Make ns_client_requests atomic.

Proper lock ordering in dns_view_setviewcommit. Need to make sure it's correct.
TSAN: lock epoll_ctl calls to silence warnings
2019-01-22 12:23:54 +01:00 · 2019-01-22 12:22:42 +01:00 · 2019-01-22 11:51:38 +01:00 · 2019-01-22 10:59:09 +01:00 · 2019-01-22 10:58:51 +01:00 · 2019-01-22 10:46:13 +01:00
533 changed files with 15685 additions and 13264 deletions
@@ -0,0 +1,64 @@
+;;; Directory Local Variables
+;;; For more information see (info "(emacs) Directory Variables")
+
+((c-mode .
+  ((eval .
+	 (set (make-local-variable 'directory-of-current-dir-locals-file)
+	      (file-name-directory (locate-dominating-file default-directory ".dir-locals.el"))
+	      )
+	 )
+   (eval .
+	 (set (make-local-variable 'include-directories)
+	      (list
+
+	       ;; top directory
+	       (expand-file-name
+		(concat directory-of-current-dir-locals-file "./"))
+
+	       ;; current directory
+	       (expand-file-name (concat default-directory "./"))
+
+	       ;; libisc
+	       (expand-file-name
+		(concat directory-of-current-dir-locals-file "lib/isc/unix/include"))
+	       (expand-file-name
+		(concat directory-of-current-dir-locals-file "lib/isc/pthreads/include"))
+	       (expand-file-name
+		(concat directory-of-current-dir-locals-file "lib/isc/include"))
+
+	       ;; libdns
+
+	       (expand-file-name
+		(concat directory-of-current-dir-locals-file "lib/dns/include"))
+
+	       ;; libisccc
+	       (expand-file-name
+		(concat directory-of-current-dir-locals-file "lib/isccc/include"))
+
+	       ;; libisccfg
+	       (expand-file-name
+		(concat directory-of-current-dir-locals-file "lib/isccfg/include"))
+
+	       ;; libns
+	       (expand-file-name
+		(concat directory-of-current-dir-locals-file "lib/ns/include"))
+
+	       ;; libirs
+	       (expand-file-name
+		(concat directory-of-current-dir-locals-file "lib/irs/include"))
+
+	       ;; libbind9
+	       (expand-file-name
+		(concat directory-of-current-dir-locals-file "lib/bind9/include"))
+
+	       (expand-file-name "/usr/local/opt/openssl@1.1/include")
+	       (expand-file-name "/usr/local/opt/libxml2/include/libxml2")
+	       (expand-file-name "/usr/local/include")
+	       )
+	      )
+	 )
+
+   (eval setq flycheck-clang-include-path include-directories)
+   (eval setq flycheck-cppcheck-include-path include-directories)
+   )
+  ))
@@ -82,20 +82,6 @@ stages:
    - docker
    - i386

-.ubuntu-trusty-amd64: &ubuntu_trusty_amd64_image
-  image: "$CI_REGISTRY_IMAGE:ubuntu-trusty-amd64"
-  tags:
-    - linux
-    - docker
-    - amd64
-
-.ubuntu-trusty-i386: &ubuntu_trusty_i386_image
-  image: "$CI_REGISTRY_IMAGE:ubuntu-trusty-i386"
-  tags:
-    - linux
-    - docker
-    - i386
-
 .ubuntu-xenial-amd64: &ubuntu_xenial_amd64_image
  image: "$CI_REGISTRY_IMAGE:ubuntu-xenial-amd64"
  tags:
@@ -110,6 +96,20 @@ stages:
    - docker
    - i386

+.ubuntu-bionic-amd64: &ubuntu_bionic_amd64_image
+  image: "$CI_REGISTRY_IMAGE:ubuntu-bionic-amd64"
+  tags:
+    - linux
+    - docker
+    - amd64
+
+.ubuntu-bionic-i386: &ubuntu_bionic_i386_image
+  image: "$CI_REGISTRY_IMAGE:ubuntu-bionic-i386"
+  tags:
+    - linux
+    - docker
+    - i386
+
 .build: &build_job
  stage: build
  before_script:
@@ -117,12 +117,14 @@ stages:
 #    - ./autogen.sh
  script:
    - ./configure --enable-developer --with-libtool --disable-static --with-cmocka --prefix=$HOME/.local --without-make-clean $EXTRA_CONFIGURE || cat config.log
-    - make -j${PARALLEL_JOBS_BUILD:-1} -k all V=1
+    - make -j${BUILD_PARALLEL_JOBS:-1} -k all V=1
  artifacts:
    paths:
    - doc/
    expire_in: '1 hour'
    untracked: true
+  only:
+  - merge_requests

 .install_test: &install_test_job
  stage: test
@@ -133,6 +135,7 @@ stages:

 .system_test: &system_test_job
  stage: test
+  retry: 2
  before_script:
    - rm -rf .ccache
    - bash -x bin/tests/system/ifconfig.sh up
@@ -144,6 +147,8 @@ stages:
    untracked: true
    expire_in: '1 week'
    when: on_failure
+  only:
+  - merge_requests

 .unit_test: &unit_test_job
  stage: test
@@ -161,12 +166,17 @@ stages:
    - kyua_html/
    expire_in: '1 week'
    when: on_failure
+  only:
+  - merge_requests

-precheck:debian:sid:amd64:
+sid:amd64:precheck:
  <<: *debian_sid_amd64_image
  stage: precheck
  script:
    - sh util/checklibs.sh > checklibs.out
+    - sh util/tabify-changes < CHANGES > CHANGES.tmp
+    - diff -urNap CHANGES CHANGES.tmp
+    - rm CHANGES.tmp
    - perl util/check-changes CHANGES
    - perl -w util/merge_copyrights
    - diff -urNap util/copyrights util/newcopyrights
@@ -181,12 +191,21 @@ precheck:debian:sid:amd64:
    - checklibs.out
    expire_in: '1 week'
    when: on_failure
+  only:
+  - merge_requests

-docs:debian:sid:amd64:
+🐞:sid:amd64:precheck:
+  <<: *debian_sid_amd64_image
+  stage: precheck
+  script: util/check-cocci
+  only:
+  - merge_requests
+
+docs:sid:amd64:
  <<: *debian_sid_amd64_image
  stage: test
  dependencies:
-    - build:debian:sid:amd64
+    - sid:amd64:build
  script:
    - make -C doc/misc docbook
    - make -C doc/arm Bv9ARM.html
@@ -194,26 +213,30 @@ docs:debian:sid:amd64:
    paths:
    - doc/arm/
    expire_in: '1 month'
+  only:
+  - merge_requests
+  - master@isc-projects/bind9
+  - /^v9_.*$/@isc-projects/bind9

-push:docs:
+docs:push:
  <<: *debian_sid_amd64_image
  stage: push
  dependencies: []
  script:
    - curl -X POST -F token=$GITLAB_PAGES_DOCS_TRIGGER_TOKEN -F ref=master $GITLAB_PAGES_DOCS_TRIGGER_URL
  only:
-    - master@isc-projects/bind9
-    - /^v9_.*$/@isc-projects/bind9
+  - master@isc-projects/bind9
+  - /^v9_.*$/@isc-projects/bind9

-#build:debian:jessie:amd64:
+#jessie:amd64:build:
 #  <<: *debian_jessie_amd64_image
 #  <<: *build_job
 #
-#build:debian:jessie:i386:
+#build:jessie:i386:
 #  <<: *debian_jessie_i386_image
 #  <<: *build_job
 #
-#build:debian:stretch:amd64:
+#build:stretch:amd64:
 #  <<: *debian_stretch_amd64_image
 #  <<: *build_job
 #
@@ -221,15 +244,15 @@ push:docs:
 #  <<: *debian_buster_i386_image
 #  <<: *build_job
 #
-#build:ubuntu:trusty:amd64:
-#  <<: *ubuntu_trusty_amd64_image
+#build:ubuntu:bionic:amd64:
+#  <<: *ubuntu_bionic_amd64_image
 #  <<: *build_job
 #
 #build:ubuntu:xenial:i386:
 #  <<: *ubuntu_xenial_i386_image
 #  <<: *build_job

-build:centos:centos6:amd64:
+centos6:amd64:build:
  variables:
    CC: gcc
    CFLAGS: "-Wall -Wextra -O2 -g"
@@ -237,7 +260,7 @@ build:centos:centos6:amd64:
  <<: *centos_centos6_amd64_image
  <<: *build_job

-build:centos:centos7:amd64:
+centos7:amd64:build:
  variables:
    CC: gcc
    CFLAGS: "-Wall -Wextra -O2 -g"
@@ -245,37 +268,42 @@ build:centos:centos7:amd64:
  <<: *centos_centos7_amd64_image
  <<: *build_job

-build:clang:debian:stretch:amd64:
+clang:stretch:amd64:build:
  variables:
    CC: clang
    CFLAGS: "-Wall -Wextra -Wenum-conversion -O2 -g"
+    EXTRA_CONFIGURE: "--with-python=python3"
  <<: *debian_stretch_amd64_image
  <<: *build_job

-build:debian:jessie:amd64:
+jessie:amd64:build:
  variables:
    CC: gcc
    CFLAGS: "-Wall -Wextra -O2 -g"
-    EXTRA_CONFIGURE: --without-cmocka
+    EXTRA_CONFIGURE: "--without-cmocka --with-python"
  <<: *debian_jessie_amd64_image
  <<: *build_job

-build:debian:stretch:amd64:
+stretch:amd64:build:
  variables:
    CC: gcc
    CFLAGS: "-Wall -Wextra -O2 -g"
  <<: *debian_stretch_amd64_image
  <<: *build_job

-build:debian:sid:amd64:
+sid:amd64:build:
  variables:
    CC: gcc
    CFLAGS: "-Wall -Wextra -O2 -g"
    EXTRA_CONFIGURE: "--with-libidn2"
  <<: *debian_sid_amd64_image
  <<: *build_job
+  only:
+  - merge_requests
+  - master@isc-projects/bind9
+  - /^v9_.*$/@isc-projects/bind9

-build:asan:debian:sid:amd64:
+asan:sid:amd64:build:
  variables:
    CC: gcc
    CFLAGS: "-Wall -Wextra -O2 -g -fsanitize=address,undefined -DISC_MEM_USE_INTERNAL_MALLOC=0"
@@ -284,118 +312,131 @@ build:asan:debian:sid:amd64:
  <<: *debian_sid_amd64_image
  <<: *build_job

-build:clang:debian:stretch:i386:
+clang:stretch:i386:build:
  variables:
    CC: clang
    CFLAGS: "-Wall -Wextra -Wenum-conversion -O2 -g"
+    EXTRA_CONFIGURE: "--with-python=python2"
  <<: *debian_stretch_i386_image
  <<: *build_job

-build:debian:sid:i386:
+sid:i386:build:
  variables:
    CC: gcc
    CFLAGS: "-Wall -Wextra -O2 -g"
-    EXTRA_CONFIGURE: "--with-libidn2"
+    EXTRA_CONFIGURE: "--with-libidn2 --without-python"
  <<: *debian_sid_i386_image
  <<: *build_job

-unittest:centos:centos6:amd64:
+unit:centos6:amd64:
  <<: *centos_centos6_amd64_image
  <<: *unit_test_job
  dependencies:
-    - build:centos:centos6:amd64
+    - centos6:amd64:build

-unittest:centos:centos7:amd64:
+unit:centos7:amd64:
  <<: *centos_centos7_amd64_image
  <<: *unit_test_job
  dependencies:
-    - build:centos:centos7:amd64
+    - centos7:amd64:build

-unittest:debian:jessie:amd64:
+unit:jessie:amd64:
  <<: *debian_jessie_amd64_image
  <<: *unit_test_job
  dependencies:
-    - build:debian:jessie:amd64
+    - jessie:amd64:build

-unittest:debian:stretch:amd64:
+unit:stretch:amd64:
  <<: *debian_stretch_amd64_image
  <<: *unit_test_job
  dependencies:
-    - build:debian:stretch:amd64
+    - stretch:amd64:build

-unittest:debian:sid:amd64:
+unit:sid:amd64:
  <<: *debian_sid_amd64_image
  <<: *unit_test_job
  dependencies:
-    - build:debian:sid:amd64
+    - sid:amd64:build
+  only:
+  - merge_requests
+  - master@isc-projects/bind9
+  - /^v9_.*$/@isc-projects/bind9

-unittest:asan:debian:sid:amd64:
+unit:asan:sid:amd64:
  <<: *debian_sid_amd64_image
  <<: *unit_test_job
  dependencies:
-    - build:asan:debian:sid:amd64
+    - asan:sid:amd64:build

-unittest:clang:debian:stretch:amd64:
+unit:clang:stretch:amd64:
  <<: *debian_stretch_amd64_image
  <<: *unit_test_job
  dependencies:
-    - build:clang:debian:stretch:amd64
+    - clang:stretch:amd64:build

-unittest:debian:sid:i386:
+unit:sid:i386:
  <<: *debian_sid_i386_image
  <<: *unit_test_job
  dependencies:
-    - build:debian:sid:i386
+    - sid:i386:build

-systemtest:centos:centos6:amd64:
+system:centos6:amd64:
  <<: *centos_centos6_amd64_image
  <<: *system_test_job
  dependencies:
-    - build:centos:centos6:amd64
+    - centos6:amd64:build

-systemtest:centos:centos7:amd64:
+system:centos7:amd64:
  <<: *centos_centos7_amd64_image
  <<: *system_test_job
  dependencies:
-    - build:centos:centos7:amd64
+    - centos7:amd64:build

-systemtest:debian:jessie:amd64:
+system:jessie:amd64:
  <<: *debian_jessie_amd64_image
  <<: *system_test_job
  dependencies:
-    - build:debian:jessie:amd64
+    - jessie:amd64:build

-systemtest:debian:stretch:amd64:
+system:stretch:amd64:
  <<: *debian_stretch_amd64_image
  <<: *system_test_job
  dependencies:
-    - build:debian:stretch:amd64
+    - stretch:amd64:build

-systemtest:debian:sid:amd64:
+system:sid:amd64:
  <<: *debian_sid_amd64_image
  <<: *system_test_job
  dependencies:
-    - build:debian:sid:amd64
+    - sid:amd64:build
+  only:
+  - merge_requests
+  - master@isc-projects/bind9
+  - /^v9_.*$/@isc-projects/bind9

-systemtest:asan:debian:sid:amd64:
+system:asan:sid:amd64:
  <<: *debian_sid_amd64_image
  <<: *system_test_job
  dependencies:
-    - build:asan:debian:sid:amd64
+    - asan:sid:amd64:build

-systemtest:debian:sid:i386:
+system:sid:i386:
  <<: *debian_sid_i386_image
  <<: *system_test_job
  dependencies:
-    - build:debian:sid:i386
+    - sid:i386:build

-install:debian:sid:amd64:
+install:sid:amd64:
  <<: *debian_sid_amd64_image
  <<: *install_test_job
  dependencies:
-    - build:debian:sid:amd64
+    - sid:amd64:build
+  only:
+  - merge_requests
+  - master@isc-projects/bind9
+  - /^v9_.*$/@isc-projects/bind9

-pkcs11:build:debian:sid:amd64:
+pkcs11:sid:amd64:build:
  variables:
    CC: gcc
    CFLAGS: "-Wall -Wextra -O2 -g"
@@ -403,19 +444,19 @@ pkcs11:build:debian:sid:amd64:
  <<: *debian_sid_amd64_image
  <<: *build_job

-pkcs11:unittest:debian:sid:amd64:
+pkcs11:unit:sid:amd64:
  <<: *debian_sid_amd64_image
  <<: *unit_test_job
  dependencies:
-    - pkcs11:build:debian:sid:amd64
+    - pkcs11:sid:amd64:build

-pkcs11:systemtest:debian:sid:amd64:
+pkcs11:system:sid:amd64:
  <<: *debian_sid_amd64_image
  <<: *system_test_job
  dependencies:
-    - pkcs11:build:debian:sid:amd64
+    - pkcs11:sid:amd64:build

-noassert:build:debian:sid:amd64:
+noassert:sid:amd64:build:
  variables:
    CC: gcc
    CFLAGS: "-Wall -Wextra -O2 -g -DISC_CHECK_NONE=1"
@@ -423,14 +464,53 @@ noassert:build:debian:sid:amd64:
  <<: *debian_sid_amd64_image
  <<: *build_job

-noassert:unittest:debian:sid:amd64:
+noassert:unit:sid:amd64:
  <<: *debian_sid_amd64_image
  <<: *unit_test_job
  dependencies:
-    - noassert:build:debian:sid:amd64
+    - noassert:sid:amd64:build

-noassert:systemtest:debian:sid:amd64:
+noassert:system:sid:amd64:
  <<: *debian_sid_amd64_image
  <<: *system_test_job
  dependencies:
-    - noassert:build:debian:sid:amd64
+    - noassert:sid:amd64:build
+
+xenial:amd64:build:
+  variables:
+    CC: gcc
+    CFLAGS: "-Wall -Wextra -O2 -g"
+  <<: *ubuntu_xenial_amd64_image
+  <<: *build_job
+
+unit:xenial:amd64:
+  <<: *ubuntu_xenial_amd64_image
+  <<: *unit_test_job
+  dependencies:
+    - xenial:amd64:build
+
+system:xenial:amd64:
+  <<: *ubuntu_xenial_amd64_image
+  <<: *system_test_job
+  dependencies:
+    - xenial:amd64:build
+
+bionic:amd64:build:
+  variables:
+    CC: gcc
+    CFLAGS: "-Wall -Wextra -O2 -g"
+    EXTRA_CONFIGURE: "--with-libidn2"
+  <<: *ubuntu_bionic_amd64_image
+  <<: *build_job
+
+unit:bionic:amd64:
+  <<: *ubuntu_bionic_amd64_image
+  <<: *unit_test_job
+  dependencies:
+    - bionic:amd64:build
+
+system:bionic:amd64:
+  <<: *ubuntu_bionic_amd64_image
+  <<: *system_test_job
+  dependencies:
+    - bionic:amd64:build
@@ -1,3 +1,143 @@
+5139.	[bug]		If possible, don't use forwarders when priming.
+			This ensures we can get root server IP addresses
+			from priming query response glue, which may not
+			be present if the forwarding server is returning
+			minimal responses. [GL #752]
+
+5138.	[bug]		Under some circumstances named could hit an assertion
+			failure when doing qname minimization when using
+			forwarders. [GL #797]
+
+5137.	[func]		named now logs messages whenever a mirror zone becomes
+			usable or unusable for resolution purposes. [GL #818]
+
+5136.	[cleanup]	Check in named-checkconf that allow-update and
+			allow-update-forwarding are not set at the
+			view/options level; fix documentation. [GL #512]
+
+5135.	[port]		sparc: Use smt_pause() instead of pause. [GL #816]
+
+5134.	[bug]		win32: WSAStartup was not called before getservbyname
+			was called. [GL #590]
+
+5133.	[bug]		'rndc managed-keys' didn't handle class and view
+			correctly and failed to add new lines between each
+			view. [GL !1327]
+
+5132.	[bug]		Fix race condition in cleanup part of dns_dt_create().
+			[GL !1323]
+
+5131.	[cleanup]	Address Coverity warnings. [GL #801]
+
+5130.	[cleanup]	Remove support for l10n message catalogs. [GL #709]
+
+5129.	[contrib]	sdlz_helper.c:build_querylist was not properly
+			splitting the query string. [GL #798]
+
+5128.	[bug]		Refreshkeytime was not being updated for managed
+			keys zones. [GL #784]
+
+5127.	[bug]		rcode.c:maybe_numeric failed to handle NUL in text
+			regions. [GL #807]
+
+5126.	[bug]		Named incorrectly accepted empty base64 and hex encoded
+			fields when reading master files. [GL #807]
+
+5125.	[bug]		Allow for up to 100 records or 64k of data when caching
+			a negative response. [GL #804]
+
+5124.	[bug]		Named could incorrectly return FORMERR rather than
+			SERVFAIL. [GL #804]
+
+5123.	[bug]		dig could hang indefinitely after encountering an error
+			before creating a TCP socket. [GL #692]
+
+5122.	[bug]		In a "forward first;" configuration, a forwarder
+			timeout did not prevent that forwarder from being
+			queried again after falling back to full recursive
+			resolution. [GL #315]
+
+5121.	[contrib]	dlz_stub_driver.c fails to return ISC_R_NOTFOUND on none
+			matching zone names. [GL !1299]
+
+5120.	[placeholder]
+
+5119.	[placeholder]
+
+5118.	[placeholder]
+
+5117.	[placeholder]
+
+5116.	[bug]		Named/named-checkconf triggered a assertion when
+			a mirror zone's name is bad. [GL #778]
+
+5115.	[bug]		Allow unsupported algorithms in zone when not used for
+			signing with dnssec-signzone. [GL #783]
+
+5114.	[func]		Include a 'reconfig/reload in progress' status line
+			in rndc status, use it in tests.
+
+5113.	[port]		Fixed a Windows build error.
+
+5112.	[bug]		Named/named-checkconf could dump core if there was
+			a missing masters clause and a bad notify clause.
+			[GL #779]
+
+5111.	[bug]		Occluded DNSKEY records could make it into the
+			delegating NSEC/NSEC3 bitmap. [GL #742]
+
+5110.	[placeholder]
+
+5109.	[cleanup]	Remove support for RSAMD5 algorithm. [GL #628]
+
+	--- 9.13.5 released ---
+
+5108.	[bug]		Named could fail to determine bottom of zone when
+			removing out of date keys leading to invalid NSEC
+			and NSEC3 records being added to the zone. [GL #771]
+
+5107.	[bug]		'host -U' did not work. [GL #769]
+
+5106.	[experimental]	A new "plugin" mechanism has been added to allow
+			extension of query processing functionality through
+			the use of dynamically loadable libraries. A
+			"filter-aaaa.so" plugin has been implemented,
+			replacing the filter-aaaa feature that was formerly
+			implemented as a native part of BIND.
+
+			The "filter-aaaa", "filter-aaaa-on-v4" and
+			"filter-aaaa-on-v6" options can no longer be
+			configured using native named.conf syntax. However,
+			loading the filter-aaaa.so plugin and setting its
+			parameters provides identical functionality.
+
+			Note that the plugin API is a work in progress and
+			is likely to evolve as further plugins are
+			implemented. [GL #15]
+
+5105.	[bug]		Fix a race between process_fd and socketclose in
+			unix socket code. [GL #744]
+
+5104.	[cleanup]	Log clearer informational message when a catz zone
+			is overridden by a zone in named.conf.
+			Thanks to Tony Finch. [GL !1157]
+
+5103.	[bug]		Add missing design by contract tests to dns_catz*.
+			[GL #748]
+
+5102.	[bug]		dnssec-coverage failed to use the default TTL when
+			checking KSK deletion times leading to a exception.
+			[GL #585]
+
+5101.	[bug]		Fix default installation path for Python modules and
+			remove the dnspython dependency accidentally introduced
+			by change 4970. [GL #730]
+
+5100.	[func]		Pin resolver tasks to specific task queues. [GL !1117]
+
+5099.	[func]		Failed mutex and conditional creations are always
+			fatal. [GL #674]
+
 	--- 9.13.4 released ---

 5098.	[func]		Failed memory allocations are now fatal. [GL #674]
@@ -1,4 +1,4 @@
-Copyright (C) 1996-2018  Internet Systems Consortium, Inc. ("ISC")
+Copyright (C) 1996-2019  Internet Systems Consortium, Inc. ("ISC")

 This Source Code Form is subject to the terms of the Mozilla Public
 License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -104,6 +104,10 @@ BIND 9.13 features
 BIND 9.13 is the newest development branch of BIND 9. It includes a number
 of changes from BIND 9.12 and earlier releases. New features include:

+  * A new "plugin" mechanism has been added to allow query functionality
+    to be extended using dynamically loadable libraries. The "filter-aaaa"
+    feature has been removed from named and is now implemented as a
+    plugin.
  * Socket and task code has been refactored to improve performance.
  * QNAME minimization, as described in RFC 7816, is now supported.
  * "Root key sentinel" support, enabling validating resolvers to indicate
@@ -122,6 +122,9 @@ BIND 9.13 is the newest development branch of BIND 9. It includes a
 number of changes from BIND 9.12 and earlier releases.  New features
 include:

+* A new "plugin" mechanism has been added to allow query functionality
+  to be extended using dynamically loadable libraries. The "filter-aaaa"
+  feature has been removed from named and is now implemented as a plugin.
 * Socket and task code has been refactored to improve performance.
 * QNAME minimization, as described in RFC 7816, is now supported.
 * "Root key sentinel" support, enabling validating resolvers to indicate
@@ -144,7 +147,7 @@ for more details.
 Cryptographic support has been modernized. BIND now uses the
 best available pseudo-random number generator for the platform on which
 it's built. Very old versions of OpenSSL are no longer supported.
-Cryptography is now mandatory: building BIND without DNSSEC is now
+Cryptography is now mandatory: building BIND without DNSSEC is no
 longer supported.

