Provide debugging information for the isc_random function

.gitignore

@@ -7,8 +7,6 @@ libtool
 /isc-config.sh
 /configure.lineno
 autom4te.cache/
-*.rej
-*.orig
 *.o
 *.lo
 *.so

CHANGES

@@ -1,80 +1,5 @@
-	--- 9.13.1 released ---
-
-4968.	[bug]		If glue records are signed, attempt to validate them.
-			[GL #209]
-
-4967.	[cleanup]	Add "answer-cookie" to the parser, marked obsolete.
-
-4966.	[placeholder]
-
-4965.	[func]		Add support for marking options as deprecated.
-			[GL #322]
-
-4964.	[bug]		Reduce the probabilty of double signature when deleting
-			a DNSKEY by checking if the node is otherwise signed
-			by the algorithm of the key to be deleted. [GL #240]
-
-4963.	[test]		ifconfig.sh now uses "ip" instead of "ifconfig",
-			if available, to configure the test interfaces on
-			linux.  [GL #302]
-
-4962.	[cleanup]	Move 'named -T' processing to its own function.
-			[GL #316]
-
-4961.	[protocol]	Remove support for ECC-GOST (GOST R 34.11-94).
-			[GL #295]
-
-4960.	[security]	When recursion is enabled, but the "allow-recursion"
-			and "allow-query-cache" ACLs are not specified,
-			they should be limited to local networks,
-			but were inadvertently set to match the default
-			"allow-query", thus allowing remote queries.
-			(CVE-2018-5738) [GL #309]
-
-4959.	[func]		NSID logging (enabled by the "request-nsid" option)
-			now has its own "nsid" category, instead of using the
-			"resolver" category. [GL !332]
-
-4958.	[bug]		Remove redundant space from NSEC3 record. [GL #281]
-
-4957.	[func]		The default setting for "dnssec-validation" is now
-			"auto", which activates DNSSEC validation using the
-			IANA root key. (The default can be changed back to
-			"yes", which activates DNSSEC validation only when keys
-			are explicitly configured in named.conf, by building
-			BIND with "configure --disable-auto-validation".)
-			[GL #30]
-
-4956.	[func]		Change isc_random() to be just PRNG using xoshiro128**,
-			and add isc_nonce_buf() that uses CSPRNG. [GL #289]
-
-4955.	[cleanup]	Silence cppcheck warnings in lib/dns/master.c.
-			[GL #286]
-
-4954.	[func]		Messages about serving of stale answers are now
-			directed to the "serve-stale" logging category.
-			Also clarified serve-stale documentation. [GL !323]
-
-4953.	[bug]		Removed the option to build the red black tree
-			database without a hash table; the non-hashing
-			version was buggy and is not needed. [GL #184]
-
-4952.	[func]		Authoritative server support in named for the
-			EDNS CLIENT-SUBNET option (which was experimental
-			and not practical to deploy) has been removed.
-
-			The ECS option is still supported in dig and mdig
-			via the +subnet option, and can be parsed and logged
-			when received by named, but it is no longer used
-			for ACL processing. The "geoip-use-ecs" option
-			is now obsolete; a warning will be logged if it is
-			used in named.conf. "ecs" tags in an ACL definition
-			are also obsolete and will cause the configuration
-			to fail to load.  [GL #32]
-
 4951.	[protocol]	Add "HOME.ARPA" to list of built in empty zones as
 			per RFC 8375. [GL #273]
-
 	--- 9.13.0 released ---
 
 4950.	[bug]		ISC_SOCKEVENTATTR_TRUNC was not be set. [GL #238]

Makefile.in

@@ -22,8 +22,7 @@ MANPAGES =	isc-config.sh.1
 
 HTMLPAGES =	isc-config.sh.html
 
-MANOBJS =	README HISTORY OPTIONS CONTRIBUTING PLATFORMS \
-		${MANPAGES} ${HTMLPAGES}
+MANOBJS =	README HISTORY OPTIONS CONTRIBUTING ${MANPAGES} ${HTMLPAGES}
 
 @BIND9_MAKE_RULES@
 
@@ -115,11 +114,6 @@ CONTRIBUTING: CONTRIBUTING.md
 		${W3M} -dump -cols 75 -O ascii -T text/html | \
 		sed -e '$${/^$$/d;}' > $@
 
-PLATFORMS: PLATFORMS.md
-	${PANDOC} --email-obfuscation=none -s -t html PLATFORMS.md | \
-		${W3M} -dump -cols 75 -O ascii -T text/html | \
-		sed -e '$${/^$$/d;}' > $@
-
 unit::
 	sh ${top_builddir}/unit/unittest.sh
 

PLATFORMS

@@ -1,56 +0,0 @@
-Supported platforms
-
-In general, this version of BIND will build and run on any POSIX-compliant
-system with a C99-compliant C compiler, BSD-style sockets, and the OpenSSL
-cryptography library. To build with multiprocessing support, a
-C11-compliant C compiler will be needed for standard atomics.
-
-ISC regularly tests BIND on many operating systems and architectures, but
-lacks the resources to test all of them. Consequently, ISC is only able to
-offer support on a "best effort" basis for some.
-
-Regularly tested platforms
-
-As of May 2018, BIND 9.13 is tested on the following systems:
-
-  * Debian 8, 9
-  * Ubuntu 16.04, 18.04
-  * Fedora 27, 28
-  * Red Hat/CentOS 6, 7
-  * FreeBSD 10.x, 11.x
-  * OpenBSD 6.3
-
-The amd64, i386, armhf and arm64 CPU architectures are all fully
-supported.
-
-Best effort
-
-The following are platforms on which BIND is known to build and run, but
-on which it is not routinely tested. ISC makes every effort to fix bugs on
-these platforms, but may be unable to do so quickly due to lack of
-hardware, less familiarity on the part of engineering staff, and other
-constraints.
-
-  * Windows 10 / x64
-  * Windows Server 2012 R2, 2016 / x64
-  * macOS 10.12+
-  * Solaris 10
-  * FreeBSD 12+
-  * OpenBSD 6.2
-  * NetBSD
-  * Older or less popular Linux distributions still supported by their
-    vendors, such as:
-      + Ubuntu 14.04, 18.10+
-      + Gentoo
-      + ArchLinux
-      + Alpine Linux
-  * OpenWRT/LEDE 17.0
-  * Other CPU architectures (mips, mipsel, sparc, ...)
-
-Unsupported platforms
-
-These are platforms on which BIND is known not to build or run:
-
-  * Platforms without at least OpenSSL 1.0.2
-  * Windows 10 / x86
-  * Windows Server 2012

PLATFORMS.md

@@ -1,64 +0,0 @@
-<!--
- - Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- -
- - This Source Code Form is subject to the terms of the Mozilla Public
- - License, v. 2.0. If a copy of the MPL was not distributed with this
- - file, You can obtain one at http://mozilla.org/MPL/2.0/.
- -
- - See the COPYRIGHT file distributed with this work for additional
- - information regarding copyright ownership.
--->
-## Supported platforms
-
-In general, this version of BIND will build and run on any POSIX-compliant
-system with a C99-compliant C compiler, BSD-style sockets, and the OpenSSL
-cryptography library. To build with multiprocessing support, a
-C11-compliant C compiler will be needed for standard atomics.
-
-ISC regularly tests BIND on many operating systems and architectures, but
-lacks the resources to test all of them. Consequently, ISC is only able to
-offer support on a "best effort" basis for some.
-
-### Regularly tested platforms
-
-As of May 2018, BIND 9.13 is tested on the following systems:
-
-* Debian 8, 9
-* Ubuntu 16.04, 18.04
-* Fedora 27, 28
-* Red Hat/CentOS 6, 7
-* FreeBSD 10.x, 11.x
-* OpenBSD 6.3
-
-The amd64, i386, armhf and arm64 CPU architectures are all fully supported.
-
-### Best effort
-
-The following are platforms on which BIND is known to build and run,
-but on which it is not routinely tested. ISC makes every effort to fix bugs
-on these platforms, but may be unable to do so quickly due to lack of
-hardware, less familiarity on the part of engineering staff, and other
-constraints.
-
-* Windows 10 / x64
-* Windows Server 2012 R2, 2016 / x64
-* macOS 10.12+
-* Solaris 10
-* FreeBSD 12+
-* OpenBSD 6.2
-* NetBSD
-* Older or less popular Linux distributions still supported by their vendors, such as:
-    * Ubuntu 14.04, 18.10+
-    * Gentoo
-    * ArchLinux
-    * Alpine Linux
-* OpenWRT/LEDE 17.0
-* Other CPU architectures (mips, mipsel, sparc, ...)
-
-## Unsupported platforms
-
-These are platforms on which BIND is known *not* to build or run:
-
-* Platforms without at least OpenSSL 1.0.2
-* Windows 10 / x86
-* Windows Server 2012

README

@@ -31,9 +31,9 @@ administrative tools, including the dig and delv DNS lookup tools,
 nsupdate for dynamic DNS zone updates, rndc for remote name server
 administration, and more.
 
-BIND 9 began as a complete re-write of the BIND architecture that was used
-in versions 4 and 8. Internet Systems Consortium (https://www.isc.org), a
-501(c)(3) public benefit corporation dedicated to providing software and
+BIND 9 is a complete re-write of the BIND architecture that was used in
+versions 4 and 8. Internet Systems Consortium (https://www.isc.org), a 501
+(c)(3) public benefit corporation dedicated to providing software and
 services in support of the Internet infrastructure, developed BIND 9 and
 is responsible for its ongoing maintenance and improvement. BIND is open
 source software licenced under the terms of the Mozilla Public License,
@@ -48,8 +48,6 @@ the file CHANGES. See below for details on the CHANGES file format.
 For up-to-date release notes and errata, see http://www.isc.org/software/
 bind9/releasenotes
 
-For information about supported platforms, see PLATFORMS.
-
 Reporting bugs and getting help
 
 To report non-security-sensitive bugs or request new features, you may
@@ -101,20 +99,11 @@ format-patch.
 
 BIND 9.13 features
 
-BIND 9.13 is the newest development branch of BIND 9. It includes a number
-of changes from BIND 9.12 and earlier releases. New features include:
+BIND 9.13.0 is the newest development branch of BIND 9. It includes a
+number of changes from BIND 9.12 and earlier releases. New features
+include:
 
-  * The default value of "dnssec-validation" is now "auto".
-  * Support for IDNA2008 when linking with libidn2.
-  * "Root key sentinel" support, enabling validating resolvers to indicate
-    via a special query which trust anchors are configured for the root
-    zone.
-
-In addition, cryptographic support has been modernized. BIND now uses the
-best available pseudo-random number generator for the platform on which
-it's built. Very old versions of OpenSSL are no longer supported.
-Cryptography is now mandatory; building BIND without DNSSEC is now longer
-supported.
+  * TBD
 
 Building BIND
 

README.md

@@ -41,8 +41,8 @@ administrative tools, including the `dig` and `delv` DNS lookup tools,
 `nsupdate` for dynamic DNS zone updates, `rndc` for remote name server
 administration, and more.
 
