Update release.md

Merge branch 'ondrej/vicky/add-coc' into 'master'
Add Code of Conduct See merge request isc-projects/bind9!2219
2019-08-29 19:57:45 -04:00 · 2019-08-29 15:04:44 -04:00 · 2019-08-29 21:01:29 +02:00 · 2019-08-29 13:29:45 -04:00 · 2019-08-29 10:07:41 -07:00 · 2019-08-29 10:03:36 -07:00
62 changed files with 1269 additions and 383 deletions
@@ -17,7 +17,9 @@ variables:
 stages:
  - precheck
  - build
-  - test
+  - unit
+  - system
+  - docs
  - push

 ### Runner Tag Templates
@@ -148,6 +150,8 @@ stages:
    - test -z "${RUN_MAKE_INSTALL}" || make install
  dependencies:
    - autoreconf:sid:amd64
+  needs:
+    - autoreconf:sid:amd64
  artifacts:
    untracked: true
    expire_in: "1 hour"
@@ -164,7 +168,7 @@ stages:

 .system_test: &system_test_job
  <<: *default_triggering_rules
-  stage: test
+  stage: system
  retry: 2
  before_script:
    - *setup_interfaces
@@ -186,7 +190,7 @@ stages:

 .unit_test: &unit_test_job
  <<: *default_triggering_rules
-  stage: test
+  stage: unit
  before_script:
    - *setup_softhsm
  script:
@@ -242,13 +246,15 @@ misc:sid:amd64:

 docs:sid:amd64:
  <<: *debian_sid_amd64_image
-  stage: build
+  stage: docs
  script:
    - ./configure || cat config.log
    - make -C doc/misc docbook
    - make -C doc/arm Bv9ARM.html
  dependencies:
    - autoreconf:sid:amd64
+  needs:
+    - autoreconf:sid:amd64
  artifacts:
    paths:
      - doc/arm/
@@ -285,12 +291,14 @@ system:gcc:alpine3.10:amd64:
  <<: *system_test_job
  dependencies:
    - gcc:alpine3.10:amd64
+  needs: ["gcc:alpine3.10:amd64"]

 unit:gcc:alpine3.10:amd64:
  <<: *alpine_3_10_amd64_image
  <<: *unit_test_job
  dependencies:
    - gcc:alpine3.10:amd64
+  needs: ["gcc:alpine3.10:amd64"]

 # Jobs for regular GCC builds on CentOS 6 (amd64)

@@ -307,12 +315,14 @@ system:gcc:centos6:amd64:
  <<: *system_test_job
  dependencies:
    - gcc:centos6:amd64
+  needs: ["gcc:centos6:amd64"]

 unit:gcc:centos6:amd64:
  <<: *centos_centos6_amd64_image
  <<: *unit_test_job
  dependencies:
    - gcc:centos6:amd64
+  needs: ["gcc:centos6:amd64"]

 # Jobs for regular GCC builds on CentOS 7 (amd64)

@@ -329,12 +339,14 @@ system:gcc:centos7:amd64:
  <<: *system_test_job
  dependencies:
    - gcc:centos7:amd64
+  needs: ["gcc:centos7:amd64"]

 unit:gcc:centos7:amd64:
  <<: *centos_centos7_amd64_image
  <<: *unit_test_job
  dependencies:
    - gcc:centos7:amd64
+  needs: ["gcc:centos7:amd64"]

 # Jobs for regular GCC builds on Debian 8 Jessie (amd64)

@@ -351,12 +363,14 @@ system:gcc:jessie:amd64:
  <<: *system_test_job
  dependencies:
    - gcc:jessie:amd64
+  needs: ["gcc:jessie:amd64"]

 unit:gcc:jessie:amd64:
  <<: *debian_jessie_amd64_image
  <<: *unit_test_job
  dependencies:
    - gcc:jessie:amd64
+  needs: ["gcc:jessie:amd64"]

 # Jobs for regular GCC builds on Debian 9 Stretch (amd64)

@@ -372,12 +386,14 @@ system:gcc:stretch:amd64:
  <<: *system_test_job
  dependencies:
    - gcc:stretch:amd64
+  needs: ["gcc:stretch:amd64"]

 unit:gcc:stretch:amd64:
  <<: *debian_stretch_amd64_image
  <<: *unit_test_job
  dependencies:
    - gcc:stretch:amd64
+  needs: ["gcc:stretch:amd64"]

 # Jobs for regular GCC builds on Debian 10 Buster (amd64)

@@ -393,12 +409,14 @@ system:gcc:buster:amd64:
  <<: *system_test_job
  dependencies:
    - gcc:buster:amd64
+  needs: ["gcc:buster:amd64"]

 unit:gcc:buster:amd64:
  <<: *debian_buster_amd64_image
  <<: *unit_test_job
  dependencies:
    - gcc:buster:amd64
+  needs: ["gcc:buster:amd64"]

 # Jobs for regular GCC builds on Debian Sid (amd64)

@@ -416,12 +434,14 @@ system:gcc:sid:amd64:
  <<: *system_test_job
  dependencies:
    - gcc:sid:amd64
+  needs: ["gcc:sid:amd64"]

 unit:gcc:sid:amd64:
  <<: *debian_sid_amd64_image
  <<: *unit_test_job
  dependencies:
    - gcc:sid:amd64
+  needs: ["gcc:sid:amd64"]

 # Jobs for regular GCC builds on Debian Sid (i386)

@@ -438,12 +458,14 @@ system:gcc:sid:i386:
  <<: *system_test_job
  dependencies:
    - gcc:sid:i386
+  needs: ["gcc:sid:i386"]

 unit:gcc:sid:i386:
  <<: *debian_sid_i386_image
  <<: *unit_test_job
  dependencies:
    - gcc:sid:i386
+  needs: ["gcc:sid:i386"]

 # Jobs for regular GCC builds on Fedora 30 (amd64)

@@ -460,12 +482,14 @@ system:gcc:fedora30:amd64:
  <<: *system_test_job
  dependencies:
    - gcc:fedora30:amd64
+  needs: ["gcc:fedora30:amd64"]

 unit:gcc:fedora30:amd64:
  <<: *fedora_30_amd64_image
  <<: *unit_test_job
  dependencies:
    - gcc:fedora30:amd64
+  needs: ["gcc:fedora30:amd64"]

 # Jobs for regular GCC builds on Ubuntu 16.04 Xenial Xerus (amd64)

@@ -482,12 +506,14 @@ system:gcc:xenial:amd64:
  <<: *system_test_job
  dependencies:
    - gcc:xenial:amd64
+  needs: ["gcc:xenial:amd64"]

 unit:gcc:xenial:amd64:
  <<: *ubuntu_xenial_amd64_image
  <<: *unit_test_job
  dependencies:
    - gcc:xenial:amd64
+  needs: ["gcc:xenial:amd64"]

 # Jobs for regular GCC builds on Ubuntu 18.04 Bionic Beaver (amd64)

@@ -504,12 +530,14 @@ system:gcc:bionic:amd64:
  <<: *system_test_job
  dependencies:
    - gcc:bionic:amd64
+  needs: ["gcc:bionic:amd64"]

 unit:gcc:bionic:amd64:
  <<: *ubuntu_bionic_amd64_image
  <<: *unit_test_job
  dependencies:
    - gcc:bionic:amd64
+  needs: ["gcc:bionic:amd64"]

 # Jobs for GCC builds with ASAN enabled on Debian Sid (amd64)

@@ -527,12 +555,14 @@ system:asan:sid:amd64:
  <<: *system_test_job
  dependencies:
    - asan:sid:amd64
+  needs: ["asan:sid:amd64"]

 unit:asan:sid:amd64:
  <<: *debian_sid_amd64_image
  <<: *unit_test_job
  dependencies:
    - asan:sid:amd64
+  needs: ["asan:sid:amd64"]

 rwlock:sid:amd64:
  variables:
@@ -547,12 +577,14 @@ system:rwlock:sid:amd64:
  <<: *system_test_job
  dependencies:
    - rwlock:sid:amd64
+  needs: ["rwlock:sid:amd64"]

 unit:rwlock:sid:amd64:
  <<: *debian_sid_amd64_image
  <<: *unit_test_job
  dependencies:
    - rwlock:sid:amd64
+  needs: ["rwlock:sid:amd64"]

 # Jobs for mutex-based atomics on Debian SID (amd64)
 mutexatomics:sid:amd64:
@@ -568,6 +600,7 @@ mutexatomics:sid:amd64:
 #  <<: *system_test_job
 #  dependencies:
 #    - mutexatomics:sid:amd64
+#    - mutexatomics:sid:amd64
 #  allow_failure: true

 #unit:mutexatomics:sid:amd64:
@@ -592,6 +625,7 @@ unit:clang:stretch:amd64:
  <<: *unit_test_job
  dependencies:
    - clang:stretch:amd64
+  needs: ["clang:stretch:amd64"]

 # Jobs for Clang builds on Debian Stretch (i386)

@@ -618,12 +652,14 @@ system:pkcs11:sid:amd64:
  <<: *system_test_job
  dependencies:
    - pkcs11:sid:amd64
+  needs: ["pkcs11:sid:amd64"]

 unit:pkcs11:sid:amd64:
  <<: *debian_sid_amd64_image
  <<: *unit_test_job
  dependencies:
    - pkcs11:sid:amd64
+  needs: ["pkcs11:sid:amd64"]

 # Jobs with libtool disabled

@@ -640,9 +676,11 @@ system:nolibtool:sid:amd64:
  <<: *system_test_job
  dependencies:
    - nolibtool:sid:amd64
+  needs: ["nolibtool:sid:amd64"]

 unit:nolibtool:sid:amd64:
  <<: *debian_sid_amd64_image
  <<: *unit_test_job
  dependencies:
    - nolibtool:sid:amd64
+  needs: ["nolibtool:sid:amd64"]
@@ -39,6 +39,9 @@
 - [ ] Update tickets in case of waiting support customers.

 ## Marketing
- - [ ] Post short note to Twitter.
+ - [ ] Update BIND Product page if needed
+ - [ ] Update BIND Significant Features Matrix in KB if needed
+ - [ ] Update BIND -S Edition data sheet if S Edition feature change
+ - [ ] Announce on social media
 - [ ] Update [Wikipedia entry for BIND](http://en.wikipedia.org/wiki/BIND).
 - [ ] Write blog article (if a major release).
@@ -1,3 +1,13 @@
+5280.	[protocol]	Add support for displaying EDNS option LLQ. [GL #1201]
+
+5279.	[bug]		When loading, reject zones containing CDS or CDNSKEY
+			RRsets at the zone apex if they would cause DNSSEC
+			validation failures if published in the parent zone
+			as the DS RRset.  [GL #1187]
+
+5278.	[func]		Add YAML output formats for dig, mdig and delv;
+			use the "+yaml" option to enable. [GL #1145]
+
 	--- 9.15.3 released ---

 5277.	[bug]		Cache DB statistics could underflow when serve-stale
@@ -0,0 +1,79 @@
+CODE OF CONDUCT
+
+BIND 9 Code of Conduct
+
+Like the technical community as a whole, the BIND 9 team and community is
+made up of a mixture of professionals and volunteers from all over the
+world, working on every aspect of the mission - including mentorship,
+teaching, and connecting people.
+
+Diversity is one of our huge strengths, but it can also lead to
+communication issues and unhappiness. To that end, we have a few ground
+rules that we ask people to adhere to. This code applies equally to the
+core development team, open source contributors and those seeking help and
+guidance.
+
+This isn't an exhaustive list of things that you can't do. Rather, take it
+in the spirit in which it's intended - a guide to make it easier to enrich
+all of us and the technical communities in which we participate.
+
+This code of conduct applies to all spaces managed by the BIND 9 project
+or Internet Systems Consortium. This includes chat, the mailing lists, the
+issue tracker, and any other fora created by the project team which the
+community uses for communication. In addition, violations of this code
+outside these spaces may affect a person's ability to participate within
+them.
+
+If you believe someone is violating the code of conduct, we ask that you
+report it by emailing conduct@isc.org. For more details please see our
+Reporting Guidelines.
+
+  * Be friendly and patient.
+  * Be welcoming. We strive to be a community that welcomes and supports
+    people of all backgrounds and identities. This includes, but is not
+    limited to members of any race, ethnicity, culture, national origin,
+    colour, immigration status, social and economic class, educational
+    level, sex, sexual orientation, gender identity and expression, age,
+    size, family status, political belief, religion, and mental and
+    physical ability.
+  * Be considerate. Your work will be used by other people, and you in
+    turn will depend on the work of others. Any decision you take will
+    affect users and colleagues, and you should take those consequences
+    into account when making decisions. Remember that we're a world-wide
+    community, so you might not be communicating in someone else's primary
+    language.
+  * Be respectful. Not all of us will agree all the time, but disagreement
+    is no excuse for poor behavior and poor manners. We might all
+    experience some frustration now and then, but we cannot allow that
+    frustration to turn into a personal attack. It's important to remember
+    that a community where people feel uncomfortable or threatened is not
+    a productive one. Members of the BIND 9 community should be respectful
+    when dealing with other members as well as with people outside the
+    BIND 9 community.
+  * Be careful in the words that you choose. We are a community of
+    professionals, and we conduct ourselves professionally. Be kind to
+    others. Do not insult or put down other participants. Harassment and
+    other exclusionary behavior aren't acceptable. This includes, but is
+    not limited to:
+      + Violent threats or language directed against another person.
+      + Discriminatory jokes and language.
+      + Posting sexually explicit or violent material.
+      + Posting (or threatening to post) other people's personally
+        identifying information ("doxing").
+      + Personal insults, especially those using racist or sexist terms.
+      + Unwelcome sexual attention.
+      + Advocating for, or encouraging, any of the above behavior.
+      + Repeated harassment of others. In general, if someone asks you to
+        stop, then stop.
+  * When we disagree, try to understand why. Disagreements, both social
+    and technical, happen all the time and BIND 9 is no exception. It is
+    important that we resolve disagreements and differing views
+    constructively. Remember that we're different. The strength of BIND 9
+    comes from its varied community, people from a wide range of
+    backgrounds. Different people have different perspectives on issues.
+    Being unable to understand why someone holds a viewpoint doesn't mean
+    that they're wrong. Don't forget that it is human to err and blaming
+    each other doesn't get us anywhere. Instead, focus on helping to
+    resolve issues and learning from mistakes.
+
+Original text courtesy of the Django Code of Conduct project.
@@ -0,0 +1,71 @@
+# BIND 9 Code of Conduct
+
+Like the technical community as a whole, the BIND 9 team and community is made
+up of a mixture of professionals and volunteers from all over the world, working
+on every aspect of the mission - including mentorship, teaching, and connecting
+people.
+
+Diversity is one of our huge strengths, but it can also lead to communication
+issues and unhappiness. To that end, we have a few ground rules that we ask
+people to adhere to. This code applies equally to the core development team, open source contributors and those
+seeking help and guidance.
+
+This isn't an exhaustive list of things that you can't do. Rather, take it in
+the spirit in which it's intended - a guide to make it easier to enrich all of
+us and the technical communities in which we participate.
+
+This code of conduct applies to all spaces managed by the BIND 9 project or
+Internet Systems Consortium. This includes chat, the mailing lists, the issue
+tracker, and any other fora created by the project team which the
+community uses for communication. In addition, violations of this code outside
+these spaces may affect a person's ability to participate within them.
+
+If you believe someone is violating the code of conduct, we ask that you report
+it by emailing [conduct@isc.org](conduct@isc.org). For more details please see
+our [Reporting Guidelines](https://www.isc.org/conductreporting/).
+
+* **Be friendly and patient.**
+* **Be welcoming.** We strive to be a community that welcomes and supports
+  people of all backgrounds and identities. This includes, but is not limited to
+  members of any race, ethnicity, culture, national origin, colour, immigration
+  status, social and economic class, educational level, sex, sexual orientation,
+  gender identity and expression, age, size, family status, political belief,
+  religion, and mental and physical ability.
+* **Be considerate.** Your work will be used by other people, and you in turn
+  will depend on the work of others. Any decision you take will affect users and
+  colleagues, and you should take those consequences into account when making
+  decisions. Remember that we're a world-wide community, so you might not be
+  communicating in someone else's primary language.
+* **Be respectful.** Not all of us will agree all the time, but disagreement is
+  no excuse for poor behavior and poor manners. We might all experience some
+  frustration now and then, but we cannot allow that frustration to turn into a
+  personal attack. It's important to remember that a community where people feel
+  uncomfortable or threatened is not a productive one. Members of the BIND 9
+  community should be respectful when dealing with other members as well as with
+  people outside the BIND 9 community.
+* **Be careful in the words that you choose.** We are a community of
+  professionals, and we conduct ourselves professionally. Be kind to others. Do
+  not insult or put down other participants. Harassment and other exclusionary
+  behavior aren't acceptable. This includes, but is not limited to:
+  * Violent threats or language directed against another person.
+  * Discriminatory jokes and language.
+  * Posting sexually explicit or violent material.
+  * Posting (or threatening to post) other people's personally identifying
+    information ("doxing").
+  * Personal insults, especially those using racist or sexist terms.
+  * Unwelcome sexual attention.
+  * Advocating for, or encouraging, any of the above behavior.
+  * Repeated harassment of others. In general, if someone asks you to stop, then
+    stop.
+* **When we disagree, try to understand why.** Disagreements, both social and
+  technical, happen all the time and BIND 9 is no exception. It is important
+  that we resolve disagreements and differing views constructively. Remember
+  that we're different. The strength of BIND 9 comes from its varied community,
+  people from a wide range of backgrounds. Different people have different
+  perspectives on issues. Being unable to understand why someone holds a
+  viewpoint doesn't mean that they're wrong. Don't forget that it is human to
+  err and blaming each other doesn't get us anywhere. Instead, focus on helping
+  to resolve issues and learning from mistakes.
+
+Original text courtesy of the [Django Code of Conduct](https://www.djangoproject.com/conduct/)
+project.
@@ -34,6 +34,14 @@ access to the source repository was restricted just as commit access was.
 That's now changing, with the opening of a public git mirror to the BIND
 source tree (see below).