 Special code to support certain legacy operating systems has also
@@ -12,7 +12,7 @@ VPATH =		@srcdir@
 top_srcdir =	@top_srcdir@

 SUBDIRS =	named rndc dig delv dnssec tools nsupdate check confgen \
-		@NZD_TOOLS@ @PYTHON_TOOLS@ @PKCS11_TOOLS@ tests
+		@NZD_TOOLS@ @PYTHON_TOOLS@ @PKCS11_TOOLS@ plugins tests
 TARGETS =

@BIND9_MAKE_RULES@
@@ -66,7 +66,7 @@ named-checkzone.@O@: named-checkzone.c
 named-checkconf@EXEEXT@: named-checkconf.@O@ check-tool.@O@ ${ISCDEPLIBS} \
 		${NSDEPENDLIBS} ${DNSDEPLIBS} ${ISCCFGDEPLIBS} ${BIND9DEPLIBS}
 	export BASEOBJS="named-checkconf.@O@ check-tool.@O@"; \
-	export LIBS0="${NSLIBS} ${BIND9LIBS} ${ISCCFGLIBS} ${DNSLIBS}"; \
+	export LIBS0="${BIND9LIBS} ${NSLIBS} ${ISCCFGLIBS} ${DNSLIBS}"; \
 	${FINALBUILDCMD}

 named-checkzone@EXEEXT@: named-checkzone.@O@ check-tool.@O@ ${ISCDEPLIBS} \
@@ -39,7 +39,7 @@
 named-checkconf \- named configuration file syntax checking tool
 .SH "SYNOPSIS"
 .HP \w'\fBnamed\-checkconf\fR\ 'u
-\fBnamed\-checkconf\fR [\fB\-hjlvz\fR] [\fB\-p\fR\ [\fB\-x\fR\ ]] [\fB\-t\ \fR\fB\fIdirectory\fR\fR] {filename}
+\fBnamed\-checkconf\fR [\fB\-chjlvz\fR] [\fB\-p\fR\ [\fB\-x\fR\ ]] [\fB\-t\ \fR\fB\fIdirectory\fR\fR] {filename}
 .SH "DESCRIPTION"
 .PP
 \fBnamed\-checkconf\fR
@@ -79,6 +79,13 @@ When loading a zonefile read the journal if it exists\&.
 List all the configured zones\&. Each line of output contains the zone name, class (e\&.g\&. IN), view, and type (e\&.g\&. master or slave)\&.
 .RE
 .PP
+\-c
+.RS 4
+Check "core" configuration only\&. This suppresses the loading of plugin modules, and causes all parameters to
+\fBplugin\fR
+statements to be ignored\&.
+.RE
+.PP
 \-p
 .RS 4
 Print out the
@@ -46,6 +46,8 @@

 static const char *program = "named-checkconf";

+static bool loadplugins = true;
+
 isc_log_t *logc = NULL;

 #define CHECK(r)\
@@ -562,7 +564,7 @@ main(int argc, char **argv) {
 	/*
 	 * Process memory debugging argument first.
 	 */
-#define CMDLINE_FLAGS "dhjlm:t:pvxz"
+#define CMDLINE_FLAGS "cdhjlm:t:pvxz"
 	while ((c = isc_commandline_parse(argc, argv, CMDLINE_FLAGS)) != -1) {
 		switch (c) {
 		case 'm':
@@ -587,6 +589,10 @@ main(int argc, char **argv) {

 	while ((c = isc_commandline_parse(argc, argv, CMDLINE_FLAGS)) != EOF) {
 		switch (c) {
+		case 'c':
+			loadplugins = false;
+			break;
+
 		case 'd':
 			debug++;
 			break;
@@ -677,9 +683,10 @@ main(int argc, char **argv) {
 	    ISC_R_SUCCESS)
 		exit(1);

-	result = bind9_check_namedconf(config, logc, mctx);
-	if (result != ISC_R_SUCCESS)
+	result = bind9_check_namedconf(config, loadplugins, logc, mctx);
+	if (result != ISC_R_SUCCESS) {
 		exit_status = 1;
+	}

 	if (result == ISC_R_SUCCESS && (load_zones || list_zones)) {
 		result = load_zones_fromconfig(config, mctx, list_zones);
@@ -40,6 +40,7 @@
      <year>2015</year>
      <year>2016</year>
      <year>2018</year>
+      <year>2019</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
  </docinfo>
@@ -52,7 +53,7 @@
  <refsynopsisdiv>
    <cmdsynopsis sepchar=" ">
      <command>named-checkconf</command>
-      <arg choice="opt" rep="norepeat"><option>-hjlvz</option></arg>
+      <arg choice="opt" rep="norepeat"><option>-chjlvz</option></arg>
      <arg choice="opt" rep="norepeat"><option>-p</option>
 	<arg choice="opt" rep="norepeat"><option>-x</option>
      </arg></arg>
@@ -114,6 +115,17 @@
        </listitem>
      </varlistentry>

+      <varlistentry>
+        <term>-c</term>
+        <listitem>
+          <para>
+	    Check "core" configuration only. This suppresses the loading
+	    of plugin modules, and causes all parameters to
+	    <command>plugin</command> statements to be ignored.
+          </para>
+        </listitem>
+      </varlistentry>
+
      <varlistentry>
        <term>-p</term>
        <listitem>
@@ -33,7 +33,7 @@
 <h2>Synopsis</h2>
    <div class="cmdsynopsis"><p>
      <code class="command">named-checkconf</code> 
-       [<code class="option">-hjlvz</code>]
+       [<code class="option">-chjlvz</code>]
       [<code class="option">-p</code>
 	 [<code class="option">-x</code>
      ]]
@@ -88,6 +88,14 @@
            (e.g. master or slave).
          </p>
        </dd>
+<dt><span class="term">-c</span></dt>
+<dd>
+          <p>
+	    Check "core" configuration only. This suppresses the loading
+	    of plugin modules, and causes all parameters to
+	    <span class="command"><strong>plugin</strong></span> statements to be ignored.
+          </p>
+        </dd>
 <dt><span class="term">-p</span></dt>
 <dd>
          <p>
@@ -43,6 +43,7 @@
      <year>2015</year>
      <year>2016</year>
      <year>2018</year>
+      <year>2019</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
  </docinfo>
@@ -37,6 +37,7 @@
      <year>2015</year>
      <year>2016</year>
      <year>2018</year>
+      <year>2019</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
  </docinfo>
@@ -44,6 +44,7 @@
      <year>2016</year>
      <year>2017</year>
      <year>2018</year>
+      <year>2019</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
  </docinfo>
@@ -39,6 +39,7 @@
      <year>2016</year>
      <year>2017</year>
      <year>2018</year>
+      <year>2019</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
  </docinfo>
@@ -52,6 +52,7 @@
      <year>2016</year>
      <year>2017</year>
      <year>2018</year>
+      <year>2019</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
  </docinfo>
@@ -1390,8 +1390,7 @@ setup_libs(void) {
 	isc_mempool_setfreemax(commctx, 6);
 	isc_mempool_setfillcount(commctx, 2);

-	result = isc_mutex_init(&lookup_lock);
-	check_result(result, "isc_mutex_init");
+	isc_mutex_init(&lookup_lock);
 }

 typedef struct dig_ednsoptname {
@@ -2731,27 +2730,6 @@ send_tcp_connect(dig_query_t *query) {
 		return;
 	}

-	if (specified_source &&
-	    (isc_sockaddr_pf(&query->sockaddr) !=
-	     isc_sockaddr_pf(&bind_address))) {
-		printf(";; Skipping server %s, incompatible "
-		       "address family\n", query->servname);
-		query->waiting_connect = false;
-		if (ISC_LINK_LINKED(query, link))
-			next = ISC_LIST_NEXT(query, link);
-		else
-			next = NULL;
-		l = query->lookup;
-		clear_query(query);
-		if (next == NULL) {
-			printf(";; No acceptable nameservers\n");
-			check_next_lookup(l);
-			return;
-		}
-		send_tcp_connect(next);
-		return;
-	}
-
 	INSIST(query->sock == NULL);

 	if (keep != NULL && isc_sockaddr_equal(&keepaddr, &query->sockaddr)) {
@@ -2902,6 +2880,36 @@ send_udp(dig_query_t *query) {
 	sendcount++;
 }

+/*%
+ * If there are more servers available for querying within 'lookup', initiate a
+ * TCP or UDP query to the next available server and return true; otherwise,
+ * return false.
+ */
+static bool
+try_next_server(dig_lookup_t *lookup) {
+	dig_query_t *current_query, *next_query;
+
+	current_query = lookup->current_query;
+	if (current_query == NULL || !ISC_LINK_LINKED(current_query, link)) {
+		return (false);
+	}
+
+	next_query = ISC_LIST_NEXT(current_query, link);
+	if (next_query == NULL) {
+		return (false);
+	}
+
+	debug("trying next server...");
+
+	if (lookup->tcp_mode) {
+		send_tcp_connect(next_query);
+	} else {
+		send_udp(next_query);
+	}
+
+	return (true);
+}
+
 /*%
 * IO timeout handler, used for both connect and recv timeouts.  If
 * retries are still allowed, either resend the UDP packet or queue a
@@ -2910,7 +2918,7 @@ send_udp(dig_query_t *query) {
 static void
 connect_timeout(isc_task_t *task, isc_event_t *event) {
 	dig_lookup_t *l = NULL;
-	dig_query_t *query = NULL, *cq;
+	dig_query_t *query = NULL;

 	UNUSED(task);
 	REQUIRE(event->ev_type == ISC_TIMEREVENT_IDLE);
@@ -2930,18 +2938,14 @@ connect_timeout(isc_task_t *task, isc_event_t *event) {
 		return;
 	}

-	if ((query != NULL) && (query->lookup->current_query != NULL) &&
-	    ISC_LINK_LINKED(query->lookup->current_query, link) &&
-	    (ISC_LIST_NEXT(query->lookup->current_query, link) != NULL)) {
-		debug("trying next server...");
-		cq = query->lookup->current_query;
-		if (!l->tcp_mode)
-			send_udp(ISC_LIST_NEXT(cq, link));
-		else {
-			if (query->sock != NULL)
+	if (try_next_server(l)) {
+		if (l->tcp_mode) {
+			if (query->sock != NULL) {
 				isc_socket_cancel(query->sock, NULL,
 						  ISC_SOCKCANCEL_ALL);
-			send_tcp_connect(ISC_LIST_NEXT(cq, link));
+			} else {
+				clear_query(query);
+			}
 		}
 		UNLOCK_LOOKUP;
 		return;
@@ -4199,7 +4203,7 @@ destroy_libs(void) {
 	}

 	UNLOCK_LOOKUP;
-	DESTROYLOCK(&lookup_lock);
+	isc_mutex_destroy(&lookup_lock);
 	debug("Removing log context");
 	isc_log_destroy(&lctx);

@@ -151,6 +151,7 @@ show_usage(void) {
 "       -s a SERVFAIL response should stop query\n"
 "       -t specifies the query type\n"
 "       -T enables TCP/IP mode\n"
+"       -U enables UDP mode\n"
 "       -v enables verbose output\n"
 "       -V print version number and exit\n"
 "       -w specifies to wait forever for a reply\n"
@@ -624,28 +625,29 @@ pre_parse_args(int argc, char **argv) {
 		case 'a': break;
 		case 'A': break;
 		case 'c': break;
+		case 'C': break;
 		case 'd': break;
+		case 'D':
+			if (debugging)
+				debugtiming = true;
+			debugging = true;
+			break;
 		case 'i': break;
 		case 'l': break;
 		case 'n': break;
+		case 'N': break;
 		case 'r': break;
+		case 'R': break;
 		case 's': break;
 		case 't': break;
+		case 'T': break;
+		case 'U': break;
 		case 'v': break;
 		case 'V':
 			  version();
 			  exit(0);
 			  break;
 		case 'w': break;
-		case 'C': break;
-		case 'D':
-			if (debugging)
-				debugtiming = true;
-			debugging = true;
-			break;
-		case 'N': break;
-		case 'R': break;
-		case 'T': break;
 		case 'W': break;
 		default:
 			show_usage();
@@ -47,6 +47,7 @@
      <year>2016</year>
      <year>2017</year>
      <year>2018</year>
+      <year>2019</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
  </docinfo>
@@ -71,6 +71,7 @@
      <year>2016</year>
      <year>2017</year>
      <year>2018</year>
+      <year>2019</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
  </docinfo>
@@ -573,7 +573,7 @@ match_keyset_dsset(dns_rdataset_t *keyset, dns_rdataset_t *dsset,
 		ki->algo = dnskey.algorithm;

 		dns_rdata_toregion(keyrdata, &r);
-		ki->tag = dst_region_computeid(&r, ki->algo);
+		ki->tag = dst_region_computeid(&r);

 		ki->dst = NULL;
 		if (!match_key_dsset(ki, dsset, strictness)) {
@@ -40,6 +40,7 @@
    <copyright>
      <year>2017</year>
      <year>2018</year>
+      <year>2019</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
  </docinfo>
@@ -330,7 +330,7 @@ usage(void) {
 	fprintf(stderr, "    -K <directory>: directory in which to find "
 			"key file or keyset file\n");
 	fprintf(stderr, "    -a algorithm: digest algorithm "
-			"(SHA-1, SHA-256, GOST or SHA-384)\n");
+			"(SHA-1, SHA-256 or SHA-384)\n");
 	fprintf(stderr, "    -1: use SHA-1\n");
 	fprintf(stderr, "    -2: use SHA-256\n");
 	fprintf(stderr, "    -C: print CDS record\n");
@@ -41,6 +41,7 @@
      <year>2015</year>
      <year>2016</year>
      <year>2018</year>
+      <year>2019</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
  </docinfo>
@@ -38,6 +38,7 @@
      <year>2015</year>
      <year>2016</year>
      <year>2018</year>
+      <year>2019</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
  </docinfo>
@@ -64,7 +64,7 @@ usage(void) {
 	fprintf(stderr, "    name: owner of the key\n");
 	fprintf(stderr, "Other options:\n");
 	fprintf(stderr, "    -a algorithm: \n"
-			"        RSA | RSAMD5 | DH | RSASHA1 |\n"
+			"        DH | RSASHA1 |\n"
 			"        NSEC3RSASHA1 |\n"
 			"        RSASHA256 | RSASHA512 |\n"
 			"        ECDSAP256SHA256 | ECDSAP384SHA384\n");
@@ -382,22 +382,14 @@ main(int argc, char **argv) {
 			fatal("no algorithm specified");
 		}

-		if (strcasecmp(algname, "RSA") == 0) {
-			fprintf(stderr, "The use of RSA (RSAMD5) is not "
-					"recommended.\nIf you still wish to "
-					"use RSA (RSAMD5) please specify "
-					"\"-a RSAMD5\"\n");
-			if (freeit != NULL)
-				free(freeit);
-			return (1);
-		} else {
-			r.base = algname;
-			r.length = strlen(algname);
-			ret = dns_secalg_fromtext(&alg, &r);
-			if (ret != ISC_R_SUCCESS)
-				fatal("unknown algorithm %s", algname);
-			if (alg == DST_ALG_DH)
-				options |= DST_TYPE_KEY;
+		r.base = algname;
+		r.length = strlen(algname);
+		ret = dns_secalg_fromtext(&alg, &r);
+		if (ret != ISC_R_SUCCESS) {
+			fatal("unknown algorithm %s", algname);
+		}
+		if (alg == DST_ALG_DH) {
+			options |= DST_TYPE_KEY;
 		}

 		if (use_nsec3) {
@@ -639,10 +631,10 @@ main(int argc, char **argv) {

 		if (setdel)
 			dst_key_settime(key, DST_TIME_DELETE, deltime);
-	if (setsyncadd)
-		dst_key_settime(key, DST_TIME_SYNCPUBLISH, syncadd);
-	if (setsyncdel)
-		dst_key_settime(key, DST_TIME_SYNCDELETE, syncdel);
+		if (setsyncadd)
+			dst_key_settime(key, DST_TIME_SYNCPUBLISH, syncadd);
+		if (setsyncdel)
+			dst_key_settime(key, DST_TIME_SYNCDELETE, syncdel);

 	} else {
 		if (setpub || setact || setrev || setinact ||
@@ -43,6 +43,7 @@
      <year>2016</year>
      <year>2017</year>
      <year>2018</year>
+      <year>2019</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
  </docinfo>
@@ -105,7 +106,7 @@
 	<listitem>
 	  <para>
 	    Selects the cryptographic algorithm.  The value of
-	    <option>algorithm</option> must be one of RSAMD5, RSASHA1,
+	    <option>algorithm</option> must be one of RSASHA1,
 	    NSEC3RSASHA1, RSASHA256, RSASHA512,
 	    ECDSAP256SHA256, ECDSAP384SHA384, ED25519 or ED448.
 	  </para>
@@ -327,21 +327,21 @@ and
 files are generated for symmetric cryptography algorithms such as HMAC\-MD5, even though the public and private key are equivalent\&.
 .SH "EXAMPLE"
 .PP
-To generate a 768\-bit DSA key for the domain
+To generate an ECDSAP256SHA256 key for the domain
 \fBexample\&.com\fR, the following command would be issued:
 .PP
-\fBdnssec\-keygen \-a DSA \-b 768 \-n ZONE example\&.com\fR
+\fBdnssec\-keygen \-a ECDSAP256SHA256 \-n ZONE example\&.com\fR
 .PP
 The command would print a string of the form:
 .PP
-\fBKexample\&.com\&.+003+26160\fR
+\fBKexample\&.com\&.+013+26160\fR
 .PP
 In this example,
 \fBdnssec\-keygen\fR
 creates the files
-Kexample\&.com\&.+003+26160\&.key
+Kexample\&.com\&.+013+26160\&.key
 and
-Kexample\&.com\&.+003+26160\&.private\&.
+Kexample\&.com\&.+013+26160\&.private\&.
 .SH "SEE ALSO"
 .PP
 \fBdnssec-signzone\fR(8),
@@ -79,14 +79,12 @@ usage(void) {
 	fprintf(stderr, "Options:\n");
 	fprintf(stderr, "    -K <directory>: write keys into directory\n");
 	fprintf(stderr, "    -a <algorithm>:\n");
-	fprintf(stderr, "        RSA | RSAMD5 | RSASHA1 | NSEC3RSASHA1"
-				" |\n");
+	fprintf(stderr, "        RSASHA1 | NSEC3RSASHA1 |\n");
 	fprintf(stderr, "        RSASHA256 | RSASHA512 |\n");
 	fprintf(stderr, "        ECDSAP256SHA256 | ECDSAP384SHA384 |\n");
 	fprintf(stderr, "        ED25519 | ED448 | DH\n");
 	fprintf(stderr, "    -3: use NSEC3-capable algorithm\n");
 	fprintf(stderr, "    -b <key size in bits>:\n");
-	fprintf(stderr, "        RSAMD5:\t[1024..%d]\n", MAX_RSA);
 	fprintf(stderr, "        RSASHA1:\t[1024..%d]\n", MAX_RSA);
 	fprintf(stderr, "        NSEC3RSASHA1:\t[1024..%d]\n", MAX_RSA);
 	fprintf(stderr, "        RSASHA256:\t[1024..%d]\n", MAX_RSA);
@@ -508,23 +506,14 @@ main(int argc, char **argv) {
 			fatal("no algorithm specified");
 		}

-		if (strcasecmp(algname, "RSA") == 0) {
-			fprintf(stderr, "The use of RSA (RSAMD5) is not "
-					"recommended.\nIf you still wish to "
-					"use RSA (RSAMD5) please specify "
-					"\"-a RSAMD5\"\n");
-			INSIST(freeit == NULL);
-			return (1);
-		} else {
-			r.base = algname;
-			r.length = strlen(algname);
-			ret = dns_secalg_fromtext(&alg, &r);
-			if (ret != ISC_R_SUCCESS) {
-				fatal("unknown algorithm %s", algname);
-			}
-			if (alg == DST_ALG_DH) {
-				options |= DST_TYPE_KEY;
-			}
+		r.base = algname;
+		r.length = strlen(algname);
+		ret = dns_secalg_fromtext(&alg, &r);
+		if (ret != ISC_R_SUCCESS) {
+			fatal("unknown algorithm %s", algname);
+		}
+		if (alg == DST_ALG_DH) {
+			options |= DST_TYPE_KEY;
 		}

 		if (!dst_algorithm_supported(alg)) {
@@ -698,7 +687,6 @@ main(int argc, char **argv) {
 	}

 	switch (alg) {
-	case DNS_KEYALG_RSAMD5:
 	case DNS_KEYALG_RSASHA1:
 	case DNS_KEYALG_NSEC3RSASHA1:
 	case DNS_KEYALG_RSASHA256:
@@ -780,7 +768,6 @@ main(int argc, char **argv) {
 	}

 	switch(alg) {
-	case DNS_KEYALG_RSAMD5:
 	case DNS_KEYALG_RSASHA1:
 	case DNS_KEYALG_NSEC3RSASHA1:
 	case DNS_KEYALG_RSASHA256:
@@ -50,6 +50,7 @@
      <year>2016</year>
      <year>2017</year>
      <year>2018</year>
+      <year>2019</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
  </docinfo>
@@ -122,7 +123,7 @@
 	<listitem>
 	  <para>
 	    Selects the cryptographic algorithm.  For DNSSEC keys, the value
-	    of <option>algorithm</option> must be one of RSAMD5, RSASHA1,
+	    of <option>algorithm</option> must be one of RSASHA1,
 	    NSEC3RSASHA1, RSASHA256, RSASHA512,
 	    ECDSAP256SHA256, ECDSAP384SHA384, ED25519 or ED448.  For
 	    TKEY, the value must be DH (Diffie Hellman); specifying
@@ -605,22 +606,22 @@
  <refsection><info><title>EXAMPLE</title></info>

    <para>
-      To generate a 768-bit DSA key for the domain
+      To generate an ECDSAP256SHA256 key for the domain
      <userinput>example.com</userinput>, the following command would be
      issued:
    </para>
-    <para><userinput>dnssec-keygen -a DSA -b 768 -n ZONE example.com</userinput>
+    <para><userinput>dnssec-keygen -a ECDSAP256SHA256 -n ZONE example.com</userinput>
    </para>
    <para>
      The command would print a string of the form:
    </para>
-    <para><userinput>Kexample.com.+003+26160</userinput>
+    <para><userinput>Kexample.com.+013+26160</userinput>
    </para>
    <para>
      In this example, <command>dnssec-keygen</command> creates
-      the files <filename>Kexample.com.+003+26160.key</filename>
+      the files <filename>Kexample.com.+013+26160.key</filename>
      and
-      <filename>Kexample.com.+003+26160.private</filename>.
+      <filename>Kexample.com.+013+26160.private</filename>.
    </para>
  </refsection>