-BIND 9 began as a complete re-write of the BIND architecture that was
-used in versions 4 and 8.  Internet Systems Consortium
+BIND 9 is a complete re-write of the BIND architecture that was used in
+versions 4 and 8.  Internet Systems Consortium
 ([https://www.isc.org](https://www.isc.org)), a 501(c)(3) public benefit
 corporation dedicated to providing software and services in support of the
 Internet infrastructure, developed BIND 9 and is responsible for its
@@ -59,8 +59,6 @@ CHANGES file format.
 For up-to-date release notes and errata, see
 [http://www.isc.org/software/bind9/releasenotes](http://www.isc.org/software/bind9/releasenotes)
 
-For information about supported platforms, see [PLATFORMS](PLATFORMS.md).
-
 ### <a name="help"/> Reporting bugs and getting help
 
 To report non-security-sensitive bugs or request new features, you may
@@ -118,20 +116,11 @@ including your patch as an attachment, preferably generated by
 
 ### <a name="features"/> BIND 9.13 features
 
-BIND 9.13 is the newest development branch of BIND 9. It includes a
+BIND 9.13.0 is the newest development branch of BIND 9. It includes a
 number of changes from BIND 9.12 and earlier releases.  New features
 include:
 
-* The default value of "dnssec-validation" is now "auto".
-* Support for IDNA2008 when linking with `libidn2`.
-* "Root key sentinel" support, enabling validating resolvers to indicate
-  via a special query which trust anchors are configured for the root zone.
-
-In addition, cryptographic support has been modernized. BIND now uses the
-best available pseudo-random number generator for the platform on which
-it's built. Very old versions of OpenSSL are no longer supported.
-Cryptography is now mandatory; building BIND without DNSSEC is now
-longer supported.
+* TBD
 
 ### <a name="build"/> Building BIND
 

bin/dig/dig.c

@@ -1933,7 +1933,7 @@ parse_args(isc_boolean_t is_batchfile, isc_boolean_t config_only,
 			{
 				debug("config line %s", batchline);
 				bargc = split_batchline(batchline, bargv, 62,
-							".digrc argv");
+						        ".digrc argv");
 				bargv[0] = argv[0];
 				argv0 = argv[0];
 				parse_args(ISC_TRUE, ISC_TRUE,

bin/dig/dighost.c

@@ -63,7 +63,6 @@
 #include <isc/log.h>
 #include <isc/netaddr.h>
 #include <isc/netdb.h>
-#include <isc/nonce.h>
 #include <isc/parseint.h>
 #include <isc/print.h>
 #include <isc/random.h>
@@ -1316,7 +1315,7 @@ setup_system(isc_boolean_t ipv4only, isc_boolean_t ipv6only) {
 	else if (keysecret[0] != 0)
 		setup_text_key();
 
-	isc_nonce_buf(cookie_secret, sizeof(cookie_secret));
+	isc_random_buf(cookie_secret, sizeof(cookie_secret));
 }
 
 /*%
@@ -1871,7 +1870,8 @@ followup_lookup(dns_message_t *msg, dig_query_t *query, dns_section_t section)
 		     srv != NULL;
 		     srv = ISC_LIST_HEAD(lookup->my_server_list)) {
 			INSIST(i > 0);
-			j = isc_random_uniform(i);
+			j = isc_random();
+			j %= i;
 			next = ISC_LIST_NEXT(srv, link);
 			while (j-- > 0 && next != NULL) {
 				srv = next;
@@ -2023,6 +2023,7 @@ compute_cookie(unsigned char *clientcookie, size_t len) {
 isc_boolean_t
 setup_lookup(dig_lookup_t *lookup) {
 	isc_result_t result;
+	isc_uint32_t id;
 	unsigned int len;
 	dig_server_t *serv;
 	dig_query_t *query;
@@ -2197,7 +2198,8 @@ setup_lookup(dig_lookup_t *lookup) {
 	dighost_trying(store, lookup);
 	INSIST(dns_name_isabsolute(lookup->name));
 
-	lookup->sendmsg->id = (dns_messageid_t)isc_random16();
+	id = isc_random();
+	lookup->sendmsg->id = (unsigned short)id & 0xFFFF;
 	lookup->sendmsg->opcode = lookup->opcode;
 	lookup->msgcounter = 0;
 	/*

bin/dnssec/dnssec-cds.8

@@ -102,7 +102,7 @@ Specify a digest algorithm to use when converting CDNSKEY records to DS records\
 .sp
 The
 \fIalgorithm\fR
-must be one of SHA\-1 (SHA1), SHA\-256 (SHA256), or SHA\-384 (SHA384)\&. These values are case insensitive\&. If no algorithm is specified, the default is SHA\-256\&.
+must be one of SHA\-1 (SHA1), SHA\-256 (SHA256), GOST, or SHA\-384 (SHA384)\&. These values are case insensitive\&. If no algorithm is specified, the default is SHA\-256\&.
 .RE
 .PP
 \-c \fIclass\fR

bin/dnssec/dnssec-cds.c

@@ -1115,7 +1115,7 @@ usage(void) {
 		program);
 	fprintf(stderr, "Version: %s\n", VERSION);
 	fprintf(stderr, "Options:\n"
-"    -a <algorithm>     digest algorithm (SHA-1 / SHA-256 / SHA-384)\n"
+"    -a <algorithm>     digest algorithm (SHA-1 / SHA-256 / GOST / SHA-384)\n"
 "    -c <class>         of domain (default IN)\n"
 "    -D                 prefer CDNSKEY records instead of CDS\n"
 "    -d <file|dir>      where to find parent dsset- file\n"

bin/dnssec/dnssec-cds.docbook

@@ -144,7 +144,7 @@
           </para>
           <para>
 	    The <replaceable>algorithm</replaceable> must be one of SHA-1
-	    (SHA1), SHA-256 (SHA256), or SHA-384 (SHA384). These
+	    (SHA1), SHA-256 (SHA256), GOST, or SHA-384 (SHA384). These
 	    values are case insensitive. If no algorithm is specified,
 	    the default is SHA-256.
           </para>

bin/dnssec/dnssec-cds.html

@@ -130,7 +130,7 @@
           </p>
           <p>
 	    The <em class="replaceable"><code>algorithm</code></em> must be one of SHA-1
-	    (SHA1), SHA-256 (SHA256), or SHA-384 (SHA384). These
+	    (SHA1), SHA-256 (SHA256), GOST, or SHA-384 (SHA384). These
 	    values are case insensitive. If no algorithm is specified,
 	    the default is SHA-256.
           </p>

bin/dnssec/dnssec-dsfromkey.8

@@ -64,7 +64,7 @@ Use SHA\-256 as the digest algorithm\&.
 .RS 4
 Select the digest algorithm\&. The value of
 \fBalgorithm\fR
-must be one of SHA\-1 (SHA1), SHA\-256 (SHA256) or SHA\-384 (SHA384)\&. These values are case insensitive\&.
+must be one of SHA\-1 (SHA1), SHA\-256 (SHA256), GOST or SHA\-384 (SHA384)\&. These values are case insensitive\&.
 .RE
 .PP
 \-C

bin/dnssec/dnssec-dsfromkey.docbook

@@ -117,7 +117,7 @@
 	  <para>
 	    Select the digest algorithm. The value of
 	    <option>algorithm</option> must be one of SHA-1 (SHA1),
-	    SHA-256 (SHA256) or SHA-384 (SHA384).
+	    SHA-256 (SHA256), GOST or SHA-384 (SHA384).
 	    These values are case insensitive.
 	  </para>
 	</listitem>

bin/dnssec/dnssec-dsfromkey.html

@@ -97,7 +97,7 @@
 	  <p>
 	    Select the digest algorithm. The value of
 	    <code class="option">algorithm</code> must be one of SHA-1 (SHA1),
-	    SHA-256 (SHA256) or SHA-384 (SHA384).
+	    SHA-256 (SHA256), GOST or SHA-384 (SHA384).
 	    These values are case insensitive.
 	  </p>
 	</dd>

bin/dnssec/dnssec-keyfromlabel.8

@@ -55,7 +55,7 @@ of the key is specified on the command line\&. This must match the name of the z
 .RS 4
 Selects the cryptographic algorithm\&. The value of
 \fBalgorithm\fR
-must be one of RSAMD5, RSASHA1, DSA, NSEC3RSASHA1, NSEC3DSA, RSASHA256, RSASHA512, ECDSAP256SHA256, ECDSAP384SHA384, ED25519 or ED448\&.
+must be one of RSAMD5, RSASHA1, DSA, NSEC3RSASHA1, NSEC3DSA, RSASHA256, RSASHA512, ECCGOST, ECDSAP256SHA256, ECDSAP384SHA384, ED25519 or ED448\&.
 .sp
 If no algorithm is specified, then RSASHA1 will be used by default, unless the
 \fB\-3\fR

bin/dnssec/dnssec-keyfromlabel.c

@@ -64,7 +64,7 @@ usage(void) {
 	fprintf(stderr, "    -a algorithm: \n"
 			"        RSA | RSAMD5 | DH | DSA | RSASHA1 |\n"
 			"        NSEC3DSA | NSEC3RSASHA1 |\n"
-			"        RSASHA256 | RSASHA512 |\n"
+			"        RSASHA256 | RSASHA512 | ECCGOST |\n"
 			"        ECDSAP256SHA256 | ECDSAP384SHA384\n");
 	fprintf(stderr, "    -3: use NSEC3-capable algorithm\n");
 	fprintf(stderr, "    -c class (default: IN)\n");
@@ -427,6 +427,7 @@ main(int argc, char **argv) {
 			case DST_ALG_NSEC3RSASHA1:
 			case DST_ALG_RSASHA256:
 			case DST_ALG_RSASHA512:
+			case DST_ALG_ECCGOST:
 			case DST_ALG_ECDSA256:
 			case DST_ALG_ECDSA384:
 			case DST_ALG_ED25519:

bin/dnssec/dnssec-keyfromlabel.docbook

@@ -106,7 +106,7 @@
 	  <para>
 	    Selects the cryptographic algorithm.  The value of
 	    <option>algorithm</option> must be one of RSAMD5, RSASHA1,
-	    DSA, NSEC3RSASHA1, NSEC3DSA, RSASHA256, RSASHA512,
+	    DSA, NSEC3RSASHA1, NSEC3DSA, RSASHA256, RSASHA512, ECCGOST,
 	    ECDSAP256SHA256, ECDSAP384SHA384, ED25519 or ED448.
 	  </para>
 	  <para>

bin/dnssec/dnssec-keyfromlabel.html

@@ -90,7 +90,7 @@
 	  <p>
 	    Selects the cryptographic algorithm.  The value of
 	    <code class="option">algorithm</code> must be one of RSAMD5, RSASHA1,
-	    DSA, NSEC3RSASHA1, NSEC3DSA, RSASHA256, RSASHA512,
+	    DSA, NSEC3RSASHA1, NSEC3DSA, RSASHA256, RSASHA512, ECCGOST,
 	    ECDSAP256SHA256, ECDSAP384SHA384, ED25519 or ED448.
 	  </p>
 	  <p>

