Update release.md

.gitlab/issue_templates/release.md

@@ -39,6 +39,9 @@
  - [ ] Update tickets in case of waiting support customers.
 
 ## Marketing
- - [ ] Post short note to Twitter.
+ - [ ] Update BIND Product page if needed
+ - [ ] Update BIND Significant Features Matrix in KB if needed
+ - [ ] Update BIND -S Edition data sheet if S Edition feature change
+ - [ ] Announce on social media
  - [ ] Update [Wikipedia entry for BIND](http://en.wikipedia.org/wiki/BIND).
  - [ ] Write blog article (if a major release).

CHANGES

@@ -1,38 +1,3 @@
-	--- 9.15.3 released ---
-
-5291.	[placeholder]
-
-5290.	[placeholder]
-
-5289.	[bug]		Address NULL pointer dereference in rpz.c:rpz_detach.
-			[GL #1210]
-
-5288.	[bug]		dnssec-must-be-secure was not always honoured.
-			[GL #1209]
-
-5287.	[placeholder]
-
-5286.	[contrib]	Address potential NULL pointer dereferences in
-			dlz_mysqldyn_mod.c. [GL #1207]
-
-5285.	[port]		win32: implement "-T maxudpXXX". [GL #837]
-
-5284.	[func]		Added +unexpected command line option to dig.
-			By default, dig won't accept a reply from a source
-			other than the one to which it sent the query.
-			Invoking dig with +unexpected argument will allow it
-			to process replies from unexpected sources.
-
-5283.	[bug]		When a response-policy zone expires, ensure that
-			its policies are removed from the RPZ summary
-			database. [GL #1146]
-
-5282.	[bug]		Fixed a bug in searching for possible wildcard matches
-			for query names in the RPZ summary database. [GL #1146]
-
-5281.	[cleanup]	Don't escape commas when reporting named's command
-			line. [GL #1189]
-
 5280.	[protocol]	Add support for displaying EDNS option LLQ. [GL #1201]
 
 5279.	[bug]		When loading, reject zones containing CDS or CDNSKEY

Makefile.in

@@ -104,7 +104,7 @@ PLATFORMS: PLATFORMS.md
 		sed -e '$${/^$$/d;}' > $@
 
 CODE_OF_CONDUCT: CODE_OF_CONDUCT.md
-	${PANDOC} --email-obfuscation=none -s --metadata title="CODE OF CONDUCT" -f markdown-smart -t html CODE_OF_CONDUCT.md | \
+	${PANDOC} --email-obfuscation=none -s --metadata title="CODE OF CONDUCT" -f markdown-smart -t html $< | \
 		${W3M} -dump -cols 75 -O ascii -T text/html | \
 		sed -e '$${/^$$/d;}' > $@
 

README

@@ -110,7 +110,6 @@ of changes from BIND 9.14 and earlier releases. New features include:
 
   * Support for the new GeoIP2 geolocation API
   * Improved DNSSEC key configuration using dnssec-keys
-  * YAML output for dig, mdig, and delv.
 
 Building BIND
 

bin/delv/delv.1

@@ -409,11 +409,6 @@ Controls whether to use TCP when sending queries\&. The default is to use UDP un
 .RS 4
 Print all RDATA in unknown RR type presentation format (RFC 3597)\&. The default is to print RDATA for known types in the type\*(Aqs presentation format\&.
 .RE
-.PP
-\fB+[no]yaml\fR
-.RS 4
-Print response data in YAML format\&.
-.RE
 .SH "FILES"
 .PP
 /etc/bind\&.keys

bin/delv/delv.html

@@ -548,12 +548,6 @@
 	      in the type's presentation format.
 	    </p>
 	  </dd>
-<dt><span class="term"><code class="option">+[no]yaml</code></span></dt>
-<dd>
-	    <p>
-	      Print response data in YAML format.
-	    </p>
-	  </dd>
 </dl></div>
 <p>
 

bin/dig/dig.1

@@ -744,13 +744,6 @@ Display [do not display] the TTL when printing the record\&.
 Display [do not display] the TTL in friendly human\-readable time units of "s", "m", "h", "d", and "w", representing seconds, minutes, hours, days and weeks\&. Implies +ttlid\&.
 .RE
 .PP
-\fB+[no]unexpected\fR
-.RS 4
-Accept [do not accept] answers from unexpected sources\&. By default,
-\fBdig\fR
-won\*(Aqt accept a reply from a source other than the one to which it sent the query\&.
-.RE
-.PP
 \fB+[no]unknownformat\fR
 .RS 4
 Print all RDATA in unknown RR type presentation format (RFC 3597)\&. The default is to print RDATA for known types in the type\*(Aqs presentation format\&.
@@ -763,13 +756,6 @@ Use [do not use] TCP when querying name servers\&. This alternate syntax to
 is provided for backwards compatibility\&. The "vc" stands for "virtual circuit"\&.
 .RE
 .PP
-\fB+[no]yaml\fR
-.RS 4
-Print the responses (and, if
-\fB+qr\fR
-is in use, also the outgoing queries) in a detailed YAML format\&.
-.RE
-.PP
 \fB+[no]zflag\fR
 .RS 4
 Set [do not set] the last unassigned DNS header flag in a DNS query\&. This flag is off by default\&.

bin/dig/dig.c

@@ -64,7 +64,8 @@ static char hexcookie[81];
 
 static bool short_form = false, printcmd = true,
 	plusquest = false, pluscomm = false,
-	ipv4only = false, ipv6only = false, digrc = true;
+	ipv4only = false, ipv6only = false, digrc = true,
+	yaml = false;
 static uint32_t splitwidth = 0xffffffff;
 
 /*% opcode text */
@@ -234,8 +235,6 @@ help(void) {
 "                 +tries=###          (Set number of UDP attempts) [3]\n"
 "                 +[no]ttlid          (Control display of ttls in records)\n"
 "                 +[no]ttlunits       (Display TTLs in human-readable units)\n"
-"                 +[no]unexpected     (Print replies from unexpected sources\n"
-"                                      default=off)\n"
 "                 +[no]unknownformat  (Print RDATA in RFC 3597 \"unknown\" "
 					"format)\n"
 "                 +[no]vc             (TCP mode (+[no]tcp))\n"
@@ -1668,25 +1667,8 @@ plus_option(char *option, bool is_batchfile,
 		}
 		break;
 	case 'u':
-		switch (cmd[1]) {
-		case 'n':
-			switch (cmd[2]) {
-			case 'e':
-				FULLCHECK("unexpected");
-				lookup->accept_reply_unexpected_src = state;
-				break;
-			case 'k':
-				FULLCHECK("unknownformat");
-				lookup->print_unknown_format = state;
-				break;
-			default:
-				goto invalid_option;
-			}
-			break;
-		default:
-			goto invalid_option;
-		}
-
+		FULLCHECK("unknownformat");
+		lookup->print_unknown_format = state;
 		break;
 	case 'v':
 		FULLCHECK("vc");
@@ -2445,36 +2427,6 @@ dig_error(const char *format, ...) {
 	}
 }
 
-static void
-dig_warning(const char *format, ...) {
-	va_list args;
-
-	if (!yaml) {
-		printf(";; ");
-
-		va_start(args, format);
-		vprintf(format, args);
-		va_end(args);
-
-		printf("\n");
-	}
-}
-
-static void
-dig_comments(dig_lookup_t *lookup, const char *format, ...) {
-	va_list args;
-
-	if (lookup->comments && !yaml) {
-		printf(";; ");
-
-		va_start(args, format);
-		vprintf(format, args);
-		va_end(args);
-
-		printf("\n");
-	}
-}
-
 void
 dig_setup(int argc, char **argv) {
 	isc_result_t result;
@@ -2491,8 +2443,6 @@ dig_setup(int argc, char **argv) {
 	dighost_trying = trying;
 	dighost_shutdown = query_finished;
 	dighost_error = dig_error;
-	dighost_warning = dig_warning;
-	dighost_comments = dig_comments;
 
 	progname = argv[0];
 	preparse_args(argc, argv);

bin/dig/dig.docbook

@@ -1269,17 +1269,6 @@
 	  </listitem>
 	</varlistentry>
 
-	<varlistentry>
-	  <term><option>+[no]unexpected</option></term>
-	  <listitem>
-	    <para>
-	      Accept [do not accept] answers from unexpected sources.  By
-	      default, <command>dig</command> won't accept a reply from a
-	      source other than the one to which it sent the query.
-	    </para>
-	  </listitem>
-	</varlistentry>
-
 	<varlistentry>
 	  <term><option>+[no]unknownformat</option></term>
 	  <listitem>

bin/dig/dig.html

@@ -1000,14 +1000,6 @@
 	      seconds, minutes, hours, days and weeks.  Implies +ttlid.
 	    </p>
 	  </dd>
-<dt><span class="term"><code class="option">+[no]unexpected</code></span></dt>
-<dd>
-	    <p>
-	      Accept [do not accept] answers from unexpected sources.  By
-	      default, <span class="command"><strong>dig</strong></span> won't accept a reply from a
-	      source other than the one to which it sent the query.
-	    </p>
-	  </dd>
 <dt><span class="term"><code class="option">+[no]unknownformat</code></span></dt>
 <dd>
 	    <p>
@@ -1025,13 +1017,6 @@
 	      stands for "virtual circuit".
 	    </p>
 	  </dd>
-<dt><span class="term"><code class="option">+[no]yaml</code></span></dt>
-<dd>
-	    <p>
-	      Print the responses (and, if <code class="option">+qr</code> is in use,
-	      also the outgoing queries) in a detailed YAML format.
-	    </p>
-	  </dd>
 <dt><span class="term"><code class="option">+[no]zflag</code></span></dt>
 <dd>
 	    <p>

bin/dig/dighost.c

@@ -112,8 +112,7 @@ bool
 	showsearch = false,
 	is_dst_up = false,
 	keep_open = false,
-	verbose = false,
-	yaml = false;
+	verbose = false;
 in_port_t port = 53;
 unsigned int timeout = 0;
 unsigned int extrabytes;
@@ -191,30 +190,6 @@ dig_lookup_t *current_lookup = NULL;
 		     "isc_mutex_unlock");\
 }
 
