Bump the maximum TCP timeout to 65535 [RT #44710 ]

2017-10-25 14:15:04 +04:00
282 changed files with 5265 additions and 7410 deletions
@@ -1,208 +1,3 @@
-	--- 9.12.0 released ---
-
-	--- 9.12.0rc3 released ---
-
-4863.	[bug]		Fix various other bugs reported by Valgrind's
-			memcheck tool. [RT #46978]
-
-4862.	[bug]		The rdata flags for RRSIG were not being properly set
-			when constructing a rdataslab. [RT #46978]
-
-	--- 9.12.0rc2 released ---
-
-4859.	[bug]		A loop was possible when attempting to validate
-			unsigned CNAME responses from secure zones;
-			this caused a delay in returning SERVFAIL and
-			also increased the chances of encountering
-			CVE-2017-3145. [RT #46839]
-
-4858.	[security]	Addresses could be referenced after being freed
-			in resolver.c, causing an assertion failure.
-			(CVE-2017-3145) [RT #46839]
-
-4850.	[bug]		Named failed to restart with multiple added zones in
-			lmdb database. [RT #46889]
-
-4849.	[bug]		Duplicate zones could appear in the .nzf file if
-			addzone failed. [RT #46435]
-
-	--- 9.12.0rc1 released ---
-
-4841.	[bug]		Address -fsanitize=undefined warnings. [RT #46786]
-
-4840.	[test]		Add tests to cover fallback to using ZSK on inactive
-			KSK. [RT #46787]
-
-4839.	[bug]		zone.c:zone_sign was not properly determining
-			if there were active KSK and ZSK keys for
-			a algorithm when update-check-ksk is true
-			(default) leaving records unsigned with one or
-			more DNSKEY algorithms. [RT #46774]
-
-4838.	[bug]		zone.c:add_sigs was not properly determining
-			if there were active KSK and ZSK keys for
-			a algorithm when update-check-ksk is true
-			(default) leaving records unsigned with one or
-			more DNSKEY algorithms. [RT #46754]
-
-4837.	[bug]		dns_update_signatures{inc} (add_sigs) was not
-			properly determining if there were active KSK and
-			ZSK keys for a algorithm when update-check-ksk is
-			true (default) leaving records unsigned when there
-			were multiple DNSKEY algorithms for the zone.
-			[RT #46743]
-
-4836.	[bug]		Zones created using "rndc addzone" could
-			temporarily fail to inherit an "allow-transfer"
-			ACL that had been configured in the options
-			statement. [RT #46603]
-
-4835.	[cleanup]	Clean up and refactor LMDB-related code. [RT #46718]
-
-4834.	[port]		Fix LMDB support on OpenBSD. [RT #46718]
-
-4833.	[bug]		isc_event_free should check that the event is not
-			linked when called. [RT #46725]
-
-4832.	[bug]		Events were not being removed from zone->rss_events.
-			[RT #46725]
-
-4831.	[bug]		Convert the RRSIG expirytime to 64 bits for
-			comparisions in diff.c:resign. [RT #46710]
-
-4830.	[bug]		Failure to configure ATF when requested did not cause
-			an error in top-level configure script. [RT #46655]
-
-4829.	[bug]		isc_heap_delete did not zero the index value when
-			the heap was created with a callback to do that.
-			[RT #46709]
-
-4828.	[bug]		Do not use thread-local storage for storing LMDB reader
-			locktable slots. [RT #46556]
-
-4827.	[misc]		Add a precommit check script util/checklibs.sh
-			[RT #46215]
-
-4826.	[cleanup]	Prevent potential build failures in bin/confgen/ and
-			bin/named/ when using parallel make. [RT #46648]
-
-4825.	[bug]		Prevent a bogus "error during managed-keys processing
-			(no more)" warning from being logged. [RT #46645]
-
-4824.	[port]		Add iOS hooks to dig. [RT #42011]
-
-4823.	[test]		Refactor reclimit system test to improve its
-			reliability and speed. [RT #46632]
-
-4822.	[bug]		Use resign_sooner in dns_db_setsigningtime. [RT #46473]
-
-4821.	[bug]		When resigning ensure that the SOA's expire time is
-			always later that the resigning time of other records.
-			[RT #46473]
-
-4820.	[bug]		dns_db_subtractrdataset should transfer the resigning
-			information to the new header. [RT #46473]
-
-4819.	[bug]		Fully backout the transaction when adding a RRset
-			to the resigning / removal heaps fails. [RT #46473]
-
-4818.	[test]		The logfileconfig system test could intermittently
-			report false negatives on some platforms. [RT #46615]
-
-4817.	[cleanup]	Use DNS_NAME_INITABSOLUTE and DNS_NAME_INITNONABSOLUTE.
-			[RT #45433]
-
-4816.	[bug]		Don't use a common array for storing EDNS options
-			in DiG as it could fill up. [RT #45611]
-
-4815.	[bug]		rbt_test.c:insert_and_delete needed to call
-			dns_rbt_addnode instead of dns_rbt_addname. [RT #46553]
-
-4814.	[cleanup]	Use AS_HELP_STRING for consistent help text. [RT #46521]
-
-4813.	[bug]		Address potential read after free errors from
-			query_synthnodata, query_synthwildcard and
-			query_synthnxdomain. [RT #46547]
-
-4812.	[bug]		Minor improvements to stability and consistency of code
-			handling managed keys. [RT #46468]
-
-4811.	[bug]		Revert api changes to use <isc/buffer.h> inline
-			macros.  Provide a alternative mechanism to turn
-			on the use of inline macros when building BIND.
-			[RT #46520]
-
-4810.	[test]		The chain system test failed if the IPv6 interfaces
-			were not configured. [RT #46508]
-
-	--- 9.12.0b2 released ---
-
-4809.	[port]		Check at configure time whether -latomic is needed
-			for stdatomic.h. [RT #46324]
-
-4808.	[bug]		Properly test for zlib.h. [RT #46504]
-
-4807.	[cleanup]	isc_rng_randombytes() returns a specified number of
-			bytes from the PRNG; this is now used instead of
-			calling isc_rng_random() multiple times. [RT #46230]
-
-4806.	[func]		Log messages related to loading of zones are now
-			directed to the "zoneload" logging category.
-			[RT #41640]
-
-4805.	[bug]		TCP4Active and TCP6Active weren't being updated
-			correctly. [RT #46454]
-
-4804.	[port]		win32: access() does not work on directories as
-			required by POSIX.  Supply a alternative in
-			isc_file_isdirwritable. [RT #46394]
-
-4803.	[placeholder]
-
-4802.	[test]		Refactor mkeys system test to make it quicker and more
-			reliable. [RT #45293]
-
-4801.	[func]		'dnssec-lookaside auto;' and 'dnssec-lookaside .
-			trust-anchor dlv.isc.org;' now elicit warnings rather
-			than being fatal configuration errors. [RT #46410]
-
-4800.	[bug]		When processing delzone, write one zone config per
-			line to the NZF. [RT #46323]
-
-4799.	[cleanup]	Improve clarity of keytable unit tests. [RT #46407]
-
-4798.	[func]		Keys specified in "managed-keys" statements
-			are tagged as "initializing" until they have been
-			updated by a key refresh query. If initialization
-			fails it will be visible from "rndc secroots".
-			[RT #46267]
-
-4797.	[func]		Removed "isc-hmac-fixup", as the versions of BIND that
-			had the bug it worked around are long past end of
-			life. [RT #46411]
-
-4796.	[bug]		Increase the maximum configurable TCP keepalive
-			timeout to 65535. [RT #44710]
-
-4795.	[func]		A new statistics counter has been added to track
-			priming queries. [RT #46313]
-
-4794.	[func]		"dnssec-checkds -s" specifies a file from which
-			to read a DS set rather than querying the parent.
-			[RT #44667]
-
-4793.	[bug]		nsupdate -[46] could overflow the array of server
-			addresses. [RT #46402]
-
-4792.	[bug]		Fix map file header correctness check. [RT #38418]
-
-4791.	[doc]		Fixed outdated documentation about export libraries.
-			[RT #46341]
-
-4790.	[bug]		nsupdate could trigger a require when sending a
-			update to the second address of the server.
-			[RT #45731]
-
 4789.	[cleanup]	Check writability of new-zones-directory. [RT #46308]

 4788.	[cleanup]	When using "update-policy local", log a warning
@@ -218,8 +13,10 @@
 			[RT #46340]

 4785.	[func]		The hmac-md5 algorithm is no longer recommended for
-			use with RNDC keys.  The default in rndc-confgen
-			is now hmac-sha256. [RT #42272]
+			use with RNDC keys. For compatibility reasons, it
+			it is still the default algorithm in rndc-confgen,
+			but this will be changed to hmac-sha256 in a future
+			release. [RT #42272]

 4784.	[func]		The use of dnssec-keygen to generate HMAC keys is
 			deprecated in favor of tsig-keygen.  dnssec-keygen
@@ -368,7 +165,7 @@
 			- Removed DLV key from bind.keys
 			- No longer use ISC DLV by default in delv
 			- "dnssec-lookaside auto" and configuration of
-			  "dnssec-lookaide" with dlv.isc.org as the trust
+			  "dnssec-lookaide" with dlv.isc.org as trust
 			  anchor are both now fatal errors.
 			[RT #46155]

@@ -508,8 +305,8 @@
 4713.	[func]		Added support for the DNS Response Policy Service
 			(DNSRPS) API, which allows named to use an external
 			response policy daemon when built with
-			"configure --enable-dnsrps". Thanks to Farsight
-			Security. [RT #43376]
+			"configure --enable-dnsrps".  Thanks to Vernon
+			Schryver and Farsight Security. [RT #43376]

 4712.	[bug]		"dig +domain" and "dig +search" didn't retain the
 			search domain when retrying with TCP. [RT #45547]
@@ -1,4 +1,4 @@
-Copyright (C) 1996-2018  Internet Systems Consortium, Inc. ("ISC")
+Copyright (C) 1996-2017  Internet Systems Consortium, Inc. ("ISC")

 This Source Code Form is subject to the terms of the Mozilla Public
 License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -1,4 +0,0 @@
-syntax(2)
-test_suite('bind9')
-
-include('lib/Kyuafile')
@@ -22,9 +22,4 @@ Setting                   Description
                          Increase the maximum number of configurable
 -DNS_RPZ_MAX_ZONES=64     response policy zones from 32 to 64; this is the
                          highest possible setting
-                          Disable the use of inline functions to implement
-DISC_BUFFER_USEINLINE=0  the isc_buffer API: this reduces performance but
-                          may be useful when debugging
-DISC_HEAP_CHECK          Test heap consistency after every heap
-                          operation; used when debugging

@@ -21,5 +21,3 @@ Some of these settings are:
 |`-DCHECK_LOCAL=0`|Don't check out-of-zone addresses in `named-checkzone`|
 |`-DNS_RUN_PID_DIR=0`|Create default PID files in `${localstatedir}/run` rather than `${localstatedir}/run/named/`|
 |`-DNS_RPZ_MAX_ZONES=64`|Increase the maximum number of configurable response policy zones from 32 to 64; this is the highest possible setting|
-|`-DISC_BUFFER_USEINLINE=0`|Disable the use of inline functions to implement the `isc_buffer` API: this reduces performance but may be useful when debugging |
-|`-DISC_HEAP_CHECK`|Test heap consistency after every heap operation; used when debugging|
@@ -7,12 +7,11 @@ Contents
 3. Contributing to BIND
 4. BIND 9.12 features
 5. Building BIND
- 6. macOS
- 7. Compile-time options
- 8. Automated testing
- 9. Documentation
-10. Change log
-11. Acknowledgments
+ 6. Compile-time options
+ 7. Automated testing
+ 8. Documentation
+ 9. Change log
+10. Acknowledgments

 Introduction

@@ -118,11 +117,7 @@ include:
  * 'named-checkconf -l' lists zones found in named.conf.
  * Added support for the EDNS Padding and Keepalive options.
  * 'new-zones-directory' option sets the location where the configuration
-    data for zones added by rndc addzone is stored.
-  * The default key algorithm in rndc-confgen is now hmac-sha256.
-  * filter-aaaa-on-v4 and filter-aaaa-on-v6 options are now available by
-    default without a configure option.
-  * The obsolete isc-hmac-fixup command has been removed.
+    data for zones added by rndc addzone is stored

 Building BIND

@@ -132,8 +127,8 @@ on many versions of Linux and UNIX, including RedHat, Fedora, Debian,
 Ubuntu, SuSE, Slackware, FreeBSD, NetBSD, OpenBSD, Mac OS X, Solaris,
 HP-UX, AIX, SCO OpenServer, and OpenWRT.

-BIND is also available for Windows 2008 and higher. See win32utils/
-readme1st.txt for details on building for Windows systems.
+BIND is also available for Windows XP, 2003, 2008, and higher. See
+win32utils/readme1st.txt for details on building for Windows systems.

 To build on a UNIX or Linux system, use:

@@ -166,14 +161,6 @@ BUILD_CPPFLAGS
 BUILD_LDFLAGS
 BUILD_LIBS

-macOS
-
-Building on macOS assumes that the "Command Tools for Xcode" is installed.
-This can be downloaded from https://developer.apple.com/download/more/ or
-if you have Xcode already installed you can run "xcode-select --install".
-This will add /usr/include to the system and install the compiler and
-other tools so that they can be easily found.
-
 Compile-time options

 To see a full list of configuration options, run configure --help.
@@ -14,7 +14,6 @@
 1. [Contributing to BIND](#contrib)
 1. [BIND 9.12 features](#features)
 1. [Building BIND](#build)
-1. [macOS](#macos)
 1. [Compile-time options](#opts)
 1. [Automated testing](#testing)
 1. [Documentation](#doc)
@@ -130,11 +129,7 @@ include:
 * `'named-checkconf -l'` lists zones found in `named.conf`.
 * Added support for the EDNS Padding and Keepalive options.
 * 'new-zones-directory' option sets the location where the configuration
-  data for zones added by rndc addzone is stored.
-* The default key algorithm in `rndc-confgen` is now hmac-sha256.
-* `filter-aaaa-on-v4` and `filter-aaaa-on-v6` options are now available
-  by default without a configure option.
-* The obsolete `isc-hmac-fixup` command has been removed.
+  data for zones added by rndc addzone is stored

 ### <a name="build"/> Building BIND

@@ -144,9 +139,8 @@ many versions of Linux and UNIX, including RedHat, Fedora, Debian, Ubuntu,
 SuSE, Slackware, FreeBSD, NetBSD, OpenBSD, Mac OS X, Solaris, HP-UX, AIX,
 SCO OpenServer, and OpenWRT. 

-BIND is also available for Windows 2008 and higher.  See
-`win32utils/readme1st.txt` for details on building for Windows
-systems.
+BIND is also available for Windows XP, 2003, 2008, and higher.  See
+`win32utils/readme1st.txt` for details on building for Windows systems.

 To build on a UNIX or Linux system, use:

@@ -172,14 +166,6 @@ affect compilation:
 |`BUILD_LDFLAGS`||
 |`BUILD_LIBS`||

-#### <a name="macos"> macOS
-
-Building on macOS assumes that the "Command Tools for Xcode" is installed.
-This can be downloaded from https://developer.apple.com/download/more/
-or if you have Xcode already installed you can run "xcode-select --install".
-This will add /usr/include to the system and install the compiler and other
-tools so that they can be easily found.
-
 #### <a name="opts"/> Compile-time options

 To see a full list of configuration options, run `configure --help`.
@@ -8,10 +8,6 @@ srcdir =	@srcdir@
 VPATH =		@srcdir@
 top_srcdir =	@top_srcdir@

-# Attempt to disable parallel processing.
-.NOTPARALLEL:
-.NO_PARALLEL:
-
 VERSION=@BIND9_VERSION@

@BIND9_MAKE_INCLUDES@
@@ -68,11 +64,11 @@ rndc-confgen.@O@: rndc-confgen.c
 ddns-confgen.@O@: ddns-confgen.c
 	${LIBTOOL_MODE_COMPILE} ${CC} ${ALL_CFLAGS} -c ${srcdir}/ddns-confgen.c

-rndc-confgen@EXEEXT@: rndc-confgen.@O@ util.@O@ keygen.@O@ ${CONFDEPLIBS}
+rndc-confgen@EXEEXT@: rndc-confgen.@O@ util.@O@ keygen.@O@ ${UOBJS} ${CONFDEPLIBS}
 	export BASEOBJS="rndc-confgen.@O@ util.@O@ keygen.@O@ ${UOBJS}"; \
 	${FINALBUILDCMD}

-ddns-confgen@EXEEXT@: ddns-confgen.@O@ util.@O@ keygen.@O@ ${CONFDEPLIBS}
+ddns-confgen@EXEEXT@: ddns-confgen.@O@ util.@O@ keygen.@O@ ${UOBJS} ${CONFDEPLIBS}
 	export BASEOBJS="ddns-confgen.@O@ util.@O@ keygen.@O@ ${UOBJS}"; \
 	${FINALBUILDCMD}

@@ -111,7 +111,9 @@ as directed\&.
 .PP
 \-A \fIalgorithm\fR
 .RS 4
-Specifies the algorithm to use for the TSIG key\&. Available choices are: hmac\-md5, hmac\-sha1, hmac\-sha224, hmac\-sha256, hmac\-sha384 and hmac\-sha512\&. The default is hmac\-sha256\&.
+Specifies the algorithm to use for the TSIG key\&. Available choices are: hmac\-md5, hmac\-sha1, hmac\-sha224, hmac\-sha256, hmac\-sha384 and hmac\-sha512\&. The default is hmac\-md5, or if MD5 was disabled at compile time, hmac\-sha256\&.
+.sp
+Note: Use of hmac\-md5 is no longer recommended, and the default value will be changed to hmac\-sha256 in a future release\&.
 .RE
 .PP
 \-b \fIkeysize\fR
@@ -6,6 +6,8 @@
 * file, You can obtain one at http://mozilla.org/MPL/2.0/.
 */

+/* $Id: rndc-confgen.c,v 1.7 2011/03/12 04:59:46 tbox Exp $ */
+
 /*! \file */

 /**
@@ -65,6 +67,23 @@ usage(int status) ISC_PLATFORM_NORETURN_POST;
 static void
 usage(int status) {

+#ifndef PK11_MD5_DISABLE
+	fprintf(stderr, "\
+Usage:\n\
+ %s [-a] [-b bits] [-c keyfile] [-k keyname] [-p port] [-r randomfile] \
+[-s addr] [-t chrootdir] [-u user]\n\
+  -a:		 generate just the key clause and write it to keyfile (%s)\n\
+  -A alg:	 algorithm (default hmac-md5 (deprecated and will change))\n\
+  -b bits:	 from 1 through 512, default 256; total length of the secret\n\
+  -c keyfile:	 specify an alternate key file (requires -a)\n\
+  -k keyname:	 the name as it will be used  in named.conf and rndc.conf\n\
+  -p port:	 the port named will listen on and rndc will connect to\n\
+  -r randomfile: source of random data (use \"keyboard\" for key timing)\n\
+  -s addr:	 the address to which rndc should connect\n\
+  -t chrootdir:	 write a keyfile in chrootdir as well (requires -a)\n\
+  -u user:	 set the keyfile owner to \"user\" (requires -a)\n",
+		 progname, keydef);
+#else
 	fprintf(stderr, "\
 Usage:\n\
 %s [-a] [-b bits] [-c keyfile] [-k keyname] [-p port] [-r randomfile] \
@@ -80,6 +99,7 @@ Usage:\n\
  -t chrootdir:	 write a keyfile in chrootdir as well (requires -a)\n\
  -u user:	 set the keyfile owner to \"user\" (requires -a)\n",
 		 progname, keydef);
+#endif

 	exit (status);
 }
@@ -95,6 +115,7 @@ main(int argc, char **argv) {
 	const char *randomfile = NULL;
 	const char *serveraddr = NULL;
 	dns_secalg_t alg;
+	isc_boolean_t algset = ISC_FALSE;
 	const char *algname;
 	char *p;
 	int ch;
@@ -115,7 +136,11 @@ main(int argc, char **argv) {
 	progname = program;

 	keyname = DEFAULT_KEYNAME;
+#ifndef PK11_MD5_DISABLE
+	alg = DST_ALG_HMACMD5;
+#else
 	alg = DST_ALG_HMACSHA256;
+#endif
 	serveraddr = DEFAULT_SERVER;
 	port = DEFAULT_PORT;

@@ -129,6 +154,7 @@ main(int argc, char **argv) {
 			keyonly = ISC_TRUE;
 			break;
 		case 'A':
+			algset = ISC_TRUE;
 			algname = isc_commandline_argument;
 			alg = alg_fromtext(algname);
 			if (alg == DST_ALG_UNKNOWN)
@@ -202,9 +228,17 @@ main(int argc, char **argv) {
 		usage(1);

 	if (alg == DST_ALG_HMACMD5) {
-		fprintf(stderr,
-			"warning: use of hmac-md5 for RNDC keys "
-			"is deprecated; hmac-sha256 is now recommended.\n");
+		if (algset) {
+			fprintf(stderr,
+				"warning: use of hmac-md5 for RNDC keys "
+				"is deprecated; hmac-sha256 is now "
+				"recommended.\n");
+		} else {
+			fprintf(stderr,
+				"warning: the default algorithm hmac-md5 "
+				"is deprecated and will be\n"
+				"changed to hmac-sha256 in a future release\n");
+		}
 	}

 	if (keysize < 0)
@@ -129,7 +129,12 @@
          <para>
            Specifies the algorithm to use for the TSIG key.  Available
            choices are: hmac-md5, hmac-sha1, hmac-sha224, hmac-sha256,
-            hmac-sha384 and hmac-sha512.  The default is hmac-sha256.
+            hmac-sha384 and hmac-sha512.  The default is hmac-md5, or
+            if MD5 was disabled at compile time, hmac-sha256.
+          </para>
+          <para>
+            Note: Use of hmac-md5 is no longer recommended, and the default
+            value will be changed to hmac-sha256 in a future release.
          </para>
        </listitem>
      </varlistentry>
@@ -113,7 +113,12 @@
          <p>
            Specifies the algorithm to use for the TSIG key.  Available
            choices are: hmac-md5, hmac-sha1, hmac-sha224, hmac-sha256,
-            hmac-sha384 and hmac-sha512.  The default is hmac-sha256.
+            hmac-sha384 and hmac-sha512.  The default is hmac-md5, or
+            if MD5 was disabled at compile time, hmac-sha256.
+          </p>
+          <p>
+            Note: Use of hmac-md5 is no longer recommended, and the default
+            value will be changed to hmac-sha256 in a future release.
          </p>
        </dd>
 <dt><span class="term">-b <em class="replaceable"><code>keysize</code></em></span></dt>
@@ -469,11 +469,6 @@ Convert [do not convert] puny code on output\&. This requires IDN SUPPORT to hav
 Ignore truncation in UDP responses instead of retrying with TCP\&. By default, TCP retries are performed\&.
 .RE
 .PP
-\fB+[no]keepalive\fR
-.RS 4
-Send [or do not send] an EDNS Keepalive option\&.
-.RE
-.PP
 \fB+[no]keepopen\fR
 .RS 4
 Keep the TCP socket open between queries and reuse it rather than creating a new TCP socket for each lookup\&. The default is
@@ -109,11 +109,6 @@ print_usage(FILE *fp) {
 "            [ host [@local-server] {local-d-opt} [...]]\n", fp);
 }

-#if TARGET_OS_IPHONE
-static void usage(void) {
-	fprintf(stderr, "Press <Help> for complete list of options\n");
-}
-#else
 ISC_PLATFORM_NORETURN_PRE static void
 usage(void) ISC_PLATFORM_NORETURN_POST;

@@ -124,7 +119,6 @@ usage(void) {
 	      "for complete list of options\n", stderr);
 	exit(1);
 }
-#endif