bin/dnssec/dnssec-keygen.8

@@ -62,7 +62,7 @@ may be preferable to direct use of
 .RS 4
 Selects the cryptographic algorithm\&. For DNSSEC keys, the value of
 \fBalgorithm\fR
-must be one of RSAMD5, RSASHA1, DSA, NSEC3RSASHA1, NSEC3DSA, RSASHA256, RSASHA512, ECDSAP256SHA256, ECDSAP384SHA384, ED25519 or ED448\&. For TKEY, the value must be DH (Diffie Hellman); specifying his value will automatically set the
+must be one of RSAMD5, RSASHA1, DSA, NSEC3RSASHA1, NSEC3DSA, RSASHA256, RSASHA512, ECCGOST, ECDSAP256SHA256, ECDSAP384SHA384, ED25519 or ED448\&. For TKEY, the value must be DH (Diffie Hellman); specifying his value will automatically set the
 \fB\-T KEY\fR
 option as well\&.
 .sp

bin/dnssec/dnssec-keygen.c

@@ -79,7 +79,7 @@ usage(void) {
 	fprintf(stderr, "    -a <algorithm>:\n");
 	fprintf(stderr, "        RSA | RSAMD5 | DSA | RSASHA1 | NSEC3RSASHA1"
 				" | NSEC3DSA |\n");
-	fprintf(stderr, "        RSASHA256 | RSASHA512 |\n");
+	fprintf(stderr, "        RSASHA256 | RSASHA512 | ECCGOST |\n");
 	fprintf(stderr, "        ECDSAP256SHA256 | ECDSAP384SHA384 |\n");
 	fprintf(stderr, "        ED25519 | ED448 | DH\n");
 	fprintf(stderr, "    -3: use NSEC3-capable algorithm\n");

bin/dnssec/dnssec-keygen.docbook

@@ -123,7 +123,7 @@
 	  <para>
 	    Selects the cryptographic algorithm.  For DNSSEC keys, the value
 	    of <option>algorithm</option> must be one of RSAMD5, RSASHA1,
-	    DSA, NSEC3RSASHA1, NSEC3DSA, RSASHA256, RSASHA512,
+	    DSA, NSEC3RSASHA1, NSEC3DSA, RSASHA256, RSASHA512, ECCGOST,
 	    ECDSAP256SHA256, ECDSAP384SHA384, ED25519 or ED448.  For
 	    TKEY, the value must be DH (Diffie Hellman); specifying
 	    his value will automatically set the <option>-T KEY</option>

bin/dnssec/dnssec-keygen.html

@@ -100,7 +100,7 @@
 	  <p>
 	    Selects the cryptographic algorithm.  For DNSSEC keys, the value
 	    of <code class="option">algorithm</code> must be one of RSAMD5, RSASHA1,
-	    DSA, NSEC3RSASHA1, NSEC3DSA, RSASHA256, RSASHA512,
+	    DSA, NSEC3RSASHA1, NSEC3DSA, RSASHA256, RSASHA512, ECCGOST,
 	    ECDSAP256SHA256, ECDSAP384SHA384, ED25519 or ED448.  For
 	    TKEY, the value must be DH (Diffie Hellman); specifying
 	    his value will automatically set the <code class="option">-T KEY</code>

bin/dnssec/dnssectool.c

@@ -360,6 +360,10 @@ strtodsdigest(const char *algname) {
 		   strcasecmp(algname, "SHA-256") == 0)
 	{
 		return (DNS_DSDIGEST_SHA256);
+#if defined(HAVE_OPENSSL_GOST) || defined(HAVE_PKCS11_GOST)
+	} else if (strcasecmp(algname, "GOST") == 0) {
+		return (DNS_DSDIGEST_GOST);
+#endif
 	} else if (strcasecmp(algname, "SHA384") == 0 ||
 		   strcasecmp(algname, "SHA-384") == 0)
 	{

bin/named/config.c

@@ -27,7 +27,6 @@
 
 #include <pk11/site.h>
 
-#include <isccfg/grammar.h>
 #include <isccfg/namedconf.h>
 
 #include <dns/fixedname.h>
@@ -47,7 +46,6 @@
 /*% default configuration */
 static char defaultconf[] = "\
 options {\n\
-#	answer-cookie <obsolete>;\n\
 	automatic-interface-scan yes;\n\
 	bindkeys-file \"" NAMED_SYSCONFDIR "/bind.keys\";\n\
 #	blackhole {none;};\n"
@@ -148,7 +146,7 @@ options {\n\
 	clients-per-query 10;\n\
 	dnssec-accept-expired no;\n\
 	dnssec-enable yes;\n\
-	dnssec-validation " VALIDATION_DEFAULT "; \n"
+	dnssec-validation yes; \n"
 #ifdef HAVE_DNSTAP
 "	dnstap-identity hostname;\n"
 #endif
@@ -310,9 +308,8 @@ named_config_parsedefaults(cfg_parser_t *parser, cfg_obj_t **conf) {
 
 	isc_buffer_init(&b, defaultconf, sizeof(defaultconf) - 1);
 	isc_buffer_add(&b, sizeof(defaultconf) - 1);
-	return (cfg_parse_buffer4(parser, &b, __FILE__, 0,
-				  &cfg_type_namedconf,
-				  CFG_PCTX_NODEPRECATED, conf));
+	return (cfg_parse_buffer3(parser, &b, __FILE__, 0,
+				  &cfg_type_namedconf, conf));
 }
 
 isc_result_t

bin/named/controlconf.c

@@ -20,7 +20,6 @@
 #include <isc/mem.h>
 #include <isc/net.h>
 #include <isc/netaddr.h>
-#include <isc/nonce.h>
 #include <isc/random.h>
 #include <isc/result.h>
 #include <isc/stdtime.h>
@@ -231,12 +230,13 @@ address_ok(isc_sockaddr_t *sockaddr, dns_acl_t *acl) {
 
 	isc_netaddr_fromsockaddr(&netaddr, sockaddr);
 
-	result = dns_acl_match(&netaddr, NULL, acl, env, &match, NULL);
-	if (result != ISC_R_SUCCESS || match <= 0) {
+	result = dns_acl_match(&netaddr, NULL, NULL, 0, NULL, acl, env, &match,
+			       NULL);
+
+	if (result != ISC_R_SUCCESS || match <= 0)
 		return (ISC_FALSE);
-	} else {
+	else
 		return (ISC_TRUE);
-	}
 }
 
 static isc_result_t
@@ -458,7 +458,7 @@ control_recvmessage(isc_task_t *task, isc_event_t *event) {
 	 */
 	if (conn->nonce == 0) {
 		while (conn->nonce == 0) {
-			isc_nonce_buf(&conn->nonce, sizeof(conn->nonce));
+			isc_random_buf(&conn->nonce, sizeof(conn->nonce));
 		}
 		eresult = ISC_R_SUCCESS;
 	} else

bin/named/main.c

@@ -129,7 +129,6 @@ static unsigned int delay = 0;
 static isc_boolean_t nonearest = ISC_FALSE;
 static isc_boolean_t notcp = ISC_FALSE;
 static isc_boolean_t fixedlocal = ISC_FALSE;
-static isc_boolean_t sigvalinsecs = ISC_FALSE;
 
 /*
  * -4 and -6
@@ -465,97 +464,12 @@ parse_fuzz_arg(void) {
 	}
 }
 
-static void
-parse_T_opt(char *option) {
-	const char *p;
-	char *last = NULL;
-	/*
-	 * force the server to behave (or misbehave) in
-	 * specified ways for testing purposes.
-	 *
-	 * clienttest: make clients single shot with their
-	 * 	       own memory context.
-	 * delay=xxxx: delay client responses by xxxx ms to
-	 *	       simulate remote servers.
-	 * dscp=x:     check that dscp values are as
-	 * 	       expected and assert otherwise.
-	 */
-	if (!strcmp(option, "clienttest")) {
-		clienttest = ISC_TRUE;
-	} else if (!strncmp(option, "delay=", 6)) {
-		delay = atoi(option + 6);
-	} else if (!strcmp(option, "dropedns")) {
-		dropedns = ISC_TRUE;
-	} else if (!strncmp(option, "dscp=", 5)) {
-		isc_dscp_check_value = atoi(option + 5);
-	} else if (!strcmp(option, "fixedlocal")) {
-		fixedlocal = ISC_TRUE;
-	} else if (!strcmp(option, "keepstderr")) {
-		named_g_keepstderr = ISC_TRUE;
-	} else if (!strcmp(option, "noaa")) {
-		noaa = ISC_TRUE;
-	} else if (!strcmp(option, "noedns")) {
-		noedns = ISC_TRUE;
-	} else if (!strcmp(option, "nonearest")) {
-		nonearest = ISC_TRUE;
-	} else if (!strcmp(option, "nosoa")) {
-		nosoa = ISC_TRUE;
-	} else if (!strcmp(option, "nosyslog")) {
-		named_g_nosyslog = ISC_TRUE;
-	} else if (!strcmp(option, "notcp")) {
-		notcp = ISC_TRUE;
-	} else if (!strcmp(option, "maxudp512")) {
-		maxudp = 512;
-	} else if (!strcmp(option, "maxudp1460")) {
-		maxudp = 1460;
-	} else if (!strncmp(option, "maxudp=", 7)) {
-		maxudp = atoi(option + 7);
-	} else if (!strncmp(option, "mkeytimers=", 11)) {
-		p = strtok_r(option + 11, "/", &last);
-		if (p == NULL) {
-			named_main_earlyfatal("bad mkeytimer");
-		}
-
-		dns_zone_mkey_hour = atoi(p);
-		if (dns_zone_mkey_hour == 0) {
-			named_main_earlyfatal("bad mkeytimer");
-		}
-
-		p = strtok_r(NULL, "/", &last);
-		if (p == NULL) {
-			dns_zone_mkey_day = (24 * dns_zone_mkey_hour);
-			dns_zone_mkey_month = (30 * dns_zone_mkey_day);
-			return;
-		}
-
-		dns_zone_mkey_day = atoi(p);
-		if (dns_zone_mkey_day < dns_zone_mkey_hour)
-			named_main_earlyfatal("bad mkeytimer");
-
-		p = strtok_r(NULL, "/", &last);
-		if (p == NULL) {
-			dns_zone_mkey_month = (30 * dns_zone_mkey_day);
-			return;
-		}
-
-		dns_zone_mkey_month = atoi(p);
-		if (dns_zone_mkey_month < dns_zone_mkey_day) {
-			named_main_earlyfatal("bad mkeytimer");
-		}
-	} else if (!strcmp(option, "sigvalinsecs")) {
-		sigvalinsecs = ISC_TRUE;
-	} else if (!strncmp(option, "tat=", 4)) {
-		named_g_tat_interval = atoi(option + 4);
-	} else {
-		fprintf(stderr, "unknown -T flag '%s\n", option);
-	}
-}
-
 static void
 parse_command_line(int argc, char *argv[]) {
 	int ch;
 	int port;
 	const char *p;
+	char *last;
 
 	save_command_line(argc, argv);
 