@@ -498,22 +498,22 @@
 <a name="id-1.11"></a><h2>EXAMPLE</h2>

    <p>
-      To generate a 768-bit DSA key for the domain
+      To generate an ECDSAP256SHA256 key for the domain
      <strong class="userinput"><code>example.com</code></strong>, the following command would be
      issued:
    </p>
-    <p><strong class="userinput"><code>dnssec-keygen -a DSA -b 768 -n ZONE example.com</code></strong>
+    <p><strong class="userinput"><code>dnssec-keygen -a ECDSAP256SHA256 -n ZONE example.com</code></strong>
    </p>
    <p>
      The command would print a string of the form:
    </p>
-    <p><strong class="userinput"><code>Kexample.com.+003+26160</code></strong>
+    <p><strong class="userinput"><code>Kexample.com.+013+26160</code></strong>
    </p>
    <p>
      In this example, <span class="command"><strong>dnssec-keygen</strong></span> creates
-      the files <code class="filename">Kexample.com.+003+26160.key</code>
+      the files <code class="filename">Kexample.com.+013+26160.key</code>
      and
-      <code class="filename">Kexample.com.+003+26160.private</code>.
+      <code class="filename">Kexample.com.+013+26160.private</code>.
    </p>
  </div>

@@ -239,7 +239,7 @@ main(int argc, char **argv) {
 		 * Remove old key file, if told to (and if
 		 * it isn't the same as the new file)
 		 */
-		if (removefile && dst_key_alg(key) != DST_ALG_RSAMD5) {
+		if (removefile) {
 			isc_buffer_init(&buf, oldname, sizeof(oldname));
 			dst_key_setflags(key, flags & ~DNS_KEYFLAG_REVOKE);
 			dst_key_buildfilename(key, DST_TYPE_PRIVATE, dir, &buf);
@@ -38,6 +38,7 @@
      <year>2015</year>
      <year>2016</year>
      <year>2018</year>
+      <year>2019</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
  </docinfo>
@@ -40,6 +40,7 @@
      <year>2016</year>
      <year>2017</year>
      <year>2018</year>
+      <year>2019</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
  </docinfo>
@@ -415,9 +415,9 @@ Specify which keys should be used to sign the zone\&. If no keys are specified,
 .PP
 The following command signs the
 \fBexample\&.com\fR
-zone with the DSA key generated by
+zone with the ECDSAP256SHA256 key generated by key generated by
 \fBdnssec\-keygen\fR
-(Kexample\&.com\&.+003+17247)\&. Because the
+(Kexample\&.com\&.+013+17247)\&. Because the
 \fB\-S\fR
 option is not being used, the zone\*(Aqs keys must be in the master file (db\&.example\&.com)\&. This invocation looks for
 dsset
@@ -428,7 +428,7 @@ files, in the current directory, so that DS records can be imported from them (\
 .\}
 .nf
 % dnssec\-signzone \-g \-o example\&.com db\&.example\&.com \e
-Kexample\&.com\&.+003+17247
+Kexample\&.com\&.+013+17247
 db\&.example\&.com\&.signed
 %
 .fi
@@ -3874,9 +3874,11 @@ main(int argc, char *argv[]) {
 			      isc_result_totext(result));
 	}

-	RUNTIME_CHECK(isc_mutex_init(&namelock) == ISC_R_SUCCESS);
-	if (printstats)
-		RUNTIME_CHECK(isc_mutex_init(&statslock) == ISC_R_SUCCESS);
+	isc_mutex_init(&namelock);
+
+	if (printstats) {
+		isc_mutex_init(&statslock);
+	}

 	presign();
 	TIME_NOW(&sign_start);
@@ -3934,9 +3936,9 @@ main(int argc, char *argv[]) {
 		check_result(result, "dns_master_dumptostream3");
 	}

-	DESTROYLOCK(&namelock);
+	isc_mutex_destroy(&namelock);
 	if (printstats)
-		DESTROYLOCK(&statslock);
+		isc_mutex_destroy(&statslock);

 	if (!output_stdout) {
 		result = isc_stdio_close(outfp);
@@ -50,6 +50,7 @@
      <year>2016</year>
      <year>2017</year>
      <year>2018</year>
+      <year>2019</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
  </docinfo>
@@ -787,15 +788,16 @@

    <para>
      The following command signs the <userinput>example.com</userinput>
-      zone with the DSA key generated by <command>dnssec-keygen</command>
-      (Kexample.com.+003+17247).  Because the <command>-S</command> option
-      is not being used, the zone's keys must be in the master file
+      zone with the ECDSAP256SHA256 key generated by key generated by
+      <command>dnssec-keygen</command> (Kexample.com.+013+17247).
+      Because the <command>-S</command> option is not being used,
+      the zone's keys must be in the master file
      (<filename>db.example.com</filename>).  This invocation looks
      for <filename>dsset</filename> files, in the current directory,
      so that DS records can be imported from them (<command>-g</command>).
    </para>
 <programlisting>% dnssec-signzone -g -o example.com db.example.com \
-Kexample.com.+003+17247
+Kexample.com.+013+17247
 db.example.com.signed
 %</programlisting>
    <para>
@@ -624,15 +624,16 @@

    <p>
      The following command signs the <strong class="userinput"><code>example.com</code></strong>
-      zone with the DSA key generated by <span class="command"><strong>dnssec-keygen</strong></span>
-      (Kexample.com.+003+17247).  Because the <span class="command"><strong>-S</strong></span> option
-      is not being used, the zone's keys must be in the master file
+      zone with the ECDSAP256SHA256 key generated by key generated by
+      <span class="command"><strong>dnssec-keygen</strong></span> (Kexample.com.+013+17247).
+      Because the <span class="command"><strong>-S</strong></span> option is not being used,
+      the zone's keys must be in the master file
      (<code class="filename">db.example.com</code>).  This invocation looks
      for <code class="filename">dsset</code> files, in the current directory,
      so that DS records can be imported from them (<span class="command"><strong>-g</strong></span>).
    </p>
 <pre class="programlisting">% dnssec-signzone -g -o example.com db.example.com \
-Kexample.com.+003+17247
+Kexample.com.+013+17247
 db.example.com.signed
 %</pre>
    <p>
@@ -37,6 +37,7 @@
      <year>2015</year>
      <year>2016</year>
      <year>2018</year>
+      <year>2019</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
  </docinfo>
@@ -154,10 +154,7 @@ options {\n\
 #	fetch-glue <obsolete>;\n\
 	fetch-quota-params 100 0.1 0.3 0.7;\n\
 	fetches-per-server 0;\n\
-	fetches-per-zone 0;\n\
-	filter-aaaa-on-v4 no;\n\
-	filter-aaaa-on-v6 no;\n\
-	filter-aaaa { any; };\n"
+	fetches-per-zone 0;\n"
 #ifdef HAVE_GEOIP
 "	geoip-use-ecs yes;\n"
 #endif
@@ -152,16 +152,11 @@ named_control_docommand(isccc_sexpr_t *message, bool readonly,
 		      "received control channel command '%s'",
 		      cmdline);

-	if (command_compare(command, NAMED_COMMAND_RELOAD)) {
-		result = named_server_reloadcommand(named_g_server, lex, text);
-	} else if (command_compare(command, NAMED_COMMAND_RECONFIG)) {
-		result = named_server_reconfigcommand(named_g_server);
-	} else if (command_compare(command, NAMED_COMMAND_REFRESH)) {
-		result = named_server_refreshcommand(named_g_server, lex, text);
-	} else if (command_compare(command, NAMED_COMMAND_RETRANSFER)) {
-		result = named_server_retransfercommand(named_g_server,
-							lex, text);
-	} else if (command_compare(command, NAMED_COMMAND_HALT)) {
+	/*
+	 * After the lengthy "halt" and "stop", the commands are
+	 * handled in alphabetical order of the NAMED_COMMAND_ macros.
+	 */
+	if (command_compare(command, NAMED_COMMAND_HALT)) {
 #ifdef HAVE_LIBSCF
 		/*
 		 * If we are managed by smf(5), AND in chroot, then
@@ -206,83 +201,90 @@ named_control_docommand(isccc_sexpr_t *message, bool readonly,
 		named_os_shutdownmsg(cmdline, *text);
 		isc_app_shutdown();
 		result = ISC_R_SUCCESS;
-	} else if (command_compare(command, NAMED_COMMAND_DUMPSTATS)) {
-		result = named_server_dumpstats(named_g_server);
-	} else if (command_compare(command, NAMED_COMMAND_QUERYLOG)) {
-		result = named_server_togglequerylog(named_g_server, lex);
+	} else if (command_compare(command, NAMED_COMMAND_ADDZONE) ||
+		   command_compare(command, NAMED_COMMAND_MODZONE)) {
+		result = named_server_changezone(named_g_server, cmdline, text);
+	} else if (command_compare(command, NAMED_COMMAND_DELZONE)) {
+		result = named_server_delzone(named_g_server, lex, text);
+	} else if (command_compare(command, NAMED_COMMAND_DNSTAP) ||
+		   command_compare(command, NAMED_COMMAND_DNSTAPREOPEN)) {
+		result = named_server_dnstap(named_g_server, lex, text);
 	} else if (command_compare(command, NAMED_COMMAND_DUMPDB)) {
 		named_server_dumpdb(named_g_server, lex, text);
 		result = ISC_R_SUCCESS;
-	} else if (command_compare(command, NAMED_COMMAND_SECROOTS)) {
-		result = named_server_dumpsecroots(named_g_server, lex, text);
-	} else if (command_compare(command, NAMED_COMMAND_TRACE)) {
-		result = named_server_setdebuglevel(named_g_server, lex);
-	} else if (command_compare(command, NAMED_COMMAND_NOTRACE)) {
-		named_g_debuglevel = 0;
-		isc_log_setdebuglevel(named_g_lctx, named_g_debuglevel);
-		result = ISC_R_SUCCESS;
+	} else if (command_compare(command, NAMED_COMMAND_DUMPSTATS)) {
+		result = named_server_dumpstats(named_g_server);
 	} else if (command_compare(command, NAMED_COMMAND_FLUSH)) {
 		result = named_server_flushcache(named_g_server, lex);
 	} else if (command_compare(command, NAMED_COMMAND_FLUSHNAME)) {
 		result = named_server_flushnode(named_g_server, lex, false);
 	} else if (command_compare(command, NAMED_COMMAND_FLUSHTREE)) {
 		result = named_server_flushnode(named_g_server, lex, true);
-	} else if (command_compare(command, NAMED_COMMAND_STATUS)) {
-		result = named_server_status(named_g_server, text);
-	} else if (command_compare(command, NAMED_COMMAND_TSIGLIST)) {
-		result = named_server_tsiglist(named_g_server, text);
-	} else if (command_compare(command, NAMED_COMMAND_TSIGDELETE)) {
-		result = named_server_tsigdelete(named_g_server, lex, text);
 	} else if (command_compare(command, NAMED_COMMAND_FREEZE)) {
-		result = named_server_freeze(named_g_server, true, lex,
-					     text);
-	} else if (command_compare(command, NAMED_COMMAND_UNFREEZE) ||
-		   command_compare(command, NAMED_COMMAND_THAW)) {
-		result = named_server_freeze(named_g_server, false, lex,
-					     text);
-	} else if (command_compare(command, NAMED_COMMAND_SCAN)) {
-		result = ISC_R_SUCCESS;
-		named_server_scan_interfaces(named_g_server);
-	} else if (command_compare(command, NAMED_COMMAND_SYNC)) {
-		result = named_server_sync(named_g_server, lex, text);
-	} else if (command_compare(command, NAMED_COMMAND_RECURSING)) {
-		result = named_server_dumprecursing(named_g_server);
-	} else if (command_compare(command, NAMED_COMMAND_TIMERPOKE)) {
-		result = ISC_R_SUCCESS;
-		isc_timermgr_poke(named_g_timermgr);
-	} else if (command_compare(command, NAMED_COMMAND_NULL)) {
-		result = ISC_R_SUCCESS;
+		result = named_server_freeze(named_g_server, true, lex, text);
+	} else if (command_compare(command, NAMED_COMMAND_LOADKEYS) ||
+		   command_compare(command, NAMED_COMMAND_SIGN)) {
+		result = named_server_rekey(named_g_server, lex, text);
+	} else if (command_compare(command, NAMED_COMMAND_MKEYS)) {
+		result = named_server_mkeys(named_g_server, lex, text);
 	} else if (command_compare(command, NAMED_COMMAND_NOTIFY)) {
 		result = named_server_notifycommand(named_g_server, lex, text);
-	} else if (command_compare(command, NAMED_COMMAND_VALIDATION)) {
-		result = named_server_validation(named_g_server, lex, text);
-	} else if (command_compare(command, NAMED_COMMAND_SIGN) ||
-		   command_compare(command, NAMED_COMMAND_LOADKEYS)) {
-		result = named_server_rekey(named_g_server, lex, text);
-	} else if (command_compare(command, NAMED_COMMAND_ADDZONE) ||
-		   command_compare(command, NAMED_COMMAND_MODZONE)) {
-		result = named_server_changezone(named_g_server, cmdline, text);
-	} else if (command_compare(command, NAMED_COMMAND_DELZONE)) {
-		result = named_server_delzone(named_g_server, lex, text);
+	} else if (command_compare(command, NAMED_COMMAND_NOTRACE)) {
+		named_g_debuglevel = 0;
+		isc_log_setdebuglevel(named_g_lctx, named_g_debuglevel);
+		result = ISC_R_SUCCESS;
+	} else if (command_compare(command, NAMED_COMMAND_NTA)) {
+		result = named_server_nta(named_g_server, lex, readonly, text);
+	} else if (command_compare(command, NAMED_COMMAND_NULL)) {
+		result = ISC_R_SUCCESS;
+	} else if (command_compare(command, NAMED_COMMAND_QUERYLOG)) {
+		result = named_server_togglequerylog(named_g_server, lex);
+	} else if (command_compare(command, NAMED_COMMAND_RECONFIG)) {
+		result = named_server_reconfigcommand(named_g_server);
+	} else if (command_compare(command, NAMED_COMMAND_RECURSING)) {
+		result = named_server_dumprecursing(named_g_server);
+	} else if (command_compare(command, NAMED_COMMAND_REFRESH)) {
+		result = named_server_refreshcommand(named_g_server, lex, text);
+	} else if (command_compare(command, NAMED_COMMAND_RELOAD)) {
+		result = named_server_reloadcommand(named_g_server, lex, text);
+	} else if (command_compare(command, NAMED_COMMAND_RETRANSFER)) {
+		result = named_server_retransfercommand(named_g_server,
+							lex, text);
+	} else if (command_compare(command, NAMED_COMMAND_SCAN)) {
+		named_server_scan_interfaces(named_g_server);
+		result = ISC_R_SUCCESS;
+	} else if (command_compare(command, NAMED_COMMAND_SECROOTS)) {
+		result = named_server_dumpsecroots(named_g_server, lex, text);
+	} else if (command_compare(command, NAMED_COMMAND_SERVESTALE)) {
+		result = named_server_servestale(named_g_server, lex, text);
 	} else if (command_compare(command, NAMED_COMMAND_SHOWZONE)) {
 		result = named_server_showzone(named_g_server, lex, text);
 	} else if (command_compare(command, NAMED_COMMAND_SIGNING)) {
 		result = named_server_signing(named_g_server, lex, text);
-	} else if (command_compare(command, NAMED_COMMAND_ZONESTATUS)) {
-		result = named_server_zonestatus(named_g_server, lex, text);
-	} else if (command_compare(command, NAMED_COMMAND_NTA)) {
-		result = named_server_nta(named_g_server, lex, readonly, text);
-	} else if (command_compare(command, NAMED_COMMAND_TESTGEN)) {
-		result = named_server_testgen(lex, text);
-	} else if (command_compare(command, NAMED_COMMAND_MKEYS)) {
-		result = named_server_mkeys(named_g_server, lex, text);
-	} else if (command_compare(command, NAMED_COMMAND_DNSTAP) ||
-		   command_compare(command, NAMED_COMMAND_DNSTAPREOPEN)) {
-		result = named_server_dnstap(named_g_server, lex, text);
+	} else if (command_compare(command, NAMED_COMMAND_STATUS)) {
+		result = named_server_status(named_g_server, text);
+	} else if (command_compare(command, NAMED_COMMAND_SYNC)) {
+		result = named_server_sync(named_g_server, lex, text);
 	} else if (command_compare(command, NAMED_COMMAND_TCPTIMEOUTS)) {
 		result = named_server_tcptimeouts(lex, text);
-	} else if (command_compare(command, NAMED_COMMAND_SERVESTALE)) {
-		result = named_server_servestale(named_g_server, lex, text);
+	} else if (command_compare(command, NAMED_COMMAND_TESTGEN)) {
+		result = named_server_testgen(lex, text);
+	} else if (command_compare(command, NAMED_COMMAND_THAW) ||
+		   command_compare(command, NAMED_COMMAND_UNFREEZE)) {
+		result = named_server_freeze(named_g_server, false, lex, text);
+	} else if (command_compare(command, NAMED_COMMAND_TIMERPOKE)) {
+		isc_timermgr_poke(named_g_timermgr);
+		result = ISC_R_SUCCESS;
+	} else if (command_compare(command, NAMED_COMMAND_TRACE)) {
+		result = named_server_setdebuglevel(named_g_server, lex);
+	} else if (command_compare(command, NAMED_COMMAND_TSIGDELETE)) {
+		result = named_server_tsigdelete(named_g_server, lex, text);
+	} else if (command_compare(command, NAMED_COMMAND_TSIGLIST)) {
+		result = named_server_tsiglist(named_g_server, text);
+	} else if (command_compare(command, NAMED_COMMAND_VALIDATION)) {
+		result = named_server_validation(named_g_server, lex, text);
+	} else if (command_compare(command, NAMED_COMMAND_ZONESTATUS)) {
+		result = named_server_zonestatus(named_g_server, lex, text);
 	} else {
 		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 			      NAMED_LOGMODULE_CONTROL, ISC_LOG_WARNING,
@@ -78,6 +78,7 @@ struct named_server {

 	isc_mutex_t		reload_event_lock;
 	isc_event_t *		reload_event;
+	bool			reload_in_progress;

 	bool		flushonshutdown;

@@ -48,6 +48,7 @@
      <year>2016</year>
      <year>2017</year>
      <year>2018</year>
+      <year>2019</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
  </docinfo>
@@ -48,6 +48,7 @@
      <year>2016</year>
      <year>2017</year>
      <year>2018</year>
+      <year>2019</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
  </docinfo>
@@ -102,6 +102,7 @@
 #include <dst/result.h>

 #include <ns/client.h>
+#include <ns/hooks.h>
 #include <ns/listenlist.h>
 #include <ns/interfacemgr.h>

@@ -776,8 +777,7 @@ dstkey_fromconfig(const cfg_obj_t *vconfig, const cfg_obj_t *key,
 	keystruct.datalen = r.length;
 	keystruct.data = r.base;

-	if ((keystruct.algorithm == DST_ALG_RSASHA1 ||
-	     keystruct.algorithm == DST_ALG_RSAMD5) &&
+	if ((keystruct.algorithm == DST_ALG_RSASHA1) &&
 	    r.length > 1 && r.base[0] == 1 && r.base[1] == 3)
 		cfg_obj_log(key, named_g_lctx, ISC_LOG_WARNING,
 			    "%s key '%s' has a weak exponent",
@@ -2551,7 +2551,15 @@ catz_addmodzone_taskaction(isc_task_t *task, isc_event_t *event0) {
 		}

 	} else {
-		if (result != ISC_R_NOTFOUND && result != DNS_R_PARTIALMATCH) {
+		if (result == ISC_R_SUCCESS) {
+			isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+				      NAMED_LOGMODULE_SERVER, ISC_LOG_INFO,
+				      "catz: zone \"%s\" is overridden "
+				      "by explicitly configured zone",
+				      nameb);
+			goto cleanup;
+		} else if (result != ISC_R_NOTFOUND &&
+			   result != DNS_R_PARTIALMATCH) {
 			isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 				      NAMED_LOGMODULE_SERVER, ISC_LOG_WARNING,
 				      "catz: error \"%s\" while trying to "
@@ -3638,6 +3646,35 @@ create_mapped_acl(void) {
 	return (result);
 }

+#ifdef HAVE_DLOPEN
+/*%
+ * A callback for the cfg_pluginlist_foreach() call in configure_view() below.
+ * If registering any plugin fails, registering subsequent ones is not
+ * attempted.
+ */
+static isc_result_t
+register_one_plugin(const cfg_obj_t *config, const cfg_obj_t *obj,
+		    const char *plugin_path, const char *parameters,
+		    void *callback_data)
+{
+	dns_view_t *view = callback_data;
+	isc_result_t result;
+
+	result = ns_plugin_register(plugin_path, parameters, config,
+				    cfg_obj_file(obj), cfg_obj_line(obj),
+				    named_g_mctx, named_g_lctx,
+				    named_g_aclconfctx, view);
+	if (result != ISC_R_SUCCESS) {
+		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+			      NAMED_LOGMODULE_SERVER, ISC_LOG_ERROR,
+			      "%s: plugin configuration failed: %s",
+			      plugin_path, isc_result_totext(result));
+	}
+
+	return (result);
+}
+#endif
+
 /*
 * Configure 'view' according to 'vconfig', taking defaults from 'config'
 * where values are missing in 'vconfig'.
@@ -3666,7 +3703,7 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
 	const cfg_obj_t *dlvobj = NULL;
 	unsigned int dlzargc;
 	char **dlzargv;
-	const cfg_obj_t *dyndb_list;
+	const cfg_obj_t *dyndb_list, *plugin_list;
 	const cfg_obj_t *disabled;
 	const cfg_obj_t *obj, *obj2;
 	const cfg_listelt_t *element;
@@ -4958,16 +4995,10 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
 				      &view->sortlist));

 	/*
-	 * Configure default allow-notify, allow-update
-	 * and allow-update-forwarding ACLs, so they can be
-	 * inherited by zones. (Note these cannot be set at
+	 * Configure default allow-update and allow-update-forwarding ACLs,
+	 * so they can be inherited by zones.  (Note these cannot be set at
 	 * options/view level.)
 	 */
-	if (view->notifyacl == NULL) {
-		CHECK(configure_view_acl(vconfig, config, named_g_config,
-					 "allow-notify", NULL, actx,
-					 named_g_mctx, &view->notifyacl));
-	}
 	if (view->updateacl == NULL) {
 		CHECK(configure_view_acl(NULL, NULL, named_g_config,
 					 "allow-update", NULL, actx,
@@ -4980,14 +5011,19 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
 	}

 	/*
-	 * Configure default allow-transer ACL so it can be inherited
-	 * by zones. (Note this *can* be set at options or view level.)
+	 * Configure default allow-transfer and allow-notify ACLs so they
+	 * can be inherited by zones.
 	 */
 	if (view->transferacl == NULL) {
 		CHECK(configure_view_acl(vconfig, config, named_g_config,
 					 "allow-transfer", NULL, actx,
 					 named_g_mctx, &view->transferacl));
 	}
+	if (view->notifyacl == NULL) {
+		CHECK(configure_view_acl(vconfig, config, named_g_config,
+					 "allow-notify", NULL, actx,
+					 named_g_mctx, &view->notifyacl));
+	}

 	obj = NULL;
 	result = named_config_get(maps, "provide-ixfr", &obj);
@@ -5080,46 +5116,6 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
 					      dns_quotatype_zone, r);
 	}

-	obj = NULL;
-	result = named_config_get(maps, "filter-aaaa-on-v4", &obj);
-	INSIST(result == ISC_R_SUCCESS);
-	if (cfg_obj_isboolean(obj)) {
-		if (cfg_obj_asboolean(obj))
-			view->v4_aaaa = dns_aaaa_filter;
-		else
-			view->v4_aaaa = dns_aaaa_ok;
-	} else {
-		const char *v4_aaaastr = cfg_obj_asstring(obj);
-		if (strcasecmp(v4_aaaastr, "break-dnssec") == 0) {
-			view->v4_aaaa = dns_aaaa_break_dnssec;
-		} else {
-			INSIST(0);
-			ISC_UNREACHABLE();
-		}
-	}
-
-	obj = NULL;
-	result = named_config_get(maps, "filter-aaaa-on-v6", &obj);
-	INSIST(result == ISC_R_SUCCESS);
-	if (cfg_obj_isboolean(obj)) {
-		if (cfg_obj_asboolean(obj))
-			view->v6_aaaa = dns_aaaa_filter;
-		else
-			view->v6_aaaa = dns_aaaa_ok;
-	} else {
-		const char *v6_aaaastr = cfg_obj_asstring(obj);
-		if (strcasecmp(v6_aaaastr, "break-dnssec") == 0) {
-			view->v6_aaaa = dns_aaaa_break_dnssec;
-		} else {
-			INSIST(0);
-			ISC_UNREACHABLE();
-		}
-	}
-
-	CHECK(configure_view_acl(vconfig, config, named_g_config,
-				 "filter-aaaa", NULL, actx,
-				 named_g_mctx, &view->aaaa_acl));
-
 	obj = NULL;
 	result = named_config_get(maps, "prefetch", &obj);
 	if (result == ISC_R_SUCCESS) {
@@ -5261,10 +5257,11 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
 	 * Load DynDB modules.
 	 */
 	dyndb_list = NULL;
-	if (voptions != NULL)
+	if (voptions != NULL) {
 		(void)cfg_map_get(voptions, "dyndb", &dyndb_list);
-	else
+	} else {
 		(void)cfg_map_get(config, "dyndb", &dyndb_list);
+	}