-static void
-default_warnerr(const char *format, ...) {
-	va_list args;
-
-	printf(";; ");
-	va_start(args, format);
-	vprintf(format, args);
-	va_end(args);
-	printf("\n");
-};
-
-static void
-default_comments(dig_lookup_t *lookup, const char *format, ...) {
-	va_list args;
-
-	if (lookup->comments) {
-		printf(";; ");
-		va_start(args, format);
-		vprintf(format, args);
-		va_end(args);
-		printf("\n");
-	}
-};
-
 /* dynamic callbacks */
 
 isc_result_t
@@ -222,13 +197,7 @@ isc_result_t
 			dns_message_t *msg, bool headers);
 
 void
-(*dighost_error)(const char *format, ...) = default_warnerr;
-
-void
-(*dighost_warning)(const char *format, ...) = default_warnerr;
-
-void
-(*dighost_comments)(dig_lookup_t *lookup, const char *format, ...) = default_comments;
+(*dighost_error)(const char *format, ...);
 
 void
 (*dighost_received)(unsigned int bytes, isc_sockaddr_t *from,
@@ -652,7 +621,6 @@ make_empty_lookup(void) {
 	looknew->ttlunits = false;
 	looknew->expandaaaa = false;
 	looknew->qr = false;
-	looknew->accept_reply_unexpected_src = false;
 #ifdef HAVE_LIBIDN2
 	looknew->idnin = isatty(1)?(getenv("IDN_DISABLE") == NULL):false;
 	looknew->idnout = looknew->idnin;
@@ -798,8 +766,6 @@ clone_lookup(dig_lookup_t *lookold, bool servers) {
 	looknew->ttlunits = lookold->ttlunits;
 	looknew->expandaaaa = lookold->expandaaaa;
 	looknew->qr = lookold->qr;
-	looknew->accept_reply_unexpected_src =
-		lookold->accept_reply_unexpected_src;
 	looknew->idnin = lookold->idnin;
 	looknew->idnout = lookold->idnout;
 	looknew->udpsize = lookold->udpsize;
@@ -1791,15 +1757,12 @@ followup_lookup(dns_message_t *msg, dig_query_t *query, dns_section_t section)
 			namereln = dns_name_fullcompare(name, domain,
 							&order, &nlabels);
 			if (namereln == dns_namereln_equal) {
-				if (!horizontal) {
-					dighost_warning("BAD (HORIZONTAL) "
-							"REFERRAL");
-				}
+				if (!horizontal)
+					printf(";; BAD (HORIZONTAL) REFERRAL\n");
 				horizontal = true;
 			} else if (namereln != dns_namereln_subdomain) {
-				if (!bad) {
-					dighost_warning( "BAD REFERRAL");
-				}
+				if (!bad)
+					printf(";; BAD REFERRAL\n");
 				bad = true;
 				continue;
 			}
@@ -2670,6 +2633,10 @@ force_timeout(dig_query_t *query) {
 	event = isc_event_allocate(mctx, query, ISC_TIMEREVENT_IDLE,
 				   connect_timeout, query,
 				   sizeof(isc_event_t));
+	if (event == NULL) {
+		fatal("isc_event_allocate: %s",
+		      isc_result_totext(ISC_R_NOMEMORY));
+	}
 	isc_task_send(global_task, &event);
 
 	/*
@@ -2721,7 +2688,7 @@ send_tcp_connect(dig_query_t *query) {
 
 		isc_netaddr_fromsockaddr(&netaddr, &query->sockaddr);
 		isc_netaddr_format(&netaddr, buf, sizeof(buf));
-		dighost_warning("Skipping mapped address '%s'", buf);
+		printf(";; Skipping mapped address '%s'\n", buf);
 
 		query->waiting_connect = false;
 		if (ISC_LINK_LINKED(query, link))
@@ -2731,7 +2698,7 @@ send_tcp_connect(dig_query_t *query) {
 		l = query->lookup;
 		clear_query(query);
 		if (next == NULL) {
-			dighost_warning("No acceptable nameservers");
+			printf(";; No acceptable nameservers\n");
 			check_next_lookup(l);
 			return;
 		}
@@ -2792,14 +2759,6 @@ send_tcp_connect(dig_query_t *query) {
 	}
 }
 
-static void
-print_query_size(dig_query_t *query) {
-	if (!yaml) {
-		printf(";; QUERY SIZE: %u\n\n",
-		       isc_buffer_usedlength(&query->lookup->renderbuf));
-	}
-}
-
 /*%
  * Send a UDP packet to the remote nameserver, possible starting the
  * recv action as well.  Also make sure that the timer is running and
@@ -2838,12 +2797,13 @@ send_udp(dig_query_t *query) {
 
 			isc_netaddr_fromsockaddr(&netaddr, &query->sockaddr);
 			isc_netaddr_format(&netaddr, buf, sizeof(buf));
-			dighost_warning("Skipping mapped address '%s'", buf);
+			printf(";; Skipping mapped address '%s'\n", buf);
+
 			next = ISC_LIST_NEXT(query, link);
 			l = query->lookup;
 			clear_query(query);
 			if (next == NULL) {
-				dighost_warning("No acceptable nameservers");
+				printf(";; No acceptable nameservers\n");
 				check_next_lookup(l);
 			} else {
 				send_udp(next);
@@ -2902,7 +2862,8 @@ send_udp(dig_query_t *query) {
 				     &query->lookup->renderbuf,
 				     query->lookup->sendmsg, true);
 		if (query->lookup->stats) {
-			print_query_size(query);
+			printf(";; QUERY SIZE: %u\n\n",
+			     isc_buffer_usedlength(&query->lookup->renderbuf));
 		}
 	}
 }
@@ -3188,7 +3149,9 @@ launch_next_query(dig_query_t *query, bool include_question) {
 					     &query->lookup->renderbuf,
 					     query->lookup->sendmsg, true);
 			if (query->lookup->stats) {
-				print_query_size(query);
+				printf(";; QUERY SIZE: %u\n\n",
+				       isc_buffer_usedlength(
+						    &query->lookup->renderbuf));
 			}
 		}
 	}
@@ -3230,12 +3193,11 @@ connect_done(isc_task_t *task, isc_event_t *event) {
 	if (sevent->result == ISC_R_CANCELED) {
 		debug("in cancel handler");
 		isc_sockaddr_format(&query->sockaddr, sockstr, sizeof(sockstr));
-		if (query->timedout) {
-			dighost_warning("Connection to %s(%s) for %s failed: "
-					"%s.", sockstr, query->servname,
-					query->lookup->textname,
-					isc_result_totext(ISC_R_TIMEDOUT));
-		}
+		if (query->timedout)
+			printf(";; Connection to %s(%s) for %s failed: %s.\n",
+			       sockstr, query->servname,
+			       query->lookup->textname,
+			       isc_result_totext(ISC_R_TIMEDOUT));
 		isc_socket_detach(&query->sock);
 		INSIST(sockcount > 0);
 		sockcount--;
@@ -3253,12 +3215,11 @@ connect_done(isc_task_t *task, isc_event_t *event) {
 		debug("unsuccessful connection: %s",
 		      isc_result_totext(sevent->result));
 		isc_sockaddr_format(&query->sockaddr, sockstr, sizeof(sockstr));
-		if (sevent->result != ISC_R_CANCELED) {
-			dighost_warning("Connection to %s(%s) for %s failed: "
-					"%s.", sockstr, query->servname,
-					 query->lookup->textname,
-					 isc_result_totext(sevent->result));
-		}
+		if (sevent->result != ISC_R_CANCELED)
+			printf(";; Connection to %s(%s) for %s failed: "
+			       "%s.\n", sockstr,
+			       query->servname, query->lookup->textname,
+			       isc_result_totext(sevent->result));
 		isc_socket_detach(&query->sock);
 		INSIST(sockcount > 0);
 		sockcount--;
@@ -3466,12 +3427,12 @@ process_cookie(dig_lookup_t *l, dns_message_t *msg,
 		if (isc_safe_memequal(isc_buffer_current(optbuf), sent, 8)) {
 			msg->cc_ok = 1;
 		} else {
-			dighost_warning("Warning: Client COOKIE mismatch");
+			printf(";; Warning: Client COOKIE mismatch\n");
 			msg->cc_bad = 1;
 			copy = false;
 		}
 	} else {
-		dighost_warning("Warning: COOKIE bad token (too short)");
+		printf(";; Warning: COOKIE bad token (too short)\n");
 		msg->cc_bad = 1;
 		copy = false;
 	}
@@ -3643,11 +3604,9 @@ recv_done(isc_task_t *task, isc_event_t *event) {
 			sizeof(buf1));
 			isc_sockaddr_format(&query->sockaddr, buf2,
 			sizeof(buf2));
-			dighost_warning("reply from unexpected source: %s,"
-					" expected %s\n", buf1, buf2);
-			if (!l->accept_reply_unexpected_src) {
-				match = false;
-			}
+			printf(";; reply from unexpected source: %s,"
+			" expected %s\n", buf1, buf2);
+			match = false;
 		}
 	}
 
