WIP: Add F&A Array Queue implementation

Make a copy of ns__client_request as ns__client_request_old

The 'old' one will be used by not-yet-reworked parts, while we
keep history of ns__client_request.

Start netmgr with named, shutdown at the end

- udplistener in interfacemgr uses netmgr
- use per-client buffer for udp send
- first steps at making ns_client_request use netmgr for UDP
- uncrustify

Make interfacemgr and interface references isc_refcount_t instead of locked ints

Use clock_gettime instead of gettimeofday

Cleanup get_client, use one interface for clientmgr instead of attaching it to each client

'extra' field at the end of handle - for client data

WiP: no TCP, UDP works, no resolver

.gitignore

@@ -10,6 +10,7 @@
 *.rej
 *.so
 *_test
+*.ipch # vscode/intellisense precompiled header
 *~
 .ccache/
 .cproject

.gitlab-ci.yml

@@ -17,7 +17,9 @@ variables:
 stages:
   - precheck
   - build
-  - test
+  - unit
+  - system
+  - docs
   - push
 
 ### Runner Tag Templates
@@ -148,6 +150,8 @@ stages:
     - test -z "${RUN_MAKE_INSTALL}" || make install
   dependencies:
     - autoreconf:sid:amd64
+  needs:
+    - autoreconf:sid:amd64
   artifacts:
     untracked: true
     expire_in: "1 hour"
@@ -164,7 +168,7 @@ stages:
 
 .system_test: &system_test_job
   <<: *default_triggering_rules
-  stage: test
+  stage: system
   retry: 2
   before_script:
     - *setup_interfaces
@@ -186,7 +190,7 @@ stages:
 
 .unit_test: &unit_test_job
   <<: *default_triggering_rules
-  stage: test
+  stage: unit
   before_script:
     - *setup_softhsm
   script:
@@ -242,13 +246,15 @@ misc:sid:amd64:
 
 docs:sid:amd64:
   <<: *debian_sid_amd64_image
-  stage: build
+  stage: docs
   script:
     - ./configure || cat config.log
     - make -C doc/misc docbook
     - make -C doc/arm Bv9ARM.html
   dependencies:
     - autoreconf:sid:amd64
+  needs:
+    - autoreconf:sid:amd64
   artifacts:
     paths:
       - doc/arm/
@@ -285,34 +291,14 @@ system:gcc:alpine3.10:amd64:
   <<: *system_test_job
   dependencies:
     - gcc:alpine3.10:amd64
+  needs: ["gcc:alpine3.10:amd64"]
 
 unit:gcc:alpine3.10:amd64:
   <<: *alpine_3_10_amd64_image
   <<: *unit_test_job
   dependencies:
     - gcc:alpine3.10:amd64
-
-# Jobs for regular GCC builds on CentOS 6 (amd64)
-
-gcc:centos6:amd64:
-  variables:
-    CC: gcc
-    CFLAGS: "-Wall -Wextra -O2 -g"
-    EXTRA_CONFIGURE: "--with-libidn2 --disable-warn-error"
-  <<: *centos_centos6_amd64_image
-  <<: *build_job
-
-system:gcc:centos6:amd64:
-  <<: *centos_centos6_amd64_image
-  <<: *system_test_job
-  dependencies:
-    - gcc:centos6:amd64
-
-unit:gcc:centos6:amd64:
-  <<: *centos_centos6_amd64_image
-  <<: *unit_test_job
-  dependencies:
-    - gcc:centos6:amd64
+  needs: ["gcc:alpine3.10:amd64"]
 
 # Jobs for regular GCC builds on CentOS 7 (amd64)
 
@@ -329,34 +315,14 @@ system:gcc:centos7:amd64:
   <<: *system_test_job
   dependencies:
     - gcc:centos7:amd64
+  needs: ["gcc:centos7:amd64"]
 
 unit:gcc:centos7:amd64:
   <<: *centos_centos7_amd64_image
   <<: *unit_test_job
   dependencies:
     - gcc:centos7:amd64
-
-# Jobs for regular GCC builds on Debian 8 Jessie (amd64)
-
-gcc:jessie:amd64:
-  variables:
-    CC: gcc
-    CFLAGS: "-Wall -Wextra -O2 -g"
-    EXTRA_CONFIGURE: "--without-cmocka --with-python --disable-geoip"
-  <<: *debian_jessie_amd64_image
-  <<: *build_job
-
-system:gcc:jessie:amd64:
-  <<: *debian_jessie_amd64_image
-  <<: *system_test_job
-  dependencies:
-    - gcc:jessie:amd64
-
-unit:gcc:jessie:amd64:
-  <<: *debian_jessie_amd64_image
-  <<: *unit_test_job
-  dependencies:
-    - gcc:jessie:amd64
+  needs: ["gcc:centos7:amd64"]
 
 # Jobs for regular GCC builds on Debian 9 Stretch (amd64)
 
@@ -372,12 +338,14 @@ system:gcc:stretch:amd64:
   <<: *system_test_job
   dependencies:
     - gcc:stretch:amd64
+  needs: ["gcc:stretch:amd64"]
 
 unit:gcc:stretch:amd64:
   <<: *debian_stretch_amd64_image
   <<: *unit_test_job
   dependencies:
     - gcc:stretch:amd64
+  needs: ["gcc:stretch:amd64"]
 
 # Jobs for regular GCC builds on Debian 10 Buster (amd64)
 
@@ -393,12 +361,14 @@ system:gcc:buster:amd64:
   <<: *system_test_job
   dependencies:
     - gcc:buster:amd64
+  needs: ["gcc:buster:amd64"]
 
 unit:gcc:buster:amd64:
   <<: *debian_buster_amd64_image
   <<: *unit_test_job
   dependencies:
     - gcc:buster:amd64
+  needs: ["gcc:buster:amd64"]
 
 # Jobs for regular GCC builds on Debian Sid (amd64)
 
@@ -416,12 +386,14 @@ system:gcc:sid:amd64:
   <<: *system_test_job
   dependencies:
     - gcc:sid:amd64
+  needs: ["gcc:sid:amd64"]
 
 unit:gcc:sid:amd64:
   <<: *debian_sid_amd64_image
   <<: *unit_test_job
   dependencies:
     - gcc:sid:amd64
+  needs: ["gcc:sid:amd64"]
 
 # Jobs for regular GCC builds on Debian Sid (i386)
 
@@ -438,12 +410,14 @@ system:gcc:sid:i386:
   <<: *system_test_job
   dependencies:
     - gcc:sid:i386
+  needs: ["gcc:sid:i386"]
 
 unit:gcc:sid:i386:
   <<: *debian_sid_i386_image
   <<: *unit_test_job
   dependencies:
     - gcc:sid:i386
+  needs: ["gcc:sid:i386"]
 
 # Jobs for regular GCC builds on Fedora 30 (amd64)
 
@@ -460,12 +434,14 @@ system:gcc:fedora30:amd64:
   <<: *system_test_job
   dependencies:
     - gcc:fedora30:amd64
+  needs: ["gcc:fedora30:amd64"]
 
 unit:gcc:fedora30:amd64:
   <<: *fedora_30_amd64_image
   <<: *unit_test_job
   dependencies:
     - gcc:fedora30:amd64
+  needs: ["gcc:fedora30:amd64"]
 
 # Jobs for regular GCC builds on Ubuntu 16.04 Xenial Xerus (amd64)
 
@@ -482,12 +458,14 @@ system:gcc:xenial:amd64:
   <<: *system_test_job
   dependencies:
     - gcc:xenial:amd64
+  needs: ["gcc:xenial:amd64"]
 
 unit:gcc:xenial:amd64:
   <<: *ubuntu_xenial_amd64_image
   <<: *unit_test_job
   dependencies:
     - gcc:xenial:amd64
+  needs: ["gcc:xenial:amd64"]
 
 # Jobs for regular GCC builds on Ubuntu 18.04 Bionic Beaver (amd64)
 
@@ -504,12 +482,14 @@ system:gcc:bionic:amd64:
   <<: *system_test_job
   dependencies:
     - gcc:bionic:amd64
+  needs: ["gcc:bionic:amd64"]
 
 unit:gcc:bionic:amd64:
   <<: *ubuntu_bionic_amd64_image
   <<: *unit_test_job
   dependencies:
     - gcc:bionic:amd64
+  needs: ["gcc:bionic:amd64"]
 
 # Jobs for GCC builds with ASAN enabled on Debian Sid (amd64)
 
@@ -527,12 +507,14 @@ system:asan:sid:amd64:
   <<: *system_test_job
   dependencies:
     - asan:sid:amd64
+  needs: ["asan:sid:amd64"]
 
 unit:asan:sid:amd64:
   <<: *debian_sid_amd64_image
   <<: *unit_test_job
   dependencies:
     - asan:sid:amd64
+  needs: ["asan:sid:amd64"]
 
 rwlock:sid:amd64:
   variables:
@@ -547,12 +529,14 @@ system:rwlock:sid:amd64:
   <<: *system_test_job
   dependencies:
     - rwlock:sid:amd64
+  needs: ["rwlock:sid:amd64"]
 
 unit:rwlock:sid:amd64:
   <<: *debian_sid_amd64_image
   <<: *unit_test_job
   dependencies:
     - rwlock:sid:amd64
+  needs: ["rwlock:sid:amd64"]
 
 # Jobs for mutex-based atomics on Debian SID (amd64)
 mutexatomics:sid:amd64:
@@ -568,6 +552,7 @@ mutexatomics:sid:amd64:
 #  <<: *system_test_job
 #  dependencies:
 #    - mutexatomics:sid:amd64
+#    - mutexatomics:sid:amd64
 #  allow_failure: true
 
 #unit:mutexatomics:sid:amd64:
@@ -592,6 +577,7 @@ unit:clang:stretch:amd64:
   <<: *unit_test_job
   dependencies:
     - clang:stretch:amd64
+  needs: ["clang:stretch:amd64"]
 
 # Jobs for Clang builds on Debian Stretch (i386)
 
@@ -618,12 +604,14 @@ system:pkcs11:sid:amd64:
   <<: *system_test_job
   dependencies:
     - pkcs11:sid:amd64
+  needs: ["pkcs11:sid:amd64"]
 
 unit:pkcs11:sid:amd64:
   <<: *debian_sid_amd64_image
   <<: *unit_test_job
   dependencies:
     - pkcs11:sid:amd64
+  needs: ["pkcs11:sid:amd64"]
 
 # Jobs with libtool disabled
 
@@ -640,9 +628,11 @@ system:nolibtool:sid:amd64:
   <<: *system_test_job
   dependencies:
     - nolibtool:sid:amd64
+  needs: ["nolibtool:sid:amd64"]
 
 unit:nolibtool:sid:amd64:
   <<: *debian_sid_amd64_image
   <<: *unit_test_job
   dependencies:
     - nolibtool:sid:amd64
+  needs: ["nolibtool:sid:amd64"]

.uncrustify.cfg

@@ -642,7 +642,7 @@ align_with_tabs                          = true     # false/true
 align_on_tabstop                         = false    # false/true
 
 # Whether to left-align numbers
-align_number_left                        = false    # false/true
+#align_number_left                        = false    # false/true
 
 # Align variable definitions in prototypes and functions
 align_func_params                        = false    # false/true

CHANGES

@@ -1,5 +1,50 @@
 	--- 9.15.3 released ---
 
+5291.	[placeholder]
+
+5290.	[placeholder]
+
+5289.	[bug]		Address NULL pointer dereference in rpz.c:rpz_detach.
+			[GL #1210]
+
+5288.	[bug]		dnssec-must-be-secure was not always honoured.
+			[GL #1209]
+
+5287.	[placeholder]
+
+5286.	[contrib]	Address potential NULL pointer dereferences in
+			dlz_mysqldyn_mod.c. [GL #1207]
+
+5285.	[port]		win32: implement "-T maxudpXXX". [GL #837]
+
+5284.	[func]		Added +unexpected command line option to dig.
+			By default, dig won't accept a reply from a source
+			other than the one to which it sent the query.
+			Invoking dig with +unexpected argument will allow it
+			to process replies from unexpected sources.
+
+5283.	[bug]		When a response-policy zone expires, ensure that
+			its policies are removed from the RPZ summary
+			database. [GL #1146]
+
+5282.	[bug]		Fixed a bug in searching for possible wildcard matches
+			for query names in the RPZ summary database. [GL #1146]
+
+5281.	[cleanup]	Don't escape commas when reporting named's command
+			line. [GL #1189]
+
+5280.	[protocol]	Add support for displaying EDNS option LLQ. [GL #1201]
+
+5279.	[bug]		When loading, reject zones containing CDS or CDNSKEY
+			RRsets at the zone apex if they would cause DNSSEC
+			validation failures if published in the parent zone
+			as the DS RRset.  [GL #1187]
+
+5278.	[func]		Add YAML output formats for dig, mdig and delv;
+			use the "+yaml" option to enable. [GL #1145]
+
+	--- 9.15.3 released ---
+
 5277.	[bug]		Cache DB statistics could underflow when serve-stale
 			was in use, because of a bug in counter maintenance
 			when RRsets become stale.

CODE_OF_CONDUCT

@@ -0,0 +1,79 @@
+CODE OF CONDUCT
+
+BIND 9 Code of Conduct
+
+Like the technical community as a whole, the BIND 9 team and community is
+made up of a mixture of professionals and volunteers from all over the
+world, working on every aspect of the mission - including mentorship,
+teaching, and connecting people.
+
+Diversity is one of our huge strengths, but it can also lead to
+communication issues and unhappiness. To that end, we have a few ground
+rules that we ask people to adhere to. This code applies equally to the
+core development team, open source contributors and those seeking help and
+guidance.
+
+This isn't an exhaustive list of things that you can't do. Rather, take it
+in the spirit in which it's intended - a guide to make it easier to enrich
+all of us and the technical communities in which we participate.
+
+This code of conduct applies to all spaces managed by the BIND 9 project
+or Internet Systems Consortium. This includes chat, the mailing lists, the
+issue tracker, and any other fora created by the project team which the
+community uses for communication. In addition, violations of this code
+outside these spaces may affect a person's ability to participate within
+them.
+
+If you believe someone is violating the code of conduct, we ask that you
+report it by emailing conduct@isc.org. For more details please see our
+Reporting Guidelines.
+
+  * Be friendly and patient.
+  * Be welcoming. We strive to be a community that welcomes and supports
+    people of all backgrounds and identities. This includes, but is not
+    limited to members of any race, ethnicity, culture, national origin,
+    colour, immigration status, social and economic class, educational
+    level, sex, sexual orientation, gender identity and expression, age,
+    size, family status, political belief, religion, and mental and
+    physical ability.
+  * Be considerate. Your work will be used by other people, and you in
+    turn will depend on the work of others. Any decision you take will
+    affect users and colleagues, and you should take those consequences
+    into account when making decisions. Remember that we're a world-wide
+    community, so you might not be communicating in someone else's primary
+    language.
+  * Be respectful. Not all of us will agree all the time, but disagreement
+    is no excuse for poor behavior and poor manners. We might all
+    experience some frustration now and then, but we cannot allow that
+    frustration to turn into a personal attack. It's important to remember
+    that a community where people feel uncomfortable or threatened is not
+    a productive one. Members of the BIND 9 community should be respectful
+    when dealing with other members as well as with people outside the
+    BIND 9 community.
+  * Be careful in the words that you choose. We are a community of
+    professionals, and we conduct ourselves professionally. Be kind to
+    others. Do not insult or put down other participants. Harassment and
+    other exclusionary behavior aren't acceptable. This includes, but is
+    not limited to:
+      + Violent threats or language directed against another person.
+      + Discriminatory jokes and language.
+      + Posting sexually explicit or violent material.
+      + Posting (or threatening to post) other people's personally
+        identifying information ("doxing").
+      + Personal insults, especially those using racist or sexist terms.
+      + Unwelcome sexual attention.
+      + Advocating for, or encouraging, any of the above behavior.
+      + Repeated harassment of others. In general, if someone asks you to
+        stop, then stop.
+  * When we disagree, try to understand why. Disagreements, both social
+    and technical, happen all the time and BIND 9 is no exception. It is
+    important that we resolve disagreements and differing views
+    constructively. Remember that we're different. The strength of BIND 9
+    comes from its varied community, people from a wide range of
+    backgrounds. Different people have different perspectives on issues.
+    Being unable to understand why someone holds a viewpoint doesn't mean
+    that they're wrong. Don't forget that it is human to err and blaming
+    each other doesn't get us anywhere. Instead, focus on helping to
+    resolve issues and learning from mistakes.
+
+Original text courtesy of the Django Code of Conduct project.

CODE_OF_CONDUCT.md

@@ -0,0 +1,71 @@
+# BIND 9 Code of Conduct
+
+Like the technical community as a whole, the BIND 9 team and community is made
+up of a mixture of professionals and volunteers from all over the world, working
+on every aspect of the mission - including mentorship, teaching, and connecting
+people.
+
+Diversity is one of our huge strengths, but it can also lead to communication
+issues and unhappiness. To that end, we have a few ground rules that we ask
+people to adhere to. This code applies equally to the core development team, open source contributors and those
+seeking help and guidance.
+
+This isn't an exhaustive list of things that you can't do. Rather, take it in
+the spirit in which it's intended - a guide to make it easier to enrich all of
+us and the technical communities in which we participate.
+
+This code of conduct applies to all spaces managed by the BIND 9 project or
+Internet Systems Consortium. This includes chat, the mailing lists, the issue
+tracker, and any other fora created by the project team which the
+community uses for communication. In addition, violations of this code outside
+these spaces may affect a person's ability to participate within them.
+
+If you believe someone is violating the code of conduct, we ask that you report
+it by emailing [conduct@isc.org](conduct@isc.org). For more details please see
+our [Reporting Guidelines](https://www.isc.org/conductreporting/).
+
+* **Be friendly and patient.**
+* **Be welcoming.** We strive to be a community that welcomes and supports
+  people of all backgrounds and identities. This includes, but is not limited to
+  members of any race, ethnicity, culture, national origin, colour, immigration
+  status, social and economic class, educational level, sex, sexual orientation,
+  gender identity and expression, age, size, family status, political belief,
+  religion, and mental and physical ability.
+* **Be considerate.** Your work will be used by other people, and you in turn
+  will depend on the work of others. Any decision you take will affect users and
+  colleagues, and you should take those consequences into account when making
+  decisions. Remember that we're a world-wide community, so you might not be
+  communicating in someone else's primary language.
+* **Be respectful.** Not all of us will agree all the time, but disagreement is
+  no excuse for poor behavior and poor manners. We might all experience some
+  frustration now and then, but we cannot allow that frustration to turn into a
+  personal attack. It's important to remember that a community where people feel
+  uncomfortable or threatened is not a productive one. Members of the BIND 9
+  community should be respectful when dealing with other members as well as with
+  people outside the BIND 9 community.
+* **Be careful in the words that you choose.** We are a community of
+  professionals, and we conduct ourselves professionally. Be kind to others. Do
+  not insult or put down other participants. Harassment and other exclusionary
+  behavior aren't acceptable. This includes, but is not limited to:
+  * Violent threats or language directed against another person.
+  * Discriminatory jokes and language.
+  * Posting sexually explicit or violent material.
+  * Posting (or threatening to post) other people's personally identifying
+    information ("doxing").
+  * Personal insults, especially those using racist or sexist terms.
+  * Unwelcome sexual attention.
+  * Advocating for, or encouraging, any of the above behavior.
+  * Repeated harassment of others. In general, if someone asks you to stop, then
+    stop.
+* **When we disagree, try to understand why.** Disagreements, both social and
+  technical, happen all the time and BIND 9 is no exception. It is important
+  that we resolve disagreements and differing views constructively. Remember
+  that we're different. The strength of BIND 9 comes from its varied community,
+  people from a wide range of backgrounds. Different people have different
+  perspectives on issues. Being unable to understand why someone holds a
+  viewpoint doesn't mean that they're wrong. Don't forget that it is human to
+  err and blaming each other doesn't get us anywhere. Instead, focus on helping
+  to resolve issues and learning from mistakes.
+
+Original text courtesy of the [Django Code of Conduct](https://www.djangoproject.com/conduct/)
+project.

CONTRIBUTING

@@ -34,6 +34,14 @@ access to the source repository was restricted just as commit access was.
 That's now changing, with the opening of a public git mirror to the BIND
 source tree (see below).
 
+At Internet Systems Consortium, we're committed to building communities
+that are welcoming and inclusive; environments where people are encouraged
+to share ideas, treat each other with respect, and collaborate towards the
+best solutions. To reinforce our commitment, the Internet Systems
+Consortium has adopted the Contributor Covenant version 1.4 as our Code of
+Conduct for BIND 9 project, as well as for the conduct of our developers
+throughout the industry.
+
 Access to source code
 
 Public BIND releases are always available from the ISC FTP site.

CONTRIBUTING.md

@@ -41,6 +41,14 @@ a release: read access to the source repository was restricted just
 as commit access was.  That's now changing, with the opening of a
 public git mirror to the BIND source tree (see below).
 
+At [Internet Systems Consortium](https://www.isc.org), we're committed to
+building communities that are welcoming and inclusive; environments where people
+are encouraged to share ideas, treat each other with respect, and collaborate
+towards the best solutions. To reinforce our commitment, the [Internet Systems
+Consortium](https://www.isc.org) has adopted the Contributor Covenant version
+1.4 as our Code of Conduct for BIND 9 project, as well as for the conduct of our
+developers throughout the industry.
+
 ### <a name="access"></a>Access to source code
 
 Public BIND releases are always available from the
@@ -108,7 +116,7 @@ ISC's Security Vulnerability Disclosure Policy is documented at [https://kb.isc.
 If you have a crash, you may want to consult
 [‘What to do if your BIND or DHCP server has crashed.’](https://kb.isc.org/article/AA-00340/89/What-to-do-if-your-BIND-or-DHCP-server-has-crashed.html)
 
-### <a name="bugs"></a>Contributing code
+### <a name="contrib"></a>Contributing code
 
 BIND is licensed under the
 [Mozilla Public License 2.0](http://www.isc.org/downloads/software-support-policy/isc-license/).