+At Internet Systems Consortium, we're committed to building communities
+that are welcoming and inclusive; environments where people are encouraged
+to share ideas, treat each other with respect, and collaborate towards the
+best solutions. To reinforce our commitment, the Internet Systems
+Consortium has adopted the Contributor Covenant version 1.4 as our Code of
+Conduct for BIND 9 project, as well as for the conduct of our developers
+throughout the industry.
+
 Access to source code

 Public BIND releases are always available from the ISC FTP site.
@@ -41,6 +41,14 @@ a release: read access to the source repository was restricted just
 as commit access was.  That's now changing, with the opening of a
 public git mirror to the BIND source tree (see below).

+At [Internet Systems Consortium](https://www.isc.org), we're committed to
+building communities that are welcoming and inclusive; environments where people
+are encouraged to share ideas, treat each other with respect, and collaborate
+towards the best solutions. To reinforce our commitment, the [Internet Systems
+Consortium](https://www.isc.org) has adopted the Contributor Covenant version
+1.4 as our Code of Conduct for BIND 9 project, as well as for the conduct of our
+developers throughout the industry.
+
 ### <a name="access"></a>Access to source code

 Public BIND releases are always available from the
@@ -108,7 +116,7 @@ ISC's Security Vulnerability Disclosure Policy is documented at [https://kb.isc.
 If you have a crash, you may want to consult
 [‘What to do if your BIND or DHCP server has crashed.’](https://kb.isc.org/article/AA-00340/89/What-to-do-if-your-BIND-or-DHCP-server-has-crashed.html)

-### <a name="bugs"></a>Contributing code
+### <a name="contrib"></a>Contributing code

 BIND is licensed under the
 [Mozilla Public License 2.0](http://www.isc.org/downloads/software-support-policy/isc-license/).
@@ -18,7 +18,7 @@ SUBDIRS =	make lib fuzz bin doc
 TARGETS =
 PREREQS =	bind.keys.h

-MANOBJS =	README HISTORY OPTIONS CONTRIBUTING PLATFORMS \
+MANOBJS =	README HISTORY OPTIONS CONTRIBUTING PLATFORMS CODE_OF_CONDUCT \
 		${MANPAGES} ${HTMLPAGES}

@BIND9_MAKE_RULES@
@@ -103,6 +103,11 @@ PLATFORMS: PLATFORMS.md
 		${W3M} -dump -cols 75 -O ascii -T text/html | \
 		sed -e '$${/^$$/d;}' > $@

+CODE_OF_CONDUCT: CODE_OF_CONDUCT.md
+	${PANDOC} --email-obfuscation=none -s --metadata title="CODE OF CONDUCT" -f markdown-smart -t html $< | \
+		${W3M} -dump -cols 75 -O ascii -T text/html | \
+		sed -e '$${/^$$/d;}' > $@
+
 unit::
 	sh ${top_builddir}/unit/unittest.sh

@@ -87,8 +87,9 @@ ISC maintains a public git repository for BIND; details can be found at
 http://www.isc.org/git/.

 Information for BIND contributors can be found in the following files: -
-General information: CONTRIBUTING.md - BIND 9 code style: doc/dev/style.md
- BIND architecture and developer guide: doc/dev/dev.md
+General information: CONTRIBUTING.md - Code of Conduct: CODE_OF_CONDUCT.md
+- BIND 9 code style: doc/dev/style.md - BIND architecture and developer
+guide: doc/dev/dev.md

 Patches for BIND may be submitted as Merge Requests in the ISC GitLab
 server at at https://gitlab.isc.org/isc-projects/bind9/merge_requests.
@@ -98,7 +98,8 @@ ISC maintains a public git repository for BIND; details can be found
 at [http://www.isc.org/git/](http://www.isc.org/git/).

 Information for BIND contributors can be found in the following files:
- General information: [CONTRIBUTING.md](CONTRIBUTING)
+- General information: [CONTRIBUTING.md](CONTRIBUTING.md)
+- Code of Conduct: [CODE_OF_CONDUCT.md](CODE_OF_CONDUCT.md)
 - BIND 9 code style: [doc/dev/style.md](doc/dev/style.md)
 - BIND architecture and developer guide: [doc/dev/dev.md](doc/dev/dev.md)

@@ -125,6 +126,7 @@ include:

 * Support for the new GeoIP2 geolocation API
 * Improved DNSSEC key configuration using `dnssec-keys`
+* YAML output for dig, mdig, and delv.

 ### <a name="build"/> Building BIND

@@ -111,7 +111,8 @@ static bool
 	nottl = false,
 	multiline = false,
 	short_form = false,
-	print_unknown_format = false;
+	print_unknown_format = false,
+	yaml = false;

 static bool
 	resolve_trace = false,
@@ -353,52 +354,80 @@ setup_logging(FILE *errout) {

 static void
 print_status(dns_rdataset_t *rdataset) {
-	const char *astr = "", *tstr = "";
+	char buf[1024] = { 0 };

 	REQUIRE(rdataset != NULL);

-	if (!showtrust || !dns_rdataset_isassociated(rdataset))
+	if (!showtrust || !dns_rdataset_isassociated(rdataset)) {
 		return;
+	}

-	if ((rdataset->attributes & DNS_RDATASETATTR_NEGATIVE) != 0)
-		astr = "negative response, ";
+	buf[0] = '\0';
+
+	if ((rdataset->attributes & DNS_RDATASETATTR_NEGATIVE) != 0) {
+		strlcat(buf, "negative response", sizeof(buf));
+		strlcat(buf, (yaml ? "_" : ", "), sizeof(buf));
+	}

 	switch (rdataset->trust) {
 	case dns_trust_none:
-		tstr = "untrusted";
+		strlcat(buf, "untrusted", sizeof(buf));
 		break;
 	case dns_trust_pending_additional:
-		tstr = "signed additional data, pending validation";
+		strlcat(buf, "signed additional data", sizeof(buf));
+		if (!yaml) {
+			strlcat(buf, ", ", sizeof(buf));
+		}
+		strlcat(buf, "pending validation", sizeof(buf));
 		break;
 	case dns_trust_pending_answer:
-		tstr = "signed answer, pending validation";
+		strlcat(buf, "signed answer", sizeof(buf));
+		if (!yaml) {
+			strlcat(buf, ", ", sizeof(buf));
+		}
+		strlcat(buf, "pending validation", sizeof(buf));
 		break;
 	case dns_trust_additional:
-		tstr = "unsigned additional data";
+		strlcat(buf, "unsigned additional data", sizeof(buf));
 		break;
 	case dns_trust_glue:
-		tstr = "glue data";
+		strlcat(buf, "glue data", sizeof(buf));
 		break;
 	case dns_trust_answer:
 		if (root_validation) {
-			tstr = "unsigned answer";
+			strlcat(buf, "unsigned answer", sizeof(buf));
+		} else {
+			strlcat(buf, "answer not validated", sizeof(buf));
 		}
 		break;
 	case dns_trust_authauthority:
-		tstr = "authority data";
+		strlcat(buf, "authority data", sizeof(buf));
 		break;
 	case dns_trust_authanswer:
-		tstr = "authoritative";
+		strlcat(buf, "authoritative", sizeof(buf));
 		break;
 	case dns_trust_secure:
-		tstr = "fully validated";
+		strlcat(buf, "fully validated", sizeof(buf));
 		break;
 	case dns_trust_ultimate:
-		tstr = "ultimate trust";
+		strlcat(buf, "ultimate trust", sizeof(buf));
 		break;
 	}

-	printf("; %s%s\n", astr, tstr);
+	if (yaml) {
+		char *p;
+
+		/* Convert spaces to underscores for YAML */
+		for (p = buf; p != NULL && *p != '\0'; p++) {
+			if (*p == ' ') {
+				*p = '_';
+			}
+		}
+
+		printf("  - %s:\n", buf);
+	} else {
+		printf("; %s\n", buf);
+	}
 }

 static isc_result_t
@@ -425,8 +454,9 @@ printdata(dns_rdataset_t *rdataset, dns_name_t *owner,
 		return (ISC_R_SUCCESS);

 	if (first || rdataset->trust != trust) {
-		if (!first && showtrust && !short_form)
+		if (!first && showtrust && !short_form && !yaml) {
 			putchar('\n');
+		}
 		print_status(rdataset);
 		trust = rdataset->trust;
 		first = false;
@@ -465,9 +495,11 @@ printdata(dns_rdataset_t *rdataset, dns_name_t *owner,
 				dns_rdata_reset(&rdata);
 			}
 		} else {
-			if ((rdataset->attributes &
-			     DNS_RDATASETATTR_NEGATIVE) != 0)
+			if (!yaml && (rdataset->attributes &
+				      DNS_RDATASETATTR_NEGATIVE) != 0)
+			{
 				isc_buffer_putstr(&target, "; ");
+			}

 			result = dns_master_rdatasettotext(owner, rdataset,
 							   style, &target);
@@ -500,38 +532,52 @@ setup_style(dns_master_style_t **stylep) {
 	REQUIRE(stylep != NULL || *stylep == NULL);

 	styleflags |= DNS_STYLEFLAG_REL_OWNER;
-	if (showcomments)
-		styleflags |= DNS_STYLEFLAG_COMMENT;
-	if (print_unknown_format)
-		styleflags |= DNS_STYLEFLAG_UNKNOWNFORMAT;
-	if (rrcomments)
-		styleflags |= DNS_STYLEFLAG_RRCOMMENT;
-	if (nottl)
-		styleflags |= DNS_STYLEFLAG_NO_TTL;
-	if (noclass)
-		styleflags |= DNS_STYLEFLAG_NO_CLASS;
-	if (nocrypto)
-		styleflags |= DNS_STYLEFLAG_NOCRYPTO;
-	if (multiline) {
-		styleflags |= DNS_STYLEFLAG_MULTILINE;
-		styleflags |= DNS_STYLEFLAG_COMMENT;
+	if (yaml) {
+		styleflags |= DNS_STYLEFLAG_YAML;
+		dns_master_indentstr = "  ";
+		dns_master_indent = 2;
+	} else {
+		if (showcomments) {
+			styleflags |= DNS_STYLEFLAG_COMMENT;
+		}
+		if (print_unknown_format) {
+			styleflags |= DNS_STYLEFLAG_UNKNOWNFORMAT;
+		}
+		if (rrcomments) {
+			styleflags |= DNS_STYLEFLAG_RRCOMMENT;
+		}
+		if (nottl) {
+			styleflags |= DNS_STYLEFLAG_NO_TTL;
+		}
+		if (noclass) {
+			styleflags |= DNS_STYLEFLAG_NO_CLASS;
+		}
+		if (nocrypto) {
+			styleflags |= DNS_STYLEFLAG_NOCRYPTO;
+		}
+		if (multiline) {
+			styleflags |= DNS_STYLEFLAG_MULTILINE;
+			styleflags |= DNS_STYLEFLAG_COMMENT;
+		}
 	}

-	if (multiline || (nottl && noclass))
+	if (multiline || (nottl && noclass)) {
 		result = dns_master_stylecreate(&style, styleflags,
 						24, 24, 24, 32, 80, 8,
 						splitwidth, mctx);
-	else if (nottl || noclass)
+	} else if (nottl || noclass) {
 		result = dns_master_stylecreate(&style, styleflags,
 						24, 24, 32, 40, 80, 8,
 						splitwidth, mctx);
-	else
+	} else {
 		result = dns_master_stylecreate(&style, styleflags,
 						24, 32, 40, 48, 80, 8,
 						splitwidth, mctx);
+	}

-	if (result == ISC_R_SUCCESS)
+	if (result == ISC_R_SUCCESS) {
 		*stylep = style;
+	}
 	return (result);
 }

@@ -1139,6 +1185,13 @@ plus_option(char *option) {
 		if (state)
 			resolve_trace = state;
 		break;
+	case 'y': /* yaml */
+		FULLCHECK("yaml");
+		yaml = state;
+		if (state) {
+			rrcomments = false;
+		}
+		break;
 	default:
 	invalid_option:
 		/*
@@ -1565,6 +1618,7 @@ main(int argc, char *argv[]) {
 	isc_result_t result;
 	dns_fixedname_t qfn;
 	dns_name_t *query_name, *response_name;
+	char namestr[DNS_NAME_FORMATSIZE];
 	dns_rdataset_t *rdataset;
 	dns_namelist_t namelist;
 	unsigned int resopt, clopt;
@@ -1653,9 +1707,18 @@ main(int argc, char *argv[]) {
 	ISC_LIST_INIT(namelist);
 	result = dns_client_resolve(client, query_name, dns_rdataclass_in,
 				    qtype, resopt, &namelist);
-	if (result != ISC_R_SUCCESS)
+	if (result != ISC_R_SUCCESS && !yaml) {
 		delv_log(ISC_LOG_ERROR, "resolution failed: %s",
 			  isc_result_totext(result));
+	}
+
+	if (yaml) {
+		printf("type: DELV_RESULT\n");
+		dns_name_format(query_name, namestr, sizeof(namestr));
+		printf("query_name: %s\n", namestr);
+		printf("status: %s\n", isc_result_totext(result));
+		printf("records:\n");
+	}

 	for (response_name = ISC_LIST_HEAD(namelist);
 	     response_name != NULL;
@@ -658,6 +658,16 @@
 	    </para>
 	  </listitem>
 	</varlistentry>
+
+	<varlistentry>
+	  <term><option>+[no]yaml</option></term>
+	  <listitem>
+	    <para>
+	      Print response data in YAML format.
+	    </para>
+	  </listitem>
+	</varlistentry>
+
      </variablelist>

    </para>
@@ -64,7 +64,8 @@ static char hexcookie[81];

 static bool short_form = false, printcmd = true,
 	plusquest = false, pluscomm = false,
-	ipv4only = false, ipv6only = false, digrc = true;
+	ipv4only = false, ipv6only = false, digrc = true,
+	yaml = false;
 static uint32_t splitwidth = 0xffffffff;

 /*% opcode text */
@@ -262,7 +263,11 @@ received(unsigned int bytes, isc_sockaddr_t *from, dig_query_t *query) {

 	isc_sockaddr_format(from, fromtext, sizeof(fromtext));

-	if (query->lookup->stats && !short_form) {
+	if (short_form || yaml) {
+		return;
+	}
+
+	if (query->lookup->stats) {
 		diff = isc_time_microdiff(&query->time_recv, &query->time_sent);
 		if (query->lookup->use_usec)
 			printf(";; Query time: %ld usec\n", (long) diff);
@@ -283,11 +288,15 @@ received(unsigned int bytes, isc_sockaddr_t *from, dig_query_t *query) {
 		 */
 		if (wcsftime(time_str, sizeof(time_str)/sizeof(time_str[0]),
 			     L"%a %b %d %H:%M:%S %Z %Y", &tmnow) > 0U)
+		{
 			printf(";; WHEN: %ls\n", time_str);
+		}
 #else
 		if (strftime(time_str, sizeof(time_str),
 			     "%a %b %d %H:%M:%S %Z %Y", &tmnow) > 0U)
+		{
 			printf(";; WHEN: %s\n", time_str);
+		}
 #endif
 		if (query->lookup->doing_xfr) {
 			printf(";; XFR size: %u records (messages %u, "
@@ -298,30 +307,32 @@ received(unsigned int bytes, isc_sockaddr_t *from, dig_query_t *query) {
 			printf(";; MSG SIZE  rcvd: %u\n", bytes);
 		}
 		if (tsigkey != NULL) {
-			if (!validated)
+			if (!validated) {
 				puts(";; WARNING -- Some TSIG could not "
 				     "be validated");
+			}
 		}
 		if ((tsigkey == NULL) && (keysecret[0] != 0)) {
 			puts(";; WARNING -- TSIG key was not used.");
 		}
 		puts("");
-	} else if (query->lookup->identify && !short_form) {
+	} else if (query->lookup->identify) {
 		diff = isc_time_microdiff(&query->time_recv, &query->time_sent);
-		if (query->lookup->use_usec)
+		if (query->lookup->use_usec) {
 			printf(";; Received %" PRIu64 " bytes "
 			       "from %s(%s) in %ld us\n\n",
 			       query->lookup->doing_xfr
 				 ? query->byte_count
 				 : (uint64_t)bytes,
 			       fromtext, query->userarg, (long) diff);
-		else
+		} else {
 			printf(";; Received %" PRIu64 " bytes "
 			       "from %s(%s) in %ld ms\n\n",
 			       query->lookup->doing_xfr
 				 ?  query->byte_count
 				 : (uint64_t)bytes,
 			       fromtext, query->userarg, (long) diff / 1000);
+		}
 	}
 }