@@ -3657,22 +3616,19 @@ recv_done(isc_task_t *task, isc_event_t *event) {
 		if (l->tcp_mode) {
 			bool fail = true;
 			if (result == ISC_R_SUCCESS) {
-				if ((!query->first_soa_rcvd || query->warn_id))
-				{
-					dighost_warning("%s: ID mismatch: "
-							"expected ID %u, got "
-							"%u",
-							query->first_soa_rcvd ?
-							"WARNING" : "ERROR",
-							l->sendmsg->id, id);
-				}
+				if (!query->first_soa_rcvd ||
+				     query->warn_id)
+					printf(";; %s: ID mismatch: "
+					       "expected ID %u, got %u\n",
+					       query->first_soa_rcvd ?
+					       "WARNING" : "ERROR",
+					       l->sendmsg->id, id);
 				if (query->first_soa_rcvd)
 					fail = false;
 				query->warn_id = false;
-			} else {
-				dighost_warning("ERROR: short (< header size) "
-						"message");
-			}
+			} else
+				printf(";; ERROR: short "
+				       "(< header size) message\n");
 			if (fail) {
 				isc_event_free(&event);
 				clear_query(query);
@@ -3682,18 +3638,16 @@ recv_done(isc_task_t *task, isc_event_t *event) {
 				return;
 			}
 			match = true;
-		} else if (result == ISC_R_SUCCESS) {
-			dighost_warning("Warning: ID mismatch: expected ID %u,"
-					" got %u", l->sendmsg->id, id);
-		} else {
-			dighost_warning("Warning: short (< header size) "
-					"message received");
-		}
+		} else if (result == ISC_R_SUCCESS)
+			printf(";; Warning: ID mismatch: "
+			       "expected ID %u, got %u\n", l->sendmsg->id, id);
+		else
+			printf(";; Warning: short "
+			       "(< header size) message received\n");
 	}
 
-	if (result == ISC_R_SUCCESS && (msgflags & DNS_MESSAGEFLAG_QR) == 0) {
-		dighost_warning("Warning: query response not set");
-	}
+	if (result == ISC_R_SUCCESS && (msgflags & DNS_MESSAGEFLAG_QR) == 0)
+		printf(";; Warning: query response not set\n");
 
 	if (!match)
 		goto udp_mismatch;
@@ -3727,16 +3681,13 @@ recv_done(isc_task_t *task, isc_event_t *event) {
 	}
 	result = dns_message_parse(msg, &b, parseflags);
 	if (result == DNS_R_RECOVERABLE) {
-		dighost_warning("Warning: Message parser reports malformed "
-				"message packet.");
+		printf(";; Warning: Message parser reports malformed "
+		       "message packet.\n");
 		result = ISC_R_SUCCESS;
 	}
 	if (result != ISC_R_SUCCESS) {
-		if (!yaml) {
-			printf(";; Got bad packet: %s\n",
-			       isc_result_totext(result));
-			hex_dump(&b);
-		}
+		printf(";; Got bad packet: %s\n", isc_result_totext(result));
+		hex_dump(&b);
 		query->waiting_connect = false;
 		dns_message_destroy(&msg);
 		isc_event_free(&event);
@@ -3773,10 +3724,9 @@ recv_done(isc_task_t *task, isc_event_t *event) {
 					dns_rdataclass_format(rdataset->rdclass,
 							      classbuf,
 							      sizeof(classbuf));
-					dighost_warning(";; Question section "
-							"mismatch: got "
-							"%s/%s/%s", namestr,
-							typebuf, classbuf);
+					printf(";; Question section mismatch: "
+					       "got %s/%s/%s\n",
+					       namestr, typebuf, classbuf);
 					match = false;
 				}
 			}
@@ -3799,8 +3749,9 @@ recv_done(isc_task_t *task, isc_event_t *event) {
 		/*
 		 * Add minimum EDNS version required checks here if needed.
 		 */
-		dighost_comments(l, "BADVERS, retrying with EDNS version %u.",
-				 (unsigned int)newedns);
+		if (l->comments)
+			printf(";; BADVERS, retrying with EDNS version %u.\n",
+			       (unsigned int)newedns);
 		l->edns = newedns;
 		n = requeue_lookup(l, true);
 		if (l->trace && l->trace_root)
@@ -3817,7 +3768,8 @@ recv_done(isc_task_t *task, isc_event_t *event) {
 	    !l->ignore && !l->tcp_mode) {
 		if (l->cookie == NULL && l->sendcookie && msg->opt != NULL)
 			process_opt(l, msg);
-		dighost_comments(l, "Truncated, retrying in TCP mode.");
+		if (l->comments)
+			printf(";; Truncated, retrying in TCP mode.\n");
 		n = requeue_lookup(l, true);
 		n->tcp_mode = true;
 		if (l->trace && l->trace_root)
@@ -3834,9 +3786,9 @@ recv_done(isc_task_t *task, isc_event_t *event) {
 	    l->sendcookie && l->badcookie) {
 		process_opt(l, msg);
 		if (msg->cc_ok) {
-			dighost_comments(l, "BADCOOKIE, retrying%s.",
-					 l->seenbadcookie ?
-					 " in TCP mode" : "");
+			if (l->comments)
+				printf(";; BADCOOKIE, retrying%s.\n",
+				       l->seenbadcookie ? " in TCP mode" : "");
 			n = requeue_lookup(l, true);
 			if (l->seenbadcookie)
 				n->tcp_mode = true;
@@ -3873,12 +3825,13 @@ recv_done(isc_task_t *task, isc_event_t *event) {
 		 */
 		if ((ISC_LIST_HEAD(l->q) != query) ||
 		    (ISC_LIST_NEXT(query, link) != NULL)) {
-			dighost_comments(l, "Got %s from %s, trying next "
-					 "server",
-					 msg->rcode == dns_rcode_servfail ?
-					 "SERVFAIL reply" :
-					 "recursion not available",
-					 query->servname);
+			if (l->comments)
+				printf(";; Got %s from %s, "
+				       "trying next server\n",
+				       msg->rcode == dns_rcode_servfail ?
+				       "SERVFAIL reply" :
+				       "recursion not available",
+				       query->servname);
 			clear_query(query);
 			check_next_lookup(l);
 			dns_message_destroy(&msg);
@@ -3891,8 +3844,8 @@ recv_done(isc_task_t *task, isc_event_t *event) {
 	if (tsigkey != NULL) {
 		result = dns_tsig_verify(&b, msg, NULL, NULL);
 		if (result != ISC_R_SUCCESS) {
-			dighost_warning("Couldn't verify signature: %s",
-					isc_result_totext(result));
+			printf(";; Couldn't verify signature: %s\n",
+			       isc_result_totext(result));
 			validated = false;
 		}
 		l->tsigctx = msg->tsigctx;
@@ -3943,8 +3896,7 @@ recv_done(isc_task_t *task, isc_event_t *event) {
 	if (!done_process_opt) {
 		if (l->cookie != NULL) {
 			if (msg->opt == NULL) {
-				dighost_warning("expected opt record in "
-						"response");
+				printf(";; expected opt record in response\n");
 			} else {
 				process_opt(l, msg);
 			}

bin/dig/host.c

@@ -857,6 +857,17 @@ parse_args(bool is_batchfile, int argc, char **argv) {
 	ISC_LIST_APPEND(lookup_list, lookup, link);
 }
 
+static void
+host_error(const char *format, ...) {
+	va_list args;
+
+	printf(";; ");
+	va_start(args, format);
+	vfprintf(stdout, format, args);
+	va_end(args);
+	printf("\n");
+}
+
 int
 main(int argc, char **argv) {
 	isc_result_t result;
@@ -874,6 +885,7 @@ main(int argc, char **argv) {
 	dighost_received = received;
 	dighost_trying = trying;
 	dighost_shutdown = host_shutdown;
+	dighost_error = host_error;
 
 	debug("main()");
 	progname = argv[0];

bin/dig/include/dig/dig.h

@@ -141,9 +141,7 @@ struct dig_lookup {
 		idnin,
 		idnout,
 		expandaaaa,
-		qr,
-		accept_reply_unexpected_src;  /*%  print replies from unexpected
-						   sources. */
+		qr;
 	char textname[MXNAME]; /*% Name we're going to be looking up */
 	char cmdline[MXNAME];
 	dns_rdatatype_t rdtype;
@@ -252,7 +250,7 @@ extern dig_searchlistlist_t search_list;
 extern unsigned int extrabytes;
 
 extern bool check_ra, have_ipv4, have_ipv6, specified_source,
-	usesearch, showsearch, yaml;
+	usesearch, showsearch;
 extern in_port_t port;
 extern unsigned int timeout;
 extern isc_mem_t *mctx;
@@ -391,18 +389,6 @@ extern isc_result_t
 extern void
 (*dighost_error)(const char *format, ...);
 
-/*
- * Print a warning message in the appropriate format.
- */
-extern void
-(*dighost_warning)(const char *format, ...);
-
-/*
- * Print a comment in the appropriate format.
- */
-extern void
-(*dighost_comments)(dig_lookup_t *lookup, const char *format, ...);
-
 /*%<
  * Print the final result of the lookup.
  */

bin/dig/nslookup.c

@@ -983,6 +983,17 @@ getinput(isc_task_t *task, isc_event_t *event) {
 	isc_app_shutdown();
 }
 
+static void
+nsl_error(const char *format, ...) {
+	va_list args;
+
+	printf(";; ");
+	va_start(args, format);
+	vfprintf(stdout, format, args);
+	va_end(args);
+	printf("\n");
+}
+
 int
 main(int argc, char **argv) {
 	isc_result_t result;
@@ -1000,6 +1011,7 @@ main(int argc, char **argv) {
 	dighost_received = received;
 	dighost_trying = trying;
 	dighost_shutdown = query_finished;
+	dighost_error = nsl_error;
 
 	result = isc_app_start();
 	check_result(result, "isc_app_start");

bin/dnssec/dnssec-signzone.c

@@ -1570,6 +1570,8 @@ assignwork(isc_task_t *task, isc_task_t *worker) {
 	sevent = (sevent_t *)
 		 isc_event_allocate(mctx, task, SIGNER_EVENT_WORK,
 				    sign, NULL, sizeof(sevent_t));
+	if (sevent == NULL)
+		fatal("failed to allocate event\n");
 
 	sevent->node = node;
 	sevent->fname = fname;
@@ -1625,6 +1627,8 @@ sign(isc_task_t *task, isc_event_t *event) {
 	wevent = (sevent_t *)
 		 isc_event_allocate(mctx, task, SIGNER_EVENT_WRITE,
 				    writenode, NULL, sizeof(sevent_t));
+	if (wevent == NULL)
+		fatal("failed to allocate event\n");
 	wevent->node = node;
 	wevent->fname = fname;
 	isc_task_send(master, ISC_EVENT_PTR(&wevent));

bin/named/config.c

@@ -855,7 +855,6 @@ named_config_getipandkeylist(const cfg_obj_t *config, const cfg_obj_t *list,
 		isc_mem_put(mctx, stack, stackcount * sizeof(*stack));
 