 /*% version */
 static void
@@ -420,8 +414,14 @@ isdotlocal(dns_message_t *msg) {
 	isc_result_t result;
 	static unsigned char local_ndata[] = { "\005local\0" };
 	static unsigned char local_offsets[] = { 0, 6 };
-	static dns_name_t local =
-		DNS_NAME_INITABSOLUTE(local_ndata, local_offsets);
+	static dns_name_t local = {
+		DNS_NAME_MAGIC,
+		local_ndata, 7, 2,
+		DNS_NAMEATTR_READONLY | DNS_NAMEATTR_ABSOLUTE,
+		local_offsets, NULL,
+		{(void *)-1, (void *)-1},
+		{NULL, NULL}
+	};

 	for (result = dns_message_firstname(msg, DNS_SECTION_QUESTION);
 	     result == ISC_R_SUCCESS;
@@ -824,10 +824,8 @@ plus_option(const char *option, isc_boolean_t is_batchfile,
 				goto invalid_option;
 			result = parse_uint(&num, value, COMMSIZE,
 					    "buffer size");
-			if (result != ISC_R_SUCCESS) {
-				warn("Couldn't parse buffer size");
-				goto exit_or_usage;
-			}
+			if (result != ISC_R_SUCCESS)
+				fatal("Couldn't parse buffer size");
 			lookup->udpsize = num;
 			break;
 		default:
@@ -872,10 +870,8 @@ plus_option(const char *option, isc_boolean_t is_batchfile,
 				if (value != NULL) {
 					n = strlcpy(hexcookie, value,
 						    sizeof(hexcookie));
-					if (n >= sizeof(hexcookie)) {
-						warn("COOKIE data too large");
-						goto exit_or_usage;
-					}
+					if (n >= sizeof(hexcookie))
+						fatal("COOKIE data too large");
 					lookup->cookie = hexcookie;
 				} else
 					lookup->cookie = NULL;
@@ -926,10 +922,8 @@ plus_option(const char *option, isc_boolean_t is_batchfile,
 			if (value == NULL)
 				goto need_value;
 			result = parse_uint(&num, value, 0x3f, "DSCP");
-			if (result != ISC_R_SUCCESS) {
-				warn("Couldn't parse DSCP value");
-				goto exit_or_usage;
-			}
+			if (result != ISC_R_SUCCESS)
+				fatal("Couldn't parse DSCP value");
 			lookup->dscp = num;
 			break;
 		default:
@@ -958,11 +952,9 @@ plus_option(const char *option, isc_boolean_t is_batchfile,
 								    value,
 								    255,
 								    "edns");
-						if (result != ISC_R_SUCCESS) {
-							warn("Couldn't parse "
+						if (result != ISC_R_SUCCESS)
+							fatal("Couldn't parse "
 							      "edns");
-							goto exit_or_usage;
-						}
 						lookup->edns = num;
 						break;
 					case 'f':
@@ -979,11 +971,9 @@ plus_option(const char *option, isc_boolean_t is_batchfile,
 								    value,
 								    0xffff,
 								  "ednsflags");
-						if (result != ISC_R_SUCCESS) {
-							warn("Couldn't parse "
+						if (result != ISC_R_SUCCESS)
+							fatal("Couldn't parse "
 							      "ednsflags");
-							goto exit_or_usage;
-						}
 						lookup->ednsflags = num;
 						break;
 					case 'n':
@@ -996,12 +986,10 @@ plus_option(const char *option, isc_boolean_t is_batchfile,
 							lookup->ednsoptscnt = 0;
 							break;
 						}
-						if (value == NULL) {
-							warn("ednsopt no "
-							     "code point "
-							     "specified");
-							goto exit_or_usage;
-						}
+						if (value == NULL)
+							fatal("ednsopt no "
+							      "code point "
+							      "specified");
 						code = next_token(&value, ":");
 						save_opt(lookup, code, value);
 						break;
@@ -1116,10 +1104,8 @@ plus_option(const char *option, isc_boolean_t is_batchfile,
 			if (!state)
 				goto invalid_option;
 			result = parse_uint(&num, value, MAXNDOTS, "ndots");
-			if (result != ISC_R_SUCCESS) {
-				warn("Couldn't parse ndots");
-				goto exit_or_usage;
-			}
+			if (result != ISC_R_SUCCESS)
+				fatal("Couldn't parse ndots");
 			ndots = num;
 			break;
 		case 's':
@@ -1181,10 +1167,8 @@ plus_option(const char *option, isc_boolean_t is_batchfile,
 				break;
 			}
 			result = parse_uint(&num, value, 15, "opcode");
-			if (result != ISC_R_SUCCESS) {
-				warn("Couldn't parse opcode");
-				goto exit_or_usage;
-			}
+			if (result != ISC_R_SUCCESS)
+				fatal("Couldn't parse opcode");
 			lookup->opcode = (dns_opcode_t)num;
 			break;
 		default:
@@ -1198,10 +1182,8 @@ plus_option(const char *option, isc_boolean_t is_batchfile,
 		if (value == NULL)
 			goto need_value;
 		result = parse_uint(&num, value, 512, "padding");
-		if (result != ISC_R_SUCCESS) {
-			warn("Couldn't parse padding");
-			goto exit_or_usage;
-		}
+		if (result != ISC_R_SUCCESS)
+			fatal("Couldn't parse padding");
 		lookup->padding = (isc_uint16_t)num;
 		break;
 	case 'q':
@@ -1240,10 +1222,8 @@ plus_option(const char *option, isc_boolean_t is_batchfile,
 					goto invalid_option;
 				result = parse_uint(&lookup->retries, value,
 						    MAXTRIES - 1, "retries");
-				if (result != ISC_R_SUCCESS) {
-					warn("Couldn't parse retries");
-					goto exit_or_usage;
-				}
+				if (result != ISC_R_SUCCESS)
+					fatal("Couldn't parse retries");
 				lookup->retries++;
 				break;
 			default:
@@ -1326,10 +1306,8 @@ plus_option(const char *option, isc_boolean_t is_batchfile,
 			 */
 			if (splitwidth)
 				splitwidth += 3;
-			if (result != ISC_R_SUCCESS) {
-				warn("Couldn't parse split");
-				goto exit_or_usage;
-			}
+			if (result != ISC_R_SUCCESS)
+				fatal("Couldn't parse split");
 			break;
 		case 't': /* stats */
 			FULLCHECK("stats");
@@ -1353,10 +1331,8 @@ plus_option(const char *option, isc_boolean_t is_batchfile,
 				lookup->ecs_addr = NULL;
 			}
 			result = parse_netprefix(&lookup->ecs_addr, value);
-			if (result != ISC_R_SUCCESS) {
-				warn("Couldn't parse client");
-				goto exit_or_usage;
-			}
+			if (result != ISC_R_SUCCESS)
+				fatal("Couldn't parse client");
 			break;
 		default:
 			goto invalid_option;
@@ -1379,10 +1355,8 @@ plus_option(const char *option, isc_boolean_t is_batchfile,
 				goto invalid_option;
 			result = parse_uint(&timeout, value, MAXTIMEOUT,
 					    "timeout");
-			if (result != ISC_R_SUCCESS) {
-				warn("Couldn't parse timeout");
-				goto exit_or_usage;
-			}
+			if (result != ISC_R_SUCCESS)
+				fatal("Couldn't parse timeout");
 			if (timeout == 0)
 				timeout = 1;
 			break;
@@ -1418,10 +1392,8 @@ plus_option(const char *option, isc_boolean_t is_batchfile,
 					goto invalid_option;
 				result = parse_uint(&lookup->retries, value,
 						    MAXTRIES, "tries");
-				if (result != ISC_R_SUCCESS) {
-					warn("Couldn't parse tries");
-					goto exit_or_usage;
-				}
+				if (result != ISC_R_SUCCESS)
+					fatal("Couldn't parse tries");
 				if (lookup->retries == 0)
 					lookup->retries = 1;
 				break;
@@ -1478,19 +1450,11 @@ plus_option(const char *option, isc_boolean_t is_batchfile,
 	default:
 	invalid_option:
 	need_value:
-#if TARGET_OS_IPHONE
-	exit_or_usage:
-#endif
 		fprintf(stderr, "Invalid option: +%s\n",
 			option);
 		usage();
 	}
 	return;
-
-#if ! TARGET_OS_IPHONE
- exit_or_usage:
-	digexit();
-#endif
 }

 /*%
@@ -784,15 +784,6 @@
 	  </listitem>
 	</varlistentry>

-	<varlistentry>
-	  <term><option>+[no]keepalive</option></term>
-	  <listitem>
-	    <para>
-	      Send [or do not send] an EDNS Keepalive option.
-	    </para>
-	  </listitem>
-	</varlistentry>
-
 	<varlistentry>
 	  <term><option>+[no]keepopen</option></term>
 	  <listitem>
@@ -628,12 +628,6 @@
 	      with TCP.  By default, TCP retries are performed.
 	    </p>
 	  </dd>
-<dt><span class="term"><code class="option">+[no]keepalive</code></span></dt>
-<dd>
-	    <p>
-	      Send [or do not send] an EDNS Keepalive option.
-	    </p>
-	  </dd>
 <dt><span class="term"><code class="option">+[no]keepopen</code></span></dt>
 <dd>
 	    <p>
@@ -375,46 +375,6 @@ get_reverse(char *reverse, size_t len, char *value, isc_boolean_t ip6_int,
 	}
 }

-void (*dighost_pre_exit_hook)(void) = NULL;
-
-#if TARGET_OS_IPHONE
-void
-warn(const char *format, ...) {
-	va_list args;
-
-	fflush(stdout);
-	fprintf(stderr, ";; Warning: ");
-	va_start(args, format);
-	vfprintf(stderr, format, args);
-	va_end(args);
-	fprintf(stderr, "\n");
-}
-#else
-void
-warn(const char *format, ...) {
-	va_list args;
-
-	fflush(stdout);
-	fprintf(stderr, "%s: ", progname);
-	va_start(args, format);
-	vfprintf(stderr, format, args);
-	va_end(args);
-	fprintf(stderr, "\n");
-}
-#endif
-
-void
-digexit(void) {
-	if (exitcode < 10)
-		exitcode = 10;
-	if (fatalexit != 0)
-		exitcode = fatalexit;
-	if (dighost_pre_exit_hook != NULL) {
-		dighost_pre_exit_hook();
-	}
-	exit(exitcode);
-}
-
 void
 fatal(const char *format, ...) {
 	va_list args;
@@ -425,7 +385,11 @@ fatal(const char *format, ...) {
 	vfprintf(stderr, format, args);
 	va_end(args);
 	fprintf(stderr, "\n");
-	digexit();
+	if (exitcode < 10)
+		exitcode = 10;
+	if (fatalexit != 0)
+		exitcode = fatalexit;
+	exit(exitcode);
 }

 void
@@ -691,41 +655,6 @@ make_empty_lookup(void) {
 	return (looknew);
 }

-#define EDNSOPT_OPTIONS 100U
-
-static void
-cloneopts(dig_lookup_t *looknew, dig_lookup_t *lookold) {
-	size_t len = sizeof(looknew->ednsopts[0]) * EDNSOPT_OPTIONS;
-	size_t i;
-	looknew->ednsopts = isc_mem_allocate(mctx, len);
-	if (looknew->ednsopts == NULL)
-		fatal("out of memory");
-	for (i = 0; i < EDNSOPT_OPTIONS; i++) {
-		looknew->ednsopts[i].code = 0;
-		looknew->ednsopts[i].length = 0;
-		looknew->ednsopts[i].value = NULL;
-	}
-	looknew->ednsoptscnt = 0;
-	if (lookold == NULL || lookold->ednsopts == NULL)
-		return;
-
-	for (i = 0; i < lookold->ednsoptscnt; i++) {
-		len = lookold->ednsopts[i].length;
-		if (len != 0) {
-			INSIST(lookold->ednsopts[i].value != NULL);
-			looknew->ednsopts[i].value =
-				 isc_mem_allocate(mctx, len);
-			if (looknew->ednsopts[i].value == NULL)
-				fatal("out of memory");
-			memmove(looknew->ednsopts[i].value,
-				lookold->ednsopts[i].value, len);
-		}
-		looknew->ednsopts[i].code = lookold->ednsopts[i].code;
-		looknew->ednsopts[i].length = len;
-	}
-	looknew->ednsoptscnt = lookold->ednsoptscnt;
-}
-
 /*%
 * Clone a lookup, perhaps copying the server list.  This does not clone
 * the query list, since it will be regenerated by the setup_lookup()
@@ -771,12 +700,8 @@ clone_lookup(dig_lookup_t *lookold, isc_boolean_t servers) {
 	looknew->seenbadcookie = lookold->seenbadcookie;
 	looknew->badcookie = lookold->badcookie;
 	looknew->cookie = lookold->cookie;
-	if (lookold->ednsopts != NULL) {
-		cloneopts(looknew, lookold);
-	} else {
-		looknew->ednsopts = NULL;
-		looknew->ednsoptscnt = 0;
-	}
+	looknew->ednsopts = lookold->ednsopts;
+	looknew->ednsoptscnt = lookold->ednsoptscnt;
 	looknew->ednsneg = lookold->ednsneg;
 	looknew->padding = lookold->padding;
 	looknew->mapped = lookold->mapped;
@@ -1392,6 +1317,13 @@ setup_libs(void) {
 	check_result(result, "isc_mutex_init");
 }

+/*
+ * Array of up to 100 options configured by +ednsopt
+ */
+#define EDNSOPT_OPTIONS 100U
+static dns_ednsopt_t ednsopts[EDNSOPT_OPTIONS];
+static unsigned char ednsoptscnt = 0;
+
 typedef struct dig_ednsoptname {
 	isc_uint32_t code;
 	const char  *name;
@@ -1418,12 +1350,12 @@ dig_ednsoptname_t optnames[] = {
 void
 save_opt(dig_lookup_t *lookup, char *code, char *value) {
 	isc_result_t result;
-	isc_uint32_t num = 0;
+	isc_uint32_t num;
 	isc_buffer_t b;
 	isc_boolean_t found = ISC_FALSE;
 	unsigned int i;

-	if (lookup->ednsoptscnt >= EDNSOPT_OPTIONS)
+	if (ednsoptscnt == EDNSOPT_OPTIONS)
 		fatal("too many ednsopts");

 	for (i = 0; i < N_EDNS_OPTNAMES; i++) {
@@ -1440,16 +1372,9 @@ save_opt(dig_lookup_t *lookup, char *code, char *value) {
 			fatal("bad edns code point: %s", code);
 	}

-	if (lookup->ednsopts == NULL) {
-		cloneopts(lookup, NULL);
-	}
-
-	if (lookup->ednsopts[lookup->ednsoptscnt].value != NULL)
-		isc_mem_free(mctx, lookup->ednsopts[lookup->ednsoptscnt].value);
-
-	lookup->ednsopts[lookup->ednsoptscnt].code = num;
-	lookup->ednsopts[lookup->ednsoptscnt].length = 0;
-	lookup->ednsopts[lookup->ednsoptscnt].value = NULL;
+	ednsopts[ednsoptscnt].code = num;
+	ednsopts[ednsoptscnt].length = 0;
+	ednsopts[ednsoptscnt].value = NULL;

 	if (value != NULL) {
 		char *buf;
@@ -1459,13 +1384,14 @@ save_opt(dig_lookup_t *lookup, char *code, char *value) {
 		isc_buffer_init(&b, buf, (unsigned int) strlen(value)/2 + 1);
 		result = isc_hex_decodestring(value, &b);
 		check_result(result, "isc_hex_decodestring");
-		lookup->ednsopts[lookup->ednsoptscnt].value =
-						 isc_buffer_base(&b);
-		lookup->ednsopts[lookup->ednsoptscnt].length =
-						 isc_buffer_usedlength(&b);
+		ednsopts[ednsoptscnt].value = isc_buffer_base(&b);
+		ednsopts[ednsoptscnt].length = isc_buffer_usedlength(&b);
 	}

+	if (lookup->ednsoptscnt == 0)
+		lookup->ednsopts = &ednsopts[ednsoptscnt];
 	lookup->ednsoptscnt++;
+	ednsoptscnt++;
 }

 /*%
@@ -1644,15 +1570,6 @@ destroy_lookup(dig_lookup_t *lookup) {
 	if (lookup->ecs_addr != NULL)
 		isc_mem_free(mctx, lookup->ecs_addr);

-	if (lookup->ednsopts != NULL) {
-		size_t i;
-		for (i = 0; i < EDNSOPT_OPTIONS; i++) {
-			if (lookup->ednsopts[i].value != NULL)
-				isc_mem_free(mctx, lookup->ednsopts[i].value);
-		}
-		isc_mem_free(mctx, lookup->ednsopts);
-	}
-
 	isc_mem_free(mctx, lookup);
 }

@@ -2197,13 +2114,9 @@ setup_lookup(dig_lookup_t *lookup) {
 		if (result != ISC_R_SUCCESS) {
 			dns_message_puttempname(lookup->sendmsg,
 						&lookup->name);
-			warn("'%s' is not a legal name "
+			fatal("'%s' is not a legal name "
 			      "(%s)", lookup->textname,
 			      isc_result_totext(result));
-#if TARGET_OS_IPHONE
-			check_next_lookup(current_lookup);
-			return (ISC_FALSE);
-#endif
 		}
 	}
 	dns_name_format(lookup->name, store, sizeof(store));
@@ -4214,6 +4127,12 @@ destroy_libs(void) {
 	debug("Removing log context");
 	isc_log_destroy(&lctx);

+	while (ednsoptscnt > 0U) {
+		ednsoptscnt--;
+		if (ednsopts[ednsoptscnt].value != NULL)
+			isc_mem_free(mctx, ednsopts[ednsoptscnt].value);
+	}
+
 	debug("Destroy memory");
 	if (memdebugging != 0)
 		isc_mem_stats(mctx, stderr);
@@ -26,10 +26,6 @@
 #include <isc/sockaddr.h>
 #include <isc/socket.h>

-#ifdef __APPLE__
-#include <TargetConditionals.h>
-#endif
-
 #define MXSERV 20
 #define MXNAME (DNS_NAME_MAXTEXT+1)
 #define MXRD 32
@@ -286,13 +282,6 @@ ISC_PLATFORM_NORETURN_PRE void
 fatal(const char *format, ...)
 ISC_FORMAT_PRINTF(1, 2) ISC_PLATFORM_NORETURN_POST;

-void
-warn(const char *format, ...) ISC_FORMAT_PRINTF(1, 2);
-
-ISC_PLATFORM_NORETURN_PRE void
-digexit(void)
-ISC_PLATFORM_NORETURN_POST;
-
 void
 debug(const char *format, ...) ISC_FORMAT_PRINTF(1, 2);

@@ -395,9 +384,6 @@ extern void
 extern void
 (*dighost_shutdown)(void);

-extern void
-(*dighost_pre_exit_hook)(void);
-
 void save_opt(dig_lookup_t *lookup, char *code, char *value);

 void setup_file_key(void);
@@ -62,11 +62,11 @@ may be preferable to direct use of
 .RS 4
 Selects the cryptographic algorithm\&. For DNSSEC keys, the value of
 \fBalgorithm\fR
-must be one of RSAMD5, RSASHA1, DSA, NSEC3RSASHA1, NSEC3DSA, RSASHA256, RSASHA512, ECCGOST, ECDSAP256SHA256, ECDSAP384SHA384, ED25519 or ED448\&. For TKEY, the value must be DH (Diffie Hellman); specifying his value will automatically set the
+must be one of RSAMD5, RSASHA1, DSA, NSEC3RSASHA1, NSEC3DSA, RSASHA256, RSASHA512, ECCGOST, ECDSAP256SHA256, ECDSAP384SHA384, ED25519 or ED448\&. For TKEY and SIG(0) keys, the value must be DH (Diffie Hellman); specifying this value will automatically set the
 \fB\-T KEY\fR
 option as well\&.
 .sp
-TSIG keys can also be generated by setting the value to one of HMAC\-MD5, HMAC\-SHA1, HMAC\-SHA224, HMAC\-SHA256, HMAC\-SHA384, or HMAC\-SHA512\&. As with DH, specifying these values will automatically set
+TSIG keys can also by generated by setting the value to one of HMAC\-MD5, HMAC\-SHA1, HMAC\-SHA224, HMAC\-SHA256, HMAC\-SHA384, or HMAC\-SHA512\&. As with DH, specifying these values will automatically set
 \fB\-T KEY\fR\&. Note, however, that
 \fBtsig\-keygen\fR
 produces TSIG keys in a more useful format\&. These algorithms have been deprecated in
@@ -122,12 +122,12 @@
 	    of <option>algorithm</option> must be one of RSAMD5, RSASHA1,
 	    DSA, NSEC3RSASHA1, NSEC3DSA, RSASHA256, RSASHA512, ECCGOST,
 	    ECDSAP256SHA256, ECDSAP384SHA384, ED25519 or ED448.  For
-	    TKEY, the value must be DH (Diffie Hellman); specifying
-	    his value will automatically set the <option>-T KEY</option>
-	    option as well.
+	    TKEY and SIG(0) keys, the value must be DH (Diffie Hellman);
+	    specifying this value will automatically set the
+	    <option>-T KEY</option> option as well.
 	  </para>
 	  <para>
-	    TSIG keys can also be generated by setting the value to
+	    TSIG keys can also by generated by setting the value to
 	    one of HMAC-MD5, HMAC-SHA1, HMAC-SHA224, HMAC-SHA256,
 	    HMAC-SHA384, or HMAC-SHA512.  As with DH, specifying these
 	    values will automatically set <option>-T KEY</option>. Note,
@@ -103,12 +103,12 @@
 	    of <code class="option">algorithm</code> must be one of RSAMD5, RSASHA1,
 	    DSA, NSEC3RSASHA1, NSEC3DSA, RSASHA256, RSASHA512, ECCGOST,
 	    ECDSAP256SHA256, ECDSAP384SHA384, ED25519 or ED448.  For
-	    TKEY, the value must be DH (Diffie Hellman); specifying
-	    his value will automatically set the <code class="option">-T KEY</code>
-	    option as well.
+	    TKEY and SIG(0) keys, the value must be DH (Diffie Hellman);
+	    specifying this value will automatically set the
+	    <code class="option">-T KEY</code> option as well.
 	  </p>
 	  <p>
-	    TSIG keys can also be generated by setting the value to
+	    TSIG keys can also by generated by setting the value to
 	    one of HMAC-MD5, HMAC-SHA1, HMAC-SHA224, HMAC-SHA256,
 	    HMAC-SHA384, or HMAC-SHA512.  As with DH, specifying these
 	    values will automatically set <code class="option">-T KEY</code>. Note,
@@ -8,10 +8,6 @@ srcdir =	@srcdir@
 VPATH =		@srcdir@
 top_srcdir =	@top_srcdir@

-# Attempt to disable parallel processing.
-.NOTPARALLEL:
-.NO_PARALLEL:
-
 VERSION=@BIND9_VERSION@

@BIND9_PRODUCT@
@@ -134,7 +130,7 @@ server.@O@: server.c
 		-DPRODUCT=\"${PRODUCT}\" \
 		-DVERSION=\"${VERSION}\" -c ${srcdir}/server.c

-named@EXEEXT@: ${OBJS} ${DEPLIBS}
+named@EXEEXT@: ${OBJS} ${UOBJS} ${DEPLIBS}
 	export MAKE_SYMTABLE="yes"; \
 	export BASEOBJS="${OBJS} ${UOBJS}"; \
 	${FINALBUILDCMD}
@@ -9,7 +9,7 @@

