodes added after children (${t})"
+  # regression test for RT #36272: the success condition
+  # is the slave server not crashing.
+  for i in 1 2 3 4 5; do
     nsd $ns5 add example.com.policy1. '*.example.com.policy1.'
     nsd $ns5 delete example.com.policy1. '*.example.com.policy1.'
-done
-for i in 1 2 3 4 5; do
+  done
+  for i in 1 2 3 4 5; do
     nsd $ns5 add '*.example.com.policy1.' example.com.policy1.
     nsd $ns5 delete '*.example.com.policy1.' example.com.policy1.
+  done
+
+  echo_i "checking that going from a empty policy zone works"
+  nsd $ns5 add '*.x.servfail.policy2.' x.servfail.policy2.
+  sleep 1
+  $RNDCCMD $ns7 reload policy2
+  $DIG z.x.servfail -p ${PORT} @$ns7 > dig.out.ns7
+  grep NXDOMAIN dig.out.ns7 > /dev/null || setret I:failed;
+
+  echo_i "checking rpz with delegation fails correctly"
+  $DIG -p ${PORT} @$ns3 ns example.com > dig.out.delegation
+  grep "status: SERVFAIL" dig.out.delegation > /dev/null || setret "I:failed"
 done
-
-echo_i "checking that going from a empty policy zone works"
-nsd $ns5 add '*.x.servfail.policy2.' x.servfail.policy2.
-sleep 1
-$RNDCCMD $ns7 reload policy2
-$DIG z.x.servfail -p ${PORT} @$ns7 > dig.out.ns7
-grep NXDOMAIN dig.out.ns7 > /dev/null || setret I:failed;
-
-echo_i "checking rpz with delegation fails correctly"
-$DIG -p ${PORT} @$ns3 ns example.com > dig.out.delegation
-grep "status: SERVFAIL" dig.out.delegation > /dev/null || setret "I:failed"
+status=`expr ${native:-0} + ${dnsrps:-0}`
 
 echo_i "exit status: $status"
 [ $status -eq 0 ] || exit 1

bin/tests/system/rpzrecurse/tests.sh

@@ -181,7 +181,7 @@ $RNDC -c ../common/rndc.conf -s 10.53.0.2 -p ${CONTROLPORT} reload 6a.00.policy.
 sleep 1
 t=`expr $t + 1`
 echo_i "running dig to follow CNAME (blocks, so runs in the background) (${t})"
-$DIG $DIGOPTS @10.53.0.2 -p ${PORT} www.test.example.org A > dig.out.${t} &
+$DIG $DIGOPTS @10.53.0.2 -p ${PORT} www.test.example.org A +time=5 > dig.out.${t} &
 sleep 1
 echo_i "removing the NSDNAME policy"
 cp ns2/db.6c.00.policy.local ns2/db.6a.00.policy.local
@@ -225,7 +225,7 @@ $RNDC -c ../common/rndc.conf -s 10.53.0.2 -p ${CONTROLPORT} reload 6a.00.policy.
 sleep 1
 t=`expr $t + 1`
 echo_i "running dig to follow CNAME (blocks, so runs in the background) (${t})"
-$DIG $DIGOPTS @10.53.0.2 -p ${PORT} www.test.example.org A > dig.out.${t} &
+$DIG $DIGOPTS @10.53.0.2 -p ${PORT} www.test.example.org A +time=5 > dig.out.${t} &
 sleep 1
 echo_i "removing the policy zone"
 cp ns2/named.default.conf ns2/named.conf

bin/tests/system/rrchecker/setup.sh

@@ -0,0 +1,15 @@
+#!/bin/sh
+#
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+# shellcheck source=conf.sh
+. "$SYSTEMTESTTOP/conf.sh"
+
+$SHELL clean.sh

bin/tests/system/start.pl

@@ -213,6 +213,7 @@ sub start_server {
 			print "I:$test:Couldn't start server $command (pid=$child)\n";
 			print "I:$test:failed\n";
 			system "kill -9 $child" if ("$child" ne "");
+			chdir "$testdir";
 			system "$PERL $topdir/stop.pl $test";
 			exit 1;
 		}

bin/tests/system/staticstub/setup.sh

@@ -12,6 +12,8 @@
 SYSTEMTESTTOP=..
 . $SYSTEMTESTTOP/conf.sh
 
+$SHELL clean.sh
+
 copy_setports ns1/named.conf.in ns1/named.conf
 copy_setports ns2/named.conf.in tmp
 sed 's/SERVER_CONFIG_PLACEHOLDER/server-names { "ns.example.net"; };/' tmp > ns2/named.conf
@@ -19,8 +21,6 @@ sed 's/SERVER_CONFIG_PLACEHOLDER/server-names { "ns.example.net"; };/' tmp > ns2
 copy_setports ns3/named.conf.in tmp
 sed 's/EXAMPLE_ZONE_PLACEHOLDER/zone "example" { type master; file "example.db.signed"; };/' tmp > ns3/named.conf
 
-rm -f tmp
-
 copy_setports ns4/named.conf.in ns4/named.conf
 
 test -r $RANDFILE || $GENRANDOM $RANDOMSIZE $RANDFILE

bin/tests/system/statistics/tests.sh

@@ -145,8 +145,8 @@ n=`expr $n + 1`
 ret=0
 echo_i "checking that zones return their type ($n)"
 if $FEATURETEST --have-libxml2 && [ -x ${CURL} ] ; then
-    ${CURL} http://10.53.0.1:${EXTRAPORT1}/xml/v3/zones > curl.out.${t} 2>/dev/null || ret=1
-    grep '<zone name="32/1.0.0.127-in-addr.example" rdataclass="IN"><type>master</type>' curl.out.${t} > /dev/null || ret=1
+    ${CURL} http://10.53.0.1:${EXTRAPORT1}/xml/v3/zones > curl.out.${n} 2>/dev/null || ret=1
+    grep '<zone name="32/1.0.0.127-in-addr.example" rdataclass="IN"><type>master</type>' curl.out.${n} > /dev/null || ret=1
 else
     echo_i "skipping test as libxml2 and/or curl was not found"
 fi

bin/tests/system/statschannel/tests.sh

@@ -181,13 +181,15 @@ echo_i "checking consistency between regular and compressed output ($n)"
 if [ "$HAVEXMLSTATS" ];
 then
 	URL=http://10.53.0.2:${EXTRAPORT1}/xml/v3/server
+	filter_str='s#<current-time>.*</current-time>##g'
 else
 	URL=http://10.53.0.2:${EXTRAPORT1}/json/v1/server
+	filter_str='s#"current-time.*",##g'
 fi
 $CURL -D regular.headers $URL 2>/dev/null | \
-	sed -e "s#<current-time>.*</current-time>##g" > regular.out
+	sed -e "$filter_str" > regular.out
 $CURL -D compressed.headers --compressed $URL 2>/dev/null | \
-	sed -e "s#<current-time>.*</current-time>##g" > compressed.out
+	sed -e "$filter_str" > compressed.out
 $DIFF regular.out compressed.out >/dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`

bin/tests/system/stop.pl

@@ -137,9 +137,20 @@ exit($errors);
 
 # Subroutines
 
+# Return the full path to a given server's lock file.
+sub server_lock_file {
+	my ( $server ) = @_;
+
+	return $testdir . "/" . $server . "/named.lock" if ($server =~ /^ns/);
+	return if ($server =~ /^ans/);
+	return $testdir . "/" . $server . "/lwresd.lock" if ($server =~ /^lwresd/);
+
+	die "Unknown server type $server\n";
+}
+
 # Return the full path to a given server's PID file.
 sub server_pid_file {
-	my($server) = @_;
+	my ( $server ) = @_;
 
 	return $testdir . "/" . $server . "/named.pid" if ($server =~ /^ns/);
 	return $testdir . "/" . $server . "/ans.pid" if ($server =~ /^ans/);
@@ -239,7 +250,7 @@ sub stop_signal {
 	return;
 }
 