 #ifdef HAVE_DLOPEN
 	for (element = cfg_list_first(dyndb_list);
@@ -5286,6 +5283,31 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
 	}
 #endif

+	/*
+	 * Load plugins.
+	 */
+	plugin_list = NULL;
+	if (voptions != NULL) {
+		(void)cfg_map_get(voptions, "plugin", &plugin_list);
+	} else {
+		(void)cfg_map_get(config, "plugin", &plugin_list);
+	}
+
+#ifdef HAVE_DLOPEN
+	if (plugin_list != NULL) {
+		INSIST(view->hooktable == NULL);
+		CHECK(ns_hooktable_create(view->mctx,
+				  (ns_hooktable_t **) &view->hooktable));
+		view->hooktable_free = ns_hooktable_free;
+
+		ns_plugins_create(view->mctx, (ns_plugins_t **)&view->plugins);
+		view->plugins_free = ns_plugins_free;
+
+		CHECK(cfg_pluginlist_foreach(config, plugin_list, named_g_lctx,
+					     register_one_plugin, view));
+	}
+#endif
+
 	/*
 	 * Setup automatic empty zones.  If recursion is off then
 	 * they are disabled by default.
@@ -6871,7 +6893,7 @@ tat_timer_tick(isc_task_t *task, isc_event_t *event) {
 static void
 pps_timer_tick(isc_task_t *task, isc_event_t *event) {
 	static unsigned int oldrequests = 0;
-	unsigned int requests = ns_client_requests;
+	unsigned int requests = atomic_load(&ns_client_requests);

 	UNUSED(task);
 	isc_event_free(&event);
@@ -8056,8 +8078,12 @@ load_configuration(const char *filename, named_server_t *server,

 	/*
 	 * Check the validity of the configuration.
+	 *
+	 * (Ignore plugin parameters for now; they will be
+	 * checked later when the modules are actually loaded and
+	 * registered.)
 	 */
-	CHECK(bind9_check_namedconf(config, named_g_lctx, named_g_mctx));
+	CHECK(bind9_check_namedconf(config, false, named_g_lctx, named_g_mctx));

 	/*
 	 * Fill in the maps array, used for resolving defaults.
@@ -9298,6 +9324,7 @@ view_loaded(void *arg) {
 			      "FIPS mode is %s",
 			      FIPS_mode() ? "enabled" : "disabled");
 #endif
+		server->reload_in_progress = false;

 		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 			      NAMED_LOGMODULE_SERVER, ISC_LOG_NOTICE,
@@ -9351,7 +9378,11 @@ load_zones(named_server_t *server, bool init, bool reconfig) {
 		 * zones.
 		 */
 		isc_refcount_increment(&zl->refs);
-		CHECK(dns_view_asyncload(view, reconfig, view_loaded, zl));
+		result = dns_view_asyncload(view, reconfig, view_loaded, zl);
+		if (result != ISC_R_SUCCESS) {
+			(void)isc_refcount_decrement(&zl->refs);
+			goto cleanup;
+		}
 	}

 cleanup:
@@ -9498,6 +9529,9 @@ shutdown_server(isc_task_t *task, isc_event_t *event) {
 			dns_view_detach(&view);
 	}

+	/*
+	 * Shut down all dyndb instances.
+	 */
 	dns_dyndb_cleanup(true);

 	while ((nsc = ISC_LIST_HEAD(server->cachelist)) != NULL) {
@@ -9615,8 +9649,8 @@ named_server_create(isc_mem_t *mctx, named_server_t **serverp) {
 				     &server->in_roothints),
 		   "setting up root hints");

-	CHECKFATAL(isc_mutex_init(&server->reload_event_lock),
-		   "initializing reload event lock");
+	isc_mutex_init(&server->reload_event_lock);
+
 	server->reload_event =
 		isc_event_allocate(named_g_mctx, server,
 				   NAMED_EVENT_RELOAD,
@@ -9626,6 +9660,7 @@ named_server_create(isc_mem_t *mctx, named_server_t **serverp) {
 	CHECKFATAL(server->reload_event == NULL ?
 		   ISC_R_NOMEMORY : ISC_R_SUCCESS,
 		   "allocating reload event");
+	server->reload_in_progress = true;

 	/*
 	 * Setup the server task, which is responsible for coordinating
@@ -9936,6 +9971,7 @@ loadconfig(named_server_t *server) {
 static isc_result_t
 reload(named_server_t *server) {
 	isc_result_t result;
+	server->reload_in_progress = true;
 	CHECK(loadconfig(server));

 	result = load_zones(server, false, false);
@@ -10282,6 +10318,7 @@ named_server_reloadcommand(named_server_t *server, isc_lex_t *lex,
 isc_result_t
 named_server_reconfigcommand(named_server_t *server) {
 	isc_result_t result;
+	server->reload_in_progress = true;

 	CHECK(loadconfig(server));

@@ -11427,6 +11464,10 @@ named_server_status(named_server_t *server, isc_buffer_t **text) {
 		     server->sctx->tcpquota.used, server->sctx->tcpquota.max);
 	CHECK(putstr(text, line));

+	if (server->reload_in_progress) {
+		CHECK(putstr(text, "reload/reconfig in progress"));
+	}
+
 	CHECK(putstr(text, "server is up and running"));
 	CHECK(putnull(text));

@@ -14416,7 +14457,6 @@ named_server_nta(named_server_t *server, isc_lex_t *lex,
 	bool ttlset = false, excl = false, viewfound = false;
 	dns_rdataclass_t rdclass = dns_rdataclass_in;
 	bool first = true;
-	bool is_option = true;

 	UNUSED(force);

@@ -14436,10 +14476,8 @@ named_server_nta(named_server_t *server, isc_lex_t *lex,
 			return (ISC_R_UNEXPECTEDEND);
 		}

-		if (!is_option) {
-			nametext = ptr;
-		} else if (strcmp(ptr, "--") == 0) {
-			is_option = false;
+		if (strcmp(ptr, "--") == 0) {
+			break;
 		} else if (argcheck(ptr, "dump")) {
 			dump = true;
 		} else if (argcheck(ptr, "remove")) {
@@ -14526,7 +14564,7 @@ named_server_nta(named_server_t *server, isc_lex_t *lex,
 		CHECK(ISC_R_FAILURE);
 	}

-	/* Get the NTA name. */
+	/* Get the NTA name if not found above. */
 	if (nametext == NULL) {
 		nametext = next_token(lex, text);
 	}
@@ -14879,7 +14917,7 @@ mkey_dumpzone(dns_view_t *view, isc_buffer_t **text) {

 			dns_rdata_toregion(&rdata, &r);
 			isc_region_consume(&r, 12);
-			keyid = dst_region_computeid(&r, kd.algorithm);
+			keyid = dst_region_computeid(&r);

 			snprintf(buf, sizeof(buf), "\n    keyid: %u", keyid);
 			CHECK(putstr(text, buf));
@@ -15010,29 +15048,17 @@ named_server_mkeys(named_server_t *server, isc_lex_t *lex,
 	/* Look for the optional class name. */
 	classtxt = next_token(lex, text);
 	if (classtxt != NULL) {
-		/* Look for the optional view name. */
-		viewtxt = next_token(lex, text);
-	}
-
-	if (classtxt == NULL) {
-		rdclass = dns_rdataclass_in;
-	} else {
 		isc_textregion_t r;
 		r.base = classtxt;
 		r.length = strlen(classtxt);
 		result = dns_rdataclass_fromtext(&rdclass, &r);
 		if (result != ISC_R_SUCCESS) {
-			if (viewtxt == NULL) {
-				rdclass = dns_rdataclass_in;
-				viewtxt = classtxt;
-				result = ISC_R_SUCCESS;
-			} else {
-				snprintf(msg, sizeof(msg),
-					 "unknown class '%s'", classtxt);
-				(void) putstr(text, msg);
-				goto cleanup;
-			}
+			snprintf(msg, sizeof(msg),
+				 "unknown class '%s'", classtxt);
+			(void) putstr(text, msg);
+			goto cleanup;
 		}
+		viewtxt = next_token(lex, text);
 	}

 	for (view = ISC_LIST_HEAD(server->viewlist);
@@ -15061,6 +15087,9 @@ named_server_mkeys(named_server_t *server, isc_lex_t *lex,

 		switch (opt) {
 		case REFRESH:
+			if (!first) {
+				CHECK(putstr(text, "\n"));
+			}
 			CHECK(mkey_refresh(view, text));
 			break;
 		case STATUS:
@@ -15068,12 +15097,14 @@ named_server_mkeys(named_server_t *server, isc_lex_t *lex,
 				CHECK(putstr(text, "\n\n"));
 			}
 			CHECK(mkey_status(view, text));
-			first = false;
 			break;
 		case SYNC:
 			CHECK(dns_zone_flush(view->managed_keys));
 			break;
 		case DESTROY:
+			if (!first) {
+				CHECK(putstr(text, "\n"));
+			}
 			CHECK(mkey_destroy(server, view, text));
 			break;
 		default:
@@ -15084,6 +15115,7 @@ named_server_mkeys(named_server_t *server, isc_lex_t *lex,
 		if (viewtxt != NULL) {
 			break;
 		}
+		first = false;
 	}

 	if (!found) {
@@ -3226,7 +3226,7 @@ destroy_listener(void *arg) {
 	/* We don't have to acquire the lock here since it's already unlinked */
 	dns_acl_detach(&listener->acl);

-	DESTROYLOCK(&listener->lock);
+	isc_mutex_destroy(&listener->lock);
 	isc_mem_putanddetach(&listener->mctx, listener, sizeof(*listener));
 }

@@ -3253,11 +3253,7 @@ add_listener(named_server_t *server, named_statschannel_t **listenerp,
 	listener->mctx = NULL;
 	ISC_LINK_INIT(listener, link);

-	result = isc_mutex_init(&listener->lock);
-	if (result != ISC_R_SUCCESS) {
-		isc_mem_put(server->mctx, listener, sizeof(*listener));
-		return (ISC_R_FAILURE);
-	}
+	isc_mutex_init(&listener->lock);

 	isc_mem_attach(server->mctx, &listener->mctx);

@@ -3352,7 +3348,7 @@ cleanup:
 	if (result != ISC_R_SUCCESS) {
 		if (listener->acl != NULL)
 			dns_acl_detach(&listener->acl);
-		DESTROYLOCK(&listener->lock);
+		isc_mutex_destroy(&listener->lock);
 		isc_mem_putanddetach(&listener->mctx, listener,
 				     sizeof(*listener));
 	}
@@ -252,14 +252,12 @@ dlopen_dlz_create(const char *dlzname, unsigned int argc, char *argv[],
 	}

 	/* Initialize the lock */
-	result = isc_mutex_init(&cd->lock);
-	if (result != ISC_R_SUCCESS)
-		goto failed;
+	isc_mutex_init(&cd->lock);

 	/* Open the library */
 	dlopen_flags = RTLD_NOW|RTLD_GLOBAL;

-#ifdef RTLD_DEEPBIND
+#if defined(RTLD_DEEPBIND) && !__SANITIZE_ADDRESS__
 	/*
 	 * If RTLD_DEEPBIND is available then use it. This can avoid
 	 * issues with a module using a different version of a system
@@ -364,15 +362,19 @@ dlopen_dlz_create(const char *dlzname, unsigned int argc, char *argv[],

 failed:
 	dlopen_log(ISC_LOG_ERROR, "dlz_dlopen of '%s' failed", dlzname);
-	if (cd->dl_path != NULL)
+	if (cd->dl_path != NULL) {
 		isc_mem_free(mctx, cd->dl_path);
-	if (cd->dlzname != NULL)
+	}
+	if (cd->dlzname != NULL) {
 		isc_mem_free(mctx, cd->dlzname);
-	if (dlopen_flags != 0)
-		(void) isc_mutex_destroy(&cd->lock);
+	}
+	if (dlopen_flags != 0) {
+		isc_mutex_destroy(&cd->lock);
+	}
 #ifdef HAVE_DLCLOSE
-	if (cd->dl_handle)
+	if (cd->dl_handle) {
 		dlclose(cd->dl_handle);
+	}
 #endif
 	isc_mem_put(mctx, cd, sizeof(*cd));
 	isc_mem_destroy(&mctx);
@@ -395,17 +397,20 @@ dlopen_dlz_destroy(void *driverarg, void *dbdata) {
 		MAYBE_UNLOCK(cd);
 	}

-	if (cd->dl_path)
+	if (cd->dl_path) {
 		isc_mem_free(cd->mctx, cd->dl_path);
-	if (cd->dlzname)
+	}
+	if (cd->dlzname) {
 		isc_mem_free(cd->mctx, cd->dlzname);
+	}

 #ifdef HAVE_DLCLOSE
-	if (cd->dl_handle)
+	if (cd->dl_handle) {
 		dlclose(cd->dl_handle);
+	}
 #endif

-	(void) isc_mutex_destroy(&cd->lock);
+	isc_mutex_destroy(&cd->lock);

 	mctx = cd->mctx;
 	isc_mem_put(mctx, cd, sizeof(*cd));
@@ -253,9 +253,7 @@ dlopen_dlz_create(const char *dlzname, unsigned int argc, char *argv[],
 	triedload = true;

 	/* Initialize the lock */
-	result = isc_mutex_init(&cd->lock);
-	if (result != ISC_R_SUCCESS)
-		goto failed;
+	isc_mutex_init(&cd->lock);

 	/* Open the library */
 	cd->dl_handle = LoadLibraryA(cd->dl_path);
@@ -349,17 +347,21 @@ dlopen_dlz_create(const char *dlzname, unsigned int argc, char *argv[],
 	return (ISC_R_SUCCESS);

 cleanup_lock:
-	DESTROYLOCK(&cd->lock);
+	isc_mutex_destroy(&cd->lock);
 failed:
 	dlopen_log(ISC_LOG_ERROR, "dlz_dlopen of '%s' failed", dlzname);
-	if (cd->dl_path)
+	if (cd->dl_path) {
 		isc_mem_free(mctx, cd->dl_path);
-	if (cd->dlzname)
+	}
+	if (cd->dlzname) {
 		isc_mem_free(mctx, cd->dlzname);
-	if (triedload)
-		(void) isc_mutex_destroy(&cd->lock);
-	if (cd->dl_handle)
+	}
+	if (triedload) {
+		isc_mutex_destroy(&cd->lock);
+	}
+	if (cd->dl_handle) {
 		FreeLibrary(cd->dl_handle);
+	}
 	isc_mem_put(mctx, cd, sizeof(*cd));
 	isc_mem_destroy(&mctx);
 	return (result);
@@ -390,7 +392,7 @@ dlopen_dlz_destroy(void *driverarg, void *dbdata) {
 	if (cd->dl_handle)
 		FreeLibrary(cd->dl_handle);

-	DESTROYLOCK(&cd->lock);
+	isc_mutex_destroy(&cd->lock);