Makefile.in

@@ -18,7 +18,7 @@ SUBDIRS =	make lib fuzz bin doc
 TARGETS =
 PREREQS =	bind.keys.h
 
-MANOBJS =	README HISTORY OPTIONS CONTRIBUTING PLATFORMS \
+MANOBJS =	README HISTORY OPTIONS CONTRIBUTING PLATFORMS CODE_OF_CONDUCT \
 		${MANPAGES} ${HTMLPAGES}
 
 @BIND9_MAKE_RULES@
@@ -103,6 +103,11 @@ PLATFORMS: PLATFORMS.md
 		${W3M} -dump -cols 75 -O ascii -T text/html | \
 		sed -e '$${/^$$/d;}' > $@
 
+CODE_OF_CONDUCT: CODE_OF_CONDUCT.md
+	${PANDOC} --email-obfuscation=none -s --metadata title="CODE OF CONDUCT" -f markdown-smart -t html CODE_OF_CONDUCT.md | \
+		${W3M} -dump -cols 75 -O ascii -T text/html | \
+		sed -e '$${/^$$/d;}' > $@
+
 unit::
 	sh ${top_builddir}/unit/unittest.sh
 

README

@@ -87,8 +87,9 @@ ISC maintains a public git repository for BIND; details can be found at
 http://www.isc.org/git/.
 
 Information for BIND contributors can be found in the following files: -
-General information: CONTRIBUTING.md - BIND 9 code style: doc/dev/style.md
-- BIND architecture and developer guide: doc/dev/dev.md
+General information: CONTRIBUTING.md - Code of Conduct: CODE_OF_CONDUCT.md
+- BIND 9 code style: doc/dev/style.md - BIND architecture and developer
+guide: doc/dev/dev.md
 
 Patches for BIND may be submitted as Merge Requests in the ISC GitLab
 server at at https://gitlab.isc.org/isc-projects/bind9/merge_requests.
@@ -109,6 +110,7 @@ of changes from BIND 9.14 and earlier releases. New features include:
 
   * Support for the new GeoIP2 geolocation API
   * Improved DNSSEC key configuration using dnssec-keys
+  * YAML output for dig, mdig, and delv.
 
 Building BIND
 

README.md

@@ -98,7 +98,8 @@ ISC maintains a public git repository for BIND; details can be found
 at [http://www.isc.org/git/](http://www.isc.org/git/).
 
 Information for BIND contributors can be found in the following files:
-- General information: [CONTRIBUTING.md](CONTRIBUTING)
+- General information: [CONTRIBUTING.md](CONTRIBUTING.md)
+- Code of Conduct: [CODE_OF_CONDUCT.md](CODE_OF_CONDUCT.md)
 - BIND 9 code style: [doc/dev/style.md](doc/dev/style.md)
 - BIND architecture and developer guide: [doc/dev/dev.md](doc/dev/dev.md)
 
@@ -125,6 +126,7 @@ include:
 
 * Support for the new GeoIP2 geolocation API
 * Improved DNSSEC key configuration using `dnssec-keys`
+* YAML output for dig, mdig, and delv.
 
 ### <a name="build"/> Building BIND
 

bin/delv/delv.1

@@ -409,6 +409,11 @@ Controls whether to use TCP when sending queries\&. The default is to use UDP un
 .RS 4
 Print all RDATA in unknown RR type presentation format (RFC 3597)\&. The default is to print RDATA for known types in the type\*(Aqs presentation format\&.
 .RE
+.PP
+\fB+[no]yaml\fR
+.RS 4
+Print response data in YAML format\&.
+.RE
 .SH "FILES"
 .PP
 /etc/bind\&.keys

bin/delv/delv.c

@@ -111,7 +111,8 @@ static bool
 	nottl = false,
 	multiline = false,
 	short_form = false,
-	print_unknown_format = false;
+	print_unknown_format = false,
+	yaml = false;
 
 static bool
 	resolve_trace = false,
@@ -353,52 +354,80 @@ setup_logging(FILE *errout) {
 
 static void
 print_status(dns_rdataset_t *rdataset) {
-	const char *astr = "", *tstr = "";
+	char buf[1024] = { 0 };
 
 	REQUIRE(rdataset != NULL);
 
-	if (!showtrust || !dns_rdataset_isassociated(rdataset))
+	if (!showtrust || !dns_rdataset_isassociated(rdataset)) {
 		return;
+	}
 
-	if ((rdataset->attributes & DNS_RDATASETATTR_NEGATIVE) != 0)
-		astr = "negative response, ";
+	buf[0] = '\0';
+
+	if ((rdataset->attributes & DNS_RDATASETATTR_NEGATIVE) != 0) {
+		strlcat(buf, "negative response", sizeof(buf));
+		strlcat(buf, (yaml ? "_" : ", "), sizeof(buf));
+	}
 
 	switch (rdataset->trust) {
 	case dns_trust_none:
-		tstr = "untrusted";
+		strlcat(buf, "untrusted", sizeof(buf));
 		break;
 	case dns_trust_pending_additional:
-		tstr = "signed additional data, pending validation";
+		strlcat(buf, "signed additional data", sizeof(buf));
+		if (!yaml) {
+			strlcat(buf, ", ", sizeof(buf));
+		}
+		strlcat(buf, "pending validation", sizeof(buf));
 		break;
 	case dns_trust_pending_answer:
-		tstr = "signed answer, pending validation";
+		strlcat(buf, "signed answer", sizeof(buf));
+		if (!yaml) {
+			strlcat(buf, ", ", sizeof(buf));
+		}
+		strlcat(buf, "pending validation", sizeof(buf));
 		break;
 	case dns_trust_additional:
-		tstr = "unsigned additional data";
+		strlcat(buf, "unsigned additional data", sizeof(buf));
 		break;
 	case dns_trust_glue:
-		tstr = "glue data";
+		strlcat(buf, "glue data", sizeof(buf));
 		break;
 	case dns_trust_answer:
 		if (root_validation) {
-			tstr = "unsigned answer";
+			strlcat(buf, "unsigned answer", sizeof(buf));
+		} else {
+			strlcat(buf, "answer not validated", sizeof(buf));
 		}
 		break;
 	case dns_trust_authauthority:
-		tstr = "authority data";
+		strlcat(buf, "authority data", sizeof(buf));
 		break;
 	case dns_trust_authanswer:
-		tstr = "authoritative";
+		strlcat(buf, "authoritative", sizeof(buf));
 		break;
 	case dns_trust_secure:
-		tstr = "fully validated";
+		strlcat(buf, "fully validated", sizeof(buf));
 		break;
 	case dns_trust_ultimate:
-		tstr = "ultimate trust";
+		strlcat(buf, "ultimate trust", sizeof(buf));
 		break;
 	}
 
-	printf("; %s%s\n", astr, tstr);
+	if (yaml) {
+		char *p;
+
+		/* Convert spaces to underscores for YAML */
+		for (p = buf; p != NULL && *p != '\0'; p++) {
+			if (*p == ' ') {
+				*p = '_';
+			}
+		}
+
+		printf("  - %s:\n", buf);
+	} else {
+		printf("; %s\n", buf);
+	}
 }
 
 static isc_result_t
@@ -425,8 +454,9 @@ printdata(dns_rdataset_t *rdataset, dns_name_t *owner,
 		return (ISC_R_SUCCESS);
 
 	if (first || rdataset->trust != trust) {
-		if (!first && showtrust && !short_form)
+		if (!first && showtrust && !short_form && !yaml) {
 			putchar('\n');
+		}
 		print_status(rdataset);
 		trust = rdataset->trust;
 		first = false;
@@ -465,9 +495,11 @@ printdata(dns_rdataset_t *rdataset, dns_name_t *owner,
 				dns_rdata_reset(&rdata);
 			}
 		} else {
-			if ((rdataset->attributes &
-			     DNS_RDATASETATTR_NEGATIVE) != 0)
+			if (!yaml && (rdataset->attributes &
+				      DNS_RDATASETATTR_NEGATIVE) != 0)
+			{
 				isc_buffer_putstr(&target, "; ");
+			}
 
 			result = dns_master_rdatasettotext(owner, rdataset,
 							   style, &target);
@@ -500,38 +532,52 @@ setup_style(dns_master_style_t **stylep) {
 	REQUIRE(stylep != NULL || *stylep == NULL);
 
 	styleflags |= DNS_STYLEFLAG_REL_OWNER;
-	if (showcomments)
-		styleflags |= DNS_STYLEFLAG_COMMENT;
-	if (print_unknown_format)
-		styleflags |= DNS_STYLEFLAG_UNKNOWNFORMAT;
-	if (rrcomments)
-		styleflags |= DNS_STYLEFLAG_RRCOMMENT;
-	if (nottl)
-		styleflags |= DNS_STYLEFLAG_NO_TTL;
-	if (noclass)
-		styleflags |= DNS_STYLEFLAG_NO_CLASS;
-	if (nocrypto)
-		styleflags |= DNS_STYLEFLAG_NOCRYPTO;
-	if (multiline) {
-		styleflags |= DNS_STYLEFLAG_MULTILINE;
-		styleflags |= DNS_STYLEFLAG_COMMENT;
+	if (yaml) {
+		styleflags |= DNS_STYLEFLAG_YAML;
+		dns_master_indentstr = "  ";
+		dns_master_indent = 2;
+	} else {
+		if (showcomments) {
+			styleflags |= DNS_STYLEFLAG_COMMENT;
+		}
+		if (print_unknown_format) {
+			styleflags |= DNS_STYLEFLAG_UNKNOWNFORMAT;
+		}
+		if (rrcomments) {
+			styleflags |= DNS_STYLEFLAG_RRCOMMENT;
+		}
+		if (nottl) {
+			styleflags |= DNS_STYLEFLAG_NO_TTL;
+		}
+		if (noclass) {
+			styleflags |= DNS_STYLEFLAG_NO_CLASS;
+		}
+		if (nocrypto) {
+			styleflags |= DNS_STYLEFLAG_NOCRYPTO;
+		}
+		if (multiline) {
+			styleflags |= DNS_STYLEFLAG_MULTILINE;
+			styleflags |= DNS_STYLEFLAG_COMMENT;
+		}
 	}
 
-	if (multiline || (nottl && noclass))
+	if (multiline || (nottl && noclass)) {
 		result = dns_master_stylecreate(&style, styleflags,
 						24, 24, 24, 32, 80, 8,
 						splitwidth, mctx);
-	else if (nottl || noclass)
+	} else if (nottl || noclass) {
 		result = dns_master_stylecreate(&style, styleflags,
 						24, 24, 32, 40, 80, 8,
 						splitwidth, mctx);
-	else
+	} else {
 		result = dns_master_stylecreate(&style, styleflags,
 						24, 32, 40, 48, 80, 8,
 						splitwidth, mctx);
+	}
 
-	if (result == ISC_R_SUCCESS)
+	if (result == ISC_R_SUCCESS) {
 		*stylep = style;
+	}
 	return (result);
 }
 
@@ -1139,6 +1185,13 @@ plus_option(char *option) {
 		if (state)
 			resolve_trace = state;
 		break;
+	case 'y': /* yaml */
+		FULLCHECK("yaml");
+		yaml = state;
+		if (state) {
+			rrcomments = false;
+		}
+		break;
 	default:
 	invalid_option:
 		/*
@@ -1565,6 +1618,7 @@ main(int argc, char *argv[]) {
 	isc_result_t result;
 	dns_fixedname_t qfn;
 	dns_name_t *query_name, *response_name;
+	char namestr[DNS_NAME_FORMATSIZE];
 	dns_rdataset_t *rdataset;
 	dns_namelist_t namelist;
 	unsigned int resopt, clopt;
@@ -1653,9 +1707,18 @@ main(int argc, char *argv[]) {
 	ISC_LIST_INIT(namelist);
 	result = dns_client_resolve(client, query_name, dns_rdataclass_in,
 				    qtype, resopt, &namelist);
-	if (result != ISC_R_SUCCESS)
+	if (result != ISC_R_SUCCESS && !yaml) {
 		delv_log(ISC_LOG_ERROR, "resolution failed: %s",
 			  isc_result_totext(result));
+	}
+
+	if (yaml) {
+		printf("type: DELV_RESULT\n");
+		dns_name_format(query_name, namestr, sizeof(namestr));
+		printf("query_name: %s\n", namestr);
+		printf("status: %s\n", isc_result_totext(result));
+		printf("records:\n");
+	}
 
 	for (response_name = ISC_LIST_HEAD(namelist);
 	     response_name != NULL;

bin/delv/delv.docbook

@@ -658,6 +658,16 @@
 	    </para>
 	  </listitem>
 	</varlistentry>
+
+	<varlistentry>
+	  <term><option>+[no]yaml</option></term>
+	  <listitem>
+	    <para>
+	      Print response data in YAML format.
+	    </para>
+	  </listitem>
+	</varlistentry>
+
       </variablelist>
 
     </para>

bin/delv/delv.html

@@ -548,6 +548,12 @@
 	      in the type's presentation format.
 	    </p>
 	  </dd>
+<dt><span class="term"><code class="option">+[no]yaml</code></span></dt>
+<dd>
+	    <p>
+	      Print response data in YAML format.
+	    </p>
+	  </dd>
 </dl></div>
 <p>
 

bin/dig/dig.1

@@ -744,6 +744,13 @@ Display [do not display] the TTL when printing the record\&.
 Display [do not display] the TTL in friendly human\-readable time units of "s", "m", "h", "d", and "w", representing seconds, minutes, hours, days and weeks\&. Implies +ttlid\&.
 .RE
 .PP
+\fB+[no]unexpected\fR
+.RS 4
+Accept [do not accept] answers from unexpected sources\&. By default,
+\fBdig\fR
+won\*(Aqt accept a reply from a source other than the one to which it sent the query\&.
+.RE
+.PP
 \fB+[no]unknownformat\fR
 .RS 4
 Print all RDATA in unknown RR type presentation format (RFC 3597)\&. The default is to print RDATA for known types in the type\*(Aqs presentation format\&.
@@ -756,6 +763,13 @@ Use [do not use] TCP when querying name servers\&. This alternate syntax to
 is provided for backwards compatibility\&. The "vc" stands for "virtual circuit"\&.
 .RE
 .PP
+\fB+[no]yaml\fR
+.RS 4
+Print the responses (and, if
+\fB+qr\fR
+is in use, also the outgoing queries) in a detailed YAML format\&.
+.RE
+.PP
 \fB+[no]zflag\fR
 .RS 4
 Set [do not set] the last unassigned DNS header flag in a DNS query\&. This flag is off by default\&.

bin/dig/dig.c

@@ -234,6 +234,8 @@ help(void) {
 "                 +tries=###          (Set number of UDP attempts) [3]\n"
 "                 +[no]ttlid          (Control display of ttls in records)\n"
 "                 +[no]ttlunits       (Display TTLs in human-readable units)\n"
+"                 +[no]unexpected     (Print replies from unexpected sources\n"
+"                                      default=off)\n"
 "                 +[no]unknownformat  (Print RDATA in RFC 3597 \"unknown\" "
 					"format)\n"
 "                 +[no]vc             (TCP mode (+[no]tcp))\n"
@@ -262,7 +264,11 @@ received(unsigned int bytes, isc_sockaddr_t *from, dig_query_t *query) {
 
 	isc_sockaddr_format(from, fromtext, sizeof(fromtext));
 
-	if (query->lookup->stats && !short_form) {
+	if (short_form || yaml) {
+		return;
+	}
+
+	if (query->lookup->stats) {
 		diff = isc_time_microdiff(&query->time_recv, &query->time_sent);
 		if (query->lookup->use_usec)
 			printf(";; Query time: %ld usec\n", (long) diff);
@@ -283,11 +289,15 @@ received(unsigned int bytes, isc_sockaddr_t *from, dig_query_t *query) {
 		 */
 		if (wcsftime(time_str, sizeof(time_str)/sizeof(time_str[0]),
 			     L"%a %b %d %H:%M:%S %Z %Y", &tmnow) > 0U)
+		{
 			printf(";; WHEN: %ls\n", time_str);
+		}
 #else
 		if (strftime(time_str, sizeof(time_str),
 			     "%a %b %d %H:%M:%S %Z %Y", &tmnow) > 0U)
+		{
 			printf(";; WHEN: %s\n", time_str);
+		}
 #endif
 		if (query->lookup->doing_xfr) {
 			printf(";; XFR size: %u records (messages %u, "
@@ -298,30 +308,32 @@ received(unsigned int bytes, isc_sockaddr_t *from, dig_query_t *query) {
 			printf(";; MSG SIZE  rcvd: %u\n", bytes);
 		}
 		if (tsigkey != NULL) {
-			if (!validated)
+			if (!validated) {
 				puts(";; WARNING -- Some TSIG could not "
 				     "be validated");
+			}
 		}
 		if ((tsigkey == NULL) && (keysecret[0] != 0)) {
 			puts(";; WARNING -- TSIG key was not used.");
 		}
 		puts("");
-	} else if (query->lookup->identify && !short_form) {
+	} else if (query->lookup->identify) {
 		diff = isc_time_microdiff(&query->time_recv, &query->time_sent);
-		if (query->lookup->use_usec)
+		if (query->lookup->use_usec) {
 			printf(";; Received %" PRIu64 " bytes "
 			       "from %s(%s) in %ld us\n\n",
 			       query->lookup->doing_xfr
 				 ? query->byte_count
 				 : (uint64_t)bytes,
 			       fromtext, query->userarg, (long) diff);
-		else
+		} else {
 			printf(";; Received %" PRIu64 " bytes "
 			       "from %s(%s) in %ld ms\n\n",
 			       query->lookup->doing_xfr
 				 ?  query->byte_count
 				 : (uint64_t)bytes,
 			       fromtext, query->userarg, (long) diff / 1000);
+		}
 	}
 }
 
@@ -364,18 +376,20 @@ say_message(dns_rdata_t *rdata, dig_query_t *query, isc_buffer_t *buf) {
 		styleflags |= DNS_STYLEFLAG_EXPANDAAAA;
 	result = dns_rdata_tofmttext(rdata, NULL, styleflags, 0,
 				     splitwidth, " ", buf);
-	if (result == ISC_R_NOSPACE)
+	if (result == ISC_R_NOSPACE) {
 		return (result);
+	}
 	check_result(result, "dns_rdata_totext");
 	if (query->lookup->identify) {
-
 		diff = isc_time_microdiff(&query->time_recv, &query->time_sent);
 		ADD_STRING(buf, " from server ");
 		ADD_STRING(buf, query->servname);
 		if (query->lookup->use_usec) {
-			snprintf(store, sizeof(store), " in %" PRIu64 " us.", diff);
+			snprintf(store, sizeof(store),
+				 " in %" PRIu64 " us.", diff);
 		} else {
-			snprintf(store, sizeof(store), " in %" PRIu64 " ms.", diff / 1000);
+			snprintf(store, sizeof(store),
+				 " in %" PRIu64 " ms.", diff / 1000);
 		}
 		ADD_STRING(buf, store);
 	}
@@ -415,8 +429,7 @@ short_answer(dns_message_t *msg, dns_messagetextflag_t flags,
 			loopresult = dns_rdataset_first(rdataset);
 			while (loopresult == ISC_R_SUCCESS) {
 				dns_rdataset_current(rdataset, &rdata);
-				result = say_message(&rdata, query,
-						     buf);
+				result = say_message(&rdata, query, buf);
 				if (result == ISC_R_NOSPACE)
 					return (result);
 				check_result(result, "say_message");
@@ -458,63 +471,85 @@ isdotlocal(dns_message_t *msg) {
  * Callback from dighost.c to print the reply from a server
  */
 static isc_result_t
-printmessage(dig_query_t *query, dns_message_t *msg, bool headers) {
+printmessage(dig_query_t *query, const isc_buffer_t *msgbuf,
+	     dns_message_t *msg, bool headers)
+{
 	isc_result_t result;
 	dns_messagetextflag_t flags;
 	isc_buffer_t *buf = NULL;
 	unsigned int len = OUTPUTBUF;
 	dns_master_style_t *style = NULL;
 	unsigned int styleflags = 0;
+	bool isquery = (msg == query->lookup->sendmsg);
+
+	UNUSED(msgbuf);
 
 	styleflags |= DNS_STYLEFLAG_REL_OWNER;
-	if (query->lookup->comments)
-		styleflags |= DNS_STYLEFLAG_COMMENT;
-	if (query->lookup->print_unknown_format)
-		styleflags |= DNS_STYLEFLAG_UNKNOWNFORMAT;
-	/* Turn on rrcomments if explicitly enabled */
-	if (query->lookup->rrcomments > 0)
-		styleflags |= DNS_STYLEFLAG_RRCOMMENT;
-	if (query->lookup->ttlunits)
-		styleflags |= DNS_STYLEFLAG_TTL_UNITS;
-	if (query->lookup->nottl)
-		styleflags |= DNS_STYLEFLAG_NO_TTL;
-	if (query->lookup->noclass)
-		styleflags |= DNS_STYLEFLAG_NO_CLASS;
-	if (query->lookup->nocrypto)
-		styleflags |= DNS_STYLEFLAG_NOCRYPTO;
-	if (query->lookup->expandaaaa)
-		styleflags |= DNS_STYLEFLAG_EXPANDAAAA;
-	if (query->lookup->multiline) {
-		styleflags |= DNS_STYLEFLAG_OMIT_OWNER;
-		styleflags |= DNS_STYLEFLAG_OMIT_CLASS;
-		styleflags |= DNS_STYLEFLAG_REL_DATA;
-		styleflags |= DNS_STYLEFLAG_OMIT_TTL;
-		styleflags |= DNS_STYLEFLAG_TTL;
-		styleflags |= DNS_STYLEFLAG_MULTILINE;
-		/* Turn on rrcomments unless explicitly disabled */
-		if (query->lookup->rrcomments >= 0)
+	if (yaml) {
+		dns_master_indentstr = "  ";
+		dns_master_indent = 3;
+		styleflags |= DNS_STYLEFLAG_YAML;
+	} else {
+		if (query->lookup->comments) {
+			styleflags |= DNS_STYLEFLAG_COMMENT;
+		}
+		if (query->lookup->print_unknown_format) {
+			styleflags |= DNS_STYLEFLAG_UNKNOWNFORMAT;
+		}
+		/* Turn on rrcomments if explicitly enabled */
+		if (query->lookup->rrcomments > 0) {
 			styleflags |= DNS_STYLEFLAG_RRCOMMENT;
+		}
+		if (query->lookup->ttlunits) {
+			styleflags |= DNS_STYLEFLAG_TTL_UNITS;
+		}
+		if (query->lookup->nottl) {
+			styleflags |= DNS_STYLEFLAG_NO_TTL;
+		}
+		if (query->lookup->noclass) {
+			styleflags |= DNS_STYLEFLAG_NO_CLASS;
+		}
+		if (query->lookup->nocrypto) {
+			styleflags |= DNS_STYLEFLAG_NOCRYPTO;
+		}
+		if (query->lookup->expandaaaa) {
+			styleflags |= DNS_STYLEFLAG_EXPANDAAAA;
+		}
+		if (query->lookup->multiline) {
+			styleflags |= DNS_STYLEFLAG_OMIT_OWNER;
+			styleflags |= DNS_STYLEFLAG_OMIT_CLASS;
+			styleflags |= DNS_STYLEFLAG_REL_DATA;
+			styleflags |= DNS_STYLEFLAG_OMIT_TTL;
+			styleflags |= DNS_STYLEFLAG_TTL;
+			styleflags |= DNS_STYLEFLAG_MULTILINE;
+			/* Turn on rrcomments unless explicitly disabled */
+			if (query->lookup->rrcomments >= 0) {
+				styleflags |= DNS_STYLEFLAG_RRCOMMENT;
+			}
+		}
 	}
 	if (query->lookup->multiline ||
 	    (query->lookup->nottl && query->lookup->noclass))
+	{
 		result = dns_master_stylecreate(&style, styleflags,
 						24, 24, 24, 32, 80, 8,
 						splitwidth, mctx);
-	else if (query->lookup->nottl || query->lookup->noclass)
+	} else if (query->lookup->nottl || query->lookup->noclass) {
 		result = dns_master_stylecreate(&style, styleflags,
 						24, 24, 32, 40, 80, 8,
 						splitwidth, mctx);
-	else
+	} else {
 		result = dns_master_stylecreate(&style, styleflags,
 						24, 32, 40, 48, 80, 8,
 						splitwidth, mctx);
+	}
 	check_result(result, "dns_master_stylecreate");
 
 	if (query->lookup->cmdline[0] != 0) {
 		if (!short_form && printcmd) {
 			fputs(query->lookup->cmdline, stdout);
 		}
-		query->lookup->cmdline[0]=0;
+		query->lookup->cmdline[0] = '\0';
 	}
 	debug("printmessage(%s %s %s)", headers ? "headers" : "noheaders",
 	      query->lookup->comments ? "comments" : "nocomments",
@@ -535,13 +570,110 @@ printmessage(dig_query_t *query, dns_message_t *msg, bool headers) {
 	result = isc_buffer_allocate(mctx, &buf, len);
 	check_result(result, "isc_buffer_allocate");
 