-sub clean_pid_file {
+sub pid_file_exists {
 	my ( $server ) = @_;
 
 	my $pid_file = server_pid_file($server);
@@ -251,7 +262,7 @@ sub clean_pid_file {
 	if (send_signal(0, $pid) == 0) {
 		# XXX: on windows this is likely to result in a
 		# false positive, so don't bother reporting the error.
-		if ($ENV{'CYGWIN'} eq "") {
+		if (!defined($ENV{'CYGWIN'})) {
 			print "I:$test:$server crashed on shutdown\n";
 			$errors = 1;
 		}
@@ -261,6 +272,15 @@ sub clean_pid_file {
 	return $server;
 }
 
+sub lock_file_exists {
+	my ( $server ) = @_;
+	my $lock_file = server_lock_file($server);
+
+	return unless defined($lock_file) && -f $lock_file;
+
+	return $server;
+}
+
 sub wait_for_servers {
 	my ( $timeout, @servers ) = @_;
 
@@ -268,7 +288,7 @@ sub wait_for_servers {
 		sleep 1 if (@servers > 0);
 		@servers =
 			grep { defined($_) }
-			map  { clean_pid_file($_) } @servers;
+			map  { pid_file_exists($_) || lock_file_exists($_) } @servers;
 		$timeout--;
 	}
 

bin/tests/system/stress/setup.sh

@@ -9,6 +9,11 @@
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.
 
+# shellcheck source=conf.sh
+. "$SYSTEMTESTTOP/conf.sh"
+
+$SHELL clean.sh
+
 #
 # Set up test data for zone transfer quota tests.
 #

bin/tests/system/upforwd/setup.sh

@@ -32,5 +32,4 @@ then
 	echo $keyname > keyname
 else
 	cat ns1/example1.db > ns1/example2.db
-	rm -f keyname
 fi

bin/tests/system/views/setup.sh

@@ -17,12 +17,6 @@ $SHELL clean.sh
 test -r $RANDFILE || $GENRANDOM $RANDOMSIZE $RANDFILE
 
 cp -f ns2/example1.db ns2/example.db
-rm -f ns2/external/K*
-rm -f ns2/external/inline.db.signed
-rm -f ns2/external/inline.db.signed.jnl
-rm -f ns2/internal/K*
-rm -f ns2/internal/inline.db.signed
-rm -f ns2/internal/inline.db.signed.jnl
 
 copy_setports ns1/named.conf.in ns1/named.conf
 copy_setports ns2/named1.conf.in ns2/named.conf

bin/tests/system/xfer/clean.sh

@@ -20,7 +20,7 @@ rm -f ns1/edns-expire.db
 rm -f ns2/example.db ns2/tsigzone.db ns2/example.db.jnl
 rm -f ns3/example.bk ns3/tsigzone.bk ns3/example.bk.jnl
 rm -f ns3/master.bk ns3/master.bk.jnl
-rm -f ns4/nil.db ns4/root.db
+rm -f ns4/*.db ns4/*.jnl
 rm -f ns6/*.db ns6/*.bk ns6/*.jnl
 rm -f ns7/*.db ns7/*.bk ns7/*.jnl
 rm -f ns8/large.db ns8/small.db

bin/tests/system/xfer/dig1.good

@@ -121,7 +121,7 @@ openpgpkey.example.	3600	IN	OPENPGPKEY  AQMFD5raczCJHViKtLYhWGz8hMY9UGRuniJDBzC7
 ptr01.example.		3600	IN	PTR	example.
 px01.example.		3600	IN	PX	65535 foo. bar.
 px02.example.		3600	IN	PX	65535 . .
-rkey01.example.		3600	IN	RKEY	512 255 1 AQMFD5raczCJHViKtLYhWGz8hMY9UGRuniJDBzC7w0aRyzWZriO6i2od GWWQVucZqKVsENW91IOW4vqudngPZsY3GvQ/xVA8/7pyFj6b7Esga60z yGW6LFe9r8n6paHrlG5ojqf0BaqHT+8=
+rkey01.example.		3600	IN	RKEY	0 255 1 AQMFD5raczCJHViKtLYhWGz8hMY9UGRuniJDBzC7w0aRyzWZriO6i2od GWWQVucZqKVsENW91IOW4vqudngPZsY3GvQ/xVA8/7pyFj6b7Esga60z yGW6LFe9r8n6paHrlG5ojqf0BaqHT+8=
 rp01.example.		3600	IN	RP	mbox-dname.example. txt-dname.example.
 rp02.example.		3600	IN	RP	. .
 rt01.example.		3600	IN	RT	0 intermediate-host.example.

bin/tests/system/xfer/dig2.good

@@ -121,7 +121,7 @@ openpgpkey.example.	3600	IN	OPENPGPKEY  AQMFD5raczCJHViKtLYhWGz8hMY9UGRuniJDBzC7
 ptr01.example.		3600	IN	PTR	example.
 px01.example.		3600	IN	PX	65535 foo. bar.
 px02.example.		3600	IN	PX	65535 . .
-rkey01.example.		3600	IN	RKEY	512 255 1 AQMFD5raczCJHViKtLYhWGz8hMY9UGRuniJDBzC7w0aRyzWZriO6i2od GWWQVucZqKVsENW91IOW4vqudngPZsY3GvQ/xVA8/7pyFj6b7Esga60z yGW6LFe9r8n6paHrlG5ojqf0BaqHT+8=
+rkey01.example.		3600	IN	RKEY	0 255 1 AQMFD5raczCJHViKtLYhWGz8hMY9UGRuniJDBzC7w0aRyzWZriO6i2od GWWQVucZqKVsENW91IOW4vqudngPZsY3GvQ/xVA8/7pyFj6b7Esga60z yGW6LFe9r8n6paHrlG5ojqf0BaqHT+8=
 rp01.example.		3600	IN	RP	mbox-dname.example. txt-dname.example.
 rp02.example.		3600	IN	RP	. .
 rt01.example.		3600	IN	RT	0 intermediate-host.example.

bin/tests/system/xfer/setup.sh

@@ -21,7 +21,6 @@ $SHELL ../genzone.sh 2 3 >ns2/tsigzone.db
 $SHELL ../genzone.sh 6 3 >ns6/master.db
 $SHELL ../genzone.sh 7 >ns7/master2.db
 
-rm -f ns4/*.db ns4/*.jnl
 cp -f ns4/root.db.in ns4/root.db
 $PERL -e 'for ($i=0;$i<10000;$i++){ printf("x%u 0 in a 10.53.0.1\n", $i);}' >> ns4/root.db
 

bin/tools/dnstap-read.c

@@ -47,6 +47,9 @@
 #include <dns/name.h>
 #include <dns/result.h>
 
+#include <protobuf-c/protobuf-c.h>
+#include "lib/dns/dnstap.pb-c.h"
+
 isc_mem_t *mctx = NULL;
 bool memrecord = false;
 bool printmessage = false;

bind.keys

@@ -12,34 +12,20 @@
 #
 # This file is NOT expected to be user-configured.
 #
-# These keys are current as of October 2017.  If any key fails to
-# initialize correctly, it may have expired.  In that event you should
-# replace this file with a current version.  The latest version of
-# bind.keys can always be obtained from ISC at https://www.isc.org/bind-keys.
+# Servers being set up for the first time can use the contents of this file
+# as initializing keys; thereafter, the keys in the managed key database
+# will be trusted and maintained automatically.
 #
-# See https://data.iana.org/root-anchors/root-anchors.xml
-# for current trust anchor information for the root zone.
+# These keys are current as of Mar 2019.  If any key fails to initialize
+# correctly, it may have expired.  In that event you should replace this
+# file with a current version.  The latest version of bind.keys can always
+# be obtained from ISC at https://www.isc.org/bind-keys.
+#
+# See https://data.iana.org/root-anchors/root-anchors.xml for current trust
+# anchor information for the root zone.
 