 <xsl:stylesheet xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns="http://www.w3.org/1999/xhtml" version="1.0">
  <xsl:output method="html" indent="yes" version="4.0"/>
-  <xsl:template match="statistics[@version=&quot;3.11&quot;]">
+  <xsl:template match="statistics[@version=&quot;3.10&quot;]">
    <html>
      <head>
        <xsl:if test="system-property('xsl:vendor')!='Transformiix'">
@@ -14,7 +14,7 @@ static char xslmsg[] =
 	"\n"
 	"<xsl:stylesheet xmlns:xsl=\"http://www.w3.org/1999/XSL/Transform\" xmlns=\"http://www.w3.org/1999/xhtml\" version=\"1.0\">\n"
 	" <xsl:output method=\"html\" indent=\"yes\" version=\"4.0\"/>\n"
-	" <xsl:template match=\"statistics[@version=&quot;3.11&quot;]\">\n"
+	" <xsl:template match=\"statistics[@version=&quot;3.10&quot;]\">\n"
 	" <html>\n"
 	" <head>\n"
 	" <xsl:if test=\"system-property('xsl:vendor')!='Transformiix'\">\n"
@@ -456,8 +456,9 @@ control_recvmessage(isc_task_t *task, isc_event_t *event) {
 	 */
 	if (conn->nonce == 0) {
 		while (conn->nonce == 0) {
-			isc_rng_randombytes(server->sctx->rngctx, &conn->nonce,
-					    sizeof(conn->nonce));
+			isc_uint16_t r1 = isc_rng_random(server->sctx->rngctx);
+			isc_uint16_t r2 = isc_rng_random(server->sctx->rngctx);
+			conn->nonce = (r1 << 16) | r2;
 		}
 		eresult = ISC_R_SUCCESS;
 	} else
@@ -26,8 +26,6 @@
 int scmp_syscalls[] = {
 	SCMP_SYS(access),
 	SCMP_SYS(open),
-	SCMP_SYS(openat),
-	SCMP_SYS(lseek),
 	SCMP_SYS(clock_gettime),
 	SCMP_SYS(time),
 	SCMP_SYS(read),
@@ -56,7 +54,6 @@ int scmp_syscalls[] = {
 #ifdef HAVE_GETRANDOM
 	SCMP_SYS(getrandom),
 #endif
-	SCMP_SYS(rename),
 	SCMP_SYS(unlink),
 	SCMP_SYS(socket),
 	SCMP_SYS(sendto),
@@ -75,6 +72,7 @@ int scmp_syscalls[] = {
 	SCMP_SYS(getsockopt),
 	SCMP_SYS(getsockname),
 	SCMP_SYS(lstat),
+	SCMP_SYS(lseek),
 	SCMP_SYS(getgid),
 	SCMP_SYS(getegid),
 	SCMP_SYS(getuid),
@@ -85,7 +83,9 @@ int scmp_syscalls[] = {
 	SCMP_SYS(setuid),
 	SCMP_SYS(prctl),
 	SCMP_SYS(epoll_wait),
+	SCMP_SYS(openat),
 	SCMP_SYS(getdents),
+	SCMP_SYS(rename),
 	SCMP_SYS(utimes),
 	SCMP_SYS(dup),
 #endif
@@ -93,8 +93,6 @@ int scmp_syscalls[] = {
 const char *scmp_syscall_names[] = {
 	"access",
 	"open",
-	"openat",
-	"lseek",
 	"clock_gettime",
 	"time",
 	"read",
@@ -123,7 +121,6 @@ const char *scmp_syscall_names[] = {
 #ifdef HAVE_GETRANDOM
 	"getrandom",
 #endif
-	"rename",
 	"unlink",
 	"socket",
 	"sendto",
@@ -142,6 +139,7 @@ const char *scmp_syscall_names[] = {
 	"getsockopt",
 	"getsockname",
 	"lstat",
+	"lseek",
 	"getgid",
 	"getegid",
 	"getuid",
@@ -152,7 +150,9 @@ const char *scmp_syscall_names[] = {
 	"setuid",
 	"prctl",
 	"epoll_wait",
+	"openat",
 	"getdents",
+	"rename",
 	"utimes",
 	"dup",
 #endif
@@ -395,7 +395,6 @@ init_desc(void) {
 	SET_RESSTATDESC(serverquota, "spilled due to server quota",
 			"ServerQuota");
 	SET_RESSTATDESC(nextitem, "waited for next item", "NextItem");
-	SET_RESSTATDESC(priming, "priming queries", "Priming");

 	INSIST(i == dns_resstatscounter_max);

@@ -1616,7 +1615,7 @@ generatexml(named_server_t *server, isc_uint32_t flags,
 			ISC_XMLCHAR "type=\"text/xsl\" href=\"/bind9.xsl\""));
 	TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "statistics"));
 	TRY0(xmlTextWriterWriteAttribute(writer, ISC_XMLCHAR "version",
-					 ISC_XMLCHAR "3.11"));
+					 ISC_XMLCHAR "3.10"));

 	/* Set common fields for statistics dump */
 	dumparg.type = isc_statsformat_xml;
@@ -2412,7 +2411,7 @@ generatejson(named_server_t *server, size_t *msglen,
 	/*
 	 * These statistics are included no matter which URL we use.
 	 */
-	obj = json_object_new_string("1.5");
+	obj = json_object_new_string("1.4");
 	CHECKMEM(obj);
 	json_object_object_add(bindstats, "json-stats-version", obj);

@@ -150,7 +150,6 @@ static dns_dispatch_t *dispatchv4 = NULL;
 static dns_dispatch_t *dispatchv6 = NULL;
 static dns_message_t *updatemsg = NULL;
 static dns_fixedname_t fuserzone;
-static dns_fixedname_t fzname;
 static dns_name_t *userzone = NULL;
 static dns_name_t *zname = NULL;
 static dns_name_t tmpzonename;
@@ -944,21 +943,16 @@ setup_system(void) {
 			case AF_INET:
 				if (have_ipv4) {
 					sa->type.sin.sin_port = htons(dnsport);
-				} else {
-					continue;
 				}
 				break;
 			case AF_INET6:
 				if (have_ipv6) {
 					sa->type.sin6.sin6_port = htons(dnsport);
-				} else {
-					continue;
 				}
 				break;
 			default:
 				fatal("bad family");
 			}
-			INSIST(i < ns_alloc);
 			servers[i++] = *sa;
 		}
 	}
@@ -2396,6 +2390,7 @@ update_completed(isc_task_t *task, isc_event_t *event) {
 		dns_request_destroy(&request);
 		dns_message_renderreset(updatemsg);
 		dns_message_settsigkey(updatemsg, NULL);
+		/* XXX MPA fix zonename is freed already */
 		send_update(zname, &master_servers[master_inuse]);
 		isc_event_free(&event);
 		return;
@@ -2698,17 +2693,13 @@ recvsoa(isc_task_t *task, isc_event_t *event) {
 	dns_name_init(&master, NULL);
 	dns_name_clone(&soa.origin, &master);

-	if (userzone != NULL) {
+	/*
+	 * XXXMPA
+	 */
+	if (userzone != NULL)
 		zname = userzone;
-	} else {
-		/*
-		 * Save the zone name in case we need to try a second
-		 * address.
-		 */
-		dns_fixedname_init(&fzname);
-		zname = dns_fixedname_name(&fzname);
-		dns_name_copy(name, zname, NULL);
-	}
+	else
+		zname = name;

 	if (debugging) {
 		char namestr[DNS_NAME_FORMATSIZE];
@@ -39,7 +39,9 @@
 dnssec-checkds \- DNSSEC delegation consistency checking tool
 .SH "SYNOPSIS"
 .HP \w'\fBdnssec\-checkds\fR\ 'u
-\fBdnssec\-checkds\fR [\fB\-d\ \fR\fB\fIdig\ path\fR\fR] [\fB\-D\ \fR\fB\fIdsfromkey\ path\fR\fR] [\fB\-f\ \fR\fB\fIfile\fR\fR] [\fB\-l\ \fR\fB\fIdomain\fR\fR] [\fB\-s\ \fR\fB\fIfile\fR\fR] {zone}
+\fBdnssec\-checkds\fR [\fB\-l\ \fR\fB\fIdomain\fR\fR] [\fB\-f\ \fR\fB\fIfile\fR\fR] [\fB\-d\ \fR\fB\fIdig\ path\fR\fR] [\fB\-D\ \fR\fB\fIdsfromkey\ path\fR\fR] {zone}
+.HP \w'\fBdnssec\-dsfromkey\fR\ 'u
+\fBdnssec\-dsfromkey\fR [\fB\-l\ \fR\fB\fIdomain\fR\fR] [\fB\-f\ \fR\fB\fIfile\fR\fR] [\fB\-d\ \fR\fB\fIdig\ path\fR\fR] [\fB\-D\ \fR\fB\fIdsfromkey\ path\fR\fR] {zone}
 .SH "DESCRIPTION"
 .PP
 \fBdnssec\-checkds\fR
@@ -58,12 +60,6 @@ is specified, then the zone is read from that file to find the DNSKEY records\&.
 Check for a DLV record in the specified lookaside domain, instead of checking for a DS record in the zone\*(Aqs parent\&.
 .RE
 .PP
-\-s \fIfile\fR
-.RS 4
-Specifies a prepared dsset file, such as would be generated by
-\fBdnssec\-signzone\fR, to use as a source for the DS RRset instead of querying the parent\&.
-.RE
-.PP
 \-d \fIdig path\fR
 .RS 4
 Specifies a path to a
@@ -42,13 +42,20 @@
  <refsynopsisdiv>
    <cmdsynopsis sepchar=" ">
      <command>dnssec-checkds</command>
+      <arg choice="opt" rep="norepeat"><option>-l <replaceable class="parameter">domain</replaceable></option></arg>
+      <arg choice="opt" rep="norepeat"><option>-f <replaceable class="parameter">file</replaceable></option></arg>
      <arg choice="opt" rep="norepeat"><option>-d <replaceable class="parameter">dig path</replaceable></option></arg>
      <arg choice="opt" rep="norepeat"><option>-D <replaceable class="parameter">dsfromkey path</replaceable></option></arg>
-      <arg choice="opt" rep="norepeat"><option>-f <replaceable class="parameter">file</replaceable></option></arg>
-      <arg choice="opt" rep="norepeat"><option>-l <replaceable class="parameter">domain</replaceable></option></arg>
-      <arg choice="opt" rep="norepeat"><option>-s <replaceable class="parameter">file</replaceable></option></arg>
      <arg choice="req" rep="norepeat">zone</arg>
    </cmdsynopsis>
+    <cmdsynopsis sepchar=" ">
+      <command>dnssec-dsfromkey</command>
+      <arg choice="opt" rep="norepeat"><option>-l <replaceable class="parameter">domain</replaceable></option></arg>
+      <arg choice="opt" rep="norepeat"><option>-f <replaceable class="parameter">file</replaceable></option></arg>
+      <arg choice="opt" rep="norepeat"><option>-d <replaceable class="parameter">dig path</replaceable></option></arg>
+      <arg choice="opt" rep="norepeat"><option>-D <replaceable class="parameter">dsfromkey path</replaceable></option></arg>
+      <arg choice="req" rep="norepeat">zone</arg>
+   </cmdsynopsis>
  </refsynopsisdiv>

  <refsection><info><title>DESCRIPTION</title></info>
@@ -85,17 +92,6 @@
        </listitem>
      </varlistentry>

-      <varlistentry>
-        <term>-s <replaceable class="parameter">file</replaceable></term>
-        <listitem>
-          <para>
-            Specifies a prepared dsset file, such as would be generated
-            by <command>dnssec-signzone</command>, to use as a source for
-            the DS RRset instead of querying the parent.
-          </para>
-        </listitem>
-      </varlistentry>
-
      <varlistentry>
        <term>-d <replaceable class="parameter">dig path</replaceable></term>
        <listitem>
@@ -33,13 +33,20 @@
 <h2>Synopsis</h2>
    <div class="cmdsynopsis"><p>
      <code class="command">dnssec-checkds</code> 
+       [<code class="option">-l <em class="replaceable"><code>domain</code></em></code>]
+       [<code class="option">-f <em class="replaceable"><code>file</code></em></code>]
       [<code class="option">-d <em class="replaceable"><code>dig path</code></em></code>]
       [<code class="option">-D <em class="replaceable"><code>dsfromkey path</code></em></code>]
-       [<code class="option">-f <em class="replaceable"><code>file</code></em></code>]
-       [<code class="option">-l <em class="replaceable"><code>domain</code></em></code>]
-       [<code class="option">-s <em class="replaceable"><code>file</code></em></code>]
       {zone}
    </p></div>
+    <div class="cmdsynopsis"><p>
+      <code class="command">dnssec-dsfromkey</code> 
+       [<code class="option">-l <em class="replaceable"><code>domain</code></em></code>]
+       [<code class="option">-f <em class="replaceable"><code>file</code></em></code>]
+       [<code class="option">-d <em class="replaceable"><code>dig path</code></em></code>]
+       [<code class="option">-D <em class="replaceable"><code>dsfromkey path</code></em></code>]
+       {zone}
+   </p></div>
  </div>

  <div class="refsection">
@@ -72,14 +79,6 @@
            instead of checking for a DS record in the zone's parent.
          </p>
        </dd>
-<dt><span class="term">-s <em class="replaceable"><code>file</code></em></span></dt>
-<dd>
-          <p>
-            Specifies a prepared dsset file, such as would be generated
-            by <span class="command"><strong>dnssec-signzone</strong></span>, to use as a source for
-            the DS RRset instead of querying the parent.
-          </p>
-        </dd>
 <dt><span class="term">-d <em class="replaceable"><code>dig path</code></em></span></dt>
 <dd>
          <p>
@@ -1,5 +1,5 @@
 ############################################################################
-# Copyright (C) 2012-2017  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2012-2016  Internet Systems Consortium, Inc. ("ISC")
 #
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -34,11 +34,7 @@ class SECRR:
        if not rrtext:
            raise Exception

-        # 'str' does not have decode method in python3
-        if type(rrtext) is not str:
-            fields = rrtext.decode('ascii').split()
-        else:
-            fields = rrtext.split()
+        fields = rrtext.decode('ascii').split()
        if len(fields) < 7:
            raise Exception

@@ -93,39 +89,35 @@ class SECRR:
 # Generate a set of expected DS/DLV records from the DNSKEY RRset,
 # and report on congruency.
 ############################################################################
-def check(zone, args):
+def check(zone, args, masterfile=None, lookaside=None):
    rrlist = []
-    if args.dssetfile:
-        fp = open(args.dssetfile).read()
-    else:
-        cmd = [args.dig, "+noall", "+answer", "-t",
-                "dlv" if args.lookaside else "ds", "-q",
-                zone + "." + args.lookaside if args.lookaside else zone]
-        fp, _ = Popen(cmd, stdout=PIPE).communicate()
+    cmd = [args.dig, "+noall", "+answer", "-t", "dlv" if lookaside else "ds",
+           "-q", zone + "." + lookaside if lookaside else zone]
+    fp, _ = Popen(cmd, stdout=PIPE).communicate()

    for line in fp.splitlines():
-        rrlist.append(SECRR(line, args.lookaside))
+        rrlist.append(SECRR(line, lookaside))
    rrlist = sorted(rrlist, key=lambda rr: (rr.keyid, rr.keyalg, rr.hashalg))

    klist = []

-    if args.masterfile:
-        cmd = [args.dsfromkey, "-f", args.masterfile]
-        if args.lookaside:
-            cmd += ["-l", args.lookaside]
+    if masterfile:
+        cmd = [args.dsfromkey, "-f", masterfile]
+        if lookaside:
+            cmd += ["-l", lookaside]
        cmd.append(zone)
        fp, _ = Popen(cmd, stdout=PIPE).communicate()
    else:
        intods, _ = Popen([args.dig, "+noall", "+answer", "-t", "dnskey",
                           "-q", zone], stdout=PIPE).communicate()
        cmd = [args.dsfromkey, "-f", "-"]
-        if args.lookaside:
-            cmd += ["-l", args.lookaside]
+        if lookaside:
+            cmd += ["-l", lookaside]
        cmd.append(zone)
        fp, _ = Popen(cmd, stdin=PIPE, stdout=PIPE).communicate(intods)

    for line in fp.splitlines():
-        klist.append(SECRR(line, args.lookaside))
+        klist.append(SECRR(line, lookaside))

    if len(klist) < 1:
        print("No DNSKEY records found in zone apex")
@@ -144,8 +136,7 @@ def check(zone, args):
                   rr.keyid, SECRR.hashalgs[rr.hashalg]))

    if not found:
-        print("No %s records were found for any DNSKEY" %
-                ("DLV" if args.lookaside else "DS"))
+        print("No %s records were found for any DNSKEY" % ("DLV" if lookaside else "DS"))

    return found

@@ -160,6 +151,10 @@ def parse_args():
    sbindir = 'bin' if os.name == 'nt' else 'sbin'

    parser.add_argument('zone', type=str, help='zone to check')
+    parser.add_argument('-f', '--file', dest='masterfile', type=str,
+                        help='zone master file')
+    parser.add_argument('-l', '--lookaside', dest='lookaside', type=str,
+                        help='DLV lookaside zone')
    parser.add_argument('-d', '--dig', dest='dig',
                        default=os.path.join(prefix(bindir), 'dig'),
                        type=str, help='path to \'dig\'')
@@ -167,12 +162,6 @@ def parse_args():
                        default=os.path.join(prefix(sbindir),
                                             'dnssec-dsfromkey'),
                        type=str, help='path to \'dig\'')
-    parser.add_argument('-f', '--file', dest='masterfile', type=str,
-                        help='zone master file')
-    parser.add_argument('-l', '--lookaside', dest='lookaside', type=str,
-                        help='DLV lookaside zone')
-    parser.add_argument('-s', '--dsset', dest='dssetfile', type=str,
-                        help='prepared DSset file')
    parser.add_argument('-v', '--version', action='version',
                        version=version)
    args = parser.parse_args()
@@ -189,5 +178,5 @@ def parse_args():
 ############################################################################
 def main():
    args = parse_args()
-    found = check(args.zone, args)
+    found = check(args.zone, args, args.masterfile, args.lookaside)
    exit(0 if found else 1)
@@ -516,10 +516,7 @@ Status will report whether serving of stale answers is currently enabled, disabl
 .PP
 \fBsecroots \fR\fB[\-]\fR\fB \fR\fB[\fIview \&.\&.\&.\fR]\fR
 .RS 4
-Dump the security roots (i\&.e\&., trust anchors configured via
-\fBtrusted\-keys\fR,
-\fBmanaged\-keys\fR, or
-\fBdnssec\-validation auto\fR) and negative trust anchors for the specified views\&. If no view is specified, all views are dumped\&. Security roots will indicate whether they are configured as trusted keys, managed keys, or initializing managed keys (managed keys that have not yet been updated by a successful key refresh query)\&.
+Dump the server\*(Aqs security roots and negative trust anchors for the specified views\&. If no view is specified, all views are dumped\&.
 .sp
 If the first argument is "\-", then the output is returned via the
 \fBrndc\fR
@@ -433,7 +433,6 @@ rndc_recvnonce(isc_task_t *task, isc_event_t *event) {

 	isc_event_free(&event);
 	isccc_sexpr_free(&response);
-	isccc_sexpr_free(&request);
 	return;
 }

@@ -499,7 +498,6 @@ rndc_connected(isc_task_t *task, isc_event_t *event) {
 					   NULL));
 	sends++;
 	isc_event_free(&event);
-	isccc_sexpr_free(&request);
 }

 static void
@@ -774,15 +774,9 @@
 	<term><userinput>secroots <optional>-</optional> <optional><replaceable>view ...</replaceable></optional></userinput></term>
 	<listitem>
 	  <para>
-	    Dump the security roots (i.e., trust anchors
-	    configured via <command>trusted-keys</command>,
-	    <command>managed-keys</command>, or
-	    <command>dnssec-validation auto</command>) and negative trust
-	    anchors for the specified views.  If no view is specified, all
-	    views are dumped.  Security roots will indicate whether
-	    they are configured as trusted keys, managed keys, or
-	    initializing managed keys (managed keys that have not yet
-	    been updated by a successful key refresh query).
+	    Dump the server's security roots and negative trust anchors
+	    for the specified views.  If no view is specified, all views
+	    are dumped.
 	  </para>
 	  <para>
 	    If the first argument is "-", then the output is
@@ -969,15 +963,15 @@
 	<listitem>
 	  <para>
 	    When called without arguments, display the current
-	    values of the <command>tcp-initial-timeout</command>,
+            values of the <command>tcp-initial-timeout</command>,
 	    <command>tcp-idle-timeout</command>,
 	    <command>tcp-keepalive-timeout</command> and
 	    <command>tcp-advertised-timeout</command> options.
-	    When called with arguments, update these values. This
-	    allows an administrator to make rapid adjustments when
-	    under a denial of service attack.  See the descriptions of
-	    these options in the BIND 9 Administrator Reference Manual
-	    for details of their use.
+            When called with arguments, update these values. This
+            allows an administrator to make rapid adjustments when
+            under a denial of service attack.  See the descriptions of
+            these options in the BIND 9 Administrator Reference Manual
+            for details of their use.
 	  </para>
 	</listitem>
      </varlistentry>
@@ -657,15 +657,9 @@
 <dt><span class="term"><strong class="userinput"><code>secroots [<span class="optional">-</span>] [<span class="optional"><em class="replaceable"><code>view ...</code></em></span>]</code></strong></span></dt>
 <dd>
 	  <p>
-	    Dump the security roots (i.e., trust anchors
-	    configured via <span class="command"><strong>trusted-keys</strong></span>,
-	    <span class="command"><strong>managed-keys</strong></span>, or
-	    <span class="command"><strong>dnssec-validation auto</strong></span>) and negative trust
-	    anchors for the specified views.  If no view is specified, all
-	    views are dumped.  Security roots will indicate whether
-	    they are configured as trusted keys, managed keys, or
-	    initializing managed keys (managed keys that have not yet
-	    been updated by a successful key refresh query).
+	    Dump the server's security roots and negative trust anchors
+	    for the specified views.  If no view is specified, all views
+	    are dumped.
 	  </p>
 	  <p>
 	    If the first argument is "-", then the output is
@@ -828,15 +822,15 @@
 <dd>
 	  <p>
 	    When called without arguments, display the current
-	    values of the <span class="command"><strong>tcp-initial-timeout</strong></span>,
+            values of the <span class="command"><strong>tcp-initial-timeout</strong></span>,
 	    <span class="command"><strong>tcp-idle-timeout</strong></span>,
 	    <span class="command"><strong>tcp-keepalive-timeout</strong></span> and
 	    <span class="command"><strong>tcp-advertised-timeout</strong></span> options.
-	    When called with arguments, update these values. This
-	    allows an administrator to make rapid adjustments when
-	    under a denial of service attack.  See the descriptions of
-	    these options in the BIND 9 Administrator Reference Manual
-	    for details of their use.
+            When called with arguments, update these values. This
+            allows an administrator to make rapid adjustments when
+            under a denial of service attack.  See the descriptions of
+            these options in the BIND 9 Administrator Reference Manual
+            for details of their use.
 	  </p>
 	</dd>
 <dt><span class="term"><strong class="userinput"><code>thaw [<span class="optional"><em class="replaceable"><code>zone</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em> [<span class="optional"><em class="replaceable"><code>view</code></em></span>]</span>]</span>]</code></strong></span></dt>
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2011, 2013, 2015-2017  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2011, 2013, 2015, 2016  Internet Systems Consortium, Inc. ("ISC")
 *
 * This Source Code Form is subject to the terms of the Mozilla Public
 * License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -181,7 +181,7 @@ static void
 do_store(isc_task_t *task, isc_event_t *ev) {
 	counter_t *state = (counter_t *)ev->ev_arg;
 	int i;
-	isc_uint32_t r;
+	isc_uint8_t r;
 	isc_uint32_t val;

 	r = random() % 256;
@@ -205,7 +205,7 @@ test_atomic_store() {
 	isc_task_t *tasks[TASKS];
 	isc_event_t *event;
 	int i;
-	isc_uint32_t r;
+	isc_uint8_t r;
 	isc_uint32_t val;

 	t_assert("test_atomic_store", 1, T_REQUIRED, "%s",
@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# Copyright (C) 2008, 2012, 2014-2017  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2008, 2012, 2014-2016  Internet Systems Consortium, Inc. ("ISC")
 #
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -15,5 +15,3 @@ rm -f ns2/example.db ns2/tsigzone.db ns2/example.db.jnl ns2/named.conf
 rm -f */named.memstats
 rm -f */named.run
 rm -f ns*/named.lock
-rm -f ns*/_default.nzf
-rm -f ns*/_default.nzd*
@@ -1,16 +0,0 @@
-; Copyright (C) 2017  Internet Systems Consortium, Inc. ("ISC")
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
-
-$TTL 300	; 5 minutes
-@			IN SOA	ns root (
-				2000082401 ; serial
-				1800       ; refresh (30 minutes)
-				1800       ; retry (30 minutes)
-				1814400    ; expire (3 weeks)
-				3600       ; minimum (1 hour)
-				)
-			NS	ns
-ns			A	10.53.0.3
@@ -1,30 +0,0 @@
-/*
- * Copyright (C) 2017  Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- */
-
-options {
-	query-source address 10.53.0.3;
-	notify-source 10.53.0.3;
-	transfer-source 10.53.0.3;
-	port 5300;
-	pid-file "named.pid";
-	listen-on { 10.53.0.3; };
-	listen-on-v6 { none; };
-	recursion no;
-	notify no;
-	allow-new-zones yes;
-	allow-transfer { none; };
-};
-
-controls {
-	inet 10.53.0.3 port 9953 allow { any; } keys { rndc_key; };
-};
-
-key rndc_key {
-	secret "1234abcd8765";
-	algorithm hmac-sha256;
-};
@@ -1,16 +0,0 @@
-; Copyright (C) 2017  Internet Systems Consortium, Inc. ("ISC")
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
-
-$TTL 300	; 5 minutes
-@			IN SOA	ns root (
-				2000082401 ; serial
-				1800       ; refresh (30 minutes)
-				1800       ; retry (30 minutes)
-				1814400    ; expire (3 weeks)
-				3600       ; minimum (1 hour)
-				)
-			NS	ns
-ns			A	10.53.0.4
@@ -1,16 +0,0 @@
-; Copyright (C) 2017  Internet Systems Consortium, Inc. ("ISC")
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
-
-$TTL 300	; 5 minutes
-@			IN SOA	ns root (
-				2000082401 ; serial
-				1800       ; refresh (30 minutes)
-				1800       ; retry (30 minutes)
-				1814400    ; expire (3 weeks)
-				3600       ; minimum (1 hour)
-				)
-			NS	ns
-ns			A	10.53.0.4
@@ -1,35 +0,0 @@
-/*
- * Copyright (C) 2017  Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- */
-
-options {
-	query-source address 10.53.0.4;
-	notify-source 10.53.0.4;
-	transfer-source 10.53.0.4;
-	port 5300;
-	pid-file "named.pid";
-	listen-on { 10.53.0.4; };
-	listen-on-v6 { none; };
-	recursion no;
-	notify no;
-	allow-new-zones yes;
-	allow-transfer { none; };
-};
-
-controls {
-	inet 10.53.0.4 port 9953 allow { any; } keys { rndc_key; };
-};
-
-key rndc_key {
-	secret "1234abcd8765";
-	algorithm hmac-sha256;
-};
-
-zone "existing" {
-	type master;
-	file "existing.db";
-};
@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# Copyright (C) 2008, 2012-2014, 2016, 2017  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2008, 2012-2014, 2016  Internet Systems Consortium, Inc. ("ISC")
 #
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -172,65 +172,5 @@ t=`expr $t + 1`
 $DIG example. soa @10.53.0.2 +subnet="192.0.2.128/32" -p 5300 > dig.out.${t}
 grep "CLIENT-SUBNET.*192.0.2.128/32/24" dig.out.${t} > /dev/null || { echo "I:test $t failed" ; status=1; }