-	if (query->lookup->comments && !short_form) {
-		if (query->lookup->cmdline[0] != 0 && printcmd)
+	if (yaml) {
+		enum { Q = 0x1, R = 0x2 }; /* Q:query; R:ecursive */
+		unsigned int tflag = 0;
+		isc_sockaddr_t saddr;
+		char sockstr[ISC_SOCKADDR_FORMATSIZE];
+		uint16_t sport;
+		char *hash;
+		int pf;
+
+		printf("-\n");
+		printf("  type: MESSAGE\n");
+		printf("  message:\n");
+
+		if (isquery) {
+			tflag |= Q;
+			if ((msg->flags & DNS_MESSAGEFLAG_RD) != 0) {
+				tflag |= R;
+			}
+		} else if (((msg->flags & DNS_MESSAGEFLAG_RD) != 0) &&
+			   ((msg->flags & DNS_MESSAGEFLAG_RA) != 0))
+		{
+			tflag |= R;
+		}
+
+		if (tflag == (Q|R)) {
+			printf("    type: RECURSIVE_QUERY\n");
+		} else if (tflag == Q) {
+			printf("    type: AUTH_QUERY\n");
+		} else if (tflag == R) {
+			printf("    type: RECURSIVE_RESPONSE\n");
+		} else {
+			printf("    type: AUTH_RESPONSE\n");
+		}
+
+		if (!isc_time_isepoch(&query->time_sent)) {
+			char tbuf[100];
+			isc_time_formatISO8601ms(&query->time_sent,
+						 tbuf, sizeof(tbuf));
+			printf("    query_time: !!timestamp %s\n", tbuf);
+		}
+
+		if (!isquery && !isc_time_isepoch(&query->time_recv)) {
+			char tbuf[100];
+			isc_time_formatISO8601ms(&query->time_recv,
+						 tbuf, sizeof(tbuf));
+			printf("    response_time: !!timestamp %s\n", tbuf);
+		}
+
+		printf("    message_size: %ub\n",
+		       isc_buffer_usedlength(msgbuf));
+
+		pf = isc_sockaddr_pf(&query->sockaddr);
+		if (pf == PF_INET || pf == PF_INET6) {
+			printf("    socket_family: %s\n",
+			       pf == PF_INET ? "INET" : "INET6");
+
+			printf("    socket_protocol: %s\n",
+			       query->lookup->tcp_mode ? "TCP" : "UDP");
+
+			sport = isc_sockaddr_getport(&query->sockaddr);
+			isc_sockaddr_format(&query->sockaddr,
+					    sockstr, sizeof(sockstr));
+			hash = strchr(sockstr, '#');
+			if (hash != NULL) {
+				*hash = '\0';
+			}
+			if (strcmp(sockstr, "::") == 0) {
+				strlcat(sockstr, "0", sizeof(sockstr));
+			}
+
+			printf("    response_address: %s\n", sockstr);
+			printf("    response_port: %u\n", sport);
+		}
+
+		if (query->sock != NULL &&
+		    isc_socket_getsockname(query->sock, &saddr)
+		      == ISC_R_SUCCESS)
+		{
+			sport = isc_sockaddr_getport(&saddr);
+			isc_sockaddr_format(&saddr, sockstr, sizeof(sockstr));
+			hash = strchr(sockstr, '#');
+			if (hash != NULL) {
+				*hash = '\0';
+			}
+			if (strcmp(sockstr, "::") == 0) {
+				strlcat(sockstr, "0", sizeof(sockstr));
+			}
+
+			printf("    query_address: %s\n", sockstr);
+			printf("    query_port: %u\n", sport);
+		}
+
+		printf("    %s:\n", isquery ? "query_message_data"
+					    : "response_message_data");
+		result = dns_message_headertotext(msg, style, flags, buf);
+	} else if (query->lookup->comments && !short_form) {
+		if (query->lookup->cmdline[0] != '\0' && printcmd) {
 			printf("; %s\n", query->lookup->cmdline);
-		if (msg == query->lookup->sendmsg)
+		}
+		if (msg == query->lookup->sendmsg) {
 			printf(";; Sending:\n");
-		else
+		} else {
 			printf(";; Got answer:\n");
+		}
 
 		if (headers) {
 			if (isdotlocal(msg)) {
@@ -686,8 +818,9 @@ buftoosmall:
 		}
 	}
 
-	if (headers && query->lookup->comments && !short_form)
+	if (headers && query->lookup->comments && !short_form && !yaml) {
 		printf("\n");
+	}
 
 	printf("%.*s", (int)isc_buffer_usedlength(buf),
 	       (char *)isc_buffer_base(buf));
@@ -1535,8 +1668,25 @@ plus_option(char *option, bool is_batchfile,
 		}
 		break;
 	case 'u':
-		FULLCHECK("unknownformat");
-		lookup->print_unknown_format = state;
+		switch (cmd[1]) {
+		case 'n':
+			switch (cmd[2]) {
+			case 'e':
+				FULLCHECK("unexpected");
+				lookup->accept_reply_unexpected_src = state;
+				break;
+			case 'k':
+				FULLCHECK("unknownformat");
+				lookup->print_unknown_format = state;
+				break;
+			default:
+				goto invalid_option;
+			}
+			break;
+		default:
+			goto invalid_option;
+		}
+
 		break;
 	case 'v':
 		FULLCHECK("vc");
@@ -1545,6 +1695,15 @@ plus_option(char *option, bool is_batchfile,
 			lookup->tcp_mode_set = true;
 		}
 		break;
+	case 'y': /* yaml */
+		FULLCHECK("yaml");
+		yaml = state;
+		if (state) {
+			printcmd = false;
+			lookup->stats = false;
+			lookup->rrcomments = -1;
+		}
+		break;
 	case 'z': /* zflag */
 		FULLCHECK("zflag");
 		lookup->zflag = state;
@@ -2257,8 +2416,67 @@ query_finished(void) {
 	}
 }
 
-void dig_setup(int argc, char **argv)
-{
+static void
+dig_error(const char *format, ...) {
+	va_list args;
+
+	if (yaml) {
+		printf("-\n");
+		printf("  type: DIG_ERROR\n");
+
+		/*
+		 * Print an indent before a literal block quote.
+		 * Note: this will break if used to print more than
+		 * one line of text as only the first line would be
+		 * indented.
+		 */
+		printf("  message: |\n");
+		printf("    ");
+	} else {
+		printf(";; ");
+	}
+
+	va_start(args, format);
+	vprintf(format, args);
+	va_end(args);
+
+	if (!yaml) {
+		printf("\n");
+	}
+}
+
+static void
+dig_warning(const char *format, ...) {
+	va_list args;
+
+	if (!yaml) {
+		printf(";; ");
+
+		va_start(args, format);
+		vprintf(format, args);
+		va_end(args);
+
+		printf("\n");
+	}
+}
+
+static void
+dig_comments(dig_lookup_t *lookup, const char *format, ...) {
+	va_list args;
+
+	if (lookup->comments && !yaml) {
+		printf(";; ");
+
+		va_start(args, format);
+		vprintf(format, args);
+		va_end(args);
+
+		printf("\n");
+	}
+}
+
+void
+dig_setup(int argc, char **argv) {
 	isc_result_t result;
 
 	ISC_LIST_INIT(lookup_list);
@@ -2272,6 +2490,9 @@ void dig_setup(int argc, char **argv)
 	dighost_received = received;
 	dighost_trying = trying;
 	dighost_shutdown = query_finished;
+	dighost_error = dig_error;
+	dighost_warning = dig_warning;
+	dighost_comments = dig_comments;
 
 	progname = argv[0];
 	preparse_args(argc, argv);

bin/dig/dig.docbook

@@ -1269,6 +1269,17 @@
 	  </listitem>
 	</varlistentry>
 
+	<varlistentry>
+	  <term><option>+[no]unexpected</option></term>
+	  <listitem>
+	    <para>
+	      Accept [do not accept] answers from unexpected sources.  By
+	      default, <command>dig</command> won't accept a reply from a
+	      source other than the one to which it sent the query.
+	    </para>
+	  </listitem>
+	</varlistentry>
+
 	<varlistentry>
 	  <term><option>+[no]unknownformat</option></term>
 	  <listitem>
@@ -1292,6 +1303,16 @@
 	  </listitem>
 	</varlistentry>
 
+	<varlistentry>
+	  <term><option>+[no]yaml</option></term>
+	  <listitem>
+	    <para>
+	      Print the responses (and, if <option>+qr</option> is in use,
+	      also the outgoing queries) in a detailed YAML format.
+	    </para>
+	  </listitem>
+	</varlistentry>
+
 	<varlistentry>
 	  <term><option>+[no]zflag</option></term>
 	  <listitem>

bin/dig/dig.html

@@ -1000,6 +1000,14 @@
 	      seconds, minutes, hours, days and weeks.  Implies +ttlid.
 	    </p>
 	  </dd>
+<dt><span class="term"><code class="option">+[no]unexpected</code></span></dt>
+<dd>
+	    <p>
+	      Accept [do not accept] answers from unexpected sources.  By
+	      default, <span class="command"><strong>dig</strong></span> won't accept a reply from a
+	      source other than the one to which it sent the query.
+	    </p>
+	  </dd>
 <dt><span class="term"><code class="option">+[no]unknownformat</code></span></dt>
 <dd>
 	    <p>
@@ -1017,6 +1025,13 @@
 	      stands for "virtual circuit".
 	    </p>
 	  </dd>
+<dt><span class="term"><code class="option">+[no]yaml</code></span></dt>
+<dd>
+	    <p>
+	      Print the responses (and, if <code class="option">+qr</code> is in use,
+	      also the outgoing queries) in a detailed YAML format.
+	    </p>
+	  </dd>
 <dt><span class="term"><code class="option">+[no]zflag</code></span></dt>
 <dd>
 	    <p>

bin/dig/dighost.c

@@ -112,7 +112,8 @@ bool
 	showsearch = false,
 	is_dst_up = false,
 	keep_open = false,
-	verbose = false;
+	verbose = false,
+	yaml = false;
 in_port_t port = 53;
 unsigned int timeout = 0;
 unsigned int extrabytes;
@@ -190,14 +191,48 @@ dig_lookup_t *current_lookup = NULL;
 		     "isc_mutex_unlock");\
 }
 
+static void
+default_warnerr(const char *format, ...) {
+	va_list args;
+
+	printf(";; ");
+	va_start(args, format);
+	vprintf(format, args);
+	va_end(args);
+	printf("\n");
+};
+
+static void
+default_comments(dig_lookup_t *lookup, const char *format, ...) {
+	va_list args;
+
+	if (lookup->comments) {
+		printf(";; ");
+		va_start(args, format);
+		vprintf(format, args);
+		va_end(args);
+		printf("\n");
+	}
+};
+
 /* dynamic callbacks */
 
 isc_result_t
-(*dighost_printmessage)(dig_query_t *query, dns_message_t *msg,
-	bool headers);
+(*dighost_printmessage)(dig_query_t *query, const isc_buffer_t *msgbuf,
+			dns_message_t *msg, bool headers);
 
 void
-(*dighost_received)(unsigned int bytes, isc_sockaddr_t *from, dig_query_t *query);
+(*dighost_error)(const char *format, ...) = default_warnerr;
+
+void
+(*dighost_warning)(const char *format, ...) = default_warnerr;
+
+void
+(*dighost_comments)(dig_lookup_t *lookup, const char *format, ...) = default_comments;
+
+void
+(*dighost_received)(unsigned int bytes, isc_sockaddr_t *from,
+		    dig_query_t *query);
 
 void
 (*dighost_trying)(char *frm, dig_lookup_t *lookup);
@@ -617,6 +652,7 @@ make_empty_lookup(void) {
 	looknew->ttlunits = false;
 	looknew->expandaaaa = false;
 	looknew->qr = false;
+	looknew->accept_reply_unexpected_src = false;
 #ifdef HAVE_LIBIDN2
 	looknew->idnin = isatty(1)?(getenv("IDN_DISABLE") == NULL):false;
 	looknew->idnout = looknew->idnin;
@@ -762,6 +798,8 @@ clone_lookup(dig_lookup_t *lookold, bool servers) {
 	looknew->ttlunits = lookold->ttlunits;
 	looknew->expandaaaa = lookold->expandaaaa;
 	looknew->qr = lookold->qr;
+	looknew->accept_reply_unexpected_src =
+		lookold->accept_reply_unexpected_src;
 	looknew->idnin = lookold->idnin;
 	looknew->idnout = lookold->idnout;
 	looknew->udpsize = lookold->udpsize;
@@ -1343,7 +1381,7 @@ setup_libs(void) {
 
 	isc_log_setdebuglevel(lctx, 0);
 
-	result = isc_taskmgr_create(mctx, 1, 0, &taskmgr);
+	result = isc_taskmgr_create(mctx, 1, 0, NULL, &taskmgr);
 	check_result(result, "isc_taskmgr_create");
 
 	result = isc_task_create(taskmgr, 0, &global_task);
@@ -1379,6 +1417,7 @@ typedef struct dig_ednsoptname {
 } dig_ednsoptname_t;
 
 dig_ednsoptname_t optnames[] = {
+	{ 1, "LLQ" },		/* draft-sekar-dns-llq */
 	{ 3, "NSID" },		/* RFC 5001 */
 	{ 5, "DAU" },		/* RFC 6975 */
 	{ 6, "DHU" },		/* RFC 6975 */
@@ -1752,12 +1791,15 @@ followup_lookup(dns_message_t *msg, dig_query_t *query, dns_section_t section)
 			namereln = dns_name_fullcompare(name, domain,
 							&order, &nlabels);
 			if (namereln == dns_namereln_equal) {
-				if (!horizontal)
-					printf(";; BAD (HORIZONTAL) REFERRAL\n");
+				if (!horizontal) {
+					dighost_warning("BAD (HORIZONTAL) "
+							"REFERRAL");
+				}
 				horizontal = true;
 			} else if (namereln != dns_namereln_subdomain) {
-				if (!bad)
-					printf(";; BAD REFERRAL\n");
+				if (!bad) {
+					dighost_warning( "BAD REFERRAL");
+				}
 				bad = true;
 				continue;
 			}
@@ -2501,6 +2543,9 @@ setup_lookup(dig_lookup_t *lookup) {
 				COMMSIZE);
 		query->sendbuf = lookup->renderbuf;
 
+		isc_time_settoepoch(&query->time_sent);
+		isc_time_settoepoch(&query->time_recv);
+
 		ISC_LINK_INIT(query, clink);
 		ISC_LINK_INIT(query, link);
 
@@ -2509,16 +2554,6 @@ setup_lookup(dig_lookup_t *lookup) {
 		ISC_LIST_ENQUEUE(lookup->q, query, link);
 	}
 
-	/* XXX qrflag, print_query, etc... */
-	if (!ISC_LIST_EMPTY(lookup->q) && lookup->qr) {
-		extrabytes = 0;
-		dighost_printmessage(ISC_LIST_HEAD(lookup->q),
-				     lookup->sendmsg, true);
-		if (lookup->stats) {
-			printf(";; QUERY SIZE: %u\n\n",
-			       isc_buffer_usedlength(&lookup->renderbuf));
-		}
-	}
 	return (true);
 }
 
@@ -2635,10 +2670,6 @@ force_timeout(dig_query_t *query) {
 	event = isc_event_allocate(mctx, query, ISC_TIMEREVENT_IDLE,
 				   connect_timeout, query,
 				   sizeof(isc_event_t));
-	if (event == NULL) {
-		fatal("isc_event_allocate: %s",
-		      isc_result_totext(ISC_R_NOMEMORY));
-	}
 	isc_task_send(global_task, &event);
 
 	/*
@@ -2690,7 +2721,7 @@ send_tcp_connect(dig_query_t *query) {
 
 		isc_netaddr_fromsockaddr(&netaddr, &query->sockaddr);
 		isc_netaddr_format(&netaddr, buf, sizeof(buf));
-		printf(";; Skipping mapped address '%s'\n", buf);
+		dighost_warning("Skipping mapped address '%s'", buf);
 
 		query->waiting_connect = false;
 		if (ISC_LINK_LINKED(query, link))
@@ -2700,7 +2731,7 @@ send_tcp_connect(dig_query_t *query) {
 		l = query->lookup;
 		clear_query(query);
 		if (next == NULL) {
-			printf(";; No acceptable nameservers\n");
+			dighost_warning("No acceptable nameservers");
 			check_next_lookup(l);
 			return;
 		}
@@ -2761,6 +2792,14 @@ send_tcp_connect(dig_query_t *query) {
 	}
 }
 
+static void
+print_query_size(dig_query_t *query) {
+	if (!yaml) {
+		printf(";; QUERY SIZE: %u\n\n",
+		       isc_buffer_usedlength(&query->lookup->renderbuf));
+	}
+}
+
 /*%
  * Send a UDP packet to the remote nameserver, possible starting the
  * recv action as well.  Also make sure that the timer is running and
@@ -2799,13 +2838,12 @@ send_udp(dig_query_t *query) {
 
 			isc_netaddr_fromsockaddr(&netaddr, &query->sockaddr);
 			isc_netaddr_format(&netaddr, buf, sizeof(buf));
-			printf(";; Skipping mapped address '%s'\n", buf);
-
+			dighost_warning("Skipping mapped address '%s'", buf);
 			next = ISC_LIST_NEXT(query, link);
 			l = query->lookup;
 			clear_query(query);
 			if (next == NULL) {
-				printf(";; No acceptable nameservers\n");
+				dighost_warning("No acceptable nameservers");
 				check_next_lookup(l);
 			} else {
 				send_udp(next);
@@ -2856,6 +2894,17 @@ send_udp(dig_query_t *query) {
 				    sevent, ISC_SOCKFLAG_NORETRY);
 	check_result(result, "isc_socket_sendto2");
 	sendcount++;
+
+	/* XXX qrflag, print_query, etc... */
+	if (!ISC_LIST_EMPTY(query->lookup->q) && query->lookup->qr) {
+		extrabytes = 0;
+		dighost_printmessage(ISC_LIST_HEAD(query->lookup->q),
+				     &query->lookup->renderbuf,
+				     query->lookup->sendmsg, true);
+		if (query->lookup->stats) {
+			print_query_size(query);
+		}
+	}
 }
 
 /*%
@@ -2955,11 +3004,11 @@ connect_timeout(isc_task_t *task, isc_event_t *event) {
 			isc_netaddr_fromsockaddr(&netaddr, &query->sockaddr);
 			isc_netaddr_format(&netaddr, buf, sizeof(buf));
 