 	mctx = cd->mctx;
 	isc_mem_put(mctx, cd, sizeof(*cd));
@@ -49,6 +49,7 @@
      <year>2016</year>
      <year>2017</year>
      <year>2018</year>
+      <year>2019</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
  </docinfo>
@@ -37,6 +37,7 @@
      <year>2015</year>
      <year>2016</year>
      <year>2018</year>
+      <year>2019</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
  </docinfo>
@@ -38,6 +38,7 @@
      <year>2016</year>
      <year>2017</year>
      <year>2018</year>
+      <year>2019</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
  </docinfo>
@@ -37,6 +37,7 @@
      <year>2015</year>
      <year>2016</year>
      <year>2018</year>
+      <year>2019</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
  </docinfo>
@@ -36,6 +36,7 @@
      <year>2015</year>
      <year>2016</year>
      <year>2018</year>
+      <year>2019</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
  </docinfo>
@@ -0,0 +1,72 @@
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+srcdir =	@srcdir@
+VPATH =		@srcdir@
+top_srcdir =	@top_srcdir@
+
+@BIND9_MAKE_INCLUDES@
+
+CINCLUDES =	-I${srcdir}/include -I${srcdir}/unix/include -I. \
+		${NS_INCLUDES} ${DNS_INCLUDES} \
+		${ISCCFG_INCLUDES} ${ISC_INCLUDES}
+
+DNSLIBS =	../../lib/dns/libdns.@A@ @DNS_CRYPTO_LIBS@
+ISCCFGLIBS =	../../lib/isccfg/libisccfg.@A@
+ISCLIBS =	../../lib/isc/libisc.@A@ @OPENSSL_LIBS@
+NSLIBS =	../../lib/ns/libns.@A@
+
+LIBS =
+
+SO_TARGETS =	lib/filter-aaaa.@SO@
+TARGETS =	@SO_TARGETS@
+
+SO_OBJS =	filter-aaaa.@O@
+SO_SRCS =	filter-aaaa.c
+
+CFLAGS =	@CFLAGS@ @SO_CFLAGS@
+SO_LDFLAGS =	@LDFLAGS@ @SO_LDFLAGS@
+
+MANPAGES =	filter-aaaa.8
+
+HTMLPAGES =	filter-aaaa.html
+
+MANOBJS =	${MANPAGES} ${HTMLPAGES}
+
+@BIND9_MAKE_RULES@
+
+lib/filter-aaaa.@SO@: filter-aaaa.@SO@
+	$(SHELL) ${top_srcdir}/mkinstalldirs `pwd`/lib
+	${LIBTOOL_MODE_INSTALL} ${INSTALL} filter-aaaa.@SO@ `pwd`/lib
+
+filter-aaaa.@SO@: filter-aaaa.@O@
+	${LIBTOOL_MODE_LINK} @SO_LD@ ${SO_LDFLAGS} -o $@ \
+		filter-aaaa.@O@ ${LIBS}
+
+doc man:: ${MANOBJS}
+
+docclean manclean maintainer-clean::
+	rm -f ${MANOBJS}
+
+clean distclean::
+	rm -f filter-aaaa.so
+	rm -f ${TARGETS} ${OBJS}
+
+installdirs:
+	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${libdir}
+	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${mandir}/man8
+
+install:: filter-aaaa.@SO@ installdirs
+	${LIBTOOL_MODE_INSTALL} ${INSTALL_LIBRARY} filter-aaaa.@SO@ \
+		${DESTDIR}${libdir}
+	${INSTALL_DATA} ${srcdir}/filter-aaaa.8 ${DESTDIR}${mandir}/man8
+
+uninstall::
+	${LIBTOOL_MODE_UNINSTALL} rm -f ${DESTDIR}${libdir}/filter-aaaa.@SO@
+	rm -f ${DESTDIR}${mandir}/man8/filter-aaaa.8
@@ -0,0 +1,116 @@
+.\" Copyright (C) 2018 Internet Systems Consortium, Inc. ("ISC")
+.\" 
+.\" This Source Code Form is subject to the terms of the Mozilla Public
+.\" License, v. 2.0. If a copy of the MPL was not distributed with this
+.\" file, You can obtain one at http://mozilla.org/MPL/2.0/.
+.\"
+.hy 0
+.ad l
+'\" t
+.\"     Title: filter-aaaa.so
+.\"    Author: 
+.\" Generator: DocBook XSL Stylesheets v1.78.1 <http://docbook.sf.net/>
+.\"      Date: 2018-08-13
+.\"    Manual: BIND9
+.\"    Source: ISC
+.\"  Language: English
+.\"
+.TH "FILTER\-AAAA\&.SO" "8" "2018\-08\-13" "ISC" "BIND9"
+.\" -----------------------------------------------------------------
+.\" * Define some portability stuff
+.\" -----------------------------------------------------------------
+.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+.\" http://bugs.debian.org/507673
+.\" http://lists.gnu.org/archive/html/groff/2009-02/msg00013.html
+.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+.ie \n(.g .ds Aq \(aq
+.el       .ds Aq '
+.\" -----------------------------------------------------------------
+.\" * set default formatting
+.\" -----------------------------------------------------------------
+.\" disable hyphenation
+.nh
+.\" disable justification (adjust text to left margin only)
+.ad l
+.\" -----------------------------------------------------------------
+.\" * MAIN CONTENT STARTS HERE *
+.\" -----------------------------------------------------------------
+.SH "NAME"
+filter-aaaa.so \- filter AAAA in DNS responses when A is present
+.SH "SYNOPSIS"
+.HP \w'\fBplugin\ query\ "filter\-aaaa\&.so"\fR\ 'u
+\fBplugin query "filter\-aaaa\&.so"\fR [\fI{\ parameters\ }\fR];
+.SH "DESCRIPTION"
+.PP
+\fBfilter\-aaaa\&.so\fR
+is a query plugin module for
+\fBnamed\fR, enabling
+\fBnamed\fR
+to omit some IPv6 addresses when responding to clients\&.
+.PP
+Until BIND 9\&.12, this feature was implemented natively in
+\fBnamed\fR
+and enabled with the
+\fBfilter\-aaaa\fR
+ACL and the
+\fBfilter\-aaaa\-on\-v4\fR
+and
+\fBfilter\-aaaa\-on\-v6\fR
+options\&. These options are now deprecated in
+named\&.conf, but can be passed as parameters to the
+\fBfilter\-aaaa\&.so\fR
+plugin, for example:
+.sp
+.if n \{\
+.RS 4
+.\}
+.nf
+plugin query "/usr/local/lib/filter\-aaaa\&.so" {
+        filter\-aaaa\-on\-v4 yes;
+        filter\-aaaa\-on\-v6 yes;
+        filter\-aaaa { 192\&.0\&.2\&.1; 2001:db8:2::1; };
+};
+.fi
+.if n \{\
+.RE
+.\}
+.PP
+This module is intended to aid transition from IPv4 to IPv6 by withholding IPv6 addresses from DNS clients which are not connected to the IPv6 Internet, when the name being looked up has an IPv4 address available\&. Use of this module is not recommended unless absolutely necessary\&.
+.PP
+Note: This mechanism can erroneously cause other servers not to give AAAA records to their clients\&. If a recursing server with both IPv6 and IPv4 network connections queries an authoritative server using this mechanism via IPv4, it will be denied AAAA records even if its client is using IPv6\&.
+.SH "OPTIONS"
+.PP
+\fBfilter\-aaaa\fR
+.RS 4
+Specifies a list of client addresses for which AAAA filtering is to be applied\&. The default is
+\fBany\fR\&.
+.RE
+.PP
+\fBfilter\-aaaa\-on\-v4\fR
+.RS 4
+If set to
+\fByes\fR, the DNS client is at an IPv4 address, in
+\fBfilter\-aaaa\fR, and if the response does not include DNSSEC signatures, then all AAAA records are deleted from the response\&. This filtering applies to all responses and not only authoritative responses\&.
+.sp
+If set to
+\fBbreak\-dnssec\fR, then AAAA records are deleted even when DNSSEC is enabled\&. As suggested by the name, this causes the response to fail to verify, because the DNSSEC protocol is designed to detect deletions\&.
+.sp
+This mechanism can erroneously cause other servers not to give AAAA records to their clients\&. A recursing server with both IPv6 and IPv4 network connections that queries an authoritative server using this mechanism via IPv4 will be denied AAAA records even if its client is using IPv6\&.
+.RE
+.PP
+\fBfilter\-aaaa\-on\-v6\fR
+.RS 4
+Identical to
+\fBfilter\-aaaa\-on\-v4\fR, except it filters AAAA responses to queries from IPv6 clients instead of IPv4 clients\&. To filter all responses, set both options to
+\fByes\fR\&.
+.RE
+.SH "SEE ALSO"
+.PP
+BIND 9 Administrator Reference Manual\&.
+.SH "AUTHOR"
+.PP
+\fBInternet Systems Consortium, Inc\&.\fR
+.SH "COPYRIGHT"
+.br
+Copyright \(co 2018 Internet Systems Consortium, Inc. ("ISC")
+.br
@@ -0,0 +1,926 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+/*! \file */
+
+#include <config.h>
+
+#include <inttypes.h>
+#include <stdbool.h>
+#include <string.h>
+
+#include <isc/buffer.h>
+#include <isc/hash.h>
+#include <isc/ht.h>
+#include <isc/lib.h>
+#include <isc/log.h>
+#include <isc/mem.h>
+#include <isc/netaddr.h>
+#include <isc/result.h>
+#include <isc/types.h>
+#include <isc/util.h>
+
+#include <isccfg/aclconf.h>
+#include <isccfg/cfg.h>
+#include <isccfg/grammar.h>
+
+#include <ns/client.h>
+#include <ns/hooks.h>
+#include <ns/log.h>
+#include <ns/query.h>
+#include <ns/types.h>
+
+#include <dns/acl.h>
+#include <dns/db.h>
+#include <dns/enumtype.h>
+#include <dns/log.h>
+#include <dns/message.h>
+#include <dns/rdataset.h>
+#include <dns/result.h>
+#include <dns/types.h>
+#include <dns/view.h>
+
+#define CHECK(op)						\
+	do {							\
+		result = (op);					\
+		if (result != ISC_R_SUCCESS) {			\
+			goto cleanup;				\
+		}						\
+	} while (0)
+
+/*
+ * Possible values for the settings of filter-aaaa-on-v4 and
+ * filter-aaaa-on-v6: "no" is NONE, "yes" is FILTER, "break-dnssec"
+ * is BREAK_DNSSEC.
+ */
+typedef enum {
+	NONE = 0,
+	FILTER = 1,
+	BREAK_DNSSEC = 2
+} filter_aaaa_t;
+
+/*
+ * Persistent data for use by this module. This will be associated
+ * with client object address in the hash table, and will remain
+ * accessible until the client object is detached.
+ */
+typedef struct filter_data {
+	filter_aaaa_t mode;
+	uint32_t flags;
+} filter_data_t;
+
+typedef struct filter_instance {
+	ns_plugin_t *module;
+	isc_mem_t *mctx;
+
+	/*
+	 * Memory pool for use with persistent data.
+	 */
+	isc_mempool_t *datapool;
+
+	/*
+	 * Hash table associating a client object with its persistent data.
+	 */
+	isc_ht_t *ht;
+
+	/*
+	 * Values configured when the module is loaded.
+	 */
+	filter_aaaa_t v4_aaaa;
+	filter_aaaa_t v6_aaaa;
+	dns_acl_t *aaaa_acl;
+} filter_instance_t;
+
+/*
+ * Per-client flags set by this module
+ */
+#define FILTER_AAAA_RECURSING	0x0001	/* Recursing for A */
+#define FILTER_AAAA_FILTERED	0x0002	/* AAAA was removed from answer */
+
+/*
+ * Client attribute tests.
+ */
+#define WANTDNSSEC(c)	(((c)->attributes & NS_CLIENTATTR_WANTDNSSEC) != 0)
+#define RECURSIONOK(c)	(((c)->query.attributes & \
+				  NS_QUERYATTR_RECURSIONOK) != 0)
+
+/*
+ * Forward declarations of functions referenced in install_hooks().
+ */
+static ns_hookresult_t
+filter_qctx_initialize(void *arg, void *cbdata, isc_result_t *resp);
+static ns_hookresult_t
+filter_respond_begin(void *arg, void *cbdata, isc_result_t *resp);
+static ns_hookresult_t
+filter_respond_any_found(void *arg, void *cbdata, isc_result_t *resp);
+static ns_hookresult_t
+filter_prep_response_begin(void *arg, void *cbdata, isc_result_t *resp);
+static ns_hookresult_t
+filter_query_done_send(void *arg, void *cbdata, isc_result_t *resp);
+static ns_hookresult_t
+filter_qctx_destroy(void *arg, void *cbdata, isc_result_t *resp);
+
+/*%
+ * Register the functions to be called at each hook point in 'hooktable', using
+ * memory context 'mctx' for allocating copies of stack-allocated structures
+ * passed to ns_hook_add().  Make sure 'inst' will be passed as the 'cbdata'
+ * argument to every callback.
+ */
+static void
+install_hooks(ns_hooktable_t *hooktable, isc_mem_t *mctx,
+	      filter_instance_t *inst)
+{
+	const ns_hook_t filter_init = {
+		.action = filter_qctx_initialize,
+		.action_data = inst,
+	};
+
+	const ns_hook_t filter_respbegin = {
+		.action = filter_respond_begin,
+		.action_data = inst,
+	};
+
+	const ns_hook_t filter_respanyfound = {
+		.action = filter_respond_any_found,
+		.action_data = inst,
+	};
+
+	const ns_hook_t filter_prepresp = {
+		.action = filter_prep_response_begin,
+		.action_data = inst,
+	};
+
+	const ns_hook_t filter_donesend = {
+		.action = filter_query_done_send,
+		.action_data = inst,
+	};
+
+	const ns_hook_t filter_destroy = {
+		.action = filter_qctx_destroy,
+		.action_data = inst,
+	};
+
+	ns_hook_add(hooktable, mctx, -
+		    NS_QUERY_QCTX_INITIALIZED, &filter_init);
+	ns_hook_add(hooktable, mctx,
+		    NS_QUERY_RESPOND_BEGIN, &filter_respbegin);
+	ns_hook_add(hooktable, mctx,
+		    NS_QUERY_RESPOND_ANY_FOUND, &filter_respanyfound);
+	ns_hook_add(hooktable, mctx,
+		    NS_QUERY_PREP_RESPONSE_BEGIN, &filter_prepresp);
+	ns_hook_add(hooktable, mctx,
+		    NS_QUERY_DONE_SEND, &filter_donesend);
+	ns_hook_add(hooktable, mctx,
+		    NS_QUERY_QCTX_DESTROYED, &filter_destroy);
+}
+
+/**
+ ** Support for parsing of parameters and configuration of the module.
+ **/
+
+/*
+ * Support for parsing of parameters.
+ */
+static const char *filter_aaaa_enums[] = { "break-dnssec", NULL };
+
+static isc_result_t
+parse_filter_aaaa(cfg_parser_t *pctx, const cfg_type_t *type, cfg_obj_t **ret) {
+	return (cfg_parse_enum_or_other(pctx, type, &cfg_type_boolean, ret));
+}
+
+static void
+doc_filter_aaaa(cfg_printer_t *pctx, const cfg_type_t *type) {
+	cfg_doc_enum_or_other(pctx, type, &cfg_type_boolean);
+}
+
+static cfg_type_t cfg_type_filter_aaaa = {
+	"filter_aaaa", parse_filter_aaaa, cfg_print_ustring,
+	doc_filter_aaaa, &cfg_rep_string, filter_aaaa_enums,
+};
+
+static cfg_clausedef_t param_clauses[] = {
+	{ "filter-aaaa", &cfg_type_bracketed_aml, 0 },
+	{ "filter-aaaa-on-v4", &cfg_type_filter_aaaa, 0 },
+	{ "filter-aaaa-on-v6", &cfg_type_filter_aaaa, 0 },
+};
+
+static cfg_clausedef_t *param_clausesets[] = {
+	param_clauses,
+	NULL
+};
+
+static cfg_type_t cfg_type_parameters = {
+	"filter-aaaa-params", cfg_parse_mapbody, cfg_print_mapbody,
+	cfg_doc_mapbody, &cfg_rep_map, param_clausesets
+};
+
+static isc_result_t
+parse_filter_aaaa_on(const cfg_obj_t *param_obj, const char *param_name,
+		     filter_aaaa_t *dstp)
+{
+	const cfg_obj_t *obj = NULL;
+	isc_result_t result;
+
+	result = cfg_map_get(param_obj, param_name, &obj);
+	if (result != ISC_R_SUCCESS) {
+		return (ISC_R_SUCCESS);
+	}
+
+	if (cfg_obj_isboolean(obj)) {
+		if (cfg_obj_asboolean(obj)) {
+			*dstp = FILTER;
+		} else {
+			*dstp = NONE;
+		}
+	} else if (strcasecmp(cfg_obj_asstring(obj), "break-dnssec") == 0) {
+		*dstp = BREAK_DNSSEC;
+	} else {
+		result = ISC_R_UNEXPECTED;
+	}
+
+	return (result);
+}
+
+static isc_result_t
+check_syntax(cfg_obj_t *fmap, const void *cfg,
+	     isc_mem_t *mctx, isc_log_t *lctx, void *actx)
+{
+	isc_result_t result = ISC_R_SUCCESS;
+	const cfg_obj_t *aclobj = NULL;
+	dns_acl_t *acl = NULL;
+	filter_aaaa_t f4 = NONE, f6 = NONE;
+
+	cfg_map_get(fmap, "filter-aaaa", &aclobj);
+	if (aclobj == NULL) {
+		return (result);
+	}
+
+	CHECK(cfg_acl_fromconfig(aclobj, (const cfg_obj_t *) cfg,
+				 lctx, (cfg_aclconfctx_t *) actx,
+				 mctx, 0, &acl));
+
+	CHECK(parse_filter_aaaa_on(fmap, "filter-aaaa-on-v4", &f4));
+	CHECK(parse_filter_aaaa_on(fmap, "filter-aaaa-on-v6", &f6));
+
+	if ((f4 != NONE || f6 != NONE) && dns_acl_isnone(acl)) {
+		cfg_obj_log(aclobj, lctx, ISC_LOG_WARNING,
+			    "\"filter-aaaa\" is 'none;' but "
+			    "either filter-aaaa-on-v4 or filter-aaaa-on-v6 "
+			    "is enabled");
+		result = ISC_R_FAILURE;
+	} else if (f4 == NONE && f6 == NONE && !dns_acl_isnone(acl)) {
+		cfg_obj_log(aclobj, lctx, ISC_LOG_WARNING,
+			    "\"filter-aaaa\" is set but "
+			    "neither filter-aaaa-on-v4 or filter-aaaa-on-v6 "
+			    "is enabled");
+		result = ISC_R_FAILURE;
+	}
+
+ cleanup:
+	if (acl != NULL) {
+		dns_acl_detach(&acl);
+	}
+
+	return (result);
+}
+
+static isc_result_t
+parse_parameters(filter_instance_t *inst, const char *parameters,
+		 const void *cfg, const char *cfg_file, unsigned long cfg_line,
+		 isc_mem_t *mctx, isc_log_t *lctx, void *actx)
+{
+	isc_result_t result = ISC_R_SUCCESS;
+	cfg_parser_t *parser = NULL;
+	cfg_obj_t *param_obj = NULL;
+	const cfg_obj_t *obj = NULL;
+	isc_buffer_t b;
+
+	CHECK(cfg_parser_create(mctx, lctx, &parser));
+
+	isc_buffer_constinit(&b, parameters, strlen(parameters));
+	isc_buffer_add(&b, strlen(parameters));
+	CHECK(cfg_parse_buffer4(parser, &b, cfg_file, cfg_line,
+				&cfg_type_parameters, 0, &param_obj));
+
+	CHECK(check_syntax(param_obj, cfg, mctx, lctx, actx));
+
+	CHECK(parse_filter_aaaa_on(param_obj, "filter-aaaa-on-v4",
+				   &inst->v4_aaaa));
+	CHECK(parse_filter_aaaa_on(param_obj, "filter-aaaa-on-v6",
+				   &inst->v6_aaaa));
+
+	result = cfg_map_get(param_obj, "filter-aaaa", &obj);
+	if (result == ISC_R_SUCCESS) {
+		CHECK(cfg_acl_fromconfig(obj, (const cfg_obj_t *) cfg,
+					 lctx, (cfg_aclconfctx_t *) actx,
+					 mctx, 0, &inst->aaaa_acl));
+	} else {
+		CHECK(dns_acl_any(mctx, &inst->aaaa_acl));
+	}
+
+ cleanup:
+	if (param_obj != NULL) {
+		cfg_obj_destroy(parser, &param_obj);
+	}
+	if (parser != NULL) {
+		cfg_parser_destroy(&parser);
+	}
+	return (result);
+}
+
+/**
+ ** Mandatory plugin API functions:
+ **
+ ** - plugin_destroy
+ ** - plugin_register
+ ** - plugin_version
+ ** - plugin_check
+ **/
+
+/*
+ * Called by ns_plugin_register() to initialize the plugin and
+ * register hook functions into the view hook table.
+ */
+isc_result_t
+plugin_register(const char *parameters,
+		const void *cfg, const char *cfg_file, unsigned long cfg_line,
+		isc_mem_t *mctx, isc_log_t *lctx, void *actx,
+		ns_hooktable_t *hooktable, void **instp)
+{
+	filter_instance_t *inst = NULL;
+	isc_result_t result;
+
+
+	isc_log_write(lctx, NS_LOGCATEGORY_GENERAL,
+		      NS_LOGMODULE_HOOKS, ISC_LOG_INFO,
+		      "registering 'filter-aaaa' "
+		      "module from %s:%lu, %s parameters",
+		      cfg_file, cfg_line, parameters != NULL ? "with" : "no");
+
+	inst = isc_mem_get(mctx, sizeof(*inst));
+	memset(inst, 0, sizeof(*inst));
+	isc_mem_attach(mctx, &inst->mctx);
+
+	if (parameters != NULL) {
+		CHECK(parse_parameters(inst, parameters, cfg, cfg_file,
+				       cfg_line, mctx, lctx, actx));
+	}
+
+	CHECK(isc_mempool_create(mctx, sizeof(filter_data_t),
+				 &inst->datapool));
+	CHECK(isc_ht_init(&inst->ht, mctx, 16));
+
+	/*
+	 * Fill the mempool with 1K filter_aaaa state objects at
+	 * a time; ideally after a single allocation, the mempool will
+	 * have enough to handle all the simultaneous queries the system
+	 * requires and it won't be necessary to allocate more.
+	 *
+	 * We don't set any limit on the number of free state objects
+	 * so that they'll always be returned to the pool and not
+	 * freed until the pool is destroyed on shutdown.
+	 */
+	isc_mempool_setfillcount(inst->datapool, 1024);
+	isc_mempool_setfreemax(inst->datapool, UINT_MAX);
+
+	/*
+	 * Set hook points in the view's hooktable.
+	 */
+	install_hooks(hooktable, mctx, inst);
+
+	*instp = inst;
+
+ cleanup:
+	if (result != ISC_R_SUCCESS && inst != NULL) {
+		plugin_destroy((void **) &inst);
+	}
+
+	return (result);
+}
+
+isc_result_t
+plugin_check(const char *parameters,
+	     const void *cfg, const char *cfg_file, unsigned long cfg_line,
+	     isc_mem_t *mctx, isc_log_t *lctx, void *actx)
+{
+	isc_result_t result = ISC_R_SUCCESS;
+	cfg_parser_t *parser = NULL;
+	cfg_obj_t *param_obj = NULL;
+	isc_buffer_t b;
+
+	CHECK(cfg_parser_create(mctx, lctx, &parser));
+
+	isc_buffer_constinit(&b, parameters, strlen(parameters));
+	isc_buffer_add(&b, strlen(parameters));
+	CHECK(cfg_parse_buffer4(parser, &b, cfg_file, cfg_line,
+				&cfg_type_parameters, 0, &param_obj));
+
+	CHECK(check_syntax(param_obj, cfg, mctx, lctx, actx));
+
+ cleanup:
+	if (param_obj != NULL) {
+		cfg_obj_destroy(parser, &param_obj);
+	}
+	if (parser != NULL) {
+		cfg_parser_destroy(&parser);
+	}
+	return (result);
+}
+
+/*
+ * Called by ns_plugins_free(); frees memory allocated by
+ * the module when it was registered.
+ */
+void
+plugin_destroy(void **instp) {
+	filter_instance_t *inst = (filter_instance_t *) *instp;
+
+	if (inst->ht != NULL) {
+		isc_ht_destroy(&inst->ht);
+	}
+	if (inst->datapool != NULL) {
+		isc_mempool_destroy(&inst->datapool);
+	}
+	if (inst->aaaa_acl != NULL) {
+		dns_acl_detach(&inst->aaaa_acl);
+	}
+
+	isc_mem_putanddetach(&inst->mctx, inst, sizeof(*inst));
+	*instp = NULL;
+
+	return;
+}
+
+/*
+ * Returns plugin API version for compatibility checks.
+ */
+int
+plugin_version(void) {
+	return (NS_PLUGIN_VERSION);
+}
+
+/**
+ ** "filter-aaaa" feature implementation begins here.
+ **/
+
+/*%
+ * Structure describing the filtering to be applied by process_section().
+ */
+typedef struct section_filter {
+	query_ctx_t *		qctx;
+	filter_aaaa_t 		mode;
+	dns_section_t		section;
+	const dns_name_t *	name;
+	dns_rdatatype_t		type;
+	bool			only_if_a_exists;
+} section_filter_t;
+
+/*
+ * Check whether this is an IPv4 client.
+ */
+static bool
+is_v4_client(ns_client_t *client) {
+	if (isc_sockaddr_pf(&client->peeraddr) == AF_INET) {
+		return (true);
+	}
+	if (isc_sockaddr_pf(&client->peeraddr) == AF_INET6 &&
+	    IN6_IS_ADDR_V4MAPPED(&client->peeraddr.type.sin6.sin6_addr))
+	{
+		return (true);
+	}
+	return (false);
+}
+
+/*
+ * Check whether this is an IPv6 client.
+ */
+static bool
+is_v6_client(ns_client_t *client) {
+	if (isc_sockaddr_pf(&client->peeraddr) == AF_INET6 &&
+	    !IN6_IS_ADDR_V4MAPPED(&client->peeraddr.type.sin6.sin6_addr))
+	{
+		return (true);
+	}
+	return (false);
+}
+
+static filter_data_t *
+client_state_get(const query_ctx_t *qctx, filter_instance_t *inst) {
+	filter_data_t *client_state = NULL;
+	isc_result_t result;
+
+	result = isc_ht_find(inst->ht, (const unsigned char *)&qctx->client,
+			     sizeof(qctx->client), (void **)&client_state);
+
+	return (result == ISC_R_SUCCESS ? client_state : NULL);
+}
+
+static void
+client_state_create(const query_ctx_t *qctx, filter_instance_t *inst) {
+	filter_data_t *client_state;
+	isc_result_t result;
+
+	client_state = isc_mempool_get(inst->datapool);
+	if (client_state == NULL) {
+		return;
+	}
+
+	client_state->mode = NONE;
+	client_state->flags = 0;
+
+	result = isc_ht_add(inst->ht, (const unsigned char *)&qctx->client,
+			    sizeof(qctx->client), client_state);
+	RUNTIME_CHECK(result == ISC_R_SUCCESS);
+}
+
+static void
+client_state_destroy(const query_ctx_t *qctx, filter_instance_t *inst) {
+	filter_data_t *client_state = client_state_get(qctx, inst);
+	isc_result_t result;
+
+	if (client_state == NULL) {
+		return;
+	}
+
+	result = isc_ht_delete(inst->ht, (const unsigned char *)&qctx->client,
+			       sizeof(qctx->client));
+	RUNTIME_CHECK(result == ISC_R_SUCCESS);
+
+	isc_mempool_put(inst->datapool, client_state);
+}
+
+/*%
+ * Mark 'rdataset' and 'sigrdataset' as rendered, gracefully handling NULL
+ * pointers and non-associated rdatasets.
+ */
+static void
+mark_as_rendered(dns_rdataset_t *rdataset, dns_rdataset_t *sigrdataset) {
+	if (rdataset != NULL && dns_rdataset_isassociated(rdataset)) {
+		rdataset->attributes |= DNS_RDATASETATTR_RENDERED;
+	}
+	if (sigrdataset != NULL && dns_rdataset_isassociated(sigrdataset)) {
+		sigrdataset->attributes |= DNS_RDATASETATTR_RENDERED;
+	}
+}
+
+/*%
+ * Check whether an RRset of given 'type' is present at given 'name'.  If
+ * it is found and either it is not signed or the combination of query
+ * flags and configured processing 'mode' allows it, mark the RRset and its
+ * associated signatures as already rendered to prevent them from appearing
+ * in the response message stored in 'qctx'.  If 'only_if_a_exists' is
+ * true, an RRset of type A must also exist at 'name' in order for the
+ * above processing to happen.
+ */
+static bool
+process_name(query_ctx_t *qctx, filter_aaaa_t mode, const dns_name_t *name,
+	     dns_rdatatype_t type, bool only_if_a_exists)
+{
+	dns_rdataset_t *rdataset = NULL, *sigrdataset = NULL;
+	isc_result_t result;
+	bool modified = false;
+
+	if (only_if_a_exists) {
+		CHECK(dns_message_findtype(name, dns_rdatatype_a, 0, NULL));
+	}
+
+	(void)dns_message_findtype(name, type, 0, &rdataset);
+	(void)dns_message_findtype(name, dns_rdatatype_rrsig, type,
+				   &sigrdataset);
+
+	if (rdataset != NULL &&
+	    (sigrdataset == NULL || !WANTDNSSEC(qctx->client) ||
+	     mode == BREAK_DNSSEC))
+	{
+		/*
+		 * An RRset of given 'type' was found at 'name' and at least
+		 * one of the following is true:
+		 *
+		 *   - the RRset is not signed,
+		 *   - the client did not set the DO bit in its request,
+		 *   - configuration allows us to tamper with signed responses.
+		 *
+		 * This means it is okay to filter out this RRset and its
+		 * signatures, if any, from the response.
+		 */
+		mark_as_rendered(rdataset, sigrdataset);
+		modified = true;
+	}
+
+ cleanup:
+	return (modified);
+}
+
+/*%
+ * Apply the requested section filter, i.e. prevent (when possible, as
+ * determined by process_name()) RRsets of given 'type' from being rendered
+ * in the given 'section' of the response message stored in 'qctx'.  Clear
+ * the AD bit if the answer and/or authority section was modified.  If
+ * 'name' is NULL, all names in the given 'section' are processed;
+ * otherwise, only 'name' is.  'only_if_a_exists' is passed through to
+ * process_name().
+ */
+static void
+process_section(const section_filter_t *filter) {
+	query_ctx_t *qctx = filter->qctx;
+	filter_aaaa_t mode = filter->mode;
+	dns_section_t section = filter->section;
+	const dns_name_t *name = filter->name;
+	dns_rdatatype_t type = filter->type;
+	bool only_if_a_exists = filter->only_if_a_exists;
+
+	dns_message_t *message = qctx->client->message;
+	isc_result_t result;
+
+	for (result = dns_message_firstname(message, section);
+	     result == ISC_R_SUCCESS;
+	     result = dns_message_nextname(message, section))
+	{
+		dns_name_t *cur = NULL;
+		dns_message_currentname(message, section, &cur);
+		if (name != NULL && !dns_name_equal(name, cur)) {
+			/*
+			 * We only want to process 'name' and this is not it.
+			 */
+			continue;
+		}
+
+		if (!process_name(qctx, mode, cur, type, only_if_a_exists)) {
+			/*
+			 * Response was not modified, do not touch the AD bit.
+			 */
+			continue;
+		}
+
+		if (section == DNS_SECTION_ANSWER ||
+		    section == DNS_SECTION_AUTHORITY)
+		{
+			message->flags &= ~DNS_MESSAGEFLAG_AD;
+		}
+	}
+}
+
+/*
+ * Initialize filter state, fetching it from a memory pool and storing it
+ * in a hash table keyed according to the client object; this enables us to
+ * retrieve persistent data related to a client query for as long as the
+ * object persists.
+ */
+static ns_hookresult_t
+filter_qctx_initialize(void *arg, void *cbdata, isc_result_t *resp) {
+	query_ctx_t *qctx = (query_ctx_t *) arg;
+	filter_instance_t *inst = (filter_instance_t *) cbdata;
+	filter_data_t *client_state;
+
+	*resp = ISC_R_UNSET;
+
+	client_state = client_state_get(qctx, inst);
+	if (client_state == NULL) {
+		client_state_create(qctx, inst);
+	}
+
+	return (NS_HOOK_CONTINUE);
+}
+
+/*
+ * Determine whether this client should have AAAA filtered or not, based on
+ * the client address family and the settings of filter-aaaa-on-v4 and
+ * filter-aaaa-on-v6.
+ */
+static ns_hookresult_t
+filter_prep_response_begin(void *arg, void *cbdata, isc_result_t *resp) {
+	query_ctx_t *qctx = (query_ctx_t *) arg;
+	filter_instance_t *inst = (filter_instance_t *) cbdata;
+	filter_data_t *client_state = client_state_get(qctx, inst);
+	isc_result_t result;
+
+	*resp = ISC_R_UNSET;
+
+	if (client_state == NULL) {
+		return (NS_HOOK_CONTINUE);
+	}
+
+	if (inst->v4_aaaa != NONE || inst->v6_aaaa != NONE) {
+		result = ns_client_checkaclsilent(qctx->client, NULL,
+						  inst->aaaa_acl, true);
+		if (result == ISC_R_SUCCESS &&
+		    inst->v4_aaaa != NONE &&
+		    is_v4_client(qctx->client))
+		{
+			client_state->mode = inst->v4_aaaa;
+		} else if (result == ISC_R_SUCCESS &&
+			   inst->v6_aaaa != NONE &&
+			   is_v6_client(qctx->client))
+		{
+			client_state->mode = inst->v6_aaaa;
+		}
+	}
+
+	return (NS_HOOK_CONTINUE);
+}
+
+/*
+ * Hide AAAA rrsets if there is a matching A. Trigger recursion if
+ * necessary to find out whether an A exists.
+ *
+ * (This version is for processing answers to explicit AAAA queries; ANY
+ * queries are handled in filter_respond_any_found().)
+ */
+static ns_hookresult_t
+filter_respond_begin(void *arg, void *cbdata, isc_result_t *resp) {
+	query_ctx_t *qctx = (query_ctx_t *) arg;
+	filter_instance_t *inst = (filter_instance_t *) cbdata;
+	filter_data_t *client_state = client_state_get(qctx, inst);
+	isc_result_t result = ISC_R_UNSET;
+
+	*resp = ISC_R_UNSET;
+
+	if (client_state == NULL) {
+		return (NS_HOOK_CONTINUE);
+	}
+
+	if (client_state->mode != BREAK_DNSSEC &&
+	    (client_state->mode != FILTER ||
+	     (WANTDNSSEC(qctx->client) && qctx->sigrdataset != NULL &&
+	      dns_rdataset_isassociated(qctx->sigrdataset))))
+	{
+		return (NS_HOOK_CONTINUE);
+	}
+
+	if (qctx->qtype == dns_rdatatype_aaaa) {
+		dns_rdataset_t *trdataset;
+		trdataset = ns_client_newrdataset(qctx->client);
+		result = dns_db_findrdataset(qctx->db, qctx->node,
+					     qctx->version,
+					     dns_rdatatype_a, 0,
+					     qctx->client->now,
+					     trdataset, NULL);
+		if (dns_rdataset_isassociated(trdataset)) {
+			dns_rdataset_disassociate(trdataset);
+		}
+		ns_client_putrdataset(qctx->client, &trdataset);
+
+		/*
+		 * We found an AAAA. If we also found an A, then the AAAA
+		 * must not be rendered.
+		 *
+		 * If the A is not in our cache, then any result other than
+		 * DNS_R_DELEGATION or ISC_R_NOTFOUND means there is no A,
+		 * and so AAAAs are okay.
+		 *
+		 * We assume there is no A if we can't recurse for this
+		 * client. That might be the wrong answer, but what else
+		 * can we do?  Besides, the fact that we have the AAAA and
+		 * are using this mechanism in the first place suggests
+		 * that we care more about As than AAAAs, and would have
+		 * cached an A if it existed.
+		 */
+		if (result == ISC_R_SUCCESS) {
+			mark_as_rendered(qctx->rdataset, qctx->sigrdataset);
+			qctx->client->message->flags &= ~DNS_MESSAGEFLAG_AD;
+			client_state->flags |= FILTER_AAAA_FILTERED;
+		} else if (!qctx->authoritative &&
+			   RECURSIONOK(qctx->client) &&
+			   (result == DNS_R_DELEGATION ||
+			    result == ISC_R_NOTFOUND))
+		{
+			/*
+			 * This is an ugly kludge to recurse
+			 * for the A and discard the result.
+			 *
+			 * Continue to add the AAAA now.
+			 * We'll make a note to not render it
+			 * if the recursion for the A succeeds.
+			 */
+			result = ns_query_recurse(qctx->client,
+						  dns_rdatatype_a,
+						  qctx->client->query.qname,
+						  NULL, NULL, qctx->resuming);
+			if (result == ISC_R_SUCCESS) {
+				client_state->flags |= FILTER_AAAA_RECURSING;
+				qctx->client->query.attributes |=
+					NS_QUERYATTR_RECURSING;
+			}
+		}
+	} else if (qctx->qtype == dns_rdatatype_a &&
+		   (client_state->flags & FILTER_AAAA_RECURSING) != 0)
+	{
+		const section_filter_t filter_answer = {
+			.qctx = qctx,
+			.mode = client_state->mode,
+			.section = DNS_SECTION_ANSWER,
+			.name = qctx->fname,
+			.type = dns_rdatatype_aaaa,
+		};
+		process_section(&filter_answer);
+
+		client_state->flags &= ~FILTER_AAAA_RECURSING;
+
+		result = ns_query_done(qctx);
+
+		*resp = result;
+
+		return (NS_HOOK_RETURN);
+	}
+
+	*resp = result;
+	return (NS_HOOK_CONTINUE);
+}
+
+/*
+ * When answering an ANY query, remove AAAA if A is present.
+ */
+static ns_hookresult_t
+filter_respond_any_found(void *arg, void *cbdata, isc_result_t *resp) {
+	query_ctx_t *qctx = (query_ctx_t *) arg;
+	filter_instance_t *inst = (filter_instance_t *) cbdata;
+	filter_data_t *client_state = client_state_get(qctx, inst);
+
+	*resp = ISC_R_UNSET;
+
+	if (client_state != NULL && client_state->mode != NONE) {
+		/*
+		 * If we are authoritative, require an A record to be
+		 * present before filtering out AAAA records; otherwise,
+		 * just assume an A record exists even if it was not in the
+		 * cache (and therefore is not in the response message),
+		 * thus proceeding with filtering out AAAA records.
+		 */
+		const section_filter_t filter_answer = {
+			.qctx = qctx,
+			.mode = client_state->mode,
+			.section = DNS_SECTION_ANSWER,
+			.name = qctx->tname,
+			.type = dns_rdatatype_aaaa,
+			.only_if_a_exists = qctx->authoritative,
+		};
+		process_section(&filter_answer);
+	}
+
+	return (NS_HOOK_CONTINUE);
+}
+
+/*
+ * Hide AAAA rrsets in the additional section if there is a matching A, and
+ * hide NS in the authority section if AAAA was filtered in the answer
+ * section.
+ */
+static ns_hookresult_t
+filter_query_done_send(void *arg, void *cbdata, isc_result_t *resp) {
+	query_ctx_t *qctx = (query_ctx_t *) arg;
+	filter_instance_t *inst = (filter_instance_t *) cbdata;
+	filter_data_t *client_state = client_state_get(qctx, inst);
+
+	*resp = ISC_R_UNSET;
+
+	if (client_state != NULL && client_state->mode != NONE) {
+		const section_filter_t filter_additional = {
+			.qctx = qctx,
+			.mode = client_state->mode,
+			.section = DNS_SECTION_ADDITIONAL,
+			.type = dns_rdatatype_aaaa,
+			.only_if_a_exists = true,
+		};
+		process_section(&filter_additional);
+
+		if ((client_state->flags & FILTER_AAAA_FILTERED) != 0) {
+			const section_filter_t filter_authority = {
+				.qctx = qctx,
+				.mode = client_state->mode,
+				.section = DNS_SECTION_AUTHORITY,
+				.type = dns_rdatatype_ns,
+			};
+			process_section(&filter_authority);
+		}
+	}
+
+	return (NS_HOOK_CONTINUE);
+}
+
+/*
+ * If the client is being detached, then we can delete our persistent data
+ * from hash table and return it to the memory pool.
+ */
+static ns_hookresult_t
+filter_qctx_destroy(void *arg, void *cbdata, isc_result_t *resp) {
+	query_ctx_t *qctx = (query_ctx_t *) arg;
+	filter_instance_t *inst = (filter_instance_t *) cbdata;
+
+	*resp = ISC_R_UNSET;
+
+	if (!qctx->detach_client) {
+		return (NS_HOOK_CONTINUE);
+	}
+
+	client_state_destroy(qctx, inst);
+
+	return (NS_HOOK_CONTINUE);
+}
@@ -0,0 +1,147 @@
+<!--
+ - Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ -
+ - This Source Code Form is subject to the terms of the Mozilla Public
+ - License, v. 2.0. If a copy of the MPL was not distributed with this
+ - file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ -
+ - See the COPYRIGHT file distributed with this work for additional
+ - information regarding copyright ownership.
+-->
+
+<!-- Converted by db4-upgrade version 1.0 -->
+<refentry xmlns:db="http://docbook.org/ns/docbook" version="5.0" xml:id="man.filter-aaaa">
+  <info>
+    <date>2018-08-13</date>
+  </info>
+  <refentryinfo>
+    <corpname>ISC</corpname>
+    <corpauthor>Internet Systems Consortium, Inc.</corpauthor>
+  </refentryinfo>
+  <refmeta>
+    <refentrytitle><application>filter-aaaa.so</application></refentrytitle>
+    <manvolnum>8</manvolnum>
+    <refmiscinfo>BIND9</refmiscinfo>
+  </refmeta>
+
+  <refnamediv>
+    <refname><application>filter-aaaa.so</application></refname>
+    <refpurpose>filter AAAA in DNS responses when A is present</refpurpose>
+  </refnamediv>
+
+  <docinfo>
+    <copyright>
+      <year>2018</year>
+      <year>2019</year>
+      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
+    </copyright>
+  </docinfo>
+
+  <refsynopsisdiv>
+    <cmdsynopsis sepchar=" ">
+      <command>plugin query "filter-aaaa.so"</command>
+      <arg choice="opt" rep="norepeat"><replaceable class="parameter">{ parameters }</replaceable></arg>;
+    </cmdsynopsis>
+  </refsynopsisdiv>
+
+  <refsection><info><title>DESCRIPTION</title></info>
+    <para>
+      <command>filter-aaaa.so</command> is a query plugin module for
+      <command>named</command>, enabling <command>named</command>
+      to omit some IPv6 addresses when responding to clients.
+    </para>
+    <para>
+      Until BIND 9.12, this feature was implemented natively in
+      <command>named</command> and enabled with the
+      <command>filter-aaaa</command> ACL and the
+      <command>filter-aaaa-on-v4</command> and
+      <command>filter-aaaa-on-v6</command> options. These options are
+      now deprecated in <filename>named.conf</filename>, but can be
+      passed as parameters to the <command>filter-aaaa.so</command>
+      plugin, for example:
+    </para>
+    <programlisting>
+plugin query "/usr/local/lib/filter-aaaa.so" {
+        filter-aaaa-on-v4 yes;
+        filter-aaaa-on-v6 yes;
+        filter-aaaa { 192.0.2.1; 2001:db8:2::1; };
+};
+</programlisting>
+    <para>
+      This module is intended to aid transition from IPv4 to IPv6 by
+      withholding IPv6 addresses from DNS clients which are not connected
+      to the IPv6 Internet, when the name being looked up has an IPv4
+      address available.  Use of this module is not recommended unless
+      absolutely necessary.
+    </para>
+    <para>
+      Note: This mechanism can erroneously cause other servers not to
+      give AAAA records to their clients.  If a recursing server with
+      both IPv6 and IPv4 network connections queries an authoritative
+      server using this mechanism via IPv4, it will be denied AAAA
+      records even if its client is using IPv6.
+    </para>
+  </refsection>
+
+  <refsection><info><title>OPTIONS</title></info>
+    <variablelist>
+      <varlistentry>
+	<term><command>filter-aaaa</command></term>
+	<listitem>
+	  <para>
+	    Specifies a list of client addresses for which AAAA
+	    filtering is to be applied.  The default is
+	    <userinput>any</userinput>.
+	  </para>
+	</listitem>
+      </varlistentry>
+
+      <varlistentry>
+	<term><command>filter-aaaa-on-v4</command></term>
+	<listitem>
+	  <para>
+	    If set to <userinput>yes</userinput>, the DNS client is
+	    at an IPv4 address, in <command>filter-aaaa</command>,
+	    and if the response does not include DNSSEC signatures,
+	    then all AAAA records are deleted from the response.
+	    This filtering applies to all responses and not only
+	    authoritative responses.
+	  </para>
+	  <para>
+	    If set to <userinput>break-dnssec</userinput>,
+	    then AAAA records are deleted even when DNSSEC is
+	    enabled.  As suggested by the name, this causes the
+	    response to fail to verify, because the DNSSEC protocol is
+	    designed to detect deletions.
+	  </para>
+	  <para>
+	    This mechanism can erroneously cause other servers not to
+	    give AAAA records to their clients.  A recursing server with
+	    both IPv6 and IPv4 network connections that queries an
+	    authoritative server using this mechanism via IPv4 will be
+	    denied AAAA records even if its client is using IPv6.
+	  </para>
+	</listitem>
+      </varlistentry>
+
+      <varlistentry>
+	<term><command>filter-aaaa-on-v6</command></term>
+	<listitem>
+	  <para>
+	    Identical to <command>filter-aaaa-on-v4</command>,
+	    except it filters AAAA responses to queries from IPv6
+	    clients instead of IPv4 clients.  To filter all
+	    responses, set both options to <userinput>yes</userinput>.
+	  </para>
+	</listitem>
+      </varlistentry>
+    </variablelist>
+  </refsection>
+
+  <refsection><info><title>SEE ALSO</title></info>
+    <para>
+      <citetitle>BIND 9 Administrator Reference Manual</citetitle>.
+    </para>
+  </refsection>
+
+</refentry>
@@ -0,0 +1,135 @@
+<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
+<!--
+ - Copyright (C) 2018 Internet Systems Consortium, Inc. ("ISC")
+ - 
+ - This Source Code Form is subject to the terms of the Mozilla Public
+ - License, v. 2.0. If a copy of the MPL was not distributed with this
+ - file, You can obtain one at http://mozilla.org/MPL/2.0/.
+-->
+<html lang="en">
+<head>
+<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
+<title>filter-aaaa.so</title>
+<meta name="generator" content="DocBook XSL Stylesheets V1.78.1">
+</head>
+<body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="refentry">
+<a name="man.filter-aaaa"></a><div class="titlepage"></div>
+  
+  
+  
+
+  <div class="refnamediv">
+<h2>Name</h2>
+<p>
+    <span class="application">filter-aaaa.so</span>
+     &#8212; filter AAAA in DNS responses when A is present
+  </p>
+</div>
+
+  
+
+  <div class="refsynopsisdiv">
+<h2>Synopsis</h2>
+    <div class="cmdsynopsis"><p>
+      <code class="command">plugin query "filter-aaaa.so"</code> 
+       [<em class="replaceable"><code>{ parameters }</code></em>];
+    </p></div>
+  </div>
+
+  <div class="refsection">
+<a name="id-1.7"></a><h2>DESCRIPTION</h2>
+    <p>
+      <span class="command"><strong>filter-aaaa.so</strong></span> is a query plugin module for
+      <span class="command"><strong>named</strong></span>, enabling <span class="command"><strong>named</strong></span>
+      to omit some IPv6 addresses when responding to clients.
+    </p>
+    <p>
+      Until BIND 9.12, this feature was implemented natively in
+      <span class="command"><strong>named</strong></span> and enabled with the
+      <span class="command"><strong>filter-aaaa</strong></span> ACL and the
+      <span class="command"><strong>filter-aaaa-on-v4</strong></span> and
+      <span class="command"><strong>filter-aaaa-on-v6</strong></span> options. These options are
+      now deprecated in <code class="filename">named.conf</code>, but can be
+      passed as parameters to the <span class="command"><strong>filter-aaaa.so</strong></span>
+      plugin, for example:
+    </p>
+    <pre class="programlisting">
+plugin query "/usr/local/lib/filter-aaaa.so" {
+        filter-aaaa-on-v4 yes;
+        filter-aaaa-on-v6 yes;
+        filter-aaaa { 192.0.2.1; 2001:db8:2::1; };
+};
+</pre>
+    <p>
+      This module is intended to aid transition from IPv4 to IPv6 by
+      withholding IPv6 addresses from DNS clients which are not connected
+      to the IPv6 Internet, when the name being looked up has an IPv4
+      address available.  Use of this module is not recommended unless
+      absolutely necessary.
+    </p>
+    <p>
+      Note: This mechanism can erroneously cause other servers not to
+      give AAAA records to their clients.  If a recursing server with
+      both IPv6 and IPv4 network connections queries an authoritative
+      server using this mechanism via IPv4, it will be denied AAAA
+      records even if its client is using IPv6.
+    </p>
+  </div>
+
+  <div class="refsection">
+<a name="id-1.8"></a><h2>OPTIONS</h2>
+    <div class="variablelist"><dl class="variablelist">
+<dt><span class="term"><span class="command"><strong>filter-aaaa</strong></span></span></dt>
+<dd>
+	  <p>
+	    Specifies a list of client addresses for which AAAA
+	    filtering is to be applied.  The default is
+	    <strong class="userinput"><code>any</code></strong>.
+	  </p>
+	</dd>
+<dt><span class="term"><span class="command"><strong>filter-aaaa-on-v4</strong></span></span></dt>
+<dd>
+	  <p>
+	    If set to <strong class="userinput"><code>yes</code></strong>, the DNS client is
+	    at an IPv4 address, in <span class="command"><strong>filter-aaaa</strong></span>,
+	    and if the response does not include DNSSEC signatures,
+	    then all AAAA records are deleted from the response.
+	    This filtering applies to all responses and not only
+	    authoritative responses.
+	  </p>
+	  <p>
+	    If set to <strong class="userinput"><code>break-dnssec</code></strong>,
+	    then AAAA records are deleted even when DNSSEC is
+	    enabled.  As suggested by the name, this causes the
+	    response to fail to verify, because the DNSSEC protocol is
+	    designed to detect deletions.
+	  </p>
+	  <p>
+	    This mechanism can erroneously cause other servers not to
+	    give AAAA records to their clients.  A recursing server with
+	    both IPv6 and IPv4 network connections that queries an
+	    authoritative server using this mechanism via IPv4 will be
+	    denied AAAA records even if its client is using IPv6.
+	  </p>
+	</dd>
+<dt><span class="term"><span class="command"><strong>filter-aaaa-on-v6</strong></span></span></dt>
+<dd>
+	  <p>
+	    Identical to <span class="command"><strong>filter-aaaa-on-v4</strong></span>,
+	    except it filters AAAA responses to queries from IPv6
+	    clients instead of IPv4 clients.  To filter all
+	    responses, set both options to <strong class="userinput"><code>yes</code></strong>.
+	  </p>
+	</dd>
+</dl></div>
+  </div>
+
+  <div class="refsection">
+<a name="id-1.9"></a><h2>SEE ALSO</h2>
+    <p>
+      <em class="citetitle">BIND 9 Administrator Reference Manual</em>.
+    </p>
+  </div>
+
+</div></body>
+</html>
@@ -39,6 +39,7 @@
      <year>2016</year>
      <year>2017</year>
      <year>2018</year>
+      <year>2019</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
  </docinfo>
@@ -37,6 +37,7 @@
      <year>2015</year>
      <year>2016</year>
      <year>2018</year>
+      <year>2019</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
  </docinfo>
@@ -34,6 +34,7 @@
      <year>2016</year>
      <year>2017</year>
      <year>2018</year>
+      <year>2019</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
  </docinfo>
@@ -452,6 +452,10 @@ class dnskey:
        if timespan is None:
            timespan = self.ttl

