Merge branch 'prep-release' into v9_11

Address cppcheck warnings and errors in v9_11

See merge request isc-projects/bind9!2421

.dir-locals.el

@@ -0,0 +1,112 @@
+;;; Directory Local Variables
+;;; For more information see (info "(emacs) Directory Variables")
+
+((c-mode .
+  ((eval .
+	 (set (make-local-variable 'directory-of-current-dir-locals-file)
+	      (file-name-directory (locate-dominating-file default-directory ".dir-locals.el"))
+	      )
+	 )
+   (eval .
+	 (set (make-local-variable 'include-directories)
+	      (list
+
+	       ;; top directory
+	       (expand-file-name
+		(concat directory-of-current-dir-locals-file "./"))
+
+	       ;; libisc
+	       (expand-file-name
+		(concat directory-of-current-dir-locals-file "lib/isc/unix/include"))
+	       (expand-file-name
+		(concat directory-of-current-dir-locals-file "lib/isc/pthreads/include"))
+	       (expand-file-name
+		(concat directory-of-current-dir-locals-file "lib/isc/include"))
+	       (expand-file-name
+		(concat directory-of-current-dir-locals-file "lib/isc"))
+	       (expand-file-name
+		(concat directory-of-current-dir-locals-file "lib/isc/netmgr"))
+
+	       ;; libdns
+	       (expand-file-name
+		(concat directory-of-current-dir-locals-file "lib/dns/include"))
+	       (expand-file-name
+		(concat directory-of-current-dir-locals-file "lib/dns"))
+
+	       ;; libisccc
+	       (expand-file-name
+		(concat directory-of-current-dir-locals-file "lib/isccc/include"))
+
+	       ;; libisccfg
+	       (expand-file-name
+		(concat directory-of-current-dir-locals-file "lib/isccfg/include"))
+
+	       ;; libns
+	       (expand-file-name
+		(concat directory-of-current-dir-locals-file "lib/ns/include"))
+
+	       ;; libirs
+	       (expand-file-name
+		(concat directory-of-current-dir-locals-file "lib/irs/include"))
+
+	       ;; libbind9
+	       (expand-file-name
+		(concat directory-of-current-dir-locals-file "lib/bind9/include"))
+
+	       ;; bin
+	       (expand-file-name
+		(concat directory-of-current-dir-locals-file "bin/check"))
+	       (expand-file-name
+		(concat directory-of-current-dir-locals-file "bin/confgen/include"))
+	       (expand-file-name
+		(concat directory-of-current-dir-locals-file "bin/confgen"))
+	       (expand-file-name
+		(concat directory-of-current-dir-locals-file "bin/confgen/include"))	       
+	       (expand-file-name
+		(concat directory-of-current-dir-locals-file "bin/dig/include"))
+	       (expand-file-name
+		(concat directory-of-current-dir-locals-file "bin/named/include"))
+	       (expand-file-name
+		(concat directory-of-current-dir-locals-file "bin/rndc/include"))
+	       (expand-file-name
+		(concat directory-of-current-dir-locals-file "bin/dnssec/include"))
+	       (expand-file-name
+		(concat directory-of-current-dir-locals-file "bin/named/include"))
+	       (expand-file-name
+		(concat directory-of-current-dir-locals-file "bin/rndc/include"))
+
+	       (expand-file-name "/usr/local/opt/openssl@1.1/include")
+	       (expand-file-name "/usr/local/opt/libxml2/include/libxml2")
+	       (expand-file-name "/usr/local/opt/json-c/include/json-c/")
+	       (expand-file-name "/usr/local/include")
+	       )
+	      )
+	 )
+
+   (eval setq flycheck-clang-include-path include-directories)
+   (eval setq flycheck-cppcheck-include-path include-directories)
+   (eval setq flycheck-gcc-include-path include-directories)
+   (eval setq flycheck-clang-args
+	 (list
+	  "-include"
+	  (expand-file-name
+	   (concat directory-of-current-dir-locals-file "config.h"))
+	  )
+	 )
+   (eval setq flycheck-gcc-args
+	 (list
+	  "-include"
+	  (expand-file-name
+	   (concat directory-of-current-dir-locals-file "config.h"))
+	  )
+	 )
+   (eval setq flycheck-cppcheck-args
+	 (list
+	  "--enable=all"
+	  "--suppress=missingIncludeSystem"
+	  (concat "-include=" (expand-file-name
+			       (concat directory-of-current-dir-locals-file "config.h")))
+	  )
+	 )
+   )
+  ))

.gitignore

@@ -1,33 +1,61 @@
-Makefile
-config.log
-config.h
-config.cache
-config.status
-libtool
-/isc-config.sh
-/configure.lineno
-autom4te.cache/
-*.o
-*.lo
-*.so
-*.a
-*.la
-*.gcno
-*.gcda
-*_test
 *-symtbl.c
-timestamp
-ans.run
-lwresd.run
-named.run
-named.memstats
-gen.dSYM/
+*.a
+*.gcda
+*.gcno
+*.la
+*.lo
+*.o
+*.orig
+*.plist/ # ccc-analyzer store its results in .plist directories
+*.rej
+*.so
+*_test
+*~
+.ccache/
+.cproject
 .deps/
 .dirstamp
 .libs/
-# ccc-analyzer store its results in .plist directories
-*.plist/
-*~
 .project
-.cproject
 .settings
+/aclocal.m4
+/ar-lib
+/autom4te.cache/
+/bind.keys.h
+/compile
+/config.cache
+/config.guess
+/config.h
+/config.h.in
+/config.log
+/config.status
+/config.sub
+/configure
+/configure.lineno
+/depcomp
+/install-sh
+/isc-config.sh
+/libltdl/*
+/libtool
+/ltmain.sh
+/m4/libtool.m4
+/m4/ltargz.m4
+/m4/ltdl.m4
+/m4/ltoptions.m4
+/m4/ltsugar.m4
+/m4/ltversion.m4
+/m4/lt~obsolete.m4
+/missing
+/py-compile
+/stamp-h1
+/test-driver
+Makefile
+ans.run
+gen.dSYM/
+kyua.log
+named.memstats
+named.run
+timestamp
+/compile_commands.json
+/cppcheck_html/
+/cppcheck.results

.gitlab-ci.yml

@@ -8,14 +8,33 @@ variables:
   CCACHE_DIR: "/ccache"
   SOFTHSM2_CONF: "/var/tmp/softhsm2/softhsm2.conf"
 
+  # VirtualBox driver needs to set build_dir to "/builds" in gitlab-runner.toml
+  KYUA_RESULT: "$CI_PROJECT_DIR/kyua.results"
+
+  GIT_DEPTH: 1
+  BUILD_PARALLEL_JOBS: 6
+  TEST_PARALLEL_JOBS: 6
+
+  MAKE: make
+
 stages:
   - precheck
   - build
-  - test
+  - unit
+  - system
+  - docs
   - push
+  - postcheck
 
 ### Runner Tag Templates
 
+# Note: FreeBSD runners extract the FreeBSD version to use from job name
+
+.freebsd-amd64: &freebsd_amd64
+  tags:
+    - freebsd
+    - amd64
+
 .linux-amd64: &linux_amd64
   tags:
     - linux
@@ -28,6 +47,12 @@ stages:
 
 ### Docker Image Templates
 
+# Alpine Linux
+
+.alpine-3.10-amd64: &alpine_3_10_amd64_image
+  image: "$CI_REGISTRY_IMAGE:alpine-3.10-amd64"
+  <<: *linux_amd64
+
 # CentOS
 
 .centos-centos6-amd64: &centos_centos6_amd64_image
@@ -44,10 +69,6 @@ stages:
   image: "$CI_REGISTRY_IMAGE:debian-jessie-amd64"
   <<: *linux_amd64
 
-.debian-jessie-i386: &debian_jessie_i386_image
-  image: "$CI_REGISTRY_IMAGE:debian-jessie-i386"
-  <<: *linux_i386
-
 .debian-stretch-amd64: &debian_stretch_amd64_image
   image: "$CI_REGISTRY_IMAGE:debian-stretch-amd64"
   <<: *linux_amd64
@@ -56,6 +77,10 @@ stages:
   image: "$CI_REGISTRY_IMAGE:debian-stretch-i386"
   <<: *linux_i386
 
+.debian-buster-amd64: &debian_buster_amd64_image
+  image: "$CI_REGISTRY_IMAGE:debian-buster-amd64"
+  <<: *linux_i386
+
 .debian-sid-amd64: &debian_sid_amd64_image
   image: "$CI_REGISTRY_IMAGE:debian-sid-amd64"
   <<: *linux_amd64
@@ -66,8 +91,8 @@ stages:
 
 # Fedora
 
-.fedora-29-amd64: &fedora_29_amd64_image
-  image: "$CI_REGISTRY_IMAGE:fedora-29-amd64"
+.fedora-30-amd64: &fedora_30_amd64_image
+  image: "$CI_REGISTRY_IMAGE:fedora-30-amd64"
   <<: *linux_amd64
 
 # Ubuntu
@@ -101,26 +126,66 @@ stages:
   <<: *debian_sid_amd64_image
   stage: precheck
 
+.autoconf: &autoconf_job
+  <<: *default_triggering_rules
+  <<: *debian_sid_amd64_image
+  stage: precheck
+  script:
+    - autoreconf -fi
+  artifacts:
+    untracked: true
+    expire_in: "1 hour"
+
+.configure: &configure |
+    ./configure \
+    --disable-maintainer-mode \
+    --enable-developer \
+    --with-randomdev=/dev/urandom \
+    --with-libtool \
+    --with-geoip2=auto \
+    --disable-static \
+    --with-cmocka \
+    --with-libxml2 \
+    --with-json \
+    --prefix=$HOME/.local \
+    --without-make-clean \
+    $EXTRA_CONFIGURE \
+    || cat config.log
+
 .build: &build_job
   <<: *default_triggering_rules
   stage: build
   before_script:
     - test -w "${CCACHE_DIR}" && export PATH="/usr/lib/ccache:${PATH}"
   script:
-    - ./configure --enable-developer --with-randomdev=/dev/urandom --with-libtool --disable-static --with-cmocka --prefix=$HOME/.local --without-make-clean ${EXTRA_CONFIGURE} || cat config.log
-    - make -j${BUILD_PARALLEL_JOBS:-1} -k all V=1
+    - *configure
+    - ${MAKE} -j${BUILD_PARALLEL_JOBS:-1} -k all V=1
     - test -z "${RUN_MAKE_INSTALL}" || make install
+  dependencies:
+    - autoreconf:sid:amd64
+  needs:
+    - autoreconf:sid:amd64
   artifacts:
     untracked: true
     expire_in: "1 hour"
 
+.setup_interfaces: &setup_interfaces |
+    if [ "$(id -u)" -eq "0" ]; then
+      sh -x bin/tests/system/ifconfig.sh up;
+    else
+      sudo sh -x bin/tests/system/ifconfig.sh up;
+    fi
+
+.setup_softhsm: &setup_softhsm |
+    sh -x util/prepare-softhsm2.sh
+
 .system_test: &system_test_job
   <<: *default_triggering_rules
-  stage: test
+  stage: system
   retry: 2
   before_script:
-    - bash -x bin/tests/system/ifconfig.sh up
-    - bash -x util/prepare-softhsm2.sh
+    - *setup_interfaces
+    - *setup_softhsm
   script:
     - ( cd bin/tests && make -j${TEST_PARALLEL_JOBS:-1} -k test V=1 )
     - test -s bin/tests/system/systests.output
@@ -129,16 +194,22 @@ stages:
     expire_in: "1 week"
     when: on_failure
 
+.kyua_report: &kyua_report_html |
+  kyua --logfile /dev/null report-html \
+       --force \
+       --results-file "$KYUA_RESULT" \
+       --results-filter "" \
+       --output kyua_html
+
 .unit_test: &unit_test_job
   <<: *default_triggering_rules
-  stage: test
+  stage: unit
   before_script:
-    - export KYUA_RESULT="$CI_PROJECT_DIR/kyua.results"
-    - bash -x util/prepare-softhsm2.sh
+    - *setup_softhsm
   script:
     - make unit
   after_script:
-    - kyua report-html --force --results-file kyua.results --results-filter "" --output kyua_html
+    - *kyua_report_html
   artifacts:
     paths:
       - kyua.log
@@ -147,10 +218,47 @@ stages:
     expire_in: "1 week"
     when: on_failure
 
+.cppcheck_args: &run_cppcheck |
+  cppcheck --enable=warning,performance,portability,information,missingInclude \
+           --include=config.h \
+           --quiet \
+           --std=c11 \
+           --language=c \
+           --project=compile_commands.json \
+           --error-exitcode=2 \
+           -j ${TEST_PARALLEL_JOBS:-1} \
+           --xml \
+           --output-file=cppcheck.results \
+           --inline-suppr
+
+.cppcheck_report: &cppcheck_report_html |
+  cppcheck-htmlreport --title="BIND 9 ($CI_COMMIT_SHORT_SHA) Cppcheck Report" \
+                      --file=cppcheck.results \
+                      --report-dir=cppcheck_html/
+
+.cppcheck: &cppcheck_job
+  <<: *default_triggering_rules
+  stage: postcheck
+  script:
+    - *run_cppcheck
+  after_script:
+    - *cppcheck_report_html
+  artifacts:
+    paths:
+      - compile_commands.json
+      - cppcheck.results
+      - cppcheck_html/
+    expire_in: "1 week"
+    when: on_failure
+  allow_failure: true
+
 ### Job Definitions
 
 # Jobs in the precheck stage
 
+autoreconf:sid:amd64:
+  <<: *autoconf_job
+
 misc:sid:amd64:
   <<: *precheck_job
   script:
@@ -167,6 +275,7 @@ misc:sid:amd64:
     - if test "$(git status --porcelain | grep -Ev '\?\?' | wc -l)" -gt "0"; then git status --short; exit 1; fi
     - xmllint --noout --nonet `git ls-files '*.xml' '*.docbook'`
     - xmllint --noout --nonet --html `git ls-files '*.html'`
+    - sh util/check-win32util-configure
   artifacts:
     paths:
       - util/newcopyrights
@@ -176,17 +285,23 @@ misc:sid:amd64:
 
 🐞:sid:amd64:
   <<: *precheck_job
-  script: util/check-cocci
+  script:
+    - util/check-cocci
+    - if test "$(git status --porcelain | grep -Ev '\?\?' | wc -l)" -gt "0"; then git status --short; exit 1; fi
 
 # Jobs for doc builds on Debian Sid (amd64)
 
 docs:sid:amd64:
   <<: *debian_sid_amd64_image
-  stage: build
+  stage: docs
   script:
     - ./configure || cat config.log
     - make -C doc/misc docbook
     - make -C doc/arm Bv9ARM.html
+  dependencies:
+    - autoreconf:sid:amd64
+  needs:
+    - autoreconf:sid:amd64
   artifacts:
     paths:
       - doc/arm/
@@ -208,6 +323,30 @@ push:docs:sid:amd64:
     - master@isc-projects/bind9
     - /^v9_[1-9][0-9]$/@isc-projects/bind9
 
+# Jobs for regular GCC builds on Alpine Linux 3.10 (amd64)
+
+gcc:alpine3.10:amd64:
+  variables:
+    CC: gcc
+    CFLAGS: "-Wall -Wextra -O2 -g"
+    EXTRA_CONFIGURE: "--enable-dnstap"
+  <<: *alpine_3_10_amd64_image
+  <<: *build_job
+
+system:gcc:alpine3.10:amd64:
+  <<: *alpine_3_10_amd64_image
+  <<: *system_test_job
+  dependencies:
+    - gcc:alpine3.10:amd64
+  needs: ["gcc:alpine3.10:amd64"]
+
+unit:gcc:alpine3.10:amd64:
+  <<: *alpine_3_10_amd64_image
+  <<: *unit_test_job
+  dependencies:
+    - gcc:alpine3.10:amd64
+  needs: ["gcc:alpine3.10:amd64"]
+
 # Jobs for regular GCC builds on CentOS 6 (amd64)
 
 gcc:centos6:amd64:
@@ -223,12 +362,14 @@ system:gcc:centos6:amd64:
   <<: *system_test_job
   dependencies:
     - gcc:centos6:amd64
+  needs: ["gcc:centos6:amd64"]
 
 unit:gcc:centos6:amd64:
   <<: *centos_centos6_amd64_image
   <<: *unit_test_job
   dependencies:
     - gcc:centos6:amd64
+  needs: ["gcc:centos6:amd64"]
 
 # Jobs for regular GCC builds on CentOS 7 (amd64)
 
@@ -236,7 +377,7 @@ gcc:centos7:amd64:
   variables:
     CC: gcc
     CFLAGS: "-Wall -Wextra -O2 -g"
-    EXTRA_CONFIGURE: "--with-libidn2"
+    EXTRA_CONFIGURE: "--enable-dnstap --with-libidn2"
   <<: *centos_centos7_amd64_image
   <<: *build_job
 
@@ -245,12 +386,14 @@ system:gcc:centos7:amd64:
   <<: *system_test_job
   dependencies:
     - gcc:centos7:amd64
+  needs: ["gcc:centos7:amd64"]
 
 unit:gcc:centos7:amd64:
   <<: *centos_centos7_amd64_image
   <<: *unit_test_job
   dependencies:
     - gcc:centos7:amd64
+  needs: ["gcc:centos7:amd64"]
 
 # Jobs for regular GCC builds on Debian 8 Jessie (amd64)
 
@@ -258,7 +401,7 @@ gcc:jessie:amd64:
   variables:
     CC: gcc
     CFLAGS: "-Wall -Wextra -O2 -g"
-    EXTRA_CONFIGURE: "--without-cmocka --with-python"
+    EXTRA_CONFIGURE: "--without-cmocka --with-python --disable-geoip"
   <<: *debian_jessie_amd64_image
   <<: *build_job
 
@@ -267,12 +410,14 @@ system:gcc:jessie:amd64:
   <<: *system_test_job
   dependencies:
     - gcc:jessie:amd64
+  needs: ["gcc:jessie:amd64"]
 
 unit:gcc:jessie:amd64:
   <<: *debian_jessie_amd64_image
   <<: *unit_test_job
   dependencies:
     - gcc:jessie:amd64
+  needs: ["gcc:jessie:amd64"]
 
 # Jobs for regular GCC builds on Debian 9 Stretch (amd64)
 
@@ -288,21 +433,47 @@ system:gcc:stretch:amd64:
   <<: *system_test_job
   dependencies:
     - gcc:stretch:amd64
+  needs: ["gcc:stretch:amd64"]
 
 unit:gcc:stretch:amd64:
   <<: *debian_stretch_amd64_image
   <<: *unit_test_job
   dependencies:
     - gcc:stretch:amd64
+  needs: ["gcc:stretch:amd64"]
+
+# Jobs for regular GCC builds on Debian 10 Buster (amd64)
+
+gcc:buster:amd64:
+  variables:
+    CC: gcc
+    CFLAGS: "-Wall -Wextra -O2 -g"
+  <<: *debian_buster_amd64_image
+  <<: *build_job
+
+system:gcc:buster:amd64:
+  <<: *debian_buster_amd64_image
+  <<: *system_test_job
+  dependencies:
+    - gcc:buster:amd64
+  needs: ["gcc:buster:amd64"]
+
+unit:gcc:buster:amd64:
+  <<: *debian_buster_amd64_image
+  <<: *unit_test_job
+  dependencies:
+    - gcc:buster:amd64
+  needs: ["gcc:buster:amd64"]
 
 # Jobs for regular GCC builds on Debian Sid (amd64)
 
 gcc:sid:amd64:
   variables:
     CC: gcc
-    CFLAGS: "-Wall -Wextra -O2 -g"
-    EXTRA_CONFIGURE: "--with-libidn2"
+    CFLAGS: "-Wall -Wextra -O3 -g"
+    EXTRA_CONFIGURE: "--enable-dnstap --with-libidn2"
     RUN_MAKE_INSTALL: 1
+    MAKE: bear make
   <<: *debian_sid_amd64_image
   <<: *build_job
 
@@ -311,20 +482,29 @@ system:gcc:sid:amd64:
   <<: *system_test_job
   dependencies:
     - gcc:sid:amd64
+  needs: ["gcc:sid:amd64"]
 
 unit:gcc:sid:amd64:
   <<: *debian_sid_amd64_image
   <<: *unit_test_job
   dependencies:
     - gcc:sid:amd64
+  needs: ["gcc:sid:amd64"]
+
+cppcheck:gcc:sid:amd64:
+  <<: *debian_sid_amd64_image
+  <<: *cppcheck_job
+  dependencies:
+    - gcc:sid:amd64
+  needs: ["gcc:sid:amd64"]
 
 # Jobs for regular GCC builds on Debian Sid (i386)
 
 gcc:sid:i386:
   variables:
     CC: gcc
-    CFLAGS: "-Wall -Wextra -O2 -g"
-    EXTRA_CONFIGURE: "--with-libidn2 --without-python"
+    CFLAGS: "-Wall -Wextra -O3 -g"
+    EXTRA_CONFIGURE: "--enable-dnstap --with-libidn2 --without-python"
   <<: *debian_sid_i386_image
   <<: *build_job
 
@@ -333,34 +513,38 @@ system:gcc:sid:i386:
   <<: *system_test_job
   dependencies:
     - gcc:sid:i386
+  needs: ["gcc:sid:i386"]
 
 unit:gcc:sid:i386:
   <<: *debian_sid_i386_image
   <<: *unit_test_job
   dependencies:
     - gcc:sid:i386
+  needs: ["gcc:sid:i386"]
 
-# Jobs for regular GCC builds on Fedora 29 (amd64)
+# Jobs for regular GCC builds on Fedora 30 (amd64)
 
-gcc:fedora29:amd64:
+gcc:fedora30:amd64:
   variables:
     CC: gcc
     CFLAGS: "-Wall -Wextra -O2 -g"
     EXTRA_CONFIGURE: "--with-libidn2"
-  <<: *fedora_29_amd64_image
+  <<: *fedora_30_amd64_image
   <<: *build_job
 
-system:gcc:fedora29:amd64:
-  <<: *fedora_29_amd64_image
+system:gcc:fedora30:amd64:
+  <<: *fedora_30_amd64_image
   <<: *system_test_job
   dependencies:
-    - gcc:fedora29:amd64
+    - gcc:fedora30:amd64
+  needs: ["gcc:fedora30:amd64"]
 
-unit:gcc:fedora29:amd64:
-  <<: *fedora_29_amd64_image
+unit:gcc:fedora30:amd64:
+  <<: *fedora_30_amd64_image
   <<: *unit_test_job
   dependencies:
-    - gcc:fedora29:amd64
+    - gcc:fedora30:amd64
+  needs: ["gcc:fedora30:amd64"]
 
 # Jobs for regular GCC builds on Ubuntu 16.04 Xenial Xerus (amd64)
 
@@ -368,6 +552,7 @@ gcc:xenial:amd64:
   variables:
     CC: gcc
     CFLAGS: "-Wall -Wextra -O2 -g"
+    EXTRA_CONFIGURE: "--disable-geoip"
   <<: *ubuntu_xenial_amd64_image
   <<: *build_job
 
@@ -376,12 +561,14 @@ system:gcc:xenial:amd64:
   <<: *system_test_job
   dependencies:
     - gcc:xenial:amd64
+  needs: ["gcc:xenial:amd64"]
 
 unit:gcc:xenial:amd64:
   <<: *ubuntu_xenial_amd64_image
   <<: *unit_test_job
   dependencies:
     - gcc:xenial:amd64
+  needs: ["gcc:xenial:amd64"]
 
 # Jobs for regular GCC builds on Ubuntu 18.04 Bionic Beaver (amd64)
 
@@ -398,12 +585,14 @@ system:gcc:bionic:amd64:
   <<: *system_test_job
   dependencies:
     - gcc:bionic:amd64
+  needs: ["gcc:bionic:amd64"]
 
 unit:gcc:bionic:amd64:
   <<: *ubuntu_bionic_amd64_image
   <<: *unit_test_job
   dependencies:
     - gcc:bionic:amd64
+  needs: ["gcc:bionic:amd64"]
 
 # Jobs for GCC builds with ASAN enabled on Debian Sid (amd64)
 
@@ -421,12 +610,14 @@ system:asan:sid:amd64:
   <<: *system_test_job
   dependencies:
     - asan:sid:amd64
+  needs: ["asan:sid:amd64"]
 
 unit:asan:sid:amd64:
   <<: *debian_sid_amd64_image
   <<: *unit_test_job
   dependencies:
     - asan:sid:amd64
+  needs: ["asan:sid:amd64"]
 
 # Jobs for Clang builds on Debian Stretch (amd64)
 
@@ -443,6 +634,7 @@ unit:clang:stretch:amd64:
   <<: *unit_test_job
   dependencies:
     - clang:stretch:amd64
+  needs: ["clang:stretch:amd64"]
 
 # Jobs for Clang builds on Debian Stretch (i386)
 
@@ -454,6 +646,28 @@ clang:stretch:i386:
   <<: *debian_stretch_i386_image
   <<: *build_job
 
+# Jobs for nocrypt builds on Debian Sid (amd64)
+
+nocrypto:sid:amd64:
+  variables:
+    CC: gcc
+    CFLAGS: "-Wall -Wextra -O2 -g"
+    EXTRA_CONFIGURE: "--with-openssl=no"
+  <<: *debian_sid_amd64_image
+  <<: *build_job
+
+system:nocrypto:sid:amd64:
+  <<: *debian_sid_amd64_image
+  <<: *system_test_job
+  dependencies:
+    - nocrypto:sid:amd64
+
+unit:nocrypto:sid:amd64:
+  <<: *debian_sid_amd64_image
+  <<: *unit_test_job
+  dependencies:
+    - nocrypto:sid:amd64
+
 # Jobs for PKCS#11-enabled GCC builds on Debian Sid (amd64)
 
 pkcs11:sid:amd64:
@@ -469,31 +683,139 @@ system:pkcs11:sid:amd64:
   <<: *system_test_job
   dependencies:
     - pkcs11:sid:amd64
+  needs: ["pkcs11:sid:amd64"]
 
 unit:pkcs11:sid:amd64:
   <<: *debian_sid_amd64_image
   <<: *unit_test_job
   dependencies:
     - pkcs11:sid:amd64
+  needs: ["pkcs11:sid:amd64"]
 
-# Jobs for GCC builds with assertions compiled away on Debian Sid (amd64)
+# Jobs for Clang builds on FreeBSD 11.3 (amd64)
 
-noassert:sid:amd64:
+clang:freebsd11.3:amd64:
+  variables:
+    CFLAGS: "-Wall -Wextra -O2 -g"
+  <<: *freebsd_amd64
+  <<: *build_job
+
+system:clang:freebsd11.3:amd64:
+  <<: *freebsd_amd64
+  <<: *system_test_job
+  dependencies:
+    - clang:freebsd11.3:amd64
+  needs: ["clang:freebsd11.3:amd64"]
+
+unit:clang:freebsd11.3:amd64:
+  <<: *freebsd_amd64
+  <<: *unit_test_job
+  dependencies:
+    - clang:freebsd11.3:amd64
+  needs: ["clang:freebsd11.3:amd64"]
+
+# Jobs for Clang builds on FreeBSD 12.0 (amd64)
+
+clang:freebsd12.0:amd64:
+  variables:
+    CFLAGS: "-Wall -Wextra -O2 -g"
+    EXTRA_CONFIGURE: "--enable-dnstap"
+  <<: *freebsd_amd64
+  <<: *build_job
+
+system:clang:freebsd12.0:amd64:
+  <<: *freebsd_amd64
+  <<: *system_test_job
+  dependencies:
+    - clang:freebsd12.0:amd64
+  needs: ["clang:freebsd12.0:amd64"]
+
+unit:clang:freebsd12.0:amd64:
+  <<: *freebsd_amd64
+  <<: *unit_test_job
+  dependencies:
+    - clang:freebsd12.0:amd64
+  needs: ["clang:freebsd12.0:amd64"]
+
+# Jobs with libtool disabled
+
+nolibtool:sid:amd64:
   variables:
     CC: gcc
-    CFLAGS: "-Wall -Wextra -O2 -g -DISC_CHECK_NONE=1"
-    EXTRA_CONFIGURE: "--with-libidn2"
+    CFLAGS: "-Wall -Wextra -Og -g"
+    EXTRA_CONFIGURE: "--with-libidn2 --without-libtool --with-dlopen"
   <<: *debian_sid_amd64_image
   <<: *build_job
 
-system:noassert:sid:amd64:
+system:nolibtool:sid:amd64:
   <<: *debian_sid_amd64_image
   <<: *system_test_job
   dependencies:
-    - noassert:sid:amd64
+    - nolibtool:sid:amd64
+  needs: ["nolibtool:sid:amd64"]
 
-unit:noassert:sid:amd64:
+unit:nolibtool:sid:amd64:
   <<: *debian_sid_amd64_image
   <<: *unit_test_job
   dependencies:
-    - noassert:sid:amd64
+    - nolibtool:sid:amd64
+  needs: ["nolibtool:sid:amd64"]
+
+# Jobs for Visual Studio 2017 builds on Windows (amd64)
+
+msvc:windows:amd64:
+  <<: *default_triggering_rules
+  stage: build
+  tags:
+    - windows
+    - amd64
+  variables:
+    VSCONF: Release
+  script:
+    - 'Push-Location "C:/Program Files (x86)/Microsoft Visual Studio/2017/BuildTools/VC/Auxiliary/Build"'
+    - '& cmd.exe /C "vcvarsall.bat x64 & set" | Foreach-Object { if ($_ -match "(.*?)=(.*)") { Set-Item -force -path "Env:\$($matches[1])" -value "$($matches[2])" } }'
+    - 'Pop-Location'
+    - 'Set-Location win32utils'
+    - '& "C:/Strawberry/perl/bin/perl.exe" Configure
+         "with-tools-version=15.0"
+         "with-platform-toolset=v141"
+         "with-platform-version=10.0.17763.0"
+         "with-vcredist=C:/Program Files (x86)/Microsoft Visual Studio/2017/BuildTools/VC/Redist/MSVC/14.16.27012/vcredist_x64.exe"
+         "with-openssl=C:/OpenSSL"
+         "with-libxml2=C:/libxml2"
+         "without-python"
+         "with-system-tests"
+         x64'
+    - 'Set-Item -path "Env:CL" -value "/MP$([Math]::Truncate($BUILD_PARALLEL_JOBS/2))"'
+    - '& msbuild.exe /maxCpuCount:2 /t:Build /p:Configuration=$VSCONF bind9.sln'
+  artifacts:
+    untracked: true
+    expire_in: "1 hour"
+
+system:msvc:windows:amd64:
+  stage: system
+  tags:
+    - windows
+    - amd64
+  variables:
+    VSCONF: Release
+  script:
+    - 'Push-Location bin/tests/system'
+    - '$ifIndex = Get-NetIPInterface -AddressFamily IPv4 -InterfaceMetric 75 | Select-Object -ExpandProperty ifIndex'
+    - '& C:/tools/cygwin/bin/sed.exe -i "s/^exit.*/netsh interface ipv4 set dnsservers $ifIndex dhcp/; s/\(name\|interface\)=Loopback/$ifIndex/;" ifconfig.bat'
+    - '& C:/tools/cygwin/bin/sed.exe -i "s/kill -f/kill -W/;" conf.sh stop.pl'
+    - '& cmd.exe /C ifconfig.bat up; ""'
+    - 'Start-Sleep 2'
+    - '$Env:Path = "C:/tools/cygwin/bin;$Env:Path"'
+    - '& sh.exe runall.sh $TEST_PARALLEL_JOBS'
+    - 'If (Test-Path C:/CrashDumps/*) { dir C:/CrashDumps; Throw }'
+  dependencies:
+    - msvc:windows:amd64
+  needs: ["msvc:windows:amd64"]
+  artifacts:
+    untracked: true
+    expire_in: "1 week"
+    when: on_failure
+  only:
+    - tags
+    - web

CHANGES

@@ -1,3 +1,242 @@
+	--- 9.11.12 released ---
+
+5296.	[bug]		Address various issues reported by cppcheck. [GL !2421]
+
+5294.	[func]		Fallback to ACE name on output in locale, which does not
+			support converting it to unicode.  [GL #846]
+
+5293.	[bug]		On Windows, named crashed upon any attempt to fetch XML
+			statistics from it. [GL #1245]
+
+5292.	[bug]		Queue 'rndc nsec3param' requests while signing inline
+			zone changes. [GL #1205]
+
+	--- 9.11.11 released ---
+
+5291.	[cleanup]	Revert change #4825 as it was not appropriate for 9.11.
+			[GL #1213]
+
+5290.	[bug]		Address potential NULL pointer dereference in
+			isc_ht_find. [GL #1211]
+
+5287.	[bug]		Address potential NULL pointer dereference. [GL #1208]
+
+5286.	[contrib]	Address potential NULL pointer dereferences in
+			dlz_mysqldyn_mod.c. [GL #1207]
+
+5285.	[port]		win32: implement "-T maxudpXXX". [GL #837]
+
+5282.	[bug]		Fixed a bug in searching for possible wildcard matches
+			for query names in the RPZ summary database. [GL #1146]
+
+5281.	[cleanup]	Don't escape commas when reporting named's command
+			line. [GL #1189]
+
+5280.	[protocol]	Add support for displaying EDNS option LLQ. [GL #1201]
+
+5279.	[bug]		When loading, reject zones containing CDS or CDNSKEY
+			RRsets at the zone apex if they would cause DNSSEC
+			validation failures if published in the parent zone
+			as the DS RRset.  [GL #1187]
+
+	--- 9.11.10 released ---
+
+5275.	[bug]		Mark DS records included in referral messages
+			with trust level "pending" so that they can be
+			validated and cached immediately, with no need to
+			re-query. [GL #964]
+
+5273.	[bug]		Check that bits [64..71] of a dns64 prefix are zero.
+			[GL #1159]
+
+5269.	[port]		cygwin: can return ETIMEDOUT on connect() with a
+			non-blocking socket. [GL #1133]
+
+5268.	[bug]		named could crash during configuration if
+			configured to use "geoip continent" ACLs with
+			legacy GeoIP. [GL #1163]
+
+5266.	[bug]		named-checkconf failed to report dnstap-output
+			missing from named.conf when dnstap was specified.
+			[GL #1136]
+
+5265.	[bug]		DNS64 and RPZ nodata (CNAME *.) rules interacted badly
+			[GL #1106]
+
+5264.	[func]		New DNS Cookie algorithm - siphash24 - has been added to
+			BIND 9. [GL #605]
+
+	--- 9.11.9 released ---
+
+5260.	[bug]		dnstap-read was producing malformed output for large
+			packets. [GL #1093]
+
+5258.	[func]		Added support for the GeoIP2 API from MaxMind,
+			when BIND is compiled using "configure --with-geoip2".
+			The legacy GeoIP API can be enabled by using
+			"configure --with-geoip" instead. These options
+			cannot be used together.
+
+			Certain geoip ACL settings that were available with
+			legacy GeoIP are not available when using GeoIP2.
+			See the ARM for details. [GL #182]
+
+5257.	[bug]		Some statistics data was not being displayed.
+			Add shading to the zone tables. [GL #1030]
+
+5256.	[bug]		Ensure that glue records are included in root
+			priming responses if "minimal-responses" is not
+			set to "yes". [GL #1092]
+
+5255.	[bug]		Errors encountered while reloading inline-signing
+			zones could be ignored, causing the zone content to
+			be left in an incompletely updated state rather than
+			reverted. [GL #1109]
+
+5253.	[port]		Support platforms that don't define ULLONG_MAX.
+			[GL #1098]
+
+5249.	[bug]		Fix a possible underflow in recursion clients
+			statistics when hitting recursive clients
+			soft quota. [GL #1067]
+
+	--- 9.11.8 released ---
+
+5244.	[security]	Fixed a race condition in dns_dispatch_getnext()
+			that could cause an assertion failure if a
+			significant number of incoming packets were
+			rejected. (CVE-2019-6471) [GL #942]
+
+5241.	[bug]		Fix Ed448 private and public key ASN.1 prefix blobs.
+			[GL #225]
+
+5237.	[bug]		Recurse to find the root server list with 'dig +trace'.
+			[GL #1028]
+
+	--- 9.11.7 released ---
+
+5233.	[bug]		Negative trust anchors did not work with "forward only;"
+			to validating resolvers. [GL #997]
+
+5232.	[bug]		Fix a high-load race/crash in isc_socket_cancel().
+			[GL #834]
+
+5231.	[protocol]	Add support for displaying CLIENT-TAG and SERVER-TAG.
+			[GL #960]
+
+5229.	[protocol]	Enforce known SSHFP fingerprint lengths. [GL #852]
+
+5228.	[cleanup]	If trusted-keys and managed-keys are configured
+			simultaneously for the same name, the key cannot
+			be rolled automatically. This configuration now
+			logs a warning. [GL #868]
+
+5224.	[bug]		Only test provide-ixfr on TCP streams. [GL #991]
+
+5222.	[bug]		'delv -t ANY' could leak memory. [GL #983]
+
+5221.	[test]		Enable parallel execution of system tests on
+			Windows. [GL !4101]
+
+5218.	[bug]		Conditionally include <dlfcn.h>. [GL #995]
+
+5214.	[bug]		win32: named now removes its lock file upon shutdown.
+			[GL #979]
+
+5213.	[bug]		win32: Eliminated a race which allowed named.exe running
+			as a service to be killed prematurely during shutdown.
+			[GL #978]
+
+5210.	[bug]		When dnstap is enabled and recursion is not
+			available, incoming queries are now logged
+			as "auth". Previously, this depended on whether
+			recursion was requested by the client, not on
+			whether recursion was available. [GL #963]
+
+5209.	[bug]		When update-check-ksk is true, add_sigs was not
+			considering offline keys, leaving record sets signed
+			with the incorrect type key. [GL #763]
+
+5208.	[test]		Run valid rdata wire encodings through totext+fromtext
+			and tofmttext+fromtext methods to check these methods.
+			[GL #899]
+
+5207.	[test]		Check delv and dig TTL values. [GL #965]
+
+5205.	[bug]		Enforce that a DS hash exists. [GL #899]
+
+5204.	[test]		Check that dns_rdata_fromtext() produces a record that
+			will be accepted by dns_rdata_fromwire(). [GL #852]
+
+5203.	[bug]		Enforce whether key rdata exists or not in KEY,
+			DNSKEY, CDNSKEY and RKEY. [GL #899]
+
+5197.	[bug]		dig could die in best effort mode on multiple SIG(0)
+			records. Similarly on multiple OPT and multiple TSIG
+			records. [GL #920]
+
+5194.	[bug]		Enforce non empty ZOMEMD hash. [GL #899]
+
+5193.	[bug]		EID and NIMLOC failed to do multi-line output
+			correctly. [GL #899]
+
+5192.	[bug]		configure --fips-mode failed. [GL #946]
+
+5191.	[port]		Darwin: dlzexternal/driver.so was not building.
+			[GL #948]
+
+5189.	[cleanup]	Remove revoked root DNSKEY from bind.keys. [GL #945]
+
+5187.	[test]		Set time zone before running any tests in dnstap_test.
+			[GL #940]
+
+5185.	[bug]		PKCS11 build could fail if ECDSA is not supported.
+			[GL #935]
+
+5184.	[bug]		Missing unlocks in sdlz.c. [GL #936]
+
+5182.	[bug]		Fix a high-load race/crash in handling of
+			isc_socket_close() in resolver. [GL #834]
+
+5180.	[bug]		delv now honors the operating system's preferred
+			ephemeral port range. [GL #925]
+
+5179.	[cleanup]	Replace some vague type declarations with the more
+			specific dns_secalg_t and dns_dsdigest_t.
+			Thanks to Tony Finch. [GL !1498]
+
+5178.	[bug]		Handle EDQUOT (disk quota) and ENOSPC (disk full)
+			errors when writing files. [GL #902]
+
+5176.	[tests]		Remove a dependency on libxml in statschannel system
+			test. [GL #926]
+
+5175.	[bug]		Fixed a problem with file input in dnssec-keymgr,
+			dnssec-coverage and dnssec-checkds when using
+			python3. [GL #882]
+
+5174.	[doc]		Tidy dnssec-keygen manual. [GL !1557]
+
+5172.	[bug]		nsupdate now honors the operating system's preferred
+			ephemeral port range. [GL #905]
+
+5170.	[test]		Added --with-dlz-filesystem to feature-test. [GL !1587]
+
+5168.	[test]		Do not crash on shutdown when RPZ fails to load.  Also,
+			keep previous version of the database if RPZ fails to
+			load. [GL #813]
+
+5167.	[bug]		nxdomain-redirect could sometimes lookup the wrong
+			redirect name. [GL #892]
+
+	--- 9.11.6-P1 released ---
+
+5200.	[security]	tcp-clients settings could be exceeded in some cases,
+			which could lead to exhaustion of file descriptors.
+			(CVE-2018-5743) [GL #615]
+
+	--- 9.11.6 released ---
+
 	--- 9.11.6rc1 released ---
 
 5166.	[port]		openbsd: Threads are now enabled by default. [GL !1548]
@@ -135,8 +374,8 @@
 5092.	[bug]		Address memory leak on SIGTERM in nsupdate when using
 			GSS-TSIG. [GL #558]
 
-5090.	[bug]		dig and mdig failed to properly preparse dash value
-			pairs when value was a seperate argument and started
+5090.	[bug]		dig and mdig failed to properly pre-parse dash value
+			pairs when value was a separate argument and started
 			with a dash. [GL #584]
 
 5088.	[bug]		dig/host/nslookup could crash when interrupted close to
@@ -162,7 +401,7 @@
 5072.	[bug]		Add unit tests for isc_buffer_copyregion() and fix its
 			behavior for auto-reallocated buffers. [GL #644]
 
-5071.	[bug]		Comparision of NXT records was broken. [GL #631]
+5071.	[bug]		Comparison of NXT records was broken. [GL #631]
 
 5070.	[bug]		Record types which support a empty rdata field were
 			not handling the empty rdata field case. [GL #638]
@@ -172,7 +411,7 @@
 
 5065.	[bug]		Only set IPV6_USE_MIN_MTU on IPv6. [GL #553]
 
-5064.	[test]		Initalize TZ environment variable before calling
+5064.	[test]		Initialize TZ environment variable before calling
 			dns_test_begin in dnstap_test. [GL #624]
 
 5061.	[protocol]	Add support for EID and NIMLOC. [GL #626]

CONTRIBUTING

@@ -1,3 +1,5 @@
+CONTRIBUTING
+
 BIND Source Access and Contributor Guidelines
 
 Feb 22, 2018

HISTORY

@@ -1,3 +1,5 @@
+HISTORY
+
 Functional enhancements from prior major releases of BIND 9
 
 BIND 9.10.0
@@ -303,11 +305,11 @@ BIND 9.4.0
   * Detect duplicates of UDP queries we are recursing on and drop them.
     New stats category "duplicates".
   * "USE INTERNAL MALLOC" is now runtime selectable.
-  * The lame cache is now done on a basis as some servers only appear to
-    be lame for certain query types.
+  * The lame cache is now done on a <qname,qclass,qtype> basis as some
+    servers only appear to be lame for certain query types.
   * Limit the number of recursive clients that can be waiting for a single
-    query () to resolve. New options clients-per-query and
-    max-clients-per-query.
+    query (<qname,qtype,qclass>) to resolve. New options clients-per-query
+    and max-clients-per-query.
   * dig: report the number of extra bytes still left in the packet after
     processing all the records.
   * Support for IPSECKEY rdata type.