@@ -650,7 +564,95 @@ parse_command_line(int argc, char *argv[]) {
 			named_g_chrootdir = isc_commandline_argument;
 			break;
 		case 'T':	/* NOT DOCUMENTED */
-			parse_T_opt(isc_commandline_argument);
+			/*
+			 * force the server to behave (or misbehave) in
+			 * specified ways for testing purposes.
+			 *
+			 * clienttest: make clients single shot with their
+			 * 	       own memory context.
+			 * delay=xxxx: delay client responses by xxxx ms to
+			 *	       simulate remote servers.
+			 * dscp=x:     check that dscp values are as
+			 * 	       expected and assert otherwise.
+			 */
+			if (!strcmp(isc_commandline_argument, "clienttest"))
+				clienttest = ISC_TRUE;
+			else if (!strcmp(isc_commandline_argument, "nosoa"))
+				nosoa = ISC_TRUE;
+			else if (!strcmp(isc_commandline_argument, "noaa"))
+				noaa = ISC_TRUE;
+			else if (!strcmp(isc_commandline_argument,
+					 "maxudp512"))
+				maxudp = 512;
+			else if (!strcmp(isc_commandline_argument,
+					 "maxudp1460"))
+				maxudp = 1460;
+			else if (!strcmp(isc_commandline_argument, "dropedns"))
+				dropedns = ISC_TRUE;
+			else if (!strcmp(isc_commandline_argument, "noedns"))
+				noedns = ISC_TRUE;
+			else if (!strncmp(isc_commandline_argument,
+					  "maxudp=", 7))
+				maxudp = atoi(isc_commandline_argument + 7);
+			else if (!strncmp(isc_commandline_argument,
+					  "delay=", 6))
+				delay = atoi(isc_commandline_argument + 6);
+			else if (!strcmp(isc_commandline_argument, "nosyslog"))
+				named_g_nosyslog = ISC_TRUE;
+			else if (!strcmp(isc_commandline_argument, "nonearest"))
+				nonearest = ISC_TRUE;
+			else if (!strncmp(isc_commandline_argument, "dscp=", 5))
+				isc_dscp_check_value =
+					   atoi(isc_commandline_argument + 5);
+			else if (!strncmp(isc_commandline_argument,
+					  "mkeytimers=", 11))
+			{
+				p = strtok_r(isc_commandline_argument + 11, "/", &last);
+				if (p == NULL)
+					named_main_earlyfatal("bad mkeytimer");
+				dns_zone_mkey_hour = atoi(p);
+				if (dns_zone_mkey_hour == 0)
+					named_main_earlyfatal("bad mkeytimer");
+
+				p = strtok_r(NULL, "/", &last);
+				if (p == NULL) {
+					dns_zone_mkey_day =
+						(24 * dns_zone_mkey_hour);
+					dns_zone_mkey_month =
+						(30 * dns_zone_mkey_day);
+					break;
+				}
+				dns_zone_mkey_day = atoi(p);
+				if (dns_zone_mkey_day < dns_zone_mkey_hour)
+					named_main_earlyfatal("bad mkeytimer");
+
+				p = strtok_r(NULL, "/", &last);
+				if (p == NULL) {
+					dns_zone_mkey_month =
+						(30 * dns_zone_mkey_day);
+					break;
+				}
+				dns_zone_mkey_month = atoi(p);
+				if (dns_zone_mkey_month < dns_zone_mkey_day)
+					named_main_earlyfatal("bad mkeytimer");
+			} else if (!strcmp(isc_commandline_argument, "notcp"))
+				notcp = ISC_TRUE;
+			else if (!strncmp(isc_commandline_argument, "tat=", 4))
+			{
+				named_g_tat_interval =
+					   atoi(isc_commandline_argument + 4);
+			} else if (!strcmp(isc_commandline_argument,
+					 "keepstderr"))
+			{
+				named_g_keepstderr = ISC_TRUE;
+			} else if (!strcmp(isc_commandline_argument,
+					   "fixedlocal"))
+			{
+				fixedlocal = ISC_TRUE;
+			} else {
+				fprintf(stderr, "unknown -T flag '%s\n",
+					isc_commandline_argument);
+			}
 			break;
 		case 'U':
 			named_g_udpdisp = parse_int(isc_commandline_argument,
@@ -1114,8 +1116,6 @@ setup(void) {
 		ns_server_setoption(sctx, NS_SERVER_DISABLE4, ISC_TRUE);
 	if (disable6)
 		ns_server_setoption(sctx, NS_SERVER_DISABLE6, ISC_TRUE);
-	if (sigvalinsecs)
-		ns_server_setoption(sctx, NS_SERVER_SIGVALINSECS, ISC_TRUE);
 
 	named_g_server->sctx->delay = delay;
 }

bin/named/server.c

@@ -32,11 +32,11 @@
 #include <isc/httpd.h>
 #include <isc/lex.h>
 #include <isc/meminfo.h>
-#include <isc/nonce.h>
 #include <isc/parseint.h>
 #include <isc/platform.h>
 #include <isc/portset.h>
 #include <isc/print.h>
+#include <isc/random.h>
 #include <isc/refcount.h>
 #include <isc/resource.h>
 #include <isc/sha2.h>
@@ -3613,7 +3613,8 @@ create_mapped_acl(void) {
 	if (result != ISC_R_SUCCESS)
 		return (result);
 
-	result = dns_iptable_addprefix(acl->iptable, &addr, 96, ISC_TRUE);
+	result = dns_iptable_addprefix(acl->iptable, &addr, 96,
+				       ISC_TRUE, ISC_FALSE);
 	if (result == ISC_R_SUCCESS)
 		dns_acl_attach(acl, &named_g_mapped);
 	dns_acl_detach(&acl);
@@ -3725,6 +3726,10 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
 	CHECKM(named_config_getport(config, &port), "port");
 	dns_view_setdstport(view, port);
 
+	CHECK(configure_view_acl(vconfig, config, named_g_config,
+				 "allow-query", NULL, actx,
+				 named_g_mctx, &view->queryacl));
+
 	/*
 	 * Make the list of response policy zone names for a view that
 	 * is used for real lookups and so cares about hints.
@@ -4089,7 +4094,7 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
 	obj = NULL;
 	result = named_config_get(maps, "max-stale-ttl", &obj);
 	INSIST(result == ISC_R_SUCCESS);
-	max_stale_ttl = ISC_MAX(cfg_obj_asuint32(obj), 1);
+	max_stale_ttl = cfg_obj_asuint32(obj);
 
 	obj = NULL;
 	result = named_config_get(maps, "stale-answer-enable", &obj);
@@ -4693,35 +4698,21 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
 				 "allow-query-cache-on", NULL, actx,
 				 named_g_mctx, &view->cacheonacl));
 	/*
-	 * Set the "allow-query", "allow-query-cache", "allow-recursion",
-	 * and "allow-recursion-on" ACLs if configured in named.conf, but
-	 * NOT from the global defaults. This is done by leaving the third
-	 * argument to configure_view_acl() NULL.
-	 *
-	 * We ignore the global defaults here because these ACLs
-	 * can inherit from each other.  If any are still unset after
-	 * applying the inheritance rules, we'll look up the defaults at
-	 * that time.
+	 * Set "allow-query-cache", "allow-recursion", and
+	 * "allow-recursion-on" acls if configured in named.conf.
+	 * (Ignore the global defaults for now, because these ACLs
+	 * can inherit from each other when only some of them set at
+	 * the options/view level.)
 	 */
-
-	/* named.conf only */
-	CHECK(configure_view_acl(vconfig, config, NULL,
-				 "allow-query", NULL, actx,
-				 named_g_mctx, &view->queryacl));
-
-	/* named.conf only */
-	CHECK(configure_view_acl(vconfig, config, NULL,
-				 "allow-query-cache", NULL, actx,
-				 named_g_mctx, &view->cacheacl));
+	CHECK(configure_view_acl(vconfig, config, NULL, "allow-query-cache",
+				 NULL, actx, named_g_mctx, &view->cacheacl));
 
 	if (strcmp(view->name, "_bind") != 0 &&
 	    view->rdclass != dns_rdataclass_chaos)
 	{
-		/* named.conf only */
 		CHECK(configure_view_acl(vconfig, config, NULL,
 					 "allow-recursion", NULL, actx,
 					 named_g_mctx, &view->recursionacl));
-		/* named.conf only */
 		CHECK(configure_view_acl(vconfig, config, NULL,
 					 "allow-recursion-on", NULL, actx,
 					 named_g_mctx, &view->recursiononacl));
@@ -4759,21 +4750,18 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
 		 * the global config.
 		 */
 		if (view->recursionacl == NULL) {
-			/* global default only */
 			CHECK(configure_view_acl(NULL, NULL, named_g_config,
 						 "allow-recursion", NULL,
 						 actx, named_g_mctx,
 						 &view->recursionacl));
 		}
 		if (view->recursiononacl == NULL) {
-			/* global default only */
 			CHECK(configure_view_acl(NULL, NULL, named_g_config,
 						 "allow-recursion-on", NULL,
 						 actx, named_g_mctx,
 						 &view->recursiononacl));
 		}
 		if (view->cacheacl == NULL) {
-			/* global default only */
 			CHECK(configure_view_acl(NULL, NULL, named_g_config,
 						 "allow-query-cache", NULL,
 						 actx, named_g_mctx,
@@ -4787,14 +4775,6 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
 		CHECK(dns_acl_none(mctx, &view->cacheacl));
 	}
 
-	if (view->queryacl == NULL) {
-		/* global default only */
-		CHECK(configure_view_acl(NULL, NULL, named_g_config,
-					 "allow-query", NULL,
-					 actx, named_g_mctx,
-					 &view->queryacl));
-	}
-
 	/*
 	 * Ignore case when compressing responses to the specified
 	 * clients. This causes case not always to be preserved,
@@ -5691,7 +5671,7 @@ create_view(const cfg_obj_t *vconfig, dns_viewlist_t *viewlist,
 	if (result != ISC_R_SUCCESS)
 		return (result);
 
-	isc_nonce_buf(view->secret, sizeof(view->secret));
+	isc_random_buf(view->secret, sizeof(view->secret));
 
 	ISC_LIST_APPEND(*viewlist, view, link);
 	dns_view_attach(view, viewp);
@@ -6282,7 +6262,7 @@ add_listenelt(isc_mem_t *mctx, ns_listenlist_t *list, isc_sockaddr_t *addr,
 			return (result);
 
 		result = dns_iptable_addprefix(src_acl->iptable, &netaddr,
-					       128, ISC_TRUE);
+					       128, ISC_TRUE, ISC_FALSE);
 		if (result != ISC_R_SUCCESS)
 			goto clean;
 
@@ -7930,6 +7910,11 @@ load_configuration(const char *filename, named_server_t *server,
 		named_geoip_load(NULL);
 	}
 	named_g_aclconfctx->geoip = named_g_geoip;
+
+	obj = NULL;
+	result = named_config_get(maps, "geoip-use-ecs", &obj);
+	INSIST(result == ISC_R_SUCCESS);
+	env->geoip_use_ecs = cfg_obj_asboolean(obj);
 #endif /* HAVE_GEOIP */
 
 	/*
@@ -8866,8 +8851,8 @@ load_configuration(const char *filename, named_server_t *server,
 			}
 		}
 	} else {
-		isc_nonce_buf(server->sctx->secret,
-			      sizeof(server->sctx->secret));
+		isc_random_buf(server->sctx->secret,
+			       sizeof(server->sctx->secret));
 	}
 
 	/*
@@ -9281,7 +9266,7 @@ shutdown_server(isc_task_t *task, isc_event_t *event) {
  */
 static isc_result_t
 get_matching_view(isc_netaddr_t *srcaddr, isc_netaddr_t *destaddr,
-		  dns_message_t *message, dns_aclenv_t *env,
+		  dns_message_t *message, dns_aclenv_t *env, dns_ecs_t *ecs,
 		  isc_result_t *sigresult, dns_view_t **viewp)
 {
 	dns_view_t *view;
@@ -9298,6 +9283,9 @@ get_matching_view(isc_netaddr_t *srcaddr, isc_netaddr_t *destaddr,
 		    message->rdclass == dns_rdataclass_any)
 		{
 			dns_name_t *tsig = NULL;
+			isc_netaddr_t *addr = NULL;
+			isc_uint8_t *scope = NULL;
+			isc_uint8_t source = 0;
 