-# AXFR tests against ns3
-
-echo "I:testing allow-transfer ACLs against ns3 (no existing zones)"
-
-echo "I:calling addzone example.com on ns3"
-$RNDC -c ../common/rndc.conf -s 10.53.0.3 -p 9953 addzone 'example.com {type master; file "example.db"; }; '
-
-sleep 1
-
-t=`expr $t + 1`
-ret=0
-echo "I:checking AXFR of example.com from ns3 with ACL allow-transfer { none; }; (${t})"
-$DIG @10.53.0.3 -p 5300 example.com axfr > dig.out.${t} 2>&1
-grep "Transfer failed." dig.out.${t} >/dev/null 2>&1 || ret=1
-[ $ret -eq 0 ] || echo "I:failed"
-status=`expr $status + $ret`
-
-echo "I:calling rndc reconfig"
-$RNDC -c ../common/rndc.conf -s 10.53.0.3 -p 9953 reconfig
-
-sleep 1
-
-t=`expr $t + 1`
-ret=0
-echo "I:re-checking AXFR of example.com from ns3 with ACL allow-transfer { none; }; (${t})"
-$DIG @10.53.0.3 -p 5300 example.com axfr > dig.out.${t} 2>&1
-grep "Transfer failed." dig.out.${t} >/dev/null 2>&1 || ret=1
-[ $ret -eq 0 ] || echo "I:failed"
-status=`expr $status + $ret`
-
-# AXFR tests against ns4
-
-echo "I:testing allow-transfer ACLs against ns4 (1 pre-existing zone)"
-
-echo "I:calling addzone example.com on ns4"
-$RNDC -c ../common/rndc.conf -s 10.53.0.4 -p 9953 addzone 'example.com {type master; file "example.db"; }; '
-
-sleep 1
-
-t=`expr $t + 1`
-ret=0
-echo "I:checking AXFR of example.com from ns4 with ACL allow-transfer { none; }; (${t})"
-$DIG @10.53.0.4 -p 5300 example.com axfr > dig.out.${t} 2>&1
-grep "Transfer failed." dig.out.${t} >/dev/null 2>&1 || ret=1
-[ $ret -eq 0 ] || echo "I:failed"
-status=`expr $status + $ret`
-
-echo "I:calling rndc reconfig"
-$RNDC -c ../common/rndc.conf -s 10.53.0.4 -p 9953 reconfig
-
-sleep 1
-
-t=`expr $t + 1`
-ret=0
-echo "I:re-checking AXFR of example.com from ns4 with ACL allow-transfer { none; }; (${t})"
-$DIG @10.53.0.4 -p 5300 example.com axfr > dig.out.${t} 2>&1
-grep "Transfer failed." dig.out.${t} >/dev/null 2>&1 || ret=1
-[ $ret -eq 0 ] || echo "I:failed"
-status=`expr $status + $ret`
-
 echo "I:exit status: $status"
 [ $status -eq 0 ] || exit 1
@@ -1,9 +0,0 @@
-; Copyright (C) 2018  Internet Systems Consortium, Inc. ("ISC")
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
-
-@	SOA	ns3 hostmaster 0 0 0 0 0
-@	NS	ns3
-ns3	A	10.53.0.3
@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# Copyright (C) 2010-2018  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2010-2017  Internet Systems Consortium, Inc. ("ISC")
 #
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -672,31 +672,5 @@ n=`expr $n + 1`
 if [ $ret != 0 ]; then echo "I:failed"; fi
 status=`expr $status + $ret`

-if ! $FEATURETEST --with-lmdb
-then
-    echo "I:check that addzone is fully reversed on failure (--with-lmdb=no) ($n)"
-    ret=0
-    $RNDC -c ../common/rndc.conf -s 10.53.0.3 -p 9953 addzone "test1.baz" '{ type master; file "e.db"; };' > /dev/null 2>&1 || ret=1
-    $RNDC -c ../common/rndc.conf -s 10.53.0.3 -p 9953 addzone "test2.baz" '{ type master; file "dne.db"; };' > /dev/null 2>&1 && ret=1
-    $RNDC -c ../common/rndc.conf -s 10.53.0.3 -p 9953 addzone "test3.baz" '{ type master; file "e.db"; };' > /dev/null 2>&1 || ret=1
-    $RNDC -c ../common/rndc.conf -s 10.53.0.3 -p 9953 delzone "test3.baz" > /dev/null 2>&1 || ret=1
-    grep test2.baz ns3/_default.nzf > /dev/null && ret=1
-    n=`expr $n + 1`
-    if [ $ret != 0 ]; then echo "I:failed"; fi
-    status=`expr $status + $ret`
-fi
-
-echo "I:check that named restarts with multiple added zones ($n)"
-ret=0
-$RNDC -c ../common/rndc.conf -s 10.53.0.3 -p 9953 addzone "test4.baz" '{ type master; file "e.db"; };' > /dev/null 2>&1 || ret=1
-$RNDC -c ../common/rndc.conf -s 10.53.0.3 -p 9953 addzone "test5.baz" '{ type master; file "e.db"; };' > /dev/null 2>&1 || ret=1
-$PERL $SYSTEMTESTTOP/stop.pl . ns3
-$PERL $SYSTEMTESTTOP/start.pl --noclean --restart . ns3 || ret=1
-$DIG -p 5300 @10.53.0.3 version.bind txt ch > dig.out.test$n || ret=1
-grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
-n=`expr $n + 1`
-if [ $ret != 0 ]; then echo "I:failed"; fi
-status=`expr $status + $ret`
-
 echo "I:exit status: $status"
 [ $status -eq 0 ] || exit 1
@@ -28,10 +28,6 @@ rm -f ns2/private.secure.example.db ns2/bar.db
 rm -f ns3/*.nzd ns3/*.nzd-lock ns3/*.nzf
 rm -f ns3/*.nzf
 rm -f ns3/autonsec3.example.db
-rm -f ns3/inacksk2.example.db
-rm -f ns3/inacksk3.example.db
-rm -f ns3/inaczsk2.example.db
-rm -f ns3/inaczsk3.example.db
 rm -f ns3/kg.out ns3/s.out ns3/st.out
 rm -f ns3/kskonly.example.db
 rm -f ns3/nozsk.example.db ns3/inaczsk.example.db
@@ -1,21 +0,0 @@
-; Copyright (C) 2017  Internet Systems Consortium, Inc. ("ISC")
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
-
-$TTL 300	; 5 minutes
-@			IN SOA	mname1. . (
-				1          ; serial
-				20         ; refresh (20 seconds)
-				20         ; retry (20 seconds)
-				1814400    ; expire (3 weeks)
-				3600       ; minimum (1 hour)
-				)
-			NS	ns
-ns			A	10.53.0.3
-
-a			A	10.0.0.1
-b			A	10.0.0.2
-d			A	10.0.0.4
-x			CNAME	a
@@ -1,21 +0,0 @@
-; Copyright (C) 2017  Internet Systems Consortium, Inc. ("ISC")
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
-
-$TTL 300	; 5 minutes
-@			IN SOA	mname1. . (
-				1          ; serial
-				20         ; refresh (20 seconds)
-				20         ; retry (20 seconds)
-				1814400    ; expire (3 weeks)
-				3600       ; minimum (1 hour)
-				)
-			NS	ns
-ns			A	10.53.0.3
-
-a			A	10.0.0.1
-b			A	10.0.0.2
-d			A	10.0.0.4
-x			CNAME	a
@@ -1,21 +0,0 @@
-; Copyright (C) 2017  Internet Systems Consortium, Inc. ("ISC")
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
-
-$TTL 300	; 5 minutes
-@			IN SOA	mname1. . (
-				1          ; serial
-				20         ; refresh (20 seconds)
-				20         ; retry (20 seconds)
-				1814400    ; expire (3 weeks)
-				3600       ; minimum (1 hour)
-				)
-			NS	ns
-ns			A	10.53.0.3
-
-a			A	10.0.0.1
-b			A	10.0.0.2
-d			A	10.0.0.4
-x			CNAME	a
@@ -1,21 +0,0 @@
-; Copyright (C) 2017  Internet Systems Consortium, Inc. ("ISC")
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
-
-$TTL 300	; 5 minutes
-@			IN SOA	mname1. . (
-				1          ; serial
-				20         ; refresh (20 seconds)
-				20         ; retry (20 seconds)
-				1814400    ; expire (3 weeks)
-				3600       ; minimum (1 hour)
-				)
-			NS	ns
-ns			A	10.53.0.3
-
-a			A	10.0.0.1
-b			A	10.0.0.2
-d			A	10.0.0.4
-x			CNAME	a
@@ -273,41 +273,3 @@ cp $infile $zonefile
 ksk=`$KEYGEN -a RSASHA1 -3 -q -r $RANDFILE -fk -P sync now $zone 2> kg.out` || dumpit kg.out
 $KEYGEN -a RSASHA1 -3 -q -r $RANDFILE $zone > kg.out 2>&1 || dumpit kg.out
 $DSFROMKEY $ksk.key > dsset-${zone}$TP
-
-#
-# A zone that has a published inactive key that is autosigned.
-#
-setup inacksk2.example
-cp $infile $zonefile
-ksk=`$KEYGEN -a RSASHA1 -3 -q -r $RANDFILE -Pnow -A now+3600 -fk $zone 2> kg.out` || dumpit kg.out
-$KEYGEN -a RSASHA1 -3 -q -r $RANDFILE $zone > kg.out 2>&1 || dumpit kg.out
-$DSFROMKEY $ksk.key > dsset-${zone}$TP
-
-#
-# A zone that has a published inactive key that is autosigned.
-#
-setup inaczsk2.example
-cp $infile $zonefile
-ksk=`$KEYGEN -a RSASHA1 -3 -q -r $RANDFILE -fk $zone 2> kg.out` || dumpit kg.out
-$KEYGEN -a RSASHA1 -3 -q -r $RANDFILE -P now -A now+3600 $zone > kg.out 2>&1 || dumpit kg.out
-$DSFROMKEY $ksk.key > dsset-${zone}$TP
-
-#
-#  A zone that starts with a active KSK + ZSK and a inactive ZSK.
-#
-setup inacksk3.example
-cp $infile $zonefile
-$KEYGEN -a NSEC3RSASHA1 -3 -q -r $RANDFILE -P now -A now+3600 -fk $zone > kg.out 2>&1 || dumpit kg.out
-ksk=`$KEYGEN -a NSEC3RSASHA1 -3 -q -r $RANDFILE -fk $zone 2> kg.out` || dumpit kg.out
-$KEYGEN -a NSEC3RSASHA1 -3 -q -r $RANDFILE $zone > kg.out 2>&1 || dumpit kg.out
-$DSFROMKEY $ksk.key > dsset-${zone}$TP
-
-#
-#  A zone that starts with a active KSK + ZSK and a inactive ZSK.
-#
-setup inaczsk3.example
-cp $infile $zonefile
-ksk=`$KEYGEN -a NSEC3RSASHA1 -3 -q -r $RANDFILE -fk $zone 2> kg.out` || dumpit kg.out
-$KEYGEN -a NSEC3RSASHA1 -3 -q -r $RANDFILE $zone > kg.out 2>&1 || dumpit kg.out
-$KEYGEN -a NSEC3RSASHA1 -3 -q -r $RANDFILE -P now -A now+3600 $zone > kg.out 2>&1 || dumpit kg.out
-$DSFROMKEY $ksk.key > dsset-${zone}$TP
@@ -249,34 +249,4 @@ zone "kskonly.example" {
 	auto-dnssec maintain;
 };

-zone "inacksk2.example" {
-	type master;
-	file "inacksk2.example.db";
-	allow-update { any; };
-	dnssec-dnskey-kskonly yes;
-	auto-dnssec maintain;
-};
-
-zone "inacksk3.example" {
-	type master;
-	file "inacksk3.example.db";
-	allow-update { any; };
-	dnssec-dnskey-kskonly yes;
-	auto-dnssec maintain;
-};
-
-zone "inaczsk2.example" {
-	type master;
-	file "inaczsk2.example.db";
-	allow-update { any; };
-	auto-dnssec maintain;
-};
-
-zone "inaczsk3.example" {
-	type master;
-	file "inaczsk3.example.db";
-	allow-update { any; };
-	auto-dnssec maintain;
-};
-
 include "trusted.conf";
@@ -72,8 +72,7 @@ do
 		$DIG $DIGOPTS $z @10.53.0.2 nsec > dig.out.ns2.test$n || ret=1
 		grep "NS SOA" dig.out.ns2.test$n > /dev/null || ret=1
 	done
-	for z in bar. example. inacksk2.example. inacksk3.example \
-		 inaczsk2.example. inaczsk3.example
+	for z in bar. example.
 	do 
 		$DIG $DIGOPTS $z @10.53.0.3 nsec > dig.out.ns3.test$n || ret=1
 		grep "NS SOA" dig.out.ns3.test$n > /dev/null || ret=1
@@ -87,70 +86,6 @@ n=`expr $n + 1`
 if [ $ret != 0 ]; then echo "I:failed"; else echo "I:done"; fi
 status=`expr $status + $ret`

-#
-# Check that DNSKEY is initially signed with a KSK and not a ZSK.
-#
-echo "I:check that zone with active and inactive KSK and active ZSK is properly"
-echo "I:  resigned after the active KSK is deleted - stage 1: Verify that DNSKEY"
-echo "I:  is initially signed with a KSK and not a ZSK. ($n)"
-ret=0
-
-$DIG  $DIGOPTS @10.53.0.3 axfr inacksk3.example > dig.out.ns3.test$n
-
-zskid=`awk '$4 == "DNSKEY" && $5 == 256 { print }' dig.out.ns3.test$n |
-       $DSFROMKEY -A -2 -f - inacksk3.example | awk '{ print $4}' `
-grep "DNSKEY 7 2 " dig.out.ns3.test$n > /dev/null || ret=1
-
-pattern="DNSKEY 7 2 [0-9]* [0-9]* [0-9]* ${zskid} "
-grep "${pattern}" dig.out.ns3.test$n > /dev/null && ret=1
-
-count=`awk 'BEGIN { count = 0 }
-	    $4 == "RRSIG" && $5 == "DNSKEY" { count++ }
-	    END {print count}' dig.out.ns3.test$n`
-test $count -eq 1 || ret=1
-
-count=`awk 'BEGIN { count = 0 }
-       $4 == "DNSKEY" { count++ }
-       END {print count}' dig.out.ns3.test$n`
-test $count -eq 3 || ret=1
-
-awk='$4 == "RRSIG" && $5 == "DNSKEY" { printf "%05u\n", $11 }'
-id=`awk "${awk}" dig.out.ns3.test$n`
-
-$SETTIME -D now+5 ns3/Kinacksk3.example.+007+${id}
-$RNDC -c ../common/rndc.conf -s 10.53.0.3 -p 9953 loadkeys inacksk3.example
-
-n=`expr $n + 1`
-if [ $ret != 0 ]; then echo "I:failed"; fi
-status=`expr $status + $ret`
-
-#
-# Check that zone is initially signed with a ZSK and not a KSK.
-#
-echo "I:check that zone with active and inactive ZSK and active KSK is properly"
-echo "I:  resigned after the active ZSK is deleted - stage 1: Verify that zone"
-echo "I:  is initially signed with a ZSK and not a KSK. ($n)"
-ret=0
-$DIG  $DIGOPTS @10.53.0.3 axfr inaczsk3.example > dig.out.ns3.test$n
-kskid=`awk '$4 == "DNSKEY" && $5 == 257 { print }' dig.out.ns3.test$n |
-       $DSFROMKEY -2 -f - inaczsk3.example | awk '{ print $4}' `
-grep "CNAME 7 3 " dig.out.ns3.test$n > /dev/null || ret=1
-grep "CNAME 7 3 [0-9]* [0-9]* [0-9]* ${kskid} " dig.out.ns3.test$n > /dev/null && ret=1
-count=`awk 'BEGIN { count = 0 }
-	    $4 == "RRSIG" && $5 == "CNAME" { count++ }
-	    END {print count}' dig.out.ns3.test$n`
-test $count -eq 1 || ret=1
-count=`awk 'BEGIN { count = 0 }
-       $4 == "DNSKEY" { count++ }
-       END {print count}' dig.out.ns3.test$n`
-test $count -eq 3 || ret=1
-id=`awk '$4 == "RRSIG" && $5 == "CNAME" { printf "%05u\n", $11 }' dig.out.ns3.test$n`
-$SETTIME -D now+5 ns3/Kinaczsk3.example.+007+${id}
-$RNDC -c ../common/rndc.conf -s 10.53.0.3 -p 9953 loadkeys inaczsk3.example
-n=`expr $n + 1`
-if [ $ret != 0 ]; then echo "I:failed"; fi
-status=`expr $status + $ret`
-
 echo "I:checking NSEC->NSEC3 conversion prerequisites ($n)"
 ret=0
 # these commands should result in an empty file:
@@ -1296,83 +1231,5 @@ if [ "$lret" != 0 ]; then ret=$lret; fi
 if [ $ret != 0 ]; then echo "I:failed"; fi
 status=`expr $status + $ret`

-echo "I:check that zone with inactive KSK and active ZSK is properly autosigned ($n)"
-ret=0
-$DIG  $DIGOPTS @10.53.0.3 axfr inacksk2.example > dig.out.ns3.test$n
-
-zskid=`awk '$4 == "DNSKEY" && $5 == 256 { print }' dig.out.ns3.test$n |
-       $DSFROMKEY -A -2 -f - inacksk2.example | awk '{ print $4}' `
-pattern="DNSKEY 7 2 [0-9]* [0-9]* [0-9]* ${zskid} "
-grep "${pattern}" dig.out.ns3.test$n > /dev/null || ret=1
-
-kskid=`awk '$4 == "DNSKEY" && $5 == 257 { print }' dig.out.ns3.test$n |
-       $DSFROMKEY -2 -f - inacksk2.example | awk '{ print $4}' `
-pattern="DNSKEY 7 2 [0-9]* [0-9]* [0-9]* ${kskid} "
-grep "${pattern}" dig.out.ns3.test$n > /dev/null && ret=1
-
-n=`expr $n + 1`
-if [ $ret != 0 ]; then echo "I:failed"; fi
-status=`expr $status + $ret`
-
-echo "I:check that zone with inactive ZSK and active KSK is properly autosigned ($n)"
-ret=0
-$DIG  $DIGOPTS @10.53.0.3 axfr inaczsk2.example > dig.out.ns3.test$n
-grep "SOA 7 2" dig.out.ns3.test$n > /dev/null || ret=1
-n=`expr $n + 1`
-if [ $ret != 0 ]; then echo "I:failed"; fi
-status=`expr $status + $ret`
-
-#
-# Check that DNSKEY is now signed with the ZSK.
-#
-echo "I:check that zone with active and inactive KSK and active ZSK is properly"
-echo "I:  resigned after the active KSK is deleted - stage 2: Verify that DNSKEY"
-echo "I:  is now signed with the ZSK. ($n)"
-ret=0
-
-$DIG  $DIGOPTS @10.53.0.3 axfr inacksk3.example > dig.out.ns3.test$n
-
-zskid=`awk '$4 == "DNSKEY" && $5 == 256 { print }' dig.out.ns3.test$n |
-       $DSFROMKEY -A -2 -f - inacksk3.example | awk '{ print $4}' `
-pattern="DNSKEY 7 2 [0-9]* [0-9]* [0-9]* ${zskid} "
-grep "${pattern}" dig.out.ns3.test$n > /dev/null || ret=1
-
-count=`awk 'BEGIN { count = 0 }
-       $4 == "RRSIG" && $5 == "DNSKEY" { count++ }
-       END {print count}' dig.out.ns3.test$n`
-test $count -eq 1 || ret=1
-
-count=`awk 'BEGIN { count = 0 }
-       $4 == "DNSKEY" { count++ }
-       END {print count}' dig.out.ns3.test$n`
-test $count -eq 2 || ret=1
-
-n=`expr $n + 1`
-if [ $ret != 0 ]; then echo "I:failed"; fi
-status=`expr $status + $ret`
-
-#
-# Check that zone is now signed with the KSK.
-#
-echo "I:check that zone with active and inactive ZSK and active KSK is properly"
-echo "I:  resigned after the active ZSK is deleted - stage 2: Verify that zone"
-echo "I:  is now signed with the KSK. ($n)"
-ret=0
-$DIG  $DIGOPTS @10.53.0.3 axfr inaczsk3.example > dig.out.ns3.test$n
-kskid=`awk '$4 == "DNSKEY" && $5 == 257 { print }' dig.out.ns3.test$n |
-       $DSFROMKEY -2 -f - inaczsk3.example | awk '{ print $4}' `
-grep "CNAME 7 3 [0-9]* [0-9]* [0-9]* ${kskid} " dig.out.ns3.test$n > /dev/null || ret=1
-count=`awk 'BEGIN { count = 0 }
-       $4 == "RRSIG" && $5 == "CNAME" { count++ }
-       END {print count}' dig.out.ns3.test$n`
-test $count -eq 1 || ret=1
-count=`awk 'BEGIN { count = 0 }
-       $4 == "DNSKEY" { count++ }
-       END {print count}' dig.out.ns3.test$n`
-test $count -eq 2 || ret=1
-n=`expr $n + 1`
-if [ $ret != 0 ]; then echo "I:failed"; fi
-status=`expr $status + $ret`
-
 echo "I:exit status: $status"
 [ $status -eq 0 ] || exit 1
@@ -10,4 +10,4 @@ my $target = shift;
 my $file = shift;
 my $mtime = time - (stat $file)[9];
 die "bad mtime $mtime"
-	unless abs($mtime - $target) < 10;
+	unless abs($mtime - $target) < 3;
@@ -43,7 +43,7 @@ check_stderr() {
 		[ -s err.$n ] || return 0
 	fi
 	echo "D:stderr did not match '$err'"
-	sed 's/^/D:/' err.$n
+	sed 's/^/D:/' err
 	fail
 }

@@ -254,7 +254,7 @@ def create_response(msg):
 def sigterm(signum, frame):
    print ("Shutting down now...")
    os.remove('ans.pid')
-    running = False
+    running = 0
    sys.exit(0)

 ############################################################################
@@ -270,17 +270,8 @@ sock = 5300

 query4_socket = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
 query4_socket.bind((ip4, sock))
-
-havev6 = True
-try:
-    query6_socket = socket.socket(socket.AF_INET6, socket.SOCK_DGRAM)
-    try:
-        query6_socket.bind((ip6, sock))
-    except:
-        query6_socket.close()
-        havev6 = False
-except:
-    havev6 = False
+query6_socket = socket.socket(socket.AF_INET6, socket.SOCK_DGRAM)
+query6_socket.bind((ip6, sock))

 ctrl_socket = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
 ctrl_socket.bind((ip4, sock + 1))
@@ -293,18 +284,14 @@ pid = os.getpid()
 print (pid, file=f)
 f.close()

-running = True
+running = 1

 print ("Listening on %s port %d" % (ip4, sock))
-if havev6:
-    print ("Listening on %s port %d" % (ip6, sock))
+print ("Listening on %s port %d" % (ip6, sock))
 print ("Control channel on %s port %d" % (ip4, sock + 1))
 print ("Ctrl-c to quit")

-if havev6:
-    input = [query4_socket, query6_socket, ctrl_socket]
-else:
-    input = [query4_socket, ctrl_socket]
+input = [query4_socket, query6_socket, ctrl_socket]

 while running:
    try:
@@ -1,11 +0,0 @@
-/*
- * Copyright (C) 2017  Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- */
-
-options {
-	dnssec-lookaside . trust-anchor dlv.example.com;
-};
@@ -1,4 +1,4 @@
-# Copyright (C) 2005, 2007, 2010-2017  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2005, 2007, 2010-2016  Internet Systems Consortium, Inc. ("ISC")
 #
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -135,7 +135,6 @@ done
 if [ $ret != 0 ]; then echo "I:failed"; fi
 status=`expr $status + $ret`

-n=`expr $n + 1`
 echo "I: checking options allowed in inline-signing slaves ($n)"
 ret=0
 l=`$CHECKCONF bad-dnssec.conf 2>&1 | grep "dnssec-dnskey-kskonly.*requires inline" | wc -l`
@@ -328,29 +327,5 @@ diff good.zonelist checkconf.out$n  > diff.out$n || ret=1
 if [ $ret != 0 ]; then echo "I:failed"; ret=1; fi
 status=`expr $status + $ret`

-n=`expr $n + 1`
-echo "I: check that 'dnssec-lookaside auto;' generates a warning ($n)"
-ret=0
-$CHECKCONF warn-dlv-auto.conf > checkconf.out$n 2>/dev/null || ret=1
-grep "dnssec-lookaside 'auto' is no longer supported" checkconf.out$n > /dev/null || ret=1
-if [ $ret != 0 ]; then echo "I:failed"; ret=1; fi
-status=`expr $status + $ret`
-
-n=`expr $n + 1`
-echo "I: check that 'dnssec-lookaside . trust-anchor dlv.isc.org;' generates a warning ($n)"
-ret=0
-$CHECKCONF warn-dlv-dlv.isc.org.conf > checkconf.out$n 2>/dev/null || ret=1
-grep "dlv.isc.org has been shut down" checkconf.out$n > /dev/null || ret=1
-if [ $ret != 0 ]; then echo "I:failed"; ret=1; fi
-status=`expr $status + $ret`
-
-n=`expr $n + 1`
-echo "I: check that 'dnssec-lookaside . trust-anchor dlv.example.com;' doesn't generates a warning ($n)"
-ret=0
-$CHECKCONF good-dlv-dlv.example.com.conf > checkconf.out$n 2>/dev/null || ret=1
-[ -s checkconf.out$n ] && ret=1
-if [ $ret != 0 ]; then echo "I:failed"; ret=1; fi
-status=`expr $status + $ret`
-
 echo "I:exit status: $status"
 [ $status -eq 0 ] || exit 1
@@ -1,10 +1,12 @@
 #!/bin/sh
 #
-# Copyright (C) 2012-2014, 2016, 2017  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2012-2014, 2016  Internet Systems Consortium, Inc. ("ISC")
 #
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.