Makefile.in

@@ -95,22 +95,22 @@ test-force:
 	exit $$status
 
 README: README.md
-	${PANDOC} --email-obfuscation=none -s -t html README.md | \
+	${PANDOC} --email-obfuscation=none -s --metadata title="README" -f markdown-smart -t html README.md | \
 		${W3M} -dump -cols 75 -O ascii -T text/html | \
 		sed -e '$${/^$$/d;}' > $@
 
 HISTORY: HISTORY.md
-	${PANDOC} --email-obfuscation=none -s -t html HISTORY.md | \
+	${PANDOC} --email-obfuscation=none -s --metadata title="HISTORY" -f markdown-smart -t html HISTORY.md | \
 		${W3M} -dump -cols 75 -O ascii -T text/html | \
 		sed -e '$${/^$$/d;}' > $@
 
 OPTIONS: OPTIONS.md
-	${PANDOC} --email-obfuscation=none -s -t html OPTIONS.md | \
+	${PANDOC} --email-obfuscation=none -s --metadata title="OPTIONS" -f markdown-smart -t html OPTIONS.md | \
 		${W3M} -dump -cols 75 -O ascii -T text/html | \
 		sed -e '$${/^$$/d;}' > $@
 
 CONTRIBUTING: CONTRIBUTING.md
-	${PANDOC} --email-obfuscation=none -s -t html CONTRIBUTING.md | \
+	${PANDOC} --email-obfuscation=none -s --metadata title="CONTRIBUTING" -f markdown-smart -t html CONTRIBUTING.md | \
 		${W3M} -dump -cols 75 -O ascii -T text/html | \
 		sed -e '$${/^$$/d;}' > $@
 

OPTIONS

@@ -1,10 +1,12 @@
+OPTIONS
+
 Setting the STD_CDEFINES environment variable before running configure can
 be used to enable certain compile-time options that are not explicitly
 defined in configure.
 
 Some of these settings are:
 
-Setting                   Description
+         Setting                            Description
                           Don't ovewrite memory when allocating or freeing
 -DISC_MEM_FILL=0          it; this improves performance but makes
                           debugging more difficult.

README

@@ -1,3 +1,5 @@
+README
+
 BIND 9
 
 Contents
@@ -37,9 +39,9 @@ versions 4 and 8. Internet Systems Consortium (https://www.isc.org), a 501
 (c)(3) public benefit corporation dedicated to providing software and
 services in support of the Internet infrastructure, developed BIND 9 and
 is responsible for its ongoing maintenance and improvement. BIND is open
-source software licenced under the terms of ISC License for all versions
+source software licensed under the terms of ISC License for all versions
 up to and including BIND 9.10, and the Mozilla Public License version 2.0
-for all subsequent verisons.
+for all subsequent versions.
 
 For a summary of features introduced in past major releases of BIND, see
 the file HISTORY.
@@ -68,6 +70,9 @@ If the bug you are reporting is a potential security issue, such as an
 assertion failure or other crash in named, please do NOT use GitLab to
 report it. Instead, please send mail to security-officer@isc.org.
 
+For a general overview of ISC security policies, read the Knowledge Base
+article at https://kb.isc.org/docs/aa-00861.
+
 Professional support and training for BIND are available from ISC at
 https://www.isc.org/support.
 
@@ -87,7 +92,7 @@ Information for BIND contributors can be found in the following files: -
 General information: doc/dev/contrib.md - BIND 9 code style: doc/dev/
 style.md - BIND architecture and developer guide: doc/dev/dev.md
 
-Patches for BIND may be submitted as Merge Requests in the ISC GitLab
+Patches for BIND may be submitted as merge requests in the ISC GitLab
 server at at https://gitlab.isc.org/isc-projects/bind9/merge_requests.
 
 By default, external contributors don't have ability to fork BIND in the
@@ -128,7 +133,7 @@ releases. New features include:
         fetches-per-server, this value is not self-tuning.)
       + New stats counters have been added to count queries spilled due to
         these quotas.
-  * Added a new dnssec-keymgr key mainenance utility, which can generate
+  * Added a new dnssec-keymgr key maintenance utility, which can generate
     or update keys as needed to ensure that a zone's keys match a defined
     DNSSEC policy.
   * The experimental "SIT" feature in BIND 9.10 has been renamed "COOKIE"
@@ -249,7 +254,9 @@ disclosed in CVE-2017-3145.
 BIND 9.11.4
 
 BIND 9.11.4 is a maintenance release, and addresses the security flaw
-disclosed in CVE-2018-5738.
+disclosed in CVE-2018-5738. It also introduces "root key sentinel"
+support, enabling validating resolvers to indicate via a special query
+which trust anchors are configured for the root zone.
 
 BIND 9.11.5
 
@@ -263,18 +270,47 @@ correcting faulty documentation and introducing the following new feature:
 BIND 9.11.6
 
 BIND 9.11.6 is a maintenance release, and also addresses the security
-flaws disclosed in CVE-2018-5744, CVE-2018-5745, and CVE-2019-6465.
+flaws disclosed in CVE-2018-5743, CVE-2018-5745, CVE-2018-5744, and
+CVE-2019-6465.
+
+BIND 9.11.7
+
+BIND 9.11.7 is a maintenance release, and also addresses the security flaw
+disclosed in CVE-2018-5743.
+
+BIND 9.11.8
+
+BIND 9.11.8 is a maintenance release, and also addresses the security flaw
+disclosed in CVE-2019-6471.
+
+BIND 9.11.9
+
+BIND 9.11.9 is a maintenance release, and also adds support for the new
+MaxMind GeoIP2 geolocation API when built with configure --with-geoip2.
+
+BIND 9.11.10
+
+BIND 9.11.10 is a maintenance release.
+
+BIND 9.11.11
+
+BIND 9.11.11 is a maintenance release.
+
+BIND 9.11.12
+
+BIND 9.11.12 is a maintenance release.
 
 Building BIND
 
-BIND requires a UNIX or Linux system with an ANSI C compiler, basic POSIX
-support, and a 64-bit integer type. Successful builds have been observed
-on many versions of Linux and UNIX, including RedHat, Fedora, Debian,
-Ubuntu, SuSE, Slackware, FreeBSD, NetBSD, OpenBSD, Mac OS X, Solaris,
-HP-UX, AIX, SCO OpenServer, and OpenWRT.
+Minimally, BIND requires a UNIX or Linux system with an ANSI C compiler,
+basic POSIX support, and a 64-bit integer type. Successful builds have
+been observed on many versions of Linux and UNIX, including RHEL/CentOS,
+Fedora, Debian, Ubuntu, SLES, openSUSE, Slackware, Alpine, FreeBSD,
+NetBSD, OpenBSD, macOS, Solaris, OpenIndiana, OmniOS CE, HP-UX, and
+OpenWRT.
 
-BIND is also available for Windows XP, 2003, 2008, and higher. See
-win32utils/readme1st.txt for details on building for Windows systems.
+BIND is also available for Windows Server 2008 and higher. See win32utils/
+build.txt for details on building for Windows systems.
 
 To build on a UNIX or Linux system, use:
 
@@ -287,7 +323,7 @@ make depend. If you're using Emacs, you might find make tags helpful.
 Several environment variables that can be set before running configure
 will affect compilation:
 
-Variable       Description
+   Variable                            Description
 CC             The C compiler to use. configure tries to figure out the
                right one for supported systems.
                C compiler flags. Defaults to include -g and/or -O2 as
@@ -302,25 +338,23 @@ STD_CDEFINES   Defaults to empty string. For a list of possible settings,
 LDFLAGS        Linker flags. Defaults to empty string.
 BUILD_CC       Needed when cross-compiling: the native C compiler to use
                when building for the target system.
-BUILD_CFLAGS   Optional, used for cross-compiling
-BUILD_CPPFLAGS
-BUILD_LDFLAGS
-BUILD_LIBS
+BUILD_CFLAGS   CFLAGS for the target system during cross-compiling.
+BUILD_CPPFLAGS CPPFLAGS for the target system during cross-compiling.
+BUILD_LDFLAGS  LDFLAGS for the target system during cross-compiling.
+BUILD_LIBS     LIBS for the target system during cross-compiling.
 
 macOS
 
 Building on macOS assumes that the "Command Tools for Xcode" is installed.
 This can be downloaded from https://developer.apple.com/download/more/ or
-if you have Xcode already installed you can run "xcode-select --install".
-This will add /usr/include to the system and install the compiler and
-other tools so that they can be easily found.
+if you have Xcode already installed you can run xcode-select --install.
 
 Dependencies
 
 Portions of BIND that are written in Python, including dnssec-keymgr,
 dnssec-coverage, dnssec-checkds, and some of the system tests, require the
-'argparse' and 'ply' modules to be available. 'argparse' is a standard
-module as of Python 2.7 and Python 3.2. 'ply' is available from https://
+argparse and ply modules to be available. argparse is a standard module as
+of Python 2.7 and Python 3.2. ply is available from https://
 pypi.python.org/pypi/ply.
 
 Compile-time options
@@ -343,16 +377,18 @@ line.
 For the server to support DNSSEC, you need to build it with crypto
 support. To use OpenSSL, you should have OpenSSL 1.0.2e or newer
 installed. If the OpenSSL library is installed in a nonstandard location,
-specify the prefix using "--with-openssl=<PREFIX>" on the configure
-command line. To use a PKCS#11 hardware service module for cryptographic
+specify the prefix using --with-openssl=<PREFIX> on the configure command
+line. To use a PKCS#11 hardware service module for cryptographic
 operations, specify the path to the PKCS#11 provider library using
-"--with-pkcs11=<PREFIX>", and configure BIND with
-"--enable-native-pkcs11".
+--with-pkcs11=<PREFIX>, and configure BIND with "--enable-native-pkcs11".
 
 To support the HTTP statistics channel, the server must be linked with at
-least one of the following: libxml2 http://xmlsoft.org or json-c https://
-github.com/json-c. If these are installed at a nonstandard location,
-specify the prefix using --with-libxml2=/prefix or --with-libjson=/prefix.
+least one of the following libraries: libxml2 http://xmlsoft.org or json-c
+https://github.com/json-c/json-c. If these are installed at a nonstandard
+location, then:
+
+  * for libxml2, specify the prefix using --with-libxml2=/prefix,
+  * for json-c, adjust PKG_CONFIG_PATH.
 
 To support compression on the HTTP statistics channel, the server must be
 linked against libzlib. If this is installed in a nonstandard location,
@@ -360,7 +396,7 @@ specify the prefix using --with-zlib=/prefix.
 
 To support storing configuration data for runtime-added zones in an LMDB
 database, the server must be linked with liblmdb. If this is installed in
-a nonstandard location, specify the prefix using "with-lmdb=/prefix".
+a nonstandard location, specify the prefix using with-lmdb=/prefix.
 
 To support GeoIP location-based ACLs, the server must be linked with
 libGeoIP. This is not turned on by default; BIND must be configured with
@@ -418,7 +454,7 @@ ifconfig.sh up as root.
 
 Some tests require Perl and the Net::DNS and/or IO::Socket::INET6 modules,
 and will be skipped if these are not available. Some tests require Python
-and the 'dnspython' module and will be skipped if these are not available.
+and the dnspython module and will be skipped if these are not available.
 See bin/tests/system/README for further details.
 
 Unit tests are implemented using the CMocka unit testing framework. To
@@ -429,7 +465,7 @@ tests can be run via make test or make unit.
 Documentation
 
 The BIND 9 Administrator Reference Manual is included with the source
-distribution, in DocBook XML, HTML and PDF format, in the doc/arm
+distribution, in DocBook XML, HTML, and PDF format, in the doc/arm
 directory.
 
 Some of the programs in the BIND 9 distribution have man pages in their
@@ -449,7 +485,7 @@ development BIND 9 is included in the file CHANGES, with the most recent
 changes listed first. Change notes include tags indicating the category of
 the change that was made; these categories are:
 
-Category       Description
+   Category                            Description
 [func]         New feature
 [bug]          General bug fix
 [security]     Fix for a significant security flaw
@@ -477,26 +513,46 @@ releases (i.e., those with version numbers ending in zero). Some new
 functionality may be backported to older releases on a case-by-case basis.
 All other change types may be applied to all currently-supported releases.
 
+Bug report identifiers
+
+Most notes in the CHANGES file include a reference to a bug report or
+issue number. Prior to 2018, these were usually of the form [RT #NNN] and
+referred to entries in the "bind9-bugs" RT database, which was not open to
+the public. More recent entries use the form [GL #NNN] or, less often, [GL
+!NNN], which, respectively, refer to issues or merge requests in the
+GitLab database. Most of these are publicly readable, unless they include
+information which is confidential or security sensitive.
+
+To look up a GitLab issue by its number, use the URL https://
+gitlab.isc.org/isc-projects/bind9/issues/NNN. To look up a merge request,
+use https://gitlab.isc.org/isc-projects/bind9/merge_requests/NNN.
+
+In rare cases, an issue or merge request number may be followed with the
+letter "P". This indicates that the information is in the private ISC
+GitLab instance, which is not visible to the public.
+
 Acknowledgments
 
   * The original development of BIND 9 was underwritten by the following
     organizations:
 
-    Sun Microsystems, Inc.
-    Hewlett Packard
-    Compaq Computer Corporation
-    IBM
-    Process Software Corporation
-    Silicon Graphics, Inc.
-    Network Associates, Inc.
-    U.S. Defense Information Systems Agency
-    USENIX Association
-    Stichting NLnet - NLnet Foundation
-    Nominum, Inc.
+      Sun Microsystems, Inc.
+      Hewlett Packard
+      Compaq Computer Corporation
+      IBM
+      Process Software Corporation
+      Silicon Graphics, Inc.
+      Network Associates, Inc.
+      U.S. Defense Information Systems Agency
+      USENIX Association
+      Stichting NLnet - NLnet Foundation
+      Nominum, Inc.
 
   * This product includes software developed by the OpenSSL Project for
     use in the OpenSSL Toolkit. http://www.OpenSSL.org/
+
   * This product includes cryptographic software written by Eric Young
     (eay@cryptsoft.com)
+
   * This product includes software written by Tim Hudson
     (tjh@cryptsoft.com)

README.md

@@ -48,9 +48,9 @@ versions 4 and 8.  Internet Systems Consortium
 corporation dedicated to providing software and services in support of the
 Internet infrastructure, developed BIND 9 and is responsible for its
 ongoing maintenance and improvement.  BIND is open source software
-licenced under the terms of ISC License for all versions up to and
+licensed under the terms of ISC License for all versions up to and
 including BIND 9.10, and the Mozilla Public License version 2.0 for all
-subsequent verisons.
+subsequent versions.
 
 For a summary of features introduced in past major releases of BIND,
 see the file [HISTORY](HISTORY.md).
@@ -82,6 +82,9 @@ assertion failure or other crash in `named`, please do *NOT* use GitLab to
 report it. Instead, please send mail to
 [security-officer@isc.org](mailto:security-officer@isc.org).
 
+For a general overview of ISC security policies, read the Knowledge Base
+article at [https://kb.isc.org/docs/aa-00861](https://kb.isc.org/docs/aa-00861).
+
 Professional support and training for BIND are available from
 ISC at [https://www.isc.org/support](https://www.isc.org/support).
 
@@ -103,7 +106,7 @@ Information for BIND contributors can be found in the following files:
 - BIND architecture and developer guide: [doc/dev/dev.md](doc/dev/dev.md)
 
 Patches for BIND may be submitted as
-[Merge Requests](https://gitlab.isc.org/isc-projects/bind9/merge_requests)
+[merge requests](https://gitlab.isc.org/isc-projects/bind9/merge_requests)
 in the [ISC GitLab server](https://gitlab.isc.org) at
 at [https://gitlab.isc.org/isc-projects/bind9/merge_requests](https://gitlab.isc.org/isc-projects/bind9/merge_requests).
 
@@ -146,7 +149,7 @@ releases.  New features include:
       `fetches-per-server`, this value is not self-tuning.)
     * New stats counters have been added to count queries spilled due to
       these quotas.
-* Added a new `dnssec-keymgr` key mainenance utility, which can generate or
+* Added a new `dnssec-keymgr` key maintenance utility, which can generate or
   update keys as needed to ensure that a zone's keys match a defined DNSSEC
   policy.
 * The experimental "SIT" feature in BIND 9.10 has been renamed "COOKIE" and
@@ -265,7 +268,9 @@ disclosed in CVE-2017-3145.
 #### BIND 9.11.4
 
 BIND 9.11.4 is a maintenance release, and addresses the security flaw
-disclosed in CVE-2018-5738.
+disclosed in CVE-2018-5738. It also introduces "root key sentinel" support,
+enabling validating resolvers to indicate via a special query which trust
+anchors are configured for the root zone.
 
 #### BIND 9.11.5
 
@@ -280,18 +285,48 @@ feature:
 #### BIND 9.11.6
 
 BIND 9.11.6 is a maintenance release, and also addresses the security
-flaws disclosed in CVE-2018-5744, CVE-2018-5745, and CVE-2019-6465.
+flaws disclosed in CVE-2018-5743, CVE-2018-5745, CVE-2018-5744,
+and CVE-2019-6465.
+
+#### BIND 9.11.7
+
+BIND 9.11.7 is a maintenance release, and also addresses the security
+flaw disclosed in CVE-2018-5743.
+
+#### BIND 9.11.8
+
+BIND 9.11.8 is a maintenance release, and also addresses the security
+flaw disclosed in CVE-2019-6471.
+
+#### BIND 9.11.9
+
+BIND 9.11.9 is a maintenance release, and also adds support for
+the new MaxMind GeoIP2 geolocation API when built with
+`configure --with-geoip2`.
+
+#### BIND 9.11.10
+
+BIND 9.11.10 is a maintenance release.
+
+#### BIND 9.11.11
+
+BIND 9.11.11 is a maintenance release.
+
+#### BIND 9.11.12
+
+BIND 9.11.12 is a maintenance release.
 
 ### <a name="build"/> Building BIND
 
-BIND requires a UNIX or Linux system with an ANSI C compiler, basic POSIX
-support, and a 64-bit integer type. Successful builds have been observed on
-many versions of Linux and UNIX, including RedHat, Fedora, Debian, Ubuntu,
-SuSE, Slackware, FreeBSD, NetBSD, OpenBSD, Mac OS X, Solaris, HP-UX, AIX,
-SCO OpenServer, and OpenWRT. 
+Minimally, BIND requires a UNIX or Linux system with an ANSI C compiler,
+basic POSIX support, and a 64-bit integer type. Successful builds have been
+observed on many versions of Linux and UNIX, including RHEL/CentOS, Fedora,
+Debian, Ubuntu, SLES, openSUSE, Slackware, Alpine, FreeBSD, NetBSD,
+OpenBSD, macOS, Solaris, OpenIndiana, OmniOS CE, HP-UX, and OpenWRT.
 
-BIND is also available for Windows XP, 2003, 2008, and higher.  See
-`win32utils/readme1st.txt` for details on building for Windows systems.
+BIND is also available for Windows Server 2008 and higher.  See
+`win32utils/build.txt` for details on building for Windows
+systems.
 
 To build on a UNIX or Linux system, use:
 
@@ -312,26 +347,24 @@ affect compilation:
 |`STD_CDEFINES`|Any additional preprocessor symbols you want defined.  Defaults to empty string. For a list of possible settings, see the file [OPTIONS](OPTIONS.md).|
 |`LDFLAGS`|Linker flags. Defaults to empty string.|
 |`BUILD_CC`|Needed when cross-compiling: the native C compiler to use when building for the target system.|
-|`BUILD_CFLAGS`|Optional, used for cross-compiling|
-|`BUILD_CPPFLAGS`||
-|`BUILD_LDFLAGS`||
-|`BUILD_LIBS`||
+|`BUILD_CFLAGS`|`CFLAGS` for the target system during cross-compiling.|
+|`BUILD_CPPFLAGS`|`CPPFLAGS` for the target system during cross-compiling.|
+|`BUILD_LDFLAGS`|`LDFLAGS` for the target system during cross-compiling.|
+|`BUILD_LIBS`|`LIBS` for the target system during cross-compiling.|
 
 #### <a name="macos"> macOS
 
 Building on macOS assumes that the "Command Tools for Xcode" is installed.
-This can be downloaded from https://developer.apple.com/download/more/
-or if you have Xcode already installed you can run "xcode-select --install".
-This will add /usr/include to the system and install the compiler and other
-tools so that they can be easily found.
+This can be downloaded from [https://developer.apple.com/download/more/](https://developer.apple.com/download/more/)
+or if you have Xcode already installed you can run `xcode-select --install`.
 
 ### <a name="dependencies"/> Dependencies
 
 Portions of BIND that are written in Python, including
 `dnssec-keymgr`, `dnssec-coverage`, `dnssec-checkds`, and some of the
-system tests, require the 'argparse' and 'ply' modules to be available.
-'argparse' is a standard module as of Python 2.7 and Python 3.2.
-'ply' is available from [https://pypi.python.org/pypi/ply](https://pypi.python.org/pypi/ply).
+system tests, require the `argparse` and `ply` modules to be available.
+`argparse` is a standard module as of Python 2.7 and Python 3.2.
+`ply` is available from [https://pypi.python.org/pypi/ply](https://pypi.python.org/pypi/ply).
 
 #### <a name="opts"/> Compile-time options
 
@@ -353,34 +386,36 @@ command line.
 For the server to support DNSSEC, you need to build it with crypto support.
 To use OpenSSL, you should have OpenSSL 1.0.2e or newer installed.  If the
 OpenSSL library is installed in a nonstandard location, specify the prefix
-using "--with-openssl=&lt;PREFIX&gt;" on the configure command line. To use a
+using `--with-openssl=<PREFIX>` on the configure command line. To use a
 PKCS#11 hardware service module for cryptographic operations, specify the
-path to the PKCS#11 provider library using "--with-pkcs11=&lt;PREFIX&gt;", and
+path to the PKCS#11 provider library using `--with-pkcs11=<PREFIX>`, and
 configure BIND with "--enable-native-pkcs11".
 
 To support the HTTP statistics channel, the server must be linked with at
-least one of the following: libxml2
-[http://xmlsoft.org](http://xmlsoft.org) or json-c
-[https://github.com/json-c](https://github.com/json-c).  If these are
-installed at a nonstandard location, specify the prefix using
-`--with-libxml2=/prefix` or `--with-libjson=/prefix`.
+least one of the following libraries: `libxml2`
+[http://xmlsoft.org](http://xmlsoft.org) or `json-c`
+[https://github.com/json-c/json-c](https://github.com/json-c/json-c).
+If these are installed at a nonstandard location, then:
+
+* for `libxml2`, specify the prefix using `--with-libxml2=/prefix`,
+* for `json-c`, adjust `PKG_CONFIG_PATH`.
 
 To support compression on the HTTP statistics channel, the server must be
-linked against libzlib.  If this is installed in a nonstandard location,
+linked against `libzlib`.  If this is installed in a nonstandard location,
 specify the prefix using `--with-zlib=/prefix`.
 
 To support storing configuration data for runtime-added zones in an LMDB
 database, the server must be linked with liblmdb. If this is installed in a
-nonstandard location, specify the prefix using "with-lmdb=/prefix".
+nonstandard location, specify the prefix using `with-lmdb=/prefix`.
 
 To support GeoIP location-based ACLs, the server must be linked with
 libGeoIP. This is not turned on by default; BIND must be configured with
 "--with-geoip". If the library is installed in a nonstandard location, use
 specify the prefix using "--with-geoip=/prefix".
 
-For DNSTAP packet logging, you must have installed libfstrm
+For DNSTAP packet logging, you must have installed `libfstrm`
 [https://github.com/farsightsec/fstrm](https://github.com/farsightsec/fstrm)
-and libprotobuf-c
+and `libprotobuf-c`
 [https://developers.google.com/protocol-buffers](https://developers.google.com/protocol-buffers),
 and BIND must be configured with `--enable-dnstap`.
 
@@ -428,20 +463,21 @@ multiple servers to run locally and communicate with one another).  These
 IP addresses can be configured by running the command
 `bin/tests/system/ifconfig.sh up` as root.
 
-Some tests require Perl and the Net::DNS and/or IO::Socket::INET6 modules,
+Some tests require Perl and the `Net::DNS` and/or `IO::Socket::INET6` modules,
 and will be skipped if these are not available. Some tests require Python
-and the 'dnspython' module and will be skipped if these are not available.
+and the `dnspython` module and will be skipped if these are not available.
 See bin/tests/system/README for further details.
 
-Unit tests are implemented using the CMocka unit testing framework.
+Unit tests are implemented using the [CMocka unit testing framework](https://cmocka.org/).
 To build them, use `configure --with-cmocka`. Execution of tests is done
-by the Kyua test execution engine; if the `kyua` command is available,
-then unit tests can be run via `make test` or `make unit`.
+by the [Kyua test execution engine](https://github.com/jmmv/kyua); if the
+`kyua` command is available, then unit tests can be run via `make test`
+or `make unit`.
 
 ### <a name="doc"/> Documentation
 
 The *BIND 9 Administrator Reference Manual* is included with the source
-distribution, in DocBook XML, HTML and PDF format, in the `doc/arm`
+distribution, in DocBook XML, HTML, and PDF format, in the `doc/arm`
 directory.
 
 Some of the programs in the BIND 9 distribution have man pages in their
@@ -484,6 +520,25 @@ releases (i.e., those with version numbers ending in zero).  Some new
 functionality may be backported to older releases on a case-by-case basis.
 All other change types may be applied to all currently-supported releases.
 
+#### Bug report identifiers
+
+Most notes in the CHANGES file include a reference to a bug report or
+issue number. Prior to 2018, these were usually of the form `[RT #NNN]`
+and referred to entries in the "bind9-bugs" RT database, which was not open
+to the public. More recent entries use the form `[GL #NNN]` or, less often,
+`[GL !NNN]`, which, respectively, refer to issues or merge requests in the
+GitLab database. Most of these are publicly readable, unless they include
+information which is confidential or security sensitive.
+
+To look up a GitLab issue by its number, use the URL
+[https://gitlab.isc.org/isc-projects/bind9/issues/NNN](https://gitlab.isc.org/isc-projects/bind9/issues).
+To look up a merge request, use
+[https://gitlab.isc.org/isc-projects/bind9/merge_requests/NNN](https://gitlab.isc.org/isc-projects/bind9/merge_requests).
+
+In rare cases, an issue or merge request number may be followed with the
+letter "P". This indicates that the information is in the private ISC
+GitLab instance, which is not visible to the public.
+
 ### <a name="ack"/> Acknowledgments
 
 * The original development of BIND 9 was underwritten by the

aclocal.m4

@@ -288,6 +288,8 @@ AS_VAR_COPY([$1], [pkg_cv_][$1])
 AS_VAR_IF([$1], [""], [$5], [$4])dnl
 ])dnl PKG_CHECK_VAR
 
+m4_include([libtool.m4/ax_restore_flags.m4])
+m4_include([libtool.m4/ax_save_flags.m4])
 m4_include([libtool.m4/libtool.m4])
 m4_include([libtool.m4/ltoptions.m4])
 m4_include([libtool.m4/ltsugar.m4])

bin/check/Makefile.in

@@ -7,8 +7,6 @@
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.
 
-# $Id: Makefile.in,v 1.36 2009/12/05 23:31:40 each Exp $
-
 srcdir =	@srcdir@
 VPATH =		@srcdir@
 top_srcdir =	@top_srcdir@
@@ -23,7 +21,7 @@ CINCLUDES =	${BIND9_INCLUDES} ${DNS_INCLUDES} ${ISCCFG_INCLUDES} \
 CDEFINES = 	@CRYPTO@ -DNAMED_CONFFILE=\"${sysconfdir}/named.conf\"
 CWARNINGS =
 
-DNSLIBS =	../../lib/dns/libdns.@A@ @DNS_CRYPTO_LIBS@
+DNSLIBS =	../../lib/dns/libdns.@A@ ${MAXMINDDB_LIBS} @DNS_CRYPTO_LIBS@
 ISCCFGLIBS =	../../lib/isccfg/libisccfg.@A@
 ISCLIBS =	../../lib/isc/libisc.@A@
 ISCNOSYMLIBS =	../../lib/isc/libisc-nosymtbl.@A@

bin/check/win32/checkconf.vcxproj.in

@@ -1,5 +1,5 @@
 <?xml version="1.0" encoding="utf-8"?>
-<Project DefaultTargets="Build" ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+<Project DefaultTargets="Build" ToolsVersion="@TOOLS_VERSION@" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
   <ItemGroup Label="ProjectConfigurations">
     <ProjectConfiguration Include="Debug|@PLATFORM@">
       <Configuration>Debug</Configuration>
@@ -14,18 +14,21 @@
     <ProjectGuid>{03A96113-CB14-43AA-AEB2-48950E3915C5}</ProjectGuid>
     <Keyword>Win32Proj</Keyword>
     <RootNamespace>checkconf</RootNamespace>
+    @WINDOWS_TARGET_PLATFORM_VERSION@
   </PropertyGroup>
   <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|@PLATFORM@'" Label="Configuration">
     <ConfigurationType>Application</ConfigurationType>
     <UseDebugLibraries>true</UseDebugLibraries>
     <CharacterSet>MultiByte</CharacterSet>
+    @PLATFORM_TOOLSET@
   </PropertyGroup>
   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'" Label="Configuration">
     <ConfigurationType>Application</ConfigurationType>
     <UseDebugLibraries>false</UseDebugLibraries>
     <WholeProgramOptimization>true</WholeProgramOptimization>
     <CharacterSet>MultiByte</CharacterSet>
+    @PLATFORM_TOOLSET@
   </PropertyGroup>
   <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
   <ImportGroup Label="ExtensionSettings">

bin/check/win32/checktool.vcxproj.in

@@ -1,5 +1,5 @@
 <?xml version="1.0" encoding="utf-8"?>
-<Project DefaultTargets="Build" ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+<Project DefaultTargets="Build" ToolsVersion="@TOOLS_VERSION@" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
   <ItemGroup Label="ProjectConfigurations">
     <ProjectConfiguration Include="Debug|@PLATFORM@">
       <Configuration>Debug</Configuration>
@@ -17,18 +17,21 @@
     <ProjectGuid>{2C1F7096-C5B5-48D4-846F-A7ACA454335D}</ProjectGuid>
     <Keyword>Win32Proj</Keyword>
     <RootNamespace>checktool</RootNamespace>
+    @WINDOWS_TARGET_PLATFORM_VERSION@
   </PropertyGroup>
   <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|@PLATFORM@'" Label="Configuration">
     <ConfigurationType>StaticLibrary</ConfigurationType>
     <UseDebugLibraries>true</UseDebugLibraries>
     <CharacterSet>MultiByte</CharacterSet>
+    @PLATFORM_TOOLSET@
   </PropertyGroup>
   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'" Label="Configuration">
     <ConfigurationType>StaticLibrary</ConfigurationType>
     <UseDebugLibraries>false</UseDebugLibraries>
     <WholeProgramOptimization>true</WholeProgramOptimization>
     <CharacterSet>MultiByte</CharacterSet>
+    @PLATFORM_TOOLSET@
   </PropertyGroup>
   <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
   <ImportGroup Label="ExtensionSettings">

bin/check/win32/checkzone.vcxproj.in

@@ -1,5 +1,5 @@
 <?xml version="1.0" encoding="utf-8"?>
-<Project DefaultTargets="Build" ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+<Project DefaultTargets="Build" ToolsVersion="@TOOLS_VERSION@" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
   <ItemGroup Label="ProjectConfigurations">
     <ProjectConfiguration Include="Debug|@PLATFORM@">
       <Configuration>Debug</Configuration>
@@ -14,18 +14,21 @@
     <ProjectGuid>{66028555-7DD5-4016-B601-9EF9A1EE8BFA}</ProjectGuid>
     <Keyword>Win32Proj</Keyword>
     <RootNamespace>checkzone</RootNamespace>
+    @WINDOWS_TARGET_PLATFORM_VERSION@
   </PropertyGroup>
   <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|@PLATFORM@'" Label="Configuration">
     <ConfigurationType>Application</ConfigurationType>
     <UseDebugLibraries>true</UseDebugLibraries>
     <CharacterSet>MultiByte</CharacterSet>
+    @PLATFORM_TOOLSET@
   </PropertyGroup>
   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'" Label="Configuration">
     <ConfigurationType>Application</ConfigurationType>
     <UseDebugLibraries>false</UseDebugLibraries>
     <WholeProgramOptimization>true</WholeProgramOptimization>
     <CharacterSet>MultiByte</CharacterSet>
+    @PLATFORM_TOOLSET@
   </PropertyGroup>
   <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
   <ImportGroup Label="ExtensionSettings">
@@ -62,15 +65,15 @@
       <ObjectFileName>.\$(Configuration)\</ObjectFileName>
       <ProgramDataBaseFileName>$(OutDir)$(TargetName).pdb</ProgramDataBaseFileName>
       <BrowseInformation>true</BrowseInformation>
-      <AdditionalIncludeDirectories>.\;..\..\..\;@LIBXML2_INC@@OPENSSL_INC@..\..\..\lib\isc\win32;..\..\..\lib\isc\win32\include;..\..\..\lib\isc\include;..\..\..\lib\dns\include;..\..\..\lib\bind9\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+      <AdditionalIncludeDirectories>.\;..\..\..\;@LIBXML2_INC@@OPENSSL_INC@..\..\..\lib\isc\win32;..\..\..\lib\isc\win32\include;..\..\..\lib\isc\include;..\..\..\lib\dns\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
       <CompileAs>CompileAsC</CompileAs>
     </ClCompile>
     <Link>
       <SubSystem>Console</SubSystem>
       <GenerateDebugInformation>true</GenerateDebugInformation>
       <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);..\..\..\lib\isccfg\win32\$(Configuration);..\..\..\lib\bind9\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>checktool.lib;libisc.lib;libdns.lib;libisccfg.lib;libbind9.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);..\..\..\lib\isccfg\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
+      <AdditionalDependencies>checktool.lib;libisc.lib;libdns.lib;libisccfg.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
     </Link>
     <PostBuildEvent>
       <Command>cd ..\..\..\Build\$(Configuration)
@@ -95,7 +98,7 @@ copy /Y named-checkzone.ilk named-compilezone.ilk
       <AssemblerListingLocation>.\$(Configuration)\</AssemblerListingLocation>
       <ObjectFileName>.\$(Configuration)\</ObjectFileName>
       <ProgramDataBaseFileName>$(OutDir)$(TargetName).pdb</ProgramDataBaseFileName>
-      <AdditionalIncludeDirectories>.\;..\..\..\;@LIBXML2_INC@@OPENSSL_INC@..\..\..\lib\isc\win32;..\..\..\lib\isc\win32\include;..\..\..\lib\isc\include;..\..\..\lib\dns\include;..\..\..\lib\bind9\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+      <AdditionalIncludeDirectories>.\;..\..\..\;@LIBXML2_INC@@OPENSSL_INC@..\..\..\lib\isc\win32;..\..\..\lib\isc\win32\include;..\..\..\lib\isc\include;..\..\..\lib\dns\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
       <CompileAs>CompileAsC</CompileAs>
     </ClCompile>
     <Link>
@@ -104,8 +107,8 @@ copy /Y named-checkzone.ilk named-compilezone.ilk
       <EnableCOMDATFolding>true</EnableCOMDATFolding>
       <OptimizeReferences>true</OptimizeReferences>
       <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);..\..\..\lib\isccfg\win32\$(Configuration);..\..\..\lib\bind9\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>checktool.lib;libisc.lib;libdns.lib;libisccfg.lib;libbind9.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);..\..\..\lib\isccfg\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
+      <AdditionalDependencies>checktool.lib;libisc.lib;libdns.lib;libisccfg.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
       <LinkTimeCodeGeneration>Default</LinkTimeCodeGeneration>
     </Link>
     <PostBuildEvent>

bin/confgen/Makefile.in

@@ -7,8 +7,6 @@
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.
 