 			*sigresult = dns_message_rechecksig(message, view);
 			if (*sigresult == ISC_R_SUCCESS) {
@@ -9307,9 +9295,15 @@ get_matching_view(isc_netaddr_t *srcaddr, isc_netaddr_t *destaddr,
 				tsig = dns_tsigkey_identity(tsigkey);
 			}
 
-			if (dns_acl_allowed(srcaddr, tsig,
-					    view->matchclients, env) &&
-			    dns_acl_allowed(destaddr, tsig,
+			if (ecs != NULL) {
+				addr = &ecs->addr;
+				source = ecs->source;
+				scope = &ecs->scope;
+			}
+
+			if (dns_acl_allowed(srcaddr, tsig, addr, source,
+					    scope, view->matchclients, env) &&
+			    dns_acl_allowed(destaddr, tsig, NULL, 0, NULL,
 					    view->matchdestinations, env) &&
 			    !(view->matchrecursiveonly &&
 			      (message->flags & DNS_MESSAGEFLAG_RD) == 0))
@@ -13534,7 +13528,7 @@ generate_salt(unsigned char *salt, size_t saltlen) {
 	if (saltlen > 256U)
 		return (ISC_R_RANGE);
 
-	isc_nonce_buf(salt, saltlen);
+	isc_random_buf(salt, saltlen);
 
 	r.base = salt;
 	r.length = (unsigned int) saltlen;
@@ -14426,6 +14420,7 @@ mkey_destroy(named_server_t *server, dns_view_t *view, isc_buffer_t **text) {
 	return (result);
 }
 
+
 static isc_result_t
 mkey_dumpzone(dns_view_t *view, isc_buffer_t **text) {
 	isc_result_t result;

bin/named/statschannel.c

@@ -3196,8 +3196,8 @@ client_ok(const isc_sockaddr_t *fromaddr, void *arg) {
 	isc_netaddr_fromsockaddr(&netaddr, fromaddr);
 
 	LOCK(&listener->lock);
-	if ((dns_acl_match(&netaddr, NULL, listener->acl, env,
-			   &match, NULL) == ISC_R_SUCCESS) && match > 0)
+	if (dns_acl_match(&netaddr, NULL, NULL, 0, NULL, listener->acl, env,
+			  &match, NULL) == ISC_R_SUCCESS && match > 0)
 	{
 		UNLOCK(&listener->lock);
 		return (ISC_TRUE);

bin/named/zoneconf.c

@@ -815,12 +815,11 @@ isself(dns_view_t *myview, dns_tsigkey_t *mykey,
 			tsig = dns_tsigkey_identity(mykey);
 		}
 
-		if (dns_acl_allowed(&netsrc, tsig, view->matchclients, env) &&
-		    dns_acl_allowed(&netdst, tsig, view->matchdestinations,
-				    env))
-		{
+		if (dns_acl_allowed(&netsrc, tsig, NULL, 0, NULL,
+				    view->matchclients, env) &&
+		    dns_acl_allowed(&netdst, tsig, NULL, 0, NULL,
+				    view->matchdestinations, env))
 			break;
-		}
 	}
 	return (ISC_TF(view == myview));
 }
@@ -1439,9 +1438,7 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 	}
 
 	if (ztype == dns_zone_master || raw != NULL) {
-		const cfg_obj_t *validity, *resign;
 		isc_boolean_t allow = ISC_FALSE, maint = ISC_FALSE;
-		isc_boolean_t sigvalinsecs;
 
 		obj = NULL;
 		result = named_config_get(maps, "dnskey-sig-validity", &obj);
@@ -1452,29 +1449,26 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 		obj = NULL;
 		result = named_config_get(maps, "sig-validity-interval", &obj);
 		INSIST(result == ISC_R_SUCCESS && obj != NULL);
+		{
+			const cfg_obj_t *validity, *resign;
 
-		sigvalinsecs = ns_server_getoption(named_g_server->sctx,
-						   NS_SERVER_SIGVALINSECS);
-		validity = cfg_tuple_get(obj, "validity");
-		seconds = cfg_obj_asuint32(validity);
-		if (!sigvalinsecs) {
-			seconds *= 86400;
-		}
-		dns_zone_setsigvalidityinterval(zone, seconds);
+			validity = cfg_tuple_get(obj, "validity");
+			seconds = cfg_obj_asuint32(validity) * 86400;
+			dns_zone_setsigvalidityinterval(zone, seconds);
 
-		resign = cfg_tuple_get(obj, "re-sign");
-		if (cfg_obj_isvoid(resign)) {
-			seconds /= 4;
-		} else if (!sigvalinsecs) {
-			if (seconds > 7 * 86400) {
-				seconds = cfg_obj_asuint32(resign) * 86400;
+			resign = cfg_tuple_get(obj, "re-sign");
+			if (cfg_obj_isvoid(resign)) {
+				seconds /= 4;
 			} else {
-				seconds = cfg_obj_asuint32(resign) * 3600;
+				if (seconds > 7 * 86400)
+					seconds = cfg_obj_asuint32(resign) *
+							86400;
+				else
+					seconds = cfg_obj_asuint32(resign) *
+							3600;
 			}
-		} else {
-			seconds = cfg_obj_asuint32(resign);
+			dns_zone_setsigresigninginterval(zone, seconds);
 		}
-		dns_zone_setsigresigninginterval(zone, seconds);
 
 		obj = NULL;
 		result = named_config_get(maps, "key-directory", &obj);

bin/nsupdate/nsupdate.c

@@ -29,7 +29,6 @@
 #include <isc/lex.h>
 #include <isc/log.h>
 #include <isc/mem.h>
-#include <isc/nonce.h>
 #include <isc/parseint.h>
 #include <isc/print.h>
 #include <isc/platform.h>
@@ -2830,16 +2829,14 @@ start_gssrequest(dns_name_t *master) {
 			fatal("out of memory");
 	}
 
-	memmove(kserver, &master_servers[master_inuse],
-		sizeof(isc_sockaddr_t));
+	memmove(kserver, &master_servers[master_inuse], sizeof(isc_sockaddr_t));
 
 	servname = dns_fixedname_initname(&fname);
 
 	if (realm == NULL)
 		get_ticket_realm(gmctx);
 
-	result = snprintf(servicename, sizeof(servicename), "DNS/%s%s",
-			  namestr, realm ? realm : "");
+	result = snprintf(servicename, sizeof(servicename), "DNS/%s%s", namestr, realm ? realm : "");
 	RUNTIME_CHECK(result < sizeof(servicename));
 	isc_buffer_init(&buf, servicename, strlen(servicename));
 	isc_buffer_add(&buf, strlen(servicename));
@@ -2851,10 +2848,9 @@ start_gssrequest(dns_name_t *master) {
 
 	keyname = dns_fixedname_initname(&fkname);
 
-	isc_nonce_buf(&val, sizeof(val));
+	val = isc_random();
 
-	result = snprintf(mykeystr, sizeof(mykeystr), "%u.sig-%s", val,
-			  namestr);
+	result = snprintf(mykeystr, sizeof(mykeystr), "%u.sig-%s", val, namestr);
 	RUNTIME_CHECK(result <= sizeof(mykeystr));
 
 	isc_buffer_init(&buf, mykeystr, strlen(mykeystr));

bin/python/isc/dnskey.py.in

@@ -32,7 +32,7 @@ class dnskey:
 
     _ALGNAMES = (None, 'RSAMD5', 'DH', 'DSA', 'ECC', 'RSASHA1',
                  'NSEC3DSA', 'NSEC3RSASHA1', 'RSASHA256', None,
-                 'RSASHA512', None, None, 'ECDSAP256SHA256',
+                 'RSASHA512', None, 'ECCGOST', 'ECDSAP256SHA256',
                  'ECDSAP384SHA384', 'ED25519', 'ED448')
 
     def __init__(self, key, directory=None, keyttl=None):

bin/python/isc/policy.py.in

@@ -71,7 +71,7 @@ class PolicyLex:
         return t
 
     def t_ALGNAME(self, t):
-        r'(?i)\b(RSAMD5|DH|DSA|NSEC3DSA|ECC|RSASHA1|NSEC3RSASHA1|RSASHA256|RSASHA512|ECDSAP256SHA256|ECDSAP384SHA384|ED25519|ED448)\b'
+        r'(?i)\b(RSAMD5|DH|DSA|NSEC3DSA|ECC|RSASHA1|NSEC3RSASHA1|RSASHA256|RSASHA512|ECCGOST|ECDSAP256SHA256|ECDSAP384SHA384|ED25519|ED448)\b'
         t.value = t.value.upper()
         return t
 
@@ -139,6 +139,7 @@ class Policy:
                              'NSEC3RSASHA1': [512, 4096],
                              'RSASHA256': [1024, 4096],
                              'RSASHA512': [1024, 4096],
+                             'ECCGOST': None,
                              'ECDSAP256SHA256': None,
                              'ECDSAP384SHA384': None,
                              'ED25519': None,
@@ -277,7 +278,8 @@ class Policy:
                         ('ZSK key size %d not divisible by 64 ' +
                          'as required for DSA') % self.zsk_keysize
 
-            if self.algorithm in ['ECDSAP256SHA256', \
+            if self.algorithm in ['ECCGOST', \
+                                  'ECDSAP256SHA256', \
                                   'ECDSAP384SHA384', \
                                   'ED25519', \
                                   'ED448']:
@@ -367,6 +369,10 @@ class dnssec_policy:
         self.alg_policy['RSASHA512'].algorithm = "RSASHA512"
         self.alg_policy['RSASHA512'].name = "RSASHA512"
 
+        self.alg_policy['ECCGOST'] = copy(p)
+        self.alg_policy['ECCGOST'].algorithm = "ECCGOST"
+        self.alg_policy['ECCGOST'].name = "ECCGOST"
+
         self.alg_policy['ECDSAP256SHA256'] = copy(p)
         self.alg_policy['ECDSAP256SHA256'].algorithm = "ECDSAP256SHA256"
         self.alg_policy['ECDSAP256SHA256'].name = "ECDSAP256SHA256"

bin/rndc/rndc.8

@@ -524,25 +524,13 @@ See also
 \fBrndc managed\-keys\fR\&.
 .RE
 .PP
-\fBserve\-stale ( on | off | reset | status ) \fR\fB[\fIclass\fR [\fIview\fR]]\fR
+\fBserve\-stale ( on | off | status | reset ) \fR\fB[\fIclass\fR [\fIview\fR]]\fR
 .RS 4
-Enable, disable, reset, or report the current status of the serving of stale answers as configured in
-named\&.conf\&.
+Enable, disable, or reset the serving of stale answers as configured in named\&.conf\&. Serving of stale answers will remain disabled across
+named\&.conf
+reloads if disabled via rndc until it is reset via rndc\&.
 .sp
-If serving of stale answers is disabled by
-\fBrndc\-serve\-stale off\fR, then it will remain disabled even if
-\fBnamed\fR
-is reloaded or reconfigured\&.
-\fBrndc serve\-stale reset\fR
-restores the setting as configured in
-named\&.conf\&.
-.sp
-\fBrndc serve\-stale status\fR
-will report whether serving of stale answers is currently enabled, disabled by the configuration, or disabled by
-\fBrndc\fR\&. It will also report the values of
-\fBstale\-answer\-ttl\fR
-and
-\fBmax\-stale\-ttl\fR\&.
+Status will report whether serving of stale answers is currently enabled, disabled or not configured for a view\&. If serving of stale records is configured then the values of stale\-answer\-ttl and max\-stale\-ttl are reported\&.
 .RE
 .PP
 \fBshowzone \fR\fB\fIzone\fR\fR\fB \fR\fB[\fIclass\fR [\fIview\fR]]\fR\fB \fR

bin/rndc/rndc.c

@@ -930,7 +930,7 @@ main(int argc, char **argv) {
 	if (argc < 1)
 		usage(1);
 