+# $Id$
+
 rm -f checkds.*
 rm -f ns*/named.lock
@@ -1,11 +1,13 @@
 #!/usr/bin/perl
 #
-# Copyright (C) 2014, 2016, 2017  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2014, 2016  Internet Systems Consortium, Inc. ("ISC")
 #
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.

+# $Id$
+
 my $arg;
 my $ext;
 my $file;
@@ -1,11 +1,14 @@
 #!/bin/sh
 #
-# Copyright (C) 2012, 2013, 2016, 2017  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2012, 2013, 2016  Internet Systems Consortium, Inc. ("ISC")
 #
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.

+# $Id$
+
+
 while [ "$#" != 0 ]; do
    case $1 in
    +*) shift ;;
@@ -1,121 +0,0 @@
-; File written on Thu Oct  5 23:44:34 2017
-; dnssec_signzone version 9.12.0a1
-prep.example.		300	IN SOA	ns1.prep.example. hostmaster.prep.example. (
-					1          ; serial
-					2000       ; refresh (33 minutes 20 seconds)
-					2000       ; retry (33 minutes 20 seconds)
-					1814400    ; expire (3 weeks)
-					3600       ; minimum (1 hour)
-					)
-			300	RRSIG	SOA 8 2 300 (
-					20171105054434 20171006054434 19260 prep.example.
-					1fX0z7Swu4gMPews/ZE8bzNg+JXNedFBDGIH
-					PTSfVQtVLIvRWpME+PylX7MdVMZE/PST+x4/
-					mWyveyjetEOo7/7aQL236FfI0y6TxQFy7HwC
-					FMieqoQCUluuKOvToxg4vUp4GOdlUGbqC63h
-					DbX5Z37VptJXLkt4niF4Kl2iD+U9/bk7HAEU
-					4zDiKroYnusGKfVB9xAWddzoHdLxhVuPi7ut
-					328suPdgX0bfs7uB+y4cikhGzAmPpNMlGHju
-					qYG74NcFGQNutLB7ayx/m87t7mTty7jbNKm3
-					QWJSPf5IR8/kmzAi8HMnapY5vUmm+hX8JOfU
-					UtH7i0iEsUqRbEwu5A== )
-			300	NS	ns1.prep.example.
-			300	RRSIG	NS 8 2 300 (
-					20171105054434 20171006054434 19260 prep.example.
-					u5sU2cfqNqIyCLw18ZNnFw28/GyRt0EOiPYS
-					dygmpfMDrvDaxjiiai8zWYjnl/E3qzVH9Zku
-					07lEDORZdVb0uCDe1NynjAyw4AHps85cAwVc
-					8HTSbzdVZsQTELpunYFJffh24PDr9unw7KOY
-					jzTP6qNedJ1uM54TOr177zfmBh7N2fkAoGyV
-					NjvTKrlgDYGNIn8/YMgHb4sNgyfe54MYY00f
-					kehVxfKnRCgDsbJ0Pk6jhBMCQWvOh8jG8WyV
-					ElAa/eMqlxUC1idF8ydWefjsI/7lPcjSalw9
-					qZw4CDCLHHZy0TOSmCYRRZuIeVXzBfDPJyi4
-					2A3iLntKFJ4AOLFMJg== )
-			3600	NSEC	ns1.prep.example. NS SOA RRSIG NSEC DNSKEY
-			3600	RRSIG	NSEC 8 2 3600 (
-					20171105054434 20171006054434 19260 prep.example.
-					Aed99/jdG82YAkKVWjoKOsAGtB3JnyKkCaAq
-					zgMrYkXU41y3KDCAmGzooGPQY7NN+WxX7FJ2
-					1nXkgljma/azgpsbi9ssneFtv7PPFClVmN+u
-					j+mM4MK/ZR7eJOsMqETg4PAO5VAh6c/GVmyA
-					RD/m6EhJVZEjPfLWbDoC4hVAgem7DP/NMjyI
-					GfztpDjMmyLQyv6tL+UEXSJHGp3ZEa5Z5i7X
-					Nl/bRTUlZs7L4rTgoqHv6LEmsXKAf9rZYq4b
-					eP6GF9I1Ry41MfHLc7lPUmtR38ErEsM5uGzw
-					trCQYEFhuRWUBxZ8OSL2EZK9rUBXZX+cwK/8
-					ZP7mIfDfljkXPQcmow== )
-			3600	DNSKEY	256 3 8 (
-					AwEAAfMzj6aZIgZDVcpH1pKOtq998E85+nEY
-					YJa0lLS8+QTCC1Efke8GLwsXT0IPTuwnOuXM
-					RjySirab0NuEr69T8KP/43YxcRdmCg89mjjN
-					szoVPPstC9xBKVOc0pRMDF7sfsTrSye3RY7+
-					Z6uZEH5FOAkz2hNbJJHOn4HpNUhLPJGRauhf
-					0evamwUmQ/mlhkVW5q4WmqPCDMNY3K6XtkEm
-					cvm8n9ZCXC9Z5AX6KpynujzLdKyxpdGqUk6r
-					lavp9ILPpRKoTZDX+2q1pDgP5cDndwtgNSvU
-					DBQZoD0psS2cyB3PHo+dPwwpEyM//ZSKsH9m
-					e85Ti0413TOWFyFd/jUOUA8=
-					) ; ZSK; alg = RSASHA256 ; key id = 19260
-			3600	DNSKEY	257 3 8 (
-					AwEAAbV8X06Qvk350aZ6eZ1d7WbT1H/Y0Sv7
-					qAdbk5fbYIKpMvZ8D9xqoTHgD0z0uCgWWIcm
-					/xyKBfmax76oLwMBpR/kdtuJz0irgFITnJCH
-					pEfR9AJ/Mfm7NyMglq+/39I03E1/LXvpXQLG
-					tg+Mo/2CUE5sbG31jmPNK/2J8RMESkIi87fW
-					azZU/oyUEtECE5PGbdyw+4PacAsXNjnwl30T
-					aatL277wX4pt+IUPdE6EIph3t+dxXJ7OpHgW
-					8g+YSHLlCImLVapdg3oD/cs6ncaBq9z7la5Y
-					dHNw2QAIAvQ11EsonrkonPqO6zNVZAVdT2VB
-					X5YzGAoCFUvbCvlnl2a7SxM=
-					) ; KSK; alg = RSASHA256 ; key id = 65482
-			3600	RRSIG	DNSKEY 8 2 3600 (
-					20171105054434 20171006054434 19260 prep.example.
-					pPw81pJ3PeF+tqEswTul9N8Qsl9JKgK4v8SV
-					lPfP0pnlMBMbtMFFkx5ZmhQg3Z3U8SdE64Bt
-					C5St3qItyyKdTQ0Rbm9mfV6twxDB8lVry8F7
-					Pv7gJmmcWzBcbLGcrXIrVNSZhigkemQXTElj
-					P8y1j7kaNFWBWbDMn7KesiZ9BiC6sqvuKa3R
-					wSofjwXTESspWZP0NtXr5ymaBIMR9UtNj5Wh
-					jm1+tg6BxNBKxhCHlSC0ltPS/qq9J1ZUmtJz
-					sj/EAFfPVJVuEveebMvi1oDWPTgajO9+EHl4
-					ELrgnQHCgaybMzbpd/A5+Tr1hQkv48I8Mb0/
-					8LJ2/6xrvJm64yRteg== )
-			3600	RRSIG	DNSKEY 8 2 3600 (
-					20171105054434 20171006054434 65482 prep.example.
-					WeIWiC9SnBe2+UocVjpap62O8Rz+iljwJiu9
-					VlGUwct3Vydq4/4FVAKdPklXV5cYbBLhO2MB
-					3R4toX8RNU/0Ny8DnugQzLKvVfg0xoyU/UAJ
-					k4aWa/vPivSLGouLQPiNp71bdXN4LB/2xmzu
-					cPYXzS9ePpwCOp/9JLoNjBSMQkfjfWAcaNtj
-					1DKDmHHL1sPMizninxSJLQOAKb+JwUAjAkOM
-					O1JqwkB12/IZuzxN5hly+uNsbFFxPzQkcnJ4
-					5bhzxuh5D/JRXW0nF5aO4aR+9X+lSUpDJQZ1
-					5fOt1cybZCn/ag68RA92zrnisdbrggJGS003
-					wn/VKbLVfFj3eQrfNA== )
-ns1.prep.example.	300	IN A	1.1.1.1
-			300	RRSIG	A 8 3 300 (
-					20171105054434 20171006054434 19260 prep.example.
-					QUyDyJVk3JGEq+VTZtY3firzsRqOA0LUm3Tf
-					/fnemQBeOlMda2ErA7DqYVriIGfM8jph416E
-					YX8SKAZXGEAlsEbC9cWBVyc5TYH6tZ43sV51
-					55kGTiUY92NnrH10Q+m2SLAEEaKCA/cgBwOR
-					tN2Wb1meHgiLbGYN2LbANfDQzoEk4AYAgT6r
-					wDKVVg/V9Ed7JnCnBQc9MN9+LQ3h4NBGUiEY
-					mr7HX2w+yzqcGFNLI1aFPe2IwFt120QPLyyl
-					cZgc6FUBX4YCnWoCb0aFyyOT76AQkKF5YBRn
-					gAv6S8q1pZ/0B5w4gjaLEGlts3LG0bxZ1GJd
-					gCQMEhgYgyXUchTtZA== )
-			3600	NSEC	prep.example. A RRSIG NSEC
-			3600	RRSIG	NSEC 8 3 3600 (
-					20171105054434 20171006054434 19260 prep.example.
-					rDWN40u1a3DSzWOrS+4YR2XOxaem0BAQ/glN
-					QkXNDew1WsZo3fe0IHIhDKlJ/5MJAfAHq8Xs
-					A5UGUw2efoNAN/0LuWsI/9IPm4dwQOXiTCly
-					uxugXf5islPYyvn1Z14ay/7/2P3W6HZknXzo
-					lZFpwqfFZQCxz7c/1aH+2ntAMeqx8LHuewSr
-					Rz/sLsSiCcZQ6NMWnZdoC5SGy4CTcIIPPS8z
-					9dQ6QYTC5iq4MKRfyJUyvODyU9be4e6jbo5b
-					mjRcov4ttbImhD5jrLAZIfjO6DSazGNVFf/x
-					6rjxjrc8SISPkt2xYwcOlYch9OZuoH86wcZu
-					3Don6yAnLDYDrZylAA== )
@@ -1,2 +0,0 @@
-prep.example.		IN DS 65482 8 1 F3673708FBADDEC3EB55933E2E393ACE85EAC2BB
-prep.example.		IN DS 65482 8 2 51A7C97AAC42803DA515D1CAFEE28031A5018F6345F12F4B6C1B6D20 02B59820
@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# Copyright (C) 2012-2014, 2016, 2017  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2012-2014, 2016  Internet Systems Consortium, Inc. ("ISC")
 #
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -171,15 +171,6 @@ n=`expr $n + 1`
 if [ $ret != 0 ]; then echo "I:failed"; fi
 status=`expr $status + $ret`

-echo "I:checking with prepared dsset file ($n)"
-ret=0
-$CHECKDS -f prep.example.db -s prep.example.ds.db prep.example > checkds.out.$n || ret=1
-grep 'SHA-1.*found' checkds.out.$n > /dev/null 2>&1 || ret=1
-grep 'SHA-256.*found' checkds.out.$n > /dev/null 2>&1 || ret=1
-n=`expr $n + 1`
-if [ $ret != 0 ]; then echo "I:failed"; fi
-status=`expr $status + $ret`
-
 if [ $status = 0 ]; then $SHELL clean.sh; fi
 echo "I:exit status: $status"
 [ $status -eq 0 ] || exit 1
@@ -186,19 +186,6 @@ else
 	}
 fi

-#
-# Useful functions in test scripts
-#
-
-# nextpart: read everything that's been appended to a file since the
-# last time 'nextpart' was called.
-nextpart () {
-    [ -f $1.prev ] || echo "0" > $1.prev
-    prev=`cat $1.prev`
-    awk "NR > $prev "'{ print }
-         END          { print NR > "/dev/stderr" }' $1 2> $1.prev
-}
-
 #
 # Export command paths
 #
@@ -58,8 +58,6 @@ MDIG=$TOP/Build/$VSCONF/mdig@EXEEXT@
 NZD2NZF=$TOP/Build/$VSCONF/named-nzd2nzf@EXEEXT@
 FSTRM_CAPTURE=@FSTRM_CAPTURE@
 FEATURETEST=$TOP/Build/$VSCONF/feature-test@EXEEXT@
-SAMPLEUPDATE=$TOP/Build/$VSCONF/update@EXEEXT@
-
 # to port WIRETEST=$TOP/Build/$VSCONF/wire_test@EXEEXT@

 # this is given as argument to native WIN32 executables
@@ -178,19 +176,6 @@ echoinfo () {
        printf "${COLOR_INFO}%s${COLOR_NONE}\n" "$*"
 }

-#
-# Useful functions in test scripts
-#
-
-# nextpart: read everything that's been appended to a file since the
-# last time 'nextpart' was called.
-nextpart () {
-    [ -f $1.prev ] || echo "0" > $1.prev
-    prev=`cat $1.prev`
-    awk "NR > $prev "'{ print }
-         END          { print NR > "/dev/stderr" }' $1 2> $1.prev
-}
-
 #
 # Export command paths
 #
@@ -226,7 +211,6 @@ export RANDFILE
 export RESOLVE
 export RNDC
 export RRCHECKER
-export SAMPLEUPDATE
 export SIGNER
 export SUBDIRS
 export TESTSOCK6
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2016-2018  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2016, 2017  Internet Systems Consortium, Inc. ("ISC")
 *
 * This Source Code Form is subject to the terms of the Mozilla Public
 * License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -45,7 +45,6 @@ usage() {
 	fprintf(stderr, "	--rpz-nsdname\n");
 	fprintf(stderr, "	--rpz-nsip\n");
 	fprintf(stderr, "	--with-idn\n");
-	fprintf(stderr, "	--with-lmdb\n");
 }

 int
@@ -157,14 +156,6 @@ main(int argc, char **argv) {
 #endif
 	}

-	if (strcmp(argv[1], "--with-lmdb") == 0) {
-#ifdef HAVE_LMDB
-		return (0);
-#else
-		return (1);
-#endif
-	}
-
 	if (strcmp(argv[1], "--ipv6only=no") == 0) {
 #ifdef WIN32
 		return (0);
@@ -15,10 +15,6 @@ rm -f ns1/root.db.signed
 rm -f ns2/bits.db
 rm -f ns2/bits.db.jnl
 rm -f ns1/signer.out
-rm -f ns2/inactiveksk.db
-rm -f ns2/inactiveksk.db.jnl
-rm -f ns2/inactivezsk.db
-rm -f ns2/inactivezsk.db.jnl
 rm -f ns2/retransfer.db
 rm -f ns2/retransfer.db.jnl
 rm -f ns2/retransfer3.db
@@ -48,14 +44,6 @@ rm -f ns3/expired.db
 rm -f ns3/expired.db.jnl
 rm -f ns3/expired.db.signed
 rm -f ns3/expired.db.signed.jnl
-rm -f ns3/inactiveksk.bk
-rm -f ns3/inactiveksk.bk.jnl
-rm -f ns3/inactiveksk.bk.signed
-rm -f ns3/inactiveksk.bk.signed.jnl
-rm -f ns3/inactivezsk.bk
-rm -f ns3/inactivezsk.bk.jnl
-rm -f ns3/inactivezsk.bk.signed
-rm -f ns3/inactivezsk.bk.signed.jnl
 rm -f ns3/nsec3.db
 rm -f ns3/nsec3.db.jnl
 rm -f ns3/nsec3.db.signed
@@ -1,4 +1,4 @@
-; Copyright (C) 2011-2013, 2016, 2017  Internet Systems Consortium, Inc. ("ISC")
+; Copyright (C) 2011-2013, 2016  Internet Systems Consortium, Inc. ("ISC")
 ;
 ; This Source Code Form is subject to the terms of the Mozilla Public
 ; License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -48,9 +48,3 @@ ns3.externalkey.	A	10.53.0.3

 retransfer3.		NS	ns3.retransfer.
 ns3.retransfer3.	A	10.53.0.3
-
-inactiveksk.		NS	ns3.inactiveksk.
-ns3.inactiveksk.	A	10.53.0.3
-
-inactivezsk.		NS	ns3.inactivezsk.
-ns3.inactivezsk.	A	10.53.0.3
@@ -53,15 +53,3 @@ zone "nsec3-loop" {
 	file "nsec3-loop.db";
 	notify no;
 };
-
-zone "inactiveksk" {
-	type master;
-	file "inactiveksk.db";
-	allow-update { any; };
-};
-
-zone "inactivezsk" {
-	type master;
-	file "inactivezsk.db";
-	allow-update { any; };
-};
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2011-2013, 2015-2017  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2011-2013, 2015, 2016  Internet Systems Consortium, Inc. ("ISC")
 *
 * This Source Code Form is subject to the terms of the Mozilla Public
 * License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -112,20 +112,3 @@ zone "retransfer3" {
 	auto-dnssec maintain;
 	file "retransfer3.bk";
 };
-
-zone "inactiveksk" {
-	type slave;
-	masters { 10.53.0.2; };
-	inline-signing yes;
-	auto-dnssec maintain;
-	dnssec-dnskey-kskonly yes;
-	file "inactiveksk.bk";
-};
-
-zone "inactivezsk" {
-	type slave;
-	masters { 10.53.0.2; };
-	inline-signing yes;
-	auto-dnssec maintain;
-	file "inactivezsk.bk";
-};
@@ -75,24 +75,6 @@ keyname=`$KEYGEN -q -r $RANDFILE -a NSEC3RSASHA1 -b 1024 -n zone $zone`
 keyname=`$KEYGEN -q -r $RANDFILE -a NSEC3RSASHA1 -b 1024 -n zone -f KSK $zone`
 $DSFROMKEY -T 1200 $keyname >> ../ns1/root.db

-zone=inactiveksk
-rm -f K${zone}.+*+*.key
-rm -f K${zone}.+*+*.private
-keyname=`$KEYGEN -q -r $RANDFILE -a NSEC3RSASHA1 -b 1024 -n zone $zone`
-keyname=`$KEYGEN -q -r $RANDFILE -a NSEC3RSASHA1 -b 1024 -n zone -P now -A now+3600 -f KSK $zone`
-keyname=`$KEYGEN -q -r $RANDFILE -a RSASHA256 -b 1024 -n zone $zone`
-keyname=`$KEYGEN -q -r $RANDFILE -a RSASHA256 -b 1024 -n zone -f KSK $zone`
-$DSFROMKEY -T 1200 $keyname >> ../ns1/root.db
-
-zone=inactivezsk
-rm -f K${zone}.+*+*.key
-rm -f K${zone}.+*+*.private
-keyname=`$KEYGEN -q -r $RANDFILE -a NSEC3RSASHA1 -b 1024 -n zone -P now -A now+3600 $zone`
-keyname=`$KEYGEN -q -r $RANDFILE -a NSEC3RSASHA1 -b 1024 -n zone -f KSK $zone`
-keyname=`$KEYGEN -q -r $RANDFILE -a RSASHA256 -b 1024 -n zone $zone`
-keyname=`$KEYGEN -q -r $RANDFILE -a RSASHA256 -b 1024 -n zone -f KSK $zone`
-$DSFROMKEY -T 1200 $keyname >> ../ns1/root.db
-
 for s in a c d h k l m q z
 do
 	zone=test-$s
@@ -16,8 +16,6 @@ rm -f ns1/root.db.signed

 touch ns2/trusted.conf
 cp ns2/bits.db.in ns2/bits.db
-cp ns2/bits.db.in ns2/inactiveksk.db
-cp ns2/bits.db.in ns2/inactivezsk.db
 cp ns2/bits.db.in ns2/retransfer.db
 cp ns2/bits.db.in ns2/retransfer3.db
 rm -f ns2/bits.db.jnl
@@ -6,6 +6,8 @@
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.