-# $Id: Makefile.in,v 1.8 2009/12/05 23:31:40 each Exp $
-
 srcdir =	@srcdir@
 VPATH =		@srcdir@
 top_srcdir =	@top_srcdir@
@@ -31,7 +29,7 @@ ISCCFGLIBS =	../../lib/isccfg/libisccfg.@A@
 ISCCCLIBS =	../../lib/isccc/libisccc.@A@
 ISCLIBS =	../../lib/isc/libisc.@A@
 ISCNOSYMLIBS =	../../lib/isc/libisc-nosymtbl.@A@
-DNSLIBS =	../../lib/dns/libdns.@A@ @DNS_CRYPTO_LIBS@
+DNSLIBS =	../../lib/dns/libdns.@A@ ${MAXMINDDB_LIBS} @DNS_CRYPTO_LIBS@
 BIND9LIBS =	../../lib/bind9/libbind9.@A@
 
 ISCCFGDEPLIBS =	../../lib/isccfg/libisccfg.@A@

bin/confgen/win32/confgentool.vcxproj.in

@@ -1,5 +1,5 @@
 <?xml version="1.0" encoding="utf-8"?>
-<Project DefaultTargets="Build" ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+<Project DefaultTargets="Build" ToolsVersion="@TOOLS_VERSION@" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
   <ItemGroup Label="ProjectConfigurations">
     <ProjectConfiguration Include="Debug|@PLATFORM@">
       <Configuration>Debug</Configuration>
@@ -14,18 +14,21 @@
     <ProjectGuid>{64964B03-4815-41F0-9057-E766A94AF197}</ProjectGuid>
     <Keyword>Win32Proj</Keyword>
     <RootNamespace>confgentool</RootNamespace>
+    @WINDOWS_TARGET_PLATFORM_VERSION@
   </PropertyGroup>
   <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|@PLATFORM@'" Label="Configuration">
     <ConfigurationType>StaticLibrary</ConfigurationType>
     <UseDebugLibraries>true</UseDebugLibraries>
     <CharacterSet>MultiByte</CharacterSet>
+    @PLATFORM_TOOLSET@
   </PropertyGroup>
   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'" Label="Configuration">
     <ConfigurationType>StaticLibrary</ConfigurationType>
     <UseDebugLibraries>false</UseDebugLibraries>
     <WholeProgramOptimization>true</WholeProgramOptimization>
     <CharacterSet>MultiByte</CharacterSet>
+    @PLATFORM_TOOLSET@
   </PropertyGroup>
   <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
   <ImportGroup Label="ExtensionSettings">

bin/confgen/win32/ddnsconfgen.vcxproj.in

@@ -1,5 +1,5 @@
 <?xml version="1.0" encoding="utf-8"?>
-<Project DefaultTargets="Build" ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+<Project DefaultTargets="Build" ToolsVersion="@TOOLS_VERSION@" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
   <ItemGroup Label="ProjectConfigurations">
     <ProjectConfiguration Include="Debug|@PLATFORM@">
       <Configuration>Debug</Configuration>
@@ -14,18 +14,21 @@
     <ProjectGuid>{1EA4FC64-F33B-4A50-970A-EA052BBE9CF1}</ProjectGuid>
     <Keyword>Win32Proj</Keyword>
     <RootNamespace>ddnsconfgen</RootNamespace>
+    @WINDOWS_TARGET_PLATFORM_VERSION@
   </PropertyGroup>
   <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|@PLATFORM@'" Label="Configuration">
     <ConfigurationType>Application</ConfigurationType>
     <UseDebugLibraries>true</UseDebugLibraries>
     <CharacterSet>MultiByte</CharacterSet>
+    @PLATFORM_TOOLSET@
   </PropertyGroup>
   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'" Label="Configuration">
     <ConfigurationType>Application</ConfigurationType>
     <UseDebugLibraries>false</UseDebugLibraries>
     <WholeProgramOptimization>true</WholeProgramOptimization>
     <CharacterSet>MultiByte</CharacterSet>
+    @PLATFORM_TOOLSET@
   </PropertyGroup>
   <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
   <ImportGroup Label="ExtensionSettings">

bin/confgen/win32/rndcconfgen.vcxproj.in

@@ -1,5 +1,5 @@
 <?xml version="1.0" encoding="utf-8"?>
-<Project DefaultTargets="Build" ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+<Project DefaultTargets="Build" ToolsVersion="@TOOLS_VERSION@" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
   <ItemGroup Label="ProjectConfigurations">
     <ProjectConfiguration Include="Debug|@PLATFORM@">
       <Configuration>Debug</Configuration>
@@ -14,18 +14,21 @@
     <ProjectGuid>{1E2C1635-3093-4D59-80E7-4743AC10F22F}</ProjectGuid>
     <Keyword>Win32Proj</Keyword>
     <RootNamespace>rndcconfgen</RootNamespace>
+    @WINDOWS_TARGET_PLATFORM_VERSION@
   </PropertyGroup>
   <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|@PLATFORM@'" Label="Configuration">
     <ConfigurationType>Application</ConfigurationType>
     <UseDebugLibraries>true</UseDebugLibraries>
     <CharacterSet>MultiByte</CharacterSet>
+    @PLATFORM_TOOLSET@
   </PropertyGroup>
   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'" Label="Configuration">
     <ConfigurationType>Application</ConfigurationType>
     <UseDebugLibraries>false</UseDebugLibraries>
     <WholeProgramOptimization>true</WholeProgramOptimization>
     <CharacterSet>MultiByte</CharacterSet>
+    @PLATFORM_TOOLSET@
   </PropertyGroup>
   <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
   <ImportGroup Label="ExtensionSettings">

bin/delv/Makefile.in

@@ -23,7 +23,7 @@ CDEFINES =	@CRYPTO@ -DVERSION=\"${VERSION}\" \
 CWARNINGS =
 
 ISCCFGLIBS =	../../lib/isccfg/libisccfg.@A@
-DNSLIBS =	../../lib/dns/libdns.@A@ @DNS_CRYPTO_LIBS@
+DNSLIBS =	../../lib/dns/libdns.@A@ ${MAXMINDDB_LIBS} @DNS_CRYPTO_LIBS@
 ISCNOSYMLIBS =	../../lib/isc/libisc-nosymtbl.@A@
 ISCLIBS =	../../lib/isc/libisc.@A@
 IRSLIBS =	../../lib/irs/libirs.@A@

bin/delv/win32/delv.vcxproj.in

@@ -1,5 +1,5 @@
 <?xml version="1.0" encoding="utf-8"?>
-<Project DefaultTargets="Build" ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+<Project DefaultTargets="Build" ToolsVersion="@TOOLS_VERSION@" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
   <ItemGroup Label="ProjectConfigurations">
     <ProjectConfiguration Include="Debug|@PLATFORM@">
       <Configuration>Debug</Configuration>
@@ -14,18 +14,21 @@
     <ProjectGuid>{BE172EFE-C1DC-4812-BFB9-8C5F8ADB7E9F}</ProjectGuid>
     <Keyword>Win32Proj</Keyword>
     <RootNamespace>delv</RootNamespace>
+    @WINDOWS_TARGET_PLATFORM_VERSION@
   </PropertyGroup>
   <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|@PLATFORM@'" Label="Configuration">
     <ConfigurationType>Application</ConfigurationType>
     <UseDebugLibraries>true</UseDebugLibraries>
     <CharacterSet>MultiByte</CharacterSet>
+    @PLATFORM_TOOLSET@
   </PropertyGroup>
   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'" Label="Configuration">
     <ConfigurationType>Application</ConfigurationType>
     <UseDebugLibraries>false</UseDebugLibraries>
     <WholeProgramOptimization>true</WholeProgramOptimization>
     <CharacterSet>MultiByte</CharacterSet>
+    @PLATFORM_TOOLSET@
   </PropertyGroup>
   <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
   <ImportGroup Label="ExtensionSettings">

bin/dig/Makefile.in

@@ -25,7 +25,7 @@ CDEFINES =	-DVERSION=\"${VERSION}\" @CRYPTO@
 CWARNINGS =
 
 ISCCFGLIBS =	../../lib/isccfg/libisccfg.@A@
-DNSLIBS =	../../lib/dns/libdns.@A@ @DNS_CRYPTO_LIBS@
+DNSLIBS =	../../lib/dns/libdns.@A@ ${MAXMINDDB_LIBS} @DNS_CRYPTO_LIBS@
 BIND9LIBS =	../../lib/bind9/libbind9.@A@
 ISCLIBS =	../../lib/isc/libisc.@A@
 ISCNOSYMLIBS =	../../lib/isc/libisc-nosymtbl.@A@

bin/dig/dig.1

@@ -368,14 +368,20 @@ Display [do not display] the CLASS when printing the record\&.
 .PP
 \fB+[no]cmd\fR
 .RS 4
-Toggles the printing of the initial comment in the output identifying the version of
+Toggles the printing of the initial comment in the output, identifying the version of
 \fBdig\fR
-and the query options that have been applied\&. This comment is printed by default\&.
+and the query options that have been applied\&. This option always has global effect; it cannot be set globally and then overridden on a per\-lookup basis\&. The default is to print this comment\&.
 .RE
 .PP
 \fB+[no]comments\fR
 .RS 4
-Toggle the display of comment lines in the output\&. The default is to print comments\&.
+Toggles the display of some comment lines in the output, containing information about the packet header and OPT pseudosection, and the names of the response section\&. The default is to print these comments\&.
+.sp
+Other types of comments in the output are not affected by this option, but can be controlled using other command line switches\&. These include
+\fB+[no]cmd\fR,
+\fB+[no]question\fR,
+\fB+[no]stats\fR, and
+\fB+[no]rrcomments\fR\&.
 .RE
 .PP
 \fB+[no]cookie\fR\fB[=####]\fR
@@ -554,12 +560,12 @@ Set [restore] the DNS message opcode to the specified value\&. The default value
 .PP
 \fB+[no]qr\fR
 .RS 4
-Print [do not print] the query as it is sent\&. By default, the query is not printed\&.
+Toggles the display of the query message as it is sent\&. By default, the query is not printed\&.
 .RE
 .PP
 \fB+[no]question\fR
 .RS 4
-Print [do not print] the question section of a query when an answer is returned\&. The default is to print the question section as a comment\&.
+Toggles the display of the question section of a query when an answer is returned\&. The default is to print the question section as a comment\&.
 .RE
 .PP
 \fB+[no]rdflag\fR
@@ -572,11 +578,11 @@ A synonym for
 .RS 4
 Toggle the setting of the RD (recursion desired) bit in the query\&. This bit is set by default, which means
 \fBdig\fR
-normally sends recursive queries\&. Recursion is automatically disabled when the
+normally sends recursive queries\&. Recursion is automatically disabled when using the
 \fI+nssearch\fR
-or
+option, and when using
 \fI+trace\fR
-query options are used\&.
+except for an initial recursive query to get the list of root servers\&.
 .RE
 .PP
 \fB+retry=T\fR
@@ -607,7 +613,7 @@ determines if the name will be treated as relative or not and hence whether a se
 .PP
 \fB+[no]short\fR
 .RS 4
-Provide a terse answer\&. The default is to print the answer in a verbose form\&.
+Provide a terse answer\&. The default is to print the answer in a verbose form\&. This option always has global effect; it cannot be set globally and then overridden on a per\-lookup basis\&.
 .RE
 .PP
 \fB+[no]showsearch\fR
@@ -637,7 +643,7 @@ causes fields not to be split at all\&. The default is 56 characters, or 44 char
 .PP
 \fB+[no]stats\fR
 .RS 4
-This query option toggles the printing of statistics: when the query was made, the size of the reply and so on\&. The default behavior is to print the query statistics\&.
+Toggles the printing of statistics: when the query was made, the size of the reply and so on\&. The default behavior is to print the query statistics as a comment after each lookup\&.
 .RE
 .PP
 \fB+[no]subnet=addr[/prefix\-length]\fR

bin/dig/dig.c

@@ -176,11 +176,13 @@ help(void) {
 "                 +bufsize=###        (Set EDNS0 Max UDP packet size)\n"
 "                 +[no]cdflag         (Set checking disabled flag in query)\n"
 "                 +[no]class          (Control display of class in records)\n"
-"                 +[no]cmd            (Control display of command line)\n"
-"                 +[no]comments       (Control display of comment lines)\n"
+"                 +[no]cmd            (Control display of command line -\n"
+"                                      global option)\n"
+"                 +[no]comments       (Control display of packet header\n"
+"                                      and section name comments)\n"
 "                 +[no]cookie         (Add a COOKIE option to the request)\n"
-"                 +[no]crypto         (Control display of cryptographic "
-				       "fields in records)\n"
+"                 +[no]crypto         (Control display of cryptographic\n"
+"                                      fields in records)\n"
 "                 +[no]defname        (Use search list (+[no]search))\n"
 "                 +[no]dnssec         (Request DNSSEC records)\n"
 "                 +domain=###         (Set default domainname)\n"
@@ -196,10 +198,12 @@ help(void) {
 "                 +[no]identify       (ID responders in short answers)\n"
 #ifdef HAVE_LIBIDN2
 "                 +[no]idnin          (Parse IDN names [default=on on tty])\n"
-"                 +[no]idnout         (Convert IDN response [default=on on tty])\n"
+"                 +[no]idnout         (Convert IDN response "
+					"[default=on on tty])\n"
 #endif
 "                 +[no]ignore         (Don't revert to TCP for TC responses.)\n"
-"                 +[no]keepopen       (Keep the TCP socket open between queries)\n"
+"                 +[no]keepopen       (Keep the TCP socket open between "
+					"queries)\n"
 "                 +[no]mapped         (Allow mapped IPv4 over IPv6)\n"
 "                 +[no]multiline      (Print records in an expanded format)\n"
 "                 +ndots=###          (Set search NDOTS value)\n"
@@ -216,7 +220,7 @@ help(void) {
 					"comments)\n"
 "                 +[no]search         (Set whether to use searchlist)\n"
 "                 +[no]short          (Display nothing except short\n"
-"                                      form of answer)\n"
+"                                      form of answers - global option)\n"
 "                 +[no]showsearch     (Search with intermediate results)\n"
 #ifdef DIG_SIGCHASE
 "                 +[no]sigchase       (Chase DNSSEC signatures)\n"
@@ -229,14 +233,16 @@ help(void) {
 #if defined(DIG_SIGCHASE) && DIG_SIGCHASE_TD
 "                 +[no]topdown        (Do +sigchase in top-down mode)\n"
 #endif
-"                 +[no]trace          (Trace delegation down from root [+dnssec])\n"
+"                 +[no]trace          (Trace delegation down from root "
+					"[+dnssec])\n"
 #ifdef DIG_SIGCHASE
 "                 +trusted-key=####   (Trusted Key to use with +sigchase)\n"
 #endif
 "                 +tries=###          (Set number of UDP attempts) [3]\n"
 "                 +[no]ttlid          (Control display of ttls in records)\n"
 "                 +[no]ttlunits       (Display TTLs in human-readable units)\n"
-"                 +[no]unknownformat  (Print RDATA in RFC 3597 \"unknown\" format)\n"
+"                 +[no]unknownformat  (Print RDATA in RFC 3597 \"unknown\" "
+					"format)\n"
 "                 +[no]vc             (TCP mode (+[no]tcp))\n"
 "                 +[no]zflag          (Set Z flag in query)\n"
 "        global d-opts and servers (before host name) affect all queries.\n"
@@ -565,8 +571,9 @@ printmessage(dig_query_t *query, dns_message_t *msg, bool headers) {
 	check_result(result, "dns_master_stylecreate");
 
 	if (query->lookup->cmdline[0] != 0) {
-		if (!short_form)
+		if (!short_form && printcmd) {
 			fputs(query->lookup->cmdline, stdout);
+		}
 		query->lookup->cmdline[0]=0;
 	}
 	debug("printmessage(%s %s %s)", headers ? "headers" : "noheaders",
@@ -588,7 +595,7 @@ printmessage(dig_query_t *query, dns_message_t *msg, bool headers) {
 	check_result(result, "isc_buffer_allocate");
 
 	if (query->lookup->comments && !short_form) {
-		if (query->lookup->cmdline[0] != 0)
+		if (query->lookup->cmdline[0] != 0 && printcmd)
 			printf("; %s\n", query->lookup->cmdline);
 		if (msg == query->lookup->sendmsg)
 			printf(";; Sending:\n");
@@ -1431,7 +1438,7 @@ plus_option(const char *option, bool is_batchfile,
 				lookup->trace = state;
 				lookup->trace_root = state;
 				if (state) {
-					lookup->recurse = false;
+					lookup->recurse = true;
 					lookup->identify = true;
 					lookup->comments = false;
 					rrcomments = 0;

bin/dig/dig.docbook

@@ -605,9 +605,11 @@
 	  <listitem>
 	    <para>
 	      Toggles the printing of the initial comment in the
-	      output identifying the version of <command>dig</command>
-	      and the query options that have been applied.  This
-	      comment is printed by default.
+	      output, identifying the version of <command>dig</command>
+	      and the query options that have been applied.  This option
+	      always has global effect; it cannot be set globally
+	      and then overridden on a per-lookup basis.  The default
+	      is to print this comment.
 	    </para>
 	  </listitem>
 	</varlistentry>
@@ -616,8 +618,18 @@
 	  <term><option>+[no]comments</option></term>
 	  <listitem>
 	    <para>
-	      Toggle the display of comment lines in the output.
-	      The default is to print comments.
+	      Toggles the display of some comment lines in the output,
+	      containing information about the packet header and
+	      OPT pseudosection, and the names of the response
+	      section.  The default is to print these comments.
+	    </para>
+	    <para>
+	      Other types of comments in the output are not affected by
+	      this option, but can be controlled using other command
+	      line switches. These include <command>+[no]cmd</command>,
+	      <command>+[no]question</command>,
+	      <command>+[no]stats</command>, and
+	      <command>+[no]rrcomments</command>.
 	    </para>
 	  </listitem>
 	</varlistentry>
@@ -940,8 +952,8 @@
 	  <term><option>+[no]qr</option></term>
 	  <listitem>
 	    <para>
-	      Print [do not print] the query as it is sent.  By
-	      default, the query is not printed.
+	      Toggles the display of the query message as it is sent.
+	      By default, the query is not printed.
 	    </para>
 	  </listitem>
 	</varlistentry>
@@ -950,7 +962,7 @@
 	  <term><option>+[no]question</option></term>
 	  <listitem>
 	    <para>
-	      Print [do not print] the question section of a query
+	      Toggles the display of the question section of a query
 	      when an answer is returned.  The default is to print
 	      the question section as a comment.
 	    </para>
@@ -974,8 +986,10 @@
 	      in the query.  This bit is set by default, which means
 	      <command>dig</command> normally sends recursive
 	      queries.  Recursion is automatically disabled when
-	      the <parameter>+nssearch</parameter> or
-	      <parameter>+trace</parameter> query options are used.
+	      using the <parameter>+nssearch</parameter> option, and
+	      when using <parameter>+trace</parameter> except for
+	      an initial recursive query to get the list of root
+	      servers.
 	    </para>
 	  </listitem>
 	</varlistentry>
@@ -1028,7 +1042,9 @@
 	  <listitem>
 	    <para>
 	      Provide a terse answer.  The default is to print the
-	      answer in a verbose form.
+	      answer in a verbose form.  This option always has global
+	      effect; it cannot be set globally and then overridden on
+	      a per-lookup basis.
 	    </para>
 	  </listitem>
 	</varlistentry>
@@ -1074,10 +1090,9 @@
 	  <term><option>+[no]stats</option></term>
 	  <listitem>
 	    <para>
-	      This query option toggles the printing of statistics:
-	      when the query was made, the size of the reply and
-	      so on.  The default behavior is to print the query
-	      statistics.
+	      Toggles the printing of statistics: when the query was made,
+	      the size of the reply and so on.  The default behavior is to
+	      print the query statistics as a comment after each lookup.
 	    </para>
 	  </listitem>
 	</varlistentry>

bin/dig/dig.html

@@ -490,16 +490,28 @@
 <dd>
 	    <p>
 	      Toggles the printing of the initial comment in the
-	      output identifying the version of <span class="command"><strong>dig</strong></span>
-	      and the query options that have been applied.  This
-	      comment is printed by default.
+	      output, identifying the version of <span class="command"><strong>dig</strong></span>
+	      and the query options that have been applied.  This option
+	      always has global effect; it cannot be set globally
+	      and then overridden on a per-lookup basis.  The default
+	      is to print this comment.
 	    </p>
 	  </dd>
 <dt><span class="term"><code class="option">+[no]comments</code></span></dt>
 <dd>
 	    <p>
-	      Toggle the display of comment lines in the output.
-	      The default is to print comments.
+	      Toggles the display of some comment lines in the output,
+	      containing information about the packet header and
+	      OPT pseudosection, and the names of the response
+	      section.  The default is to print these comments.
+	    </p>
+	    <p>
+	      Other types of comments in the output are not affected by
+	      this option, but can be controlled using other command
+	      line switches. These include <span class="command"><strong>+[no]cmd</strong></span>,
+	      <span class="command"><strong>+[no]question</strong></span>,
+	      <span class="command"><strong>+[no]stats</strong></span>, and
+	      <span class="command"><strong>+[no]rrcomments</strong></span>.
 	    </p>
 	  </dd>
 <dt><span class="term"><code class="option">+[no]cookie[<span class="optional">=####</span>]</code></span></dt>
@@ -745,14 +757,14 @@
 <dt><span class="term"><code class="option">+[no]qr</code></span></dt>
 <dd>
 	    <p>
-	      Print [do not print] the query as it is sent.  By
-	      default, the query is not printed.
+	      Toggles the display of the query message as it is sent.
+	      By default, the query is not printed.
 	    </p>
 	  </dd>
 <dt><span class="term"><code class="option">+[no]question</code></span></dt>
 <dd>
 	    <p>
-	      Print [do not print] the question section of a query
+	      Toggles the display of the question section of a query
 	      when an answer is returned.  The default is to print
 	      the question section as a comment.
 	    </p>
@@ -770,8 +782,10 @@
 	      in the query.  This bit is set by default, which means
 	      <span class="command"><strong>dig</strong></span> normally sends recursive
 	      queries.  Recursion is automatically disabled when
-	      the <em class="parameter"><code>+nssearch</code></em> or
-	      <em class="parameter"><code>+trace</code></em> query options are used.
+	      using the <em class="parameter"><code>+nssearch</code></em> option, and
+	      when using <em class="parameter"><code>+trace</code></em> except for
+	      an initial recursive query to get the list of root
+	      servers.
 	    </p>
 	  </dd>
 <dt><span class="term"><code class="option">+retry=T</code></span></dt>
@@ -812,7 +826,9 @@
 <dd>
 	    <p>
 	      Provide a terse answer.  The default is to print the
-	      answer in a verbose form.
+	      answer in a verbose form.  This option always has global
+	      effect; it cannot be set globally and then overridden on
+	      a per-lookup basis.
 	    </p>
 	  </dd>
 <dt><span class="term"><code class="option">+[no]showsearch</code></span></dt>
@@ -846,10 +862,9 @@
 <dt><span class="term"><code class="option">+[no]stats</code></span></dt>
 <dd>
 	    <p>
-	      This query option toggles the printing of statistics:
-	      when the query was made, the size of the reply and
-	      so on.  The default behavior is to print the query
-	      statistics.
+	      Toggles the printing of statistics: when the query was made,
+	      the size of the reply and so on.  The default behavior is to
+	      print the query statistics as a comment after each lookup.
 	    </p>
 	  </dd>
 <dt><span class="term"><code class="option">+[no]subnet=addr[/prefix-length]</code></span></dt>

bin/dig/dighost.c

@@ -1670,6 +1670,7 @@ typedef struct dig_ednsoptname {
 } dig_ednsoptname_t;
 
 dig_ednsoptname_t optnames[] = {
+	{ 1, "LLQ" },		/* draft-sekar-dns-llq */
 	{ 3, "NSID" },		/* RFC 5001 */
 	{ 5, "DAU" },		/* RFC 6975 */
 	{ 6, "DHU" },		/* RFC 6975 */
@@ -1682,6 +1683,8 @@ dig_ednsoptname_t optnames[] = {
 	{ 12, "PAD" },		/* shorthand */
 	{ 13, "CHAIN" },	/* RFC 7901 */
 	{ 14, "KEY-TAG" },	/* RFC 8145 */
+	{ 16, "CLIENT-TAG" },	/* draft-bellis-dnsop-edns-tags */
+	{ 17, "SERVER-TAG" },	/* draft-bellis-dnsop-edns-tags */
 	{ 26946, "DEVICEID" },	/* Brian Hartvigsen */
 };
 
@@ -2540,12 +2543,14 @@ setup_lookup(dig_lookup_t *lookup) {
 	lookup->sendmsg->id = (unsigned short)id & 0xFFFF;
 	lookup->sendmsg->opcode = lookup->opcode;
 	lookup->msgcounter = 0;
+
 	/*
-	 * If this is a trace request, completely disallow recursion, since
-	 * it's meaningless for traces.
+	 * If this is a trace request, completely disallow recursion after
+	 * looking up the root name servers, since it's meaningless for traces.
 	 */
-	if (lookup->trace || (lookup->ns_search_only && !lookup->trace_root))
+	if ((lookup->trace || lookup->ns_search_only) && !lookup->trace_root) {
 		lookup->recurse = false;
+	}
 
 	if (lookup->recurse &&
 	    lookup->rdtype != dns_rdatatype_axfr &&
@@ -4860,9 +4865,20 @@ idn_ace_to_locale(const char *from, char *to, size_t tolen) {
 	 */
 	res = idn2_to_unicode_8zlz(utf8_src, &tmp_str, 0);
 	if (res != IDN2_OK) {
-		fatal("Cannot represent '%s' in the current locale (%s), "
-		      "use +noidnout or a different locale",
-		      from, idn2_strerror(res));
+		static bool warned = false;
+
+		res = idn2_to_ascii_8z(utf8_src, &tmp_str, 0);
+		if (res != IDN2_OK) {
+			fatal("Cannot represent '%s' "
+			      "in the current locale nor ascii (%s), "
+			      "use +noidnout or a different locale",
+			      from, idn2_strerror(res));
+		} else if (!warned) {
+			fprintf(stderr, ";; Warning: cannot represent '%s' "
+			      "in the current locale",
+			      tmp_str);
+			warned = true;
+		}
 	}
 
 	/*

bin/dig/win32/dig.vcxproj.in

@@ -1,5 +1,5 @@
 <?xml version="1.0" encoding="utf-8"?>
-<Project DefaultTargets="Build" ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+<Project DefaultTargets="Build" ToolsVersion="@TOOLS_VERSION@" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
   <ItemGroup Label="ProjectConfigurations">
     <ProjectConfiguration Include="Debug|@PLATFORM@">
       <Configuration>Debug</Configuration>
@@ -14,18 +14,21 @@
     <ProjectGuid>{F938F9B8-D395-4A40-BEC7-0122D289C692}</ProjectGuid>
     <Keyword>Win32Proj</Keyword>
     <RootNamespace>dig</RootNamespace>
+    @WINDOWS_TARGET_PLATFORM_VERSION@
   </PropertyGroup>
   <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|@PLATFORM@'" Label="Configuration">
     <ConfigurationType>Application</ConfigurationType>
     <UseDebugLibraries>true</UseDebugLibraries>
     <CharacterSet>MultiByte</CharacterSet>
+    @PLATFORM_TOOLSET@
   </PropertyGroup>
   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'" Label="Configuration">
     <ConfigurationType>Application</ConfigurationType>
     <UseDebugLibraries>false</UseDebugLibraries>
     <WholeProgramOptimization>true</WholeProgramOptimization>
     <CharacterSet>MultiByte</CharacterSet>
+    @PLATFORM_TOOLSET@
   </PropertyGroup>
   <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
   <ImportGroup Label="ExtensionSettings">

bin/dig/win32/dighost.vcxproj.in

@@ -1,5 +1,5 @@
 <?xml version="1.0" encoding="utf-8"?>
-<Project DefaultTargets="Build" ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+<Project DefaultTargets="Build" ToolsVersion="@TOOLS_VERSION@" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
   <ItemGroup Label="ProjectConfigurations">
     <ProjectConfiguration Include="Debug|@PLATFORM@">
       <Configuration>Debug</Configuration>
@@ -14,18 +14,21 @@
     <ProjectGuid>{140DE800-E552-43CC-B0C7-A33A92E368CA}</ProjectGuid>
     <Keyword>Win32Proj</Keyword>
     <RootNamespace>dighost</RootNamespace>
+    @WINDOWS_TARGET_PLATFORM_VERSION@
   </PropertyGroup>
   <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|@PLATFORM@'" Label="Configuration">
     <ConfigurationType>StaticLibrary</ConfigurationType>
     <UseDebugLibraries>true</UseDebugLibraries>
     <CharacterSet>MultiByte</CharacterSet>
+    @PLATFORM_TOOLSET@
   </PropertyGroup>
   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'" Label="Configuration">
     <ConfigurationType>StaticLibrary</ConfigurationType>
     <UseDebugLibraries>false</UseDebugLibraries>
     <WholeProgramOptimization>true</WholeProgramOptimization>
     <CharacterSet>MultiByte</CharacterSet>
+    @PLATFORM_TOOLSET@
   </PropertyGroup>
   <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
   <ImportGroup Label="ExtensionSettings">

bin/dig/win32/host.vcxproj.in

@@ -1,5 +1,5 @@
 <?xml version="1.0" encoding="utf-8"?>
-<Project DefaultTargets="Build" ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+<Project DefaultTargets="Build" ToolsVersion="@TOOLS_VERSION@" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
   <ItemGroup Label="ProjectConfigurations">
     <ProjectConfiguration Include="Debug|@PLATFORM@">
       <Configuration>Debug</Configuration>
@@ -14,18 +14,21 @@
     <ProjectGuid>{BA1048A8-6961-4A20-BE12-08BE20611C9D}</ProjectGuid>
     <Keyword>Win32Proj</Keyword>
     <RootNamespace>host</RootNamespace>
+    @WINDOWS_TARGET_PLATFORM_VERSION@
   </PropertyGroup>
   <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|@PLATFORM@'" Label="Configuration">
     <ConfigurationType>Application</ConfigurationType>
     <UseDebugLibraries>true</UseDebugLibraries>
     <CharacterSet>MultiByte</CharacterSet>
+    @PLATFORM_TOOLSET@
   </PropertyGroup>
   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'" Label="Configuration">
     <ConfigurationType>Application</ConfigurationType>
     <UseDebugLibraries>false</UseDebugLibraries>
     <WholeProgramOptimization>true</WholeProgramOptimization>
     <CharacterSet>MultiByte</CharacterSet>
+    @PLATFORM_TOOLSET@
   </PropertyGroup>
   <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
   <ImportGroup Label="ExtensionSettings">

bin/dig/win32/nslookup.vcxproj.in

@@ -1,5 +1,5 @@
 <?xml version="1.0" encoding="utf-8"?>
-<Project DefaultTargets="Build" ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+<Project DefaultTargets="Build" ToolsVersion="@TOOLS_VERSION@" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
   <ItemGroup Label="ProjectConfigurations">
     <ProjectConfiguration Include="Debug|@PLATFORM@">
       <Configuration>Debug</Configuration>
@@ -14,18 +14,21 @@
     <ProjectGuid>{C15A6E1A-94CE-4686-99F9-6BC5FD623EB5}</ProjectGuid>
     <Keyword>Win32Proj</Keyword>
     <RootNamespace>nslookup</RootNamespace>
+    @WINDOWS_TARGET_PLATFORM_VERSION@
   </PropertyGroup>
   <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|@PLATFORM@'" Label="Configuration">
     <ConfigurationType>Application</ConfigurationType>
     <UseDebugLibraries>true</UseDebugLibraries>
     <CharacterSet>MultiByte</CharacterSet>
+    @PLATFORM_TOOLSET@
   </PropertyGroup>
   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'" Label="Configuration">
     <ConfigurationType>Application</ConfigurationType>
     <UseDebugLibraries>false</UseDebugLibraries>
     <WholeProgramOptimization>true</WholeProgramOptimization>
     <CharacterSet>MultiByte</CharacterSet>
+    @PLATFORM_TOOLSET@
   </PropertyGroup>
   <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
   <ImportGroup Label="ExtensionSettings">

bin/dnssec/Makefile.in

@@ -7,8 +7,6 @@
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.
 
-# $Id: Makefile.in,v 1.42.332.1 2011/03/16 06:37:51 each Exp $
-
 srcdir =	@srcdir@
 VPATH =		@srcdir@
 top_srcdir =	@top_srcdir@
@@ -23,7 +21,7 @@ CDEFINES =	-DVERSION=\"${VERSION}\" @USE_PKCS11@ @PKCS11_ENGINE@ \
 		@CRYPTO@ -DPK11_LIB_LOCATION=\"@PKCS11_PROVIDER@\"
 CWARNINGS =
 
-DNSLIBS =	../../lib/dns/libdns.@A@ @DNS_CRYPTO_LIBS@
+DNSLIBS =	../../lib/dns/libdns.@A@ ${MAXMINDDB_LIBS} @DNS_CRYPTO_LIBS@
 ISCLIBS =	../../lib/isc/libisc.@A@
 ISCNOSYMLIBS =	../../lib/isc/libisc-nosymtbl.@A@
 

bin/dnssec/dnssec-dsfromkey.8

@@ -98,7 +98,7 @@ Specify a digest algorithm to use when converting DNSKEY records to DS records\&
 .sp
 The
 \fIalgorithm\fR
-must be one of SHA\-1, SHA\-256, or SHA\-384\&. These values are case insensitive, and the hyphen may be omitted\&. If no algorithm is specified, the default is SHA\-256\&.
+must be one of SHA\-1, SHA\-256, or SHA\-384\&. These values are case insensitive, and the hyphen may be omitted\&. If no algorithm is specified, the default is to use both SHA\-1 and SHA\-256\&.
 .RE
 .PP
 \-A

bin/dnssec/dnssec-dsfromkey.c

@@ -236,7 +236,7 @@ logkey(dns_rdata_t *rdata)
 }
 
 static void
-emit(unsigned int dtype, bool showall, char *lookaside,
+emit(dns_dsdigest_t dtype, bool showall, char *lookaside,
      bool cds, dns_rdata_t *rdata)
 {
 	isc_result_t result;
@@ -351,7 +351,7 @@ main(int argc, char **argv) {
 	char		*lookaside = NULL;
 	char		*endp;
 	int		ch;
-	unsigned int	dtype = DNS_DSDIGEST_SHA1;
+	dns_dsdigest_t	dtype = DNS_DSDIGEST_SHA1;
 	bool	cds = false;
 	bool	both = true;
 	bool	usekeyset = false;
@@ -509,24 +509,29 @@ main(int argc, char **argv) {
 	dns_rdataset_init(&rdataset);
 
 	if (usekeyset || filename != NULL) {
-		if (argc < isc_commandline_index + 1 && filename != NULL) {
+		if (argc < isc_commandline_index + 1) {
 			/* using zone name as the zone file name */
 			namestr = filename;
-		} else
+		} else {
 			namestr = argv[isc_commandline_index];
+		}
 
 		result = initname(namestr);
-		if (result != ISC_R_SUCCESS)
+		if (result != ISC_R_SUCCESS) {
 			fatal("could not initialize name %s", namestr);
+		}
 
-		if (usekeyset)
+		if (usekeyset) {
 			result = loadkeyset(dir, &rdataset);
-		else
+		} else {
+			INSIST(filename != NULL);
 			result = loadset(filename, &rdataset);
+		}
 
-		if (result != ISC_R_SUCCESS)
+		if (result != ISC_R_SUCCESS) {
 			fatal("could not load DNSKEY set: %s\n",
 			      isc_result_totext(result));
+		}
 
 		for (result = dns_rdataset_first(&rdataset);
 		     result == ISC_R_SUCCESS;
@@ -534,16 +539,18 @@ main(int argc, char **argv) {
 			dns_rdata_init(&rdata);
 			dns_rdataset_current(&rdataset, &rdata);
 
-			if (verbose > 2)
+			if (verbose > 2) {
 				logkey(&rdata);
+			}
 
 			if (both) {
 				emit(DNS_DSDIGEST_SHA1, showall, lookaside,
 				     cds, &rdata);
 				emit(DNS_DSDIGEST_SHA256, showall, lookaside,
 				     cds, &rdata);
-			} else
+			} else {
 				emit(dtype, showall, lookaside, cds, &rdata);
+			}
 		}
 	} else {
 		unsigned char key_buf[DST_KEY_MAXSIZE];
@@ -556,8 +563,9 @@ main(int argc, char **argv) {
 			     &rdata);
 			emit(DNS_DSDIGEST_SHA256, showall, lookaside, cds,
 			     &rdata);
-		} else
+		} else {
 			emit(dtype, showall, lookaside, cds, &rdata);
+		}
 	}
 
 	if (dns_rdataset_isassociated(&rdataset))

bin/dnssec/dnssec-dsfromkey.docbook

@@ -177,7 +177,7 @@
 	    The <replaceable>algorithm</replaceable> must be one of
 	    SHA-1, SHA-256, or SHA-384.  These values are case insensitive,
 	    and the hyphen may be omitted.  If no algorithm is specified,
-	    the default is SHA-256.
+	    the default is to use both SHA-1 and SHA-256.
 	  </para>
 	</listitem>
       </varlistentry>

bin/dnssec/dnssec-dsfromkey.html

@@ -156,7 +156,7 @@
 	    The <em class="replaceable"><code>algorithm</code></em> must be one of
 	    SHA-1, SHA-256, or SHA-384.  These values are case insensitive,
 	    and the hyphen may be omitted.  If no algorithm is specified,
-	    the default is SHA-256.
+	    the default is to use both SHA-1 and SHA-256.
 	  </p>
 	</dd>
 <dt><span class="term">-A</span></dt>

bin/dnssec/dnssec-keygen.8

@@ -39,7 +39,7 @@
 dnssec-keygen \- DNSSEC key generation tool
 .SH "SYNOPSIS"
 .HP \w'\fBdnssec\-keygen\fR\ 'u
-\fBdnssec\-keygen\fR [\fB\-a\ \fR\fB\fIalgorithm\fR\fR] [\fB\-b\ \fR\fB\fIkeysize\fR\fR] [\fB\-n\ \fR\fB\fInametype\fR\fR] [\fB\-3\fR] [\fB\-A\ \fR\fB\fIdate/offset\fR\fR] [\fB\-C\fR] [\fB\-c\ \fR\fB\fIclass\fR\fR] [\fB\-D\ \fR\fB\fIdate/offset\fR\fR] [\fB\-D\ sync\ \fR\fB\fIdate/offset\fR\fR] [\fB\-E\ \fR\fB\fIengine\fR\fR] [\fB\-f\ \fR\fB\fIflag\fR\fR] [\fB\-G\fR] [\fB\-g\ \fR\fB\fIgenerator\fR\fR] [\fB\-h\fR] [\fB\-I\ \fR\fB\fIdate/offset\fR\fR] [\fB\-i\ \fR\fB\fIinterval\fR\fR] [\fB\-K\ \fR\fB\fIdirectory\fR\fR] [\fB\-k\fR] [\fB\-L\ \fR\fB\fIttl\fR\fR] [\fB\-P\ \fR\fB\fIdate/offset\fR\fR] [\fB\-P\ sync\ \fR\fB\fIdate/offset\fR\fR] [\fB\-p\ \fR\fB\fIprotocol\fR\fR] [\fB\-q\fR] [\fB\-R\ \fR\fB\fIdate/offset\fR\fR] [\fB\-r\ \fR\fB\fIrandomdev\fR\fR] [\fB\-S\ \fR\fB\fIkey\fR\fR] [\fB\-s\ \fR\fB\fIstrength\fR\fR] [\fB\-t\ \fR\fB\fItype\fR\fR] [\fB\-V\fR] [\fB\-v\ \fR\fB\fIlevel\fR\fR] [\fB\-z\fR] {name}
+\fBdnssec\-keygen\fR [\fB\-3\fR] [\fB\-A\ \fR\fB\fIdate/offset\fR\fR] [\fB\-a\ \fR\fB\fIalgorithm\fR\fR] [\fB\-b\ \fR\fB\fIkeysize\fR\fR] [\fB\-C\fR] [\fB\-c\ \fR\fB\fIclass\fR\fR] [\fB\-D\ \fR\fB\fIdate/offset\fR\fR] [\fB\-D\ sync\ \fR\fB\fIdate/offset\fR\fR] [\fB\-E\ \fR\fB\fIengine\fR\fR] [\fB\-f\ \fR\fB\fIflag\fR\fR] [\fB\-G\fR] [\fB\-g\ \fR\fB\fIgenerator\fR\fR] [\fB\-h\fR] [\fB\-I\ \fR\fB\fIdate/offset\fR\fR] [\fB\-i\ \fR\fB\fIinterval\fR\fR] [\fB\-K\ \fR\fB\fIdirectory\fR\fR] [\fB\-k\fR] [\fB\-L\ \fR\fB\fIttl\fR\fR] [\fB\-n\ \fR\fB\fInametype\fR\fR] [\fB\-P\ \fR\fB\fIdate/offset\fR\fR] [\fB\-P\ sync\ \fR\fB\fIdate/offset\fR\fR] [\fB\-p\ \fR\fB\fIprotocol\fR\fR] [\fB\-q\fR] [\fB\-R\ \fR\fB\fIdate/offset\fR\fR] [\fB\-r\ \fR\fB\fIrandomdev\fR\fR] [\fB\-S\ \fR\fB\fIkey\fR\fR] [\fB\-s\ \fR\fB\fIstrength\fR\fR] [\fB\-t\ \fR\fB\fItype\fR\fR] [\fB\-V\fR] [\fB\-v\ \fR\fB\fIlevel\fR\fR] {name}
 .SH "DESCRIPTION"
 .PP
 \fBdnssec\-keygen\fR
@@ -50,6 +50,13 @@ The
 of the key is specified on the command line\&. For DNSSEC keys, this must match the name of the zone for which the key is being generated\&.
 .SH "OPTIONS"
 .PP
+\-3
+.RS 4
+Use an NSEC3\-capable algorithm to generate a DNSSEC key\&. If this option is used with an algorithm that has both NSEC and NSEC3 versions, then the NSEC3 version will be used; for example,
+\fBdnssec\-keygen \-3a RSASHA1\fR
+specifies the NSEC3RSASHA1 algorithm\&.
+.RE
+.PP
 \-a \fIalgorithm\fR
 .RS 4
 Selects the cryptographic algorithm\&. For DNSSEC keys, the value of
@@ -78,21 +85,9 @@ The key size does not need to be specified if using a default algorithm\&. The d
 must be used\&.
 .RE
 .PP
-\-n \fInametype\fR
-.RS 4
-Specifies the owner type of the key\&. The value of
-\fBnametype\fR
-must either be ZONE (for a DNSSEC zone key (KEY/DNSKEY)), HOST or ENTITY (for a key associated with a host (KEY)), USER (for a key associated with a user(KEY)) or OTHER (DNSKEY)\&. These values are case insensitive\&. Defaults to ZONE for DNSKEY generation\&.
-.RE
-.PP
-\-3
-.RS 4
-Use an NSEC3\-capable algorithm to generate a DNSSEC key\&. If this option is used and no algorithm is explicitly set on the command line, NSEC3RSASHA1 will be used by default\&. Note that RSASHA256, RSASHA512, ECCGOST, ECDSAP256SHA256, ECDSAP384SHA384, ED25519 and ED448 algorithms are NSEC3\-capable\&.
-.RE
-.PP
 \-C
 .RS 4
-Compatibility mode: generates an old\-style key, without any metadata\&. By default,
+Compatibility mode: generates an old\-style key, without any timing metadata\&. By default,
 \fBdnssec\-keygen\fR
 will include the key\*(Aqs creation date in the metadata stored with the private key, and other dates may be set there as well (publication date, activation date, etc)\&. Keys that include this data may be incompatible with older versions of BIND; the
 \fB\-C\fR
@@ -151,9 +146,17 @@ none
 is the same as leaving it unset\&.
 .RE
 .PP
+\-n \fInametype\fR
+.RS 4
+Specifies the owner type of the key\&. The value of
+\fBnametype\fR
+must either be ZONE (for a DNSSEC zone key (KEY/DNSKEY)), HOST or ENTITY (for a key associated with a host (KEY)), USER (for a key associated with a user(KEY)) or OTHER (DNSKEY)\&. These values are case insensitive\&. Defaults to ZONE for DNSKEY generation\&.
+.RE
+.PP
 \-p \fIprotocol\fR
 .RS 4
-Sets the protocol value for the generated key\&. The protocol is a number between 0 and 255\&. The default is 3 (DNSSEC)\&. Other possible values for this argument are listed in RFC 2535 and its successors\&.
+Sets the protocol value for the generated key, for use with
+\fB\-T KEY\fR\&. The protocol is a number between 0 and 255\&. The default is 3 (DNSSEC)\&. Other possible values for this argument are listed in RFC 2535 and its successors\&.
 .RE
 .PP
 \-q
@@ -196,20 +199,21 @@ Using any TSIG algorithm (HMAC\-* or DH) forces this option to KEY\&.
 .PP
 \-t \fItype\fR
 .RS 4
-Indicates the use of the key\&.
+Indicates the use of the key, for use with
+\fB\-T KEY\fR\&.
 \fBtype\fR
 must be one of AUTHCONF, NOAUTHCONF, NOAUTH, or NOCONF\&. The default is AUTHCONF\&. AUTH refers to the ability to authenticate data, and CONF the ability to encrypt data\&.
 .RE
 .PP
-\-v \fIlevel\fR
-.RS 4
-Sets the debugging level\&.
-.RE
-.PP
 \-V
 .RS 4
 Prints version information\&.
 .RE
+.PP
+\-v \fIlevel\fR
+.RS 4
+Sets the debugging level\&.
+.RE
 .SH "TIMING OPTIONS"
 .PP
 Dates can be expressed in the format YYYYMMDD or YYYYMMDDHHMMSS\&. If the argument begins with a \*(Aq+\*(Aq or \*(Aq\-\*(Aq, it is interpreted as an offset from the present time\&. For convenience, if such an offset is followed by one of the suffixes \*(Aqy\*(Aq, \*(Aqmo\*(Aq, \*(Aqw\*(Aq, \*(Aqd\*(Aq, \*(Aqh\*(Aq, or \*(Aqmi\*(Aq, then the offset is computed in years (defined as 365 24\-hour days, ignoring leap years), months (defined as 30 24\-hour days), weeks, days, hours, or minutes, respectively\&. Without a suffix, the offset is computed in seconds\&. To explicitly prevent a date from being set, use \*(Aqnone\*(Aq or \*(Aqnever\*(Aq\&.
@@ -338,6 +342,10 @@ creates the files
 Kexample\&.com\&.+003+26160\&.key
 and
 Kexample\&.com\&.+003+26160\&.private\&.
+.PP
+To generate a matching key\-signing key, issue the command:
+.PP
+\fBdnssec\-keygen \-a DSA \-b 768 \-n ZONE \-f KSK example\&.com\fR
 .SH "SEE ALSO"
 .PP
 \fBdnssec-signzone\fR(8),

bin/dnssec/dnssec-keygen.docbook

@@ -58,11 +58,10 @@
   <refsynopsisdiv>
     <cmdsynopsis sepchar=" ">
       <command>dnssec-keygen</command>
-      <arg choice="opt" rep="norepeat"><option>-a <replaceable class="parameter">algorithm</replaceable></option></arg>
-      <arg choice="opt" rep="norepeat"><option>-b <replaceable class="parameter">keysize</replaceable></option></arg>
-      <arg choice="opt" rep="norepeat"><option>-n <replaceable class="parameter">nametype</replaceable></option></arg>
       <arg choice="opt" rep="norepeat"><option>-3</option></arg>
       <arg choice="opt" rep="norepeat"><option>-A <replaceable class="parameter">date/offset</replaceable></option></arg>
+      <arg rep="norepeat"><option>-a <replaceable class="parameter">algorithm</replaceable></option></arg>
+      <arg choice="opt" rep="norepeat"><option>-b <replaceable class="parameter">keysize</replaceable></option></arg>
       <arg choice="opt" rep="norepeat"><option>-C</option></arg>
       <arg choice="opt" rep="norepeat"><option>-c <replaceable class="parameter">class</replaceable></option></arg>
       <arg choice="opt" rep="norepeat"><option>-D <replaceable class="parameter">date/offset</replaceable></option></arg>
@@ -77,6 +76,7 @@
       <arg choice="opt" rep="norepeat"><option>-K <replaceable class="parameter">directory</replaceable></option></arg>
       <arg choice="opt" rep="norepeat"><option>-k</option></arg>
       <arg choice="opt" rep="norepeat"><option>-L <replaceable class="parameter">ttl</replaceable></option></arg>
+      <arg choice="opt" rep="norepeat"><option>-n <replaceable class="parameter">nametype</replaceable></option></arg>
       <arg choice="opt" rep="norepeat"><option>-P <replaceable class="parameter">date/offset</replaceable></option></arg>
       <arg choice="opt" rep="norepeat"><option>-P sync <replaceable class="parameter">date/offset</replaceable></option></arg>
       <arg choice="opt" rep="norepeat"><option>-p <replaceable class="parameter">protocol</replaceable></option></arg>
@@ -88,7 +88,6 @@
       <arg choice="opt" rep="norepeat"><option>-t <replaceable class="parameter">type</replaceable></option></arg>
       <arg choice="opt" rep="norepeat"><option>-V</option></arg>
       <arg choice="opt" rep="norepeat"><option>-v <replaceable class="parameter">level</replaceable></option></arg>
-      <arg choice="opt" rep="norepeat"><option>-z</option></arg>
       <arg choice="req" rep="norepeat">name</arg>
     </cmdsynopsis>
   </refsynopsisdiv>
@@ -112,6 +111,20 @@
 