 managed-keys {
-        # This key (19036) is to be phased out starting in 2017. It will
-        # remain in the root zone for some time after its successor key
-        # has been added. It will remain this file until it is removed from
-        # the root zone.
-        . initial-key 257 3 8 "AwEAAagAIKlVZrpC6Ia7gEzahOR+9W29euxhJhVVLOyQbSEW0O8gcCjF
-                FVQUTf6v58fLjwBd0YI0EzrAcQqBGCzh/RStIoO8g0NfnfL2MTJRkxoX
-                bfDaUeVPQuYEhg37NZWAJQ9VnMVDxP/VHL496M/QZxkjf5/Efucp2gaD
-                X6RS6CXpoY68LsvPVjR0ZSwzz1apAzvN9dlzEheX7ICJBBtuA6G3LQpz
-                W5hOA2hzCTMjJPJ8LbqF6dsV6DoBQzgul0sGIcGOYl7OyQdXfZ57relS
-                Qageu+ipAdTTJ25AsRTAoub8ONGcLmqrAmRLKBP1dfwhYB4N7knNnulq
-                QxA+Uk1ihz0=";
-
         # This key (20326) was published in the root zone in 2017.
-        # Servers which were already using the old key (19036) should
-        # roll seamlessly to this new one via RFC 5011 rollover. Servers
-        # being set up for the first time can use the contents of this
-        # file as initializing keys; thereafter, the keys in the
-        # managed key database will be trusted and maintained
-        # automatically.
         . initial-key 257 3 8 "AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3
                 +/4RgWOq7HrxRixHlFlExOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kv
                 ArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgCmr3EgVLrjyBxWezF

bind.keys.h

@@ -15,34 +15,20 @@
 #\n\
 # This file is NOT expected to be user-configured.\n\
 #\n\
-# These keys are current as of October 2017.  If any key fails to\n\
-# initialize correctly, it may have expired.  In that event you should\n\
-# replace this file with a current version.  The latest version of\n\
-# bind.keys can always be obtained from ISC at https://www.isc.org/bind-keys.\n\
+# Servers being set up for the first time can use the contents of this file\n\
+# as initializing keys; thereafter, the keys in the managed key database\n\
+# will be trusted and maintained automatically.\n\
 #\n\
-# See https://data.iana.org/root-anchors/root-anchors.xml\n\
-# for current trust anchor information for the root zone.\n\
+# These keys are current as of Mar 2019.  If any key fails to initialize\n\
+# correctly, it may have expired.  In that event you should replace this\n\
+# file with a current version.  The latest version of bind.keys can always\n\
+# be obtained from ISC at https://www.isc.org/bind-keys.\n\
+#\n\
+# See https://data.iana.org/root-anchors/root-anchors.xml for current trust\n\
+# anchor information for the root zone.\n\
 \n\
 trusted-keys {\n\
-        # This key (19036) is to be phased out starting in 2017. It will\n\
-        # remain in the root zone for some time after its successor key\n\
-        # has been added. It will remain this file until it is removed from\n\
-        # the root zone.\n\
-        . 257 3 8 \"AwEAAagAIKlVZrpC6Ia7gEzahOR+9W29euxhJhVVLOyQbSEW0O8gcCjF\n\
-                FVQUTf6v58fLjwBd0YI0EzrAcQqBGCzh/RStIoO8g0NfnfL2MTJRkxoX\n\
-                bfDaUeVPQuYEhg37NZWAJQ9VnMVDxP/VHL496M/QZxkjf5/Efucp2gaD\n\
-                X6RS6CXpoY68LsvPVjR0ZSwzz1apAzvN9dlzEheX7ICJBBtuA6G3LQpz\n\
-                W5hOA2hzCTMjJPJ8LbqF6dsV6DoBQzgul0sGIcGOYl7OyQdXfZ57relS\n\
-                Qageu+ipAdTTJ25AsRTAoub8ONGcLmqrAmRLKBP1dfwhYB4N7knNnulq\n\
-                QxA+Uk1ihz0=\";\n\
-\n\
         # This key (20326) was published in the root zone in 2017.\n\
-        # Servers which were already using the old key (19036) should\n\
-        # roll seamlessly to this new one via RFC 5011 rollover. Servers\n\
-        # being set up for the first time can use the contents of this\n\
-        # file as initializing keys; thereafter, the keys in the\n\
-        # managed key database will be trusted and maintained\n\
-        # automatically.\n\
         . 257 3 8 \"AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3\n\
                 +/4RgWOq7HrxRixHlFlExOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kv\n\
                 ArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgCmr3EgVLrjyBxWezF\n\
@@ -68,34 +54,20 @@ trusted-keys {\n\
 #\n\
 # This file is NOT expected to be user-configured.\n\
 #\n\
-# These keys are current as of October 2017.  If any key fails to\n\
-# initialize correctly, it may have expired.  In that event you should\n\
-# replace this file with a current version.  The latest version of\n\
-# bind.keys can always be obtained from ISC at https://www.isc.org/bind-keys.\n\
+# Servers being set up for the first time can use the contents of this file\n\
+# as initializing keys; thereafter, the keys in the managed key database\n\
+# will be trusted and maintained automatically.\n\
 #\n\
-# See https://data.iana.org/root-anchors/root-anchors.xml\n\
-# for current trust anchor information for the root zone.\n\
+# These keys are current as of Mar 2019.  If any key fails to initialize\n\
+# correctly, it may have expired.  In that event you should replace this\n\
+# file with a current version.  The latest version of bind.keys can always\n\
+# be obtained from ISC at https://www.isc.org/bind-keys.\n\
+#\n\
+# See https://data.iana.org/root-anchors/root-anchors.xml for current trust\n\
+# anchor information for the root zone.\n\
 \n\
 managed-keys {\n\
-        # This key (19036) is to be phased out starting in 2017. It will\n\
-        # remain in the root zone for some time after its successor key\n\
-        # has been added. It will remain this file until it is removed from\n\
-        # the root zone.\n\
-        . initial-key 257 3 8 \"AwEAAagAIKlVZrpC6Ia7gEzahOR+9W29euxhJhVVLOyQbSEW0O8gcCjF\n\
-                FVQUTf6v58fLjwBd0YI0EzrAcQqBGCzh/RStIoO8g0NfnfL2MTJRkxoX\n\
-                bfDaUeVPQuYEhg37NZWAJQ9VnMVDxP/VHL496M/QZxkjf5/Efucp2gaD\n\
-                X6RS6CXpoY68LsvPVjR0ZSwzz1apAzvN9dlzEheX7ICJBBtuA6G3LQpz\n\
-                W5hOA2hzCTMjJPJ8LbqF6dsV6DoBQzgul0sGIcGOYl7OyQdXfZ57relS\n\
-                Qageu+ipAdTTJ25AsRTAoub8ONGcLmqrAmRLKBP1dfwhYB4N7knNnulq\n\
-                QxA+Uk1ihz0=\";\n\
-\n\
         # This key (20326) was published in the root zone in 2017.\n\
-        # Servers which were already using the old key (19036) should\n\
-        # roll seamlessly to this new one via RFC 5011 rollover. Servers\n\
-        # being set up for the first time can use the contents of this\n\
-        # file as initializing keys; thereafter, the keys in the\n\
-        # managed key database will be trusted and maintained\n\
-        # automatically.\n\
         . initial-key 257 3 8 \"AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3\n\
                 +/4RgWOq7HrxRixHlFlExOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kv\n\
                 ArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgCmr3EgVLrjyBxWezF\n\

configure

@@ -705,7 +705,6 @@ W3M
 DBLATEX
 PDFLATEX
 LATEX
-DNSTAP_PB_C_H
 DNSTAPTARGETS
 DNSTAPOBJS
 DNSTAPSRCS
@@ -21771,7 +21770,6 @@ DNSTAP=
 DNSTAPSRCS=
 DNSTAPOBJS=
 DNSTAPTARGETS=
-DNSTAP_PB_C_H=
 if test "x$use_dnstap" != "xno"; then
 	if ! $use_threads; then
 		as_fn_error $? "Dnstap requires threads." "$LINENO" 5
@@ -22107,14 +22105,12 @@ $as_echo "#define HAVE_DNSTAP 1" >>confdefs.h
 	DNSTAPSRCS='${DNSTAPSRCS}'
 	DNSTAPOBJS='${DNSTAPOBJS}'
 	DNSTAPTARGETS='${DNSTAPTARGETS}'
-	DNSTAP_PB_C_H="dnstap.pb-c.h"
 fi
 