-			printf(";; no response from %s\n", buf);
+			dighost_error("no response from %s\n", buf);
 		} else {
 			fputs(l->cmdline, stdout);
-			printf(";; connection timed out; no servers could be "
-			       "reached\n");
+			dighost_error("connection timed out; "
+				      "no servers could be reached\n");
 		}
 		cancel_lookup(l);
 		check_next_lookup(l);
@@ -3031,8 +3080,8 @@ tcp_length_done(isc_task_t *task, isc_event_t *event) {
 		char sockstr[ISC_SOCKADDR_FORMATSIZE];
 		isc_sockaddr_format(&query->sockaddr, sockstr,
 				    sizeof(sockstr));
-		printf(";; communications error to %s: %s\n",
-		       sockstr, isc_result_totext(sevent->result));
+		dighost_error("communications error to %s: %s\n",
+			      sockstr, isc_result_totext(sevent->result));
 		if (keep != NULL)
 			isc_socket_detach(&keep);
 		l = query->lookup;
@@ -3131,6 +3180,17 @@ launch_next_query(dig_query_t *query, bool include_question) {
 		check_result(result, "isc_socket_send");
 		sendcount++;
 		debug("sendcount=%d", sendcount);
+
+		/* XXX qrflag, print_query, etc... */
+		if (!ISC_LIST_EMPTY(query->lookup->q) && query->lookup->qr) {
+			extrabytes = 0;
+			dighost_printmessage(ISC_LIST_HEAD(query->lookup->q),
+					     &query->lookup->renderbuf,
+					     query->lookup->sendmsg, true);
+			if (query->lookup->stats) {
+				print_query_size(query);
+			}
+		}
 	}
 	query->waiting_connect = false;
 #if 0
@@ -3170,11 +3230,12 @@ connect_done(isc_task_t *task, isc_event_t *event) {
 	if (sevent->result == ISC_R_CANCELED) {
 		debug("in cancel handler");
 		isc_sockaddr_format(&query->sockaddr, sockstr, sizeof(sockstr));
-		if (query->timedout)
-			printf(";; Connection to %s(%s) for %s failed: %s.\n",
-			       sockstr, query->servname,
-			       query->lookup->textname,
-			       isc_result_totext(ISC_R_TIMEDOUT));
+		if (query->timedout) {
+			dighost_warning("Connection to %s(%s) for %s failed: "
+					"%s.", sockstr, query->servname,
+					query->lookup->textname,
+					isc_result_totext(ISC_R_TIMEDOUT));
+		}
 		isc_socket_detach(&query->sock);
 		INSIST(sockcount > 0);
 		sockcount--;
@@ -3192,11 +3253,12 @@ connect_done(isc_task_t *task, isc_event_t *event) {
 		debug("unsuccessful connection: %s",
 		      isc_result_totext(sevent->result));
 		isc_sockaddr_format(&query->sockaddr, sockstr, sizeof(sockstr));
-		if (sevent->result != ISC_R_CANCELED)
-			printf(";; Connection to %s(%s) for %s failed: "
-			       "%s.\n", sockstr,
-			       query->servname, query->lookup->textname,
-			       isc_result_totext(sevent->result));
+		if (sevent->result != ISC_R_CANCELED) {
+			dighost_warning("Connection to %s(%s) for %s failed: "
+					"%s.", sockstr, query->servname,
+					 query->lookup->textname,
+					 isc_result_totext(sevent->result));
+		}
 		isc_socket_detach(&query->sock);
 		INSIST(sockcount > 0);
 		sockcount--;
@@ -3404,12 +3466,12 @@ process_cookie(dig_lookup_t *l, dns_message_t *msg,
 		if (isc_safe_memequal(isc_buffer_current(optbuf), sent, 8)) {
 			msg->cc_ok = 1;
 		} else {
-			printf(";; Warning: Client COOKIE mismatch\n");
+			dighost_warning("Warning: Client COOKIE mismatch");
 			msg->cc_bad = 1;
 			copy = false;
 		}
 	} else {
-		printf(";; Warning: COOKIE bad token (too short)\n");
+		dighost_warning("Warning: COOKIE bad token (too short)");
 		msg->cc_bad = 1;
 		copy = false;
 	}
@@ -3505,7 +3567,6 @@ recv_done(isc_task_t *task, isc_event_t *event) {
 
 	query = event->ev_arg;
 	TIME_NOW(&query->time_recv);
-	debug("lookup=%p, query=%p", query->lookup, query);
 
 	l = query->lookup;
 
@@ -3534,8 +3595,8 @@ recv_done(isc_task_t *task, isc_event_t *event) {
 			debug("in recv cancel handler");
 			query->waiting_connect = false;
 		} else {
-			printf(";; communications error: %s\n",
-			       isc_result_totext(sevent->result));
+			dighost_error("communications error: %s\n",
+				      isc_result_totext(sevent->result));
 			if (keep != NULL)
 				isc_socket_detach(&keep);
 			isc_socket_detach(&query->sock);
@@ -3582,9 +3643,11 @@ recv_done(isc_task_t *task, isc_event_t *event) {
 			sizeof(buf1));
 			isc_sockaddr_format(&query->sockaddr, buf2,
 			sizeof(buf2));
-			printf(";; reply from unexpected source: %s,"
-			" expected %s\n", buf1, buf2);
-			match = false;
+			dighost_warning("reply from unexpected source: %s,"
+					" expected %s\n", buf1, buf2);
+			if (!l->accept_reply_unexpected_src) {
+				match = false;
+			}
 		}
 	}
 
@@ -3594,19 +3657,22 @@ recv_done(isc_task_t *task, isc_event_t *event) {
 		if (l->tcp_mode) {
 			bool fail = true;
 			if (result == ISC_R_SUCCESS) {
-				if (!query->first_soa_rcvd ||
-				     query->warn_id)
-					printf(";; %s: ID mismatch: "
-					       "expected ID %u, got %u\n",
-					       query->first_soa_rcvd ?
-					       "WARNING" : "ERROR",
-					       l->sendmsg->id, id);
+				if ((!query->first_soa_rcvd || query->warn_id))
+				{
+					dighost_warning("%s: ID mismatch: "
+							"expected ID %u, got "
+							"%u",
+							query->first_soa_rcvd ?
+							"WARNING" : "ERROR",
+							l->sendmsg->id, id);
+				}
 				if (query->first_soa_rcvd)
 					fail = false;
 				query->warn_id = false;
-			} else
-				printf(";; ERROR: short "
-				       "(< header size) message\n");
+			} else {
+				dighost_warning("ERROR: short (< header size) "
+						"message");
+			}
 			if (fail) {
 				isc_event_free(&event);
 				clear_query(query);
@@ -3616,16 +3682,18 @@ recv_done(isc_task_t *task, isc_event_t *event) {
 				return;
 			}
 			match = true;
-		} else if (result == ISC_R_SUCCESS)
-			printf(";; Warning: ID mismatch: "
-			       "expected ID %u, got %u\n", l->sendmsg->id, id);
-		else
-			printf(";; Warning: short "
-			       "(< header size) message received\n");
+		} else if (result == ISC_R_SUCCESS) {
+			dighost_warning("Warning: ID mismatch: expected ID %u,"
+					" got %u", l->sendmsg->id, id);
+		} else {
+			dighost_warning("Warning: short (< header size) "
+					"message received");
+		}
 	}
 
-	if (result == ISC_R_SUCCESS && (msgflags & DNS_MESSAGEFLAG_QR) == 0)
-		printf(";; Warning: query response not set\n");
+	if (result == ISC_R_SUCCESS && (msgflags & DNS_MESSAGEFLAG_QR) == 0) {
+		dighost_warning("Warning: query response not set");
+	}
 
 	if (!match)
 		goto udp_mismatch;
@@ -3659,13 +3727,16 @@ recv_done(isc_task_t *task, isc_event_t *event) {
 	}
 	result = dns_message_parse(msg, &b, parseflags);
 	if (result == DNS_R_RECOVERABLE) {
-		printf(";; Warning: Message parser reports malformed "
-		       "message packet.\n");
+		dighost_warning("Warning: Message parser reports malformed "
+				"message packet.");
 		result = ISC_R_SUCCESS;
 	}
 	if (result != ISC_R_SUCCESS) {
-		printf(";; Got bad packet: %s\n", isc_result_totext(result));
-		hex_dump(&b);
+		if (!yaml) {
+			printf(";; Got bad packet: %s\n",
+			       isc_result_totext(result));
+			hex_dump(&b);
+		}
 		query->waiting_connect = false;
 		dns_message_destroy(&msg);
 		isc_event_free(&event);
@@ -3702,9 +3773,10 @@ recv_done(isc_task_t *task, isc_event_t *event) {
 					dns_rdataclass_format(rdataset->rdclass,
 							      classbuf,
 							      sizeof(classbuf));
-					printf(";; Question section mismatch: "
-					       "got %s/%s/%s\n",
-					       namestr, typebuf, classbuf);
+					dighost_warning(";; Question section "
+							"mismatch: got "
+							"%s/%s/%s", namestr,
+							typebuf, classbuf);
 					match = false;
 				}
 			}
@@ -3727,9 +3799,8 @@ recv_done(isc_task_t *task, isc_event_t *event) {
 		/*
 		 * Add minimum EDNS version required checks here if needed.
 		 */
-		if (l->comments)
-			printf(";; BADVERS, retrying with EDNS version %u.\n",
-			       (unsigned int)newedns);
+		dighost_comments(l, "BADVERS, retrying with EDNS version %u.",
+				 (unsigned int)newedns);
 		l->edns = newedns;
 		n = requeue_lookup(l, true);
 		if (l->trace && l->trace_root)
@@ -3746,8 +3817,7 @@ recv_done(isc_task_t *task, isc_event_t *event) {
 	    !l->ignore && !l->tcp_mode) {
 		if (l->cookie == NULL && l->sendcookie && msg->opt != NULL)
 			process_opt(l, msg);
-		if (l->comments)
-			printf(";; Truncated, retrying in TCP mode.\n");
+		dighost_comments(l, "Truncated, retrying in TCP mode.");
 		n = requeue_lookup(l, true);
 		n->tcp_mode = true;
 		if (l->trace && l->trace_root)
@@ -3764,9 +3834,9 @@ recv_done(isc_task_t *task, isc_event_t *event) {
 	    l->sendcookie && l->badcookie) {
 		process_opt(l, msg);
 		if (msg->cc_ok) {
-			if (l->comments)
-				printf(";; BADCOOKIE, retrying%s.\n",
-				       l->seenbadcookie ? " in TCP mode" : "");
+			dighost_comments(l, "BADCOOKIE, retrying%s.",
+					 l->seenbadcookie ?
+					 " in TCP mode" : "");
 			n = requeue_lookup(l, true);
 			if (l->seenbadcookie)
 				n->tcp_mode = true;
@@ -3803,13 +3873,12 @@ recv_done(isc_task_t *task, isc_event_t *event) {
 		 */
 		if ((ISC_LIST_HEAD(l->q) != query) ||
 		    (ISC_LIST_NEXT(query, link) != NULL)) {
-			if (l->comments)
-				printf(";; Got %s from %s, "
-				       "trying next server\n",
-				       msg->rcode == dns_rcode_servfail ?
-				       "SERVFAIL reply" :
-				       "recursion not available",
-				       query->servname);
+			dighost_comments(l, "Got %s from %s, trying next "
+					 "server",
+					 msg->rcode == dns_rcode_servfail ?
+					 "SERVFAIL reply" :
+					 "recursion not available",
+					 query->servname);
 			clear_query(query);
 			check_next_lookup(l);
 			dns_message_destroy(&msg);
@@ -3822,8 +3891,8 @@ recv_done(isc_task_t *task, isc_event_t *event) {
 	if (tsigkey != NULL) {
 		result = dns_tsig_verify(&b, msg, NULL, NULL);
 		if (result != ISC_R_SUCCESS) {
-			printf(";; Couldn't verify signature: %s\n",
-			       isc_result_totext(result));
+			dighost_warning("Couldn't verify signature: %s",
+					isc_result_totext(result));
 			validated = false;
 		}
 		l->tsigctx = msg->tsigctx;
@@ -3874,7 +3943,8 @@ recv_done(isc_task_t *task, isc_event_t *event) {
 	if (!done_process_opt) {
 		if (l->cookie != NULL) {
 			if (msg->opt == NULL) {
-				printf(";; expected opt record in response\n");
+				dighost_warning("expected opt record in "
+						"response");
 			} else {
 				process_opt(l, msg);
 			}
@@ -3886,19 +3956,19 @@ recv_done(isc_task_t *task, isc_event_t *event) {
 		if (msg->rcode == dns_rcode_nxdomain &&
 		    (l->origin != NULL || l->need_search)) {
 			if (!next_origin(query->lookup) || showsearch) {
-				dighost_printmessage(query, msg, true);
+				dighost_printmessage(query, &b, msg, true);
 				dighost_received(isc_buffer_usedlength(&b),
 						 &sevent->address, query);
 			}
 		} else if (!l->trace && !l->ns_search_only) {
-			dighost_printmessage(query, msg, true);
+			dighost_printmessage(query, &b, msg, true);
 		} else if (l->trace) {
 			int nl = 0;
 			int count = msg->counts[DNS_SECTION_ANSWER];
 
 			debug("in TRACE code");
 			if (!l->ns_search_only)
-				dighost_printmessage(query, msg, true);
+				dighost_printmessage(query, &b, msg, true);
 
 			l->rdtype = l->qrdtype;
 			if (l->trace_root || (l->ns_search_only && count > 0)) {
@@ -3929,7 +3999,7 @@ recv_done(isc_task_t *task, isc_event_t *event) {
 				l->trace_root = false;
 				usesearch = false;
 			} else {
-				dighost_printmessage(query, msg, true);
+				dighost_printmessage(query, &b, msg, true);
 			}
 		}
 	}

bin/dig/host.c

@@ -400,13 +400,16 @@ chase_cnamechain(dns_message_t *msg, dns_name_t *qname) {
 }
 
 static isc_result_t
-printmessage(dig_query_t *query, dns_message_t *msg, bool headers) {
+printmessage(dig_query_t *query, const isc_buffer_t *msgbuf,
+	     dns_message_t *msg, bool headers)
+{
 	bool did_flag = false;
 	dns_rdataset_t *opt, *tsig = NULL;
 	const dns_name_t *tsigname;
 	isc_result_t result = ISC_R_SUCCESS;
 	int force_error;
 
+	UNUSED(msgbuf);
 	UNUSED(headers);
 
 	/*

bin/dig/include/dig/dig.h

@@ -141,7 +141,9 @@ struct dig_lookup {
 		idnin,
 		idnout,
 		expandaaaa,
-		qr;
+		qr,
+		accept_reply_unexpected_src;  /*%  print replies from unexpected
+						   sources. */
 	char textname[MXNAME]; /*% Name we're going to be looking up */
 	char cmdline[MXNAME];
 	dns_rdatatype_t rdtype;
@@ -250,7 +252,7 @@ extern dig_searchlistlist_t search_list;
 extern unsigned int extrabytes;
 
 extern bool check_ra, have_ipv4, have_ipv6, specified_source,
-	usesearch, showsearch;
+	usesearch, showsearch, yaml;
 extern in_port_t port;
 extern unsigned int timeout;
 extern isc_mem_t *mctx;
@@ -380,13 +382,34 @@ set_search_domain(char *domain);
  * then assigned to the appropriate function pointer
  */
 extern isc_result_t
-(*dighost_printmessage)(dig_query_t *query, dns_message_t *msg, bool headers);
+(*dighost_printmessage)(dig_query_t *query, const isc_buffer_t *msgbuf,
+			dns_message_t *msg, bool headers);
+
+/*
+ * Print an error message in the appropriate format.
+ */
+extern void
+(*dighost_error)(const char *format, ...);
+
+/*
+ * Print a warning message in the appropriate format.
+ */
+extern void
+(*dighost_warning)(const char *format, ...);
+
+/*
+ * Print a comment in the appropriate format.
+ */
+extern void
+(*dighost_comments)(dig_lookup_t *lookup, const char *format, ...);
+
 /*%<
  * Print the final result of the lookup.
  */
 
 extern void
-(*dighost_received)(unsigned int bytes, isc_sockaddr_t *from, dig_query_t *query);
+(*dighost_received)(unsigned int bytes, isc_sockaddr_t *from,
+		    dig_query_t *query);
 /*%<
  * Print a message about where and when the response
  * was received from, like the final comment in the

bin/dig/nslookup.c

@@ -429,16 +429,21 @@ chase_cnamechain(dns_message_t *msg, dns_name_t *qname) {
 }
 
 static isc_result_t
-printmessage(dig_query_t *query, dns_message_t *msg, bool headers) {
+printmessage(dig_query_t *query, const isc_buffer_t *msgbuf,
+	     dns_message_t *msg, bool headers)
+{
 	char servtext[ISC_SOCKADDR_FORMATSIZE];
 
+	UNUSED(msgbuf);
+
 	/* I've we've gotten this far, we've reached a server. */
 	query_error = 0;
 
 	debug("printmessage()");
 
 	if(!default_lookups || query->lookup->rdtype == dns_rdatatype_a) {
-		isc_sockaddr_format(&query->sockaddr, servtext, sizeof(servtext));
+		isc_sockaddr_format(&query->sockaddr, servtext,
+				    sizeof(servtext));
 		printf("Server:\t\t%s\n", query->userarg);
 		printf("Address:\t%s\n", servtext);
 

bin/dnssec/dnssec-signzone.c

@@ -1570,8 +1570,6 @@ assignwork(isc_task_t *task, isc_task_t *worker) {
 	sevent = (sevent_t *)
 		 isc_event_allocate(mctx, task, SIGNER_EVENT_WORK,
 				    sign, NULL, sizeof(sevent_t));
-	if (sevent == NULL)
-		fatal("failed to allocate event\n");
 
 	sevent->node = node;
 	sevent->fname = fname;
@@ -1627,8 +1625,6 @@ sign(isc_task_t *task, isc_event_t *event) {
 	wevent = (sevent_t *)
 		 isc_event_allocate(mctx, task, SIGNER_EVENT_WRITE,
 				    writenode, NULL, sizeof(sevent_t));
-	if (wevent == NULL)
-		fatal("failed to allocate event\n");
 	wevent->node = node;
 	wevent->fname = fname;
 	isc_task_send(master, ISC_EVENT_PTR(&wevent));
@@ -3802,7 +3798,7 @@ main(int argc, char *argv[]) {
 	print_time(outfp);
 	print_version(outfp);
 
-	result = isc_taskmgr_create(mctx, ntasks, 0, &taskmgr);
+	result = isc_taskmgr_create(mctx, ntasks, 0, NULL, &taskmgr);
 	if (result != ISC_R_SUCCESS)
 		fatal("failed to create task manager: %s",
 		      isc_result_totext(result));

bin/named/config.c

@@ -855,6 +855,7 @@ named_config_getipandkeylist(const cfg_obj_t *config, const cfg_obj_t *list,
 		isc_mem_put(mctx, stack, stackcount * sizeof(*stack));
 
 	INSIST(keycount == addrcount);
+	INSIST(keycount == dscpcount);
 
 	ipkl->addrs = addrs;
 	ipkl->dscps = dscps;

bin/named/include/named/globals.h

@@ -19,6 +19,7 @@
 #include <isc/rwlock.h>
 #include <isc/log.h>
 #include <isc/net.h>
+#include <isc/netmgr.h>
 
 #include <isccfg/aclconf.h>
 #include <isccfg/cfg.h>
@@ -62,6 +63,7 @@ EXTERN bool		named_g_run_done	INIT(false);
  */
 EXTERN isc_timermgr_t *		named_g_timermgr	INIT(NULL);
 EXTERN isc_socketmgr_t *	named_g_socketmgr	INIT(NULL);
+EXTERN isc_nm_t *		named_g_nm		INIT(NULL);
 EXTERN cfg_parser_t *		named_g_parser		INIT(NULL);
 EXTERN cfg_parser_t *		named_g_addparser	INIT(NULL);
 EXTERN const char *		named_g_version		INIT(VERSION);

bin/named/main.c

@@ -24,6 +24,7 @@
 #include <isc/file.h>
 #include <isc/hash.h>
 #include <isc/httpd.h>
+#include <isc/netmgr.h>
 #include <isc/os.h>
 #include <isc/platform.h>
 #include <isc/print.h>
@@ -123,7 +124,6 @@ static int		maxudp = 0;
 /*
  * -T options:
  */
-static bool clienttest = false;
 static bool dropedns = false;
 static bool ednsformerr = false;
 static bool ednsnotimp = false;
@@ -352,7 +352,7 @@ save_command_line(int argc, char *argv[]) {
 		*dst++ = ' ';
 
 		while (*src != '\0' && dst < eob) {
-			if (isalnum(*src) ||
+			if (isalnum(*src) || *src == ',' ||
 			    *src == '-' || *src == '_' ||
 			    *src == '.' || *src == '/')
 			{
@@ -602,17 +602,12 @@ parse_T_opt(char *option) {
 	/*
 	 * force the server to behave (or misbehave) in
 	 * specified ways for testing purposes.
-	 *
-	 * clienttest: make clients single shot with their
-	 * 	       own memory context.
-	 * delay=xxxx: delay client responses by xxxx ms to
+	 *	 * delay=xxxx: delay client responses by xxxx ms to
 	 *	       simulate remote servers.
 	 * dscp=x:     check that dscp values are as
 	 * 	       expected and assert otherwise.
 	 */
-	if (!strcmp(option, "clienttest")) {
-		clienttest = true;
-	} else if (!strncmp(option, "delay=", 6)) {
+	if (!strncmp(option, "delay=", 6)) {
 		delay = atoi(option + 6);
 	} else if (!strcmp(option, "dropedns")) {
 		dropedns = true;
@@ -646,6 +641,9 @@ parse_T_opt(char *option) {
 		maxudp = 1460;
 	} else if (!strncmp(option, "maxudp=", 7)) {
 		maxudp = atoi(option + 7);
+		if (maxudp <= 0) {
+			named_main_earlyfatal("bad maxudp");
+		}
 	} else if (!strncmp(option, "mkeytimers=", 11)) {
 		p = strtok_r(option + 11, "/", &last);
 		if (p == NULL) {
@@ -874,8 +872,15 @@ create_managers(void) {
 		      "using %u UDP listener%s per interface",
 		      named_g_udpdisp, named_g_udpdisp == 1 ? "" : "s");
 
+	named_g_nm = isc_nm_start(named_g_mctx, named_g_cpus);
+	if (named_g_nm == NULL) {
+		UNEXPECTED_ERROR(__FILE__, __LINE__,
+				"isc_nm_start() failed");
+		return (ISC_R_UNEXPECTED);
+	}
+
 	result = isc_taskmgr_create(named_g_mctx, named_g_cpus, 0,
-				    &named_g_taskmgr);
+				    named_g_nm, &named_g_taskmgr);
 	if (result != ISC_R_SUCCESS) {
 		UNEXPECTED_ERROR(__FILE__, __LINE__,
 				 "isc_taskmgr_create() failed: %s",
@@ -918,6 +923,7 @@ destroy_managers(void) {
 	isc_taskmgr_destroy(&named_g_taskmgr);
 	isc_timermgr_destroy(&named_g_timermgr);
 	isc_socketmgr_destroy(&named_g_socketmgr);
+	isc_nm_shutdown(&named_g_nm);
 }
 
 static void
@@ -1231,8 +1237,6 @@ setup(void) {
 	/*
 	 * Modify server context according to command line options
 	 */
-	if (clienttest)
-		ns_server_setoption(sctx, NS_SERVER_CLIENTTEST, true);
 	if (disable4)
 		ns_server_setoption(sctx, NS_SERVER_DISABLE4, true);
 	if (disable6)

bin/named/server.c

@@ -2827,8 +2827,6 @@ catz_create_chg_task(dns_catz_entry_t *entry, dns_catz_zone_t *origin,
 	event = (catz_chgzone_event_t *) isc_event_allocate(view->mctx, origin,
 							    type, action, NULL,
 							    sizeof(*event));
-	if (event == NULL)
-		return (ISC_R_NOMEMORY);
 
 	event->cbd = (catz_cb_data_t *) udata;
 	event->entry = NULL;
@@ -9401,6 +9399,7 @@ run_server(isc_task_t *task, isc_event_t *event) {
 	CHECKFATAL(ns_interfacemgr_create(named_g_mctx, server->sctx,
 					  named_g_taskmgr, named_g_timermgr,
 					  named_g_socketmgr,
+					  named_g_nm,
 					  named_g_dispatchmgr,
 					  server->task, named_g_udpdisp, geoip,
 					  &server->interfacemgr),
@@ -9463,6 +9462,10 @@ shutdown_server(isc_task_t *task, isc_event_t *event) {
 	UNUSED(task);
 	INSIST(task == server->task);
 