 
     <variablelist>
+
+      <varlistentry>
+	<term>-3</term>
+	<listitem>
+	  <para>
+	    Use an NSEC3-capable algorithm to generate a DNSSEC key.
+	    If this option is used with an algorithm that has both
+	    NSEC and NSEC3 versions, then the NSEC3 version will be
+	    used; for example, <command>dnssec-keygen -3a RSASHA1</command>
+	    specifies the NSEC3RSASHA1 algorithm.
+	  </para>
+	</listitem>
+      </varlistentry>
+
       <varlistentry>
 	<term>-a <replaceable class="parameter">algorithm</replaceable></term>
 	<listitem>
@@ -168,45 +181,16 @@
 	</listitem>
       </varlistentry>
 
-      <varlistentry>
-	<term>-n <replaceable class="parameter">nametype</replaceable></term>
-	<listitem>
-	  <para>
-	    Specifies the owner type of the key.  The value of
-	    <option>nametype</option> must either be ZONE (for a DNSSEC
-	    zone key (KEY/DNSKEY)), HOST or ENTITY (for a key associated with
-	    a host (KEY)),
-	    USER (for a key associated with a user(KEY)) or OTHER (DNSKEY).
-	    These values are case insensitive.  Defaults to ZONE for DNSKEY
-	    generation.
-	  </para>
-	</listitem>
-      </varlistentry>
-
-      <varlistentry>
-	<term>-3</term>
-	<listitem>
-	  <para>
-	    Use an NSEC3-capable algorithm to generate a DNSSEC key.
-	    If this option is used and no algorithm is explicitly
-	    set on the command line, NSEC3RSASHA1 will be used by
-	    default. Note that RSASHA256, RSASHA512, ECCGOST,
-	    ECDSAP256SHA256, ECDSAP384SHA384, ED25519 and ED448
-	    algorithms are NSEC3-capable.
-	  </para>
-	</listitem>
-      </varlistentry>
-
       <varlistentry>
 	<term>-C</term>
 	<listitem>
 	  <para>
-	    Compatibility mode:  generates an old-style key, without
-	    any metadata.  By default, <command>dnssec-keygen</command>
-	    will include the key's creation date in the metadata stored
-	    with the private key, and other dates may be set there as well
-	    (publication date, activation date, etc).  Keys that include
-	    this data may be incompatible with older versions of BIND; the
+	    Compatibility mode: generates an old-style key, without any
+	    timing metadata. By default, <command>dnssec-keygen</command>
+	    will include the key's creation date in the metadata stored with
+	    the private key, and other dates may be set there as well
+	    (publication date, activation date, etc). Keys that include this
+	    data may be incompatible with older versions of BIND; the
 	    <option>-C</option> option suppresses them.
 	  </para>
 	</listitem>
@@ -315,14 +299,28 @@
 	</listitem>
       </varlistentry>
 
+      <varlistentry>
+	<term>-n <replaceable class="parameter">nametype</replaceable></term>
+	<listitem>
+	  <para>
+	    Specifies the owner type of the key.  The value of
+	    <option>nametype</option> must either be ZONE (for a DNSSEC
+	    zone key (KEY/DNSKEY)), HOST or ENTITY (for a key associated
+	    with a host (KEY)), USER (for a key associated with a
+	    user(KEY)) or OTHER (DNSKEY).  These values are case
+	    insensitive.  Defaults to ZONE for DNSKEY generation.
+	  </para>
+	</listitem>
+      </varlistentry>
+
       <varlistentry>
 	<term>-p <replaceable class="parameter">protocol</replaceable></term>
 	<listitem>
 	  <para>
-	    Sets the protocol value for the generated key.  The protocol
-	    is a number between 0 and 255.  The default is 3 (DNSSEC).
-	    Other possible values for this argument are listed in
-	    RFC 2535 and its successors.
+	    Sets the protocol value for the generated key, for use
+	    with <option>-T KEY</option>. The protocol is a number between 0
+	    and 255. The default is 3 (DNSSEC). Other possible values for
+	    this argument are listed in RFC 2535 and its successors.
 	  </para>
 	</listitem>
       </varlistentry>
@@ -409,19 +407,11 @@
 	<term>-t <replaceable class="parameter">type</replaceable></term>
 	<listitem>
 	  <para>
-	    Indicates the use of the key.  <option>type</option> must be
-	    one of AUTHCONF, NOAUTHCONF, NOAUTH, or NOCONF.  The default
-	    is AUTHCONF.  AUTH refers to the ability to authenticate
-	    data, and CONF the ability to encrypt data.
-	  </para>
-	</listitem>
-      </varlistentry>
-
-      <varlistentry>
-	<term>-v <replaceable class="parameter">level</replaceable></term>
-	<listitem>
-	  <para>
-	    Sets the debugging level.
+	    Indicates the use of the key, for use with <option>-T
+	    KEY</option>. <option>type</option> must be one of AUTHCONF,
+	    NOAUTHCONF, NOAUTH, or NOCONF. The default is AUTHCONF. AUTH
+	    refers to the ability to authenticate data, and CONF the ability
+	    to encrypt data.
 	  </para>
 	</listitem>
       </varlistentry>
@@ -435,6 +425,15 @@
 	</listitem>
       </varlistentry>
 
+      <varlistentry>
+	<term>-v <replaceable class="parameter">level</replaceable></term>
+	<listitem>
+	  <para>
+	    Sets the debugging level.
+	  </para>
+	</listitem>
+      </varlistentry>
+
     </variablelist>
   </refsection>
 
@@ -637,6 +636,12 @@
       and
       <filename>Kexample.com.+003+26160.private</filename>.
     </para>
+    <para>
+      To generate a matching key-signing key, issue the command:
+    </para>
+    <para>
+      <userinput>dnssec-keygen -a DSA -b 768 -n ZONE -f KSK example.com</userinput>
+    </para>
   </refsection>
 
   <refsection><info><title>SEE ALSO</title></info>

bin/dnssec/dnssec-keygen.html

@@ -33,11 +33,10 @@
 <h2>Synopsis</h2>
     <div class="cmdsynopsis"><p>
       <code class="command">dnssec-keygen</code> 
-       [<code class="option">-a <em class="replaceable"><code>algorithm</code></em></code>]
-       [<code class="option">-b <em class="replaceable"><code>keysize</code></em></code>]
-       [<code class="option">-n <em class="replaceable"><code>nametype</code></em></code>]
        [<code class="option">-3</code>]
        [<code class="option">-A <em class="replaceable"><code>date/offset</code></em></code>]
+       [<code class="option">-a <em class="replaceable"><code>algorithm</code></em></code>]
+       [<code class="option">-b <em class="replaceable"><code>keysize</code></em></code>]
        [<code class="option">-C</code>]
        [<code class="option">-c <em class="replaceable"><code>class</code></em></code>]
        [<code class="option">-D <em class="replaceable"><code>date/offset</code></em></code>]
@@ -52,6 +51,7 @@
        [<code class="option">-K <em class="replaceable"><code>directory</code></em></code>]
        [<code class="option">-k</code>]
        [<code class="option">-L <em class="replaceable"><code>ttl</code></em></code>]
+       [<code class="option">-n <em class="replaceable"><code>nametype</code></em></code>]
        [<code class="option">-P <em class="replaceable"><code>date/offset</code></em></code>]
        [<code class="option">-P sync <em class="replaceable"><code>date/offset</code></em></code>]
        [<code class="option">-p <em class="replaceable"><code>protocol</code></em></code>]
@@ -63,7 +63,6 @@
        [<code class="option">-t <em class="replaceable"><code>type</code></em></code>]
        [<code class="option">-V</code>]
        [<code class="option">-v <em class="replaceable"><code>level</code></em></code>]
-       [<code class="option">-z</code>]
        {name}
     </p></div>
   </div>
@@ -89,6 +88,16 @@
 
 
     <div class="variablelist"><dl class="variablelist">
+<dt><span class="term">-3</span></dt>
+<dd>
+	  <p>
+	    Use an NSEC3-capable algorithm to generate a DNSSEC key.
+	    If this option is used with an algorithm that has both
+	    NSEC and NSEC3 versions, then the NSEC3 version will be
+	    used; for example, <span class="command"><strong>dnssec-keygen -3a RSASHA1</strong></span>
+	    specifies the NSEC3RSASHA1 algorithm.
+	  </p>
+	</dd>
 <dt><span class="term">-a <em class="replaceable"><code>algorithm</code></em></span></dt>
 <dd>
 	  <p>
@@ -139,38 +148,15 @@
 	    must be used.
 	  </p>
 	</dd>
-<dt><span class="term">-n <em class="replaceable"><code>nametype</code></em></span></dt>
-<dd>
-	  <p>
-	    Specifies the owner type of the key.  The value of
-	    <code class="option">nametype</code> must either be ZONE (for a DNSSEC
-	    zone key (KEY/DNSKEY)), HOST or ENTITY (for a key associated with
-	    a host (KEY)),
-	    USER (for a key associated with a user(KEY)) or OTHER (DNSKEY).
-	    These values are case insensitive.  Defaults to ZONE for DNSKEY
-	    generation.
-	  </p>
-	</dd>
-<dt><span class="term">-3</span></dt>
-<dd>
-	  <p>
-	    Use an NSEC3-capable algorithm to generate a DNSSEC key.
-	    If this option is used and no algorithm is explicitly
-	    set on the command line, NSEC3RSASHA1 will be used by
-	    default. Note that RSASHA256, RSASHA512, ECCGOST,
-	    ECDSAP256SHA256, ECDSAP384SHA384, ED25519 and ED448
-	    algorithms are NSEC3-capable.
-	  </p>
-	</dd>
 <dt><span class="term">-C</span></dt>
 <dd>
 	  <p>
-	    Compatibility mode:  generates an old-style key, without
-	    any metadata.  By default, <span class="command"><strong>dnssec-keygen</strong></span>
-	    will include the key's creation date in the metadata stored
-	    with the private key, and other dates may be set there as well
-	    (publication date, activation date, etc).  Keys that include
-	    this data may be incompatible with older versions of BIND; the
+	    Compatibility mode: generates an old-style key, without any
+	    timing metadata. By default, <span class="command"><strong>dnssec-keygen</strong></span>
+	    will include the key's creation date in the metadata stored with
+	    the private key, and other dates may be set there as well
+	    (publication date, activation date, etc). Keys that include this
+	    data may be incompatible with older versions of BIND; the
 	    <code class="option">-C</code> option suppresses them.
 	  </p>
 	</dd>
@@ -250,13 +236,24 @@
 	    or <code class="literal">none</code> is the same as leaving it unset.
 	  </p>
 	</dd>
+<dt><span class="term">-n <em class="replaceable"><code>nametype</code></em></span></dt>
+<dd>
+	  <p>
+	    Specifies the owner type of the key.  The value of
+	    <code class="option">nametype</code> must either be ZONE (for a DNSSEC
+	    zone key (KEY/DNSKEY)), HOST or ENTITY (for a key associated
+	    with a host (KEY)), USER (for a key associated with a
+	    user(KEY)) or OTHER (DNSKEY).  These values are case
+	    insensitive.  Defaults to ZONE for DNSKEY generation.
+	  </p>
+	</dd>
 <dt><span class="term">-p <em class="replaceable"><code>protocol</code></em></span></dt>
 <dd>
 	  <p>
-	    Sets the protocol value for the generated key.  The protocol
-	    is a number between 0 and 255.  The default is 3 (DNSSEC).
-	    Other possible values for this argument are listed in
-	    RFC 2535 and its successors.
+	    Sets the protocol value for the generated key, for use
+	    with <code class="option">-T KEY</code>. The protocol is a number between 0
+	    and 255. The default is 3 (DNSSEC). Other possible values for
+	    this argument are listed in RFC 2535 and its successors.
 	  </p>
 	</dd>
 <dt><span class="term">-q</span></dt>
@@ -327,16 +324,11 @@
 <dt><span class="term">-t <em class="replaceable"><code>type</code></em></span></dt>
 <dd>
 	  <p>
-	    Indicates the use of the key.  <code class="option">type</code> must be
-	    one of AUTHCONF, NOAUTHCONF, NOAUTH, or NOCONF.  The default
-	    is AUTHCONF.  AUTH refers to the ability to authenticate
-	    data, and CONF the ability to encrypt data.
-	  </p>
-	</dd>
-<dt><span class="term">-v <em class="replaceable"><code>level</code></em></span></dt>
-<dd>
-	  <p>
-	    Sets the debugging level.
+	    Indicates the use of the key, for use with <code class="option">-T
+	    KEY</code>. <code class="option">type</code> must be one of AUTHCONF,
+	    NOAUTHCONF, NOAUTH, or NOCONF. The default is AUTHCONF. AUTH
+	    refers to the ability to authenticate data, and CONF the ability
+	    to encrypt data.
 	  </p>
 	</dd>
 <dt><span class="term">-V</span></dt>
@@ -345,6 +337,12 @@
 	    Prints version information.
 	  </p>
 	</dd>
+<dt><span class="term">-v <em class="replaceable"><code>level</code></em></span></dt>
+<dd>
+	  <p>
+	    Sets the debugging level.
+	  </p>
+	</dd>
 </dl></div>
   </div>
 
@@ -526,6 +524,12 @@
       and
       <code class="filename">Kexample.com.+003+26160.private</code>.
     </p>
+    <p>
+      To generate a matching key-signing key, issue the command:
+    </p>
+    <p>
+      <strong class="userinput"><code>dnssec-keygen -a DSA -b 768 -n ZONE -f KSK example.com</code></strong>
+    </p>
   </div>
 
   <div class="refsection">

bin/dnssec/win32/dnssectool.vcxproj.in

@@ -1,5 +1,5 @@
 <?xml version="1.0" encoding="utf-8"?>
-<Project DefaultTargets="Build" ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+<Project DefaultTargets="Build" ToolsVersion="@TOOLS_VERSION@" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
   <ItemGroup Label="ProjectConfigurations">
     <ProjectConfiguration Include="Debug|@PLATFORM@">
       <Configuration>Debug</Configuration>
@@ -20,18 +20,21 @@
     <ProjectGuid>{2CB7DC75-023B-4AA3-AF3A-AE5046A4EE70}</ProjectGuid>
     <Keyword>Win32Proj</Keyword>
     <RootNamespace>dnssectool</RootNamespace>
+    @WINDOWS_TARGET_PLATFORM_VERSION@
   </PropertyGroup>
   <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|@PLATFORM@'" Label="Configuration">
     <ConfigurationType>StaticLibrary</ConfigurationType>
     <UseDebugLibraries>true</UseDebugLibraries>
     <CharacterSet>MultiByte</CharacterSet>
+    @PLATFORM_TOOLSET@
   </PropertyGroup>
   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'" Label="Configuration">
     <ConfigurationType>StaticLibrary</ConfigurationType>
     <UseDebugLibraries>false</UseDebugLibraries>
     <WholeProgramOptimization>true</WholeProgramOptimization>
     <CharacterSet>MultiByte</CharacterSet>
+    @PLATFORM_TOOLSET@
   </PropertyGroup>
   <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
   <ImportGroup Label="ExtensionSettings">

bin/dnssec/win32/dsfromkey.vcxproj.in

@@ -1,5 +1,5 @@
 <?xml version="1.0" encoding="utf-8"?>
-<Project DefaultTargets="Build" ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+<Project DefaultTargets="Build" ToolsVersion="@TOOLS_VERSION@" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
   <ItemGroup Label="ProjectConfigurations">
     <ProjectConfiguration Include="Debug|@PLATFORM@">
       <Configuration>Debug</Configuration>
@@ -14,18 +14,21 @@
     <ProjectGuid>{6E6297F4-69D7-4533-85E1-BD17C30017C8}</ProjectGuid>
     <Keyword>Win32Proj</Keyword>
     <RootNamespace>dsfromkey</RootNamespace>
+    @WINDOWS_TARGET_PLATFORM_VERSION@
   </PropertyGroup>
   <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|@PLATFORM@'" Label="Configuration">
     <ConfigurationType>Application</ConfigurationType>
     <UseDebugLibraries>true</UseDebugLibraries>
     <CharacterSet>MultiByte</CharacterSet>
+    @PLATFORM_TOOLSET@
   </PropertyGroup>
   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'" Label="Configuration">
     <ConfigurationType>Application</ConfigurationType>
     <UseDebugLibraries>false</UseDebugLibraries>
     <WholeProgramOptimization>true</WholeProgramOptimization>
     <CharacterSet>MultiByte</CharacterSet>
+    @PLATFORM_TOOLSET@
   </PropertyGroup>
   <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
   <ImportGroup Label="ExtensionSettings">

bin/dnssec/win32/importkey.vcxproj.in

@@ -1,5 +1,5 @@
 <?xml version="1.0" encoding="utf-8"?>
-<Project DefaultTargets="Build" ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+<Project DefaultTargets="Build" ToolsVersion="@TOOLS_VERSION@" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
   <ItemGroup Label="ProjectConfigurations">
     <ProjectConfiguration Include="Debug|@PLATFORM@">
       <Configuration>Debug</Configuration>
@@ -14,18 +14,21 @@
     <ProjectGuid>{AB6690A0-055E-458f-BAC5-BF38BCC5834F}</ProjectGuid>
     <Keyword>Win32Proj</Keyword>
     <RootNamespace>importkey</RootNamespace>
+    @WINDOWS_TARGET_PLATFORM_VERSION@
   </PropertyGroup>
   <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|@PLATFORM@'" Label="Configuration">
     <ConfigurationType>Application</ConfigurationType>
     <UseDebugLibraries>true</UseDebugLibraries>
     <CharacterSet>MultiByte</CharacterSet>
+    @PLATFORM_TOOLSET@
   </PropertyGroup>
   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'" Label="Configuration">
     <ConfigurationType>Application</ConfigurationType>
     <UseDebugLibraries>false</UseDebugLibraries>
     <WholeProgramOptimization>true</WholeProgramOptimization>
     <CharacterSet>MultiByte</CharacterSet>
+    @PLATFORM_TOOLSET@
   </PropertyGroup>
   <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
   <ImportGroup Label="ExtensionSettings">

bin/dnssec/win32/keyfromlabel.vcxproj.in

@@ -1,5 +1,5 @@
 <?xml version="1.0" encoding="utf-8"?>
-<Project DefaultTargets="Build" ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+<Project DefaultTargets="Build" ToolsVersion="@TOOLS_VERSION@" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
   <ItemGroup Label="ProjectConfigurations">
     <ProjectConfiguration Include="Debug|@PLATFORM@">
       <Configuration>Debug</Configuration>
@@ -14,18 +14,21 @@
     <ProjectGuid>{17455DC6-5FBB-47C3-8F44-7DB574A188D3}</ProjectGuid>
     <Keyword>Win32Proj</Keyword>
     <RootNamespace>keyfromlabel</RootNamespace>
+    @WINDOWS_TARGET_PLATFORM_VERSION@
   </PropertyGroup>
   <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|@PLATFORM@'" Label="Configuration">
     <ConfigurationType>Application</ConfigurationType>
     <UseDebugLibraries>true</UseDebugLibraries>
     <CharacterSet>MultiByte</CharacterSet>
+    @PLATFORM_TOOLSET@
   </PropertyGroup>
   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'" Label="Configuration">
     <ConfigurationType>Application</ConfigurationType>
     <UseDebugLibraries>false</UseDebugLibraries>
     <WholeProgramOptimization>true</WholeProgramOptimization>
     <CharacterSet>MultiByte</CharacterSet>
+    @PLATFORM_TOOLSET@
   </PropertyGroup>
   <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
   <ImportGroup Label="ExtensionSettings">

bin/dnssec/win32/keygen.vcxproj.in

@@ -1,5 +1,5 @@
 <?xml version="1.0" encoding="utf-8"?>
-<Project DefaultTargets="Build" ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+<Project DefaultTargets="Build" ToolsVersion="@TOOLS_VERSION@" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
   <ItemGroup Label="ProjectConfigurations">
     <ProjectConfiguration Include="Debug|@PLATFORM@">
       <Configuration>Debug</Configuration>
@@ -14,18 +14,21 @@
     <ProjectGuid>{0BF11E21-168C-4CAA-B784-429D126BBAE5}</ProjectGuid>
     <Keyword>Win32Proj</Keyword>
     <RootNamespace>keygen</RootNamespace>
+    @WINDOWS_TARGET_PLATFORM_VERSION@
   </PropertyGroup>
   <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|@PLATFORM@'" Label="Configuration">
     <ConfigurationType>Application</ConfigurationType>
     <UseDebugLibraries>true</UseDebugLibraries>
     <CharacterSet>MultiByte</CharacterSet>
+    @PLATFORM_TOOLSET@
   </PropertyGroup>
   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'" Label="Configuration">
     <ConfigurationType>Application</ConfigurationType>
     <UseDebugLibraries>false</UseDebugLibraries>
     <WholeProgramOptimization>true</WholeProgramOptimization>
     <CharacterSet>MultiByte</CharacterSet>
+    @PLATFORM_TOOLSET@
   </PropertyGroup>
   <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
   <ImportGroup Label="ExtensionSettings">

bin/dnssec/win32/revoke.vcxproj.in

@@ -1,5 +1,5 @@
 <?xml version="1.0" encoding="utf-8"?>
-<Project DefaultTargets="Build" ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+<Project DefaultTargets="Build" ToolsVersion="@TOOLS_VERSION@" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
   <ItemGroup Label="ProjectConfigurations">
     <ProjectConfiguration Include="Debug|@PLATFORM@">
       <Configuration>Debug</Configuration>
@@ -14,18 +14,21 @@
     <ProjectGuid>{D171F185-D3C2-4463-9CF3-ED1D0B1D6832}</ProjectGuid>
     <Keyword>Win32Proj</Keyword>
     <RootNamespace>revoke</RootNamespace>
+    @WINDOWS_TARGET_PLATFORM_VERSION@
   </PropertyGroup>
   <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|@PLATFORM@'" Label="Configuration">
     <ConfigurationType>Application</ConfigurationType>
     <UseDebugLibraries>true</UseDebugLibraries>
     <CharacterSet>MultiByte</CharacterSet>
+    @PLATFORM_TOOLSET@
   </PropertyGroup>
   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'" Label="Configuration">
     <ConfigurationType>Application</ConfigurationType>
     <UseDebugLibraries>false</UseDebugLibraries>
     <WholeProgramOptimization>true</WholeProgramOptimization>
     <CharacterSet>MultiByte</CharacterSet>
+    @PLATFORM_TOOLSET@
   </PropertyGroup>
   <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
   <ImportGroup Label="ExtensionSettings">

bin/dnssec/win32/settime.vcxproj.in

@@ -1,5 +1,5 @@
 <?xml version="1.0" encoding="utf-8"?>
-<Project DefaultTargets="Build" ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+<Project DefaultTargets="Build" ToolsVersion="@TOOLS_VERSION@" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
   <ItemGroup Label="ProjectConfigurations">
     <ProjectConfiguration Include="Debug|@PLATFORM@">
       <Configuration>Debug</Configuration>
@@ -14,18 +14,21 @@
     <ProjectGuid>{03FB7588-C5A7-4572-968F-14F1206BC69C}</ProjectGuid>
     <Keyword>Win32Proj</Keyword>
     <RootNamespace>settime</RootNamespace>
+    @WINDOWS_TARGET_PLATFORM_VERSION@
   </PropertyGroup>
   <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|@PLATFORM@'" Label="Configuration">
     <ConfigurationType>Application</ConfigurationType>
     <UseDebugLibraries>true</UseDebugLibraries>
     <CharacterSet>MultiByte</CharacterSet>
+    @PLATFORM_TOOLSET@
   </PropertyGroup>
   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'" Label="Configuration">
     <ConfigurationType>Application</ConfigurationType>
     <UseDebugLibraries>false</UseDebugLibraries>
     <WholeProgramOptimization>true</WholeProgramOptimization>
     <CharacterSet>MultiByte</CharacterSet>
+    @PLATFORM_TOOLSET@
   </PropertyGroup>
   <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
   <ImportGroup Label="ExtensionSettings">

bin/dnssec/win32/signzone.vcxproj.in

@@ -1,5 +1,5 @@
 <?xml version="1.0" encoding="utf-8"?>
-<Project DefaultTargets="Build" ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+<Project DefaultTargets="Build" ToolsVersion="@TOOLS_VERSION@" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
   <ItemGroup Label="ProjectConfigurations">
     <ProjectConfiguration Include="Debug|@PLATFORM@">
       <Configuration>Debug</Configuration>
@@ -14,18 +14,21 @@
     <ProjectGuid>{205ED8A9-2E4C-41CC-9385-F3613402AA90}</ProjectGuid>
     <Keyword>Win32Proj</Keyword>
     <RootNamespace>signzone</RootNamespace>
+    @WINDOWS_TARGET_PLATFORM_VERSION@
   </PropertyGroup>
   <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|@PLATFORM@'" Label="Configuration">
     <ConfigurationType>Application</ConfigurationType>
     <UseDebugLibraries>true</UseDebugLibraries>
     <CharacterSet>MultiByte</CharacterSet>
+    @PLATFORM_TOOLSET@
   </PropertyGroup>
   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'" Label="Configuration">
     <ConfigurationType>Application</ConfigurationType>
     <UseDebugLibraries>false</UseDebugLibraries>
     <WholeProgramOptimization>true</WholeProgramOptimization>
     <CharacterSet>MultiByte</CharacterSet>
+    @PLATFORM_TOOLSET@
   </PropertyGroup>
   <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
   <ImportGroup Label="ExtensionSettings">

bin/dnssec/win32/verify.vcxproj.in

@@ -1,5 +1,5 @@
 <?xml version="1.0" encoding="utf-8"?>
-<Project DefaultTargets="Build" ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+<Project DefaultTargets="Build" ToolsVersion="@TOOLS_VERSION@" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
   <ItemGroup Label="ProjectConfigurations">
     <ProjectConfiguration Include="Debug|@PLATFORM@">
       <Configuration>Debug</Configuration>
@@ -14,18 +14,21 @@
     <ProjectGuid>{FD653434-F1A8-44A9-85B2-A7468491DA6D}</ProjectGuid>
     <Keyword>Win32Proj</Keyword>
     <RootNamespace>verify</RootNamespace>
+    @WINDOWS_TARGET_PLATFORM_VERSION@
   </PropertyGroup>
   <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|@PLATFORM@'" Label="Configuration">
     <ConfigurationType>Application</ConfigurationType>
     <UseDebugLibraries>true</UseDebugLibraries>
     <CharacterSet>MultiByte</CharacterSet>
+    @PLATFORM_TOOLSET@
   </PropertyGroup>
   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'" Label="Configuration">
     <ConfigurationType>Application</ConfigurationType>
     <UseDebugLibraries>false</UseDebugLibraries>
     <WholeProgramOptimization>true</WholeProgramOptimization>
     <CharacterSet>MultiByte</CharacterSet>
+    @PLATFORM_TOOLSET@
   </PropertyGroup>
   <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
   <ImportGroup Label="ExtensionSettings">

bin/named/Makefile.in

@@ -45,13 +45,14 @@ DLZDRIVER_LIBS =	@DLZ_DRIVER_LIBS@
 CINCLUDES =	-I${srcdir}/include -I${srcdir}/unix/include -I. \
 		${LWRES_INCLUDES} ${DNS_INCLUDES} ${BIND9_INCLUDES} \
 		${ISCCFG_INCLUDES} ${ISCCC_INCLUDES} ${ISC_INCLUDES} \
-		${DLZDRIVER_INCLUDES} ${DBDRIVER_INCLUDES} @DST_OPENSSL_INC@
+		${DLZDRIVER_INCLUDES} ${DBDRIVER_INCLUDES} ${MAXMINDDB_CFLAGS} \
+		@DST_OPENSSL_INC@
 
 CDEFINES =      @CONTRIB_DLZ@ @USE_PKCS11@ @PKCS11_ENGINE@ @CRYPTO@
 
 CWARNINGS =
 
-DNSLIBS =	../../lib/dns/libdns.@A@ @DNS_CRYPTO_LIBS@
+DNSLIBS =	../../lib/dns/libdns.@A@ ${MAXMINDDB_LIBS} @DNS_CRYPTO_LIBS@
 ISCCFGLIBS =	../../lib/isccfg/libisccfg.@A@
 ISCCCLIBS =	../../lib/isccc/libisccc.@A@
 ISCLIBS =	../../lib/isc/libisc.@A@
@@ -82,10 +83,13 @@ SUBDIRS =	unix
 TARGETS =	named@EXEEXT@ lwresd@EXEEXT@
 
 GEOIPLINKOBJS = geoip.@O@
+GEOIP2LINKOBJS = geoip.@O@
 
 OBJS =		builtin.@O@ client.@O@ config.@O@ control.@O@ \
-		controlconf.@O@ fuzz.@O@ @GEOIPLINKOBJS@ interfacemgr.@O@ \
-		listenlist.@O@ log.@O@ logconf.@O@ main.@O@ notify.@O@ \
+		controlconf.@O@ fuzz.@O@ \
+		@GEOIPLINKOBJS@ @GEOIP2LINKOBJS@ \
+		interfacemgr.@O@ listenlist.@O@ log.@O@ logconf.@O@ \
+		main.@O@ notify.@O@ \
 		query.@O@ server.@O@ sortlist.@O@ statschannel.@O@ \
 		tkeyconf.@O@ tsigconf.@O@ update.@O@ xfrout.@O@ \
 		zoneconf.@O@ \
@@ -98,10 +102,13 @@ UOBJS =		unix/os.@O@ unix/dlz_dlopen_driver.@O@
 SYMOBJS =	symtbl.@O@
 
 GEOIPLINKSRCS = geoip.c
+GEOIP2LINKSRCS = geoip.c
 
 SRCS =		builtin.c client.c config.c control.c \
-		controlconf.c fuzz.c @GEOIPLINKSRCS@ interfacemgr.c \
-		listenlist.c log.c logconf.c main.c notify.c \
+		controlconf.c fuzz.c \
+		@GEOIPLINKSRCS@ @GEOIP2LINKSRCS@ \
+		interfacemgr.c \ listenlist.c log.c logconf.c \
+		main.c notify.c \
 		query.c server.c sortlist.c statschannel.c \
 		tkeyconf.c tsigconf.c update.c xfrout.c \
 		zoneconf.c \
@@ -135,6 +142,7 @@ config.@O@: config.c
 		-DDYNDB_LIBDIR=\"@libdir@/bind\" \
 		-DNS_LOCALSTATEDIR=\"${localstatedir}\" \
 		-DNS_SYSCONFDIR=\"${sysconfdir}\" \
+		-DMAXMINDDB_PREFIX=\"@MAXMINDDB_PREFIX@\" \
 		-c ${srcdir}/config.c
 
 server.@O@: server.c

bin/named/bind9.xsl

@@ -15,6 +15,15 @@
   <xsl:template match="statistics[@version=&quot;3.8&quot;]">
     <html>
       <head>
+        <script type="text/javascript" src="https://ajax.googleapis.com/ajax/libs/jquery/3.4.1/jquery.min.js"></script>
+        <script type="text/javascript">
+          $(function($) {
+              var wid=0;
+              $('table.zones').each(function(i) { if( $(this).width() > wid ) wid = $(this).width(); return true; });
+              $('table.zones').css('min-width', wid );
+          });
+        </script>
+
         <xsl:if test="system-property('xsl:vendor')!='Transformiix'">
           <!-- Non Mozilla specific markup -->
           <script type="text/javascript" src="https://www.google.com/jsapi"/>
@@ -221,6 +230,22 @@
       background-color: rgb(1,169,206);
       color: #ffffff;
      }
+     table.zones {
+       border: 1px solid grey;
+     }
+     table.zones td {
+       text-align: right;
+       font-family: monospace;
+     }
+     table.zones td:nth-child(2) {
+       text-align: center;
+     }
+     table.zones td:nth-child(3) {
+       text-align: left;
+     }
+     table.zones tr:hover{
+      background-color: #99ddff;
+     }
 
      td, th {
       padding-right: 5px;
@@ -293,25 +318,25 @@
         <hr/>
         <h2>Server Status</h2>
         <table class="info">
-          <tr>
+          <tr class="odd">
             <th>Boot time:</th>
             <td>
               <xsl:value-of select="server/boot-time"/>
             </td>
           </tr>
-          <tr>
+          <tr class="even">
             <th>Last reconfigured:</th>
             <td>
               <xsl:value-of select="server/config-time"/>
             </td>
           </tr>
-          <tr>
+          <tr class="odd">
             <th>Current time:</th>
             <td>
               <xsl:value-of select="server/current-time"/>
             </td>
           </tr>
-          <tr>
+          <tr class="even">
             <th>Server version:</th>
             <td>
               <xsl:value-of select="server/version"/>
@@ -330,7 +355,13 @@
           <table class="counters">
             <xsl:for-each select="server/counters[@type=&quot;opcode&quot;]/counter[. &gt; 0 or substring(@name,1,3) != 'RES']">
               <xsl:sort select="." data-type="number" order="descending"/>
-              <tr>
+                <xsl:variable name="css-class0">
+                  <xsl:choose>
+                    <xsl:when test="position() mod 2 = 0">even</xsl:when>
+                    <xsl:otherwise>odd</xsl:otherwise>
+                  </xsl:choose>
+                </xsl:variable>
+                <tr class="{$css-class0}">
                 <th>
                   <xsl:value-of select="@name"/>
                 </th>
@@ -611,13 +642,13 @@
             <br/>
           </xsl:if>
         </xsl:for-each>
-        <xsl:if test="traffic/udp/counters[@type=&quot;request-size&quot;]/counter[.&gt;0] or traffic/udp/counters[@type=&quot;response-size&quot;]/counter[.&gt;0] or traffic/tcp/counters[@type=&quot;request-size&quot;]/counter[.&gt;0] or traffic/tcp/counters[@type=&quot;response-size&quot;]/counter[.&gt;0]">
+        <xsl:if test="traffic//udp/counters[@type=&quot;request-size&quot;]/counter[.&gt;0] or traffic//udp/counters[@type=&quot;response-size&quot;]/counter[.&gt;0] or traffic//tcp/counters[@type=&quot;request-size&quot;]/counter[.&gt;0] or traffic//tcp/counters[@type=&quot;response-size&quot;]/counter[.&gt;0]">
           <h2>Traffic Size Statistics</h2>
         </xsl:if>
-        <xsl:if test="traffic/udp/counters[@type=&quot;request-size&quot;]/counter[.&gt;0]">
+        <xsl:if test="traffic//udp/counters[@type=&quot;request-size&quot;]/counter[.&gt;0]">
           <h4>UDP Requests Received</h4>
           <table class="counters">
-            <xsl:for-each select="traffic/udp/counters[@type=&quot;request-size&quot;]/counter[.&gt;0]">
+            <xsl:for-each select="traffic//udp/counters[@type=&quot;request-size&quot;]/counter[.&gt;0]">
               <xsl:variable name="css-class7">
                 <xsl:choose>
                   <xsl:when test="position() mod 2 = 0">even</xsl:when>
@@ -625,6 +656,7 @@
                 </xsl:choose>
               </xsl:variable>
               <tr class="{$css-class7}">
+                <th><xsl:value-of select="local-name(../../..)"/></th>
                 <th>
                   <xsl:value-of select="@name"/>
                 </th>
@@ -636,10 +668,10 @@
           </table>
           <br/>
         </xsl:if>
-        <xsl:if test="traffic/udp/counters[@type=&quot;response-size&quot;]/counter[.&gt;0]">
+        <xsl:if test="traffic//udp/counters[@type=&quot;response-size&quot;]/counter[.&gt;0]">
           <h4>UDP Responses Sent</h4>
           <table class="counters">
-            <xsl:for-each select="traffic/udp/counters[@type=&quot;response-size&quot;]/counter[.&gt;0]">
+            <xsl:for-each select="traffic//udp/counters[@type=&quot;response-size&quot;]/counter[.&gt;0]">
               <xsl:variable name="css-class7">
                 <xsl:choose>
                   <xsl:when test="position() mod 2 = 0">even</xsl:when>
@@ -647,6 +679,7 @@
                 </xsl:choose>
               </xsl:variable>
               <tr class="{$css-class7}">
+                <th><xsl:value-of select="local-name(../../..)"/></th>
                 <th>
                   <xsl:value-of select="@name"/>
                 </th>
@@ -658,10 +691,10 @@
           </table>
           <br/>
         </xsl:if>
-        <xsl:if test="traffic/tcp/counters[@type=&quot;request-size&quot;]/counter[.&gt;0]">
+        <xsl:if test="traffic//tcp/counters[@type=&quot;request-size&quot;]/counter[.&gt;0]">
           <h4>TCP Requests Received</h4>
           <table class="counters">
-            <xsl:for-each select="traffic/tcp/counters[@type=&quot;request-size&quot;]/counter[.&gt;0]">
+            <xsl:for-each select="traffic//tcp/counters[@type=&quot;request-size&quot;]/counter[.&gt;0]">
               <xsl:variable name="css-class7">
                 <xsl:choose>
                   <xsl:when test="position() mod 2 = 0">even</xsl:when>
@@ -669,6 +702,7 @@
                 </xsl:choose>
               </xsl:variable>
               <tr class="{$css-class7}">
+                <th><xsl:value-of select="local-name(../../..)"/></th>
                 <th>
                   <xsl:value-of select="@name"/>
                 </th>
@@ -680,10 +714,10 @@
           </table>
           <br/>
         </xsl:if>
-        <xsl:if test="traffic/tcp/counters[@type=&quot;response-size&quot;]/counter[.&gt;0]">
+        <xsl:if test="traffic//tcp/counters[@type=&quot;response-size&quot;]/counter[.&gt;0]">
           <h4>TCP Responses Sent</h4>
           <table class="counters">
-            <xsl:for-each select="traffic/tcp/counters[@type=&quot;response-size&quot;]/counter[.&gt;0]">
+            <xsl:for-each select="traffic//tcp/counters[@type=&quot;response-size&quot;]/counter[.&gt;0]">
               <xsl:variable name="css-class7">
                 <xsl:choose>
                   <xsl:when test="position() mod 2 = 0">even</xsl:when>
@@ -691,6 +725,7 @@
                 </xsl:choose>
               </xsl:variable>
               <tr class="{$css-class7}">
+                <th><xsl:value-of select="local-name(../../..)"/></th>
                 <th>
                   <xsl:value-of select="@name"/>
                 </th>
@@ -724,35 +759,29 @@
           </table>
           <br/>
         </xsl:if>
-        <xsl:for-each select="views/view">
-	  <xsl:if test="zones/zone">
+        <xsl:if test="views/view/zones/zone">
+          <xsl:for-each select="views/view">
             <h3>Zones for View <xsl:value-of select="@name"/></h3>
             <table class="zones">
-              <tr>
-                <th>Name</th>
-                <th>Class</th>
-                <th>Type</th>
-                <th>Serial</th>
-              </tr>
-              <xsl:for-each select="zones/zone">
-                <tr>
-                  <td>
-                    <xsl:value-of select="@name"/>
-                  </td>
-                  <td>
-                    <xsl:value-of select="@rdataclass"/>
-                  </td>
-                  <td>
-                    <xsl:value-of select="type"/>
-                  </td>
-                  <td>
-                    <xsl:value-of select="serial"/>
-                  </td>
-                </tr>
-              </xsl:for-each>
+              <thead><tr><th>Name</th><th>Class</th><th>Type</th><th>Serial</th></tr></thead>
+              <tbody>
+                <xsl:for-each select="zones/zone">
+                  <xsl:variable name="css-class15">
+                    <xsl:choose>
+                      <xsl:when test="position() mod 2 = 0">even</xsl:when>
+                      <xsl:otherwise>odd</xsl:otherwise>
+                    </xsl:choose>
+                  </xsl:variable>
+                  <tr class="{$css-class15}">
+                      <td><xsl:value-of select="@name"/></td>
+                      <td><xsl:value-of select="@rdataclass"/></td>
+                      <td><xsl:value-of select="type"/></td>
+                      <td><xsl:value-of select="serial"/></td></tr>
+                </xsl:for-each>
+              </tbody>
             </table>
-	  </xsl:if>
-        </xsl:for-each>
+          </xsl:for-each>
+        </xsl:if>
         <xsl:if test="views/view[zones/zone/counters[@type=&quot;qtype&quot;]/counter &gt;0]">
           <h2>Received QTYPES per view/zone</h2>
           <xsl:for-each select="views/view[zones/zone/counters[@type=&quot;qtype&quot;]/counter &gt;0]">