+# $Id: tests.sh,v 1.18 2012/02/23 06:53:15 marka Exp $
+
 SYSTEMTESTTOP=..
 . $SYSTEMTESTTOP/conf.sh

@@ -1020,69 +1022,5 @@ serial=`awk '$4 == "SOA" { print $7 }' dig.out.ns2.post.test$n`
 if [ $ret != 0 ]; then echo "I:failed"; fi
 status=`expr $status + $ret`

-n=`expr $n + 1`
-echo "I:testing that inline signing works with inactive ZSK and active KSK ($n)"
-ret=0
-
-$DIG $DIGOPTS @10.53.0.3 -p 5300 soa inactivezsk  > dig.out.ns3.pre.test$n || ret=1
-soa1=`awk '$4 == "SOA" { print $7 }' dig.out.ns3.pre.test$n`
-
-$NSUPDATE << EOF
-server 10.53.0.2 5300
-update add added.inactivezsk 0 IN TXT added record
-send
-EOF
-
-for i in 1 2 3 4 5 6 7 8 9 10
-do
-    $DIG $DIGOPTS @10.53.0.3 -p 5300 soa inactivezsk  > dig.out.ns3.post.test$n || ret=1
-    soa2=`awk '$4 == "SOA" { print $7 }' dig.out.ns3.post.test$n`
-    test ${soa1:-0} -ne ${soa2:-0} && break
-    sleep 1
-done
-test ${soa1:-0} -ne ${soa2:-0} || ret=1
-
-$DIG $DIGOPTS @10.53.0.3 -p 5300 txt added.inactivezsk > dig.out.ns3.test$n || ret=1
-grep "ANSWER: 3," dig.out.ns3.test$n > /dev/null || ret=1
-grep "RRSIG" dig.out.ns3.test$n > /dev/null || ret=1
-grep "TXT 7 2" dig.out.ns3.test$n > /dev/null || ret=1
-grep "TXT 8 2" dig.out.ns3.test$n > /dev/null || ret=1
-
-if [ $ret != 0 ]; then echo "I:failed"; fi
-status=`expr $status + $ret`
-
-n=`expr $n + 1`
-echo "I:testing that inline signing works with inactive KSK and active ZSK ($n)"
-ret=0
-
-$DIG $DIGOPTS @10.53.0.3 -p 5300 axfr inactiveksk > dig.out.ns3.test$n
-
-#
-#  check that DNSKEY is signed with ZSK for algorithm 7
-#
-awk='$4 == "DNSKEY" && $5 == 256 && $7 == 7 { print }'
-zskid=`awk "${awk}" dig.out.ns3.test$n |
-       $DSFROMKEY -A -2 -f - inactiveksk | awk '{ print $4}' `
-grep "DNSKEY 7 1 [0-9]* [0-9]* [0-9]* ${zskid} " dig.out.ns3.test$n > /dev/null || ret=1
-awk='$4 == "DNSKEY" && $5 == 257 && $7 == 7 { print }'
-kskid=`awk "${awk}" dig.out.ns3.test$n |
-       $DSFROMKEY -2 -f - inactiveksk | awk '{ print $4}' `
-grep "DNSKEY 7 1 [0-9]* [0-9]* [0-9]* ${kskid} " dig.out.ns3.test$n > /dev/null && ret=1
-
-#
-#  check that DNSKEY is signed with KSK for algorithm 8
-#
-awk='$4 == "DNSKEY" && $5 == 256 && $7 == 8 { print }'
-zskid=`awk "${awk}" dig.out.ns3.test$n |
-       $DSFROMKEY -A -2 -f - inactiveksk | awk '{ print $4}' `
-grep "DNSKEY 8 1 [0-9]* [0-9]* [0-9]* ${zskid} " dig.out.ns3.test$n > /dev/null && ret=1
-awk='$4 == "DNSKEY" && $5 == 257 && $7 == 8 { print }'
-kskid=`awk "${awk}" dig.out.ns3.test$n |
-       $DSFROMKEY -2 -f - inactiveksk | awk '{ print $4}' `
-grep "DNSKEY 8 1 [0-9]* [0-9]* [0-9]* ${kskid} " dig.out.ns3.test$n > /dev/null || ret=1
-
-if [ $ret != 0 ]; then echo "I:failed"; fi
-status=`expr $status + $ret`
-
 echo "I:exit status: $status"
 [ $status -eq 0 ] || exit 1
@@ -35,19 +35,6 @@ PIDFILE="${THISDIR}/${CONFDIR}/named.pid"
 myRNDC="$RNDC -c ${THISDIR}/${CONFDIR}/rndc.conf"
 myNAMED="$NAMED -c ${THISDIR}/${CONFDIR}/named.conf -m record,size,mctx -T clienttest -T nosyslog -d 99 -X named.lock -U 4"

-# Test given condition.  If true, test again after a second.  Used for testing
-# filesystem-dependent conditions in order to prevent false negatives caused by
-# directory contents not being synchronized immediately after rename() returns.
-test_with_retry() {
-	if test "$@"; then
-		sleep 1
-		if test "$@"; then
-			return 0
-		fi
-	fi
-	return 1
-}
-
 waitforpidfile() {
 	for _w in 1 2 3 4 5 6 7 8 9 10
 	do
@@ -61,10 +48,9 @@ n=0

 cd $CONFDIR

-echo "I:testing log file validity (named -g + only plain files allowed)"
-
 n=`expr $n + 1`
-echo "I: testing plain file (named -g) ($n)"
+echo "I:testing log file validity (named -g + only plain files allowed) ($n)"
+
 # First run with a known good config.
 echo > $PLAINFILE
 cp $PLAINCONF named.conf
@@ -72,9 +58,9 @@ $myRNDC reconfig > rndc.out.test$n 2>&1
 grep "reloading configuration failed" named.run > /dev/null 2>&1
 if [ $? -ne 0 ]
 then
-	echo "I:  testing plain file succeeded"
+	echo "I: testing plain file succeeded"
 else
-	echo "I:  testing plain file failed (unexpected)"
+	echo "I: testing plain file failed (unexpected)"
 	echo "I:exit status: 1"
 	exit 1 
 fi
@@ -93,14 +79,14 @@ then
 	grep "checking logging configuration failed: invalid file" named.run > /dev/null 2>&1
 	if [ $? -ne 0 ]
 	then
-		echo "I:  testing directory as file succeeded (UNEXPECTED)"
+		echo "I: testing directory as file succeeded (UNEXPECTED)"
 		echo "I:exit status: 1"
 		exit 1
 	else
-		echo "I:  testing directory as log file failed (expected)"
+		echo "I: testing directory as log file failed (expected)"
 	fi
 else
-	echo "I:  skipping directory test (unable to create directory)"
+	echo "I: skipping directory test (unable to create directory)"
 fi

 # Now try pipe file, expect failure
@@ -117,14 +103,14 @@ then
 	grep "checking logging configuration failed: invalid file" named.run  > /dev/null 2>&1
 	if [ $? -ne 0 ]
 	then
-		echo "I:  testing pipe file as log file succeeded (UNEXPECTED)"
+		echo "I: testing pipe file as log file succeeded (UNEXPECTED)"
 		echo "I:exit status: 1"
 		exit 1
 	else
-		echo "I:  testing pipe file as log file failed (expected)"
+		echo "I: testing pipe file as log file failed (expected)"
 	fi
 else
-	echo "I:  skipping pipe test (unable to create pipe)"
+	echo "I: skipping pipe test (unable to create pipe)"
 fi

 # Now try symlink file to plain file, expect success 
@@ -143,14 +129,14 @@ then
 	grep "reloading configuration failed" named.run > /dev/null 2>&1
 	if [ $? -ne 0 ]
 	then
-		echo "I:  testing symlink to plain file succeeded"
+		echo "I: testing symlink to plain file succeeded"
 	else
-		echo "I:  testing symlink to plain file failed (unexpected)"
+		echo "I: testing symlink to plain file failed (unexpected)"
 		echo "I:exit status: 1"
 		exit 1
 	fi
 else
-	echo "I:  skipping symlink test (unable to create symlink)"
+	echo "I: skipping symlink test (unable to create symlink)"
 fi
 # Stop the server and run through a series of tests with various config
 # files while controlling the stop/start of the server.
@@ -169,10 +155,9 @@ fi

 status=0

-echo "I:testing log file validity (only plain files allowed)"
-
 n=`expr $n + 1`
-echo "I: testing plain file (named -g) ($n)"
+echo "I:testing log file validity (only plain files allowed) ($n)"
+
 # First run with a known good config.
 echo > $PLAINFILE
 cp $PLAINCONF named.conf
@@ -180,9 +165,9 @@ $myRNDC reconfig > rndc.out.test$n 2>&1
 grep "reloading configuration failed" named.run > /dev/null 2>&1
 if [ $? -ne 0 ]
 then
-	echo "I:  testing plain file succeeded"
+	echo "I: testing plain file succeeded"
 else
-	echo "I:  testing plain file failed (unexpected)"
+	echo "I: testing plain file failed (unexpected)"
 	echo "I:exit status: 1"
 	exit 1 
 fi
@@ -201,14 +186,14 @@ then
 	grep "configuring logging: invalid file" named.run > /dev/null 2>&1
 	if [ $? -ne 0 ]
 	then
-		echo "I:  testing directory as file succeeded (UNEXPECTED)"
+		echo "I: testing directory as file succeeded (UNEXPECTED)"
 		echo "I:exit status: 1"
 		exit 1
 	else
-		echo "I:  testing directory as log file failed (expected)"
+		echo "I: testing directory as log file failed (expected)"
 	fi
 else
-	echo "I:  skipping directory test (unable to create directory)"
+	echo "I: skipping directory test (unable to create directory)"
 fi

 # Now try pipe file, expect failure
@@ -225,14 +210,14 @@ then
 	grep "configuring logging: invalid file" named.run  > /dev/null 2>&1
 	if [ $? -ne 0 ]
 	then
-		echo "I:  testing pipe file as log file succeeded (UNEXPECTED)"
+		echo "I: testing pipe file as log file succeeded (UNEXPECTED)"
 		echo "I:exit status: 1"
 		exit 1
 	else
-		echo "I:  testing pipe file as log file failed (expected)"
+		echo "I: testing pipe file as log file failed (expected)"
 	fi
 else
-	echo "I:  skipping pipe test (unable to create pipe)"
+	echo "I: skipping pipe test (unable to create pipe)"
 fi

 # Now try symlink file to plain file, expect success 
@@ -252,18 +237,18 @@ then
 	grep "reloading configuration failed" named.run > /dev/null 2>&1
 	if [ $? -ne 0 ]
 	then
-		echo "I:  testing symlink to plain file succeeded"
+		echo "I: testing symlink to plain file succeeded"
 	else
-		echo "I:  testing symlink to plain file failed (unexpected)"
+		echo "I: testing symlink to plain file failed (unexpected)"
 		echo "I:exit status: 1"
 		exit 1
 	fi
 else
-	echo "I:  skipping symlink test (unable to create symlink)"
+	echo "I: skipping symlink test (unable to create symlink)"
 fi

 n=`expr $n + 1`
-echo "I:testing default logfile using named -L file ($n)"
+echo "I: testing default logfile using named -L file ($n)"
 # Now stop the server again and test the -L option
 rm -f $DLFILE
 $PERL ../../stop.pl .. ns1
@@ -271,7 +256,7 @@ if ! test -f $PIDFILE; then
 	cp $PLAINCONF named.conf
 	$myNAMED -L $DLFILE > /dev/null 2>&1
 	if [ $? -ne 0 ]; then
-		echo "I: failed to start $myNAMED"
+		echo "I:failed to start $myNAMED"
 		echo "I:exit status: $status"
 		exit $status
 	fi
@@ -287,7 +272,7 @@ if ! test -f $PIDFILE; then
 		exit 1
 	fi
 else
-	echo "I: failed to cleanly stop $myNAMED"
+	echo "I:failed to cleanly stop $myNAMED"
 	echo "I:exit status: 1"
 	exit 1
 fi
@@ -299,9 +284,9 @@ echo "I: testing iso8601 timestamp ($n)"
 cp $ISOCONF named.conf
 $myRNDC reconfig > rndc.out.test$n 2>&1
 if grep '^....-..-..T..:..:..\.... ' $ISOFILE > /dev/null; then
-	echo "I:  testing iso8601 timestamp succeeded"
+	echo "I: testing iso8601 timestamp succeeded"
 else
-	echo "I:  testing iso8601 timestamp failed"
+	echo "I: testing iso8601 timestamp failed"
 	status=`expr $status + 1`
 fi

@@ -310,14 +295,14 @@ echo "I: testing iso8601-utc timestamp ($n)"
 cp $ISOCONFUTC named.conf
 $myRNDC reconfig > rndc.out.test$n 2>&1
 if grep '^....-..-..T..:..:..\....Z' $ISOUTCFILE > /dev/null; then
-	echo "I:  testing iso8601-utc timestamp succeeded"
+	echo "I: testing iso8601-utc timestamp succeeded"
 else
-	echo "I:  testing iso8601-utc timestamp failed"
+	echo "I: testing iso8601-utc timestamp failed"
 	status=`expr $status + 1`
 fi

 n=`expr $n + 1`
-echo "I: testing explicit versions ($n)"
+echo "I: testing explict versions ($n)"
 cp $VERSCONF named.conf
 # a seconds since epoch version number
 touch $VERSFILE.1480039317
@@ -328,27 +313,27 @@ t2=`$PERL -e 'print time()."\n";'`
 t=`expr ${t2:-0} - ${t1:-0}`
 if test ${t:-1000} -gt 5
 then
-        echo "I:  testing explicit versions failed: cleanup of old entries took too long ($t secs)"
+        echo "I: testing explict versions failed cleanup of old entries took too long ($t secs)"
 	status=`expr $status + 1`
 fi 
 if ! grep "status: NOERROR" dig.out.test$n > /dev/null
 then
-	echo "I:  testing explicit versions failed: DiG lookup failed"
+	echo "I: testing explict versions failed DiG lookup failed"
 	status=`expr $status + 1`
 fi
-if test_with_retry -f $VERSFILE.1480039317
+if test -f $VERSFILE.1480039317
 then
-	echo "I:  testing explicit versions failed: $VERSFILE.1480039317 not removed"
+	echo "I: testing explict versions failed $VERSFILE.1480039317 not removed"
 	status=`expr $status + 1`
 fi
-if test_with_retry -f $VERSFILE.5
+if test -f $VERSFILE.5
 then
-	echo "I:  testing explicit versions failed: $VERSFILE.5 exists"
+	echo "I: testing explict versions failed $VERSFILE.5 exists"
 	status=`expr $status + 1`
 fi
-if test_with_retry ! -f $VERSFILE.4
+if test ! -f $VERSFILE.4
 then
-	echo "I:  testing explicit versions failed: $VERSFILE.4 does not exist"
+	echo "I: testing explict versions failed $VERSFILE.4 does not exist"
 	status=`expr $status + 1`
 fi

@@ -364,17 +349,17 @@ t2=`$PERL -e 'print time()."\n";'`
 t=`expr ${t2:-0} - ${t1:-0}`
 if test ${t:-1000} -gt 5
 then
-        echo "I:  testing timestamped versions failed: cleanup of old entries took too long ($t secs)"
+        echo "I:  testing timestamped versions failed cleanup of old entries took too long ($t secs)"
 	status=`expr $status + 1`
 fi 
 if ! grep "status: NOERROR" dig.out.test$n > /dev/null
 then
-	echo "I:  testing timestamped versions failed: DiG lookup failed"
+	echo "I:  testing timestamped versions failed DiG lookup failed"
 	status=`expr $status + 1`
 fi
-if test_with_retry -f $TSFILE.1480039317
+if test -f $TSFILE.1480039317
 then
-	echo "I:  testing timestamped versions failed: $TSFILE.1480039317 not removed"
+	echo "I:  testing timestamped versions failed $TSFILE.1480039317 not removed"
 	status=`expr $status + 1`
 fi

@@ -390,22 +375,22 @@ t2=`$PERL -e 'print time()."\n";'`
 t=`expr ${t2:-0} - ${t1:-0}`
 if test ${t:-1000} -gt 5
 then
-        echo "I:  testing unlimited versions failed: took too long ($t secs)"
+        echo "I: testing unlimited versions failed took too long ($t secs)"
 	status=`expr $status + 1`
 fi 
 if ! grep "status: NOERROR" dig.out.test$n > /dev/null
 then
-	echo "I:  testing unlimited versions failed: DiG lookup failed"
+	echo "I: testing unlimited versions failed DiG lookup failed"
 	status=`expr $status + 1`
 fi
-if test_with_retry ! -f $UNLIMITEDFILE.1480039317
+if test ! -f $UNLIMITEDFILE.1480039317
 then
-	echo "I:  testing unlimited versions failed: $UNLIMITEDFILE.1480039317 removed"
+	echo "I: testing unlimited versions failed $UNLIMITEDFILE.1480039317 removed"
 	status=`expr $status + 1`
 fi
-if test_with_retry ! -f $UNLIMITEDFILE.4
+if test ! -f $UNLIMITEDFILE.4
 then
-	echo "I:  testing unlimited versions failed: $UNLIMITEDFILE.4 does not exist"
+	echo "I: testing unlimited versions failed $UNLIMITEDFILE.4 does not"
 	status=`expr $status + 1`
 fi

@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# Copyright (C) 2005, 2007, 2011-2014, 2016, 2017  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2005, 2007, 2011-2014, 2016  Internet Systems Consortium, Inc. ("ISC")
 #
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -238,16 +238,6 @@ done
 [ $ret -eq 0 ] || echo "I:failed"
 status=`expr $status + $ret`

-# stomp on the file header
-echo "I:checking corrupt map files fail to load (bad file header)"
-ret=0
-./named-compilezone -D -f text -F map -o map.5 example.nil baseline.txt > /dev/null
-cp map.5 badmap
-stomp badmap 0 32 99
-./named-compilezone -D -f map -F text -o text.5 example.nil badmap > /dev/null
-[ $? = 1 ] || ret=1
-[ $ret -eq 0 ] || echo "I:failed"
-status=`expr $status + $ret`
 # stomp on the file data so it hashes differently.
 # these are small and subtle changes, so that the resulting file
 # would appear to be a legitimate map file and would not trigger an
@@ -255,6 +245,7 @@ status=`expr $status + $ret`
 # load because of a SHA1 hash mismatch.
 echo "I:checking corrupt map files fail to load (bad node header)"
 ret=0
+./named-compilezone -D -f text -F map -o map.5 example.nil baseline.txt > /dev/null
 cp map.5 badmap
 stomp badmap 2754 2 99
 ./named-compilezone -D -f map -F text -o text.5 example.nil badmap > /dev/null
@@ -16,8 +16,16 @@ is used so it will send TAT queries once per second.

 ns3 is a validator with a broken key in managed-keys.

-ns4 is a validator with a deliberately broken managed-keys.bind and
-managed-keys.jnl, causing RFC 5011 initialization to fail.
+Tests TODO:

-ns5 is a validator which is prevented from getting a response from the
-root server, causing key refresh queries to fail.
+- initial working KSK
+
+TODO: test using delv with new trusted key too
+
+- introduce a REVOKE bit
+
+- later remove a signature
+
+- corrupt a signature
+
+TODO: also same things with dlv auto updates of trust anchor
@@ -10,10 +10,8 @@ rm -f */K* */*.signed */trusted.conf */*.jnl */*.bk
 rm -f dsset-. ns1/dsset-.
 rm -f ns*/named.lock
 rm -f */managed-keys.bind* */named.secroots
-rm -f */managed*.conf ns1/managed.key ns1/managed.key.id
-rm -f */named.memstats */named.run */named.run.prev
+rm -f */managed.conf ns1/managed.key ns1/managed.key.id
+rm -f */named.memstats */named.run
 rm -f dig.out* delv.out* rndc.out* signer.out*
 rm -f ns1/named.secroots ns1/root.db.signed* ns1/root.db.tmp
 rm -f ns1/named.conf
-rm -rf ns4/nope
-rm -f ns5/named.args
@@ -10,11 +10,6 @@

 controls { /* empty */ };

-acl allowed {
-	! 10.53.0.5;
-	any;
-};
-
 options {
 	query-source address 10.53.0.1;
 	notify-source 10.53.0.1;
@@ -27,7 +22,6 @@ options {
 	notify no;
 	dnssec-enable yes;
 	dnssec-validation yes;
-	allow-query { allowed; };
 };

 key rndc_key {
@@ -10,11 +10,6 @@

 controls { /* empty */ };

-acl allowed {
-	! 10.53.0.5;
-	any;
-};
-
 options {
 	query-source address 10.53.0.1;
 	notify-source 10.53.0.1;
@@ -27,7 +22,6 @@ options {
 	notify no;
 	dnssec-enable yes;
 	dnssec-validation yes;
-	allow-query { allowed; };
 };

 key rndc_key {
@@ -1,39 +0,0 @@
-/*
- * Copyright (C) 2017  Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- */
-
-// NS1
-
-controls { /* empty */ };
-
-options {
-	query-source address 10.53.0.1;
-	notify-source 10.53.0.1;
-	transfer-source 10.53.0.1;
-	port 5300;
-	pid-file "named.pid";
-	listen-on { 10.53.0.1; };
-	listen-on-v6 { none; };
-	recursion no;
-	notify no;
-	dnssec-enable yes;
-	dnssec-validation yes;
-};
-
-key rndc_key {
-	secret "1234abcd8765";
-	algorithm hmac-sha256;
-};
-
-controls {
-	inet 10.53.0.1 port 9953 allow { any; } keys { rndc_key; };
-};
-
-zone "." {
-	type master;
-	file "root.db.signed";
-};
@@ -1,10 +1,10 @@
-; Copyright (C) 2015-2017  Internet Systems Consortium, Inc. ("ISC")
+; Copyright (C) 2015, 2016  Internet Systems Consortium, Inc. ("ISC")
 ;
 ; This Source Code Form is subject to the terms of the Mozilla Public
 ; License, v. 2.0. If a copy of the MPL was not distributed with this
 ; file, You can obtain one at http://mozilla.org/MPL/2.0/.

-$TTL 20
+$TTL 2
 . 			IN SOA	gson.nominum.com. a.root.servers.nil. (
 				2000042100   	; serial
 				600         	; refresh
@@ -28,8 +28,6 @@ managed-keys {
 EOF
 ' > managed.conf
 cp managed.conf ../ns2/managed.conf
-cp managed.conf ../ns4/managed.conf
-cp managed.conf ../ns5/managed.conf

 # Configure a trusted key statement (used by delve)
 cat $keyname.key | grep -v '^; ' | $PERL -n -e '
@@ -1 +1 @@
-m record,size,mctx -T clienttest -c named.conf -d 99 -X named.lock -g -T mkeytimers=5/10/20 -T tat=1
+-m record,size,mctx -T clienttest -c named.conf -d 99 -X named.lock -g -T mkeytimers=2/20/40
@@ -1 +1 @@
-m record,size,mctx -T clienttest -c named.conf -d 99 -X named.lock -g -T mkeytimers=5/10/20
+-m record,size,mctx -T clienttest -c named.conf -d 99 -X named.lock -g -T mkeytimers=2/20/40 -T tat=1
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2015-2017  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2015, 2016  Internet Systems Consortium, Inc. ("ISC")
 *
 * This Source Code Form is subject to the terms of the Mozilla Public
 * License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -23,7 +23,6 @@ options {
 	dnssec-enable yes;
 	dnssec-validation yes;
 	bindkeys-file "managed.conf";
-	trust-anchor-telemetry no;
 };

 key rndc_key {
@@ -1,41 +0,0 @@
-/*
- * Copyright (C) 2017  Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- */
-
-// NS4
-
-controls { /* empty */ };
-
-options {
-	query-source address 10.53.0.4;
-	notify-source 10.53.0.4;
-	transfer-source 10.53.0.4;
-	port 5300;
-	pid-file "named.pid";
-	listen-on { 10.53.0.4; };
-	listen-on-v6 { none; };
-	recursion yes;
-	notify no;
-	dnssec-enable yes;
-	dnssec-validation auto;
-	bindkeys-file "managed.conf";
-	managed-keys-directory "nope";
-};
-
-key rndc_key {
-	secret "1234abcd8765";
-	algorithm hmac-sha256;
-};
-
-controls {
-	inet 10.53.0.4 port 9953 allow { any; } keys { rndc_key; };
-};
-
-zone "." {
-	type hint;
-	file "../../common/root.hint";
-};
@@ -1,38 +0,0 @@
-/*
- * Copyright (C) 2017  Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- */
-
-// NS5
-
-options {
-	query-source address 10.53.0.5;
-	notify-source 10.53.0.5;
-	transfer-source 10.53.0.5;
-	port 5300;
-	pid-file "named.pid";
-	listen-on { 10.53.0.5; };
-	listen-on-v6 { none; };
-	recursion yes;
-	notify no;
-	dnssec-enable yes;
-	dnssec-validation auto;
-	bindkeys-file "managed.conf";
-};
-
-key rndc_key {
-	secret "1234abcd8765";
-	algorithm hmac-sha256;
-};
-
-controls {
-	inet 10.53.0.5 port 9953 allow { any; } keys { rndc_key; };
-};
-
-zone "." {
-	type hint;
-	file "../../common/root.hint";
-};
@@ -1 +0,0 @@
-m record,size,mctx -T clienttest -c named.conf -d 99 -X named.lock -g
@@ -1 +0,0 @@
-m record,size,mctx -T clienttest -c named.conf -d 99 -X named.lock -g -T mkeytimers=2/20/40
@@ -14,14 +14,5 @@ $SHELL clean.sh
 test -r $RANDFILE || $GENRANDOM 800 $RANDFILE

 cp ns1/named1.conf ns1/named.conf
-cp ns5/named1.args ns5/named.args

-( cd ns1 && $SHELL sign.sh )
-
-cp ns2/managed.conf ns2/managed1.conf
-
-cd ns4
-mkdir nope
-touch nope/managed-keys.bind
-touch nope/managed.keys.bind.jnl
-chmod 444 nope/*
+cd ns1 && $SHELL sign.sh
@@ -9,74 +9,6 @@
 SYSTEMTESTTOP=..
 . $SYSTEMTESTTOP/conf.sh