 	INSIST(keycount == addrcount);
-	INSIST(keycount == dscpcount);
 
 	ipkl->addrs = addrs;
 	ipkl->dscps = dscps;

bin/named/main.c

@@ -352,7 +352,7 @@ save_command_line(int argc, char *argv[]) {
 		*dst++ = ' ';
 
 		while (*src != '\0' && dst < eob) {
-			if (isalnum(*src) || *src == ',' ||
+			if (isalnum(*src) ||
 			    *src == '-' || *src == '_' ||
 			    *src == '.' || *src == '/')
 			{
@@ -646,9 +646,6 @@ parse_T_opt(char *option) {
 		maxudp = 1460;
 	} else if (!strncmp(option, "maxudp=", 7)) {
 		maxudp = atoi(option + 7);
-		if (maxudp <= 0) {
-			named_main_earlyfatal("bad maxudp");
-		}
 	} else if (!strncmp(option, "mkeytimers=", 11)) {
 		p = strtok_r(option + 11, "/", &last);
 		if (p == NULL) {

bin/named/server.c

@@ -2827,6 +2827,8 @@ catz_create_chg_task(dns_catz_entry_t *entry, dns_catz_zone_t *origin,
 	event = (catz_chgzone_event_t *) isc_event_allocate(view->mctx, origin,
 							    type, action, NULL,
 							    sizeof(*event));
+	if (event == NULL)
+		return (ISC_R_NOMEMORY);
 
 	event->cbd = (catz_cb_data_t *) udata;
 	event->entry = NULL;
@@ -13563,6 +13565,8 @@ named_server_delzone(named_server_t *server, isc_lex_t *lex,
 	dns_zone_attach(zone, &dz->zone);
 	dzevent = isc_event_allocate(named_g_mctx, server, NAMED_EVENT_DELZONE,
 				     rmzone, dz, sizeof(isc_event_t));
+	if (dzevent == NULL)
+		CHECK(ISC_R_NOMEMORY);
 
 	dns_zone_gettask(zone, &task);
 	isc_task_send(task, &dzevent);

bin/tests/system/checkconf/tests.sh

@@ -425,7 +425,6 @@ $CHECKCONF check-root-ksk-both.conf > checkconf.out$n 2>/dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; ret=1; fi
 status=`expr $status + $ret`
 
-n=`expr $n + 1`
 echo_i "check that the 2017 ICANN ROOT KSK alone does not generate a warning ($n)"
 ret=0
 $CHECKCONF check-root-ksk-2017.conf > checkconf.out$n 2>/dev/null || ret=1
@@ -433,7 +432,6 @@ $CHECKCONF check-root-ksk-2017.conf > checkconf.out$n 2>/dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; ret=1; fi
 status=`expr $status + $ret`
 
-n=`expr $n + 1`
 echo_i "check that a static root key generates a warning ($n)"
 ret=0
 $CHECKCONF check-root-static-key.conf > checkconf.out$n 2>/dev/null || ret=1
@@ -441,7 +439,6 @@ grep "static-key entry for the root zone WILL FAIL" checkconf.out$n > /dev/null
 if [ $ret != 0 ]; then echo_i "failed"; ret=1; fi
 status=`expr $status + $ret`
 
-n=`expr $n + 1`
 echo_i "check that a trusted-keys entry for root generates a warning ($n)"
 ret=0
 $CHECKCONF check-root-trusted-key.conf > checkconf.out$n 2>/dev/null || ret=1
@@ -449,7 +446,6 @@ grep "trusted-keys entry for the root zone WILL FAIL" checkconf.out$n > /dev/nul
 if [ $ret != 0 ]; then echo_i "failed"; ret=1; fi
 status=`expr $status + $ret`
 
-n=`expr $n + 1`
 echo_i "check that using dnssec-keys and managed-keys generates an error ($n)"
 ret=0
 $CHECKCONF check-mixed-keys.conf > checkconf.out$n 2>/dev/null && ret=1
@@ -457,7 +453,6 @@ grep "use of managed-keys is not allowed" checkconf.out$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; ret=1; fi
 status=`expr $status + $ret`
 
-n=`expr $n + 1`
 echo_i "check that 'geoip-use-ecs no' generates a warning ($n)"
 ret=0
 $CHECKCONF warn-geoip-use-ecs.conf > checkconf.out$n 2>/dev/null || ret=1

bin/tests/system/conf.sh.win32

@@ -28,7 +28,7 @@ CYGWIN=1
 . $TOP/bin/tests/system/conf.sh.common
 
 # Visual Studio build configurations are Release and Debug
-VSCONF=${VSCONF:-Debug}
+VSCONF=Debug
 
 ARPANAME=$TOP/Build/$VSCONF/arpaname@EXEEXT@
 CDS=$TOP/Build/$VSCONF/dnssec-cds@EXEEXT@

bin/tests/system/digdelv/ans6/ans.pl

@@ -1,82 +0,0 @@
-#!/usr/bin/perl -w
-#
-# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, You can obtain one at http://mozilla.org/MPL/2.0/.
-#
-# See the COPYRIGHT file distributed with this work for additional
-# information regarding copyright ownership.
-
-use IO::File;
-use IO::Socket;
-use Net::DNS;
-use Net::DNS::Packet;
-
-my $localport = int($ENV{'PORT'});
-if (!$localport) { $localport = 5300; }
-
-my $sock = IO::Socket::INET->new(LocalAddr => "10.53.0.6",
-   LocalPort => $localport, Proto => "udp") or die "$!";
-
-my $pidf = new IO::File "ans.pid", "w" or die "cannot open pid file: $!";
-print $pidf "$$\n" or die "cannot write pid file: $!";
-$pidf->close or die "cannot close pid file: $!";
-sub rmpid { unlink "ans.pid"; exit 1; };
-
-$SIG{INT} = \&rmpid;
-$SIG{TERM} = \&rmpid;
-
-for (;;) {
-	$sock->recv($buf, 512);
-
-	print "**** request from " , $sock->peerhost, " port ", $sock->peerport, "\n";
-
-	my $packet;
-
-	if ($Net::DNS::VERSION > 0.68) {
-		$packet = new Net::DNS::Packet(\$buf, 0);
-		$@ and die $@;
-	} else {
-		my $err;
-		($packet, $err) = new Net::DNS::Packet(\$buf, 0);
-		$err and die $err;
-	}
-
-	print "REQUEST:\n";
-	$packet->print;
-
-	$packet->header->qr(1);
-
-	my @questions = $packet->question;
-	my $qname = $questions[0]->qname;
-	my $qtype = $questions[0]->qtype;
-
-	my $donotrespond = 0;
-
-	$packet->header->aa(1);
-	if ($qtype eq "A") {
-		$packet->push("answer",
-			      new Net::DNS::RR($qname .  " 300 A 10.53.0.5"));
-	} else {
-		$donotrespond = 1;
-	}
-
-	if ($donotrespond == 0) {
-                my $sendsock =
-                        IO::Socket::INET->new(LocalAddr => "10.53.1.2",
-                                              PeerAddr => $sock->peerhost,
-                                              PeerPort => $sock->peerport,
-                                              Proto => "udp") or die "$!";
-                print "**** response from ", $sendsock->sockhost, " to " ,
-                      $sendsock->peerhost, " port ", $sendsock->peerport, "\n";
-		$sendsock->send($packet->data);
-                $sendsock->close;
-		print "RESPONSE:\n";
-		$packet->print;
-		print "\n";
-	} else {
-		print "DROP:\n";
-	}
-}

bin/tests/system/digdelv/tests.sh

@@ -68,7 +68,6 @@ if [ -n "$PYTHON" ] ; then
 fi
 
 if [ -x "$DIG" ] ; then
-
   n=$((n+1))
   echo_i "checking dig short form works ($n)"
   ret=0
@@ -724,7 +723,6 @@ if [ -x "$DIG" ] ; then
   status=$((status+ret))
 
   n=$((n+1))
-
   echo_i "check that dig +short +expandaaaa works ($n)"
   ret=0
   dig_with_opts @10.53.0.3 +short +expandaaaa AAAA ns2.example > dig.out.test$n 2>&1 || ret=1
@@ -746,33 +744,6 @@ if [ -x "$DIG" ] ; then
     if [ $ret -ne 0 ]; then echo_i "failed"; fi
     status=$((status+ret))
   fi
-
-  echo_i "check that dig +unexpected works ($n)"
-  ret=0
-  dig_with_opts @10.53.0.6 +unexpected a a.example > dig.out.test$n || ret=1
-  grep 'reply from unexpected source' dig.out.test$n > /dev/null || ret=1
-  grep 'status: NOERROR' dig.out.test$n > /dev/null || ret=1
-  if [ $ret -ne 0 ]; then echo_i "failed"; fi
-  status=$((status+ret))
-
-  n=$((n+1))
-  echo_i "check that dig +nounexpected works ($n)"
-  ret=0
-  dig_with_opts @10.53.0.6 +nounexpected +tries=1 +time=2 a a.example > dig.out.test$n && ret=1
-  grep 'reply from unexpected source' dig.out.test$n > /dev/null || ret=1
-  grep "status: NOERROR" < dig.out.test$n > /dev/null && ret=1
-  if [ $ret -ne 0 ]; then echo_i "failed"; fi
-  status=$((status+ret))
-
-  n=$((n+1))
-  echo_i "check that dig default for +[no]unexpected (+nounexpected) works ($n)"
-  ret=0
-  dig_with_opts @10.53.0.6 +tries=1 +time=2 a a.example > dig.out.test$n && ret=1
-  grep 'reply from unexpected source' dig.out.test$n > /dev/null || ret=1
-  grep "status: NOERROR" < dig.out.test$n > /dev/null && ret=1
-  if [ $ret -ne 0 ]; then echo_i "failed"; fi
-  status=$((status+ret))
-
 else
   echo_i "$DIG is needed, so skipping these dig tests"
 fi

bin/tests/system/dyndb/driver/syncptr.c

@@ -213,6 +213,10 @@ syncptr(sample_instance_t *inst, dns_name_t *name,
 						      SYNCPTR_WRITE_EVENT,
 						      syncptr_write, NULL,
 						      sizeof(syncptrevent_t));
+	if (pevent == NULL) {
+		result = ISC_R_NOMEMORY;
+		goto cleanup;
+	}
 	isc_buffer_init(&pevent->b, pevent->buf, sizeof(pevent->buf));
 	dns_fixedname_init(&pevent->ptr_target_name);
 

bin/tests/system/keymgr/tests.sh

@@ -134,7 +134,7 @@ n=`expr $n + 1`
 echo_i "checking policy.conf parser ($n)"
 ret=0
 ${PYTHON} testpolicy.py policy.sample > policy.out
-$DOS2UNIX policy.out > /dev/null 2>&1
+$DOS2UNIX policy.out > /dev/null
 cmp -s policy.good policy.out || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`

bin/tests/system/resolver/tests.sh

@@ -795,12 +795,5 @@ grep "status: SERVFAIL" dig.ns5.out.${n} > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
 