 
 
 
 
-
 #
 #  The following sets up how non-blocking i/o is established.
 #  Sunos, cygwin and solaris 2.x (x<5) require special handling.
@@ -23672,25 +23668,45 @@ SO_STRIP="cat"
 
 # Check whether --with-dlopen was given.
 if test "${with_dlopen+set}" = set; then :
-  withval=$with_dlopen; dlopen="$withval"
+  withval=$with_dlopen;
 else
-  dlopen="yes"
+  with_dlopen="auto"
 fi
 
 
-case $host in
-	*-sunos*) dlopen="no"
-		;;
+#
+# Disable for SunOS
+#
+case $host in #(
+  *-sunos*) :
+    with_dlopen="no" ;; #(
+  *) :
+     ;;
 esac
 
-if test "yes" = "$dlopen"; then
-	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for dlopen in -ldl" >&5
-$as_echo_n "checking for dlopen in -ldl... " >&6; }
-if ${ac_cv_lib_dl_dlopen+:} false; then :
+#
+# If PIC is disabled, dlopen must also be
+#
+if test "$pic_mode" = "no"; then :
+  case $with_dlopen in #(
+  auto) :
+    with_dlopen="no" ;; #(
+  yes) :
+    as_fn_error $? "--with-dlopen requires PIC" "$LINENO" 5 ;; #(
+  *) :
+     ;;
+esac
+fi
+
+case $with_dlopen in #(
+  auto|yes) :
+
+	  { $as_echo "$as_me:${as_lineno-$LINENO}: checking for library containing dlopen" >&5
+$as_echo_n "checking for library containing dlopen... " >&6; }
+if ${ac_cv_search_dlopen+:} false; then :
   $as_echo_n "(cached) " >&6
 else
-  ac_check_lib_save_LIBS=$LIBS
-LIBS="-ldl  $LIBS"
+  ac_func_search_save_LIBS=$LIBS
 cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 /* end confdefs.h.  */
 
@@ -23709,27 +23725,39 @@ return dlopen ();
   return 0;
 }
 _ACEOF
-if ac_fn_c_try_link "$LINENO"; then :
-  ac_cv_lib_dl_dlopen=yes
-else
-  ac_cv_lib_dl_dlopen=no
+for ac_lib in '' dl; do
+  if test -z "$ac_lib"; then
+    ac_res="none required"
+  else
+    ac_res=-l$ac_lib
+    LIBS="-l$ac_lib  $ac_func_search_save_LIBS"
+  fi
+  if ac_fn_c_try_link "$LINENO"; then :
+  ac_cv_search_dlopen=$ac_res
 fi
 rm -f core conftest.err conftest.$ac_objext \
-    conftest$ac_exeext conftest.$ac_ext
-LIBS=$ac_check_lib_save_LIBS
+    conftest$ac_exeext
+  if ${ac_cv_search_dlopen+:} false; then :
+  break
 fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_dl_dlopen" >&5
-$as_echo "$ac_cv_lib_dl_dlopen" >&6; }
-if test "x$ac_cv_lib_dl_dlopen" = xyes; then :
-  have_dl=yes
+done
+if ${ac_cv_search_dlopen+:} false; then :
+
 else
-  have_dl=no
+  ac_cv_search_dlopen=no
+fi
+rm conftest.$ac_ext
+LIBS=$ac_func_search_save_LIBS
+fi
+{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_search_dlopen" >&5
+$as_echo "$ac_cv_search_dlopen" >&6; }
+ac_res=$ac_cv_search_dlopen
+if test "$ac_res" != no; then :
+  test "$ac_res" = "none required" || LIBS="$ac_res $LIBS"
+
 fi
 
-	if test "yes" = "$have_dl"; then
-		LIBS="-ldl $LIBS"
-	fi
-	for ac_func in dlopen dlclose dlsym
+	  for ac_func in dlopen dlclose dlsym
 do :
   as_ac_var=`$as_echo "ac_cv_func_$ac_func" | $as_tr_sh`
 ac_fn_c_check_func "$LINENO" "$ac_func" "$as_ac_var"
@@ -23737,91 +23765,108 @@ if eval test \"x\$"$as_ac_var"\" = x"yes"; then :
   cat >>confdefs.h <<_ACEOF
 #define `$as_echo "HAVE_$ac_func" | $as_tr_cpp` 1
 _ACEOF
-
+ with_dlopen="yes"
 else
-  dlopen=no
+  with_dlopen="no"
 fi
 done
 
+	 ;; #(
+  *) :
+     ;;
+esac
+
+if test "$with_dlopen" = "yes"; then :
+  case $host in #(
+  *-linux*|*-gnu*) :
+
+		 LDFLAGS="${LDFLAGS} -Wl,--export-dynamic"
+		 SO_CFLAGS="-fPIC"
+		 SO_LDFLAGS=""
+		 if test "$use_libtool" = "yes"; then :
+
+			 SO_LDFLAGS="-Xcompiler -shared"
+			 SO_LD="${CC}"
+
+else
+
+			 SO_LDFLAGS="-shared"
+			 SO_LD="${CC}"
+
+fi
+	        ;; #(
+  *-freebsd*|*-openbsd*|*-netbsd*) :
+
+		 LDFLAGS="${LDFLAGS} -Wl,-E"
+		 SO_CFLAGS="-fpic"
+		 if test "$use_libtool" = "yes"; then :
+
+			 SO_LDFLAGS="-Xcompiler -shared"
+			 SO_LD="${CC}"
+
+else
+
+			 SO_LDFLAGS="-shared"
+			 SO_LD="${CC}"
+
+fi
+	        ;; #(
+  *-darwin*) :
+
+		 SO_CFLAGS="-fPIC"
+                 SO_LD="${CC}"
+		 if test "$use_libtool" = "yes"; then :
+
+			 SO_LDFLAGS="-Xcompiler -dynamiclib -undefined dynamic_lookup"
+
+else
+
+			 SO_LDFLAGS="-dynamiclib -undefined dynamic_lookup"
+
+fi
+	        ;; #(
+  *-solaris*) :
+
+		 SO_CFLAGS="-KPIC"
+		 SO_LDFLAGS="-G -z text"
+		 SO_LD="ld"
+	        ;; #(
+  *) :
+
+		 SO_CFLAGS="-fPIC"
+	        ;;
+esac
+       if test "$GCC" = "yes"; then :
+
+	       SO_CFLAGS="-fPIC"
+	       if test -z "$SO_LD"; then :
+  if test "$use_libtool" = "yes"; then :
+
+			      SO_LDFLAGS="-Xcompiler -shared"
+			      SO_LD="${CC}"
+
+else
+
+			      SO_LDFLAGS="-shared"
+			      SO_LD="${CC}"
+
 fi
 
-if test "yes" = "$dlopen"; then
-	case $host in
-		*-linux*|*-gnu*)
-			SO_CFLAGS="-fPIC"
-                        LDFLAGS="${LDFLAGS} -Wl,--export-dynamic"
-			SO_LDFLAGS=""
-			if test "yes" = "$have_dl"
-			then
-				if test "yes" = "$use_libtool"; then
-					SO_LDFLAGS="-Xcompiler -shared"
-					SO_LD="${CC}"
-				else
-					SO_LDFLAGS="-shared"
-					SO_LD="${CC}"
-				fi
-			else
-				SO_LDFLAGS="-shared"
-				SO_LD="ld"
-			fi
-			;;
-		*-freebsd*|*-openbsd*)
-			LDFLAGS="${LDFLAGS} -Wl,-E"
-			SO_CFLAGS="-fpic"
-			if test "yes" = "$use_libtool"; then
-				SO_LDFLAGS="-Xcompiler -shared"
-				SO_LD="${CC}"
-			else
-				SO_LDFLAGS="-shared"
-				SO_LD="${CC}"
-			fi
-			;;
-		*-netbsd*)
-			SO_CFLAGS="-fpic"
-			SO_LDFLAGS="-Bshareable -x"
-			SO_LD="ld"
-			SO_STRIP="sed -e s/-Wl,//g"
-			;;
-		*-solaris*)
-			SO_CFLAGS="-KPIC"
-			SO_LDFLAGS="-G -z text"
-			SO_LD="ld"
-			;;
-		*-hp-hpux*)
-			SO=sl
-			SO_CFLAGS="+z"
-			SO_LDFLAGS="-b +vnocompatwarnings"
-			SO_LD="ld"
-			;;
-		*)
-			SO_CFLAGS="-fPIC"
-			;;
-	esac
+fi
 