+	/* We need to shutdown the interface before going exclusive (and
+	 * pausing netmgr. */
+	ns_interfacemgr_shutdown(server->interfacemgr);
+
 	result = isc_task_beginexclusive(server->task);
 	RUNTIME_CHECK(result == ISC_R_SUCCESS);
 
@@ -9512,7 +9515,6 @@ shutdown_server(isc_task_t *task, isc_event_t *event) {
 	isc_timer_detach(&server->pps_timer);
 	isc_timer_detach(&server->tat_timer);
 
-	ns_interfacemgr_shutdown(server->interfacemgr);
 	ns_interfacemgr_detach(&server->interfacemgr);
 
 	dns_dispatchmgr_destroy(&named_g_dispatchmgr);
@@ -11488,7 +11490,7 @@ delete_keynames(dns_tsig_keyring_t *ring, char *target,
 	origin = dns_fixedname_initname(&fixedorigin);
 
  again:
-	dns_rbtnodechain_init(&chain, ring->mctx);
+	dns_rbtnodechain_init(&chain);
 	result = dns_rbtnodechain_first(&chain, ring->keys, &foundname,
 					origin);
 	if (result == ISC_R_NOTFOUND) {
@@ -11604,7 +11606,7 @@ list_keynames(dns_view_t *view, dns_tsig_keyring_t *ring, isc_buffer_t **text,
 
 	dns_name_init(&foundname, NULL);
 	origin = dns_fixedname_initname(&fixedorigin);
-	dns_rbtnodechain_init(&chain, ring->mctx);
+	dns_rbtnodechain_init(&chain);
 	result = dns_rbtnodechain_first(&chain, ring->keys, &foundname,
 					origin);
 	if (result == ISC_R_NOTFOUND) {
@@ -13565,8 +13567,6 @@ named_server_delzone(named_server_t *server, isc_lex_t *lex,
 	dns_zone_attach(zone, &dz->zone);
 	dzevent = isc_event_allocate(named_g_mctx, server, NAMED_EVENT_DELZONE,
 				     rmzone, dz, sizeof(isc_event_t));
-	if (dzevent == NULL)
-		CHECK(ISC_R_NOMEMORY);
 
 	dns_zone_gettask(zone, &task);
 	isc_task_send(task, &dzevent);

bin/nsupdate/nsupdate.c

@@ -906,7 +906,7 @@ setup_system(void) {
 	result = isc_timermgr_create(gmctx, &timermgr);
 	check_result(result, "dns_timermgr_create");
 
-	result = isc_taskmgr_create(gmctx, 1, 0, &taskmgr);
+	result = isc_taskmgr_create(gmctx, 1, 0, NULL, &taskmgr);
 	check_result(result, "isc_taskmgr_create");
 
 	result = isc_task_create(taskmgr, 0, &global_task);

bin/rndc/rndc.c

@@ -932,7 +932,8 @@ main(int argc, char **argv) {
 
 	DO("create memory context", isc_mem_create(0, 0, &rndc_mctx));
 	DO("create socket manager", isc_socketmgr_create(rndc_mctx, &socketmgr));
-	DO("create task manager", isc_taskmgr_create(rndc_mctx, 1, 0, &taskmgr));
+	DO("create task manager",
+	   isc_taskmgr_create(rndc_mctx, 1, 0, NULL, &taskmgr));
 	DO("create task", isc_task_create(taskmgr, 0, &task));
 
 	DO("create logging context", isc_log_create(rndc_mctx, &log, &logconfig));

bin/tests/optional/adb_test.c

@@ -144,7 +144,7 @@ create_managers(void) {
 	isc_result_t result;
 
 	taskmgr = NULL;
-	result = isc_taskmgr_create(mctx, 5, 0, &taskmgr);
+	result = isc_taskmgr_create(mctx, 5, 0, NULL, &taskmgr);
 	check_result(result, "isc_taskmgr_create");
 
 	timermgr = NULL;

bin/tests/optional/byaddr_test.c

@@ -112,7 +112,7 @@ main(int argc, char *argv[]) {
 	}
 
 	taskmgr = NULL;
-	RUNTIME_CHECK(isc_taskmgr_create(mctx, workers, 0, &taskmgr)
+	RUNTIME_CHECK(isc_taskmgr_create(mctx, workers, 0, NULL, &taskmgr)
 		      == ISC_R_SUCCESS);
 	task = NULL;
 	RUNTIME_CHECK(isc_task_create(taskmgr, 0, &task)

bin/tests/optional/byname_test.c

@@ -226,7 +226,7 @@ main(int argc, char *argv[]) {
 	}
 
 	taskmgr = NULL;
-	RUNTIME_CHECK(isc_taskmgr_create(mctx, workers, 0, &taskmgr) ==
+	RUNTIME_CHECK(isc_taskmgr_create(mctx, workers, 0, NULL, &taskmgr) ==
 		      ISC_R_SUCCESS);
 	task = NULL;
 	RUNTIME_CHECK(isc_task_create(taskmgr, 0, &task) ==

bin/tests/optional/gsstest.c

@@ -470,7 +470,7 @@ main(int argc, char *argv[]) {
 	RUNCHECK(dst_lib_init(mctx, NULL));
 
 	taskmgr = NULL;
-	RUNCHECK(isc_taskmgr_create(mctx, 1, 0, &taskmgr));
+	RUNCHECK(isc_taskmgr_create(mctx, 1, 0, NULL, &taskmgr));
 	task = NULL;
 	RUNCHECK(isc_task_create(taskmgr, 0, &task));
 	timermgr = NULL;

bin/tests/optional/ratelimiter_test.c

@@ -102,7 +102,7 @@ main(int argc, char *argv[]) {
 	isc_interval_set(&linterval, 1, 0);
 
 	RUNTIME_CHECK(isc_mem_create(0, 0, &mctx) == ISC_R_SUCCESS);
-	RUNTIME_CHECK(isc_taskmgr_create(mctx, 3, 0, &taskmgr) ==
+	RUNTIME_CHECK(isc_taskmgr_create(mctx, 3, 0, NULL, &taskmgr) ==
 		      ISC_R_SUCCESS);
 	RUNTIME_CHECK(isc_timermgr_create(mctx, &timermgr) ==
 		      ISC_R_SUCCESS);

bin/tests/optional/rbt_test.c

@@ -103,7 +103,7 @@ detail(dns_rbt_t *rbt, dns_name_t *name) {
 	isc_result_t result;
 	bool nodes_should_match = false;
 
-	dns_rbtnodechain_init(&chain, mctx);
+	dns_rbtnodechain_init(&chain);
 
 	origin = dns_fixedname_initname(&fixedorigin);
 	fullname = dns_fixedname_initname(&fixedfullname);
@@ -182,7 +182,7 @@ iterate(dns_rbt_t *rbt, bool forward) {
 	isc_result_t (*move)(dns_rbtnodechain_t *chain, dns_name_t *name,
 			     dns_name_t *origin);
 
-	dns_rbtnodechain_init(&chain, mctx);
+	dns_rbtnodechain_init(&chain);
 
 	dns_name_init(&foundname, NULL);
 	origin = dns_fixedname_initname(&fixedorigin);

bin/tests/optional/shutdown_test.c

@@ -181,7 +181,7 @@ main(int argc, char *argv[]) {
 	RUNTIME_CHECK(isc_mem_create(0, 0, &mctx) == ISC_R_SUCCESS);
 	mctx2 = NULL;
 	RUNTIME_CHECK(isc_mem_create(0, 0, &mctx2) == ISC_R_SUCCESS);
-	RUNTIME_CHECK(isc_taskmgr_create(mctx, workers, 0, &task_manager) ==
+	RUNTIME_CHECK(isc_taskmgr_create(mctx, workers, 0, NULL, &task_manager) ==
 		      ISC_R_SUCCESS);
 	RUNTIME_CHECK(isc_timermgr_create(mctx, &timer_manager) ==
 		      ISC_R_SUCCESS);

bin/tests/optional/sig0_test.c

@@ -226,7 +226,7 @@ main(int argc, char *argv[]) {
 	dst_result_register();
 
 	taskmgr = NULL;
-	RUNTIME_CHECK(isc_taskmgr_create(mctx, 2, 0, &taskmgr) ==
+	RUNTIME_CHECK(isc_taskmgr_create(mctx, 2, 0, NULL, &taskmgr) ==
 		      ISC_R_SUCCESS);
 	task1 = NULL;
 	RUNTIME_CHECK(isc_task_create(taskmgr, 0, &task1) == ISC_R_SUCCESS);

bin/tests/optional/sock_test.c

@@ -292,7 +292,7 @@ main(int argc, char *argv[]) {
 	 * The task manager is independent (other than memory context)
 	 */
 	manager = NULL;
-	RUNTIME_CHECK(isc_taskmgr_create(mctx, workers, 0, &manager) ==
+	RUNTIME_CHECK(isc_taskmgr_create(mctx, workers, 0, NULL, &manager) ==
 		      ISC_R_SUCCESS);
 
 	/*

bin/tests/optional/task_test.c

@@ -79,7 +79,7 @@ main(int argc, char *argv[]) {
 
 	RUNTIME_CHECK(isc_mem_create(0, 0, &mctx) == ISC_R_SUCCESS);
 
-	RUNTIME_CHECK(isc_taskmgr_create(mctx, workers, 0, &manager) ==
+	RUNTIME_CHECK(isc_taskmgr_create(mctx, workers, 0, NULL, &manager) ==
 		      ISC_R_SUCCESS);
 
 	RUNTIME_CHECK(isc_task_create(manager, 0, &t1) == ISC_R_SUCCESS);

bin/tests/optional/timer_test.c

@@ -108,7 +108,7 @@ main(int argc, char *argv[]) {
 	printf("%u workers\n", workers);
 
 	RUNTIME_CHECK(isc_mem_create(0, 0, &mctx1) == ISC_R_SUCCESS);
-	RUNTIME_CHECK(isc_taskmgr_create(mctx1, workers, 0, &manager) ==
+	RUNTIME_CHECK(isc_taskmgr_create(mctx1, workers, 0, NULL, &manager) ==
 		      ISC_R_SUCCESS);
 	RUNTIME_CHECK(isc_timermgr_create(mctx1, &timgr) == ISC_R_SUCCESS);
 

bin/tests/optional/zone_test.c

@@ -281,7 +281,7 @@ main(int argc, char **argv) {
 
 	RUNTIME_CHECK(isc_app_start() == ISC_R_SUCCESS);
 	RUNTIME_CHECK(isc_mem_create(0, 0, &mctx) == ISC_R_SUCCESS);
-	RUNTIME_CHECK(isc_taskmgr_create(mctx, 2, 0, &taskmgr) ==
+	RUNTIME_CHECK(isc_taskmgr_create(mctx, 2, 0, NULL, &taskmgr) ==
 		      ISC_R_SUCCESS);
 	RUNTIME_CHECK(isc_timermgr_create(mctx, &timermgr) == ISC_R_SUCCESS);
 	RUNTIME_CHECK(isc_socketmgr_create(mctx, &socketmgr) == ISC_R_SUCCESS);

bin/tests/system/checkconf/tests.sh

@@ -425,6 +425,7 @@ $CHECKCONF check-root-ksk-both.conf > checkconf.out$n 2>/dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; ret=1; fi
 status=`expr $status + $ret`
 
+n=`expr $n + 1`
 echo_i "check that the 2017 ICANN ROOT KSK alone does not generate a warning ($n)"
 ret=0
 $CHECKCONF check-root-ksk-2017.conf > checkconf.out$n 2>/dev/null || ret=1
@@ -432,6 +433,7 @@ $CHECKCONF check-root-ksk-2017.conf > checkconf.out$n 2>/dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; ret=1; fi
 status=`expr $status + $ret`
 
+n=`expr $n + 1`
 echo_i "check that a static root key generates a warning ($n)"
 ret=0
 $CHECKCONF check-root-static-key.conf > checkconf.out$n 2>/dev/null || ret=1
@@ -439,6 +441,7 @@ grep "static-key entry for the root zone WILL FAIL" checkconf.out$n > /dev/null
 if [ $ret != 0 ]; then echo_i "failed"; ret=1; fi
 status=`expr $status + $ret`
 
+n=`expr $n + 1`
 echo_i "check that a trusted-keys entry for root generates a warning ($n)"
 ret=0
 $CHECKCONF check-root-trusted-key.conf > checkconf.out$n 2>/dev/null || ret=1
@@ -446,6 +449,7 @@ grep "trusted-keys entry for the root zone WILL FAIL" checkconf.out$n > /dev/nul
 if [ $ret != 0 ]; then echo_i "failed"; ret=1; fi
 status=`expr $status + $ret`
 
+n=`expr $n + 1`
 echo_i "check that using dnssec-keys and managed-keys generates an error ($n)"
 ret=0
 $CHECKCONF check-mixed-keys.conf > checkconf.out$n 2>/dev/null && ret=1
@@ -453,6 +457,7 @@ grep "use of managed-keys is not allowed" checkconf.out$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; ret=1; fi
 status=`expr $status + $ret`
 
+n=`expr $n + 1`
 echo_i "check that 'geoip-use-ecs no' generates a warning ($n)"
 ret=0
 $CHECKCONF warn-geoip-use-ecs.conf > checkconf.out$n 2>/dev/null || ret=1

bin/tests/system/checkzone/zones/bad-cdnskey.db

@@ -0,0 +1,4 @@
+example.	0	SOA	. . 0 0 0 0 0
+example.	0 	NS	.
+example. 	0	DNSKEY	257 3 10 AwEAAbqjg7xdvnU2Q/gtLw5LOfr5cDeTRjYuEbkzGrUiVSOSoxcTxuao WS/AFPQHuD8OSLiE/CeZ087JowREXl058rRfae8KMrveY17V0wmKs9N1 F1wf/hRDpXiThlRHWlskp8eSEEIqYrrHgWTesy/xDGIEOFM1gwRo0w8j KdRRJeL2hseTMa+m3rTzrYudUsI0BHLW8PiDUCbG5xgdee8/5YR4847i AAqHIiPJ1Z/IT53OIjMmtv5BUykZ8RYjlJxxX+C+dpRKiK73SQaR3hCB XAYOL9WsDp2/fpmEZpewavkMkdC+j2CX+z27MCS3ASO0AeKK0lcNXwND kgreE+Kr7gc=
+example. 	0	CDNSKEY	257 3 10 AwEAAbqjg7xdvnU2Q/gtLw5LOfr5cDeTRjYuEbkzGrUiVSOSoxcTXXXX WS/AFPQHuD8OSLiE/CeZ087JowREXl058rRfae8KMrveY17V0wmKs9N1 F1wf/hRDpXiThlRHWlskp8eSEEIqYrrHgWTesy/xDGIEOFM1gwRo0w8j KdRRJeL2hseTMa+m3rTzrYudUsI0BHLW8PiDUCbG5xgdee8/5YR4847i AAqHIiPJ1Z/IT53OIjMmtv5BUykZ8RYjlJxxX+C+dpRKiK73SQaR3hCB XAYOL9WsDp2/fpmEZpewavkMkdC+j2CX+z27MCS3ASO0AeKK0lcNXwND kgreE+Kr7gc=

bin/tests/system/checkzone/zones/bad-cds.db

@@ -0,0 +1,6 @@
+example.	0	SOA	. . 0 0 0 0 0
+example.	0 	NS	.
+example. 	0	DNSKEY	257 3 10 AwEAAbqjg7xdvnU2Q/gtLw5LOfr5cDeTRjYuEbkzGrUiVSOSoxcTxuao WS/AFPQHuD8OSLiE/CeZ087JowREXl058rRfae8KMrveY17V0wmKs9N1 F1wf/hRDpXiThlRHWlskp8eSEEIqYrrHgWTesy/xDGIEOFM1gwRo0w8j KdRRJeL2hseTMa+m3rTzrYudUsI0BHLW8PiDUCbG5xgdee8/5YR4847i AAqHIiPJ1Z/IT53OIjMmtv5BUykZ8RYjlJxxX+C+dpRKiK73SQaR3hCB XAYOL9WsDp2/fpmEZpewavkMkdC+j2CX+z27MCS3ASO0AeKK0lcNXwND kgreE+Kr7gc=
+; Actual CDS
+; example.	0	CDS 	14364 10 2 FD03B2312C8F0FE72C1751EFA1007D743C94EC91594FF0047C23C37CE119BA0C
+example.	0	CDS 	14364 10 2 FD03B2312C8F0FE72C1751EFA1007D743C94EC91594FF0047C23C37CE119BA0B

bin/tests/system/checkzone/zones/good-cdnskey.db

@@ -0,0 +1,4 @@
+example.	0	SOA	. . 0 0 0 0 0
+example.	0 	NS	.
+example. 	0	DNSKEY	257 3 10 AwEAAbqjg7xdvnU2Q/gtLw5LOfr5cDeTRjYuEbkzGrUiVSOSoxcTxuao WS/AFPQHuD8OSLiE/CeZ087JowREXl058rRfae8KMrveY17V0wmKs9N1 F1wf/hRDpXiThlRHWlskp8eSEEIqYrrHgWTesy/xDGIEOFM1gwRo0w8j KdRRJeL2hseTMa+m3rTzrYudUsI0BHLW8PiDUCbG5xgdee8/5YR4847i AAqHIiPJ1Z/IT53OIjMmtv5BUykZ8RYjlJxxX+C+dpRKiK73SQaR3hCB XAYOL9WsDp2/fpmEZpewavkMkdC+j2CX+z27MCS3ASO0AeKK0lcNXwND kgreE+Kr7gc=
+example. 	0	CDNSKEY	257 3 10 AwEAAbqjg7xdvnU2Q/gtLw5LOfr5cDeTRjYuEbkzGrUiVSOSoxcTxuao WS/AFPQHuD8OSLiE/CeZ087JowREXl058rRfae8KMrveY17V0wmKs9N1 F1wf/hRDpXiThlRHWlskp8eSEEIqYrrHgWTesy/xDGIEOFM1gwRo0w8j KdRRJeL2hseTMa+m3rTzrYudUsI0BHLW8PiDUCbG5xgdee8/5YR4847i AAqHIiPJ1Z/IT53OIjMmtv5BUykZ8RYjlJxxX+C+dpRKiK73SQaR3hCB XAYOL9WsDp2/fpmEZpewavkMkdC+j2CX+z27MCS3ASO0AeKK0lcNXwND kgreE+Kr7gc=

bin/tests/system/checkzone/zones/good-cds.db

@@ -0,0 +1,4 @@
+example.	0	SOA	. . 0 0 0 0 0
+example.	0 	NS	.
+example. 	0	DNSKEY	257 3 10 AwEAAbqjg7xdvnU2Q/gtLw5LOfr5cDeTRjYuEbkzGrUiVSOSoxcTxuao WS/AFPQHuD8OSLiE/CeZ087JowREXl058rRfae8KMrveY17V0wmKs9N1 F1wf/hRDpXiThlRHWlskp8eSEEIqYrrHgWTesy/xDGIEOFM1gwRo0w8j KdRRJeL2hseTMa+m3rTzrYudUsI0BHLW8PiDUCbG5xgdee8/5YR4847i AAqHIiPJ1Z/IT53OIjMmtv5BUykZ8RYjlJxxX+C+dpRKiK73SQaR3hCB XAYOL9WsDp2/fpmEZpewavkMkdC+j2CX+z27MCS3ASO0AeKK0lcNXwND kgreE+Kr7gc=
+example.	0	CDS 	14364 10 2 FD03B2312C8F0FE72C1751EFA1007D743C94EC91594FF0047C23C37CE119BA0C

bin/tests/system/conf.sh.win32

@@ -28,7 +28,7 @@ CYGWIN=1
 . $TOP/bin/tests/system/conf.sh.common
 
 # Visual Studio build configurations are Release and Debug
-VSCONF=Debug
+VSCONF=${VSCONF:-Debug}
 
 ARPANAME=$TOP/Build/$VSCONF/arpaname@EXEEXT@
 CDS=$TOP/Build/$VSCONF/dnssec-cds@EXEEXT@

bin/tests/system/digdelv/ans6/ans.pl

@@ -0,0 +1,82 @@
+#!/usr/bin/perl -w
+#
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+use IO::File;
+use IO::Socket;
+use Net::DNS;
+use Net::DNS::Packet;
+
+my $localport = int($ENV{'PORT'});
+if (!$localport) { $localport = 5300; }
+
+my $sock = IO::Socket::INET->new(LocalAddr => "10.53.0.6",
+   LocalPort => $localport, Proto => "udp") or die "$!";
+
+my $pidf = new IO::File "ans.pid", "w" or die "cannot open pid file: $!";
+print $pidf "$$\n" or die "cannot write pid file: $!";
+$pidf->close or die "cannot close pid file: $!";
+sub rmpid { unlink "ans.pid"; exit 1; };
+
+$SIG{INT} = \&rmpid;
+$SIG{TERM} = \&rmpid;
+
+for (;;) {
+	$sock->recv($buf, 512);
+
+	print "**** request from " , $sock->peerhost, " port ", $sock->peerport, "\n";
+
+	my $packet;
+
+	if ($Net::DNS::VERSION > 0.68) {
+		$packet = new Net::DNS::Packet(\$buf, 0);
+		$@ and die $@;
+	} else {
+		my $err;
+		($packet, $err) = new Net::DNS::Packet(\$buf, 0);
+		$err and die $err;
+	}
+
+	print "REQUEST:\n";
+	$packet->print;
+
+	$packet->header->qr(1);
+
+	my @questions = $packet->question;
+	my $qname = $questions[0]->qname;
+	my $qtype = $questions[0]->qtype;
+
+	my $donotrespond = 0;
+
+	$packet->header->aa(1);
+	if ($qtype eq "A") {
+		$packet->push("answer",
+			      new Net::DNS::RR($qname .  " 300 A 10.53.0.5"));
+	} else {
+		$donotrespond = 1;
+	}
+
+	if ($donotrespond == 0) {
+                my $sendsock =
+                        IO::Socket::INET->new(LocalAddr => "10.53.1.2",
+                                              PeerAddr => $sock->peerhost,
+                                              PeerPort => $sock->peerport,
+                                              Proto => "udp") or die "$!";
+                print "**** response from ", $sendsock->sockhost, " to " ,
+                      $sendsock->peerhost, " port ", $sendsock->peerport, "\n";
+		$sendsock->send($packet->data);
+                $sendsock->close;
+		print "RESPONSE:\n";
+		$packet->print;
+		print "\n";
+	} else {
+		print "DROP:\n";
+	}
+}

bin/tests/system/digdelv/tests.sh

@@ -62,7 +62,13 @@ KEYID="$(cat ns2/keyid)"
 KEYDATA="$(< ns2/keydata sed -e 's/+/[+]/g')"
 NOSPLIT="$(< ns2/keydata sed -e 's/+/[+]/g' -e 's/ //g')"
 