-n=`expr $n + 1`
-echo_i "check logged command line ($n)"
-ret=0
-grep "running as: .* -m record,size,mctx " ns1/named.run > /dev/null || ret=1
-if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
-
 echo_i "exit status: $status"
 [ $status -eq 0 ] || exit 1

bin/tests/system/rpz/clean.sh

@@ -29,9 +29,9 @@ fi
 # remove those files first, then decide whether to remove the others.
 rm -f ns*/*.key ns*/*.private
 rm -f ns2/tld2s.db ns2/bl.tld2.db
-rm -f ns3/bl*.db ns3/fast-expire.db ns*/empty.db
+rm -f ns3/bl*.db ns*/empty.db
 rm -f ns3/manual-update-rpz.db
-rm -f ns5/example.db ns5/bl.db ns5/fast-expire.db ns5/expire.conf
+rm -f ns5/example.db ns5/bl.db
 rm -f ns8/manual-update-rpz.db
 rm -f */policy2.db
 rm -f */*.jnl

bin/tests/system/rpz/ns3/named.conf.in

@@ -28,11 +28,8 @@ options {
 	minimal-responses no;
 	recursion yes;
 	dnssec-validation yes;
-	min-refresh-time 1;
-	min-retry-time 1;
 
 	response-policy {
-	    zone "fast-expire";
 	    zone "bl"					max-policy-ttl 100;
 	    zone "bl-2";
 	    zone "bl-given"	policy given		recursive-only yes;
@@ -113,10 +110,3 @@ zone "manual-update-rpz." {
 	file "manual-update-rpz.db";
 	notify no;
 };
-
-zone "fast-expire." {
-	type secondary;
-	file "fast-expire.db";
-	masters { 10.53.0.5; };
-	notify no;
-};

bin/tests/system/rpz/ns5/expire.conf.in

@@ -1,17 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-zone "fast-expire." {
-	type master;
-	file "fast-expire.db";
-	allow-transfer { any; };
-	notify no;
-};

bin/tests/system/rpz/ns5/fast-expire.db.in

@@ -1,16 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 300
-@					SOA	fast-expire. hostmaster (
-						1 3 1 5 60
-						)
-					NS	ns.tld3.
-
-expired.fast-expire.		        A	10.0.0.10

bin/tests/system/rpz/ns5/named.conf.in

@@ -86,5 +86,3 @@ zone "policy2" {
 	allow-update { any; };
 	allow-transfer { any; };
 };
-
-include "expire.conf";

bin/tests/system/rpz/setup.sh

@@ -74,10 +74,6 @@ done
 cp ns3/manual-update-rpz.db.in ns3/manual-update-rpz.db
 cp ns8/manual-update-rpz.db.in ns8/manual-update-rpz.db
 
-# a zone that expires quickly and then can't be refreshed
-cp ns5/fast-expire.db.in ns5/fast-expire.db
-cp ns5/expire.conf.in ns5/expire.conf
-
 # $1=directory
 # $2=domain name
 # $3=input zone file

bin/tests/system/rpz/tests.sh

@@ -759,11 +759,6 @@ EOF
     done
   fi
 
-  # reconfigure the ns5 master server without the fast-exire zone, so
-  # it can't be refreshed on ns3, and will expire in 5 seconds.
-  cat /dev/null > ns5/expire.conf
-  rndc_reconfig ns5 10.53.0.5
-
   # restart the main test RPZ server to see if that creates a core file
   if test -z "$HAVE_CORE"; then
     $PERL $SYSTEMTESTTOP/stop.pl --use-rndc --port ${CONTROLPORT} rpz ns3
@@ -859,12 +854,6 @@ EOF
     echo_i "checking rpz with delegation fails correctly (${t})"
     $DIG -p ${PORT} @$ns3 ns example.com > dig.out.$t
     grep "status: SERVFAIL" dig.out.$t > /dev/null || setret "failed"
-
-    t=`expr $t + 1`
-    echo_i "checking policies from expired zone are no longer in effect ($t)"
-    $DIG -p ${PORT} @$ns3 a expired > dig.out.$t
-    grep "expired.*10.0.0.10" dig.out.$t > /dev/null && setret "failed"
-    grep "fast-expire/IN: response-policy zone expired" ns3/named.run > /dev/null || setret "failed"
   fi
 
   # RPZ 'CNAME *.' (NODATA) trumps DNS64.  Test against various DNS64 senarios.

bin/tests/system/xfer/tests.sh

@@ -410,7 +410,7 @@ echo_i "test smaller transfer TCP message size ($n)"
 $DIG $DIGOPTS example. @10.53.0.8 axfr \
 	-y key1.:1234abcd8765 > dig.out.msgsize || status=1
 
-$DOS2UNIX dig.out.msgsize >/dev/null 2>&1
+$DOS2UNIX dig.out.msgsize >/dev/null
 
 bytes=`wc -c < dig.out.msgsize`
 if [ $bytes -ne 459357 ]; then

bin/tools/mdig.1

@@ -233,11 +233,6 @@ Use [do not use] TCP when querying name servers\&. This alternate syntax to
 \fI+[no]tcp\fR
 is provided for backwards compatibility\&. The "vc" stands for "virtual circuit"\&.
 .RE
-.PP
-\fB+[no]yaml\fR
-.RS 4
-Print the responses in a detailed YAML format\&.
-.RE
 .SH "LOCAL OPTIONS"
 .PP
 The

bin/tools/mdig.c

@@ -364,7 +364,6 @@ recvresponse(isc_task_t *task, isc_event_t *event) {
 
 		printf("    %s:\n", "response_message_data");
 		result = dns_message_headertotext(response, style, flags, buf);
-		CHECK("dns_message_headertotext", result);
 	} else if (display_comments && !display_short_form) {
 		printf(";; Got answer:\n");
 

bin/tools/mdig.html

@@ -333,12 +333,6 @@
               stands for "virtual circuit".
             </p>
           </dd>
-<dt><span class="term"><code class="option">+[no]yaml</code></span></dt>
-<dd>
-	    <p>
-	      Print the responses in a detailed YAML format.
-	    </p>
-	  </dd>
 </dl></div>
 <p>
 

cocci/isc_event_allocat_never_fail.spatch

@@ -1,33 +0,0 @@
-@@
-statement S;
-expression V;
-@@
-
-V = isc_event_allocate(...);
-- if (V == NULL) S
-
-@@
-type T;
-statement S;
-expression V;
-@@
-
-V = (T *)isc_event_allocate(...);
-- if (V == NULL) S
-
-@@
-statement S;
-expression V;
-@@
-
-if (V == NULL) V = isc_event_allocate(...);
-- if (V == NULL) S
-
-@@
-statement S1, S2;
-expression V;
-@@
-
-V = isc_event_allocate(...);
-- if (V == NULL) S1 else { S2 }
-+ S2

config.h.in

@@ -279,9 +279,6 @@
 /* define if OpenSSL supports Ed448 */
 #undef HAVE_OPENSSL_ED448
 
-/* define if OpenSSL supports SipHash */
-#undef HAVE_OPENSSL_SIPHASH
-
 /* Define to 1 if you have the `processor_bind' function. */
 #undef HAVE_PROCESSOR_BIND
 

configure

@@ -16596,36 +16596,6 @@ $as_echo "no" >&6; }
 fi
 rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
 
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for SipHash support" >&5
-$as_echo_n "checking for SipHash support... " >&6; }
-cat confdefs.h - <<_ACEOF >conftest.$ac_ext
-/* end confdefs.h.  */
-#include <openssl/evp.h>
-		       #include <openssl/opensslv.h>
-int
-main ()
-{
-#if OPENSSL_VERSION_NUMBER < 0x10101010L
-		       #error OpenSSL >= 1.1.1a required for working SipHash initialization
-		       #endif
-		       EVP_PKEY *key = EVP_PKEY_new_raw_private_key(
-			   EVP_PKEY_SIPHASH, NULL, NULL, 0);
-  ;
-  return 0;
-}
-_ACEOF
-if ac_fn_c_try_compile "$LINENO"; then :
-
-$as_echo "#define HAVE_OPENSSL_SIPHASH 1" >>confdefs.h
-
-     { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
-$as_echo "yes" >&6; }
-else
-  { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
-fi
-rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
-
 #
 # Check for OpenSSL SHA-1 support
 #

configure.ac

@@ -776,19 +776,6 @@ AC_COMPILE_IFELSE(
      AC_MSG_RESULT([yes])],
     [AC_MSG_RESULT([no])])
 