-	if test "X$GCC" = "Xyes"; then
-		SO_CFLAGS="-fPIC"
-		if test -z "$SO_LD"
-		then
-			if test "yes" = "$use_libtool"; then
-				SO_LDFLAGS="-Xcompiler -shared"
-				SO_LD="${CC}"
-			else
-				SO_LDFLAGS="-shared"
-				SO_LD="${CC}"
-			fi
-		fi
-	fi
-
-	# If we still don't know how to make shared objects, don't make any.
-	if test -n "$SO_LD"; then
-		SO_TARGETS="\${SO_TARGETS}"
+fi
+       # If we still don't know how to make shared objects, don't make any.
+       if test -n "$SO_LD"; then :
+  SO_TARGETS="\${SO_TARGETS}"
 
 $as_echo "#define ISC_DLZ_DLOPEN 1" >>confdefs.h
 
-	fi
-fi
-CFLAGS="$CFLAGS $SO_CFLAGS"
 
+fi
+
+fi
+
+CFLAGS="$CFLAGS $SO_CFLAGS"
 
 
 
@@ -24884,7 +24929,7 @@ ac_config_commands="$ac_config_commands chmod"
 # elsewhere if there's a good reason for doing so.
 #
 
-ac_config_files="$ac_config_files make/Makefile make/mkdep Makefile bin/Makefile bin/check/Makefile bin/confgen/Makefile bin/confgen/unix/Makefile bin/delv/Makefile bin/dig/Makefile bin/dnssec/Makefile bin/named/Makefile bin/named/unix/Makefile bin/nsupdate/Makefile bin/pkcs11/Makefile bin/python/Makefile bin/python/isc/Makefile bin/python/isc/utils.py bin/python/isc/tests/Makefile bin/python/dnssec-checkds.py bin/python/dnssec-coverage.py bin/python/dnssec-keymgr.py bin/python/isc/__init__.py bin/python/isc/checkds.py bin/python/isc/coverage.py bin/python/isc/dnskey.py bin/python/isc/eventlist.py bin/python/isc/keydict.py bin/python/isc/keyevent.py bin/python/isc/keymgr.py bin/python/isc/keyseries.py bin/python/isc/keyzone.py bin/python/isc/policy.py bin/python/isc/rndc.py bin/python/isc/tests/dnskey_test.py bin/python/isc/tests/policy_test.py bin/rndc/Makefile bin/tests/Makefile bin/tests/headerdep_test.sh bin/tests/optional/Makefile bin/tests/pkcs11/Makefile bin/tests/pkcs11/benchmarks/Makefile bin/tests/system/Makefile bin/tests/system/conf.sh bin/tests/system/dlz/prereq.sh bin/tests/system/dlzexternal/Makefile bin/tests/system/dlzexternal/ns1/dlzs.conf bin/tests/system/dyndb/Makefile bin/tests/system/dyndb/driver/Makefile bin/tests/system/inline/checkdsa.sh bin/tests/system/lwresd/Makefile bin/tests/system/pipelined/Makefile bin/tests/system/rndc/Makefile bin/tests/system/rsabigexponent/Makefile bin/tests/system/tkey/Makefile bin/tests/virtual-time/Makefile bin/tests/virtual-time/conf.sh bin/tools/Makefile contrib/scripts/check-secure-delegation.pl contrib/scripts/zone-edit.sh doc/Makefile doc/arm/Makefile doc/arm/noteversion.xml doc/arm/pkgversion.xml doc/arm/releaseinfo.xml doc/doxygen/Doxyfile doc/doxygen/Makefile doc/doxygen/doxygen-input-filter doc/misc/Makefile doc/tex/Makefile doc/tex/armstyle.sty doc/xsl/Makefile doc/xsl/isc-docbook-chunk.xsl doc/xsl/isc-docbook-html.xsl doc/xsl/isc-manpage.xsl doc/xsl/isc-notes-html.xsl isc-config.sh lib/Makefile lib/bind9/Makefile lib/bind9/include/Makefile lib/bind9/include/bind9/Makefile lib/dns/Makefile lib/dns/include/Makefile lib/dns/include/dns/Makefile lib/dns/include/dst/Makefile lib/dns/tests/Makefile lib/irs/Makefile lib/irs/include/Makefile lib/irs/include/irs/Makefile lib/irs/include/irs/netdb.h lib/irs/include/irs/platform.h lib/irs/tests/Makefile lib/isc/$arch/Makefile lib/isc/$arch/include/Makefile lib/isc/$arch/include/isc/Makefile lib/isc/$thread_dir/Makefile lib/isc/$thread_dir/include/Makefile lib/isc/$thread_dir/include/isc/Makefile lib/isc/Makefile lib/isc/include/Makefile lib/isc/include/isc/Makefile lib/isc/include/isc/platform.h lib/isc/include/pk11/Makefile lib/isc/include/pkcs11/Makefile lib/isc/tests/Makefile lib/isc/nls/Makefile lib/isc/unix/Makefile lib/isc/unix/include/Makefile lib/isc/unix/include/isc/Makefile lib/isc/unix/include/pkcs11/Makefile lib/isccc/Makefile lib/isccc/include/Makefile lib/isccc/include/isccc/Makefile lib/isccc/tests/Makefile lib/isccfg/Makefile lib/isccfg/include/Makefile lib/isccfg/include/isccfg/Makefile lib/isccfg/tests/Makefile lib/lwres/Makefile lib/lwres/include/Makefile lib/lwres/include/lwres/Makefile lib/lwres/include/lwres/netdb.h lib/lwres/include/lwres/platform.h lib/lwres/man/Makefile lib/lwres/tests/Makefile lib/lwres/unix/Makefile lib/lwres/unix/include/Makefile lib/lwres/unix/include/lwres/Makefile lib/samples/Makefile lib/samples/Makefile-postinstall unit/unittest.sh"
+ac_config_files="$ac_config_files make/Makefile make/mkdep Makefile bin/Makefile bin/check/Makefile bin/confgen/Makefile bin/confgen/unix/Makefile bin/delv/Makefile bin/dig/Makefile bin/dnssec/Makefile bin/named/Makefile bin/named/unix/Makefile bin/nsupdate/Makefile bin/pkcs11/Makefile bin/python/Makefile bin/python/isc/Makefile bin/python/isc/utils.py bin/python/isc/tests/Makefile bin/python/dnssec-checkds.py bin/python/dnssec-coverage.py bin/python/dnssec-keymgr.py bin/python/isc/__init__.py bin/python/isc/checkds.py bin/python/isc/coverage.py bin/python/isc/dnskey.py bin/python/isc/eventlist.py bin/python/isc/keydict.py bin/python/isc/keyevent.py bin/python/isc/keymgr.py bin/python/isc/keyseries.py bin/python/isc/keyzone.py bin/python/isc/policy.py bin/python/isc/rndc.py bin/python/isc/tests/dnskey_test.py bin/python/isc/tests/policy_test.py bin/rndc/Makefile bin/tests/Makefile bin/tests/headerdep_test.sh bin/tests/optional/Makefile bin/tests/pkcs11/Makefile bin/tests/pkcs11/benchmarks/Makefile bin/tests/system/Makefile bin/tests/system/conf.sh bin/tests/system/dlzexternal/Makefile bin/tests/system/dlzexternal/ns1/dlzs.conf bin/tests/system/dyndb/Makefile bin/tests/system/dyndb/driver/Makefile bin/tests/system/inline/checkdsa.sh bin/tests/system/lwresd/Makefile bin/tests/system/pipelined/Makefile bin/tests/system/rndc/Makefile bin/tests/system/rsabigexponent/Makefile bin/tests/system/tkey/Makefile bin/tests/virtual-time/Makefile bin/tests/virtual-time/conf.sh bin/tools/Makefile contrib/scripts/check-secure-delegation.pl contrib/scripts/zone-edit.sh doc/Makefile doc/arm/Makefile doc/arm/noteversion.xml doc/arm/pkgversion.xml doc/arm/releaseinfo.xml doc/doxygen/Doxyfile doc/doxygen/Makefile doc/doxygen/doxygen-input-filter doc/misc/Makefile doc/tex/Makefile doc/tex/armstyle.sty doc/xsl/Makefile doc/xsl/isc-docbook-chunk.xsl doc/xsl/isc-docbook-html.xsl doc/xsl/isc-manpage.xsl doc/xsl/isc-notes-html.xsl isc-config.sh lib/Makefile lib/bind9/Makefile lib/bind9/include/Makefile lib/bind9/include/bind9/Makefile lib/dns/Makefile lib/dns/include/Makefile lib/dns/include/dns/Makefile lib/dns/include/dst/Makefile lib/dns/tests/Makefile lib/irs/Makefile lib/irs/include/Makefile lib/irs/include/irs/Makefile lib/irs/include/irs/netdb.h lib/irs/include/irs/platform.h lib/irs/tests/Makefile lib/isc/$arch/Makefile lib/isc/$arch/include/Makefile lib/isc/$arch/include/isc/Makefile lib/isc/$thread_dir/Makefile lib/isc/$thread_dir/include/Makefile lib/isc/$thread_dir/include/isc/Makefile lib/isc/Makefile lib/isc/include/Makefile lib/isc/include/isc/Makefile lib/isc/include/isc/platform.h lib/isc/include/pk11/Makefile lib/isc/include/pkcs11/Makefile lib/isc/tests/Makefile lib/isc/nls/Makefile lib/isc/unix/Makefile lib/isc/unix/include/Makefile lib/isc/unix/include/isc/Makefile lib/isc/unix/include/pkcs11/Makefile lib/isccc/Makefile lib/isccc/include/Makefile lib/isccc/include/isccc/Makefile lib/isccc/tests/Makefile lib/isccfg/Makefile lib/isccfg/include/Makefile lib/isccfg/include/isccfg/Makefile lib/isccfg/tests/Makefile lib/lwres/Makefile lib/lwres/include/Makefile lib/lwres/include/lwres/Makefile lib/lwres/include/lwres/netdb.h lib/lwres/include/lwres/platform.h lib/lwres/man/Makefile lib/lwres/tests/Makefile lib/lwres/unix/Makefile lib/lwres/unix/include/Makefile lib/lwres/unix/include/lwres/Makefile lib/samples/Makefile lib/samples/Makefile-postinstall unit/unittest.sh"
 