bin/named/bind9.xsl.h

@@ -20,6 +20,15 @@ static char xslmsg[] =
 	" <xsl:template match=\"statistics[@version=&quot;3.8&quot;]\">\n"
 	" <html>\n"
 	" <head>\n"
+	" <script type=\"text/javascript\" src=\"https://ajax.googleapis.com/ajax/libs/jquery/3.4.1/jquery.min.js\"></script>\n"
+	" <script type=\"text/javascript\">\n"
+	" $(function($) {\n"
+	" var wid=0;\n"
+	" $('table.zones').each(function(i) { if( $(this).width() > wid ) wid = $(this).width(); return true; });\n"
+	" $('table.zones').css('min-width', wid );\n"
+	" });\n"
+	" </script>\n"
+	"\n"
 	" <xsl:if test=\"system-property('xsl:vendor')!='Transformiix'\">\n"
 	" <!-- Non Mozilla specific markup -->\n"
 	" <script type=\"text/javascript\" src=\"https://www.google.com/jsapi\"/>\n"
@@ -226,6 +235,22 @@ static char xslmsg[] =
 	" background-color: rgb(1,169,206);\n"
 	" color: #ffffff;\n"
 	" }\n"
+	" table.zones {\n"
+	" border: 1px solid grey;\n"
+	" }\n"
+	" table.zones td {\n"
+	" text-align: right;\n"
+	" font-family: monospace;\n"
+	" }\n"
+	" table.zones td:nth-child(2) {\n"
+	" text-align: center;\n"
+	" }\n"
+	" table.zones td:nth-child(3) {\n"
+	" text-align: left;\n"
+	" }\n"
+	" table.zones tr:hover{\n"
+	" background-color: #99ddff;\n"
+	" }\n"
 	"\n"
 	" td, th {\n"
 	" padding-right: 5px;\n"
@@ -298,25 +323,25 @@ static char xslmsg[] =
 	" <hr/>\n"
 	" <h2>Server Status</h2>\n"
 	" <table class=\"info\">\n"
-	" <tr>\n"
+	" <tr class=\"odd\">\n"
 	" <th>Boot time:</th>\n"
 	" <td>\n"
 	" <xsl:value-of select=\"server/boot-time\"/>\n"
 	" </td>\n"
 	" </tr>\n"
-	" <tr>\n"
+	" <tr class=\"even\">\n"
 	" <th>Last reconfigured:</th>\n"
 	" <td>\n"
 	" <xsl:value-of select=\"server/config-time\"/>\n"
 	" </td>\n"
 	" </tr>\n"
-	" <tr>\n"
+	" <tr class=\"odd\">\n"
 	" <th>Current time:</th>\n"
 	" <td>\n"
 	" <xsl:value-of select=\"server/current-time\"/>\n"
 	" </td>\n"
 	" </tr>\n"
-	" <tr>\n"
+	" <tr class=\"even\">\n"
 	" <th>Server version:</th>\n"
 	" <td>\n"
 	" <xsl:value-of select=\"server/version\"/>\n"
@@ -335,7 +360,13 @@ static char xslmsg[] =
 	" <table class=\"counters\">\n"
 	" <xsl:for-each select=\"server/counters[@type=&quot;opcode&quot;]/counter[. &gt; 0 or substring(@name,1,3) != 'RES']\">\n"
 	" <xsl:sort select=\".\" data-type=\"number\" order=\"descending\"/>\n"
-	" <tr>\n"
+	" <xsl:variable name=\"css-class0\">\n"
+	" <xsl:choose>\n"
+	" <xsl:when test=\"position() mod 2 = 0\">even</xsl:when>\n"
+	" <xsl:otherwise>odd</xsl:otherwise>\n"
+	" </xsl:choose>\n"
+	" </xsl:variable>\n"
+	" <tr class=\"{$css-class0}\">\n"
 	" <th>\n"
 	" <xsl:value-of select=\"@name\"/>\n"
 	" </th>\n"
@@ -616,13 +647,13 @@ static char xslmsg[] =
 	" <br/>\n"
 	" </xsl:if>\n"
 	" </xsl:for-each>\n"
-	" <xsl:if test=\"traffic/udp/counters[@type=&quot;request-size&quot;]/counter[.&gt;0] or traffic/udp/counters[@type=&quot;response-size&quot;]/counter[.&gt;0] or traffic/tcp/counters[@type=&quot;request-size&quot;]/counter[.&gt;0] or traffic/tcp/counters[@type=&quot;response-size&quot;]/counter[.&gt;0]\">\n"
+	" <xsl:if test=\"traffic//udp/counters[@type=&quot;request-size&quot;]/counter[.&gt;0] or traffic//udp/counters[@type=&quot;response-size&quot;]/counter[.&gt;0] or traffic//tcp/counters[@type=&quot;request-size&quot;]/counter[.&gt;0] or traffic//tcp/counters[@type=&quot;response-size&quot;]/counter[.&gt;0]\">\n"
 	" <h2>Traffic Size Statistics</h2>\n"
 	" </xsl:if>\n"
-	" <xsl:if test=\"traffic/udp/counters[@type=&quot;request-size&quot;]/counter[.&gt;0]\">\n"
+	" <xsl:if test=\"traffic//udp/counters[@type=&quot;request-size&quot;]/counter[.&gt;0]\">\n"
 	" <h4>UDP Requests Received</h4>\n"
 	" <table class=\"counters\">\n"
-	" <xsl:for-each select=\"traffic/udp/counters[@type=&quot;request-size&quot;]/counter[.&gt;0]\">\n"
+	" <xsl:for-each select=\"traffic//udp/counters[@type=&quot;request-size&quot;]/counter[.&gt;0]\">\n"
 	" <xsl:variable name=\"css-class7\">\n"
 	" <xsl:choose>\n"
 	" <xsl:when test=\"position() mod 2 = 0\">even</xsl:when>\n"
@@ -630,6 +661,7 @@ static char xslmsg[] =
 	" </xsl:choose>\n"
 	" </xsl:variable>\n"
 	" <tr class=\"{$css-class7}\">\n"
+	" <th><xsl:value-of select=\"local-name(../../..)\"/></th>\n"
 	" <th>\n"
 	" <xsl:value-of select=\"@name\"/>\n"
 	" </th>\n"
@@ -641,10 +673,10 @@ static char xslmsg[] =
 	" </table>\n"
 	" <br/>\n"
 	" </xsl:if>\n"
-	" <xsl:if test=\"traffic/udp/counters[@type=&quot;response-size&quot;]/counter[.&gt;0]\">\n"
+	" <xsl:if test=\"traffic//udp/counters[@type=&quot;response-size&quot;]/counter[.&gt;0]\">\n"
 	" <h4>UDP Responses Sent</h4>\n"
 	" <table class=\"counters\">\n"
-	" <xsl:for-each select=\"traffic/udp/counters[@type=&quot;response-size&quot;]/counter[.&gt;0]\">\n"
+	" <xsl:for-each select=\"traffic//udp/counters[@type=&quot;response-size&quot;]/counter[.&gt;0]\">\n"
 	" <xsl:variable name=\"css-class7\">\n"
 	" <xsl:choose>\n"
 	" <xsl:when test=\"position() mod 2 = 0\">even</xsl:when>\n"
@@ -652,6 +684,7 @@ static char xslmsg[] =
 	" </xsl:choose>\n"
 	" </xsl:variable>\n"
 	" <tr class=\"{$css-class7}\">\n"
+	" <th><xsl:value-of select=\"local-name(../../..)\"/></th>\n"
 	" <th>\n"
 	" <xsl:value-of select=\"@name\"/>\n"
 	" </th>\n"
@@ -663,10 +696,10 @@ static char xslmsg[] =
 	" </table>\n"
 	" <br/>\n"
 	" </xsl:if>\n"
-	" <xsl:if test=\"traffic/tcp/counters[@type=&quot;request-size&quot;]/counter[.&gt;0]\">\n"
+	" <xsl:if test=\"traffic//tcp/counters[@type=&quot;request-size&quot;]/counter[.&gt;0]\">\n"
 	" <h4>TCP Requests Received</h4>\n"
 	" <table class=\"counters\">\n"
-	" <xsl:for-each select=\"traffic/tcp/counters[@type=&quot;request-size&quot;]/counter[.&gt;0]\">\n"
+	" <xsl:for-each select=\"traffic//tcp/counters[@type=&quot;request-size&quot;]/counter[.&gt;0]\">\n"
 	" <xsl:variable name=\"css-class7\">\n"
 	" <xsl:choose>\n"
 	" <xsl:when test=\"position() mod 2 = 0\">even</xsl:when>\n"
@@ -674,6 +707,7 @@ static char xslmsg[] =
 	" </xsl:choose>\n"
 	" </xsl:variable>\n"
 	" <tr class=\"{$css-class7}\">\n"
+	" <th><xsl:value-of select=\"local-name(../../..)\"/></th>\n"
 	" <th>\n"
 	" <xsl:value-of select=\"@name\"/>\n"
 	" </th>\n"
@@ -685,10 +719,10 @@ static char xslmsg[] =
 	" </table>\n"
 	" <br/>\n"
 	" </xsl:if>\n"
-	" <xsl:if test=\"traffic/tcp/counters[@type=&quot;response-size&quot;]/counter[.&gt;0]\">\n"
+	" <xsl:if test=\"traffic//tcp/counters[@type=&quot;response-size&quot;]/counter[.&gt;0]\">\n"
 	" <h4>TCP Responses Sent</h4>\n"
 	" <table class=\"counters\">\n"
-	" <xsl:for-each select=\"traffic/tcp/counters[@type=&quot;response-size&quot;]/counter[.&gt;0]\">\n"
+	" <xsl:for-each select=\"traffic//tcp/counters[@type=&quot;response-size&quot;]/counter[.&gt;0]\">\n"
 	" <xsl:variable name=\"css-class7\">\n"
 	" <xsl:choose>\n"
 	" <xsl:when test=\"position() mod 2 = 0\">even</xsl:when>\n"
@@ -696,6 +730,7 @@ static char xslmsg[] =
 	" </xsl:choose>\n"
 	" </xsl:variable>\n"
 	" <tr class=\"{$css-class7}\">\n"
+	" <th><xsl:value-of select=\"local-name(../../..)\"/></th>\n"
 	" <th>\n"
 	" <xsl:value-of select=\"@name\"/>\n"
 	" </th>\n"
@@ -729,35 +764,29 @@ static char xslmsg[] =
 	" </table>\n"
 	" <br/>\n"
 	" </xsl:if>\n"
+	" <xsl:if test=\"views/view/zones/zone\">\n"
 	" <xsl:for-each select=\"views/view\">\n"
-	" <xsl:if test=\"zones/zone\">\n"
 	" <h3>Zones for View <xsl:value-of select=\"@name\"/></h3>\n"
 	" <table class=\"zones\">\n"
-	" <tr>\n"
-	" <th>Name</th>\n"
-	" <th>Class</th>\n"
-	" <th>Type</th>\n"
-	" <th>Serial</th>\n"
-	" </tr>\n"
+	" <thead><tr><th>Name</th><th>Class</th><th>Type</th><th>Serial</th></tr></thead>\n"
+	" <tbody>\n"
 	" <xsl:for-each select=\"zones/zone\">\n"
-	" <tr>\n"
-	" <td>\n"
-	" <xsl:value-of select=\"@name\"/>\n"
-	" </td>\n"
-	" <td>\n"
-	" <xsl:value-of select=\"@rdataclass\"/>\n"
-	" </td>\n"
-	" <td>\n"
-	" <xsl:value-of select=\"type\"/>\n"
-	" </td>\n"
-	" <td>\n"
-	" <xsl:value-of select=\"serial\"/>\n"
-	" </td>\n"
-	" </tr>\n"
+	" <xsl:variable name=\"css-class15\">\n"
+	" <xsl:choose>\n"
+	" <xsl:when test=\"position() mod 2 = 0\">even</xsl:when>\n"
+	" <xsl:otherwise>odd</xsl:otherwise>\n"
+	" </xsl:choose>\n"
+	" </xsl:variable>\n"
+	" <tr class=\"{$css-class15}\">\n"
+	" <td><xsl:value-of select=\"@name\"/></td>\n"
+	" <td><xsl:value-of select=\"@rdataclass\"/></td>\n"
+	" <td><xsl:value-of select=\"type\"/></td>\n"
+	" <td><xsl:value-of select=\"serial\"/></td></tr>\n"
 	" </xsl:for-each>\n"
+	" </tbody>\n"
 	" </table>\n"
-	" </xsl:if>\n"
 	" </xsl:for-each>\n"
+	" </xsl:if>\n"
 	" <xsl:if test=\"views/view[zones/zone/counters[@type=&quot;qtype&quot;]/counter &gt;0]\">\n"
 	" <h2>Received QTYPES per view/zone</h2>\n"
 	" <xsl:for-each select=\"views/view[zones/zone/counters[@type=&quot;qtype&quot;]/counter &gt;0]\">\n"

bin/named/client.c

@@ -25,6 +25,7 @@
 #include <isc/random.h>
 #include <isc/safe.h>
 #include <isc/serial.h>
+#include <isc/siphash.h>
 #include <isc/stats.h>
 #include <isc/stdio.h>
 #include <isc/string.h>
@@ -246,10 +247,11 @@ static void ns_client_dumpmessage(ns_client_t *client, const char *reason);
 static isc_result_t get_client(ns_clientmgr_t *manager, ns_interface_t *ifp,
 			       dns_dispatch_t *disp, bool tcp);
 static isc_result_t get_worker(ns_clientmgr_t *manager, ns_interface_t *ifp,
-			       isc_socket_t *sock);
+			       isc_socket_t *sock, ns_client_t *oldclient);
 static inline bool
-allowed(isc_netaddr_t *addr, dns_name_t *signer, isc_netaddr_t *ecs_addr,
-	uint8_t ecs_addrlen, uint8_t *ecs_scope, dns_acl_t *acl);
+allowed(isc_netaddr_t *addr, dns_name_t *signer,
+	isc_netaddr_t *ecs_addr, uint8_t ecs_addrlen,
+	uint8_t *ecs_scope, dns_acl_t *acl);
 static void compute_cookie(ns_client_t *client, uint32_t when,
 			   uint32_t nonce, const unsigned char *secret,
 			   isc_buffer_t *buf);
@@ -298,6 +300,121 @@ ns_client_settimeout(ns_client_t *client, unsigned int seconds) {
 	}
 }
 
+/*%
+ * Allocate a reference-counted object that will maintain a single pointer to
+ * the (also reference-counted) TCP client quota, shared between all the
+ * clients processing queries on a single TCP connection, so that all
+ * clients sharing the one socket will together consume only one slot in
+ * the 'tcp-clients' quota.
+ */
+static isc_result_t
+tcpconn_init(ns_client_t *client, bool force) {
+	isc_result_t result;
+	isc_quota_t *quota = NULL;
+	ns_tcpconn_t *tconn = NULL;
+
+	REQUIRE(client->tcpconn == NULL);
+
+	/*
+	 * Try to attach to the quota first, so we won't pointlessly
+	 * allocate memory for a tcpconn object if we can't get one.
+	 */
+	if (force) {
+		result = isc_quota_force(&ns_g_server->tcpquota, &quota);
+	} else {
+		result = isc_quota_attach(&ns_g_server->tcpquota, &quota);
+	}
+	if (result != ISC_R_SUCCESS) {
+		return (result);
+	}
+
+	/*
+	 * A global memory context is used for the allocation as different
+	 * client structures may have different memory contexts assigned and a
+	 * reference counter allocated here might need to be freed by a
+	 * different client.  The performance impact caused by memory context
+	 * contention here is expected to be negligible, given that this code
+	 * is only executed for TCP connections.
+	 */
+	tconn = isc_mem_allocate(ns_g_mctx, sizeof(*tconn));
+	if (tconn == NULL) {
+		isc_quota_detach(&quota);
+		return (ISC_R_NOMEMORY);
+	}
+
+	isc_refcount_init(&tconn->refs, 1);
+	tconn->tcpquota = quota;
+	quota = NULL;
+	tconn->pipelined = false;
+
+	client->tcpconn = tconn;
+
+	return (ISC_R_SUCCESS);
+}
+
+/*%
+ * Increase the count of client structures sharing the TCP connection
+ * that 'source' is associated with; add a pointer to the same tcpconn
+ * to 'target', thus associating it with the same TCP connection.
+ */
+static void
+tcpconn_attach(ns_client_t *source, ns_client_t *target) {
+	int refs;
+
+	REQUIRE(source->tcpconn != NULL);
+	REQUIRE(target->tcpconn == NULL);
+	REQUIRE(source->tcpconn->pipelined);
+
+	isc_refcount_increment(&source->tcpconn->refs, &refs);
+	INSIST(refs > 1);
+	target->tcpconn = source->tcpconn;
+}
+
+/*%
+ * Decrease the count of client structures sharing the TCP connection that
+ * 'client' is associated with.  If this is the last client using this TCP
+ * connection, we detach from the TCP quota and free the tcpconn
+ * object. Either way, client->tcpconn is set to NULL.
+ */
+static void
+tcpconn_detach(ns_client_t *client) {
+	ns_tcpconn_t *tconn = NULL;
+	int refs;
+
+	REQUIRE(client->tcpconn != NULL);
+
+	tconn = client->tcpconn;
+	client->tcpconn = NULL;
+
+	isc_refcount_decrement(&tconn->refs, &refs);
+	if (refs == 0) {
+		isc_quota_detach(&tconn->tcpquota);
+		isc_mem_free(ns_g_mctx, tconn);
+	}
+}
+
+/*%
+ * Mark a client as active and increment the interface's 'ntcpactive'
+ * counter, as a signal that there is at least one client servicing
+ * TCP queries for the interface. If we reach the TCP client quota at
+ * some point, this will be used to determine whether a quota overrun
+ * should be permitted.
+ *
+ * Marking the client active with the 'tcpactive' flag ensures proper
+ * accounting, by preventing us from incrementing or decrementing
+ * 'ntcpactive' more than once per client.
+ */
+static void
+mark_tcp_active(ns_client_t *client, bool active) {
+	if (active && !client->tcpactive) {
+		isc_refcount_increment0(&client->interface->ntcpactive, NULL);
+		client->tcpactive = active;
+	} else if (!active && client->tcpactive) {
+		isc_refcount_decrement(&client->interface->ntcpactive, NULL);
+		client->tcpactive = active;
+	}
+}
+
 /*%
  * Check for a deactivation or shutdown request and take appropriate
  * action.  Returns true if either is in progress; in this case
@@ -387,7 +504,8 @@ exit_check(ns_client_t *client) {
 		INSIST(client->recursionquota == NULL);
 
 		if (NS_CLIENTSTATE_READING == client->newstate) {
-			if (!client->pipelined) {
+			INSIST(client->tcpconn != NULL);
+			if (!client->tcpconn->pipelined) {
 				client_read(client);
 				client->newstate = NS_CLIENTSTATE_MAX;
 				return (true); /* We're done. */
@@ -405,25 +523,62 @@ exit_check(ns_client_t *client) {
 		 */
 		INSIST(client->recursionquota == NULL);
 		INSIST(client->newstate <= NS_CLIENTSTATE_READY);
-		if (client->nreads > 0)
+
+		if (client->nreads > 0) {
 			dns_tcpmsg_cancelread(&client->tcpmsg);
-		if (client->nreads != 0) {
-			/* Still waiting for read cancel completion. */
-			return (true);
+			/* Still waiting for read cancel completion? */
+			if (client->nreads > 0) {
+				return (true);
+			}
 		}
 
 		if (client->tcpmsg_valid) {
 			dns_tcpmsg_invalidate(&client->tcpmsg);
 			client->tcpmsg_valid = false;
 		}
+
+		/*
+		 * Soon the client will be ready to accept a new TCP
+		 * connection or UDP request, but we may have enough
+		 * clients doing that already.  Check whether this client
+		 * needs to remain active and allow it go inactive if
+		 * not.
+		 *
+		 * UDP clients always go inactive at this point, but a TCP
+		 * client may need to stay active and return to READY
+		 * state if no other clients are available to listen
+		 * for TCP requests on this interface.
+		 *
+		 * Regardless, if we're going to FREED state, that means
+		 * the system is shutting down and we don't need to
+		 * retain clients.
+		 */
+		if (client->mortal && TCP_CLIENT(client) &&
+		    client->newstate != NS_CLIENTSTATE_FREED &&
+		    !ns_g_clienttest &&
+		    isc_refcount_current(&client->interface->ntcpaccepting) == 0)
+		{
+			/* Nobody else is accepting */
+			client->mortal = false;
+			client->newstate = NS_CLIENTSTATE_READY;
+		}
+
+		/*
+		 * Detach from TCP connection and TCP client quota,
+		 * if appropriate. If this is the last reference to
+		 * the TCP connection in our pipeline group, the
+		 * TCP quota slot will be released.
+		 */
+		if (client->tcpconn) {
+			tcpconn_detach(client);
+		}
+
 		if (client->tcpsocket != NULL) {
 			CTRACE("closetcp");
 			isc_socket_detach(&client->tcpsocket);
+			mark_tcp_active(client, false);
 		}
 
-		if (client->tcpquota != NULL)
-			isc_quota_detach(&client->tcpquota);
-
 		if (client->timerset) {
 			(void)isc_timer_reset(client->timer,
 					      isc_timertype_inactive,
@@ -431,45 +586,26 @@ exit_check(ns_client_t *client) {
 			client->timerset = false;
 		}
 
-		client->pipelined = false;
-
 		client->peeraddr_valid = false;
 
 		client->state = NS_CLIENTSTATE_READY;
-		INSIST(client->recursionquota == NULL);
-
-		/*
-		 * Now the client is ready to accept a new TCP connection
-		 * or UDP request, but we may have enough clients doing
-		 * that already.  Check whether this client needs to remain
-		 * active and force it to go inactive if not.
-		 *
-		 * UDP clients go inactive at this point, but TCP clients
-		 * may remain active if we have fewer active TCP client
-		 * objects than desired due to an earlier quota exhaustion.
-		 */
-		if (client->mortal && TCP_CLIENT(client) && !ns_g_clienttest) {
-			LOCK(&client->interface->lock);
-			if (client->interface->ntcpcurrent <
-				    client->interface->ntcptarget)
-				client->mortal = false;
-			UNLOCK(&client->interface->lock);
-		}
 
 		/*
 		 * We don't need the client; send it to the inactive
 		 * queue for recycling.
 		 */
 		if (client->mortal) {
-			if (client->newstate > NS_CLIENTSTATE_INACTIVE)
+			if (client->newstate > NS_CLIENTSTATE_INACTIVE) {
 				client->newstate = NS_CLIENTSTATE_INACTIVE;
+			}
 		}
 
 		if (NS_CLIENTSTATE_READY == client->newstate) {
 			if (TCP_CLIENT(client)) {
 				client_accept(client);
-			} else
+			} else {
 				client_udprecv(client);
+			}
 			client->newstate = NS_CLIENTSTATE_MAX;
 			return (true);
 		}
@@ -481,41 +617,48 @@ exit_check(ns_client_t *client) {
 		/*
 		 * We are trying to enter the inactive state.
 		 */
-		if (client->naccepts > 0)
+		if (client->naccepts > 0) {
 			isc_socket_cancel(client->tcplistener, client->task,
 					  ISC_SOCKCANCEL_ACCEPT);
-
-		/* Still waiting for accept cancel completion. */
-		if (! (client->naccepts == 0))
-			return (true);
+			/* Still waiting for accept cancel completion? */
+			if (client->naccepts > 0) {
+				return (true);
+			}
+		}
 
 		/* Accept cancel is complete. */
-		if (client->nrecvs > 0)
+		if (client->nrecvs > 0) {
 			isc_socket_cancel(client->udpsocket, client->task,
 					  ISC_SOCKCANCEL_RECV);
-
-		/* Still waiting for recv cancel completion. */
-		if (! (client->nrecvs == 0))
-			return (true);
+			/* Still waiting for recv cancel completion? */
+			if (client->nrecvs > 0) {
+				return (true);
+			}
+		}
 
 		/* Still waiting for control event to be delivered */
-		if (client->nctls > 0)
+		if (client->nctls > 0) {
 			return (true);
-
-		/* Deactivate the client. */
-		if (client->interface)
-			ns_interface_detach(&client->interface);
+		}
 
 		INSIST(client->naccepts == 0);
 		INSIST(client->recursionquota == NULL);
-		if (client->tcplistener != NULL)
+		if (client->tcplistener != NULL) {
 			isc_socket_detach(&client->tcplistener);
-
-		if (client->udpsocket != NULL)
+			mark_tcp_active(client, false);
+		}
+		if (client->udpsocket != NULL) {
 			isc_socket_detach(&client->udpsocket);
+		}
 
-		if (client->dispatch != NULL)
+		/* Deactivate the client. */
+		if (client->interface != NULL) {
+			ns_interface_detach(&client->interface);
+		}
+
+		if (client->dispatch != NULL) {
 			dns_dispatch_detach(&client->dispatch);
+		}
 
 		client->attributes = 0;
 		client->mortal = false;
@@ -540,10 +683,13 @@ exit_check(ns_client_t *client) {
 			client->newstate = NS_CLIENTSTATE_MAX;
 			if (!ns_g_clienttest && manager != NULL &&
 			    !manager->exiting)
+			{
 				ISC_QUEUE_PUSH(manager->inactive, client,
 					       ilink);
-			if (client->needshutdown)
+			}
+			if (client->needshutdown) {
 				isc_task_shutdown(client->task);
+			}
 			return (true);
 		}
 	}
@@ -654,7 +800,7 @@ client_start(isc_task_t *task, isc_event_t *event) {
 		return;
 
 	if (TCP_CLIENT(client)) {
-		if (client->pipelined) {
+		if (client->tcpconn != NULL) {
 			client_read(client);
 		} else {
 			client_accept(client);
@@ -664,7 +810,6 @@ client_start(isc_task_t *task, isc_event_t *event) {
 	}
 }
 
-
 /*%
  * The client's task has received a shutdown event.
  */
@@ -900,7 +1045,6 @@ client_sendpkg(ns_client_t *client, isc_buffer_t *buffer) {
 	isc_netaddr_t netaddr;
 	int match;
 	unsigned int sockflags = ISC_SOCKFLAG_IMMEDIATE;
-	isc_dscp_t dispdscp = -1;
 
 	if (TCP_CLIENT(client)) {
 		sock = client->tcpsocket;
@@ -927,9 +1071,10 @@ client_sendpkg(ns_client_t *client, isc_buffer_t *buffer) {
 		pktinfo = NULL;
 
 	if (client->dispatch != NULL) {
-		dispdscp = dns_dispatch_getdscp(client->dispatch);
-		if (dispdscp != -1)
-			client->dscp = dispdscp;
+		isc_dscp_t dscp = dns_dispatch_getdscp(client->dispatch);
+		if (dscp != -1) {
+			client->dscp = dscp;
+		}
 	}
 
 	if (client->dscp == -1) {
@@ -1785,6 +1930,42 @@ compute_cookie(ns_client_t *client, uint32_t when, uint32_t nonce,
 	       const unsigned char *secret, isc_buffer_t *buf)
 {
 	switch (ns_g_server->cookiealg) {
+	case ns_cookiealg_siphash24: {
+		unsigned char digest[ISC_SIPHASH24_TAG_LENGTH] = { 0 };
+		unsigned char input[16 + 16] = { 0 };
+		size_t inputlen = 0;
+		isc_netaddr_t netaddr;
+		unsigned char *cp;
+
+		cp = isc_buffer_used(buf);
+		isc_buffer_putmem(buf, client->cookie, 8);
+		isc_buffer_putuint8(buf, NS_COOKIE_VERSION_1);
+		isc_buffer_putuint24(buf, 0); /* Reserved */
+		isc_buffer_putuint32(buf, when);
+
+		memmove(input, cp, 16);
+
+		isc_netaddr_fromsockaddr(&netaddr, &client->peeraddr);
+		switch (netaddr.family) {
+		case AF_INET:
+			cp = (unsigned char *)&netaddr.type.in;
+			memmove(input + 16, cp, 4);
+			inputlen = 20;
+			break;
+		case AF_INET6:
+			cp = (unsigned char *)&netaddr.type.in6;
+			memmove(input + 16, cp, 16);
+			inputlen = 32;
+			break;
+		default:
+			INSIST(0);
+			ISC_UNREACHABLE();
+		}
+
+		isc_siphash24(secret, input, inputlen, digest);
+		isc_buffer_putmem(buf, digest, 8);
+		break;
+	}
 #if defined(HAVE_OPENSSL_AES) || defined(HAVE_OPENSSL_EVP_AES)
 	case ns_cookiealg_aes: {
 		unsigned char digest[ISC_AES_BLOCK_LENGTH];
@@ -1793,15 +1974,15 @@ compute_cookie(ns_client_t *client, uint32_t when, uint32_t nonce,
 		unsigned char *cp;
 		unsigned int i;
 
-		memset(input, 0, sizeof(input));
 		cp = isc_buffer_used(buf);
 		isc_buffer_putmem(buf, client->cookie, 8);
 		isc_buffer_putuint32(buf, nonce);
 		isc_buffer_putuint32(buf, when);
 		memmove(input, cp, 16);
 		isc_aes128_crypt(secret, input, digest);
-		for (i = 0; i < 8; i++)
+		for (i = 0; i < 8; i++) {
 			input[i] = digest[i] ^ digest[i + 8];
+		}
 		isc_netaddr_fromsockaddr(&netaddr, &client->peeraddr);
 		switch (netaddr.family) {
 		case AF_INET:
@@ -1814,14 +1995,19 @@ compute_cookie(ns_client_t *client, uint32_t when, uint32_t nonce,
 			cp = (unsigned char *)&netaddr.type.in6;
 			memmove(input + 8, cp, 16);
 			isc_aes128_crypt(secret, input, digest);
-			for (i = 0; i < 8; i++)
+			for (i = 0; i < 8; i++) {
 				input[i + 8] = digest[i] ^ digest[i + 8];
+			}
 			isc_aes128_crypt(ns_g_server->secret, input + 8,
 					 digest);
 			break;
+		default:
+			INSIST(0);
+			ISC_UNREACHABLE();
 		}
-		for (i = 0; i < 8; i++)
+		for (i = 0; i < 8; i++) {
 			digest[i] ^= digest[i + 8];
+		}
 		isc_buffer_putmem(buf, digest, 8);
 		break;
 	}
@@ -2309,6 +2495,7 @@ client_request(isc_task_t *task, isc_event_t *event) {
 		client->nrecvs--;
 	} else {
 		INSIST(TCP_CLIENT(client));
+		INSIST(client->tcpconn != NULL);
 		REQUIRE(event->ev_type == DNS_EVENT_TCPMSG);
 		REQUIRE(event->ev_sender == &client->tcpmsg);
 		buffer = &client->tcpmsg.buffer;
@@ -2496,18 +2683,27 @@ client_request(isc_task_t *task, isc_event_t *event) {
 	/*
 	 * Pipeline TCP query processing.
 	 */
-	if (client->message->opcode != dns_opcode_query)
-		client->pipelined = false;
-	if (TCP_CLIENT(client) && client->pipelined) {
-		result = isc_quota_reserve(&ns_g_server->tcpquota);
-		if (result == ISC_R_SUCCESS)
-			result = ns_client_replace(client);
+	if (TCP_CLIENT(client) &&
+	    client->message->opcode != dns_opcode_query)
+	{
+		client->tcpconn->pipelined = false;
+	}
+	if (TCP_CLIENT(client) && client->tcpconn->pipelined) {
+		/*
+		 * We're pipelining. Replace the client; the
+		 * replacement can read the TCP socket looking
+		 * for new messages and this one can process the
+		 * current message asynchronously.
+		 *
+		 * There will now be at least three clients using this
+		 * TCP socket - one accepting new connections,
+		 * one reading an existing connection to get new
+		 * messages, and one answering the message already
+		 * received.
+		 */
+		result = ns_client_replace(client);
 		if (result != ISC_R_SUCCESS) {
-			ns_client_log(client, NS_LOGCATEGORY_CLIENT,
-				      NS_LOGMODULE_CLIENT, ISC_LOG_WARNING,
-				      "no more TCP clients(read): %s",
-				      isc_result_totext(result));
-			client->pipelined = false;
+			client->tcpconn->pipelined = false;
 		}
 	}
 
@@ -2543,6 +2739,31 @@ client_request(isc_task_t *task, isc_event_t *event) {
 	client->ecs_scope = 0;
 
 	if (opt != NULL) {
+		/*
+		 * Are returning FORMERR to all EDNS queries?
+		 * Simulate a STD13 compliant server.
+		 */
+		if (ns_g_ednsformerr) {
+			ns_client_error(client, DNS_R_FORMERR);
+			return;
+		}
+
+		/*
+		 * Are returning NOTIMP to all EDNS queries?
+		 */
+		if (ns_g_ednsnotimp) {
+			ns_client_error(client, DNS_R_NOTIMP);
+			return;
+		}
+
+		/*
+		 * Are returning REFUSED to all EDNS queries?
+		 */
+		if (ns_g_ednsrefused) {
+			ns_client_error(client, DNS_R_REFUSED);
+			return;
+		}
+
 		/*
 		 * Are we dropping all EDNS queries?
 		 */
@@ -2550,6 +2771,7 @@ client_request(isc_task_t *task, isc_event_t *event) {
 			ns_client_next(client, ISC_R_SUCCESS);
 			goto cleanup;
 		}
+
 		result = process_opt(client, opt);
 		if (result != ISC_R_SUCCESS)
 			goto cleanup;
@@ -2825,8 +3047,9 @@ client_request(isc_task_t *task, isc_event_t *event) {
 				     true) == ISC_R_SUCCESS)
 		ra = true;
 
-	if (ra == true)
+	if (ra == true) {
 		client->attributes |= NS_CLIENTATTR_RA;
+	}
 
 	ns_client_log(client, DNS_LOGCATEGORY_SECURITY, NS_LOGMODULE_CLIENT,
 		      ISC_LOG_DEBUG(3), ra ? "recursion available" :
@@ -2852,10 +3075,11 @@ client_request(isc_task_t *task, isc_event_t *event) {
 	case dns_opcode_query:
 		CTRACE("query");
 #ifdef HAVE_DNSTAP
-		if ((client->message->flags & DNS_MESSAGEFLAG_RD) != 0)
+		if (ra && (client->message->flags & DNS_MESSAGEFLAG_RD) != 0) {
 			dtmsgtype = DNS_DTTYPE_CQ;
-		else
+		} else {
 			dtmsgtype = DNS_DTTYPE_AQ;
+		}
 
 		dns_dt_send(view, dtmsgtype, &client->peeraddr,
 			    &client->destsockaddr, TCP_CLIENT(client), NULL,
@@ -3063,8 +3287,7 @@ client_create(ns_clientmgr_t *manager, ns_client_t **clientp) {
 	client->signer = NULL;
 	dns_name_init(&client->signername, NULL);
 	client->mortal = false;
-	client->pipelined = false;
-	client->tcpquota = NULL;
+	client->tcpconn = NULL;
 	client->recursionquota = NULL;
 	client->interface = NULL;
 	client->peeraddr_valid = false;
@@ -3074,6 +3297,7 @@ client_create(ns_clientmgr_t *manager, ns_client_t **clientp) {
 	client->filter_aaaa = dns_aaaa_ok;
 #endif
 	client->needshutdown = ns_g_clienttest;
+	client->tcpactive = false;
 
 	ISC_EVENT_INIT(&client->ctlevent, sizeof(client->ctlevent), 0, NULL,
 		       NS_EVENT_CLIENTCONTROL, client_start, client, client,
@@ -3168,9 +3392,9 @@ client_read(ns_client_t *client) {
 
 static void
 client_newconn(isc_task_t *task, isc_event_t *event) {
+	isc_result_t result;
 	ns_client_t *client = event->ev_arg;
 	isc_socket_newconnev_t *nevent = (isc_socket_newconnev_t *)event;
-	isc_result_t result;
 
 	REQUIRE(event->ev_type == ISC_SOCKEVENT_NEWCONN);
 	REQUIRE(NS_CLIENT_VALID(client));
@@ -3180,13 +3404,17 @@ client_newconn(isc_task_t *task, isc_event_t *event) {
 
 	INSIST(client->state == NS_CLIENTSTATE_READY);
 
+	/*
+	 * The accept() was successful and we're now establishing a new
+	 * connection. We need to make note of it in the client and
+	 * interface objects so client objects can do the right thing
+	 * when going inactive in exit_check() (see comments in
+	 * client_accept() for details).
+	 */
 	INSIST(client->naccepts == 1);
 	client->naccepts--;
 
-	LOCK(&client->interface->lock);
-	INSIST(client->interface->ntcpcurrent > 0);
-	client->interface->ntcpcurrent--;
-	UNLOCK(&client->interface->lock);
+	isc_refcount_decrement(&client->interface->ntcpaccepting, NULL);
 
 	/*
 	 * We must take ownership of the new socket before the exit
@@ -3219,6 +3447,7 @@ client_newconn(isc_task_t *task, isc_event_t *event) {
 			      NS_LOGMODULE_CLIENT, ISC_LOG_DEBUG(3),
 			      "accept failed: %s",
 			      isc_result_totext(nevent->result));
+		tcpconn_detach(client);
 	}
 
 	if (exit_check(client))
@@ -3256,20 +3485,13 @@ client_newconn(isc_task_t *task, isc_event_t *event) {
 		 * telnetting to port 53 (once per CPU) will
 		 * deny service to legitimate TCP clients.
 		 */
-		client->pipelined = false;
-		result = isc_quota_attach(&ns_g_server->tcpquota,
-					  &client->tcpquota);
-		if (result == ISC_R_SUCCESS)
-			result = ns_client_replace(client);
-		if (result != ISC_R_SUCCESS) {
-			ns_client_log(client, NS_LOGCATEGORY_CLIENT,
-				      NS_LOGMODULE_CLIENT, ISC_LOG_WARNING,
-				      "no more TCP clients(accept): %s",
-				      isc_result_totext(result));
-		} else if (ns_g_server->keepresporder == NULL ||
-			   !allowed(&netaddr, NULL, NULL, 0, NULL,
-				    ns_g_server->keepresporder)) {
-			client->pipelined = true;
+		result = ns_client_replace(client);
+		if (result == ISC_R_SUCCESS &&
+		    (ns_g_server->keepresporder == NULL ||
+		     !allowed(&netaddr, NULL, NULL, 0, NULL,
+			      ns_g_server->keepresporder)))
+		{
+			client->tcpconn->pipelined = true;
 		}
 
 		client_read(client);
@@ -3285,12 +3507,66 @@ client_accept(ns_client_t *client) {
 