-AC_MSG_CHECKING([for SipHash support])
-AC_COMPILE_IFELSE(
-    [AC_LANG_PROGRAM([[#include <openssl/evp.h>
-		       #include <openssl/opensslv.h>]],
-		     [[#if OPENSSL_VERSION_NUMBER < 0x10101010L
-		       #error OpenSSL >= 1.1.1a required for working SipHash initialization
-		       #endif
-		       EVP_PKEY *key = EVP_PKEY_new_raw_private_key(
-			   EVP_PKEY_SIPHASH, NULL, NULL, 0);]])],
-    [AC_DEFINE([HAVE_OPENSSL_SIPHASH], [1], [define if OpenSSL supports SipHash])
-     AC_MSG_RESULT([yes])],
-    [AC_MSG_RESULT([no])])
-
 #
 # Check for OpenSSL SHA-1 support
 #

contrib/dlz/modules/mysqldyn/dlz_mysqldyn_mod.c

@@ -1297,21 +1297,9 @@ dlz_newversion(const char *zone, void *dbdata, void **versionp) {
 	 * Create new transaction
 	 */
 	newtx = (mysql_transaction_t *)
-		calloc(1, sizeof(mysql_transaction_t));
-	if (newtx == NULL) {
-		result = ISC_R_NOMEMORY;
-		goto cleanup;
-	}
+		malloc(sizeof(mysql_transaction_t));
 	newtx->zone = strdup(zone);
-	if (newtx->zone == NULL) {
-		result = ISC_R_NOMEMORY;
-		goto cleanup;
-	}
 	newtx->zone_id = strdup(zone_id);
-	if (newtx->zone_id == NULL) {
-		result = ISC_R_NOMEMORY;
-		goto cleanup;
-	}
 	newtx->dbi = get_dbi(state);
 	newtx->next = NULL;
 
@@ -1341,15 +1329,9 @@ dlz_newversion(const char *zone, void *dbdata, void **versionp) {
 		*versionp = (void *) newtx;
 	} else {
 		dlz_mutex_unlock(&state->tx_mutex);
-		if (newtx != NULL) {
-			if (newtx->zone != NULL) {
-				free(newtx->zone);
-			}
-			if (newtx->zone != NULL) {
-				free(newtx->zone_id);
-			}
-			free(newtx);
-		}
+		free(newtx->zone);
+		free(newtx->zone_id);
+		free(newtx);
 	}
 
 	return (result);

doc/arm/Bv9ARM-book.xml

@@ -8963,7 +8963,18 @@ avoid-v6-udp-ports { 40000; range 50000 60000; };
 		  this has the greatest chance of success on the first try.
 		</para>
 		<para>
-		  If the initial query is successful with
+		  If the initial response times out, <command>named</command>
+		  will try again with plain DNS, and if that is successful,
+		  it will be taken as evidence that the server does not
+		  support EDNS. After enough failures using EDNS and
+		  successes using plain DNS, <command>named</command>
+		  will default to plain DNS for future communications
+		  with that server.  (Periodically, <command>named</command>
+		  will send an EDNS query to see if the situation has
+		  improved.)
+		</para>
+		<para>
+		  However, if the initial query is successful with
 		  EDNS advertising a buffer size of 512, then
 		  <command>named</command> will advertise progressively
 		  larger buffer sizes on successive queries, until

doc/arm/Bv9ARM.ch01.html

@@ -614,6 +614,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.4 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.3 (Development Release)</p>
 </body>
 </html>

doc/arm/Bv9ARM.ch02.html

@@ -146,6 +146,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.4 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.3 (Development Release)</p>
 </body>
 </html>

doc/arm/Bv9ARM.ch03.html

@@ -856,6 +856,6 @@ controls {
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.4 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.3 (Development Release)</p>
 </body>
 </html>

doc/arm/Bv9ARM.ch04.html

@@ -2840,6 +2840,6 @@ $ORIGIN 0.0.0.0.0.0.0.0.8.b.d.0.1.0.0.2.ip6.arpa.
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.4 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.3 (Development Release)</p>
 </body>
 </html>

doc/arm/Bv9ARM.ch05.html

@@ -6968,7 +6968,18 @@ avoid-v6-udp-ports { 40000; range 50000 60000; };
                   this has the greatest chance of success on the first try.
                 </p>
                 <p>
-                  If the initial query is successful with
+                  If the initial response times out, <span class="command"><strong>named</strong></span>
+                  will try again with plain DNS, and if that is successful,
+                  it will be taken as evidence that the server does not
+                  support EDNS. After enough failures using EDNS and
+                  successes using plain DNS, <span class="command"><strong>named</strong></span>
+                  will default to plain DNS for future communications
+                  with that server.  (Periodically, <span class="command"><strong>named</strong></span>
+                  will send an EDNS query to see if the situation has
+                  improved.)
+                </p>
+                <p>
+                  However, if the initial query is successful with
                   EDNS advertising a buffer size of 512, then
                   <span class="command"><strong>named</strong></span> will advertise progressively
                   larger buffer sizes on successive queries, until
@@ -8247,6 +8258,22 @@ example.com                 CNAME   rpz-tcp-only.
             but are counted to compute the query per second rate.
           </p>
 
+          <p>
+            Rate limiters for different name spaces maintain
+            separate counters: If, for example, there is a
+            <span class="command"><strong>rate-limit</strong></span> statement for "com" and
+            another for "example.com", queries matching "example.com"
+            will not be debited against the rate limiter for "com".
+          </p>
+
+          <p>
+            If a <span class="command"><strong>rate-limit</strong></span> statement does not specify a
+            <span class="command"><strong>domain</strong></span>, then it applies to the root domain
+            (".") and thus affects the entire DNS namespace, except those
+            portions covered by other <span class="command"><strong>rate-limit</strong></span>
+            statements.
+          </p>
+
           <p>
             Communities of DNS clients can be given their own parameters or no
             rate limiting by putting
@@ -14897,6 +14924,6 @@ HOST-127.EXAMPLE. MX 0 .
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.4 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.3 (Development Release)</p>
 </body>
 </html>

doc/arm/Bv9ARM.ch06.html

@@ -360,6 +360,6 @@ allow-query { !{ !10/8; any; }; key example; };
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.4 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.3 (Development Release)</p>
 </body>
 </html>

doc/arm/Bv9ARM.ch07.html

@@ -191,6 +191,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.4 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.3 (Development Release)</p>
 </body>
 </html>

doc/arm/Bv9ARM.ch08.html

@@ -36,7 +36,7 @@
 <div class="toc">
 <p><b>Table of Contents</b></p>
 <dl class="toc">
-<dt><span class="section"><a href="Bv9ARM.ch08.html#id-1.9.2">Release Notes for BIND Version 9.15.4</a></span></dt>
+<dt><span class="section"><a href="Bv9ARM.ch08.html#id-1.9.2">Release Notes for BIND Version 9.15.3</a></span></dt>
 <dd><dl>
 <dt><span class="section"><a href="Bv9ARM.ch08.html#relnotes_intro">Introduction</a></span></dt>
 <dt><span class="section"><a href="Bv9ARM.ch08.html#relnotes_versions">Note on Version Numbering</a></span></dt>
@@ -55,7 +55,7 @@
 </div>
       <div class="section">
 <div class="titlepage"><div><div><h2 class="title" style="clear: both">
-<a name="id-1.9.2"></a>Release Notes for BIND Version 9.15.4</h2></div></div></div>
+<a name="id-1.9.2"></a>Release Notes for BIND Version 9.15.3</h2></div></div></div>
   
   <div class="section">
 <div class="titlepage"><div><div><h3 class="title">
@@ -163,15 +163,6 @@
 <div class="titlepage"><div><div><h3 class="title">
 <a name="relnotes_features"></a>New Features</h3></div></div></div>
     <div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; ">
-<li class="listitem">
-	<p>
-          Added a new command line option to <span class="command"><strong>dig</strong></span>:
-	  <span style="color: red">&lt;comand&gt;+[no]unexpected&lt;/comand&gt;</span>. By default, <span class="command"><strong>dig</strong></span>
-	  won't accept a reply from a source other than the one to which
-	  it sent the query.  Add the <span class="command"><strong>+unexpected</strong></span> argument
-	  to enable it to process replies from unexpected sources.
-        </p>
-      </li>
 <li class="listitem">
 	<p>
 	  The GeoIP2 API from MaxMind is now supported. Geolocation support
@@ -245,16 +236,9 @@
       </li>
 <li class="listitem">
 	<p>
-	  Statistics channel groups are now toggleable. [GL #1030]
+	Statistics channel groups are now toggleable. [GL #1030]
 	</p>
       </li>
-<li class="listitem">
-	<p>
-	  <span class="command"><strong>dig</strong></span>, <span class="command"><strong>mdig</strong></span> and
-	  <span class="command"><strong>delv</strong></span> can all now take a <span class="command"><strong>+yaml</strong></span>
-	  option to print output in a a detailed YAML format. [RT #1145]
-        </p>
-      </li>
 </ul></div>
   </div>
 
@@ -344,7 +328,7 @@
 	  A SipHash 2-4 based DNS Cookie (RFC 7873) algorithm has been added and
 	  made default.  Old non-default HMAC-SHA based DNS Cookie algorithms
 	  have been removed, and only the default AES algorithm is being kept
-	  for legacy reasons.  This change doesn't have any operational impact
+	  for legacy reasons.  This changes doesn't have any operational impact
 	  in most common scenarios. [GL #605]
 	</p>
 	<p>
@@ -442,8 +426,8 @@
       </li>
 <li class="listitem">
 	<p>
-	  <span class="command"><strong>named-checkconf</strong></span> now correctly reports
-	  a missing <span class="command"><strong>dnstap-output</strong></span> option when
+	  <span class="command"><strong>named-checkconf</strong></span> now correctly reports missing
+	  <span class="command"><strong>dnstap-output</strong></span> option when
 	  <span class="command"><strong>dnstap</strong></span> is set. [GL #1136]
 	</p>
       </li>
@@ -459,13 +443,6 @@
 	  when run with <span class="command"><strong>+expandaaaa +short</strong></span>. [GL #1152]
 	</p>
       </li>
-<li class="listitem">
-	<p>
-	  When a <span class="command"><strong>response-policy</strong></span> zone expires, ensure
-	  that its policies are removed from the RPZ summary database.
-	  [GL #1146]
-	</p>
-      </li>
 </ul></div>
   </div>
 