@@ -364,18 +375,20 @@ say_message(dns_rdata_t *rdata, dig_query_t *query, isc_buffer_t *buf) {
 		styleflags |= DNS_STYLEFLAG_EXPANDAAAA;
 	result = dns_rdata_tofmttext(rdata, NULL, styleflags, 0,
 				     splitwidth, " ", buf);
-	if (result == ISC_R_NOSPACE)
+	if (result == ISC_R_NOSPACE) {
 		return (result);
+	}
 	check_result(result, "dns_rdata_totext");
 	if (query->lookup->identify) {
-
 		diff = isc_time_microdiff(&query->time_recv, &query->time_sent);
 		ADD_STRING(buf, " from server ");
 		ADD_STRING(buf, query->servname);
 		if (query->lookup->use_usec) {
-			snprintf(store, sizeof(store), " in %" PRIu64 " us.", diff);
+			snprintf(store, sizeof(store),
+				 " in %" PRIu64 " us.", diff);
 		} else {
-			snprintf(store, sizeof(store), " in %" PRIu64 " ms.", diff / 1000);
+			snprintf(store, sizeof(store),
+				 " in %" PRIu64 " ms.", diff / 1000);
 		}
 		ADD_STRING(buf, store);
 	}
@@ -415,8 +428,7 @@ short_answer(dns_message_t *msg, dns_messagetextflag_t flags,
 			loopresult = dns_rdataset_first(rdataset);
 			while (loopresult == ISC_R_SUCCESS) {
 				dns_rdataset_current(rdataset, &rdata);
-				result = say_message(&rdata, query,
-						     buf);
+				result = say_message(&rdata, query, buf);
 				if (result == ISC_R_NOSPACE)
 					return (result);
 				check_result(result, "say_message");
@@ -458,63 +470,85 @@ isdotlocal(dns_message_t *msg) {
 * Callback from dighost.c to print the reply from a server
 */
 static isc_result_t
-printmessage(dig_query_t *query, dns_message_t *msg, bool headers) {
+printmessage(dig_query_t *query, const isc_buffer_t *msgbuf,
+	     dns_message_t *msg, bool headers)
+{
 	isc_result_t result;
 	dns_messagetextflag_t flags;
 	isc_buffer_t *buf = NULL;
 	unsigned int len = OUTPUTBUF;
 	dns_master_style_t *style = NULL;
 	unsigned int styleflags = 0;
+	bool isquery = (msg == query->lookup->sendmsg);
+
+	UNUSED(msgbuf);

 	styleflags |= DNS_STYLEFLAG_REL_OWNER;
-	if (query->lookup->comments)
-		styleflags |= DNS_STYLEFLAG_COMMENT;
-	if (query->lookup->print_unknown_format)
-		styleflags |= DNS_STYLEFLAG_UNKNOWNFORMAT;
-	/* Turn on rrcomments if explicitly enabled */
-	if (query->lookup->rrcomments > 0)
-		styleflags |= DNS_STYLEFLAG_RRCOMMENT;
-	if (query->lookup->ttlunits)
-		styleflags |= DNS_STYLEFLAG_TTL_UNITS;
-	if (query->lookup->nottl)
-		styleflags |= DNS_STYLEFLAG_NO_TTL;
-	if (query->lookup->noclass)
-		styleflags |= DNS_STYLEFLAG_NO_CLASS;
-	if (query->lookup->nocrypto)
-		styleflags |= DNS_STYLEFLAG_NOCRYPTO;
-	if (query->lookup->expandaaaa)
-		styleflags |= DNS_STYLEFLAG_EXPANDAAAA;
-	if (query->lookup->multiline) {
-		styleflags |= DNS_STYLEFLAG_OMIT_OWNER;
-		styleflags |= DNS_STYLEFLAG_OMIT_CLASS;
-		styleflags |= DNS_STYLEFLAG_REL_DATA;
-		styleflags |= DNS_STYLEFLAG_OMIT_TTL;
-		styleflags |= DNS_STYLEFLAG_TTL;
-		styleflags |= DNS_STYLEFLAG_MULTILINE;
-		/* Turn on rrcomments unless explicitly disabled */
-		if (query->lookup->rrcomments >= 0)
+	if (yaml) {
+		dns_master_indentstr = "  ";
+		dns_master_indent = 3;
+		styleflags |= DNS_STYLEFLAG_YAML;
+	} else {
+		if (query->lookup->comments) {
+			styleflags |= DNS_STYLEFLAG_COMMENT;
+		}
+		if (query->lookup->print_unknown_format) {
+			styleflags |= DNS_STYLEFLAG_UNKNOWNFORMAT;
+		}
+		/* Turn on rrcomments if explicitly enabled */
+		if (query->lookup->rrcomments > 0) {
 			styleflags |= DNS_STYLEFLAG_RRCOMMENT;
+		}
+		if (query->lookup->ttlunits) {
+			styleflags |= DNS_STYLEFLAG_TTL_UNITS;
+		}
+		if (query->lookup->nottl) {
+			styleflags |= DNS_STYLEFLAG_NO_TTL;
+		}
+		if (query->lookup->noclass) {
+			styleflags |= DNS_STYLEFLAG_NO_CLASS;
+		}
+		if (query->lookup->nocrypto) {
+			styleflags |= DNS_STYLEFLAG_NOCRYPTO;
+		}
+		if (query->lookup->expandaaaa) {
+			styleflags |= DNS_STYLEFLAG_EXPANDAAAA;
+		}
+		if (query->lookup->multiline) {
+			styleflags |= DNS_STYLEFLAG_OMIT_OWNER;
+			styleflags |= DNS_STYLEFLAG_OMIT_CLASS;
+			styleflags |= DNS_STYLEFLAG_REL_DATA;
+			styleflags |= DNS_STYLEFLAG_OMIT_TTL;
+			styleflags |= DNS_STYLEFLAG_TTL;
+			styleflags |= DNS_STYLEFLAG_MULTILINE;
+			/* Turn on rrcomments unless explicitly disabled */
+			if (query->lookup->rrcomments >= 0) {
+				styleflags |= DNS_STYLEFLAG_RRCOMMENT;
+			}
+		}
 	}
 	if (query->lookup->multiline ||
 	    (query->lookup->nottl && query->lookup->noclass))
+	{
 		result = dns_master_stylecreate(&style, styleflags,
 						24, 24, 24, 32, 80, 8,
 						splitwidth, mctx);
-	else if (query->lookup->nottl || query->lookup->noclass)
+	} else if (query->lookup->nottl || query->lookup->noclass) {
 		result = dns_master_stylecreate(&style, styleflags,
 						24, 24, 32, 40, 80, 8,
 						splitwidth, mctx);
-	else
+	} else {
 		result = dns_master_stylecreate(&style, styleflags,
 						24, 32, 40, 48, 80, 8,
 						splitwidth, mctx);
+	}
 	check_result(result, "dns_master_stylecreate");

 	if (query->lookup->cmdline[0] != 0) {
 		if (!short_form && printcmd) {
 			fputs(query->lookup->cmdline, stdout);
 		}
-		query->lookup->cmdline[0]=0;
+		query->lookup->cmdline[0] = '\0';
 	}
 	debug("printmessage(%s %s %s)", headers ? "headers" : "noheaders",
 	      query->lookup->comments ? "comments" : "nocomments",
@@ -535,13 +569,110 @@ printmessage(dig_query_t *query, dns_message_t *msg, bool headers) {
 	result = isc_buffer_allocate(mctx, &buf, len);
 	check_result(result, "isc_buffer_allocate");

-	if (query->lookup->comments && !short_form) {
-		if (query->lookup->cmdline[0] != 0 && printcmd)
+	if (yaml) {
+		enum { Q = 0x1, R = 0x2 }; /* Q:query; R:ecursive */
+		unsigned int tflag = 0;
+		isc_sockaddr_t saddr;
+		char sockstr[ISC_SOCKADDR_FORMATSIZE];
+		uint16_t sport;
+		char *hash;
+		int pf;
+
+		printf("-\n");
+		printf("  type: MESSAGE\n");
+		printf("  message:\n");
+
+		if (isquery) {
+			tflag |= Q;
+			if ((msg->flags & DNS_MESSAGEFLAG_RD) != 0) {
+				tflag |= R;
+			}
+		} else if (((msg->flags & DNS_MESSAGEFLAG_RD) != 0) &&
+			   ((msg->flags & DNS_MESSAGEFLAG_RA) != 0))
+		{
+			tflag |= R;
+		}
+
+		if (tflag == (Q|R)) {
+			printf("    type: RECURSIVE_QUERY\n");
+		} else if (tflag == Q) {
+			printf("    type: AUTH_QUERY\n");
+		} else if (tflag == R) {
+			printf("    type: RECURSIVE_RESPONSE\n");
+		} else {
+			printf("    type: AUTH_RESPONSE\n");
+		}
+
+		if (!isc_time_isepoch(&query->time_sent)) {
+			char tbuf[100];
+			isc_time_formatISO8601ms(&query->time_sent,
+						 tbuf, sizeof(tbuf));
+			printf("    query_time: !!timestamp %s\n", tbuf);
+		}
+
+		if (!isquery && !isc_time_isepoch(&query->time_recv)) {
+			char tbuf[100];
+			isc_time_formatISO8601ms(&query->time_recv,
+						 tbuf, sizeof(tbuf));
+			printf("    response_time: !!timestamp %s\n", tbuf);
+		}
+
+		printf("    message_size: %ub\n",
+		       isc_buffer_usedlength(msgbuf));
+
+		pf = isc_sockaddr_pf(&query->sockaddr);
+		if (pf == PF_INET || pf == PF_INET6) {
+			printf("    socket_family: %s\n",
+			       pf == PF_INET ? "INET" : "INET6");
+
+			printf("    socket_protocol: %s\n",
+			       query->lookup->tcp_mode ? "TCP" : "UDP");
+
+			sport = isc_sockaddr_getport(&query->sockaddr);
+			isc_sockaddr_format(&query->sockaddr,
+					    sockstr, sizeof(sockstr));
+			hash = strchr(sockstr, '#');
+			if (hash != NULL) {
+				*hash = '\0';
+			}
+			if (strcmp(sockstr, "::") == 0) {
+				strlcat(sockstr, "0", sizeof(sockstr));
+			}
+
+			printf("    response_address: %s\n", sockstr);
+			printf("    response_port: %u\n", sport);
+		}
+
+		if (query->sock != NULL &&
+		    isc_socket_getsockname(query->sock, &saddr)
+		      == ISC_R_SUCCESS)
+		{
+			sport = isc_sockaddr_getport(&saddr);
+			isc_sockaddr_format(&saddr, sockstr, sizeof(sockstr));
+			hash = strchr(sockstr, '#');
+			if (hash != NULL) {
+				*hash = '\0';
+			}
+			if (strcmp(sockstr, "::") == 0) {
+				strlcat(sockstr, "0", sizeof(sockstr));
+			}
+
+			printf("    query_address: %s\n", sockstr);
+			printf("    query_port: %u\n", sport);
+		}
+
+		printf("    %s:\n", isquery ? "query_message_data"
+					    : "response_message_data");
+		result = dns_message_headertotext(msg, style, flags, buf);
+	} else if (query->lookup->comments && !short_form) {
+		if (query->lookup->cmdline[0] != '\0' && printcmd) {
 			printf("; %s\n", query->lookup->cmdline);
-		if (msg == query->lookup->sendmsg)
+		}
+		if (msg == query->lookup->sendmsg) {
 			printf(";; Sending:\n");
-		else
+		} else {
 			printf(";; Got answer:\n");
+		}

 		if (headers) {
 			if (isdotlocal(msg)) {
@@ -686,8 +817,9 @@ buftoosmall:
 		}
 	}

-	if (headers && query->lookup->comments && !short_form)
+	if (headers && query->lookup->comments && !short_form && !yaml) {
 		printf("\n");
+	}

 	printf("%.*s", (int)isc_buffer_usedlength(buf),
 	       (char *)isc_buffer_base(buf));
@@ -1545,6 +1677,15 @@ plus_option(char *option, bool is_batchfile,
 			lookup->tcp_mode_set = true;
 		}
 		break;
+	case 'y': /* yaml */
+		FULLCHECK("yaml");
+		yaml = state;
+		if (state) {
+			printcmd = false;
+			lookup->stats = false;
+			lookup->rrcomments = -1;
+		}
+		break;
 	case 'z': /* zflag */
 		FULLCHECK("zflag");
 		lookup->zflag = state;
@@ -2257,8 +2398,37 @@ query_finished(void) {
 	}
 }

-void dig_setup(int argc, char **argv)
-{
+static void
+dig_error(const char *format, ...) {
+	va_list args;
+
+	if (yaml) {
+		printf("-\n");
+		printf("  type: DIG_ERROR\n");
+
+		/*
+		 * Print an indent before a literal block quote.
+		 * Note: this will break if used to print more than
+		 * one line of text as only the first line would be
+		 * indented.
+		 */
+		printf("  message: |\n");
+		printf("    ");
+	} else {
+		printf(";; ");
+	}
+
+	va_start(args, format);
+	vprintf(format, args);
+	va_end(args);
+
+	if (!yaml) {
+		printf("\n");
+	}
+}
+
+void
+dig_setup(int argc, char **argv) {
 	isc_result_t result;

 	ISC_LIST_INIT(lookup_list);
@@ -2272,6 +2442,7 @@ void dig_setup(int argc, char **argv)
 	dighost_received = received;
 	dighost_trying = trying;
 	dighost_shutdown = query_finished;
+	dighost_error = dig_error;

 	progname = argv[0];
 	preparse_args(argc, argv);
@@ -1292,6 +1292,16 @@
 	  </listitem>
 	</varlistentry>

+	<varlistentry>
+	  <term><option>+[no]yaml</option></term>
+	  <listitem>
+	    <para>
+	      Print the responses (and, if <option>+qr</option> is in use,
+	      also the outgoing queries) in a detailed YAML format.
+	    </para>
+	  </listitem>
+	</varlistentry>
+
 	<varlistentry>
 	  <term><option>+[no]zflag</option></term>
 	  <listitem>
@@ -193,11 +193,15 @@ dig_lookup_t *current_lookup = NULL;
 /* dynamic callbacks */

 isc_result_t
-(*dighost_printmessage)(dig_query_t *query, dns_message_t *msg,
-	bool headers);
+(*dighost_printmessage)(dig_query_t *query, const isc_buffer_t *msgbuf,
+			dns_message_t *msg, bool headers);

 void
-(*dighost_received)(unsigned int bytes, isc_sockaddr_t *from, dig_query_t *query);
+(*dighost_error)(const char *format, ...);
+
+void
+(*dighost_received)(unsigned int bytes, isc_sockaddr_t *from,
+		    dig_query_t *query);

 void
 (*dighost_trying)(char *frm, dig_lookup_t *lookup);
@@ -1379,6 +1383,7 @@ typedef struct dig_ednsoptname {
 } dig_ednsoptname_t;

 dig_ednsoptname_t optnames[] = {
+	{ 1, "LLQ" },		/* draft-sekar-dns-llq */
 	{ 3, "NSID" },		/* RFC 5001 */
 	{ 5, "DAU" },		/* RFC 6975 */
 	{ 6, "DHU" },		/* RFC 6975 */
@@ -2501,6 +2506,9 @@ setup_lookup(dig_lookup_t *lookup) {
 				COMMSIZE);
 		query->sendbuf = lookup->renderbuf;

+		isc_time_settoepoch(&query->time_sent);
+		isc_time_settoepoch(&query->time_recv);
+
 		ISC_LINK_INIT(query, clink);
 		ISC_LINK_INIT(query, link);

@@ -2509,16 +2517,6 @@ setup_lookup(dig_lookup_t *lookup) {
 		ISC_LIST_ENQUEUE(lookup->q, query, link);
 	}

-	/* XXX qrflag, print_query, etc... */
-	if (!ISC_LIST_EMPTY(lookup->q) && lookup->qr) {
-		extrabytes = 0;
-		dighost_printmessage(ISC_LIST_HEAD(lookup->q),
-				     lookup->sendmsg, true);
-		if (lookup->stats) {
-			printf(";; QUERY SIZE: %u\n\n",
-			       isc_buffer_usedlength(&lookup->renderbuf));
-		}
-	}
 	return (true);
 }

@@ -2856,6 +2854,18 @@ send_udp(dig_query_t *query) {
 				    sevent, ISC_SOCKFLAG_NORETRY);
 	check_result(result, "isc_socket_sendto2");
 	sendcount++;
+
+	/* XXX qrflag, print_query, etc... */
+	if (!ISC_LIST_EMPTY(query->lookup->q) && query->lookup->qr) {
+		extrabytes = 0;
+		dighost_printmessage(ISC_LIST_HEAD(query->lookup->q),
+				     &query->lookup->renderbuf,
+				     query->lookup->sendmsg, true);
+		if (query->lookup->stats) {
+			printf(";; QUERY SIZE: %u\n\n",
+			     isc_buffer_usedlength(&query->lookup->renderbuf));
+		}
+	}
 }