+        if timespan is None:
+            output("WARNING: Key %s using default TTL." % repr(self))
+            timespan = (60*60*24)
+
        now = time.time()
        d = self.delete()
        i = self.inactive()
@@ -71,7 +71,7 @@ class PolicyLex:
        return t

    def t_ALGNAME(self, t):
-        r'(?i)\b(RSAMD5|DH|ECC|RSASHA1|NSEC3RSASHA1|RSASHA256|RSASHA512|ECDSAP256SHA256|ECDSAP384SHA384|ED25519|ED448)\b'
+        r'(?i)\b(DH|ECC|RSASHA1|NSEC3RSASHA1|RSASHA256|RSASHA512|ECDSAP256SHA256|ECDSAP384SHA384|ED25519|ED448)\b'
        t.value = t.value.upper()
        return t

@@ -132,8 +132,7 @@ class Policy:
    keyttl = None
    coverage = None
    directory = None
-    valid_key_sz_per_algo = {'RSAMD5': [1024, 4096],
-                             'RSASHA1': [1024, 4096],
+    valid_key_sz_per_algo = {'RSASHA1': [1024, 4096],
                             'NSEC3RSASHA1': [512, 4096],
                             'RSASHA256': [1024, 4096],
                             'RSASHA512': [1024, 4096],
@@ -322,10 +321,6 @@ class dnssec_policy:
        # set default algorithm policies

        # these can use default settings
-        self.alg_policy['RSAMD5'] = copy(p)
-        self.alg_policy['RSAMD5'].algorithm = "RSAMD5"
-        self.alg_policy['RSAMD5'].name = "RSAMD5"
-
        self.alg_policy['RSASHA1'] = copy(p)
        self.alg_policy['RSASHA1'].algorithm = "RSASHA1"
        self.alg_policy['RSASHA1'].name = "RSASHA1"
@@ -75,7 +75,7 @@ static isccc_region_t secret;
 static bool failed = false;
 static bool c_flag = false;
 static isc_mem_t *rndc_mctx;
-static int sends, recvs, connects;
+static atomic_uint_fast32_t sends, recvs, connects;
 static char *command;
 static char *args;
 static char program[256];
@@ -273,11 +273,11 @@ rndc_senddone(isc_task_t *task, isc_event_t *event) {

 	UNUSED(task);

-	sends--;
+	atomic_fetch_sub(&sends, 1);
 	if (sevent->result != ISC_R_SUCCESS)
 		fatal("send failed: %s", isc_result_totext(sevent->result));
 	isc_event_free(&event);
-	if (sends == 0 && recvs == 0) {
+	if (atomic_load(&sends) == 0 && atomic_load(&recvs) == 0) {
 		isc_socket_detach(&sock);
 		isc_task_shutdown(task);
 		RUNTIME_CHECK(isc_app_shutdown() == ISC_R_SUCCESS);
@@ -346,7 +346,7 @@ rndc_recvdone(isc_task_t *task, isc_event_t *event) {

 	isc_event_free(&event);
 	isccc_sexpr_free(&response);
-	if (sends == 0 && recvs == 0) {
+	if (atomic_load(&sends) == 0 && atomic_load(&recvs) == 0) {
 		isc_socket_detach(&sock);
 		isc_task_shutdown(task);
 		RUNTIME_CHECK(isc_app_shutdown() == ISC_R_SUCCESS);
@@ -430,7 +430,7 @@ rndc_recvnonce(isc_task_t *task, isc_event_t *event) {
 	recvs++;
 	DO("send message", isc_socket_send(sock, &r, task, rndc_senddone,
 					   NULL));
-	sends++;
+	atomic_fetch_add(&sends, 1);

 	isc_event_free(&event);
 	isccc_sexpr_free(&response);
@@ -498,7 +498,7 @@ rndc_connected(isc_task_t *task, isc_event_t *event) {
 	recvs++;
 	DO("send message", isc_socket_send(sock, &r, task, rndc_senddone,
 					   NULL));
-	sends++;
+	atomic_fetch_add(&sends, 1);
 	isc_event_free(&event);
 	isccc_sexpr_free(&request);
 }
@@ -999,8 +999,10 @@ main(int argc, char **argv) {
 	if (result != ISC_R_SUCCESS)
 		fatal("isc_app_run() failed: %s", isc_result_totext(result));