@@ -541,6 +518,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.4 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.3 (Development Release)</p>
 </body>
 </html>

doc/arm/Bv9ARM.ch09.html

@@ -148,6 +148,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.4 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.3 (Development Release)</p>
 </body>
 </html>

doc/arm/Bv9ARM.ch10.html

@@ -914,6 +914,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.4 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.3 (Development Release)</p>
 </body>
 </html>

doc/arm/Bv9ARM.ch11.html

@@ -537,6 +537,6 @@ $ <strong class="userinput"><code>sample-update -a sample-update -k Kxxx.+nnn+mm
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.4 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.3 (Development Release)</p>
 </body>
 </html>

doc/arm/Bv9ARM.ch12.html

@@ -210,6 +210,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.4 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.3 (Development Release)</p>
 </body>
 </html>

doc/arm/Bv9ARM.html

@@ -32,7 +32,7 @@
 <div>
 <div><h1 class="title">
 <a name="id-1"></a>BIND 9 Administrator Reference Manual</h1></div>
-<div><p class="releaseinfo">BIND Version 9.15.4</p></div>
+<div><p class="releaseinfo">BIND Version 9.15.3</p></div>
 <div><p class="copyright">Copyright © 2000-2019 Internet Systems Consortium, Inc. ("ISC")</p></div>
 </div>
 <hr>
@@ -245,7 +245,7 @@
 </dl></dd>
 <dt><span class="appendix"><a href="Bv9ARM.ch08.html">A. Release Notes</a></span></dt>
 <dd><dl>
-<dt><span class="section"><a href="Bv9ARM.ch08.html#id-1.9.2">Release Notes for BIND Version 9.15.4</a></span></dt>
+<dt><span class="section"><a href="Bv9ARM.ch08.html#id-1.9.2">Release Notes for BIND Version 9.15.3</a></span></dt>
 <dd><dl>
 <dt><span class="section"><a href="Bv9ARM.ch08.html#relnotes_intro">Introduction</a></span></dt>
 <dt><span class="section"><a href="Bv9ARM.ch08.html#relnotes_versions">Note on Version Numbering</a></span></dt>
@@ -443,6 +443,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.4 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.3 (Development Release)</p>
 </body>
 </html>

doc/arm/man.arpaname.html

@@ -90,6 +90,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.4 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.3 (Development Release)</p>
 </body>
 </html>

doc/arm/man.ddns-confgen.html

@@ -220,6 +220,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.4 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.3 (Development Release)</p>
 </body>
 </html>

doc/arm/man.delv.html

@@ -566,12 +566,6 @@
 	      in the type's presentation format.
 	    </p>
 	  </dd>
-<dt><span class="term"><code class="option">+[no]yaml</code></span></dt>
-<dd>
-	    <p>
-	      Print response data in YAML format.
-	    </p>
-	  </dd>
 </dl></div>
 <p>
 
@@ -621,6 +615,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.4 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.3 (Development Release)</p>
 </body>
 </html>

doc/arm/man.dig.html

@@ -1018,14 +1018,6 @@
 	      seconds, minutes, hours, days and weeks.  Implies +ttlid.
 	    </p>
 	  </dd>
-<dt><span class="term"><code class="option">+[no]unexpected</code></span></dt>
-<dd>
-	    <p>
-	      Accept [do not accept] answers from unexpected sources.  By
-	      default, <span class="command"><strong>dig</strong></span> won't accept a reply from a
-	      source other than the one to which it sent the query.
-	    </p>
-	  </dd>
 <dt><span class="term"><code class="option">+[no]unknownformat</code></span></dt>
 <dd>
 	    <p>
@@ -1043,13 +1035,6 @@
 	      stands for "virtual circuit".
 	    </p>
 	  </dd>
-<dt><span class="term"><code class="option">+[no]yaml</code></span></dt>
-<dd>
-	    <p>
-	      Print the responses (and, if <code class="option">+qr</code> is in use,
-	      also the outgoing queries) in a detailed YAML format.
-	    </p>
-	  </dd>
 <dt><span class="term"><code class="option">+[no]zflag</code></span></dt>
 <dd>
 	    <p>
@@ -1188,6 +1173,6 @@ dig +qr www.isc.org any -x 127.0.0.1 isc.org ns +noqr
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.4 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.3 (Development Release)</p>
 </body>
 </html>

doc/arm/man.dnssec-cds.html

@@ -376,6 +376,6 @@ nsupdate -l
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.4 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.3 (Development Release)</p>
 </body>
 </html>

doc/arm/man.dnssec-checkds.html

@@ -156,6 +156,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.4 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.3 (Development Release)</p>
 </body>
 </html>

doc/arm/man.dnssec-coverage.html

@@ -270,6 +270,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.4 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.3 (Development Release)</p>
 </body>
 </html>

doc/arm/man.dnssec-dsfromkey.html

@@ -341,6 +341,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.4 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.3 (Development Release)</p>
 </body>
 </html>

doc/arm/man.dnssec-importkey.html

@@ -250,6 +250,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.4 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.3 (Development Release)</p>
 </body>
 </html>

doc/arm/man.dnssec-keyfromlabel.html

@@ -498,6 +498,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.4 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.3 (Development Release)</p>
 </body>
 </html>

doc/arm/man.dnssec-keygen.html

@@ -555,6 +555,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.4 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.3 (Development Release)</p>
 </body>
 </html>

doc/arm/man.dnssec-keymgr.html

@@ -405,6 +405,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.4 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.3 (Development Release)</p>
 </body>
 </html>

doc/arm/man.dnssec-revoke.html

@@ -171,6 +171,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.4 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.3 (Development Release)</p>
 </body>
 </html>

doc/arm/man.dnssec-settime.html

@@ -349,6 +349,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.4 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.3 (Development Release)</p>
 </body>
 </html>

doc/arm/man.dnssec-signzone.html

@@ -707,6 +707,6 @@ db.example.com.signed
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.4 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.3 (Development Release)</p>
 </body>
 </html>

doc/arm/man.dnssec-verify.html

@@ -214,6 +214,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.4 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.3 (Development Release)</p>
 </body>
 </html>

doc/arm/man.dnstap-read.html

@@ -143,6 +143,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.4 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.3 (Development Release)</p>
 </body>
 </html>

doc/arm/man.filter-aaaa.html

@@ -168,6 +168,6 @@ plugin query "/usr/local/lib/filter-aaaa.so" {
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.4 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.3 (Development Release)</p>
 </body>
 </html>

doc/arm/man.host.html

@@ -366,6 +366,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.4 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.3 (Development Release)</p>
 </body>
 </html>

doc/arm/man.mdig.html

@@ -351,12 +351,6 @@
               stands for "virtual circuit".
             </p>
           </dd>
-<dt><span class="term"><code class="option">+[no]yaml</code></span></dt>
-<dd>
-	    <p>
-	      Print the responses in a detailed YAML format.
-	    </p>
-	  </dd>
 </dl></div>
 <p>
 
@@ -610,6 +604,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.4 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.3 (Development Release)</p>
 </body>
 </html>

doc/arm/man.named-checkconf.html

@@ -214,6 +214,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.4 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.3 (Development Release)</p>
 </body>
 </html>

doc/arm/man.named-checkzone.html

@@ -463,6 +463,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.4 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.3 (Development Release)</p>
 </body>
 </html>

doc/arm/man.named-journalprint.html

@@ -117,6 +117,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.4 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.3 (Development Release)</p>
 </body>
 </html>

doc/arm/man.named-nzd2nzf.html

@@ -119,6 +119,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.4 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.3 (Development Release)</p>
 </body>
 </html>

doc/arm/man.named-rrchecker.html

@@ -121,6 +121,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.4 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.3 (Development Release)</p>
 </body>
 </html>

doc/arm/man.named.conf.html

@@ -1069,6 +1069,6 @@ zone
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.4 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.3 (Development Release)</p>
 </body>
 </html>

doc/arm/man.named.html

@@ -492,6 +492,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.4 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.3 (Development Release)</p>
 </body>
 </html>

doc/arm/man.nsec3hash.html

@@ -155,6 +155,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.4 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.3 (Development Release)</p>
 </body>
 </html>

doc/arm/man.nslookup.html

@@ -437,6 +437,6 @@ nslookup -query=hinfo  -timeout=10
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.4 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.3 (Development Release)</p>
 </body>
 </html>

doc/arm/man.nsupdate.html

@@ -818,6 +818,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.4 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.3 (Development Release)</p>
 </body>
 </html>

doc/arm/man.pkcs11-destroy.html

@@ -162,6 +162,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.4 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.3 (Development Release)</p>
 </body>
 </html>

doc/arm/man.pkcs11-keygen.html

@@ -200,6 +200,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.4 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.3 (Development Release)</p>
 </body>
 </html>

doc/arm/man.pkcs11-list.html

@@ -158,6 +158,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.4 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.3 (Development Release)</p>
 </body>
 </html>

doc/arm/man.pkcs11-tokens.html

@@ -123,6 +123,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.4 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.3 (Development Release)</p>
 </body>
 </html>

doc/arm/man.rndc-confgen.html

@@ -260,6 +260,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.4 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.3 (Development Release)</p>
 </body>
 </html>

doc/arm/man.rndc.conf.html

@@ -268,6 +268,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.4 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.3 (Development Release)</p>
 </body>
 </html>

doc/arm/man.rndc.html

@@ -1017,6 +1017,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.4 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.3 (Development Release)</p>
 </body>
 </html>

doc/arm/notes.html

@@ -15,7 +15,7 @@
 
   <div class="section">
 <div class="titlepage"><div><div><h2 class="title" style="clear: both">
-<a name="id-1.2"></a>Release Notes for BIND Version 9.15.4</h2></div></div></div>
+<a name="id-1.2"></a>Release Notes for BIND Version 9.15.3</h2></div></div></div>
   