+HAS_PYYAML=0
+if [ -n "$PYTHON" ] ; then
+	$PYTHON -c "import yaml" 2> /dev/null && HAS_PYYAML=1
+fi
+
 if [ -x "$DIG" ] ; then
+
   n=$((n+1))
   echo_i "checking dig short form works ($n)"
   ret=0
@@ -514,6 +520,14 @@ if [ -x "$DIG" ] ; then
   if [ $ret -ne 0 ]; then echo_i "failed"; fi
   status=$((status+ret))
 
+  n=$((n+1))
+  echo_i "checking ednsopt LLQ prints as expected ($n)"
+  ret=0
+  dig_with_opts @10.53.0.3 +ednsopt=llq:0001000200001234567812345678fefefefe +qr a.example > dig.out.test$n 2>&1 || ret=1
+  grep 'LLQ: Version: 1, Opcode: 2, Error: 0, Identifier: 1311768465173141112, Lifetime: 4278124286$' dig.out.test$n > /dev/null || ret=1
+  if [ $ret -ne 0 ]; then echo_i "failed"; fi
+  status=$((status+ret))
+
   n=$((n+1))
   echo_i "checking that dig warns about .local queries ($n)"
   ret=0
@@ -710,12 +724,55 @@ if [ -x "$DIG" ] ; then
   status=$((status+ret))
 
   n=$((n+1))
+
   echo_i "check that dig +short +expandaaaa works ($n)"
   ret=0
   dig_with_opts @10.53.0.3 +short +expandaaaa AAAA ns2.example > dig.out.test$n 2>&1 || ret=1
   grep '^fd92:7065:0b8e:ffff:0000:0000:0000:0002$' dig.out.test$n > /dev/null || ret=1
   if [ $ret -ne 0 ]; then echo_i "failed"; fi
   status=$((status+ret))
+
+  if [ $HAS_PYYAML -ne 0 ] ; then
+    n=$((n+1))
+    echo_i "check dig +yaml output ($n)"
+    ret=0
+    dig_with_opts +qr +yaml @10.53.0.3 any ns2.example > dig.out.test$n 2>&1 || ret=1
+    value=$($PYTHON yamlget.py dig.out.test$n 0 message query_message_data status || ret=1)
+    [ "$value" = "NOERROR" ] || ret=1
+    value=$($PYTHON yamlget.py dig.out.test$n 1 message response_message_data status || ret=1)
+    [ "$value" = "NOERROR" ] || ret=1
+    value=$($PYTHON yamlget.py dig.out.test$n 1 message response_message_data QUESTION_SECTION 0 || ret=1)
+    [ "$value" = "ns2.example. IN ANY" ] || ret=1
+    if [ $ret -ne 0 ]; then echo_i "failed"; fi
+    status=$((status+ret))
+  fi
+
+  echo_i "check that dig +unexpected works ($n)"
+  ret=0
+  dig_with_opts @10.53.0.6 +unexpected a a.example > dig.out.test$n || ret=1
+  grep 'reply from unexpected source' dig.out.test$n > /dev/null || ret=1
+  grep 'status: NOERROR' dig.out.test$n > /dev/null || ret=1
+  if [ $ret -ne 0 ]; then echo_i "failed"; fi
+  status=$((status+ret))
+
+  n=$((n+1))
+  echo_i "check that dig +nounexpected works ($n)"
+  ret=0
+  dig_with_opts @10.53.0.6 +nounexpected +tries=1 +time=2 a a.example > dig.out.test$n && ret=1
+  grep 'reply from unexpected source' dig.out.test$n > /dev/null || ret=1
+  grep "status: NOERROR" < dig.out.test$n > /dev/null && ret=1
+  if [ $ret -ne 0 ]; then echo_i "failed"; fi
+  status=$((status+ret))
+
+  n=$((n+1))
+  echo_i "check that dig default for +[no]unexpected (+nounexpected) works ($n)"
+  ret=0
+  dig_with_opts @10.53.0.6 +tries=1 +time=2 a a.example > dig.out.test$n && ret=1
+  grep 'reply from unexpected source' dig.out.test$n > /dev/null || ret=1
+  grep "status: NOERROR" < dig.out.test$n > /dev/null && ret=1
+  if [ $ret -ne 0 ]; then echo_i "failed"; fi
+  status=$((status+ret))
+
 else
   echo_i "$DIG is needed, so skipping these dig tests"
 fi
@@ -744,6 +801,19 @@ if [ -x "$MDIG" ] ; then
   grep "; serial" < dig.out.test$n > /dev/null && ret=1
   if [ $ret -ne 0 ]; then echo_i "failed"; fi
   status=$((status+ret))
+
+  if [ $HAS_PYYAML -ne 0 ] ; then
+    n=$((n+1))
+    echo_i "check mdig +yaml output ($n)"
+    ret=0
+    mdig_with_opts +yaml @10.53.0.3 -t any ns2.example > dig.out.test$n 2>&1 || ret=1
+    value=$($PYTHON yamlget.py dig.out.test$n 0 message response_message_data status || ret=1)
+    [ "$value" = "NOERROR" ] || ret=1
+    value=$($PYTHON yamlget.py dig.out.test$n 0 message response_message_data QUESTION_SECTION 0 || ret=1)
+    [ "$value" = "ns2.example. IN ANY" ] || ret=1
+    if [ $ret -ne 0 ]; then echo_i "failed"; fi
+    status=$((status+ret))
+  fi
 else
   echo_i "$MDIG is needed, so skipping these mdig tests"
 fi
@@ -965,6 +1035,22 @@ if [ -x "$DELV" ] ; then
   check_ttl_range delv.out.test$n SOA 300 || ret=1
   if [ $ret -ne 0 ]; then echo_i "failed"; fi
   status=$((status+ret))
+
+  if [ $HAS_PYYAML -ne 0 ] ; then
+    n=$((n+1))
+    echo_i "check delv +yaml output ($n)"
+    ret=0
+    delv_with_opts +yaml @10.53.0.3 any ns2.example > delv.out.test$n 2>&1 || ret=1
+    value=$($PYTHON yamlget.py delv.out.test$n status || ret=1)
+    [ "$value" = "success" ] || ret=1
+    value=$($PYTHON yamlget.py delv.out.test$n query_name || ret=1)
+    [ "$value" = "ns2.example" ] || ret=1
+    value=$($PYTHON yamlget.py delv.out.test$n records 0 answer_not_validated 0 || ret=1)
+    count=$(echo $value | wc -w )
+    [ ${count:-0} -eq 5 ] || ret=1
+    if [ $ret -ne 0 ]; then echo_i "failed"; fi
+    status=$((status+ret))
+  fi
 else
   echo_i "$DELV is needed, so skipping these delv tests"
 fi

bin/tests/system/digdelv/yamlget.py

@@ -0,0 +1,33 @@
+############################################################################
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+############################################################################
+
+try:
+    import yaml
+except:
+    print("No python yaml module, skipping")
+    exit(1)
+
+import subprocess
+import pprint
+import sys
+
+f = open(sys.argv[1], "r")
+for item in yaml.safe_load_all(f):
+    for key in sys.argv[2:]:
+        try:
+            key = int(key)
+        except: pass
+        try:
+            item = item[key]
+        except:
+            print('error: index not found')
+            exit(1)
+    print (item)

bin/tests/system/dnssec/ns2/sign.sh

@@ -220,7 +220,7 @@ key1=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone -f KSK "$
 key2=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone -f KSK "$zone")
 key3=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone")
 "$DSFROMKEY" -C "$key2.key" > "$key2.cds"
-cat "$infile" "$key1.key" "$key3.key" "$key2.cds" > "$zonefile"
+cat "$infile" "$key1.key" "$key2.key" "$key3.key" "$key2.cds" > "$zonefile"
 "$SIGNER" -P -g -x -o "$zone" "$zonefile" > /dev/null 2>&1
 
 zone=cds-update.secure
@@ -244,8 +244,8 @@ infile=cds-auto.secure.db.in
 zonefile=cds-auto.secure.db
 key1=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone -f KSK "$zone")
 key2=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone")
-"$DSFROMKEY" -C "$key1.key" > "$key1.cds"
-cat "$infile" "$key1.cds" > "$zonefile.signed"
+$SETTIME -P sync now "$key1" > /dev/null
+cat "$infile" > "$zonefile.signed"
 
 zone=cdnskey.secure
 infile=cdnskey.secure.db.in
@@ -263,7 +263,7 @@ key1=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone -f KSK "$
 key2=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone -f KSK "$zone")
 key3=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone")
 sed 's/DNSKEY/CDNSKEY/' "$key1.key" > "$key1.cds"
-cat "$infile" "$key2.key" "$key3.key" "$key1.cds" > "$zonefile"
+cat "$infile" "$key1.key" "$key2.key" "$key3.key" "$key1.cds" > "$zonefile"
 "$SIGNER" -P -g -x -o "$zone" "$zonefile" > /dev/null 2>&1
 
 zone=cdnskey-update.secure
@@ -287,8 +287,8 @@ infile=cdnskey-auto.secure.db.in
 zonefile=cdnskey-auto.secure.db
 key1=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone -f KSK "$zone")
 key2=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone")
-sed 's/DNSKEY/CDNSKEY/' "$key1.key" > "$key1.cds"
-cat "$infile" "$key1.cds" > "$zonefile.signed"
+$SETTIME -P sync now "$key1" > /dev/null
+cat "$infile" > "$zonefile.signed"
 
 zone=updatecheck-kskonly.secure
 infile=template.secure.db.in

bin/tests/system/dnssec/tests.sh

@@ -3247,7 +3247,7 @@ echo_i "check that CDS records are not signed using ZSK by dnssec-signzone -x ($
 ret=0
 dig_with_opts +noall +answer @10.53.0.2 cds cds-x.secure > dig.out.test$n
 lines=$(awk '$4 == "RRSIG" && $5 == "CDS" {print}' dig.out.test$n | wc -l)
-test "$lines" -eq 1 || ret=1
+test "$lines" -eq 2 || ret=1
 n=$((n+1))
 test "$ret" -eq 0 || echo_i "failed"
 status=$((status+ret))
@@ -3399,7 +3399,7 @@ echo_i "check that CDNSKEY records are not signed using ZSK by dnssec-signzone -
 ret=0
 dig_with_opts +noall +answer @10.53.0.2 cdnskey cdnskey-x.secure > dig.out.test$n
 lines=$(awk '$4 == "RRSIG" && $5 == "CDNSKEY" {print}' dig.out.test$n | wc -l)
-test "$lines" -eq 1 || ret=1
+test "$lines" -eq 2 || ret=1
 n=$((n+1))
 test "$ret" -eq 0 || echo_i "failed"
 status=$((status+ret))

bin/tests/system/dnstap/tests.sh

@@ -484,7 +484,6 @@ ret=0
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
 
-
 HAS_PYYAML=0
 if [ -n "$PYTHON" ] ; then
 	$PYTHON -c "import yaml" 2> /dev/null && HAS_PYYAML=1

bin/tests/system/dyndb/driver/syncptr.c

@@ -213,10 +213,6 @@ syncptr(sample_instance_t *inst, dns_name_t *name,
 						      SYNCPTR_WRITE_EVENT,
 						      syncptr_write, NULL,
 						      sizeof(syncptrevent_t));
-	if (pevent == NULL) {
-		result = ISC_R_NOMEMORY;
-		goto cleanup;
-	}
 	isc_buffer_init(&pevent->b, pevent->buf, sizeof(pevent->buf));
 	dns_fixedname_init(&pevent->ptr_target_name);
 

bin/tests/system/ecdsa/tests.sh

@@ -20,7 +20,7 @@ rm -f dig.out.*
 DIGOPTS="+tcp +noau +noadd +nosea +nostat +nocmd +dnssec -p 5300"
 
 # Check the example. domain
-
+sleep 5
 echo "I:checking that positive validation works ($n)"
 ret=0
 $DIG $DIGOPTS . @10.53.0.1 soa > dig.out.ns1.test$n || ret=1

bin/tests/system/glue/clean.sh

@@ -13,7 +13,7 @@
 # Clean up after glue tests.
 #
 
-rm -f dig.out ns1/cache
+rm -f dig.out
 rm -f */named.conf
 rm -f */named.memstats
 rm -f */named.run

bin/tests/system/glue/ns1/mil.db

@@ -1,23 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$ORIGIN mil.
-$TTL 300
-@ 			IN SOA	gson.nominum.com. a.root.servers.nil. (
-				2000042100   	; serial
-				600         	; refresh
-				600         	; retry
-				1200    	; expire
-				600       	; minimum
-				)
-@			NS	a.root-servers.nil.
-
-ARL.MIL.         	172800  IN      NS	NS1.ARL.MIL.
-NS1.arl.mil.            172800  IN A  128.63.16.4
-

bin/tests/system/glue/ns1/named.conf.in

@@ -19,8 +19,6 @@ options {
 	listen-on-v6 { none; };
 	recursion yes;
 	notify no;
-	cache-file "cache";
-	check-integrity no;
 };
 
 zone "." {
@@ -36,8 +34,3 @@ zone "net" {
 	type master;
 	file "net.db";
 };
-
-zone "mil" {
-	type master;
-	file "mil.db";
-};

bin/tests/system/glue/ns1/root.db

@@ -23,8 +23,6 @@ a.root-servers.nil.	A	10.53.0.1
 ; Delegate some domains that contain name servers for the sample
 ; ccTLDs below.
 net.			172800	IN	NS	a.root-servers.nil.
-mil.			172800	IN	NS	a.root-servers.nil.
-se.			172800	IN	NS	ns.uu.net.
 
 ;
 ; A sample ccTLD
@@ -42,17 +40,3 @@ NS.UU.NET.		172800	IN	A	137.39.1.3
 T.NS.VERIO.NET.		172800	IN	A	192.67.14.16
 HYDRA.HELSINKI.fi.	172800	IN	A	128.214.4.29
 NS.EU.NET.		172800	IN	A	192.16.202.11
-
-;
-; Another sample ccTLD
-;
-is.                     172800  IN      NS      ISGATE.is.
-is.                     172800  IN      NS      NISC.JVNC.NET.
-is.                     172800  IN      NS      NS.EU.NET.
-is.                     172800  IN      NS      SPARKY.ARL.MIL.
-is.                     172800  IN      NS      SUNIC.SUNET.SE.
-ISGATE.is.              172800  IN      A       193.4.58.51
-NISC.JVNC.NET.          172800  IN      A       128.121.50.7
-NS.EU.NET.              172800  IN      A       192.16.202.11
-SPARKY.ARL.MIL.         172800  IN      A       128.63.58.18
-SUNIC.SUNET.SE.         172800  IN      A       192.36.125.2

bin/tests/system/glue/setup.sh

@@ -14,5 +14,3 @@ SYSTEMTESTTOP=..
 
 $SHELL clean.sh
 copy_setports ns1/named.conf.in ns1/named.conf
-
-cd ns1 && cp -f cache.in cache

bin/tests/system/glue/xx.good

@@ -1,16 +0,0 @@
-
-; <<>> DiG 9.0 <<>> +norec @10.53.0.1 -p 5300 foo.bar.xx. a
-;; global options:  printcmd
-;; Got answer:
-;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 41239
-;; flags: qr ad; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1
-
-;; QUESTION SECTION:
-;foo.bar.xx.			IN	A
-
-;; AUTHORITY SECTION:
-xx.			172800	IN	NS	b.root-servers.nil.
-
-;; ADDITIONAL SECTION:
-b.root-servers.nil.	300	IN	A	10.53.0.2
-

bin/tests/system/glue/yy.good

@@ -1,17 +0,0 @@
-
-; <<>> DiG 9.0 <<>> +norec @10.53.0.1 -p 5300 foo.bar.yy. a
-;; global options:  printcmd
-;; Got answer:
-;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 6172
-;; flags: qr ad; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 3
-
-;; QUESTION SECTION:
-;foo.bar.yy.			IN	A
-
-;; AUTHORITY SECTION:
-yy.			172800	IN	NS	ns.zz.
-
-;; ADDITIONAL SECTION:
-ns.zz.			3463	IN	A	10.0.0.1
-ns.zz.			86263	IN	AAAA	10::1
-

bin/tests/system/keymgr/tests.sh

@@ -134,7 +134,7 @@ n=`expr $n + 1`
 echo_i "checking policy.conf parser ($n)"
 ret=0
 ${PYTHON} testpolicy.py policy.sample > policy.out
-$DOS2UNIX policy.out > /dev/null
+$DOS2UNIX policy.out > /dev/null 2>&1
 cmp -s policy.good policy.out || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`

bin/tests/system/pipelined/pipequeries.c

@@ -277,7 +277,7 @@ main(int argc, char *argv[]) {
 	RUNCHECK(dst_lib_init(mctx, NULL));
 
 	taskmgr = NULL;
-	RUNCHECK(isc_taskmgr_create(mctx, 1, 0, &taskmgr));
+	RUNCHECK(isc_taskmgr_create(mctx, 1, 0, NULL, &taskmgr));
 	task = NULL;
 	RUNCHECK(isc_task_create(taskmgr, 0, &task));
 	timermgr = NULL;

bin/tests/system/resolver/ns6/delegation-only.db

@@ -17,7 +17,7 @@ $TTL 120
 ;
 @	IN	A	1.2.3.4
 @	IN	AAAA	c::1.2.3.4
-@	IN	CDS	21366 7 1 E6C1716CFB6BDC84E84CE1AB5510DAC69173B5B2
+@	IN	CDS 	12023 7 2 36FB69A752615831B47EA6EF9EA4619D0FB08ABDA69EA3ED200F4C02FF4921D4
 @	IN	CDNSKEY	256 3 7 AwEAAY9437GPWJHzBeR4FP6eJAie7gh2QSM6LUnbDAHvHOx8MNqgSVRM PZka2rAgivb65/MkT1lXRUegj91iRFP3iggTpCgvdUbcBjsYrdODsrwF YUMIUl1pU0lH9x7KvfFUOfSmG+Rk5UHUWuRZbNyc65Sq69iFXg5c11+8 MAkRoeDF
 ;
 ;	Delegation only test CDS and CDNSKEY records.  These should be rejected

bin/tests/system/resolver/tests.sh

@@ -795,5 +795,12 @@ grep "status: SERVFAIL" dig.ns5.out.${n} > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
 
+n=`expr $n + 1`
+echo_i "check logged command line ($n)"
+ret=0
+grep "running as: .* -m record,size,mctx " ns1/named.run > /dev/null || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=`expr $status + $ret`
+
 echo_i "exit status: $status"
 [ $status -eq 0 ] || exit 1

bin/tests/system/rpz/clean.sh

@@ -29,9 +29,9 @@ fi
 # remove those files first, then decide whether to remove the others.
 rm -f ns*/*.key ns*/*.private
 rm -f ns2/tld2s.db ns2/bl.tld2.db
-rm -f ns3/bl*.db ns*/empty.db
+rm -f ns3/bl*.db ns3/fast-expire.db ns*/empty.db
 rm -f ns3/manual-update-rpz.db
-rm -f ns5/example.db ns5/bl.db
+rm -f ns5/example.db ns5/bl.db ns5/fast-expire.db ns5/expire.conf
 rm -f ns8/manual-update-rpz.db
 rm -f */policy2.db
 rm -f */*.jnl

bin/tests/system/rpz/ns3/named.conf.in

@@ -28,8 +28,11 @@ options {
 	minimal-responses no;
 	recursion yes;
 	dnssec-validation yes;
+	min-refresh-time 1;
+	min-retry-time 1;
 
 	response-policy {
+	    zone "fast-expire";
 	    zone "bl"					max-policy-ttl 100;
 	    zone "bl-2";
 	    zone "bl-given"	policy given		recursive-only yes;
@@ -110,3 +113,10 @@ zone "manual-update-rpz." {
 	file "manual-update-rpz.db";
 	notify no;
 };
+
+zone "fast-expire." {
+	type secondary;
+	file "fast-expire.db";
+	masters { 10.53.0.5; };
+	notify no;
+};

bin/tests/system/rpz/ns5/expire.conf.in

@@ -0,0 +1,17 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+zone "fast-expire." {
+	type master;
+	file "fast-expire.db";
+	allow-transfer { any; };
+	notify no;
+};

bin/tests/system/rpz/ns5/fast-expire.db.in

@@ -7,9 +7,10 @@
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
 
-; Preloaded cache data for glue test
+$TTL 300
+@					SOA	fast-expire. hostmaster (
+						1 3 1 5 60
+						)
+					NS	ns.tld3.
 