-wait_for_log() {
-	msg=$1
-	file=$2
-	for i in 1 2 3 4 5 6 7 8 9 10; do
-		nextpart "$file" | grep "$msg" > /dev/null && return
-		sleep 1
-	done
-	echo "I: exceeded time limit waiting for '$msg' in $file"
-	ret=1
-}
-
-mkeys_reconfig_on() {
-	nsidx=$1
-	$RNDC -c ../common/rndc.conf -s 10.53.0.${nsidx} -p 9953 reconfig . | sed "s/^/I: ns${nsidx} /"
-}
-
-mkeys_reload_on() {
-	nsidx=$1
-	nextpart ns${nsidx}/named.run > /dev/null
-	$RNDC -c ../common/rndc.conf -s 10.53.0.${nsidx} -p 9953 reload . | sed "s/^/I: ns${nsidx} /"
-	wait_for_log "loaded serial" ns${nsidx}/named.run
-}
-
-mkeys_loadkeys_on() {
-	nsidx=$1
-	nextpart ns${nsidx}/named.run > /dev/null
-	$RNDC -c ../common/rndc.conf -s 10.53.0.${nsidx} -p 9953 loadkeys . | sed "s/^/I: ns${nsidx} /"
-	wait_for_log "next key event" ns${nsidx}/named.run
-}
-
-mkeys_refresh_on() {
-	nsidx=$1
-	nextpart ns${nsidx}/named.run > /dev/null
-	$RNDC -c ../common/rndc.conf -s 10.53.0.${nsidx} -p 9953 managed-keys refresh | sed "s/^/I: ns${nsidx} /"
-	wait_for_log "Returned from key fetch in keyfetch_done()" ns${nsidx}/named.run
-}
-
-mkeys_sync_on() {
-	# No race with mkeys_refresh_on() is possible as even if the latter
-	# returns immediately after the expected log message is written, the
-	# managed-keys zone is already locked and the command below calls
-	# dns_zone_flush(), which also attempts to take that zone's lock
-	nsidx=$1
-	nextpart ns${nsidx}/named.run > /dev/null
-	$RNDC -c ../common/rndc.conf -s 10.53.0.${nsidx} -p 9953 managed-keys sync | sed "s/^/I: ns${nsidx} /"
-	wait_for_log "dump_done" ns${nsidx}/named.run
-}
-
-mkeys_status_on() {
-	# No race with mkeys_refresh_on() is possible as even if the latter
-	# returns immediately after the expected log message is written, the
-	# managed-keys zone is already locked and the command below calls
-	# mkey_status(), which in turn calls dns_zone_getrefreshkeytime(),
-	# which also attempts to take that zone's lock
-	nsidx=$1
-	$RNDC -c ../common/rndc.conf -s 10.53.0.${nsidx} -p 9953 managed-keys status
-}
-
-mkeys_flush_on() {
-	nsidx=$1
-	$RNDC -c ../common/rndc.conf -s 10.53.0.${nsidx} -p 9953 flush | sed "s/^/I: ns${nsidx} /"
-}
-
-mkeys_secroots_on() {
-	nsidx=$1
-	$RNDC -c ../common/rndc.conf -s 10.53.0.${nsidx} -p 9953 secroots | sed "s/^/I: ns${nsidx} /"
-}
-
 status=0
 n=1

@@ -126,9 +58,11 @@ n=`expr $n + 1`
 echo "I: check new trust anchor can be added ($n)"
 ret=0
 standby1=`$KEYGEN -a rsasha256 -qfk -r $RANDFILE -K ns1 .`
-mkeys_loadkeys_on 1
-mkeys_refresh_on 2
-mkeys_status_on 2 > rndc.out.$n 2>&1
+$RNDC -c ../common/rndc.conf -s 10.53.0.1 -p 9953 loadkeys . | sed 's/^/I: ns1 /'
+sleep 5
+$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys refresh | sed 's/^/I: ns2 /'
+$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys sync | sed 's/^/I: ns2 /'
+$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys status > rndc.out.$n 2>&1
 # there should be two keys listed now
 count=`grep -c "keyid: " rndc.out.$n` 
 [ "$count" -eq 2 ] || ret=1
@@ -147,8 +81,10 @@ status=`expr $status + $ret`
 n=`expr $n + 1`
 echo "I: check new trust anchor can't be added with bad initial key ($n)"
 ret=0
-mkeys_refresh_on 3
-mkeys_status_on 3 > rndc.out.$n 2>&1
+$RNDC -c ../common/rndc.conf -s 10.53.0.3 -p 9953 managed-keys refresh | sed 's/^/I: ns3 /'
+sleep 1
+$RNDC -c ../common/rndc.conf -s 10.53.0.3 -p 9953 managed-keys sync | sed 's/^/I: ns3 /'
+$RNDC -c ../common/rndc.conf -s 10.53.0.3 -p 9953 managed-keys status > rndc.out.$n 2>&1
 # there should be one key listed now
 count=`grep -c "keyid: " rndc.out.$n` 
 [ "$count" -eq 1 ] || ret=1
@@ -164,17 +100,14 @@ status=`expr $status + $ret`
 n=`expr $n + 1`
 echo "I: remove untrusted standby key, check timer restarts ($n)"
 ret=0
-mkeys_sync_on 2
-t1=`grep "trust pending" ns2/managed-keys.bind`
 $SETTIME -D now -K ns1 $standby1 > /dev/null
-mkeys_loadkeys_on 1
-# Less than a second may have passed since the last time ns2 received a
-# ./DNSKEY response from ns1.  Ensure keys are refreshed at a different
-# timestamp to prevent false negatives caused by the acceptance timer getting
-# reset to the same timestamp.
+t1=`grep "trust pending" ns2/managed-keys.bind`
+$RNDC -c ../common/rndc.conf -s 10.53.0.1 -p 9953 loadkeys . | sed 's/^/I: ns1 /'
+sleep 3
+$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys refresh | sed 's/^/I: ns2 /'
+sleep 1
+$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys sync | sed 's/^/I: ns2 /'
 sleep 1
-mkeys_refresh_on 2
-mkeys_sync_on 2
 t2=`grep "trust pending" ns2/managed-keys.bind`
 # trust pending date must be different
 [ -n "$t2" ] || ret=1
@@ -188,15 +121,12 @@ echo "I: restore untrusted standby key, revoke original key ($n)"
 t1=$t2
 $SETTIME -D none -K ns1 $standby1 > /dev/null
 $SETTIME -R now -K ns1 `cat ns1/managed.key` > /dev/null
-mkeys_loadkeys_on 1
-# Less than a second may have passed since the last time ns2 received a
-# ./DNSKEY response from ns1.  Ensure keys are refreshed at a different
-# timestamp to prevent false negatives caused by the acceptance timer getting
-# reset to the same timestamp.
+$RNDC -c ../common/rndc.conf -s 10.53.0.1 -p 9953 loadkeys . | sed 's/^/I: ns1 /'
+sleep 3
+$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys refresh | sed 's/^/I: ns2 /'
 sleep 1
-mkeys_refresh_on 2
-mkeys_sync_on 2
-mkeys_status_on 2 > rndc.out.$n 2>&1
+$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys sync | sed 's/^/I: ns2 /'
+$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys status > rndc.out.$n 2>&1
 # two keys listed
 count=`grep -c "keyid: " rndc.out.$n` 
 [ "$count" -eq 2 ] || ret=1
@@ -223,14 +153,10 @@ n=`expr $n + 1`
 ret=0
 echo "I: refresh managed-keys, ensure same result ($n)"
 t1=$t2
-# Less than a second may have passed since the last time ns2 received a
-# ./DNSKEY response from ns1.  Ensure keys are refreshed at a different
-# timestamp to prevent false negatives caused by the acceptance timer getting
-# reset to the same timestamp.
-sleep 1
-mkeys_refresh_on 2
-mkeys_sync_on 2
-mkeys_status_on 2 > rndc.out.$n 2>&1
+sleep 2
+$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys refresh | sed 's/^/I: ns2 /'
+$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys sync | sed 's/^/I: ns2 /'
+$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys status > rndc.out.$n 2>&1
 # two keys listed
 count=`grep -c "keyid: " rndc.out.$n` 
 [ "$count" -eq 2 ] || ret=1
@@ -258,17 +184,15 @@ ret=0
 echo "I: restore revoked key, ensure same result ($n)"
 t1=$t2
 $SETTIME -R none -D now -K ns1 `cat ns1/managed.key` > /dev/null
-mkeys_loadkeys_on 1
+$RNDC -c ../common/rndc.conf -s 10.53.0.1 -p 9953 loadkeys . | sed 's/^/I: ns1 /'
+sleep 3
 $SETTIME -D none -K ns1 `cat ns1/managed.key` > /dev/null
-mkeys_loadkeys_on 1
-# Less than a second may have passed since the last time ns2 received a
-# ./DNSKEY response from ns1.  Ensure keys are refreshed at a different
-# timestamp to prevent false negatives caused by the acceptance timer getting
-# reset to the same timestamp.
+$RNDC -c ../common/rndc.conf -s 10.53.0.1 -p 9953 loadkeys . | sed 's/^/I: ns1 /'
+sleep 3
+$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys refresh | sed 's/^/I: ns2 /'
 sleep 1
-mkeys_refresh_on 2
-mkeys_sync_on 2
-mkeys_status_on 2 > rndc.out.$n 2>&1
+$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys sync | sed 's/^/I: ns2 /'
+$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys status > rndc.out.$n 2>&1
 # two keys listed
 count=`grep -c "keyid: " rndc.out.$n` 
 [ "$count" -eq 2 ] || ret=1
@@ -291,44 +215,17 @@ t2=`grep "trust pending" ns2/managed-keys.bind`
 if [ $ret != 0 ]; then echo "I:failed"; fi
 status=`expr $status + $ret`

-echo "I: reinitialize trust anchors, add second key to bind.keys"
+echo "I: reinitialize trust anchors"
 $PERL $SYSTEMTESTTOP/stop.pl --use-rndc . ns2
 rm -f ns2/managed-keys.bind*
-cat ns1/$standby1.key | grep -v '^; ' | $PERL -n -e '
-local ($dn, $class, $type, $flags, $proto, $alg, @rest) = split;
-local $key = join("", @rest);
-local $originalkey = `grep initial-key ns2/managed1.conf`;
-print <<EOF
-managed-keys {
-    $originalkey
-    "$dn" initial-key $flags $proto $alg "$key";
-};
-EOF
-' > ns2/managed.conf
-nextpart ns2/named.run > /dev/null
-$PERL $SYSTEMTESTTOP/start.pl --noclean --restart . ns2
-
-n=`expr $n + 1`
-echo "I: check that no key from bind.keys is marked as an initializing key ($n)"
-ret=0
-wait_for_log "Returned from key fetch in keyfetch_done()" ns2/named.run
-mkeys_secroots_on 2
-grep '; initializing' ns2/named.secroots > /dev/null 2>&1 && ret=1
-if [ $ret != 0 ]; then echo "I:failed"; fi
-status=`expr $status + $ret`
-
-echo "I: reinitialize trust anchors, revert to one key in bind.keys"
-$PERL $SYSTEMTESTTOP/stop.pl --use-rndc . ns2
-rm -f ns2/managed-keys.bind*
-mv ns2/managed1.conf ns2/managed.conf
-nextpart ns2/named.run > /dev/null
 $PERL $SYSTEMTESTTOP/start.pl --noclean --restart . ns2

 n=`expr $n + 1`
 echo "I: check that standby key is now trusted ($n)"
 ret=0
-wait_for_log "Returned from key fetch in keyfetch_done()" ns2/named.run
-mkeys_status_on 2 > rndc.out.$n 2>&1
+sleep 3
+$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys sync | sed 's/^/I: ns2 /'
+$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys status > rndc.out.$n 2>&1
 # two keys listed
 count=`grep -c "keyid: " rndc.out.$n` 
 [ "$count" -eq 2 ] || ret=1
@@ -346,9 +243,12 @@ echo "I: revoke original key, add new standby ($n)"
 ret=0
 standby2=`$KEYGEN -a rsasha256 -qfk -r $RANDFILE -K ns1 .`
 $SETTIME -R now -K ns1 `cat ns1/managed.key` > /dev/null
-mkeys_loadkeys_on 1
-mkeys_refresh_on 2
-mkeys_status_on 2 > rndc.out.$n 2>&1
+$RNDC -c ../common/rndc.conf -s 10.53.0.1 -p 9953 loadkeys . | sed 's/^/I: ns1 /'
+sleep 3
+$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys refresh | sed 's/^/I: ns2 /'
+sleep 1
+$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys sync | sed 's/^/I: ns2 /'
+$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys status > rndc.out.$n 2>&1
 # three keys listed
 count=`grep -c "keyid: " rndc.out.$n` 
 [ "$count" -eq 3 ] || ret=1
@@ -377,9 +277,11 @@ n=`expr $n + 1`
 echo "I: revoke standby before it is trusted ($n)"
 ret=0
 standby3=`$KEYGEN -a rsasha256 -qfk -r $RANDFILE -K ns1 .`
-mkeys_loadkeys_on 1
-mkeys_refresh_on 2
-mkeys_status_on 2 > rndc.out.a.$n 2>&1
+$RNDC -c ../common/rndc.conf -s 10.53.0.1 -p 9953 loadkeys . | sed 's/^/I: ns1 /'
+sleep 3
+$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys refresh | sed 's/^/I: ns2 /'
+sleep 1
+$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys status > rndc.out.a.$n 2>&1
 # four keys listed
 count=`grep -c "keyid: " rndc.out.a.$n` 
 [ "$count" -eq 4 ] || { echo "keyid: count ($count) != 4"; ret=1; }
@@ -390,9 +292,11 @@ count=`grep -c "trust revoked" rndc.out.a.$n`
 count=`grep -c "trust pending" rndc.out.a.$n` 
 [ "$count" -eq 2 ] || { echo "trust pending count ($count) != 2"; ret=1; }
 $SETTIME -R now -K ns1 $standby3 > /dev/null
-mkeys_loadkeys_on 1
-mkeys_refresh_on 2
-mkeys_status_on 2 > rndc.out.b.$n 2>&1
+$RNDC -c ../common/rndc.conf -s 10.53.0.1 -p 9953 loadkeys . | sed 's/^/I: ns1 /'
+sleep 3
+$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys refresh | sed 's/^/I: ns2 /'
+sleep 1
+$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys status > rndc.out.b.$n 2>&1
 # now three keys listed
 count=`grep -c "keyid: " rndc.out.b.$n` 
 [ "$count" -eq 3 ] || { echo "keyid: count ($count) != 3"; ret=1; }
@@ -403,16 +307,18 @@ count=`grep -c "trust revoked" rndc.out.b.$n`
 count=`grep -c "trust pending" rndc.out.b.$n` 
 [ "$count" -eq 1 ] || { echo "trust pending count ($count) != 1"; ret=1; }
 $SETTIME -D now -K ns1 $standby3 > /dev/null
-mkeys_loadkeys_on 1
+$RNDC -c ../common/rndc.conf -s 10.53.0.1 -p 9953 loadkeys . | sed 's/^/I: ns1 /'
 if [ $ret != 0 ]; then echo "I:failed"; fi
 status=`expr $status + $ret`

 n=`expr $n + 1`
-echo "I: wait 20 seconds for key add/remove holddowns to expire ($n)"
+echo "I: wait 30 seconds for key add/remove holddowns to expire ($n)"
 ret=0
-sleep 20
-mkeys_refresh_on 2
-mkeys_status_on 2 > rndc.out.$n 2>&1
+sleep 30
+$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys refresh | sed 's/^/I: ns2 /'
+sleep 1
+$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys sync | sed 's/^/I: ns2 /'
+$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys status > rndc.out.$n 2>&1
 # two keys listed
 count=`grep -c "keyid: " rndc.out.$n` 
 [ "$count" -eq 2 ] || ret=1
@@ -434,9 +340,12 @@ ret=0
 $SETTIME -D now -K ns1 `cat ns1/managed.key` > /dev/null
 $SETTIME -R now -K ns1 $standby1 > /dev/null
 $SETTIME -R now -K ns1 $standby2 > /dev/null
-mkeys_loadkeys_on 1
-mkeys_refresh_on 2
-mkeys_status_on 2 > rndc.out.$n 2>&1
+$RNDC -c ../common/rndc.conf -s 10.53.0.1 -p 9953 loadkeys . | sed 's/^/I: ns1 /'
+sleep 3
+$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys refresh | sed 's/^/I: ns2 /'
+sleep 1
+$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys sync | sed 's/^/I: ns2 /'
+$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys status > rndc.out.$n 2>&1
 # two keys listed
 count=`grep -c "keyid: " rndc.out.$n` 
 [ "$count" -eq 2 ] || ret=1
@@ -458,10 +367,8 @@ status=`expr $status + $ret`
 n=`expr $n + 1`
 echo "I: check for insecure response ($n)"
 ret=0
-mkeys_refresh_on 2
 $DIG $DIGOPTS +noauth example. @10.53.0.2 txt > dig.out.ns2.test$n || ret=1
 grep "status: NOERROR" dig.out.ns2.test$n > /dev/null || ret=1
-grep "flags:.*ad.*QUERY" dig.out.ns2.test$n > /dev/null && ret=1
 grep "example..*.RRSIG..*TXT" dig.out.ns2.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo "I:failed"; fi
 status=`expr $status + $ret`
@@ -473,18 +380,16 @@ $SETTIME -D now -K ns1 $standby2 > /dev/null
 $SIGNER -Sg -K ns1 -N unixtime -r $RANDFILE -o . ns1/root.db > /dev/null 2>&-
 cp ns1/named2.conf ns1/named.conf
 rm -f ns1/root.db.signed.jnl
-mkeys_reconfig_on 1
+$RNDC -c ../common/rndc.conf -s 10.53.0.1 -p 9953 reconfig

 echo "I: reinitialize trust anchors"
 $PERL $SYSTEMTESTTOP/stop.pl --use-rndc . ns2
 rm -f ns2/managed-keys.bind*
-nextpart ns2/named.run > /dev/null
 $PERL $SYSTEMTESTTOP/start.pl --noclean --restart . ns2

 n=`expr $n + 1`
 echo "I: check positive validation ($n)"
 ret=0
-wait_for_log "Returned from key fetch in keyfetch_done()" ns2/named.run
 $DIG $DIGOPTS +noauth example. @10.53.0.2 txt > dig.out.ns2.test$n || ret=1
 grep "flags:.*ad.*QUERY" dig.out.ns2.test$n > /dev/null || ret=1
 grep "example..*.RRSIG..*TXT" dig.out.ns2.test$n > /dev/null || ret=1
@@ -498,25 +403,17 @@ orig=`cat ns1/managed.key`
 keyid=`cat ns1/managed.key.id`
 revoked=`$REVOKE -K ns1 $orig`
 rkeyid=`expr $revoked : 'ns1/K\.+00.+0*\([1-9]*[0-9]*[0-9]\)'`
-rm -f ns1/root.db.signed.jnl
-# We need to activate at least one valid DNSKEY to prevent dnssec-signzone from
-# failing.  Alternatively, we could use -P to disable post-sign verification,
-# but we actually do want post-sign verification to happen to ensure the zone
-# is correct before we break it on purpose.
 $SETTIME -R none -D none -K ns1 $standby1 > /dev/null
 $SIGNER -Sg -K ns1 -N unixtime -r $RANDFILE -O full -o . -f signer.out.$n ns1/root.db > /dev/null 2>&-
 cp -f ns1/root.db.signed ns1/root.db.tmp
 BADSIG="SVn2tLDzpNX2rxR4xRceiCsiTqcWNKh7NQ0EQfCrVzp9WEmLw60sQ5kP xGk4FS/xSKfh89hO2O/H20Bzp0lMdtr2tKy8IMdU/mBZxQf2PXhUWRkg V2buVBKugTiOPTJSnaqYCN3rSfV1o7NtC1VNHKKK/D5g6bpDehdn5Gaq kpBhN+MSCCh9OZP2IT20luS1ARXxLlvuSVXJ3JYuuhTsQXUbX/SQpNoB Lo6ahCE55szJnmAxZEbb2KOVnSlZRA6ZBHDhdtO0S4OkvcmTutvcVV+7 w53CbKdaXhirvHIh0mZXmYk2PbPLDY7PU9wSH40UiWPOB9f00wwn6hUe uEQ1Qg=="
-# Less than a second may have passed since ns1 was started.  If we call
-# dnssec-signzone immediately, ns1/root.db.signed will not be reloaded by the
-# subsequent "rndc reload ." call on platforms which do not set the
-# "nanoseconds" field of isc_time_t, due to zone load time being seemingly
-# equal to master file modification time.
-sleep 1
 sed -e "/ $rkeyid \./s, \. .*$, . $BADSIG," signer.out.$n > ns1/root.db.signed
-mkeys_reload_on 1
-mkeys_refresh_on 2
-mkeys_status_on 2 > rndc.out.$n 2>&1
+$RNDC -c ../common/rndc.conf -s 10.53.0.1 -p 9953 reload . | sed 's/^/I: ns1 /'
+sleep 3
+$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys refresh | sed 's/^/I: ns2 /'
+sleep 1
+$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys sync | sed 's/^/I: ns2 /'
+$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys status > rndc.out.$n 2>&1
 # one key listed
 count=`grep -c "keyid: " rndc.out.$n` 
 [ "$count" -eq 1 ] || { echo "'keyid:' count ($count) != 1"; ret=1; }
@@ -537,7 +434,6 @@ status=`expr $status + $ret`
 n=`expr $n + 1`
 echo "I: check validation fails with bad DNSKEY rrset ($n)"
 ret=0
-mkeys_flush_on 2
 $DIG $DIGOPTS +noauth example. @10.53.0.2 txt > dig.out.ns2.test$n || ret=1
 grep "status: SERVFAIL" dig.out.ns2.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo "I:failed"; fi
@@ -547,18 +443,17 @@ n=`expr $n + 1`
 echo "I: restore DNSKEY rrset, check validation succeeds again ($n)"
 ret=0
 rm -f ${revoked}.key ${revoked}.private
-rm -f ns1/root.db.signed.jnl
 $SETTIME -D none -R none -K ns1 `cat ns1/managed.key` > /dev/null
 $SETTIME -D now -K ns1 $standby1 > /dev/null
-# Less than a second may have passed since ns1 was started.  If we call
-# dnssec-signzone immediately, ns1/root.db.signed will not be reloaded by the
-# subsequent "rndc reload ." call on platforms which do not set the
-# "nanoseconds" field of isc_time_t, due to zone load time being seemingly
-# equal to master file modification time.
+$SETTIME -D now -K ns1 $standby2 > /dev/null
+$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 flush | sed 's/^/I: ns1 /'
 sleep 1
 $SIGNER -Sg -K ns1 -N unixtime -r $RANDFILE -o . ns1/root.db > /dev/null 2>&-
-mkeys_reload_on 1
-mkeys_flush_on 2
+$RNDC -c ../common/rndc.conf -s 10.53.0.1 -p 9953 reload . | sed 's/^/I: ns1 /'
+sleep 3
+$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys refresh | sed 's/^/I: ns2 /'
+sleep 1
+$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys status > rndc.out.$n 2>&1
 $DIG $DIGOPTS +noauth example. @10.53.0.2 txt > dig.out.ns2.test$n || ret=1
 grep "flags:.*ad.*QUERY" dig.out.ns2.test$n > /dev/null || ret=1
 grep "example..*.RRSIG..*TXT" dig.out.ns2.test$n > /dev/null || ret=1
@@ -567,24 +462,15 @@ status=`expr $status + $ret`

 n=`expr $n + 1`
 echo "I: reset the root server with no keys, check for minimal update ($n)"
-ret=0
-# Refresh keys first to prevent previous checks from influencing this one.
-# Note that we might still get occasional false negatives on some really slow
-# machines, when $t1 equals $t2 due to the time elapsed between "rndc
-# managed-keys status" calls being equal to the normal active refresh period
-# (as calculated per rules listed in RFC 5011 section 2.3) minus an "hour" (as
-# set using -T mkeytimers).
-mkeys_refresh_on 2
-mkeys_status_on 2 > rndc.out.$n 2>&1
+$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys status > rndc.out.$n 2>&1
 t1=`grep 'next refresh:' rndc.out.$n`
 $PERL $SYSTEMTESTTOP/stop.pl --use-rndc . ns1
-rm -f ns1/root.db.signed.jnl
 cp ns1/root.db ns1/root.db.signed
-nextpart ns1/named.run > /dev/null
 $PERL $SYSTEMTESTTOP/start.pl --noclean --restart . ns1
-wait_for_log "loaded serial" ns1/named.run
-mkeys_refresh_on 2
-mkeys_status_on 2 > rndc.out.$n 2>&1
+sleep 3
+$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys refresh | sed 's/^/I: ns2 /'
+sleep 1
+$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys status > rndc.out.$n 2>&1
 # one key listed
 count=`grep -c "keyid: " rndc.out.$n` 
 [ "$count" -eq 1 ] || ret=1
@@ -606,23 +492,14 @@ status=`expr $status + $ret`