   <div class="section">
 <div class="titlepage"><div><div><h3 class="title">
@@ -123,15 +123,6 @@
 <div class="titlepage"><div><div><h3 class="title">
 <a name="relnotes_features"></a>New Features</h3></div></div></div>
     <div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; ">
-<li class="listitem">
-	<p>
-          Added a new command line option to <span class="command"><strong>dig</strong></span>:
-	  <span style="color: red">&lt;comand&gt;+[no]unexpected&lt;/comand&gt;</span>. By default, <span class="command"><strong>dig</strong></span>
-	  won't accept a reply from a source other than the one to which
-	  it sent the query.  Add the <span class="command"><strong>+unexpected</strong></span> argument
-	  to enable it to process replies from unexpected sources.
-        </p>
-      </li>
 <li class="listitem">
 	<p>
 	  The GeoIP2 API from MaxMind is now supported. Geolocation support
@@ -205,16 +196,9 @@
       </li>
 <li class="listitem">
 	<p>
-	  Statistics channel groups are now toggleable. [GL #1030]
+	Statistics channel groups are now toggleable. [GL #1030]
 	</p>
       </li>
-<li class="listitem">
-	<p>
-	  <span class="command"><strong>dig</strong></span>, <span class="command"><strong>mdig</strong></span> and
-	  <span class="command"><strong>delv</strong></span> can all now take a <span class="command"><strong>+yaml</strong></span>
-	  option to print output in a a detailed YAML format. [RT #1145]
-        </p>
-      </li>
 </ul></div>
   </div>
 
@@ -304,7 +288,7 @@
 	  A SipHash 2-4 based DNS Cookie (RFC 7873) algorithm has been added and
 	  made default.  Old non-default HMAC-SHA based DNS Cookie algorithms
 	  have been removed, and only the default AES algorithm is being kept
-	  for legacy reasons.  This change doesn't have any operational impact
+	  for legacy reasons.  This changes doesn't have any operational impact
 	  in most common scenarios. [GL #605]
 	</p>
 	<p>
@@ -402,8 +386,8 @@
       </li>
 <li class="listitem">
 	<p>
-	  <span class="command"><strong>named-checkconf</strong></span> now correctly reports
-	  a missing <span class="command"><strong>dnstap-output</strong></span> option when
+	  <span class="command"><strong>named-checkconf</strong></span> now correctly reports missing
+	  <span class="command"><strong>dnstap-output</strong></span> option when
 	  <span class="command"><strong>dnstap</strong></span> is set. [GL #1136]
 	</p>
       </li>
@@ -419,13 +403,6 @@
 	  when run with <span class="command"><strong>+expandaaaa +short</strong></span>. [GL #1152]
 	</p>
       </li>
-<li class="listitem">
-	<p>
-	  When a <span class="command"><strong>response-policy</strong></span> zone expires, ensure
-	  that its policies are removed from the RPZ summary database.
-	  [GL #1146]
-	</p>
-      </li>
 </ul></div>
   </div>
 

doc/arm/notes.txt

@@ -1,4 +1,4 @@
-Release Notes for BIND Version 9.15.4
+Release Notes for BIND Version 9.15.3
 
 Introduction
 
@@ -65,11 +65,6 @@ Security Fixes
 
 New Features
 
-  * Added a new command line option to dig: <comand>+[no]unexpected</
-    comand>. By default, dig won't accept a reply from a source other than
-    the one to which it sent the query. Add the +unexpected argument to
-    enable it to process replies from unexpected sources.
-
   * The GeoIP2 API from MaxMind is now supported. Geolocation support will
     be compiled in by default if the libmaxminddb library is found at
     compile time, but can be turned off by using configure --disable-geoip
@@ -114,9 +109,6 @@ New Features
 
   * Statistics channel groups are now toggleable. [GL #1030]
 
-  * dig, mdig and delv can all now take a +yaml option to print output in
-    a a detailed YAML format. [RT #1145]
-
 Removed Features
 
   * The dnssec-enable option has been obsoleted and no longer has any
@@ -161,8 +153,8 @@ Feature Changes
   * A SipHash 2-4 based DNS Cookie (RFC 7873) algorithm has been added and
     made default. Old non-default HMAC-SHA based DNS Cookie algorithms
     have been removed, and only the default AES algorithm is being kept
-    for legacy reasons. This change doesn't have any operational impact in
-    most common scenarios. [GL #605]
+    for legacy reasons. This changes doesn't have any operational impact
+    in most common scenarios. [GL #605]
 
     If you are running multiple DNS Servers (different versions of BIND 9
     or DNS server from multiple vendors) responding from the same IP
@@ -215,7 +207,7 @@ Bug Fixes
   * named-checkconf now checks DNS64 prefixes to ensure bits 64-71 are
     zero. [GL #1159]
 
-  * named-checkconf now correctly reports a missing dnstap-output option
+  * named-checkconf now correctly reports missing dnstap-output option
     when dnstap is set. [GL #1136]
 
   * Handle ETIMEDOUT error on connect() with a non-blocking socket. [GL #
@@ -224,9 +216,6 @@ Bug Fixes
   * dig now correctly expands the IPv6 address when run with +expandaaaa
     +short. [GL #1152]
 
-  * When a response-policy zone expires, ensure that its policies are
-    removed from the RPZ summary database. [GL #1146]
-
 License
 
 BIND is open source software licensed under the terms of the Mozilla

doc/arm/notes.xml

@@ -113,15 +113,6 @@
 
   <section xml:id="relnotes_features"><info><title>New Features</title></info>
     <itemizedlist>
-      <listitem>
-	<para>
-          Added a new command line option to <command>dig</command>:
-	  <comand>+[no]unexpected</comand>. By default, <command>dig</command>
-	  won't accept a reply from a source other than the one to which
-	  it sent the query.  Add the <command>+unexpected</command> argument
-	  to enable it to process replies from unexpected sources.
-        </para>
-      </listitem>
       <listitem>
 	<para>
 	  The GeoIP2 API from MaxMind is now supported. Geolocation support
@@ -403,13 +394,6 @@
 	  when run with <command>+expandaaaa +short</command>. [GL #1152]
 	</para>
       </listitem>
-      <listitem>
-	<para>
-	  When a <command>response-policy</command> zone expires, ensure
-	  that its policies are removed from the RPZ summary database.
-	  [GL #1146]
-	</para>
-      </listitem>
     </itemizedlist>
   </section>
 

lib/dns/api

@@ -10,6 +10,6 @@
 # 9.12: 1200-1299
 # 9.13/9.14: 1300-1499
 # 9.15/9.16: 1500-1699
-LIBINTERFACE = 1503
+LIBINTERFACE = 1502
 LIBREVISION = 0
 LIBAGE = 0

lib/dns/cache.c

@@ -556,12 +556,20 @@ cache_cleaner_init(dns_cache_t *cache, isc_taskmgr_t *taskmgr,
 					   DNS_EVENT_CACHECLEAN,
 					   incremental_cleaning_action,
 					   cleaner, sizeof(isc_event_t));
+		if (cleaner->resched_event == NULL) {
+			result = ISC_R_NOMEMORY;
+			goto cleanup;
+		}
 
 		cleaner->overmem_event =
 			isc_event_allocate(cache->mctx, cleaner,
 					   DNS_EVENT_CACHEOVERMEM,
 					   overmem_cleaning_action,
 					   cleaner, sizeof(isc_event_t));
+		if (cleaner->overmem_event == NULL) {
+			result = ISC_R_NOMEMORY;
+			goto cleanup;
+		}
 	}
 
 	return (ISC_R_SUCCESS);

lib/dns/client.c

@@ -1342,6 +1342,10 @@ dns_client_startresolve(dns_client_t *client, const dns_name_t *name,
 	event = (dns_clientresevent_t *)
 		isc_event_allocate(mctx, tclone, DNS_EVENT_CLIENTRESDONE,
 				   action, arg, sizeof(*event));
+	if (event == NULL) {
+		result = ISC_R_NOMEMORY;
+		goto cleanup;
+	}
 	event->result = DNS_R_SERVFAIL;
 	ISC_LIST_INIT(event->answerlist);
 
@@ -1729,6 +1733,10 @@ dns_client_startrequest(dns_client_t *client, dns_message_t *qmessage,
 		isc_event_allocate(client->mctx, tclone,
 				   DNS_EVENT_CLIENTREQDONE,
 				   action, arg, sizeof(*event));
+	if (event == NULL) {
+		result = ISC_R_NOMEMORY;
+		goto cleanup;
+	}
 
 	ctx = isc_mem_get(client->mctx, sizeof(*ctx));
 	if (ctx == NULL)
@@ -2839,6 +2847,8 @@ dns_client_startupdate(dns_client_t *client, dns_rdataclass_t rdclass,
 	uctx->event = (dns_clientupdateevent_t *)
 		isc_event_allocate(client->mctx, tclone, DNS_EVENT_UPDATEDONE,
 				   action, arg, sizeof(*uctx->event));
+	if (uctx->event == NULL)
+		goto fail;
 	if (zonename != NULL) {
 		uctx->zonename = dns_fixedname_name(&uctx->zonefname);
 		result = dns_name_copy(zonename, uctx->zonename, NULL);
@@ -2914,8 +2924,11 @@ dns_client_startupdate(dns_client_t *client, dns_rdataclass_t rdclass,
 		event = isc_event_allocate(client->mctx, dns_client_startupdate,
 					   DNS_EVENT_STARTUPDATE, startupdate,
 					   uctx, sizeof(*event));
-		result = ISC_R_SUCCESS;
-		isc_task_send(task, &event);
+		if (event != NULL) {
+			result = ISC_R_SUCCESS;
+			isc_task_send(task, &event);
+		} else
+			result = ISC_R_NOMEMORY;
 	}
 	if (result == ISC_R_SUCCESS)
 		return (result);