-	if (connects > 0 || sends > 0 || recvs > 0)
+	if (atomic_load(&connects) > 0 || atomic_load(&sends) > 0 ||
+	    atomic_load(&recvs) > 0) {
 		isc_socket_cancel(sock, task, ISC_SOCKCANCEL_ALL);
+	}

 	isc_task_detach(&task);
 	isc_taskmgr_destroy(&taskmgr);
@@ -42,6 +42,7 @@
      <year>2015</year>
      <year>2016</year>
      <year>2018</year>
+      <year>2019</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
  </docinfo>
@@ -43,6 +43,7 @@
      <year>2016</year>
      <year>2017</year>
      <year>2018</year>
+      <year>2019</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
  </docinfo>
@@ -47,7 +47,6 @@ XTARGETS =	adb_test@EXEEXT@ \
 		backtrace_test_nosymtbl@EXEEXT@ \
 		byname_test@EXEEXT@ \
 		db_test@EXEEXT@ \
-		dst_test@EXEEXT@ \
 		gsstest@EXEEXT@ \
 		fsaccess_test@EXEEXT@ \
 		inter_test@EXEEXT@ \
@@ -76,7 +75,6 @@ XSRCS =		adb_test.c \
 		backtrace_test.c \
 		byname_test.c \
 		db_test.c \
-		dst_test.c \
 		fsaccess_test.c \
 		gsstest.c \
 		inter_test.c \
@@ -237,10 +235,6 @@ sig0_test@EXEEXT@: sig0_test.@O@ ${ISCDEPLIBS} ${DNSDEPLIBS}
 	${LIBTOOL_MODE_LINK} ${PURIFY} ${CC} ${CFLAGS} ${LDFLAGS} -o $@ sig0_test.@O@ \
 		${DNSLIBS} ${ISCLIBS} ${LIBS}

-dst_test@EXEEXT@: dst_test.@O@ ${ISCDEPLIBS} ${DNSDEPLIBS}
-	${LIBTOOL_MODE_LINK} ${PURIFY} ${CC} ${CFLAGS} ${LDFLAGS} \
-		-o $@ dst_test.@O@ ${DNSLIBS} ${ISCLIBS} ${LIBS}
-
 gsstest@EXEEXT@: gsstest.@O@ ${ISCDEPLIBS} ${DNSDEPLIBS}
 	${LIBTOOL_MODE_LINK} ${PURIFY} ${CC} ${CFLAGS} ${LDFLAGS} \
 		-o $@ gsstest.@O@ ${DNSLIBS} ${ISCLIBS} ${LIBS}
@@ -290,8 +290,8 @@ main(int argc, char **argv) {

 	isc_stdtime_get(&now);

-	result = isc_mutex_init(&client_lock);
-	check_result(result, "isc_mutex_init(&client_lock)");
+	isc_mutex_init(&client_lock);
+
 	ISC_LIST_INIT(clients);

 	/*
@@ -359,7 +359,6 @@ main(int argc, char *argv[]) {
 	dbinfo *dbi;
 	dns_dbversion_t *version;
 	const dns_name_t *origin;
-	size_t memory_quota = 0;
 	dns_trust_t trust = 0;
 	unsigned int addopts;
 	isc_log_t *lctx = NULL;
@@ -411,10 +410,6 @@ main(int argc, char *argv[]) {
 		case 'P':
 			pause_every = atoi(isc_commandline_argument);
 			break;
-		case 'Q':
-			memory_quota = atoi(isc_commandline_argument);
-			isc_mem_setquota(mctx, memory_quota);
-			break;
 		case 't':
 			type = atoi(isc_commandline_argument);
 			break;
@@ -1,280 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-#include <config.h>
-
-#include <stdbool.h>
-#include <stdlib.h>
-#include <unistd.h>
-
-#include <isc/buffer.h>
-#include <isc/mem.h>
-#include <isc/print.h>
-#include <isc/region.h>
-#include <isc/string.h>		/* Required for HP/UX (and others?) */
-
-#include <dns/fixedname.h>
-#include <dns/log.h>
-#include <dns/name.h>
-#include <dns/result.h>
-
-#include <dst/dst.h>
-#include <dst/result.h>
-
-char *current;
-const char *tmp = "/tmp";
-
-static void
-use(dst_key_t *key, isc_mem_t *mctx) {
-	isc_result_t ret;
-	const char *data = "This is some data";
-	unsigned char sig[512];
-	isc_buffer_t databuf, sigbuf;
-	isc_region_t datareg, sigreg;
-	dst_context_t *ctx = NULL;
-
-	isc_buffer_init(&sigbuf, sig, sizeof(sig));
-	/*
-	 * Advance 1 byte for fun.
-	 */
-	isc_buffer_add(&sigbuf, 1);
-
-	isc_buffer_constinit(&databuf, data, strlen(data));
-	isc_buffer_add(&databuf, strlen(data));
-	isc_buffer_usedregion(&databuf, &datareg);
-
-	ret = dst_context_create(key, mctx,
-				 DNS_LOGCATEGORY_GENERAL, true, 0, &ctx);
-	if (ret != ISC_R_SUCCESS) {
-		printf("contextcreate(%u) returned: %s\n", dst_key_alg(key),
-		       isc_result_totext(ret));
-		return;
-	}
-	ret = dst_context_adddata(ctx, &datareg);
-	if (ret != ISC_R_SUCCESS) {
-		printf("adddata(%u) returned: %s\n", dst_key_alg(key),
-		       isc_result_totext(ret));
-		dst_context_destroy(&ctx);
-		return;
-	}
-	ret = dst_context_sign(ctx, &sigbuf);
-	printf("sign(%u) returned: %s\n", dst_key_alg(key),
-	       isc_result_totext(ret));
-	dst_context_destroy(&ctx);
-
-	isc_buffer_forward(&sigbuf, 1);
-	isc_buffer_remainingregion(&sigbuf, &sigreg);
-	ret = dst_context_create(key, mctx,
-				 DNS_LOGCATEGORY_GENERAL, false, 0, &ctx);
-	if (ret != ISC_R_SUCCESS) {
-		printf("contextcreate(%u) returned: %s\n", dst_key_alg(key),
-		       isc_result_totext(ret));
-		return;
-	}
-	ret = dst_context_adddata(ctx, &datareg);
-	if (ret != ISC_R_SUCCESS) {
-		printf("adddata(%u) returned: %s\n", dst_key_alg(key),
-		       isc_result_totext(ret));
-		dst_context_destroy(&ctx);
-		return;
-	}
-	ret = dst_context_verify(ctx, &sigreg);
-	printf("verify(%u) returned: %s\n", dst_key_alg(key),
-	       isc_result_totext(ret));
-	dst_context_destroy(&ctx);
-}
-
-static void
-dns(dst_key_t *key, isc_mem_t *mctx) {
-	unsigned char buffer1[2048];
-	unsigned char buffer2[2048];
-	isc_buffer_t buf1, buf2;
-	isc_region_t r1, r2;
-	dst_key_t *newkey = NULL;
-	isc_result_t ret;
-	bool match;
-
-	isc_buffer_init(&buf1, buffer1, sizeof(buffer1));
-	ret = dst_key_todns(key, &buf1);
-	printf("todns(%u) returned: %s\n", dst_key_alg(key),
-	       isc_result_totext(ret));
-	if (ret != ISC_R_SUCCESS)
-		return;
-	ret = dst_key_fromdns(dst_key_name(key), dns_rdataclass_in,
-			      &buf1, mctx, &newkey);
-	printf("fromdns(%u) returned: %s\n", dst_key_alg(key),
-	       isc_result_totext(ret));
-	if (ret != ISC_R_SUCCESS)
-		return;
-	isc_buffer_init(&buf2, buffer2, sizeof(buffer2));
-	ret = dst_key_todns(newkey, &buf2);
-	printf("todns2(%u) returned: %s\n", dst_key_alg(key),
-	       isc_result_totext(ret));
-	if (ret != ISC_R_SUCCESS)
-		return;
-	isc_buffer_usedregion(&buf1, &r1);
-	isc_buffer_usedregion(&buf2, &r2);
-	match = (r1.length == r2.length &&
-		 memcmp(r1.base, r2.base, r1.length) == 0);
-	printf("compare(%u): %s\n", dst_key_alg(key),
-	       match ? "true" : "false");
-	dst_key_free(&newkey);
-}
-
-static void
-io(dns_name_t *name, int id, int alg, int type, isc_mem_t *mctx) {
-	dst_key_t *key = NULL;
-	isc_result_t ret;
-
-	ret = dst_key_fromfile(name, id, alg, type, current, mctx, &key);
-	printf("read(%d) returned: %s\n", alg, isc_result_totext(ret));
-	if (ret != 0)
-		return;
-	ret = dst_key_tofile(key, type, tmp);
-	printf("write(%d) returned: %s\n", alg, isc_result_totext(ret));
-	if (ret != 0)
-		return;
-	use(key, mctx);
-	dns(key, mctx);
-	dst_key_free(&key);
-}
-
-static void
-dh(dns_name_t *name1, int id1, dns_name_t *name2, int id2, isc_mem_t *mctx) {
-	dst_key_t *key1 = NULL, *key2 = NULL;
-	isc_result_t ret;
-	isc_buffer_t b1, b2;
-	isc_region_t r1, r2;
-	unsigned char array1[1024], array2[1024];
-	int alg = DST_ALG_DH;
-	int type = DST_TYPE_PUBLIC|DST_TYPE_PRIVATE|DST_TYPE_KEY;
-
-	ret = dst_key_fromfile(name1, id1, alg, type, current, mctx, &key1);
-	printf("read(%d) returned: %s\n", alg, isc_result_totext(ret));
-	if (ret != 0)
-		return;
-	ret = dst_key_fromfile(name2, id2, alg, type, current, mctx, &key2);
-	printf("read(%d) returned: %s\n", alg, isc_result_totext(ret));
-	if (ret != 0)
-		return;
-
-	ret = dst_key_tofile(key1, type, tmp);
-	printf("write(%d) returned: %s\n", alg, isc_result_totext(ret));
-	if (ret != 0)
-		return;
-	ret = dst_key_tofile(key2, type, tmp);
-	printf("write(%d) returned: %s\n", alg, isc_result_totext(ret));
-	if (ret != 0)
-		return;
-
-	isc_buffer_init(&b1, array1, sizeof(array1));
-	ret = dst_key_computesecret(key1, key2, &b1);
-	printf("computesecret() returned: %s\n", isc_result_totext(ret));
-	if (ret != 0)
-		return;
-
-	isc_buffer_init(&b2, array2, sizeof(array2));
-	ret = dst_key_computesecret(key2, key1, &b2);
-	printf("computesecret() returned: %s\n", isc_result_totext(ret));
-	if (ret != 0)
-		return;
-
-	isc_buffer_usedregion(&b1, &r1);
-	isc_buffer_usedregion(&b2, &r2);
-
-	if (r1.length != r2.length || memcmp(r1.base, r2.base, r1.length) != 0)
-	{
-		int i;
-		printf("secrets don't match\n");
-		printf("secret 1: %u bytes\n", r1.length);
-		for (i = 0; i < (int) r1.length; i++)
-			printf("%02x ", r1.base[i]);
-		printf("\n");
-		printf("secret 2: %u bytes\n", r2.length);
-		for (i = 0; i < (int) r2.length; i++)
-			printf("%02x ", r2.base[i]);
-		printf("\n");
-	}
-	dst_key_free(&key1);
-	dst_key_free(&key2);
-}
-
-static void
-generate(int alg, isc_mem_t *mctx) {
-	isc_result_t ret;
-	dst_key_t *key = NULL;
-
-	ret = dst_key_generate(dns_rootname, alg, 512, 0, 0, 0,
-			       dns_rdataclass_in, mctx, &key, NULL);
-	printf("generate(%d) returned: %s\n", alg, isc_result_totext(ret));
-	if (ret != ISC_R_SUCCESS)
-		return;
-
-	if (alg != DST_ALG_DH)
-		use(key, mctx);
-
-	dst_key_free(&key);
-}
-
-int
-main(void) {
-	isc_mem_t *mctx = NULL;
-	isc_buffer_t b;
-	dns_fixedname_t fname;
-	dns_name_t *name;
-	isc_result_t result;
-
-	result = isc_mem_create(0, 0, &mctx);
-	if (result != ISC_R_SUCCESS)
-		return (1);
-
-	current = isc_mem_get(mctx, 256);
-	if (current == NULL)
-		return (1);
-	if (getcwd(current, 256) == NULL) {
-		perror("getcwd");
-		return (1);
-	}
-
-	dns_result_register();
-
-	dst_lib_init(mctx, NULL);
-
-	name = dns_fixedname_initname(&fname);
-	isc_buffer_constinit(&b, "test.", 5);
-	isc_buffer_add(&b, 5);
-	result = dns_name_fromtext(name, &b, NULL, 0, NULL);
-	if (result != ISC_R_SUCCESS)
-		return (1);
-	io(name, 54622, DST_ALG_RSAMD5, DST_TYPE_PRIVATE|DST_TYPE_PUBLIC,
-	   mctx);
-
-	io(name, 2, DST_ALG_RSAMD5, DST_TYPE_PRIVATE|DST_TYPE_PUBLIC, mctx);
-
-	isc_buffer_constinit(&b, "dh.", 3);
-	isc_buffer_add(&b, 3);
-	result = dns_name_fromtext(name, &b, NULL, 0, NULL);
-	if (result != ISC_R_SUCCESS)
-		return (1);
-	dh(name, 18602, name, 48957, mctx);
-
-	generate(DST_ALG_RSAMD5, mctx);
-	generate(DST_ALG_DH, mctx);
-	generate(DST_ALG_HMACMD5, mctx);
-
-	dst_lib_destroy();
-
-	isc_mem_put(mctx, current, 256);
-/*	isc_mem_stats(mctx, stdout);*/
-	isc_mem_destroy(&mctx);
-
-	return (0);
-}
@@ -30,7 +30,7 @@ main(int argc, char *argv[]) {

 	isc_mem_debugging = ISC_MEM_DEBUGRECORD;

-	RUNTIME_CHECK(isc_mutex_init(&lock) == ISC_R_SUCCESS);
+	isc_mutex_init(&lock);

 	mctx = NULL;
 	RUNTIME_CHECK(isc_mem_create(0, 0, &mctx) == ISC_R_SUCCESS);
@@ -114,7 +114,7 @@ main(int argc, char *argv[]) {

 	isc_mem_destroy(&mctx);

-	DESTROYLOCK(&lock);
+	isc_mutex_destroy(&lock);

 	return (0);
 }
@@ -206,7 +206,7 @@ main(int argc, char *argv[]) {

 	RUNTIME_CHECK(isc_app_start() == ISC_R_SUCCESS);

-	RUNTIME_CHECK(isc_mutex_init(&lock) == ISC_R_SUCCESS);
+	isc_mutex_init(&lock);

 	mctx = NULL;
 	RUNTIME_CHECK(isc_mem_create(0, 0, &mctx) == ISC_R_SUCCESS);
@@ -282,7 +282,7 @@ main(int argc, char *argv[]) {
 		isc_mem_stats(mctx, stdout);
 	isc_mem_destroy(&mctx);

-	DESTROYLOCK(&lock);
+	isc_mutex_destroy(&lock);

 	isc_app_finish();

@@ -33,7 +33,7 @@ $DIG $DIGOPTS tsigzone. \
 grep "^;" dig.out.${t} > /dev/null 2>&1 && { echo_i "test $t failed" ; status=1; }

 copy_setports ns2/named2.conf.in ns2/named.conf
-$RNDCCMD 10.53.0.2 reload 2>&1 | sed 's/^/ns2 /' | cat_i
+rndc_reload ns2 10.53.0.2
 sleep 5

 # prefix 10/8 should fail
@@ -56,7 +56,7 @@ grep "^;" dig.out.${t} > /dev/null 2>&1 && { echo_i "test $t failed" ; status=1;
 echo_i "testing nested ACL processing"
 # all combinations of 10.53.0.{1|2} with key {one|two}, should succeed
 copy_setports ns2/named3.conf.in ns2/named.conf
-$RNDCCMD 10.53.0.2 reload 2>&1 | sed 's/^/ns2 /' | cat_i
+rndc_reload ns2 10.53.0.2
 sleep 5

 # should succeed
@@ -102,7 +102,7 @@ grep "^;" dig.out.${t} > /dev/null 2>&1 || { echo_i "test $t failed" ; status=1;

 # now we only allow 10.53.0.1 *and* key one, or 10.53.0.2 *and* key two
 copy_setports ns2/named4.conf.in ns2/named.conf
-$RNDCCMD 10.53.0.2 reload 2>&1 | sed 's/^/ns2 /' | cat_i
+rndc_reload ns2 10.53.0.2
 sleep 5

 # should succeed
@@ -137,7 +137,7 @@ grep "^;" dig.out.${t} > /dev/null 2>&1 || { echo_i "test $t failed" ; status=1;

 echo_i "testing allow-query-on ACL processing"
 copy_setports ns2/named5.conf.in ns2/named.conf
-$RNDCCMD 10.53.0.2 reload 2>&1 | sed 's/^/ns2 /' | cat_i
+rndc_reload ns2 10.53.0.2
 sleep 5
 t=`expr $t + 1`
 $DIG -p ${PORT} +tcp soa example. \
@@ -161,7 +161,7 @@ grep "Transfer failed." dig.out.${t} >/dev/null 2>&1 || ret=1
 status=`expr $status + $ret`

 echo_i "calling rndc reconfig"
-$RNDCCMD 10.53.0.3 reconfig 2>&1 | sed 's/^/ns3 /' | cat_i
+rndc_reconfig ns3 10.53.0.3

 sleep 1

@@ -190,7 +190,7 @@ grep "Transfer failed." dig.out.${t} >/dev/null 2>&1 || ret=1
 status=`expr $status + $ret`

 echo_i "calling rndc reconfig"
-$RNDCCMD 10.53.0.4 reconfig 2>&1 | sed 's/^/ns4 /' | cat_i
+rndc_reconfig ns4 10.53.0.4

 sleep 1

@@ -218,8 +218,7 @@ dotests

 echo_i "reconfiguring server: minimal-responses no"
 copy_setports ns1/named2.conf.in ns1/named.conf
-$RNDCCMD 10.53.0.1 reconfig 2>&1 | sed 's/^/ns1 /' | cat_i
-sleep 2
+rndc_reconfig ns1 10.53.0.1

 echo_i "testing with 'minimal-responses no;'"
 minimal=no
@@ -236,8 +235,7 @@ fi

 echo_i "reconfiguring server: minimal-any yes"
 copy_setports ns1/named3.conf.in ns1/named.conf
-$RNDCCMD 10.53.0.1 reconfig 2>&1 | sed 's/^/ns1 /' | cat_i
-sleep 2
+rndc_reconfig ns1 10.53.0.1

 n=`expr $n + 1`
 echo_i "testing with 'minimal-any yes;' over UDP ($n)"
@@ -272,8 +270,7 @@ dotests

 echo_i "reconfiguring server: minimal-responses no-auth-recursive"
 copy_setports ns1/named4.conf.in ns1/named.conf
-$RNDCCMD 10.53.0.1 reconfig 2>&1 | sed 's/^/ns1 /' | cat_i
-sleep 2
+rndc_reconfig ns1 10.53.0.1

 echo_i "testing with 'minimal-responses no-auth-recursive;'"
 minimal=no-auth-recursive
@@ -303,8 +300,7 @@ fi

 echo_i "reconfiguring server: minimal-responses no"
 copy_setports ns1/named2.conf.in ns1/named.conf
-$RNDCCMD 10.53.0.1 reconfig 2>&1 | sed 's/^/ns1 /' | cat_i
-sleep 2
+rndc_reconfig ns1 10.53.0.1

 n=`expr $n + 1`
 echo_i "testing NS handling in ANY responses (authoritative) ($n)"
@@ -467,10 +467,9 @@ if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`

 echo_i "reconfiguring server with multiple views"
-rm -f ns2/named.conf 
+rm -f ns2/named.conf
 copy_setports ns2/named2.conf.in ns2/named.conf
-$RNDCCMD 10.53.0.2 reconfig 2>&1 | sed 's/^/I:ns2 /'
-sleep 5
+rndc_reconfig ns2 10.53.0.2

 echo_i "adding new zone to external view ($n)"
 # NOTE: The internal view has "recursion yes" set, and so queries for
@@ -591,8 +590,7 @@ status=`expr $status + $ret`
 echo_i "reconfiguring server with multiple views and new-zones-directory"
 rm -f ns2/named.conf
 copy_setports ns2/named3.conf.in ns2/named.conf
-$RNDCCMD 10.53.0.2 reconfig 2>&1 | sed 's/^/I:ns2 /'
-sleep 5
+rndc_reconfig ns2 10.53.0.2

 echo_i "checking new zone is still loaded after dir change ($n)"
 ret=0
@@ -659,8 +657,7 @@ status=`expr $status + $ret`

 echo_i "ensure the configuration context is cleaned up correctly ($n)"
 ret=0
-$RNDCCMD 10.53.0.2 reconfig > /dev/null 2>&1 || ret=1
-sleep 5
+rndc_reconfig ns2 10.53.0.2
 $RNDCCMD 10.53.0.2 status > /dev/null 2>&1 || ret=1
 n=`expr $n + 1`
 if [ $ret != 0 ]; then echo_i "failed"; fi
@@ -670,8 +667,7 @@ echo_i "check delzone after reconfig failure ($n)"
 ret=0
 $RNDCCMD 10.53.0.3 addzone 'inlineslave.example. IN { type slave; file "inlineslave.db"; masterfile-format text; masters { testmaster; }; };' > /dev/null 2>&1 || ret=1
 copy_setports ns3/named2.conf.in ns3/named.conf
-$RNDCCMD 10.53.0.3 reconfig > /dev/null 2>&1 && ret=1
-sleep 5
+rndc_reconfgi ns3 10.53.0.3
 $RNDCCMD 10.53.0.3 delzone inlineslave.example > /dev/null 2>&1 || ret=1
 n=`expr $n + 1`
 if [ $ret != 0 ]; then echo_i "failed"; fi
@@ -695,8 +691,8 @@ echo_i "check that named restarts with multiple added zones ($n)"
 ret=0
 $RNDCCMD 10.53.0.3 addzone "test4.baz" '{ type master; file "e.db"; };' > /dev/null 2>&1 || ret=1
 $RNDCCMD 10.53.0.3 addzone "test5.baz" '{ type master; file "e.db"; };' > /dev/null 2>&1 || ret=1
-$PERL $SYSTEMTESTTOP/stop.pl . ns3
-$PERL $SYSTEMTESTTOP/start.pl --noclean --restart --port ${PORT} . ns3 || ret=1
+$PERL $SYSTEMTESTTOP/stop.pl addzone ns3
+$PERL $SYSTEMTESTTOP/start.pl --noclean --restart --port ${PORT} addzone ns3 || ret=1
 $DIG $DIGOPTS @10.53.0.3 version.bind txt ch > dig.out.test$n || ret=1
 grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
 n=`expr $n + 1`
@@ -55,14 +55,6 @@ SYSTEMTESTTOP=..