 /*%
@@ -2955,11 +2965,11 @@ connect_timeout(isc_task_t *task, isc_event_t *event) {
 			isc_netaddr_fromsockaddr(&netaddr, &query->sockaddr);
 			isc_netaddr_format(&netaddr, buf, sizeof(buf));

-			printf(";; no response from %s\n", buf);
+			dighost_error("no response from %s\n", buf);
 		} else {
 			fputs(l->cmdline, stdout);
-			printf(";; connection timed out; no servers could be "
-			       "reached\n");
+			dighost_error("connection timed out; "
+				      "no servers could be reached\n");
 		}
 		cancel_lookup(l);
 		check_next_lookup(l);
@@ -3031,8 +3041,8 @@ tcp_length_done(isc_task_t *task, isc_event_t *event) {
 		char sockstr[ISC_SOCKADDR_FORMATSIZE];
 		isc_sockaddr_format(&query->sockaddr, sockstr,
 				    sizeof(sockstr));
-		printf(";; communications error to %s: %s\n",
-		       sockstr, isc_result_totext(sevent->result));
+		dighost_error("communications error to %s: %s\n",
+			      sockstr, isc_result_totext(sevent->result));
 		if (keep != NULL)
 			isc_socket_detach(&keep);
 		l = query->lookup;
@@ -3131,6 +3141,19 @@ launch_next_query(dig_query_t *query, bool include_question) {
 		check_result(result, "isc_socket_send");
 		sendcount++;
 		debug("sendcount=%d", sendcount);
+
+		/* XXX qrflag, print_query, etc... */
+		if (!ISC_LIST_EMPTY(query->lookup->q) && query->lookup->qr) {
+			extrabytes = 0;
+			dighost_printmessage(ISC_LIST_HEAD(query->lookup->q),
+					     &query->lookup->renderbuf,
+					     query->lookup->sendmsg, true);
+			if (query->lookup->stats) {
+				printf(";; QUERY SIZE: %u\n\n",
+				       isc_buffer_usedlength(
+						    &query->lookup->renderbuf));
+			}
+		}
 	}
 	query->waiting_connect = false;
 #if 0
@@ -3505,7 +3528,6 @@ recv_done(isc_task_t *task, isc_event_t *event) {

 	query = event->ev_arg;
 	TIME_NOW(&query->time_recv);
-	debug("lookup=%p, query=%p", query->lookup, query);

 	l = query->lookup;

@@ -3534,8 +3556,8 @@ recv_done(isc_task_t *task, isc_event_t *event) {
 			debug("in recv cancel handler");
 			query->waiting_connect = false;
 		} else {
-			printf(";; communications error: %s\n",
-			       isc_result_totext(sevent->result));
+			dighost_error("communications error: %s\n",
+				      isc_result_totext(sevent->result));
 			if (keep != NULL)
 				isc_socket_detach(&keep);
 			isc_socket_detach(&query->sock);
@@ -3886,19 +3908,19 @@ recv_done(isc_task_t *task, isc_event_t *event) {
 		if (msg->rcode == dns_rcode_nxdomain &&
 		    (l->origin != NULL || l->need_search)) {
 			if (!next_origin(query->lookup) || showsearch) {
-				dighost_printmessage(query, msg, true);
+				dighost_printmessage(query, &b, msg, true);
 				dighost_received(isc_buffer_usedlength(&b),
 						 &sevent->address, query);
 			}
 		} else if (!l->trace && !l->ns_search_only) {
-			dighost_printmessage(query, msg, true);
+			dighost_printmessage(query, &b, msg, true);
 		} else if (l->trace) {
 			int nl = 0;
 			int count = msg->counts[DNS_SECTION_ANSWER];

 			debug("in TRACE code");
 			if (!l->ns_search_only)
-				dighost_printmessage(query, msg, true);
+				dighost_printmessage(query, &b, msg, true);

 			l->rdtype = l->qrdtype;
 			if (l->trace_root || (l->ns_search_only && count > 0)) {
@@ -3929,7 +3951,7 @@ recv_done(isc_task_t *task, isc_event_t *event) {
 				l->trace_root = false;
 				usesearch = false;
 			} else {
-				dighost_printmessage(query, msg, true);
+				dighost_printmessage(query, &b, msg, true);
 			}
 		}
 	}
@@ -400,13 +400,16 @@ chase_cnamechain(dns_message_t *msg, dns_name_t *qname) {
 }

 static isc_result_t
-printmessage(dig_query_t *query, dns_message_t *msg, bool headers) {
+printmessage(dig_query_t *query, const isc_buffer_t *msgbuf,
+	     dns_message_t *msg, bool headers)
+{
 	bool did_flag = false;
 	dns_rdataset_t *opt, *tsig = NULL;
 	const dns_name_t *tsigname;
 	isc_result_t result = ISC_R_SUCCESS;
 	int force_error;

+	UNUSED(msgbuf);
 	UNUSED(headers);

 	/*
@@ -854,6 +857,17 @@ parse_args(bool is_batchfile, int argc, char **argv) {
 	ISC_LIST_APPEND(lookup_list, lookup, link);
 }

+static void
+host_error(const char *format, ...) {
+	va_list args;
+
+	printf(";; ");
+	va_start(args, format);
+	vfprintf(stdout, format, args);
+	va_end(args);
+	printf("\n");
+}
+
 int
 main(int argc, char **argv) {
 	isc_result_t result;
@@ -871,6 +885,7 @@ main(int argc, char **argv) {
 	dighost_received = received;
 	dighost_trying = trying;
 	dighost_shutdown = host_shutdown;
+	dighost_error = host_error;

 	debug("main()");
 	progname = argv[0];
@@ -380,13 +380,22 @@ set_search_domain(char *domain);
 * then assigned to the appropriate function pointer
 */
 extern isc_result_t
-(*dighost_printmessage)(dig_query_t *query, dns_message_t *msg, bool headers);
+(*dighost_printmessage)(dig_query_t *query, const isc_buffer_t *msgbuf,
+			dns_message_t *msg, bool headers);
+
+/*
+ * Print an error message in the appropriate format.
+ */
+extern void
+(*dighost_error)(const char *format, ...);
+
 /*%<
 * Print the final result of the lookup.
 */

 extern void
-(*dighost_received)(unsigned int bytes, isc_sockaddr_t *from, dig_query_t *query);
+(*dighost_received)(unsigned int bytes, isc_sockaddr_t *from,
+		    dig_query_t *query);
 /*%<
 * Print a message about where and when the response
 * was received from, like the final comment in the
@@ -429,16 +429,21 @@ chase_cnamechain(dns_message_t *msg, dns_name_t *qname) {
 }

 static isc_result_t
-printmessage(dig_query_t *query, dns_message_t *msg, bool headers) {
+printmessage(dig_query_t *query, const isc_buffer_t *msgbuf,
+	     dns_message_t *msg, bool headers)
+{
 	char servtext[ISC_SOCKADDR_FORMATSIZE];

+	UNUSED(msgbuf);
+
 	/* I've we've gotten this far, we've reached a server. */
 	query_error = 0;

 	debug("printmessage()");

 	if(!default_lookups || query->lookup->rdtype == dns_rdatatype_a) {
-		isc_sockaddr_format(&query->sockaddr, servtext, sizeof(servtext));
+		isc_sockaddr_format(&query->sockaddr, servtext,
+				    sizeof(servtext));
 		printf("Server:\t\t%s\n", query->userarg);
 		printf("Address:\t%s\n", servtext);

@@ -978,6 +983,17 @@ getinput(isc_task_t *task, isc_event_t *event) {
 	isc_app_shutdown();
 }

+static void
+nsl_error(const char *format, ...) {
+	va_list args;
+
+	printf(";; ");
+	va_start(args, format);
+	vfprintf(stdout, format, args);
+	va_end(args);
+	printf("\n");
+}
+
 int
 main(int argc, char **argv) {
 	isc_result_t result;
@@ -995,6 +1011,7 @@ main(int argc, char **argv) {
 	dighost_received = received;
 	dighost_trying = trying;
 	dighost_shutdown = query_finished;
+	dighost_error = nsl_error;

 	result = isc_app_start();
 	check_result(result, "isc_app_start");
@@ -11488,7 +11488,7 @@ delete_keynames(dns_tsig_keyring_t *ring, char *target,
 	origin = dns_fixedname_initname(&fixedorigin);

 again:
-	dns_rbtnodechain_init(&chain, ring->mctx);
+	dns_rbtnodechain_init(&chain);
 	result = dns_rbtnodechain_first(&chain, ring->keys, &foundname,
 					origin);
 	if (result == ISC_R_NOTFOUND) {
@@ -11604,7 +11604,7 @@ list_keynames(dns_view_t *view, dns_tsig_keyring_t *ring, isc_buffer_t **text,

 	dns_name_init(&foundname, NULL);
 	origin = dns_fixedname_initname(&fixedorigin);
-	dns_rbtnodechain_init(&chain, ring->mctx);
+	dns_rbtnodechain_init(&chain);
 	result = dns_rbtnodechain_first(&chain, ring->keys, &foundname,
 					origin);
 	if (result == ISC_R_NOTFOUND) {
@@ -103,7 +103,7 @@ detail(dns_rbt_t *rbt, dns_name_t *name) {
 	isc_result_t result;
 	bool nodes_should_match = false;

-	dns_rbtnodechain_init(&chain, mctx);
+	dns_rbtnodechain_init(&chain);

 	origin = dns_fixedname_initname(&fixedorigin);
 	fullname = dns_fixedname_initname(&fixedfullname);
@@ -182,7 +182,7 @@ iterate(dns_rbt_t *rbt, bool forward) {
 	isc_result_t (*move)(dns_rbtnodechain_t *chain, dns_name_t *name,
 			     dns_name_t *origin);

-	dns_rbtnodechain_init(&chain, mctx);
+	dns_rbtnodechain_init(&chain);

 	dns_name_init(&foundname, NULL);
 	origin = dns_fixedname_initname(&fixedorigin);
@@ -0,0 +1,4 @@
+example.	0	SOA	. . 0 0 0 0 0
+example.	0 	NS	.
+example. 	0	DNSKEY	257 3 10 AwEAAbqjg7xdvnU2Q/gtLw5LOfr5cDeTRjYuEbkzGrUiVSOSoxcTxuao WS/AFPQHuD8OSLiE/CeZ087JowREXl058rRfae8KMrveY17V0wmKs9N1 F1wf/hRDpXiThlRHWlskp8eSEEIqYrrHgWTesy/xDGIEOFM1gwRo0w8j KdRRJeL2hseTMa+m3rTzrYudUsI0BHLW8PiDUCbG5xgdee8/5YR4847i AAqHIiPJ1Z/IT53OIjMmtv5BUykZ8RYjlJxxX+C+dpRKiK73SQaR3hCB XAYOL9WsDp2/fpmEZpewavkMkdC+j2CX+z27MCS3ASO0AeKK0lcNXwND kgreE+Kr7gc=
+example. 	0	CDNSKEY	257 3 10 AwEAAbqjg7xdvnU2Q/gtLw5LOfr5cDeTRjYuEbkzGrUiVSOSoxcTXXXX WS/AFPQHuD8OSLiE/CeZ087JowREXl058rRfae8KMrveY17V0wmKs9N1 F1wf/hRDpXiThlRHWlskp8eSEEIqYrrHgWTesy/xDGIEOFM1gwRo0w8j KdRRJeL2hseTMa+m3rTzrYudUsI0BHLW8PiDUCbG5xgdee8/5YR4847i AAqHIiPJ1Z/IT53OIjMmtv5BUykZ8RYjlJxxX+C+dpRKiK73SQaR3hCB XAYOL9WsDp2/fpmEZpewavkMkdC+j2CX+z27MCS3ASO0AeKK0lcNXwND kgreE+Kr7gc=
@@ -0,0 +1,6 @@
+example.	0	SOA	. . 0 0 0 0 0
+example.	0 	NS	.
+example. 	0	DNSKEY	257 3 10 AwEAAbqjg7xdvnU2Q/gtLw5LOfr5cDeTRjYuEbkzGrUiVSOSoxcTxuao WS/AFPQHuD8OSLiE/CeZ087JowREXl058rRfae8KMrveY17V0wmKs9N1 F1wf/hRDpXiThlRHWlskp8eSEEIqYrrHgWTesy/xDGIEOFM1gwRo0w8j KdRRJeL2hseTMa+m3rTzrYudUsI0BHLW8PiDUCbG5xgdee8/5YR4847i AAqHIiPJ1Z/IT53OIjMmtv5BUykZ8RYjlJxxX+C+dpRKiK73SQaR3hCB XAYOL9WsDp2/fpmEZpewavkMkdC+j2CX+z27MCS3ASO0AeKK0lcNXwND kgreE+Kr7gc=
+; Actual CDS
+; example.	0	CDS 	14364 10 2 FD03B2312C8F0FE72C1751EFA1007D743C94EC91594FF0047C23C37CE119BA0C
+example.	0	CDS 	14364 10 2 FD03B2312C8F0FE72C1751EFA1007D743C94EC91594FF0047C23C37CE119BA0B
@@ -0,0 +1,4 @@
+example.	0	SOA	. . 0 0 0 0 0
+example.	0 	NS	.
+example. 	0	DNSKEY	257 3 10 AwEAAbqjg7xdvnU2Q/gtLw5LOfr5cDeTRjYuEbkzGrUiVSOSoxcTxuao WS/AFPQHuD8OSLiE/CeZ087JowREXl058rRfae8KMrveY17V0wmKs9N1 F1wf/hRDpXiThlRHWlskp8eSEEIqYrrHgWTesy/xDGIEOFM1gwRo0w8j KdRRJeL2hseTMa+m3rTzrYudUsI0BHLW8PiDUCbG5xgdee8/5YR4847i AAqHIiPJ1Z/IT53OIjMmtv5BUykZ8RYjlJxxX+C+dpRKiK73SQaR3hCB XAYOL9WsDp2/fpmEZpewavkMkdC+j2CX+z27MCS3ASO0AeKK0lcNXwND kgreE+Kr7gc=
+example. 	0	CDNSKEY	257 3 10 AwEAAbqjg7xdvnU2Q/gtLw5LOfr5cDeTRjYuEbkzGrUiVSOSoxcTxuao WS/AFPQHuD8OSLiE/CeZ087JowREXl058rRfae8KMrveY17V0wmKs9N1 F1wf/hRDpXiThlRHWlskp8eSEEIqYrrHgWTesy/xDGIEOFM1gwRo0w8j KdRRJeL2hseTMa+m3rTzrYudUsI0BHLW8PiDUCbG5xgdee8/5YR4847i AAqHIiPJ1Z/IT53OIjMmtv5BUykZ8RYjlJxxX+C+dpRKiK73SQaR3hCB XAYOL9WsDp2/fpmEZpewavkMkdC+j2CX+z27MCS3ASO0AeKK0lcNXwND kgreE+Kr7gc=
@@ -0,0 +1,4 @@
+example.	0	SOA	. . 0 0 0 0 0
+example.	0 	NS	.
+example. 	0	DNSKEY	257 3 10 AwEAAbqjg7xdvnU2Q/gtLw5LOfr5cDeTRjYuEbkzGrUiVSOSoxcTxuao WS/AFPQHuD8OSLiE/CeZ087JowREXl058rRfae8KMrveY17V0wmKs9N1 F1wf/hRDpXiThlRHWlskp8eSEEIqYrrHgWTesy/xDGIEOFM1gwRo0w8j KdRRJeL2hseTMa+m3rTzrYudUsI0BHLW8PiDUCbG5xgdee8/5YR4847i AAqHIiPJ1Z/IT53OIjMmtv5BUykZ8RYjlJxxX+C+dpRKiK73SQaR3hCB XAYOL9WsDp2/fpmEZpewavkMkdC+j2CX+z27MCS3ASO0AeKK0lcNXwND kgreE+Kr7gc=
+example.	0	CDS 	14364 10 2 FD03B2312C8F0FE72C1751EFA1007D743C94EC91594FF0047C23C37CE119BA0C
@@ -62,6 +62,11 @@ KEYID="$(cat ns2/keyid)"
 KEYDATA="$(< ns2/keydata sed -e 's/+/[+]/g')"
 NOSPLIT="$(< ns2/keydata sed -e 's/+/[+]/g' -e 's/ //g')"

+HAS_PYYAML=0
+if [ -n "$PYTHON" ] ; then
+	$PYTHON -c "import yaml" 2> /dev/null && HAS_PYYAML=1
+fi
+
 if [ -x "$DIG" ] ; then
  n=$((n+1))
  echo_i "checking dig short form works ($n)"
@@ -514,6 +519,14 @@ if [ -x "$DIG" ] ; then
  if [ $ret -ne 0 ]; then echo_i "failed"; fi
  status=$((status+ret))