-$TTL 86400
-ns.zz.	  3600	IN	A	10.0.0.1
-ns.zz.		IN	AAAA	10::1
-ns.zz.		IN	A6	0 ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff
+expired.fast-expire.		        A	10.0.0.10

bin/tests/system/rpz/ns5/named.conf.in

@@ -86,3 +86,5 @@ zone "policy2" {
 	allow-update { any; };
 	allow-transfer { any; };
 };
+
+include "expire.conf";

bin/tests/system/rpz/setup.sh

@@ -74,6 +74,10 @@ done
 cp ns3/manual-update-rpz.db.in ns3/manual-update-rpz.db
 cp ns8/manual-update-rpz.db.in ns8/manual-update-rpz.db
 
+# a zone that expires quickly and then can't be refreshed
+cp ns5/fast-expire.db.in ns5/fast-expire.db
+cp ns5/expire.conf.in ns5/expire.conf
+
 # $1=directory
 # $2=domain name
 # $3=input zone file

bin/tests/system/rpz/tests.sh

@@ -759,6 +759,11 @@ EOF
     done
   fi
 
+  # reconfigure the ns5 master server without the fast-exire zone, so
+  # it can't be refreshed on ns3, and will expire in 5 seconds.
+  cat /dev/null > ns5/expire.conf
+  rndc_reconfig ns5 10.53.0.5
+
   # restart the main test RPZ server to see if that creates a core file
   if test -z "$HAVE_CORE"; then
     $PERL $SYSTEMTESTTOP/stop.pl --use-rndc --port ${CONTROLPORT} rpz ns3
@@ -854,6 +859,12 @@ EOF
     echo_i "checking rpz with delegation fails correctly (${t})"
     $DIG -p ${PORT} @$ns3 ns example.com > dig.out.$t
     grep "status: SERVFAIL" dig.out.$t > /dev/null || setret "failed"
+
+    t=`expr $t + 1`
+    echo_i "checking policies from expired zone are no longer in effect ($t)"
+    $DIG -p ${PORT} @$ns3 a expired > dig.out.$t
+    grep "expired.*10.0.0.10" dig.out.$t > /dev/null && setret "failed"
+    grep "fast-expire/IN: response-policy zone expired" ns3/named.run > /dev/null || setret "failed"
   fi
 
   # RPZ 'CNAME *.' (NODATA) trumps DNS64.  Test against various DNS64 senarios.

bin/tests/system/tkey/keycreate.c

@@ -236,7 +236,7 @@ main(int argc, char *argv[]) {
 	RUNCHECK(dst_lib_init(mctx, NULL));
 
 	taskmgr = NULL;
-	RUNCHECK(isc_taskmgr_create(mctx, 1, 0, &taskmgr));
+	RUNCHECK(isc_taskmgr_create(mctx, 1, 0, NULL, &taskmgr));
 	task = NULL;
 	RUNCHECK(isc_task_create(taskmgr, 0, &task));
 	timermgr = NULL;

bin/tests/system/tkey/keydelete.c

@@ -175,7 +175,7 @@ main(int argc, char **argv) {
 	RUNCHECK(dst_lib_init(mctx, NULL));
 
 	taskmgr = NULL;
-	RUNCHECK(isc_taskmgr_create(mctx, 1, 0, &taskmgr));
+	RUNCHECK(isc_taskmgr_create(mctx, 1, 0, NULL, &taskmgr));
 	task = NULL;
 	RUNCHECK(isc_task_create(taskmgr, 0, &task));
 	timermgr = NULL;

bin/tests/system/xfer/tests.sh

@@ -410,7 +410,7 @@ echo_i "test smaller transfer TCP message size ($n)"
 $DIG $DIGOPTS example. @10.53.0.8 axfr \
 	-y key1.:1234abcd8765 > dig.out.msgsize || status=1
 
-$DOS2UNIX dig.out.msgsize >/dev/null
+$DOS2UNIX dig.out.msgsize >/dev/null 2>&1
 
 bytes=`wc -c < dig.out.msgsize`
 if [ $bytes -ne 459357 ]; then

bin/tools/mdig.1

@@ -233,6 +233,11 @@ Use [do not use] TCP when querying name servers\&. This alternate syntax to
 \fI+[no]tcp\fR
 is provided for backwards compatibility\&. The "vc" stands for "virtual circuit"\&.
 .RE
+.PP
+\fB+[no]yaml\fR
+.RS 4
+Print the responses in a detailed YAML format\&.
+.RE
 .SH "LOCAL OPTIONS"
 .PP
 The

bin/tools/mdig.c

@@ -105,6 +105,7 @@ static bool display_answer  = true;
 static bool display_authority = true;
 static bool display_additional = true;
 static bool display_unknown_format = false;
+static bool yaml = false;
 static bool continue_on_error = false;
 static uint32_t display_splitwidth = 0xffffffff;
 static isc_sockaddr_t srcaddr;
@@ -211,7 +212,7 @@ recvresponse(isc_task_t *task, isc_event_t *event) {
 	isc_result_t result;
 	dns_message_t *query = NULL, *response = NULL;
 	unsigned int parseflags = 0;
-	isc_buffer_t *buf = NULL;
+	isc_buffer_t *msgbuf = NULL, *buf = NULL;
 	unsigned int len = OUTPUTBUF;
 	dns_master_style_t *style = NULL;
 	unsigned int styleflags = 0;
@@ -239,36 +240,52 @@ recvresponse(isc_task_t *task, isc_event_t *event) {
 		parseflags |= DNS_MESSAGEPARSE_BESTEFFORT;
 		parseflags |= DNS_MESSAGEPARSE_IGNORETRUNCATION;
 	}
+
+
+	msgbuf = dns_request_getanswer(reqev->request);
 	result = dns_request_getresponse(reqev->request, response, parseflags);
 	CHECK("dns_request_getresponse", result);
 
 	styleflags |= DNS_STYLEFLAG_REL_OWNER;
-	if (display_comments)
-		styleflags |= DNS_STYLEFLAG_COMMENT;
-	if (display_unknown_format)
-		styleflags |= DNS_STYLEFLAG_UNKNOWNFORMAT;
-	if (display_rrcomments > 0)
-		styleflags |= DNS_STYLEFLAG_RRCOMMENT;
-	if (display_ttlunits)
-		styleflags |= DNS_STYLEFLAG_TTL_UNITS;
-	if (!display_ttl)
-		styleflags |= DNS_STYLEFLAG_NO_TTL;
-	if (!display_class)
-		styleflags |= DNS_STYLEFLAG_NO_CLASS;
-	if (!display_crypto)
-		styleflags |= DNS_STYLEFLAG_NOCRYPTO;
-	if (display_multiline) {
-		styleflags |= DNS_STYLEFLAG_OMIT_OWNER;
-		styleflags |= DNS_STYLEFLAG_OMIT_CLASS;
-		styleflags |= DNS_STYLEFLAG_REL_DATA;
-		styleflags |= DNS_STYLEFLAG_OMIT_TTL;
-		styleflags |= DNS_STYLEFLAG_TTL;
-		styleflags |= DNS_STYLEFLAG_MULTILINE;
-		styleflags |= DNS_STYLEFLAG_COMMENT;
-		/* Turn on rrcomments unless explicitly disabled */
-		if (display_rrcomments >= 0) {
+	if (yaml) {
+		dns_master_indentstr = "  ";
+		dns_master_indent = 3;
+		styleflags |= DNS_STYLEFLAG_YAML;
+	} else {
+		if (display_comments) {
+			styleflags |= DNS_STYLEFLAG_COMMENT;
+		}
+		if (display_unknown_format) {
+			styleflags |= DNS_STYLEFLAG_UNKNOWNFORMAT;
+		}
+		if (display_rrcomments > 0) {
 			styleflags |= DNS_STYLEFLAG_RRCOMMENT;
 		}
+		if (display_ttlunits) {
+			styleflags |= DNS_STYLEFLAG_TTL_UNITS;
+		}
+		if (!display_ttl) {
+			styleflags |= DNS_STYLEFLAG_NO_TTL;
+		}
+		if (!display_class) {
+			styleflags |= DNS_STYLEFLAG_NO_CLASS;
+		}
+		if (!display_crypto) {
+			styleflags |= DNS_STYLEFLAG_NOCRYPTO;
+		}
+		if (display_multiline) {
+			styleflags |= DNS_STYLEFLAG_OMIT_OWNER;
+			styleflags |= DNS_STYLEFLAG_OMIT_CLASS;
+			styleflags |= DNS_STYLEFLAG_REL_DATA;
+			styleflags |= DNS_STYLEFLAG_OMIT_TTL;
+			styleflags |= DNS_STYLEFLAG_TTL;
+			styleflags |= DNS_STYLEFLAG_MULTILINE;
+			styleflags |= DNS_STYLEFLAG_COMMENT;
+			/* Turn on rrcomments unless explicitly disabled */
+			if (display_rrcomments >= 0) {
+				styleflags |= DNS_STYLEFLAG_RRCOMMENT;
+			}
+		}
 	}
 	if (display_multiline || (!display_ttl && !display_class))
 		result = dns_master_stylecreate(&style, styleflags,
@@ -295,7 +312,60 @@ recvresponse(isc_task_t *task, isc_event_t *event) {
 	result = isc_buffer_allocate(mctx, &buf, len);
 	CHECK("isc_buffer_allocate", result);
 
-	if (display_comments && !display_short_form) {
+	if (yaml) {
+		char sockstr[ISC_SOCKADDR_FORMATSIZE];
+		uint16_t sport;
+		char *hash;
+		int pf;
+
+		printf("-\n");
+		printf("  type: MESSAGE\n");
+		printf("  message:\n");
+
+		if (((response->flags & DNS_MESSAGEFLAG_RD) != 0) &&
+		    ((response->flags & DNS_MESSAGEFLAG_RA) != 0))
+		{
+			printf("    type: RECURSIVE_RESPONSE\n");
+		} else {
+			printf("    type: AUTH_RESPONSE\n");
+		}
+
+		printf("    message_size: %ub\n",
+		       isc_buffer_usedlength(msgbuf));
+
+		pf = isc_sockaddr_pf(&dstaddr);
+		if (pf == PF_INET || pf == PF_INET6) {
+			printf("    socket_family: %s\n",
+			       pf == PF_INET ? "INET" : "INET6");
+
+			printf("    socket_protocol: %s\n",
+			       tcp_mode ? "TCP" : "UDP");
+
+			sport = isc_sockaddr_getport(&dstaddr);
+			isc_sockaddr_format(&dstaddr, sockstr, sizeof(sockstr));
+			hash = strchr(sockstr, '#');
+			if (hash != NULL) {
+				*hash = '\0';
+			}
+			printf("    response_address: %s\n", sockstr);
+			printf("    response_port: %u\n", sport);
+		}
+
+		if (have_src) {
+			sport = isc_sockaddr_getport(&srcaddr);
+			isc_sockaddr_format(&srcaddr, sockstr, sizeof(sockstr));
+			hash = strchr(sockstr, '#');
+			if (hash != NULL) {
+				*hash = '\0';
+			}
+			printf("    query_address: %s\n", sockstr);
+			printf("    query_port: %u\n", sport);
+		}
+
+		printf("    %s:\n", "response_message_data");
+		result = dns_message_headertotext(response, style, flags, buf);
+		CHECK("dns_message_headertotext", result);
+	} else if (display_comments && !display_short_form) {
 		printf(";; Got answer:\n");
 
 		if (display_headers) {
@@ -465,8 +535,11 @@ buftoosmall:
 		CHECK("dns_message_pseudosectiontotext", result);
 	}
 
-	if (display_headers && display_comments && !display_short_form)
+	if (display_headers && display_comments &&
+	    !display_short_form && !yaml)
+	{
 		printf("\n");
+	}
 
 	printf("%.*s", (int)isc_buffer_usedlength(buf),
 	       (char *)isc_buffer_base(buf));
@@ -515,8 +588,7 @@ compute_cookie(unsigned char *cookie, size_t len) {
 }
 
 static isc_result_t
-sendquery(struct query *query, isc_task_t *task)
-{
+sendquery(struct query *query, isc_task_t *task) {
 	dns_request_t *request;
 	dns_message_t *message;
 	dns_name_t *qname;
@@ -699,8 +771,7 @@ sendquery(struct query *query, isc_task_t *task)
 }
 
 static void
-sendqueries(isc_task_t *task, isc_event_t *event)
-{
+sendqueries(isc_task_t *task, isc_event_t *event) {
 	struct query *query = (struct query *)event->ev_arg;
 
 	isc_event_free(&event);
@@ -1509,6 +1580,13 @@ plus_option(char *option, struct query *query, bool global)
 		GLOBAL();
 		tcp_mode = state;
 		break;
+	case 'y': /* yaml */
+		FULLCHECK("yaml");
+		yaml = state;
+		if (state) {
+			display_rrcomments = state;
+		}
+		break;
 	case 'z': /* zflag */
 		FULLCHECK("zflag");
 		query->have_zflag = state;
@@ -1969,7 +2047,7 @@ main(int argc, char *argv[]) {
 		fatal("can't choose between IPv4 and IPv6");
 
 	taskmgr = NULL;
-	RUNCHECK(isc_taskmgr_create(mctx, 1, 0, &taskmgr));
+	RUNCHECK(isc_taskmgr_create(mctx, 1, 0, NULL, &taskmgr));
 	task = NULL;
 	RUNCHECK(isc_task_create(taskmgr, 0, &task));
 	timermgr = NULL;

bin/tools/mdig.docbook

@@ -399,6 +399,15 @@
           </listitem>
         </varlistentry>
 
+	<varlistentry>
+	  <term><option>+[no]yaml</option></term>
+	  <listitem>
+	    <para>
+	      Print the responses in a detailed YAML format.
+	    </para>
+	  </listitem>
+	</varlistentry>
+
       </variablelist>
 
     </para>

bin/tools/mdig.html

@@ -333,6 +333,12 @@
               stands for "virtual circuit".
             </p>
           </dd>
+<dt><span class="term"><code class="option">+[no]yaml</code></span></dt>
+<dd>
+	    <p>
+	      Print the responses in a detailed YAML format.
+	    </p>
+	  </dd>
 </dl></div>
 <p>
 

cocci/dns_rbtnodechain_init.spatch

@@ -0,0 +1,7 @@
+@@
+expression C;
+expression M;
+@@
+
+- dns_rbtnodechain_init(C, M);
++ dns_rbtnodechain_init(C);

cocci/isc_event_allocat_never_fail.spatch

@@ -0,0 +1,33 @@
+@@
+statement S;
+expression V;
+@@
+
+V = isc_event_allocate(...);
+- if (V == NULL) S
+
+@@
+type T;
+statement S;
+expression V;
+@@
+
+V = (T *)isc_event_allocate(...);
+- if (V == NULL) S
+
+@@
+statement S;
+expression V;
+@@
+
+if (V == NULL) V = isc_event_allocate(...);
+- if (V == NULL) S
+
+@@
+statement S1, S2;
+expression V;
+@@
+
+V = isc_event_allocate(...);
+- if (V == NULL) S1 else { S2 }
++ S2

config.h.in

@@ -279,6 +279,9 @@
 /* define if OpenSSL supports Ed448 */
 #undef HAVE_OPENSSL_ED448
 
+/* define if OpenSSL supports SipHash */
+#undef HAVE_OPENSSL_SIPHASH
+
 /* Define to 1 if you have the `processor_bind' function. */
 #undef HAVE_PROCESSOR_BIND
 

configure

@@ -850,6 +850,7 @@ infodir
 docdir
 oldincludedir
 includedir
+runstatedir
 localstatedir
 sharedstatedir
 sysconfdir
@@ -1020,6 +1021,7 @@ datadir='${datarootdir}'
 sysconfdir='${prefix}/etc'
 sharedstatedir='${prefix}/com'
 localstatedir='${prefix}/var'
+runstatedir='${localstatedir}/run'
 includedir='${prefix}/include'
 oldincludedir='/usr/include'
 docdir='${datarootdir}/doc/${PACKAGE_TARNAME}'
@@ -1272,6 +1274,15 @@ do
   | -silent | --silent | --silen | --sile | --sil)
     silent=yes ;;
 
+  -runstatedir | --runstatedir | --runstatedi | --runstated \
+  | --runstate | --runstat | --runsta | --runst | --runs \
+  | --run | --ru | --r)
+    ac_prev=runstatedir ;;
+  -runstatedir=* | --runstatedir=* | --runstatedi=* | --runstated=* \
+  | --runstate=* | --runstat=* | --runsta=* | --runst=* | --runs=* \
+  | --run=* | --ru=* | --r=*)
+    runstatedir=$ac_optarg ;;
+
   -sbindir | --sbindir | --sbindi | --sbind | --sbin | --sbi | --sb)
     ac_prev=sbindir ;;
   -sbindir=* | --sbindir=* | --sbindi=* | --sbind=* | --sbin=* \
@@ -1409,7 +1420,7 @@ fi
 for ac_var in	exec_prefix prefix bindir sbindir libexecdir datarootdir \
 		datadir sysconfdir sharedstatedir localstatedir includedir \
 		oldincludedir docdir infodir htmldir dvidir pdfdir psdir \
-		libdir localedir mandir
+		libdir localedir mandir runstatedir
 do
   eval ac_val=\$$ac_var
   # Remove trailing slashes.
@@ -1562,6 +1573,7 @@ Fine tuning of the installation directories:
   --sysconfdir=DIR        read-only single-machine data [PREFIX/etc]
   --sharedstatedir=DIR    modifiable architecture-independent data [PREFIX/com]
   --localstatedir=DIR     modifiable single-machine data [PREFIX/var]
+  --runstatedir=DIR       modifiable per-process data [LOCALSTATEDIR/run]
   --libdir=DIR            object code libraries [EPREFIX/lib]
   --includedir=DIR        C header files [PREFIX/include]
   --oldincludedir=DIR     C header files for non-gcc [/usr/include]
@@ -4002,7 +4014,7 @@ else
     We can't simply define LARGE_OFF_T to be 9223372036854775807,
     since some C++ compilers masquerading as C compilers
     incorrectly reject 9223372036854775807.  */
-#define LARGE_OFF_T (((off_t) 1 << 62) - 1 + ((off_t) 1 << 62))
+#define LARGE_OFF_T ((((off_t) 1 << 31) << 31) - 1 + (((off_t) 1 << 31) << 31))
   int off_t_is_large[(LARGE_OFF_T % 2147483629 == 721
 		       && LARGE_OFF_T % 2147483647 == 1)
 		      ? 1 : -1];
@@ -4048,7 +4060,7 @@ else
     We can't simply define LARGE_OFF_T to be 9223372036854775807,
     since some C++ compilers masquerading as C compilers
     incorrectly reject 9223372036854775807.  */
-#define LARGE_OFF_T (((off_t) 1 << 62) - 1 + ((off_t) 1 << 62))
+#define LARGE_OFF_T ((((off_t) 1 << 31) << 31) - 1 + (((off_t) 1 << 31) << 31))
   int off_t_is_large[(LARGE_OFF_T % 2147483629 == 721
 		       && LARGE_OFF_T % 2147483647 == 1)
 		      ? 1 : -1];
@@ -4072,7 +4084,7 @@ rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
     We can't simply define LARGE_OFF_T to be 9223372036854775807,
     since some C++ compilers masquerading as C compilers
     incorrectly reject 9223372036854775807.  */
-#define LARGE_OFF_T (((off_t) 1 << 62) - 1 + ((off_t) 1 << 62))
+#define LARGE_OFF_T ((((off_t) 1 << 31) << 31) - 1 + (((off_t) 1 << 31) << 31))
   int off_t_is_large[(LARGE_OFF_T % 2147483629 == 721
 		       && LARGE_OFF_T % 2147483647 == 1)
 		      ? 1 : -1];
@@ -4117,7 +4129,7 @@ else
     We can't simply define LARGE_OFF_T to be 9223372036854775807,
     since some C++ compilers masquerading as C compilers
     incorrectly reject 9223372036854775807.  */
-#define LARGE_OFF_T (((off_t) 1 << 62) - 1 + ((off_t) 1 << 62))
+#define LARGE_OFF_T ((((off_t) 1 << 31) << 31) - 1 + (((off_t) 1 << 31) << 31))
   int off_t_is_large[(LARGE_OFF_T % 2147483629 == 721
 		       && LARGE_OFF_T % 2147483647 == 1)
 		      ? 1 : -1];
@@ -4141,7 +4153,7 @@ rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
     We can't simply define LARGE_OFF_T to be 9223372036854775807,
     since some C++ compilers masquerading as C compilers
     incorrectly reject 9223372036854775807.  */
-#define LARGE_OFF_T (((off_t) 1 << 62) - 1 + ((off_t) 1 << 62))
+#define LARGE_OFF_T ((((off_t) 1 << 31) << 31) - 1 + (((off_t) 1 << 31) << 31))
   int off_t_is_large[(LARGE_OFF_T % 2147483629 == 721
 		       && LARGE_OFF_T % 2147483647 == 1)
 		      ? 1 : -1];
@@ -15770,6 +15782,66 @@ fi
 done
 
 
+# libuv
+{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for library containing uv_run" >&5
+$as_echo_n "checking for library containing uv_run... " >&6; }
+if ${ac_cv_search_uv_run+:} false; then :
+  $as_echo_n "(cached) " >&6
+else
+  ac_func_search_save_LIBS=$LIBS
+cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+/* end confdefs.h.  */
+
+/* Override any GCC internal prototype to avoid an error.
+   Use char because int might match the return type of a GCC
+   builtin and then its argument prototype would still apply.  */
+#ifdef __cplusplus
+extern "C"
+#endif
+char uv_run ();
+int
+main ()
+{
+return uv_run ();
+  ;
+  return 0;
+}
+_ACEOF
+for ac_lib in '' uv; do
+  if test -z "$ac_lib"; then
+    ac_res="none required"
+  else
+    ac_res=-l$ac_lib
+    LIBS="-l$ac_lib  $ac_func_search_save_LIBS"
+  fi
+  if ac_fn_c_try_link "$LINENO"; then :
+  ac_cv_search_uv_run=$ac_res
+fi
+rm -f core conftest.err conftest.$ac_objext \
+    conftest$ac_exeext
+  if ${ac_cv_search_uv_run+:} false; then :
+  break
+fi
+done
+if ${ac_cv_search_uv_run+:} false; then :
+
+else
+  ac_cv_search_uv_run=no
+fi
+rm conftest.$ac_ext
+LIBS=$ac_func_search_save_LIBS
+fi
+{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_search_uv_run" >&5
+$as_echo "$ac_cv_search_uv_run" >&6; }
+ac_res=$ac_cv_search_uv_run
+if test "$ac_res" != no; then :
+  test "$ac_res" = "none required" || LIBS="$ac_res $LIBS"
+
+else
+  as_fn_error $? "The uv library was not found. Please install libuv!" "$LINENO" 5
+fi
+
+
 #
 # flockfile is usually provided by pthreads
 #
@@ -16596,6 +16668,36 @@ $as_echo "no" >&6; }
 fi
 rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
 
+{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for SipHash support" >&5
+$as_echo_n "checking for SipHash support... " >&6; }
+cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+/* end confdefs.h.  */
+#include <openssl/evp.h>
+		       #include <openssl/opensslv.h>
+int
+main ()
+{
+#if OPENSSL_VERSION_NUMBER < 0x10101010L
+		       #error OpenSSL >= 1.1.1a required for working SipHash initialization
+		       #endif
+		       EVP_PKEY *key = EVP_PKEY_new_raw_private_key(
+			   EVP_PKEY_SIPHASH, NULL, NULL, 0);
+  ;
+  return 0;
+}
+_ACEOF
+if ac_fn_c_try_compile "$LINENO"; then :
+
+$as_echo "#define HAVE_OPENSSL_SIPHASH 1" >>confdefs.h
+
+     { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
+$as_echo "yes" >&6; }
+else
+  { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
+$as_echo "no" >&6; }
+fi
+rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+
 #
 # Check for OpenSSL SHA-1 support
 #
@@ -23326,7 +23428,7 @@ ac_config_commands="$ac_config_commands chmod"
 # elsewhere if there's a good reason for doing so.
 #
 