 
 #
@@ -25927,7 +25972,6 @@ do
     "bin/tests/pkcs11/benchmarks/Makefile") CONFIG_FILES="$CONFIG_FILES bin/tests/pkcs11/benchmarks/Makefile" ;;
     "bin/tests/system/Makefile") CONFIG_FILES="$CONFIG_FILES bin/tests/system/Makefile" ;;
     "bin/tests/system/conf.sh") CONFIG_FILES="$CONFIG_FILES bin/tests/system/conf.sh" ;;
-    "bin/tests/system/dlz/prereq.sh") CONFIG_FILES="$CONFIG_FILES bin/tests/system/dlz/prereq.sh" ;;
     "bin/tests/system/dlzexternal/Makefile") CONFIG_FILES="$CONFIG_FILES bin/tests/system/dlzexternal/Makefile" ;;
     "bin/tests/system/dlzexternal/ns1/dlzs.conf") CONFIG_FILES="$CONFIG_FILES bin/tests/system/dlzexternal/ns1/dlzs.conf" ;;
     "bin/tests/system/dyndb/Makefile") CONFIG_FILES="$CONFIG_FILES bin/tests/system/dyndb/Makefile" ;;

configure.ac

@@ -4443,7 +4443,6 @@ DNSTAP=
 DNSTAPSRCS=
 DNSTAPOBJS=
 DNSTAPTARGETS=
-DNSTAP_PB_C_H=
 if test "x$use_dnstap" != "xno"; then
 	if ! $use_threads; then
 		AC_MSG_ERROR([Dnstap requires threads.])
@@ -4500,13 +4499,11 @@ if test "x$use_dnstap" != "xno"; then
 	DNSTAPSRCS='${DNSTAPSRCS}'
 	DNSTAPOBJS='${DNSTAPOBJS}'
 	DNSTAPTARGETS='${DNSTAPTARGETS}'
-	DNSTAP_PB_C_H="dnstap.pb-c.h"
 fi
 AC_SUBST(DNSTAP)
 AC_SUBST(DNSTAPSRCS)
 AC_SUBST(DNSTAPOBJS)
 AC_SUBST(DNSTAPTARGETS)
-AC_SUBST(DNSTAP_PB_C_H)
 
 #
 #  The following sets up how non-blocking i/o is established.
@@ -5065,98 +5062,94 @@ SO_LD=""
 SO_TARGETS=""
 SO_STRIP="cat"
 
-AC_ARG_WITH(dlopen,
+AC_ARG_WITH([dlopen],
 	    AS_HELP_STRING([--with-dlopen=ARG],
 			   [support dynamically loadable DLZ drivers]),
-	    dlopen="$withval", dlopen="yes")
+	    [], [with_dlopen="auto"])
 
-case $host in
-	*-sunos*) dlopen="no"
-		;;
-esac
+#
+# Disable for SunOS
+#
+AS_CASE([$host],[*-sunos*],[with_dlopen="no"])
 
-if test "yes" = "$dlopen"; then
-	AC_CHECK_LIB(dl, dlopen, have_dl=yes, have_dl=no)
-	if test "yes" = "$have_dl"; then
-		LIBS="-ldl $LIBS"
-	fi
-	AC_CHECK_FUNCS(dlopen dlclose dlsym,,dlopen=no)
-fi
+#
+# If PIC is disabled, dlopen must also be
+#
+AS_IF([test "$pic_mode" = "no"],
+      [AS_CASE([$with_dlopen],
+	       [auto],[with_dlopen="no"],
+	       [yes],[AC_MSG_ERROR([--with-dlopen requires PIC])])])
 
-if test "yes" = "$dlopen"; then
-	case $host in
-		*-linux*|*-gnu*)
-			SO_CFLAGS="-fPIC"
-                        LDFLAGS="${LDFLAGS} -Wl,--export-dynamic"
-			SO_LDFLAGS=""
-			if test "yes" = "$have_dl"
-			then
-				if test "yes" = "$use_libtool"; then
-					SO_LDFLAGS="-Xcompiler -shared"
-					SO_LD="${CC}"
-				else
-					SO_LDFLAGS="-shared"
-					SO_LD="${CC}"
-				fi
-			else
-				SO_LDFLAGS="-shared"
-				SO_LD="ld"
-			fi
-			;;
-		*-freebsd*|*-openbsd*)
-			LDFLAGS="${LDFLAGS} -Wl,-E"
-			SO_CFLAGS="-fpic"
-			if test "yes" = "$use_libtool"; then
-				SO_LDFLAGS="-Xcompiler -shared"
-				SO_LD="${CC}"
-			else
-				SO_LDFLAGS="-shared"
-				SO_LD="${CC}"
-			fi
-			;;
-		*-netbsd*)
-			SO_CFLAGS="-fpic"
-			SO_LDFLAGS="-Bshareable -x"
-			SO_LD="ld"
-			SO_STRIP="sed -e s/-Wl,//g"
-			;;
-		*-solaris*)
-			SO_CFLAGS="-KPIC"
-			SO_LDFLAGS="-G -z text"
-			SO_LD="ld"
-			;;
-		*-hp-hpux*)
-			SO=sl
-			SO_CFLAGS="+z"
-			SO_LDFLAGS="-b +vnocompatwarnings"
-			SO_LD="ld"
-			;;
-		*)
-			SO_CFLAGS="-fPIC"
-			;;
-	esac
+AS_CASE([$with_dlopen],
+	[auto|yes],[
+	  AC_SEARCH_LIBS([dlopen],[dl])
+	  AC_CHECK_FUNCS([dlopen dlclose dlsym],
+			 [with_dlopen="yes"],
+			 [with_dlopen="no"])
+	])
 