 n=`expr $n + 1`
 echo "I: reset the root server with no signatures, check for minimal update ($n)"
-ret=0
-# Refresh keys first to prevent previous checks from influencing this one
-mkeys_refresh_on 2
-mkeys_status_on 2 > rndc.out.$n 2>&1
-t1=`grep 'next refresh:' rndc.out.$n`
+t2=$t1
 $PERL $SYSTEMTESTTOP/stop.pl --use-rndc . ns1
-rm -f ns1/root.db.signed.jnl
 cat ns1/K*.key >> ns1/root.db.signed
-nextpart ns1/named.run > /dev/null
 $PERL $SYSTEMTESTTOP/start.pl --noclean --restart . ns1
-wait_for_log "loaded serial" ns1/named.run
-# Less than a second may have passed since the last time ns2 received a
-# ./DNSKEY response from ns1.  Ensure keys are refreshed at a different
-# timestamp to prevent minimal update from resetting it to the same timestamp.
+sleep 3
+$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys refresh | sed 's/^/I: ns2 /'
 sleep 1
-mkeys_refresh_on 2
-mkeys_status_on 2 > rndc.out.$n 2>&1
+$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys status > rndc.out.$n 2>&1
 # one key listed
 count=`grep -c "keyid: " rndc.out.$n` 
 [ "$count" -eq 1 ] || ret=1
@@ -644,12 +521,13 @@ status=`expr $status + $ret`

 n=`expr $n + 1`
 echo "I: restore root server, check validation succeeds again ($n)"
-ret=0
 rm -f ns1/root.db.signed.jnl
 $SIGNER -Sg -K ns1 -N unixtime -r $RANDFILE -o . ns1/root.db > /dev/null 2>&-
-mkeys_reload_on 1
-mkeys_refresh_on 2
-mkeys_status_on 2 > rndc.out.$n 2>&1
+$RNDC -c ../common/rndc.conf -s 10.53.0.1 -p 9953 reload . | sed 's/^/I: ns1 /'
+sleep 3
+$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys refresh | sed 's/^/I: ns2 /'
+sleep 1
+$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys status > rndc.out.$n 2>&1
 $DIG $DIGOPTS +noauth example. @10.53.0.2 txt > dig.out.ns2.test$n || ret=1
 grep "flags:.*ad.*QUERY" dig.out.ns2.test$n > /dev/null || ret=1
 grep "example..*.RRSIG..*TXT" dig.out.ns2.test$n > /dev/null || ret=1
@@ -659,14 +537,14 @@ status=`expr $status + $ret`
 n=`expr $n + 1`
 echo "I: check that trust-anchor-telemetry queries are logged ($n)"
 ret=0
-grep "sending trust-anchor-telemetry query '_ta-[0-9a-f]*/NULL" ns2/named.run > /dev/null || ret=1
+grep "sending trust-anchor-telemetry query '_ta-[0-9a-f]*/NULL" ns3/named.run > /dev/null || ret=1
 if [ $ret != 0 ]; then echo "I:failed"; fi
 status=`expr $status + $ret`

 n=`expr $n + 1`
 echo "I: check that trust-anchor-telemetry queries are received ($n)"
 ret=0
-grep "query '_ta-[0-9a-f][0-9a-f]*/NULL/IN' approved" ns1/named.run > /dev/null || ret=1
+grep "query '_ta-[0-9a-f]*/NULL/IN' approved" ns1/named.run > /dev/null || ret=1
 if [ $ret != 0 ]; then echo "I:failed"; fi
 status=`expr $status + $ret`

@@ -674,91 +552,15 @@ n=`expr $n + 1`
 echo "I: check 'rndc-managed-keys destroy' ($n)"
 ret=0
 $RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys destroy | sed 's/^/I: ns2 /'
-mkeys_status_on 2 > rndc.out.$n 2>&1
+sleep 1
+$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys status > rndc.out.$n 2>&1
 grep "no views with managed keys" rndc.out.$n > /dev/null || ret=1
-mkeys_reconfig_on 2
-mkeys_status_on 2 > rndc.out.$n 2>&1
+$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 reconfig | sed 's/^/I: ns2 /'
+sleep 1
+$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys status > rndc.out.$n 2>&1
 grep "name: \." rndc.out.$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo "I:failed"; fi
 status=`expr $status + $ret`

-n=`expr $n + 1`
-echo "I: check that trust-anchor-telemetry queries contain the correct key ($n)"
-ret=0
-# convert the hexadecimal key from the TAT query into decimal and
-# compare against the known key.
-tathex=`grep "query '_ta-[0-9a-f][0-9a-f]*/NULL/IN' approved" ns1/named.run | awk '{print $6; exit 0}' | sed -e 's/(_ta-\([0-9a-f][0-9a-f]*\)):/\1/'`
-tatkey=`$PERL -e 'printf("%d\n", hex(@ARGV[0]));' $tathex`
-realkey=`$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 secroots - | sed -n 's#.*SHA256/\([0-9][0-9]*\) ; .*managed.*#\1#p'`
-[ "$tatkey" -eq "$realkey" ] || ret=1
-if [ $ret != 0 ]; then echo "I:failed"; fi
-status=`expr $status + $ret`
-
-n=`expr $n + 1`
-echo "I: check initialization fails if managed-keys can't be created ($n)"
-ret=0
-mkeys_secroots_on 4
-grep '; initializing managed' ns4/named.secroots > /dev/null 2>&1 || ret=1
-grep '; managed' ns4/named.secroots > /dev/null 2>&1 && ret=1
-grep '; trusted' ns4/named.secroots > /dev/null 2>&1 && ret=1
-if [ $ret != 0 ]; then echo "I:failed"; fi
-status=`expr $status + $ret`
-
-n=`expr $n + 1`
-echo "I: check failure to contact root servers does not prevent key refreshes after restart ($n)"
-ret=0
-# By the time we get here, ns5 should have attempted refreshing its managed
-# keys.  These attempts should fail as ns1 is configured to REFUSE all queries
-# from ns5.  Note that named1.args does not contain "-T mkeytimers"; this is to
-# ensure key refresh retry will be scheduled to one actual hour after the first
-# key refresh failure instead of just a few seconds, in order to prevent races
-# between the next scheduled key refresh time and startup time of restarted ns5.
-$PERL $SYSTEMTESTTOP/stop.pl --use-rndc . ns5
-nextpart ns5/named.run > /dev/null
-$PERL $SYSTEMTESTTOP/start.pl --noclean --restart . ns5
-wait_for_log "Returned from key fetch in keyfetch_done()" ns5/named.run
-# ns5/named.run will contain logs from both the old instance and the new
-# instance.  In order for the test to pass, both must attempt a fetch.
-count=`grep -c "Creating key fetch" ns5/named.run`
-[ $count -lt 2 ] && ret=1
-if [ $ret != 0 ]; then echo "I:failed"; fi
-status=`expr $status + $ret`
-
-n=`expr $n + 1`
-echo "I: check key refreshes are resumed after root servers become available ($n)"
-ret=0
-$PERL $SYSTEMTESTTOP/stop.pl --use-rndc . ns5
-# Prevent previous check from affecting this one
-rm -f ns5/managed-keys.bind*
-# named2.args adds "-T mkeytimers=2/20/40" to named1.args as we need to wait for
-# an "hour" until keys are refreshed again after initial failure
-cp ns5/named2.args ns5/named.args
-nextpart ns5/named.run > /dev/null
-$PERL $SYSTEMTESTTOP/start.pl --noclean --restart . ns5
-wait_for_log "Returned from key fetch in keyfetch_done()" ns5/named.run
-mkeys_secroots_on 5
-grep '; initializing managed' ns5/named.secroots > /dev/null 2>&1 || ret=1
-# ns1 should still REFUSE queries from ns5, so resolving should be impossible
-$DIG $DIGOPTS +noauth example. @10.53.0.5 txt > dig.out.ns5.a.test$n || ret=1
-grep "flags:.*ad.*QUERY" dig.out.ns5.a.test$n > /dev/null && ret=1
-grep "example..*.RRSIG..*TXT" dig.out.ns5.a.test$n > /dev/null && ret=1
-grep "status: SERVFAIL" dig.out.ns5.a.test$n > /dev/null || ret=1
-# Allow queries from ns5 to ns1
-cp ns1/named3.conf ns1/named.conf
-rm -f ns1/root.db.signed.jnl
-mkeys_reconfig_on 1
-nextpart ns5/named.run > /dev/null
-wait_for_log "Returned from key fetch in keyfetch_done()" ns5/named.run
-mkeys_secroots_on 5
-grep '; managed' ns5/named.secroots > /dev/null 2>&1 || ret=1
-# ns1 should not longer REFUSE queries from ns5, so managed keys should be
-# correctly refreshed and resolving should succeed
-$DIG $DIGOPTS +noauth example. @10.53.0.5 txt > dig.out.ns5.b.test$n || ret=1
-grep "flags:.*ad.*QUERY" dig.out.ns5.b.test$n > /dev/null || ret=1
-grep "example..*.RRSIG..*TXT" dig.out.ns5.b.test$n > /dev/null || ret=1
-grep "status: NOERROR" dig.out.ns5.b.test$n > /dev/null || ret=1
-if [ $ret != 0 ]; then echo "I:failed"; fi
-status=`expr $status + $ret`
-
 echo "I:exit status: $status"
 [ $status -eq 0 ] || exit 1
@@ -53,7 +53,6 @@ view "b" {
 		type slave;
 		masters { 10.53.0.5 key "a"; };
 		file "x21.bk-b";
-		notify no;
 	};
 };

@@ -63,6 +62,5 @@ view "c" {
 		type slave;
 		masters { 10.53.0.5 key "a"; };
 		file "x21.bk-c";
-		notify no;
 	};
 };
@@ -20,7 +20,6 @@ options {
 	listen-on-v6 { none; };
 	recursion yes;
 	notify yes;
-	serial-query-rate 1; // workaround for KB AA-01213
 };

 key altkey {
@@ -278,7 +278,7 @@ sleep 10
 if 
 	$PERL $SYSTEMTESTTOP/start.pl --noclean --restart . ns1
 then
-	echo "I:restarted server ns1"
+	echo "I:restarted server ns1"	
 else
 	echo "I:could not restart server ns1"
 	exit 1
@@ -709,12 +709,8 @@ size=`$PERL -e 'use File::stat; my $sb = stat(@ARGV[0]); printf("%s\n", $sb->siz
 [ "$size" -gt 6000 ] || ret=1
 sleep 1
 $RNDC -c ../common/rndc.conf -s 10.53.0.1 -p 9953 sync maxjournal.test
-for i in 1 2 3 4 5 6
-do
-    sleep 1
-    size=`$PERL -e 'use File::stat; my $sb = stat(@ARGV[0]); printf("%s\n", $sb->size);' ns1/maxjournal.db.jnl`
-    [ "$size" -lt 5000 ] && break
-done
+sleep 1
+
 size=`$PERL -e 'use File::stat; my $sb = stat(@ARGV[0]); printf("%s\n", $sb->size);' ns1/maxjournal.db.jnl`
 [ "$size" -lt 5000 ] || ret=1
 [ $ret = 0 ] || { echo I:failed; status=1; }
@@ -889,81 +885,75 @@ grep "address family not supported" nsupdate.out-$n > /dev/null 2>&1 || ret=1
 #
 #  Add client library tests here
 #
-
-if test unset != "${SAMPLEUPDATE:-unset}" -a -x "${SAMPLEUPDATE}"
-then
-
-    n=`expr $n + 1`
-    ret=0
-    echo "I:check that dns_client_update handles prerequisite NXDOMAIN failure ($n)"
-    $SAMPLEUPDATE -P 5300 -a 10.53.0.1 -a 10.53.0.2 -p "nxdomain exists.sample" \
+n=`expr $n + 1`
+ret=0
+echo "I:check that dns_client_update handles prerequisite NXDOMAIN failure ($n)"
+$SAMPLEUPDATE -P 5300 -a 10.53.0.1 -a 10.53.0.2 -p "nxdomain exists.sample" \
 	add "nxdomain-exists.sample 0 in a 1.2.3.4" > update.out.test$n 2>&1
-    $SAMPLEUPDATE -P 5300 -a 10.53.0.2 -p "nxdomain exists.sample" \
+$SAMPLEUPDATE -P 5300 -a 10.53.0.2 -p "nxdomain exists.sample" \
 	add "check-nxdomain-exists.sample 0 in a 1.2.3.4" > update.out.check$n 2>&1
-    $DIG +tcp @10.53.0.1 -p 5300 a nxdomain-exists.sample > dig.out.ns1.test$n
-    $DIG +tcp @10.53.0.2 -p 5300 a nxdomain-exists.sample > dig.out.ns2.test$n
-    $DIG +tcp @10.53.0.2 -p 5300 a check-nxdomain-exists.sample > check.out.ns2.test$n
-    grep "update failed: YXDOMAIN" update.out.test$n > /dev/null || ret=1
-    grep "update succeeded" update.out.check$n > /dev/null || ret=1
-    grep "status: NXDOMAIN" dig.out.ns1.test$n > /dev/null || ret=1
-    grep "status: NXDOMAIN" dig.out.ns2.test$n > /dev/null || ret=1
-    grep "status: NOERROR" check.out.ns2.test$n > /dev/null || ret=1
-    [ $ret = 0 ] || { echo I:failed; status=1; }
+$DIG +tcp @10.53.0.1 -p 5300 a nxdomain-exists.sample > dig.out.ns1.test$n
+$DIG +tcp @10.53.0.2 -p 5300 a nxdomain-exists.sample > dig.out.ns2.test$n
+$DIG +tcp @10.53.0.2 -p 5300 a check-nxdomain-exists.sample > check.out.ns2.test$n
+grep "update failed: YXDOMAIN" update.out.test$n > /dev/null || ret=1
+grep "update succeeded" update.out.check$n > /dev/null || ret=1
+grep "status: NXDOMAIN" dig.out.ns1.test$n > /dev/null || ret=1
+grep "status: NXDOMAIN" dig.out.ns2.test$n > /dev/null || ret=1
+grep "status: NOERROR" check.out.ns2.test$n > /dev/null || ret=1
+[ $ret = 0 ] || { echo I:failed; status=1; }

-    n=`expr $n + 1`
-    ret=0
-    echo "I:check that dns_client_update handles prerequisite YXDOMAIN failure ($n)"
-    $SAMPLEUPDATE -P 5300 -a 10.53.0.1 -a 10.53.0.2 -p "yxdomain nxdomain.sample" \
+n=`expr $n + 1`
+ret=0
+echo "I:check that dns_client_update handles prerequisite YXDOMAIN failure ($n)"
+$SAMPLEUPDATE -P 5300 -a 10.53.0.1 -a 10.53.0.2 -p "yxdomain nxdomain.sample" \
 	add "yxdomain-nxdomain.sample 0 in a 1.2.3.4" > update.out.test$n 2>&1
-    $SAMPLEUPDATE -P 5300 -a 10.53.0.2 -p "yxdomain nxdomain.sample" \
+$SAMPLEUPDATE -P 5300 -a 10.53.0.2 -p "yxdomain nxdomain.sample" \
 	add "check-yxdomain-nxdomain.sample 0 in a 1.2.3.4" > update.out.check$n 2>&1
-    $DIG +tcp @10.53.0.1 -p 5300 a nxdomain-exists.sample > dig.out.ns1.test$n
-    $DIG +tcp @10.53.0.2 -p 5300 a nxdomain-exists.sample > dig.out.ns2.test$n
-    $DIG +tcp @10.53.0.2 -p 5300 a check-nxdomain-exists.sample > check.out.ns2.test$n
-    grep "update failed: NXDOMAIN" update.out.test$n > /dev/null || ret=1
-    grep "update succeeded" update.out.check$n > /dev/null || ret=1
-    grep "status: NXDOMAIN" dig.out.ns1.test$n > /dev/null || ret=1
-    grep "status: NXDOMAIN" dig.out.ns2.test$n > /dev/null || ret=1
-    grep "status: NOERROR" check.out.ns2.test$n > /dev/null || ret=1
-    [ $ret = 0 ] || { echo I:failed; status=1; }
+$DIG +tcp @10.53.0.1 -p 5300 a nxdomain-exists.sample > dig.out.ns1.test$n
+$DIG +tcp @10.53.0.2 -p 5300 a nxdomain-exists.sample > dig.out.ns2.test$n
+$DIG +tcp @10.53.0.2 -p 5300 a check-nxdomain-exists.sample > check.out.ns2.test$n
+grep "update failed: NXDOMAIN" update.out.test$n > /dev/null || ret=1
+grep "update succeeded" update.out.check$n > /dev/null || ret=1
+grep "status: NXDOMAIN" dig.out.ns1.test$n > /dev/null || ret=1
+grep "status: NXDOMAIN" dig.out.ns2.test$n > /dev/null || ret=1
+grep "status: NOERROR" check.out.ns2.test$n > /dev/null || ret=1
+[ $ret = 0 ] || { echo I:failed; status=1; }

-    n=`expr $n + 1`
-    ret=0
-    echo "I:check that dns_client_update handles prerequisite NXRRSET failure ($n)"
-    $SAMPLEUPDATE -P 5300 -a 10.53.0.1 -a 10.53.0.2 -p "nxrrset exists.sample TXT This RRset exists." \
+n=`expr $n + 1`
+ret=0
+echo "I:check that dns_client_update handles prerequisite NXRRSET failure ($n)"
+$SAMPLEUPDATE -P 5300 -a 10.53.0.1 -a 10.53.0.2 -p "nxrrset exists.sample TXT This RRset exists." \
 	add "nxrrset-exists.sample 0 in a 1.2.3.4" > update.out.test$n 2>&1
-    $SAMPLEUPDATE -P 5300 -a 10.53.0.2 -p "nxrrset exists.sample TXT This RRset exists." \
+$SAMPLEUPDATE -P 5300 -a 10.53.0.2 -p "nxrrset exists.sample TXT This RRset exists." \
 	add "check-nxrrset-exists.sample 0 in a 1.2.3.4" > update.out.check$n 2>&1
-    $DIG +tcp @10.53.0.1 -p 5300 a nxrrset-exists.sample > dig.out.ns1.test$n
-    $DIG +tcp @10.53.0.2 -p 5300 a nxrrset-exists.sample > dig.out.ns2.test$n
-    $DIG +tcp @10.53.0.2 -p 5300 a check-nxrrset-exists.sample > check.out.ns2.test$n
-    grep "update failed: YXRRSET" update.out.test$n > /dev/null || ret=1
-    grep "update succeeded" update.out.check$n > /dev/null || ret=1
-    grep "status: NXDOMAIN" dig.out.ns1.test$n > /dev/null || ret=1
-    grep "status: NXDOMAIN" dig.out.ns2.test$n > /dev/null || ret=1
-    grep "status: NOERROR" check.out.ns2.test$n > /dev/null || ret=1
-    [ $ret = 0 ] || { echo I:failed; status=1; }
+$DIG +tcp @10.53.0.1 -p 5300 a nxrrset-exists.sample > dig.out.ns1.test$n
+$DIG +tcp @10.53.0.2 -p 5300 a nxrrset-exists.sample > dig.out.ns2.test$n
+$DIG +tcp @10.53.0.2 -p 5300 a check-nxrrset-exists.sample > check.out.ns2.test$n
+grep "update failed: YXRRSET" update.out.test$n > /dev/null || ret=1
+grep "update succeeded" update.out.check$n > /dev/null || ret=1
+grep "status: NXDOMAIN" dig.out.ns1.test$n > /dev/null || ret=1
+grep "status: NXDOMAIN" dig.out.ns2.test$n > /dev/null || ret=1
+grep "status: NOERROR" check.out.ns2.test$n > /dev/null || ret=1
+[ $ret = 0 ] || { echo I:failed; status=1; }

-    n=`expr $n + 1`
-    ret=0
-    echo "I:check that dns_client_update handles prerequisite YXRRSET failure ($n)"
-    $SAMPLEUPDATE -s -P 5300 -a 10.53.0.1 -a 10.53.0.2 \
+n=`expr $n + 1`
+ret=0
+echo "I:check that dns_client_update handles prerequisite YXRRSET failure ($n)"
+$SAMPLEUPDATE -s -P 5300 -a 10.53.0.1 -a 10.53.0.2 \
 	-p "yxrrset no-txt.sample TXT" \
 	add "yxrrset-nxrrset.sample 0 in a 1.2.3.4" > update.out.test$n 2>&1
-    $SAMPLEUPDATE -P 5300 -a 10.53.0.2 -p "yxrrset no-txt.sample TXT" \
+$SAMPLEUPDATE -P 5300 -a 10.53.0.2 -p "yxrrset no-txt.sample TXT" \
 	add "check-yxrrset-nxrrset.sample 0 in a 1.2.3.4" > update.out.check$n 2>&1
-    $DIG +tcp @10.53.0.1 -p 5300 a yxrrset-nxrrset.sample > dig.out.ns1.test$n
-    $DIG +tcp @10.53.0.2 -p 5300 a yxrrset-nxrrset.sample > dig.out.ns2.test$n
-    $DIG +tcp @10.53.0.2 -p 5300 a check-yxrrset-nxrrset.sample > check.out.ns2.test$n
-    grep "update failed: NXRRSET" update.out.test$n > /dev/null || ret=1
-    grep "update succeeded" update.out.check$n > /dev/null || ret=1
-    grep "status: NXDOMAIN" dig.out.ns1.test$n > /dev/null || ret=1
-    grep "status: NXDOMAIN" dig.out.ns2.test$n > /dev/null || ret=1
-    grep "status: NOERROR" check.out.ns2.test$n > /dev/null || ret=1
-    grep "2nd update failed: NXRRSET" update.out.test$n > /dev/null || ret=1
-    [ $ret = 0 ] || { echo I:failed; status=1; }
-
-fi
+$DIG +tcp @10.53.0.1 -p 5300 a yxrrset-nxrrset.sample > dig.out.ns1.test$n
+$DIG +tcp @10.53.0.2 -p 5300 a yxrrset-nxrrset.sample > dig.out.ns2.test$n
+$DIG +tcp @10.53.0.2 -p 5300 a check-yxrrset-nxrrset.sample > check.out.ns2.test$n
+grep "update failed: NXRRSET" update.out.test$n > /dev/null || ret=1
+grep "update succeeded" update.out.check$n > /dev/null || ret=1
+grep "status: NXDOMAIN" dig.out.ns1.test$n > /dev/null || ret=1
+grep "status: NXDOMAIN" dig.out.ns2.test$n > /dev/null || ret=1
+grep "status: NOERROR" check.out.ns2.test$n > /dev/null || ret=1
+grep "2nd update failed: NXRRSET" update.out.test$n > /dev/null || ret=1
+[ $ret = 0 ] || { echo I:failed; status=1; }

 #
 # End client library tests here
@@ -1,4 +1,4 @@
-Copyright (C) 2014, 2016, 2017  Internet Systems Consortium, Inc. ("ISC")
+Copyright (C) 2014, 2016  Internet Systems Consortium, Inc. ("ISC")

 This Source Code Form is subject to the terms of the Mozilla Public
 License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -7,9 +7,8 @@ file, You can obtain one at http://mozilla.org/MPL/2.0/.
 system test for recursion limits

 ns1  -- root server
-ans2 -- for example.org: delegate to ns1.(n+1).example.org for all n, up to the
-                         value specified in ans.limit (or forever if limit is 0)
-        for example.net: delegate every query to 15 more name servers, with
-                         "victim" address
+ans2 -- delegate to ns1.(n+1).example.com for all n, up to
+        the value specified in ans.limit (or forever if limit is 0)
 ns3  -- resolver under test
+ans4 -- delegates every query to 16 more name servers, with "victim" address
 ans7 -- "victim" server
--- a/Show More
+++ b/Show More
				`@@ -1 +0,0 @@`
				`-m record,size,mctx -T clienttest -c named.conf -d 99 -X named.lock -g`