 	CTRACE("accept");
 
+	/*
+	 * Set up a new TCP connection. This means try to attach to the
+	 * TCP client quota (tcp-clients), but fail if we're over quota.
+	 */
+	result = tcpconn_init(client, false);
+	if (result != ISC_R_SUCCESS) {
+		bool exit;
+
+		ns_client_log(client, NS_LOGCATEGORY_CLIENT,
+			      NS_LOGMODULE_CLIENT, ISC_LOG_WARNING,
+			      "TCP client quota reached: %s",
+			      isc_result_totext(result));
+
+		/*
+		 * We have exceeded the system-wide TCP client quota.  But,
+		 * we can't just block this accept in all cases, because if
+		 * we did, a heavy TCP load on other interfaces might cause
+		 * this interface to be starved, with no clients able to
+		 * accept new connections.
+		 *
+		 * So, we check here to see if any other clients are
+		 * already servicing TCP queries on this interface (whether
+		 * accepting, reading, or processing). If we find that at
+		 * least one client other than this one is active, then
+		 * it's okay *not* to call accept - we can let this
+		 * client go inactive and another will take over when it's
+		 * done.
+		 *
+		 * If there aren't enough active clients on the interface,
+		 * then we can be a little bit flexible about the quota.
+		 * We'll allow *one* extra client through to ensure we're
+		 * listening on every interface; we do this by setting the
+		 * 'force' option to tcpconn_init().
+		 *
+		 * (Note: In practice this means that the real TCP client
+		 * quota is tcp-clients plus the number of listening
+		 * interfaces plus 1.)
+		 */
+		exit = (isc_refcount_current(&client->interface->ntcpactive) >
+			(client->tcpactive ? 1U : 0U));
+		if (exit) {
+			client->newstate = NS_CLIENTSTATE_INACTIVE;
+			(void)exit_check(client);
+			return;
+		}
+
+		result = tcpconn_init(client, true);
+		RUNTIME_CHECK(result == ISC_R_SUCCESS);
+	}
+
+	/*
+	 * If this client was set up using get_client() or get_worker(),
+	 * then TCP is already marked active. However, if it was restarted
+	 * from exit_check(), it might not be, so we take care of it now.
+	 */
+	mark_tcp_active(client, true);
+
 	result = isc_socket_accept(client->tcplistener, client->task,
 				   client_newconn, client);
 	if (result != ISC_R_SUCCESS) {
-		UNEXPECTED_ERROR(__FILE__, __LINE__,
-				 "isc_socket_accept() failed: %s",
-				 isc_result_totext(result));
 		/*
 		 * XXXRTH  What should we do?  We're trying to accept but
 		 *	   it didn't work.  If we just give up, then TCP
@@ -3298,13 +3574,37 @@ client_accept(ns_client_t *client) {
 		 *
 		 *	   For now, we just go idle.
 		 */
+		UNEXPECTED_ERROR(__FILE__, __LINE__,
+				 "isc_socket_accept() failed: %s",
+				 isc_result_totext(result));
+
+		tcpconn_detach(client);
+		mark_tcp_active(client, false);
 		return;
 	}
+
+	/*
+	 * The client's 'naccepts' counter indicates that this client has
+	 * called accept() and is waiting for a new connection. It should
+	 * never exceed 1.
+	 */
 	INSIST(client->naccepts == 0);
 	client->naccepts++;
-	LOCK(&client->interface->lock);
-	client->interface->ntcpcurrent++;
-	UNLOCK(&client->interface->lock);
+
+	/*
+	 * The interface's 'ntcpaccepting' counter is incremented when
+	 * any client calls accept(), and decremented in client_newconn()
+	 * once the connection is established.
+	 *
+	 * When the client object is shutting down after handling a TCP
+	 * request (see exit_check()), if this value is at least one, that
+	 * means another client has called accept() and is waiting to
+	 * establish the next connection. That means the client may be
+	 * be free to become inactive; otherwise it may need to start
+	 * listening for connections itself to prevent the interface
+	 * going dead.
+	 */
+	isc_refcount_increment0(&client->interface->ntcpaccepting, NULL);
 }
 
 static void
@@ -3375,15 +3675,17 @@ ns_client_replace(ns_client_t *client) {
 	REQUIRE(client->manager != NULL);
 
 	tcp = TCP_CLIENT(client);
-	if (tcp && client->pipelined) {
+	if (tcp && client->tcpconn != NULL && client->tcpconn->pipelined) {
 		result = get_worker(client->manager, client->interface,
-				    client->tcpsocket);
+				    client->tcpsocket, client);
 	} else {
 		result = get_client(client->manager, client->interface,
 				    client->dispatch, tcp);
+
 	}
-	if (result != ISC_R_SUCCESS)
+	if (result != ISC_R_SUCCESS) {
 		return (result);
+	}
 
 	/*
 	 * The responsibility for listening for new requests is hereby
@@ -3569,9 +3871,12 @@ get_client(ns_clientmgr_t *manager, ns_interface_t *ifp,
 	client->dscp = ifp->dscp;
 
 	if (tcp) {
+		mark_tcp_active(client, true);
+
 		client->attributes |= NS_CLIENTATTR_TCP;
 		isc_socket_attach(ifp->tcpsocket,
 				  &client->tcplistener);
+
 	} else {
 		isc_socket_t *sock;
 
@@ -3585,11 +3890,12 @@ get_client(ns_clientmgr_t *manager, ns_interface_t *ifp,
 	ev = &client->ctlevent;
 	isc_task_send(client->task, &ev);
 
-	return (ISC_R_SUCCESS);
+	return (result);
 }
 
 static isc_result_t
-get_worker(ns_clientmgr_t *manager, ns_interface_t *ifp, isc_socket_t *sock)
+get_worker(ns_clientmgr_t *manager, ns_interface_t *ifp, isc_socket_t *sock,
+	   ns_client_t *oldclient)
 {
 	isc_result_t result = ISC_R_SUCCESS;
 	isc_event_t *ev;
@@ -3597,6 +3903,7 @@ get_worker(ns_clientmgr_t *manager, ns_interface_t *ifp, isc_socket_t *sock)
 	MTRACE("get worker");
 
 	REQUIRE(manager != NULL);
+	REQUIRE(oldclient != NULL);
 
 	if (manager->exiting)
 		return (ISC_R_SHUTTINGDOWN);
@@ -3629,14 +3936,15 @@ get_worker(ns_clientmgr_t *manager, ns_interface_t *ifp, isc_socket_t *sock)
 	ns_interface_attach(ifp, &client->interface);
 	client->newstate = client->state = NS_CLIENTSTATE_WORKING;
 	INSIST(client->recursionquota == NULL);
-	client->tcpquota = &ns_g_server->tcpquota;
 
 	client->dscp = ifp->dscp;
 
 	client->attributes |= NS_CLIENTATTR_TCP;
-	client->pipelined = true;
 	client->mortal = true;
 
+	tcpconn_attach(oldclient, client);
+	mark_tcp_active(client, true);
+
 	isc_socket_attach(ifp->tcpsocket, &client->tcplistener);
 	isc_socket_attach(sock, &client->tcpsocket);
 	isc_socket_setname(client->tcpsocket, "worker-tcp", NULL);
@@ -3652,7 +3960,7 @@ get_worker(ns_clientmgr_t *manager, ns_interface_t *ifp, isc_socket_t *sock)
 	ev = &client->ctlevent;
 	isc_task_send(client->task, &ev);
 
-	return (ISC_R_SUCCESS);
+	return (result);
 }
 
 isc_result_t
@@ -3777,6 +4085,8 @@ ns_client_logv(ns_client_t *client, isc_logcategory_t *category,
 	const char *signer = "", *qname = "";
 	dns_name_t *q = NULL;
 
+	REQUIRE(client != NULL);
+
 	vsnprintf(msgbuf, sizeof(msgbuf), fmt, ap);
 
 	if (client->signer != NULL) {

bin/named/config.c

@@ -70,6 +70,11 @@ options {\n\
 #ifndef WIN32
 "	files unlimited;\n"
 #endif
+#if defined(HAVE_GEOIP2) && !defined(WIN32)
+"	geoip-directory \"" MAXMINDDB_PREFIX "/share/GeoIP2\";\n"
+#elif defined(HAVE_GEOIP2)
+"	geoip-directory \".\";\n"
+#endif
 "\
 #	has-old-clients <obsolete>;\n\
 	heartbeat-interval 60;\n\
@@ -167,7 +172,7 @@ options {\n\
 	filter-aaaa-on-v6 no;\n\
 	filter-aaaa { any; };\n"
 #endif
-#ifdef HAVE_GEOIP
+#if defined(HAVE_GEOIP) || defined(HAVE_GEOIP2)
 "	geoip-use-ecs yes;\n"
 #endif
 "	lame-ttl 600;\n"
@@ -858,7 +863,9 @@ ns_config_getipandkeylist(const cfg_obj_t *config, const cfg_obj_t *list,
 	if (stack != NULL)
 		isc_mem_put(mctx, stack, stackcount * sizeof(*stack));
 
+	INSIST(dscpcount == addrcount);
 	INSIST(keycount == addrcount);
+	INSIST(keycount == dscpcount);
 
 	ipkl->addrs = addrs;
 	ipkl->dscps = dscps;

bin/named/fuzz.c

@@ -19,7 +19,7 @@
 #ifdef ENABLE_AFL
 #include <named/globals.h>
 #include <named/server.h>
-#include <sys/errno.h>
+#include <errno.h>
 
 #include <isc/app.h>
 #include <isc/condition.h>

bin/named/geoip.c

@@ -13,20 +13,27 @@
 
 #include <config.h>
 
+#if defined(HAVE_GEOIP2)
+#include <maxminddb.h>
+#elif defined(HAVE_GEOIP)
+#include <GeoIP.h>
+#include <GeoIPCity.h>
+#endif
+
+#include <isc/print.h>
+#include <isc/string.h>
 #include <isc/util.h>
 
+#include <dns/geoip.h>
+
 #include <named/log.h>
 #include <named/geoip.h>
 
-#include <dns/geoip.h>
-
-#ifdef HAVE_GEOIP
-static dns_geoip_databases_t geoip_table = {
-	NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL
-};
+static dns_geoip_databases_t geoip_table;
 
+#if defined(HAVE_GEOIP)
 static void
-init_geoip_db(GeoIP **dbp, GeoIPDBTypes edition, GeoIPDBTypes fallback,
+init_geoip_db(void **dbp, GeoIPDBTypes edition, GeoIPDBTypes fallback,
 	      GeoIPOptions method, const char *name)
 {
 	char *info;
@@ -34,7 +41,7 @@ init_geoip_db(GeoIP **dbp, GeoIPDBTypes edition, GeoIPDBTypes fallback,
 
 	REQUIRE(dbp != NULL);
 
-	db = *dbp;
+	db = (GeoIP *)*dbp;
 
 	if (db != NULL) {
 		GeoIP_delete(db);
@@ -72,32 +79,96 @@ init_geoip_db(GeoIP **dbp, GeoIPDBTypes edition, GeoIPDBTypes fallback,
 
 	*dbp = db;
 	return;
+
  fail:
-	if (fallback != 0)
+	if (fallback != 0) {
 		init_geoip_db(dbp, fallback, 0, method, name);
+	}
 
 }
-#endif /* HAVE_GEOIP */
+#elif defined(HAVE_GEOIP2)
+static MMDB_s geoip_country, geoip_city, geoip_as, geoip_isp, geoip_domain;
+
+static MMDB_s *
+open_geoip2(const char *dir, const char *dbfile, MMDB_s *mmdb) {
+	char pathbuf[PATH_MAX];
+	unsigned int n;
+	int ret;
+
+	n = snprintf(pathbuf, sizeof(pathbuf), "%s/%s", dir, dbfile);
+	if (n >= sizeof(pathbuf)) {
+		isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
+			      NS_LOGMODULE_SERVER, ISC_LOG_ERROR,
+			      "GeoIP2 database '%s/%s': path too long",
+			      dir, dbfile);
+		return (NULL);
+	}
+
+	ret = MMDB_open(pathbuf, MMDB_MODE_MMAP, mmdb);
+	if (ret == MMDB_SUCCESS) {
+		isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
+			      NS_LOGMODULE_SERVER, ISC_LOG_INFO,
+			      "opened GeoIP2 database '%s'", pathbuf);
+		return (mmdb);
+	}
+
+	isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
+		      NS_LOGMODULE_SERVER, ISC_LOG_DEBUG(1),
+		      "unable to open GeoIP2 database '%s' (status %d)",
+		      pathbuf, ret);
+
+	return (NULL);
+}
+#endif /* HAVE_GEOIP2 */
+
 
 void
 ns_geoip_init(void) {
-#ifndef HAVE_GEOIP
-	return;
-#else
-	GeoIP_cleanup();
-	if (ns_g_geoip == NULL)
+#if defined(HAVE_GEOIP) || defined(HAVE_GEOIP2)
+	if (ns_g_geoip == NULL) {
 		ns_g_geoip = &geoip_table;
+	}
+#if defined(HAVE_GEOIP)
+	GeoIP_cleanup();
+#endif
+#else
+	return;
 #endif
 }
 
 void
 ns_geoip_load(char *dir) {
-#ifndef HAVE_GEOIP
+#if defined(HAVE_GEOIP2)
+	REQUIRE(dir != NULL);
 
-	UNUSED(dir);
+	isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
+		      NS_LOGMODULE_SERVER, ISC_LOG_INFO,
+		      "looking for GeoIP2 databases in '%s'", dir);
 
-	return;
-#else
+	ns_g_geoip->country = open_geoip2(dir, "GeoIP2-Country.mmdb",
+					  &geoip_country);
+	if (ns_g_geoip->country == NULL) {
+		ns_g_geoip->country = open_geoip2(dir,
+						  "GeoLite2-Country.mmdb",
+						  &geoip_country);
+	}
+
+	ns_g_geoip->city = open_geoip2(dir, "GeoIP2-City.mmdb", &geoip_city);
+	if (ns_g_geoip->city == NULL) {
+		ns_g_geoip->city = open_geoip2(dir, "GeoLite2-City.mmdb",
+					       &geoip_city);
+	}
+
+	ns_g_geoip->as = open_geoip2(dir, "GeoIP2-ASN.mmdb", &geoip_as);
+	if (ns_g_geoip->as == NULL) {
+		ns_g_geoip->as = open_geoip2(dir, "GeoLite2-ASN.mmdb",
+					     &geoip_as);
+	}
+
+	ns_g_geoip->isp = open_geoip2(dir, "GeoIP2-ISP.mmdb", &geoip_isp);
+	ns_g_geoip->domain = open_geoip2(dir, "GeoIP2-Domain.mmdb",
+					 &geoip_domain);
+#elif defined(HAVE_GEOIP)
 	GeoIPOptions method;
 
 #ifdef _WIN32
@@ -141,5 +212,37 @@ ns_geoip_load(char *dir) {
 		      method, "Domain");
 	init_geoip_db(&ns_g_geoip->netspeed, GEOIP_NETSPEED_EDITION, 0,
 		      method, "NetSpeed");
-#endif /* HAVE_GEOIP */
+#else
+	UNUSED(dir);
+
+	return;
+#endif
+}
+
+void
+ns_geoip_shutdown(void) {
+#ifdef HAVE_GEOIP2
+	if (ns_g_geoip->country != NULL) {
+		MMDB_close(ns_g_geoip->country);
+		ns_g_geoip->country = NULL;
+	}
+	if (ns_g_geoip->city != NULL) {
+		MMDB_close(ns_g_geoip->city);
+		ns_g_geoip->city = NULL;
+	}
+	if (ns_g_geoip->as != NULL) {
+		MMDB_close(ns_g_geoip->as);
+		ns_g_geoip->as = NULL;
+	}
+	if (ns_g_geoip->isp != NULL) {
+		MMDB_close(ns_g_geoip->isp);
+		ns_g_geoip->isp = NULL;
+	}
+	if (ns_g_geoip->domain != NULL) {
+		MMDB_close(ns_g_geoip->domain);
+		ns_g_geoip->domain = NULL;
+	}
+#endif /* HAVE_GEOIP2 */
+
+	dns_geoip_shutdown();
 }

bin/named/include/named/client.h

@@ -9,8 +9,6 @@
  * information regarding copyright ownership.
  */
 
-/* $Id: client.h,v 1.96 2012/01/31 23:47:31 tbox Exp $ */
-
 #ifndef NAMED_CLIENT_H
 #define NAMED_CLIENT_H 1
 
@@ -80,6 +78,13 @@
  *** Types
  ***/
 
+/*% reference-counted TCP connection object */
+typedef struct ns_tcpconn {
+	isc_refcount_t		refs;
+	isc_quota_t		*tcpquota;
+	bool			pipelined;
+} ns_tcpconn_t;
+
 /*% nameserver client structure */
 struct ns_client {
 	unsigned int		magic;
@@ -94,7 +99,8 @@ struct ns_client {
 	int			nupdates;
 	int			nctls;
 	int			references;
-	bool		needshutdown; 	/*
+	bool			tcpactive;
+	bool			needshutdown; 	/*
 						 * Used by clienttest to get
 						 * the client to go from
 						 * inactive to free state
@@ -130,10 +136,9 @@ struct ns_client {
 	isc_stdtime_t		now;
 	isc_time_t		tnow;
 	dns_name_t		signername;   /*%< [T]SIG key name */
-	dns_name_t *		signer;	      /*%< NULL if not valid sig */
-	bool		mortal;	      /*%< Die after handling request */
-	bool		pipelined;   /*%< TCP queries not in sequence */
-	isc_quota_t		*tcpquota;
+	dns_name_t		*signer;      /*%< NULL if not valid sig */
+	bool			mortal;	      /*%< Die after handling request */
+	ns_tcpconn_t		*tcpconn;
 	isc_quota_t		*recursionquota;
 	ns_interface_t		*interface;
 
@@ -143,8 +148,8 @@ struct ns_client {
 	isc_sockaddr_t		destsockaddr;
 
 	isc_netaddr_t		ecs_addr;	/*%< EDNS client subnet */
-	uint8_t		ecs_addrlen;
-	uint8_t		ecs_scope;
+	uint8_t			ecs_addrlen;
+	uint8_t			ecs_scope;
 
 	struct in6_pktinfo	pktinfo;
 	isc_dscp_t		dscp;

bin/named/include/named/geoip.h

@@ -12,15 +12,14 @@
 #ifndef _GEOIP_H
 #define _GEOIP_H
 
-#ifdef HAVE_GEOIP
-#include <GeoIP.h>
-#include <GeoIPCity.h>
-#endif /* HAVE_GEOIP */
-
-void ns_geoip_init(void);
-void ns_geoip_load(char *dir);
-
-#ifdef HAVE_GEOIP
 extern dns_geoip_databases_t *ns_g_geoip;
-#endif /* HAVE_GEOIP */
+
+void
+ns_geoip_init(void);
+
+void
+ns_geoip_load(char *dir);
+
+void
+ns_geoip_shutdown(void);
 #endif

bin/named/include/named/globals.h

@@ -77,7 +77,7 @@ EXTERN in_port_t		lwresd_g_listenport	INIT(0);
 
 EXTERN ns_server_t *		ns_g_server		INIT(NULL);
 
-EXTERN bool		ns_g_lwresdonly		INIT(false);
+EXTERN bool			ns_g_lwresdonly		INIT(false);
 
 /*
  * Logging.
@@ -105,9 +105,9 @@ EXTERN const char *		lwresd_g_conffile	INIT(NS_SYSCONFDIR
 							     "/lwresd.conf");
 EXTERN const char *		lwresd_g_resolvconffile	INIT("/etc"
 							     "/resolv.conf");
-EXTERN bool		ns_g_conffileset	INIT(false);
-EXTERN bool		lwresd_g_useresolvconf	INIT(false);
-EXTERN uint16_t		ns_g_udpsize		INIT(4096);
+EXTERN bool			ns_g_conffileset	INIT(false);
+EXTERN bool			lwresd_g_useresolvconf	INIT(false);
+EXTERN uint16_t			ns_g_udpsize		INIT(4096);
 EXTERN cfg_aclconfctx_t *	ns_g_aclconfctx		INIT(NULL);
 
 /*
@@ -121,11 +121,11 @@ EXTERN isc_resourcevalue_t	ns_g_initopenfiles	INIT(0);
 /*
  * Misc.
  */
-EXTERN bool		ns_g_coreok		INIT(true);
+EXTERN bool			ns_g_coreok		INIT(true);
 EXTERN const char *		ns_g_chrootdir		INIT(NULL);
-EXTERN bool		ns_g_foreground		INIT(false);
-EXTERN bool		ns_g_logstderr		INIT(false);
-EXTERN bool		ns_g_nosyslog		INIT(false);
+EXTERN bool			ns_g_foreground		INIT(false);
+EXTERN bool			ns_g_logstderr		INIT(false);
+EXTERN bool			ns_g_nosyslog		INIT(false);
 EXTERN const char *		ns_g_logfile		INIT(NULL);
 
 EXTERN const char *		ns_g_defaultsessionkeyfile
@@ -134,7 +134,7 @@ EXTERN const char *		ns_g_defaultsessionkeyfile
 EXTERN const char *		ns_g_defaultlockfile	INIT(NS_LOCALSTATEDIR
 							     "/run/named/"
 							     "named.lock");
-EXTERN bool		ns_g_forcelock		INIT(false);
+EXTERN bool			ns_g_forcelock		INIT(false);
 
 #if NS_RUN_PID_DIR
 EXTERN const char *		ns_g_defaultpidfile 	INIT(NS_LOCALSTATEDIR
@@ -169,23 +169,26 @@ EXTERN const char *		ns_g_engine		INIT(NULL);
 EXTERN int			ns_g_listen		INIT(3);
 EXTERN isc_time_t		ns_g_boottime;
 EXTERN isc_time_t		ns_g_configtime;
-EXTERN bool		ns_g_memstatistics	INIT(false);
-EXTERN bool		ns_g_clienttest		INIT(false);
-EXTERN bool		ns_g_dropedns		INIT(false);
-EXTERN bool		ns_g_noedns		INIT(false);
-EXTERN bool		ns_g_nosoa		INIT(false);
-EXTERN bool		ns_g_noaa		INIT(false);
-EXTERN bool		ns_g_keepstderr		INIT(false);
+EXTERN bool			ns_g_memstatistics	INIT(false);
+EXTERN bool			ns_g_clienttest		INIT(false);
+EXTERN bool			ns_g_dropedns		INIT(false);
+EXTERN bool			ns_g_ednsformerr	INIT(false);
+EXTERN bool			ns_g_ednsnotimp		INIT(false);
+EXTERN bool			ns_g_ednsrefused	INIT(false);
+EXTERN bool			ns_g_noedns		INIT(false);
+EXTERN bool			ns_g_nosoa		INIT(false);
+EXTERN bool			ns_g_noaa		INIT(false);
+EXTERN bool			ns_g_keepstderr		INIT(false);
 EXTERN unsigned int		ns_g_delay		INIT(0);
-EXTERN bool		ns_g_nonearest		INIT(false);
-EXTERN bool		ns_g_notcp		INIT(false);
-EXTERN bool		ns_g_disable6		INIT(false);
-EXTERN bool		ns_g_disable4		INIT(false);
+EXTERN bool			ns_g_nonearest		INIT(false);
+EXTERN bool			ns_g_notcp		INIT(false);
+EXTERN bool			ns_g_disable6		INIT(false);
+EXTERN bool			ns_g_disable4		INIT(false);
 EXTERN unsigned int		ns_g_tat_interval	INIT(24*3600);
-EXTERN bool		ns_g_fixedlocal		INIT(false);
-EXTERN bool		ns_g_sigvalinsecs	INIT(false);
+EXTERN bool			ns_g_fixedlocal		INIT(false);
+EXTERN bool			ns_g_sigvalinsecs	INIT(false);
 
-#ifdef HAVE_GEOIP
+#if defined(HAVE_GEOIP) || defined(HAVE_GEOIP2)
 EXTERN dns_geoip_databases_t	*ns_g_geoip		INIT(NULL);
 #endif
 

bin/named/include/named/interfacemgr.h

@@ -9,8 +9,6 @@
  * information regarding copyright ownership.
  */
 
-/* $Id: interfacemgr.h,v 1.35 2011/07/28 23:47:58 tbox Exp $ */
-
 #ifndef NAMED_INTERFACEMGR_H
 #define NAMED_INTERFACEMGR_H 1
 
@@ -47,6 +45,7 @@
 #include <isc/magic.h>
 #include <isc/mem.h>
 #include <isc/socket.h>
+#include <isc/refcount.h>
 
 #include <dns/result.h>
 
@@ -77,9 +76,14 @@ struct ns_interface {
 						/*%< UDP dispatchers. */
 	isc_socket_t *		tcpsocket;	/*%< TCP socket. */
 	isc_dscp_t		dscp;		/*%< "listen-on" DSCP value */
-	int			ntcptarget;	/*%< Desired number of concurrent
-						     TCP accepts */
-	int			ntcpcurrent;	/*%< Current ditto, locked */
+	isc_refcount_t		ntcpaccepting;	/*%< Number of clients
+						     ready to accept new
+						     TCP connections on this
+						     interface */
+	isc_refcount_t		ntcpactive;	/*%< Number of clients
+						     servicing TCP queries
+						     (whether accepting or
+						     connected) */
 	int			nudpdispatch;	/*%< Number of UDP dispatches */
 	ns_clientmgr_t *	clientmgr;	/*%< Client manager. */
 	ISC_LINK(ns_interface_t) link;

bin/named/include/named/types.h

@@ -43,7 +43,10 @@ typedef ISC_LIST(ns_altsecret_t)	ns_altsecretlist_t;
 typedef enum {
 	ns_cookiealg_aes,
 	ns_cookiealg_sha1,
-	ns_cookiealg_sha256
+	ns_cookiealg_sha256,
+	ns_cookiealg_siphash24
 } ns_cookiealg_t;
 
+#define NS_COOKIE_VERSION_1 1
+
 #endif /* NAMED_TYPES_H */

bin/named/interfacemgr.c

@@ -211,7 +211,7 @@ ns_interfacemgr_create(isc_mem_t *mctx, isc_taskmgr_t *taskmgr,
 	result = dns_aclenv_init(mctx, &mgr->aclenv);
 	if (result != ISC_R_SUCCESS)
 		goto cleanup_listenon;
-#ifdef HAVE_GEOIP
+#if defined(HAVE_GEOIP) || defined(HAVE_GEOIP2)
 	mgr->aclenv.geoip = ns_g_geoip;
 #endif
 
@@ -386,8 +386,9 @@ ns_interface_create(ns_interfacemgr_t *mgr, isc_sockaddr_t *addr,
 	 * connections will be handled in parallel even though there is
 	 * only one client initially.
 	 */
-	ifp->ntcptarget = 1;
-	ifp->ntcpcurrent = 0;
+	isc_refcount_init(&ifp->ntcpaccepting, 0);
+	isc_refcount_init(&ifp->ntcpactive, 0);
+
 	ifp->nudpdispatch = 0;
 
 	ifp->dscp = -1;
@@ -522,9 +523,7 @@ ns_interface_accepttcp(ns_interface_t *ifp) {
 	 */
 	(void)isc_socket_filter(ifp->tcpsocket, "dataready");
 
-	result = ns_clientmgr_createclients(ifp->clientmgr,
-					    ifp->ntcptarget, ifp,
-					    true);
+	result = ns_clientmgr_createclients(ifp->clientmgr, 1, ifp, true);
 	if (result != ISC_R_SUCCESS) {
 		UNEXPECTED_ERROR(__FILE__, __LINE__,
 				 "TCP ns_clientmgr_createclients(): %s",
@@ -619,6 +618,9 @@ ns_interface_destroy(ns_interface_t *ifp) {
 
 	ns_interfacemgr_detach(&ifp->mgr);
 
+	isc_refcount_destroy(&ifp->ntcpactive);
+	isc_refcount_destroy(&ifp->ntcpaccepting);
+
 	ifp->magic = 0;
 	isc_mem_put(mctx, ifp, sizeof(*ifp));
 }

bin/named/lwresd.c

@@ -9,8 +9,6 @@
  * information regarding copyright ownership.
  */
 
-/* $Id: lwresd.c,v 1.60 2009/09/02 23:48:01 tbox Exp $ */
-
 /*! \file
  * \brief
  * Main program for the Lightweight Resolver Daemon.
@@ -209,15 +207,13 @@ ns_lwresd_parseeresolvconf(isc_mem_t *mctx, cfg_parser_t *pctx,
 	 * Build the search path
 	 */
 	if (lwc->searchnxt > 0) {
-		if (lwc->searchnxt > 0) {
-			CHECK(buffer_putstr(&b, "\tsearch {\n"));
-			for (i = 0; i < lwc->searchnxt; i++) {
-				CHECK(buffer_putstr(&b, "\t\t\""));
-				CHECK(buffer_putstr(&b, lwc->search[i]));
-				CHECK(buffer_putstr(&b, "\";\n"));
-			}
-			CHECK(buffer_putstr(&b, "\t};\n"));
+		CHECK(buffer_putstr(&b, "\tsearch {\n"));
+		for (i = 0; i < lwc->searchnxt; i++) {
+			CHECK(buffer_putstr(&b, "\t\t\""));
+			CHECK(buffer_putstr(&b, lwc->search[i]));
+			CHECK(buffer_putstr(&b, "\";\n"));
 		}
+		CHECK(buffer_putstr(&b, "\t};\n"));
 	}
 
 	/*
@@ -493,6 +489,7 @@ ns_lwreslistener_detach(ns_lwreslistener_t **listenerp) {
 	INSIST(VALID_LWRESLISTENER(*listenerp));
 
 	listener = *listenerp;
+	*listenerp = NULL;
 
 	LOCK(&listener->lock);
 	INSIST(listener->refs > 0);
@@ -514,7 +511,6 @@ ns_lwreslistener_detach(ns_lwreslistener_t **listenerp) {
 	mctx = listener->mctx;
 	isc_mem_put(mctx, listener, sizeof(*listener));
 	isc_mem_detach(&mctx);
-	listenerp = NULL;
 }
 
 static isc_result_t

bin/named/main.c

@@ -356,7 +356,7 @@ save_command_line(int argc, char *argv[]) {
 			 * nearly always be fine.
 			 */
 			if (quoted || isalnum(*src & 0xff) ||
-			    *src == '-' || *src == '_' ||
+			    *src == ',' || *src == '-' || *src == '_' ||
 			    *src == '.' || *src == '/') {
 				*dst++ = *src++;
 				quoted = false;
@@ -479,6 +479,12 @@ parse_T_opt(char *option) {
 		ns_g_dropedns = true;
 	} else if (!strncmp(option, "dscp=", 5)) {
 		isc_dscp_check_value = atoi(option + 5);
+	} else if (!strcmp(option, "ednsformerr")) {
+		ns_g_ednsformerr = true;
+	} else if (!strcmp(option, "ednsnotimp")) {
+		ns_g_ednsnotimp = true;
+	} else if (!strcmp(option, "ednsrefused")) {
+		ns_g_ednsrefused = true;
 	} else if (!strcmp(option, "fixedlocal")) {
 		ns_g_fixedlocal = true;
 	} else if (!strcmp(option, "keepstderr")) {
@@ -501,6 +507,9 @@ parse_T_opt(char *option) {
 		maxudp = 1460;
 	} else if (!strncmp(option, "maxudp=", 7)) {
 		maxudp = atoi(option + 7);
+		if (maxudp <= 0) {
+			ns_main_earlyfatal("bad maxudp");
+		}
 	} else if (!strncmp(option, "mkeytimers=", 11)) {
 		p = strtok(option + 11, "/");
 		if (p == NULL) {
@@ -538,7 +547,7 @@ parse_T_opt(char *option) {
 	} else if (!strncmp(option, "tat=", 4)) {
 		ns_g_tat_interval = atoi(option + 4);
 	} else {
-		fprintf(stderr, "unknown -T flag '%s\n", option);
+		fprintf(stderr, "unknown -T flag '%s'\n", option);
 	}
 }
 
@@ -1405,6 +1414,17 @@ main(int argc, char *argv[]) {
 	(void) ProfilerStart(NULL);
 #endif
 
+#ifdef WIN32
+	/*
+	 * Prevent unbuffered I/O from crippling named performance on Windows
+	 * when it is logging to stderr (e.g. in system tests).  Use full
+	 * buffering (_IOFBF) as line buffering (_IOLBF) is unavailable on
+	 * Windows and fflush() is called anyway after each log message gets
+	 * written to the default stderr logging channels created by libisc.
+	*/
+	setvbuf(stderr, NULL, _IOFBF, BUFSIZ);
+#endif
+
 	/*
 	 * Record version in core image.
 	 * strings named.core | grep "named version:"

bin/named/named.conf.5

@@ -10,12 +10,12 @@
 .\"     Title: named.conf
 .\"    Author: 
 .\" Generator: DocBook XSL Stylesheets v1.78.1 <http://docbook.sf.net/>
-.\"      Date: 2018-06-21
+.\"      Date: 2019-07-22
 .\"    Manual: BIND9
 .\"    Source: ISC
 .\"  Language: English
 .\"
-.TH "NAMED\&.CONF" "5" "2018\-06\-21" "ISC" "BIND9"
+.TH "NAMED\&.CONF" "5" "2019\-07\-22" "ISC" "BIND9"
 .\" -----------------------------------------------------------------
 .\" * Define some portability stuff
 .\" -----------------------------------------------------------------
@@ -232,9 +232,9 @@ options {
 	bindkeys\-file \fIquoted_string\fR;
 	blackhole { \fIaddress_match_element\fR; \&.\&.\&. };
 	cache\-file \fIquoted_string\fR;
-	catalog\-zones { zone \fIquoted_string\fR [ default\-masters [ port
-	    \fIinteger\fR ] [ dscp \fIinteger\fR ] { ( \fImasters\fR | \fIipv4_address\fR [
-	    port \fIinteger\fR ] | \fIipv6_address\fR [ port \fIinteger\fR ] ) [ key
+	catalog\-zones { zone \fIstring\fR [ default\-masters [ port \fIinteger\fR ]
+	    [ dscp \fIinteger\fR ] { ( \fImasters\fR | \fIipv4_address\fR [ port
+	    \fIinteger\fR ] | \fIipv6_address\fR [ port \fIinteger\fR ] ) [ key
 	    \fIstring\fR ]; \&.\&.\&. } ] [ zone\-directory \fIquoted_string\fR ] [
 	    in\-memory \fIboolean\fR ] [ min\-update\-interval \fIinteger\fR ]; \&.\&.\&. };
 	check\-dup\-records ( fail | warn | ignore );
@@ -249,7 +249,7 @@ options {
 	check\-wildcard \fIboolean\fR;
 	cleaning\-interval \fIinteger\fR;
 	clients\-per\-query \fIinteger\fR;
-	cookie\-algorithm ( aes | sha1 | sha256 );
+	cookie\-algorithm ( aes | sha1 | sha256 | siphash24 );
 	cookie\-secret \fIstring\fR;
 	coresize ( default | unlimited | \fIsizeval\fR );
 	datasize ( default | unlimited | \fIsizeval\fR );
@@ -418,13 +418,13 @@ options {
 	require\-server\-cookie \fIboolean\fR;
 	reserved\-sockets \fIinteger\fR;
 	resolver\-query\-timeout \fIinteger\fR;
-	response\-policy { zone \fIquoted_string\fR [ log \fIboolean\fR ] [
-	    max\-policy\-ttl \fIinteger\fR ] [ policy ( cname | disabled | drop |
-	    given | no\-op | nodata | nxdomain | passthru | tcp\-only
-	    \fIquoted_string\fR ) ] [ recursive\-only \fIboolean\fR ]; \&.\&.\&. } [
-	    break\-dnssec \fIboolean\fR ] [ max\-policy\-ttl \fIinteger\fR ] [
-	    min\-ns\-dots \fIinteger\fR ] [ nsip\-wait\-recurse \fIboolean\fR ] [
-	    qname\-wait\-recurse \fIboolean\fR ] [ recursive\-only \fIboolean\fR ];
+	response\-policy { zone \fIstring\fR [ log \fIboolean\fR ] [ max\-policy\-ttl
+	    \fIinteger\fR ] [ policy ( cname | disabled | drop | given | no\-op
+	    | nodata | nxdomain | passthru | tcp\-only \fIquoted_string\fR ) ] [
+	    recursive\-only \fIboolean\fR ]; \&.\&.\&. } [ break\-dnssec \fIboolean\fR ] [
+	    max\-policy\-ttl \fIinteger\fR ] [ min\-ns\-dots \fIinteger\fR ] [
+	    nsip\-wait\-recurse \fIboolean\fR ] [ qname\-wait\-recurse \fIboolean\fR ]
+	    [ recursive\-only \fIboolean\fR ];
 	root\-delegation\-only [ exclude { \fIquoted_string\fR; \&.\&.\&. } ];
 	root\-key\-sentinel \fIboolean\fR;
 	rrset\-order { [ class \fIstring\fR ] [ type \fIstring\fR ] [ name
@@ -578,9 +578,9 @@ view \fIstring\fR [ \fIclass\fR ] {
 	auth\-nxdomain \fIboolean\fR; // default changed
 	auto\-dnssec ( allow | maintain | off );
 	cache\-file \fIquoted_string\fR;
-	catalog\-zones { zone \fIquoted_string\fR [ default\-masters [ port
-	    \fIinteger\fR ] [ dscp \fIinteger\fR ] { ( \fImasters\fR | \fIipv4_address\fR [
-	    port \fIinteger\fR ] | \fIipv6_address\fR [ port \fIinteger\fR ] ) [ key
+	catalog\-zones { zone \fIstring\fR [ default\-masters [ port \fIinteger\fR ]
+	    [ dscp \fIinteger\fR ] { ( \fImasters\fR | \fIipv4_address\fR [ port
+	    \fIinteger\fR ] | \fIipv6_address\fR [ port \fIinteger\fR ] ) [ key
 	    \fIstring\fR ]; \&.\&.\&. } ] [ zone\-directory \fIquoted_string\fR ] [
 	    in\-memory \fIboolean\fR ] [ min\-update\-interval \fIinteger\fR ]; \&.\&.\&. };
 	check\-dup\-records ( fail | warn | ignore );
@@ -734,13 +734,13 @@ view \fIstring\fR [ \fIclass\fR ] {
 	request\-nsid \fIboolean\fR;
 	require\-server\-cookie \fIboolean\fR;
 	resolver\-query\-timeout \fIinteger\fR;
-	response\-policy { zone \fIquoted_string\fR [ log \fIboolean\fR ] [
-	    max\-policy\-ttl \fIinteger\fR ] [ policy ( cname | disabled | drop |
-	    given | no\-op | nodata | nxdomain | passthru | tcp\-only
-	    \fIquoted_string\fR ) ] [ recursive\-only \fIboolean\fR ]; \&.\&.\&. } [
-	    break\-dnssec \fIboolean\fR ] [ max\-policy\-ttl \fIinteger\fR ] [
-	    min\-ns\-dots \fIinteger\fR ] [ nsip\-wait\-recurse \fIboolean\fR ] [
-	    qname\-wait\-recurse \fIboolean\fR ] [ recursive\-only \fIboolean\fR ];
+	response\-policy { zone \fIstring\fR [ log \fIboolean\fR ] [ max\-policy\-ttl
+	    \fIinteger\fR ] [ policy ( cname | disabled | drop | given | no\-op
+	    | nodata | nxdomain | passthru | tcp\-only \fIquoted_string\fR ) ] [
+	    recursive\-only \fIboolean\fR ]; \&.\&.\&. } [ break\-dnssec \fIboolean\fR ] [
+	    max\-policy\-ttl \fIinteger\fR ] [ min\-ns\-dots \fIinteger\fR ] [
+	    nsip\-wait\-recurse \fIboolean\fR ] [ qname\-wait\-recurse \fIboolean\fR ]
+	    [ recursive\-only \fIboolean\fR ];
 	root\-delegation\-only [ exclude { \fIquoted_string\fR; \&.\&.\&. } ];
 	root\-key\-sentinel \fIboolean\fR;
 	rrset\-order { [ class \fIstring\fR ] [ type \fIstring\fR ] [ name