-	if test "X$GCC" = "Xyes"; then
-		SO_CFLAGS="-fPIC"
-		if test -z "$SO_LD"
-		then
-			if test "yes" = "$use_libtool"; then
-				SO_LDFLAGS="-Xcompiler -shared"
-				SO_LD="${CC}"
-			else
-				SO_LDFLAGS="-shared"
-				SO_LD="${CC}"
-			fi
-		fi
-	fi
+AS_IF([test "$with_dlopen" = "yes"],
+      [AS_CASE([$host],
+	       [*-linux*|*-gnu*],[
+		 LDFLAGS="${LDFLAGS} -Wl,--export-dynamic"
+		 SO_CFLAGS="-fPIC"
+		 SO_LDFLAGS=""
+		 AS_IF([test "$use_libtool" = "yes"],[
+			 SO_LDFLAGS="-Xcompiler -shared"
+			 SO_LD="${CC}"
+		       ],[
+			 SO_LDFLAGS="-shared"
+			 SO_LD="${CC}"
+		       ])
+	       ],
+	       [*-freebsd*|*-openbsd*|*-netbsd*],[
+		 LDFLAGS="${LDFLAGS} -Wl,-E"
+		 SO_CFLAGS="-fpic"
+		 AS_IF([test "$use_libtool" = "yes"],[
+			 SO_LDFLAGS="-Xcompiler -shared"
+			 SO_LD="${CC}"
+		       ],[
+			 SO_LDFLAGS="-shared"
+			 SO_LD="${CC}"
+		       ])
+	       ],
+	       [*-darwin*],[
+		 SO_CFLAGS="-fPIC"
+                 SO_LD="${CC}"
+		 AS_IF([test "$use_libtool" = "yes"],[
+			 SO_LDFLAGS="-Xcompiler -dynamiclib -undefined dynamic_lookup"
+		       ],[
+			 SO_LDFLAGS="-dynamiclib -undefined dynamic_lookup"
+		       ])
+	       ],
+	       [*-solaris*],[
+		 SO_CFLAGS="-KPIC"
+		 SO_LDFLAGS="-G -z text"
+		 SO_LD="ld"
+	       ],
+	       [
+		 SO_CFLAGS="-fPIC"
+	       ])
+       AS_IF([test "$GCC" = "yes"],[
+	       SO_CFLAGS="-fPIC"
+	       AS_IF([test -z "$SO_LD"],
+		     [AS_IF([test "$use_libtool" = "yes"],[
+			      SO_LDFLAGS="-Xcompiler -shared"
+			      SO_LD="${CC}"
+			    ],[
+			      SO_LDFLAGS="-shared"
+			      SO_LD="${CC}"
+			    ])
+		     ])
+	     ])
+       # If we still don't know how to make shared objects, don't make any.
+       AS_IF([test -n "$SO_LD"],
+	     [SO_TARGETS="\${SO_TARGETS}"
+	      AC_DEFINE([ISC_DLZ_DLOPEN], [1],
+			[Define to allow building of objects for dlopen().])
+	     ])
+      ])
 
-	# If we still don't know how to make shared objects, don't make any.
-	if test -n "$SO_LD"; then
-		SO_TARGETS="\${SO_TARGETS}"
-		AC_DEFINE(ISC_DLZ_DLOPEN, 1,
-			  [Define to allow building of objects for dlopen().])
-	fi
-fi
 CFLAGS="$CFLAGS $SO_CFLAGS"
 
 AC_SUBST(SO)
@@ -5165,7 +5158,6 @@ AC_SUBST(SO_LDFLAGS)
 AC_SUBST(SO_LD)
 AC_SUBST(SO_STRIP)
 AC_SUBST(SO_TARGETS)
-
 sinclude(contrib/dlz/config.dlz.in)
 AC_MSG_CHECKING(contributed DLZ drivers)
 
@@ -5389,7 +5381,6 @@ AC_CONFIG_FILES([
 	bin/tests/pkcs11/benchmarks/Makefile
 	bin/tests/system/Makefile
 	bin/tests/system/conf.sh
-	bin/tests/system/dlz/prereq.sh
 	bin/tests/system/dlzexternal/Makefile
 	bin/tests/system/dlzexternal/ns1/dlzs.conf
 	bin/tests/system/dyndb/Makefile

contrib/dlz/drivers/dlz_filesystem_driver.c

@@ -112,10 +112,10 @@ is_safe(const char *input) {
 			if (i == 0)
 				return (false);
 			/* '..', two dots together is not allowed. */
-			else if (input[i-1] == '.')
+			if (input[i-1] == '.')
 				return (false);
 			/* '.' is not allowed as last char */
-			if (i == len)
+			if (i == len - 1)
 				return (false);
 			/* only 1 dot in ok location, continue at next char */
 			continue;

contrib/dlz/modules/filesystem/dlz_filesystem_dynamic.c

@@ -105,10 +105,10 @@ is_safe(const char *input) {
 			if (i == 0)
 				return (false);
 			/* '..', two dots together is not allowed. */
-			else if (input[i-1] == '.')
+			if (input[i-1] == '.')
 				return (false);
 			/* '.' is not allowed as last char */
-			if (i == len)
+			if (i == len - 1)
 				return (false);
 			/* only 1 dot in ok location, continue at next char */
 			continue;

contrib/dlz/modules/include/dlz_minimal.h

@@ -125,13 +125,12 @@ typedef isc_result_t (*dns_clientinfo_sourceip_t)(dns_clientinfo_t *client,
 typedef isc_result_t (*dns_clientinfo_version_t)(dns_clientinfo_t *client,
 						  void **addrp);
 
-#define DNS_CLIENTINFOMETHODS_VERSION 2
-#define DNS_CLIENTINFOMETHODS_AGE 1
+#define DNS_CLIENTINFOMETHODS_VERSION 1
+#define DNS_CLIENTINFOMETHODS_AGE 0
 typedef struct dns_clientinfomethods {
 	uint16_t version;
 	uint16_t age;
 	dns_clientinfo_sourceip_t sourceip;
-	dns_clientinfo_version_t dbversion;
 } dns_clientinfomethods_t;
 #endif /* DLZ_DLOPEN_VERSION > 1 */
 

contrib/sdb/ldap/zone2ldap.c

@@ -524,7 +524,7 @@ add_to_rr_list (char *dn, char *name, char *type,
       if (tmp->attrs[3]->mod_values == (char **)NULL)
 	 fatal("calloc");
 
-      sprintf (charttl, "%d", ttl);
+      sprintf (charttl, "%u", ttl);
       tmp->attrs[3]->mod_values[0] = strdup (charttl);
       tmp->attrs[3]->mod_values[1] = NULL;
 