+  n=$((n+1))
+  echo_i "checking ednsopt LLQ prints as expected ($n)"
+  ret=0
+  dig_with_opts @10.53.0.3 +ednsopt=llq:0001000200001234567812345678fefefefe +qr a.example > dig.out.test$n 2>&1 || ret=1
+  grep 'LLQ: Version: 1, Opcode: 2, Error: 0, Identifier: 1311768465173141112, Lifetime: 4278124286$' dig.out.test$n > /dev/null || ret=1
+  if [ $ret -ne 0 ]; then echo_i "failed"; fi
+  status=$((status+ret))
+
  n=$((n+1))
  echo_i "checking that dig warns about .local queries ($n)"
  ret=0
@@ -716,6 +729,21 @@ if [ -x "$DIG" ] ; then
  grep '^fd92:7065:0b8e:ffff:0000:0000:0000:0002$' dig.out.test$n > /dev/null || ret=1
  if [ $ret -ne 0 ]; then echo_i "failed"; fi
  status=$((status+ret))
+
+  if [ $HAS_PYYAML -ne 0 ] ; then
+    n=$((n+1))
+    echo_i "check dig +yaml output ($n)"
+    ret=0
+    dig_with_opts +qr +yaml @10.53.0.3 any ns2.example > dig.out.test$n 2>&1 || ret=1
+    value=$($PYTHON yamlget.py dig.out.test$n 0 message query_message_data status || ret=1)
+    [ "$value" = "NOERROR" ] || ret=1
+    value=$($PYTHON yamlget.py dig.out.test$n 1 message response_message_data status || ret=1)
+    [ "$value" = "NOERROR" ] || ret=1
+    value=$($PYTHON yamlget.py dig.out.test$n 1 message response_message_data QUESTION_SECTION 0 || ret=1)
+    [ "$value" = "ns2.example. IN ANY" ] || ret=1
+    if [ $ret -ne 0 ]; then echo_i "failed"; fi
+    status=$((status+ret))
+  fi
 else
  echo_i "$DIG is needed, so skipping these dig tests"
 fi
@@ -744,6 +772,19 @@ if [ -x "$MDIG" ] ; then
  grep "; serial" < dig.out.test$n > /dev/null && ret=1
  if [ $ret -ne 0 ]; then echo_i "failed"; fi
  status=$((status+ret))
+
+  if [ $HAS_PYYAML -ne 0 ] ; then
+    n=$((n+1))
+    echo_i "check mdig +yaml output ($n)"
+    ret=0
+    mdig_with_opts +yaml @10.53.0.3 -t any ns2.example > dig.out.test$n 2>&1 || ret=1
+    value=$($PYTHON yamlget.py dig.out.test$n 0 message response_message_data status || ret=1)
+    [ "$value" = "NOERROR" ] || ret=1
+    value=$($PYTHON yamlget.py dig.out.test$n 0 message response_message_data QUESTION_SECTION 0 || ret=1)
+    [ "$value" = "ns2.example. IN ANY" ] || ret=1
+    if [ $ret -ne 0 ]; then echo_i "failed"; fi
+    status=$((status+ret))
+  fi
 else
  echo_i "$MDIG is needed, so skipping these mdig tests"
 fi
@@ -965,6 +1006,22 @@ if [ -x "$DELV" ] ; then
  check_ttl_range delv.out.test$n SOA 300 || ret=1
  if [ $ret -ne 0 ]; then echo_i "failed"; fi
  status=$((status+ret))
+
+  if [ $HAS_PYYAML -ne 0 ] ; then
+    n=$((n+1))
+    echo_i "check delv +yaml output ($n)"
+    ret=0
+    delv_with_opts +yaml @10.53.0.3 any ns2.example > delv.out.test$n 2>&1 || ret=1
+    value=$($PYTHON yamlget.py delv.out.test$n status || ret=1)
+    [ "$value" = "success" ] || ret=1
+    value=$($PYTHON yamlget.py delv.out.test$n query_name || ret=1)
+    [ "$value" = "ns2.example" ] || ret=1
+    value=$($PYTHON yamlget.py delv.out.test$n records 0 answer_not_validated 0 || ret=1)
+    count=$(echo $value | wc -w )
+    [ ${count:-0} -eq 5 ] || ret=1
+    if [ $ret -ne 0 ]; then echo_i "failed"; fi
+    status=$((status+ret))
+  fi
 else
  echo_i "$DELV is needed, so skipping these delv tests"
 fi
@@ -0,0 +1,33 @@
+############################################################################
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+############################################################################
+
+try:
+    import yaml
+except:
+    print("No python yaml module, skipping")
+    exit(1)
+
+import subprocess
+import pprint
+import sys
+
+f = open(sys.argv[1], "r")
+for item in yaml.safe_load_all(f):
+    for key in sys.argv[2:]:
+        try:
+            key = int(key)
+        except: pass
+        try:
+            item = item[key]
+        except:
+            print('error: index not found')
+            exit(1)
+    print (item)
@@ -220,7 +220,7 @@ key1=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone -f KSK "$
 key2=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone -f KSK "$zone")
 key3=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone")
 "$DSFROMKEY" -C "$key2.key" > "$key2.cds"
-cat "$infile" "$key1.key" "$key3.key" "$key2.cds" > "$zonefile"
+cat "$infile" "$key1.key" "$key2.key" "$key3.key" "$key2.cds" > "$zonefile"
 "$SIGNER" -P -g -x -o "$zone" "$zonefile" > /dev/null 2>&1

 zone=cds-update.secure
@@ -244,8 +244,8 @@ infile=cds-auto.secure.db.in
 zonefile=cds-auto.secure.db
 key1=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone -f KSK "$zone")
 key2=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone")
-"$DSFROMKEY" -C "$key1.key" > "$key1.cds"
-cat "$infile" "$key1.cds" > "$zonefile.signed"
+$SETTIME -P sync now "$key1" > /dev/null
+cat "$infile" > "$zonefile.signed"

 zone=cdnskey.secure
 infile=cdnskey.secure.db.in
@@ -263,7 +263,7 @@ key1=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone -f KSK "$
 key2=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone -f KSK "$zone")
 key3=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone")
 sed 's/DNSKEY/CDNSKEY/' "$key1.key" > "$key1.cds"
-cat "$infile" "$key2.key" "$key3.key" "$key1.cds" > "$zonefile"
+cat "$infile" "$key1.key" "$key2.key" "$key3.key" "$key1.cds" > "$zonefile"
 "$SIGNER" -P -g -x -o "$zone" "$zonefile" > /dev/null 2>&1

 zone=cdnskey-update.secure
@@ -287,8 +287,8 @@ infile=cdnskey-auto.secure.db.in
 zonefile=cdnskey-auto.secure.db
 key1=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone -f KSK "$zone")
 key2=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone")
-sed 's/DNSKEY/CDNSKEY/' "$key1.key" > "$key1.cds"
-cat "$infile" "$key1.cds" > "$zonefile.signed"
+$SETTIME -P sync now "$key1" > /dev/null
+cat "$infile" > "$zonefile.signed"

 zone=updatecheck-kskonly.secure
 infile=template.secure.db.in
@@ -3247,7 +3247,7 @@ echo_i "check that CDS records are not signed using ZSK by dnssec-signzone -x ($
 ret=0
 dig_with_opts +noall +answer @10.53.0.2 cds cds-x.secure > dig.out.test$n
 lines=$(awk '$4 == "RRSIG" && $5 == "CDS" {print}' dig.out.test$n | wc -l)
-test "$lines" -eq 1 || ret=1
+test "$lines" -eq 2 || ret=1
 n=$((n+1))
 test "$ret" -eq 0 || echo_i "failed"
 status=$((status+ret))
@@ -3399,7 +3399,7 @@ echo_i "check that CDNSKEY records are not signed using ZSK by dnssec-signzone -
 ret=0
 dig_with_opts +noall +answer @10.53.0.2 cdnskey cdnskey-x.secure > dig.out.test$n
 lines=$(awk '$4 == "RRSIG" && $5 == "CDNSKEY" {print}' dig.out.test$n | wc -l)
-test "$lines" -eq 1 || ret=1
+test "$lines" -eq 2 || ret=1
 n=$((n+1))
 test "$ret" -eq 0 || echo_i "failed"
 status=$((status+ret))
@@ -484,7 +484,6 @@ ret=0
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`

-
 HAS_PYYAML=0
 if [ -n "$PYTHON" ] ; then
 	$PYTHON -c "import yaml" 2> /dev/null && HAS_PYYAML=1
@@ -13,7 +13,7 @@
 # Clean up after glue tests.
 #

-rm -f dig.out ns1/cache
+rm -f dig.out
 rm -f */named.conf
 rm -f */named.memstats
 rm -f */named.run
@@ -1,15 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-; Preloaded cache data for glue test
-
-$TTL 86400
-ns.zz.	  3600	IN	A	10.0.0.1
-ns.zz.		IN	AAAA	10::1
-ns.zz.		IN	A6	0 ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff
@@ -1,23 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$ORIGIN mil.
-$TTL 300
-@ 			IN SOA	gson.nominum.com. a.root.servers.nil. (
-				2000042100   	; serial
-				600         	; refresh
-				600         	; retry
-				1200    	; expire
-				600       	; minimum
-				)
-@			NS	a.root-servers.nil.
-
-ARL.MIL.         	172800  IN      NS	NS1.ARL.MIL.
-NS1.arl.mil.            172800  IN A  128.63.16.4
-
@@ -19,8 +19,6 @@ options {
 	listen-on-v6 { none; };
 	recursion yes;
 	notify no;
-	cache-file "cache";
-	check-integrity no;
 };

 zone "." {
@@ -36,8 +34,3 @@ zone "net" {
 	type master;
 	file "net.db";
 };
-
-zone "mil" {
-	type master;
-	file "mil.db";
-};
@@ -23,8 +23,6 @@ a.root-servers.nil.	A	10.53.0.1
 ; Delegate some domains that contain name servers for the sample
 ; ccTLDs below.
 net.			172800	IN	NS	a.root-servers.nil.
-mil.			172800	IN	NS	a.root-servers.nil.
-se.			172800	IN	NS	ns.uu.net.

 ;
 ; A sample ccTLD
@@ -42,17 +40,3 @@ NS.UU.NET.		172800	IN	A	137.39.1.3
 T.NS.VERIO.NET.		172800	IN	A	192.67.14.16
 HYDRA.HELSINKI.fi.	172800	IN	A	128.214.4.29
 NS.EU.NET.		172800	IN	A	192.16.202.11
-
-;
-; Another sample ccTLD
-;
-is.                     172800  IN      NS      ISGATE.is.
-is.                     172800  IN      NS      NISC.JVNC.NET.
-is.                     172800  IN      NS      NS.EU.NET.
-is.                     172800  IN      NS      SPARKY.ARL.MIL.
-is.                     172800  IN      NS      SUNIC.SUNET.SE.
-ISGATE.is.              172800  IN      A       193.4.58.51
-NISC.JVNC.NET.          172800  IN      A       128.121.50.7
-NS.EU.NET.              172800  IN      A       192.16.202.11
-SPARKY.ARL.MIL.         172800  IN      A       128.63.58.18
-SUNIC.SUNET.SE.         172800  IN      A       192.36.125.2
@@ -14,5 +14,3 @@ SYSTEMTESTTOP=..

 $SHELL clean.sh
 copy_setports ns1/named.conf.in ns1/named.conf
-
-cd ns1 && cp -f cache.in cache
@@ -1,16 +0,0 @@
-
-; <<>> DiG 9.0 <<>> +norec @10.53.0.1 -p 5300 foo.bar.xx. a
-;; global options:  printcmd
-;; Got answer:
-;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 41239
-;; flags: qr ad; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1
-
-;; QUESTION SECTION:
-;foo.bar.xx.			IN	A
-
-;; AUTHORITY SECTION:
-xx.			172800	IN	NS	b.root-servers.nil.
-
-;; ADDITIONAL SECTION:
-b.root-servers.nil.	300	IN	A	10.53.0.2
-
@@ -1,17 +0,0 @@
-
-; <<>> DiG 9.0 <<>> +norec @10.53.0.1 -p 5300 foo.bar.yy. a
-;; global options:  printcmd
-;; Got answer:
-;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 6172
-;; flags: qr ad; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 3
-
-;; QUESTION SECTION:
-;foo.bar.yy.			IN	A
-
-;; AUTHORITY SECTION:
-yy.			172800	IN	NS	ns.zz.
-
-;; ADDITIONAL SECTION:
-ns.zz.			3463	IN	A	10.0.0.1
-ns.zz.			86263	IN	AAAA	10::1
-
@@ -17,7 +17,7 @@ $TTL 120
 ;
@	IN	A	1.2.3.4
@	IN	AAAA	c::1.2.3.4
-@	IN	CDS	21366 7 1 E6C1716CFB6BDC84E84CE1AB5510DAC69173B5B2
+@	IN	CDS 	12023 7 2 36FB69A752615831B47EA6EF9EA4619D0FB08ABDA69EA3ED200F4C02FF4921D4
@	IN	CDNSKEY	256 3 7 AwEAAY9437GPWJHzBeR4FP6eJAie7gh2QSM6LUnbDAHvHOx8MNqgSVRM PZka2rAgivb65/MkT1lXRUegj91iRFP3iggTpCgvdUbcBjsYrdODsrwF YUMIUl1pU0lH9x7KvfFUOfSmG+Rk5UHUWuRZbNyc65Sq69iFXg5c11+8 MAkRoeDF
 ;
 ;	Delegation only test CDS and CDNSKEY records.  These should be rejected
@@ -105,6 +105,7 @@ static bool display_answer  = true;
 static bool display_authority = true;
 static bool display_additional = true;
 static bool display_unknown_format = false;
+static bool yaml = false;
 static bool continue_on_error = false;
 static uint32_t display_splitwidth = 0xffffffff;
 static isc_sockaddr_t srcaddr;
@@ -211,7 +212,7 @@ recvresponse(isc_task_t *task, isc_event_t *event) {
 	isc_result_t result;
 	dns_message_t *query = NULL, *response = NULL;
 	unsigned int parseflags = 0;
-	isc_buffer_t *buf = NULL;
+	isc_buffer_t *msgbuf = NULL, *buf = NULL;
 	unsigned int len = OUTPUTBUF;
 	dns_master_style_t *style = NULL;
 	unsigned int styleflags = 0;
@@ -239,36 +240,52 @@ recvresponse(isc_task_t *task, isc_event_t *event) {
 		parseflags |= DNS_MESSAGEPARSE_BESTEFFORT;
 		parseflags |= DNS_MESSAGEPARSE_IGNORETRUNCATION;
 	}
+
+
+	msgbuf = dns_request_getanswer(reqev->request);
 	result = dns_request_getresponse(reqev->request, response, parseflags);
 	CHECK("dns_request_getresponse", result);

 	styleflags |= DNS_STYLEFLAG_REL_OWNER;
-	if (display_comments)
-		styleflags |= DNS_STYLEFLAG_COMMENT;
-	if (display_unknown_format)
-		styleflags |= DNS_STYLEFLAG_UNKNOWNFORMAT;
-	if (display_rrcomments > 0)
-		styleflags |= DNS_STYLEFLAG_RRCOMMENT;
-	if (display_ttlunits)
-		styleflags |= DNS_STYLEFLAG_TTL_UNITS;
-	if (!display_ttl)
-		styleflags |= DNS_STYLEFLAG_NO_TTL;
-	if (!display_class)
-		styleflags |= DNS_STYLEFLAG_NO_CLASS;
-	if (!display_crypto)
-		styleflags |= DNS_STYLEFLAG_NOCRYPTO;
-	if (display_multiline) {
-		styleflags |= DNS_STYLEFLAG_OMIT_OWNER;
-		styleflags |= DNS_STYLEFLAG_OMIT_CLASS;
-		styleflags |= DNS_STYLEFLAG_REL_DATA;
-		styleflags |= DNS_STYLEFLAG_OMIT_TTL;
-		styleflags |= DNS_STYLEFLAG_TTL;
-		styleflags |= DNS_STYLEFLAG_MULTILINE;
-		styleflags |= DNS_STYLEFLAG_COMMENT;
-		/* Turn on rrcomments unless explicitly disabled */
-		if (display_rrcomments >= 0) {
+	if (yaml) {
+		dns_master_indentstr = "  ";
+		dns_master_indent = 3;
+		styleflags |= DNS_STYLEFLAG_YAML;
+	} else {
+		if (display_comments) {
+			styleflags |= DNS_STYLEFLAG_COMMENT;
+		}
+		if (display_unknown_format) {
+			styleflags |= DNS_STYLEFLAG_UNKNOWNFORMAT;
+		}
+		if (display_rrcomments > 0) {
 			styleflags |= DNS_STYLEFLAG_RRCOMMENT;
 		}
+		if (display_ttlunits) {
+			styleflags |= DNS_STYLEFLAG_TTL_UNITS;
+		}
+		if (!display_ttl) {
+			styleflags |= DNS_STYLEFLAG_NO_TTL;
+		}
+		if (!display_class) {
+			styleflags |= DNS_STYLEFLAG_NO_CLASS;
+		}
+		if (!display_crypto) {
+			styleflags |= DNS_STYLEFLAG_NOCRYPTO;
+		}
+		if (display_multiline) {
+			styleflags |= DNS_STYLEFLAG_OMIT_OWNER;
+			styleflags |= DNS_STYLEFLAG_OMIT_CLASS;
+			styleflags |= DNS_STYLEFLAG_REL_DATA;
+			styleflags |= DNS_STYLEFLAG_OMIT_TTL;
+			styleflags |= DNS_STYLEFLAG_TTL;
+			styleflags |= DNS_STYLEFLAG_MULTILINE;
+			styleflags |= DNS_STYLEFLAG_COMMENT;
+			/* Turn on rrcomments unless explicitly disabled */
+			if (display_rrcomments >= 0) {
+				styleflags |= DNS_STYLEFLAG_RRCOMMENT;
+			}
+		}
 	}
 	if (display_multiline || (!display_ttl && !display_class))
 		result = dns_master_stylecreate(&style, styleflags,
@@ -295,7 +312,59 @@ recvresponse(isc_task_t *task, isc_event_t *event) {
 	result = isc_buffer_allocate(mctx, &buf, len);
 	CHECK("isc_buffer_allocate", result);