bin/named/named.conf.docbook

@@ -13,7 +13,7 @@
 
 <refentry xmlns:db="http://docbook.org/ns/docbook" version="5.0" xml:id="man.named.conf">
   <info>
-    <date>2018-06-21</date>
+    <date>2019-07-22</date>
   </info>
   <refentryinfo>
     <corpname>ISC</corpname>
@@ -221,9 +221,9 @@ options {
 	bindkeys-file <replaceable>quoted_string</replaceable>;
 	blackhole { <replaceable>address_match_element</replaceable>; ... };
 	cache-file <replaceable>quoted_string</replaceable>;
-	catalog-zones { zone <replaceable>quoted_string</replaceable> [ default-masters [ port
-	    <replaceable>integer</replaceable> ] [ dscp <replaceable>integer</replaceable> ] { ( <replaceable>masters</replaceable> | <replaceable>ipv4_address</replaceable> [
-	    port <replaceable>integer</replaceable> ] | <replaceable>ipv6_address</replaceable> [ port <replaceable>integer</replaceable> ] ) [ key
+	catalog-zones { zone <replaceable>string</replaceable> [ default-masters [ port <replaceable>integer</replaceable> ]
+	    [ dscp <replaceable>integer</replaceable> ] { ( <replaceable>masters</replaceable> | <replaceable>ipv4_address</replaceable> [ port
+	    <replaceable>integer</replaceable> ] | <replaceable>ipv6_address</replaceable> [ port <replaceable>integer</replaceable> ] ) [ key
 	    <replaceable>string</replaceable> ]; ... } ] [ zone-directory <replaceable>quoted_string</replaceable> ] [
 	    in-memory <replaceable>boolean</replaceable> ] [ min-update-interval <replaceable>integer</replaceable> ]; ... };
 	check-dup-records ( fail | warn | ignore );
@@ -238,7 +238,7 @@ options {
 	check-wildcard <replaceable>boolean</replaceable>;
 	cleaning-interval <replaceable>integer</replaceable>;
 	clients-per-query <replaceable>integer</replaceable>;
-	cookie-algorithm ( aes | sha1 | sha256 );
+	cookie-algorithm ( aes | sha1 | sha256 | siphash24 );
 	cookie-secret <replaceable>string</replaceable>;
 	coresize ( default | unlimited | <replaceable>sizeval</replaceable> );
 	datasize ( default | unlimited | <replaceable>sizeval</replaceable> );
@@ -407,13 +407,13 @@ options {
 	require-server-cookie <replaceable>boolean</replaceable>;
 	reserved-sockets <replaceable>integer</replaceable>;
 	resolver-query-timeout <replaceable>integer</replaceable>;
-	response-policy { zone <replaceable>quoted_string</replaceable> [ log <replaceable>boolean</replaceable> ] [
-	    max-policy-ttl <replaceable>integer</replaceable> ] [ policy ( cname | disabled | drop |
-	    given | no-op | nodata | nxdomain | passthru | tcp-only
-	    <replaceable>quoted_string</replaceable> ) ] [ recursive-only <replaceable>boolean</replaceable> ]; ... } [
-	    break-dnssec <replaceable>boolean</replaceable> ] [ max-policy-ttl <replaceable>integer</replaceable> ] [
-	    min-ns-dots <replaceable>integer</replaceable> ] [ nsip-wait-recurse <replaceable>boolean</replaceable> ] [
-	    qname-wait-recurse <replaceable>boolean</replaceable> ] [ recursive-only <replaceable>boolean</replaceable> ];
+	response-policy { zone <replaceable>string</replaceable> [ log <replaceable>boolean</replaceable> ] [ max-policy-ttl
+	    <replaceable>integer</replaceable> ] [ policy ( cname | disabled | drop | given | no-op
+	    | nodata | nxdomain | passthru | tcp-only <replaceable>quoted_string</replaceable> ) ] [
+	    recursive-only <replaceable>boolean</replaceable> ]; ... } [ break-dnssec <replaceable>boolean</replaceable> ] [
+	    max-policy-ttl <replaceable>integer</replaceable> ] [ min-ns-dots <replaceable>integer</replaceable> ] [
+	    nsip-wait-recurse <replaceable>boolean</replaceable> ] [ qname-wait-recurse <replaceable>boolean</replaceable> ]
+	    [ recursive-only <replaceable>boolean</replaceable> ];
 	root-delegation-only [ exclude { <replaceable>quoted_string</replaceable>; ... } ];
 	root-key-sentinel <replaceable>boolean</replaceable>;
 	rrset-order { [ class <replaceable>string</replaceable> ] [ type <replaceable>string</replaceable> ] [ name
@@ -551,9 +551,9 @@ view <replaceable>string</replaceable> [ <replaceable>class</replaceable> ] {
 	auth-nxdomain <replaceable>boolean</replaceable>; // default changed
 	auto-dnssec ( allow | maintain | off );
 	cache-file <replaceable>quoted_string</replaceable>;
-	catalog-zones { zone <replaceable>quoted_string</replaceable> [ default-masters [ port
-	    <replaceable>integer</replaceable> ] [ dscp <replaceable>integer</replaceable> ] { ( <replaceable>masters</replaceable> | <replaceable>ipv4_address</replaceable> [
-	    port <replaceable>integer</replaceable> ] | <replaceable>ipv6_address</replaceable> [ port <replaceable>integer</replaceable> ] ) [ key
+	catalog-zones { zone <replaceable>string</replaceable> [ default-masters [ port <replaceable>integer</replaceable> ]
+	    [ dscp <replaceable>integer</replaceable> ] { ( <replaceable>masters</replaceable> | <replaceable>ipv4_address</replaceable> [ port
+	    <replaceable>integer</replaceable> ] | <replaceable>ipv6_address</replaceable> [ port <replaceable>integer</replaceable> ] ) [ key
 	    <replaceable>string</replaceable> ]; ... } ] [ zone-directory <replaceable>quoted_string</replaceable> ] [
 	    in-memory <replaceable>boolean</replaceable> ] [ min-update-interval <replaceable>integer</replaceable> ]; ... };
 	check-dup-records ( fail | warn | ignore );
@@ -707,13 +707,13 @@ view <replaceable>string</replaceable> [ <replaceable>class</replaceable> ] {
 	request-nsid <replaceable>boolean</replaceable>;
 	require-server-cookie <replaceable>boolean</replaceable>;
 	resolver-query-timeout <replaceable>integer</replaceable>;
-	response-policy { zone <replaceable>quoted_string</replaceable> [ log <replaceable>boolean</replaceable> ] [
-	    max-policy-ttl <replaceable>integer</replaceable> ] [ policy ( cname | disabled | drop |
-	    given | no-op | nodata | nxdomain | passthru | tcp-only
-	    <replaceable>quoted_string</replaceable> ) ] [ recursive-only <replaceable>boolean</replaceable> ]; ... } [
-	    break-dnssec <replaceable>boolean</replaceable> ] [ max-policy-ttl <replaceable>integer</replaceable> ] [
-	    min-ns-dots <replaceable>integer</replaceable> ] [ nsip-wait-recurse <replaceable>boolean</replaceable> ] [
-	    qname-wait-recurse <replaceable>boolean</replaceable> ] [ recursive-only <replaceable>boolean</replaceable> ];
+	response-policy { zone <replaceable>string</replaceable> [ log <replaceable>boolean</replaceable> ] [ max-policy-ttl
+	    <replaceable>integer</replaceable> ] [ policy ( cname | disabled | drop | given | no-op
+	    | nodata | nxdomain | passthru | tcp-only <replaceable>quoted_string</replaceable> ) ] [
+	    recursive-only <replaceable>boolean</replaceable> ]; ... } [ break-dnssec <replaceable>boolean</replaceable> ] [
+	    max-policy-ttl <replaceable>integer</replaceable> ] [ min-ns-dots <replaceable>integer</replaceable> ] [
+	    nsip-wait-recurse <replaceable>boolean</replaceable> ] [ qname-wait-recurse <replaceable>boolean</replaceable> ]
+	    [ recursive-only <replaceable>boolean</replaceable> ];
 	root-delegation-only [ exclude { <replaceable>quoted_string</replaceable>; ... } ];
 	root-key-sentinel <replaceable>boolean</replaceable>;
 	rrset-order { [ class <replaceable>string</replaceable> ] [ type <replaceable>string</replaceable> ] [ name

bin/named/named.conf.html

@@ -209,9 +209,9 @@ options
 	bindkeys-file <em class="replaceable"><code>quoted_string</code></em>;<br>
 	blackhole { <em class="replaceable"><code>address_match_element</code></em>; ... };<br>
 	cache-file <em class="replaceable"><code>quoted_string</code></em>;<br>
-	catalog-zones { zone <em class="replaceable"><code>quoted_string</code></em> [ default-masters [ port<br>
-	    <em class="replaceable"><code>integer</code></em> ] [ dscp <em class="replaceable"><code>integer</code></em> ] { ( <em class="replaceable"><code>masters</code></em> | <em class="replaceable"><code>ipv4_address</code></em> [<br>
-	    port <em class="replaceable"><code>integer</code></em> ] | <em class="replaceable"><code>ipv6_address</code></em> [ port <em class="replaceable"><code>integer</code></em> ] ) [ key<br>
+	catalog-zones { zone <em class="replaceable"><code>string</code></em> [ default-masters [ port <em class="replaceable"><code>integer</code></em> ]<br>
+	    [ dscp <em class="replaceable"><code>integer</code></em> ] { ( <em class="replaceable"><code>masters</code></em> | <em class="replaceable"><code>ipv4_address</code></em> [ port<br>
+	    <em class="replaceable"><code>integer</code></em> ] | <em class="replaceable"><code>ipv6_address</code></em> [ port <em class="replaceable"><code>integer</code></em> ] ) [ key<br>
 	    <em class="replaceable"><code>string</code></em> ]; ... } ] [ zone-directory <em class="replaceable"><code>quoted_string</code></em> ] [<br>
 	    in-memory <em class="replaceable"><code>boolean</code></em> ] [ min-update-interval <em class="replaceable"><code>integer</code></em> ]; ... };<br>
 	check-dup-records ( fail | warn | ignore );<br>
@@ -226,7 +226,7 @@ options
 	check-wildcard <em class="replaceable"><code>boolean</code></em>;<br>
 	cleaning-interval <em class="replaceable"><code>integer</code></em>;<br>
 	clients-per-query <em class="replaceable"><code>integer</code></em>;<br>
-	cookie-algorithm ( aes | sha1 | sha256 );<br>
+	cookie-algorithm ( aes | sha1 | sha256 | siphash24 );<br>
 	cookie-secret <em class="replaceable"><code>string</code></em>;<br>
 	coresize ( default | unlimited | <em class="replaceable"><code>sizeval</code></em> );<br>
 	datasize ( default | unlimited | <em class="replaceable"><code>sizeval</code></em> );<br>
@@ -395,13 +395,13 @@ options
 	require-server-cookie <em class="replaceable"><code>boolean</code></em>;<br>
 	reserved-sockets <em class="replaceable"><code>integer</code></em>;<br>
 	resolver-query-timeout <em class="replaceable"><code>integer</code></em>;<br>
-	response-policy { zone <em class="replaceable"><code>quoted_string</code></em> [ log <em class="replaceable"><code>boolean</code></em> ] [<br>
-	    max-policy-ttl <em class="replaceable"><code>integer</code></em> ] [ policy ( cname | disabled | drop |<br>
-	    given | no-op | nodata | nxdomain | passthru | tcp-only<br>
-	    <em class="replaceable"><code>quoted_string</code></em> ) ] [ recursive-only <em class="replaceable"><code>boolean</code></em> ]; ... } [<br>
-	    break-dnssec <em class="replaceable"><code>boolean</code></em> ] [ max-policy-ttl <em class="replaceable"><code>integer</code></em> ] [<br>
-	    min-ns-dots <em class="replaceable"><code>integer</code></em> ] [ nsip-wait-recurse <em class="replaceable"><code>boolean</code></em> ] [<br>
-	    qname-wait-recurse <em class="replaceable"><code>boolean</code></em> ] [ recursive-only <em class="replaceable"><code>boolean</code></em> ];<br>
+	response-policy { zone <em class="replaceable"><code>string</code></em> [ log <em class="replaceable"><code>boolean</code></em> ] [ max-policy-ttl<br>
+	    <em class="replaceable"><code>integer</code></em> ] [ policy ( cname | disabled | drop | given | no-op<br>
+	    | nodata | nxdomain | passthru | tcp-only <em class="replaceable"><code>quoted_string</code></em> ) ] [<br>
+	    recursive-only <em class="replaceable"><code>boolean</code></em> ]; ... } [ break-dnssec <em class="replaceable"><code>boolean</code></em> ] [<br>
+	    max-policy-ttl <em class="replaceable"><code>integer</code></em> ] [ min-ns-dots <em class="replaceable"><code>integer</code></em> ] [<br>
+	    nsip-wait-recurse <em class="replaceable"><code>boolean</code></em> ] [ qname-wait-recurse <em class="replaceable"><code>boolean</code></em> ]<br>
+	    [ recursive-only <em class="replaceable"><code>boolean</code></em> ];<br>
 	root-delegation-only [ exclude { <em class="replaceable"><code>quoted_string</code></em>; ... } ];<br>
 	root-key-sentinel <em class="replaceable"><code>boolean</code></em>;<br>
 	rrset-order { [ class <em class="replaceable"><code>string</code></em> ] [ type <em class="replaceable"><code>string</code></em> ] [ name<br>
@@ -543,9 +543,9 @@ view
 	auth-nxdomain <em class="replaceable"><code>boolean</code></em>; // default changed<br>
 	auto-dnssec ( allow | maintain | off );<br>
 	cache-file <em class="replaceable"><code>quoted_string</code></em>;<br>
-	catalog-zones { zone <em class="replaceable"><code>quoted_string</code></em> [ default-masters [ port<br>
-	    <em class="replaceable"><code>integer</code></em> ] [ dscp <em class="replaceable"><code>integer</code></em> ] { ( <em class="replaceable"><code>masters</code></em> | <em class="replaceable"><code>ipv4_address</code></em> [<br>
-	    port <em class="replaceable"><code>integer</code></em> ] | <em class="replaceable"><code>ipv6_address</code></em> [ port <em class="replaceable"><code>integer</code></em> ] ) [ key<br>
+	catalog-zones { zone <em class="replaceable"><code>string</code></em> [ default-masters [ port <em class="replaceable"><code>integer</code></em> ]<br>
+	    [ dscp <em class="replaceable"><code>integer</code></em> ] { ( <em class="replaceable"><code>masters</code></em> | <em class="replaceable"><code>ipv4_address</code></em> [ port<br>
+	    <em class="replaceable"><code>integer</code></em> ] | <em class="replaceable"><code>ipv6_address</code></em> [ port <em class="replaceable"><code>integer</code></em> ] ) [ key<br>
 	    <em class="replaceable"><code>string</code></em> ]; ... } ] [ zone-directory <em class="replaceable"><code>quoted_string</code></em> ] [<br>
 	    in-memory <em class="replaceable"><code>boolean</code></em> ] [ min-update-interval <em class="replaceable"><code>integer</code></em> ]; ... };<br>
 	check-dup-records ( fail | warn | ignore );<br>
@@ -699,13 +699,13 @@ view
 	request-nsid <em class="replaceable"><code>boolean</code></em>;<br>
 	require-server-cookie <em class="replaceable"><code>boolean</code></em>;<br>
 	resolver-query-timeout <em class="replaceable"><code>integer</code></em>;<br>
-	response-policy { zone <em class="replaceable"><code>quoted_string</code></em> [ log <em class="replaceable"><code>boolean</code></em> ] [<br>
-	    max-policy-ttl <em class="replaceable"><code>integer</code></em> ] [ policy ( cname | disabled | drop |<br>
-	    given | no-op | nodata | nxdomain | passthru | tcp-only<br>
-	    <em class="replaceable"><code>quoted_string</code></em> ) ] [ recursive-only <em class="replaceable"><code>boolean</code></em> ]; ... } [<br>
-	    break-dnssec <em class="replaceable"><code>boolean</code></em> ] [ max-policy-ttl <em class="replaceable"><code>integer</code></em> ] [<br>
-	    min-ns-dots <em class="replaceable"><code>integer</code></em> ] [ nsip-wait-recurse <em class="replaceable"><code>boolean</code></em> ] [<br>
-	    qname-wait-recurse <em class="replaceable"><code>boolean</code></em> ] [ recursive-only <em class="replaceable"><code>boolean</code></em> ];<br>
+	response-policy { zone <em class="replaceable"><code>string</code></em> [ log <em class="replaceable"><code>boolean</code></em> ] [ max-policy-ttl<br>
+	    <em class="replaceable"><code>integer</code></em> ] [ policy ( cname | disabled | drop | given | no-op<br>
+	    | nodata | nxdomain | passthru | tcp-only <em class="replaceable"><code>quoted_string</code></em> ) ] [<br>
+	    recursive-only <em class="replaceable"><code>boolean</code></em> ]; ... } [ break-dnssec <em class="replaceable"><code>boolean</code></em> ] [<br>
+	    max-policy-ttl <em class="replaceable"><code>integer</code></em> ] [ min-ns-dots <em class="replaceable"><code>integer</code></em> ] [<br>
+	    nsip-wait-recurse <em class="replaceable"><code>boolean</code></em> ] [ qname-wait-recurse <em class="replaceable"><code>boolean</code></em> ]<br>
+	    [ recursive-only <em class="replaceable"><code>boolean</code></em> ];<br>
 	root-delegation-only [ exclude { <em class="replaceable"><code>quoted_string</code></em>; ... } ];<br>
 	root-key-sentinel <em class="replaceable"><code>boolean</code></em>;<br>
 	rrset-order { [ class <em class="replaceable"><code>string</code></em> ] [ type <em class="replaceable"><code>string</code></em> ] [ name<br>

bin/named/query.c

@@ -4220,12 +4220,14 @@ query_prefetch(ns_client_t *client, dns_name_t *qname,
 	if (client->recursionquota == NULL) {
 		result = isc_quota_attach(&ns_g_server->recursionquota,
 					  &client->recursionquota);
+		if (result == ISC_R_SUCCESS || result == ISC_R_SOFTQUOTA) {
+			isc_stats_increment(ns_g_server->nsstats,
+					    dns_nsstatscounter_recursclients);
+		}
 		if (result == ISC_R_SUCCESS && !client->mortal && !TCP(client))
 			result = ns_client_replace(client);
 		if (result != ISC_R_SUCCESS)
 			return;
-		isc_stats_increment(ns_g_server->nsstats,
-				    dns_nsstatscounter_recursclients);
 	}
 
 	tmprdataset = query_newrdataset(client);
@@ -4277,8 +4279,10 @@ query_recurse(ns_client_t *client, dns_rdatatype_t qtype, dns_name_t *qname,
 		result = isc_quota_attach(&ns_g_server->recursionquota,
 					  &client->recursionquota);
 
-		isc_stats_increment(ns_g_server->nsstats,
-				    dns_nsstatscounter_recursclients);
+		if (result == ISC_R_SUCCESS || result == ISC_R_SOFTQUOTA) {
+			isc_stats_increment(ns_g_server->nsstats,
+					    dns_nsstatscounter_recursclients);
+		}
 
 		if  (result == ISC_R_SOFTQUOTA) {
 			static isc_stdtime_t last = 0;
@@ -4535,12 +4539,14 @@ query_rpzfetch(ns_client_t *client, dns_name_t *qname, dns_rdatatype_t type) {
 	if (client->recursionquota == NULL) {
 		result = isc_quota_attach(&ns_g_server->recursionquota,
 					  &client->recursionquota);
+		if (result == ISC_R_SUCCESS || result == ISC_R_SOFTQUOTA) {
+			isc_stats_increment(ns_g_server->nsstats,
+					    dns_nsstatscounter_recursclients);
+		}
 		if (result == ISC_R_SUCCESS && !client->mortal && !TCP(client))
 			result = ns_client_replace(client);
 		if (result != ISC_R_SUCCESS)
 			return;
-		isc_stats_increment(ns_g_server->nsstats,
-				    dns_nsstatscounter_recursclients);
 	}
 
 	tmprdataset = query_newrdataset(client);
@@ -4777,6 +4783,7 @@ rpz_find_p(ns_client_t *client, dns_name_t *self_name, dns_rdatatype_t qtype,
 	isc_result_t result;
 	dns_clientinfomethods_t cm;
 	dns_clientinfo_t ci;
+	bool found_a = false;
 
 	REQUIRE(nodep != NULL);
 
@@ -4820,6 +4827,18 @@ rpz_find_p(ns_client_t *client, dns_name_t *self_name, dns_rdatatype_t qtype,
 			       "rpz_find_p: allrdatasets failed");
 			return (DNS_R_SERVFAIL);
 		}
+		if (qtype == dns_rdatatype_aaaa &&
+		    !ISC_LIST_EMPTY(client->view->dns64)) {
+			for (result = dns_rdatasetiter_first(rdsiter);
+			     result == ISC_R_SUCCESS;
+			     result = dns_rdatasetiter_next(rdsiter)) {
+				dns_rdatasetiter_current(rdsiter, *rdatasetp);
+				if ((*rdatasetp)->type == dns_rdatatype_a) {
+					found_a = true;
+				}
+				dns_rdataset_disassociate(*rdatasetp);
+			}
+		}
 		for (result = dns_rdatasetiter_first(rdsiter);
 		     result == ISC_R_SUCCESS;
 		     result = dns_rdatasetiter_next(rdsiter)) {
@@ -4872,7 +4891,11 @@ rpz_find_p(ns_client_t *client, dns_name_t *self_name, dns_rdatatype_t qtype,
 		}
 		return (ISC_R_SUCCESS);
 	case DNS_R_NXRRSET:
-		*policyp = DNS_RPZ_POLICY_NODATA;
+		if (found_a) {
+			*policyp = DNS_RPZ_POLICY_DNS64;
+		} else {
+			*policyp = DNS_RPZ_POLICY_NODATA;
+		}
 		return (result);
 	case DNS_R_DNAME:
 		/*
@@ -6568,6 +6591,7 @@ redirect2(ns_client_t *client, dns_name_t *name, dns_rdataset_t *rdataset,
 	dns_dbversion_t *version = NULL;
 	dns_zone_t *zone = NULL;
 	bool is_zone;
+	unsigned int labels;
 	unsigned int options;
 
 	CTRACE(ISC_LOG_DEBUG(3), "redirect2");
@@ -6610,12 +6634,13 @@ redirect2(ns_client_t *client, dns_name_t *name, dns_rdataset_t *rdataset,
 	}
 
 	redirectname = dns_fixedname_initname(&fixedredirect);
-	if (dns_name_countlabels(name) > 1U) {
+	labels = dns_name_countlabels(client->query.qname);
+	if (labels > 1U) {
 		dns_name_t prefix;
-		unsigned int labels = dns_name_countlabels(name) - 1;
 
 		dns_name_init(&prefix, NULL);
-		dns_name_getlabelsequence(name, 0, labels, &prefix);
+		dns_name_getlabelsequence(client->query.qname, 0, labels - 1,
+					  &prefix);
 		result = dns_name_concatenate(&prefix,
 					      client->view->redirectzone,
 					      redirectname, NULL);
@@ -6764,7 +6789,7 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
 	bool failcache;
 	uint32_t flags;
 #ifdef WANT_QUERYTRACE
-	char mbuf[BUFSIZ];
+	char mbuf[4 * DNS_NAME_FORMATSIZE];
 	char qbuf[DNS_NAME_FORMATSIZE];
 	char tbuf[DNS_RDATATYPE_FORMATSIZE];
 #endif
@@ -7500,8 +7525,10 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
 				rpz = true;
 				break;
 			case DNS_RPZ_POLICY_NODATA:
-				result = DNS_R_NXRRSET;
 				nxrewrite = true;
+				/* FALLTHROUGH */
+			case DNS_RPZ_POLICY_DNS64:
+				result = DNS_R_NXRRSET;
 				rpz = true;
 				break;
 			case DNS_RPZ_POLICY_RECORD:
@@ -7962,6 +7989,7 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
 #endif
 		} else if (result == DNS_R_NXRRSET &&
 			   !ISC_LIST_EMPTY(client->view->dns64) &&
+			   !nxrewrite &&
 			   client->message->rdclass == dns_rdataclass_in &&
 			   qtype == dns_rdatatype_aaaa)
 		{
@@ -9020,11 +9048,13 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
 			}
 
 			/*
-			 * BIND 8 priming queries need the additional section.
+			 * Always add glue for root priming queries, regardless
+			 * of "minimal-responses" setting.
 			 */
 			if (dns_name_equal(client->query.qname, dns_rootname)) {
 				client->query.attributes &=
 					~NS_QUERYATTR_NOADDITIONAL;
+				dns_db_attach(db, &client->query.gluedb);
 			}
 		}
 
@@ -9176,6 +9206,10 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
 		free_devent(client, ISC_EVENT_PTR(&event), &event);
 	}
 
+	if (client->query.gluedb != NULL) {
+		dns_db_detach(&client->query.gluedb);
+	}
+
 	/*
 	 * AA bit.
 	 */

bin/named/server.c

@@ -42,6 +42,7 @@
 #include <isc/refcount.h>
 #include <isc/resource.h>
 #include <isc/sha2.h>
+#include <isc/siphash.h>
 #include <isc/socket.h>
 #include <isc/stat.h>
 #include <isc/stats.h>
@@ -105,9 +106,9 @@
 #include <named/client.h>
 #include <named/config.h>
 #include <named/control.h>
-#ifdef HAVE_GEOIP
+#if defined(HAVE_GEOIP) || defined(HAVE_GEOIP2)
 #include <named/geoip.h>
-#endif /* HAVE_GEOIP */
+#endif /* HAVE_GEOIP || HAVE_GEOIP2 */
 #include <named/interfacemgr.h>
 #include <named/log.h>
 #include <named/logconf.h>
@@ -844,7 +845,7 @@ load_view_keys(const cfg_obj_t *keys, const cfg_obj_t *vconfig,
 			key = cfg_listelt_value(elt2);
 			result = dstkey_fromconfig(vconfig, key, managed,
 						   &dstkey, mctx);
-			if (result ==  DST_R_UNSUPPORTEDALG) {
+			if (result == DST_R_UNSUPPORTEDALG) {
 				result = ISC_R_SUCCESS;
 				continue;
 			}
@@ -4384,6 +4385,7 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
 		 * "allow-recursion-on" and "allow-query-cache" ACLs from
 		 * the global config.
 		 */
+		/* cppcheck-suppress duplicateCondition */
 		if (view->recursionacl == NULL) {
 			/* global default only */
 			CHECK(configure_view_acl(NULL, NULL, ns_g_config,
@@ -4391,6 +4393,7 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
 						 actx, ns_g_mctx,
 						 &view->recursionacl));
 		}
+		/* cppcheck-suppress duplicateCondition */
 		if (view->recursiononacl == NULL) {
 			/* global default only */
 			CHECK(configure_view_acl(NULL, NULL, ns_g_config,
@@ -7631,7 +7634,7 @@ load_configuration(const char *filename, ns_server_t *server,
 	}
 	isc__socketmgr_setreserved(ns_g_socketmgr, reserved);
 
-#ifdef HAVE_GEOIP
+#if defined(HAVE_GEOIP) || defined(HAVE_GEOIP2)
 	/*
 	 * Initialize GeoIP databases from the configured location.
 	 * This should happen before configuring any ACLs, so that we
@@ -7644,8 +7647,6 @@ load_configuration(const char *filename, ns_server_t *server,
 		char *dir;
 		DE_CONST(cfg_obj_asstring(obj), dir);
 		ns_geoip_load(dir);
-	} else {
-		ns_geoip_load(NULL);
 	}
 	ns_g_aclconfctx->geoip = ns_g_geoip;
 
@@ -7653,7 +7654,7 @@ load_configuration(const char *filename, ns_server_t *server,
 	result = ns_config_get(maps, "geoip-use-ecs", &obj);
 	INSIST(result == ISC_R_SUCCESS);
 	ns_g_server->aclenv.geoip_use_ecs = cfg_obj_asboolean(obj);
-#endif /* HAVE_GEOIP */
+#endif /* HAVE_GEOIP || HAVE_GEOIP2 */
 
 	/*
 	 * Configure various server options.
@@ -8246,29 +8247,25 @@ load_configuration(const char *filename, ns_server_t *server,
 			}
 #endif
 		}
-	}
 
 #ifdef HAVE_LMDB
-	/*
-	 * If we're using LMDB, we may have created newzones databases
-	 * as root, making it impossible to reopen them later after
-	 * switching to a new userid. We close them now, and reopen
-	 * after relinquishing privileges them.
-	 */
-	if (first_time) {
+		/*
+		 * If we're using LMDB, we may have created newzones
+		 * databases as root, making it impossible to reopen
+		 * them later after switching to a new userid. We
+		 * close them now, and reopen after relinquishing
+		 * privileges them.
+		 */
 		for (view = ISC_LIST_HEAD(server->viewlist);
-		     view != NULL;
-		     view = ISC_LIST_NEXT(view, link))
+		     view != NULL; view = ISC_LIST_NEXT(view, link))
 		{
 			nzd_env_close(view);
 		}
-	}
 #endif /* HAVE_LMDB */
 
-	/*
-	 * Relinquish root privileges.
-	 */
-	if (first_time) {
+		/*
+		 * Relinquish root privileges.
+		 */
 		ns_os_changeuser();
 	}
 
@@ -8484,7 +8481,9 @@ load_configuration(const char *filename, ns_server_t *server,
 	obj = NULL;
 	result = ns_config_get(maps, "cookie-algorithm", &obj);
 	INSIST(result == ISC_R_SUCCESS);
-	if (strcasecmp(cfg_obj_asstring(obj), "aes") == 0) {
+	if (strcasecmp(cfg_obj_asstring(obj), "siphash24") == 0) {
+		server->cookiealg = ns_cookiealg_siphash24;
+	} else if (strcasecmp(cfg_obj_asstring(obj), "aes") == 0) {
 #if defined(HAVE_OPENSSL_AES) || defined(HAVE_OPENSSL_EVP_AES)
 		server->cookiealg = ns_cookiealg_aes;
 #else
@@ -8547,11 +8546,16 @@ load_configuration(const char *filename, ns_server_t *server,
 
 			usedlength = isc_buffer_usedlength(&b);
 			switch (server->cookiealg) {
+			case ns_cookiealg_siphash24:
+				if (usedlength != ISC_SIPHASH24_KEY_LENGTH) {
+					CHECKM(ISC_R_RANGE,
+					       "SipHash-2-4 cookie-secret must be 128 bits");
+				}
+				break;
 			case ns_cookiealg_aes:
 				if (usedlength != ISC_AES128_KEYLENGTH) {
 					CHECKM(ISC_R_RANGE,
-					       "AES cookie-secret must be "
-					       "128 bits");
+					       "AES cookie-secret must be 128 bits");
 				}
 				break;
 			case ns_cookiealg_sha1:
@@ -8960,9 +8964,9 @@ shutdown_server(isc_task_t *task, isc_event_t *event) {
 #ifdef HAVE_DNSTAP
 	dns_dt_shutdown();
 #endif
-#ifdef HAVE_GEOIP
-	dns_geoip_shutdown();
-#endif
+#if defined(HAVE_GEOIP) || defined(HAVE_GEOIP2)
+	ns_geoip_shutdown();
+#endif /* HAVE_GEOIP || HAVE_GEOIP2 */
 
 	dns_db_detach(&server->in_roothints);
 
@@ -8995,7 +8999,7 @@ ns_server_create(isc_mem_t *mctx, ns_server_t **serverp) {
 	result = dns_aclenv_init(mctx, &server->aclenv);
 	RUNTIME_CHECK(result == ISC_R_SUCCESS);
 
-#ifdef HAVE_GEOIP
+#if defined(HAVE_GEOIP) || defined(HAVE_GEOIP2)
 	/* Initialize GeoIP before using ACL environment */
 	ns_geoip_init();
 	server->aclenv.geoip = ns_g_geoip;
@@ -10039,17 +10043,21 @@ dumpdone(void *arg, isc_result_t result) {
 	char buf[1024+32];
 	const dns_master_style_t *style;
 
-	if (result != ISC_R_SUCCESS)
+	if (result != ISC_R_SUCCESS) {
 		goto cleanup;
-	if (dctx->mdctx != NULL)
+	}
+	if (dctx->mdctx != NULL) {
 		dns_dumpctx_detach(&dctx->mdctx);
+	}
 	if (dctx->view == NULL) {
 		dctx->view = ISC_LIST_HEAD(dctx->viewlist);
-		if (dctx->view == NULL)
+		if (dctx->view == NULL) {
 			goto done;
+		}
 		INSIST(dctx->zone == NULL);
-	} else
+	} else {
 		goto resume;
+	}
  nextview:
 	fprintf(dctx->fp, ";\n; Start view %s\n;\n", dctx->view->view->name);
  resume:
@@ -10063,8 +10071,9 @@ dumpdone(void *arg, isc_result_t result) {
 	{
 		style = &dns_master_style_cache;
 		/* start cache dump */
-		if (dctx->view->view->cachedb != NULL)
+		if (dctx->view->view->cachedb != NULL) {
 			dns_db_attach(dctx->view->view->cachedb, &dctx->cache);
+		}
 		if (dctx->cache != NULL) {
 			fprintf(dctx->fp,
 				";\n; Cache dump of view '%s' (cache %s)\n;\n",
@@ -10076,43 +10085,52 @@ dumpdone(void *arg, isc_result_t result) {
 							    dctx->task,
 							    dumpdone, dctx,
 							    &dctx->mdctx);
-			if (result == DNS_R_CONTINUE)
+			if (result == DNS_R_CONTINUE) {
 				return;
-			if (result == ISC_R_NOTIMPLEMENTED)
+			}
+			if (result == ISC_R_NOTIMPLEMENTED) {
 				fprintf(dctx->fp, "; %s\n",
 					dns_result_totext(result));
-			else if (result != ISC_R_SUCCESS)
+			} else if (result != ISC_R_SUCCESS) {
 				goto cleanup;
+			}
 		}
 	}
 
 	if ((dctx->dumpadb || dctx->dumpbad || dctx->dumpfail) &&
-	    dctx->cache == NULL && dctx->view->view->cachedb != NULL)
+	    dctx->cache == NULL && dctx->view->view->cachedb != NULL) {
 		dns_db_attach(dctx->view->view->cachedb, &dctx->cache);
+	}
 
 	if (dctx->cache != NULL) {
-		if (dctx->dumpadb)
+		if (dctx->dumpadb) {
 			dns_adb_dump(dctx->view->view->adb, dctx->fp);
-		if (dctx->dumpbad)
+		}
+		if (dctx->dumpbad) {
 			dns_resolver_printbadcache(dctx->view->view->resolver,
 						   dctx->fp);
-		if (dctx->dumpfail)
+		}
+		if (dctx->dumpfail) {
 			dns_badcache_print(dctx->view->view->failcache,
 					   "SERVFAIL cache", dctx->fp);
+		}
 		dns_db_detach(&dctx->cache);
 	}
 	if (dctx->dumpzones) {
 		style = &dns_master_style_full;
  nextzone:
-		if (dctx->version != NULL)
+		if (dctx->version != NULL) {
 			dns_db_closeversion(dctx->db, &dctx->version,
 					    false);
-		if (dctx->db != NULL)
+		}
+		if (dctx->db != NULL) {
 			dns_db_detach(&dctx->db);
-		if (dctx->zone == NULL)
+		}
+		if (dctx->zone == NULL) {
 			dctx->zone = ISC_LIST_HEAD(dctx->view->zonelist);
-		else
+		} else {
 			dctx->zone = ISC_LIST_NEXT(dctx->zone, link);
+		}
 		if (dctx->zone != NULL) {
 			/* start zone dump */
 			dns_zone_name(dctx->zone->zone, buf, sizeof(buf));
@@ -10131,8 +10149,9 @@ dumpdone(void *arg, isc_result_t result) {
 							    dctx->task,
 							    dumpdone, dctx,
 							    &dctx->mdctx);
-			if (result == DNS_R_CONTINUE)
+			if (result == DNS_R_CONTINUE) {
 				return;
+			}
 			if (result == ISC_R_NOTIMPLEMENTED) {
 				fprintf(dctx->fp, "; %s\n",
 					dns_result_totext(result));
@@ -10140,26 +10159,31 @@ dumpdone(void *arg, isc_result_t result) {
 				POST(result);
 				goto nextzone;
 			}
-			if (result != ISC_R_SUCCESS)
+			if (result != ISC_R_SUCCESS) {
 				goto cleanup;
+			}
 		}
 	}
-	if (dctx->view != NULL)
+	if (dctx->view != NULL) {
 		dctx->view = ISC_LIST_NEXT(dctx->view, link);
-	if (dctx->view != NULL)
-		goto nextview;
+		if (dctx->view != NULL) {
+			goto nextview;
+		}
+	}
  done:
 	fprintf(dctx->fp, "; Dump complete\n");
 	result = isc_stdio_flush(dctx->fp);
-	if (result == ISC_R_SUCCESS)
+	if (result == ISC_R_SUCCESS) {
 		isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
 			      NS_LOGMODULE_SERVER, ISC_LOG_INFO,
 			      "dumpdb complete");
+	}
  cleanup:
-	if (result != ISC_R_SUCCESS)
+	if (result != ISC_R_SUCCESS) {
 		isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
 			      NS_LOGMODULE_SERVER, ISC_LOG_ERROR,
 			      "dumpdb failed: %s", dns_result_totext(result));
+	}
 	dumpcontext_destroy(dctx);
 }
 

bin/named/statschannel.c

@@ -3277,6 +3277,10 @@ ns_statschannels_configure(ns_server_t *server, const cfg_obj_t *config,
 
 	ISC_LIST_INIT(new_listeners);
 
+#ifdef HAVE_LIBXML2
+	xmlInitThreads();
+#endif /* HAVE_LIBXML2 */
+
 	/*
 	 * Get the list of named.conf 'statistics-channels' statements.
 	 */
@@ -3409,6 +3413,10 @@ ns_statschannels_shutdown(ns_server_t *server) {
 		ISC_LIST_UNLINK(server->statschannels, listener, link);
 		shutdown_listener(listener);
 	}
+
+#ifdef HAVE_LIBXML2
+	xmlCleanupThreads();
+#endif /* HAVE_LIBXML2 */
 }
 
 isc_result_t

bin/named/unix/dlz_dlopen_driver.c

@@ -17,7 +17,9 @@
 #include <stdbool.h>
 #include <stdlib.h>
 #include <string.h>
+#if HAVE_DLFCN_H
 #include <dlfcn.h>
+#endif
 
 #include <dns/log.h>
 #include <dns/result.h>

bin/named/win32/named.vcxproj.filters.in

@@ -44,6 +44,11 @@
       <Filter>Source Files</Filter>
     </ClCompile>
 @END GEOIP
+@IF GEOIPLEGACY
+    <ClCompile Include="..\geoip.c">
+      <Filter>Source Files</Filter>
+    </ClCompile>
+@END GEOIPLEGACY
     <ClCompile Include="..\interfacemgr.c">
       <Filter>Source Files</Filter>
     </ClCompile>
@@ -141,6 +146,11 @@
       <Filter>Header Files</Filter>
     </ClInclude>
 @END GEOIP
+@IF GEOIPLEGACY
+    <ClInclude Include="..\include\named\geoip.h">
+      <Filter>Header Files</Filter>
+    </ClInclude>
+@END GEOIPLEGACY
     <ClInclude Include="..\include\named\globals.h">
       <Filter>Header Files</Filter>
     </ClInclude>

bin/named/win32/named.vcxproj.in

@@ -1,5 +1,5 @@
 <?xml version="1.0" encoding="utf-8"?>
-<Project DefaultTargets="Build" ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+<Project DefaultTargets="Build" ToolsVersion="@TOOLS_VERSION@" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
   <ItemGroup Label="ProjectConfigurations">
     <ProjectConfiguration Include="Debug|@PLATFORM@">
       <Configuration>Debug</Configuration>
@@ -14,18 +14,21 @@
     <ProjectGuid>{723C65DA-A96C-4BA3-A34E-44F11CA346F9}</ProjectGuid>
     <Keyword>Win32Proj</Keyword>
     <RootNamespace>named</RootNamespace>
+    @WINDOWS_TARGET_PLATFORM_VERSION@
   </PropertyGroup>
   <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|@PLATFORM@'" Label="Configuration">
     <ConfigurationType>Application</ConfigurationType>
     <UseDebugLibraries>true</UseDebugLibraries>
     <CharacterSet>MultiByte</CharacterSet>
+    @PLATFORM_TOOLSET@
   </PropertyGroup>
   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'" Label="Configuration">
     <ConfigurationType>Application</ConfigurationType>
     <UseDebugLibraries>false</UseDebugLibraries>
     <WholeProgramOptimization>true</WholeProgramOptimization>
     <CharacterSet>MultiByte</CharacterSet>
+    @PLATFORM_TOOLSET@
   </PropertyGroup>
   <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
   <ImportGroup Label="ExtensionSettings">
@@ -110,6 +113,9 @@
 @IF GEOIP
     <ClCompile Include="..\geoip.c" />
 @END GEOIP
+@IF GEOIPLEGACY
+    <ClCompile Include="..\geoip.c" />
+@END GEOIPLEGACY
     <ClCompile Include="..\interfacemgr.c" />
     <ClCompile Include="..\listenlist.c" />
     <ClCompile Include="..\log.c" />
@@ -146,6 +152,9 @@
 @IF GEOIP
     <ClInclude Include="..\include\named\geoip.h" />
 @END GEOIP
+@IF GEOIPLEGACY
+    <ClInclude Include="..\include\named\geoip.h" />
+@END GEOIPLEGACY
     <ClInclude Include="..\include\named\globals.h" />
     <ClInclude Include="..\include\named\interfacemgr.h" />
     <ClInclude Include="..\include\named\listenlist.h" />

bin/named/win32/ntservice.c

@@ -82,7 +82,7 @@ ServiceControl(DWORD dwCtrlCode) {
 	case SERVICE_CONTROL_STOP:
 		ns_server_flushonshutdown(ns_g_server, true);
 		isc_app_shutdown();
-		UpdateSCM(SERVICE_STOPPED);
+		UpdateSCM(SERVICE_STOP_PENDING);
 		break;
 	default:
 		break;

bin/named/win32/os.c

@@ -113,6 +113,16 @@ ns_os_init(const char *progname) {
 	 * ntservice_init();
 	 */
 	version_check(progname);
+	/*
+	 * If running in a Cygwin environment, clear the SEM_NOGPFAULTERRORBOX
+	 * bit in the process error mode to prevent Cygwin from concealing
+	 * non-abort() crashes, giving Windows Error Reporting a chance to
+	 * handle such crashes.  This is done to ensure all crashes triggered
+	 * by system tests can be detected.
+	 */
+	if (getenv("CYGWIN") != NULL) {
+		SetErrorMode(SetErrorMode(0) & ~SEM_NOGPFAULTERRORBOX);
+	}
 }
 
 void
@@ -350,9 +360,9 @@ ns_os_shutdown(void) {
 	if (lockfilefd != -1) {
 		(void) UnlockFile((HANDLE) _get_osfhandle(lockfilefd),
 				  0, 0, 0, 1);
-		close(lockfilefd);
-		lockfilefd = -1;
 	}
+	cleanup_lockfile();
+
 	ntservice_shutdown();	/* This MUST be the last thing done */
 }
 

bin/named/xfrout.c

@@ -9,8 +9,6 @@
  * information regarding copyright ownership.
  */
 
-/* $Id$ */
-
 #include <config.h>
 
 #include <inttypes.h>
@@ -797,11 +795,13 @@ ns_xfr_start(ns_client_t *client, dns_rdatatype_t reqtype) {
 	question_rdataset = ISC_LIST_HEAD(question_name->list);
 	question_class = question_rdataset->rdclass;
 	INSIST(question_rdataset->type == reqtype);
-	if (ISC_LIST_NEXT(question_rdataset, link) != NULL)
+	if (ISC_LIST_NEXT(question_rdataset, link) != NULL) {
 		FAILC(DNS_R_FORMERR, "multiple questions");
+	}
 	result = dns_message_nextname(request, DNS_SECTION_QUESTION);
-	if (result != ISC_R_NOMORE)
+	if (result != ISC_R_NOMORE) {
 		FAILC(DNS_R_FORMERR, "multiple questions");
+	}
 
 	result = dns_zt_find(client->view->zonetable, question_name, 0, NULL,
 			     &zone);
@@ -880,8 +880,9 @@ ns_xfr_start(ns_client_t *client, dns_rdatatype_t reqtype) {
 		/*
 		 * Ignore data whose owner name is not the zone apex.
 		 */
-		if (! dns_name_equal(soa_name, question_name))
+		if (! dns_name_equal(soa_name, question_name)) {
 			continue;
+		}
 
 		for (soa_rdataset = ISC_LIST_HEAD(soa_name->list);
 		     soa_rdataset != NULL;
@@ -890,25 +891,29 @@ ns_xfr_start(ns_client_t *client, dns_rdatatype_t reqtype) {
 			/*
 			 * Ignore non-SOA data.
 			 */
-			if (soa_rdataset->type != dns_rdatatype_soa)
+			if (soa_rdataset->type != dns_rdatatype_soa) {
 				continue;
-			if (soa_rdataset->rdclass != question_class)
+			}
+			if (soa_rdataset->rdclass != question_class) {
 				continue;
+			}
 