 DIGOPTS="+tcp +nosea +nostat +nocmd +norec +noques +noauth +noadd +nostats +dnssec -p ${PORT}"

-rndc_reload() {
-    echo_i "`$RNDC -c ../common/rndc.conf -s $2 -p ${CONTROLPORT} reload 2>&1 | sed 's/^/'$1' /'`"
-    for try in 0 1 2 3 4 5 6 7 8 9; do
-        nextpart $1/named.run | grep "reloading configuration succeeded" > /dev/null && break
-        sleep 1
-    done
-}
-
 status=0
 n=0

@@ -12,18 +12,19 @@
 rm -f */K* */dsset-* */*.signed */tmp* */*.jnl */*.bk
 rm -f */core
 rm -f */example.bk
+rm -f */named.conf
 rm -f */named.memstats
 rm -f */named.run
-rm -f */named.conf
 rm -f */trusted.conf */private.conf
 rm -f activate-now-publish-1day.key
-rm -f active.key inact.key del.key unpub.key standby.key rev.key
+rm -f active.key inact.key del.key delzsk.key unpub.key standby.key rev.key
 rm -f delayksk.key delayzsk.key autoksk.key autozsk.key
 rm -f dig.out.*
 rm -f digcomp.out.test*
 rm -f digcomp.out.test*
 rm -f missingzsk.key inactivezsk.key
 rm -f nopriv.key vanishing.key del1.key del2.key
+rm -f ns*/managed-keys.bind*
 rm -f ns*/named.lock
 rm -f ns*/named.lock
 rm -f ns1/root.db
@@ -32,6 +33,8 @@ rm -f ns2/private.secure.example.db ns2/bar.db
 rm -f ns3/*.nzd ns3/*.nzd-lock ns3/*.nzf
 rm -f ns3/*.nzf
 rm -f ns3/autonsec3.example.db
+rm -f ns3/delzsk.example.db
+rm -f ns3/dname-at-apex-nsec3.example.db
 rm -f ns3/inacksk2.example.db
 rm -f ns3/inacksk3.example.db
 rm -f ns3/inaczsk2.example.db
@@ -63,4 +66,3 @@ rm -f nsupdate.out
 rm -f settime.out.*
 rm -f signing.out.*
 rm -f sync.key
-rm -f ns*/managed-keys.bind*
@@ -82,3 +82,5 @@ ns.nsec3-to-nsec	A	10.53.0.3

 oldsigs			NS	ns.oldsigs
 ns.oldsigs		A	10.53.0.3
+
+dname-at-apex-nsec3	NS	ns3
@@ -15,7 +15,8 @@ SYSTEMTESTTOP=../..
 # Have the child generate subdomain keys and pass DS sets to us.
 ( cd ../ns3 && $SHELL keygen.sh )

-for subdomain in secure nsec3 autonsec3 optout rsasha256 rsasha512 nsec3-to-nsec oldsigs sync
+for subdomain in secure nsec3 autonsec3 optout rsasha256 rsasha512 nsec3-to-nsec oldsigs sync \
+    dname-at-apex-nsec3
 do
 	cp ../ns3/dsset-$subdomain.example$TP .
 done
@@ -0,0 +1,23 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0. If a copy of the MPL was not distributed with this
+; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 300	; 5 minutes
+@			IN SOA	mname1. . (
+				2000010101 ; serial
+				20         ; refresh (20 seconds)
+				20         ; retry (20 seconds)
+				1814400    ; expire (3 weeks)
+				3600       ; minimum (1 hour)
+				)
+			NS	ns
+ns			A	10.53.0.3
+
+sub			NS	ns.sub
+			DS	12345 8 1 0000000000000000000000000000000000000000
+ns.sub			A	10.53.0.3
@@ -0,0 +1,5 @@
+$TTL	600
+@	SOA	ns3.example. . 1 1200 1200 1814400 3600
+@	NS	ns3.example.
+@	DNAME	example.
+@	NSEC3PARAM 1 0 0 -
@@ -314,3 +314,23 @@ ksk=`$KEYGEN -a NSEC3RSASHA1 -3 -q -fk $zone 2> kg.out` || dumpit kg.out
 $KEYGEN -a NSEC3RSASHA1 -3 -q $zone > kg.out 2>&1 || dumpit kg.out
 $KEYGEN -a NSEC3RSASHA1 -3 -q -P now -A now+3600 $zone > kg.out 2>&1 || dumpit kg.out
 $DSFROMKEY $ksk.key > dsset-${zone}$TP
+
+#
+# A zone that starts with an active KSK + ZSK and an inactive ZSK, with the
+# latter getting deleted during the test.
+#
+setup delzsk.example
+cp $infile $zonefile
+ksk=`$KEYGEN -a NSEC3RSASHA1 -3 -q -fk $zone 2> kg.out` || dumpit kg.out
+$KEYGEN -a NSEC3RSASHA1 -3 -q $zone > kg.out 2>&1 || dumpit kg.out
+zsk=`$KEYGEN -a NSEC3RSASHA1 -3 -q -I now-1w $zone 2>kg.out` || dumpit kg.out
+echo $zsk > ../delzsk.key
+
+#
+#  Check that NSEC3 are correctly signed and returned from below a DNAME
+#
+setup dname-at-apex-nsec3.example
+cp $infile $zonefile
+ksk=`$KEYGEN -q -a RSASHA1 -3 -fk $zone 2> kg.out` || dumpit kg.out
+$KEYGEN -q -a RSASHA1 -3 $zone > kg.out 2>&1 || dumpit kg.out
+$DSFROMKEY $ksk.key > dsset-${zone}$TP
@@ -282,4 +282,18 @@ zone "inaczsk3.example" {
 	auto-dnssec maintain;
 };

+zone "delzsk.example." {
+	type master;
+	file "delzsk.example.db";
+	allow-update { any; };
+	auto-dnssec maintain;
+};
+
+zone "dname-at-apex-nsec3.example" {
+	type master;
+	file "dname-at-apex-nsec3.example.db";
+	allow-update { any; };
+	auto-dnssec maintain;
+};
+
 include "trusted.conf";
@@ -31,3 +31,5 @@ ns.private		A	10.53.0.2
 insecure		NS	ns.insecure
 ns.insecure		A	10.53.0.2

+dname-and-txt		DNAME	@
+			TXT	"DNAME and TXT"
@@ -1227,7 +1227,7 @@ rekey_calls=`grep "zone reconf.example.*next key event" ns3/named.run | wc -l`
 [ "$rekey_calls" -eq 0 ] || ret=1
 # ...then we add auto-dnssec and reconfigure
 $RNDCCMD 10.53.0.3 modzone reconf.example '{ type master; file "reconf.example.db"; allow-update { any; }; auto-dnssec maintain; };' 2>&1 | sed 's/^/ns3 /' | cat_i
-$RNDCCMD 10.53.0.3 reconfig 2>&1 | sed 's/^/ns3 /' | cat_i
+rndc_reconfig ns3 10.53.0.3
 for i in 0 1 2 3 4 5 6 7 8 9; do
    lret=0
    rekey_calls=`grep "zone reconf.example.*next key event" ns3/named.run | wc -l`
@@ -1395,5 +1395,77 @@ n=`expr $n + 1`
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`

+echo_i "checking for out-of-zone NSEC3 records after ZSK removal ($n)"
+ret=0
+# Switch the zone over to NSEC3 and wait until the transition is complete.
+$RNDCCMD 10.53.0.3 signing -nsec3param 1 1 10 12345678 delzsk.example. > signing.out.1.test$n 2>&1 || ret=1
+for i in 0 1 2 3 4 5 6 7 8 9; do
+	_ret=1
+	$DIG $DIGOPTS delzsk.example NSEC3PARAM @10.53.0.3 > dig.out.ns3.1.test$n 2>&1 || ret=1
+	grep "NSEC3PARAM.*12345678" dig.out.ns3.1.test$n > /dev/null 2>&1
+	if [ $? -eq 0 ]; then
+		_ret=0
+		break
+	fi
+	sleep 1
+done
+if [ $_ret -ne 0 ]; then
+	echo_i "timed out waiting for NSEC3 chain creation"
+	ret=1
+fi
+# Mark the inactive ZSK as pending removal.
+file="ns3/`cat delzsk.key`.key"
+$SETTIME -D now-1h $file > settime.out.test$n 2>&1 || ret=1
+# Trigger removal of the inactive ZSK and wait until its completion.
+$RNDCCMD 10.53.0.3 loadkeys delzsk.example 2>&1 | sed 's/^/ns3 /' | cat_i
+for i in 0 1 2 3 4 5 6 7 8 9; do
+	_ret=1
+	$RNDCCMD 10.53.0.3 signing -list delzsk.example > signing.out.2.test$n 2>&1
+	grep "Signing " signing.out.2.test$n > /dev/null 2>&1
+	if [ $? -ne 0 ]; then
+		if [ `cat signing.out.2.test$n | wc -l` -eq 2 ]; then
+			_ret=0
+			break
+		fi
+	fi
+	sleep 1
+done
+if [ $_ret -ne 0 ]; then
+	echo_i "timed out waiting for key removal"
+	ret=1
+fi
+# Check whether key removal caused NSEC3 records to be erroneously created for
+# glue records due to a secure delegation already being signed by the active key
+# (i.e. a key other than the one being removed but using the same algorithm).
+#
+# For reference:
+#
+#     $ nsec3hash 12345678 1 10 ns.sub.delzsk.example.
+#     589R358VSPJUFVAJU949JPVF74D9PTGH (salt=12345678, hash=1, iterations=10)
+#
+$DIG $DIGOPTS delzsk.example AXFR @10.53.0.3 > dig.out.ns3.3.test$n || ret=1
+grep "589R358VSPJUFVAJU949JPVF74D9PTGH" dig.out.ns3.3.test$n > /dev/null 2>&1 && ret=1
+n=`expr $n + 1`
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=`expr $status + $ret`
+
+echo_i "check that DNAME at apex with NSEC3 is correctly signed (auto-dnssec maintain) ($n)"
+ret=0
+$DIG $DIGOPTS txt dname-at-apex-nsec3.example @10.53.0.3 > dig.out.ns3.test$n || ret=1
+grep "RRSIG NSEC3 7 3 3600" dig.out.ns3.test$n > /dev/null || ret=1
+n=`expr $n + 1`
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=`expr $status + $ret`
+
+echo_i "checking that DNAME is not treated as a delegation when signing ($n)"
+ret=0
+$DIG $DIGOPTS dname-and-txt.secure.example. DNAME @10.53.0.3 > dig.out.ns3.1.test$n || ret=1
+grep "dname-and-txt.secure.example.*RRSIG.*DNAME" dig.out.ns3.1.test$n > /dev/null 2>&1 || ret=1
+$DIG $DIGOPTS dname-and-txt.secure.example. TXT @10.53.0.3 > dig.out.ns3.2.test$n || ret=1
+grep "dname-and-txt.secure.example.*RRSIG.*TXT" dig.out.ns3.2.test$n > /dev/null 2>&1 || ret=1
+n=`expr $n + 1`
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=`expr $status + $ret`
+
 echo_i "exit status: $status"
 [ $status -eq 0 ] || exit 1
@@ -148,7 +148,7 @@ if [ $ret != 0 ] ; then echo_i "failed"; status=`expr $status + $ret`; fi

 n=`expr $n + 1`
 echo_i "Checking that reloading empty zones is silent ($n)"
-$RNDCCMD 10.53.0.1 reload > /dev/null
+rndc_reload ns1 10.53.0.1
 ret=0
 grep "automatic empty zone" ns1/named.run > /dev/null || ret=1
 grep "received control channel command 'reload'" ns1/named.run > /dev/null || ret=1
@@ -9,10 +9,6 @@
 * information regarding copyright ownership.
 */

-options {
-};
-
-view myview {
-	filter-aaaa { 1.0.0.0/8; };
-	filter-aaaa-on-v4 yes;
+view {
+	allow-update-forwarding { any; };
 };
@@ -10,9 +10,5 @@
 */

 options {
-	filter-aaaa-on-v4 yes;
-};
-
-view myview {
-	filter-aaaa { none; };
+	allow-update-forwarding { any; };
 };
@@ -9,11 +9,6 @@
 * information regarding copyright ownership.
 */

-options {
-	filter-aaaa-on-v4 no;
-};
-
-view myview {
-	filter-aaaa { 1.0.0.0/8; };
-	filter-aaaa-on-v4 yes;
+view {
+	allow-update { any; };
 };
@@ -10,9 +10,5 @@
 */

 options {
-	filter-aaaa { 1.0.0.0/8; };
-};
-
-view myview {
-	filter-aaaa-on-v4 yes;
+	allow-update { any; };
 };
@@ -0,0 +1,4 @@
+zone "\0example" {
+        type mirror;
+        file "example.db";
+};
@@ -0,0 +1,23 @@
+controls { /* empty */ };
+options {
+	query-source address 10.53.0.2;
+	notify-source 10.53.0.2;
+	transfer-source 10.53.0.2;
+	port 5300;
+	pid-file "named.pid";
+	listen-on { 10.53.0.2; };
+	listen-on-v6 { none; };
+	heartbeat-interval 2;
+	recursion no;
+};
+zone "." {
+	type hint;
+	file "hint";
+};
+zone "example." {
+	type stub;
+	dialup notify;
+	notify no;
+	file "example.bk";
+	// masters { 10.53.0.1; };
+};
@@ -133,6 +133,9 @@ view "third" {
 	zone "dnssec" {
 		type master;
 		file "file";
+		allow-update {
+			"any";
+		};
 		auto-dnssec maintain;
 	};
 	zone "p" {
@@ -145,9 +148,6 @@ view "third" {
 			1.2.3.4;
 		};
 	};
-	allow-update {
-		"any";
-	};
 };
 view "chaos" chaos {
 	zone "hostname.bind" chaos {
@@ -36,15 +36,16 @@ done
 for db in zones/bad*.db
 do
 	echo_i "checking $db ($n)"
-	ret=0
+	ret=0 v=0
 	case $db in
 	zones/bad-dns-sd-reverse.db)
-		$CHECKZONE -k fail -i local 0.0.0.0.in-addr.arpa $db > test.out.$n 2>&1 && ret=1
+		$CHECKZONE -k fail -i local 0.0.0.0.in-addr.arpa $db > test.out.$n 2>&1 || v=$?
 		;;
 	*)
-                $CHECKZONE -i local example $db > test.out.$n 2>&1 && ret=1
+                $CHECKZONE -i local example $db > test.out.$n 2>&1 || v=$?
 		;;
 	esac
+	test $v = 1 || ret=1
 	n=`expr $n + 1`
 	if [ $ret != 0 ]; then echo_i "failed"; fi
 	status=`expr $status + $ret`
@@ -0,0 +1,2 @@
+@	3600	DHCID
+@	3600	DHCID
@@ -0,0 +1,2 @@
+@	EID
+@	EID
@@ -0,0 +1,2 @@
+@	3600 NIMLOC
+@	3600 NIMLOC
@@ -14,7 +14,7 @@ dyn.example.net.	7200	IN SOA	ns1.example.net. hostmaster.example.net. (
 					1209600    ; expire (2 weeks)
 					7200       ; minimum (2 hours)
 					)
-			7200	RRSIG	SOA 7 3 7200 2010	20100225214229 30323 dyn.example.net.
+			7200	RRSIG	SOA 7 3 7200 2010	20100225214229 30323 dyn.example.net. MuyI
 			7200	NS	ns1.example.net.
 			7200	NS	ns2.example.net.
 			3600	RRSIG	DNSKEY 7 3 3600 20100227180048 (
@@ -0,0 +1,305 @@
+#!/bin/sh
+#
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+if test -n "$PERL"
+then
+	if $PERL -e "use IO::Socket::INET6;" 2> /dev/null
+	then
+		TESTSOCK6="$PERL $TOP/bin/tests/system/testsock6.pl"
+	else
+		TESTSOCK6=false
+	fi
+else
+	TESTSOCK6=false
+fi
+
+TESTSOCK6="$TESTSOCK6"
+
+. ${TOP}/version
+
+#
+# Set up color-coded test output
+#
+if [ ${SYSTEMTEST_FORCE_COLOR:-0} -eq 1 ] || test -t 1 && type tput > /dev/null 2>&1 && tput setaf 7 > /dev/null 2>&1 ; then
+    COLOR_END=`tput setaf 4`    # blue
+    COLOR_FAIL=`tput setaf 1`   # red
+    COLOR_INFO=`tput bold`      # bold
+    COLOR_NONE=`tput sgr0`
+    COLOR_PASS=`tput setaf 2`   # green
+    COLOR_START=`tput setaf 4`  # blue
+    COLOR_WARN=`tput setaf 3`   # yellow
+else
+    # set to empty strings so printf succeeds
+    COLOR_END=''
+    COLOR_FAIL=''
+    COLOR_INFO=''
+    COLOR_NONE=''
+    COLOR_PASS=''
+    COLOR_START=''
+    COLOR_WARN=''
+fi
+
+if type printf > /dev/null 2>&1
+then
+	echofail () {
+		printf "${COLOR_FAIL}%s${COLOR_NONE}\n" "$*"
+	}
+	echowarn () {
+		printf "${COLOR_WARN}%s${COLOR_NONE}\n" "$*"
+	}
+	echopass () {
+		printf "${COLOR_PASS}%s${COLOR_NONE}\n" "$*"
+	}
+	echoinfo () {
+		printf "${COLOR_INFO}%s${COLOR_NONE}\n" "$*"
+	}
+	echostart () {
+		printf "${COLOR_START}%s${COLOR_NONE}\n" "$*"
+	}
+	echoend () {
+		printf "${COLOR_END}%s${COLOR_NONE}\n" "$*"
+	}
+else
+	echofail () {
+		echo "$*"
+	}
+	echowarn () {
+		echo "$*"
+	}
+	echopass () {
+		echo "$*"
+	}
+	echoinfo () {
+		echo "$*"
+	}
+	echostart () {
+		echo "$*"
+	}
+	echoend () {
+		echo "$*"
+	}
+fi
+
+SYSTESTDIR="`basename $PWD`"
+
+echo_i() {
+    echo "$@" | while read __LINE ; do
+       echoinfo "I:$SYSTESTDIR:$__LINE"
+    done
+}
+
+echo_ic() {
+    echo "$@" | while read __LINE ; do
+       echoinfo "I:$SYSTESTDIR:  $__LINE"
+    done
+}
+
+cat_i() {
+    while read __LINE ; do
+       echoinfo "I:$SYSTESTDIR:$__LINE"
+    done
+}
+
+echo_d() {
+    echo "$@" | while read __LINE ; do
+       echoinfo "D:$SYSTESTDIR:$__LINE"
+    done
+}
+
+cat_d() {
+    while read __LINE ; do
+       echoinfo "D:$SYSTESTDIR:$__LINE"
+    done
+}
+
+digcomp() {
+    output=`$PERL $SYSTEMTESTTOP/digcomp.pl "$@"`
+    result=$?
+    [ -n "$output" ] &&  { echo "digcomp failed:"; echo "$output"; } | cat_i
+    return $result
+}
+
+#
+# Useful functions in test scripts
+#
+
+# keyfile_to_keys_section: helper function for keyfile_to_*_keys() which
+# converts keyfile data into a configuration section using the supplied
+# parameters
+keyfile_to_keys_section() {
+    section_name=$1
+    key_prefix=$2
+    shift
+    shift
+    echo "$section_name {"
+    for keyname in $*; do
+        awk '!/^; /{
+            printf "\t\""$1"\" "
+            printf "'"$key_prefix"'"
+            printf $4 " " $5 " " $6 " \""
+            for (i=7; i<=NF; i++) printf $i
+            printf "\";\n"
+        }' $keyname.key
+    done
+    echo "};"
+}
+
+# keyfile_to_trusted_keys: convert key data contained in the keyfile(s)
+# provided to a "trusted-keys" section suitable for including in a
+# resolver's configuration file
+keyfile_to_trusted_keys() {
+    keyfile_to_keys_section "trusted-keys" "" $*
+}
+
+# keyfile_to_managed_keys: convert key data contained in the keyfile(s)
+# provided to a "managed-keys" section suitable for including in a
+# resolver's configuration file
+keyfile_to_managed_keys() {
+    keyfile_to_keys_section "managed-keys" "initial-key " $*
+}
+
+# nextpart*() - functions for reading files incrementally
+#
+# These functions aim to facilitate looking for (or waiting for)
+# messages which may be logged more than once throughout the lifetime of
+# a given named instance by outputting just the part of the file which
+# has been appended since the last time we read it.
+#
+# Calling some of these functions causes temporary *.prev files to be
+# created that need to be cleaned up manually (usually by a given system
+# test's clean.sh script).
+#
+# Note that unlike other nextpart*() functions, nextpartread() is not
+# meant to be directly used in system tests; its sole purpose is to
+# reduce code duplication below.
+#
+# A quick usage example:
+#
+#     $ echo line1 > named.log
+#     $ echo line2 >> named.log
+#     $ nextpart named.log
+#     line1
+#     line2
+#     $ echo line3 >> named.log
+#     $ nextpart named.log
+#     line3
+#     $ nextpart named.log
+#     $ echo line4 >> named.log
+#     $ nextpartpeek named.log
+#     line4
+#     $ nextpartpeek named.log
+#     line4
+#     $ nextpartreset named.log
+#     $ nextpartpeek named.log
+#     line1
+#     line2
+#     line3
+#     line4
+#     $ nextpart named.log
+#     line1
+#     line2
+#     line3
+#     line4
+#     $ nextpart named.log
+#     $
+
+# nextpartreset: reset the marker used by nextpart() and nextpartpeek()
+# so that it points to the start of the given file
+nextpartreset() {
+    echo "0" > $1.prev
+}
+
+# nextpartread: read everything that's been appended to a file since the
+# last time nextpart() was called and print it to stdout, print the
+# total number of lines read from that file so far to stderr
+nextpartread() {
+    [ -f $1.prev ] || nextpartreset $1
+    prev=`cat $1.prev`
+    awk "NR > $prev "'{ print }
+         END          { print NR > "/dev/stderr" }' $1
+}
+
+# nextpart: read everything that's been appended to a file since the
+# last time nextpart() was called
+nextpart() {
+	nextpartread $1 2> $1.prev.tmp
+	mv $1.prev.tmp $1.prev
+}
+
+# nextpartpeek: read everything that's been appended to a file since the
+# last time nextpart() was called
+nextpartpeek() {
+	nextpartread $1 2> /dev/null
+}
+
+rndc_reload() {
+    echo_i "`$RNDC -c ../common/rndc.conf -s $2 -p ${CONTROLPORT} reload $3 2>&1 | sed 's/^/'$1' /'`"
+    # reloading single zone is synchronous, if we're reloading whole server
+    # we need to wait for reload to finish
+    if [ -z "$3" ]; then
+	for __try in 0 1 2 3 4 5 6 7 8 9; do
+	    $RNDC -c ../common/rndc.conf -s $2 -p ${CONTROLPORT} status | grep "reload/reconfig in progress" > /dev/null || break; 
+	    sleep 1
+	done
+    fi
+}
+
+rndc_reconfig() {
+    echo_i "`$RNDC -c ../common/rndc.conf -s $2 -p ${CONTROLPORT} reconfig 2>&1 | sed 's/^/'$1' /'`"
+    for __try in 0 1 2 3 4 5 6 7 8 9; do
+        $RNDC -c ../common/rndc.conf -s $2 -p ${CONTROLPORT} status | grep "reload/reconfig in progress" > /dev/null || break; 
+	sleep 1
+    done
+}
+
+#
+# Export command paths
+#
+export ARPANAME
+export BIGKEY
+export CDS
+export CHECKZONE
+export DESCRIPTION
+export DIG
+export FEATURETEST
+export FSTRM_CAPTURE
+export GENCHECK
+export JOURNALPRINT
+export KEYCREATE
+export KEYDELETE
+export KEYFRLAB
+export KEYGEN
+export KEYSETTOOL
+export KEYSIGNER
+export KRB5_CONFIG
+export MAKEJOURNAL
+export MDIG
+export NAMED
+export NSEC3HASH
+export NSLOOKUP
+export NSUPDATE
+export NZD2NZF
+export PERL
+export PIPEQUERIES
+export PK11DEL
+export PK11GEN
+export PK11LIST
+export PSSUSPEND
+export PYTHON
+export RESOLVE
+export RNDC
+export RRCHECKER
+export SAMPLEUPDATE
+export SIGNER
+export SUBDIRS
+export TESTSOCK6
+export TSIGKEYGEN
+export WIRETEST
--- a/Show More
+++ b/Show More