-	if (display_comments && !display_short_form) {
+	if (yaml) {
+		char sockstr[ISC_SOCKADDR_FORMATSIZE];
+		uint16_t sport;
+		char *hash;
+		int pf;
+
+		printf("-\n");
+		printf("  type: MESSAGE\n");
+		printf("  message:\n");
+
+		if (((response->flags & DNS_MESSAGEFLAG_RD) != 0) &&
+		    ((response->flags & DNS_MESSAGEFLAG_RA) != 0))
+		{
+			printf("    type: RECURSIVE_RESPONSE\n");
+		} else {
+			printf("    type: AUTH_RESPONSE\n");
+		}
+
+		printf("    message_size: %ub\n",
+		       isc_buffer_usedlength(msgbuf));
+
+		pf = isc_sockaddr_pf(&dstaddr);
+		if (pf == PF_INET || pf == PF_INET6) {
+			printf("    socket_family: %s\n",
+			       pf == PF_INET ? "INET" : "INET6");
+
+			printf("    socket_protocol: %s\n",
+			       tcp_mode ? "TCP" : "UDP");
+
+			sport = isc_sockaddr_getport(&dstaddr);
+			isc_sockaddr_format(&dstaddr, sockstr, sizeof(sockstr));
+			hash = strchr(sockstr, '#');
+			if (hash != NULL) {
+				*hash = '\0';
+			}
+			printf("    response_address: %s\n", sockstr);
+			printf("    response_port: %u\n", sport);
+		}
+
+		if (have_src) {
+			sport = isc_sockaddr_getport(&srcaddr);
+			isc_sockaddr_format(&srcaddr, sockstr, sizeof(sockstr));
+			hash = strchr(sockstr, '#');
+			if (hash != NULL) {
+				*hash = '\0';
+			}
+			printf("    query_address: %s\n", sockstr);
+			printf("    query_port: %u\n", sport);
+		}
+
+		printf("    %s:\n", "response_message_data");
+		result = dns_message_headertotext(response, style, flags, buf);
+	} else if (display_comments && !display_short_form) {
 		printf(";; Got answer:\n");

 		if (display_headers) {
@@ -465,8 +534,11 @@ buftoosmall:
 		CHECK("dns_message_pseudosectiontotext", result);
 	}

-	if (display_headers && display_comments && !display_short_form)
+	if (display_headers && display_comments &&
+	    !display_short_form && !yaml)
+	{
 		printf("\n");
+	}

 	printf("%.*s", (int)isc_buffer_usedlength(buf),
 	       (char *)isc_buffer_base(buf));
@@ -515,8 +587,7 @@ compute_cookie(unsigned char *cookie, size_t len) {
 }

 static isc_result_t
-sendquery(struct query *query, isc_task_t *task)
-{
+sendquery(struct query *query, isc_task_t *task) {
 	dns_request_t *request;
 	dns_message_t *message;
 	dns_name_t *qname;
@@ -699,8 +770,7 @@ sendquery(struct query *query, isc_task_t *task)
 }

 static void
-sendqueries(isc_task_t *task, isc_event_t *event)
-{
+sendqueries(isc_task_t *task, isc_event_t *event) {
 	struct query *query = (struct query *)event->ev_arg;

 	isc_event_free(&event);
@@ -1509,6 +1579,13 @@ plus_option(char *option, struct query *query, bool global)
 		GLOBAL();
 		tcp_mode = state;
 		break;
+	case 'y': /* yaml */
+		FULLCHECK("yaml");
+		yaml = state;
+		if (state) {
+			display_rrcomments = state;
+		}
+		break;
 	case 'z': /* zflag */
 		FULLCHECK("zflag");
 		query->have_zflag = state;
@@ -399,6 +399,15 @@
          </listitem>
        </varlistentry>

+	<varlistentry>
+	  <term><option>+[no]yaml</option></term>
+	  <listitem>
+	    <para>
+	      Print the responses in a detailed YAML format.
+	    </para>
+	  </listitem>
+	</varlistentry>
+
      </variablelist>

    </para>
@@ -0,0 +1,7 @@
+@@
+expression C;
+expression M;
+@@
+
+- dns_rbtnodechain_init(C, M);
+ dns_rbtnodechain_init(C);
@@ -10318,22 +10318,6 @@ example.com                 CNAME   rpz-tcp-only.
 	    but are counted to compute the query per second rate.
 	  </para>

-	  <para>
-	    Rate limiters for different name spaces maintain
-	    separate counters: If, for example, there is a
-	    <command>rate-limit</command> statement for "com" and
-	    another for "example.com", queries matching "example.com"
-	    will not be debited against the rate limiter for "com".
-	  </para>
-
-	  <para>
-	    If a <command>rate-limit</command> statement does not specify a
-	    <command>domain</command>, then it applies to the root domain
-	    (".") and thus affects the entire DNS namespace, except those
-	    portions covered by other <command>rate-limit</command>
-	    statements.
-	  </para>
-
 	  <para>
 	    Communities of DNS clients can be given their own parameters or no
 	    rate limiting by putting
@@ -186,9 +186,16 @@
      </listitem>
      <listitem>
 	<para>
-	Statistics channel groups are now toggleable. [GL #1030]
+	  Statistics channel groups are now toggleable. [GL #1030]
 	</para>
      </listitem>
+      <listitem>
+	<para>
+	  <command>dig</command>, <command>mdig</command> and
+	  <command>delv</command> can all now take a <command>+yaml</command>
+	  option to print output in a a detailed YAML format. [RT #1145]
+        </para>
+      </listitem>
    </itemizedlist>
  </section>

@@ -274,7 +281,7 @@
 	  A SipHash 2-4 based DNS Cookie (RFC 7873) algorithm has been added and
 	  made default.  Old non-default HMAC-SHA based DNS Cookie algorithms
 	  have been removed, and only the default AES algorithm is being kept
-	  for legacy reasons.  This changes doesn't have any operational impact
+	  for legacy reasons.  This change doesn't have any operational impact
 	  in most common scenarios. [GL #605]
 	</para>
 	<para>
@@ -370,8 +377,8 @@
      </listitem>
      <listitem>
 	<para>
-	  <command>named-checkconf</command> now correctly reports missing
-	  <command>dnstap-output</command> option when
+	  <command>named-checkconf</command> now correctly reports
+	  a missing <command>dnstap-output</command> option when
 	  <command>dnstap</command> is set. [GL #1136]
 	</para>
      </listitem>
@@ -99,6 +99,7 @@
 #define DNS_MESSAGEEXTFLAG_DO		0x8000U

 /*%< EDNS0 extended OPT codes */
+#define DNS_OPT_LLQ		1		/*%< LLQ opt code */
 #define DNS_OPT_NSID		3		/*%< NSID opt code */
 #define DNS_OPT_CLIENT_SUBNET	8		/*%< client subnet opt code */
 #define DNS_OPT_EXPIRE		9		/*%< EXPIRE opt code */
@@ -384,6 +385,37 @@ dns_message_pseudosectiontotext(dns_message_t *msg,
 *\li	Note: On error return, *target may be partially filled with data.
 */

+isc_result_t
+dns_message_headertotext(dns_message_t *msg, const dns_master_style_t *style,
+		   dns_messagetextflag_t flags, isc_buffer_t *target);
+/*%<
+ * Convert the header section of message 'msg' to a cleartext
+ * representation. This is called from dns_message_totext().
+ *
+ * Notes on flags:
+ *\li	If #DNS_MESSAGETEXTFLAG_NOHEADERS is set, header lines will be
+ * 	suppressed and this function is a no-op.
+ *
+ * Requires:
+ *
+ *\li	'msg' is a valid message.
+ *
+ *\li	'target' is a valid buffer.
+ *
+ * Ensures:
+ *
+ *\li	If the result is success:
+ *		The used space in 'target' is updated.
+ *
+ * Returns:
+ *
+ *\li	#ISC_R_SUCCESS
+ *\li	#ISC_R_NOSPACE
+ *\li	#ISC_R_NOMORE
+ *
+ *\li	Note: On error return, *target may be partially filled with data.
+ */
+
 isc_result_t
 dns_message_totext(dns_message_t *msg, const dns_master_style_t *style,
 		   dns_messagetextflag_t flags, isc_buffer_t *target);
@@ -241,7 +241,6 @@ typedef void (*dns_rbtdeleter_t)(void *, void *);

 typedef struct dns_rbtnodechain {
 	unsigned int            magic;
-	isc_mem_t *             mctx;
 	/*%
 	 * The terminal node of the chain.  It is not in levels[].
 	 * This is ostensibly private ... but in a pinch it could be
@@ -837,15 +836,13 @@ dns__rbtnode_getdistance(dns_rbtnode_t *node);
 *****/

 void
-dns_rbtnodechain_init(dns_rbtnodechain_t *chain, isc_mem_t *mctx);
+dns_rbtnodechain_init(dns_rbtnodechain_t *chain);
 /*%<
 * Initialize 'chain'.
 *
 * Requires:
 *\li   'chain' is a valid pointer.
 *
- *\li   'mctx' is a valid memory context.
- *
 * Ensures:
 *\li   'chain' is suitable for use.
 */
@@ -316,6 +316,20 @@ dns_request_getresponse(dns_request_t *request, dns_message_t *message,
 *
 *\li	Any result that dns_message_parse() can return.
 */
+isc_buffer_t *
+dns_request_getanswer(dns_request_t *request);
+/*
+ * Get the response to 'request' as a buffer.
+ *
+ * Requires:
+ *
+ *\li	'request' is a valid request for which the caller has received the
+ *	completion event.
+ *
+ * Returns:
+ *
+ *\li	a pointer to the answer buffer.
+ */

 bool
 dns_request_usedtcp(dns_request_t *request);
@@ -664,7 +664,7 @@ dns_keytable_totext(dns_keytable_t *keytable, isc_buffer_t **text) {
 	REQUIRE(text != NULL && *text != NULL);

 	RWLOCK(&keytable->rwlock, isc_rwlocktype_read);
-	dns_rbtnodechain_init(&chain, keytable->mctx);
+	dns_rbtnodechain_init(&chain);
 	result = dns_rbtnodechain_first(&chain, keytable->table, NULL, NULL);
 	if (result != ISC_R_SUCCESS && result != DNS_R_NEWORIGIN) {
 		if (result == ISC_R_NOTFOUND)
@@ -713,7 +713,7 @@ dns_keytable_forall(dns_keytable_t *keytable,
 	REQUIRE(VALID_KEYTABLE(keytable));

 	RWLOCK(&keytable->rwlock, isc_rwlocktype_read);
-	dns_rbtnodechain_init(&chain, keytable->mctx);
+	dns_rbtnodechain_init(&chain);
 	result = dns_rbtnodechain_first(&chain, keytable->table, NULL, NULL);
 	if (result != ISC_R_SUCCESS && result != DNS_R_NEWORIGIN) {
 		if (result == ISC_R_NOTFOUND)
@@ -427,7 +427,7 @@ str_totext(const char *source, isc_buffer_t *target) {

 static isc_result_t
 ncache_summary(dns_rdataset_t *rdataset, bool omit_final_dot,
-	       isc_buffer_t *target)
+	       dns_totext_ctx_t *ctx, isc_buffer_t *target)
 {
 	isc_result_t result = ISC_R_SUCCESS;
 	dns_rdataset_t rds;
@@ -441,7 +441,22 @@ ncache_summary(dns_rdataset_t *rdataset, bool omit_final_dot,
 		for (result = dns_rdataset_first(&rds);
 		     result == ISC_R_SUCCESS;
 		     result = dns_rdataset_next(&rds)) {
-			CHECK(str_totext("; ", target));
+			if ((ctx->style.flags & DNS_STYLEFLAG_INDENT) != 0 ||
+			    (ctx->style.flags & DNS_STYLEFLAG_YAML) != 0)
+			{
+				unsigned int i;
+				for (i = 0; i < dns_master_indent; i++) {
+					CHECK(str_totext(dns_master_indentstr,
+							 target));
+				}
+			}
+
+			if ((ctx->style.flags & DNS_STYLEFLAG_YAML) != 0) {
+				CHECK(str_totext("- ", target));
+			} else {
+				CHECK(str_totext("; ", target));
+			}
+
 			CHECK(dns_name_totext(&name, omit_final_dot, target));
 			CHECK(str_totext(" ", target));
 			CHECK(dns_rdatatype_totext(rds.type, target));
@@ -518,22 +533,21 @@ rdataset_totext(dns_rdataset_t *rdataset,
 		 */
 		if ((ctx->style.flags & DNS_STYLEFLAG_INDENT) != 0 ||
 		    (ctx->style.flags & DNS_STYLEFLAG_YAML) != 0)
+		{
 			for (i = 0; i < dns_master_indent; i++)
 				RETERR(str_totext(dns_master_indentstr,
 						  target));
-
-		/*
-		 * YAML enumerator?
-		 */
-		if ((ctx->style.flags & DNS_STYLEFLAG_YAML) != 0) {
-			RETERR(str_totext("- ", target));
 		}

 		/*
-		 * Comment?
+		 * YAML or comment prefix?
 		 */
-		if ((ctx->style.flags & DNS_STYLEFLAG_COMMENTDATA) != 0)
+		if ((ctx->style.flags & DNS_STYLEFLAG_YAML) != 0) {
+			RETERR(str_totext("- ", target));
+		} else if ((ctx->style.flags & DNS_STYLEFLAG_COMMENTDATA) != 0)
+		{
 			RETERR(str_totext(";", target));
+		}

 		/*
 		 * Owner name.
@@ -651,23 +665,17 @@ rdataset_totext(dns_rdataset_t *rdataset,
 		 */
 		INDENT_TO(rdata_column);
 		if ((rdataset->attributes & DNS_RDATASETATTR_NEGATIVE) != 0) {
-			if ((ctx->style.flags & DNS_STYLEFLAG_INDENT) != 0 ||
-			    (ctx->style.flags & DNS_STYLEFLAG_YAML) != 0)
-			{
-				for (i = 0; i < dns_master_indent; i++)
-					RETERR(str_totext(dns_master_indentstr,
-							  target));
-			}
-			if (NXDOMAIN(rdataset))
+			if (NXDOMAIN(rdataset)) {
 				RETERR(str_totext(";-$NXDOMAIN\n", target));
-			else
+			} else {
 				RETERR(str_totext(";-$NXRRSET\n", target));
+			}
 			/*
 			 * Print a summary of the cached records which make
 			 * up the negative response.
 			 */
 			RETERR(ncache_summary(rdataset, omit_final_dot,
-					      target));
+					      ctx, target));
 			break;
 		} else {
 			dns_rdata_t rdata = DNS_RDATA_INIT;
@@ -3427,6 +3427,42 @@ render_ecs(isc_buffer_t *ecsbuf, isc_buffer_t *target) {
 	return (result);
 }

+static isc_result_t
+render_llq(isc_buffer_t *optbuf, isc_buffer_t *target) {
+	char buf[sizeof("18446744073709551615")]; /* 2^64-1 */
+	isc_result_t result = ISC_R_SUCCESS;
+	uint32_t u;
+	uint64_t q;
+
+	u = isc_buffer_getuint16(optbuf);
+	ADD_STRING(target, " Version: ");
+	snprintf(buf, sizeof(buf), "%u", u);
+	ADD_STRING(target, buf);
+
+	u = isc_buffer_getuint16(optbuf);
+	ADD_STRING(target, ", Opcode: ");
+	snprintf(buf, sizeof(buf), "%u", u);
+	ADD_STRING(target, buf);
+
+	u = isc_buffer_getuint16(optbuf);
+	ADD_STRING(target, ", Error: ");
+	snprintf(buf, sizeof(buf), "%u", u);
+	ADD_STRING(target, buf);
+
+	q = isc_buffer_getuint32(optbuf);
+	q <<= 32;
+	q |= isc_buffer_getuint32(optbuf);
+	ADD_STRING(target, ", Identifier: ");
+	snprintf(buf, sizeof(buf), "%" PRIu64, q);
+	ADD_STRING(target, buf);
+
+	u = isc_buffer_getuint32(optbuf);
+	ADD_STRING(target, ", Lifetime: ");
+	snprintf(buf, sizeof(buf), "%u", u);
+	ADD_STRING(target, buf);
+ cleanup:
+	return (result);
+}

 static isc_result_t
 dns_message_pseudosectiontoyaml(dns_message_t *msg,
@@ -3513,7 +3549,19 @@ dns_message_pseudosectiontoyaml(dns_message_t *msg,
 			optlen = isc_buffer_getuint16(&optbuf);
 			INSIST(isc_buffer_remaininglength(&optbuf) >= optlen);