 			CHECK(dns_rdataset_first(soa_rdataset));
 			dns_rdataset_current(soa_rdataset, &soa_rdata);
 			result = dns_rdataset_next(soa_rdataset);
-			if (result == ISC_R_SUCCESS)
+			if (result == ISC_R_SUCCESS) {
 				FAILC(DNS_R_FORMERR,
 				      "IXFR authority section "
 				      "has multiple SOAs");
+			}
 			have_soa = true;
 			goto got_soa;
 		}
 	}
  got_soa:
-	if (result != ISC_R_NOMORE)
+	if (result != ISC_R_NOMORE) {
 		CHECK(result);
+	}
 
 	xfrout_log1(client, question_name, question_class, ISC_LOG_DEBUG(6),
 		    "%s authority section OK", mnemonic);
@@ -928,8 +933,9 @@ ns_xfr_start(ns_client_t *client, dns_rdatatype_t reqtype) {
 	 * AXFR over UDP is not possible.
 	 */
 	if (reqtype == dns_rdatatype_axfr &&
-	    (client->attributes & NS_CLIENTATTR_TCP) == 0)
+	    (client->attributes & NS_CLIENTATTR_TCP) == 0) {
 		FAILC(DNS_R_FORMERR, "attempted AXFR over UDP");
+	}
 
 	/*
 	 * Look up the requesting server in the peer table.
@@ -940,8 +946,9 @@ ns_xfr_start(ns_client_t *client, dns_rdatatype_t reqtype) {
 	/*
 	 * Decide on the transfer format (one-answer or many-answers).
 	 */
-	if (peer != NULL)
+	if (peer != NULL) {
 		(void)dns_peer_gettransferformat(peer, &format);
+	}
 
 	/*
 	 * Get a dynamically allocated copy of the current SOA.
@@ -954,21 +961,27 @@ ns_xfr_start(ns_client_t *client, dns_rdatatype_t reqtype) {
 
 	current_serial = dns_soa_getserial(&current_soa_tuple->rdata);
 	if (reqtype == dns_rdatatype_ixfr) {
-		bool provide_ixfr;
-
 		/*
 		 * Outgoing IXFR may have been disabled for this peer
 		 * or globally.
 		 */
-		provide_ixfr = client->view->provideixfr;
-		if (peer != NULL)
-			(void) dns_peer_getprovideixfr(peer, &provide_ixfr);
-		if (provide_ixfr == false)
-			goto axfr_fallback;
+		if ((client->attributes & NS_CLIENTATTR_TCP) != 0) {
+			bool provide_ixfr;
 
-		if (! have_soa)
+			provide_ixfr = client->view->provideixfr;
+			if (peer != NULL) {
+				(void) dns_peer_getprovideixfr(peer,
+							       &provide_ixfr);
+			}
+			if (provide_ixfr == false) {
+				goto axfr_fallback;
+			}
+		}
+
+		if (! have_soa) {
 			FAILC(DNS_R_FORMERR,
 			      "IXFR request missing SOA");
+		}
 
 		begin_serial = dns_soa_getserial(&soa_rdata);
 
@@ -991,16 +1004,16 @@ ns_xfr_start(ns_client_t *client, dns_rdatatype_t reqtype) {
 			goto have_stream;
 		}
 		journalfile = is_dlz ? NULL : dns_zone_getjournal(zone);
-		if (journalfile != NULL)
+		if (journalfile != NULL) {
 			result = ixfr_rrstream_create(mctx,
 						      journalfile,
 						      begin_serial,
 						      current_serial,
 						      &data_stream);
-		else
+		} else {
 			result = ISC_R_NOTFOUND;
-		if (result == ISC_R_NOTFOUND ||
-		    result == ISC_R_RANGE) {
+		}
+		if (result == ISC_R_NOTFOUND || result == ISC_R_RANGE) {
 			xfrout_log1(client, question_name, question_class,
 				    ISC_LOG_DEBUG(4),
 				    "IXFR version not in journal, "
@@ -1033,7 +1046,7 @@ ns_xfr_start(ns_client_t *client, dns_rdatatype_t reqtype) {
 
 
 
-	if (is_dlz)
+	if (is_dlz) {
 		CHECK(xfrout_ctx_create(mctx, client, request->id,
 					question_name, reqtype, question_class,
 					zone, db, ver, quota, stream,
@@ -1045,7 +1058,7 @@ ns_xfr_start(ns_client_t *client, dns_rdatatype_t reqtype) {
 					(format == dns_many_answers) ?
 					true : false,
 					&xfr));
-	else
+	} else {
 		CHECK(xfrout_ctx_create(mctx, client, request->id,
 					question_name, reqtype, question_class,
 					zone, db, ver, quota, stream,
@@ -1057,6 +1070,7 @@ ns_xfr_start(ns_client_t *client, dns_rdatatype_t reqtype) {
 					(format == dns_many_answers) ?
 					true : false,
 					&xfr));
+	}
 
 	xfr->mnemonic = mnemonic;
 	stream = NULL;
@@ -1064,24 +1078,26 @@ ns_xfr_start(ns_client_t *client, dns_rdatatype_t reqtype) {
 
 	CHECK(xfr->stream->methods->first(xfr->stream));
 
-	if (xfr->tsigkey != NULL)
+	if (xfr->tsigkey != NULL) {
 		dns_name_format(&xfr->tsigkey->name, keyname, sizeof(keyname));
-	else
+	} else {
 		keyname[0] = '\0';
-	if (is_poll)
+	}
+	if (is_poll) {
 		xfrout_log1(client, question_name, question_class,
 			    ISC_LOG_DEBUG(1), "IXFR poll up to date%s%s",
 			    (xfr->tsigkey != NULL) ? ": TSIG " : "", keyname);
-	else if (is_ixfr)
+	} else if (is_ixfr) {
 		xfrout_log1(client, question_name, question_class,
 			    ISC_LOG_INFO, "%s started%s%s (serial %u -> %u)",
 			    mnemonic, (xfr->tsigkey != NULL) ? ": TSIG " : "",
 			    keyname, begin_serial, current_serial);
-	else
+	} else {
 		xfrout_log1(client, question_name, question_class,
 			    ISC_LOG_INFO, "%s started%s%s (serial %u)",
 			    mnemonic, (xfr->tsigkey != NULL) ? ": TSIG " : "",
 			    keyname, current_serial);
+	}
 
 
 	if (zone != NULL) {
@@ -1098,8 +1114,9 @@ ns_xfr_start(ns_client_t *client, dns_rdatatype_t reqtype) {
 				client->expire = secs - client->now;
 			}
 		}
-		if (raw != NULL)
+		if (raw != NULL) {
 			dns_zone_detach(&raw);
+		}
 	}
 
 	/*
@@ -1113,24 +1130,33 @@ ns_xfr_start(ns_client_t *client, dns_rdatatype_t reqtype) {
 	result = ISC_R_SUCCESS;
 
  failure:
-	if (result == DNS_R_REFUSED)
+	if (result == DNS_R_REFUSED) {
 		inc_stats(zone, dns_nsstatscounter_xfrrej);
-	if (quota != NULL)
+	}
+	if (quota != NULL) {
 		isc_quota_detach(&quota);
-	if (current_soa_tuple != NULL)
+	}
+	if (current_soa_tuple != NULL) {
 		dns_difftuple_free(&current_soa_tuple);
-	if (stream != NULL)
+	}
+	if (stream != NULL) {
 		stream->methods->destroy(&stream);
-	if (soa_stream != NULL)
+	}
+	if (soa_stream != NULL) {
 		soa_stream->methods->destroy(&soa_stream);
-	if (data_stream != NULL)
+	}
+	if (data_stream != NULL) {
 		data_stream->methods->destroy(&data_stream);
-	if (ver != NULL)
+	}
+	if (ver != NULL) {
 		dns_db_closeversion(db, &ver, false);
-	if (db != NULL)
+	}
+	if (db != NULL) {
 		dns_db_detach(&db);
-	if (zone != NULL)
+	}
+	if (zone != NULL) {
 		dns_zone_detach(&zone);
+	}
 	/* XXX kludge */
 	if (xfr != NULL) {
 		xfrout_fail(xfr, result, "setting up zone transfer");

bin/named/zoneconf.c

@@ -560,7 +560,8 @@ configure_staticstub(const cfg_obj_t *zconfig, dns_zone_t *zone,
 	RETERR(dns_db_create(mctx, dbtype, dns_zone_getorigin(zone),
 			     dns_dbtype_stub, dns_zone_getclass(zone),
 			     0, NULL, &db));
-	dns_zone_setdb(zone, db);
+
+	dns_rdataset_init(&rdataset);
 
 	dns_rdatalist_init(&rdatalist_ns);
 	rdatalist_ns.rdclass = dns_zone_getclass(zone);
@@ -582,23 +583,19 @@ configure_staticstub(const cfg_obj_t *zconfig, dns_zone_t *zone,
 	result = cfg_map_get(zconfig, "server-addresses", &obj);
 	if (result == ISC_R_SUCCESS) {
 		INSIST(obj != NULL);
-		result = configure_staticstub_serveraddrs(obj, zone,
-							  &rdatalist_ns,
-							  &rdatalist_a,
-							  &rdatalist_aaaa);
-		if (result != ISC_R_SUCCESS)
-			goto cleanup;
+		CHECK(configure_staticstub_serveraddrs(obj, zone,
+						       &rdatalist_ns,
+						       &rdatalist_a,
+						       &rdatalist_aaaa));
 	}
 
 	obj = NULL;
 	result = cfg_map_get(zconfig, "server-names", &obj);
 	if (result == ISC_R_SUCCESS) {
 		INSIST(obj != NULL);
-		result = configure_staticstub_servernames(obj, zone,
-							  &rdatalist_ns,
-							  zname);
-		if (result != ISC_R_SUCCESS)
-			goto cleanup;
+		CHECK(configure_staticstub_servernames(obj, zone,
+						       &rdatalist_ns,
+						       zname));
 	}
 
 	/*
@@ -619,34 +616,26 @@ configure_staticstub(const cfg_obj_t *zconfig, dns_zone_t *zone,
 	 * First open a new version for the add operation and get a pointer
 	 * to the apex node (all RRs are of the apex name).
 	 */
-	result = dns_db_newversion(db, &dbversion);
-	if (result != ISC_R_SUCCESS)
-		goto cleanup;
+	CHECK(dns_db_newversion(db, &dbversion));
+
 	dns_name_init(&apexname, NULL);
 	dns_name_clone(dns_zone_getorigin(zone), &apexname);
-	result = dns_db_findnode(db, &apexname, false, &apexnode);
-	if (result != ISC_R_SUCCESS)
-		goto cleanup;
+	CHECK(dns_db_findnode(db, &apexname, false, &apexnode));
 
 	/* Add NS RRset */
-	dns_rdataset_init(&rdataset);
 	RUNTIME_CHECK(dns_rdatalist_tordataset(&rdatalist_ns, &rdataset)
 		      == ISC_R_SUCCESS);
-	result = dns_db_addrdataset(db, apexnode, dbversion, 0, &rdataset,
-				    0, NULL);
+	CHECK(dns_db_addrdataset(db, apexnode, dbversion, 0, &rdataset,
+				 0, NULL));
 	dns_rdataset_disassociate(&rdataset);
-	if (result != ISC_R_SUCCESS)
-		goto cleanup;
 
 	/* Add glue A RRset, if any */
 	if (!ISC_LIST_EMPTY(rdatalist_a.rdata)) {
 		RUNTIME_CHECK(dns_rdatalist_tordataset(&rdatalist_a, &rdataset)
 			      == ISC_R_SUCCESS);
-		result = dns_db_addrdataset(db, apexnode, dbversion, 0,
-					    &rdataset, 0, NULL);
+		CHECK(dns_db_addrdataset(db, apexnode, dbversion, 0,
+					 &rdataset, 0, NULL));
 		dns_rdataset_disassociate(&rdataset);
-		if (result != ISC_R_SUCCESS)
-			goto cleanup;
 	}
 
 	/* Add glue AAAA RRset, if any */
@@ -654,22 +643,29 @@ configure_staticstub(const cfg_obj_t *zconfig, dns_zone_t *zone,
 		RUNTIME_CHECK(dns_rdatalist_tordataset(&rdatalist_aaaa,
 						       &rdataset)
 			      == ISC_R_SUCCESS);
-		result = dns_db_addrdataset(db, apexnode, dbversion, 0,
-					    &rdataset, 0, NULL);
+		CHECK(dns_db_addrdataset(db, apexnode, dbversion, 0,
+					 &rdataset, 0, NULL));
 		dns_rdataset_disassociate(&rdataset);
-		if (result != ISC_R_SUCCESS)
-			goto cleanup;
 	}
 
+	dns_db_closeversion(db, &dbversion, true);
+	dns_zone_setdb(zone, db);
+
 	result = ISC_R_SUCCESS;
 
   cleanup:
-	if (apexnode != NULL)
+	if (dns_rdataset_isassociated(&rdataset)) {
+		dns_rdataset_disassociate(&rdataset);
+	}
+	if (apexnode != NULL) {
 		dns_db_detachnode(db, &apexnode);
-	if (dbversion != NULL)
-		dns_db_closeversion(db, &dbversion, true);
-	if (db != NULL)
+	}
+	if (dbversion != NULL) {
+		dns_db_closeversion(db, &dbversion, false);
+	}
+	if (db != NULL) {
 		dns_db_detach(&db);
+	}
 	for (i = 0; rdatalists[i] != NULL; i++) {
 		while ((rdata = ISC_LIST_HEAD(rdatalists[i]->rdata)) != NULL) {
 			ISC_LIST_UNLINK(rdatalists[i]->rdata, rdata, link);

bin/nsupdate/Makefile.in

@@ -7,8 +7,6 @@
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.
 
-# $Id: Makefile.in,v 1.36 2009/12/05 23:31:40 each Exp $
-
 srcdir =	@srcdir@
 VPATH =		@srcdir@
 top_srcdir =	@top_srcdir@
@@ -29,7 +27,7 @@ CDEFINES =	-DVERSION=\"${VERSION}\" @CRYPTO@ @USE_GSSAPI@
 CWARNINGS =
 
 LWRESLIBS =	../../lib/lwres/liblwres.@A@
-DNSLIBS =	../../lib/dns/libdns.@A@ @DNS_CRYPTO_LIBS@
+DNSLIBS =	../../lib/dns/libdns.@A@ ${MAXMINDDB_LIBS} @DNS_CRYPTO_LIBS@
 BIND9LIBS =	../../lib/bind9/libbind9.@A@
 ISCLIBS =	../../lib/isc/libisc.@A@
 ISCNOSYMLIBS =	../../lib/isc/libisc-nosymtbl.@A@

bin/nsupdate/nsupdate.c

@@ -33,6 +33,7 @@
 #include <isc/log.h>
 #include <isc/mem.h>
 #include <isc/parseint.h>
+#include <isc/portset.h>
 #include <isc/print.h>
 #include <isc/random.h>
 #include <isc/region.h>
@@ -850,6 +851,34 @@ shutdown_program(isc_task_t *task, isc_event_t *event) {
 	maybeshutdown();
 }
 
+/*
+ * Try honoring the operating system's preferred ephemeral port range.
+ */
+static void
+set_source_ports(dns_dispatchmgr_t *manager) {
+	isc_portset_t *v4portset = NULL, *v6portset = NULL;
+	in_port_t udpport_low, udpport_high;
+	isc_result_t result;
+
+	result = isc_portset_create(gmctx, &v4portset);
+	check_result(result, "isc_portset_create (v4)");
+	result = isc_net_getudpportrange(AF_INET, &udpport_low, &udpport_high);
+	check_result(result, "isc_net_getudpportrange (v4)");
+	isc_portset_addrange(v4portset, udpport_low, udpport_high);
+
+	result = isc_portset_create(gmctx, &v6portset);
+	check_result(result, "isc_portset_create (v6)");
+	result = isc_net_getudpportrange(AF_INET6, &udpport_low, &udpport_high);
+	check_result(result, "isc_net_getudpportrange (v6)");
+	isc_portset_addrange(v6portset, udpport_low, udpport_high);
+
+	result = dns_dispatchmgr_setavailports(manager, v4portset, v6portset);
+	check_result(result, "dns_dispatchmgr_setavailports");
+
+	isc_portset_destroy(gmctx, &v4portset);
+	isc_portset_destroy(gmctx, &v6portset);
+}
+
 static void
 setup_system(void) {
 	isc_result_t result;
@@ -975,6 +1004,8 @@ setup_system(void) {
 	check_result(result, "dst_lib_init");
 	is_dst_up = true;
 
+	set_source_ports(dispatchmgr);
+
 	attrmask = DNS_DISPATCHATTR_UDP | DNS_DISPATCHATTR_TCP;
 	attrmask |= DNS_DISPATCHATTR_IPV4 | DNS_DISPATCHATTR_IPV6;
 

bin/nsupdate/win32/nsupdate.vcxproj.in

@@ -1,5 +1,5 @@
 <?xml version="1.0" encoding="utf-8"?>
-<Project DefaultTargets="Build" ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+<Project DefaultTargets="Build" ToolsVersion="@TOOLS_VERSION@" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
   <ItemGroup Label="ProjectConfigurations">
     <ProjectConfiguration Include="Debug|@PLATFORM@">
       <Configuration>Debug</Configuration>
@@ -14,18 +14,21 @@
     <ProjectGuid>{C41266C7-E27E-4D60-9815-82D3B32BF82F}</ProjectGuid>
     <Keyword>Win32Proj</Keyword>
     <RootNamespace>nsupdate</RootNamespace>
+    @WINDOWS_TARGET_PLATFORM_VERSION@
   </PropertyGroup>
   <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|@PLATFORM@'" Label="Configuration">
     <ConfigurationType>Application</ConfigurationType>
     <UseDebugLibraries>true</UseDebugLibraries>
     <CharacterSet>MultiByte</CharacterSet>
+    @PLATFORM_TOOLSET@
   </PropertyGroup>
   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'" Label="Configuration">
     <ConfigurationType>Application</ConfigurationType>
     <UseDebugLibraries>false</UseDebugLibraries>
     <WholeProgramOptimization>true</WholeProgramOptimization>
     <CharacterSet>MultiByte</CharacterSet>
+    @PLATFORM_TOOLSET@
   </PropertyGroup>
   <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
   <ImportGroup Label="ExtensionSettings">

bin/pkcs11/pkcs11-keygen.c

@@ -373,10 +373,12 @@ main(int argc, char *argv[]) {
 	switch (keyclass) {
 	case key_rsa:
 		op_type = OP_RSA;
-		if (expsize == 0)
+		if (expsize == 0) {
 			expsize = 3;
-		if (bits == 0)
+		}
+		if (bits == 0) {
 			usage();
+		}
 
 		mech.mechanism = CKM_RSA_PKCS_KEY_PAIR_GEN;
 		mech.pParameter = NULL;
@@ -389,9 +391,9 @@ main(int argc, char *argv[]) {
 		/* Set public exponent to F4 or F5 */
 		exponent[0] = 0x01;
 		exponent[1] = 0x00;
-		if (expsize == 3)
+		if (expsize == 3) {
 			exponent[2] = 0x01;
-		else {
+		} else {
 			exponent[2] = 0x00;
 			exponent[3] = 0x00;
 			exponent[4] = 0x01;
@@ -403,10 +405,15 @@ main(int argc, char *argv[]) {
 		public_template[RSA_PUBLIC_EXPONENT].ulValueLen = expsize;
 		break;
 	case key_ecc:
+#if !defined(HAVE_PKCS11_ECDSA)
+		fprintf(stderr,
+			"prime256v1 and secp3841r1 are not supported\n");
+		usage();
+#else
 		op_type = OP_EC;
-		if (bits == 0)
+		if (bits == 0) {
 			bits = 256;
-		else if (bits != 256 && bits != 384) {
+		} else if (bits != 256 && bits != 384) {
 			fprintf(stderr, "ECC keys only support bit sizes of "
 					"256 and 384\n");
 			exit(2);
@@ -429,7 +436,7 @@ main(int argc, char *argv[]) {
 			public_template[4].ulValueLen =
 				sizeof(pk11_ecc_secp384r1);
 		}
-
+#endif
 		break;
 	case key_ecx:
 #if !defined(CKM_EDDSA_KEY_PAIR_GEN)
@@ -437,9 +444,9 @@ main(int argc, char *argv[]) {
 		usage();
 #else
 		op_type = OP_EC;
-		if (bits == 0)
+		if (bits == 0) {
 			bits = 256;
-		else if (bits != 256 && bits != 456) {
+		} else if (bits != 256 && bits != 456) {
 			fprintf(stderr, "ECX keys only support bit sizes of "
 					"256 and 456\n");
 			exit(2);
@@ -570,8 +577,9 @@ main(int argc, char *argv[]) {
 	pk11_result_register();
 
 	/* Initialize the CRYPTOKI library */
-	if (lib_name != NULL)
+	if (lib_name != NULL) {
 		pk11_set_lib_name(lib_name);
+	}
 
 	if (pin == NULL)
 		pin = getpassphrase("Enter Pin: ");
@@ -729,8 +737,9 @@ main(int argc, char *argv[]) {
 	if (rv != CKR_OK) {
 		fprintf(stderr, "C_GenerateKeyPair: Error = 0x%.8lX\n", rv);
 		error = 1;
-	 } else if (!quiet)
+	} else if (!quiet) {
 		printf("Key pair generation complete.\n");
+	}
 
  exit_params:
 	/* Free parameter attributes */

bin/pkcs11/win32/pk11destroy.vcxproj.in

@@ -1,5 +1,5 @@
 <?xml version="1.0" encoding="utf-8"?>
-<Project DefaultTargets="Build" ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+<Project DefaultTargets="Build" ToolsVersion="@TOOLS_VERSION@" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
   <ItemGroup Label="ProjectConfigurations">
     <ProjectConfiguration Include="Debug|@PLATFORM@">
       <Configuration>Debug</Configuration>
@@ -14,18 +14,21 @@
     <ProjectGuid>{5B3137E5-7E1F-49AA-8810-A09AA417D326}</ProjectGuid>
     <Keyword>Win32Proj</Keyword>
     <RootNamespace>pk11destroy</RootNamespace>
+    @WINDOWS_TARGET_PLATFORM_VERSION@
   </PropertyGroup>
   <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|@PLATFORM@'" Label="Configuration">
     <ConfigurationType>Application</ConfigurationType>
     <UseDebugLibraries>true</UseDebugLibraries>
     <CharacterSet>MultiByte</CharacterSet>
+    @PLATFORM_TOOLSET@
   </PropertyGroup>
   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'" Label="Configuration">
     <ConfigurationType>Application</ConfigurationType>
     <UseDebugLibraries>false</UseDebugLibraries>
     <WholeProgramOptimization>true</WholeProgramOptimization>
     <CharacterSet>MultiByte</CharacterSet>
+    @PLATFORM_TOOLSET@
   </PropertyGroup>
   <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
   <ImportGroup Label="ExtensionSettings">

bin/pkcs11/win32/pk11keygen.vcxproj.in

@@ -1,5 +1,5 @@
 <?xml version="1.0" encoding="utf-8"?>
-<Project DefaultTargets="Build" ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+<Project DefaultTargets="Build" ToolsVersion="@TOOLS_VERSION@" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
   <ItemGroup Label="ProjectConfigurations">
     <ProjectConfiguration Include="Debug|@PLATFORM@">
       <Configuration>Debug</Configuration>
@@ -14,18 +14,21 @@
     <ProjectGuid>{5042D371-0402-4FA3-A52A-769708694422}</ProjectGuid>
     <Keyword>Win32Proj</Keyword>
     <RootNamespace>pk11keygen</RootNamespace>
+    @WINDOWS_TARGET_PLATFORM_VERSION@
   </PropertyGroup>
   <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|@PLATFORM@'" Label="Configuration">
     <ConfigurationType>Application</ConfigurationType>
     <UseDebugLibraries>true</UseDebugLibraries>
     <CharacterSet>MultiByte</CharacterSet>
+    @PLATFORM_TOOLSET@
   </PropertyGroup>
   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'" Label="Configuration">
     <ConfigurationType>Application</ConfigurationType>
     <UseDebugLibraries>false</UseDebugLibraries>
     <WholeProgramOptimization>true</WholeProgramOptimization>
     <CharacterSet>MultiByte</CharacterSet>
+    @PLATFORM_TOOLSET@
   </PropertyGroup>
   <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
   <ImportGroup Label="ExtensionSettings">

bin/pkcs11/win32/pk11list.vcxproj.in

@@ -1,5 +1,5 @@
 <?xml version="1.0" encoding="utf-8"?>
-<Project DefaultTargets="Build" ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+<Project DefaultTargets="Build" ToolsVersion="@TOOLS_VERSION@" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
   <ItemGroup Label="ProjectConfigurations">
     <ProjectConfiguration Include="Debug|@PLATFORM@">
       <Configuration>Debug</Configuration>
@@ -14,18 +14,21 @@
     <ProjectGuid>{C663B088-F7BC-4C8C-8D06-A76636EED651}</ProjectGuid>
     <Keyword>Win32Proj</Keyword>
     <RootNamespace>pk11list</RootNamespace>
+    @WINDOWS_TARGET_PLATFORM_VERSION@
   </PropertyGroup>
   <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|@PLATFORM@'" Label="Configuration">
     <ConfigurationType>Application</ConfigurationType>
     <UseDebugLibraries>true</UseDebugLibraries>
     <CharacterSet>MultiByte</CharacterSet>
+    @PLATFORM_TOOLSET@
   </PropertyGroup>
   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'" Label="Configuration">
     <ConfigurationType>Application</ConfigurationType>
     <UseDebugLibraries>false</UseDebugLibraries>
     <WholeProgramOptimization>true</WholeProgramOptimization>
     <CharacterSet>MultiByte</CharacterSet>
+    @PLATFORM_TOOLSET@
   </PropertyGroup>
   <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
   <ImportGroup Label="ExtensionSettings">

bin/pkcs11/win32/pk11tokens.vcxproj.in

@@ -1,5 +1,5 @@
 <?xml version="1.0" encoding="utf-8"?>
-<Project DefaultTargets="Build" ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+<Project DefaultTargets="Build" ToolsVersion="@TOOLS_VERSION@" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
   <ItemGroup Label="ProjectConfigurations">
     <ProjectConfiguration Include="Debug|@PLATFORM@">
       <Configuration>Debug</Configuration>
@@ -14,18 +14,21 @@
     <ProjectGuid>{403FD4B1-A4F9-4159-9013-5860E3A4417D}</ProjectGuid>
     <Keyword>Win32Proj</Keyword>
     <RootNamespace>pk11tokens</RootNamespace>
+    @WINDOWS_TARGET_PLATFORM_VERSION@
   </PropertyGroup>
   <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|@PLATFORM@'" Label="Configuration">
     <ConfigurationType>Application</ConfigurationType>
     <UseDebugLibraries>true</UseDebugLibraries>
     <CharacterSet>MultiByte</CharacterSet>
+    @PLATFORM_TOOLSET@
   </PropertyGroup>
   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'" Label="Configuration">
     <ConfigurationType>Application</ConfigurationType>
     <UseDebugLibraries>false</UseDebugLibraries>
     <WholeProgramOptimization>true</WholeProgramOptimization>
     <CharacterSet>MultiByte</CharacterSet>
+    @PLATFORM_TOOLSET@
   </PropertyGroup>
   <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
   <ImportGroup Label="ExtensionSettings">

bin/python/isc/checkds.py.in

@@ -37,7 +37,11 @@ class SECRR:
         if not rrtext:
             raise Exception
 
-        fields = rrtext.decode('ascii').split()
+        # 'str' does not have decode method in python3
+        if type(rrtext) is not str:
+            fields = rrtext.decode('ascii').split()
+        else:
+            fields = rrtext.split()
         if len(fields) < 7:
             raise Exception
 
@@ -99,6 +103,8 @@ def check(zone, args, masterfile=None, lookaside=None):
     fp, _ = Popen(cmd, stdout=PIPE).communicate()
 
     for line in fp.splitlines():
+        if type(line) is not str:
+            line = line.decode('ascii')
         rrlist.append(SECRR(line, lookaside))
     rrlist = sorted(rrlist, key=lambda rr: (rr.keyid, rr.keyalg, rr.hashalg))
 
@@ -120,6 +126,8 @@ def check(zone, args, masterfile=None, lookaside=None):
         fp, _ = Popen(cmd, stdin=PIPE, stdout=PIPE).communicate(intods)
 
     for line in fp.splitlines():
+        if type(line) is not str:
+            line = line.decode('ascii')
         klist.append(SECRR(line, lookaside))
 
     if len(klist) < 1:

bin/python/isc/keyzone.py.in

@@ -43,6 +43,8 @@ class keyzone:
         fp, _ = Popen([czpath, "-o", "-", name, filename],
                       stdout=PIPE, stderr=PIPE).communicate()
         for line in fp.splitlines():
+            if type(line) is not str:
+                line = line.decode('ascii')
             if re.search('^[:space:]*;', line):
                 continue
             fields = line.split()

bin/rndc/Makefile.in

@@ -7,8 +7,6 @@
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.
 
-# $Id: Makefile.in,v 1.49 2009/12/05 23:31:40 each Exp $
-
 srcdir =	@srcdir@
 VPATH =		@srcdir@
 top_srcdir =	@top_srcdir@
@@ -27,7 +25,7 @@ ISCCFGLIBS =	../../lib/isccfg/libisccfg.@A@
 ISCCCLIBS =	../../lib/isccc/libisccc.@A@
 ISCLIBS =	../../lib/isc/libisc.@A@
 ISCNOSYMLIBS =	../../lib/isc/libisc-nosymtbl.@A@
-DNSLIBS =	../../lib/dns/libdns.@A@ @DNS_CRYPTO_LIBS@
+DNSLIBS =	../../lib/dns/libdns.@A@ ${MAXMINDDB_LIBS} @DNS_CRYPTO_LIBS@
 BIND9LIBS =	../../lib/bind9/libbind9.@A@
 
 ISCCFGDEPLIBS =	../../lib/isccfg/libisccfg.@A@

bin/rndc/rndc.8

@@ -584,7 +584,7 @@ Delete a given TKEY\-negotiated key from the server\&. (This does not apply to s
 .RS 4
 List the names of all TSIG keys currently configured for use by
 \fBnamed\fR
-in each view\&. The list both statically configured keys and dynamic TKEY\-negotiated keys\&.
+in each view\&. The list includes both statically configured keys and dynamic TKEY\-negotiated keys\&.
 .RE
 .PP
 \fBvalidation ( on | off | status ) \fR\fB[\fIview \&.\&.\&.\fR]\fR\fB \fR

bin/rndc/rndc.docbook

@@ -936,7 +936,7 @@
 	  <para>
 	    List the names of all TSIG keys currently configured
 	    for use by <command>named</command> in each view.  The
-	    list both statically configured keys and dynamic
+	    list includes both statically configured keys and dynamic
 	    TKEY-negotiated keys.
 	  </para>
 	</listitem>

bin/rndc/rndc.html

@@ -787,7 +787,7 @@
 	  <p>
 	    List the names of all TSIG keys currently configured
 	    for use by <span class="command"><strong>named</strong></span> in each view.  The
-	    list both statically configured keys and dynamic
+	    list includes both statically configured keys and dynamic
 	    TKEY-negotiated keys.
 	  </p>
 	</dd>

bin/rndc/win32/rndc.vcxproj.in

@@ -1,5 +1,5 @@
 <?xml version="1.0" encoding="utf-8"?>
-<Project DefaultTargets="Build" ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+<Project DefaultTargets="Build" ToolsVersion="@TOOLS_VERSION@" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
   <ItemGroup Label="ProjectConfigurations">
     <ProjectConfiguration Include="Debug|@PLATFORM@">
       <Configuration>Debug</Configuration>
@@ -14,18 +14,21 @@
     <ProjectGuid>{39721F26-8B80-4AA9-9826-2AEF7322C3D5}</ProjectGuid>
     <Keyword>Win32Proj</Keyword>
     <RootNamespace>rndc</RootNamespace>
+    @WINDOWS_TARGET_PLATFORM_VERSION@
   </PropertyGroup>
   <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|@PLATFORM@'" Label="Configuration">
     <ConfigurationType>Application</ConfigurationType>
     <UseDebugLibraries>true</UseDebugLibraries>
     <CharacterSet>MultiByte</CharacterSet>
+    @PLATFORM_TOOLSET@
   </PropertyGroup>
   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'" Label="Configuration">
     <ConfigurationType>Application</ConfigurationType>
     <UseDebugLibraries>false</UseDebugLibraries>
     <WholeProgramOptimization>true</WholeProgramOptimization>
     <CharacterSet>MultiByte</CharacterSet>
+    @PLATFORM_TOOLSET@
   </PropertyGroup>
   <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
   <ImportGroup Label="ExtensionSettings">

bin/rndc/win32/rndcutil.vcxproj.in

@@ -1,5 +1,5 @@
 <?xml version="1.0" encoding="utf-8"?>
-<Project DefaultTargets="Build" ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+<Project DefaultTargets="Build" ToolsVersion="@TOOLS_VERSION@" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
   <ItemGroup Label="ProjectConfigurations">
     <ProjectConfiguration Include="Debug|@PLATFORM@">
       <Configuration>Debug</Configuration>
@@ -14,18 +14,21 @@
     <ProjectGuid>{7C8681A1-E3A8-470E-9EEF-16054D111A19}</ProjectGuid>
     <Keyword>Win32Proj</Keyword>
     <RootNamespace>rndcutil</RootNamespace>
+    @WINDOWS_TARGET_PLATFORM_VERSION@
   </PropertyGroup>
   <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|@PLATFORM@'" Label="Configuration">
     <ConfigurationType>StaticLibrary</ConfigurationType>
     <UseDebugLibraries>true</UseDebugLibraries>
     <CharacterSet>MultiByte</CharacterSet>
+    @PLATFORM_TOOLSET@
   </PropertyGroup>
   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'" Label="Configuration">
     <ConfigurationType>StaticLibrary</ConfigurationType>
     <UseDebugLibraries>false</UseDebugLibraries>
     <WholeProgramOptimization>true</WholeProgramOptimization>
     <CharacterSet>MultiByte</CharacterSet>
+    @PLATFORM_TOOLSET@
   </PropertyGroup>
   <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
   <ImportGroup Label="ExtensionSettings">

bin/tests/Makefile.in

@@ -20,7 +20,7 @@ CDEFINES =	@CRYPTO@
 CWARNINGS =
 BACKTRACECFLAGS = @BACKTRACECFLAGS@
 
-DNSLIBS =	../../lib/dns/libdns.@A@ @DNS_CRYPTO_LIBS@
+DNSLIBS =	../../lib/dns/libdns.@A@ ${MAXMINDDB_LIBS} @DNS_CRYPTO_LIBS@
 ISCLIBS =	../../lib/isc/libisc.@A@ @ISC_OPENSSL_LIBS@
 ISCNOSYMLIBS =	../../lib/isc/libisc-nosymtbl.@A@ @ISC_OPENSSL_LIBS@
 ISCCFGLIBS = 	../../lib/isccfg/libisccfg.@A@

bin/tests/optional/Makefile.in

@@ -21,7 +21,7 @@ CDEFINES =	@CRYPTO@ @USE_GSSAPI@
 CWARNINGS =
 BACKTRACECFLAGS = @BACKTRACECFLAGS@
 
-DNSLIBS =	../../../lib/dns/libdns.@A@ @DNS_CRYPTO_LIBS@
+DNSLIBS =	../../../lib/dns/libdns.@A@ ${MAXMINDDB_LIBS} @DNS_CRYPTO_LIBS@
 ISCLIBS =	../../../lib/isc/libisc.@A@ @ISC_OPENSSL_LIBS@
 ISCNOSYMLIBS =	../../../lib/isc/libisc-nosymtbl.@A@ @ISC_OPENSSL_LIBS@
 ISCCFGLIBS = 	../../../lib/isccfg/libisccfg.@A@

bin/tests/optional/nsecify.c

@@ -28,6 +28,9 @@
 
 static isc_mem_t *mctx = NULL;
 
+ISC_PLATFORM_NORETURN_PRE static inline void
+fatal(const char *message) ISC_PLATFORM_NORETURN_POST;
+
 static inline void
 fatal(const char *message) {
 	fprintf(stderr, "%s\n", message);

bin/tests/pkcs11/benchmarks/create.c

@@ -78,10 +78,10 @@ clock_gettime(int32_t id, struct timespec *tp)
 	UNUSED(id);
 
 	result = gettimeofday(&tv, NULL);
-	if (result)
-		return (result);
-	tp->tv_sec = tv.tv_sec;
-	tp->tv_nsec = (long) tv.tv_usec * 1000;
+	if (result == 0) {
+		tp->tv_sec = tv.tv_sec;
+		tp->tv_nsec = (long) tv.tv_usec * 1000;
+	}
 	return (result);
 }
 #endif

bin/tests/pkcs11/benchmarks/find.c

@@ -78,10 +78,10 @@ clock_gettime(int32_t id, struct timespec *tp)
 	UNUSED(id);
 
 	result = gettimeofday(&tv, NULL);
-	if (result)
-		return (result);
-	tp->tv_sec = tv.tv_sec;
-	tp->tv_nsec = (long) tv.tv_usec * 1000;
+	if (result == 0) {
+		tp->tv_sec = tv.tv_sec;
+		tp->tv_nsec = (long) tv.tv_usec * 1000;
+	}
 	return (result);
 }
 #endif

bin/tests/pkcs11/benchmarks/genrsa.c

@@ -78,10 +78,10 @@ clock_gettime(int32_t id, struct timespec *tp)
 	UNUSED(id);
 
 	result = gettimeofday(&tv, NULL);
-	if (result)
-		return (result);
-	tp->tv_sec = tv.tv_sec;
-	tp->tv_nsec = (long) tv.tv_usec * 1000;
+	if (result == 0) {
+		tp->tv_sec = tv.tv_sec;
+		tp->tv_nsec = (long) tv.tv_usec * 1000;
+	}
 	return (result);
 }
 #endif

bin/tests/pkcs11/benchmarks/login.c

@@ -78,10 +78,10 @@ clock_gettime(int32_t id, struct timespec *tp)
 	UNUSED(id);
 
 	result = gettimeofday(&tv, NULL);
-	if (result)
-		return (result);
-	tp->tv_sec = tv.tv_sec;
-	tp->tv_nsec = (long) tv.tv_usec * 1000;
+	if (result == 0) {
+		tp->tv_sec = tv.tv_sec;
+		tp->tv_nsec = (long) tv.tv_usec * 1000;
+	}
 	return (result);
 }
 #endif

bin/tests/pkcs11/benchmarks/privrsa.c

@@ -78,10 +78,10 @@ clock_gettime(int32_t id, struct timespec *tp)
 	UNUSED(id);
 
 	result = gettimeofday(&tv, NULL);
-	if (result)
-		return (result);
-	tp->tv_sec = tv.tv_sec;
-	tp->tv_nsec = (long) tv.tv_usec * 1000;
+	if (result == 0) {
+		tp->tv_sec = tv.tv_sec;
+		tp->tv_nsec = (long) tv.tv_usec * 1000;
+	}
 	return (result);
 }
 #endif