@@ -687,7 +687,7 @@ build_dn_from_dc_list (char **dc_list, unsigned int ttl, int flag)
     if (flag == WI_SPEC)
     {
       if (x == (size - 2) && (strncmp (dc_list[x], "@", 1) == 0) && (ttl))
-	sprintf (tmp, "relativeDomainName=%s + dNSTTL=%d,", dc_list[x], ttl);
+	sprintf (tmp, "relativeDomainName=%s + dNSTTL=%u,", dc_list[x], ttl);
       else if (x == (size - 2))
 	      sprintf(tmp, "relativeDomainName=%s,",dc_list[x]);
       else

contrib/sdb/time/timedb.c

@@ -70,22 +70,30 @@ timedb_lookup(const char *zone, const char *name, void *dbdata,
 		 * remove the trailing newline.
 		 */
 		n = snprintf(buf, sizeof(buf), "\"%s", ctime(&now));
-		if (n < 0)
+		if (n <= 0) {
 			return (ISC_R_FAILURE);
+		}
+		if (n >= sizeof(buf) || buf[n - 1] != '\n') {
+			return (ISC_R_FAILURE);
+		}
 		buf[n - 1] = '\"';
 		result = dns_sdb_putrr(lookup, "txt", 1, buf);
-		if (result != ISC_R_SUCCESS)
+		if (result != ISC_R_SUCCESS) {
 			return (ISC_R_FAILURE);
+		}
 	} else if (strcmp(name, "clock") == 0) {
 		result = dns_sdb_putrr(lookup, "cname", 1, "time");
-		if (result != ISC_R_SUCCESS)
+		if (result != ISC_R_SUCCESS) {
 			return (ISC_R_FAILURE);
+		}
 	} else if (strcmp(name, "current") == 0) {
 		result = dns_sdb_putrr(lookup, "dname", 1, "@");
-		if (result != ISC_R_SUCCESS)
+		if (result != ISC_R_SUCCESS) {
 			return (ISC_R_FAILURE);
-	} else
+		}
+	} else {
 		return (ISC_R_NOTFOUND);
+	}
 
 	return (ISC_R_SUCCESS);
 }

doc/arm/Bv9ARM.ch01.html

@@ -616,6 +616,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.11.6rc1 (Extended Support Version)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.11.6 (Extended Support Version)</p>
 </body>
 </html>

doc/arm/Bv9ARM.ch02.html

@@ -151,6 +151,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.11.6rc1 (Extended Support Version)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.11.6 (Extended Support Version)</p>
 </body>
 </html>

doc/arm/Bv9ARM.ch03.html

@@ -759,6 +759,6 @@ controls {
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.11.6rc1 (Extended Support Version)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.11.6 (Extended Support Version)</p>
 </body>
 </html>

doc/arm/Bv9ARM.ch04.html

@@ -2867,6 +2867,6 @@ $ORIGIN 0.0.0.0.0.0.0.0.8.b.d.0.1.0.0.2.ip6.arpa.
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.11.6rc1 (Extended Support Version)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.11.6 (Extended Support Version)</p>
 </body>
 </html>

doc/arm/Bv9ARM.ch05.html

@@ -142,6 +142,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.11.6rc1 (Extended Support Version)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.11.6 (Extended Support Version)</p>
 </body>
 </html>

doc/arm/Bv9ARM.ch06.html

@@ -2456,9 +2456,9 @@ badresp:1,adberr:0,findfail:0,valfail:0]
 	<span class="command"><strong>bindkeys-file</strong></span> <em class="replaceable"><code>quoted_string</code></em>;
 	<span class="command"><strong>blackhole</strong></span> { <em class="replaceable"><code>address_match_element</code></em>; ... };
 	<span class="command"><strong>cache-file</strong></span> <em class="replaceable"><code>quoted_string</code></em>;
-	<span class="command"><strong>catalog-zones</strong></span> { zone <em class="replaceable"><code>quoted_string</code></em> [ default-masters [ port
-	    <em class="replaceable"><code>integer</code></em> ] [ dscp <em class="replaceable"><code>integer</code></em> ] { ( <em class="replaceable"><code>masters</code></em> | <em class="replaceable"><code>ipv4_address</code></em> [
-	    <span class="command"><strong>port</strong></span> <em class="replaceable"><code>integer</code></em> ] | <em class="replaceable"><code>ipv6_address</code></em> [ port <em class="replaceable"><code>integer</code></em> ] ) [ key
+	<span class="command"><strong>catalog-zones</strong></span> { zone <em class="replaceable"><code>string</code></em> [ default-masters [ port <em class="replaceable"><code>integer</code></em> ]
+	    [ dscp <em class="replaceable"><code>integer</code></em> ] { ( <em class="replaceable"><code>masters</code></em> | <em class="replaceable"><code>ipv4_address</code></em> [ port
+	    <em class="replaceable"><code>integer</code></em> ] | <em class="replaceable"><code>ipv6_address</code></em> [ port <em class="replaceable"><code>integer</code></em> ] ) [ key
 	    <em class="replaceable"><code>string</code></em> ]; ... } ] [ zone-directory <em class="replaceable"><code>quoted_string</code></em> ] [
 	    <span class="command"><strong>in-memory</strong></span> <em class="replaceable"><code>boolean</code></em> ] [ min-update-interval <em class="replaceable"><code>integer</code></em> ]; ... };
 	<span class="command"><strong>check-dup-records</strong></span> ( fail | warn | ignore );
@@ -2642,13 +2642,13 @@ badresp:1,adberr:0,findfail:0,valfail:0]
 	<span class="command"><strong>require-server-cookie</strong></span> <em class="replaceable"><code>boolean</code></em>;
 	<span class="command"><strong>reserved-sockets</strong></span> <em class="replaceable"><code>integer</code></em>;
 	<span class="command"><strong>resolver-query-timeout</strong></span> <em class="replaceable"><code>integer</code></em>;
-	<span class="command"><strong>response-policy</strong></span> { zone <em class="replaceable"><code>quoted_string</code></em> [ log <em class="replaceable"><code>boolean</code></em> ] [
-	    <span class="command"><strong>max-policy-ttl</strong></span> <em class="replaceable"><code>integer</code></em> ] [ policy ( cname | disabled | drop |
-	    <span class="command"><strong>given</strong></span> | no-op | nodata | nxdomain | passthru | tcp-only
-	    <em class="replaceable"><code>quoted_string</code></em> ) ] [ recursive-only <em class="replaceable"><code>boolean</code></em> ]; ... } [
-	    <span class="command"><strong>break-dnssec</strong></span> <em class="replaceable"><code>boolean</code></em> ] [ max-policy-ttl <em class="replaceable"><code>integer</code></em> ] [
-	    <span class="command"><strong>min-ns-dots</strong></span> <em class="replaceable"><code>integer</code></em> ] [ nsip-wait-recurse <em class="replaceable"><code>boolean</code></em> ] [
-	    <span class="command"><strong>qname-wait-recurse</strong></span> <em class="replaceable"><code>boolean</code></em> ] [ recursive-only <em class="replaceable"><code>boolean</code></em> ];
+	<span class="command"><strong>response-policy</strong></span> { zone <em class="replaceable"><code>string</code></em> [ log <em class="replaceable"><code>boolean</code></em> ] [ max-policy-ttl
+	    <em class="replaceable"><code>integer</code></em> ] [ policy ( cname | disabled | drop | given | no-op
+	    | nodata | nxdomain | passthru | tcp-only <em class="replaceable"><code>quoted_string</code></em> ) ] [
+	    <span class="command"><strong>recursive-only</strong></span> <em class="replaceable"><code>boolean</code></em> ]; ... } [ break-dnssec <em class="replaceable"><code>boolean</code></em> ] [
+	    <span class="command"><strong>max-policy-ttl</strong></span> <em class="replaceable"><code>integer</code></em> ] [ min-ns-dots <em class="replaceable"><code>integer</code></em> ] [
+	    <span class="command"><strong>nsip-wait-recurse</strong></span> <em class="replaceable"><code>boolean</code></em> ] [ qname-wait-recurse <em class="replaceable"><code>boolean</code></em> ]
+	    [ recursive-only <em class="replaceable"><code>boolean</code></em> ];
 	<span class="command"><strong>root-delegation-only</strong></span> [ exclude { <em class="replaceable"><code>quoted_string</code></em>; ... } ];
 	<span class="command"><strong>root-key-sentinel</strong></span> <em class="replaceable"><code>boolean</code></em>;
 	<span class="command"><strong>rrset-order</strong></span> { [ class <em class="replaceable"><code>string</code></em> ] [ type <em class="replaceable"><code>string</code></em> ] [ name
@@ -14676,6 +14676,6 @@ HOST-127.EXAMPLE. MX 0 .
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.11.6rc1 (Extended Support Version)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.11.6 (Extended Support Version)</p>
 </body>
 </html>

doc/arm/Bv9ARM.ch07.html

@@ -399,6 +399,6 @@ allow-query { !{ !10/8; any; }; key example; };
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.11.6rc1 (Extended Support Version)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.11.6 (Extended Support Version)</p>
 </body>
 </html>