-			if (optcode == DNS_OPT_NSID) {
+			if (optcode == DNS_OPT_LLQ) {
+				INDENT(style);
+				if (optlen == 18U) {
+					ADD_STRING(target, "LLQ: ");
+					result = render_llq(&optbuf, target);
+					if (result != ISC_R_SUCCESS) {
+						goto cleanup;
+					}
+					ADD_STRING(target, "\n");
+					continue;
+				}
+				ADD_STRING(target, "LLQ");
+			} else if (optcode == DNS_OPT_NSID) {
 				INDENT(style);
 				ADD_STRING(target, "NSID");
 			} else if (optcode == DNS_OPT_COOKIE) {
@@ -3795,7 +3843,18 @@ dns_message_pseudosectiontotext(dns_message_t *msg,

 			INDENT(style);

-			if (optcode == DNS_OPT_NSID) {
+			if (optcode == DNS_OPT_LLQ) {
+				if (optlen == 18U) {
+					ADD_STRING(target, "; LLQ:");
+					result = render_llq(&optbuf, target);
+					if (result != ISC_R_SUCCESS) {
+						return (result);
+					}
+					ADD_STRING(target, "\n");
+					continue;
+				}
+				ADD_STRING(target, "; LLQ");
+			} else if (optcode == DNS_OPT_NSID) {
 				ADD_STRING(target, "; NSID");
 			} else if (optcode == DNS_OPT_COOKIE) {
 				ADD_STRING(target, "; COOKIE");
@@ -4001,8 +4060,8 @@ dns_message_pseudosectiontotext(dns_message_t *msg,
 }

 isc_result_t
-dns_message_totext(dns_message_t *msg, const dns_master_style_t *style,
-		   dns_messagetextflag_t flags, isc_buffer_t *target)
+dns_message_headertotext(dns_message_t *msg, const dns_master_style_t *style,
+			 dns_messagetextflag_t flags, isc_buffer_t *target)
 {
 	char buf[sizeof("1234567890")];
 	isc_result_t result;
@@ -4010,9 +4069,11 @@ dns_message_totext(dns_message_t *msg, const dns_master_style_t *style,
 	REQUIRE(DNS_MESSAGE_VALID(msg));
 	REQUIRE(target != NULL);

-	if (((flags & DNS_MESSAGETEXTFLAG_NOHEADERS) == 0) &&
-	     (dns_master_styleflags(style) & DNS_STYLEFLAG_YAML))
-	{
+	if ((flags & DNS_MESSAGETEXTFLAG_NOHEADERS) != 0) {
+		return (ISC_R_SUCCESS);
+	}
+
+	if (dns_master_styleflags(style) & DNS_STYLEFLAG_YAML) {
 		INDENT(style);
 		ADD_STRING(target, "opcode: ");
 		ADD_STRING(target, opcodetext[msg->opcode]);
@@ -4020,30 +4081,38 @@ dns_message_totext(dns_message_t *msg, const dns_master_style_t *style,
 		INDENT(style);
 		ADD_STRING(target, "status: ");
 		result = dns_rcode_totext(msg->rcode, target);
-		if (result != ISC_R_SUCCESS)
+		if (result != ISC_R_SUCCESS) {
 			return (result);
+		}
 		ADD_STRING(target, "\n");
 		INDENT(style);
 		ADD_STRING(target, "id: ");
-		snprintf(buf, sizeof(buf), "%6u", msg->id);
+		snprintf(buf, sizeof(buf), "%u", msg->id);
 		ADD_STRING(target, buf);
 		ADD_STRING(target, "\n");
 		INDENT(style);
 		ADD_STRING(target, "flags:");
-		if ((msg->flags & DNS_MESSAGEFLAG_QR) != 0)
+		if ((msg->flags & DNS_MESSAGEFLAG_QR) != 0) {
 			ADD_STRING(target, " qr");
-		if ((msg->flags & DNS_MESSAGEFLAG_AA) != 0)
+		}
+		if ((msg->flags & DNS_MESSAGEFLAG_AA) != 0) {
 			ADD_STRING(target, " aa");
-		if ((msg->flags & DNS_MESSAGEFLAG_TC) != 0)
+		}
+		if ((msg->flags & DNS_MESSAGEFLAG_TC) != 0) {
 			ADD_STRING(target, " tc");
-		if ((msg->flags & DNS_MESSAGEFLAG_RD) != 0)
+		}
+		if ((msg->flags & DNS_MESSAGEFLAG_RD) != 0) {
 			ADD_STRING(target, " rd");
-		if ((msg->flags & DNS_MESSAGEFLAG_RA) != 0)
+		}
+		if ((msg->flags & DNS_MESSAGEFLAG_RA) != 0) {
 			ADD_STRING(target, " ra");
-		if ((msg->flags & DNS_MESSAGEFLAG_AD) != 0)
+		}
+		if ((msg->flags & DNS_MESSAGEFLAG_AD) != 0) {
 			ADD_STRING(target, " ad");
-		if ((msg->flags & DNS_MESSAGEFLAG_CD) != 0)
+		}
+		if ((msg->flags & DNS_MESSAGEFLAG_CD) != 0) {
 			ADD_STRING(target, " cd");
+		}
 		ADD_STRING(target, "\n");
 		/*
 		 * The final unnamed flag must be zero.
@@ -4091,34 +4160,42 @@ dns_message_totext(dns_message_t *msg, const dns_master_style_t *style,
 			msg->counts[DNS_SECTION_ADDITIONAL]);
 		ADD_STRING(target, buf);
 		ADD_STRING(target, "\n");
-	} else if ((flags & DNS_MESSAGETEXTFLAG_NOHEADERS) == 0) {
+	} else {
 		INDENT(style);
 		ADD_STRING(target, ";; ->>HEADER<<- opcode: ");
 		ADD_STRING(target, opcodetext[msg->opcode]);
 		ADD_STRING(target, ", status: ");
 		result = dns_rcode_totext(msg->rcode, target);
-		if (result != ISC_R_SUCCESS)
+		if (result != ISC_R_SUCCESS) {
 			return (result);
+		}
 		ADD_STRING(target, ", id: ");
 		snprintf(buf, sizeof(buf), "%6u", msg->id);
 		ADD_STRING(target, buf);
 		ADD_STRING(target, "\n");
 		INDENT(style);
 		ADD_STRING(target, ";; flags:");
-		if ((msg->flags & DNS_MESSAGEFLAG_QR) != 0)
+		if ((msg->flags & DNS_MESSAGEFLAG_QR) != 0) {
 			ADD_STRING(target, " qr");
-		if ((msg->flags & DNS_MESSAGEFLAG_AA) != 0)
+		}
+		if ((msg->flags & DNS_MESSAGEFLAG_AA) != 0) {
 			ADD_STRING(target, " aa");
-		if ((msg->flags & DNS_MESSAGEFLAG_TC) != 0)
+		}
+		if ((msg->flags & DNS_MESSAGEFLAG_TC) != 0) {
 			ADD_STRING(target, " tc");
-		if ((msg->flags & DNS_MESSAGEFLAG_RD) != 0)
+		}
+		if ((msg->flags & DNS_MESSAGEFLAG_RD) != 0) {
 			ADD_STRING(target, " rd");
-		if ((msg->flags & DNS_MESSAGEFLAG_RA) != 0)
+		}
+		if ((msg->flags & DNS_MESSAGEFLAG_RA) != 0) {
 			ADD_STRING(target, " ra");
-		if ((msg->flags & DNS_MESSAGEFLAG_AD) != 0)
+		}
+		if ((msg->flags & DNS_MESSAGEFLAG_AD) != 0) {
 			ADD_STRING(target, " ad");
-		if ((msg->flags & DNS_MESSAGEFLAG_CD) != 0)
+		}
+		if ((msg->flags & DNS_MESSAGEFLAG_CD) != 0) {
 			ADD_STRING(target, " cd");
+		}
 		/*
 		 * The final unnamed flag must be zero.
 		 */
@@ -4158,42 +4235,63 @@ dns_message_totext(dns_message_t *msg, const dns_master_style_t *style,
 		ADD_STRING(target, buf);
 		ADD_STRING(target, "\n");
 	}
-	result = dns_message_pseudosectiontotext(msg,
-						 DNS_PSEUDOSECTION_OPT,
-						 style, flags, target);
-	if (result != ISC_R_SUCCESS)
+
+ cleanup:
+	return (result);
+}
+
+isc_result_t
+dns_message_totext(dns_message_t *msg, const dns_master_style_t *style,
+		   dns_messagetextflag_t flags, isc_buffer_t *target)
+{
+	isc_result_t result;
+
+	REQUIRE(DNS_MESSAGE_VALID(msg));
+	REQUIRE(target != NULL);
+
+	result = dns_message_headertotext(msg, style, flags, target);
+	if (result != ISC_R_SUCCESS) {
 		return (result);
+	}
+
+	result = dns_message_pseudosectiontotext(msg, DNS_PSEUDOSECTION_OPT,
+						 style, flags, target);
+	if (result != ISC_R_SUCCESS) {
+		return (result);
+	}

 	result = dns_message_sectiontotext(msg, DNS_SECTION_QUESTION,
 					   style, flags, target);
-	if (result != ISC_R_SUCCESS)
+	if (result != ISC_R_SUCCESS) {
 		return (result);
+	}
+
 	result = dns_message_sectiontotext(msg, DNS_SECTION_ANSWER,
 					   style, flags, target);
-	if (result != ISC_R_SUCCESS)
+	if (result != ISC_R_SUCCESS) {
 		return (result);
+	}
+
 	result = dns_message_sectiontotext(msg, DNS_SECTION_AUTHORITY,
 					   style, flags, target);
-	if (result != ISC_R_SUCCESS)
+	if (result != ISC_R_SUCCESS) {
 		return (result);
+	}
+
 	result = dns_message_sectiontotext(msg, DNS_SECTION_ADDITIONAL,
 					   style, flags, target);
-	if (result != ISC_R_SUCCESS)
+	if (result != ISC_R_SUCCESS) {
 		return (result);
+	}

-	result = dns_message_pseudosectiontotext(msg,
-						 DNS_PSEUDOSECTION_TSIG,
+	result = dns_message_pseudosectiontotext(msg, DNS_PSEUDOSECTION_TSIG,
 						 style, flags, target);
-	if (result != ISC_R_SUCCESS)
+	if (result != ISC_R_SUCCESS) {
 		return (result);
+	}

-	result = dns_message_pseudosectiontotext(msg,
-						 DNS_PSEUDOSECTION_SIG0,
+	result = dns_message_pseudosectiontotext(msg, DNS_PSEUDOSECTION_SIG0,
 						 style, flags, target);
-	if (result != ISC_R_SUCCESS)
-		return (result);
-
- cleanup:
 	return (result);
 }

@@ -504,7 +504,7 @@ dns_ntatable_totext(dns_ntatable_t *ntatable, const char *view,
 	isc_stdtime_get(&now);

 	RWLOCK(&ntatable->rwlock, isc_rwlocktype_read);
-	dns_rbtnodechain_init(&chain, ntatable->view->mctx);
+	dns_rbtnodechain_init(&chain);
 	result = dns_rbtnodechain_first(&chain, ntatable->table, NULL, NULL);
 	if (result != ISC_R_SUCCESS && result != DNS_R_NEWORIGIN) {
 		if (result == ISC_R_NOTFOUND)
@@ -603,7 +603,7 @@ dns_ntatable_save(dns_ntatable_t *ntatable, FILE *fp) {
 	isc_stdtime_get(&now);

 	RWLOCK(&ntatable->rwlock, isc_rwlocktype_read);
-	dns_rbtnodechain_init(&chain, ntatable->view->mctx);
+	dns_rbtnodechain_init(&chain);
 	result = dns_rbtnodechain_first(&chain, ntatable->table, NULL, NULL);
 	if (result != ISC_R_SUCCESS && result != DNS_R_NEWORIGIN)
 		goto cleanup;
@@ -1462,7 +1462,7 @@ dns_rbt_findnode(dns_rbt_t *rbt, const dns_name_t *name, dns_name_t *foundname,
 	if (chain == NULL) {
 		options |= DNS_RBTFIND_NOPREDECESSOR;
 		chain = &localchain;
-		dns_rbtnodechain_init(chain, rbt->mctx);
+		dns_rbtnodechain_init(chain);
 	} else
 		dns_rbtnodechain_reset(chain);

@@ -3121,14 +3121,12 @@ dns_rbt_printdot(dns_rbt_t *rbt, bool show_pointers, FILE *f) {
 */

 void
-dns_rbtnodechain_init(dns_rbtnodechain_t *chain, isc_mem_t *mctx) {
-
+dns_rbtnodechain_init(dns_rbtnodechain_t *chain) {
 	REQUIRE(chain != NULL);

 	/*
 	 * Initialize 'chain'.
 	 */
-	chain->mctx = mctx;
 	chain->end = NULL;
 	chain->level_count = 0;
 	chain->level_matches = 0;
@@ -3410,7 +3410,7 @@ find_wildcard(rbtdb_search_t *search, dns_rbtnode_t **nodep,
 				break;

 			wnode = NULL;
-			dns_rbtnodechain_init(&wchain, NULL);
+			dns_rbtnodechain_init(&wchain);
 			result = dns_rbt_findnode(rbtdb->tree, wname,
 						  NULL, &wnode, &wchain,
 						  DNS_RBTFIND_EMPTYDATA,
@@ -3548,7 +3548,7 @@ previous_closest_nsec(dns_rdatatype_t type, rbtdb_search_t *search,
 			 * It is the first node sought in the NSEC tree.
 			 */
 			*firstp = false;
-			dns_rbtnodechain_init(nsecchain, NULL);
+			dns_rbtnodechain_init(nsecchain);
 			result = dns_name_concatenate(name, origin,
 						      target, NULL);
 			if (result != ISC_R_SUCCESS)
@@ -3862,7 +3862,7 @@ zone_find(dns_db_t *db, const dns_name_t *name, dns_dbversion_t *version,
 	search.wild = false;
 	search.zonecut = NULL;
 	dns_fixedname_init(&search.zonecut_name);
-	dns_rbtnodechain_init(&search.chain, search.rbtdb->common.mctx);
+	dns_rbtnodechain_init(&search.chain);
 	search.now = 0;

 	/*
@@ -4739,7 +4739,7 @@ cache_find(dns_db_t *db, const dns_name_t *name, dns_dbversion_t *version,
 	search.wild = false;
 	search.zonecut = NULL;
 	dns_fixedname_init(&search.zonecut_name);
-	dns_rbtnodechain_init(&search.chain, search.rbtdb->common.mctx);
+	dns_rbtnodechain_init(&search.chain);
 	search.now = now;
 	update = NULL;
 	updatesig = NULL;
@@ -5079,7 +5079,7 @@ cache_findzonecut(dns_db_t *db, const dns_name_t *name, unsigned int options,
 	search.wild = false;
 	search.zonecut = NULL;
 	dns_fixedname_init(&search.zonecut_name);
-	dns_rbtnodechain_init(&search.chain, search.rbtdb->common.mctx);
+	dns_rbtnodechain_init(&search.chain);
 	search.now = now;

 	if (dcnull) {
@@ -5434,8 +5434,8 @@ createiterator(dns_db_t *db, unsigned int options, dns_dbiterator_t **iteratorp)
 	rbtdbiter->nsec3only = ((options & DNS_DB_NSEC3ONLY) != 0);
 	rbtdbiter->nonsec3 = ((options & DNS_DB_NONSEC3) != 0);
 	memset(rbtdbiter->deletions, 0, sizeof(rbtdbiter->deletions));
-	dns_rbtnodechain_init(&rbtdbiter->chain, db->mctx);
-	dns_rbtnodechain_init(&rbtdbiter->nsec3chain, db->mctx);
+	dns_rbtnodechain_init(&rbtdbiter->chain);
+	dns_rbtnodechain_init(&rbtdbiter->nsec3chain);
 	if (rbtdbiter->nsec3only)
 		rbtdbiter->current = &rbtdbiter->nsec3chain;
 	else
@@ -116,6 +116,12 @@ fromwire_opt(ARGS_FROMWIRE) {
 			return (ISC_R_UNEXPECTEDEND);
 		}
 		switch (opt) {
+		case DNS_OPT_LLQ:
+			if (length != 18U) {
+				return (DNS_R_OPTERR);
+			}
+			isc_region_consume(&sregion, length);
+			break;
 		case DNS_OPT_CLIENT_SUBNET: {
 			uint16_t family;
 			uint8_t addrlen;
@@ -1196,6 +1196,13 @@ dns_request_getresponse(dns_request_t *request, dns_message_t *message,
 	return (result);
 }

+isc_buffer_t *
+dns_request_getanswer(dns_request_t *request) {
+	REQUIRE(VALID_REQUEST(request));
+
+	return (request->answer);
+}
+
 bool
 dns_request_usedtcp(dns_request_t *request) {
 	REQUIRE(VALID_REQUEST(request));
@@ -677,6 +677,82 @@ destroynode(dns_sdbnode_t *node) {
 	detach((dns_db_t **) (void *)&sdb);
 }