-ac_config_files="$ac_config_files make/Makefile make/mkdep Makefile bin/Makefile bin/check/Makefile bin/confgen/Makefile bin/confgen/unix/Makefile bin/delv/Makefile bin/dig/Makefile bin/dnssec/Makefile bin/named/Makefile bin/named/unix/Makefile bin/nsupdate/Makefile bin/pkcs11/Makefile bin/plugins/Makefile bin/python/Makefile bin/python/isc/Makefile bin/python/isc/utils.py bin/python/isc/tests/Makefile bin/python/dnssec-checkds.py bin/python/dnssec-coverage.py bin/python/dnssec-keymgr.py bin/python/isc/__init__.py bin/python/isc/checkds.py bin/python/isc/coverage.py bin/python/isc/dnskey.py bin/python/isc/eventlist.py bin/python/isc/keydict.py bin/python/isc/keyevent.py bin/python/isc/keymgr.py bin/python/isc/keyseries.py bin/python/isc/keyzone.py bin/python/isc/policy.py bin/python/isc/rndc.py bin/python/isc/tests/dnskey_test.py bin/python/isc/tests/policy_test.py bin/rndc/Makefile bin/tests/Makefile bin/tests/headerdep_test.sh bin/tests/optional/Makefile bin/tests/pkcs11/Makefile bin/tests/pkcs11/benchmarks/Makefile bin/tests/system/Makefile bin/tests/system/conf.sh bin/tests/system/dlzexternal/Makefile bin/tests/system/dlzexternal/ns1/dlzs.conf bin/tests/system/dyndb/Makefile bin/tests/system/dyndb/driver/Makefile bin/tests/system/pipelined/Makefile bin/tests/system/rndc/Makefile bin/tests/system/rpz/Makefile bin/tests/system/rsabigexponent/Makefile bin/tests/system/tkey/Makefile bin/tools/Makefile contrib/scripts/check-secure-delegation.pl contrib/scripts/zone-edit.sh doc/Makefile doc/arm/Makefile doc/arm/noteversion.xml doc/arm/pkgversion.xml doc/arm/releaseinfo.xml doc/doxygen/Doxyfile doc/doxygen/Makefile doc/doxygen/doxygen-input-filter doc/misc/Makefile doc/tex/Makefile doc/tex/armstyle.sty doc/xsl/Makefile doc/xsl/isc-docbook-chunk.xsl doc/xsl/isc-docbook-html.xsl doc/xsl/isc-manpage.xsl doc/xsl/isc-notes-html.xsl lib/Makefile lib/bind9/Makefile lib/bind9/include/Makefile lib/bind9/include/bind9/Makefile lib/dns/Makefile lib/dns/include/Makefile lib/dns/include/dns/Makefile lib/dns/include/dst/Makefile lib/dns/tests/Makefile lib/irs/Makefile lib/irs/include/Makefile lib/irs/include/irs/Makefile lib/irs/include/irs/netdb.h lib/irs/include/irs/platform.h lib/irs/tests/Makefile lib/isc/pthreads/Makefile lib/isc/pthreads/include/Makefile lib/isc/pthreads/include/isc/Makefile lib/isc/Makefile lib/isc/include/Makefile lib/isc/include/isc/Makefile lib/isc/include/isc/platform.h lib/isc/include/pk11/Makefile lib/isc/include/pkcs11/Makefile lib/isc/tests/Makefile lib/isc/unix/Makefile lib/isc/unix/include/Makefile lib/isc/unix/include/isc/Makefile lib/isc/unix/include/pkcs11/Makefile lib/isccc/Makefile lib/isccc/include/Makefile lib/isccc/include/isccc/Makefile lib/isccc/tests/Makefile lib/isccfg/Makefile lib/isccfg/include/Makefile lib/isccfg/include/isccfg/Makefile lib/isccfg/tests/Makefile lib/ns/Makefile lib/ns/include/Makefile lib/ns/include/ns/Makefile lib/ns/tests/Makefile lib/samples/Makefile lib/samples/Makefile-postinstall unit/unittest.sh fuzz/Makefile"
+ac_config_files="$ac_config_files make/Makefile make/mkdep Makefile bin/Makefile bin/check/Makefile bin/confgen/Makefile bin/confgen/unix/Makefile bin/delv/Makefile bin/dig/Makefile bin/dnssec/Makefile bin/named/Makefile bin/named/unix/Makefile bin/nsupdate/Makefile bin/pkcs11/Makefile bin/plugins/Makefile bin/python/Makefile bin/python/isc/Makefile bin/python/isc/utils.py bin/python/isc/tests/Makefile bin/python/dnssec-checkds.py bin/python/dnssec-coverage.py bin/python/dnssec-keymgr.py bin/python/isc/__init__.py bin/python/isc/checkds.py bin/python/isc/coverage.py bin/python/isc/dnskey.py bin/python/isc/eventlist.py bin/python/isc/keydict.py bin/python/isc/keyevent.py bin/python/isc/keymgr.py bin/python/isc/keyseries.py bin/python/isc/keyzone.py bin/python/isc/policy.py bin/python/isc/rndc.py bin/python/isc/tests/dnskey_test.py bin/python/isc/tests/policy_test.py bin/rndc/Makefile bin/tests/Makefile bin/tests/headerdep_test.sh bin/tests/optional/Makefile bin/tests/pkcs11/Makefile bin/tests/pkcs11/benchmarks/Makefile bin/tests/system/Makefile bin/tests/system/conf.sh bin/tests/system/dlzexternal/Makefile bin/tests/system/dlzexternal/ns1/dlzs.conf bin/tests/system/dyndb/Makefile bin/tests/system/dyndb/driver/Makefile bin/tests/system/pipelined/Makefile bin/tests/system/rndc/Makefile bin/tests/system/rpz/Makefile bin/tests/system/rsabigexponent/Makefile bin/tests/system/tkey/Makefile bin/tools/Makefile contrib/scripts/check-secure-delegation.pl contrib/scripts/zone-edit.sh doc/Makefile doc/arm/Makefile doc/arm/noteversion.xml doc/arm/pkgversion.xml doc/arm/releaseinfo.xml doc/doxygen/Doxyfile doc/doxygen/Makefile doc/doxygen/doxygen-input-filter doc/misc/Makefile doc/tex/Makefile doc/tex/armstyle.sty doc/xsl/Makefile doc/xsl/isc-docbook-chunk.xsl doc/xsl/isc-docbook-html.xsl doc/xsl/isc-manpage.xsl doc/xsl/isc-notes-html.xsl lib/Makefile lib/bind9/Makefile lib/bind9/include/Makefile lib/bind9/include/bind9/Makefile lib/dns/Makefile lib/dns/include/Makefile lib/dns/include/dns/Makefile lib/dns/include/dst/Makefile lib/dns/tests/Makefile lib/irs/Makefile lib/irs/include/Makefile lib/irs/include/irs/Makefile lib/irs/include/irs/netdb.h lib/irs/include/irs/platform.h lib/irs/tests/Makefile lib/isc/pthreads/Makefile lib/isc/pthreads/include/Makefile lib/isc/pthreads/include/isc/Makefile lib/isc/Makefile lib/isc/include/Makefile lib/isc/include/isc/Makefile lib/isc/include/isc/platform.h lib/isc/include/pk11/Makefile lib/isc/include/pkcs11/Makefile lib/isc/netmgr/Makefile lib/isc/tests/Makefile lib/isc/unix/Makefile lib/isc/unix/include/Makefile lib/isc/unix/include/isc/Makefile lib/isc/unix/include/pkcs11/Makefile lib/isccc/Makefile lib/isccc/include/Makefile lib/isccc/include/isccc/Makefile lib/isccc/tests/Makefile lib/isccfg/Makefile lib/isccfg/include/Makefile lib/isccfg/include/isccfg/Makefile lib/isccfg/tests/Makefile lib/ns/Makefile lib/ns/include/Makefile lib/ns/include/ns/Makefile lib/ns/tests/Makefile lib/samples/Makefile lib/samples/Makefile-postinstall unit/unittest.sh fuzz/Makefile"
 
 
 #
@@ -24426,6 +24528,7 @@ do
     "lib/isc/include/isc/platform.h") CONFIG_FILES="$CONFIG_FILES lib/isc/include/isc/platform.h" ;;
     "lib/isc/include/pk11/Makefile") CONFIG_FILES="$CONFIG_FILES lib/isc/include/pk11/Makefile" ;;
     "lib/isc/include/pkcs11/Makefile") CONFIG_FILES="$CONFIG_FILES lib/isc/include/pkcs11/Makefile" ;;
+    "lib/isc/netmgr/Makefile") CONFIG_FILES="$CONFIG_FILES lib/isc/netmgr/Makefile" ;;
     "lib/isc/tests/Makefile") CONFIG_FILES="$CONFIG_FILES lib/isc/tests/Makefile" ;;
     "lib/isc/unix/Makefile") CONFIG_FILES="$CONFIG_FILES lib/isc/unix/Makefile" ;;
     "lib/isc/unix/include/Makefile") CONFIG_FILES="$CONFIG_FILES lib/isc/unix/include/Makefile" ;;

configure.ac

@@ -641,6 +641,9 @@ AC_CHECK_FUNCS([pthread_setaffinity_np cpuset_setaffinity processor_bind sched_s
 AC_CHECK_FUNCS([pthread_setname_np pthread_set_name_np])
 AC_CHECK_HEADERS([pthread_np.h], [], [], [#include <pthread.h>])
 
+# libuv
+AC_SEARCH_LIBS([uv_run], [uv], [], AC_MSG_ERROR([The uv library was not found. Please install libuv!]))
+
 #
 # flockfile is usually provided by pthreads
 #
@@ -776,6 +779,19 @@ AC_COMPILE_IFELSE(
      AC_MSG_RESULT([yes])],
     [AC_MSG_RESULT([no])])
 
+AC_MSG_CHECKING([for SipHash support])
+AC_COMPILE_IFELSE(
+    [AC_LANG_PROGRAM([[#include <openssl/evp.h>
+		       #include <openssl/opensslv.h>]],
+		     [[#if OPENSSL_VERSION_NUMBER < 0x10101010L
+		       #error OpenSSL >= 1.1.1a required for working SipHash initialization
+		       #endif
+		       EVP_PKEY *key = EVP_PKEY_new_raw_private_key(
+			   EVP_PKEY_SIPHASH, NULL, NULL, 0);]])],
+    [AC_DEFINE([HAVE_OPENSSL_SIPHASH], [1], [define if OpenSSL supports SipHash])
+     AC_MSG_RESULT([yes])],
+    [AC_MSG_RESULT([no])])
+
 #
 # Check for OpenSSL SHA-1 support
 #
@@ -2810,6 +2826,7 @@ AC_CONFIG_FILES([
 	lib/isc/include/isc/platform.h
 	lib/isc/include/pk11/Makefile
 	lib/isc/include/pkcs11/Makefile
+	lib/isc/netmgr/Makefile
 	lib/isc/tests/Makefile
 	lib/isc/unix/Makefile
 	lib/isc/unix/include/Makefile

contrib/dlz/modules/mysqldyn/dlz_mysqldyn_mod.c

@@ -1297,9 +1297,21 @@ dlz_newversion(const char *zone, void *dbdata, void **versionp) {
 	 * Create new transaction
 	 */
 	newtx = (mysql_transaction_t *)
-		malloc(sizeof(mysql_transaction_t));
+		calloc(1, sizeof(mysql_transaction_t));
+	if (newtx == NULL) {
+		result = ISC_R_NOMEMORY;
+		goto cleanup;
+	}
 	newtx->zone = strdup(zone);
+	if (newtx->zone == NULL) {
+		result = ISC_R_NOMEMORY;
+		goto cleanup;
+	}
 	newtx->zone_id = strdup(zone_id);
+	if (newtx->zone_id == NULL) {
+		result = ISC_R_NOMEMORY;
+		goto cleanup;
+	}
 	newtx->dbi = get_dbi(state);
 	newtx->next = NULL;
 
@@ -1329,9 +1341,15 @@ dlz_newversion(const char *zone, void *dbdata, void **versionp) {
 		*versionp = (void *) newtx;
 	} else {
 		dlz_mutex_unlock(&state->tx_mutex);
-		free(newtx->zone);
-		free(newtx->zone_id);
-		free(newtx);
+		if (newtx != NULL) {
+			if (newtx->zone != NULL) {
+				free(newtx->zone);
+			}
+			if (newtx->zone != NULL) {
+				free(newtx->zone_id);
+			}
+			free(newtx);
+		}
 	}
 
 	return (result);

doc/arm/Bv9ARM-book.xml

@@ -8963,18 +8963,7 @@ avoid-v6-udp-ports { 40000; range 50000 60000; };
 		  this has the greatest chance of success on the first try.
 		</para>
 		<para>
-		  If the initial response times out, <command>named</command>
-		  will try again with plain DNS, and if that is successful,
-		  it will be taken as evidence that the server does not
-		  support EDNS. After enough failures using EDNS and
-		  successes using plain DNS, <command>named</command>
-		  will default to plain DNS for future communications
-		  with that server.  (Periodically, <command>named</command>
-		  will send an EDNS query to see if the situation has
-		  improved.)
-		</para>
-		<para>
-		  However, if the initial query is successful with
+		  If the initial query is successful with
 		  EDNS advertising a buffer size of 512, then
 		  <command>named</command> will advertise progressively
 		  larger buffer sizes on successive queries, until
@@ -10318,22 +10307,6 @@ example.com                 CNAME   rpz-tcp-only.
 	    but are counted to compute the query per second rate.
 	  </para>
 
-	  <para>
-	    Rate limiters for different name spaces maintain
-	    separate counters: If, for example, there is a
-	    <command>rate-limit</command> statement for "com" and
-	    another for "example.com", queries matching "example.com"
-	    will not be debited against the rate limiter for "com".
-	  </para>
-
-	  <para>
-	    If a <command>rate-limit</command> statement does not specify a
-	    <command>domain</command>, then it applies to the root domain
-	    (".") and thus affects the entire DNS namespace, except those
-	    portions covered by other <command>rate-limit</command>
-	    statements.
-	  </para>
-
 	  <para>
 	    Communities of DNS clients can be given their own parameters or no
 	    rate limiting by putting

doc/arm/Bv9ARM.ch01.html

@@ -614,6 +614,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.3 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.4 (Development Release)</p>
 </body>
 </html>

doc/arm/Bv9ARM.ch02.html

@@ -146,6 +146,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.3 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.4 (Development Release)</p>
 </body>
 </html>

doc/arm/Bv9ARM.ch03.html

@@ -856,6 +856,6 @@ controls {
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.3 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.4 (Development Release)</p>
 </body>
 </html>

doc/arm/Bv9ARM.ch04.html

@@ -2840,6 +2840,6 @@ $ORIGIN 0.0.0.0.0.0.0.0.8.b.d.0.1.0.0.2.ip6.arpa.
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.3 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.4 (Development Release)</p>
 </body>
 </html>

doc/arm/Bv9ARM.ch05.html

@@ -6968,18 +6968,7 @@ avoid-v6-udp-ports { 40000; range 50000 60000; };
                   this has the greatest chance of success on the first try.
                 </p>
                 <p>
-                  If the initial response times out, <span class="command"><strong>named</strong></span>
-                  will try again with plain DNS, and if that is successful,
-                  it will be taken as evidence that the server does not
-                  support EDNS. After enough failures using EDNS and
-                  successes using plain DNS, <span class="command"><strong>named</strong></span>
-                  will default to plain DNS for future communications
-                  with that server.  (Periodically, <span class="command"><strong>named</strong></span>
-                  will send an EDNS query to see if the situation has
-                  improved.)
-                </p>
-                <p>
-                  However, if the initial query is successful with
+                  If the initial query is successful with
                   EDNS advertising a buffer size of 512, then
                   <span class="command"><strong>named</strong></span> will advertise progressively
                   larger buffer sizes on successive queries, until
@@ -8258,22 +8247,6 @@ example.com                 CNAME   rpz-tcp-only.
             but are counted to compute the query per second rate.
           </p>
 
-          <p>
-            Rate limiters for different name spaces maintain
-            separate counters: If, for example, there is a
-            <span class="command"><strong>rate-limit</strong></span> statement for "com" and
-            another for "example.com", queries matching "example.com"
-            will not be debited against the rate limiter for "com".
-          </p>
-
-          <p>
-            If a <span class="command"><strong>rate-limit</strong></span> statement does not specify a
-            <span class="command"><strong>domain</strong></span>, then it applies to the root domain
-            (".") and thus affects the entire DNS namespace, except those
-            portions covered by other <span class="command"><strong>rate-limit</strong></span>
-            statements.
-          </p>
-
           <p>
             Communities of DNS clients can be given their own parameters or no
             rate limiting by putting
@@ -14924,6 +14897,6 @@ HOST-127.EXAMPLE. MX 0 .
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.3 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.4 (Development Release)</p>
 </body>
 </html>

doc/arm/Bv9ARM.ch06.html

@@ -360,6 +360,6 @@ allow-query { !{ !10/8; any; }; key example; };
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.3 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.4 (Development Release)</p>
 </body>
 </html>

doc/arm/Bv9ARM.ch07.html

@@ -191,6 +191,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.3 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.4 (Development Release)</p>
 </body>
 </html>

doc/arm/Bv9ARM.ch08.html

@@ -36,7 +36,7 @@
 <div class="toc">
 <p><b>Table of Contents</b></p>
 <dl class="toc">
-<dt><span class="section"><a href="Bv9ARM.ch08.html#id-1.9.2">Release Notes for BIND Version 9.15.3</a></span></dt>
+<dt><span class="section"><a href="Bv9ARM.ch08.html#id-1.9.2">Release Notes for BIND Version 9.15.4</a></span></dt>
 <dd><dl>
 <dt><span class="section"><a href="Bv9ARM.ch08.html#relnotes_intro">Introduction</a></span></dt>
 <dt><span class="section"><a href="Bv9ARM.ch08.html#relnotes_versions">Note on Version Numbering</a></span></dt>
@@ -55,7 +55,7 @@
 </div>
       <div class="section">
 <div class="titlepage"><div><div><h2 class="title" style="clear: both">
-<a name="id-1.9.2"></a>Release Notes for BIND Version 9.15.3</h2></div></div></div>
+<a name="id-1.9.2"></a>Release Notes for BIND Version 9.15.4</h2></div></div></div>
   
   <div class="section">
 <div class="titlepage"><div><div><h3 class="title">
@@ -163,6 +163,15 @@
 <div class="titlepage"><div><div><h3 class="title">
 <a name="relnotes_features"></a>New Features</h3></div></div></div>
     <div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; ">
+<li class="listitem">
+	<p>
+          Added a new command line option to <span class="command"><strong>dig</strong></span>:
+	  <span style="color: red">&lt;comand&gt;+[no]unexpected&lt;/comand&gt;</span>. By default, <span class="command"><strong>dig</strong></span>
+	  won't accept a reply from a source other than the one to which
+	  it sent the query.  Add the <span class="command"><strong>+unexpected</strong></span> argument
+	  to enable it to process replies from unexpected sources.
+        </p>
+      </li>
 <li class="listitem">
 	<p>
 	  The GeoIP2 API from MaxMind is now supported. Geolocation support
@@ -236,9 +245,16 @@
       </li>
 <li class="listitem">
 	<p>
-	Statistics channel groups are now toggleable. [GL #1030]
+	  Statistics channel groups are now toggleable. [GL #1030]
 	</p>
       </li>
+<li class="listitem">
+	<p>
+	  <span class="command"><strong>dig</strong></span>, <span class="command"><strong>mdig</strong></span> and
+	  <span class="command"><strong>delv</strong></span> can all now take a <span class="command"><strong>+yaml</strong></span>
+	  option to print output in a a detailed YAML format. [RT #1145]
+        </p>
+      </li>
 </ul></div>
   </div>
 
@@ -328,7 +344,7 @@
 	  A SipHash 2-4 based DNS Cookie (RFC 7873) algorithm has been added and
 	  made default.  Old non-default HMAC-SHA based DNS Cookie algorithms
 	  have been removed, and only the default AES algorithm is being kept
-	  for legacy reasons.  This changes doesn't have any operational impact
+	  for legacy reasons.  This change doesn't have any operational impact
 	  in most common scenarios. [GL #605]
 	</p>
 	<p>
@@ -426,8 +442,8 @@
       </li>
 <li class="listitem">
 	<p>
-	  <span class="command"><strong>named-checkconf</strong></span> now correctly reports missing
-	  <span class="command"><strong>dnstap-output</strong></span> option when
+	  <span class="command"><strong>named-checkconf</strong></span> now correctly reports
+	  a missing <span class="command"><strong>dnstap-output</strong></span> option when
 	  <span class="command"><strong>dnstap</strong></span> is set. [GL #1136]
 	</p>
       </li>
@@ -443,6 +459,13 @@
 	  when run with <span class="command"><strong>+expandaaaa +short</strong></span>. [GL #1152]
 	</p>
       </li>
+<li class="listitem">
+	<p>
+	  When a <span class="command"><strong>response-policy</strong></span> zone expires, ensure
+	  that its policies are removed from the RPZ summary database.
+	  [GL #1146]
+	</p>
+      </li>
 </ul></div>
   </div>
 
@@ -518,6 +541,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.3 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.4 (Development Release)</p>
 </body>
 </html>

doc/arm/Bv9ARM.ch09.html

@@ -148,6 +148,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.3 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.4 (Development Release)</p>
 </body>
 </html>

doc/arm/Bv9ARM.ch10.html

@@ -914,6 +914,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.3 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.4 (Development Release)</p>
 </body>
 </html>

doc/arm/Bv9ARM.ch11.html

@@ -537,6 +537,6 @@ $ <strong class="userinput"><code>sample-update -a sample-update -k Kxxx.+nnn+mm
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.3 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.4 (Development Release)</p>
 </body>
 </html>

doc/arm/Bv9ARM.ch12.html

@@ -210,6 +210,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.3 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.4 (Development Release)</p>
 </body>
 </html>