-	serial = isc_random32();
+	serial = isc_random();
 
 	DO("create memory context", isc_mem_create(0, 0, &rndc_mctx));
 	DO("create socket manager", isc_socketmgr_create(rndc_mctx, &socketmgr));

bin/rndc/rndc.docbook

@@ -785,28 +785,20 @@
       </varlistentry>
 
       <varlistentry>
-	<term><userinput>serve-stale ( on | off | reset | status ) <optional><replaceable>class</replaceable> <optional><replaceable>view</replaceable></optional></optional></userinput></term>
+	<term><userinput>serve-stale ( on | off | status | reset ) <optional><replaceable>class</replaceable> <optional><replaceable>view</replaceable></optional></optional></userinput></term>
 	<listitem>
 	  <para>
-	    Enable, disable, reset, or report the current status
-            of the serving of stale answers as configured in
-            <filename>named.conf</filename>.
+	    Enable, disable, or reset the serving of stale answers
+	    as configured in named.conf. Serving of stale answers
+	    will remain disabled across <filename>named.conf</filename>
+	    reloads if disabled via rndc until it is reset via rndc.
 	  </para>
 	  <para>
-            If serving of stale answers is disabled by
-            <command>rndc-serve-stale off</command>, then it
-	    will remain disabled even if <command>named</command>
-            is reloaded or reconfigured.
-            <command>rndc serve-stale reset</command> restores
-            the setting as configured in <filename>named.conf</filename>.
-	  </para>
-	  <para>
-	    <command>rndc serve-stale status</command> will report
-            whether serving of stale answers is currently enabled,
-            disabled by the configuration, or disabled by
-            <command>rndc</command>.  It will also report the
-	    values of <command>stale-answer-ttl</command> and
-	    <command>max-stale-ttl</command>.
+	    Status will report whether serving of stale answers is
+	    currently enabled, disabled or not configured for a
+	    view.  If serving of stale records is configured then
+	    the values of stale-answer-ttl and max-stale-ttl are
+	    reported.
 	  </para>
 	</listitem>
       </varlistentry>

bin/rndc/rndc.html

@@ -664,28 +664,20 @@
 	    See also <span class="command"><strong>rndc managed-keys</strong></span>.
 	  </p>
 	</dd>
-<dt><span class="term"><strong class="userinput"><code>serve-stale ( on | off | reset | status ) [<span class="optional"><em class="replaceable"><code>class</code></em> [<span class="optional"><em class="replaceable"><code>view</code></em></span>]</span>]</code></strong></span></dt>
+<dt><span class="term"><strong class="userinput"><code>serve-stale ( on | off | status | reset ) [<span class="optional"><em class="replaceable"><code>class</code></em> [<span class="optional"><em class="replaceable"><code>view</code></em></span>]</span>]</code></strong></span></dt>
 <dd>
 	  <p>
-	    Enable, disable, reset, or report the current status
-            of the serving of stale answers as configured in
-            <code class="filename">named.conf</code>.
+	    Enable, disable, or reset the serving of stale answers
+	    as configured in named.conf. Serving of stale answers
+	    will remain disabled across <code class="filename">named.conf</code>
+	    reloads if disabled via rndc until it is reset via rndc.
 	  </p>
 	  <p>
-            If serving of stale answers is disabled by
-            <span class="command"><strong>rndc-serve-stale off</strong></span>, then it
-	    will remain disabled even if <span class="command"><strong>named</strong></span>
-            is reloaded or reconfigured.
-            <span class="command"><strong>rndc serve-stale reset</strong></span> restores
-            the setting as configured in <code class="filename">named.conf</code>.
-	  </p>
-	  <p>
-	    <span class="command"><strong>rndc serve-stale status</strong></span> will report
-            whether serving of stale answers is currently enabled,
-            disabled by the configuration, or disabled by
-            <span class="command"><strong>rndc</strong></span>.  It will also report the
-	    values of <span class="command"><strong>stale-answer-ttl</strong></span> and
-	    <span class="command"><strong>max-stale-ttl</strong></span>.
+	    Status will report whether serving of stale answers is
+	    currently enabled, disabled or not configured for a
+	    view.  If serving of stale records is configured then
+	    the values of stale-answer-ttl and max-stale-ttl are
+	    reported.
 	  </p>
 	</dd>
 <dt><span class="term"><strong class="userinput"><code>showzone <em class="replaceable"><code>zone</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em> [<span class="optional"><em class="replaceable"><code>view</code></em></span>]</span>] </code></strong></span></dt>

bin/tests/optional/.gitignore

@@ -1,5 +0,0 @@
-/backtrace_test.dSYM/
-/backtrace_test0.dSYM/
-/backtrace_test_nosymtbl
-/backtrace_test_nosymtbl.dSYM/
-/nsecify

bin/tests/system/acl/clean.sh

@@ -21,4 +21,3 @@ rm -f */named.run
 rm -f ns*/named.lock
 rm -f ns*/_default.nzf
 rm -f ns*/_default.nzd*
-rm -f ns*/managed-keys.bind* ns*/*.mkeys*

bin/tests/system/acl/ns2/named6.conf.in

@@ -0,0 +1,50 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+key rndc_key {
+	secret "1234abcd8765";
+	algorithm hmac-sha256;
+};
+
+controls {
+	inet 10.53.0.2 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
+};
+
+options {
+	query-source address 10.53.0.2;
+	notify-source 10.53.0.2;
+	transfer-source 10.53.0.2;
+	port @PORT@;
+	pid-file "named.pid";
+	listen-on { 10.53.0.2; };
+	listen-on-v6 { none; };
+	recursion no;
+	notify yes;
+	ixfr-from-differences yes;
+	check-integrity no;
+	allow-query-on { 10.53.0.2; };
+};
+
+zone "." {
+	type hint;
+	file "../../common/root.hint";
+};
+
+zone "example" {
+	type master;
+	file "example.db";
+};
+
+zone "tsigzone" {
+	type master;
+	file "tsigzone.db";
+	allow-transfer { ecs 10.53/16; !10/8; };
+};

bin/tests/system/acl/ns2/named7.conf.in

@@ -0,0 +1,60 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+key rndc_key {
+	secret "1234abcd8765";
+	algorithm hmac-sha256;
+};
+
+controls {
+	inet 10.53.0.2 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
+};
+
+options {
+	query-source address 10.53.0.2;
+	notify-source 10.53.0.2;
+	transfer-source 10.53.0.2;
+	port @PORT@;
+	pid-file "named.pid";
+	listen-on { 10.53.0.2; };
+	listen-on-v6 { none; };
+	recursion no;
+	notify yes;
+	ixfr-from-differences yes;
+	check-integrity no;
+	allow-query-on { 10.53.0.2; };
+};
+
+view one {
+	match-clients { ecs 192.0.2/24; };
+
+	zone "." {
+		type hint;
+		file "../../common/root.hint";
+	};
+
+	zone "example" {
+		type master;
+		file "example.db";
+	};
+};
+
+view two {
+	zone "." {
+		type hint;
+		file "../../common/root.hint";
+	};
+
+	zone "example" {
+		type master;
+		file "example.db";
+	};
+};

bin/tests/system/acl/tests.sh

@@ -144,6 +144,36 @@ $DIG -p ${PORT} +tcp soa example. \
 	@10.53.0.2 -b 10.53.0.3 > dig.out.${t}
 grep "status: NOERROR" dig.out.${t} > /dev/null 2>&1 || { echo_i "test $t failed" ; status=1; }
 
+echo_i "testing EDNS client-subnet ACL processing"
+copy_setports ns2/named6.conf.in ns2/named.conf
+$RNDCCMD 10.53.0.2 reload 2>&1 | sed 's/^/ns2 /' | cat_i
+sleep 5
+
+# should fail
+t=`expr $t + 1`
+$DIG $DIGOPTS tsigzone. \
+	@10.53.0.2 -b 10.53.0.2 axfr > dig.out.${t}
+grep "^;" dig.out.${t} > /dev/null 2>&1 || { echo_i "test $t failed" ; status=1; }
+
+# should succeed
+t=`expr $t + 1`
+$DIG $DIGOPTS tsigzone. \
+	@10.53.0.2 -b 10.53.0.2 +subnet="10.53.0/24" axfr > dig.out.${t}
+grep "^;" dig.out.${t} > /dev/null 2>&1 && { echo_i "test $t failed" ; status=1; }
+
+echo_i "testing EDNS client-subnet response scope"
+copy_setports ns2/named7.conf.in ns2/named.conf
+$RNDCCMD 10.53.0.2 reload 2>&1 | sed 's/^/ns2 /' | cat_i
+sleep 5
+
+t=`expr $t + 1`
+$DIG -p ${PORT} example. soa @10.53.0.2 +subnet="10.53.0.1/32" > dig.out.${t}
+grep "CLIENT-SUBNET.*10.53.0.1/32/0" dig.out.${t} > /dev/null || { echo_i "test $t failed" ; status=1; }
+
+t=`expr $t + 1`
+$DIG -p ${PORT} example. soa @10.53.0.2 +subnet="192.0.2.128/32" > dig.out.${t}
+grep "CLIENT-SUBNET.*192.0.2.128/32/24" dig.out.${t} > /dev/null || { echo_i "test $t failed" ; status=1; }
+
 # AXFR tests against ns3
 
 echo_i "testing allow-transfer ACLs against ns3 (no existing zones)"

bin/tests/system/additional/clean.sh

@@ -18,4 +18,3 @@ rm -f */named.memstats
 rm -f */named.conf
 rm -f */named.run
 rm -f ns*/named.lock
-rm -f ns*/managed-keys.bind*

bin/tests/system/additional/ns1/named1.conf.in

@@ -14,7 +14,6 @@ options {
 	notify-source 10.53.0.1;
 	transfer-source 10.53.0.1;
 	recursion no;
-	dnssec-validation no;
 	port @PORT@;
 	pid-file "named.pid";
 	listen-on { 10.53.0.1; };

bin/tests/system/additional/ns1/named2.conf.in

@@ -14,7 +14,6 @@ options {
 	notify-source 10.53.0.1;
 	transfer-source 10.53.0.1;
 	recursion no;
-	dnssec-validation no;
 	port @PORT@;
 	pid-file "named.pid";
 	listen-on { 10.53.0.1; };