+static isc_result_t
+getoriginnode(dns_db_t *db, dns_dbnode_t **nodep) {
+	dns_sdb_t *sdb = (dns_sdb_t *)db;
+	dns_sdbnode_t *node = NULL;
+	isc_result_t result;
+	isc_buffer_t b;
+	char namestr[DNS_NAME_MAXTEXT + 1];
+	dns_sdbimplementation_t *imp;
+	dns_name_t relname;
+	dns_name_t *name;
+
+	REQUIRE(VALID_SDB(sdb));
+	REQUIRE(nodep != NULL && *nodep == NULL);
+
+	imp = sdb->implementation;
+	name = &sdb->common.origin;
+
+	if (imp->methods->lookup2 != NULL) {
+		if ((imp->flags & DNS_SDBFLAG_RELATIVEOWNER) != 0) {
+			dns_name_init(&relname, NULL);
+			name = &relname;
+		}
+	} else {
+		isc_buffer_init(&b, namestr, sizeof(namestr));
+		if ((imp->flags & DNS_SDBFLAG_RELATIVEOWNER) != 0) {
+
+			dns_name_init(&relname, NULL);
+			result = dns_name_totext(&relname, true, &b);
+			if (result != ISC_R_SUCCESS) {
+				return (result);
+			}
+		} else {
+			result = dns_name_totext(name, true, &b);
+			if (result != ISC_R_SUCCESS) {
+				return (result);
+			}
+		}
+		isc_buffer_putuint8(&b, 0);
+	}
+
+	result = createnode(sdb, &node);
+	if (result != ISC_R_SUCCESS) {
+		return (result);
+	}
+
+	MAYBE_LOCK(sdb);
+	if (imp->methods->lookup2 != NULL) {
+		result = imp->methods->lookup2(&sdb->common.origin, name,
+					       sdb->dbdata, node, NULL, NULL);
+	} else {
+		result = imp->methods->lookup(sdb->zone, namestr, sdb->dbdata,
+					      node, NULL, NULL);
+	}
+	MAYBE_UNLOCK(sdb);
+	if (result != ISC_R_SUCCESS &&
+	    !(result == ISC_R_NOTFOUND &&
+	      imp->methods->authority != NULL))
+	{
+		destroynode(node);
+		return (result);
+	}
+
+	if (imp->methods->authority != NULL) {
+		MAYBE_LOCK(sdb);
+		result = imp->methods->authority(sdb->zone, sdb->dbdata, node);
+		MAYBE_UNLOCK(sdb);
+		if (result != ISC_R_SUCCESS) {
+			destroynode(node);
+			return (result);
+		}
+	}
+
+	*nodep = node;
+	return (ISC_R_SUCCESS);
+}
+
 static isc_result_t
 findnodeext(dns_db_t *db, const dns_name_t *name, bool create,
 	    dns_clientinfomethods_t *methods, dns_clientinfo_t *clientinfo,
@@ -1224,7 +1300,7 @@ static dns_dbmethods_t sdb_methods = {
 	ispersistent,
 	overmem,
 	settask,
-	NULL,			/* getoriginnode */
+	getoriginnode,		/* getoriginnode */
 	NULL,			/* transfernode */
 	NULL,			/* getnsec3parameters */
 	NULL,			/* findnsec3node */
@@ -332,6 +332,7 @@ serialize_test(void **state) {
 	 * Map in the whole file in one go
 	 */
 	fd = open("zone.bin", O_RDWR);
+	assert_int_not_equal(fd, -1);
 	isc_file_getsizefd(fd, &filesize);
 	base = mmap(NULL, filesize, PROT_READ|PROT_WRITE,
 		    MAP_FILE|MAP_PRIVATE, fd, 0);
@@ -392,6 +393,7 @@ deserialize_corrupt_test(void **state) {
 		dns_rbt_t *rbt_deserialized = NULL;

 		fd = open("zone.bin", O_RDWR);
+		assert_int_not_equal(fd, -1);
 		isc_file_getsizefd(fd, &filesize);
 		base = mmap(NULL, filesize, PROT_READ|PROT_WRITE,
 			    MAP_FILE|MAP_PRIVATE, fd, 0);
@@ -292,7 +292,7 @@ rbtnode_get_distance(void **state) {
 	dns_test_namefromstring(name_str, &fname);
 	name = dns_fixedname_name(&fname);

-	dns_rbtnodechain_init(&chain, dt_mctx);
+	dns_rbtnodechain_init(&chain);

 	result = dns_rbt_findnode(ctx->rbt_distances, name, NULL,
 				  &node, &chain, 0, NULL, NULL);
@@ -730,7 +730,7 @@ rbt_remove(void **state) {
 		tree_ok = dns__rbt_checkproperties(mytree);
 		assert_true(tree_ok);

-		dns_rbtnodechain_init(&chain, dt_mctx);
+		dns_rbtnodechain_init(&chain);

 		/* Now, walk through nodes in order. */
 		if (j == 0) {
@@ -1157,7 +1157,7 @@ rbt_nodechain(void **state) {

 	ctx = test_context_setup();

-	dns_rbtnodechain_init(&chain, dt_mctx);
+	dns_rbtnodechain_init(&chain);

 	dns_test_namefromstring("a", &fname);
 	name = dns_fixedname_name(&fname);
@@ -408,7 +408,7 @@ cleanup_ring(dns_tsig_keyring_t *ring)
 	origin = dns_fixedname_initname(&fixedorigin);

 again:
-	dns_rbtnodechain_init(&chain, ring->mctx);
+	dns_rbtnodechain_init(&chain);
 	result = dns_rbtnodechain_first(&chain, ring->keys, &foundname,
 					origin);
 	if (result != ISC_R_SUCCESS && result != DNS_R_NEWORIGIN) {
@@ -614,7 +614,7 @@ dns_tsigkeyring_dumpanddetach(dns_tsig_keyring_t **ringp, FILE *fp) {
 	isc_stdtime_get(&now);
 	dns_name_init(&foundname, NULL);
 	origin = dns_fixedname_initname(&fixedorigin);
-	dns_rbtnodechain_init(&chain, ring->mctx);
+	dns_rbtnodechain_init(&chain);
 	result = dns_rbtnodechain_first(&chain, ring->keys, &foundname,
 					origin);
 	if (result != ISC_R_SUCCESS && result != DNS_R_NEWORIGIN) {
@@ -496,6 +496,7 @@ dns_message_gettemprdataset
 dns_message_gettimeadjust
 dns_message_gettsig
 dns_message_gettsigkey
+dns_message_headertotext
 dns_message_logfmtpacket
 dns_message_logpacket
 dns_message_movename
@@ -847,6 +848,7 @@ dns_request_create
 dns_request_createraw
 dns_request_createvia
 dns_request_destroy
+dns_request_getanswer
 dns_request_getresponse
 dns_request_usedtcp
 dns_requestmgr_attach
@@ -4732,6 +4732,16 @@ zone_postload(dns_zone_t *zone, dns_db_t *db, isc_time_t loadtime,
 			goto cleanup;
 		}

+		if (zone->type == dns_zone_master) {
+			result = dns_zone_cdscheck(zone, db, NULL);
+			if (result != ISC_R_SUCCESS) {
+				dns_zone_log(zone, ISC_LOG_ERROR,
+					     "CDS/CDNSKEY consistency checks "
+					     "failed");
+				goto cleanup;
+			}
+		}
+
 		result = dns_zone_verifydb(zone, db, NULL);
 		if (result != ISC_R_SUCCESS) {
 			goto cleanup;
@@ -433,7 +433,7 @@ dns_zt_setviewcommit(dns_zt_t *zt) {

 	REQUIRE(VALID_ZT(zt));

-	dns_rbtnodechain_init(&chain, zt->mctx);
+	dns_rbtnodechain_init(&chain);

 	result = dns_rbtnodechain_first(&chain, zt->table, NULL, NULL);
 	while (result == DNS_R_NEWORIGIN || result == ISC_R_SUCCESS) {
@@ -457,7 +457,7 @@ dns_zt_setviewrevert(dns_zt_t *zt) {

 	REQUIRE(VALID_ZT(zt));

-	dns_rbtnodechain_init(&chain, zt->mctx);
+	dns_rbtnodechain_init(&chain);

 	result = dns_rbtnodechain_first(&chain, zt->table, NULL, NULL);
 	while (result == DNS_R_NEWORIGIN || result == ISC_R_SUCCESS) {
@@ -485,7 +485,7 @@ dns_zt_apply(dns_zt_t *zt, bool stop, isc_result_t *sub,
 	REQUIRE(VALID_ZT(zt));
 	REQUIRE(action != NULL);

-	dns_rbtnodechain_init(&chain, zt->mctx);
+	dns_rbtnodechain_init(&chain);
 	result = dns_rbtnodechain_first(&chain, zt->table, NULL, NULL);
 	if (result == ISC_R_NOTFOUND) {
 		/*
@@ -2,6 +2,7 @@
 ./.gitlab-ci.yml				X	2018,2019
 ./.uncrustify.cfg				X	2018,2019
 ./CHANGES					X	2000,2001,2002,2003,2004,2005,2006,2007,2008,2009,2010,2011,2012,2013,2014,2015,2016,2017,2018,2019
+./CODE_OF_CONDUCT				X	2019
 ./CONTRIBUTING					X	2017,2018,2019
 ./COPYRIGHT					TXT.TOP	1996,1997,1998,1999,2000,2001,2002,2003,2004,2005,2006,2007,2008,2009,2010,2011,2012,2013,2014,2015,2016,2017,2018,2019
 ./HISTORY					X	2010,2013,2016,2017,2018,2019
@@ -501,6 +502,7 @@
 ./bin/tests/system/digdelv/prereq.sh		SH	2018,2019
 ./bin/tests/system/digdelv/setup.sh		SH	2018,2019
 ./bin/tests/system/digdelv/tests.sh		SH	2015,2016,2017,2018,2019
+./bin/tests/system/digdelv/yamlget.py		PYTHON	2019
 ./bin/tests/system/ditch.pl			PERL	2015,2016,2018,2019
 ./bin/tests/system/dlz/clean.sh			SH	2010,2012,2014,2016,2018,2019
 ./bin/tests/system/dlz/ns1/dns-root/com/broken/dns.d/@/DNAME=10=example.net.=	TXT.BRIEF	2015,2016,2018,2019
@@ -666,11 +668,8 @@
 ./bin/tests/system/glue/clean.sh		SH	2000,2001,2004,2007,2012,2014,2015,2016,2018,2019
 ./bin/tests/system/glue/fi.good			X	2000,2001,2018,2019
 ./bin/tests/system/glue/noglue.good		X	2000,2001,2018,2019
-./bin/tests/system/glue/ns1/cache.in		X	2018,2019
 ./bin/tests/system/glue/setup.sh		SH	2001,2004,2007,2012,2016,2018,2019
 ./bin/tests/system/glue/tests.sh		SH	2000,2001,2003,2004,2007,2012,2013,2016,2017,2018,2019
-./bin/tests/system/glue/xx.good			X	2000,2001,2018,2019
-./bin/tests/system/glue/yy.good			X	2000,2001,2003,2018,2019
 ./bin/tests/system/idna/clean.sh		SH	2018,2019
 ./bin/tests/system/idna/setup.sh		SH	2018,2019
 ./bin/tests/system/idna/tests.sh		SH	2018,2019
Author	SHA1	Message	Date
Vicky Risk	c65f307d57	Update release.md	2019-08-29 19:57:45 -04:00
Ondřej Surý	3b8a52264c	Merge branch 'ondrej/vicky/add-coc' into 'master' Add Code of Conduct See merge request isc-projects/bind9!2219	2019-08-29 15:04:44 -04:00
Ondřej Surý	db00eb2fa9	Add Code of Conduct adapted from Django Code of Conduct	2019-08-29 21:01:29 +02:00
Evan Hunt	8b5aa19ed9	Merge branch 'each-simplify-rbtnodechain' into 'master' simplify dns_rbtnodechain_init() by removing unnecessary 'mctx' parameter See merge request isc-projects/bind9!2273	2019-08-29 13:29:45 -04:00
Evan Hunt	a8595262f7	add a semantic patch for the API change	2019-08-29 10:07:41 -07:00
Evan Hunt	c48979e6c5	simplify dns_rbtnodechain_init() by removing unnecessary 'mctx' parameter	2019-08-29 10:03:36 -07:00
Ondřej Surý	ca52242661	Merge branch 'ondrej/use-needs-kw-in-gitlab-ci' into 'master' Ondrej/use needs kw in gitlab ci See merge request isc-projects/bind9!2280	2019-08-29 08:58:37 -04:00
Ondřej Surý	3f2de6d39c	Swap unit and system stages	2019-08-29 14:39:08 +02:00
Ondřej Surý	fc834aa4bc	Further improve the CI by starting the build and docs right after autoreconf	2019-08-29 14:37:33 +02:00
Ondřej Surý	008b73fb41	Split the system and unit tests into separate stages	2019-08-29 14:32:27 +02:00
Ondřej Surý	04ce124279	Make use of DAG for GitLab Pipelines GitLab 12.2 has introduced Directed Acyclic Graphs in the GitLab CI[1] that allow jobs to run out-of-order and not wait for the whole previous stage to complete. 1. https://docs.gitlab.com/ee/ci/directed_acyclic_graph/	2019-08-29 14:31:37 +02:00
Ondřej Surý	057e9fdb51	Merge branch 'ondrej/missing-extern-in-dighost_error-declaration' into 'master' dighost_error declaration in dig/dig.h was missing extern See merge request isc-projects/bind9!2278	2019-08-29 07:05:26 -04:00
Ondřej Surý	f1a887a0b9	dighost_error declaration in dig/dig.h was missing extern	2019-08-29 11:24:16 +02:00
Mark Andrews	d9e96809ac	Merge branch '1199-return-value-from-open-not-checked' into 'master' Resolve "Return value from open() not checked." Closes #1199 See merge request isc-projects/bind9!2264	2019-08-28 20:17:01 -04:00
Mark Andrews	510306c654	check that open() succeeded	2019-08-28 19:50:44 -04:00
Mark Andrews	9d3205e894	Merge branch '1201-add-llq-option' into 'master' Resolve "Add LLQ option" Closes #1201 See merge request isc-projects/bind9!2267	2019-08-28 02:41:43 -04:00
Mark Andrews	d98f446d3f	Add support for displaying EDNS option LLQ.	2019-08-28 16:13:43 +10:00
Mark Andrews	c8ed70a108	Merge branch '1187-ddns-rejected-if-zone-contains-cds-cdnskey' into 'master' Resolve "DDNS rejected if zone contains CDS/CDNSKEY" Closes #1187 See merge request isc-projects/bind9!2254	2019-08-28 02:09:39 -04:00
Mark Andrews	ba26c6eb48	add CHANGES	2019-08-28 15:47:16 +10:00
Mark Andrews	30610eb9a5	add good and bad CDS / CDNSKEY test zones	2019-08-28 15:46:41 +10:00
Mark Andrews	3705605e0b	fix dnssec system tests that fail now that we call dns_zone_cdscheck	2019-08-28 15:46:41 +10:00
Mark Andrews	cd40c9fe61	add dns_zone_cdscheck to integrity checks	2019-08-28 15:46:41 +10:00
Mark Andrews	2ebc4776ca	implement getoriginnode for sdb	2019-08-28 15:46:41 +10:00
Evan Hunt	ddd871bbea	Merge branch 'each-tidy-glue-test' into 'master' remove unneeded files and options from glue test See merge request isc-projects/bind9!2238	2019-08-27 13:00:47 -04:00
Evan Hunt	7b65ea4c11	remove unneeded files and options from glue test - the cache-file and check-itegrity options were not needed - some zones and files were not used	2019-08-27 09:41:33 -07:00
Evan Hunt	417df8cfbc	Merge branch 'each-dig-yaml' into 'master' dig/delv/mdig +yaml output Closes #1145 See merge request isc-projects/bind9!2168	2019-08-25 20:02:33 -04:00
Evan Hunt	2627287dbc	CHANGES, README, relnotes	2019-08-25 16:41:39 -07:00
Evan Hunt	33887dd941	add digdelv +yaml system tests	2019-08-25 16:41:38 -07:00
Evan Hunt	617696fbfc	document the +yaml option in dig, mdig and delv	2019-08-25 16:41:38 -07:00
Evan Hunt	241cf78fee	add "delv +yaml" output format	2019-08-25 16:41:34 -07:00
Evan Hunt	5aa375f0d8	add "mdig +yaml" output format	2019-08-25 16:41:29 -07:00
Evan Hunt	71325852f1	add "dig +yaml" output format	2019-08-25 16:41:14 -07:00
Evan Hunt	89d5ecb04d	Merge branch '1031-multiple-rate-limit-clauses-are-unsupported-master' into 'master' Resolve "Multiple rate-limit clauses are unsupported" See merge request isc-projects/bind9!2262	2019-08-21 11:04:14 -04:00
Mark AndrewsandEvan Hunt	9fc4be226d	remove reference to rate-limit { domain ...; } (cherry picked from commit `2275630bc9`)	2019-08-21 08:40:09 -06:00