bin/tests/system/additional/ns1/named3.conf.in

@@ -14,7 +14,6 @@ options {
 	notify-source 10.53.0.1;
 	transfer-source 10.53.0.1;
 	recursion no;
-	dnssec-validation no;
 	port @PORT@;
 	pid-file "named.pid";
 	listen-on { 10.53.0.1; };

bin/tests/system/additional/ns1/named4.conf.in

@@ -14,7 +14,6 @@ options {
 	notify-source 10.53.0.1;
 	transfer-source 10.53.0.1;
 	recursion no;
-	dnssec-validation no;
 	port @PORT@;
 	pid-file "named.pid";
 	listen-on { 10.53.0.1; };

bin/tests/system/additional/ns3/named.conf.in

@@ -20,7 +20,6 @@ options {
 	listen-on { 10.53.0.3; };
 	listen-on-v6 { none; };
 	recursion yes;
-	dnssec-validation yes;
 };
 
 zone "." {

bin/tests/system/addzone/clean.sh

@@ -37,4 +37,3 @@ rm -f ns1/redirect.db
 rm -f ns2/redirect.db
 rm -f ns2/redirect.bk
 rm -f ns3/redirect.db
-rm -f ns*/managed-keys.bind* ns*/*.mkeys*

bin/tests/system/allow-query/clean.sh

@@ -14,9 +14,7 @@
 #
 
 rm -f dig.out.*
-rm -f ns*/named.conf
-rm -f ns2/controls.conf
+rm -f ns2/named.conf ns2/controls.conf
 rm -f */named.memstats
 rm -f ns*/named.lock
 rm -f ns*/named.run ns*/named.run.prev
-rm -f ns*/managed-keys.bind* ns*/*.mkeys*

bin/tests/system/allow-query/ns3/named.args

@@ -1,2 +0,0 @@
-# this server only has 127.0.0.1 in its localhost/localnets ACLs
--m record,size,mctx -c named.conf -d 99 -X named.lock -g -T clienttest -T fixedlocal

bin/tests/system/allow-query/setup.sh

@@ -13,6 +13,4 @@ SYSTEMTESTTOP=..
 . $SYSTEMTESTTOP/conf.sh
 
 copy_setports ../common/controls.conf.in ns2/controls.conf
-copy_setports  ns1/named.conf.in ns1/named.conf
 copy_setports  ns2/named01.conf.in ns2/named.conf
-copy_setports  ns3/named.conf.in ns3/named.conf

bin/tests/system/allow-query/tests.sh

@@ -602,16 +602,5 @@ grep '^a.aclnotallow.example' dig.out.ns2.2.$n > /dev/null && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
 
-# Test 58 - allow-recursion inheritance
-n=`expr $n + 1`
-echo_i "test $n: default recursion configuration"
-ret=0
-$DIG -p ${PORT} @10.53.0.3 -b 127.0.0.1 a.normal.example a > dig.out.ns3.1.$n
-grep 'status: NOERROR' dig.out.ns3.1.$n > /dev/null || ret=1
-$DIG -p ${PORT} @10.53.0.3 -b 10.53.0.1 a.normal.example a > dig.out.ns3.2.$n
-grep 'status: REFUSED' dig.out.ns3.2.$n > /dev/null || ret=1
-if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
-
 echo_i "exit status: $status"
 [ $status -eq 0 ] || exit 1

bin/tests/system/auth/clean.sh

@@ -13,4 +13,3 @@ rm -f */named.conf
 rm -f dig.out.test*
 rm -f ns2/example.com.bk
 rm -f ns2/example.net.bk
-rm -f ns*/managed-keys.bind*

bin/tests/system/autosign/clean.sh

@@ -63,4 +63,3 @@ rm -f nsupdate.out
 rm -f settime.out.*
 rm -f signing.out.*
 rm -f sync.key
-rm -f ns*/managed-keys.bind*

bin/tests/system/builtin/clean.sh

@@ -15,4 +15,3 @@ rm -f ns?/named.conf
 rm -f rndc.status.ns*
 rm -f dig.out.ns*
 rm -f ns*/named.lock
-rm -f ns*/managed-keys.bind*

bin/tests/system/cacheclean/clean.sh

@@ -21,4 +21,3 @@ rm -f */named.run
 rm -f */named.conf
 rm -f ns2/named_dump.db.*
 rm -f ns*/named.lock
-rm -f ns*/managed-keys.bind*

bin/tests/system/cacheclean/ns1/named.conf.in

@@ -18,7 +18,6 @@ options {
 	listen-on { 10.53.0.1; };
 	listen-on-v6 { none; };
 	recursion no;
-	dnssec-validation no;
 	notify yes;
 	check-integrity no;
 	minimal-responses no;

bin/tests/system/cacheclean/ns2/named.conf.in

@@ -20,8 +20,6 @@ options {
 	notify yes;
 	max-cache-size 80%;
 	disable-empty-zone 127.IN-ADDR.ARPA;
-	recursion yes;
-	dnssec-validation yes;
 };
 
 key rndc_key {

bin/tests/system/case/clean.sh

@@ -19,4 +19,3 @@ rm -f ns1/dynamic.db.jnl
 rm -f ns2/dynamic.bk
 rm -f ns2/dynamic.bk.jnl
 rm -f ns2/example.bk
-rm -f ns*/managed-keys.bind*

bin/tests/system/catz/clean.sh

@@ -17,9 +17,8 @@ rm -f ns*/named.run
 rm -f ns1/*dom*example.db
 rm -f ns2/__catz__*db
 rm -f ns2/named.conf.tmp
-rm -f ns3/dom13.example.db ns3/dom14.example.db
+rm -f ns3/dom{13,14}.example.db
 rm -f nsupdate.out.*
-rm -f ns[123]/catalog[1234].example.db
+rm -f ns{1,2,3}/catalog{1,2,3,4}.example.db
 rm -rf ns2/zonedir
 rm -f ns*/*.nzd ns*/*.nzd-lock
-rm -f ns*/managed-keys.bind*

bin/tests/system/chain/clean.sh

@@ -13,4 +13,3 @@ rm -f dig.out.* named*.pid
 rm -f ns*/named.conf
 rm -f */named.memstats */named.recursing */named.lock */named.run */ans.run
 rm -f ns2/K* ns2/dsset-* ns2/example.db.signed
-rm -f ns*/managed-keys.bind*

bin/tests/system/chain/ns1/named.conf.in

@@ -18,8 +18,8 @@ options {
 	listen-on { 10.53.0.1; };
 	listen-on-v6 { none; };
 	recursion no;
-	dnssec-validation yes;
 	notify yes;
+	dnssec-enable yes;
 };
 
 zone "." { type master; file "root.db"; };

bin/tests/system/chain/ns2/named.conf.in

@@ -20,7 +20,6 @@ options {
 	listen-on { 10.53.0.2; };
 	listen-on-v6 { none; };
 	recursion no;
-	dnssec-validation no;
 	notify yes;
 };
 

bin/tests/system/chain/ns5/named.conf.in

@@ -20,7 +20,6 @@ options {
 	listen-on { 10.53.0.5; };
 	listen-on-v6 { none; };
 	recursion no;
-	dnssec-validation no;
 	notify yes;
 };
 

bin/tests/system/chain/ns7/named.conf.in

@@ -20,7 +20,6 @@ options {
 	listen-on-v6 { fd92:7065:b8e:ffff::7; };
 	recursion yes;
 	allow-recursion { any; };
-	dnssec-validation yes;
 };
 
 key rndc_key {

bin/tests/system/checkconf/bad-geoip-use-ecs.conf

@@ -1,14 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-options {
-	geoip-use-ecs yes;
-};

bin/tests/system/checkconf/tests.sh

@@ -396,13 +396,5 @@ grep "trusted-key for dlv.isc.org still present" checkconf.out$n > /dev/null ||
 if [ $ret != 0 ]; then echo_i "failed"; ret=1; fi
 status=`expr $status + $ret`
 
-echo_i "check that 'geoip-use-ecs no' generates a warning ($n)"
-ret=0
-$CHECKCONF warn-geoip-use-ecs.conf > checkconf.out$n 2>/dev/null || ret=1
-[ -s checkconf.out$n ] || ret=1
-grep "'geoip-use-ecs' is obsolete" checkconf.out$n > /dev/null || ret=1
-if [ $ret != 0 ]; then echo_i "failed"; ret=1; fi
-status=`expr $status + $ret`
-
 echo_i "exit status: $status"
 [ $status -eq 0 ] || exit 1

bin/tests/system/checkconf/warn-geoip-use-ecs.conf

@@ -1,14 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-options {
-	geoip-use-ecs no;
-};

bin/tests/system/checknames/clean.sh

@@ -20,4 +20,3 @@ rm -f ns4/*.update.db.jnl
 rm -f */named.memstats
 rm -f */named.run
 rm -f ns*/named.lock
-rm -f ns*/managed-keys.bind*

bin/tests/system/checknames/ns1/named.conf.in

@@ -18,7 +18,6 @@ options {
 	listen-on { 10.53.0.1; };
 	listen-on-v6 { none; };
 	recursion no;
-	dnssec-validation no;
 	notify yes;
 	check-integrity no;
 };

bin/tests/system/checknames/ns2/named.conf.in

@@ -18,7 +18,6 @@ options {
 	listen-on { 10.53.0.2; };
 	listen-on-v6 { none; };
 	recursion yes;
-	dnssec-validation yes;
 	check-names response warn;
 	notify yes;
 };

bin/tests/system/checknames/ns3/named.conf.in

@@ -18,7 +18,6 @@ options {
 	listen-on { 10.53.0.3; };
 	listen-on-v6 { none; };
 	recursion yes;
-	dnssec-validation yes;
 	check-names response fail;
 	notify yes;
 };

bin/tests/system/checknames/ns4/named.conf.in

@@ -18,7 +18,6 @@ options {
 	listen-on { 10.53.0.4; };
 	listen-on-v6 { none; };
 	recursion yes;
-	dnssec-validation yes;
 	check-names master ignore;
 	notify yes;
 };

bin/tests/system/conf.sh.in

@@ -71,12 +71,12 @@ KRB5_CONFIG=/dev/null
 
 # The "stress" test is not run by default since it creates enough
 # load on the machine to make it unusable to other users.
-# The "dialup", "delzone", and "dupsigs" tests are also not run by
-# default because they take a very long time to complete.
+# The "dialup" and "delzone" tests are also not run by default because
+# they take a very long time to complete.
 #
 # List of tests hard-coded to use ports 5300 and 9953. For this
 # reason, these must be run sequentially.
-SEQUENTIALDIRS="ecdsa eddsa @PKCS11_TEST@ tkey"
+SEQUENTIALDIRS="ecdsa eddsa gost @PKCS11_TEST@ tkey"
 
 # List of tests that use ports assigned by caller (other than 5300
 # and 9953). Because separate blocks of ports can be used for teach
@@ -163,7 +163,7 @@ NZD=@NZD_TOOLS@
 #
 # Set up color-coded test output
 #
-if [ ${SYSTEMTEST_FORCE_COLOR:-0} -eq 1 ] || test -t 1 && type tput > /dev/null 2>&1 && tput setaf 7 > /dev/null 2>&1 ; then
+if [ ${SYSTEMTEST_FORCE_COLOR:-0} -eq 1 ] || test -t 1 && type tput > /dev/null 2>&1 ; then
     COLOR_END=`tput setaf 4`    # blue
     COLOR_FAIL=`tput setaf 1`   # red
     COLOR_INFO=`tput bold`      # bold

bin/tests/system/conf.sh.win32

@@ -77,8 +77,7 @@ KRB5_CONFIG=NUL
 
 # The "stress" test is not run by default since it creates enough
 # load on the machine to make it unusable to other users.
-# The "dialup", "delzone", and "dupsigs" tests are also not run by
-# default because they take a very long time to complete.
+# v6synth
 #
 # List of tests that use ports 5300 and 9953.  For this reason, these must
 # be run sequentially.
@@ -88,7 +87,7 @@ SEQUENTIALDIRS="acl additional addzone autosign builtin \
 	 database digdelv dlv dlvauto dlz dlzexternal dname \
 	 dns64 dnssec @DNSTAP@ dscp dsdigest dyndb ecdsa eddsa \
 	 ednscompliance emptyzones \
-	 fetchlimit filter-aaaa formerr forward geoip glue idna inline ixfr \
+	 fetchlimit filter-aaaa formerr forward geoip glue gost idna inline ixfr \
 	 keepalive @KEYMGR@ legacy limits logfileconfig masterfile \
 	 masterformat metadata mkeys names notify nslookup nsupdate \
 	 nzd2nzf padding pending pipelined @PKCS11_TEST@ reclimit \
@@ -200,17 +199,11 @@ echoend () {
         printf "${COLOR_END}%s${COLOR_NONE}\n" "$*"
 }
 
-SYSTESTDIR="`basename $PWD`"
+TESTNAME="`basename $PWD`"
 
 echo_i() {
     echo "$@" | while read LINE ; do
-       echoinfo "I:$SYSTESTDIR:$LINE"
-    done
-}
-
-echo_ic() {
-    echo "$@" | while read LINE ; do
-       echoinfo "I:$SYSTESTDIR:  $LINE"
+       echoinfo "I:$TESTNAME:$LINE"
     done
 }
 

bin/tests/system/cookie/clean.sh

@@ -13,4 +13,3 @@ rm -f ns1/named_dump.db
 rm -f ns*/named.memstats
 rm -f ns*/named.run
 rm -f ns*/named.lock
-rm -f ns*/managed-keys.bind*

bin/tests/system/cookie/ns1/named.conf.in

@@ -27,7 +27,6 @@ options {
 	listen-on { 10.53.0.1; };
 	listen-on-v6 { none; };
 	recursion yes;
-	dnssec-validation yes;
 	deny-answer-addresses { 192.0.2.0/24; 2001:db8:beef::/48; }
 		 except-from { "example.org"; };
 	deny-answer-aliases { "example.org"; }

bin/tests/system/cookie/ns2/named.conf.in

@@ -18,7 +18,6 @@ options {
 	listen-on { 10.53.0.2; };
 	listen-on-v6 { none; };
 	recursion no;
-	dnssec-validation no;
 	send-cookie yes;
 	nocookie-udp-size 512;
 };

bin/tests/system/cookie/ns3/named.conf.in

@@ -27,7 +27,6 @@ options {
 	listen-on { 10.53.0.3; };
 	listen-on-v6 { none; };
 	recursion yes;
-	dnssec-validation yes;
 	deny-answer-addresses { 192.0.2.0/24; 2001:db8:beef::/48; }
 		 except-from { "example.org"; };
 	deny-answer-aliases { "example.org"; }

bin/tests/system/cookie/ns4/named.conf.in

@@ -27,7 +27,6 @@ options {
 	listen-on { 10.53.0.4; };
 	listen-on-v6 { none; };
 	recursion yes;
-	dnssec-validation yes;
 	cookie-algorithm sha1;
 	cookie-secret "569d36a6cc27d6bf55502183302ba352745255a2";
 	require-server-cookie yes;

bin/tests/system/cookie/ns5/named.conf.in

@@ -27,7 +27,6 @@ options {
 	listen-on { 10.53.0.5; };
 	listen-on-v6 { none; };
 	recursion yes;
-	dnssec-validation yes;
 	cookie-algorithm sha1;
 	cookie-secret "569d36a6cc27d6bf55502183302ba352745255a2";
 	cookie-secret "6b300e27a0db46d4b046e4189790fa7db3c1ffb3";

bin/tests/system/cookie/ns6/named.conf.in

@@ -27,7 +27,6 @@ options {
 	listen-on { 10.53.0.6; };
 	listen-on-v6 { none; };
 	recursion yes;
-	dnssec-validation yes;
 	cookie-algorithm sha1;
 	cookie-secret "6b300e27a0db46d4b046e4189790fa7db3c1ffb3";
 	require-server-cookie yes;

bin/tests/system/database/clean.sh

@@ -12,4 +12,3 @@
 rm -f ns1/named.conf ns1/named.run ns1/named.memstats
 rm -f dig.out.*
 rm -f ns*/named.lock
-rm -f ns*/managed-keys.bind*

bin/tests/system/delzone/clean.sh

@@ -20,4 +20,3 @@ rm -f ns2/inline.db.signed
 rm -f ns2/inlineslave.bk*
 rm -f ns*/named.lock
 rm -f ns2/nzf-*
-rm -f ns*/managed-keys.bind*

bin/tests/system/delzone/ns1/named.conf

@@ -18,7 +18,6 @@ options {
 	listen-on-v6 { none; };
 	allow-query { any; };
 	recursion no;
-	dnssec-validation no;
 };
 
 zone "." {

bin/tests/system/delzone/ns2/named.conf

@@ -16,7 +16,6 @@ options {
 	listen-on-v6 { none; };
 	allow-query { any; };
 	recursion no;
-	dnssec-validation no;
 	allow-new-zones yes;
 };
 

bin/tests/system/dialup/ns1/named.conf

@@ -21,7 +21,6 @@ options {
 	listen-on-v6 { none; };
 	heartbeat-interval 2;
 	recursion no;
-	dnssec-validation no;
 };
 
 zone "." {

bin/tests/system/dialup/ns2/named.conf

@@ -21,7 +21,6 @@ options {
 	listen-on-v6 { none; };
 	heartbeat-interval 2;
 	recursion no;
-	dnssec-validation no;
 };
 
 zone "." {

bin/tests/system/dialup/ns3/named.conf

@@ -21,7 +21,6 @@ options {
 	listen-on-v6 { none; };
 	heartbeat-interval 2;
 	recursion no;
-	dnssec-validation no;
 };
 
 zone "." {

bin/tests/system/digdelv/clean.sh

@@ -19,4 +19,3 @@ rm -f dig.out.mn.*
 rm -f dig.out.nm.*
 rm -f dig.out.nn.*
 rm -f ns*/named.lock
-rm -f ns*/managed-keys.bind*

bin/tests/system/dlv/clean.sh

@@ -40,4 +40,3 @@ rm -f ns6/signer.err
 rm -f */named.memstats
 rm -f dig.out.ns*.test*
 rm -f ns*/named.lock
-rm -f ns*/managed-keys.bind*

bin/tests/system/dlz/clean.sh

@@ -14,4 +14,3 @@ rm -f dig.out.*
 rm -f */named.memstats
 rm -f */named.run
 rm -f ns*/named.lock
-rm -f ns*/managed-keys.bind*

bin/tests/system/dlzexternal/clean.sh

@@ -21,4 +21,3 @@ rm -f ns1/ddns.key
 rm -f dig.out*
 rm -f ns*/named.lock
 rm -f ns1/session.key
-rm -f ns*/managed-keys.bind*

bin/tests/system/dns64/clean.sh

@@ -17,4 +17,3 @@ rm -f */named.memstats
 rm -f */named.run
 rm -f dig.out.*
 rm -f ns*/named.lock
-rm -f ns*/managed-keys.bind*

bin/tests/system/dnssec/clean.sh

@@ -97,4 +97,3 @@ rm -f signer/general/signer.out.*
 rm -f signer/general/dsset*
 rm -f signing.out*
 rm -f python.out.*
-rm -f ns*/managed-keys.bind* ns*/*.mkeys*

bin/tests/system/dnssec/tests.sh

@@ -18,7 +18,6 @@ n=1
 rm -f dig.out.*
 
 DIGOPTS="+tcp +noadd +nosea +nostat +nocmd +dnssec -p ${PORT}"
-ADDITIONALOPTS="+noall +additional +dnssec -p ${PORT}"
 ANSWEROPTS="+noall +answer +dnssec -p ${PORT}"
 DELVOPTS="-a ns1/trusted.conf -p ${PORT}"
 RNDCCMD="$RNDC -c $SYSTEMTESTTOP/common/rndc.conf -p ${CONTROLPORT} -s"
@@ -2768,30 +2767,12 @@ n=`expr $n + 1`
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
 
-echo_i "testing TTL is capped at RRSIG expiry time for records in the additional section (NS) ($n)"
+echo_i "testing TTL is capped at RRSIG expiry time for records in the additional section ($n)"
 ret=0
 $RNDCCMD 10.53.0.4 flush 2>&1 | sed 's/^/ns4 /' | cat_i
 sleep 1
-$DIG $ADDITIONALOPTS +cd expiring.example ns @10.53.0.4 > dig.out.ns4.1.$n
-$DIG $ADDITIONALOPTS expiring.example ns @10.53.0.4 > dig.out.ns4.2.$n
-ttls=`awk '$1 != ";;" {print $2}' dig.out.ns4.1.$n`
-ttls2=`awk '$1 != ";;" {print $2}' dig.out.ns4.2.$n`
-for ttl in ${ttls:-300}; do
-    [ ${ttl:-0} -eq 300 ] || ret=1
-done
-for ttl in ${ttls2:-0}; do
-    [ ${ttl:-0} -le 60 ] || ret=1
-done
-n=`expr $n + 1`
-if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
-
-echo_i "testing TTL is capped at RRSIG expiry time for records in the additional section (MX) ($n)"
-ret=0
-$RNDCCMD 10.53.0.4 flush 2>&1 | sed 's/^/ns4 /' | cat_i
-sleep 1
-$DIG $ADDITIONALOPTS +cd expiring.example mx @10.53.0.4 > dig.out.ns4.1.$n
-$DIG $ADDITIONALOPTS expiring.example mx @10.53.0.4 > dig.out.ns4.2.$n
+$DIG $ANSWEROPTS +cd expiring.example mx @10.53.0.4 > dig.out.ns4.1.$n
+$DIG $ANSWEROPTS expiring.example mx @10.53.0.4 > dig.out.ns4.2.$n
 ttls=`awk '$1 != ";;" {print $2}' dig.out.ns4.1.$n`
 ttls2=`awk '$1 != ";;" {print $2}' dig.out.ns4.2.$n`
 for ttl in ${ttls:-300}; do

bin/tests/system/dnstap/clean.sh

@@ -22,4 +22,3 @@ rm -f ns*/dnstap.out.save
 rm -f ns*/dnstap.out.save.?
 rm -f ns*/named.lock
 rm -f ydump.out
-rm -f ns*/managed-keys.bind*

bin/tests/system/dscp/clean.sh

@@ -13,4 +13,3 @@ rm -f */named.memstats
 rm -f */named.run
 rm -f */named.conf
 rm -f ns*/named.lock
-rm -f ns*/managed-keys.bind*